From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9A9C838AC92 for ; Fri, 21 Aug 2026 18:23:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787336621; cv=none; b=MTjxyuJrEz60gF9lk/7TVFnoW1clz9AgiogMC/6PbRdSZcsTkZYBtk/W9jcqPKkEKif0ChH/Gjxv2oNK2vIH4Pr1nC6EjYfDPS8R0PN4dPvLtOxIMbSoc+Vmt/Ogbyv4YlLSeNxDy/xcZBlNHXozkFZ/NDvAId+9K7bkyHZ6/nA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787336621; c=relaxed/simple; bh=JnEhZEX9bZjuzKFtOwqhjc95eaOl62uMkh2vDpRJy6c=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=OqhJGARNUHOausCuoEWMEb0pynFbi/dbOcrW/chbupd+ezuGEsZhGWUDT56I9+RRNEV9y6e9HdsyWq8PylIkpFLPH/jlLLK5vmubiRp55LiCig2GGY4Y/VvjBe07SH2hA0r1HdNVlG0M6O99rS8G39hMwrKgzri6GukdNQH9zWw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=kEproVlo; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="kEproVlo" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 354E31F000E9; Fri, 21 Aug 2026 18:23:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787336619; bh=5b7cFHm6oxeq9qapqN+UDtp45+mElz3GDxCrkZRNQXQ=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=kEproVlofcbeK10ETFJo/e2EXWUuvC1gLuBkqBhw6Vrq39uN0tEkd0A3ZlPixzmRc PqWR7iYi3ltMuIWXeQeRfClL32kNr8JJ34A3wdUbyiB7OPfnH77MXXr6r/JlZORJti q6ApQO408oqqyl3z3tjYh39XLpq90vCGBRKM14sZeNYZUE2F0bPnqp3FVC7WnPhKPp YQShYuMgNUQqZmGsNryzAw4ocm1mKL5DCae8+P+ch03aIgtfL+G0lLeoCD8zz9bwbJ VeXfzxqy/OeLZ3vFBgbjckwgrOdxca8tPX8t0FDlYou+q6eKHkf469oaiNjvSVzQ8D g9HTpPZr3Xzrw== Date: Fri, 21 Aug 2026 19:23:34 +0100 From: "Lorenzo Stoakes (ARM)" To: Gregory Price Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-team@meta.com, akpm@linux-foundation.org, liam@infradead.org, david@kernel.org, vbabka@kernel.org, jannh@google.com, sashiko-bot Subject: Re: [PATCH] mm/madvise: use folio_trylock() in the cold/pageout PMD split Message-ID: References: <20260821150912.183976-1-gourry@gourry.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260821150912.183976-1-gourry@gourry.net> On Fri, Aug 21, 2026 at 11:09:12AM -0400, Gregory Price wrote: > MADV_COLD or MADV_PAGEOUT over part of a PMD splits the THP in > madvise_cold_or_pageout_pte_range(). Two threads doing that to > the same THP create spurious failures. > > CPU0 CPU1 > ---- ---- > folio_get() > spin_unlock(ptl) > folio_lock() > folio_get() > spin_unlock(ptl) > folio_lock() <- blocks, keeps its ref > split_folio() > folio_expected_ref_count(folio) != folio_ref_count(folio) - 1 > -EAGAIN Hmm, but doesn't converting to a folio_trylock() introduce entirely new spurious failures due to folio lock contention? > > CPU1 cannot drop its reference until it gets the lock CPU0 holds, so CPU0's > split always fails. folio_trylock() makes CPU1 leave without ever taking a > reference. The PTE branch of this same function already does this, as do > madvise_free_pte_range() and madvise_free_huge_pmd(). > > Reproducer: 400 rounds of eight threads calling MADV_COLD on half of each > of eight THPs, re-formed with MADV_COLLAPSE between rounds. From > /proc/vmstat: > > thp_split_page thp_split_page_failed > before 3186 860 > after 3200 0 I am _so_ glad to see an actual reproducer used in a sashiko bug fix. THANKS. :) > > The short before count is rounds where every thread failed and the > advice was dropped for that THP entirely. > > On failure the walker returns 0 and nothing retries. The PMD path becomes > best effort when the folio lock is held elsewhere - same as the PTE path. > > Reported-by: sashiko-bot > Closes: https://sashiko.dev/#/patchset/20260817220810.1175596-1-gourry%40gourry.net > Assisted-by: Claude:claude-opus-5 > Signed-off-by: Gregory Price (Meta) > --- > mm/madvise.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/mm/madvise.c b/mm/madvise.c > index 07a21ca31bad..bd9119880ef2 100644 > --- a/mm/madvise.c > +++ b/mm/madvise.c > @@ -405,9 +405,10 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd, > if (next - addr != HPAGE_PMD_SIZE) { > int err; > > + if (!folio_trylock(folio)) > + goto huge_unlock; Doesn't this violate lock ordering? >From rmap.c: folio_lock ... mm->page_table_lock or pte_lock So now you hold the ptl lock _before_ you obtain the folio lock? I'm not sure if it being a trylock gets us out of that particular situation? And I'd be reticent for us to violate it... unless I'm missing something :) > folio_get(folio); > spin_unlock(ptl); > - folio_lock(folio); > err = split_folio(folio); > folio_unlock(folio); > folio_put(folio); > -- > 2.55.0 > -- Cheers, Lorenzo