From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from DM5PR21CU001.outbound.protection.outlook.com (mail-centralusazon11011017.outbound.protection.outlook.com [52.101.62.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BE3483E9299 for ; Tue, 2 Jun 2026 14:40:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.62.17 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780411229; cv=fail; b=utG5QEZEEWYhH9PbblmByU2ZfK39KkFMgsySRz9iEM6B2+6NqB0usPEZ5jafutuEkU1Wj+XhxRy0urgYRLV8cOjg9c0hzakO+uLD5lvDEjelljy/fRBLtl/L/S12wB0En10NUHxPPAbkSp1WufyzyMleY578BwYc7VSSXTOnCzA= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780411229; c=relaxed/simple; bh=wrdmj3dsWh8uWKNXKgRw7yzzP2Yqf1yBWv5sfpCkUWY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=mrcsdUT9ovdK8pCTkXtWyRpv872EU7opxkH2yCYpw1q5Qj490wjNsdM+Ka6tci/DpfEw+ueeTxLvLMJEevO10cbCIbUFVTniGXWnD/LxIxfzb/Pqb1s0yObFxhnK/HmCWaBhp4kEj33mqx/ZgYSnKZmq0o6s3wDSFxaFE/EEcQk= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=MPPVYuiS; arc=fail smtp.client-ip=52.101.62.17 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="MPPVYuiS" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=FkEe/YbAANfEmIkhWRFXQP8LRO+Lobznx3FZgy0xO/InLd0lM3UoSlTWs62F9KA/T+bwDYzjv5g6G459HdHlkb+Ccj7HjwNFqkIXoXy4KuFYUjEVLMH/v0fiLRMf1EFT0QWSvR3hkZtfj6Fe28Vp6I6b1IRoY1pQZr4Cq9Qo6ydhjgp408CBevH+tZ0pmfKdIE6IMlAD2OwYkaxhPUKz9aqHvEuCrf8Db4Fr3+c5UfaLvBgodgqaEcgBcX/Sl/oONq3YU/bWv9ML5H1FQUvPU27+2oYZq2zrpiqLZTJl1lxiuK7UQt1PW5b09rH4QOW6GniolJ//CYuMuC94VGu9vQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=+ngsXpA9FuIr24rYVE+VwuWVf/2qnrgpZQFTbi4iEOY=; b=qdSk7PhRSx7u8EW3M8gzdwUiUhv2IOMxLmWRizpmlb7Czi1f6wyGibZixgsUAkD0x8skHAuFk7y5R7WPwO3KURwXgf2B/w3DQtxvwz4wZL/d9Q3PVRXpN+RAdWl1PSKbUzqjRn1aDvnmusq668k1NGBPYw0UUKGdjF3+3jFm9/KIkJbOhqTMvtsOjaG4V2n/Qm1zQGcVieyYfV7LGuXP6oBckHDu1sZGDqbR0T6pv8k+LemXkAvQ05rl7cKPvih6yT6oNxXiLEzy4rdyTYnuBzhCTcpfVfDY1DkkZV2NzYt5hmaC1B/T9BSSo60himxFyFhcV98WrVd1dBevD1SQHw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+ngsXpA9FuIr24rYVE+VwuWVf/2qnrgpZQFTbi4iEOY=; b=MPPVYuiS+3pXQktlqR5eSSn9vlFTtrHhfGL4NCWpNj6FYjtd/UF7EXTkDSavHmy1f/sK2vc4do+JV6JxBl/y4cj+dn1t3PWLPAY3CmQfmk36aFgkapoVLDQbq4ofKVILN7f/DM0voFcQ3VnFJFEgHz4XXm8pq82OHYyxLMN0lyv/bNo9wfK/EDOYh6EMvRnxWp/Pee6lWUrkYXWn0/jFnMUAYX9vAF0RgAwQHRHpdiUSdj9HZW8Xef1vruHesUZtvWBa0LC/XjHn3wbewM7fbN6kS6J0AGyXx2LVjEa5CNu+CwOmb3Vjn20P7DAQy6N/O3bgzMeL1dcxBH9ciXeEwg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from DS7PR12MB9473.namprd12.prod.outlook.com (2603:10b6:8:252::5) by CH3PR12MB8850.namprd12.prod.outlook.com (2603:10b6:610:167::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.71.12; Tue, 2 Jun 2026 14:40:19 +0000 Received: from DS7PR12MB9473.namprd12.prod.outlook.com ([fe80::f01d:73d2:2dda:c7b2]) by DS7PR12MB9473.namprd12.prod.outlook.com ([fe80::f01d:73d2:2dda:c7b2%5]) with mapi id 15.21.0071.014; Tue, 2 Jun 2026 14:40:19 +0000 From: Zi Yan To: Lorenzo Stoakes Cc: Andrew Morton , David Hildenbrand , Baolin Wang , "Liam R . Howlett" , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Lance Yang , SeongJae Park , Balbir Singh , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH mm-hotfixes] mm/huge_memory: use correct flags for device private PMD entry Date: Tue, 02 Jun 2026 10:40:16 -0400 X-Mailer: MailMate (2.0r6290) Message-ID: <263FB5F0-AA3C-4885-86E2-9EDB030A0CDF@nvidia.com> In-Reply-To: <20260601083044.57132-1-ljs@kernel.org> References: <20260601083044.57132-1-ljs@kernel.org> Content-Type: text/plain Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: MN2PR03CA0016.namprd03.prod.outlook.com (2603:10b6:208:23a::21) To DS7PR12MB9473.namprd12.prod.outlook.com (2603:10b6:8:252::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DS7PR12MB9473:EE_|CH3PR12MB8850:EE_ X-MS-Office365-Filtering-Correlation-Id: 1443bbd2-c863-424f-2d54-08dec0b4de89 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|1800799024|7416014|376014|22082099003|18002099003|6133799003|56012099006|11063799006|3023799007; X-Microsoft-Antispam-Message-Info: ySm2+p6wLwdA3Ayp29L/fbedKfwiK3clD5MsbkOM4AvPKUbb0S+ZJjNetH5v2HGQhv37DY8XnO2TuE24v+dbhb20TKE6ucLLuKLfsi3Wty17qM00uYetUV1gtQsPogodMJncUcdpo+LXoPb8t8aF6QGMP9MkyPMViJv71oc5CV8Oj/CCQO8EbGBCrkg31fA+Q7MNVaGgnTePXJ1EVhuG736nDN0LrGCnYhHWt1542Z+NaeN3wMn30YnAeGDPpFnM8bGQhDFHh72sEkUMjHFbuQO5HcDmfs2mDWUJaL1TBRRR4RITyUiA7L/B/P0itNJS554p8o7zogH9aqM7pwfZIPHxCJOaoVFmI9lou7G/2tjhPXsbX8xxPNMeeaobWgq6/8S1Xl87GFn3p2KVXLza0CNSLPCDKTF0EhaCMXVzUgj/36xrKSa7+bNZkU3DWGwfRC0aOvS0zdAUX53dYAgP9XUvq3MkJgXJFhsptyh59Mo9FIRGD+/41XHlh2ZCTR1s0V5CgYFtih5Rfr7zWTG7KbyHoXXQ9VEzeotJX6vPW2pJVNJu7kUbv9bfwQAaBLBMEfgw/e87vwrjsx0ZVhWeTJAXyrC/Jat/Wokago0YNNUwGm/DYJikUfUZKOm1YSLs/VyRL4LCTadJJEd5u91H51bH+Hsnm3i6fUuiZFo/2BwbKnDcthPK0XzkZTtk59O8 X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DS7PR12MB9473.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(7416014)(376014)(22082099003)(18002099003)(6133799003)(56012099006)(11063799006)(3023799007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?xn1aixkG5ZCBxkvJRBWzfsQ7u9njOpuYNO5bjQB4ORnqDVYiVSdwmKDsqxcF?= =?us-ascii?Q?fpn2FodR5zboZ0Sed0MZ9JHxnECpKQAju+tvVwRcyWhXB4+EPHzU8LGDzNXA?= =?us-ascii?Q?1TxelIYWhYVoq93Xc4goKXNmpp0g3eHrjaOuijrppegWQ0l0makiIpNW0lgR?= =?us-ascii?Q?XcnZcr1+8foybnhoNYsFCoMKwxMt1NlFCmA4tAdYK9WpbBEMUs5a1QwXpnFk?= =?us-ascii?Q?4ar32AkMWKVsNAk9H7wUHISLGaVJY4a2+jmgKg8ZrHbdQWl0aI6+HAJfivGG?= =?us-ascii?Q?imAtWvRvgXFzDUAkpmPKRTUmk3GFTHHGcxRRG7tWufRiCb/9Y/RGOxw314xa?= =?us-ascii?Q?8cj2U0xHcU6ATxDhWf5gxqmM4+Ae68Dc97XojgxBQPJegbw1k7zKBRJAkkO1?= =?us-ascii?Q?1o7mGLA3czSCOhqXuIsnJM7wrigBRgcP/Xx8FgrGDDdH1xxdcayUvASZsuPu?= =?us-ascii?Q?kclR3lYx+bDDuSKKJHng9WhQTdNMtgrZ96gZoSipsERgz25nk2zxFbuF6yHN?= =?us-ascii?Q?cud2WCKLrb/i327XwbTg1GeEDoXKzRKTGJkbWeynbB2Q+Fgd6mLa81AHbVBb?= =?us-ascii?Q?vO3i0GpUCQbTdHThAc2aQBxBs4hl5cE6XsBYnXvs+zpCyHw3DBb3Sn5kB8U/?= =?us-ascii?Q?AuLaXeZpJfzyMo9yGWFBjxzD3ytgwKqRMoV7RqORjvTDfh0YM9CeQDGpUOBA?= =?us-ascii?Q?5ikrv0+4fkgFBUmNdiqBtVeD96PGyAoS8x2WJOkyRpdscS5EM3sype1B4bXU?= =?us-ascii?Q?Tmg5nk3GCCipr43Po5TpipB0jCiFQRxNQ3y0BLmGRE40Yg2Olt6+CcMgBZSK?= =?us-ascii?Q?KR8cCcQR8/SnBC5eq/m12+Gk21bI0wpPju8oix7p+mVrJ420X+KXdGsxIpGz?= =?us-ascii?Q?68Hc05PrT3dU1LmvwUJnRAWWbFPSia44LBnaGsXTSk8dVHZbqXmOZUUWkj3i?= =?us-ascii?Q?lodQxiUlgRAC+Phio+K/aD7VzSgRbAMyZwYBJWQWsZqgBkeilqyoT4ijxZwZ?= =?us-ascii?Q?QbHSDG7k3IYY0Lh0VhCDXYLAbWsK599oUyr3l1bT37lgvPYECwYujUtoylEG?= =?us-ascii?Q?8wGcC29Ql0aI0S/n9Wr3MNERBCwHtErFlTZ77V8OEaauxogfaSySE9GeN+NX?= =?us-ascii?Q?PLZqG+GIk2ujmalHOgmk6Mx6JyI6pYIzJW6nrK7MDnzQAxuC3x7X+dUK0B1e?= =?us-ascii?Q?5pzBbtipHnYmJ3fOiOj2XJD3fcAr2NxcoUSazUJNJcYqHfZ+/CnO/2LDW39v?= =?us-ascii?Q?tMMrXNJhlC25TdHTPduPESRT6jljwCRKJusqEiFBJShniN60YX/u8kIye9if?= =?us-ascii?Q?OwjzKNnY2KdVl2g2Q23JqZx+c/a0C9Hn1uS7ETdb5nZhBC4GRrbotrOXcq1s?= =?us-ascii?Q?lH4rh7H9Gv5yLujdhmZuHj2MR82MhEH/A3UGyUBW3iCih2g+JPVDNA1RzfEp?= =?us-ascii?Q?BcAK69A5eXWR8fmq/9XmE+Syif95yYMvROAsnR9AsPPlv4nyEEgi07/bv8n2?= =?us-ascii?Q?Trzsh4iDQZhXkX1i5dsASFWKvlK49TnO3Nm0qnT0XKKoDn6bRoLLrn4OH2vU?= =?us-ascii?Q?IQvDwdQJ5mAu1SgsufuK2AtrBYrfrn0ERvjG7FEpu8fnqlAPbkCQWzUHH+4i?= =?us-ascii?Q?5ydhguKVjFdmirYqzRxNr3QO9cxaS0h18xF7WOcUH+eCGo9V3EhKW9/leoFC?= =?us-ascii?Q?c7kcqOMyCTRUvbgSOGA4C6gRtfdIcpTdYZZwsPzy3yKQHO33?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1443bbd2-c863-424f-2d54-08dec0b4de89 X-MS-Exchange-CrossTenant-AuthSource: DS7PR12MB9473.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Jun 2026 14:40:19.5014 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: jrRtVmyRRcmRohJAxxKs1dlVKVgnq73rGTAru45yc7AFltaZOGJlO8DK/hbZ+x82 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR12MB8850 On 1 Jun 2026, at 4:30, Lorenzo Stoakes wrote: > Commit 65edfda6f3f2 ("mm/rmap: extend rmap and migration support > device-private entries") updated set_pmd_migration_entry() to use > pmdp_huge_get_and_clear() in the softleaf case, but made no further > adjustments to the function itself. > > Therefore this function continues to incorrectly use pmd_write(), > pmd_soft_dirty() and pmd_uffd_wp() to determine whether the installed > migration entry should be marked writable, softdirty or uffd-wp > respectively. > > Whilst all are incorrect, the most problematic of these is pmd_write(),= as > this can lead to corrupted rmap state. > > On x86-64 _PAGE_SWP_SOFT_DIRTY is aliased to _PAGE_RW. So calling > pmd_write() on a softleaf will return the softdirty state encoded in th= e > entry, assuming CONFIG_MEM_SOFT_DIRTY was enabled. > > This was observed when running the hmm.hmm_device_private.anon_write_ch= ild > selftest: > > 1. The test faults in a range then migrates it such that a device-priva= te > THP range is established. > > 2. The parent then migrates it to a device-private writable PMD entry w= hose > folio is entirely AnonExclusive with entire_mapcount=3D1, softdirty = set > (accidentally correct write state). > > 3. The parent forks and the PMD entries are set to device-private read = only > entries, entire_mapcount=3D2, softdirty still set. > > 4. [BUG] The child writes to the range then migrates to RAM - intending= to > install non-writable migration entries - but replacing parent and ch= ild > PMD mappings with WRITABLE entries due to misinterpreting the softdi= rty > bit. > > 5. In remove_migration_pmd(), if !softleaf_is_migration_read(entry) we > set the RMAP_EXCLUSIVE flag when calling folio_add_anon_rmap_pmd() f= or > both parent and child, which are therefore AnonExclusive. > > 6. [SPLAT] Child sets migrated folio entire_mapcount=3D1, parent sets > entire_mapcount=3D2 and we end up with an AnonExclusive folio with > entire_mapcount=3D2! Assert fires in __folio_add_anon_rmap(): > > VM_WARN_ON_FOLIO(folio_test_large(folio) && > folio_entire_mapcount(folio) > 1 && > PageAnonExclusive(cur_page), folio) > > This patch fixes the issue by correctly referencing the softleaf entry > fields for writable, softdirty and uffd-wp in set_pmd_migration_entry()= =2E > > It also only updates A/D flags if the entry is present as these are > otherwise not meaningful for a softleaf entry. > > This patch also flips the if (!present) { ... } else { ... } logic in > set_pmd_migration_entry() so it is easier to understand, and adds some > comments to make things clearer. > > I was able to bisect this to commit 775465fd26a3 ("lib/test_hmm: add zo= ne > device private THP test infrastructure") which first exposes this bug a= s it > was the commit that permitted test_hmm to generate the test. > > However commit 65edfda6f3f2 ("mm/rmap: extend rmap and migration suppor= t > device-private entries") is the commit that actually enabled this > behaviour. Thanks for the detailed explanation. > > Fixes: 65edfda6f3f2 ("mm/rmap: extend rmap and migration support device= -private entries") > Cc: stable@vger.kernel.org > Signed-off-by: Lorenzo Stoakes > --- > mm/huge_memory.c | 45 +++++++++++++++++++++++++++++++++------------ > 1 file changed, 33 insertions(+), 12 deletions(-) > > diff --git a/mm/huge_memory.c b/mm/huge_memory.c > index bf9b480bb3b0..79463c709c98 100644 > --- a/mm/huge_memory.c > +++ b/mm/huge_memory.c > @@ -4982,7 +4982,7 @@ int set_pmd_migration_entry(struct page_vma_mappe= d_walk *pvmw, > struct vm_area_struct *vma =3D pvmw->vma; > struct mm_struct *mm =3D vma->vm_mm; > unsigned long address =3D pvmw->address; > - bool anon_exclusive; > + bool anon_exclusive, present, writable, softdirty, uffd_wp; > pmd_t pmdval; > swp_entry_t entry; > pmd_t pmdswp; > @@ -4990,12 +4990,26 @@ int set_pmd_migration_entry(struct page_vma_map= ped_walk *pvmw, > if (!(pvmw->pmd && !pvmw->pte)) > return 0; > > - flush_cache_range(vma, address, address + HPAGE_PMD_SIZE); > - if (unlikely(!pmd_present(*pvmw->pmd))) > - pmdval =3D pmdp_huge_get_and_clear(vma->vm_mm, address, pvmw->pmd); > - else > + present =3D pmd_present(*pvmw->pmd); > + if (likely(present)) { > + flush_cache_range(vma, address, address + HPAGE_PMD_SIZE); > + > pmdval =3D pmdp_invalidate(vma, address, pvmw->pmd); > > + writable =3D pmd_write(pmdval); > + softdirty =3D pmd_soft_dirty(pmdval); > + uffd_wp =3D pmd_uffd_wp(pmdval); > + } else { > + softleaf_t old_entry; > + > + pmdval =3D pmdp_huge_get_and_clear(vma->vm_mm, address, pvmw->pmd); > + old_entry =3D softleaf_from_pmd(pmdval); > + > + writable =3D softleaf_is_device_private_write(old_entry); Just to make sure I get it. This means the only possible writable non present/softleaf entry is device private writable. There is writable migration entry, but since we are setting a migration entry here, that should not be possible. The patch LGTM. Thanks. Reviewed-by: Zi Yan Best Regards, Yan, Zi