futex: Calculate the futex key based on a tail page for file-based futexes
PATCH 1/1 futex: Calculate the futex key based on a tail page for file-based futexes
Mike Galbraith reported that the LTP test case futex_wake04 was broken by commit 65d8fc777f6d ("futex: Remove requirement for lock_page() in get_futex_key()").
This test case uses futexes backed by hugetlbfs pages and so there is an associated inode with a futex stored on such pages. The problem is that the key is being calculated based on the head page index of the hugetlbfs page and not the tail page.
Prior to the optimisation, the page lock was used to stabilise mappings and pin the inode is file-backed which is overkill. If the page was a compound page, the head page was automatically looked up as part of the page lock operation but the tail page index was used to calculate the futex key.
After the optimisation, the compound head is looked up early and the page lock is only relied upon to identify truncated pages, special pages or a shmem page moving to swapcache. The head page is looked up because without the page lock, special care has to be taken to pin the inode correctly. However, the tail page is still required to calculate the futex key so this patch records the tail page.
On vanilla 4.6, the output of the test case is;
futex_wake04 0 TINFO : Hugepagesize 2097152 futex_wake04 1 TFAIL : futex_wake04.c:126: Bug: wait_thread2 did not wake after 30 secs.
With the patch applied
futex_wake04 0 TINFO : Hugepagesize 2097152 futex_wake04 1 TPASS : Hi hydra, thread2 awake!
--- kernel/futex.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
kernel/futex.c +11 -3
@@ -469,7 +469,7 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw) {unsigned long address = (unsigned long )uaddr;struct mm_struct *mm = current->mm; -struct page *page; +struct page *page, *tail;struct address_space *mapping;int err, ro =0 ;
@@ -530,7 +530,15 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)* considered here and page lock forces unnecessarily serialization * From this point on, mapping will be re-verified if necessary and * page lock will be acquired only if it is unavoidable -*/ +* +* Mapping checks require the head page for any compound page so the +* head page and mapping is looked up now. For anonymous pages, it +* does not matter if the page splits in the future as the key is +* based on the address. For filesystem-backed pages, the tail is +* required as the index of the page determines the key. For +* base pages, there is no tail page and tail == page. +*/ + tail = page; page =compound_head (page); mapping =READ_ONCE (page->mapping);
@@ -654,7 +662,7 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw) key->both.offset |=FUT_OFF_INODE ;/* inode-based key */ key->shared.inode = inode; - key->shared.pgoff =basepage_index (page); + key->shared.pgoff =basepage_index (tail);rcu_read_unlock (); }
Quoted 26 lines · Mel Gorman
Mike Galbraith reported that the LTP test case
futex_wake04was broken by commit65d8fc777f6d("futex: Remove requirement forlock_page()inget_futex_key()").This test case uses futexes backed by hugetlbfs pages and so there is an associated inode with a futex stored on such pages. The problem is that the key is being calculated based on the head page index of the hugetlbfs page and not the tail page.
Prior to the optimisation, the page lock was used to stabilise mappings and pin the inode is file-backed which is overkill. If the page was a compound page, the head page was automatically looked up as part of the page lock operation but the tail page index was used to calculate the futex key.
After the optimisation, the compound head is looked up early and the page lock is only relied upon to identify truncated pages, special pages or a shmem page moving to swapcache. The head page is looked up because without the page lock, special care has to be taken to pin the inode correctly. However, the tail page is still required to calculate the futex key so this patch records the tail page.
On vanilla 4.6, the output of the test case is;
futex_wake04 0 TINFO : Hugepagesize 2097152 futex_wake04 1 TFAIL : futex_wake04.c:126: Bug: wait_thread2 did not wake after 30 secs.
Quoted 7 lines
With the patch applied
futex_wake04 0 TINFO : Hugepagesize 2097152 futex_wake04 1 TPASS : Hi hydra, thread2 awake!Reported-by Mike Galbraith <[email protected]>Signed-off-by Mel Gorman <[email protected]>
Quoted 43 lines
--- kernel/futex.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)kernel/futex.c +11
-3@@ -469,7 +469,7 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw) {unsigned long address = (unsigned long )uaddr;struct mm_struct *mm = current->mm; -struct page *page; +struct page *page, *tail;struct address_space *mapping;int err, ro =0 ;@@ -530,7 +530,15 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)* considered here and page lock forces unnecessarily serialization * From this point on, mapping will be re-verified if necessary and * page lock will be acquired only if it is unavoidable -*/ +* +* Mapping checks require the head page for any compound page so the +* head page and mapping is looked up now. For anonymous pages, it +* does not matter if the page splits in the future as the key is +* based on the address. For filesystem-backed pages, the tail is +* required as the index of the page determines the key. For +* base pages, there is no tail page and tail == page. +*/ + tail = page; page =compound_head (page); mapping =READ_ONCE (page->mapping);@@ -654,7 +662,7 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw) key->both.offset |=FUT_OFF_INODE ;/* inode-based key */ key->shared.inode = inode; - key->shared.pgoff =basepage_index (page); + key->shared.pgoff =basepage_index (tail);rcu_read_unlock (); }
Quoted 4 lines · Peter Zijlstra
Quoted 1 line · Mel Gorman
Signed-off-by Mel Gorman <[email protected]>
Wants a stable tag so it gets auto-snarfed by Greg?
Quoted 7 lines · Mike Galbraith
Quoted 4 lines · Peter Zijlstra
Quoted 1 line · Mel Gorman
Signed-off-by Mel Gorman <[email protected]>Wants a stable tag so it gets auto-snarfed by Greg?
Can I assume it passed tests for you?
If so, I'll resend with any acks and a "# 4.6+" stable tag to Thomas assuming he does not object to the patch in the meantime.
Signature · 2 lines
Mel Gorman SUSE Labs
Quoted 10 lines · Mel Gorman
Quoted 7 lines · Mike Galbraith
Quoted 4 lines · Peter Zijlstra
Quoted 1 line · Mel Gorman
Signed-off-by Mel Gorman <[email protected]>Wants a stable tag so it gets auto-snarfed by Greg?
Can I assume it passed tests for you?
While I didn't test this specific patch, modulo 'tail' vs 'pinned', it's identical to the three liner I tested to confirm that the get/put_page() bits I added were in indeed superfluous.. so yeah, it definitely squashes buglet.
-Mike
Quoted 26 lines · Mel Gorman
Mike Galbraith reported that the LTP test case
futex_wake04was broken by commit65d8fc777f6d("futex: Remove requirement forlock_page()inget_futex_key()").This test case uses futexes backed by hugetlbfs pages and so there is an associated inode with a futex stored on such pages. The problem is that the key is being calculated based on the head page index of the hugetlbfs page and not the tail page.
Prior to the optimisation, the page lock was used to stabilise mappings and pin the inode is file-backed which is overkill. If the page was a compound page, the head page was automatically looked up as part of the page lock operation but the tail page index was used to calculate the futex key.
After the optimisation, the compound head is looked up early and the page lock is only relied upon to identify truncated pages, special pages or a shmem page moving to swapcache. The head page is looked up because without the page lock, special care has to be taken to pin the inode correctly. However, the tail page is still required to calculate the futex key so this patch records the tail page.
On vanilla 4.6, the output of the test case is;
futex_wake04 0 TINFO : Hugepagesize 2097152 futex_wake04 1 TFAIL : futex_wake04.c:126: Bug: wait_thread2 did not wake after 30 secs.
Quoted 7 lines
With the patch applied
futex_wake04 0 TINFO : Hugepagesize 2097152 futex_wake04 1 TPASS : Hi hydra, thread2 awake!Reported-by Mike Galbraith <[email protected]>Signed-off-by Mel Gorman <[email protected]>
(and yay for maintaining performance)