From: Jason Gunthorpe <jgg@ziepe.ca>
To: Sean Christopherson <sean.j.christopherson@intel.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>,
"Longpeng (Mike,
Cloud Infrastructure Service Product Dept.)"
<longpeng2@huawei.com>,
akpm@linux-foundation.org, kirill.shutemov@linux.intel.com,
linux-kernel@vger.kernel.org, arei.gonglei@huawei.com,
weidong.huang@huawei.com, weifuqiang@huawei.com,
kvm@vger.kernel.org, linux-mm@kvack.org,
Matthew Wilcox <willy@infradead.org>,
stable@vger.kernel.org
Subject: Re: [PATCH v2] mm/hugetlb: fix a addressing exception caused by huge_pte_offset()
Date: Mon, 23 Mar 2020 13:44:03 -0300 [thread overview]
Message-ID: <20200323164403.GZ20941@ziepe.ca> (raw)
In-Reply-To: <20200323144030.GA28711@linux.intel.com>
On Mon, Mar 23, 2020 at 07:40:31AM -0700, Sean Christopherson wrote:
> On Sun, Mar 22, 2020 at 07:54:32PM -0700, Mike Kravetz wrote:
> > On 3/22/20 7:03 PM, Longpeng (Mike, Cloud Infrastructure Service Product Dept.) wrote:
> > >
> > > On 2020/3/22 7:38, Mike Kravetz wrote:
> > >> On 2/21/20 7:33 PM, Longpeng(Mike) wrote:
> > >>> From: Longpeng <longpeng2@huawei.com>
> > I have not looked closely at the generated code for lookup_address_in_pgd.
> > It appears that it would dereference p4d, pud and pmd multiple times. Sean
> > seemed to think there was something about the calling context that would
> > make issues like those seen with huge_pte_offset less likely to happen. I
> > do not know if this is accurate or not.
>
> Only for KVM's calls to lookup_address_in_mm(), I can't speak to other
> calls that funnel into to lookup_address_in_pgd().
>
> KVM uses a combination of tracking and blocking mmu_notifier calls to ensure
> PTE changes/invalidations between gup() and lookup_address_in_pgd() cause a
> restart of the faulting instruction, and that pending changes/invalidations
> are blocked until installation of the pfn in KVM's secondary MMU completes.
>
> kvm_mmu_page_fault():
>
> mmu_seq = kvm->mmu_notifier_seq;
> smp_rmb();
>
> pfn = gup(hva);
>
> spin_lock(&kvm->mmu_lock);
> smp_rmb();
> if (kvm->mmu_notifier_seq != mmu_seq)
> goto out_unlock: // Restart guest, i.e. retry the fault
>
> lookup_address_in_mm(hva, ...);
It works because the mmu_lock spinlock is taken before and after any
change to the page table via invalidate_range_start/end() callbacks.
So if you are in the spinlock and mmu_notifier_count == 0, then nobody
can be writing to the page tables.
It is effectively a full page table lock, so any page table read under
that lock do not need to worry about any data races.
Jason
next prev parent reply other threads:[~2020-03-23 16:44 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-22 3:33 [PATCH v2] mm/hugetlb: fix a addressing exception caused by huge_pte_offset() Longpeng(Mike)
2020-03-21 23:38 ` Mike Kravetz
2020-03-23 2:03 ` Longpeng (Mike, Cloud Infrastructure Service Product Dept.)
2020-03-23 2:54 ` Mike Kravetz
2020-03-23 3:43 ` Longpeng (Mike, Cloud Infrastructure Service Product Dept.)
2020-03-23 14:40 ` Sean Christopherson
2020-03-23 16:44 ` Jason Gunthorpe [this message]
2020-03-23 16:09 ` Jason Gunthorpe
2020-03-23 17:27 ` Mike Kravetz
2020-03-23 18:07 ` Jason Gunthorpe
2020-03-23 20:35 ` Mike Kravetz
2020-03-23 22:52 ` Jason Gunthorpe
2020-03-24 2:37 ` Longpeng (Mike, Cloud Infrastructure Service Product Dept.)
2020-03-24 11:55 ` Jason Gunthorpe
2020-03-24 15:25 ` Mike Kravetz
2020-03-24 15:55 ` Jason Gunthorpe
2020-03-24 16:19 ` Mike Kravetz
2020-03-24 17:59 ` Jason Gunthorpe
2020-03-24 19:47 ` Mike Kravetz
2020-02-22 5:23 Qian Cai
2020-02-22 6:33 ` Longpeng (Mike)
2020-02-22 11:50 ` Qian Cai
2020-02-22 17:02 ` Matthew Wilcox
2020-02-23 1:24 ` Longpeng (Mike)
2020-02-27 21:41 ` Mike Kravetz
2020-03-21 22:46 ` Andrew Morton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200323164403.GZ20941@ziepe.ca \
--to=jgg@ziepe.ca \
--cc=akpm@linux-foundation.org \
--cc=arei.gonglei@huawei.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=longpeng2@huawei.com \
--cc=mike.kravetz@oracle.com \
--cc=sean.j.christopherson@intel.com \
--cc=stable@vger.kernel.org \
--cc=weidong.huang@huawei.com \
--cc=weifuqiang@huawei.com \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).