Re: [PATCH 14/14] mm,migration: Allow the migration of PageSwapCache pages

[Minchan Kim]

On Fri, Apr 2, 2010 at 2:36 AM, Mel Gorman <mel@xxxxxxxxx> wrote:
> On Thu, Apr 01, 2010 at 07:51:31PM +0900, Minchan Kim wrote:
>> On Thu, Apr 1, 2010 at 2:42 PM, KAMEZAWA Hiroyuki
>> <kamezawa.hiroyu@xxxxxxxxxxxxxx> wrote:
>> > On Thu, 1 Apr 2010 13:44:29 +0900
>> > Minchan Kim <minchan.kim@xxxxxxxxx> wrote:
>> >
>> >> On Thu, Apr 1, 2010 at 12:01 PM, KAMEZAWA Hiroyuki
>> >> <kamezawa.hiroyu@xxxxxxxxxxxxxx> wrote:
>> >> > On Thu, 1 Apr 2010 11:43:18 +0900
>> >> > Minchan Kim <minchan.kim@xxxxxxxxx> wrote:
>> >> >
>> >> >> On Wed, Mar 31, 2010 at 2:26 PM, KAMEZAWA Hiroyuki    /*
>> >> >> >> diff --git a/mm/rmap.c b/mm/rmap.c
>> >> >> >> index af35b75..d5ea1f2 100644
>> >> >> >> --- a/mm/rmap.c
>> >> >> >> +++ b/mm/rmap.c
>> >> >> >> @@ -1394,9 +1394,11 @@ int rmap_walk(struct page *page, int (*rmap_one)(struct page *,
>> >> >> >>
>> >> >> >> Â Â Â if (unlikely(PageKsm(page)))
>> >> >> >> Â Â Â Â Â Â Â return rmap_walk_ksm(page, rmap_one, arg);
>> >> >> >> - Â Â else if (PageAnon(page))
>> >> >> >> + Â Â else if (PageAnon(page)) {
>> >> >> >> + Â Â Â Â Â Â if (PageSwapCache(page))
>> >> >> >> + Â Â Â Â Â Â Â Â Â Â return SWAP_AGAIN;
>> >> >> >> Â Â Â Â Â Â Â return rmap_walk_anon(page, rmap_one, arg);
>> >> >> >
>> >> >> > SwapCache has a condition as (PageSwapCache(page) && page_mapped(page) == true.
>> >> >> >
>> >> >>
>> >> >> In case of tmpfs, page has swapcache but not mapped.
>> >> >>
>> >> >> > Please see do_swap_page(), PageSwapCache bit is cleared only when
>> >> >> >
>> >> >> > do_swap_page()...
>> >> >> > Â Â Â swap_free(entry);
>> >> >> > Â Â Â Âif (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
>> >> >> > Â Â Â Â Â Â Â Âtry_to_free_swap(page);
>> >> >> >
>> >> >> > Then, PageSwapCache is cleared only when swap is freeable even if mapped.
>> >> >> >
>> >> >> > rmap_walk_anon() should be called and the check is not necessary.
>> >> >>
>> >> >> Frankly speaking, I don't understand what is Mel's problem, why he added
>> >> >> Swapcache check in rmap_walk, and why do you said we don't need it.
>> >> >>
>> >> >> Could you explain more detail if you don't mind?
>> >> >>
>> >> > I may miss something.
>> >> >
>> >> > unmap_and_move()
>> >> > Â1. try_to_unmap(TTU_MIGRATION)
>> >> > Â2. move_to_newpage
>> >> > Â3. remove_migration_ptes
>> >> > Â Â Â Â-> rmap_walk()
>> >> >
>> >> > Then, to map a page back we unmapped we call rmap_walk().
>> >> >
>> >> > Assume a SwapCache which is mapped, then, PageAnon(page) == true.
>> >> >
>> >> > ÂAt 1. try_to_unmap() will rewrite pte with swp_entry of SwapCache.
>> >> > Â Â Â mapcount goes to 0.
>> >> > ÂAt 2. SwapCache is copied to a new page.
>> >> > ÂAt 3. The new page is mapped back to the place. Now, newpage's mapcount is 0.
>> >> > Â Â Â Before patch, the new page is mapped back to all ptes.
>> >> > Â Â Â After patch, the new page is not mapped back because its mapcount is 0.
>> >> >
>> >> > I don't think shared SwapCache of anon is not an usual behavior, so, the logic
>> >> > before patch is more attractive.
>> >> >
>> >> > If SwapCache is not mapped before "1", we skip "1" and rmap_walk will do nothing
>> >> > because page->mapping is NULL.
>> >> >
>> >>
>> >> Thanks. I agree. We don't need the check.
>> >> Then, my question is why Mel added the check in rmap_walk.
>> >> He mentioned some BUG trigger and fixed things after this patch.
>> >> What's it?
>> >> Is it really related to this logic?
>> >> I don't think so or we are missing something.
>> >>
>> > Hmm. Consiering again.
>> >
>> > Now.
>> > Â Â Â Âif (PageAnon(page)) {
>> > Â Â Â Â Â Â Â Ârcu_locked = 1;
>> > Â Â Â Â Â Â Â Ârcu_read_lock();
>> > Â Â Â Â Â Â Â Âif (!page_mapped(page)) {
>> > Â Â Â Â Â Â Â Â Â Â Â Âif (!PageSwapCache(page))
>> > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Âgoto rcu_unlock;
>> > Â Â Â Â Â Â Â Â} else {
>> > Â Â Â Â Â Â Â Â Â Â Â Âanon_vma = page_anon_vma(page);
>> > Â Â Â Â Â Â Â Â Â Â Â Âatomic_inc(&anon_vma->external_refcount);
>> > Â Â Â Â Â Â Â Â}
>> >
>> >
>> > Maybe this is a fix.
>> >
>> > ==
>> > Â Â Â Âskip_remap = 0;
>> > Â Â Â Âif (PageAnon(page)) {
>> > Â Â Â Â Â Â Â Ârcu_read_lock();
>> > Â Â Â Â Â Â Â Âif (!page_mapped(page)) {
>> > Â Â Â Â Â Â Â Â Â Â Â Âif (!PageSwapCache(page))
>> > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Âgoto rcu_unlock;
>> > Â Â Â Â Â Â Â Â Â Â Â Â/*
>> > Â Â Â Â Â Â Â Â Â Â Â Â * We can't convice this anon_vma is valid or not because
>> > Â Â Â Â Â Â Â Â Â Â Â Â * !page_mapped(page). Then, we do migration(radix-tree replacement)
>> > Â Â Â Â Â Â Â Â Â Â Â Â * but don't remap it which touches anon_vma in page->mapping.
>> > Â Â Â Â Â Â Â Â Â Â Â Â */
>> > Â Â Â Â Â Â Â Â Â Â Â Âskip_remap = 1;
>> > Â Â Â Â Â Â Â Â Â Â Â Âgoto skip_unmap;
>> > Â Â Â Â Â Â Â Â} else {
>> > Â Â Â Â Â Â Â Â Â Â Â Âanon_vma = page_anon_vma(page);
>> > Â Â Â Â Â Â Â Â Â Â Â Âatomic_inc(&anon_vma->external_refcount);
>> > Â Â Â Â Â Â Â Â}
>> > Â Â Â Â}
>> > Â Â Â Â.....copy page, radix-tree replacement,....
>> >
>>
>> It's not enough.
>> we uses remove_migration_ptes in Âmove_to_new_page, too.
>> We have to prevent it.
>> We can check PageSwapCache(page) in move_to_new_page and then
>> skip remove_migration_ptes.
>>
>> ex)
>> static int move_to_new_page(....)
>> {
>> Â Â Âint swapcache = PageSwapCache(page);
>> Â Â Â...
>> Â Â Âif (!swapcache)
>> Â Â Â Â Âif(!rc)
>> Â Â Â Â Â Â Âremove_migration_ptes
>> Â Â Â Â Âelse
>> Â Â Â Â Â Â Ânewpage->mapping = NULL;
>> }
>>
>
> This I agree with.
>
>> And we have to close race between PageAnon(page) and rcu_read_lock.
>
> Not so sure on this. The page is locked at this point and that should
> prevent it from becoming !PageAnon

page lock can't prevent anon_vma free.
It's valid just only file-backed page, I think.

>> If we don't do it, anon_vma could be free in the middle of operation.
>> I means
>>
>> Â Â Â Â Â* of migration. File cache pages are no problem because of page_lock()
>> Â Â Â Â Â* File Caches may use write_page() or lock_page() in migration, then,
>> Â Â Â Â Â* just care Anon page here.
>> Â Â Â Â Â*/
>> Â Â Â Â if (PageAnon(page)) {
>> Â Â Â Â Â Â Â Â !!! RACE !!!!
>> Â Â Â Â Â Â Â Â rcu_read_lock();
>> Â Â Â Â Â Â Â Â rcu_locked = 1;
>>
>> +
>> + Â Â Â Â Â Â Â /*
>> + Â Â Â Â Â Â Â Â* If the page has no mappings any more, just bail. An
>> + Â Â Â Â Â Â Â Â* unmapped anon page is likely to be freed soon but worse,
>>
>
> I am not sure this race exists because the page is locked but a key
> observation has been made - A page that is unmapped can be migrated if
> it's PageSwapCache but it may not have a valid anon_vma. Hence, in the
> !page_mapped case, the key is to not use anon_vma. How about the
> following patch?

I like this. Kame. How about your opinion?
please, look at a comment.

>
> ==== CUT HERE ====
>
> mm,migration: Allow the migration of PageSwapCache pages
>
> PageAnon pages that are unmapped may or may not have an anon_vma so are
> not currently migrated. However, a swap cache page can be migrated and
> fits this description. This patch identifies page swap caches and allows
> them to be migrated but ensures that no attempt to made to remap the pages
> would would potentially try to access an already freed anon_vma.
>
> Signed-off-by: Mel Gorman <mel@xxxxxxxxx>
>
> diff --git a/mm/migrate.c b/mm/migrate.c
> index 35aad2a..5d0218b 100644
> --- a/mm/migrate.c
> +++ b/mm/migrate.c
> @@ -484,7 +484,8 @@ static int fallback_migrate_page(struct address_space *mapping,
> Â* Â < 0 - error code
> Â* Â== 0 - success
> Â*/
> -static int move_to_new_page(struct page *newpage, struct page *page)
> +static int move_to_new_page(struct page *newpage, struct page *page,
> + Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â int safe_to_remap)
> Â{
> Â Â Â Âstruct address_space *mapping;
> Â Â Â Âint rc;
> @@ -519,10 +520,12 @@ static int move_to_new_page(struct page *newpage, struct page *page)
> Â Â Â Âelse
> Â Â Â Â Â Â Â Ârc = fallback_migrate_page(mapping, newpage, page);
>
> - Â Â Â if (!rc)
> - Â Â Â Â Â Â Â remove_migration_ptes(page, newpage);
> - Â Â Â else
> - Â Â Â Â Â Â Â newpage->mapping = NULL;
> + Â Â Â if (safe_to_remap) {
> + Â Â Â Â Â Â Â if (!rc)
> + Â Â Â Â Â Â Â Â Â Â Â remove_migration_ptes(page, newpage);
> + Â Â Â Â Â Â Â else
> + Â Â Â Â Â Â Â Â Â Â Â newpage->mapping = NULL;
> + Â Â Â }
>
> Â Â Â Âunlock_page(newpage);
>
> @@ -539,6 +542,7 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
> Â Â Â Âint rc = 0;
> Â Â Â Âint *result = NULL;
> Â Â Â Âstruct page *newpage = get_new_page(page, private, &result);
> + Â Â Â int safe_to_remap = 1;
> Â Â Â Âint rcu_locked = 0;
> Â Â Â Âint charge = 0;
> Â Â Â Âstruct mem_cgroup *mem = NULL;
> @@ -600,18 +604,26 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
> Â Â Â Â Â Â Â Ârcu_read_lock();
> Â Â Â Â Â Â Â Ârcu_locked = 1;
>
> - Â Â Â Â Â Â Â /*
> - Â Â Â Â Â Â Â Â* If the page has no mappings any more, just bail. An
> - Â Â Â Â Â Â Â Â* unmapped anon page is likely to be freed soon but worse,
> - Â Â Â Â Â Â Â Â* it's possible its anon_vma disappeared between when
> - Â Â Â Â Â Â Â Â* the page was isolated and when we reached here while
> - Â Â Â Â Â Â Â Â* the RCU lock was not held
> - Â Â Â Â Â Â Â Â*/
> - Â Â Â Â Â Â Â if (!page_mapped(page))
> - Â Â Â Â Â Â Â Â Â Â Â goto rcu_unlock;
> + Â Â Â Â Â Â Â /* Determine how to safely use anon_vma */
> + Â Â Â Â Â Â Â if (!page_mapped(page)) {
> + Â Â Â Â Â Â Â Â Â Â Â if (!PageSwapCache(page))
> + Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â goto rcu_unlock;
>
> - Â Â Â Â Â Â Â anon_vma = page_anon_vma(page);
> - Â Â Â Â Â Â Â atomic_inc(&anon_vma->external_refcount);
> + Â Â Â Â Â Â Â Â Â Â Â /*
> + Â Â Â Â Â Â Â Â Â Â Â Â* We cannot be sure that the anon_vma of an unmapped
> + Â Â Â Â Â Â Â Â Â Â Â Â* page is safe to use. In this case, the page still

How about changing comment?
"In this case, swapcache page still "
Also, I want to change "safe_to_remap" to "remap_swapcache".
I think it's just problem related to swapcache page.
So I want to represent it explicitly although we can know it's swapcache
by code.


-- 
Kind regards,
Minchan Kim
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/