From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D792F37C90C for ; Thu, 5 Mar 2026 15:58:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.73 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772726321; cv=none; b=hRA9hBgMp9soeMyKrE7S4CnGRVTHIZkVzbXuwX0JXusBPDIj6Rn+ehqNaBiaNMVnnRqV0TdYxt0zIzDFMypHzlm5z2cEjH+WkzdGGg3VDoru/jUmzyHYdXUudqV6dKNGU9/XRluw/tGATjKvH1owp5DIcC8pz4a6p95jeANZB7U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772726321; c=relaxed/simple; bh=oNCFurlKx0FeZ/EYAzDOw/qqYHTT5MWNSdM2p2PCMrs=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=SZcfpKv/8U7ZsSpjggwwd4WO7/AwtEHw4naeHHlHg2pky1DNQqSuEcoFmTBUCYzGmnH3bDN2Sr32yKljfxNbCqGlSxw0bkTbRDXUcXFomM5sLTsmTB4BhFEY2v6ZFEaZl6MOOsbyw7tQ4ic6B8XXp/uD7lKIyVWZfkjJUYfYb/8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--jackmanb.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=cY4wHzBi; arc=none smtp.client-ip=209.85.128.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--jackmanb.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="cY4wHzBi" Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-483a24db6ecso99219935e9.1 for ; Thu, 05 Mar 2026 07:58:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1772726318; x=1773331118; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=k3V7M4a9Y5QPWB0hu53eAcqPdtXJEAUrJLWxVZTKOBw=; b=cY4wHzBiDW2yn4oJP4yrQBrCIL+8bcvAIVox/+FO+vK4hwZ3CaeFNxwd/UU9OqMJhr X8ooVTXasM9FRgQE+50xGbaKuU/d3p54KM4pswFc0/hwLGXY6/v55NNa6rTzsI7lPtXc qF+vOnxmxCkrWeXCb8pD2iX+B2cymumOCYvYCOGWnuT/mgoc8c0opmYfiIyi/BNUAIsU DtUqk9ymDc1Y+i0bD5XnTj7gmURQrrTeGo7WB3ycE4Psj8Q13YKslVwnRaMBUfYYarZF +OZHdv4ssF//b5WG9ByouKB9xvofggoGD3do7qh7Mp7N1SwUEAMJxdzXVdXg17bSuNz/ 5ZEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772726318; x=1773331118; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=k3V7M4a9Y5QPWB0hu53eAcqPdtXJEAUrJLWxVZTKOBw=; b=WXKafP6M0awUZaA8mHjh1bdqZiROOqpdgdH8ITRnDWgMRO3Z8asptmFVbr+fPnYF7W C/YfrEB3e9h8I3iD8OXx2cGxat21EEyDvDMamYzbW5E/wjCArKkuozClaCiFkY7QnsM6 +js6DYEUKNf5zzbRHdsB8rdqHP6DDCfqUj4GVAqjVIG00iwtHLwnGaDbT22DM33Xhacb sWS3vmGwlqJajlgpByQ7Ar9afmeYjk4hZXXRkc8Xm2/Xc26skt4nnTKTZEbGyK8WyTFn cvzYJ5BXCE8GgEfboZnvkfYMm7VK6H0MoRV3Cm9UXDHnPCaOsERaA2g+4nYGrOOqD/Jf VzcA== X-Forwarded-Encrypted: i=1; AJvYcCV05jRmxaQJgI3JoH/rc+ve5mRbkgfb6JFVrfk5pyyfGmgwAdmvXhsC+TfDXRuvKsTHAt7Vwc0hPxy2BnI=@vger.kernel.org X-Gm-Message-State: AOJu0Yy+I1wlDxSmMIQY34BT4gDyU1RrMg9CePHFemILpTA5dND2Xvld kzin+jZWXjFU8pheq8Gb6I5KdRukc35oV074NCwWI6oFBAhgGD6L9uLcM9HU0MStV9M7MaEbeX3 mbIf1bPi9UK8rqw== X-Received: from wmbg9.prod.google.com ([2002:a05:600c:a409:b0:483:7827:ade4]) (user=jackmanb job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:34c6:b0:483:71f7:2782 with SMTP id 5b1f17b1804b1-48519855f27mr113892325e9.12.1772726318086; Thu, 05 Mar 2026 07:58:38 -0800 (PST) Date: Thu, 05 Mar 2026 15:58:37 +0000 In-Reply-To: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260225-page_alloc-unmapped-v1-0-e8808a03cd66@google.com> X-Mailer: aerc 0.21.0 Message-ID: Subject: Re: [PATCH RFC 00/19] mm: Add __GFP_UNMAPPED From: Brendan Jackman To: Kevin Brodsky , Brendan Jackman , Borislav Petkov , Dave Hansen , Peter Zijlstra , Andrew Morton , David Hildenbrand , Lorenzo Stoakes , Vlastimil Babka , Wei Xu , Johannes Weiner , Zi Yan Cc: , , , , Sumit Garg , , , Will Deacon , , "Kalyazin, Nikita" , , "Itazuri, Takahiro" , Andy Lutomirski , David Kaplan , Thomas Gleixner , Yosry Ahmed , Ryan Roberts , Rick Edgecombe Content-Type: text/plain; charset="UTF-8" On Thu Mar 5, 2026 at 2:51 PM UTC, Kevin Brodsky wrote: > On 25/02/2026 17:34, Brendan Jackman wrote: >> .:::: Design: Introducing "freetypes" >> >> The biggest challenge for efficiently getting stuff out of the direct >> map is TLB flushing. Pushing this problem into the page allocator turns >> out to enable amortising that flush cost into almost nothing. The core >> idea is to have pools of already-unmapped pages. We'd like those pages >> to be physically contiguous so they don't unduly fragment the pagetables >> around them, and we'd like to be able to efficiently look up these >> already-unmapped pages during allocation. The page allocator already has >> deeply-ingrained functionality for physically grouping pages by a >> certain attribute, and then indexing free pages by that attribute, this >> mechanism is: migratetypes. >> >> So basically, this series extends the concepts of migratetypes in the >> allocator so that as well as just representing mobility, they can >> represent other properties of the page too. (Actually, migratetypes are >> already sort of overloaded, but the main extension is to be able to >> represent _orthogonal_ properties). In order to avoid further >> overloading the concept of a migratetype, this extension is done by >> adding a new concept on top of migratetype: the _freetype_. A freetype >> is basically just a migratetype plus some flags, and it replaces >> migratetypes wherever the latter is currently used as to index free >> pages. >> >> The first freetype flag is then added, which marks the pages it indexes >> as being absent from the direct map. This is then used to implement the >> new __GFP_UNMAPPED flag, which allocates pages from pageblocks that have >> the new flag, or unmaps pages if no existing ones are already available. > > This approach seems very interesting to me, and I wonder if it could be > applied to another use-case. > > I am working on a security feature to protect page table pages (PTPs) > using pkeys [1]. This relies on all PTPs being mapped with a specific > pkey (in the direct map). That requires changing a mapping attribute > rather than making it invalid, but AFAICT this is essentially the same > problem as the one you're trying to solve. Yeah, I think so: 1. The fragmentation issues seem exactly the same. 2. The TLB flushing issues are probably also basically the same, I assume you need to flush the TLB when you convert a page to use for pagetables, and without allocator integration that can happen pretty often and in hot paths. Correct? > There are however extra challenges with mapping PTPs with special > attributes. The main one, which you mention in patch 17, is that > splitting the direct map may require allocating PTPs, which may lead to > recursion. > > [1] introduces a dedicated page table allocator on top of the buddy > allocator, which attempts to cache PMD-sized blocks if possible. It > ensures that no recursion occurs by using a special flag when allocating > PTPs while splitting the direct map, and keeping a reserve of pages > specifically for that situation (patch 15 and 24). Right, and actually just today someone pointed out mm/execmem.c to me, I think execmem_cache_populate() is basically doing the same thing (although it's also creating a separate virtual mapping). > There is also special > handling for early page tables (essentially keeping track of them and > setting their pkey once we can split the direct map). > > Do you think that this freetype infrastructure could be used for that > purpose, instead of introducing a layer on top of the buddy allocator? Yes!!! 100% definitely, my code certainly solves all your problems... > I > expect that much of the special handling for allocating PTPs can be kept > separate. Ensuring that protected pages are always available to split > the direct map may be difficult though... This is deeply embedded in the > allocator I proposed. ...Oh, hm, well, um, good point. Thinking aloud a bit... The way this series dodges the question is (copying from the code comments in patch 17 for convenient reading): 1) - The direct map starts out fully mapped at boot. (This is not really * an assumption" as its in direct control of page_alloc.c). * 2) - Once pages in the direct map are broken down, they are not * re-aggregated into larger pages again. * 3) - Pagetables are never allocated with __GFP_UNMAPPED. * * Under these assumptions, a pagetable might need to be allocated while * _unmapping_ stuff from the direct map during a __GFP_UNMAPPED * allocation. But, the allocation of that pagetable never requires * allocating a further pagetable. In other words, we might need to allocate while we allocate (which is fine because I have to do locking shenanigans anyway due to x86 TLB shootdown requirements), but there's no further recursion after that. Can we come up with an analogue for protected PTPs? Point 3) is the inflexible one, and we obviously can't say "PTPs are never allocated as PTPs". But if we invert it and _also_ invert point 1) I think we get something that works in principle: 1) The direct map starts out _fully protected_ (i.e. we treat everything as if it's a pagetable at first). 2) We assume the direct map doesn't get reaggregated once we've broken things down to serve PTP allocations 3) PTPs are always PTPs... But... this is a bit silly, since what it means is we'll then go through ~all the pagetblocks in the system (except the ones that _are_ actually used for PTPs) and flip their pkey, breaking down the physmap to pageblock granularity as we go. And... if we're gonna do that, we might as well just say the physmap has to be at pageblock granularity to begin with. (Could we do that? Maybe - Mike Rapoport has previously argued that physmap fragmentation is not a very big deal, so I guess the question is whether we're ready to really lean into that analysis, it would be quite painful if it turned out to be wrong). Another potential "dodge": Is it really important that the PTPs are always protected from the very moment they are created? Coz this feature still seems pretty useful even if there's an awkward fallback case where, under specific memory pressure patterns, we temporarily use unprotected pagetables to set up protected pagetables. That still makes exploiting a pagetable overwrite an order of magnitude harder than before, right? Similar to how there's probably ways to exploit bugs if you can get them to race with the intended pagetable update paths that flip the pkey register, or if you can get a ROP chain to flip that register for you or whatever.