From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 30B9439EF2E; Fri, 29 May 2026 07:25:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780039506; cv=none; b=go0P4syOYs5fBnw/Hno5nuGZFQwm5w09iTs4cjtPgBokgerr4BCdtuoeaqOzGbnl0dUyhmXyTLaons5qL47sFzRC/GNFYllPswvwOhN4HmFynnXvTX0OpClztw2bo4N6Zn3RJ3LFL8mkKFXEwF6DmVAZgrIOTN3TmWLQtmLHKcI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780039506; c=relaxed/simple; bh=qd5gEHq4/HklwNvBcX7Ni0HbPukEuBB4iJC1gA3gdTE=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=P7saxs6ikEj1XQZgTiLyMzeUNiIxgn6ebqTE5xR74Dy6E6aUbkeinK3vrj/UHmjdWhQbhcJYfR2FuDs+uOustQZZMbB69SO1t80NAJLgtDDgqal7QzLNpjDv5J2AvhYtiFJcD+nnuDAoLIUJroNGFl5IKu5xJ87eqzBUk7ek2SI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=dtcc3LgH; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="dtcc3LgH" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 788991F00898; Fri, 29 May 2026 07:24:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780039505; bh=DvnGy/aNdoF1O4Iz8f505H7qbHc2cS9hrHwlzAYFJpo=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=dtcc3LgHMxD/qPlbvql/b6ShNTNw5wxrlzhV+pAA+DKoz8JwSsviSl2sap7itXy8a RiJc+a/NkOEbKGc/FeXi3ZxGcjRme0f/QlRYgQt5uDSu135tVrwuq0rrr7NMkn0A5p hq5Bb2Jaw6WthWwi461yqEyOsDg2Op/ok22WtEahzW89aSoSHjcjqrGC64D0ZOOhg7 XlziVs3ZZuwSYh/rCy119Xtzb/Ruf4rPJ+DhY6hLnOJHQFYApCVWqeIsTAJyfh5jQs wUnCCK5FNnv6jlOLmEGjDPsUOugVmLGjHWDbj4tf0qlNlwiQYvvjOtwLA5qok4ts0x CYGE16Y7eB12w== Date: Fri, 29 May 2026 08:24:55 +0100 From: Lorenzo Stoakes To: Kiryl Shutsemau Cc: akpm@linux-foundation.org, rppt@kernel.org, peterx@redhat.com, david@kernel.org, surenb@google.com, vbabka@kernel.org, Liam.Howlett@oracle.com, ziy@nvidia.com, corbet@lwn.net, skhan@linuxfoundation.org, seanjc@google.com, pbonzini@redhat.com, jthoughton@google.com, aarcange@redhat.com, sj@kernel.org, usama.arif@linux.dev, linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org, kvm@vger.kernel.org, kernel-team@meta.com, "Kiryl Shutsemau (Meta)" Subject: Re: [PATCH v5 08/18] mm: add VM_UFFD_RWP VMA flag Message-ID: References: <20260526130509.2748441-1-kirill@shutemov.name> <20260526130509.2748441-9-kirill@shutemov.name> Precedence: bulk X-Mailing-List: linux-doc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260526130509.2748441-9-kirill@shutemov.name> On Tue, May 26, 2026 at 02:04:56PM +0100, Kiryl Shutsemau wrote: > From: "Kiryl Shutsemau (Meta)" > > Preparatory patch for userfaultfd read-write protection (RWP). RWP > extends userfaultfd protection from plain write-protection (WP) to > full read-write protection: accesses to an RWP-protected range -- > reads as well as writes -- trap through userfaultfd. > > Reserve VM_UFFD_RWP, add the userfaultfd_rwp() and > userfaultfd_protected() helpers, and wire up the smaps "ur" entry and > the trace-flag table the rest of the series will use. The flag is > gated on CONFIG_USERFAULTFD_RWP, which is introduced together with the > UAPI in a later patch; until then VM_UFFD_RWP aliases VM_NONE and > every downstream check folds to dead code. > > Nothing sets or queries the flag yet. > > Signed-off-by: Kiryl Shutsemau > Assisted-by: Claude:claude-opus-4-6 Hm, if you've just used claude to bounce ideas off, I'm really not sure if it's necessary to disclose, though I respect your thoroughness for doing so :) I guess determining the threshold at which it makes sense to do so is still a WIP for us in the kernel. > Reviewed-by: Mike Rapoport (Microsoft) > Reviewed-by: SeongJae Park > --- > Documentation/filesystems/proc.rst | 1 + > fs/proc/task_mmu.c | 3 +++ > include/linux/mm.h | 28 +++++++++++++++++---------- > include/linux/userfaultfd_k.h | 31 +++++++++++++++++++++++++----- > include/trace/events/mmflags.h | 7 +++++++ > 5 files changed, 55 insertions(+), 15 deletions(-) > > diff --git a/Documentation/filesystems/proc.rst b/Documentation/filesystems/proc.rst > index db6167befb7b..db28207c5290 100644 > --- a/Documentation/filesystems/proc.rst > +++ b/Documentation/filesystems/proc.rst > @@ -607,6 +607,7 @@ encoded manner. The codes are the following: > um userfaultfd missing tracking > uw userfaultfd wr-protect tracking > ui userfaultfd minor fault > + ur userfaultfd read-write-protect tracking > ss shadow/guarded control stack page > sl sealed > lf lock on fault pages > diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c > index 1e5f6ee8a3b6..974c5f4aa533 100644 > --- a/fs/proc/task_mmu.c > +++ b/fs/proc/task_mmu.c > @@ -1237,6 +1237,9 @@ static void show_smap_vma_flags(struct seq_file *m, struct vm_area_struct *vma) > #ifdef CONFIG_HAVE_ARCH_USERFAULTFD_MINOR > [ilog2(VM_UFFD_MINOR)] = "ui", > #endif /* CONFIG_HAVE_ARCH_USERFAULTFD_MINOR */ > +#ifdef CONFIG_USERFAULTFD_RWP > + [ilog2(VM_UFFD_RWP)] = "ur", > +#endif > #ifdef CONFIG_ARCH_HAS_USER_SHADOW_STACK > [ilog2(VM_SHADOW_STACK)] = "ss", > #endif > diff --git a/include/linux/mm.h b/include/linux/mm.h > index 71b11945e4fc..6499cfb61dc4 100644 > --- a/include/linux/mm.h > +++ b/include/linux/mm.h > @@ -362,6 +362,7 @@ enum { > #endif > DECLARE_VMA_BIT(UFFD_MINOR, 41), > DECLARE_VMA_BIT(SEALED, 42), > + DECLARE_VMA_BIT(UFFD_RWP, 43), I'm guessing CONFIG_USERFAULTFD_RWP is predicated on CONFIG_64BIT? It's a silly situation and once my VMA flags stuff is done it'll be eliminated but for now... :) > /* Flags that reuse flags above. */ > DECLARE_VMA_BIT_ALIAS(PKEY_BIT0, HIGH_ARCH_0), > DECLARE_VMA_BIT_ALIAS(PKEY_BIT1, HIGH_ARCH_1), > @@ -505,6 +506,11 @@ enum { > #else > #define VM_UFFD_MINOR VM_NONE > #endif > +#ifdef CONFIG_USERFAULTFD_RWP > +#define VM_UFFD_RWP INIT_VM_FLAG(UFFD_RWP) > +#else > +#define VM_UFFD_RWP VM_NONE > +#endif > #ifdef CONFIG_64BIT > #define VM_ALLOW_ANY_UNCACHED INIT_VM_FLAG(ALLOW_ANY_UNCACHED) > #define VM_SEALED INIT_VM_FLAG(SEALED) > @@ -642,22 +648,24 @@ enum { > * reconsistuted upon page fault, so necessitate page table copying upon fork. > * > * Note that these flags should be compared with the DESTINATION VMA not the > - * source, as VM_UFFD_WP may not be propagated to destination, while all other > - * flags will be. > + * source: VM_UFFD_WP and VM_UFFD_RWP may be cleared on the destination > + * (dup_userfaultfd() -> userfaultfd_reset_ctx() when the parent context did > + * not negotiate UFFD_FEATURE_EVENT_FORK), while all other flags propagate. > * > * VM_PFNMAP / VM_MIXEDMAP - These contain kernel-mapped data which cannot be > * reasonably reconstructed on page fault. > * > * VM_UFFD_WP - Encodes metadata about an installed uffd > - * write protect handler, which cannot be > - * reconstructed on page fault. > + * VM_UFFD_RWP write- or read-write-protect handler, which > + * cannot be reconstructed on page fault. > * > - * We always copy pgtables when dst_vma has uffd-wp > - * enabled even if it's file-backed > - * (e.g. shmem). Because when uffd-wp is enabled, > - * pgtable contains uffd-wp protection information, > - * that's something we can't retrieve from page cache, > - * and skip copying will lose those info. > + * We always copy pgtables when dst_vma has the > + * uffd PTE bit in use even if it's file-backed > + * (e.g. shmem). Because when the uffd bit is > + * in use, the pgtable contains the protection > + * information, that's something we can't > + * retrieve from page cache, and skip copying > + * will lose those info. > * > * VM_MAYBE_GUARD - Could contain page guard region markers which > * by design are a property of the page tables > diff --git a/include/linux/userfaultfd_k.h b/include/linux/userfaultfd_k.h > index f4cf5763f92c..0aef628514df 100644 > --- a/include/linux/userfaultfd_k.h > +++ b/include/linux/userfaultfd_k.h > @@ -21,10 +21,11 @@ > #include > > /* The set of all possible UFFD-related VM flags. */ > -#define __VM_UFFD_FLAGS (VM_UFFD_MISSING | VM_UFFD_WP | VM_UFFD_MINOR) > +#define __VM_UFFD_FLAGS (VM_UFFD_MISSING | VM_UFFD_MINOR | \ > + VM_UFFD_WP | VM_UFFD_RWP) > > #define __VMA_UFFD_FLAGS mk_vma_flags(VMA_UFFD_MISSING_BIT, VMA_UFFD_WP_BIT, \ > - VMA_UFFD_MINOR_BIT) > + VMA_UFFD_MINOR_BIT, VMA_UFFD_RWP_BIT) > > /* > * CAREFUL: Check include/uapi/asm-generic/fcntl.h when defining > @@ -178,7 +179,7 @@ static inline bool is_mergeable_vm_userfaultfd_ctx(struct vm_area_struct *vma, > */ > static inline bool uffd_disable_huge_pmd_share(struct vm_area_struct *vma) > { > - return vma->vm_flags & (VM_UFFD_WP | VM_UFFD_MINOR); > + return vma->vm_flags & (VM_UFFD_MINOR | VM_UFFD_WP | VM_UFFD_RWP); While we're here we might as well switch to using the new API? Can do: return vma_test_any_mask(vma, __VMA_UFFD_FLAGS); One unfortunate thing is using bit values means we can't do the VM_NONE trick, but if !CONFIG_USERFAULTFD_RWP then VMA_UFFD_RWP_BIT wouldn't be set anyway, same for minor so this should be fine? > } > > /* > @@ -208,6 +209,16 @@ static inline bool userfaultfd_minor(struct vm_area_struct *vma) > return vma->vm_flags & VM_UFFD_MINOR; > } > > +static inline bool userfaultfd_rwp(struct vm_area_struct *vma) > +{ > + return vma->vm_flags & VM_UFFD_RWP; > +} Can be: return vma_test(vma, VMA_UFFD_RWP_BIT); > + > +static inline bool userfaultfd_protected(struct vm_area_struct *vma) > +{ > + return userfaultfd_wp(vma) || userfaultfd_rwp(vma); > +} > + > static inline bool userfaultfd_pte_wp(struct vm_area_struct *vma, > pte_t pte) > { > @@ -328,6 +339,16 @@ static inline bool userfaultfd_minor(struct vm_area_struct *vma) > return false; > } > > +static inline bool userfaultfd_rwp(struct vm_area_struct *vma) > +{ > + return false; > +} > + > +static inline bool userfaultfd_protected(struct vm_area_struct *vma) > +{ > + return false; > +} > + > static inline bool userfaultfd_pte_wp(struct vm_area_struct *vma, > pte_t pte) > { > @@ -421,8 +442,8 @@ static inline bool userfaultfd_wp_use_markers(struct vm_area_struct *vma) > } > > /* > - * Returns true if this is a swap pte and was uffd-wp wr-protected in either > - * forms (pte marker or a normal swap pte), false otherwise. > + * Returns true if this swap pte carries uffd-tracked state in either > + * form (pte marker or a normal swap pte), false otherwise. > */ > static inline bool pte_swp_uffd_any(pte_t pte) > { > diff --git a/include/trace/events/mmflags.h b/include/trace/events/mmflags.h > index a6e5a44c9b42..bfface3d0203 100644 > --- a/include/trace/events/mmflags.h > +++ b/include/trace/events/mmflags.h > @@ -194,6 +194,12 @@ IF_HAVE_PG_ARCH_3(arch_3) > # define IF_HAVE_UFFD_MINOR(flag, name) > #endif > > +#ifdef CONFIG_USERFAULTFD_RWP > +# define IF_HAVE_UFFD_RWP(flag, name) {flag, name}, > +#else > +# define IF_HAVE_UFFD_RWP(flag, name) > +#endif > + > #if defined(CONFIG_64BIT) || defined(CONFIG_PPC32) > # define IF_HAVE_VM_DROPPABLE(flag, name) {flag, name}, > #else > @@ -215,6 +221,7 @@ IF_HAVE_UFFD_MINOR(VM_UFFD_MINOR, "uffd_minor" ) \ > {VM_PFNMAP, "pfnmap" }, \ > {VM_MAYBE_GUARD, "maybe_guard" }, \ > {VM_UFFD_WP, "uffd_wp" }, \ > +IF_HAVE_UFFD_RWP(VM_UFFD_RWP, "uffd_rwp" ) \ > {VM_LOCKED, "locked" }, \ > {VM_IO, "io" }, \ > {VM_SEQ_READ, "seqread" }, \ > -- > 2.54.0 > Cheers, Lorenzo