From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id CB2F02459E1 for ; Sun, 12 Jul 2026 07:46:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783842389; cv=none; b=cqjKEeYYfjJ0KprXG/oaVa6H3/nuza5e9AgrzYcvX7G9OrYCUJfqAwN4yE8V50rC0ClvqiS6auMwgumXOUt3ZCNVxjXRmk3WFx1ruQc+tIZgcq/96pVSWPwCVo/13WvMEuB4dL7lQoguhqrEqizIm5qMHvY76pViZrAU6ho2S90= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783842389; c=relaxed/simple; bh=nohsd7GiLakObGLBaDIO4H+sVaQd7yxCodOtnB+4Jxk=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=kLvUTaxSXnWUisqg4HKrHRUnf1kU/DHrAhwMjRvBojgvU1sPXsT4Wic+PObshVQou3PKln1iv1bOeeOG8P52tgHPJh3Ig3PUH9MVbrGn52n8oUTscZ61x99FPQ7TNH/W+hexZW2bRFxDLz+1Pqs0zvp8Hs5+3Y2tHfkeMPkpKPw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b=YnV5CLLN; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b="YnV5CLLN" Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 6B1BA1682; Sun, 12 Jul 2026 00:46:21 -0700 (PDT) Received: from [10.163.129.143] (unknown [10.163.129.143]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 7C97F3F85F; Sun, 12 Jul 2026 00:46:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1783842385; bh=nohsd7GiLakObGLBaDIO4H+sVaQd7yxCodOtnB+4Jxk=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=YnV5CLLNFnCF8n0m7G1DlD52+qpTPsqCfAvqMWKko4vIjG5vQF3+EDtL/TowISGrD Jks/j+ZCOhOowMhkoA7z0I626qdfwRYb+sNFzeo7vJarzWxk5cRtdIyqs/N/S0Vn+V nbo69oXFxbzeFtCUOsbNptWEYbXqYGZaGsASZh48= Message-ID: Date: Sun, 12 Jul 2026 13:16:17 +0530 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 2/2] Revert "arm64: Enable vmalloc-huge with ptdump" To: Lorenzo Stoakes , Andrew Morton , Suren Baghdasaryan , "Liam R. Howlett" , Vlastimil Babka , Shakeel Butt , David Hildenbrand , Mike Rapoport , Michal Hocko , Uladzislau Rezki , Toshi Kani , Catalin Marinas , Will Deacon Cc: David Carlier , Ryan Roberts , linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org References: <20260710-series-vmap-race-fix-v1-0-5b3794c113fe@kernel.org> <20260710-series-vmap-race-fix-v1-2-5b3794c113fe@kernel.org> Content-Language: en-US From: Dev Jain In-Reply-To: <20260710-series-vmap-race-fix-v1-2-5b3794c113fe@kernel.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 10/07/26 4:19 pm, Lorenzo Stoakes wrote: > This partially reverts commit fa93b45fd397 ("arm64: Enable vmalloc-huge > with ptdump"), retaining vmalloc-huge support but eliminating the now > redundant mitigation against a race between huge vmap page table freeing > and ptdump, as this issue has now been fixed at core. > > We also simultaneously remove the arm64 ifdeffery when acquiring the mmap > read lock upon vmap huge page table promotion as it is no longer required. > > Signed-off-by: Lorenzo Stoakes > --- As pointed out by Mike, the subject line doesn't fit. Perhaps just start with "Partially revert ..." Reviewed-by: Dev Jain > arch/arm64/include/asm/ptdump.h | 2 -- > arch/arm64/mm/mmu.c | 43 ++++------------------------------------- > arch/arm64/mm/ptdump.c | 11 ++--------- > mm/vmalloc.c | 15 +++----------- > 4 files changed, 9 insertions(+), 62 deletions(-) > > diff --git a/arch/arm64/include/asm/ptdump.h b/arch/arm64/include/asm/ptdump.h > index 5b374a6ab34a..50a195eda8ed 100644 > --- a/arch/arm64/include/asm/ptdump.h > +++ b/arch/arm64/include/asm/ptdump.h > @@ -7,8 +7,6 @@ > > #include > > -DECLARE_STATIC_KEY_FALSE(arm64_ptdump_lock_key); > - > #ifdef CONFIG_PTDUMP > > #include > diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c > index f2be501468ce..f723bcf68174 100644 > --- a/arch/arm64/mm/mmu.c > +++ b/arch/arm64/mm/mmu.c > @@ -49,8 +49,6 @@ > #define NO_CONT_MAPPINGS BIT(1) > #define NO_EXEC_MAPPINGS BIT(2) /* assumes FEAT_HPDS is not used */ > > -DEFINE_STATIC_KEY_FALSE(arm64_ptdump_lock_key); > - > u64 kimage_voffset __ro_after_init; > EXPORT_SYMBOL(kimage_voffset); > > @@ -1857,8 +1855,7 @@ int pmd_clear_huge(pmd_t *pmdp) > return 1; > } > > -static int __pmd_free_pte_page(pmd_t *pmdp, unsigned long addr, > - bool acquire_mmap_lock) > +int pmd_free_pte_page(pmd_t *pmdp, unsigned long addr) > { > pte_t *table; > pmd_t pmd; > @@ -1870,25 +1867,13 @@ static int __pmd_free_pte_page(pmd_t *pmdp, unsigned long addr, > return 1; > } > > - /* See comment in pud_free_pmd_page for static key logic */ > table = pte_offset_kernel(pmdp, addr); > pmd_clear(pmdp); > __flush_tlb_kernel_pgtable(addr); > - if (static_branch_unlikely(&arm64_ptdump_lock_key) && acquire_mmap_lock) { > - mmap_read_lock(&init_mm); > - mmap_read_unlock(&init_mm); > - } > - > pte_free_kernel(NULL, table); > return 1; > } > > -int pmd_free_pte_page(pmd_t *pmdp, unsigned long addr) > -{ > - /* If ptdump is walking the pagetables, acquire init_mm.mmap_lock */ > - return __pmd_free_pte_page(pmdp, addr, /* acquire_mmap_lock = */ true); > -} > - > int pud_free_pmd_page(pud_t *pudp, unsigned long addr) > { > pmd_t *table; > @@ -1904,36 +1889,16 @@ int pud_free_pmd_page(pud_t *pudp, unsigned long addr) > } > > table = pmd_offset(pudp, addr); > - > - /* > - * Our objective is to prevent ptdump from reading a PMD table which has > - * been freed. In this race, if pud_free_pmd_page observes the key on > - * (which got flipped by ptdump) then the mmap lock sequence here will, > - * as a result of the mmap write lock/unlock sequence in ptdump, give > - * us the correct synchronization. If not, this means that ptdump has > - * yet not started walking the pagetables - the sequence of barriers > - * issued by __flush_tlb_kernel_pgtable() guarantees that ptdump will > - * observe an empty PUD. > - */ > - pud_clear(pudp); > - __flush_tlb_kernel_pgtable(addr); > - if (static_branch_unlikely(&arm64_ptdump_lock_key)) { > - mmap_read_lock(&init_mm); > - mmap_read_unlock(&init_mm); > - } > - > pmdp = table; > next = addr; > end = addr + PUD_SIZE; > do { > if (pmd_present(pmdp_get(pmdp))) > - /* > - * PMD has been isolated, so ptdump won't see it. No > - * need to acquire init_mm.mmap_lock. > - */ > - __pmd_free_pte_page(pmdp, next, /* acquire_mmap_lock = */ false); > + pmd_free_pte_page(pmdp, next); > } while (pmdp++, next += PMD_SIZE, next != end); > > + pud_clear(pudp); > + __flush_tlb_kernel_pgtable(addr); > pmd_free(NULL, table); > return 1; > } > diff --git a/arch/arm64/mm/ptdump.c b/arch/arm64/mm/ptdump.c > index 1c20144700d7..5a76c59b5ada 100644 > --- a/arch/arm64/mm/ptdump.c > +++ b/arch/arm64/mm/ptdump.c > @@ -283,13 +283,6 @@ void note_page_flush(struct ptdump_state *pt_st) > note_page(pt_st, 0, -1, pte_val(pte_zero)); > } > > -static void arm64_ptdump_walk_pgd(struct ptdump_state *st, struct mm_struct *mm) > -{ > - static_branch_inc(&arm64_ptdump_lock_key); > - ptdump_walk_pgd(st, mm, NULL); > - static_branch_dec(&arm64_ptdump_lock_key); > -} > - > void ptdump_walk(struct seq_file *s, struct ptdump_info *info) > { > unsigned long end = ~0UL; > @@ -318,7 +311,7 @@ void ptdump_walk(struct seq_file *s, struct ptdump_info *info) > } > }; > > - arm64_ptdump_walk_pgd(&st.ptdump, info->mm); > + ptdump_walk_pgd(&st.ptdump, info->mm, NULL); > } > > static void __init ptdump_initialize(void) > @@ -360,7 +353,7 @@ bool ptdump_check_wx(void) > } > }; > > - arm64_ptdump_walk_pgd(&st.ptdump, &init_mm); > + ptdump_walk_pgd(&st.ptdump, &init_mm, NULL); > > if (st.wx_pages || st.uxn_pages) { > pr_warn("Checked W+X mappings: FAILED, %lu W+X pages found, %lu non-UXN pages found\n", > diff --git a/mm/vmalloc.c b/mm/vmalloc.c > index 9d0f1fdd6af3..537ff7b3c412 100644 > --- a/mm/vmalloc.c > +++ b/mm/vmalloc.c > @@ -170,10 +170,7 @@ static int vmap_try_huge_pmd(pmd_t *pmd, unsigned long addr, unsigned long end, > * Therefore, acquire the mmap read lock to prevent use-after-free when > * freeing page tables. > */ > -#ifndef CONFIG_ARM64 > - scoped_cond_guard(mmap_read_lock_try, return 0, &init_mm) > -#endif > - { > + scoped_cond_guard(mmap_read_lock_try, return 0, &init_mm) { > if (!pmd_free_pte_page(pmd, addr)) > return 0; > return pmd_set_huge(pmd, phys_addr, prot); > @@ -230,10 +227,7 @@ static int vmap_try_huge_pud(pud_t *pud, unsigned long addr, unsigned long end, > return pud_set_huge(pud, phys_addr, prot); > > /* See comment in vmap_try_huge_pmd(). */ > -#ifndef CONFIG_ARM64 > - scoped_cond_guard(mmap_read_lock_try, return 0, &init_mm) > -#endif > - { > + scoped_cond_guard(mmap_read_lock_try, return 0, &init_mm) { > if (!pud_free_pmd_page(pud, addr)) > return 0; > return pud_set_huge(pud, phys_addr, prot); > @@ -290,10 +284,7 @@ static int vmap_try_huge_p4d(p4d_t *p4d, unsigned long addr, unsigned long end, > return p4d_set_huge(p4d, phys_addr, prot); > > /* See comment in vmap_try_huge_pmd(). */ > -#ifndef CONFIG_ARM64 > - scoped_cond_guard(mmap_read_lock_try, return 0, &init_mm) > -#endif > - { > + scoped_cond_guard(mmap_read_lock_try, return 0, &init_mm) { > if (!p4d_free_pud_page(p4d, addr)) > return 0; > return p4d_set_huge(p4d, phys_addr, prot); >