Date:   Thu, 16 Dec 2021 13:38:33 +0800
From:   Peter Xu <peterx@redhat.com>
To:     Alistair Popple <apopple@nvidia.com>
Cc:     linux-mm@kvack.org, linux-kernel@vger.kernel.org,
        Axel Rasmussen <axelrasmussen@google.com>,
        Nadav Amit <nadav.amit@gmail.com>,
        Mike Rapoport <rppt@linux.vnet.ibm.com>,
        Hugh Dickins <hughd@google.com>,
        Mike Kravetz <mike.kravetz@oracle.com>,
        "Kirill A . Shutemov" <kirill@shutemov.name>,
        Jerome Glisse <jglisse@redhat.com>,
        Matthew Wilcox <willy@infradead.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        David Hildenbrand <david@redhat.com>,
        Andrea Arcangeli <aarcange@redhat.com>
Subject: Re: [PATCH v6 03/23] mm: Check against orig_pte for finish_fault()
Message-ID: <YbrQ2bsEYsfHrIIV@xz-m1.local>
References: <20211115075522.73795-1-peterx@redhat.com>
 <20211115075522.73795-4-peterx@redhat.com>
 <6260997.DYpkEd5BTb@nvdebian>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <6260997.DYpkEd5BTb@nvdebian>
Precedence: bulk

On Thu, Dec 16, 2021 at 04:01:47PM +1100, Alistair Popple wrote:
> On Monday, 15 November 2021 6:55:02 PM AEDT Peter Xu wrote:
> > We used to check against none pte and in those cases orig_pte should always be
> > none pte anyway.
> 
> Is that always true? From what I can see in handle_pte_fault() orig_pte only
> gets initialised in the !pmd_none() case so might not be pte_none.

I believe it's true, otherwise I must have overlooked.

IMHO it's not "when we set orig_pte" that matters - note that finish_fault()
(that this patch modifies) is only called for file-backed memories, and it's
only called in do_fault() where the pte is not mapped at all.

DAX seems to call it too, but still DAX comes from do_fault() too, afaict.

The pte will not be mapped in two cases in handle_pte_fault():

  - When pmd_none

  - When !pmd_none, however if we find that pte_none==true, that's:

        if (pte_none(vmf->orig_pte)) {
                pte_unmap(vmf->pte);
                vmf->pte = NULL;
        }

So when we're already in do_fault(), afaict, orig_pte must be pte_none().
Another side note is that, IIUC pte_none() is a looser check than the
pte_val()==0 and it should be arch dependent.

Thanks,

> 
> > This change prepares us to be able to call do_fault() on !none ptes.  For
> > example, we should allow that to happen for pte marker so that we can restore
> > information out of the pte markers.
> > 
> > Signed-off-by: Peter Xu <peterx@redhat.com>
> > ---
> >  mm/memory.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/mm/memory.c b/mm/memory.c
> > index 04662b010005..d5966d9e24c3 100644
> > --- a/mm/memory.c
> > +++ b/mm/memory.c
> > @@ -4052,7 +4052,7 @@ vm_fault_t finish_fault(struct vm_fault *vmf)
> >  				      vmf->address, &vmf->ptl);
> >  	ret = 0;
> >  	/* Re-check under ptl */
> > -	if (likely(pte_none(*vmf->pte)))
> > +	if (likely(pte_same(*vmf->pte, vmf->orig_pte)))
> >  		do_set_pte(vmf, page, vmf->address);
> >  	else
> >  		ret = VM_FAULT_NOPAGE;
> > 
> 
> 
> 
> 

-- 
Peter Xu