From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C86FAC3DA60 for ; Thu, 18 Jul 2024 09:39:23 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 56F316B0085; Thu, 18 Jul 2024 05:39:23 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 51EEC6B0088; Thu, 18 Jul 2024 05:39:23 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 40D896B0089; Thu, 18 Jul 2024 05:39:23 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 23B216B0085 for ; Thu, 18 Jul 2024 05:39:23 -0400 (EDT) Received: from smtpin01.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id B69771A1A96 for ; Thu, 18 Jul 2024 09:39:22 +0000 (UTC) X-FDA: 82352375364.01.D97E4C1 Received: from mail.marcansoft.com (marcansoft.com [212.63.210.85]) by imf06.hostedemail.com (Postfix) with ESMTP id B4D77180009 for ; Thu, 18 Jul 2024 09:39:19 +0000 (UTC) Authentication-Results: imf06.hostedemail.com; dkim=pass header.d=asahilina.net header.s=default header.b=dW4Kbg8L; spf=pass (imf06.hostedemail.com: domain of lina@asahilina.net designates 212.63.210.85 as permitted sender) smtp.mailfrom=lina@asahilina.net; dmarc=pass (policy=quarantine) header.from=asahilina.net ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1721295520; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=i905wGo7O08ugcDfQEcQaVCVd01uhM/jJcAzApKlFY4=; b=udK1U3xz6ITtCjgb3m55BX3w8xHPRiFGNVmGragxYpvoZk8Wnvtc/zTKgRQOIyiOht9oe2 9LzJWKYuoVlsz/L7V+Se7F3WN7kroDWmUiJCb05RB4G+2O1v5kRLEY4Ck7i6uqVHSR9eIa eWEbsCOQueze/IZyHIiz0J3PBqVwRaA= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1721295520; a=rsa-sha256; cv=none; b=c2b1LY6AKfljFT8z8d5EmyzvZx6hAoDHBHeSh+IGrwBGbzNEfOKlKokBxp1luBTQMCTE/K iQ803GSPpPut9nhXYMhuBJLj39w+rx5ER9o4K4E4dXzM2saSqCYzJgUaK1oCyS9FaCJ3zr roAk5JCyVa4Bk/Zi5pXrsP2KLpprw4Y= ARC-Authentication-Results: i=1; imf06.hostedemail.com; dkim=pass header.d=asahilina.net header.s=default header.b=dW4Kbg8L; spf=pass (imf06.hostedemail.com: domain of lina@asahilina.net designates 212.63.210.85 as permitted sender) smtp.mailfrom=lina@asahilina.net; dmarc=pass (policy=quarantine) header.from=asahilina.net Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: lina@asahilina.net) by mail.marcansoft.com (Postfix) with ESMTPSA id E194542A6F; Thu, 18 Jul 2024 09:39:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=asahilina.net; s=default; t=1721295556; bh=Qkdjuh70RCJPvujNbOCNmR9yHLaw3LN+OKruVzEdynk=; h=Date:To:From:Subject:Cc; b=dW4Kbg8LSKomT59k3hq7rYttO0l+C30aNIAV4nLNUIuqzSwpQfDgG/6R2XDuJtkv0 mQ6ZjcmoKs5SgOIsYbTc0TZVgjaRVy62i0RVFCvSuOGZYlbwlngCfXyLHdwH9KgxQJ bRyJUv2sJBPZGWizsfWwc2F8h/gBaJzp/kYHcmuLGeNd2CEJWLowrROcVJ4uAwzEQp xx1yL6FdajGiB8bgTBysQdcwW5de7+WMTw3SGekkrUpjFydUnUCgWLv/MMxasTIn5a ur0EAhuDbZFZ/Qu5d1YArjlGWSFAxphgV9Xq8cMx2rjqxwz9037e0ecXjZRqvu+/RZ UABhrkNlEOknQ== Message-ID: <50360968-13fb-4e6f-8f52-1725b3177215@asahilina.net> Date: Thu, 18 Jul 2024 18:39:10 +0900 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: linux-mm@kvack.org, linux-kernel@vger.kernel.org, asahi@lists.linux.dev, linux-arm-kernel@lists.infradead.org From: Asahi Lina Subject: LPA2 on non-LPA2 hardware broken with 16K pages Cc: Catalin Marinas , Will Deacon Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: B4D77180009 X-Stat-Signature: ua3zhz8grkkf3ohxp1impazjg5iajat7 X-Rspamd-Server: rspam09 X-Rspam-User: X-HE-Tag: 1721295559-689749 X-HE-Meta: U2FsdGVkX1+RId0NV9hwK7hTQccEzt2NighNhAgFTow0FGnu6Fyy+CGdo4CxO97bBuYhhmwLTxGNSYoXwP1GpmxsG3pZBVR6Erk4ETwhocedZKD0ZEjOfO/MILoIvVMyayCyi9BrgOvAiXUjInz/ADb5QjoAw5/+SOWTHclsdF72l1SvJSm/fKs/pqSt8r+b4DU1B2C+nHv/GuiMG6aFSvfwzJXhVTg6cyeKBDYI+cYBCqQi53ExSA8267YJIZ94QAYzF5ClHgndaBkigHKDCLor+9f9vpT8TzqrPgU/pU5Q0SKFFNcG8vwc+hC/cY3TDln7IVSA6mHyjFNZm9pYGu6CtPDDRvSEoEZ30xtv3dCgKGBVViIgnSd1tPno4xp1YzImTTapdA4yxhyOnOUgJIF1Y7oCX5sCB6esXL0P+c7EXueWtAYker/CN32rBpx0Zud6jbWH7x/4NefPLJsHht7xaue9YCzLpvq97WPv1vIAte2+Utn+JSSWiVXGXfX9MnoCIzWHuRarAqvjq2PocblbYmME+P2SfaKEKeLDcSNgBaxwnNsWSpO1h91XWDn+9pp7FHLLasLnb/d3AqkNKRrKY2Kb8bNvTkK7HuOv9VRZHWTyNmLI97rFCbvkiV9ZP7EyeQk5UMrAArzkijm64HLT0tv20Gpy9RF53SyuxkUYpWxSK4nO9IIznqu4NqkreMfx/FiXbpLH6sh3ej3xfKS+PT/0gqxDosw8BqX0vLFDvUM1d24zPwZHIOiRGi1tT8zvnGhq7NEa6nxgOEzf33W+lEEZNlaW7+mIO8Bo61x7u4lFiIDoEi3xx9J5agGbcRcGzxBKKT7Aq3pqvpA3oHUO0qWjLPiFiDTz6biEr0rm9pps6UcT6eiqcxX7yRL3ILIqpQAAzWFqrz841FO7uLVoItxnpLAyGghErjJ/dm1EAHOmnsNilyTzMvh2lAiQxbTAdlkmpjuOSF4iZRW 3QGBZHA0 IReNOHbH2UYmGrWGnjZ/EkDxw2lWT9ITPtpYFhbs+cXt1/HXaISQsvyZJtQZoihZrZeyhfAViQj1W+izq0FBlC+a/wrt9ZU3ZOjPD7AyXeH6VLgYd267bY5ez8+RC4HDCAIfKxBMlJ2MGuqjdsOySuqfctZE2qXiKkBnIZmnoXPzMr0d6JicODh8IwB4ZaHxByaEWnM9wnT8INb5/RVNc2R7T0n5UMqzEA6acz5AYuMe2njMdjXfSnDc1MLbzg2i/w9dX X-Bogosity: Ham, tests=bogofilter, spamicity=0.000008, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Hi, I ran into this with the Asahi Linux downstream kernel, based on v6.9.9, but I believe the problem is also still upstream. The issue seems to be an interaction between folding one page table level at compile time and another one at runtime. With this config, we have: CONFIG_PGTABLE_LEVELS=4 PAGE_SHIFT=14 PMD_SHIFT=25 PUD_SHIFT=36 PGDIR_SHIFT=47 pgtable_l5_enabled() == false (compile time) pgtable_l4_enabled() == false (runtime, due to no LPA2) With p4d folded at compile-time, and pud folded at runtime when LPA2 is not supported. With this setup, pgd_offset() is broken since the pgd is actually supposed to become a pud but the shift is wrong, as it is set at compile time: #define pgd_index(a) (((a) >> PGDIR_SHIFT) & (PTRS_PER_PGD - 1)) static inline pgd_t *pgd_offset_pgd(pgd_t *pgd, unsigned long address) { return (pgd + pgd_index(address)); }; Then we follow the gup logic (abbreviated): gup_pgd_range: pgdp = pgd_offset(current->mm, addr); pgd_t pgd = READ_ONCE(*pgdp); At this point, pgd is just the 0th entry of the top level page table (since those extra address bits will always be 0 for valid 47-bit user addresses). p4d then gets folded via pgtable-nop4d.h: gup_p4d_range: p4dp = p4d_offset_lockless(pgdp, pgd, addr); = p4d_offset(&(pgd), address) = &pgd p4d_t p4d = READ_ONCE(*p4dp); Now we have p4dp = stack address of pgd, and p4d = pgd. gup_pud_range: pudp = pud_offset_lockless(p4dp, p4d, addr); -> if (!pgtable_l4_enabled()) = p4d_to_folded_pud(p4dp, addr); = (pud_t *)PTR_ALIGN_DOWN(p4dp, PAGE_SIZE) + pud_index(addr); pud_t pud = READ_ONCE(*pudp); Which is bad pointer math because it only works if p4dp points to a real page table entry inside a page table, not a single u64 stack address. This causes random oopses in internal_get_user_pages_fast and related codepaths. ~~ Lina