[PATCH] powerpc: Fix buglet with MMU hash management

Our MMU hash management code would not set the "C" bit (changed bit) in
the hardware PTE when updating a RO PTE into a RW PTE. That would cause
the hardware to possibly to a write back to the hash table to set it on
the first store access, which in addition to being a performance issue,
might also hit a bug when running with native hash management (non-HV)
as our code is specifically optimized for the case where no write back
happens.

Thus there is a very small therocial window were a hash PTE can become
corrupted if that HPTE has just been upgraded to read write, a store
access happens on it, and that races with another processor evicting
that same slot. Since eviction (caused by an almost full hash) is
extremely rare, the bug is very unlikely to happen fortunately.

This fixes by allowing the updating of the protection bits in the native
hash handling to also set (but not clear) the "C" bit, and, in order to
also improve performances in the general case, by always setting that
bit on newly inserted hash PTE so that writeback really never happens.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

2 files changed, 4 insertions, 1 deletions

diff --git a/arch/powerpc/mm/hash_low_64.S b/arch/powerpc/mm/hash_low_64.S
index e0d02c4a2615..106fba391987 100644
--- a/arch/powerpc/mm/hash_low_64.S
+++ b/arch/powerpc/mm/hash_low_64.S
@@ -136,6 +136,7 @@ _GLOBAL(__hash_page_4K)
         and     r0,r0,r4                /* _PAGE_RW & _PAGE_DIRTY ->r0 bit 30*/
         andc    r0,r30,r0               /* r0 = pte & ~r0 */
         rlwimi  r3,r0,32-1,31,31        /* Insert result into PP lsb */
+        ori     r3,r3,HPTE_R_C          /* Always add "C" bit for perf. */
 
         /* We eventually do the icache sync here (maybe inline that
          * code rather than call a C function...) 
@@ -400,6 +401,7 @@ _GLOBAL(__hash_page_4K)
         and     r0,r0,r4                /* _PAGE_RW & _PAGE_DIRTY ->r0 bit 30*/
         andc    r0,r30,r0               /* r0 = pte & ~r0 */
         rlwimi  r3,r0,32-1,31,31        /* Insert result into PP lsb */
+        ori     r3,r3,HPTE_R_C          /* Always add "C" bit for perf. */
 
         /* We eventually do the icache sync here (maybe inline that
          * code rather than call a C function...)
@@ -671,6 +673,7 @@ _GLOBAL(__hash_page_64K)
         and     r0,r0,r4                /* _PAGE_RW & _PAGE_DIRTY ->r0 bit 30*/
         andc    r0,r30,r0               /* r0 = pte & ~r0 */
         rlwimi  r3,r0,32-1,31,31        /* Insert result into PP lsb */
+        ori     r3,r3,HPTE_R_C          /* Always add "C" bit for perf. */
 
         /* We eventually do the icache sync here (maybe inline that
          * code rather than call a C function...)
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index 33654d1b1b43..3b8205033f15 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -238,7 +238,7 @@ static long native_hpte_updatepp(unsigned long slot, unsigned long newpp,
                 DBG_LOW(" -> hit\n");
                 /* Update the HPTE */
                 hptep->r = (hptep->r & ~(HPTE_R_PP | HPTE_R_N)) |
-                        (newpp & (HPTE_R_PP | HPTE_R_N));
+                        (newpp & (HPTE_R_PP | HPTE_R_N | HPTE_R_C));
                 native_unlock_hpte(hptep);
         }