On Wed, 31 May 2023, Jann Horn wrote: > On Mon, May 29, 2023 at 8:11 AM Hugh Dickins <hughd@xxxxxxxxxx> wrote: > > Here is the third series of patches to mm (and a few architectures), based > > on v6.4-rc3 with the preceding two series applied: in which khugepaged > > takes advantage of pte_offset_map[_lock]() allowing for pmd transitions. > > To clarify: Part of the design here is that when you look up a user > page table with pte_offset_map_nolock() or pte_offset_map() without > holding mmap_lock in write mode, and you later lock the page table > yourself, you don't know whether you actually have the real page table > or a detached table that is currently in its RCU grace period, right? Right. (And I'd rather not assume anything of mmap_lock, but there are one or two or three places that may still do so.) > And detached tables are supposed to consist of only zeroed entries, > and we assume that no relevant codepath will do anything bad if one of > these functions spuriously returns a pointer to a page table full of > zeroed entries? (Nit that I expect you're well aware of: IIRC "zeroed" isn't 0 on s390.) If someone is using pte_offset_map() without lock, they must be prepared to accept page-table-like changes. The limits of pte_offset_map_nolock() with later spin_lock(ptl): I'm still exploring: there's certainly an argument that one ought to do a pmd_same() check before proceeding, but I don't think anywhere needs that at present. Whether the page table has to be full of zeroed entries when detached: I believe it is always like that at present (by the end of the series, when the collapse_pte_offset_map() oddity is fixed), but whether it needs to be so I'm not sure. Quite likely it will need to be; but I'm open to the possibility that all it needs is to be still a page table, with perhaps new entries from a new usage in it. The most obvious vital thing (in the split ptlock case) is that it remains a struct page with a usable ptl spinlock embedded in it. The question becomes more urgent when/if extending to replacing the pagetable pmd by huge pmd in one go, without any mmap_lock: powerpc wants to deposit the page table for later use even in the shmem/file case (and all arches in the anon case): I did work out the details once before, but I'm not sure whether I would still agree with myself; and was glad to leave replacement out of this series, to revisit some time later. > > So in particular, in handle_pte_fault() we can reach the "if > (unlikely(!pte_same(*vmf->pte, entry)))" with vmf->pte pointing to a > detached zeroed page table, but we're okay with that because in that > case we know that !pte_none(vmf->orig_pte)&&pte_none(*vmf->pte) , > which implies !pte_same(*vmf->pte, entry) , which means we'll bail > out? There is no current (even at end of series) circumstance in which we could be pointing to a detached page table there; but yes, I want to allow for that, and yes I agree with your analysis. But with the interesting unanswered question for the future, of what if the same value could be found there: would that imply it's safe to proceed, or would some further prevention be needed? > > If that's the intent, it might be good to add some comments, because > at least to me that's not very obvious. That's a very fair request; but I shall have difficulty deciding where to place such comments. I shall have to try, then you redirect me. And I think we approach this in opposite ways: my nature is to put some infrastructure in place, and then look at it to see what we can get away with; whereas your nature is to define upfront what the possibilities are. We can expect some tussles! Thanks, Hugh
