Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Fri, 10 Jan 2020 09:55:48 +0800
From:   Wei Yang <richardw.yang@linux.intel.com>
To:     "Kirill A. Shutemov" <kirill@shutemov.name>
Cc:     Wei Yang <richardw.yang@linux.intel.com>,
        akpm@linux-foundation.org, kirill.shutemov@linux.intel.com,
        linux-mm@kvack.org, linux-kernel@vger.kernel.org,
        richard.weiyang@gmail.com
Subject: Re: [RFC PATCH] mm/rmap.c: finer hwpoison granularity for PTE-mapped
 THP
Message-ID: <20200110015548.GA16823@richard>
Reply-To: Wei Yang <richardw.yang@linux.intel.com>
References: <20200102030421.30799-1-richardw.yang@linux.intel.com>
 <20200109123233.ye2h4dxaubu4ad22@box>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20200109123233.ye2h4dxaubu4ad22@box>
User-Agent: Mutt/1.9.4 (2018-02-28)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, Jan 09, 2020 at 03:32:33PM +0300, Kirill A. Shutemov wrote:
>On Thu, Jan 02, 2020 at 11:04:21AM +0800, Wei Yang wrote:
>> Currently we behave differently between PMD-mapped THP and PTE-mapped
>> THP on memory_failure.
>> 
>> User detected difference:
>> 
>>     For PTE-mapped THP, the whole 2M range will trigger MCE after
>>     memory_failure(), while only 4K range for PMD-mapped THP will.
>> 
>> Direct reason:
>> 
>>     All the 512 PTE entry will be marked as hwpoison entry for a PTE-mapped
>>     THP while only one PTE will be marked for a PMD-mapped THP.
>> 
>> Root reason:
>> 
>>     The root cause is PTE-mapped page doesn't need to split pmd which skip
>>     the SPLIT_FREEZE process.
>
>I don't follow how SPLIT_FREEZE is related to pisoning. Cold you
>laraborate?
>

Sure. Let me try to explain this a little.

    split_huge_page_to_list
        unmap_page
	    try_to_unmap_one
                ...
                __split_huge_pmd_locked
        __split_huge_page
            remap_page

There are two dimensions:

   * PMD mapped THP and PTE mapped THP
   * HWPOISON-ed page and non-HWPOISON-ed page

So there are total 4 cases.

1. First let's take a look at the normal case, when HWPOISON is not set.

If the page is PMD-mapped, SPLIT_FREEZE is passed down in flags. And finally
passed to __split_huge_pmd_locked. In this function, when freeze is true, PTE
will be set to migration entry. And because __split_huge_pmd_locked save
migration entry to PTE, try_to_unmap_one will not do real unmap. Then
remap_page restore those migration entry back. 

If the page is PTE-mapped, __split_huge_pmd_locked will be skipped since this
is already done. This means try_to_unmap_one will do the real unmap. Because
SPLIT_FREEZE is passed, PTE will be set to migration entry, which is the same
behavior as PMD-mapped page. Then remap_page restore those migration entry
back.

This shows PMD-mapped and PTE-mapped page share the same result on split.

While difference is who sets PTE as migration entry

  * __split_huge_pmd_locked does this job for PMD-mapped page
  * try_to_unmap_one does this job for PTE-mapped page

2. Now let's take a look at the HWPOISON case.

There are two critical differences 

  * __split_huge_pmd_locked is skipped for PTE-mapped page
  * HWPOISON effects the behavior of try_to_unmap_one

Then for PMD-mapped page, HWPOISON has no effect on split. But for PTE-mapped
page, all PTE will be set to hwpoison entry.

Then in memory_failure, the page split will have two different PTE result.

Not sure I explain it clearly.

-- 
Wei Yang
Help you, Help me