[v2,1/3] userfaultfd: UFFDIO_REMAP: rmap preparation

Commit Message

Suren Baghdasaryan Sept. 23, 2023, 1:31 a.m. UTC

From: Andrea Arcangeli <[e-mail]>

As far as the rmap code is concerned, UFFDIO_REMAP only alters the
page->mapping and page->index. It does it while holding the page
lock. However folio_referenced() is doing rmap walks without taking the
folio lock first, so folio_lock_anon_vma_read() must be updated to
re-check that the folio->mapping didn't change after we obtained the
anon_vma read lock.

UFFDIO_REMAP takes the anon_vma lock for writing before altering the
folio->mapping, so if the folio->mapping is still the same after
obtaining the anon_vma read lock (without the folio lock), the rmap
walks can go ahead safely (and UFFDIO_REMAP will wait the rmap walk to
complete before proceeding).

UFFDIO_REMAP serializes against itself with the folio lock.

All other places taking the anon_vma lock while holding the mmap_lock
for writing, don't need to check if the folio->mapping has changed
after taking the anon_vma lock, regardless of the folio lock, because
UFFDIO_REMAP holds the mmap_lock for reading.

There's one constraint enforced to allow this simplification: the
source pages passed to UFFDIO_REMAP must be mapped only in one vma,
but this constraint is an acceptable tradeoff for UFFDIO_REMAP
users.

The source addresses passed to UFFDIO_REMAP can be set as
VM_DONTCOPY with MADV_DONTFORK to avoid any risk of the mapcount of
the pages increasing if some thread of the process forks() before
UFFDIO_REMAP run.

Signed-off-by: Andrea Arcangeli <[e-mail]>
Signed-off-by: Suren Baghdasaryan <[e-mail]>
---
 mm/rmap.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

Comments

Peter Xu Sept. 28, 2023, 4:23 p.m. UTC | #1

Suren,

Sorry to review so late.

On Fri, Sep 22, 2023 at 06:31:44PM -0700, Suren Baghdasaryan wrote:
> diff --git a/mm/rmap.c b/mm/rmap.c
> index ec7f8e6c9e48..c1ebbd23fa61 100644
> --- a/mm/rmap.c
> +++ b/mm/rmap.c
> @@ -542,6 +542,7 @@ struct anon_vma *folio_lock_anon_vma_read(struct folio *folio,
>  	struct anon_vma *root_anon_vma;
>  	unsigned long anon_mapping;
>  
> +repeat:
>  	rcu_read_lock();
>  	anon_mapping = (unsigned long)READ_ONCE(folio->mapping);
>  	if ((anon_mapping & PAGE_MAPPING_FLAGS) != PAGE_MAPPING_ANON)
> @@ -586,6 +587,18 @@ struct anon_vma *folio_lock_anon_vma_read(struct folio *folio,
>  	rcu_read_unlock();
>  	anon_vma_lock_read(anon_vma);
>  
> +	/*
> +	 * Check if UFFDIO_REMAP changed the anon_vma. This is needed
> +	 * because we don't assume the folio was locked.
> +	 */
> +	if (unlikely((unsigned long) READ_ONCE(folio->mapping) !=
> +		     anon_mapping)) {
> +		anon_vma_unlock_read(anon_vma);
> +		put_anon_vma(anon_vma);
> +		anon_vma = NULL;
> +		goto repeat;
> +	}

We have an open-coded fast path above this:

	if (down_read_trylock(&root_anon_vma->rwsem)) {
		/*
		 * If the folio is still mapped, then this anon_vma is still
		 * its anon_vma, and holding the mutex ensures that it will
		 * not go away, see anon_vma_free().
		 */
		if (!folio_mapped(folio)) {
			up_read(&root_anon_vma->rwsem);
			anon_vma = NULL;
		}
		goto out;
	}

Would that also need such check?

> +
>  	if (atomic_dec_and_test(&anon_vma->refcount)) {
>  		/*
>  		 * Oops, we held the last refcount, release the lock
> -- 
> 2.42.0.515.g380fc7ccd1-goog
>

Suren Baghdasaryan Sept. 28, 2023, 8:03 p.m. UTC | #2

On Thu, Sep 28, 2023 at 9:23 AM Peter Xu <[e-mail]> wrote:
>
> Suren,
>
> Sorry to review so late.
>
> On Fri, Sep 22, 2023 at 06:31:44PM -0700, Suren Baghdasaryan wrote:
> > diff --git a/mm/rmap.c b/mm/rmap.c
> > index ec7f8e6c9e48..c1ebbd23fa61 100644
> > --- a/mm/rmap.c
> > +++ b/mm/rmap.c
> > @@ -542,6 +542,7 @@ struct anon_vma *folio_lock_anon_vma_read(struct folio *folio,
> >       struct anon_vma *root_anon_vma;
> >       unsigned long anon_mapping;
> >
> > +repeat:
> >       rcu_read_lock();
> >       anon_mapping = (unsigned long)READ_ONCE(folio->mapping);
> >       if ((anon_mapping & PAGE_MAPPING_FLAGS) != PAGE_MAPPING_ANON)
> > @@ -586,6 +587,18 @@ struct anon_vma *folio_lock_anon_vma_read(struct folio *folio,
> >       rcu_read_unlock();
> >       anon_vma_lock_read(anon_vma);
> >
> > +     /*
> > +      * Check if UFFDIO_REMAP changed the anon_vma. This is needed
> > +      * because we don't assume the folio was locked.
> > +      */
> > +     if (unlikely((unsigned long) READ_ONCE(folio->mapping) !=
> > +                  anon_mapping)) {
> > +             anon_vma_unlock_read(anon_vma);
> > +             put_anon_vma(anon_vma);
> > +             anon_vma = NULL;
> > +             goto repeat;
> > +     }
>
> We have an open-coded fast path above this:
>
>         if (down_read_trylock(&root_anon_vma->rwsem)) {
>                 /*
>                  * If the folio is still mapped, then this anon_vma is still
>                  * its anon_vma, and holding the mutex ensures that it will
>                  * not go away, see anon_vma_free().
>                  */
>                 if (!folio_mapped(folio)) {
>                         up_read(&root_anon_vma->rwsem);
>                         anon_vma = NULL;
>                 }
>                 goto out;
>         }
>
> Would that also need such check?

Yes, I think they should be handled the same way. Will fix. Thanks!

>
> > +
> >       if (atomic_dec_and_test(&anon_vma->refcount)) {
> >               /*
> >                * Oops, we held the last refcount, release the lock
> > --
> > 2.42.0.515.g380fc7ccd1-goog
> >
>
> --
> Peter Xu
>

David Hildenbrand Oct. 2, 2023, 2:42 p.m. UTC | #3

On 23.09.23 03:31, Suren Baghdasaryan wrote:
> From: Andrea Arcangeli <[e-mail]>
> 
> As far as the rmap code is concerned, UFFDIO_REMAP only alters the
> page->mapping and page->index. It does it while holding the page
> lock. However folio_referenced() is doing rmap walks without taking the
> folio lock first, so folio_lock_anon_vma_read() must be updated to
> re-check that the folio->mapping didn't change after we obtained the
> anon_vma read lock.

I'm curious: why don't we need this for existing users of 
page_move_anon_rmap()? What's special about UFFDIO_REMAP?

Peter Xu Oct. 2, 2023, 3:23 p.m. UTC | #4

On Mon, Oct 02, 2023 at 04:42:50PM +0200, David Hildenbrand wrote:
> On 23.09.23 03:31, Suren Baghdasaryan wrote:
> > From: Andrea Arcangeli <[e-mail]>
> > 
> > As far as the rmap code is concerned, UFFDIO_REMAP only alters the
> > page->mapping and page->index. It does it while holding the page
> > lock. However folio_referenced() is doing rmap walks without taking the
> > folio lock first, so folio_lock_anon_vma_read() must be updated to
> > re-check that the folio->mapping didn't change after we obtained the
> > anon_vma read lock.
> 
> I'm curious: why don't we need this for existing users of
> page_move_anon_rmap()? What's special about UFFDIO_REMAP?

Totally no expert on anon vma so I'm prone to errors, but IIUC the
difference here is root anon vma cannot change in page_move_anon_rmap(),
while UFFDIO_REMAP can.

Thanks,

David Hildenbrand Oct. 2, 2023, 5:30 p.m. UTC | #5

On 02.10.23 17:23, Peter Xu wrote:
> On Mon, Oct 02, 2023 at 04:42:50PM +0200, David Hildenbrand wrote:
>> On 23.09.23 03:31, Suren Baghdasaryan wrote:
>>> From: Andrea Arcangeli <[e-mail]>
>>>
>>> As far as the rmap code is concerned, UFFDIO_REMAP only alters the
>>> page->mapping and page->index. It does it while holding the page
>>> lock. However folio_referenced() is doing rmap walks without taking the
>>> folio lock first, so folio_lock_anon_vma_read() must be updated to
>>> re-check that the folio->mapping didn't change after we obtained the
>>> anon_vma read lock.
>>
>> I'm curious: why don't we need this for existing users of
>> page_move_anon_rmap()? What's special about UFFDIO_REMAP?
> 
> Totally no expert on anon vma so I'm prone to errors, but IIUC the
> difference here is root anon vma cannot change in page_move_anon_rmap(),
> while UFFDIO_REMAP can.

That does sound reasonable, thanks.

Probably we can do better with the patch description (once [1] is used 
to move the folio to the other anon_vma).

"mm/rmap: support move to different root anon_vma in folio_move_anon_rmap()

For now, folio_move_anon_rmap() was only used to move a folio to a 
different anon_vma after fork(), whereby the root anon_vma stayed 
unchanged. For that, it was sufficient to hold the page lock when 
calling folio_move_anon_rmap().

However, we want to make use of folio_move_anon_rmap() to move folios 
between VMAs that have a different root anon_vma. As folio_referenced() 
performs an RMAP walk without holding the page lock but only holding the 
anon_vma in read mode, holding the page lock is insufficient.

When moving to an anon_vma with a different root anon_vma, we'll have to 
hold both, the page lock and the anon_vma lock in write mode. 
Consequently, whenever we succeeded in folio_lock_anon_vma_read() to 
read-lock the anon_vma, we have to re-check if the mapping was changed 
in the meantime. If that was the case, we have to retry.

Note that folio_move_anon_rmap() must only be called if the anon page is 
exclusive to a process, and must not be called on KSM folios.

This is a preparation for UFFDIO_REMAP, which will hold the page lock, 
the anon_vma lock in write mode, and the mmap_lock in read mode.
"

In addition, we should document these locking details for 
folio_move_anon_rmap() and probably not mention UFFDIO_REMAP in the 
comment in folio_lock_anon_vma_read(), but instead say 
"folio_move_anon_rmap() might have changed the anon_vma as we might not 
hold the page lock here."


[1] https://lkml.kernel.org/r/[e-mail]

Suren Baghdasaryan Oct. 3, 2023, 5:56 p.m. UTC | #6

On Mon, Oct 2, 2023 at 10:30 AM David Hildenbrand <[e-mail]> wrote:
>
> On 02.10.23 17:23, Peter Xu wrote:
> > On Mon, Oct 02, 2023 at 04:42:50PM +0200, David Hildenbrand wrote:
> >> On 23.09.23 03:31, Suren Baghdasaryan wrote:
> >>> From: Andrea Arcangeli <[e-mail]>
> >>>
> >>> As far as the rmap code is concerned, UFFDIO_REMAP only alters the
> >>> page->mapping and page->index. It does it while holding the page
> >>> lock. However folio_referenced() is doing rmap walks without taking the
> >>> folio lock first, so folio_lock_anon_vma_read() must be updated to
> >>> re-check that the folio->mapping didn't change after we obtained the
> >>> anon_vma read lock.
> >>
> >> I'm curious: why don't we need this for existing users of
> >> page_move_anon_rmap()? What's special about UFFDIO_REMAP?
> >
> > Totally no expert on anon vma so I'm prone to errors, but IIUC the
> > difference here is root anon vma cannot change in page_move_anon_rmap(),
> > while UFFDIO_REMAP can.
>
> That does sound reasonable, thanks.
>
> Probably we can do better with the patch description (once [1] is used
> to move the folio to the other anon_vma).

I'll develop the next version with your patches in the baseline.
Hopefully by the time of my posting your patches will be in the
mm-unstable.

>
> "mm/rmap: support move to different root anon_vma in folio_move_anon_rmap()
>
> For now, folio_move_anon_rmap() was only used to move a folio to a
> different anon_vma after fork(), whereby the root anon_vma stayed
> unchanged. For that, it was sufficient to hold the page lock when
> calling folio_move_anon_rmap().
>
> However, we want to make use of folio_move_anon_rmap() to move folios
> between VMAs that have a different root anon_vma. As folio_referenced()
> performs an RMAP walk without holding the page lock but only holding the
> anon_vma in read mode, holding the page lock is insufficient.
>
> When moving to an anon_vma with a different root anon_vma, we'll have to
> hold both, the page lock and the anon_vma lock in write mode.
> Consequently, whenever we succeeded in folio_lock_anon_vma_read() to
> read-lock the anon_vma, we have to re-check if the mapping was changed
> in the meantime. If that was the case, we have to retry.
>
> Note that folio_move_anon_rmap() must only be called if the anon page is
> exclusive to a process, and must not be called on KSM folios.
>
> This is a preparation for UFFDIO_REMAP, which will hold the page lock,
> the anon_vma lock in write mode, and the mmap_lock in read mode.
> "

Thanks for taking time to write this up! Looks really clear to me.
I'll reuse it.

>
> In addition, we should document these locking details for
> folio_move_anon_rmap() and probably not mention UFFDIO_REMAP in the
> comment in folio_lock_anon_vma_read(), but instead say
> "folio_move_anon_rmap() might have changed the anon_vma as we might not
> hold the page lock here."

Sounds good. Will add.

>
>
> [1] https://lkml.kernel.org/r/[e-mail]
>
> --
> Cheers,
>
> David / dhildenb
>

Patch

diff --git a/mm/rmap.c b/mm/rmap.c
index ec7f8e6c9e48..c1ebbd23fa61 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -542,6 +542,7 @@  struct anon_vma *folio_lock_anon_vma_read(struct folio *folio,
 	struct anon_vma *root_anon_vma;
 	unsigned long anon_mapping;
 
+repeat:
 	rcu_read_lock();
 	anon_mapping = (unsigned long)READ_ONCE(folio->mapping);
 	if ((anon_mapping & PAGE_MAPPING_FLAGS) != PAGE_MAPPING_ANON)
@@ -586,6 +587,18 @@  struct anon_vma *folio_lock_anon_vma_read(struct folio *folio,
 	rcu_read_unlock();
 	anon_vma_lock_read(anon_vma);
 
+	/*
+	 * Check if UFFDIO_REMAP changed the anon_vma. This is needed
+	 * because we don't assume the folio was locked.
+	 */
+	if (unlikely((unsigned long) READ_ONCE(folio->mapping) !=
+		     anon_mapping)) {
+		anon_vma_unlock_read(anon_vma);
+		put_anon_vma(anon_vma);
+		anon_vma = NULL;
+		goto repeat;
+	}
+
 	if (atomic_dec_and_test(&anon_vma->refcount)) {
 		/*
 		 * Oops, we held the last refcount, release the lock