Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <df2597f6-af21-5547-d39c-94c02ad17adb@linux.alibaba.com>
 <20200709155002.GF12769@casper.infradead.org> <20200709160750.utl46xvavceuvnom@box>
 <f761007f-4663-f72e-b0da-fc3ce9486b4b@linux.alibaba.com> <441ebbeb-0408-e22e-20f4-1be571c4a18e@nextfour.com>
 <50113530-fae5-bb36-56c2-5b5c4f90426d@linux.alibaba.com>
In-Reply-To: <50113530-fae5-bb36-56c2-5b5c4f90426d@linux.alibaba.com>
From:   Yang Shi <shy828301@gmail.com>
Date:   Fri, 10 Jul 2020 10:29:27 -0700
Message-ID: <CAHbLzko9DtqTpamdGAZRtRm9fq8E-FQR_79SHso7SeheUjzEzA@mail.gmail.com>
Subject: Re: a question of split_huge_page
To:     Alex Shi <alex.shi@linux.alibaba.com>
Cc:     =?UTF-8?Q?Mika_Penttil=C3=A4?= <mika.penttila@nextfour.com>,
        "Kirill A. Shutemov" <kirill@shutemov.name>,
        Matthew Wilcox <willy@infradead.org>,
        Johannes Weiner <hannes@cmpxchg.org>,
        Linux-MM <linux-mm@kvack.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Hugh Dickins <hughd@google.com>,
        Joerg Roedel <joro@8bytes.org>,
        iommu@lists.linux-foundation.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Fri, Jul 10, 2020 at 2:35 AM Alex Shi <alex.shi@linux.alibaba.com> wrote=
:
>
> =E5=9C=A8 2020/7/10 =E4=B8=8B=E5=8D=881:28, Mika Penttil=C3=A4 =E5=86=99=
=E9=81=93:
> >
> >
> > On 10.7.2020 7.51, Alex Shi wrote:
> >>
> >> =E5=9C=A8 2020/7/10 =E4=B8=8A=E5=8D=8812:07, Kirill A. Shutemov =E5=86=
=99=E9=81=93:
> >>> On Thu, Jul 09, 2020 at 04:50:02PM +0100, Matthew Wilcox wrote:
> >>>> On Thu, Jul 09, 2020 at 11:11:11PM +0800, Alex Shi wrote:
> >>>>> Hi Kirill & Matthew,
> >>>>>
> >>>>> In the func call chain, from split_huge_page() to lru_add_page_tail=
(),
> >>>>> Seems tail pages are added to lru list at line 963, but in this sce=
nario
> >>>>> the head page has no lru bit and isn't set the bit later. Why we do=
 this?
> >>>>> or do I miss sth?
> >>>> I don't understand how we get to split_huge_page() with a page that'=
s
> >>>> not on an LRU list.  Both anonymous and page cache pages should be o=
n
> >>>> an LRU list.  What am I missing?>
> >>
> >> Thanks a lot for quick reply!
> >> What I am confusing is the call chain: __iommu_dma_alloc_pages()
> >> to split_huge_page(), in the func, splited page,
> >>      page =3D alloc_pages_node(nid, alloc_flags, order);
> >> And if the pages were added into lru, they maybe reclaimed and lost,
> >> that would be a panic bug. But in fact, this never happened for long t=
ime.
> >> Also I put a BUG() at the line, it's nevre triggered in ltp, and run_v=
mtests
> >
> >
> > In  __iommu_dma_alloc_pages, after split_huge_page(),  who is taking a
> > reference on tail pages? Seems tail pages are freed and the function
> > errornously returns them in pages[] array for use?
> >
>
> CC Joerg and iommu list,
>
> That's a good question. seems the split_huge_page was never triggered her=
e,
> since the func would check the PageLock first. and have page->mapping and=
 PageAnon
> check, any of them couldn't be matched for the alloced page.
>
> Hi Joerg,
> would you like look into this? do we still need the split_huge_page() her=
e?

I think this is the same problem which has been discussed a couple of
weeks ago. Please refer to:
https://lore.kernel.org/linux-mm/20200619001938.GA135965@carbon.dhcp.thefac=
ebook.com/

I think the conclusion is split_huge_page() can't be used in this path
at all. But we didn't reach a fix yet.

>
> Thanks
> Alex
>
> int split_huge_page_to_list(struct page *page, struct list_head *list)
> {
>         struct page *head =3D compound_head(page);
>         struct deferred_split *ds_queue =3D get_deferred_split_queue(head=
);
>         struct anon_vma *anon_vma =3D NULL;
>         struct address_space *mapping =3D NULL;
>         int count, mapcount, extra_pins, ret;
>         pgoff_t end;
>
>         VM_BUG_ON_PAGE(is_huge_zero_page(head), head);
>         VM_BUG_ON_PAGE(!PageLocked(head), head);        <=3D=3D
> >
>