Received-SPF: pass (google.com: domain of linux-kernel+bounces-39122-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
From: Jason Andryuk <jandryuk@gmail.com>
To: linux-kernel@vger.kernel.org
Cc: Jason Andryuk <jandryuk@gmail.com>,
	Dave Hansen <dave.hansen@linux.intel.com>,
	Andy Lutomirski <luto@kernel.org>,
	Peter Zijlstra <peterz@infradead.org>,
	Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>,
	Borislav Petkov <bp@alien8.de>,
	x86@kernel.org,
	"H. Peter Anvin" <hpa@zytor.com>
Subject: [PATCH] x86/mm/cpa-test: Ensure pfn isn't already in use
Date: Thu, 25 Jan 2024 13:28:35 -0500
Message-ID: <20240125182837.52467-1-jandryuk@gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Ensure pfn isn't already in use before assigning to addr[i].  Retry if
in use.  The subsequent pfns were checked against the bitmap, but not
the initial selection.

This prevents some false positives on a machine with a small amount of
RAM where pfn collisions are more likely to be seen.

A Xen HVM first showed:
[ 3640.227939] CPA ffff88800869c000: bad pte 800000000869c163
[ 3640.227982] CPA ffff88800104e000: bad pte 800000000104e161

Testing this patch with a Xen PV guest with one 192MB of RAM showed
varying numbers of addresses like:
[ 2768.082971] CPA test 5 pfn 930d in use

Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
---
This could infinite loop on a machine with a small amount of RAM - is
that worth handling?  Just skip an in-use pfn instead?
---
 arch/x86/mm/pat/cpa-test.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/arch/x86/mm/pat/cpa-test.c b/arch/x86/mm/pat/cpa-test.c
index ad3c1feec990..bbf337e3e246 100644
--- a/arch/x86/mm/pat/cpa-test.c
+++ b/arch/x86/mm/pat/cpa-test.c
@@ -136,7 +136,14 @@ static int pageattr_test(void)
 	failed += print_split(&sa);
 
 	for (i = 0; i < NTEST; i++) {
-		unsigned long pfn = get_random_u32_below(max_pfn_mapped);
+		unsigned long pfn;
+
+ retry:
+		pfn = get_random_u32_below(max_pfn_mapped);
+		if (test_bit(pfn, bm)) {
+			pr_debug("CPA test %d pfn %lx in use\n", i, pfn);
+			goto retry;
+		}
 
 		addr[i] = (unsigned long)__va(pfn << PAGE_SHIFT);
 		len[i] = get_random_u32_below(NPAGES);
-- 
2.43.0