| Message ID | 20190906135747.211836-1-justin.he@arm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] mm: fix double page fault on arm64 if PTE_AF is cleared | expand |
On Fri, Sep 06, 2019 at 09:57:47PM +0800, Jia He wrote: > * This really shouldn't fail, because the page is there > * in the page tables. But it might just be unreadable, > * in which case we just give up and fill the result with > - * zeroes. > + * zeroes. If PTE_AF is cleared on arm64, it might > + * cause double page fault. So makes pte young here How about: * zeroes. On architectures with software "accessed" bits, * we would take a double page fault here, so mark it * accessed here. > */ > + if (!pte_young(vmf->orig_pte)) { Let's guard this with: if (arch_sw_access_bit && !pte_young(vmf->orig_pte)) { #define arch_sw_access_bit 0 by default and have arm64 override it (either to a variable or a constant ... your choice). Also, please somebody decide on a better name than arch_sw_access_bit. > + entry = pte_mkyoung(vmf->orig_pte); > + if (ptep_set_access_flags(vmf->vma, vmf->address, > + vmf->pte, entry, 0)) This indentation is wrong; it makes vmf->pte look like part of the subsequent statement instead of part of the condition. > + update_mmu_cache(vmf->vma, vmf->address, > + vmf->pte); > + } > +
On Fri, Sep 06, 2019 at 09:57:47PM +0800, Jia He wrote: > + if (!pte_young(vmf->orig_pte)) { > + entry = pte_mkyoung(vmf->orig_pte); > + if (ptep_set_access_flags(vmf->vma, vmf->address, > + vmf->pte, entry, 0)) > + update_mmu_cache(vmf->vma, vmf->address, > + vmf->pte); > + } > + Oh, btw, why call update_mmu_cache() here? All you've done is changed the 'accessed' bit. What is any architecture supposed to do in response to this?
On Mon, Sep 09, 2019 at 02:27:12PM -0700, Matthew Wilcox wrote: > On Fri, Sep 06, 2019 at 09:57:47PM +0800, Jia He wrote: > > + if (!pte_young(vmf->orig_pte)) { > > + entry = pte_mkyoung(vmf->orig_pte); > > + if (ptep_set_access_flags(vmf->vma, vmf->address, > > + vmf->pte, entry, 0)) > > + update_mmu_cache(vmf->vma, vmf->address, > > + vmf->pte); > > + } > > + > > Oh, btw, why call update_mmu_cache() here? All you've done is changed > the 'accessed' bit. What is any architecture supposed to do in response > to this? For arm64 and x86 that's a no-op but an architecture with software TLBs may preload them to avoid a subsequent fault on access after the pte was made young.
On Fri, Sep 06, 2019 at 07:57:42AM -0700, Matthew Wilcox wrote: > On Fri, Sep 06, 2019 at 09:57:47PM +0800, Jia He wrote: > > * This really shouldn't fail, because the page is there > > * in the page tables. But it might just be unreadable, > > * in which case we just give up and fill the result with > > - * zeroes. > > + * zeroes. If PTE_AF is cleared on arm64, it might > > + * cause double page fault. So makes pte young here > > How about: > * zeroes. On architectures with software "accessed" bits, > * we would take a double page fault here, so mark it > * accessed here. > > > */ > > + if (!pte_young(vmf->orig_pte)) { > > Let's guard this with: > > if (arch_sw_access_bit && !pte_young(vmf->orig_pte)) { > > #define arch_sw_access_bit 0 > by default and have arm64 override it (either to a variable or a constant > ... your choice). Also, please somebody decide on a better name than > arch_sw_access_bit. I'm not good at names either (is arch_faults_on_old_pte any better?) but I'd make this a 0 args call: arch_sw_access_bit(). This way we can make it a static inline function on arm64 with some static label check.
On Fri, Sep 06, 2019 at 09:57:47PM +0800, Jia He wrote: > When we tested pmdk unit test [1] vmmalloc_fork TEST1 in arm64 guest, there > will be a double page fault in __copy_from_user_inatomic of cow_user_page. > > Below call trace is from arm64 do_page_fault for debugging purpose > [ 110.016195] Call trace: > [ 110.016826] do_page_fault+0x5a4/0x690 > [ 110.017812] do_mem_abort+0x50/0xb0 > [ 110.018726] el1_da+0x20/0xc4 > [ 110.019492] __arch_copy_from_user+0x180/0x280 > [ 110.020646] do_wp_page+0xb0/0x860 > [ 110.021517] __handle_mm_fault+0x994/0x1338 > [ 110.022606] handle_mm_fault+0xe8/0x180 > [ 110.023584] do_page_fault+0x240/0x690 > [ 110.024535] do_mem_abort+0x50/0xb0 > [ 110.025423] el0_da+0x20/0x24 > > The pte info before __copy_from_user_inatomic is (PTE_AF is cleared): > [ffff9b007000] pgd=000000023d4f8003, pud=000000023da9b003, pmd=000000023d4b3003, pte=360000298607bd3 > > As told by Catalin: "On arm64 without hardware Access Flag, copying from > user will fail because the pte is old and cannot be marked young. So we > always end up with zeroed page after fork() + CoW for pfn mappings. we > don't always have a hardware-managed access flag on arm64." > > This patch fix it by calling pte_mkyoung. Also, the parameter is > changed because vmf should be passed to cow_user_page() > > [1] https://github.com/pmem/pmdk/tree/master/src/test/vmmalloc_fork > > Reported-by: Yibo Cai <Yibo.Cai@arm.com> > Signed-off-by: Jia He <justin.he@arm.com> > --- > Changes > v2: remove FAULT_FLAG_WRITE when setting pte access flag (by Catalin) > > mm/memory.c | 21 ++++++++++++++++----- > 1 file changed, 16 insertions(+), 5 deletions(-) > > diff --git a/mm/memory.c b/mm/memory.c > index e2bb51b6242e..63d4fd285e8e 100644 > --- a/mm/memory.c > +++ b/mm/memory.c > @@ -2140,7 +2140,8 @@ static inline int pte_unmap_same(struct mm_struct *mm, pmd_t *pmd, > return same; > } > > -static inline void cow_user_page(struct page *dst, struct page *src, unsigned long va, struct vm_area_struct *vma) > +static inline void cow_user_page(struct page *dst, struct page *src, > + struct vm_fault *vmf) > { > debug_dma_assert_idle(src); > > @@ -2152,20 +2153,30 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo > */ > if (unlikely(!src)) { > void *kaddr = kmap_atomic(dst); > - void __user *uaddr = (void __user *)(va & PAGE_MASK); > + void __user *uaddr = (void __user *)(vmf->address & PAGE_MASK); > + pte_t entry; > > /* > * This really shouldn't fail, because the page is there > * in the page tables. But it might just be unreadable, > * in which case we just give up and fill the result with > - * zeroes. > + * zeroes. If PTE_AF is cleared on arm64, it might > + * cause double page fault. So makes pte young here > */ > + if (!pte_young(vmf->orig_pte)) { > + entry = pte_mkyoung(vmf->orig_pte); > + if (ptep_set_access_flags(vmf->vma, vmf->address, > + vmf->pte, entry, 0)) > + update_mmu_cache(vmf->vma, vmf->address, > + vmf->pte); > + } > + I don't see where you take ptl.
diff --git a/mm/memory.c b/mm/memory.c index e2bb51b6242e..63d4fd285e8e 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -2140,7 +2140,8 @@ static inline int pte_unmap_same(struct mm_struct *mm, pmd_t *pmd, return same; } -static inline void cow_user_page(struct page *dst, struct page *src, unsigned long va, struct vm_area_struct *vma) +static inline void cow_user_page(struct page *dst, struct page *src, + struct vm_fault *vmf) { debug_dma_assert_idle(src); @@ -2152,20 +2153,30 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo */ if (unlikely(!src)) { void *kaddr = kmap_atomic(dst); - void __user *uaddr = (void __user *)(va & PAGE_MASK); + void __user *uaddr = (void __user *)(vmf->address & PAGE_MASK); + pte_t entry; /* * This really shouldn't fail, because the page is there * in the page tables. But it might just be unreadable, * in which case we just give up and fill the result with - * zeroes. + * zeroes. If PTE_AF is cleared on arm64, it might + * cause double page fault. So makes pte young here */ + if (!pte_young(vmf->orig_pte)) { + entry = pte_mkyoung(vmf->orig_pte); + if (ptep_set_access_flags(vmf->vma, vmf->address, + vmf->pte, entry, 0)) + update_mmu_cache(vmf->vma, vmf->address, + vmf->pte); + } + if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) clear_page(kaddr); kunmap_atomic(kaddr); flush_dcache_page(dst); } else - copy_user_highpage(dst, src, va, vma); + copy_user_highpage(dst, src, vmf->address, vmf->vma); } static gfp_t __get_fault_gfp_mask(struct vm_area_struct *vma) @@ -2318,7 +2329,7 @@ static vm_fault_t wp_page_copy(struct vm_fault *vmf) vmf->address); if (!new_page) goto oom; - cow_user_page(new_page, old_page, vmf->address, vma); + cow_user_page(new_page, old_page, vmf); } if (mem_cgroup_try_charge_delay(new_page, mm, GFP_KERNEL, &memcg, false))
When we tested pmdk unit test [1] vmmalloc_fork TEST1 in arm64 guest, there will be a double page fault in __copy_from_user_inatomic of cow_user_page. Below call trace is from arm64 do_page_fault for debugging purpose [ 110.016195] Call trace: [ 110.016826] do_page_fault+0x5a4/0x690 [ 110.017812] do_mem_abort+0x50/0xb0 [ 110.018726] el1_da+0x20/0xc4 [ 110.019492] __arch_copy_from_user+0x180/0x280 [ 110.020646] do_wp_page+0xb0/0x860 [ 110.021517] __handle_mm_fault+0x994/0x1338 [ 110.022606] handle_mm_fault+0xe8/0x180 [ 110.023584] do_page_fault+0x240/0x690 [ 110.024535] do_mem_abort+0x50/0xb0 [ 110.025423] el0_da+0x20/0x24 The pte info before __copy_from_user_inatomic is (PTE_AF is cleared): [ffff9b007000] pgd=000000023d4f8003, pud=000000023da9b003, pmd=000000023d4b3003, pte=360000298607bd3 As told by Catalin: "On arm64 without hardware Access Flag, copying from user will fail because the pte is old and cannot be marked young. So we always end up with zeroed page after fork() + CoW for pfn mappings. we don't always have a hardware-managed access flag on arm64." This patch fix it by calling pte_mkyoung. Also, the parameter is changed because vmf should be passed to cow_user_page() [1] https://github.com/pmem/pmdk/tree/master/src/test/vmmalloc_fork Reported-by: Yibo Cai <Yibo.Cai@arm.com> Signed-off-by: Jia He <justin.he@arm.com> --- Changes v2: remove FAULT_FLAG_WRITE when setting pte access flag (by Catalin) mm/memory.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)