[PATCH 1/1] riscv/mm: fix soft-dirty migration PMDs being treated as present

[Lance Yang]

Gently ping ... Hi RISC-V folks, any thoughts on the proposed fix?

On Sun, Oct 04, 2026 at 11:03:12AM +0800, Lance Yang wrote:
>RISC-V uses _PAGE_EXEC for swap soft-dirty tracking when
>CONFIG_MEM_SOFT_DIRTY is enabled and Svrsw60t59b is available. That's
>a problem for PMD migration entries, since pmd_present() also checks
>_PAGE_LEAF (R/W/X) to recognize THPs with _PAGE_PRESENT temporarily
>cleared during splitting.
>
>When a soft-dirty THP is migrated, set_pmd_migration_entry() preserves
>soft-dirty with pmd_swp_mksoft_dirty(), setting the X bit in the
>migration PMD. Even with _PAGE_PRESENT clear, we end up treating a
>migration PMD as a present THP! The fault handler skips
>pmd_migration_entry_wait(), and a write fault can end up in
>do_huge_pmd_wp_page(), where pmd_page() decodes the migration entry
>as a mapped PFN.
>
>Move the swap soft-dirty bit to bit 12 and start the swap offset at
>bit 13 when CONFIG_MEM_SOFT_DIRTY is enabled. This keeps R/W/X clear
>in migration PMDs and lets us keep the existing pmd_present() check
>for invalidated THPs. Leave the offset at bit 12 when soft-dirty
>tracking is disabled.
>
>Fixes: 2a3ebad4db63 ("riscv: mm: add soft-dirty page tracking support")
>Cc: stable at vger.kernel.org
>Signed-off-by: Lance Yang <lance.yang at linux.dev>
>---
>I found this while reviewing Usama's PMD-level swap entries series [1]
>and comparing the swap flag bits with the PMD presence checks across
>architectures.
>
>[1] https://lore.kernel.org/all/20261002095503.3585565-1-usama.arif@linux.dev/
>
> arch/riscv/include/asm/pgtable-bits.h |  6 +++---
> arch/riscv/include/asm/pgtable.h      | 10 ++++++----
> 2 files changed, 9 insertions(+), 7 deletions(-)
>
>diff --git a/arch/riscv/include/asm/pgtable-bits.h b/arch/riscv/include/asm/pgtable-bits.h
>index d5a86b4df3ce6..d84b459e010c1 100644
>--- a/arch/riscv/include/asm/pgtable-bits.h
>+++ b/arch/riscv/include/asm/pgtable-bits.h
>@@ -27,12 +27,12 @@
> 	((riscv_has_extension_unlikely(RISCV_ISA_EXT_SVRSW60T59B)) ?	\
> 	 (1UL << 59) : 0)
> /*
>- * Bit 3 is always zero for swap entry computation, so we
>- * can borrow it for swap page soft-dirty tracking.
>+ * Bit 12 is reserved for swap soft-dirty tracking. The swap offset
>+ * starts at bit 13 when CONFIG_MEM_SOFT_DIRTY is enabled.
>  */
> #define _PAGE_SWP_SOFT_DIRTY						\
> 	((riscv_has_extension_unlikely(RISCV_ISA_EXT_SVRSW60T59B)) ?	\
>-	 _PAGE_EXEC : 0)
>+	 (1UL << 12) : 0)
> #else
> #define _PAGE_SOFT_DIRTY	0
> #define _PAGE_SWP_SOFT_DIRTY	0
>diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
>index b644db16bda94..acaf6d3b54d04 100644
>--- a/arch/riscv/include/asm/pgtable.h
>+++ b/arch/riscv/include/asm/pgtable.h
>@@ -1178,18 +1178,20 @@ static inline pud_t pud_modify(pud_t pud, pgprot_t newprot)
>  *
>  * Format of swap PTE:
>  *	bit            0:	_PAGE_PRESENT (zero)
>- *	bit       1 to 2:	(zero)
>- *	bit            3:	_PAGE_SWP_SOFT_DIRTY
>+ *	bit       1 to 3:	_PAGE_LEAF (zero)
>  *	bit            4:	_PAGE_SWP_UFFD
>  *	bit            5:	_PAGE_PROT_NONE (zero)
>  *	bit            6:	exclusive marker
>  *	bits      7 to 11:	swap type
>- *	bits 12 to XLEN-1:	swap offset
>+ *	bit           12:	_PAGE_SWP_SOFT_DIRTY (CONFIG_MEM_SOFT_DIRTY)
>+ *	bits 12/13 to XLEN-1:	swap offset (without/with CONFIG_MEM_SOFT_DIRTY)
>  */
> #define __SWP_TYPE_SHIFT	7
> #define __SWP_TYPE_BITS		5
> #define __SWP_TYPE_MASK		((1UL << __SWP_TYPE_BITS) - 1)
>-#define __SWP_OFFSET_SHIFT	(__SWP_TYPE_BITS + __SWP_TYPE_SHIFT)
>+#define __SWP_OFFSET_SHIFT \
>+	(__SWP_TYPE_BITS + __SWP_TYPE_SHIFT + \
>+	 IS_ENABLED(CONFIG_MEM_SOFT_DIRTY))
> 
> #define MAX_SWAPFILES_CHECK()	\
> 	BUILD_BUG_ON(MAX_SWAPFILES_SHIFT > __SWP_TYPE_BITS)
>-- 
>2.49.0
>
>