| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAMgjq7DmSok3YYd6dqyyYxkK_wZg7-c2bW8BFfxhs1V86h=niw@mail.gmail.com>
Date: Thu, 15 Aug 2024 17:47:54 +0800
From: Kairui Song <ryncsn@...il.com>
To: Chuanhua Han <hanchuanhua@...o.com>, Barry Song <21cnbao@...il.com>
Cc: akpm@...ux-foundation.org, linux-mm@...ck.org,
baolin.wang@...ux.alibaba.com, chrisl@...nel.org, david@...hat.com,
hannes@...xchg.org, hughd@...gle.com, kaleshsingh@...gle.com,
linux-kernel@...r.kernel.org, mhocko@...e.com, minchan@...nel.org,
nphamcs@...il.com, ryan.roberts@....com, senozhatsky@...omium.org,
shakeel.butt@...ux.dev, shy828301@...il.com, surenb@...gle.com,
v-songbaohua@...o.com, willy@...radead.org, xiang@...nel.org,
ying.huang@...el.com, yosryahmed@...gle.com, hch@...radead.org
Subject: Re: [PATCH v6 2/2] mm: support large folios swap-in for zRAM-like devices
On Fri, Aug 2, 2024 at 8:21 PM Barry Song <21cnbao@...il.com> wrote:
>
> From: Chuanhua Han <hanchuanhua@...o.com>
Hi Chuanhua,
>
> Currently, we have mTHP features, but unfortunately, without support for large
> folio swap-ins, once these large folios are swapped out, they are lost because
> mTHP swap is a one-way process. The lack of mTHP swap-in functionality prevents
> mTHP from being used on devices like Android that heavily rely on swap.
>
> This patch introduces mTHP swap-in support. It starts from sync devices such
> as zRAM. This is probably the simplest and most common use case, benefiting
> billions of Android phones and similar devices with minimal implementation
> cost. In this straightforward scenario, large folios are always exclusive,
> eliminating the need to handle complex rmap and swapcache issues.
>
> It offers several benefits:
> 1. Enables bidirectional mTHP swapping, allowing retrieval of mTHP after
> swap-out and swap-in. Large folios in the buddy system are also
> preserved as much as possible, rather than being fragmented due
> to swap-in.
>
> 2. Eliminates fragmentation in swap slots and supports successful
> THP_SWPOUT.
>
> w/o this patch (Refer to the data from Chris's and Kairui's latest
> swap allocator optimization while running ./thp_swap_allocator_test
> w/o "-a" option [1]):
>
> ./thp_swap_allocator_test
> Iteration 1: swpout inc: 233, swpout fallback inc: 0, Fallback percentage: 0.00%
> Iteration 2: swpout inc: 131, swpout fallback inc: 101, Fallback percentage: 43.53%
> Iteration 3: swpout inc: 71, swpout fallback inc: 155, Fallback percentage: 68.58%
> Iteration 4: swpout inc: 55, swpout fallback inc: 168, Fallback percentage: 75.34%
> Iteration 5: swpout inc: 35, swpout fallback inc: 191, Fallback percentage: 84.51%
> Iteration 6: swpout inc: 25, swpout fallback inc: 199, Fallback percentage: 88.84%
> Iteration 7: swpout inc: 23, swpout fallback inc: 205, Fallback percentage: 89.91%
> Iteration 8: swpout inc: 9, swpout fallback inc: 219, Fallback percentage: 96.05%
> Iteration 9: swpout inc: 13, swpout fallback inc: 213, Fallback percentage: 94.25%
> Iteration 10: swpout inc: 12, swpout fallback inc: 216, Fallback percentage: 94.74%
> Iteration 11: swpout inc: 16, swpout fallback inc: 213, Fallback percentage: 93.01%
> Iteration 12: swpout inc: 10, swpout fallback inc: 210, Fallback percentage: 95.45%
> Iteration 13: swpout inc: 16, swpout fallback inc: 212, Fallback percentage: 92.98%
> Iteration 14: swpout inc: 12, swpout fallback inc: 212, Fallback percentage: 94.64%
> Iteration 15: swpout inc: 15, swpout fallback inc: 211, Fallback percentage: 93.36%
> Iteration 16: swpout inc: 15, swpout fallback inc: 200, Fallback percentage: 93.02%
> Iteration 17: swpout inc: 9, swpout fallback inc: 220, Fallback percentage: 96.07%
>
> w/ this patch (always 0%):
> Iteration 1: swpout inc: 948, swpout fallback inc: 0, Fallback percentage: 0.00%
> Iteration 2: swpout inc: 953, swpout fallback inc: 0, Fallback percentage: 0.00%
> Iteration 3: swpout inc: 950, swpout fallback inc: 0, Fallback percentage: 0.00%
> Iteration 4: swpout inc: 952, swpout fallback inc: 0, Fallback percentage: 0.00%
> Iteration 5: swpout inc: 950, swpout fallback inc: 0, Fallback percentage: 0.00%
> Iteration 6: swpout inc: 950, swpout fallback inc: 0, Fallback percentage: 0.00%
> Iteration 7: swpout inc: 947, swpout fallback inc: 0, Fallback percentage: 0.00%
> Iteration 8: swpout inc: 950, swpout fallback inc: 0, Fallback percentage: 0.00%
> Iteration 9: swpout inc: 950, swpout fallback inc: 0, Fallback percentage: 0.00%
> Iteration 10: swpout inc: 945, swpout fallback inc: 0, Fallback percentage: 0.00%
> Iteration 11: swpout inc: 947, swpout fallback inc: 0, Fallback percentage: 0.00%
> ...
>
> 3. With both mTHP swap-out and swap-in supported, we offer the option to enable
> zsmalloc compression/decompression with larger granularity[2]. The upcoming
> optimization in zsmalloc will significantly increase swap speed and improve
> compression efficiency. Tested by running 100 iterations of swapping 100MiB
> of anon memory, the swap speed improved dramatically:
> time consumption of swapin(ms) time consumption of swapout(ms)
> lz4 4k 45274 90540
> lz4 64k 22942 55667
> zstdn 4k 85035 186585
> zstdn 64k 46558 118533
>
> The compression ratio also improved, as evaluated with 1 GiB of data:
> granularity orig_data_size compr_data_size
> 4KiB-zstd 1048576000 246876055
> 64KiB-zstd 1048576000 199763892
>
> Without mTHP swap-in, the potential optimizations in zsmalloc cannot be
> realized.
>
> 4. Even mTHP swap-in itself can reduce swap-in page faults by a factor
> of nr_pages. Swapping in content filled with the same data 0x11, w/o
> and w/ the patch for five rounds (Since the content is the same,
> decompression will be very fast. This primarily assesses the impact of
> reduced page faults):
>
> swp in bandwidth(bytes/ms) w/o w/
> round1 624152 1127501
> round2 631672 1127501
> round3 620459 1139756
> round4 606113 1139756
> round5 624152 1152281
> avg 621310 1137359 +83%
>
> [1] https://lore.kernel.org/all/20240730-swap-allocator-v5-0-cb9c148b9297@kernel.org/
> [2] https://lore.kernel.org/all/20240327214816.31191-1-21cnbao@gmail.com/
>
> Signed-off-by: Chuanhua Han <hanchuanhua@...o.com>
> Co-developed-by: Barry Song <v-songbaohua@...o.com>
> Signed-off-by: Barry Song <v-songbaohua@...o.com>
> ---
> mm/memory.c | 211 ++++++++++++++++++++++++++++++++++++++++++++++------
> 1 file changed, 188 insertions(+), 23 deletions(-)
>
> diff --git a/mm/memory.c b/mm/memory.c
> index 4cf4902db1ec..07029532469a 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -3986,6 +3986,152 @@ static vm_fault_t handle_pte_marker(struct vm_fault *vmf)
> return VM_FAULT_SIGBUS;
> }
>
> +/*
> + * check a range of PTEs are completely swap entries with
> + * contiguous swap offsets and the same SWAP_HAS_CACHE.
> + * ptep must be first one in the range
> + */
> +#ifdef CONFIG_TRANSPARENT_HUGEPAGE
> +static bool can_swapin_thp(struct vm_fault *vmf, pte_t *ptep, int nr_pages)
> +{
> + struct swap_info_struct *si;
> + unsigned long addr;
> + swp_entry_t entry;
> + pgoff_t offset;
> + char has_cache;
> + int idx, i;
> + pte_t pte;
> +
> + addr = ALIGN_DOWN(vmf->address, nr_pages * PAGE_SIZE);
> + idx = (vmf->address - addr) / PAGE_SIZE;
> + pte = ptep_get(ptep);
> +
> + if (!pte_same(pte, pte_move_swp_offset(vmf->orig_pte, -idx)))
> + return false;
> + entry = pte_to_swp_entry(pte);
> + offset = swp_offset(entry);
> + if (swap_pte_batch(ptep, nr_pages, pte) != nr_pages)
> + return false;
> +
> + si = swp_swap_info(entry);
> + has_cache = si->swap_map[offset] & SWAP_HAS_CACHE;
> + for (i = 1; i < nr_pages; i++) {
> + /*
> + * while allocating a large folio and doing swap_read_folio for the
> + * SWP_SYNCHRONOUS_IO path, which is the case the being faulted pte
> + * doesn't have swapcache. We need to ensure all PTEs have no cache
> + * as well, otherwise, we might go to swap devices while the content
> + * is in swapcache
> + */
> + if ((si->swap_map[offset + i] & SWAP_HAS_CACHE) != has_cache)
> + return false;
> + }
> +
> + return true;
> +}
> +
> +static inline unsigned long thp_swap_suitable_orders(pgoff_t swp_offset,
> + unsigned long addr, unsigned long orders)
> +{
> + int order, nr;
> +
> + order = highest_order(orders);
> +
> + /*
> + * To swap-in a THP with nr pages, we require its first swap_offset
> + * is aligned with nr. This can filter out most invalid entries.
> + */
> + while (orders) {
> + nr = 1 << order;
> + if ((addr >> PAGE_SHIFT) % nr == swp_offset % nr)
> + break;
> + order = next_order(&orders, order);
> + }
> +
> + return orders;
> +}
> +#else
> +static inline bool can_swapin_thp(struct vm_fault *vmf, pte_t *ptep, int nr_pages)
> +{
> + return false;
> +}
> +#endif
> +
> +static struct folio *alloc_swap_folio(struct vm_fault *vmf)
> +{
> + struct vm_area_struct *vma = vmf->vma;
> +#ifdef CONFIG_TRANSPARENT_HUGEPAGE
> + unsigned long orders;
> + struct folio *folio;
> + unsigned long addr;
> + swp_entry_t entry;
> + spinlock_t *ptl;
> + pte_t *pte;
> + gfp_t gfp;
> + int order;
> +
> + /*
> + * If uffd is active for the vma we need per-page fault fidelity to
> + * maintain the uffd semantics.
> + */
> + if (unlikely(userfaultfd_armed(vma)))
> + goto fallback;
> +
> + /*
> + * A large swapped out folio could be partially or fully in zswap. We
> + * lack handling for such cases, so fallback to swapping in order-0
> + * folio.
> + */
> + if (!zswap_never_enabled())
> + goto fallback;
> +
> + entry = pte_to_swp_entry(vmf->orig_pte);
> + /*
> + * Get a list of all the (large) orders below PMD_ORDER that are enabled
> + * and suitable for swapping THP.
> + */
> + orders = thp_vma_allowable_orders(vma, vma->vm_flags,
> + TVA_IN_PF | TVA_ENFORCE_SYSFS, BIT(PMD_ORDER) - 1);
> + orders = thp_vma_suitable_orders(vma, vmf->address, orders);
> + orders = thp_swap_suitable_orders(swp_offset(entry), vmf->address, orders);
> +
> + if (!orders)
> + goto fallback;
> +
> + pte = pte_offset_map_lock(vmf->vma->vm_mm, vmf->pmd, vmf->address & PMD_MASK, &ptl);
> + if (unlikely(!pte))
> + goto fallback;
> +
> + /*
> + * For do_swap_page, find the highest order where the aligned range is
> + * completely swap entries with contiguous swap offsets.
> + */
> + order = highest_order(orders);
> + while (orders) {
> + addr = ALIGN_DOWN(vmf->address, PAGE_SIZE << order);
> + if (can_swapin_thp(vmf, pte + pte_index(addr), 1 << order))
> + break;
> + order = next_order(&orders, order);
> + }
> +
> + pte_unmap_unlock(pte, ptl);
> +
> + /* Try allocating the highest of the remaining orders. */
> + gfp = vma_thp_gfp_mask(vma);
> + while (orders) {
> + addr = ALIGN_DOWN(vmf->address, PAGE_SIZE << order);
> + folio = vma_alloc_folio(gfp, order, vma, addr, true);
> + if (folio)
> + return folio;
> + order = next_order(&orders, order);
> + }
> +
> +fallback:
> +#endif
> + return vma_alloc_folio(GFP_HIGHUSER_MOVABLE, 0, vma, vmf->address, false);
> +}
> +
> +
> /*
> * We enter with non-exclusive mmap_lock (to exclude vma changes,
> * but allow concurrent faults), and pte mapped but not yet locked.
> @@ -4074,35 +4220,37 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
> if (!folio) {
> if (data_race(si->flags & SWP_SYNCHRONOUS_IO) &&
> __swap_count(entry) == 1) {
> - /*
> - * Prevent parallel swapin from proceeding with
> - * the cache flag. Otherwise, another thread may
> - * finish swapin first, free the entry, and swapout
> - * reusing the same entry. It's undetectable as
> - * pte_same() returns true due to entry reuse.
> - */
> - if (swapcache_prepare(entry, 1)) {
> - /* Relax a bit to prevent rapid repeated page faults */
> - schedule_timeout_uninterruptible(1);
> - goto out;
> - }
> - need_clear_cache = true;
> -
> /* skip swapcache */
> - folio = vma_alloc_folio(GFP_HIGHUSER_MOVABLE, 0,
> - vma, vmf->address, false);
> + folio = alloc_swap_folio(vmf);
> page = &folio->page;
> if (folio) {
> __folio_set_locked(folio);
> __folio_set_swapbacked(folio);
>
> + nr_pages = folio_nr_pages(folio);
> + if (folio_test_large(folio))
> + entry.val = ALIGN_DOWN(entry.val, nr_pages);
> + /*
> + * Prevent parallel swapin from proceeding with
> + * the cache flag. Otherwise, another thread may
> + * finish swapin first, free the entry, and swapout
> + * reusing the same entry. It's undetectable as
> + * pte_same() returns true due to entry reuse.
> + */
> + if (swapcache_prepare(entry, nr_pages)) {
> + /* Relax a bit to prevent rapid repeated page faults */
> + schedule_timeout_uninterruptible(1);
> + goto out_page;
> + }
> + need_clear_cache = true;
> +
> if (mem_cgroup_swapin_charge_folio(folio,
> vma->vm_mm, GFP_KERNEL,
> entry)) {
> ret = VM_FAULT_OOM;
> goto out_page;
> }
After your patch, with build kernel test, I'm seeing kernel log
spamming like this:
[ 101.048594] pagefault_out_of_memory: 95 callbacks suppressed
[ 101.048599] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF
[ 101.059416] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF
[ 101.118575] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF
[ 101.125585] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF
[ 101.182501] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF
[ 101.215351] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF
[ 101.272822] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF
[ 101.403195] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF
............
And heavy performance loss with workloads limited by memcg, mTHP enabled.
After some debugging, the problematic part is the
mem_cgroup_swapin_charge_folio call above.
When under pressure, cgroup charge fails easily for mTHP. One 64k
swapin will require a much more aggressive reclaim to success.
If I change MAX_RECLAIM_RETRIES from 16 to 512, the spamming log is
gone and mTHP swapin should have a much higher swapin success rate.
But this might not be the right way.
For this particular issue, maybe you can change the charge order, try
charging first, if successful, use mTHP. if failed, fallback to 4k?
> - mem_cgroup_swapin_uncharge_swap(entry, 1);
> + mem_cgroup_swapin_uncharge_swap(entry, nr_pages);
>
> shadow = get_shadow_from_swap_cache(entry);
> if (shadow)
> @@ -4209,6 +4357,22 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
> goto out_nomap;
> }
>
> + /* allocated large folios for SWP_SYNCHRONOUS_IO */
> + if (folio_test_large(folio) && !folio_test_swapcache(folio)) {
> + unsigned long nr = folio_nr_pages(folio);
> + unsigned long folio_start = ALIGN_DOWN(vmf->address, nr * PAGE_SIZE);
> + unsigned long idx = (vmf->address - folio_start) / PAGE_SIZE;
> + pte_t *folio_ptep = vmf->pte - idx;
> +
> + if (!can_swapin_thp(vmf, folio_ptep, nr))
> + goto out_nomap;
> +
> + page_idx = idx;
> + address = folio_start;
> + ptep = folio_ptep;
> + goto check_folio;
> + }
> +
> nr_pages = 1;
> page_idx = 0;
> address = vmf->address;
> @@ -4340,11 +4504,12 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
> folio_add_lru_vma(folio, vma);
> } else if (!folio_test_anon(folio)) {
> /*
> - * We currently only expect small !anon folios, which are either
> - * fully exclusive or fully shared. If we ever get large folios
> - * here, we have to be careful.
> + * We currently only expect small !anon folios which are either
> + * fully exclusive or fully shared, or new allocated large folios
> + * which are fully exclusive. If we ever get large folios within
> + * swapcache here, we have to be careful.
> */
> - VM_WARN_ON_ONCE(folio_test_large(folio));
> + VM_WARN_ON_ONCE(folio_test_large(folio) && folio_test_swapcache(folio));
> VM_WARN_ON_FOLIO(!folio_test_locked(folio), folio);
> folio_add_new_anon_rmap(folio, vma, address, rmap_flags);
> } else {
> @@ -4387,7 +4552,7 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
> out:
> /* Clear the swap cache pin for direct swapin after PTL unlock */
> if (need_clear_cache)
> - swapcache_clear(si, entry, 1);
> + swapcache_clear(si, entry, nr_pages);
> if (si)
> put_swap_device(si);
> return ret;
> @@ -4403,7 +4568,7 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
> folio_put(swapcache);
> }
> if (need_clear_cache)
> - swapcache_clear(si, entry, 1);
> + swapcache_clear(si, entry, nr_pages);
> if (si)
> put_swap_device(si);
> return ret;
> --
> 2.34.1
>
>
Powered by blists - more mailing lists