Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 18 Apr 2023 14:46:15 -0400
From:   Peter Xu <peterx@redhat.com>
To:     Suren Baghdasaryan <surenb@google.com>
Cc:     Matthew Wilcox <willy@infradead.org>, akpm@linux-foundation.org,
        hannes@cmpxchg.org, mhocko@suse.com, josef@toxicpanda.com,
        jack@suse.cz, ldufour@linux.ibm.com, laurent.dufour@fr.ibm.com,
        michel@lespinasse.org, liam.howlett@oracle.com, jglisse@google.com,
        vbabka@suse.cz, minchan@google.com, dave@stgolabs.net,
        punit.agrawal@bytedance.com, lstoakes@gmail.com,
        linux-mm@kvack.org, linux-kernel@vger.kernel.org,
        kernel-team@android.com
Subject: Re: [PATCH v2 1/1] mm: do not increment pgfault stats when page
 fault handler retries
Message-ID: <ZD7ld4Iffdmv5Q8f@x1n>
References: <20230415000818.1955007-1-surenb@google.com>
 <ZD25bBPbZYSb7grA@x1n>
 <CAJuCfpHf06cr2d277DXQUtBto_0bVgK3ykMHLYRgZXgnot=e4w@mail.gmail.com>
 <ZD61DLJNilUeDCnC@x1n>
 <ZD64C3R6BzqpSfYX@casper.infradead.org>
 <ZD672ewd4j/1v2IQ@x1n>
 <CAJuCfpGuF_kKXMSx2bHNC7FprOfqbCp+cfdsoct9sN=1+wqtAQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <CAJuCfpGuF_kKXMSx2bHNC7FprOfqbCp+cfdsoct9sN=1+wqtAQ@mail.gmail.com>
Precedence: bulk

On Tue, Apr 18, 2023 at 09:45:52AM -0700, Suren Baghdasaryan wrote:
> On Tue, Apr 18, 2023 at 8:48 AM Peter Xu <peterx@redhat.com> wrote:
> >
> > On Tue, Apr 18, 2023 at 04:32:27PM +0100, Matthew Wilcox wrote:
> > > ... when we called clone()?  A thread by definition has a reference to
> > > its own mm.
> >
> > Ah yes.. thanks!
> 
> re: I also had a quick look on do_exit() but I also didn't see where
> do we e.g. wait for all the threads to stop before recycles a mm.
> 
> We recycle mm after all refcounts are dropped in the exit path:
>   do_exit
>     exit_mm
>       mmput(if !mm->mm_users)
>         mmdrop(if !mm->mm_count)
>           free_mm

I assume Matthew means when the task_struct is created with part of
kernel_clone().

copy_mm() has:

	if (clone_flags & CLONE_VM) {
		mmget(oldmm);
		mm = oldmm;
	} else {
		mm = dup_mm(tsk, current->mm);
		if (!mm)
			return -ENOMEM;
	}

If CLONE_VM, we'll mmget() on the existing mm. If !CLONE_VM, we'll just
create a new one with reference held.  For the latter, I think that hides
in mm_init() where it'll just set it to 1:

	atomic_set(&mm->mm_users, 1);

With mm_users>0, do_exit() will leave the mm_struct* alone since mmput()
will still be called but not the final step on mmdrop().

Thanks,

-- 
Peter Xu