linux-kernel - Re: [RFC PATCH 1/2] mm,drm/ttm: Block fast GUP to TTM huge pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <314fc020-d243-dbf0-acb3-ecfcc9c2443c@shipmail.org>
Date:   Tue, 23 Mar 2021 17:34:51 +0100
From:   Thomas Hellström (Intel) 
        <thomas_os@...pmail.org>
To:     dri-devel@...ts.freedesktop.org,
        Christian Koenig <christian.koenig@....com>,
        David Airlie <airlied@...ux.ie>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Jason Gunthorpe <jgg@...dia.com>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH 1/2] mm,drm/ttm: Block fast GUP to TTM huge pages

Hi,

On 3/23/21 12:34 PM, Daniel Vetter wrote:
> On Sun, Mar 21, 2021 at 07:45:28PM +0100, Thomas Hellström (Intel) wrote:
>> TTM sets up huge page-table-entries both to system- and device memory,
>> and we don't want gup to assume there are always valid backing struct
>> pages for these. For PTEs this is handled by setting the pte_special bit,
>> but for the huge PUDs and PMDs, we have neither pmd_special nor
>> pud_special. Normally, huge TTM entries are identified by looking at
>> vma_is_special_huge(), but fast gup can't do that, so as an alternative
>> define _devmap entries for which there are no backing dev_pagemap as
>> special, update documentation and make huge TTM entries _devmap, after
>> verifying that there is no backing dev_pagemap.
>>
>> One other alternative would be to block TTM huge page-table-entries
>> completely, and while currently only vmwgfx use them, they would be
>> beneficial to other graphis drivers moving forward as well.
>>
>> Cc: Christian Koenig <christian.koenig@....com>
>> Cc: David Airlie <airlied@...ux.ie>
>> Cc: Daniel Vetter <daniel@...ll.ch>
>> Cc: Andrew Morton <akpm@...ux-foundation.org>
>> Cc: Jason Gunthorpe <jgg@...dia.com>
>> Cc: linux-mm@...ck.org
>> Cc: dri-devel@...ts.freedesktop.org
>> Cc: linux-kernel@...r.kernel.org
>> Signed-off-by: Thomas Hellström (Intel) <thomas_os@...pmail.org>
>> ---
>>   drivers/gpu/drm/ttm/ttm_bo_vm.c | 17 ++++++++++++++++-
>>   mm/gup.c                        | 21 +++++++++++----------
>>   mm/memremap.c                   |  5 +++++
>>   3 files changed, 32 insertions(+), 11 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>> index 6dc96cf66744..1c34983480e5 100644
>> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
>> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
>> @@ -195,6 +195,7 @@ static vm_fault_t ttm_bo_vm_insert_huge(struct vm_fault *vmf,
>>   	pfn_t pfnt;
>>   	struct ttm_tt *ttm = bo->ttm;
>>   	bool write = vmf->flags & FAULT_FLAG_WRITE;
>> +	struct dev_pagemap *pagemap;
>>   
>>   	/* Fault should not cross bo boundary. */
>>   	page_offset &= ~(fault_page_size - 1);
>> @@ -210,6 +211,20 @@ static vm_fault_t ttm_bo_vm_insert_huge(struct vm_fault *vmf,
>>   	if ((pfn & (fault_page_size - 1)) != 0)
>>   		goto out_fallback;
>>   
>> +	/*
>> +	 * Huge entries must be special, that is marking them as devmap
>> +	 * with no backing device map range. If there is a backing
>> +	 * range, Don't insert a huge entry.
>> +	 * If this check turns out to be too much of a performance hit,
>> +	 * we can instead have drivers indicate whether they may have
>> +	 * backing device map ranges and if not, skip this lookup.
>> +	 */
> I think we can do this statically:
> - if it's system memory we know there's no devmap for it, and we do the
>    trick to block gup_fast
Yes, that should work.
> - if it's iomem, we know gup_fast wont work anyway if don't set PFN_DEV,
>    so might as well not do that

I think gup_fast will unfortunately mistake a huge iomem page for an 
ordinary page and try to access a non-existant struct page for it, 
unless we do the devmap trick.

And the lookup would then be for the rare case where a driver would have 
already registered a dev_pagemap for an iomem area which may also be 
mapped through TTM (like the patch from Felix a couple of weeks ago). If 
a driver can promise not to do that, then we can safely remove the lookup.

/Thomas