From patchwork Mon Dec 4 17:26:44 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Houghton X-Patchwork-Id: 13478801 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9425C10DC1 for ; Mon, 4 Dec 2023 17:27:04 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6A66C6B02A1; Mon, 4 Dec 2023 12:27:04 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 656866B02AF; Mon, 4 Dec 2023 12:27:04 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 551B56B02A1; Mon, 4 Dec 2023 12:27:04 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 43BC46B02A1 for ; Mon, 4 Dec 2023 12:27:04 -0500 (EST) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 0652AC0308 for ; Mon, 4 Dec 2023 17:27:04 +0000 (UTC) X-FDA: 81529816368.19.E1EE728 Received: from mail-yw1-f201.google.com (mail-yw1-f201.google.com [209.85.128.201]) by imf23.hostedemail.com (Postfix) with ESMTP id 4FAFA140013 for ; Mon, 4 Dec 2023 17:27:02 +0000 (UTC) Authentication-Results: imf23.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=EeP3EWjv; spf=pass (imf23.hostedemail.com: domain of 35QtuZQoKCOYRbPWcOPbWVOWWOTM.KWUTQVcf-UUSdIKS.WZO@flex--jthoughton.bounces.google.com designates 209.85.128.201 as permitted sender) smtp.mailfrom=35QtuZQoKCOYRbPWcOPbWVOWWOTM.KWUTQVcf-UUSdIKS.WZO@flex--jthoughton.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1701710822; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=M646tH9YYmwVxUliD4L7Z8ZBWWZDACIb65kUaN+JDEY=; b=8oL/cImJID6UQEc0QNuuxrvUABJcc3NUVkPRDMGT9FY2DsmgeYLKehaOLaSm8CIu4Mwpbt f3oHMgeujbJZdKwVQ5vQep9y0B0ayHoNA06995//ljkYe+ujWWfmrF1i2oP+7U0etBeL96 dn9FE0e6cwrbsryIWL+DUd8McZZKdtA= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1701710822; a=rsa-sha256; cv=none; b=cDoGtNIS9yLP2AVnmZdMOLuJCKPFtTTAl3MDoN/CpxPp2wExkwlczWI1iK4W2RptqtJMbw 7gb2XqwGhNOZJvHaQYg1nXPXKgGzvL88a7w2JOju4DmB9/wTWjti544NxVnzaCONN9QnQx N+2Z1oa8vlWmrGVFQ9yflGtTkb/Yq3A= ARC-Authentication-Results: i=1; imf23.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=EeP3EWjv; spf=pass (imf23.hostedemail.com: domain of 35QtuZQoKCOYRbPWcOPbWVOWWOTM.KWUTQVcf-UUSdIKS.WZO@flex--jthoughton.bounces.google.com designates 209.85.128.201 as permitted sender) smtp.mailfrom=35QtuZQoKCOYRbPWcOPbWVOWWOTM.KWUTQVcf-UUSdIKS.WZO@flex--jthoughton.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com Received: by mail-yw1-f201.google.com with SMTP id 00721157ae682-5d064f9e2a1so65970467b3.1 for ; Mon, 04 Dec 2023 09:27:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1701710821; x=1702315621; darn=kvack.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=M646tH9YYmwVxUliD4L7Z8ZBWWZDACIb65kUaN+JDEY=; b=EeP3EWjvPj8Uqhs5wXUTDW49XJCPYGVs8QW0uR4l2dm/iBO0whTx+BqX1yKbhh2Wlx 0VRgkYLELrYLlKl9xaqTDFODmOaG+NJeepGUTjzfDfLKsbrehMnyer+vUuNSq4yMooZX L2coldMdshhAHTqduRSgcozCI7N7N2776Fta5TjgNoJ/NaHB+8B6QYvgFnTrb0/8+51I xNkCdceKXkfMoD9jNAruupiHTfWyZMBm2o3gJ/YsCM0ktInn+inQD24VggNNpZK7KDj7 K/abpYMKKrITpFGe9wadgQyMUiyZwmVsnda+yMaqT1Gy1RgTFtlKW2P+Cj7wv/buPKgD UGQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701710821; x=1702315621; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=M646tH9YYmwVxUliD4L7Z8ZBWWZDACIb65kUaN+JDEY=; b=Fw0JicqayKXyFcwUhuAugNu4siKulqo0WaCvsspXa4ukxxd79mk7OVSUhl10rDx8El Q2mdBzqSG2bzux4LQ4PWs/Pq3Ld/L6Z84d6BddwdzL/nAabybzmqubK9GsIOfjIcwD8U ZOt45KwD36gaxJFlAeK9cZeAUvYqkyWXSeE9gnpUY+MzGRq/erFmUN21LEPMc7LJ6WP+ Zxb1XE6jeHm6ojWUm9ctff9DRhJR4F7OSk8GQK4BD+SeW17YuNuNW1h1Kp03UNWhrWtm mTNEmukpJxRxtPOtikeGeelc+m5nu6K1IQ9YHa9JESSrpBIRhG/VN+wVdlIJ+/2vc57b 5QIw== X-Gm-Message-State: AOJu0YxxuGYWn1xyxyj8H8VTnPyiH1ojNoNs7crVdt/o6lsT/9smPzS1 JbtPMNsDU6vSq1tY4LC0MKWBhL64v6MC9xro X-Google-Smtp-Source: AGHT+IFU4tbIhHWbcBjJMUiGZh9G54veSthWxnyjrGsysWMzJ17YmnTeGnNZLoFKlU7bhRJcKNmlIXFlXDdpJGNN X-Received: from jthoughton.c.googlers.com ([fda3:e722:ac3:cc00:14:4d90:c0a8:2a4f]) (user=jthoughton job=sendgmr) by 2002:a0d:d60d:0:b0:5d3:9222:a83e with SMTP id y13-20020a0dd60d000000b005d39222a83emr415074ywd.10.1701710821479; Mon, 04 Dec 2023 09:27:01 -0800 (PST) Date: Mon, 4 Dec 2023 17:26:44 +0000 Mime-Version: 1.0 X-Mailer: git-send-email 2.43.0.rc2.451.g8631bc7472-goog Message-ID: <20231204172646.2541916-1-jthoughton@google.com> Subject: [PATCH 0/2] arm64: hugetlb: Fix page fault loop for sw-dirty/hw-clean contiguous PTEs From: James Houghton To: Steve Capper , Will Deacon , Andrew Morton Cc: Mike Kravetz , Muchun Song , Anshuman Khandual , Catalin Marinas , Ryan Roberts , linux-mm@kvack.org, linux-kernel@vger.kernel.org, James Houghton X-Rspamd-Queue-Id: 4FAFA140013 X-Rspam-User: X-Stat-Signature: 1rfgr8b7hnkoe5iiyuqf5i49om9rgyp3 X-Rspamd-Server: rspam03 X-HE-Tag: 1701710822-773383 X-HE-Meta: U2FsdGVkX1/dfQpJ0Ap/bhhAVhX4dyczj9IHMaSmmCyrw4TLoGHfAdNeFy0JtA1uSwRoGP+itzby9jvZvxuvZsCW8+N1b8KoVGFUL7XcG4BR3ay+9lWAkzRbTcFLZdFL5KY4XD4/TCmNXcx+IG5zQuBdxVZkNMKasRZRnNOyQh/ZCkCrlpZ3/FZhc9+8pH0sATnlYselO9Z6gd6uU9l4RUV3TzqCzwCD4jA55lkaP2doKYs0HpaqGVU9uwNfwoPSMKIZzLHZtMSWYgbDcw5Ns78qBXwbMIcY+L8Rp8HbAaKJ/Ho/I/sclmahGAleFXZn5ByEDTMXCPbBeOfu33mq1AnBq7LgZTk7/zcIcN8proF3fey4V870HDdCaFrBJ2zcd7/2fmx+15FSOWIP9VewV3k6jnQVFb2PN21cDqyNVKIkTQlhq3ZydlJnk2dh2tNSpwDjDfcmF9QpfM3TzLlfH7VrriZyroBXUak5qxVr60HiY0aHdWWOtPWnvHs+32+qIh8zt8eYScLkdIGGOuXPOEbxCCsALdT+B0cMVvkesSK4dqb+PAIVTTly8v/h03sDKXiMzjfOuRHbSIxeF6RpYoOQjUrXOHAGU/9hiKE8vhZbtadt6pSpA/CWL0LbAwtUlxfD6dql9DjyUyAFxQ2oolqXbVCycplLX4Dc4hbVHdkixSlBPBiwXRQmUor3HcHeelehvY3wZtU+77rWZdvNwUm6T3T4fKp5fuLHflCUJb/qYjZ18lDHDO7PRZdmE+pXw17qLBQBO5DrghcZlyaHvSeyquMTGGb6w7dykbD/blgB/yopqepg/xueqlKHRlLTxG4qGr84wEmJSoghgdhPsjOG2gCV9UVZJbfc3KRzcV709idDeyVsZy7xDRIaEVTCx1LeysmNiV5btjZ1fWQ40xNBKSqN1iZxTwnGJ9XtzCynKH/o44K81L68i9KlUv0XyXMVWTiKVuho+v1hTKk Zg/MDQbP vMwi7dFpwffRs3249gHW41ZUSVWeZJOYiU/hzcC+v4ODcaCY22HiUuHDVEfx1p9tmWEQW2uah+znMR+PRPD7aebK5XCooaaE+RNU9roogI1yngeuJ0pSbxWYAbCHiYzeLiwvqJT0P7BvypLjmUUSsEWlVZJWeZE0i25vSVo7ReLrKf5re/agM1Uc6C/EUo5lSe0L3GPswzIiChxtNnt/qxL9NROc8rpnN0oSXaOwfQq4AbIcN02Q2pRyp++2+HjTacZGshwWOsaRZ89frMIIaJhiWy92yhi7Vz+cVcBipBNwwjEcNeK+l8YxFY+g+c7ysF/9oD/2WNGgZAIfq7gqbwFzELZyBl9pnCP9I3crpSoLMvyfXtpM03zeWFGhXsiktkCsLlyNQXzaN0PMTkLZzl09bZmf6TRs6wZ9GzHezprdOoj65zA6u1wBiuMDwlwjYVQHOwS35SlG5Rbiz026ZDD9P1uJjySRAlKG/h2PnV31VaRVi0VRP334RcbTJAapLUBoDlovwKwiR9ZD0R9kGGNaKyOkcMsDVdAkyOCPpSw14uyQ93uAbhcnWUwiTMEFPEODFZ2LqprHFCXPYhYfQDHOhbwj9x5okbXvvFSbrXYfXZbK4muK4/p6yoLZvKzUX2F7lSxlqYCKpU4w= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000049, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: It is currently possible for a userspace application to enter a page fault loop when using HugeTLB pages implemented with contiguous PTEs when HAFDBS is not available. This happens because: 1. The kernel may sometimes write PTEs that are sw-dirty but hw-clean (PTE_DIRTY | PTE_RDONLY | PTE_WRITE). 2. If, during a write, the CPU uses a sw-dirty, hw-clean PTE in handling the memory access on a system without HAFDBS, we will get a page fault. 3. HugeTLB will check if it needs to update the dirty bits on the PTE. For contiguous PTEs, it will check to see if the pgprot bits need updating. In this case, HugeTLB wants to write a sequence of sw-dirty, hw-dirty PTEs, but it finds that all the PTEs it is about to overwrite are all pte_dirty() (pte_sw_dirty() => pte_dirty()), so it thinks no update is necessary. Please see this[1] reproducer. I think (though I may be wrong) that both step (1) and step (3) are buggy. The first patch in this series fixes step (3); instead of checking if pte_dirty is matching in __cont_access_flags_changed, check pte_hw_dirty and pte_sw_dirty separately. The second patch in this series makes step (1) less likely to occur. Without this patch, we can get the kernel to write a sw-dirty, hw-clean PTE with the following steps (showing the relevant VMA flags and pgprot bits): i. Create a valid, writable contiguous PTE. VMA vmflags: VM_SHARED | VM_READ | VM_WRITE VMA pgprot bits: PTE_RDONLY | PTE_WRITE PTE pgprot bits: PTE_DIRTY | PTE_WRITE ii. mprotect the VMA to PROT_NONE. VMA vmflags: VM_SHARED VMA pgprot bits: PTE_RDONLY PTE pgprot bits: PTE_DIRTY | PTE_RDONLY iii. mprotect the VMA back to PROT_READ | PROT_WRITE. VMA vmflags: VM_SHARED | VM_READ | VM_WRITE VMA pgprot bits: PTE_RDONLY | PTE_WRITE PTE pgprot bits: PTE_DIRTY | PTE_WRITE | PTE_RDONLY Applying either one of the two patches in this patchset will fix the particular issue with HugeTLB pages implemented with contiguous PTEs. It's possible that only one of these patches should be taken, or that the right fix is something else entirely. [1]: https://gist.github.com/48ca/11d1e466deee032cb35aa8c2280f93b0 James Houghton (2): arm64: hugetlb: Distinguish between hw and sw dirtiness in __cont_access_flags_changed arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify arch/arm64/include/asm/pgtable.h | 6 ++++++ arch/arm64/mm/hugetlbpage.c | 5 ++++- 2 files changed, 10 insertions(+), 1 deletion(-) base-commit: 645a9a454fdb7e698a63a275edca6a17ef97afc4