Message ID | 20230522205744.2825689-1-dhowells@redhat.com (mailing list archive) |
---|---|
Headers | show |
Series | block: Use page pinning | expand |
On Mon, May 22, 2023 at 09:57:38PM +0100, David Howells wrote: > Hi Jens, Al, Christoph, > > This patchset rolls page-pinning out to the bio struct and the block layer, > using iov_iter_extract_pages() to get pages and noting with BIO_PAGE_PINNED > if the data pages attached to a bio are pinned. If the data pages come > from a non-user-backed iterator, then the pages are left unpinned and > unref'd, relying on whoever set up the I/O to do the retaining. I think I already review the patches, so nothing new here. But can you please also take care of the legacy direct I/O code? I'd really hate to leave yet another unfinished transition around.
Christoph Hellwig <hch@infradead.org> wrote: > But can you please also take care of the legacy direct I/O code? I'd really > hate to leave yet another unfinished transition around. I've been poking at it this afternoon, but it doesn't look like it's going to be straightforward, unfortunately. The mm folks have been withdrawing access to the pinning API behind the ramparts of the mm/ dir. Further, the dio code will (I think), under some circumstances, arbitrarily insert the zero_page into a list of things that are maybe pinned or maybe unpinned, but I can (I think) also be given a pinned zero_page from the GUP code if the page tables point to one and a DIO-write is requested - so just doing if page == zero_page isn't sufficient. What I'd like to do is to make the GUP code not take a ref on the zero_page if, say, FOLL_DONT_PIN_ZEROPAGE is passed in, and then make the bio cleanup code always ignore the zero_page. Alternatively, I can drop the pin immediately if I get given one on the zero_page - it's not going anywhere, after all. I also need to be able to take an additional pin on a folio that gets split across multiple bio submissions to replace the get_page() that's there now. Alternatively to that, I can decide how much data I'm willing to read/write in one batch, call something like netfs_extract_user_iter() to decant that portion of the parameter iterator into an bvec[] and let that look up the overlapping page multiple times. However, I'm not sure if this would work well for a couple of reasons: does a single bio have to refer to a contiguous range of disk blocks? and we might expend time on getting pages we then have to give up because we hit a hole. Something that I noticed is that the dio code seems to wangle to page bits on the target pages for a DIO-read, which seems odd, but I'm not sure I fully understand the code yet. David
On Mon, 22 May 2023 21:57:38 +0100, David Howells wrote: > This patchset rolls page-pinning out to the bio struct and the block layer, > using iov_iter_extract_pages() to get pages and noting with BIO_PAGE_PINNED > if the data pages attached to a bio are pinned. If the data pages come > from a non-user-backed iterator, then the pages are left unpinned and > unref'd, relying on whoever set up the I/O to do the retaining. > > This requires the splice-read patchset to have been applied first, > otherwise reversion of the ITER_PAGE iterator can race with truncate and > return pages to the allocator whilst they're still undergoing DMA[2]. > > [...] Applied, thanks! [1/6] iomap: Don't get an reference on ZERO_PAGE for direct I/O block zeroing commit: 9e73bb36b189ec73c7062ec974e0ff287c1aa152 [2/6] block: Fix bio_flagged() so that gcc can better optimise it commit: b9cc607a7f722c374540b2a7c973382592196549 [3/6] block: Replace BIO_NO_PAGE_REF with BIO_PAGE_REFFED with inverted logic commit: 100ae68dac60a0688082dcaf3e436606ec0fd51f [4/6] block: Add BIO_PAGE_PINNED and associated infrastructure commit: 84d9fe8b7ea6a53fd93506583ff33a408f95ac60 [5/6] block: Convert bio_iov_iter_get_pages to use iov_iter_extract_pages commit: b7c96963925fe08d4ef175b7d438c0017155807c [6/6] block: convert bio_map_user_iov to use iov_iter_extract_pages commit: 36b61bb07963b13de4cc03a945aa25b9ffc7d003 Best regards,
On Tue, May 23, 2023 at 03:38:31PM -0600, Jens Axboe wrote:
> Applied, thanks!
This ended up on the for-6.5/block branch, but I think it needs to be
on the splice one, as that is pre-requisite unless I'm missing
something.
On Tue, May 23, 2023 at 09:16:11PM +0100, David Howells wrote: > I've been poking at it this afternoon, but it doesn't look like it's going to > be straightforward, unfortunately. The mm folks have been withdrawing access > to the pinning API behind the ramparts of the mm/ dir. Further, the dio code > will (I think), under some circumstances, arbitrarily insert the zero_page > into a list of things that are maybe pinned or maybe unpinned, but I can (I > think) also be given a pinned zero_page from the GUP code if the page tables > point to one and a DIO-write is requested - so just doing if page == zero_page > isn't sufficient. Yes. I think the proper workaround is to add a MM helper that just pins a single page and make it available to direct-io.c. It should not be exported and clearly marked to not be used in new code. > What I'd like to do is to make the GUP code not take a ref on the zero_page > if, say, FOLL_DONT_PIN_ZEROPAGE is passed in, and then make the bio cleanup > code always ignore the zero_page. I don't think that'll work, as we can't mix different pin vs get types in a bio. And that's really a good thing. > Something that I noticed is that the dio code seems to wangle to page bits on > the target pages for a DIO-read, which seems odd, but I'm not sure I fully > understand the code yet. I don't understand this sentence.
On 23.05.23 22:16, David Howells wrote: > Christoph Hellwig <hch@infradead.org> wrote: > >> But can you please also take care of the legacy direct I/O code? I'd really >> hate to leave yet another unfinished transition around. > > I've been poking at it this afternoon, but it doesn't look like it's going to > be straightforward, unfortunately. The mm folks have been withdrawing access > to the pinning API behind the ramparts of the mm/ dir. Further, the dio code > will (I think), under some circumstances, arbitrarily insert the zero_page > into a list of things that are maybe pinned or maybe unpinned, but I can (I > think) also be given a pinned zero_page from the GUP code if the page tables > point to one and a DIO-write is requested - so just doing if page == zero_page > isn't sufficient. > > What I'd like to do is to make the GUP code not take a ref on the zero_page > if, say, FOLL_DONT_PIN_ZEROPAGE is passed in, and then make the bio cleanup > code always ignore the zero_page. We discussed doing that unconditionally in the context of vfio (below), but vfio decided to add a workaround suitable for stable. In case of FOLL_PIN it's simple: if we detect the zeropage, don't mess with the refcount when pinning and don't mess with the refcount when unpinning (esp. unpin_user_pages). FOLL_GET is a different story but we don't have to mess with that. So there shouldn't be need for a FOLL_DONT_PIN_ZEROPAGE, we could just do it unconditionally. > > Alternatively, I can drop the pin immediately if I get given one on the > zero_page - it's not going anywhere, after all. That's what vfio did in commit 873aefb376bbc0ed1dd2381ea1d6ec88106fdbd4 Author: Alex Williamson <alex.williamson@redhat.com> Date: Mon Aug 29 21:05:40 2022 -0600 vfio/type1: Unpin zero pages There's currently a reference count leak on the zero page. We increment the reference via pin_user_pages_remote(), but the page is later handled as an invalid/reserved page, therefore it's not accounted against the user and not unpinned by our put_pfn(). Introducing special zero page handling in put_pfn() would resolve the leak, but without accounting of the zero page, a single user could still create enough mappings to generate a reference count overflow. The zero page is always resident, so for our purposes there's no reason to keep it pinned. Therefore, add a loop to walk pages returned from pin_user_pages_remote() and unpin any zero pages. For vfio that handling no longer required, because FOLL_LONGTERM will never pin the shared zeropage.
Christoph Hellwig <hch@infradead.org> wrote: > > Applied, thanks! > > This ended up on the for-6.5/block branch, but I think it needs to be > on the splice one, as that is pre-requisite unless I'm missing > something. Indeed. As I noted in the cover note: This requires the splice-read patchset to have been applied first, otherwise reversion of the ITER_PAGE iterator can race with truncate and return pages to the allocator whilst they're still undergoing DMA[2]. David
Christoph Hellwig <hch@infradead.org> wrote: > > What I'd like to do is to make the GUP code not take a ref on the zero_page > > if, say, FOLL_DONT_PIN_ZEROPAGE is passed in, and then make the bio cleanup > > code always ignore the zero_page. > > I don't think that'll work, as we can't mix different pin vs get types > in a bio. And that's really a good thing. True - but I was thinking of just treating the zero_page specially and never hold a pin or a ref on it. It can be checked by address, e.g.: static inline void bio_release_page(struct bio *bio, struct page *page) { if (page == ZERO_PAGE(0)) return; if (bio_flagged(bio, BIO_PAGE_PINNED)) unpin_user_page(page); else if (bio_flagged(bio, BIO_PAGE_REFFED)) put_page(page); } I'm slightly concerned about the possibility of overflowing the refcount. The problem is that it only takes about 2 million pins to do that (because the zero_page isn't a large folio) - which is within reach of userspace. Create an 8GiB anon mmap and do a bunch of async DIO writes from it. You won't hit ENOMEM because it will stick ~2 million pointers to zero_page into the page tables. > > Something that I noticed is that the dio code seems to wangle to page bits on > > the target pages for a DIO-read, which seems odd, but I'm not sure I fully > > understand the code yet. > > I don't understand this sentence. I was looking at this: static inline void dio_bio_submit(struct dio *dio, struct dio_submit *sdio) { ... if (dio->is_async && dio_op == REQ_OP_READ && dio->should_dirty) bio_set_pages_dirty(bio); ... } but looking again, the lock is taken briefly and the dirty bit is set - which is reasonable. However, should we be doing it before starting the I/O? David
On 5/23/23 11:52 PM, Christoph Hellwig wrote: > On Tue, May 23, 2023 at 03:38:31PM -0600, Jens Axboe wrote: >> Applied, thanks! > > This ended up on the for-6.5/block branch, but I think it needs to be > on the splice one, as that is pre-requisite unless I'm missing > something. Oops yes, that's my bad. I've reshuffled things now so that they should make more sense.
On Wed, May 24, 2023 at 09:47:10AM +0100, David Howells wrote: > True - but I was thinking of just treating the zero_page specially and never > hold a pin or a ref on it. It can be checked by address, e.g.: > > static inline void bio_release_page(struct bio *bio, struct page *page) > { > if (page == ZERO_PAGE(0)) > return; > if (bio_flagged(bio, BIO_PAGE_PINNED)) > unpin_user_page(page); > else if (bio_flagged(bio, BIO_PAGE_REFFED)) > put_page(page); > } That does sound good as well to me. > I was looking at this: > > static inline void dio_bio_submit(struct dio *dio, struct dio_submit *sdio) > { > ... > if (dio->is_async && dio_op == REQ_OP_READ && dio->should_dirty) > bio_set_pages_dirty(bio); > ... > } > > but looking again, the lock is taken briefly and the dirty bit is set - which > is reasonable. However, should we be doing it before starting the I/O? It is done before starting the I/O - the submit_bio is just below this.
On Wed, May 24, 2023 at 1:47 AM David Howells <dhowells@redhat.com> wrote: > > True - but I was thinking of just treating the zero_page specially and never > hold a pin or a ref on it. It can be checked by address, e.g.: > > static inline void bio_release_page(struct bio *bio, struct page *page) > { > if (page == ZERO_PAGE(0)) > return; That won't actually work. We do have cases that try to use the page coloring that we support. Admittedly it seems to be only rmda that does it directly with something like this: vmf->page = ZERO_PAGE(vmf->address); but you can get arbitrary zero pages by pinning or GUPing them from user space mappings. Now, the only architectures that *use* multiple zero pages are - I think - MIPS (including Loongarch) and s390. So it's rare, but it does happen. Linus
On 25.05.23 18:31, Linus Torvalds wrote: > On Wed, May 24, 2023 at 1:47 AM David Howells <dhowells@redhat.com> wrote: >> >> True - but I was thinking of just treating the zero_page specially and never >> hold a pin or a ref on it. It can be checked by address, e.g.: >> >> static inline void bio_release_page(struct bio *bio, struct page *page) >> { >> if (page == ZERO_PAGE(0)) >> return; > > That won't actually work. > > We do have cases that try to use the page coloring that we support. > > Admittedly it seems to be only rmda that does it directly with > something like this: > > vmf->page = ZERO_PAGE(vmf->address); > > but you can get arbitrary zero pages by pinning or GUPing them from > user space mappings. > > Now, the only architectures that *use* multiple zero pages are - I > think - MIPS (including Loongarch) and s390. > > So it's rare, but it does happen. I think the correct way to test for a zero page is is_zero_pfn(page_to_pfn(page). Using my_zero_pfn(vmf->address) in do_anonymous_page() these can easily end up in any process.
Linus Torvalds <torvalds@linux-foundation.org> wrote:
> We do have cases that try to use the page coloring that we support.
What do we gain from it? Presumably since nothing is supposed to write to
that page, it can be shared in all the caches.
David
On Thu, May 25, 2023 at 9:45 AM David Hildenbrand <david@redhat.com> wrote: > > I think the correct way to test for a zero page is > is_zero_pfn(page_to_pfn(page). Yeah. Except it's really ugly and strange, and we should probably add a helper for that pattern. The reason it has that odd "look at pfn" is just because I think the first users were in the page table code, which had the pfn already, and the test is basically based on the zero_page_mask thing that the affected architectures have. So I suspect we should add that is_zero_pfn(page_to_pfn(page)) as a helper inline function rather than write it out even more times (that "is this 'struct page' a zero page" pattern already exists in /proc and a few other places. is_longterm_pinnable_page() already has it, so adding it as a helper there in <linux/mm.h> is probably a good idea. Linus
David Hildenbrand <david@redhat.com> wrote: > I think the correct way to test for a zero page is > is_zero_pfn(page_to_pfn(page). > > Using my_zero_pfn(vmf->address) in do_anonymous_page() these can easily end up > in any process. Should everywhere that is using ZERO_PAGE(0) actually be using my_zero_pfn()? ZERO_PAGE() could do with a kdoc comment saying how to use it. David
On Thu, May 25, 2023 at 10:01 AM David Howells <dhowells@redhat.com> wrote: > > What do we gain from it? Presumably since nothing is supposed to write to > that page, it can be shared in all the caches. I don't remember the details, but they went something like "broken purely virtually indexed cache avoids physical aliases by cacheline exclusion at fill time". Which then meant that if you walk a zero mapping, you'll invalidate the caches of the previous page when you walk the next one. Causing horrendously bad performance. Unless it's colored. Something like that. I probably got all the details wrong. Linus
Linus Torvalds <torvalds@linux-foundation.org> wrote: > So I suspect we should add that > > is_zero_pfn(page_to_pfn(page)) > > as a helper inline function rather than write it out even more times > (that "is this 'struct page' a zero page" pattern already exists in > /proc and a few other places. > > is_longterm_pinnable_page() already has it, so adding it as a helper > there in <linux/mm.h> is probably a good idea. I just added: static inline bool IS_ZERO_PAGE(const struct page *page) { return is_zero_pfn(page_to_pfn(page)); } static inline bool IS_ZERO_FOLIO(const struct folio *folio) { return is_zero_pfn(page_to_pfn((const struct page *)folio)); } to include/linux/pgtable.h. It doesn't seem I can add it to mm.h as an inline function. David
On Thu, May 25, 2023 at 10:07 AM David Howells <dhowells@redhat.com> wrote: > > Should everywhere that is using ZERO_PAGE(0) actually be using my_zero_pfn()? No, that would just make code uglier for no reason, because then you have to turn that pfn into a virtual address. So if what you *want* is a pfn to begin with, then use, use my_zero_pfn(). But if what you want is just the virtual address, use ZERO_PAGE(). And if you are going to map it at some address, give it the address you're going to use, otherwise just do zero for "whatever". The only thing you can't use ZERO_PAGE(0) for is literally that "is this a zero page" address comparison, because ZERO_PAGE(0) is just _one_ address. Linus
On Thu, May 25, 2023 at 10:15 AM David Howells <dhowells@redhat.com> wrote: > > It doesn't seem I can add it to mm.h as an inline function. What? We already have that pattern inside is_longterm_pinnable_page(), so that's really strange. But regardless, please don't duplicate that odd conditional for no reason, and don't scream. So regardless of where it is, make that "is_zero_folio()" just do "is_zero_page(&folio->page)" rather than repeat the question. I also wonder whether we shouldn't just use the "transparent union" argument thing more aggressively. Something like typedef union { struct page *page; struct folio *folio; } page_or_folio_t __attribute__ ((__transparent_union__)); and then you should be able to do something like this: static inline bool is_zero_page(const page_or_folio_t arg) { return is_zero_pfn(page_to_pfn(arg.page)); } and we don't have to keep generating the two versions over and over and over again. Linus