From nobody Wed Jun 17 05:14:11 2026 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 98ED636166A; Wed, 22 Apr 2026 19:15:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776885354; cv=none; b=SBhQ424qQD4e4OGeqLF72auUj9+EnwI62dy94HfKB27B8eAa6q4DzF3zgAkOWaE4ljNS8PqnPmkLx6OYlgdHFw2NZ8hJvxzOv9MLFXM9Crxgr0s3b9nbM8WHxBvPs1GlW/p6i2nh8ID6QEuQsFkeXsCJU7t+CHmAfNZyfz71yy4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776885354; c=relaxed/simple; bh=APfLsQ13p2T272Y8e0CfG833zOxCe0Hi8c+OANBhq3Q=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=O6JiUBl9UWWTApuqDy7TEOY470zg8Vqe7k4rznkwbiKARM26sM36kuXbLpfBJuJaxBZEPH1rcRGIFUnBGAekoC+cA3/nB9JVrrrazj4ubfO+H0xl64O3JsxIF0bXwpLJwsB0e5A1Q/VP73XONfPcu9dC/ghFzWtTRKS0ZU26yaI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=T9TOX3Ni; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=n0OEUne3; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="T9TOX3Ni"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="n0OEUne3" Date: Wed, 22 Apr 2026 19:15:41 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1776885343; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Rl8g0JGtmO/0QE4cDF18W9Ebue70fSm6sgiJkVUpb1Q=; b=T9TOX3NimKVnrOIhfSent9gbvCbzagQsANA9e8sWSF+N+K0gKB6DabrgxLYpbx2chkiiJ4 5Vg+Xkw+6FArIz36/6++RfzYIX56/UF/gtHLMflICKSzFpJlTMTevX4N9w2yZLgUlML+Hi i+oNf9GRfCsEdiVAI47ySnIqX2X9+MHp5k2g8ueKs0RYbcnduFgQzuZ6NTVzJOpzzG8jx9 IHgWUl4D+8hBjczrkoCWHKmZa/LeiX4OY1MRWV6XLUxzPMNQtXF18XwbAtEqPPX57yl9/r TilIfm2oxQFcm/ua2QMxiutvGPJpVvp7XzdTBv0xD8eiU5d0rePc5jY397cIPw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1776885343; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Rl8g0JGtmO/0QE4cDF18W9Ebue70fSm6sgiJkVUpb1Q=; b=n0OEUne3lbFWlxTUP5fqhWQyicXhXAG47npThrDHuCL57iYakozzF4JVTVO3Gg6kCtZw5f JhnH8XETIjJkoSCw== From: "tip-bot2 for Dave Hansen" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/urgent] x86/mm: Revert INVLPGB optimization for set_memory code Cc: "Cui, Ling" , Dave Hansen , Rick Edgecombe , thomas.hellstrom@linux.intel.com, x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20260421151909.6B3281C6@davehans-spike.ostc.intel.com> References: <20260421151909.6B3281C6@davehans-spike.ostc.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <177688534156.2419917.12325486963253678873.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the x86/urgent branch of tip: Commit-ID: 8e3705911af255ac12af7bc73140e885b61c4666 Gitweb: https://git.kernel.org/tip/8e3705911af255ac12af7bc73140e885b= 61c4666 Author: Dave Hansen AuthorDate: Tue, 21 Apr 2026 08:19:09 -07:00 Committer: Dave Hansen CommitterDate: Wed, 22 Apr 2026 12:11:55 -07:00 x86/mm: Revert INVLPGB optimization for set_memory code tl;dr: Revert an INVLPGB optimization that did not properly handle discontiguous virtual addresses. Full story: I got a report from some graphics (i915) folks that bisected a regression in their test suite to 86e6815b316e ("x86/mm: Change cpa_flush() to call flush_kernel_range() directly"). There was a bit of flip-flopping on the exact bisect, but the code here does seem wrong to me. The i915 folks were calling set_pages_array_wc(), so using the CPA_PAGES_ARRAY mode. Basically, the 'struct cpa_data' can wrap up all kinds of page table changes. Some of these are virtually contiguous, but some are very much not which is one reason why there are ->vaddr and ->pages arrays. 86e6815b316e made the mistake of assuming that the virtual addresses in the cpa_data are always contiguous. It got things right when neither CPA_ARRAY/CPA_PAGES_ARRAY is used, but theoretically wrong when either of those is used. In the i915 case, it probably failed to flush some WB TLB entries and install WC ones, leaving some data in the caches and not flushing it out to where the device could see it. That eventually caused graphics problems. Revert the INVLPGB optimization. It can be reintroduced later, but it will need to be a bit careful about the array modes. Fixes: 86e6815b316ec ("x86/mm: Change cpa_flush() to call flush_kernel_rang= e() Reported-by: Cui, Ling Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Reviewed-by: Thomas Hellstr=C3=B6m Link: https://patch.msgid.link/20260421151909.6B3281C6@davehans-spike.ostc.= intel.com --- arch/x86/mm/pat/set_memory.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c index cba907c..d023a40 100644 --- a/arch/x86/mm/pat/set_memory.c +++ b/arch/x86/mm/pat/set_memory.c @@ -399,6 +399,15 @@ static void cpa_flush_all(unsigned long cache) on_each_cpu(__cpa_flush_all, (void *) cache, 1); } =20 +static void __cpa_flush_tlb(void *data) +{ + struct cpa_data *cpa =3D data; + unsigned int i; + + for (i =3D 0; i < cpa->numpages; i++) + flush_tlb_one_kernel(fix_addr(__cpa_addr(cpa, i))); +} + static int collapse_large_pages(unsigned long addr, struct list_head *pgta= bles); =20 static void cpa_collapse_large_pages(struct cpa_data *cpa) @@ -435,7 +444,6 @@ static void cpa_collapse_large_pages(struct cpa_data *c= pa) =20 static void cpa_flush(struct cpa_data *cpa, int cache) { - unsigned long start, end; unsigned int i; =20 BUG_ON(irqs_disabled() && !early_boot_irqs_disabled); @@ -445,12 +453,10 @@ static void cpa_flush(struct cpa_data *cpa, int cache) goto collapse_large_pages; } =20 - start =3D fix_addr(__cpa_addr(cpa, 0)); - end =3D start + cpa->numpages * PAGE_SIZE; - if (cpa->force_flush_all) - end =3D TLB_FLUSH_ALL; - - flush_tlb_kernel_range(start, end); + if (cpa->force_flush_all || cpa->numpages > tlb_single_page_flush_ceiling) + flush_tlb_all(); + else + on_each_cpu(__cpa_flush_tlb, cpa, 1); =20 if (!cache) goto collapse_large_pages;