linux-kernel - Re: [RFC PATCH RESEND 00/28] per-VMA locks proposal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 1 Sep 2022 16:26:19 -0700
From:   Suren Baghdasaryan <surenb@...gle.com>
To:     Kent Overstreet <kent.overstreet@...ux.dev>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Michel Lespinasse <michel@...pinasse.org>,
        Jerome Glisse <jglisse@...gle.com>,
        Michal Hocko <mhocko@...e.com>,
        Vlastimil Babka <vbabka@...e.cz>,
        Johannes Weiner <hannes@...xchg.org>,
        Mel Gorman <mgorman@...e.de>,
        Davidlohr Bueso <dave@...olabs.net>,
        Matthew Wilcox <willy@...radead.org>,
        "Liam R. Howlett" <liam.howlett@...cle.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Laurent Dufour <ldufour@...ux.ibm.com>,
        Laurent Dufour <laurent.dufour@...ibm.com>,
        "Paul E . McKenney" <paulmck@...nel.org>,
        Andy Lutomirski <luto@...nel.org>,
        Song Liu <songliubraving@...com>, Peter Xu <peterx@...hat.com>,
        David Hildenbrand <david@...hat.com>, dhowells@...hat.com,
        Hugh Dickins <hughd@...gle.com>, bigeasy@...utronix.de,
        David Rientjes <rientjes@...gle.com>,
        Axel Rasmussen <axelrasmussen@...gle.com>,
        Joel Fernandes <joelaf@...gle.com>,
        Minchan Kim <minchan@...gle.com>,
        kernel-team <kernel-team@...roid.com>,
        linux-mm <linux-mm@...ck.org>,
        linux-arm-kernel@...ts.infradead.org,
        linuxppc-dev@...ts.ozlabs.org, x86@...nel.org,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [RFC PATCH RESEND 00/28] per-VMA locks proposal

On Thu, Sep 1, 2022 at 1:58 PM Kent Overstreet
<kent.overstreet@...ux.dev> wrote:
>
> On Thu, Sep 01, 2022 at 10:34:48AM -0700, Suren Baghdasaryan wrote:
> > Resending to fix the issue with the In-Reply-To tag in the original
> > submission at [4].
> >
> > This is a proof of concept for per-vma locks idea that was discussed
> > during SPF [1] discussion at LSF/MM this year [2], which concluded with
> > suggestion that “a reader/writer semaphore could be put into the VMA
> > itself; that would have the effect of using the VMA as a sort of range
> > lock. There would still be contention at the VMA level, but it would be an
> > improvement.” This patchset implements this suggested approach.
> >
> > When handling page faults we lookup the VMA that contains the faulting
> > page under RCU protection and try to acquire its lock. If that fails we
> > fall back to using mmap_lock, similar to how SPF handled this situation.
> >
> > One notable way the implementation deviates from the proposal is the way
> > VMAs are marked as locked. Because during some of mm updates multiple
> > VMAs need to be locked until the end of the update (e.g. vma_merge,
> > split_vma, etc). Tracking all the locked VMAs, avoiding recursive locks
> > and other complications would make the code more complex. Therefore we
> > provide a way to "mark" VMAs as locked and then unmark all locked VMAs
> > all at once. This is done using two sequence numbers - one in the
> > vm_area_struct and one in the mm_struct. VMA is considered locked when
> > these sequence numbers are equal. To mark a VMA as locked we set the
> > sequence number in vm_area_struct to be equal to the sequence number
> > in mm_struct. To unlock all VMAs we increment mm_struct's seq number.
> > This allows for an efficient way to track locked VMAs and to drop the
> > locks on all VMAs at the end of the update.
>
> I like it - the sequence numbers are a stroke of genuius. For what it's doing
> the patchset seems almost small.

Thanks for reviewing it!

>
> Two complaints so far:
>  - I don't like the vma_mark_locked() name. To me it says that the caller
>    already took or is taking the lock and this function is just marking that
>    we're holding the lock, but it's really taking a different type of lock. But
>    this function can block, it really is taking a lock, so it should say that.
>
>    This is AFAIK a new concept, not sure I'm going to have anything good either,
>    but perhaps vma_lock_multiple()?

I'm open to name suggestions but vma_lock_multiple() is a bit
confusing to me. Will wait for more suggestions.

>
>  - I don't like the #ifdef and the separate fallback path in the fault handlers.
>
>    Can we make find_and_lock_anon_vma() do the right thing, and not fail unless
>    e.g. there isn't a vma at that address? Just have it wait for vm_lock_seq to
>    change and then retry if needed.

I think it can be done but would come with additional complexity. I
was really trying to keep things as simple as possible after SPF got
shot down on the grounds of complexity. I hope to start simple and
improve only when necessary.