From nobody Mon Jun 8 07:26:55 2026 Received: from cstnet.cn (smtp25.cstnet.cn [159.226.251.25]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C0221383326 for ; Fri, 5 Jun 2026 05:24:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.25 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780637068; cv=none; b=Ok+c7vET+Mtb2ZdoRGjqIb/fEDedvJ5TOkHL9nd+ZCWHF89uUo5SiLDivDysH970HzeHhQtV46E2btxcl6OeXGZhKOeTTm8/kIcyRQAiDqe67f8i5K49uL2CbQPbirrM1nODjtW8713DOkD+iR7FeneMNOE3bwfHXg/AwdthDB8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780637068; c=relaxed/simple; bh=yBEYlHEgDI0vj83WAUPUIc/xbnDUnNEd6uo4jxXtoiY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=m8img3ZqPcEd9UpVFO68L1RWpDVSKsENhzWswGzhoWBT+PBwE/DZSNcb7nZWhhSI1LJrvcf59uNbqAig71wvyYDpqB/5adsOgkdyxU9yaszongjU/isu6NYzNes/uG7wal/Abiy6BcJvmdgVaItziVznCPAiinKDAzj7OUIozHc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.25 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from [127.0.0.2] (unknown [123.118.218.239]) by APP-05 (Coremail) with SMTP id zQCowAB3zhF1XSJqwQ1mEg--.1348S2; Fri, 05 Jun 2026 13:24:05 +0800 (CST) From: Vivian Wang Date: Fri, 05 Jun 2026 13:23:22 +0800 Subject: [PATCH v3] riscv: mm: Avoid spurious fault after hotplugging vmemmap Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260605-mark-after-vmemmap-populate-v3-1-a06001ac9264@iscas.ac.cn> X-B4-Tracking: v=1; b=H4sIAEpdImoC/42Q0U6EMBBFf4X02SGFAgvEGP/DaDK0g9tdCtiWR kP4dwtror4YH29yc+6ZWZkjq8mxNlmZpaCdnsYYxF3C5BnHVwKtYmY5zyte5iUYtFfA3pOFYMg YnGGe5mVAT1DVnTo1vBaNbFgkzJZ6/X7Qn55v2S3dhaTfkV8NS29LnPW3GuvQEcjJGO3bJJzSD KzMXtZtbxtyDg+lNrk/jAQXEDXVQHDtaZQEs518HAA3L1ZPi4Mel8FDyIFDX3NVi7KIkupRO4k uRZnK8YHtdmft/GQ/jleE7JD519UhgwyoampVl02HWfUTfZBD/k2rePE3bRfFrsKT4qIrRPGbt m3bJzrWIba0AQAA X-Change-ID: 20260525-mark-after-vmemmap-populate-68bd790839c9 To: Paul Walmsley , Palmer Dabbelt , Alexandre Ghiti , Andrew Morton , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko Cc: linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Vivian Wang X-Mailer: b4 0.15.2 X-CM-TRANSID: zQCowAB3zhF1XSJqwQ1mEg--.1348S2 X-Coremail-Antispam: 1UD129KBjvJXoWxZrWfJr1rJr1xXFy5KF1xXwb_yoWrZw4kpF Wj9wsxKFW5JryIgws7Cw12grW7t3ZY9a43Kw10k34rZrW3XFyUXwn5Ka1Utry3XFWrCa4v qan8A3yrC3WDAaDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9014x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r4j6ryUM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4j 6F4UM28EF7xvwVC2z280aVAFwI0_Cr1j6rxdM28EF7xvwVC2z280aVCY1x0267AKxVW0oV Cq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0 I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r 4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02628v n2kIc2xKxwCY1x0262kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7x kEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E 67AF67kF1VAFwI0_Jw0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCw CI42IY6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1x MIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UYxBIda VFxhVjvjDU0xZFpf9x0JUd-B_UUUUU= X-CM-SenderInfo: pzdqw2pxlnt03j6l2u1dvotugofq/ section_activate() does not flush TLB after populating new vmemmap pages. On most architectures, this is okay. However it is a problem on RISC-V since there the TLB caching non-present entries is permitted, which causes spurious faults on some hardwares. This seems to be most easily reproduced with DEBUG_VM=3Dy and PAGE_POISONING=3Dy, which causes these newly mapped struct pages to be poisoned i.e. written to immediately after mapping. Add a hook vmemmap_populate_finalize() in __populate_section_memmap() after population, to allow architectures to handle such situations as needed. Then implement it on RISC-V to arrange for the existing exception handler code to deal with these faults if they happen. Signed-off-by: Vivian Wang --- Depends on my earlier kfence fixes for mark_new_valid_map() [1]. Found while testing AMD_HSA/ZONE_DEVICE on SpacemiT K3. Using ZONE_DEVICE requires another fix [2]. [1]: https://lore.kernel.org/linux-riscv/20260303-handle-kfence-protect-spu= rious-fault-v2-0-f80d8354d79d@iscas.ac.cn [2]: https://lore.kernel.org/linux-riscv/20260309-riscv-sparsemem-vmemmap-l= imits-v1-2-f40efe18e3cd@iscas.ac.cn --- Changes in v3: - Merged back into one patch (Mike) - (No code changes otherwise.) - Link to v2: https://patch.msgid.link/20260604-mark-after-vmemmap-populate= -v2-0-ab6a7d03b434@iscas.ac.cn Changes in v2: - Split patch in two, hook point and riscv hook=20 - Explain hook necessity in patch 1 message (Mike) - Make hook #define based (Mike) - Call finalize hook only on populate success - Link to v1: https://patch.msgid.link/20260525-mark-after-vmemmap-populate= -v1-1-e698d859ba16@iscas.ac.cn --- arch/riscv/include/asm/pgtable.h | 4 ++++ arch/riscv/mm/init.c | 6 ++++++ mm/sparse-vmemmap.c | 8 ++++++++ 3 files changed, 18 insertions(+) diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgta= ble.h index a1a7c6520a09..aa0f50e3d534 100644 --- a/arch/riscv/include/asm/pgtable.h +++ b/arch/riscv/include/asm/pgtable.h @@ -1243,6 +1243,10 @@ static inline pte_t pte_swp_clear_exclusive(pte_t pt= e) #define TASK_SIZE FIXADDR_START #endif =20 +/* Needed on SPARSEMEM_VMEMMAP */ +#define vmemmap_populate_finalize vmemmap_populate_finalize +void __meminit vmemmap_populate_finalize(void); + #else /* CONFIG_MMU */ =20 #define PAGE_SHARED __pgprot(0) diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c index 706f43523935..cf9ae4099f82 100644 --- a/arch/riscv/mm/init.c +++ b/arch/riscv/mm/init.c @@ -1360,6 +1360,12 @@ int __meminit vmemmap_populate(unsigned long start, = unsigned long end, int node, */ return vmemmap_populate_hugepages(start, end, node, altmap); } + +void __meminit vmemmap_populate_finalize(void) +{ + /* Avoid faults on cached non-present TLB entries. */ + mark_new_valid_map(); +} #endif =20 #if defined(CONFIG_MMU) && defined(CONFIG_64BIT) diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c index 6eadb9d116e4..2a8b923fabe8 100644 --- a/mm/sparse-vmemmap.c +++ b/mm/sparse-vmemmap.c @@ -544,6 +544,12 @@ static int __meminit vmemmap_populate_compound_pages(u= nsigned long start_pfn, =20 #endif =20 +#ifndef vmemmap_populate_finalize +static void __meminit vmemmap_populate_finalize(void) +{ +} +#endif + struct page * __meminit __populate_section_memmap(unsigned long pfn, unsigned long nr_pages, int nid, struct vmem_altmap *altmap, struct dev_pagemap *pgmap) @@ -564,6 +570,8 @@ struct page * __meminit __populate_section_memmap(unsig= ned long pfn, if (r < 0) return NULL; =20 + vmemmap_populate_finalize(); + return pfn_to_page(pfn); } =20 --- base-commit: 254f49634ee16a731174d2ae34bc50bd5f45e731 change-id: 20260525-mark-after-vmemmap-populate-68bd790839c9 prerequisite-message-id: <20260303-handle-kfence-protect-spurious-fault-v2-= 0-f80d8354d79d@iscas.ac.cn> prerequisite-patch-id: fdc42f2647e21d111f44a6532887a6705cd470a9 prerequisite-patch-id: 096fa339c84c36643ae4311fd8362dc63e23d950 prerequisite-patch-id: 305c876a5f4a23a840a8142aea79b796ed297545 prerequisite-patch-id: d78cb55d6a616b1170f06a401c8fd44acd11e5d5 prerequisite-patch-id: b02b4a76e94f3e2821291d4c23b46f6e5ecf5203 Best regards, -- =20 Vivian Wang