From: Peter Zijlstra <peterz@infradead.org>
To: Leonardo Bras <leonardo@linux.ibm.com>
Cc: "Song Liu" <songliubraving@fb.com>,
"Michal Hocko" <mhocko@suse.com>,
"Mahesh Salgaonkar" <mahesh@linux.vnet.ibm.com>,
"Dmitry V. Levin" <ldv@altlinux.org>,
"Keith Busch" <keith.busch@intel.com>,
linux-mm@kvack.org, "Paul Mackerras" <paulus@samba.org>,
"Christoph Lameter" <cl@linux.com>,
"Ira Weiny" <ira.weiny@intel.com>,
"Ingo Molnar" <mingo@kernel.org>,
"Elena Reshetova" <elena.reshetova@intel.com>,
linux-arch@vger.kernel.org,
"Santosh Sivaraj" <santosh@fossix.org>,
"Davidlohr Bueso" <dave@stgolabs.net>,
"Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>,
"Jann Horn" <jannh@google.com>,
"Mike Rapoport" <rppt@linux.ibm.com>,
"Jason Gunthorpe" <jgg@ziepe.ca>,
"Allison Randal" <allison@lohutok.net>,
"Jesper Dangaard Brouer" <brouer@redhat.com>,
"Andrey Ryabinin" <aryabinin@virtuozzo.com>,
"Alexey Dobriyan" <adobriyan@gmail.com>,
"Andrea Arcangeli" <aarcange@redhat.com>,
"Ralph Campbell" <rcampbell@nvidia.com>,
"Arnd Bergmann" <arnd@arndb.de>,
"Bartlomiej Zolnierkiewicz" <b.zolnierkie@samsung.com>,
"John Hubbard" <jhubbard@nvidia.com>,
linuxppc-dev@lists.ozlabs.org,
"Nicholas Piggin" <npiggin@gmail.com>,
"Jérôme Glisse" <jglisse@redhat.com>,
"Mathieu Desnoyers" <mathieu.desnoyers@efficios.com>,
kvm-ppc@vger.kernel.org,
"Dan Williams" <dan.j.williams@intel.com>,
"Reza Arbab" <arbab@linux.ibm.com>,
"Vlastimil Babka" <vbabka@suse.cz>,
"Christian Brauner" <christian.brauner@ubuntu.com>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
linux-kernel@vger.kernel.org,
"Thomas Gleixner" <tglx@linutronix.de>,
"Souptick Joarder" <jrdr.linux@gmail.com>,
"Andrew Morton" <akpm@linux-foundation.org>,
"Logan Gunthorpe" <logang@deltatee.com>,
"Roman Gushchin" <guro@fb.com>,
"Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
"Al Viro" <viro@zeniv.linux.org.uk>
Subject: Re: [PATCH v5 00/11] Introduces new count-based method for tracking lockless pagetable walks
Date: Fri, 4 Oct 2019 13:42:36 +0200 [thread overview]
Message-ID: <20191004114236.GD19463@hirez.programming.kicks-ass.net> (raw)
In-Reply-To: <c46d6c7301314a2d998cffc47d69b404f2c26ad3.camel@linux.ibm.com>
On Thu, Oct 03, 2019 at 05:36:31PM -0300, Leonardo Bras wrote:
> > Also, I'm not sure I understand things properly.
> >
> > So serialize_against_pte_lookup() wants to wait for all currently
> > out-standing __find_linux_pte() instances (which are very similar to
> > gup_fast).
> >
> > It seems to want to do this before flushing the THP TLB for some reason;
> > why? Should not THP observe the normal page table freeing rules which
> > includes a RCU-like grace period like this already.
> >
> > Why is THP special here? This doesn't seem adequately explained.
>
> "It's necessary to monitor lockless pagetable walks, in order to avoid
> doing THP splitting/collapsing during them."
>
> If a there is a THP split/collapse during the lockless pagetable walk,
> the returned ptep can be a pointing to an invalid pte.
So the whole premise of lockless page-table walks (gup_fast) is that it
can work on in-flux page-tables. Specifically gup_fast() never returns
PTEs, only struct page *, and only if it can increment the page
refcount.
In order to enable this, page-table pages are RCU(-like) freed, such
that even if we access page-tables that have (concurrently) been
unlinked, we'll not UaF (see asm-generic/tlb.h, the comment at
HAVE_RCU_TABLE_FREE). IOW, the worst case if not getting a struct page
*.
I really don't see how THP splitting/collapsing is special here, either
we see the PMD and find a struct page * or we see a PTE and find the
same struct page * (compound page head).
The only thing that needs to be guaranteed is that both PTEs and PMD
page-tables are valid. Is this not so?
> To avoid that, the pmd is updated, then serialize_against_pte_lookup is
> ran. Serialize runs a do_nothing in all cpu in cpu_mask.
>
> So, after all cpus finish running do_nothing(), there is a guarantee
> that if there is any 'lockless pagetable walk' it is running on top of
> a updated version of this pmd, and so, collapsing/splitting THP is
> safe.
But why would it matter?! It would find the same struct page * through
either version of the page-tables. *confused*
> > Also, specifically to munmap(), this seems entirely superfluous,
> > munmap() uses the normal page-table freeing code and should be entirely
> > fine without additional waiting.
>
> To be honest, I remember it being needed in munmap case, but I really
> don't remember the details. I will take a deeper look and come back
> with this answer.
munmap does normal mmu_gather page-table teardown, the THP PMD should be
RCU-like freed just like any other PMD. Which should be perfectly safe
vs lockless page-table walks.
If you can find anything there that isn't right, please explain that in
detail and we'll need to look hard at fixing _that_.
> > Furthermore, Power never accurately tracks mm_cpumask(), so using that
> > makes the whole thing more expensive than it needs to be. Also, I
> > suppose that is buggered vs file backed THP.
>
> That accuracy of mm_cpumask is above my knowledge right now. =)
Basically PowerPC only ever sets bits in there, unlike x86 that also
clears bits (at expense, but it's worth it for us).
next prev parent reply other threads:[~2019-10-04 11:45 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-03 1:33 [PATCH v5 00/11] Introduces new count-based method for tracking lockless pagetable walks Leonardo Bras
2019-10-03 1:33 ` [PATCH v5 01/11] asm-generic/pgtable: Adds generic functions to monitor lockless pgtable walks Leonardo Bras
2019-10-03 7:11 ` Peter Zijlstra
2019-10-03 11:51 ` Peter Zijlstra
2019-10-03 20:40 ` John Hubbard
2019-10-04 11:24 ` Peter Zijlstra
2019-10-03 21:24 ` Leonardo Bras
2019-10-04 11:28 ` Peter Zijlstra
2019-10-09 18:09 ` Leonardo Bras
2019-10-05 8:35 ` Aneesh Kumar K.V
2019-10-08 14:47 ` Kirill A. Shutemov
2019-10-03 1:33 ` [PATCH v5 02/11] powerpc/mm: Adds counting method " Leonardo Bras
2019-10-08 15:11 ` Christopher Lameter
2019-10-08 17:13 ` Leonardo Bras
2019-10-08 17:43 ` Christopher Lameter
2019-10-08 18:02 ` Leonardo Bras
2019-10-08 18:27 ` Christopher Lameter
2019-10-03 1:33 ` [PATCH v5 03/11] mm/gup: Applies counting method to monitor gup_pgd_range Leonardo Bras
2019-10-03 1:33 ` [PATCH v5 04/11] powerpc/mce_power: Applies counting method to monitor lockless pgtbl walks Leonardo Bras
2019-10-03 1:33 ` [PATCH v5 05/11] powerpc/perf: " Leonardo Bras
2019-10-03 1:33 ` [PATCH v5 06/11] powerpc/mm/book3s64/hash: " Leonardo Bras
2019-10-03 1:33 ` [PATCH v5 07/11] powerpc/kvm/e500: " Leonardo Bras
2019-10-03 1:33 ` [PATCH v5 08/11] powerpc/kvm/book3s_hv: " Leonardo Bras
2019-10-03 1:33 ` [PATCH v5 09/11] powerpc/kvm/book3s_64: " Leonardo Bras
2019-10-03 1:33 ` [PATCH v5 10/11] mm/Kconfig: Adds config option to track lockless pagetable walks Leonardo Bras
2019-10-03 2:08 ` Qian Cai
2019-10-03 19:04 ` Leonardo Bras
2019-10-03 19:08 ` Leonardo Bras
2019-10-03 7:44 ` Peter Zijlstra
2019-10-03 20:40 ` Leonardo Bras
2019-10-03 1:33 ` [PATCH v5 11/11] powerpc/mm/book3s64/pgtable: Uses counting method to skip serializing Leonardo Bras
2019-10-03 7:29 ` [PATCH v5 00/11] Introduces new count-based method for tracking lockless pagetable walks Peter Zijlstra
2019-10-03 20:36 ` Leonardo Bras
2019-10-03 20:49 ` John Hubbard
2019-10-03 21:38 ` Leonardo Bras
2019-10-04 11:42 ` Peter Zijlstra [this message]
2019-10-04 12:57 ` Peter Zijlstra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191004114236.GD19463@hirez.programming.kicks-ass.net \
--to=peterz@infradead.org \
--cc=aarcange@redhat.com \
--cc=adobriyan@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=allison@lohutok.net \
--cc=aneesh.kumar@linux.ibm.com \
--cc=arbab@linux.ibm.com \
--cc=arnd@arndb.de \
--cc=aryabinin@virtuozzo.com \
--cc=b.zolnierkie@samsung.com \
--cc=brouer@redhat.com \
--cc=christian.brauner@ubuntu.com \
--cc=cl@linux.com \
--cc=dan.j.williams@intel.com \
--cc=dave@stgolabs.net \
--cc=elena.reshetova@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=guro@fb.com \
--cc=ira.weiny@intel.com \
--cc=jannh@google.com \
--cc=jgg@ziepe.ca \
--cc=jglisse@redhat.com \
--cc=jhubbard@nvidia.com \
--cc=jrdr.linux@gmail.com \
--cc=keith.busch@intel.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=kvm-ppc@vger.kernel.org \
--cc=ldv@altlinux.org \
--cc=leonardo@linux.ibm.com \
--cc=linux-arch@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=logang@deltatee.com \
--cc=mahesh@linux.vnet.ibm.com \
--cc=mathieu.desnoyers@efficios.com \
--cc=mhocko@suse.com \
--cc=mingo@kernel.org \
--cc=npiggin@gmail.com \
--cc=paulus@samba.org \
--cc=rcampbell@nvidia.com \
--cc=rppt@linux.ibm.com \
--cc=santosh@fossix.org \
--cc=songliubraving@fb.com \
--cc=tglx@linutronix.de \
--cc=vbabka@suse.cz \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).