+ mm-fix-pte_af-handling-in-fault-path-on-architectures-with-hw-af-support.patch added to mm-hotfixes-unstable branch

+ mm-fix-pte_af-handling-in-fault-path-on-architectures-with-hw-af-support.patch added to mm-hotfixes-unstable branch

[Andrew Morton]

The patch titled
     Subject: mm: fix PTE_AF handling in fault path on architectures with HW AF support
has been added to the -mm mm-hotfixes-unstable branch.  Its filename is
     mm-fix-pte_af-handling-in-fault-path-on-architectures-with-hw-af-support.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-fix-pte_af-handling-in-fault-path-on-architectures-with-hw-af-support.patch

This patch will later appear in the mm-hotfixes-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days

------------------------------------------------------
From: Ram Tummala <rtummala@nvidia.com>
Subject: mm: fix PTE_AF handling in fault path on architectures with HW AF support
Date: Tue, 9 Jul 2024 17:09:42 -0700

Commit 3bd786f76de2 ("mm: convert do_set_pte() to set_pte_range()")
replaced do_set_pte() with set_pte_range() and that introduced a
regression in the following faulting path of non-anonymous vmas on CPUs
with HW AF (Access Flag) support.

handle_pte_fault()
  do_pte_missing()
    do_fault()
      do_read_fault() || do_cow_fault() || do_shared_fault()
        finish_fault()
          set_pte_range()

The polarity of prefault calculation is incorrect.  This leads to prefault
being incorrectly set for the faulting address.  The following if check
will incorrectly clear the PTE_AF bit instead of setting it and the access
will fault again on the same address due to the missing PTE_AF bit.

    if (prefault && arch_wants_old_prefaulted_pte())
        entry = pte_mkold(entry);

On a subsequent fault on the same address, the faulting path will see a
non NULL vmf->pte and instead of reaching the do_pte_missing() path,
PTE_AF will be correctly set in handle_pte_fault() itself.

Due to this bug, performance degradation in the fault handling path will
be observed due to unnecessary double faulting.

Link: https://lkml.kernel.org/r/20240710000942.623704-1-rtummala@nvidia.com
Fixes: 3bd786f76de2 ("mm: convert do_set_pte() to set_pte_range()")
Signed-off-by: Ram Tummala <rtummala@nvidia.com>
Reviewed-by: Yin Fengwei <fengwei.yin@intel.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memory.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/mm/memory.c~mm-fix-pte_af-handling-in-fault-path-on-architectures-with-hw-af-support
+++ a/mm/memory.c
@@ -4681,7 +4681,7 @@ void set_pte_range(struct vm_fault *vmf,
 {
 	struct vm_area_struct *vma = vmf->vma;
 	bool write = vmf->flags & FAULT_FLAG_WRITE;
-	bool prefault = in_range(vmf->address, addr, nr * PAGE_SIZE);
+	bool prefault = !in_range(vmf->address, addr, nr * PAGE_SIZE);
 	pte_t entry;
 
 	flush_icache_pages(vma, page, nr);
_

Patches currently in -mm which might be from rtummala@nvidia.com are

mm-fix-pte_af-handling-in-fault-path-on-architectures-with-hw-af-support.patch

Re: + mm-fix-pte_af-handling-in-fault-path-on-architectures-with-hw-af-support.patch added to mm-hotfixes-unstable branch

[Matthew Wilcox]

On Tue, Jul 09, 2024 at 10:34:42PM -0700, Andrew Morton wrote:
> 
> The patch titled
>      Subject: mm: fix PTE_AF handling in fault path on architectures with HW AF support
> has been added to the -mm mm-hotfixes-unstable branch.  Its filename is
>      mm-fix-pte_af-handling-in-fault-path-on-architectures-with-hw-af-support.patch

This looks like v1 not v2?

> This patch will shortly appear at
>      https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-fix-pte_af-handling-in-fault-path-on-architectures-with-hw-af-support.patch
> 
> This patch will later appear in the mm-hotfixes-unstable branch at
>     git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> 
> Before you just go and hit "reply", please:
>    a) Consider who else should be cc'ed
>    b) Prefer to cc a suitable mailing list as well
>    c) Ideally: find the original patch on the mailing list and do a
>       reply-to-all to that, adding suitable additional cc's
> 
> *** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
> 
> The -mm tree is included into linux-next via the mm-everything
> branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> and is updated there every 2-3 working days
> 
> ------------------------------------------------------
> From: Ram Tummala <rtummala@nvidia.com>
> Subject: mm: fix PTE_AF handling in fault path on architectures with HW AF support
> Date: Tue, 9 Jul 2024 17:09:42 -0700
> 
> Commit 3bd786f76de2 ("mm: convert do_set_pte() to set_pte_range()")
> replaced do_set_pte() with set_pte_range() and that introduced a
> regression in the following faulting path of non-anonymous vmas on CPUs
> with HW AF (Access Flag) support.
> 
> handle_pte_fault()
>   do_pte_missing()
>     do_fault()
>       do_read_fault() || do_cow_fault() || do_shared_fault()
>         finish_fault()
>           set_pte_range()
> 
> The polarity of prefault calculation is incorrect.  This leads to prefault
> being incorrectly set for the faulting address.  The following if check
> will incorrectly clear the PTE_AF bit instead of setting it and the access
> will fault again on the same address due to the missing PTE_AF bit.
> 
>     if (prefault && arch_wants_old_prefaulted_pte())
>         entry = pte_mkold(entry);
> 
> On a subsequent fault on the same address, the faulting path will see a
> non NULL vmf->pte and instead of reaching the do_pte_missing() path,
> PTE_AF will be correctly set in handle_pte_fault() itself.
> 
> Due to this bug, performance degradation in the fault handling path will
> be observed due to unnecessary double faulting.
> 
> Link: https://lkml.kernel.org/r/20240710000942.623704-1-rtummala@nvidia.com
> Fixes: 3bd786f76de2 ("mm: convert do_set_pte() to set_pte_range()")
> Signed-off-by: Ram Tummala <rtummala@nvidia.com>
> Reviewed-by: Yin Fengwei <fengwei.yin@intel.com>
> Acked-by: David Hildenbrand <david@redhat.com>
> Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
> Cc: Alistair Popple <apopple@nvidia.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> ---
> 
>  mm/memory.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> --- a/mm/memory.c~mm-fix-pte_af-handling-in-fault-path-on-architectures-with-hw-af-support
> +++ a/mm/memory.c
> @@ -4681,7 +4681,7 @@ void set_pte_range(struct vm_fault *vmf,
>  {
>  	struct vm_area_struct *vma = vmf->vma;
>  	bool write = vmf->flags & FAULT_FLAG_WRITE;
> -	bool prefault = in_range(vmf->address, addr, nr * PAGE_SIZE);
> +	bool prefault = !in_range(vmf->address, addr, nr * PAGE_SIZE);
>  	pte_t entry;
>  
>  	flush_icache_pages(vma, page, nr);
> _
> 
> Patches currently in -mm which might be from rtummala@nvidia.com are
> 
> mm-fix-pte_af-handling-in-fault-path-on-architectures-with-hw-af-support.patch
>