Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Fri, 10 Apr 2020 18:56:13 +0300
From:   "Kirill A. Shutemov" <kirill@shutemov.name>
To:     Yang Shi <yang.shi@linux.alibaba.com>
Cc:     akpm@linux-foundation.org, Andrea Arcangeli <aarcange@redhat.com>,
        Zi Yan <ziy@nvidia.com>, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org,
        "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Subject: Re: [PATCHv2 5/8] khugepaged: Allow to callapse a page shared across
 fork
Message-ID: <20200410155613.cxqplrmwckezx3hl@box>
References: <20200403112928.19742-1-kirill.shutemov@linux.intel.com>
 <20200403112928.19742-6-kirill.shutemov@linux.intel.com>
 <b03643ba-8411-8486-737c-1bc29dd10a74@linux.alibaba.com>
 <20200408131044.xzlheacvslrbwrja@box>
 <107630f5-bbde-3f78-23e9-6f6b3113d709@linux.alibaba.com>
 <61569ead-2bbd-6d18-c04c-3251218a3fcd@linux.alibaba.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <61569ead-2bbd-6d18-c04c-3251218a3fcd@linux.alibaba.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, Apr 09, 2020 at 05:03:00PM -0700, Yang Shi wrote:
> 
> 
> On 4/8/20 11:51 AM, Yang Shi wrote:
> > 
> > 
> > On 4/8/20 6:10 AM, Kirill A. Shutemov wrote:
> > > On Mon, Apr 06, 2020 at 01:50:56PM -0700, Yang Shi wrote:
> > > > 
> > > > On 4/3/20 4:29 AM, Kirill A. Shutemov wrote:
> > > > > The page can be included into collapse as long as it doesn't
> > > > > have extra
> > > > > pins (from GUP or otherwise).
> > > > > 
> > > > > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> > > > > ---
> > > > > ?? mm/khugepaged.c | 25 ++++++++++++++-----------
> > > > > ?? 1 file changed, 14 insertions(+), 11 deletions(-)
> > > > > 
> > > > > diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> > > > > index 57ff287caf6b..1e7e6543ebca 100644
> > > > > --- a/mm/khugepaged.c
> > > > > +++ b/mm/khugepaged.c
> > > > > @@ -581,11 +581,18 @@ static int
> > > > > __collapse_huge_page_isolate(struct vm_area_struct *vma,
> > > > > ?????????? }
> > > > > ?????????? /*
> > > > > -???????? * cannot use mapcount: can't collapse if there's a gup pin.
> > > > > -???????? * The page must only be referenced by the scanned process
> > > > > -???????? * and page swap cache.
> > > > > +???????? * Check if the page has any GUP (or other external) pins.
> > > > > +???????? *
> > > > > +???????? * The page table that maps the page has been
> > > > > already unlinked
> > > > > +???????? * from the page table tree and this process cannot get
> > > > > +???????? * additinal pin on the page.
> > > > > +???????? *
> > > > > +???????? * New pins can come later if the page is shared across fork,
> > > > > +???????? * but not for the this process. It is fine. The
> > > > > other process
> > > > > +???????? * cannot write to the page, only trigger CoW.
> > > > > ??????????? */
> > > > > -??????? if (page_count(page) != 1 + PageSwapCache(page)) {
> > > > > +??????? if (total_mapcount(page) + PageSwapCache(page) !=
> > > > > +??????????????? page_count(page)) {
> > > > This check looks fine for base page, but what if the page is
> > > > PTE-mapped THP?
> > > > The following patch made this possible.
> > > > 
> > > > If it is PTE-mapped THP and the page is in swap cache, the
> > > > refcount would be
> > > > 512 + the number of PTE-mapped pages.
> > > > 
> > > > Shall we do the below change in the following patch?
> > > > 
> > > > extra_pins = PageSwapCache(page) ? nr_ccompound(page) - 1 : 0;
> > > > if (total_mapcount(page) + PageSwapCache(page) != page_count(page) -
> > > > extra_pins) {
> > > > ...
> > > Looks like you're right.
> > > 
> > > It would be nice to have a test case to demonstrate the issue.
> > > 
> > > Is there any way to trigger moving the page to swap cache? I don't
> > > see it
> > > immediately.
> > 
> > It sounds not easy to trigger since it totally depends on timing, I'm
> > wondering we may have to use MADV_PAGEOUT? Something below off the top
> > of my head may trigger this?
> > 
> > 
> > ??? CPU??? ?? A??? ??? ??? ??? ??? ? ??? ? ??? ??? CPU??? B ??? ??? ???
> > ??? ??? CPU??? C
> > In parent:
> > MADV_HUGEPAGE
> > page fault to fill with THP
> > fork
> > ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? In Child:
> > MADV_NOHUGEPAGE
> > MADV_DONTNEED (split pmd)
> > MADV_PAGEOUT
> > ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ->
> > add_to_swap
> > ??? ??? ??? ??? ??? ??? ??? ??? khugepaged scan parent and try to
> > collapse PTE-mapped
> > 
> > ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ->
> > try_to_unmap
> > 
> > When doing MADV_DONTNEED we need make sure head page is unmapped since
> > MADV_PAGEOUT would call page_mapcount(page) to skip shared mapping.
> 
> This can't trigger it since MADV_PAGEOUT would isolate the page from lru so
> khugepaged_scan_pmd() can't reach the refcount check at all.
> 
> If try_to_unmap() or pageout() fails, the page may stay in swap cache. But I
> didn't think of an easy way to make this happen.

Okay, I'll fix it without a test case.

-- 
 Kirill A. Shutemov