linux-kernel - Re: [PATCH v2 2/4] mm/huge_memory: replace can_split

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <57E21FA7-7233-44CF-B67B-F24CDBA655C7@nvidia.com>
Date: Tue, 25 Nov 2025 10:55:38 -0500
From: Zi Yan <ziy@...dia.com>
To: "David Hildenbrand (Red Hat)" <david@...nel.org>
Cc: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>,
 Andrew Morton <akpm@...ux-foundation.org>,
 Baolin Wang <baolin.wang@...ux.alibaba.com>,
 "Liam R. Howlett" <Liam.Howlett@...cle.com>, Nico Pache <npache@...hat.com>,
 Ryan Roberts <ryan.roberts@....com>, Dev Jain <dev.jain@....com>,
 Barry Song <baohua@...nel.org>, Lance Yang <lance.yang@...ux.dev>,
 Miaohe Lin <linmiaohe@...wei.com>, Naoya Horiguchi <nao.horiguchi@...il.com>,
 Wei Yang <richard.weiyang@...il.com>, Balbir Singh <balbirs@...dia.com>,
 linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 2/4] mm/huge_memory: replace can_split_folio() with
 direct refcount calculation

On 25 Nov 2025, at 3:52, David Hildenbrand (Red Hat) wrote:

>>>
>>>>
>>>> Like:
>>>>
>>>>           if (folio_test_anon(folio)) {
>>>>                   /* One reference per page from the swapcache. */
>>>>                   ref_count += folio_test_swapcache(folio) << order;
>>>>           } else {
>>>> 				/* One reference per page from shmem in the swapcache. */
>>>>                   ref_count += folio_test_swapcache(folio) << order;
>>>>                   /* One reference per page from the pagecache. */
>>>>                   ref_count += !!folio->mapping << order;
>>>>                   /* One reference from PG_private. */
>>>>                   ref_count += folio_test_private(folio);
>>>>           }
>>>>
>>>> or simplified into
>>>>
>>>>      		if (!folio_test_anon(folio)) {
>>>>                   /* One reference per page from the pagecache. */
>>>>                   ref_count += !!folio->mapping << order;
>>>>                   /* One reference from PG_private. */
>>>>                   ref_count += folio_test_private(folio);
>>>>           }
>>>> 		/* One reference per page from the swapcache (anon or shmem). */
>>>>           ref_count += folio_test_swapcache(folio) << order;
>>>> ?
>>>
>>> That is incorrect I think due to swapcache being able to give false positives (PG_owner_priv_1).
>>
>> Got it. So it should be:
>>
>>            if (folio_test_anon(folio)) {
>>                    /* One reference per page from the swapcache. */
>>                    ref_count += folio_test_swapcache(folio) << order;
>>            } else {
>>   				/* One reference per page from shmem in the swapcache. */
>>                    ref_count += (folio_test_swapbacked (folio) &&
>> 								folio_test_swapcache(folio)) << order;
>>                    /* One reference per page from the pagecache. */
>>                    ref_count += !!folio->mapping << order;
>>                    /* One reference from PG_private. */
>>                    ref_count += folio_test_private(folio);
>>            }
>
> Interestingly, I think we would then also take proper care of anon folios in the
> swapcache that are not anon yet. See __read_swap_cache_async().

Right. After add_to_swap_cache() in __read_swap_cache_async(), the folio
there is in the same state as shmem in swapcache.

>
> I wonder if we can clean that up a bit, to highlight that PG_private etc
> do not apply.
>
> if (folio_test_anon(folio)) {
> 	/* One reference per page from the swapcache. */
> 	ref_count += folio_test_swapcache(folio) << order;
> } else if (folio_test_swapbacked (folio) && folio_test_swapcache(folio)) {
> 	/* to-be-anon or shmem folio in the swapcache (!folio->mapping) */
> 	ref_count += 1ul << order;
> 	VM_WAN_ON_ONCE(folio->mapping);
> } else {
> 	/* One reference per page from the pagecache. */
> 	ref_count += !!folio->mapping << order;
> 	/* One reference from PG_private. */
> 	ref_count += folio_test_private(folio);
> }

I like this better, will send a patch for folio_expected_ref_count()
separately. Since folio_test_swapcache(folio) implies
folio_test_swapbacked (folio) as Maolin pointed out in another
email, I will get rid of folio_test_swapbacked(folio) in the above code.

>
> Or maybe simply:
>
>
> if (folio_test_swapbacked (folio) && folio_test_swapcache(folio)) {
> 	/*
> 	 * (to-be) anon or shmem (!folio->mapping) folio in the swapcache:
> 	 * One reference per page from the swapcache.
> 	 */
> 	ref_count += 1 << order;
> 	VM_WAN_ON_ONCE(!folio_test_anon(folio) && folio->mapping);
> } else if (!folio_test_anon(folio)) {
> 	/* One reference per page from the pagecache. */
> 	ref_count += !!folio->mapping << order;
> 	/* One reference from PG_private. */
> 	ref_count += folio_test_private(folio);
> }
>
>>
>> I wonder if we should have folio_test_shmem_in_swapcache() instead.
>
> Interestingly, thinking about it, I think it would also match to-be anon folios
> and anon folios.
>
> folio_in_swapcache() maybe ?

Yes, will come up with a patch for it and send along with
folio_expected_ref_count() patch.

>
>>
>> BTW, this page flag reuse is really confusing.
>
> Yes ...
>
>> I see PG_checked is
>> PG_owner_priv_1 too and __folio_migrate_mapping() uses folio_test_swapcache()
>> to decide the number of i_pages entries. Wouldn’t that cause any issue?
>
> Maybe at that point all false positives were ruled out?
>
> It is horrible TBH.
>
> -- 
> Cheers
>
> David


Best Regards,
Yan, Zi