Re: [PATCHv2 5/8] khugepaged: Allow to callapse a page shared across fork

[Yang Shi]

On 4/8/20 11:51 AM, Yang Shi wrote:
> On 4/8/20 6:10 AM, Kirill A. Shutemov wrote:
> > On Mon, Apr 06, 2020 at 01:50:56PM -0700, Yang Shi wrote:
> > > On 4/3/20 4:29 AM, Kirill A. Shutemov wrote:
> > > > The page can be included into collapse as long as it doesn't have 
> > > > extra
> > > > pins (from GUP or otherwise).
> > > >
> > > > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx>
> > > > ---
> > > > ÂÂ mm/khugepaged.c | 25 ++++++++++++++-----------
> > > > ÂÂ 1 file changed, 14 insertions(+), 11 deletions(-)
> > > >
> > > > diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> > > > index 57ff287caf6b..1e7e6543ebca 100644
> > > > --- a/mm/khugepaged.c
> > > > +++ b/mm/khugepaged.c
> > > > @@ -581,11 +581,18 @@ static int 
> > > > __collapse_huge_page_isolate(struct vm_area_struct *vma,
> > > > ÂÂÂÂÂÂÂÂÂÂ }
> > > > ÂÂÂÂÂÂÂÂÂÂ /*
> > > > -ÂÂÂÂÂÂÂÂ * cannot use mapcount: can't collapse if there's a gup pin.
> > > > -ÂÂÂÂÂÂÂÂ * The page must only be referenced by the scanned process
> > > > -ÂÂÂÂÂÂÂÂ * and page swap cache.
> > > > +ÂÂÂÂÂÂÂÂ * Check if the page has any GUP (or other external) pins.
> > > > +ÂÂÂÂÂÂÂÂ *
> > > > +ÂÂÂÂÂÂÂÂ * The page table that maps the page has been already 
> > > > unlinked
> > > > +ÂÂÂÂÂÂÂÂ * from the page table tree and this process cannot get
> > > > +ÂÂÂÂÂÂÂÂ * additinal pin on the page.
> > > > +ÂÂÂÂÂÂÂÂ *
> > > > +ÂÂÂÂÂÂÂÂ * New pins can come later if the page is shared across fork,
> > > > +ÂÂÂÂÂÂÂÂ * but not for the this process. It is fine. The other 
> > > > process
> > > > +ÂÂÂÂÂÂÂÂ * cannot write to the page, only trigger CoW.
> > > > ÂÂÂÂÂÂÂÂÂÂÂ */
> > > > -ÂÂÂÂÂÂÂ if (page_count(page) != 1 + PageSwapCache(page)) {
> > > > +ÂÂÂÂÂÂÂ if (total_mapcount(page) + PageSwapCache(page) !=
> > > > +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ page_count(page)) {
> > > This check looks fine for base page, but what if the page is 
> > > PTE-mapped THP?
> > > The following patch made this possible.
> > >
> > > If it is PTE-mapped THP and the page is in swap cache, the refcount 
> > > would be
> > > 512 + the number of PTE-mapped pages.
> > >
> > > Shall we do the below change in the following patch?
> > >
> > > extra_pins = PageSwapCache(page) ? nr_ccompound(page) - 1 : 0;
> > > if (total_mapcount(page) + PageSwapCache(page) != page_count(page) -
> > > extra_pins) {
> > > ...
> > Looks like you're right.
> >
> > It would be nice to have a test case to demonstrate the issue.
> >
> > Is there any way to trigger moving the page to swap cache? I don't 
> > see it
> > immediately.
>
> It sounds not easy to trigger since it totally depends on timing, I'm 
> wondering we may have to use MADV_PAGEOUT? Something below off the top 
> of my head may trigger this?
>
>
> ÂÂÂ CPUÂÂÂ ÂÂ AÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ Â ÂÂÂ Â ÂÂÂ ÂÂÂ CPUÂÂÂ B ÂÂÂ ÂÂÂ 
> ÂÂÂ ÂÂÂ ÂÂÂ CPUÂÂÂ C
> In parent:
> MADV_HUGEPAGE
> page fault to fill with THP
> fork
> ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ In Child:
> MADV_NOHUGEPAGE
> MADV_DONTNEED (split pmd)
> MADV_PAGEOUT
> ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ -> 
> add_to_swap
> ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ khugepaged scan parent and try to 
> collapse PTE-mapped
>
> ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ ÂÂÂ -> 
> try_to_unmap
>
> When doing MADV_DONTNEED we need make sure head page is unmapped since 
> MADV_PAGEOUT would call page_mapcount(page) to skip shared mapping.

This can't trigger it since MADV_PAGEOUT would isolate the page from lru 
so khugepaged_scan_pmd() can't reach the refcount check at all.

If try_to_unmap() or pageout() fails, the page may stay in swap cache. 
But I didn't think of an easy way to make this happen.

> >