| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 19 Jul 2022 16:47:16 -0400
From: Peter Xu <peterx@...hat.com>
To: Nadav Amit <nadav.amit@...il.com>
Cc: linux-mm@...ck.org, linux-kernel@...r.kernel.org,
Andrew Morton <akpm@...ux-foundation.org>,
Mike Rapoport <rppt@...ux.ibm.com>,
Axel Rasmussen <axelrasmussen@...gle.com>,
Nadav Amit <namit@...are.com>,
Andrea Arcangeli <aarcange@...hat.com>,
Andrew Cooper <andrew.cooper3@...rix.com>,
Andy Lutomirski <luto@...nel.org>,
Dave Hansen <dave.hansen@...ux.intel.com>,
David Hildenbrand <david@...hat.com>,
Peter Zijlstra <peterz@...radead.org>,
Thomas Gleixner <tglx@...utronix.de>,
Will Deacon <will@...nel.org>, Yu Zhao <yuzhao@...gle.com>,
Nick Piggin <npiggin@...il.com>
Subject: Re: [RFC PATCH 01/14] userfaultfd: set dirty and young on
writeprotect
On Mon, Jul 18, 2022 at 05:01:59AM -0700, Nadav Amit wrote:
> From: Nadav Amit <namit@...are.com>
>
> When userfaultfd makes a PTE writable, it can now change the PTE
> directly, in some cases, without going triggering a page-fault first.
> Yet, doing so might leave the PTE that was write-unprotected as old and
> clean. At least on x86, this would cause a >500 cycles overhead when the
> PTE is first accessed.
>
> Use MM_CP_WILL_NEED to set the PTE as young and dirty when userfaultfd
> gets a hint that the page is likely to be used. Avoid changing the PTE
> to young and dirty in other cases to avoid excessive writeback and
> messing with the page reclamation logic.
>
> Cc: Andrea Arcangeli <aarcange@...hat.com>
> Cc: Andrew Cooper <andrew.cooper3@...rix.com>
> Cc: Andrew Morton <akpm@...ux-foundation.org>
> Cc: Andy Lutomirski <luto@...nel.org>
> Cc: Dave Hansen <dave.hansen@...ux.intel.com>
> Cc: David Hildenbrand <david@...hat.com>
> Cc: Peter Xu <peterx@...hat.com>
> Cc: Peter Zijlstra <peterz@...radead.org>
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Cc: Will Deacon <will@...nel.org>
> Cc: Yu Zhao <yuzhao@...gle.com>
> Cc: Nick Piggin <npiggin@...il.com>
> ---
> include/linux/mm.h | 2 ++
> mm/mprotect.c | 9 ++++++++-
> mm/userfaultfd.c | 8 ++++++--
> 3 files changed, 16 insertions(+), 3 deletions(-)
>
> diff --git a/include/linux/mm.h b/include/linux/mm.h
> index 9cc02a7e503b..4afd75ce5875 100644
> --- a/include/linux/mm.h
> +++ b/include/linux/mm.h
> @@ -1988,6 +1988,8 @@ extern unsigned long move_page_tables(struct vm_area_struct *vma,
> /* Whether this change is for write protecting */
> #define MM_CP_UFFD_WP (1UL << 2) /* do wp */
> #define MM_CP_UFFD_WP_RESOLVE (1UL << 3) /* Resolve wp */
> +/* Whether to try to mark entries as dirty as they are to be written */
> +#define MM_CP_WILL_NEED (1UL << 4)
> #define MM_CP_UFFD_WP_ALL (MM_CP_UFFD_WP | \
> MM_CP_UFFD_WP_RESOLVE)
>
> diff --git a/mm/mprotect.c b/mm/mprotect.c
> index 996a97e213ad..34c2dfb68c42 100644
> --- a/mm/mprotect.c
> +++ b/mm/mprotect.c
> @@ -82,6 +82,7 @@ static unsigned long change_pte_range(struct mmu_gather *tlb,
> bool prot_numa = cp_flags & MM_CP_PROT_NUMA;
> bool uffd_wp = cp_flags & MM_CP_UFFD_WP;
> bool uffd_wp_resolve = cp_flags & MM_CP_UFFD_WP_RESOLVE;
> + bool will_need = cp_flags & MM_CP_WILL_NEED;
>
> tlb_change_page_size(tlb, PAGE_SIZE);
>
> @@ -172,6 +173,9 @@ static unsigned long change_pte_range(struct mmu_gather *tlb,
> ptent = pte_clear_uffd_wp(ptent);
> }
>
> + if (will_need)
> + ptent = pte_mkyoung(ptent);
For uffd path, UFFD_FLAGS_ACCESS_LIKELY|UFFD_FLAGS_WRITE_LIKELY are new
internal flags used with or without the new feature bit set. It means even
with !ACCESS_HINT we'll start to set young bit while we used not to? Is
that some kind of a light abi change?
I'd suggest we only set will_need if ACCESS_HINT is set.
> +
> /*
> * In some writable, shared mappings, we might want
> * to catch actual write access -- see
> @@ -187,8 +191,11 @@ static unsigned long change_pte_range(struct mmu_gather *tlb,
> */
> if ((cp_flags & MM_CP_TRY_CHANGE_WRITABLE) &&
> !pte_write(ptent) &&
> - can_change_pte_writable(vma, addr, ptent))
> + can_change_pte_writable(vma, addr, ptent)) {
> ptent = pte_mkwrite(ptent);
> + if (will_need)
> + ptent = pte_mkdirty(ptent);
Can we make this unconditional? IOW to cover both:
(1) When will_need is not set, or
(2) mprotect() too
David's patch is good in that we merged the unprotect and CoW. However
that's not complete because the dirty bit ops are missing.
Here IMHO we should have a standalone patch to just add the dirty bit into
this logic when we'll grant write bit. IMHO it'll make the write+dirty
bits coherent again in all paths.
> + }
>
> ptep_modify_prot_commit(vma, addr, pte, oldpte, ptent);
> if (pte_needs_flush(oldpte, ptent))
> diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
> index 954c6980b29f..e0492f5f06a0 100644
> --- a/mm/userfaultfd.c
> +++ b/mm/userfaultfd.c
> @@ -749,6 +749,7 @@ int mwriteprotect_range(struct mm_struct *dst_mm, unsigned long start,
> bool enable_wp = uffd_flags & UFFD_FLAGS_WP;
> struct vm_area_struct *dst_vma;
> unsigned long page_mask;
> + unsigned long cp_flags;
> struct mmu_gather tlb;
> pgprot_t newprot;
> int err;
> @@ -795,9 +796,12 @@ int mwriteprotect_range(struct mm_struct *dst_mm, unsigned long start,
> else
> newprot = vm_get_page_prot(dst_vma->vm_flags);
>
> + cp_flags = enable_wp ? MM_CP_UFFD_WP : MM_CP_UFFD_WP_RESOLVE;
> + if (uffd_flags & (UFFD_FLAGS_ACCESS_LIKELY|UFFD_FLAGS_WRITE_LIKELY))
> + cp_flags |= MM_CP_WILL_NEED;
> +
> tlb_gather_mmu(&tlb, dst_mm);
> - change_protection(&tlb, dst_vma, start, start + len, newprot,
> - enable_wp ? MM_CP_UFFD_WP : MM_CP_UFFD_WP_RESOLVE);
> + change_protection(&tlb, dst_vma, start, start + len, newprot, cp_flags);
> tlb_finish_mmu(&tlb);
>
> err = 0;
> --
> 2.25.1
>
--
Peter Xu
Powered by blists - more mailing lists