| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAGsJ_4w3S_8Kaw2GyB3hg7b4N_D+6yBO7D6qmgxD9Fqz3_dhAg@mail.gmail.com>
Date: Tue, 7 Jun 2022 19:37:10 +1200
From: Barry Song <21cnbao@...il.com>
To: Yu Zhao <yuzhao@...gle.com>, Will Deacon <will@...nel.org>
Cc: Andrew Morton <akpm@...ux-foundation.org>,
Linux-MM <linux-mm@...ck.org>, Andi Kleen <ak@...ux.intel.com>,
Aneesh Kumar <aneesh.kumar@...ux.ibm.com>,
Catalin Marinas <catalin.marinas@....com>,
Dave Hansen <dave.hansen@...ux.intel.com>,
Hillf Danton <hdanton@...a.com>, Jens Axboe <axboe@...nel.dk>,
Johannes Weiner <hannes@...xchg.org>,
Jonathan Corbet <corbet@....net>,
Linus Torvalds <torvalds@...ux-foundation.org>,
Matthew Wilcox <willy@...radead.org>,
Mel Gorman <mgorman@...e.de>,
Michael Larabel <Michael@...haellarabel.com>,
Michal Hocko <mhocko@...nel.org>,
Mike Rapoport <rppt@...nel.org>,
Peter Zijlstra <peterz@...radead.org>,
Tejun Heo <tj@...nel.org>, Vlastimil Babka <vbabka@...e.cz>,
LAK <linux-arm-kernel@...ts.infradead.org>,
Linux Doc Mailing List <linux-doc@...r.kernel.org>,
LKML <linux-kernel@...r.kernel.org>, x86 <x86@...nel.org>,
Kernel Page Reclaim v2 <page-reclaim@...gle.com>,
Brian Geffon <bgeffon@...gle.com>,
Jan Alexander Steffens <heftig@...hlinux.org>,
Oleksandr Natalenko <oleksandr@...alenko.name>,
Steven Barrett <steven@...uorix.net>,
Suleiman Souhlal <suleiman@...gle.com>,
Daniel Byrne <djbyrne@....edu>,
Donald Carr <d@...os-reins.com>,
Holger Hoffstätte <holger@...lied-asynchrony.com>,
Konstantin Kharlamov <Hi-Angel@...dex.ru>,
Shuang Zhai <szhai2@...rochester.edu>,
Sofia Trinh <sofia.trinh@....works>,
Vaibhav Jain <vaibhav@...ux.ibm.com>, huzhanyuan@...o.com
Subject: Re: [PATCH v11 07/14] mm: multi-gen LRU: exploit locality in rmap
On Mon, Jun 6, 2022 at 9:25 PM Barry Song <21cnbao@...il.com> wrote:
>
> On Wed, May 18, 2022 at 4:49 PM Yu Zhao <yuzhao@...gle.com> wrote:
> >
> > Searching the rmap for PTEs mapping each page on an LRU list (to test
> > and clear the accessed bit) can be expensive because pages from
> > different VMAs (PA space) are not cache friendly to the rmap (VA
> > space). For workloads mostly using mapped pages, the rmap has a high
> > CPU cost in the reclaim path.
> >
> > This patch exploits spatial locality to reduce the trips into the
> > rmap. When shrink_page_list() walks the rmap and finds a young PTE, a
> > new function lru_gen_look_around() scans at most BITS_PER_LONG-1
> > adjacent PTEs. On finding another young PTE, it clears the accessed
> > bit and updates the gen counter of the page mapped by this PTE to
> > (max_seq%MAX_NR_GENS)+1.
> >
> > Server benchmark results:
> > Single workload:
> > fio (buffered I/O): no change
> >
> > Single workload:
> > memcached (anon): +[5.5, 7.5]%
> > Ops/sec KB/sec
> > patch1-6: 1120643.70 43588.06
> > patch1-7: 1193918.93 46438.15
> >
> > Configurations:
> > no change
> >
> > Client benchmark results:
> > kswapd profiles:
> > patch1-6
> > 35.99% lzo1x_1_do_compress (real work)
> > 19.40% page_vma_mapped_walk
> > 6.31% _raw_spin_unlock_irq
> > 3.95% do_raw_spin_lock
> > 2.39% anon_vma_interval_tree_iter_first
> > 2.25% ptep_clear_flush
> > 1.92% __anon_vma_interval_tree_subtree_search
> > 1.70% folio_referenced_one
> > 1.68% __zram_bvec_write
> > 1.43% anon_vma_interval_tree_iter_next
> >
> > patch1-7
> > 45.90% lzo1x_1_do_compress (real work)
> > 9.14% page_vma_mapped_walk
> > 6.81% _raw_spin_unlock_irq
> > 2.80% ptep_clear_flush
> > 2.34% __zram_bvec_write
> > 2.29% do_raw_spin_lock
> > 1.84% lru_gen_look_around
> > 1.78% memmove
> > 1.74% obj_malloc
> > 1.50% free_unref_page_list
> >
> > Configurations:
> > no change
> >
> > Signed-off-by: Yu Zhao <yuzhao@...gle.com>
> > Acked-by: Brian Geffon <bgeffon@...gle.com>
> > Acked-by: Jan Alexander Steffens (heftig) <heftig@...hlinux.org>
> > Acked-by: Oleksandr Natalenko <oleksandr@...alenko.name>
> > Acked-by: Steven Barrett <steven@...uorix.net>
> > Acked-by: Suleiman Souhlal <suleiman@...gle.com>
> > Tested-by: Daniel Byrne <djbyrne@....edu>
> > Tested-by: Donald Carr <d@...os-reins.com>
> > Tested-by: Holger Hoffstätte <holger@...lied-asynchrony.com>
> > Tested-by: Konstantin Kharlamov <Hi-Angel@...dex.ru>
> > Tested-by: Shuang Zhai <szhai2@...rochester.edu>
> > Tested-by: Sofia Trinh <sofia.trinh@....works>
> > Tested-by: Vaibhav Jain <vaibhav@...ux.ibm.com>
> > ---
> > include/linux/memcontrol.h | 31 ++++++++
> > include/linux/mm.h | 5 ++
> > include/linux/mmzone.h | 6 ++
> > mm/internal.h | 1 +
> > mm/memcontrol.c | 1 +
> > mm/rmap.c | 7 ++
> > mm/swap.c | 4 +-
> > mm/vmscan.c | 157 +++++++++++++++++++++++++++++++++++++
> > 8 files changed, 210 insertions(+), 2 deletions(-)
> >
> > diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
> > index 89b14729d59f..2bfdcc77648a 100644
> > --- a/include/linux/memcontrol.h
> > +++ b/include/linux/memcontrol.h
> > @@ -438,6 +438,7 @@ static inline struct obj_cgroup *__folio_objcg(struct folio *folio)
> > * - LRU isolation
> > * - lock_page_memcg()
> > * - exclusive reference
> > + * - mem_cgroup_trylock_pages()
> > *
> > * For a kmem folio a caller should hold an rcu read lock to protect memcg
> > * associated with a kmem folio from being released.
> > @@ -499,6 +500,7 @@ static inline struct mem_cgroup *folio_memcg_rcu(struct folio *folio)
> > * - LRU isolation
> > * - lock_page_memcg()
> > * - exclusive reference
> > + * - mem_cgroup_trylock_pages()
> > *
> > * For a kmem page a caller should hold an rcu read lock to protect memcg
> > * associated with a kmem page from being released.
> > @@ -948,6 +950,23 @@ void unlock_page_memcg(struct page *page);
> >
> > void __mod_memcg_state(struct mem_cgroup *memcg, int idx, int val);
> >
> > +/* try to stablize folio_memcg() for all the pages in a memcg */
> > +static inline bool mem_cgroup_trylock_pages(struct mem_cgroup *memcg)
> > +{
> > + rcu_read_lock();
> > +
> > + if (mem_cgroup_disabled() || !atomic_read(&memcg->moving_account))
> > + return true;
> > +
> > + rcu_read_unlock();
> > + return false;
> > +}
> > +
> > +static inline void mem_cgroup_unlock_pages(void)
> > +{
> > + rcu_read_unlock();
> > +}
> > +
> > /* idx can be of type enum memcg_stat_item or node_stat_item */
> > static inline void mod_memcg_state(struct mem_cgroup *memcg,
> > int idx, int val)
> > @@ -1386,6 +1405,18 @@ static inline void folio_memcg_unlock(struct folio *folio)
> > {
> > }
> >
> > +static inline bool mem_cgroup_trylock_pages(struct mem_cgroup *memcg)
> > +{
> > + /* to match folio_memcg_rcu() */
> > + rcu_read_lock();
> > + return true;
> > +}
> > +
> > +static inline void mem_cgroup_unlock_pages(void)
> > +{
> > + rcu_read_unlock();
> > +}
> > +
> > static inline void mem_cgroup_handle_over_high(void)
> > {
> > }
> > diff --git a/include/linux/mm.h b/include/linux/mm.h
> > index 894c289c2c06..4e8ab4ad4473 100644
> > --- a/include/linux/mm.h
> > +++ b/include/linux/mm.h
> > @@ -1523,6 +1523,11 @@ static inline unsigned long folio_pfn(struct folio *folio)
> > return page_to_pfn(&folio->page);
> > }
> >
> > +static inline struct folio *pfn_folio(unsigned long pfn)
> > +{
> > + return page_folio(pfn_to_page(pfn));
> > +}
> > +
> > static inline atomic_t *folio_pincount_ptr(struct folio *folio)
> > {
> > return &folio_page(folio, 1)->compound_pincount;
> > diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
> > index 2d023d243e73..f0b980362186 100644
> > --- a/include/linux/mmzone.h
> > +++ b/include/linux/mmzone.h
> > @@ -374,6 +374,7 @@ enum lruvec_flags {
> > #ifndef __GENERATING_BOUNDS_H
> >
> > struct lruvec;
> > +struct page_vma_mapped_walk;
> >
> > #define LRU_GEN_MASK ((BIT(LRU_GEN_WIDTH) - 1) << LRU_GEN_PGOFF)
> > #define LRU_REFS_MASK ((BIT(LRU_REFS_WIDTH) - 1) << LRU_REFS_PGOFF)
> > @@ -429,6 +430,7 @@ struct lru_gen_struct {
> > };
> >
> > void lru_gen_init_lruvec(struct lruvec *lruvec);
> > +void lru_gen_look_around(struct page_vma_mapped_walk *pvmw);
> >
> > #ifdef CONFIG_MEMCG
> > void lru_gen_init_memcg(struct mem_cgroup *memcg);
> > @@ -441,6 +443,10 @@ static inline void lru_gen_init_lruvec(struct lruvec *lruvec)
> > {
> > }
> >
> > +static inline void lru_gen_look_around(struct page_vma_mapped_walk *pvmw)
> > +{
> > +}
> > +
> > #ifdef CONFIG_MEMCG
> > static inline void lru_gen_init_memcg(struct mem_cgroup *memcg)
> > {
> > diff --git a/mm/internal.h b/mm/internal.h
> > index cf16280ce132..59d2422b647d 100644
> > --- a/mm/internal.h
> > +++ b/mm/internal.h
> > @@ -68,6 +68,7 @@ vm_fault_t do_swap_page(struct vm_fault *vmf);
> > void folio_rotate_reclaimable(struct folio *folio);
> > bool __folio_end_writeback(struct folio *folio);
> > void deactivate_file_folio(struct folio *folio);
> > +void folio_activate(struct folio *folio);
> >
> > void free_pgtables(struct mmu_gather *tlb, struct vm_area_struct *start_vma,
> > unsigned long floor, unsigned long ceiling);
> > diff --git a/mm/memcontrol.c b/mm/memcontrol.c
> > index 2ee074f80e72..98aa720ac639 100644
> > --- a/mm/memcontrol.c
> > +++ b/mm/memcontrol.c
> > @@ -2769,6 +2769,7 @@ static void commit_charge(struct folio *folio, struct mem_cgroup *memcg)
> > * - LRU isolation
> > * - lock_page_memcg()
> > * - exclusive reference
> > + * - mem_cgroup_trylock_pages()
> > */
> > folio->memcg_data = (unsigned long)memcg;
> > }
> > diff --git a/mm/rmap.c b/mm/rmap.c
> > index fedb82371efe..7cb7ef29088a 100644
> > --- a/mm/rmap.c
> > +++ b/mm/rmap.c
> > @@ -73,6 +73,7 @@
> > #include <linux/page_idle.h>
> > #include <linux/memremap.h>
> > #include <linux/userfaultfd_k.h>
> > +#include <linux/mm_inline.h>
> >
> > #include <asm/tlbflush.h>
> >
> > @@ -821,6 +822,12 @@ static bool folio_referenced_one(struct folio *folio,
> > }
> >
> > if (pvmw.pte) {
> > + if (lru_gen_enabled() && pte_young(*pvmw.pte) &&
> > + !(vma->vm_flags & (VM_SEQ_READ | VM_RAND_READ))) {
> > + lru_gen_look_around(&pvmw);
> > + referenced++;
> > + }
> > +
> > if (ptep_clear_flush_young_notify(vma, address,
>
> Hello, Yu.
> look_around() is calling ptep_test_and_clear_young(pvmw->vma, addr, pte + i)
> only without flush and notify. for flush, there is a tlb operation for arm64:
> static inline int ptep_clear_flush_young(struct vm_area_struct *vma,
> unsigned long address, pte_t *ptep)
> {
> int young = ptep_test_and_clear_young(vma, address, ptep);
>
> if (young) {
> /*
> * We can elide the trailing DSB here since the worst that can
> * happen is that a CPU continues to use the young entry in its
> * TLB and we mistakenly reclaim the associated page. The
> * window for such an event is bounded by the next
> * context-switch, which provides a DSB to complete the TLB
> * invalidation.
> */
> flush_tlb_page_nosync(vma, address);
> }
>
> return young;
> }
>
> Does it mean the current kernel is over cautious? is it
> safe to call ptep_test_and_clear_young() only?
I can't really explain why we are getting a random app/java vm crash in monkey
test by using ptep_test_and_clear_young() only in lru_gen_look_around() on an
armv8-a machine without hardware PTE young support.
Moving to ptep_clear_flush_young() in look_around can make the random
hang disappear according to zhanyuan(Cc-ed).
On x86, ptep_clear_flush_young() is exactly ptep_test_and_clear_young()
after
'commit b13b1d2d8692 ("x86/mm: In the PTE swapout page reclaim case clear
the accessed bit instead of flushing the TLB")'
But on arm64, they are different. according to Will's comments in this
thread which
tried to make arm64 same with x86,
https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1793881.html
"
This is blindly copied from x86 and isn't true for us: we don't invalidate
the TLB on context switch. That means our window for keeping the stale
entries around is potentially much bigger and might not be a great idea.
If we roll a TLB invalidation routine without the trailing DSB, what sort of
performance does that get you?
"
We shouldn't think ptep_clear_flush_young() is safe enough in LRU to
clear PTE young? Any comments from Will?
>
> btw, lru_gen_look_around() has already included 'address', are we doing
> pte check for 'address' twice here?
>
Thanks
Barry
Powered by blists - more mailing lists