Received-SPF: pass (google.com: domain of linux-kernel+bounces-156198-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Precedence: bulk
MIME-Version: 1.0
Date: Wed, 24 Apr 2024 03:04:51 +0000
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From: "Yajun Deng" <yajun.deng@linux.dev>
Message-ID: <e9c442bef63af1fab9f7630b41803aebf3c2b079@linux.dev>
TLS-Required: No
Subject: Re: [PATCH] mm/rmap: remove unnecessary page_table_lock
To: "Liam R. Howlett" <Liam.Howlett@oracle.com>
Cc: "David Hildenbrand" <david@redhat.com>, akpm@linux-foundation.org,
 linux-mm@kvack.org, linux-kernel@vger.kernel.org
In-Reply-To: <3v6xmyzmnw6go45riwlu7qv4c4phiexpqxldnlbgwsjhppe4oi@xdcqm4xupl4k>
References: <20240422105212.1485788-1-yajun.deng@linux.dev>
 <b848c431-deca-42e4-925c-673b3fa1f251@redhat.com>
 <3c452d5db5b3d5879160ab62a9e0ac4481a6298a@linux.dev>
 <fd7fde90-21ea-4617-be17-ba387b44feaf@redhat.com>
 <b6ea1fb5bc6c06d2855e41b4034656b0a76b58f5@linux.dev>
 <3v6xmyzmnw6go45riwlu7qv4c4phiexpqxldnlbgwsjhppe4oi@xdcqm4xupl4k>

April 24, 2024 at 1:11 AM, "Liam R. Howlett" <Liam.Howlett@oracle.com> wr=
ote:


>=20
>=20* Yajun Deng <yajun.deng@linux.dev> [240423 04:35]:
>=20
>=20>=20
>=20> April 23, 2024 at 4:18 PM, "David Hildenbrand" <david@redhat.com> w=
rote:
> >=20
>=20>=20=20
>=20>=20
>=20>=20=20
>=20>=20
>=20>=20=20
>=20>=20
>=20>=20=20
>=20>=20
>=20>  On 23.04.24 09:53, Yajun Deng wrote:
> >=20
>=20>=20=20
>=20>=20
>=20>  >=20
>=20>=20
>=20>  > April 22, 2024 at 7:24 PM, "David Hildenbrand" <david@redhat.com=
> wrote:
> >=20
>=20>  >=20
>=20>=20
>=20>  > > >>
> >=20
>=20>  >=20
>=20>=20
>=20>  > >=20
>=20>=20
>=20>  > > On 22.04.24 12:52, Yajun Deng wrote:
> >=20
>=20>  > >=20
>=20>=20
>=20>  >=20
>=20>=20
>=20>  > page_table_lock is a lock that for page table, we won't change p=
age
> >=20
>=20>  >=20
>=20>=20
>=20>  > table in __anon_vma_prepare(). As we can see, it works well in
> >=20
>=20>  >=20
>=20>=20
>=20>  > anon_vma_clone(). They do the same operation.
> >=20
>=20>  >=20
>=20>=20
>=20>  > >=20
>=20>=20
>=20>  > > We are reusing mm->page_table_lock to serialize, not the *actu=
al* low-level page table locks that really protect PTEs.
> >=20
>=20>  > >=20
>=20>=20
>=20>  > > With that locking gone, there would be nothing protection vma-=
>anon_vma.
> >=20
>=20>  > >=20
>=20>=20
>=20>  > > Note that anon_vma_clone() is likely called with the mmap_lock=
 held in write mode, which is not the case for __anon_vma_prepare() ...
> >=20
>=20>  > >=20
>=20>=20
>=20>  >=20
>=20>=20
>=20>  > Yes, anon_vma_clone() is called with the mmap_lock held. I added=
 mmap_assert_write_locked(dst->vm_mm) to prove it.
> >=20
>=20>  >=20
>=20>=20
>=20>  > I added mmap_assert_write_locked(vma->vm_mm) in __anon_vma_prepa=
re() at the same time, it shows __anon_vma_prepare()
> >=20
>=20>  >=20
>=20>=20
>=20>  > is also called with the mmap_lock held too.
> >=20
>=20>  >=20
>=20>=20
>=20>=20=20
>=20>=20
>=20>  Make sure you actually have lockdep built in and enabled.
> >=20
>=20>=20=20
>=20>=20
>=20>=20=20
>=20>=20
>=20>  This is my config.
> >=20
>=20>  CONFIG_LOCKDEP=3Dn
> >=20
>=20>  CONFIG_DEBUG_VM=3Dy
> >=20
>=20>=20=20
>=20>=20
>=20>  I did another test.
> >=20
>=20>  I put mmap_assert_write_locked(mm) before 'set_bit(MMF_OOM_SKIP, &=
mm->flags)' in mmap.c, it's outside the lock.
> >=20
>=20>  It will crash when on boot. I think mmap_assert_write_locked() wor=
ks.
> >=20
>=20
> If you are changing locks, then please test with lockdep on.
>=20

It's=20my fault. It shows a warning with lockdep on.

> >=20
>=20> __anon_vma_prepare() is for example called from do_anonymous_page()=
 where we might only hold the mmap_lock in read mode (or not at all IIRC =
with VMA in read mode).
> >=20
>=20
> Consider two concurrent readers getting to this function with the same
>=20
>=20vma. There is no mergeable anon vma, so both create a new anon_vma.
>=20
>=20You take the anon_vma lock to parallelize the linking to the vma - bu=
t
>=20
>=20they are different locks because they are both new anon_vma structs
>=20
>=20allocated by concurrent readers.
>=20
>=20You now need a lock that you know cannot allow this to happen. Lookin=
g
>=20
>=20at the top of mm/rmap.c and see which one works. The next in line is
>=20
>=20the page table lock, so that one is used here.
>=20
>=20What if we reverse the locks? We can deadlock.
>=20
>=20What if we don't take the anon_vma lock? We can have two writers to t=
he
>=20
>=20anon_vma.
>=20
>=20Thanks,
>=20
>=20Liam
>