From: Mike Kravetz <mike.kravetz@oracle.com>
To: "Axel Rasmussen" <axelrasmussen@google.com>,
"Alexander Viro" <viro@zeniv.linux.org.uk>,
"Alexey Dobriyan" <adobriyan@gmail.com>,
"Andrea Arcangeli" <aarcange@redhat.com>,
"Andrew Morton" <akpm@linux-foundation.org>,
"Anshuman Khandual" <anshuman.khandual@arm.com>,
"Catalin Marinas" <catalin.marinas@arm.com>,
"Chinwen Chang" <chinwen.chang@mediatek.com>,
"Huang Ying" <ying.huang@intel.com>,
"Ingo Molnar" <mingo@redhat.com>, "Jann Horn" <jannh@google.com>,
"Jerome Glisse" <jglisse@redhat.com>,
"Lokesh Gidra" <lokeshgidra@google.com>,
"Matthew Wilcox (Oracle)" <willy@infradead.org>,
"Michael Ellerman" <mpe@ellerman.id.au>,
"Michal Koutný" <mkoutny@suse.com>,
"Michel Lespinasse" <walken@google.com>,
"Mike Rapoport" <rppt@linux.vnet.ibm.com>,
"Nicholas Piggin" <npiggin@gmail.com>,
"Peter Xu" <peterx@redhat.com>, "Shaohua Li" <shli@fb.com>,
"Shawn Anastasio" <shawn@anastas.io>,
"Steven Rostedt" <rostedt@goodmis.org>,
"Steven Price" <steven.price@arm.com>,
"Vlastimil Babka" <vbabka@suse.cz>
Cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
linux-mm@kvack.org, Adam Ruprecht <ruprecht@google.com>,
Cannon Matthews <cannonmatthews@google.com>,
"Dr . David Alan Gilbert" <dgilbert@redhat.com>,
David Rientjes <rientjes@google.com>,
Mina Almasry <almasrymina@google.com>,
Oliver Upton <oupton@google.com>
Subject: Re: [PATCH v5 02/10] hugetlb/userfaultfd: Forbid huge pmd sharing when uffd enabled
Date: Thu, 11 Feb 2021 16:19:55 -0800 [thread overview]
Message-ID: <0a991b83-18f8-cd76-46c0-4e0dcd5c87a7@oracle.com> (raw)
In-Reply-To: <20210210212200.1097784-3-axelrasmussen@google.com>
On 2/10/21 1:21 PM, Axel Rasmussen wrote:
> From: Peter Xu <peterx@redhat.com>
>
> Huge pmd sharing could bring problem to userfaultfd. The thing is that
> userfaultfd is running its logic based on the special bits on page table
> entries, however the huge pmd sharing could potentially share page table
> entries for different address ranges. That could cause issues on either:
>
> - When sharing huge pmd page tables for an uffd write protected range, the
> newly mapped huge pmd range will also be write protected unexpectedly, or,
>
> - When we try to write protect a range of huge pmd shared range, we'll first
> do huge_pmd_unshare() in hugetlb_change_protection(), however that also
> means the UFFDIO_WRITEPROTECT could be silently skipped for the shared
> region, which could lead to data loss.
>
> Since at it, a few other things are done altogether:
>
> - Move want_pmd_share() from mm/hugetlb.c into linux/hugetlb.h, because
> that's definitely something that arch code would like to use too
>
> - ARM64 currently directly check against CONFIG_ARCH_WANT_HUGE_PMD_SHARE when
> trying to share huge pmd. Switch to the want_pmd_share() helper.
>
> Since at it, move vma_shareable() from huge_pmd_share() into want_pmd_share().
>
> Signed-off-by: Peter Xu <peterx@redhat.com>
> Signed-off-by: Axel Rasmussen <axelrasmussen@google.com>
> ---
> arch/arm64/mm/hugetlbpage.c | 3 +--
> include/linux/hugetlb.h | 2 ++
> include/linux/userfaultfd_k.h | 9 +++++++++
> mm/hugetlb.c | 20 ++++++++++++++------
> 4 files changed, 26 insertions(+), 8 deletions(-)
>
> diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
> index 6e3bcffe2837..58987a98e179 100644
> --- a/arch/arm64/mm/hugetlbpage.c
> +++ b/arch/arm64/mm/hugetlbpage.c
> @@ -284,8 +284,7 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
> */
> ptep = pte_alloc_map(mm, pmdp, addr);
> } else if (sz == PMD_SIZE) {
> - if (IS_ENABLED(CONFIG_ARCH_WANT_HUGE_PMD_SHARE) &&
> - pud_none(READ_ONCE(*pudp)))
> + if (want_pmd_share(vma, addr) && pud_none(READ_ONCE(*pudp)))
> ptep = huge_pmd_share(mm, vma, addr, pudp);
> else
> ptep = (pte_t *)pmd_alloc(mm, pudp, addr);
> diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
> index ca6e5ba56f73..d971e7efd17d 100644
> --- a/include/linux/hugetlb.h
> +++ b/include/linux/hugetlb.h
> @@ -1030,4 +1030,6 @@ static inline __init void hugetlb_cma_check(void)
> }
> #endif
>
> +bool want_pmd_share(struct vm_area_struct *vma, unsigned long addr);
> +
> #endif /* _LINUX_HUGETLB_H */
> diff --git a/include/linux/userfaultfd_k.h b/include/linux/userfaultfd_k.h
> index a8e5f3ea9bb2..c63ccdae3eab 100644
> --- a/include/linux/userfaultfd_k.h
> +++ b/include/linux/userfaultfd_k.h
> @@ -52,6 +52,15 @@ static inline bool is_mergeable_vm_userfaultfd_ctx(struct vm_area_struct *vma,
> return vma->vm_userfaultfd_ctx.ctx == vm_ctx.ctx;
> }
>
> +/*
> + * Never enable huge pmd sharing on uffd-wp registered vmas, because uffd-wp
> + * protect information is per pgtable entry.
> + */
> +static inline bool uffd_disable_huge_pmd_share(struct vm_area_struct *vma)
> +{
> + return vma->vm_flags & VM_UFFD_WP;
> +}
> +
> static inline bool userfaultfd_missing(struct vm_area_struct *vma)
> {
> return vma->vm_flags & VM_UFFD_MISSING;
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index 32d4d2e277ad..5710286e1984 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -5245,6 +5245,18 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr)
> return false;
> }
>
> +bool want_pmd_share(struct vm_area_struct *vma, unsigned long addr)
> +{
> +#ifndef CONFIG_ARCH_WANT_HUGE_PMD_SHARE
> + return false;
> +#endif
> +#ifdef CONFIG_USERFAULTFD
> + if (uffd_disable_huge_pmd_share(vma))
> + return false;
> +#endif
> + return vma_shareable(vma, addr);
> +}
> +
This code certainly does the right thing, however I wonder if it should
be structured a little differently.
want_pmd_share() is currently just a check for CONFIG_ARCH_WANT_HUGE_PMD_SHARE.
How about leaving that mostly as is, and adding the new vma checks to
vma_shareable(). vma_shareable() would then be something like:
if (!(vma->vm_flags & VM_MAYSHARE))
return false;
#ifdef CONFIG_USERFAULTFD
if (uffd_disable_huge_pmd_share(vma)
return false;
#endif
#ifdef /* XXX */
/* add other checks for things like uffd wp and soft dirty here */
#endif /* XXX */
if (range_in_vma(vma, base, end)
return true;
return false;
Of course, this would require we leave the call to vma_shareable() at the
beginning of huge_pmd_share. It also means that we are always making a
function call into huge_pmd_share to determine if sharing is possible.
That is not any different than today. If we do not want to make that extra
function call, then I would suggest putting all that code in want_pmd_share.
It just seems that all the vma checks for sharing should be in one place
if possible.
--
Mike Kravetz
> /*
> * Determine if start,end range within vma could be mapped by shared pmd.
> * If yes, adjust start and end to cover range associated with possible
> @@ -5301,9 +5313,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma,
> pte_t *pte;
> spinlock_t *ptl;
>
> - if (!vma_shareable(vma, addr))
> - return (pte_t *)pmd_alloc(mm, pud, addr);
> -
> i_mmap_assert_locked(mapping);
> vma_interval_tree_foreach(svma, &mapping->i_mmap, idx, idx) {
> if (svma == vma)
> @@ -5367,7 +5376,7 @@ int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma,
> *addr = ALIGN(*addr, HPAGE_SIZE * PTRS_PER_PTE) - HPAGE_SIZE;
> return 1;
> }
> -#define want_pmd_share() (1)
> +
> #else /* !CONFIG_ARCH_WANT_HUGE_PMD_SHARE */
> pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct vma,
> unsigned long addr, pud_t *pud)
> @@ -5385,7 +5394,6 @@ void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
> unsigned long *start, unsigned long *end)
> {
> }
> -#define want_pmd_share() (0)
> #endif /* CONFIG_ARCH_WANT_HUGE_PMD_SHARE */
>
> #ifdef CONFIG_ARCH_WANT_GENERAL_HUGETLB
> @@ -5407,7 +5415,7 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
> pte = (pte_t *)pud;
> } else {
> BUG_ON(sz != PMD_SIZE);
> - if (want_pmd_share() && pud_none(*pud))
> + if (want_pmd_share(vma, addr) && pud_none(*pud))
> pte = huge_pmd_share(mm, vma, addr, pud);
> else
> pte = (pte_t *)pmd_alloc(mm, pud, addr);
>
next prev parent reply other threads:[~2021-02-12 0:23 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-10 21:21 [PATCH v5 00/10] userfaultfd: add minor fault handling Axel Rasmussen
2021-02-10 21:21 ` [PATCH v5 01/10] hugetlb: Pass vma into huge_pte_alloc() and huge_pmd_share() Axel Rasmussen
2021-02-11 23:59 ` Mike Kravetz
2021-02-10 21:21 ` [PATCH v5 02/10] hugetlb/userfaultfd: Forbid huge pmd sharing when uffd enabled Axel Rasmussen
2021-02-12 0:19 ` Mike Kravetz [this message]
2021-02-12 20:40 ` Peter Xu
2021-02-12 20:47 ` Axel Rasmussen
2021-02-12 21:27 ` Mike Kravetz
2021-02-10 21:21 ` [PATCH v5 03/10] mm/hugetlb: Move flush_hugetlb_tlb_range() into hugetlb.h Axel Rasmussen
2021-02-10 21:21 ` [PATCH v5 04/10] hugetlb/userfaultfd: Unshare all pmds for hugetlbfs when register wp Axel Rasmussen
2021-02-12 18:11 ` Mike Kravetz
2021-02-12 21:18 ` Peter Xu
2021-02-12 21:34 ` Mike Kravetz
2021-02-12 22:14 ` Peter Xu
2021-02-10 21:21 ` [PATCH v5 05/10] userfaultfd: add minor fault registration mode Axel Rasmussen
2021-02-11 19:28 ` Axel Rasmussen
2021-02-11 20:58 ` Axel Rasmussen
2021-02-12 22:21 ` Matthew Wilcox
2021-02-12 22:44 ` Peter Xu
2021-02-12 22:51 ` Axel Rasmussen
2021-02-12 23:01 ` Peter Xu
2021-02-12 19:17 ` Mike Kravetz
2021-02-12 19:33 ` Axel Rasmussen
2021-02-10 21:21 ` [PATCH v5 06/10] userfaultfd: disable huge PMD sharing for MINOR registered VMAs Axel Rasmussen
2021-02-10 21:21 ` [PATCH v5 07/10] userfaultfd: hugetlbfs: only compile UFFD helpers if config enabled Axel Rasmussen
2021-02-10 21:21 ` [PATCH v5 08/10] userfaultfd: add UFFDIO_CONTINUE ioctl Axel Rasmussen
2021-02-10 22:21 ` Axel Rasmussen
2021-02-10 21:21 ` [PATCH v5 09/10] userfaultfd: update documentation to describe minor fault handling Axel Rasmussen
2021-02-10 21:22 ` [PATCH v5 10/10] userfaultfd/selftests: add test exercising " Axel Rasmussen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0a991b83-18f8-cd76-46c0-4e0dcd5c87a7@oracle.com \
--to=mike.kravetz@oracle.com \
--cc=aarcange@redhat.com \
--cc=adobriyan@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=almasrymina@google.com \
--cc=anshuman.khandual@arm.com \
--cc=axelrasmussen@google.com \
--cc=cannonmatthews@google.com \
--cc=catalin.marinas@arm.com \
--cc=chinwen.chang@mediatek.com \
--cc=dgilbert@redhat.com \
--cc=jannh@google.com \
--cc=jglisse@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=lokeshgidra@google.com \
--cc=mingo@redhat.com \
--cc=mkoutny@suse.com \
--cc=mpe@ellerman.id.au \
--cc=npiggin@gmail.com \
--cc=oupton@google.com \
--cc=peterx@redhat.com \
--cc=rientjes@google.com \
--cc=rostedt@goodmis.org \
--cc=rppt@linux.vnet.ibm.com \
--cc=ruprecht@google.com \
--cc=shawn@anastas.io \
--cc=shli@fb.com \
--cc=steven.price@arm.com \
--cc=vbabka@suse.cz \
--cc=viro@zeniv.linux.org.uk \
--cc=walken@google.com \
--cc=willy@infradead.org \
--cc=ying.huang@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).