Received-SPF: pass (google.com: domain of linux-kernel+bounces-141389-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Date: Thu, 11 Apr 2024 13:13:19 -0400
From: "Liam R. Howlett" <Liam.Howlett@Oracle.com>
To: Peter Xu <peterx@redhat.com>
Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org,
        Andrew Morton <akpm@linux-foundation.org>,
        Matthew Wilcox <willy@infradead.org>,
        Suren Baghdasaryan <surenb@google.com>,
        Lokesh Gidra <lokeshgidra@google.com>,
        Alistair Popple <apopple@nvidia.com>
Subject: Re: [PATCH] mm: Always sanity check anon_vma first for per-vma locks
Message-ID: <20240411171319.almhz23xulg4f7op@revolver>
Mail-Followup-To: "Liam R. Howlett" <Liam.Howlett@Oracle.com>,
	Peter Xu <peterx@redhat.com>, linux-kernel@vger.kernel.org,
	linux-mm@kvack.org, Andrew Morton <akpm@linux-foundation.org>,
	Matthew Wilcox <willy@infradead.org>,
	Suren Baghdasaryan <surenb@google.com>,
	Lokesh Gidra <lokeshgidra@google.com>,
	Alistair Popple <apopple@nvidia.com>
References: <20240410170621.2011171-1-peterx@redhat.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240410170621.2011171-1-peterx@redhat.com>
User-Agent: NeoMutt/20220429
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?us-ascii?Q?ZQgQUSJh1fkQ+FUwmj/riZDKg5TNCgoPdu+//JYbc/LuJURWJhwqTvDG21hD?=
 =?us-ascii?Q?7fJan2L9nb38DezJnNuxWDt10jCNiqGQUpuoAwXO00Rxlp2rN1+5QqZyh7Wg?=
 =?us-ascii?Q?CEWd8EJhYErC+r3hQ1Q//r2qg6pEw43HOGqogagaYqtOb/3mivFZUYvpebUZ?=
 =?us-ascii?Q?D9IAfb+SE53IAEBl/QBNukWEZ/Dti2zzkTolekEF9Dy9ulyY82sUq1Rcg4yh?=
 =?us-ascii?Q?TGXS8Utg84Sd3KzAZjYpXEPWYdcs2BhQ9n3Wh449hhYWBPS62Btt75XT7zya?=
 =?us-ascii?Q?X+cXYeny0NewfxLrHmZNa3oq1p1Npzxwfy1POja1ss5LT0/d5MMN6EjWUedE?=
 =?us-ascii?Q?/XraZj3sj5t5z724f5ImnZrjfvkV/pMaVYy5lNJmx6crQOCW+K53ah7Vq8nj?=
 =?us-ascii?Q?uLq3+m18ic93U2Q3K3WahzMWuD0+H0UorZ5t820LbG5HxRPtuxVIiDW69/+2?=
 =?us-ascii?Q?BT6c70wQGoiHp/BCs64Hs2bTBpEqNbgrfT6CYO6+i5rOvGhL50uioNLlSZPf?=
 =?us-ascii?Q?ZT1A7ErgB+zuAvLpkR5/yLy6a+e9mkIsMsBoLECygbyFIJ+PAZf9I/iWv7UI?=
 =?us-ascii?Q?a15MV6x1yleKSejPNRJZRtIFKANtHIXkpyfoZqLY3CEkRKZS8SACwKNgfdsv?=
 =?us-ascii?Q?KQSMVs2Sk0AUc3JYSTJo+q2nm3JnblDCXF2QaF25Gko5PLw3ryBCc1cdR2cR?=
 =?us-ascii?Q?rMX2D7kRvHTohIJvFPHm+FvFnElUZkkbdqewa5PlSep0G42s7uWOUvIS2qrg?=
 =?us-ascii?Q?ReYoozC9YFgI8BpkrWAug6sGIg5VXFP+GcH/fpQOTxHBInldcPHcGHr92613?=
 =?us-ascii?Q?GycJqUhn9Drs/f6ssx/ESARjnmmDY44AFOU8vpxmKfqrGFDPUn+/SHProbA7?=
 =?us-ascii?Q?9xdKMiLLMlh2tCHWeGgQh0iR+XG1Okpy6wIsMu1Di6NpYAOU1zrlPhyTjedK?=
 =?us-ascii?Q?N0gF1xfQanCPHh/6uBfJPZ5VC5V3SIbQvUnjnl6OZW6w70A3h9MgYlrkWmIp?=
 =?us-ascii?Q?MUOWHf5Y/P4Co4A8MAnal4quCBrDB52vH/tLSCLuyNa9Lze0TBkK0JHuitkj?=
 =?us-ascii?Q?M8BrJhKhJrZMIuil7d/omzepZPeTu7QtDTzucsjtg9nzSUKd304RV2FqU2MJ?=
 =?us-ascii?Q?PyfZsbOLUssYaZ/C/OGTTgYjez00zOV1ZAVB5FgjffI8KtMYzCctvwmK0X0i?=
 =?us-ascii?Q?Y0g6Lt+qsLpNVFH+FJb1qHFZqDUEzr44iS+n/5qYebNS0SU+6DYS7JBzeuK6?=
 =?us-ascii?Q?UKL2EgWy2FNRtld5I7qb81DYZdrAKSZiUEhzpOdKdkaDeUZL1neEP2zAQVUB?=
 =?us-ascii?Q?ZAlC9Hf4xvz0FzpyOrC75JUiGyRq6KmPkTPgRALwI8TEOzIFS7bo7bkfYGC9?=
 =?us-ascii?Q?H/JNY0TxtfljHMhYR+NcQRShvxYnrgRQKXH8lQptCnE8SqWk5vPzZ082sWwd?=
 =?us-ascii?Q?3VZSsStQSQu2O5N1NwnbiP5jjLdrUONoOUaHRo40cKMwq2DDXp1vihmH2Awz?=
 =?us-ascii?Q?dKh7LaR0Mqsn1sDsI6S7Z8Aqp+chNEyXhBgX15ktbFkVzogI5+QGcEk7HtqQ?=
 =?us-ascii?Q?r2VM+m6rMyyK1+G5PTxANjNGI0m+KTjURf6TtcPS?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	+9IqSoN6QQrEQDffCaJ8KL6KKHgKbDvA3uhSzsGSc7znQgV9CUZPqXRk013OID6Bj0gl1PluWgc1wzVbPTA0akJeXh4cH3WjOvIyBdekko87mJCBWRCoHaGsqRrFLksHOw12qrbtNFUSicn+Gh/q8lDccpzez/GSBYXE3vjRn3b8vZMB4RHXhJW+i8lFKTCS0cB3b/KrmIr7e7+LzyVjgsJrN5x9bDPTBDA1Qp6xPibPQjTe32MqAKQHLx6fCkVrnHvIGyD4Iy7SKrF9lHY0nk2jfBqWMVdPnoVdfxGeipGLDV6Pb7WSIxylX0wUL7c5afLTPde3my1NpGYRKoGZTnUpgcJCc2o5p1y9VK4174r6xTU8e7x+DLxWOAHGJnI8lyTiM/hk7kPam8KEu6pPmnsIjLuCeTdhsC8ZPSFzJf3cGsx1uXlHO3sdbxDRRAFNFijKmTHh9HAggaTlJkrfQ6h8+ls7+ky5cXp3OXmktNJqFnt9pbHh23x2ZskKIZp1gLHTWtatHDO4pLpPhH4Pomqojl09ZM1L+ffIQkhTljddF+69cjMVIazza0emK7csQ8YpWjqbczLVXz/KDvNk7Dv5juoP81wcKXRWaUxTCiY=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: cddcc3b3-76f2-4388-0a96-08dc5a4ab011
X-MS-Exchange-CrossTenant-AuthSource: DS0PR10MB7933.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Apr 2024 17:13:20.9110
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: moc3JOry8qN4Vf/d50VMVBCoSmw7DibUlzexPrAP1cqf5guSfp40P2lJ6VLFpUaZfFzCb5RREnB92O1zSWY14g==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR10MB6947
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2024-04-11_10,2024-04-09_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 malwarescore=0
 suspectscore=0 spamscore=0 mlxscore=0 bulkscore=0 adultscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2404010000 definitions=main-2404110125
X-Proofpoint-GUID: 2f1RwA5d_hzliCM1aolTaP_JjjaIDKGt
X-Proofpoint-ORIG-GUID: 2f1RwA5d_hzliCM1aolTaP_JjjaIDKGt

* Peter Xu <peterx@redhat.com> [240410 13:06]:
> anon_vma is a tricky object in the context of per-vma lock, because it's
> racy to modify it in that context and mmap lock is needed if it's not
> stable yet.

How is it racy in your view?  There isn't a way to get in a situation
where its state isn't certain, is there?

> 
> So far there are three places that sanity checks anon_vma for that:
> 
>   - lock_vma_under_rcu(): this is the major entrance of per-vma lock, where
>     we have taken care of anon memory v.s. potential anon_vma allocations.

Well, not exactly.  Single vma faults vs potential modifications beyond
one vma (including uses of adjacent vmas with anon_vmas)

> 
>   - lock_vma(): even if it looks so generic as an API, it's only used in
>     userfaultfd context to leverage per-vma locks.  It does extra check
>     over MAP_PRIVATE file mappings for the same anon_vma issue.

This static function is in mm/userfaultfd so, yes, it's not generic -
the name is generic, but I didn't see a reason to hold up the patch for
a static name that is descriptive.  It's static so I'm not concerned
about usage growing.

I would expect such a check will eventually need to be moved to common
code, and then potentially change the name to something more
descriptive.  This seems premature with a single user though.

> 
>   - vmf_anon_prepare(): it works for private file mapping faults just like
>     what lock_vma() wanted to cover above.  One trivial difference is in
>     some extremely corner case, the fault handler will still allow per-vma
>     fault to happen, like a READ on a privately mapped file.

What is happening here is that we are detecting when the virtual memory
space is stable vs when the vma is stable.  In some cases, when we need
to check prev/next, then we need to make sure the virtual memory space
is stable.  In other cases, the vma is all that matters to the operation
and so we can continue without stopping anyone else from modifying the
virtual memory space - that is, we are allowing writes in other areas.

> 
> The question is whether that's intended to make it as complicated.  Per my
> question in the thread, it is not intended, and Suren also seems to agree [1].
> 
> So the trivial side effect of such patch is:
> 
>   - We may do slightly better on the first WRITE of a private file mapping,
>   because we can retry earlier (in lock_vma_under_rcu(), rather than
>   vmf_anon_prepare() later).
> 
>   - We may always use mmap lock for the initial READs on a private file
>   mappings, while before this patch it _can_ (only when no WRITE ever
>   happened... but it doesn't make much sense for a MAP_PRIVATE..) do the
>   read fault with per-vma lock.
> 
> Then noted that right after any WRITE the anon_vma will be stablized, then
> there will be no difference.

In my view, the anon_vma is always stable.  During a write it is
initialised.

>And I believe that should be the majority
> cases too; I also did try to run a program, writting to MAP_PRIVATE file
> memory (that I pre-headed in the page cache) and I can hardly measure a
> difference in performance.
> 
> Let's simply ignore all those trivial corner cases and unify the anon_vma
> check from three places into one.  I also didn't check the rest users of
> lock_vma_under_rcu(), where in a !fault context it could even fix something
> that used to race with private file mappings but I didn't check further.

This change will increase mmap semaphore contention.  I'd like to move
to a more common structured layout, but I think we need to find a way to
do this without failing the lock_vma_under_rcu() more frequently.  In
fact, we need to be looking for ways to make it fail less.

The UFFD code is more strict on what is acceptable for a per-vma lock
[1].  This user has a restriction that will decrease the benefits of the
per-vma lock, but we shouldn't make this case the common one.

As I'm sure you are aware, the page fault path is the most common path
for using per-vma locks and should minimize taking the mmap lock as much
as possible.

I don't think we should increase the lock contention to simplify the
code.

Thanks,
Liam

[1] https://lore.kernel.org/lkml/CAG48ez0AdTijvuh0xueg_spwNE9tVcPuvqT9WpvmtiNNudQFMw@mail.gmail.com/