| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <99697544-54fd-46e6-a519-f5bdcc2e01a5@lucifer.local>
Date: Wed, 30 Apr 2025 14:36:19 +0100
From: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>
To: Ryan Roberts <ryan.roberts@....com>
Cc: Dev Jain <dev.jain@....com>, akpm@...ux-foundation.org, david@...hat.com,
willy@...radead.org, linux-mm@...ck.org, linux-kernel@...r.kernel.org,
catalin.marinas@....com, will@...nel.org, Liam.Howlett@...cle.com,
vbabka@...e.cz, jannh@...gle.com, anshuman.khandual@....com,
peterx@...hat.com, joey.gouly@....com, ioworker0@...il.com,
baohua@...nel.org, kevin.brodsky@....com, quic_zhenhuah@...cinc.com,
christophe.leroy@...roup.eu, yangyicong@...ilicon.com,
linux-arm-kernel@...ts.infradead.org, namit@...are.com,
hughd@...gle.com, yang@...amperecomputing.com, ziy@...dia.com
Subject: Re: [PATCH v2 2/7] mm: Optimize mprotect() by batch-skipping PTEs
On Wed, Apr 30, 2025 at 02:18:20PM +0100, Ryan Roberts wrote:
> On 30/04/2025 07:37, Dev Jain wrote:
> >
> >
> > On 29/04/25 6:49 pm, Lorenzo Stoakes wrote:
> >> Very very very nitty on subject (sorry I realise this is annoying :P) -
> >> generally don't need to capitalise 'Optimize' here :>)
> >>
> >> Generally I like the idea here. But some issues on impl.
> >>
> >> On Tue, Apr 29, 2025 at 10:53:31AM +0530, Dev Jain wrote:
> >>> In case of prot_numa, there are various cases in which we can skip to the
> >>> next iteration. Since the skip condition is based on the folio and not
> >>> the PTEs, we can skip a PTE batch.
> >>>
> >>> Signed-off-by: Dev Jain <dev.jain@....com>
> >>> ---
> >>> mm/mprotect.c | 27 ++++++++++++++++++++-------
> >>> 1 file changed, 20 insertions(+), 7 deletions(-)
> >>>
> >>> diff --git a/mm/mprotect.c b/mm/mprotect.c
> >>> index 70f59aa8c2a8..ec5d17af7650 100644
> >>> --- a/mm/mprotect.c
> >>> +++ b/mm/mprotect.c
> >>> @@ -91,6 +91,9 @@ static bool prot_numa_skip(struct vm_area_struct *vma,
> >>> struct folio *folio,
> >>> bool toptier;
> >>> int nid;
> >>>
> >>> + if (folio_is_zone_device(folio) || folio_test_ksm(folio))
> >>> + return true;
> >>> +
> >>
> >> Hm why not just put this here from the start? I think you should put this back
> >> in the prior commit.
> >>
> >>> /* Also skip shared copy-on-write pages */
> >>> if (is_cow_mapping(vma->vm_flags) &&
> >>> (folio_maybe_dma_pinned(folio) ||
> >>> @@ -126,8 +129,10 @@ static bool prot_numa_skip(struct vm_area_struct *vma,
> >>> struct folio *folio,
> >>> }
> >>>
> >>> static bool prot_numa_avoid_fault(struct vm_area_struct *vma,
> >>> - unsigned long addr, pte_t oldpte, int target_node)
> >>> + unsigned long addr, pte_t *pte, pte_t oldpte, int target_node,
> >>> + int max_nr, int *nr)
> >>
> >> Hate this ptr to nr.
> >>
> >> Why not just return nr, if it's 0 then skip? Simple!
> >>
> >>> {
> >>> + const fpb_t flags = FPB_IGNORE_DIRTY | FPB_IGNORE_SOFT_DIRTY;
> >>> struct folio *folio;
> >>> int ret;
> >>>
> >>> @@ -136,12 +141,16 @@ static bool prot_numa_avoid_fault(struct vm_area_struct
> >>> *vma,
> >>> return true;
> >>>
> >>> folio = vm_normal_folio(vma, addr, oldpte);
> >>> - if (!folio || folio_is_zone_device(folio) ||
> >>> - folio_test_ksm(folio))
> >>> + if (!folio)
> >>> return true;
> >>> +
> >>
> >> Very nitty, but stray extra line unless intended...
> >>
> >> Not sure why we can't just put this !folio check in prot_numa_skip()?
> >
> > Because we won't be able to batch if the folio is NULL.
> >
> > I think I really messed up by having separate patch 1 and 2. The real intent of
> > patch 1 was to do batching in patch 2 *and* not have insane indentation. Perhaps
> > I should merge them, or completely separate them logically, I'll figure this out.
>
> I'd be inclined to just merge into single patch...
Agreed!
>
> >
> >>
> >>> ret = prot_numa_skip(vma, folio, target_node);
> >>> - if (ret)
> >>> + if (ret) {
> >>> + if (folio_test_large(folio) && max_nr != 1)
> >>> + *nr = folio_pte_batch(folio, addr, pte, oldpte,
> >>> + max_nr, flags, NULL, NULL, NULL);
> >>
> >> So max_nr can <= 0 too? Shouldn't this be max_nr > 1?
> >>
> >>> return ret;
> >>
> >> Again x = fn_return_bool(); if (x) { return x; } is a bit silly, just do if
> >> (fn_return_bool()) { return true; }.
> >>
> >> If we return the number of pages, then this can become really simple, like:
> >>
> >> I feel like maybe we should abstract the folio large handling here, though it'd
> >> be a tiny function so hm.
> >>
> >> Anyway assuming we leave it in place, and return number of pages processed, this
> >> can become:
> >>
> >> if (prot_numa_skip(vma, folio, target_node)) {
> >> if (folio_test_large(folio) && max_nr > 1)
> >> return folio_pte_batch(folio, addr, pte, oldpte, max_nr, flags,
> >> NULL, NULL, NULL);
> >> return 1;
> >> }
> >>
> >> Which is neater I think!
> >>
> >>
> >>> + }
> >>> if (folio_use_access_time(folio))
> >>> folio_xchg_access_time(folio,
> >>> jiffies_to_msecs(jiffies));
> >>> @@ -159,6 +168,7 @@ static long change_pte_range(struct mmu_gather *tlb,
> >>> bool prot_numa = cp_flags & MM_CP_PROT_NUMA;
> >>> bool uffd_wp = cp_flags & MM_CP_UFFD_WP;
> >>> bool uffd_wp_resolve = cp_flags & MM_CP_UFFD_WP_RESOLVE;
> >>> + int nr;
> >>>
> >>> tlb_change_page_size(tlb, PAGE_SIZE);
> >>> pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
> >>> @@ -173,8 +183,10 @@ static long change_pte_range(struct mmu_gather *tlb,
> >>> flush_tlb_batched_pending(vma->vm_mm);
> >>> arch_enter_lazy_mmu_mode();
> >>> do {
> >>> + nr = 1;
> >>> oldpte = ptep_get(pte);
> >>> if (pte_present(oldpte)) {
> >>> + int max_nr = (end - addr) >> PAGE_SHIFT;
> >>
> >> Not a fan of open-coding this. Since we already provide addr, why not just
> >> provide end as well and have prot_numa_avoid_fault() calculate it?
> >>
> >>> pte_t ptent;
> >>>
> >>> /*
> >>> @@ -182,8 +194,9 @@ static long change_pte_range(struct mmu_gather *tlb,
> >>> * pages. See similar comment in change_huge_pmd.
> >>> */
> >>> if (prot_numa &&
> >>> - prot_numa_avoid_fault(vma, addr,
> >>> - oldpte, target_node))
> >>> + prot_numa_avoid_fault(vma, addr, pte,
> >>> + oldpte, target_node,
> >>> + max_nr, &nr))
> >>> continue;
> >>>
> >>> oldpte = ptep_modify_prot_start(vma, addr, pte);
> >>> @@ -300,7 +313,7 @@ static long change_pte_range(struct mmu_gather *tlb,
> >>> pages++;
> >>> }
> >>> }
> >>> - } while (pte++, addr += PAGE_SIZE, addr != end);
> >>> + } while (pte += nr, addr += nr * PAGE_SIZE, addr != end);
> >>
> >> This is icky, having 'nr' here like this.
>
> For better or worse, this is the pattern we have already established in other
> loops that are batching-aware. See zap_pte_range(), copy_pte_range(), etc. So
> I'd prefer to follow that pattern here, as Dev has done.
Yeah I'm fine with keeping this 'nr' stuff, I don't think there's a great
alternative.
>
> Thanks.
> Ryan
Cheers, Lorenzo
>
> >>
> >> But alternatives might be _even more_ icky (that is advancing both on
> >> prot_numa_avoid_fault() so probably we need to keep it like this.
> >>
> >> Maybe more a moan at the C programming language tbh haha!
> >>
> >>
> >>> arch_leave_lazy_mmu_mode();
> >>> pte_unmap_unlock(pte - 1, ptl);
> >>>
> >>> --
> >>> 2.30.2
> >>>
> >
>
Powered by blists - more mailing lists