| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <871q8n926m.fsf@yhuang6-desk2.ccr.corp.intel.com>
Date: Wed, 06 Mar 2024 16:47:45 +0800
From: "Huang, Ying" <ying.huang@...el.com>
To: Peng Zhang <zhangpeng362@...wei.com>
Cc: <linux-mm@...ck.org>, <linux-kernel@...r.kernel.org>,
<akpm@...ux-foundation.org>, <willy@...radead.org>,
<fengwei.yin@...el.com>, <david@...hat.com>,
<aneesh.kumar@...ux.ibm.com>, <shy828301@...il.com>,
<hughd@...gle.com>, <wangkefeng.wang@...wei.com>,
<sunnanyong@...wei.com>
Subject: Re: [PATCH v4] filemap: avoid unnecessary major faults in
filemap_fault()
Peng Zhang <zhangpeng362@...wei.com> writes:
> From: ZhangPeng <zhangpeng362@...wei.com>
>
> The major fault occurred when using mlockall(MCL_CURRENT | MCL_FUTURE)
> in application, which leading to an unexpected issue[1].
>
> This caused by temporarily cleared PTE during a read+clear/modify/write
> update of the PTE, eg, do_numa_page()/change_pte_range().
>
> For the data segment of the user-mode program, the global variable area
> is a private mapping. After the pagecache is loaded, the private anonymous
> page is generated after the COW is triggered. Mlockall can lock COW pages
> (anonymous pages), but the original file pages cannot be locked and may
> be reclaimed. If the global variable (private anon page) is accessed when
> vmf->pte is zeroed in numa fault, a file page fault will be triggered.
> At this time, the original private file page may have been reclaimed.
> If the page cache is not available at this time, a major fault will be
> triggered and the file will be read, causing additional overhead.
>
> This issue affects our traffic analysis service. The inbound traffic is
> heavy. If a major fault occurs, the I/O schedule is triggered and the
> original I/O is suspended. Generally, the I/O schedule is 0.7 ms. If
> other applications are operating disks, the system needs to wait for
> more than 10 ms. However, the inbound traffic is heavy and the NIC buffer
> is small. As a result, packet loss occurs. But the traffic analysis service
> can't tolerate packet loss.
>
> Fix this by holding PTL and rechecking the PTE in filemap_fault() before
> triggering a major fault. We do this check only if vma is VM_LOCKED to
> reduce the performance impact in common scenarios.
>
> In our product environment, there were 7 major faults every 12 hours.
> After the patch is applied, no major fault have been triggered.
>
> Testing file page read and write page fault performance in ext4 and
> ramdisk using will-it-scale[2] on a x86 physical machine. The data is
> the average change compared with the mainline after the patch is applied.
> The test results are within the range of fluctuation. We do this check
> only if vma is VM_LOCKED, therefore, no performance regressions is caused
> for most common cases.
>
> The test results are as follows:
> processes processes_idle threads threads_idle
> ext4 private file write: 0.22% 0.26% 1.21% -0.15%
> ext4 private file read: 0.03% 1.00% 1.39% 0.34%
> ext4 shared file write: -0.50% -0.02% -0.14% -0.02%
> ramdisk private file write: 0.07% 0.02% 0.53% 0.04%
> ramdisk private file read: 0.01% 1.60% -0.32% -0.02%
>
> [1] https://lore.kernel.org/linux-mm/9e62fd9a-bee0-52bf-50a7-498fa17434ee@huawei.com/
> [2] https://github.com/antonblanchard/will-it-scale/
>
> Suggested-by: "Huang, Ying" <ying.huang@...el.com>
> Suggested-by: David Hildenbrand <david@...hat.com>
> Signed-off-by: ZhangPeng <zhangpeng362@...wei.com>
> Signed-off-by: Kefeng Wang <wangkefeng.wang@...wei.com>
LGTM, Thanks! Feel free to add
Reviewed-by: "Huang, Ying" <ying.huang@...el.com>
> ---
> v3->v4:
> - Update the performance data and commit message
> - Check PTE without lock firstly per Huang, Ying
> - Update comments for recheck function per David Hildenbrand
> - Simply return 0 to make it easier to read per David Hildenbrand
> - Check !FAULT_FLAG_ORIG_PTE_VALID instead of pmd_none()
>
> v2->v3:
> - Do this check only if vma is VM_LOCKED per David Hildenbrand
> - Hold PTL and recheck the PTE
> - Place the recheck code in a new function filemap_fault_recheck_pte()
>
> v1->v2:
> - Add more test results per Huang, Ying
> - Add more comments before check PTE per Huang, Ying, David Hildenbrand
> and Yin Fengwei
> - Change pte_offset_map_nolock to pte_offset_map as the PTL won't
> be used
>
> RFC->v1:
> - Add error handling when ptep == NULL per Huang, Ying and Matthew
> Wilcox
> - Check the PTE without acquiring PTL in filemap_fault(), suggested by
> Huang, Ying and Yin Fengwei
> - Add pmd_none() check before PTE map
> - Update commit message and add performance test information
>
> mm/filemap.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 46 insertions(+)
>
> diff --git a/mm/filemap.c b/mm/filemap.c
> index b4858d89f1b1..31ab455c4537 100644
> --- a/mm/filemap.c
> +++ b/mm/filemap.c
> @@ -3181,6 +3181,48 @@ static struct file *do_async_mmap_readahead(struct vm_fault *vmf,
> return fpin;
> }
>
> +static vm_fault_t filemap_fault_recheck_pte_none(struct vm_fault *vmf)
> +{
> + struct vm_area_struct *vma = vmf->vma;
> + vm_fault_t ret = 0;
> + pte_t *ptep;
> +
> + /*
> + * We might have COW'ed a pagecache folio and might now have an mlocked
> + * anon folio mapped. The original pagecache folio is not mlocked and
> + * might have been evicted. During a read+clear/modify/write update of
> + * the PTE, such as done in do_numa_page()/change_pte_range(), we
> + * temporarily clear the PTE under PT lock and might detect it here as
> + * "none" when not holding the PT lock.
> + *
> + * Not rechecking the PTE under PT lock could result in an unexpected
> + * major fault in an mlock'ed region. Recheck only for this special
> + * scenario while holding the PT lock, to not degrade non-mlocked
> + * scenarios. Recheck the PTE without PT lock firstly, thereby reducing
> + * the number of times we hold PT lock.
> + */
> + if (!(vma->vm_flags & VM_LOCKED))
> + return 0;
> +
> + if (!(vmf->flags & FAULT_FLAG_ORIG_PTE_VALID))
> + return 0;
> +
> + ptep = pte_offset_map(vmf->pmd, vmf->address);
> + if (unlikely(!ptep))
> + return VM_FAULT_NOPAGE;
> +
> + if (unlikely(!pte_none(ptep_get_lockless(ptep)))) {
> + ret = VM_FAULT_NOPAGE;
> + } else {
> + spin_lock(vmf->ptl);
> + if (unlikely(!pte_none(ptep_get(ptep))))
> + ret = VM_FAULT_NOPAGE;
> + spin_unlock(vmf->ptl);
> + }
> + pte_unmap(ptep);
> + return ret;
> +}
> +
> /**
> * filemap_fault - read in file data for page fault handling
> * @vmf: struct vm_fault containing details of the fault
> @@ -3236,6 +3278,10 @@ vm_fault_t filemap_fault(struct vm_fault *vmf)
> mapping_locked = true;
> }
> } else {
> + ret = filemap_fault_recheck_pte_none(vmf);
> + if (unlikely(ret))
> + return ret;
> +
> /* No page in the page cache at all */
> count_vm_event(PGMAJFAULT);
> count_memcg_event_mm(vmf->vma->vm_mm, PGMAJFAULT);
Powered by blists - more mailing lists