[PATCH] mm/hmm: honor write requests for owned device-private pages

[Aveline Noir <jm5905938@gmail.com>]

The owner-matching device-private PTE and PMD paths return read-only
pages even when HMM_PFN_REQ_WRITE is requested. For example, after fork,
a write request can succeed without resolving COW or returning
HMM_PFN_WRITE. The test_hmm consumer then returns -EFAULT.

Check read-only entries for write faults before returning their PFNs.
Keep the fast path for writable entries and skip the PMD request scan
when no write request is possible.

Fixes: 10b9feee2d0d ("mm/hmm: populate PFNs from PMD swap entry")
Signed-off-by: Aveline Noir <jm5905938@gmail.com>
---
Found during code review and synthetic HMM testing.

Tested PTE and PMD write requests, COW and read-only VMAs with QEMU
test_hmm on x86-64. A separate test probe covered request flags. All
executed tests passed. Testing on a real GPU would be appreciated.
---
 mm/hmm.c | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/mm/hmm.c b/mm/hmm.c
index 2f1e98c6b644..92957541ba95 100644
--- a/mm/hmm.c
+++ b/mm/hmm.c
@@ -268,15 +268,22 @@ static int hmm_vma_handle_pte(struct mm_walk *walk, unsigned long addr,
 		const softleaf_t entry = softleaf_from_pte(pte);
 
 		/*
-		 * Don't fault in device private pages owned by the caller,
-		 * just report the PFN.
+		 * Don't fault in device private pages owned by the caller unless
+		 * a write fault is required.
 		 */
 		if (softleaf_is_device_private(entry) &&
 		    page_pgmap(softleaf_to_page(entry))->owner ==
 		    range->dev_private_owner) {
 			cpu_flags = HMM_PFN_VALID;
-			if (softleaf_is_device_private_write(entry))
+			if (softleaf_is_device_private_write(entry)) {
 				cpu_flags |= HMM_PFN_WRITE;
+			} else {
+				required_fault =
+					hmm_pte_need_fault(hmm_vma_walk, pfn_req_flags,
+							   cpu_flags);
+				if (required_fault)
+					goto fault;
+			}
 			new_pfn_flags = softleaf_to_pfn(entry) | cpu_flags;
 			goto out;
 		}
@@ -358,8 +365,15 @@ static int hmm_vma_handle_absent_pmd(struct mm_walk *walk, unsigned long start,
 		unsigned long pfn = softleaf_to_pfn(entry);
 		unsigned long i;
 
-		if (softleaf_is_device_private_write(entry))
+		if (softleaf_is_device_private_write(entry)) {
 			cpu_flags |= HMM_PFN_WRITE;
+		} else if ((range->default_flags | range->pfn_flags_mask) &
+			   HMM_PFN_REQ_WRITE) {
+			required_fault = hmm_range_need_fault(hmm_vma_walk,
+							      hmm_pfns, npages, cpu_flags);
+			if (required_fault)
+				return hmm_record_fault(addr, end, required_fault, walk);
+		}
 
 		/*
 		 * Fully populate the PFN list though subsequent PFNs could be

base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3
-- 
2.56.0