From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-179.mta0.migadu.com (out-179.mta0.migadu.com [91.218.175.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F5AF26ED5D for ; Mon, 9 Mar 2026 19:11:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773083489; cv=none; b=rTxlCTUC7h3kh8dex9UaU1KtJorYo7ttLJf5cRMiWX52exBeuzEJIANY2UK98kZdki+4/02AlnXnvuDN6/EMbaOuQNRjNPWtRMxnb3ollg90qJG40fjSl66ivo9pkvWiq1FciXZcQvQmDAwWUJAZ1Sd0HMnWsv0sMRZrciXGf+8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773083489; c=relaxed/simple; bh=HB6TkRasFhyhadWuZRiq/wbtKrYi4Voypw2syL55GXw=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=YClEoyr64aEyRfOj/X3crj0Psizv0D/NkKI/UHjbqt4Ywoz56CspcFHrEi0KfNlaJLUgF3DviKO2OPiMP2vXKMHYPCTNFPVIZRrQh1ljQP3Yn2kHm8BqxDiuwEsukjI1GEUFhDSjde8LOdxxZCeC/jAo2nUXVACsS0gETlRHKeQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=vFiXUTgr; arc=none smtp.client-ip=91.218.175.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="vFiXUTgr" Message-ID: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1773083485; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=t4mG+t+RXYYFo6HmjRVakUrKTlFJ7ROOygeekLGG8TY=; b=vFiXUTgrZJ1cpUYR+sGtEhO2tybjtnLZl7GWxczInonCmn9eljEUISVRbk75dWa1ua3QaN bMKjff7b8mf4Y5usYdQZy+en1dwCQsWWwi1+wTA2faaV/vB8ZDD4q/OAfIoHYtvL+XwZgJ 7XEQQuneWtuvrQ6yFX370zPDrHyTRN0= Date: Mon, 9 Mar 2026 22:11:20 +0300 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [PATCH] mm/migrate_device: document folio_get requirement before frozen PMD split Content-Language: en-GB To: "David Hildenbrand (Arm)" , Andrew Morton , npache@redhat.com, ziy@nvidia.com, linux-mm@kvack.org, mpenttil@redhat.com, balbirs@nvidia.com Cc: matthew.brost@intel.com, joshua.hahnjy@gmail.com, hannes@cmpxchg.org, rakie.kim@sk.com, byungchul@sk.com, gourry@gourry.net, ying.huang@linux.alibaba.com, apopple@nvidia.com, riel@surriel.com, shakeel.butt@linux.dev, kas@kernel.org, linux-kernel@vger.kernel.org, kernel-team@meta.com References: <20260306104409.3915811-1-usama.arif@linux.dev> X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Usama Arif In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Migadu-Flow: FLOW_OUT On 09/03/2026 18:18, David Hildenbrand (Arm) wrote: > On 3/6/26 11:44, Usama Arif wrote: >> split_huge_pmd_address() with freeze=true splits a PMD migration entry >> into PTE migration entries, consuming one folio reference in the >> process. The folio_get() before it provides this reference. >> >> Add a comment explaining this relationship and a VM_WARN_ON_ONCE to >> catch an unexpected refcount != 1 entry state. >> >> Suggested-by: Zi Yan >> Signed-off-by: Usama Arif >> --- >> mm/migrate_device.c | 5 +++++ >> 1 file changed, 5 insertions(+) >> >> diff --git a/mm/migrate_device.c b/mm/migrate_device.c >> index 78c7acf024615..6fa2878848a7e 100644 >> --- a/mm/migrate_device.c >> +++ b/mm/migrate_device.c >> @@ -908,6 +908,11 @@ static int migrate_vma_split_unmapped_folio(struct migrate_vma *migrate, >> unsigned long flags; >> int ret = 0; >> >> + VM_WARN_ON_ONCE(folio_ref_count(folio) != 1); > > Can't we have speculative references here? In general, asserting that > the refcount has an exact value (besides 0) is often shaky. I hope not at this point in code. At this point, the folio is locked and unmapped (both done in migrate_vma_collect_huge_pmd()), and the present PMD was set to migration entry. It is isolated from LRU in migrate_device_unmap(). So the folio should not be visible to GUP or reclaim/compaction. Only anon, non-swapcache folios should reach here. So it won't run into any folio_try_get in page cache or swap cache. The folio_get() done in migrate_vma_split_unmapped_folio() is consumed by split_huge_pmd_address(), and folio_split_unmapped() expects a folio_reference of 1 after this [1]. If its not considered good to assert a non zero refcount value, I can change the warning to a comment, but I think refcount should be 1 at this point, otherwise folio_split_unmapped will fail. [1] https://elixir.bootlin.com/linux/v6.19.6/source/mm/huge_memory.c#L4137 > >> + /* >> + * take a reference, since split_huge_pmd_address() with freeze = true >> + * drops a reference at the end. >> + */ >> folio_get(folio); >> split_huge_pmd_address(migrate->vma, addr, true); >> ret = folio_split_unmapped(folio, 0); > >