Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Song Liu <songliubraving@fb.com>
To:     Thomas Gleixner <tglx@linutronix.de>
CC:     Dave Hansen <dave.hansen@intel.com>,
        LKML <linux-kernel@vger.kernel.org>,
        "x86@kernel.org" <x86@kernel.org>, Joerg Roedel <jroedel@suse.de>,
        "Andy Lutomirski" <luto@kernel.org>,
        Peter Zijlstra <peterz@infradead.org>,
        "Rik van Riel" <riel@surriel.com>,
        Steven Rostedt <rostedt@goodmis.org>
Subject: Re: [PATCH] x86/mm/cpa: Prevent large page split when ftrace flips RW
 on kernel text
Thread-Topic: [PATCH] x86/mm/cpa: Prevent large page split when ftrace flips
 RW on kernel text
Thread-Index: AQHVXfBrwy7DRssuAUKml0PBV9k636cRLZyA
Date:   Wed, 28 Aug 2019 23:03:03 +0000
Message-ID: <704BDFE2-E6E7-4B34-8C94-01152B5C9CCD@fb.com>
References: <20190828142445.454151604@linutronix.de>
 <20190828143123.971884723@linutronix.de>
 <55bb026c-5d54-6ebf-608f-3f376fbec4e5@intel.com>
 <alpine.DEB.2.21.1908281750410.1938@nanos.tec.linutronix.de>
 <309E5006-E869-4761-ADE2-ADB7A1A63FF1@fb.com>
 <alpine.DEB.2.21.1908282029550.1938@nanos.tec.linutronix.de>
 <9B34E971-20ED-4A58-B086-AB94990B5A26@fb.com>
 <alpine.DEB.2.21.1908282355340.1938@nanos.tec.linutronix.de>
In-Reply-To: <alpine.DEB.2.21.1908282355340.1938@nanos.tec.linutronix.de>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: fb.com does not designate
 permitted sender hosts)
Content-Type: text/plain; charset="us-ascii"
Content-ID: <A031268B319BD64AAE77E9090F8AF6D0@namprd15.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 9192e40c-28a4-4be1-244b-08d72c0be195
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Aug 2019 23:03:03.5405
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: aimKWkiTVxv/kYkB0Q38yMvG4wooq1rQfU8yCNVMjRU11jvnCSgYoqraoC34wDa1VZasUVhESzVqC4HPQthmmQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR15MB1901
X-OriginatorOrg: fb.com
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.70,1.0.8
 definitions=2019-08-28_12:2019-08-28,2019-08-28 signatures=0
X-Proofpoint-Spam-Details: rule=fb_default_notspam policy=fb_default score=0 bulkscore=0
 impostorscore=0 spamscore=0 mlxlogscore=999 phishscore=0 clxscore=1015
 lowpriorityscore=0 priorityscore=1501 malwarescore=0 adultscore=0
 mlxscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-1906280000 definitions=main-1908280218
X-FB-Internal: deliver
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


> On Aug 28, 2019, at 3:31 PM, Thomas Gleixner <tglx@linutronix.de> wrote:
>=20
> ftrace does not use text_poke() for enabling trace functionality. It uses
> its own mechanism and flips the whole kernel text to RW and back to RO.
>=20
> The CPA rework removed a loop based check of 4k pages which tried to
> preserve a large page by checking each 4k page whether the change would
> actually cover all pages in the large page.
>=20
> This resulted in endless loops for nothing as in testing it turned out th=
at
> it actually never preserved anything. Of course testing missed to include
> ftrace, which is the one and only case which benefitted from the 4k loop.
>=20
> As a consequence enabling function tracing or ftrace based kprobes result=
s
> in a full 4k split of the kernel text, which affects iTLB performance.
>=20
> The kernel RO protection is the only valid case where this can actually
> preserve large pages.
>=20
> All other static protections (RO data, data NX, PCI, BIOS) are truly
> static.  So a conflict with those protections which results in a split
> should only ever happen when a change of memory next to a protected regio=
n
> is attempted. But these conflicts are rightfully splitting the large page
> to preserve the protected regions. In fact a change to the protected
> regions itself is a bug and is warned about.
>=20
> Add an exception for the static protection check for kernel text RO when
> the to be changed region spawns a full large page which allows to preserv=
e
> the large mappings. This also prevents the syslog to be spammed about CPA
> violations when ftrace is used.
>=20
> The exception needs to be removed once ftrace switched over to text_poke(=
)
> which avoids the whole issue.
>=20
> Fixes: 585948f4f695 ("x86/mm/cpa: Avoid the 4k pages check completely")
> Reported-by: Song Liu <songliubraving@fb.com>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Cc: stable@vger.kernel.org

This looks great. Much cleaner than my workaround.=20

Thanks!

Reviewed-and-tested-by: Song Liu <songliubraving@fb.com>

We need this for v4.20 to v5.3 (assuming Peter's patches will land in 5.4).=
=20


> ---
> arch/x86/mm/pageattr.c |   26 ++++++++++++++++++--------
> 1 file changed, 18 insertions(+), 8 deletions(-)
>=20
> --- a/arch/x86/mm/pageattr.c
> +++ b/arch/x86/mm/pageattr.c
> @@ -516,7 +516,7 @@ static inline void check_conflict(int wa
>  */
> static inline pgprot_t static_protections(pgprot_t prot, unsigned long st=
art,
> 					  unsigned long pfn, unsigned long npg,
> -					  int warnlvl)
> +					  unsigned long lpsize, int warnlvl)
> {
> 	pgprotval_t forbidden, res;
> 	unsigned long end;
> @@ -535,9 +535,17 @@ static inline pgprot_t static_protection
> 	check_conflict(warnlvl, prot, res, start, end, pfn, "Text NX");
> 	forbidden =3D res;
>=20
> -	res =3D protect_kernel_text_ro(start, end);
> -	check_conflict(warnlvl, prot, res, start, end, pfn, "Text RO");
> -	forbidden |=3D res;
> +	/*
> +	 * Special case to preserve a large page. If the change spawns the
> +	 * full large page mapping then there is no point to split it
> +	 * up. Happens with ftrace and is going to be removed once ftrace
> +	 * switched to text_poke().
> +	 */
> +	if (lpsize !=3D (npg * PAGE_SIZE) || (start & (lpsize - 1))) {
> +		res =3D protect_kernel_text_ro(start, end);
> +		check_conflict(warnlvl, prot, res, start, end, pfn, "Text RO");
> +		forbidden |=3D res;
> +	}
>=20
> 	/* Check the PFN directly */
> 	res =3D protect_pci_bios(pfn, pfn + npg - 1);
> @@ -819,7 +827,7 @@ static int __should_split_large_page(pte
> 	 * extra conditional required here.
> 	 */
> 	chk_prot =3D static_protections(old_prot, lpaddr, old_pfn, numpages,
> -				      CPA_CONFLICT);
> +				      psize, CPA_CONFLICT);
>=20
> 	if (WARN_ON_ONCE(pgprot_val(chk_prot) !=3D pgprot_val(old_prot))) {
> 		/*
> @@ -855,7 +863,7 @@ static int __should_split_large_page(pte
> 	 * protection requirement in the large page.
> 	 */
> 	new_prot =3D static_protections(req_prot, lpaddr, old_pfn, numpages,
> -				      CPA_DETECT);
> +				      psize, CPA_DETECT);
>=20
> 	/*
> 	 * If there is a conflict, split the large page.
> @@ -906,7 +914,8 @@ static void split_set_pte(struct cpa_dat
> 	if (!cpa->force_static_prot)
> 		goto set;
>=20
> -	prot =3D static_protections(ref_prot, address, pfn, npg, CPA_PROTECT);
> +	/* Hand in lpsize =3D 0 to enforce the protection mechanism */
> +	prot =3D static_protections(ref_prot, address, pfn, npg, 0, CPA_PROTECT=
);
>=20
> 	if (pgprot_val(prot) =3D=3D pgprot_val(ref_prot))
> 		goto set;
> @@ -1503,7 +1512,8 @@ static int __change_page_attr(struct cpa
> 		pgprot_val(new_prot) |=3D pgprot_val(cpa->mask_set);
>=20
> 		cpa_inc_4k_install();
> -		new_prot =3D static_protections(new_prot, address, pfn, 1,
> +		/* Hand in lpsize =3D 0 to enforce the protection mechanism */
> +		new_prot =3D static_protections(new_prot, address, pfn, 1, 0,
> 					      CPA_PROTECT);
>=20
> 		new_prot =3D pgprot_clear_protnone_bits(new_prot);