[PATCH] arm64: Don't report clear pmds and puds as huge

[PATCH] arm64: Don't report clear pmds and puds as huge

[Christoffer Dall]

The current pmd_huge() and pud_huge() functions simply check if the table
bit is not set and reports the entries as huge in that case.  This is
counter-intuitive as a clear pmd/pud cannot also be a huge pmd/pud, and
it is inconsistent with at least arm and x86.

To prevent others from making the same mistake as me in looking at code
that calls these functions and to fix an issue with KVM on arm64 that
causes memory corruption due to incorrect page reference counting
resulting from this mistake, let's change the behavior.

Cc: stable at vger.kernel.org
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
---
 arch/arm64/mm/hugetlbpage.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 2de9d2e..0eeb4f09 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -40,13 +40,13 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
 
 int pmd_huge(pmd_t pmd)
 {
-	return !(pmd_val(pmd) & PMD_TABLE_BIT);
+	return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
 }
 
 int pud_huge(pud_t pud)
 {
 #ifndef __PAGETABLE_PMD_FOLDED
-	return !(pud_val(pud) & PUD_TABLE_BIT);
+	return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
 #else
 	return 0;
 #endif
-- 
2.1.2.330.g565301e.dirty

[PATCH] arm64: Don't report clear pmds and puds as huge

[Steve Capper]

On 1 July 2015 at 13:08, Christoffer Dall <christoffer.dall@linaro.org> wrote:
> The current pmd_huge() and pud_huge() functions simply check if the table
> bit is not set and reports the entries as huge in that case.  This is
> counter-intuitive as a clear pmd/pud cannot also be a huge pmd/pud, and
> it is inconsistent with at least arm and x86.
>
> To prevent others from making the same mistake as me in looking at code
> that calls these functions and to fix an issue with KVM on arm64 that
> causes memory corruption due to incorrect page reference counting
> resulting from this mistake, let's change the behavior.
>
> Cc: stable at vger.kernel.org

Thanks Christoffer.

It may be worth adding:

Fixes: 084bd29810a5 ("ARM64: mm: HugeTLB support.")

And, please feel free to add:

Reviewed-by: Steve Capper <steve.capper@linaro.org>

> Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
> ---
>  arch/arm64/mm/hugetlbpage.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
> index 2de9d2e..0eeb4f09 100644
> --- a/arch/arm64/mm/hugetlbpage.c
> +++ b/arch/arm64/mm/hugetlbpage.c
> @@ -40,13 +40,13 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
>
>  int pmd_huge(pmd_t pmd)
>  {
> -       return !(pmd_val(pmd) & PMD_TABLE_BIT);
> +       return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
>  }
>
>  int pud_huge(pud_t pud)
>  {
>  #ifndef __PAGETABLE_PMD_FOLDED
> -       return !(pud_val(pud) & PUD_TABLE_BIT);
> +       return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
>  #else
>         return 0;
>  #endif
> --
> 2.1.2.330.g565301e.dirty
>

[PATCH] arm64: Don't report clear pmds and puds as huge

[Christoffer Dall]

On Wed, Jul 01, 2015 at 01:24:34PM +0100, Steve Capper wrote:
> On 1 July 2015 at 13:08, Christoffer Dall <christoffer.dall@linaro.org> wrote:
> > The current pmd_huge() and pud_huge() functions simply check if the table
> > bit is not set and reports the entries as huge in that case.  This is
> > counter-intuitive as a clear pmd/pud cannot also be a huge pmd/pud, and
> > it is inconsistent with at least arm and x86.
> >
> > To prevent others from making the same mistake as me in looking at code
> > that calls these functions and to fix an issue with KVM on arm64 that
> > causes memory corruption due to incorrect page reference counting
> > resulting from this mistake, let's change the behavior.
> >
> > Cc: stable at vger.kernel.org
> 
> Thanks Christoffer.
> 
> It may be worth adding:
> 
> Fixes: 084bd29810a5 ("ARM64: mm: HugeTLB support.")
> 
> And, please feel free to add:
> 
> Reviewed-by: Steve Capper <steve.capper@linaro.org>
> 
Thanks!
-Christoffer

[PATCH] arm64: Don't report clear pmds and puds as huge

[Marc Zyngier]

On 01/07/15 13:08, Christoffer Dall wrote:
> The current pmd_huge() and pud_huge() functions simply check if the table
> bit is not set and reports the entries as huge in that case.  This is
> counter-intuitive as a clear pmd/pud cannot also be a huge pmd/pud, and
> it is inconsistent with at least arm and x86.
> 
> To prevent others from making the same mistake as me in looking at code
> that calls these functions and to fix an issue with KVM on arm64 that
> causes memory corruption due to incorrect page reference counting
> resulting from this mistake, let's change the behavior.
> 
> Cc: stable at vger.kernel.org
> Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>

FWIW:

Acked-by: Marc Zyngier <marc.zyngier@arm.com>

	M.
-- 
Jazz is not dead. It just smells funny...

[PATCH] arm64: Don't report clear pmds and puds as huge

[Catalin Marinas]

On Wed, Jul 01, 2015 at 02:08:31PM +0200, Christoffer Dall wrote:
> The current pmd_huge() and pud_huge() functions simply check if the table
> bit is not set and reports the entries as huge in that case.  This is
> counter-intuitive as a clear pmd/pud cannot also be a huge pmd/pud, and
> it is inconsistent with at least arm and x86.
> 
> To prevent others from making the same mistake as me in looking at code
> that calls these functions and to fix an issue with KVM on arm64 that
> causes memory corruption due to incorrect page reference counting
> resulting from this mistake, let's change the behavior.
> 
> Cc: stable at vger.kernel.org
> Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
> ---
>  arch/arm64/mm/hugetlbpage.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
> index 2de9d2e..0eeb4f09 100644
> --- a/arch/arm64/mm/hugetlbpage.c
> +++ b/arch/arm64/mm/hugetlbpage.c
> @@ -40,13 +40,13 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
>  
>  int pmd_huge(pmd_t pmd)
>  {
> -	return !(pmd_val(pmd) & PMD_TABLE_BIT);
> +	return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
>  }
>  
>  int pud_huge(pud_t pud)
>  {
>  #ifndef __PAGETABLE_PMD_FOLDED
> -	return !(pud_val(pud) & PUD_TABLE_BIT);
> +	return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
>  #else
>  	return 0;
>  #endif

Thanks for the patch, I'll add the acks/reviews and Fixes: tags.

(and I think I'll change pmd_val to pmd_present, same for pud; no
functional difference)

-- 
Catalin

[PATCH] arm64: Don't report clear pmds and puds as huge

[Catalin Marinas]

On Wed, Jul 01, 2015 at 02:18:31PM +0100, Catalin Marinas wrote:
> On Wed, Jul 01, 2015 at 02:08:31PM +0200, Christoffer Dall wrote:
> > diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
> > index 2de9d2e..0eeb4f09 100644
> > --- a/arch/arm64/mm/hugetlbpage.c
> > +++ b/arch/arm64/mm/hugetlbpage.c
> > @@ -40,13 +40,13 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
> >  
> >  int pmd_huge(pmd_t pmd)
> >  {
> > -	return !(pmd_val(pmd) & PMD_TABLE_BIT);
> > +	return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
> >  }
> >  
> >  int pud_huge(pud_t pud)
> >  {
> >  #ifndef __PAGETABLE_PMD_FOLDED
> > -	return !(pud_val(pud) & PUD_TABLE_BIT);
> > +	return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
> >  #else
> >  	return 0;
> >  #endif
> 
> Thanks for the patch, I'll add the acks/reviews and Fixes: tags.
> 
> (and I think I'll change pmd_val to pmd_present, same for pud; no
> functional difference)

A related question - can we ever have PROT_NONE on a huge pmd? I'll
leave this patch with pmd_val for now, it matches pmd_trans_huge().

-- 
Catalin

[PATCH] arm64: Don't report clear pmds and puds as huge

[Steve Capper]

On 1 July 2015 at 14:28, Catalin Marinas <catalin.marinas@arm.com> wrote:
> On Wed, Jul 01, 2015 at 02:18:31PM +0100, Catalin Marinas wrote:
>> On Wed, Jul 01, 2015 at 02:08:31PM +0200, Christoffer Dall wrote:
>> > diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
>> > index 2de9d2e..0eeb4f09 100644
>> > --- a/arch/arm64/mm/hugetlbpage.c
>> > +++ b/arch/arm64/mm/hugetlbpage.c
>> > @@ -40,13 +40,13 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
>> >
>> >  int pmd_huge(pmd_t pmd)
>> >  {
>> > -   return !(pmd_val(pmd) & PMD_TABLE_BIT);
>> > +   return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
>> >  }
>> >
>> >  int pud_huge(pud_t pud)
>> >  {
>> >  #ifndef __PAGETABLE_PMD_FOLDED
>> > -   return !(pud_val(pud) & PUD_TABLE_BIT);
>> > +   return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
>> >  #else
>> >     return 0;
>> >  #endif
>>
>> Thanks for the patch, I'll add the acks/reviews and Fixes: tags.
>>
>> (and I think I'll change pmd_val to pmd_present, same for pud; no
>> functional difference)
>
> A related question - can we ever have PROT_NONE on a huge pmd? I'll
> leave this patch with pmd_val for now, it matches pmd_trans_huge().

Yes PROT_NONE can be used. I have a test case for it in libhugetlbfs
(for HugeTLB) and for THP at:
https://git.linaro.org/people/steve.capper/memory-tests.git

They worked last time I touched them ;-).

Cheers,
--
Steve

>
> --
> Catalin