From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-172.mta1.migadu.com (out-172.mta1.migadu.com [95.215.58.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 13E6E258CD9 for ; Sun, 21 Jun 2026 21:34:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782077699; cv=none; b=DgUj13/PoV1GhqWVfg+dJFZPe29wm51vpqQpp66oiE89J/KaSqth9gmZAehO22ECeR4RTdYC0Hm+j+Rr3Qn+LrsAdpcAEk+vYWhFhPe3V6Dn9U5HYrKzt+Qo9L6Zt+l2xigO0/fUDUdjVUCjaCchWlTFYw4v8OGRPZf7783STxY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782077699; c=relaxed/simple; bh=KqQHouXgkNXe/7+DT0GiZCioxakG1AGoGeZisKax3pA=; h=MIME-Version:Date:Content-Type:From:Message-ID:Subject:To:Cc: In-Reply-To:References; b=N6+K8bk3TNqAuown3Xo0zvQbbr6fHNl0mEmlvS+Vf8g6bZhIu0OQr8dCY5eL+fU6I/Boj4m/FRnEvKO/8qDvUT19FcD+TUpHyyYMt3NLFoO7y5YX0RswZtUncycRfS1tbD+tB89Ix36YCHQ0xOYPoZpQ7nByvYNSFX8lZC1qco4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=GXExkcGT; arc=none smtp.client-ip=95.215.58.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="GXExkcGT" Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1782077695; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=T+qigLIPdHrFoWDjUFktrl/sfbc2RolswMUSPfU7LxY=; b=GXExkcGTuOJcnv+ozYRBOM9AYGbahUnecr33XshVJiwNWeE+mKdii1lLEXYc63O5f/Nl+u 6WhSBwwt+MAk7FyWettP6l3VqNJXZx3dTy61egjU4aTyiqIfABw7B+mG2wY+XCJjCl4u8y F0zyDJnEFdsKKAAl7q7JDLIjVYXBork= Date: Sun, 21 Jun 2026 21:34:47 +0000 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: "Gladyshev Ilya" Message-ID: <839a2ea2755fdddf5af773e006237b07c9e261df@linux.dev> TLS-Required: No Subject: Re: [PATCH v4 0/2] mm: improve folio refcount scalability To: "Linus Torvalds" Cc: "Andrew Morton" , ivgorbunov@me.com, Liam.Howlett@oracle.com, apopple@nvidia.com, artem.kuzin@huawei.com, baolin.wang@linux.alibaba.com, david@kernel.org, foxido@foxido.dev, harry.yoo@oracle.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, lorenzo.stoakes@oracle.com, mhocko@suse.com, muchun.song@linux.dev, rppt@kernel.org, surenb@google.com, vbabka@suse.cz, willy@infradead.org, yuzhao@google.com, ziy@nvidia.com, pfalcato@suse.de, kirill@shutemov.name In-Reply-To: References: <20260608154734.8e4115fde4e2e14a3b6892fb@linux-foundation.org> X-Migadu-Flow: FLOW_OUT June 21, 2026 at 7:46 AM, Linus Torvalds wrote: >=20 >=20On Sat, 20 Jun 2026 at 11:19, wrote: >=20 >=20>=20 >=20> T2: optimistic get() [0 -> 1] > > T2: put page back [1 -> 0] > > T2: calls dtor for type X, returns into the allocator > >=20 >=20Which optimistic getter does this? If I understood you correctly, you are talking about the scenario where an optimistic getter took a refcount on the stolen page, so the validity check in the XArray will fail. And this scenario does indeed work normall= y. This "ABA" happens if the optimistic getter successfully gets a refcount on a valid page, so the full T2 execution looks like this: T2: optimistic get() [0 -> 1] T2: re-checks page [OK] T2: *normally works with this page* T2: frees page [1 -> 0 -> FROZEN] T2: calls dtor for type X, returns into the allocator ... T3 reuses the page, T1 wakes up and conflicts ... T1 basically needs to sleep for a veeery long time to miss full T2 & T3 execution.=20 >=20I didn't go back and look at the series, but isn't the rule that the = code does: >=20 >=20 - optimistic get >=20 >=20 - then check that the folio is still valid (*not* using the page > count, but by re-looking it up elsewhere, typically the address space > mapping) >=20 >=20 - put the page if it wasn't valid >=20 >=20 - if it goes to zero, there's no destructor inherent in that >=20 >=20 - everybody who sees it go to zero - optimistic or not - does the > "zero to frozen" cmpxchg The problem is -- the zero you've seen and zero you are trying to CAS can be different zeros if the page gets reused fast enough. (Or couldn't and I am just confused :) ) > - only *one* of those will succeed, and *THAT* triggers the destructor > > > IOW, the transition to zero is not special per se and has no > destructor. All it triggers is the "now we try to mark it frozen" > phase. >=20 >=20At least that was my mental picture. >=20 >=20Was I wrong? Am I just confused? Wouldn't be the first time. >=20 >=20 Linus >