From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 68C6FC7EE29 for ; Mon, 22 May 2023 12:52:38 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id BC048900002; Mon, 22 May 2023 08:52:37 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id B701B6B0075; Mon, 22 May 2023 08:52:37 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A3835900002; Mon, 22 May 2023 08:52:37 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 903E26B0074 for ; Mon, 22 May 2023 08:52:37 -0400 (EDT) Received: from smtpin12.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 5C22D8021C for ; Mon, 22 May 2023 12:52:37 +0000 (UTC) X-FDA: 80817879954.12.26948C8 Received: from out-28.mta0.migadu.com (out-28.mta0.migadu.com [91.218.175.28]) by imf13.hostedemail.com (Postfix) with ESMTP id 67F5120002 for ; Mon, 22 May 2023 12:52:35 +0000 (UTC) Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=jdLuNuP5; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf13.hostedemail.com: domain of qi.zheng@linux.dev designates 91.218.175.28 as permitted sender) smtp.mailfrom=qi.zheng@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1684759955; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=YHbNOydWK5gCXaBShYnOGzZDvMMinxhe2BOs3NoEFIo=; b=YzUFciWn6aZ6SdHVWoikIr/FQWfDL2GFmLDMnIt7x7wGQrvbLeJIDLWSMZsh8Tb2pF+Gom rkq+tB5j0sDWQTB2GfYRSYBewSIQx+PNDXsMhIXYNopTiE9Ml/fbJZP/+ZJDpyI3KvyM2Z MwJyQhn65t2lPR2rv8lRw3yIfoEkvhc= ARC-Authentication-Results: i=1; imf13.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=jdLuNuP5; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf13.hostedemail.com: domain of qi.zheng@linux.dev designates 91.218.175.28 as permitted sender) smtp.mailfrom=qi.zheng@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1684759955; a=rsa-sha256; cv=none; b=BULSpjobNow0+0xV3q3lGVoPB+pfTQZjbrMK5/Y0+nuTdn68l/eSLh25VnKpBTvjiU7T4K ZWzhk5UhB9HC2VLV+cUoHv3ky4jA5DK951xUpGCQrC0t3lUf26v1bbuJ5JyqztOO7Xpp80 YyLc4nAZ/baVKdYgJd8VVzw4k2bLE5U= Message-ID: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1684759952; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=YHbNOydWK5gCXaBShYnOGzZDvMMinxhe2BOs3NoEFIo=; b=jdLuNuP5mENiSr3tB5gH4N2rOp1VCiL2/WVXk+6KbOWyiP5/ntDqfGzra7Zox7masm7H2M UTdRTXiF0RldfXzzzvkTcdrYnk7FtA2kGCVkdspa4bMsE5A4pisXWPKPQNPDMkSQxPglOu 12NrK0OtbA93QI0xKNMlcebV2ujY+L0= Date: Mon, 22 May 2023 20:52:19 +0800 MIME-Version: 1.0 Subject: Re: [PATCH 29/31] mm/memory: handle_pte_fault() use pte_offset_map_nolock() Content-Language: en-US To: Hugh Dickins , Andrew Morton Cc: Mike Kravetz , Mike Rapoport , "Kirill A. Shutemov" , Matthew Wilcox , David Hildenbrand , Suren Baghdasaryan , Qi Zheng , Yang Shi , Mel Gorman , Peter Xu , Peter Zijlstra , Will Deacon , Yu Zhao , Alistair Popple , Ralph Campbell , Ira Weiny , Steven Price , SeongJae Park , Naoya Horiguchi , Christophe Leroy , Zack Rusin , Jason Gunthorpe , Axel Rasmussen , Anshuman Khandual , Pasha Tatashin , Miaohe Lin , Minchan Kim , Christoph Hellwig , Song Liu , Thomas Hellstrom , linux-kernel@vger.kernel.org, linux-mm@kvack.org References: <68a97fbe-5c1e-7ac6-72c-7b9c6290b370@google.com> <5f10e87-c413-eb92-fc6-541e52c1f6be@google.com> X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Qi Zheng In-Reply-To: <5f10e87-c413-eb92-fc6-541e52c1f6be@google.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Migadu-Flow: FLOW_OUT X-Rspam-User: X-Stat-Signature: z1gfxnxcdxz5h3pmg8gjtbsjnk7ea6gf X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 67F5120002 X-HE-Tag: 1684759955-212900 X-HE-Meta: U2FsdGVkX19YCu6An/9fhCbJTKtM1vSmk2VMNs1RZKJc2Hyr/Fg/gd/i3ongmLqtN+TxaIrETB8U6JejzbQLgLgMiBCpC640+R6BTo/zo+qGO+5ZtLxqR2c1R7JV77ca+RVfR726YftG6lUaLL1z8gur2ADViUJkS/GmJp6zE9emBI4mNXF8RAM5dOaxwFS4ihHUwYR0i970x4fsQzra24ELADSOUeyqez291EOWTnqQYv6dq448IeahWbLUXjsQ1F615V3noinBithF09gLFYuFWEfrFkzR+msGWbKsf5Z/qZ+TuIQBuxWVb4cp8T4yCOyna6xMpwyuDvnd+t6FT7BBYTl9j6YdOxxiHWh+t7OkTVZB+SkBUmKvmbatIjJsorh2Dwh3DgY/kC2x4JzOTP2JGSvzZAlTiFj4XqEVn9EfIrfCtSFlwbKo760G7miJB+MLEP69Bt0u2HZ/Qncr3aNQq60Ysb3UeiwB2yp0ePOTELUzUspRbQfwIxxGV1rNEtf54NREirNw9jVMfKRenPPqvquz/K1tFzGs19Vxmod54kuwxZWkkuvFeF3hZk+leGsEwnylzkw1VURfMXACdHC2mckp0Imf5MoTswAFfZQ6XnMVxw6NHXbtaN4/EwCu2pTzsuKboQ0aHa9gyrvixBxKEmtFYywstZkqOf28unHhX3f8XM3F93L4vCHoV1ojYChO1AEbWnLvNImaWErKqr4ceIdptTopgayws/XwL4MZRdJfoJZb/HzUlqj4HOGWjqXOJrCX46KRHOGB4jyV13PRf2cLnr8ggeuyNJWpAQAXe0MIaU3qIitahMe/AouRhOyWmCi4AGgPZ3dvvzdDtapPaxZ6GfiHOL5Rj+7Ou8dbKqZplogX8QjIGnQ+nMJ0pJOayxzz1m/ABs0qn/AMzMViuZ0iec9O165f5zPmTA9v741YyQsRlHwYYkBVPyWBatnQVddrD+SDgejQbPZ qUYI590H ylEopGcjfZdQMgPCgIRPaCH08uolD632iSjKCfDmvSk5QUrB+DN86ZqjafGJMVPtpJtluz7fTHtCa6wBx91doJz6WTK0MF2cee5AM6VmSMaSIF48UJ/fUCqyT3Z3KJCh/F04+7//YeNWYDUdzqAQfqnHw1ez2d/3adnhV X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 2023/5/22 13:26, Hugh Dickins wrote: > handle_pte_fault() use pte_offset_map_nolock() to get the vmf.ptl which > corresponds to vmf.pte, instead of pte_lockptr() being used later, when > there's a chance that the pmd entry might have changed, perhaps to none, > or to a huge pmd, with no split ptlock in its struct page. > > Remove its pmd_devmap_trans_unstable() call: pte_offset_map_nolock() > will handle that case by failing. Update the "morph" comment above, > looking forward to when shmem or file collapse to THP may not take > mmap_lock for write (or not at all). > > do_numa_page() use the vmf->ptl from handle_pte_fault() at first, but > refresh it when refreshing vmf->pte. > > do_swap_page()'s pte_unmap_same() (the thing that takes ptl to verify a > two-part PAE orig_pte) use the vmf->ptl from handle_pte_fault() too; but > do_swap_page() is also used by anon THP's __collapse_huge_page_swapin(), > so adjust that to set vmf->ptl by pte_offset_map_nolock(). > > Signed-off-by: Hugh Dickins > --- > mm/khugepaged.c | 6 ++++-- > mm/memory.c | 38 +++++++++++++------------------------- > 2 files changed, 17 insertions(+), 27 deletions(-) > > diff --git a/mm/khugepaged.c b/mm/khugepaged.c > index 49cfa7cdfe93..c11db2e78e95 100644 > --- a/mm/khugepaged.c > +++ b/mm/khugepaged.c > @@ -1005,6 +1005,7 @@ static int __collapse_huge_page_swapin(struct mm_struct *mm, > unsigned long address, end = haddr + (HPAGE_PMD_NR * PAGE_SIZE); > int result; > pte_t *pte = NULL; > + spinlock_t *ptl; > > for (address = haddr; address < end; address += PAGE_SIZE) { > struct vm_fault vmf = { > @@ -1016,7 +1017,7 @@ static int __collapse_huge_page_swapin(struct mm_struct *mm, > }; > > if (!pte++) { > - pte = pte_offset_map(pmd, address); > + pte = pte_offset_map_nolock(mm, pmd, address, &ptl); > if (!pte) { > mmap_read_unlock(mm); > result = SCAN_PMD_NULL; > @@ -1024,11 +1025,12 @@ static int __collapse_huge_page_swapin(struct mm_struct *mm, > } > } > > - vmf.orig_pte = *pte; > + vmf.orig_pte = ptep_get_lockless(pte); > if (!is_swap_pte(vmf.orig_pte)) > continue; > > vmf.pte = pte; > + vmf.ptl = ptl; > ret = do_swap_page(&vmf); > /* Which unmaps pte (after perhaps re-checking the entry) */ > pte = NULL; > diff --git a/mm/memory.c b/mm/memory.c > index c7b920291a72..4ec46eecefd3 100644 > --- a/mm/memory.c > +++ b/mm/memory.c > @@ -2786,10 +2786,9 @@ static inline int pte_unmap_same(struct vm_fault *vmf) > int same = 1; > #if defined(CONFIG_SMP) || defined(CONFIG_PREEMPTION) > if (sizeof(pte_t) > sizeof(unsigned long)) { > - spinlock_t *ptl = pte_lockptr(vmf->vma->vm_mm, vmf->pmd); > - spin_lock(ptl); > + spin_lock(vmf->ptl); > same = pte_same(*vmf->pte, vmf->orig_pte); > - spin_unlock(ptl); > + spin_unlock(vmf->ptl); > } > #endif > pte_unmap(vmf->pte); > @@ -4696,7 +4695,6 @@ static vm_fault_t do_numa_page(struct vm_fault *vmf) > * validation through pte_unmap_same(). It's of NUMA type but > * the pfn may be screwed if the read is non atomic. > */ > - vmf->ptl = pte_lockptr(vma->vm_mm, vmf->pmd); > spin_lock(vmf->ptl); > if (unlikely(!pte_same(*vmf->pte, vmf->orig_pte))) { > pte_unmap_unlock(vmf->pte, vmf->ptl); > @@ -4767,8 +4765,10 @@ static vm_fault_t do_numa_page(struct vm_fault *vmf) > flags |= TNF_MIGRATED; > } else { > flags |= TNF_MIGRATE_FAIL; > - vmf->pte = pte_offset_map(vmf->pmd, vmf->address); > - spin_lock(vmf->ptl); > + vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, > + vmf->address, &vmf->ptl); > + if (unlikely(!vmf->pte)) > + goto out; > if (unlikely(!pte_same(*vmf->pte, vmf->orig_pte))) { > pte_unmap_unlock(vmf->pte, vmf->ptl); > goto out; > @@ -4897,27 +4897,16 @@ static vm_fault_t handle_pte_fault(struct vm_fault *vmf) > vmf->pte = NULL; > vmf->flags &= ~FAULT_FLAG_ORIG_PTE_VALID; > } else { > - /* > - * If a huge pmd materialized under us just retry later. Use > - * pmd_trans_unstable() via pmd_devmap_trans_unstable() instead > - * of pmd_trans_huge() to ensure the pmd didn't become > - * pmd_trans_huge under us and then back to pmd_none, as a > - * result of MADV_DONTNEED running immediately after a huge pmd > - * fault in a different thread of this mm, in turn leading to a > - * misleading pmd_trans_huge() retval. All we have to ensure is > - * that it is a regular pmd that we can walk with > - * pte_offset_map() and we can do that through an atomic read > - * in C, which is what pmd_trans_unstable() provides. > - */ > - if (pmd_devmap_trans_unstable(vmf->pmd)) > - return 0; > /* > * A regular pmd is established and it can't morph into a huge > - * pmd from under us anymore at this point because we hold the > - * mmap_lock read mode and khugepaged takes it in write mode. > - * So now it's safe to run pte_offset_map(). > + * pmd by anon khugepaged, since that takes mmap_lock in write > + * mode; but shmem or file collapse to THP could still morph > + * it into a huge pmd: just retry later if so. > */ > - vmf->pte = pte_offset_map(vmf->pmd, vmf->address); > + vmf->pte = pte_offset_map_nolock(vmf->vma->vm_mm, vmf->pmd, > + vmf->address, &vmf->ptl); > + if (unlikely(!vmf->pte)) > + return 0; Just jump to the retry label below? diff --git a/mm/memory.c b/mm/memory.c index 63632a5eafc1..2e712fe6f4be 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -4897,7 +4897,8 @@ static vm_fault_t handle_pte_fault(struct vm_fault *vmf) { pte_t entry; - if (unlikely(pmd_none(*vmf->pmd))) { +retry: + if (unlikely(pmd_none(READ_ONCE(*vmf->pmd)))) { /* * Leave __pte_alloc() until later: because vm_ops->fault may * want to allocate huge page, and if we expose page table > vmf->orig_pte = ptep_get_lockless(vmf->pte); > vmf->flags |= FAULT_FLAG_ORIG_PTE_VALID; > > @@ -4936,7 +4925,6 @@ static vm_fault_t handle_pte_fault(struct vm_fault *vmf) > if (pte_protnone(vmf->orig_pte) && vma_is_accessible(vmf->vma)) > return do_numa_page(vmf); > > - vmf->ptl = pte_lockptr(vmf->vma->vm_mm, vmf->pmd); > spin_lock(vmf->ptl); > entry = vmf->orig_pte; > if (unlikely(!pte_same(*vmf->pte, entry))) { -- Thanks, Qi