Re: [PATCH v2] mm: migrate: Fix THP's mapcount on isolation

[David Hildenbrand]

On 24.11.22 13:55, Gavin Shan wrote:
> On 11/24/22 6:43 PM, David Hildenbrand wrote:
> > On 24.11.22 11:21, Gavin Shan wrote:
> > > On 11/24/22 6:09 PM, David Hildenbrand wrote:
> > > > On 24.11.22 10:55, Gavin Shan wrote:
> > > > > The issue is reported when removing memory through virtio_mem device.
> > > > > The transparent huge page, experienced copy-on-write fault, is wrongly
> > > > > regarded as pinned. The transparent huge page is escaped from being
> > > > > isolated in isolate_migratepages_block(). The transparent huge page
> > > > > can't be migrated and the corresponding memory block can't be put
> > > > > into offline state.
> > > > >
> > > > > Fix it by replacing page_mapcount() with total_mapcount(). With this,
> > > > > the transparent huge page can be isolated and migrated, and the memory
> > > > > block can be put into offline state. Besides, The page's refcount is
> > > > > increased a bit earlier to avoid the page is released when the check
> > > > > is executed.
> > > >
> > > > Did you look into handling pages that are in the swapcache case as well?
> > > >
> > > > See is_refcount_suitable() in mm/khugepaged.c.
> > > >
> > > > Should be easy to reproduce, let me know if you need inspiration.
> > >
> > > Nope, I didn't look into the case. Please elaborate the details so that
> > > I can reproduce it firstly.
> >
> >
> > A simple reproducer would be (on a system with ordinary swap (not zram))
> >
> > 1) mmap a region (MAP_ANON|MAP_PRIVATE) that can hold a THP
> >
> > 2) Enable THP for that region (MADV_HUGEPAGE)
> >
> > 3) Populate a THP (e.g., write access)
> >
> > 4) PTE-map the THP, for example, using MADV_FREE on the last subpage
> >
> > 5) Trigger swapout of the THP, for example, using MADV_PAGEOUT
> >
> > 6) Read-access to some subpages to fault them in from the swapcache
> >
> >
> > Now you'd have a THP, which
> >
> > 1) Is partially PTE-mapped into the page table
> > 2) Is in the swapcache (each subpage should have one reference from the swapache)
> >
> >
> > Now we could test, if alloc_contig_range() will still succeed (e.g., using virtio-mem).
>
> Thanks for the details. Step (4) and (5) can be actually combined. To swap part of
> the THP (e.g. one sub-page) will force the THP to be split.
>
> I followed your steps in the attached program, there is no issue to do memory hot-remove
> through virtio-mem with or without this patch.

Interesting. But I don't really see how we could pass this check with a 
page that's in the swapcache, maybe I'm missing something else.

I'll try to see if I can reproduce it.

--
Thanks,

David / dhildenb