From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id C456038F233 for ; Mon, 22 Jun 2026 08:14:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782116099; cv=none; b=oIZ0K2+6jpZaXrn1qcn3Q3yGKv6H/9cUpj8oXL4nhQ9sLnIO9FlrdT5st0uVD7OR5ViMX2bi3YENdLKWaHUNE1WmQCDhFP4FNjLLFkl9MMxULbBWP2aMNmIIwjSC9EkCdookLUsFSJNo+Y5O9Jz5XrCH+ggMKMw/+MrwJkRWNLk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782116099; c=relaxed/simple; bh=kfN/FpTa765EpipB1e7lODEHn3FZOJnKInx4uJ85UO0=; h=Message-ID:Date:MIME-Version:Subject:From:To:Cc:References: In-Reply-To:Content-Type; b=lu+Wu/gDNGg/u9e7b63h9UucT8vIMCjfHSjcaR97/xONP8auVIJg4aOZ+kcsNIBqRTBQmF/QM23EsEaBhKdyW2fgBFYT4HLk4eLAkOthoLXAr+sEp09/PNnJsFS91rtcMaaaJOt8pjDjcT69rPAof7lD3EWat+rhzpkkQ/Ptjyc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b=gnp3IodP; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b="gnp3IodP" Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 5DFCE1BF7; Mon, 22 Jun 2026 01:14:52 -0700 (PDT) Received: from [10.164.19.14] (unknown [10.164.19.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 4C9523F632; Mon, 22 Jun 2026 01:14:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1782116097; bh=kfN/FpTa765EpipB1e7lODEHn3FZOJnKInx4uJ85UO0=; h=Date:Subject:From:To:Cc:References:In-Reply-To:From; b=gnp3IodPrm2sqVyqDQ7j95a2oBiRhHNNKL3rqJyJjVEA3HbvOS/+rOU/vexI9+H1u rHl+MtXyGAfJLWBIjr/V8D80HxS5qUYAMNAc1XZ18u5gnryrxrPw/IoYe4NjvT9wDo /5YcudYDmBmUay6rByCKKgj18d6G6W6MWY7HjsUg= Message-ID: Date: Mon, 22 Jun 2026 13:44:46 +0530 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v4 02/12] mm/rmap: Add try_to_unmap_hugetlb_one From: Dev Jain To: Lance Yang , "David Hildenbrand (Arm)" Cc: akpm@linux-foundation.org, ljs@kernel.org, chrisl@kernel.org, kasong@tencent.com, hughd@google.com, liam@infradead.org, riel@surriel.com, vbabka@kernel.org, harry@kernel.org, jannh@google.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, rppt@kernel.org, surenb@google.com, mhocko@suse.com, qi.zheng@linux.dev, shakeel.butt@linux.dev, baohua@kernel.org, axelrasmussen@google.com, yuanchu@google.com, weixugc@google.com, shikemeng@huaweicloud.com, nphamcs@gmail.com, bhe@redhat.com, youngjun.park@lge.com, baolin.wang@linux.alibaba.com, pfalcato@suse.de, ryan.roberts@arm.com, anshuman.khandual@arm.com References: <20260618074449.24974-1-lance.yang@linux.dev> <0fe2a584-c633-4f82-8c47-d204e3b39a57@linux.dev> <22613c23-612b-4de0-8731-00ad2da63eae@linux.dev> Content-Language: en-US In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On 22/06/26 1:43 pm, Dev Jain wrote: > > > On 18/06/26 3:31 pm, Lance Yang wrote: >> >> >> On 2026/6/18 17:43, David Hildenbrand (Arm) wrote: >>> On 6/18/26 11:09, Lance Yang wrote: >>>> >>>> >>>> On 2026/6/18 15:55, David Hildenbrand (Arm) wrote: >>>>>>      return __rste_to_pte(pte_val(*ptep)); >>>>>> } >>>>>> >>>>>> >>>>>> So plain ptep_get() can feed raw huge-entry bits into pte_pfn(), and the >>>>>> derived subpage can be wrong. >>>>> >>>>> Good question which impact that might have in practice? >>>> >>>> The subpage check can warn, but we still pass that subpage to >>>> make_hwpoison_entry(). So the hwpoison marker can end up with the >>>> wrong PFN? >>>> >>>> +    subpage = folio_page(folio, pte_pfn(pteval) - folio_pfn(folio)); >>>> +    VM_WARN_ON(folio_page(folio, 0) != subpage); >>>> [...] >>>> +    pteval = swp_entry_to_pte(make_hwpoison_entry(subpage)); >>> >>> My s390x page table knowledge is a bit rusty. >>> >>> IIUC, it would be a problem if some PTE bits in segment/region entries (pmd/pud/ >>> ...) would pass the >>> >>>      pte_pfn(x) -> (pte_val(x) >> PAGE_SHIFT) >>> >>> check. I don't think this applies, because >>> >>> While >>>     #define _SEGMENT_ENTRY_ORIGIN_LARGE ~0xfffffUL >>> >>> We also have >>> >>>     #define _SEGMENT_ENTRY_ORIGIN ~0x7ffUL >>> >>> So these bits are not actually used. >>> >>> What __rste_to_pte() primarily does is reshuffling present bits etc. >>> >>> So using any other bits besides the PFN would be problematic I guess. >>> >>> Am I wrong or isn't the present bit already at a different location? For >>> prot-none hugetlb folios there might be a real issue, as the PTE present bit >>> corresponds to the PMD/PUD read-permission bit. >>> >>> >>> Oh my :) >>> >>> So yeah, we should probably fix that ahead of time unless I am missing >>> something? Good that we separate that hugetlb crap out. >> >> Yeah, looks like this was already there before the split. Should this >> be fixed separately? > > Same bug is there in try_to_migrate_one(), check_pte(), remove_migration_pte() > and prot_none_hugetlb_entry() :) > Lemme send a series for them. Main thing is identifying the fixes tag really. > >