On Wed, Dec 9, 2020 at 8:40 AM Will Deacon <will@xxxxxxxxxx> wrote: > > @@ -3978,8 +3994,17 @@ static vm_fault_t do_fault_around(struct vm_fault *vmf) > > /* check if the page fault is solved */ > vmf->pte -= (vmf->address >> PAGE_SHIFT) - (address >> PAGE_SHIFT); > - if (!pte_none(*vmf->pte)) > - ret = VM_FAULT_NOPAGE; > + if (pte_none(*vmf->pte)) > + goto out_unlock; > + > + if (vmf->flags & FAULT_FLAG_PREFAULT_OLD) { > + pte_t pte = pte_mkyoung(*vmf->pte); > + if (ptep_set_access_flags(vmf->vma, address, vmf->pte, pte, 0)) > + update_mmu_cache(vmf->vma, address, vmf->pte); > + } Oh, please dear God no. First you incorrectly set it old, and then you conditionally make it young again and as a result force an atomic rwm update and another TLB flush for no good reason. Just make sure that the FAULT_FLAG_PREFAULT_OLD never sets the *actual* address to old. And yes, that probably means that you need to change "alloc_set_pte()" to actually pass in the real address, and leave "vmf->address" alone - so that it can know which ones are prefaulted and which one is real, but that sounds like a good idea anyway. Then you can just make alloc_set_pte() do the right thing in the first place, instead of doing this nasty "lets do it wrong and fix it up later" horror. Linus