| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <bb2e70cb-002d-8032-d8c2-bb64dd2476a0@redhat.com>
Date: Wed, 2 Nov 2022 18:06:20 +0100
From: Paolo Bonzini <pbonzini@...hat.com>
To: Peter Xu <peterx@...hat.com>, kvm@...r.kernel.org,
linux-kernel@...r.kernel.org
Cc: Sean Christopherson <seanjc@...gle.com>,
John Hubbard <jhubbard@...dia.com>,
David Matlack <dmatlack@...gle.com>,
Andrew Morton <akpm@...ux-foundation.org>,
Andrea Arcangeli <aarcange@...hat.com>,
"Dr . David Alan Gilbert" <dgilbert@...hat.com>,
David Hildenbrand <david@...hat.com>,
Linux MM Mailing List <linux-mm@...ck.org>,
Mike Kravetz <mike.kravetz@...cle.com>
Subject: Re: [PATCH v4 1/4] mm/gup: Add FOLL_INTERRUPTIBLE
On 10/11/22 21:58, Peter Xu wrote:
> We have had FAULT_FLAG_INTERRUPTIBLE but it was never applied to GUPs. One
> issue with it is that not all GUP paths are able to handle signal delivers
> besides SIGKILL.
>
> That's not ideal for the GUP users who are actually able to handle these
> cases, like KVM.
>
> KVM uses GUP extensively on faulting guest pages, during which we've got
> existing infrastructures to retry a page fault at a later time. Allowing
> the GUP to be interrupted by generic signals can make KVM related threads
> to be more responsive. For examples:
>
> (1) SIGUSR1: which QEMU/KVM uses to deliver an inter-process IPI,
> e.g. when the admin issues a vm_stop QMP command, SIGUSR1 can be
> generated to kick the vcpus out of kernel context immediately,
>
> (2) SIGINT: which can be used with interactive hypervisor users to stop a
> virtual machine with Ctrl-C without any delays/hangs,
>
> (3) SIGTRAP: which grants GDB capability even during page faults that are
> stuck for a long time.
>
> Normally hypervisor will be able to receive these signals properly, but not
> if we're stuck in a GUP for a long time for whatever reason. It happens
> easily with a stucked postcopy migration when e.g. a network temp failure
> happens, then some vcpu threads can hang death waiting for the pages. With
> the new FOLL_INTERRUPTIBLE, we can allow GUP users like KVM to selectively
> enable the ability to trap these signals.
>
> Reviewed-by: John Hubbard <jhubbard@...dia.com>
> Reviewed-by: David Hildenbrand <david@...hat.com>
> Signed-off-by: Peter Xu <peterx@...hat.com>
If no one shouts I will queue the series for 6.2, but it would be nice
to get an ACK from the mm folks.
> ---
> include/linux/mm.h | 1 +
> mm/gup.c | 33 +++++++++++++++++++++++++++++----
> mm/hugetlb.c | 5 ++++-
> 3 files changed, 34 insertions(+), 5 deletions(-)
>
> diff --git a/include/linux/mm.h b/include/linux/mm.h
> index 21f8b27bd9fd..488a9f4cce07 100644
> --- a/include/linux/mm.h
> +++ b/include/linux/mm.h
> @@ -2897,6 +2897,7 @@ struct page *follow_page(struct vm_area_struct *vma, unsigned long address,
> #define FOLL_SPLIT_PMD 0x20000 /* split huge pmd before returning */
> #define FOLL_PIN 0x40000 /* pages must be released via unpin_user_page */
> #define FOLL_FAST_ONLY 0x80000 /* gup_fast: prevent fall-back to slow gup */
> +#define FOLL_INTERRUPTIBLE 0x100000 /* allow interrupts from generic signals */
>
> /*
> * FOLL_PIN and FOLL_LONGTERM may be used in various combinations with each
> diff --git a/mm/gup.c b/mm/gup.c
> index 5abdaf487460..d51e7ccaef32 100644
> --- a/mm/gup.c
> +++ b/mm/gup.c
> @@ -970,8 +970,17 @@ static int faultin_page(struct vm_area_struct *vma,
> fault_flags |= FAULT_FLAG_WRITE;
> if (*flags & FOLL_REMOTE)
> fault_flags |= FAULT_FLAG_REMOTE;
> - if (locked)
> + if (locked) {
> fault_flags |= FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
> + /*
> + * FAULT_FLAG_INTERRUPTIBLE is opt-in. GUP callers must set
> + * FOLL_INTERRUPTIBLE to enable FAULT_FLAG_INTERRUPTIBLE.
> + * That's because some callers may not be prepared to
> + * handle early exits caused by non-fatal signals.
> + */
> + if (*flags & FOLL_INTERRUPTIBLE)
> + fault_flags |= FAULT_FLAG_INTERRUPTIBLE;
> + }
> if (*flags & FOLL_NOWAIT)
> fault_flags |= FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_RETRY_NOWAIT;
> if (*flags & FOLL_TRIED) {
> @@ -1380,6 +1389,22 @@ int fixup_user_fault(struct mm_struct *mm,
> }
> EXPORT_SYMBOL_GPL(fixup_user_fault);
>
> +/*
> + * GUP always responds to fatal signals. When FOLL_INTERRUPTIBLE is
> + * specified, it'll also respond to generic signals. The caller of GUP
> + * that has FOLL_INTERRUPTIBLE should take care of the GUP interruption.
> + */
> +static bool gup_signal_pending(unsigned int flags)
> +{
> + if (fatal_signal_pending(current))
> + return true;
> +
> + if (!(flags & FOLL_INTERRUPTIBLE))
> + return false;
> +
> + return signal_pending(current);
> +}
> +
> /*
> * Please note that this function, unlike __get_user_pages will not
> * return 0 for nr_pages > 0 without FOLL_NOWAIT
> @@ -1461,11 +1486,11 @@ static __always_inline long __get_user_pages_locked(struct mm_struct *mm,
> * Repeat on the address that fired VM_FAULT_RETRY
> * with both FAULT_FLAG_ALLOW_RETRY and
> * FAULT_FLAG_TRIED. Note that GUP can be interrupted
> - * by fatal signals, so we need to check it before we
> + * by fatal signals of even common signals, depending on
> + * the caller's request. So we need to check it before we
> * start trying again otherwise it can loop forever.
> */
> -
> - if (fatal_signal_pending(current)) {
> + if (gup_signal_pending(flags)) {
> if (!pages_done)
> pages_done = -EINTR;
> break;
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index e070b8593b37..202f3ad7f35c 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -6206,9 +6206,12 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
> fault_flags |= FAULT_FLAG_WRITE;
> else if (unshare)
> fault_flags |= FAULT_FLAG_UNSHARE;
> - if (locked)
> + if (locked) {
> fault_flags |= FAULT_FLAG_ALLOW_RETRY |
> FAULT_FLAG_KILLABLE;
> + if (flags & FOLL_INTERRUPTIBLE)
> + fault_flags |= FAULT_FLAG_INTERRUPTIBLE;
> + }
> if (flags & FOLL_NOWAIT)
> fault_flags |= FAULT_FLAG_ALLOW_RETRY |
> FAULT_FLAG_RETRY_NOWAIT;
Powered by blists - more mailing lists