[PATCH 0/4] mm/ksm: fix some accounting problems

[PATCH 0/4] mm/ksm: fix some accounting problems

[Chengming Zhou]

We encounter some abnormal ksm_pages_scanned and ksm_zero_pages during
some random tests.

1. ksm_pages_scanned unchanged even ksmd scanning has progress.
2. ksm_zero_pages maybe -1 in some rare cases.

The first two patches fix these problems and the last two patches are
minor optimizations about ksm_stable_node and general_profit calculation.

Thanks for review and comments!

Signed-off-by: Chengming Zhou <chengming.zhou@linux.dev>
---
Chengming Zhou (4):
      mm/ksm: fix ksm_pages_scanned accounting
      mm/ksm: fix ksm_zero_pages accounting
      mm/ksm: union hlist_node with list_head in struct ksm_stable_node
      mm/ksm: calculate general_profit more accurately

 fs/proc/base.c           |  2 +-
 include/linux/ksm.h      | 22 +++++++++++++++++++---
 include/linux/mm_types.h |  2 +-
 mm/ksm.c                 | 33 ++++++++++++++++++++-------------
 4 files changed, 41 insertions(+), 18 deletions(-)
---
base-commit: fb0f40125feec3de7ef4524600ac83946207117e
change-id: 20240508-b4-ksm-counters-04817b40d3ee

Best regards,
-- 
Chengming Zhou <chengming.zhou@linux.dev>

[PATCH 1/4] mm/ksm: fix ksm_pages_scanned accounting

[Chengming Zhou]

During testing, I found ksm_pages_scanned is unchanged although the
scan_get_next_rmap_item() did return valid rmap_item that is not NULL.

The reason is the scan_get_next_rmap_item() will return NULL after
a full scan, so ksm_do_scan() just return without accounting of the
ksm_pages_scanned.

Fix it by just putting ksm_pages_scanned accounting in that loop,
and it will be accounted more timely if that loop would last for
a long time.

Signed-off-by: Chengming Zhou <chengming.zhou@linux.dev>
---
 mm/ksm.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/mm/ksm.c b/mm/ksm.c
index e1034bf1c937..0f9c491552ff 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -2753,18 +2753,16 @@ static void ksm_do_scan(unsigned int scan_npages)
 {
 	struct ksm_rmap_item *rmap_item;
 	struct page *page;
-	unsigned int npages = scan_npages;
 
-	while (npages-- && likely(!freezing(current))) {
+	while (scan_npages-- && likely(!freezing(current))) {
 		cond_resched();
 		rmap_item = scan_get_next_rmap_item(&page);
 		if (!rmap_item)
 			return;
 		cmp_and_merge_page(page, rmap_item);
 		put_page(page);
+		ksm_pages_scanned++;
 	}
-
-	ksm_pages_scanned += scan_npages - npages;
 }
 
 static int ksmd_should_run(void)

-- 
2.45.0

[PATCH 2/4] mm/ksm: fix ksm_zero_pages accounting

[Chengming Zhou]

We normally ksm_zero_pages++ in ksmd when page is merged with zero page,
but ksm_zero_pages-- is done from page tables side, which can't protected
by the ksmd mutex.

So we can read very exceptional value of ksm_zero_pages in rare cases,
such as -1, which is very confusing to users.

Fix it by changing to use atomic_long_t, and the same case with the
mm->ksm_zero_pages.

Signed-off-by: Chengming Zhou <chengming.zhou@linux.dev>
---
 fs/proc/base.c           |  2 +-
 include/linux/ksm.h      | 22 +++++++++++++++++++---
 include/linux/mm_types.h |  2 +-
 mm/ksm.c                 | 11 +++++------
 4 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 18550c071d71..72a1acd03675 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -3214,7 +3214,7 @@ static int proc_pid_ksm_stat(struct seq_file *m, struct pid_namespace *ns,
 	mm = get_task_mm(task);
 	if (mm) {
 		seq_printf(m, "ksm_rmap_items %lu\n", mm->ksm_rmap_items);
-		seq_printf(m, "ksm_zero_pages %lu\n", mm->ksm_zero_pages);
+		seq_printf(m, "ksm_zero_pages %ld\n", mm_ksm_zero_pages(mm));
 		seq_printf(m, "ksm_merging_pages %lu\n", mm->ksm_merging_pages);
 		seq_printf(m, "ksm_process_profit %ld\n", ksm_process_profit(mm));
 		mmput(mm);
diff --git a/include/linux/ksm.h b/include/linux/ksm.h
index 52c63a9c5a9c..bfc2cf756b0d 100644
--- a/include/linux/ksm.h
+++ b/include/linux/ksm.h
@@ -33,16 +33,32 @@ void __ksm_exit(struct mm_struct *mm);
  */
 #define is_ksm_zero_pte(pte)	(is_zero_pfn(pte_pfn(pte)) && pte_dirty(pte))
 
-extern unsigned long ksm_zero_pages;
+extern atomic_long_t ksm_zero_pages;
+
+static inline void ksm_map_zero_page(struct mm_struct *mm)
+{
+	atomic_long_inc(&ksm_zero_pages);
+	atomic_long_inc(&mm->ksm_zero_pages);
+}
 
 static inline void ksm_might_unmap_zero_page(struct mm_struct *mm, pte_t pte)
 {
 	if (is_ksm_zero_pte(pte)) {
-		ksm_zero_pages--;
-		mm->ksm_zero_pages--;
+		atomic_long_dec(&ksm_zero_pages);
+		atomic_long_dec(&mm->ksm_zero_pages);
 	}
 }
 
+static inline long get_ksm_zero_pages(void)
+{
+	return atomic_long_read(&ksm_zero_pages);
+}
+
+static inline long mm_ksm_zero_pages(struct mm_struct *mm)
+{
+	return atomic_long_read(&mm->ksm_zero_pages);
+}
+
 static inline int ksm_fork(struct mm_struct *mm, struct mm_struct *oldmm)
 {
 	if (test_bit(MMF_VM_MERGEABLE, &oldmm->flags))
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 24323c7d0bd4..af3a0256fa93 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -985,7 +985,7 @@ struct mm_struct {
 		 * Represent how many empty pages are merged with kernel zero
 		 * pages when enabling KSM use_zero_pages.
 		 */
-		unsigned long ksm_zero_pages;
+		atomic_long_t ksm_zero_pages;
 #endif /* CONFIG_KSM */
 #ifdef CONFIG_LRU_GEN_WALKS_MMU
 		struct {
diff --git a/mm/ksm.c b/mm/ksm.c
index 0f9c491552ff..6e0dca3cecf3 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -296,7 +296,7 @@ static bool ksm_use_zero_pages __read_mostly;
 static bool ksm_smart_scan = true;
 
 /* The number of zero pages which is placed by KSM */
-unsigned long ksm_zero_pages;
+atomic_long_t ksm_zero_pages = ATOMIC_LONG_INIT(0);
 
 /* The number of pages that have been skipped due to "smart scanning" */
 static unsigned long ksm_pages_skipped;
@@ -1429,8 +1429,7 @@ static int replace_page(struct vm_area_struct *vma, struct page *page,
 		 * the dirty bit in zero page's PTE is set.
 		 */
 		newpte = pte_mkdirty(pte_mkspecial(pfn_pte(page_to_pfn(kpage), vma->vm_page_prot)));
-		ksm_zero_pages++;
-		mm->ksm_zero_pages++;
+		ksm_map_zero_page(mm);
 		/*
 		 * We're replacing an anonymous page with a zero page, which is
 		 * not anonymous. We need to do proper accounting otherwise we
@@ -3373,7 +3372,7 @@ static void wait_while_offlining(void)
 #ifdef CONFIG_PROC_FS
 long ksm_process_profit(struct mm_struct *mm)
 {
-	return (long)(mm->ksm_merging_pages + mm->ksm_zero_pages) * PAGE_SIZE -
+	return (long)(mm->ksm_merging_pages + mm_ksm_zero_pages(mm)) * PAGE_SIZE -
 		mm->ksm_rmap_items * sizeof(struct ksm_rmap_item);
 }
 #endif /* CONFIG_PROC_FS */
@@ -3662,7 +3661,7 @@ KSM_ATTR_RO(pages_skipped);
 static ssize_t ksm_zero_pages_show(struct kobject *kobj,
 				struct kobj_attribute *attr, char *buf)
 {
-	return sysfs_emit(buf, "%ld\n", ksm_zero_pages);
+	return sysfs_emit(buf, "%ld\n", get_ksm_zero_pages());
 }
 KSM_ATTR_RO(ksm_zero_pages);
 
@@ -3671,7 +3670,7 @@ static ssize_t general_profit_show(struct kobject *kobj,
 {
 	long general_profit;
 
-	general_profit = (ksm_pages_sharing + ksm_zero_pages) * PAGE_SIZE -
+	general_profit = (ksm_pages_sharing + get_ksm_zero_pages()) * PAGE_SIZE -
 				ksm_rmap_items * sizeof(struct ksm_rmap_item);
 
 	return sysfs_emit(buf, "%ld\n", general_profit);

-- 
2.45.0

[PATCH 3/4] mm/ksm: union hlist_node with list_head in struct ksm_stable_node

[Chengming Zhou]

The ksm_stable_node->hlist_node is used for linking on chain node hlist,
and ksm_stable_node->list_head is used for linking on migration list.

We always stable_node_dup_del() first before adding it on migration list
or list_del() first from migration list before adding it on stable tree.

So we can union hlist_node with list_head to save some memory.

Signed-off-by: Chengming Zhou <chengming.zhou@linux.dev>
---
 mm/ksm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/ksm.c b/mm/ksm.c
index 6e0dca3cecf3..87ffd228944c 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -162,7 +162,7 @@ struct ksm_stable_node {
 		struct rb_node node;	/* when node of stable tree */
 		struct {		/* when listed for migration */
 			struct list_head *head;
-			struct {
+			union {
 				struct hlist_node hlist_dup;
 				struct list_head list;
 			};

-- 
2.45.0

[PATCH 4/4] mm/ksm: calculate general_profit more accurately

[Chengming Zhou]

The memory resource of KSM is mainly ksm_rmap_item, which has to allocate
for each anon page that mm has mapped on. Another memory resource is the
ksm_stable_node, which is much less than the ksm_rmap_item.

We can account it easily to make general_profit calculation more accurate.
This is important when max_page_sharing is limited and so we have more
chained nodes.

Signed-off-by: Chengming Zhou <chengming.zhou@linux.dev>
---
 mm/ksm.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/mm/ksm.c b/mm/ksm.c
index 87ffd228944c..a9ce17e6814d 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -267,6 +267,9 @@ static unsigned long ksm_pages_unshared;
 /* The number of rmap_items in use: to calculate pages_volatile */
 static unsigned long ksm_rmap_items;
 
+/* The number of stable_node */
+static unsigned long ksm_stable_nodes;
+
 /* The number of stable_node chains */
 static unsigned long ksm_stable_node_chains;
 
@@ -584,12 +587,17 @@ static inline void free_rmap_item(struct ksm_rmap_item *rmap_item)
 
 static inline struct ksm_stable_node *alloc_stable_node(void)
 {
+	struct ksm_stable_node *node;
+
 	/*
 	 * The allocation can take too long with GFP_KERNEL when memory is under
 	 * pressure, which may lead to hung task warnings.  Adding __GFP_HIGH
 	 * grants access to memory reserves, helping to avoid this problem.
 	 */
-	return kmem_cache_alloc(stable_node_cache, GFP_KERNEL | __GFP_HIGH);
+	node = kmem_cache_alloc(stable_node_cache, GFP_KERNEL | __GFP_HIGH);
+	if (likely(node))
+		ksm_stable_nodes++;
+	return node;
 }
 
 static inline void free_stable_node(struct ksm_stable_node *stable_node)
@@ -597,6 +605,7 @@ static inline void free_stable_node(struct ksm_stable_node *stable_node)
 	VM_BUG_ON(stable_node->rmap_hlist_len &&
 		  !is_stable_node_chain(stable_node));
 	kmem_cache_free(stable_node_cache, stable_node);
+	ksm_stable_nodes--;
 }
 
 /*
@@ -3671,7 +3680,8 @@ static ssize_t general_profit_show(struct kobject *kobj,
 	long general_profit;
 
 	general_profit = (ksm_pages_sharing + get_ksm_zero_pages()) * PAGE_SIZE -
-				ksm_rmap_items * sizeof(struct ksm_rmap_item);
+				ksm_rmap_items * sizeof(struct ksm_rmap_item) -
+				ksm_stable_nodes * sizeof(struct ksm_stable_node);
 
 	return sysfs_emit(buf, "%ld\n", general_profit);
 }

-- 
2.45.0

Re: [PATCH 0/4] mm/ksm: fix some accounting problems

[David Hildenbrand]

On 08.05.24 11:55, Chengming Zhou wrote:
> We encounter some abnormal ksm_pages_scanned and ksm_zero_pages during
> some random tests.
> 
> 1. ksm_pages_scanned unchanged even ksmd scanning has progress.
> 2. ksm_zero_pages maybe -1 in some rare cases.
> 
> The first two patches fix these problems and the last two patches 

Can you find+add "Fixes:" tags for these? They look sane after having a 
quick peek.

-- 
Cheers,

David / dhildenb

Re: [PATCH 0/4] mm/ksm: fix some accounting problems

[Chengming Zhou]

On 2024/5/8 18:24, David Hildenbrand wrote:
> On 08.05.24 11:55, Chengming Zhou wrote:
>> We encounter some abnormal ksm_pages_scanned and ksm_zero_pages during
>> some random tests.
>>
>> 1. ksm_pages_scanned unchanged even ksmd scanning has progress.
>> 2. ksm_zero_pages maybe -1 in some rare cases.
>>
>> The first two patches fix these problems and the last two patches 
> 
> Can you find+add "Fixes:" tags for these? They look sane after having a quick peek.
> 

Right, will add "Fixes:" tags.

Thanks.

Re: [PATCH 1/4] mm/ksm: fix ksm_pages_scanned accounting

[Chengming Zhou]

On 2024/5/8 17:55, Chengming Zhou wrote:
> During testing, I found ksm_pages_scanned is unchanged although the
> scan_get_next_rmap_item() did return valid rmap_item that is not NULL.
> 
> The reason is the scan_get_next_rmap_item() will return NULL after
> a full scan, so ksm_do_scan() just return without accounting of the
> ksm_pages_scanned.
> 
> Fix it by just putting ksm_pages_scanned accounting in that loop,
> and it will be accounted more timely if that loop would last for
> a long time.
> 

Fixes: b348b5fe2b5f ("mm/ksm: add pages scanned metric")

> Signed-off-by: Chengming Zhou <chengming.zhou@linux.dev>
> ---
>  mm/ksm.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/mm/ksm.c b/mm/ksm.c
> index e1034bf1c937..0f9c491552ff 100644
> --- a/mm/ksm.c
> +++ b/mm/ksm.c
> @@ -2753,18 +2753,16 @@ static void ksm_do_scan(unsigned int scan_npages)
>  {
>  	struct ksm_rmap_item *rmap_item;
>  	struct page *page;
> -	unsigned int npages = scan_npages;
>  
> -	while (npages-- && likely(!freezing(current))) {
> +	while (scan_npages-- && likely(!freezing(current))) {
>  		cond_resched();
>  		rmap_item = scan_get_next_rmap_item(&page);
>  		if (!rmap_item)
>  			return;
>  		cmp_and_merge_page(page, rmap_item);
>  		put_page(page);
> +		ksm_pages_scanned++;
>  	}
> -
> -	ksm_pages_scanned += scan_npages - npages;
>  }
>  
>  static int ksmd_should_run(void)
> 

Re: [PATCH 2/4] mm/ksm: fix ksm_zero_pages accounting

[Chengming Zhou]

On 2024/5/8 17:55, Chengming Zhou wrote:
> We normally ksm_zero_pages++ in ksmd when page is merged with zero page,
> but ksm_zero_pages-- is done from page tables side, which can't protected
> by the ksmd mutex.
> 
> So we can read very exceptional value of ksm_zero_pages in rare cases,
> such as -1, which is very confusing to users.
> 
> Fix it by changing to use atomic_long_t, and the same case with the
> mm->ksm_zero_pages.
> 

Fixes: e2942062e01d ("ksm: count all zero pages placed by KSM")
Fixes: 6080d19f0704 ("ksm: add ksm zero pages for each process")

> Signed-off-by: Chengming Zhou <chengming.zhou@linux.dev>
> ---
>  fs/proc/base.c           |  2 +-
>  include/linux/ksm.h      | 22 +++++++++++++++++++---
>  include/linux/mm_types.h |  2 +-
>  mm/ksm.c                 | 11 +++++------
>  4 files changed, 26 insertions(+), 11 deletions(-)
> 
> diff --git a/fs/proc/base.c b/fs/proc/base.c
> index 18550c071d71..72a1acd03675 100644
> --- a/fs/proc/base.c
> +++ b/fs/proc/base.c
> @@ -3214,7 +3214,7 @@ static int proc_pid_ksm_stat(struct seq_file *m, struct pid_namespace *ns,
>  	mm = get_task_mm(task);
>  	if (mm) {
>  		seq_printf(m, "ksm_rmap_items %lu\n", mm->ksm_rmap_items);
> -		seq_printf(m, "ksm_zero_pages %lu\n", mm->ksm_zero_pages);
> +		seq_printf(m, "ksm_zero_pages %ld\n", mm_ksm_zero_pages(mm));
>  		seq_printf(m, "ksm_merging_pages %lu\n", mm->ksm_merging_pages);
>  		seq_printf(m, "ksm_process_profit %ld\n", ksm_process_profit(mm));
>  		mmput(mm);
> diff --git a/include/linux/ksm.h b/include/linux/ksm.h
> index 52c63a9c5a9c..bfc2cf756b0d 100644
> --- a/include/linux/ksm.h
> +++ b/include/linux/ksm.h
> @@ -33,16 +33,32 @@ void __ksm_exit(struct mm_struct *mm);
>   */
>  #define is_ksm_zero_pte(pte)	(is_zero_pfn(pte_pfn(pte)) && pte_dirty(pte))
>  
> -extern unsigned long ksm_zero_pages;
> +extern atomic_long_t ksm_zero_pages;
> +
> +static inline void ksm_map_zero_page(struct mm_struct *mm)
> +{
> +	atomic_long_inc(&ksm_zero_pages);
> +	atomic_long_inc(&mm->ksm_zero_pages);
> +}
>  
>  static inline void ksm_might_unmap_zero_page(struct mm_struct *mm, pte_t pte)
>  {
>  	if (is_ksm_zero_pte(pte)) {
> -		ksm_zero_pages--;
> -		mm->ksm_zero_pages--;
> +		atomic_long_dec(&ksm_zero_pages);
> +		atomic_long_dec(&mm->ksm_zero_pages);
>  	}
>  }
>  
> +static inline long get_ksm_zero_pages(void)
> +{
> +	return atomic_long_read(&ksm_zero_pages);
> +}
> +
> +static inline long mm_ksm_zero_pages(struct mm_struct *mm)
> +{
> +	return atomic_long_read(&mm->ksm_zero_pages);
> +}
> +
>  static inline int ksm_fork(struct mm_struct *mm, struct mm_struct *oldmm)
>  {
>  	if (test_bit(MMF_VM_MERGEABLE, &oldmm->flags))
> diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
> index 24323c7d0bd4..af3a0256fa93 100644
> --- a/include/linux/mm_types.h
> +++ b/include/linux/mm_types.h
> @@ -985,7 +985,7 @@ struct mm_struct {
>  		 * Represent how many empty pages are merged with kernel zero
>  		 * pages when enabling KSM use_zero_pages.
>  		 */
> -		unsigned long ksm_zero_pages;
> +		atomic_long_t ksm_zero_pages;
>  #endif /* CONFIG_KSM */
>  #ifdef CONFIG_LRU_GEN_WALKS_MMU
>  		struct {
> diff --git a/mm/ksm.c b/mm/ksm.c
> index 0f9c491552ff..6e0dca3cecf3 100644
> --- a/mm/ksm.c
> +++ b/mm/ksm.c
> @@ -296,7 +296,7 @@ static bool ksm_use_zero_pages __read_mostly;
>  static bool ksm_smart_scan = true;
>  
>  /* The number of zero pages which is placed by KSM */
> -unsigned long ksm_zero_pages;
> +atomic_long_t ksm_zero_pages = ATOMIC_LONG_INIT(0);
>  
>  /* The number of pages that have been skipped due to "smart scanning" */
>  static unsigned long ksm_pages_skipped;
> @@ -1429,8 +1429,7 @@ static int replace_page(struct vm_area_struct *vma, struct page *page,
>  		 * the dirty bit in zero page's PTE is set.
>  		 */
>  		newpte = pte_mkdirty(pte_mkspecial(pfn_pte(page_to_pfn(kpage), vma->vm_page_prot)));
> -		ksm_zero_pages++;
> -		mm->ksm_zero_pages++;
> +		ksm_map_zero_page(mm);
>  		/*
>  		 * We're replacing an anonymous page with a zero page, which is
>  		 * not anonymous. We need to do proper accounting otherwise we
> @@ -3373,7 +3372,7 @@ static void wait_while_offlining(void)
>  #ifdef CONFIG_PROC_FS
>  long ksm_process_profit(struct mm_struct *mm)
>  {
> -	return (long)(mm->ksm_merging_pages + mm->ksm_zero_pages) * PAGE_SIZE -
> +	return (long)(mm->ksm_merging_pages + mm_ksm_zero_pages(mm)) * PAGE_SIZE -
>  		mm->ksm_rmap_items * sizeof(struct ksm_rmap_item);
>  }
>  #endif /* CONFIG_PROC_FS */
> @@ -3662,7 +3661,7 @@ KSM_ATTR_RO(pages_skipped);
>  static ssize_t ksm_zero_pages_show(struct kobject *kobj,
>  				struct kobj_attribute *attr, char *buf)
>  {
> -	return sysfs_emit(buf, "%ld\n", ksm_zero_pages);
> +	return sysfs_emit(buf, "%ld\n", get_ksm_zero_pages());
>  }
>  KSM_ATTR_RO(ksm_zero_pages);
>  
> @@ -3671,7 +3670,7 @@ static ssize_t general_profit_show(struct kobject *kobj,
>  {
>  	long general_profit;
>  
> -	general_profit = (ksm_pages_sharing + ksm_zero_pages) * PAGE_SIZE -
> +	general_profit = (ksm_pages_sharing + get_ksm_zero_pages()) * PAGE_SIZE -
>  				ksm_rmap_items * sizeof(struct ksm_rmap_item);
>  
>  	return sysfs_emit(buf, "%ld\n", general_profit);
> 

Re: [PATCH 1/4] mm/ksm: fix ksm_pages_scanned accounting

[David Hildenbrand]

On 08.05.24 12:35, Chengming Zhou wrote:
> On 2024/5/8 17:55, Chengming Zhou wrote:
>> During testing, I found ksm_pages_scanned is unchanged although the
>> scan_get_next_rmap_item() did return valid rmap_item that is not NULL.
>>
>> The reason is the scan_get_next_rmap_item() will return NULL after
>> a full scan, so ksm_do_scan() just return without accounting of the
>> ksm_pages_scanned.
>>
>> Fix it by just putting ksm_pages_scanned accounting in that loop,
>> and it will be accounted more timely if that loop would last for
>> a long time.
>>
> 
> Fixes: b348b5fe2b5f ("mm/ksm: add pages scanned metric")

Acked-by: David Hildenbrand <david@redhat.com>

-- 
Cheers,

David / dhildenb

Re: [PATCH 2/4] mm/ksm: fix ksm_zero_pages accounting

[David Hildenbrand]

On 08.05.24 11:55, Chengming Zhou wrote:
> We normally ksm_zero_pages++ in ksmd when page is merged with zero page,
> but ksm_zero_pages-- is done from page tables side, which can't protected
> by the ksmd mutex.
> 
> So we can read very exceptional value of ksm_zero_pages in rare cases,
> such as -1, which is very confusing to users.
> 
> Fix it by changing to use atomic_long_t, and the same case with the
> mm->ksm_zero_pages.
> 
> Signed-off-by: Chengming Zhou <chengming.zhou@linux.dev>
> ---
>   fs/proc/base.c           |  2 +-
>   include/linux/ksm.h      | 22 +++++++++++++++++++---
>   include/linux/mm_types.h |  2 +-
>   mm/ksm.c                 | 11 +++++------
>   4 files changed, 26 insertions(+), 11 deletions(-)
> 
> diff --git a/fs/proc/base.c b/fs/proc/base.c
> index 18550c071d71..72a1acd03675 100644
> --- a/fs/proc/base.c
> +++ b/fs/proc/base.c
> @@ -3214,7 +3214,7 @@ static int proc_pid_ksm_stat(struct seq_file *m, struct pid_namespace *ns,
>   	mm = get_task_mm(task);
>   	if (mm) {
>   		seq_printf(m, "ksm_rmap_items %lu\n", mm->ksm_rmap_items);
> -		seq_printf(m, "ksm_zero_pages %lu\n", mm->ksm_zero_pages);
> +		seq_printf(m, "ksm_zero_pages %ld\n", mm_ksm_zero_pages(mm));
>   		seq_printf(m, "ksm_merging_pages %lu\n", mm->ksm_merging_pages);
>   		seq_printf(m, "ksm_process_profit %ld\n", ksm_process_profit(mm));
>   		mmput(mm);
> diff --git a/include/linux/ksm.h b/include/linux/ksm.h
> index 52c63a9c5a9c..bfc2cf756b0d 100644
> --- a/include/linux/ksm.h
> +++ b/include/linux/ksm.h
> @@ -33,16 +33,32 @@ void __ksm_exit(struct mm_struct *mm);
>    */
>   #define is_ksm_zero_pte(pte)	(is_zero_pfn(pte_pfn(pte)) && pte_dirty(pte))
>   
> -extern unsigned long ksm_zero_pages;
> +extern atomic_long_t ksm_zero_pages;
> +
> +static inline void ksm_map_zero_page(struct mm_struct *mm)
> +{
> +	atomic_long_inc(&ksm_zero_pages);
> +	atomic_long_inc(&mm->ksm_zero_pages);
> +}
>   
>   static inline void ksm_might_unmap_zero_page(struct mm_struct *mm, pte_t pte)
>   {
>   	if (is_ksm_zero_pte(pte)) {
> -		ksm_zero_pages--;
> -		mm->ksm_zero_pages--;
> +		atomic_long_dec(&ksm_zero_pages);
> +		atomic_long_dec(&mm->ksm_zero_pages);
>   	}
>   }
>   
> +static inline long get_ksm_zero_pages(void)
> +{
> +	return atomic_long_read(&ksm_zero_pages);
> +}

I suggest inlining that one. The naming of the function also is a bit 
inconsistent staring at the others.

> +
> +static inline long mm_ksm_zero_pages(struct mm_struct *mm)
> +{
> +	return atomic_long_read(&mm->ksm_zero_pages);
> +}
> +

Apart from that LGTM

Acked-by: David Hildenbrand <david@redhat.com>

-- 
Cheers,

David / dhildenb

Re: [PATCH 2/4] mm/ksm: fix ksm_zero_pages accounting

[Chengming Zhou]

On 2024/5/8 20:36, David Hildenbrand wrote:
> On 08.05.24 11:55, Chengming Zhou wrote:
>> We normally ksm_zero_pages++ in ksmd when page is merged with zero page,
>> but ksm_zero_pages-- is done from page tables side, which can't protected
>> by the ksmd mutex.
>>
>> So we can read very exceptional value of ksm_zero_pages in rare cases,
>> such as -1, which is very confusing to users.
>>
>> Fix it by changing to use atomic_long_t, and the same case with the
>> mm->ksm_zero_pages.
>>
>> Signed-off-by: Chengming Zhou <chengming.zhou@linux.dev>
>> ---
>>   fs/proc/base.c           |  2 +-
>>   include/linux/ksm.h      | 22 +++++++++++++++++++---
>>   include/linux/mm_types.h |  2 +-
>>   mm/ksm.c                 | 11 +++++------
>>   4 files changed, 26 insertions(+), 11 deletions(-)
>>
>> diff --git a/fs/proc/base.c b/fs/proc/base.c
>> index 18550c071d71..72a1acd03675 100644
>> --- a/fs/proc/base.c
>> +++ b/fs/proc/base.c
>> @@ -3214,7 +3214,7 @@ static int proc_pid_ksm_stat(struct seq_file *m, struct pid_namespace *ns,
>>       mm = get_task_mm(task);
>>       if (mm) {
>>           seq_printf(m, "ksm_rmap_items %lu\n", mm->ksm_rmap_items);
>> -        seq_printf(m, "ksm_zero_pages %lu\n", mm->ksm_zero_pages);
>> +        seq_printf(m, "ksm_zero_pages %ld\n", mm_ksm_zero_pages(mm));
>>           seq_printf(m, "ksm_merging_pages %lu\n", mm->ksm_merging_pages);
>>           seq_printf(m, "ksm_process_profit %ld\n", ksm_process_profit(mm));
>>           mmput(mm);
>> diff --git a/include/linux/ksm.h b/include/linux/ksm.h
>> index 52c63a9c5a9c..bfc2cf756b0d 100644
>> --- a/include/linux/ksm.h
>> +++ b/include/linux/ksm.h
>> @@ -33,16 +33,32 @@ void __ksm_exit(struct mm_struct *mm);
>>    */
>>   #define is_ksm_zero_pte(pte)    (is_zero_pfn(pte_pfn(pte)) && pte_dirty(pte))
>>   -extern unsigned long ksm_zero_pages;
>> +extern atomic_long_t ksm_zero_pages;
>> +
>> +static inline void ksm_map_zero_page(struct mm_struct *mm)
>> +{
>> +    atomic_long_inc(&ksm_zero_pages);
>> +    atomic_long_inc(&mm->ksm_zero_pages);
>> +}
>>     static inline void ksm_might_unmap_zero_page(struct mm_struct *mm, pte_t pte)
>>   {
>>       if (is_ksm_zero_pte(pte)) {
>> -        ksm_zero_pages--;
>> -        mm->ksm_zero_pages--;
>> +        atomic_long_dec(&ksm_zero_pages);
>> +        atomic_long_dec(&mm->ksm_zero_pages);
>>       }
>>   }
>>   +static inline long get_ksm_zero_pages(void)
>> +{
>> +    return atomic_long_read(&ksm_zero_pages);
>> +}
> 
> I suggest inlining that one. The naming of the function also is a bit inconsistent staring at the others.

Good point, I will inline it.

> 
>> +
>> +static inline long mm_ksm_zero_pages(struct mm_struct *mm)
>> +{
>> +    return atomic_long_read(&mm->ksm_zero_pages);
>> +}
>> +
> 
> Apart from that LGTM
> 
> Acked-by: David Hildenbrand <david@redhat.com>
> 

Thanks!