Re: [PATCH v3 01/12] mm/huge_memory: zap deposited page tables after an RCU grace period

[David Hildenbrand (Arm)]

On 9/16/26 18:59, Lorenzo Stoakes (ARM) wrote:
> On Wed, Sep 16, 2026 at 04:42:04PM +0200, David Hildenbrand (Arm) wrote:
>> On 9/11/26 21:36, Lorenzo Stoakes (ARM) wrote:
>>> When an anonymous mapping is collapsed for THP, a PTE page table is
>>> 'deposited' with the installed PMD entry.
>>
>> Right. Or when we allocate an anon THP.
> 
> That case doesn't interact with page walking though, as they're
> just-allocated right?

I was surprised to read that page tables deposited during collapse should behave
differently than page tables deposited during allocation :)

That's the semantic change you are adding (and that I didn't quite understand
from reading your description): a deposited page table could now get reused and
modified for another page table due to a PMD split, while there might still be
an RCU page table walker walking it. And PMD comparisons (+ proper memory
ordering) have to make sure that we didn't just walk  something that doesn't
belong to us.

[...]

>>
>> Wait, but wouldn't it be really problematic to punch a page table that is still
> 
> Punch? You mean deposit?

Yes!

> 
>> being walked into the deposited list where it can just be allocated from another
>> PMD->PTE split?
> 
> In general, RCU-only page table walkers are _only_ guaranteed that the page
> tables are not freed from underneath them, as per the cover letter:
> 
> 	"As a result, page table walks can now be performed safely under RCU without
> 	 any risk of page tables being freed underneath a walker.
> 
> 	However, this is the only guarantee that this work provides - page table
> 	walkers must still ensure that page table entries are as expected
> 	throughout."

So far page table walkers never walk deposited page tables. Just like they never
walk freed page tables.

For *current* lockless page table walkers (IRQs disabled),
tlb_remove_table_sync_one() takes care of that. So there is no such thing as
"walking a page table that was reused in different context (as a page table) in
the meantime".

> 
> So this series doesn't actually have to answer that :)
> 
> But a PTE PTL -> pmd_same() check will flag anything like that,
> a.k.a. pte_offset_map_lock().
> 
> The RCU lock replaces stablisation on stuff other than VMA/mmap or rmap
> lock.
> 
> If the walker needs to be sure the PTE is actually valid and belongs to the
> expected walk then further is required.
> 
> Alternatively (like GUP-fast) if you wanted to avoid locking at all, IRQs
> off would be required paired with the tlb_remove_table_sync_one() in
> collapse_huge_page().

Doing an RCU sync in tlb_remove_table_sync_one() would be the big hammer (I
thought that was discussed with Lance recently). There is also this option: just
allocate a new page table and deposit it, and free the existing page table
through RCU.

Long story short: allowing empty page tables to be freed by RCU is simple.
Allowing empty page tables to be reused while they are still getting walked is
obviously more complicated conceptually. Likely it can be made working, but I'd
hope that we can keep it simpler.

> 
> Another strategy could be used I guess with looped checks but it gets a bit
> sketchy with timing etc.
> 
> But actually maybe we can avoid all that...
> 
>>
>> Note that pgtable_trans_huge_withdraw() just dequeues *some* PTE page table in
>> the list attached to the PMD table.
>>
>> Something is odd here.
> 
> ...Since this code path already allocates (the huge folio), so allocation
> here isn't an issue (as long as done outside of lcosk), why not have it
> also allocate a new PTE to deposit and RCU-free the existing PTE instead?
> 
> That eliminates the one place in the kernel (afaik) where a
> page-table-walker-visible table can just get yoinked over somewhere else.
> 
> Then a lockless PMD check works.
> 
> E.g. something like the below?

Hah! Great minds think alike.

-- 
Cheers,

David