Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.300.101.1.3\))
Subject: Re: [PATCH 3/3] mm/uffd: Detect pgtable allocation failures
From:   Nadav Amit <nadav.amit@gmail.com>
In-Reply-To: <20230104225207.1066932-4-peterx@redhat.com>
Date:   Wed, 4 Jan 2023 19:10:55 -0800
Cc:     Linux-MM <linux-mm@kvack.org>,
        kernel list <linux-kernel@vger.kernel.org>,
        Mike Kravetz <mike.kravetz@oracle.com>,
        Muchun Song <songmuchun@bytedance.com>,
        Andrea Arcangeli <aarcange@redhat.com>,
        David Hildenbrand <david@redhat.com>,
        James Houghton <jthoughton@google.com>,
        Axel Rasmussen <axelrasmussen@google.com>,
        Andrew Morton <akpm@linux-foundation.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <AF984D5D-DC66-4FD3-A749-5AF6B7289E0D@gmail.com>
References: <20230104225207.1066932-1-peterx@redhat.com>
 <20230104225207.1066932-4-peterx@redhat.com>
To:     Peter Xu <peterx@redhat.com>
Precedence: bulk


> On Jan 4, 2023, at 2:52 PM, Peter Xu <peterx@redhat.com> wrote:
>=20
> Before this patch, when there's any pgtable allocation issues happened
> during change_protection(), the error will be ignored from the =
syscall.
> For shmem, there will be an error dumped into the host dmesg.  Two =
issues
> with that:
>=20
>  (1) Doing a trace dump when allocation fails is not anything close to
>      grace..
>=20
>  (2) The user should be notified with any kind of such error, so the =
user
>      can trap it and decide what to do next, either by retrying, or =
stop
>      the process properly, or anything else.
>=20
> For userfault users, this will change the API of UFFDIO_WRITEPROTECT =
when
> pgtable allocation failure happened.  It should not normally break =
anyone,
> though.  If it breaks, then in good ways.
>=20
> One man-page update will be on the way to introduce the new -ENOMEM =
for
> UFFDIO_WRITEPROTECT.  Not marking stable so we keep the old behavior =
on the
> 5.19-till-now kernels.

I understand that the current assumption is that change_protection() =
should
fully succeed or fail, and I guess this is the current behavior.

However, to be more =E2=80=9Cfuture-proof=E2=80=9D perhaps this needs to =
be revisited.

For instance, UFFDIO_WRITEPROTECT can benefit from the ability to (based =
on
userspace request) prevent write-protection of pages that are pinned. =
This is
necessary to allow userspace uffd monitor to avoid write-protection of
O_DIRECT=E2=80=99d memory, for instance, that might change even if a =
uffd monitor
considers it write-protected.

In such a case, a =E2=80=9Cpartial failure=E2=80=9D is possible, since =
only part of the memory
was write-protected. The uffd monitor should be allowed to continue
execution, but it has to know the part of the memory that was =
successfully
write-protected.=20

To support =E2=80=9Cpartial failure=E2=80=9D, the kernel should return =
to
UFFDIO_WRITEPROTECT-users the number of pages/bytes that were not
successfully write-protected, unless no memory was successfully
write-protected. (Unlike NUMA, pages that were skipped should be =
accounted
as =E2=80=9Csuccessfully write-protected").=20

I am only raising this subject to avoid multiple API changes.