Add KSM doctor check and memfd probe evidence

[TheusHen]

Summary

This updates the #5 follow-up after checking the KSM counters directly.

The original version of this PR tried to mark a controller-side MAP_SHARED memfd mapping as MADV_MERGEABLE. After the review, I added a small probe under bench/ksm-memfd/ and ran it against /sys/kernel/mm/ksm counters. The result matches the concern from review: the anonymous private control case merges, but the memfd MAP_SHARED case does not move pages_shared or pages_sharing.

So this PR now removes the misleading memfd-side hint instead of keeping a no-op mapping around. What remains is:

• a forkd doctor KSM row, so operators can see when KSM is disabled or has pages_to_scan=0;
• a reproducible KSM probe plus captured results showing that memfd MAP_SHARED is not the right implementation path for KSM directed hints for fork families #5;
• small docs cleanup around Question: why MAP_PRIVATE for first BRANCH instead of userfaultfd for everything? #257 and Question: design rationale for tag-scoped vs sandbox-scoped branch concurrency #263.

This does not claim to fully fix #5 anymore. It narrows the next implementation attempt to a mapping/backing shape KSM actually scans.

Issues

Helps #5 by adding the doctor check and ruling out the memfd MAP_SHARED approach.
Documents #257 and #263.

Testing

• cargo fmt --check
• git diff --check
• cargo test --workspace
• cargo clippy --workspace --all-targets -- -D warnings
• python -m py_compile sdk/mcp/forkd_mcp/server.py bench/ksm-memfd/probe.py
• docker run --rm --privileged -v "$PWD:/work" -w /work python:3.12-slim bash -lc 'python bench/ksm-memfd/probe.py --pages 4096 --timeout 30'

[WaylandYang]

Thanks for tackling #5. I think this needs one more proof point before merge.

The implementation marks a controller-side MAP_SHARED memfd mapping as MADV_MERGEABLE, but Linux KSM documentation says KSM only merges private anonymous pages and does not merge page-cache/file-backed pages. Since memfd/shmem MAP_SHARED pages appear to fall on the wrong side of that boundary, this may be a no-op apart from adding a populated controller mapping.

Could you add evidence from /sys/kernel/mm/ksm/pages_shared, pages_sharing, etc. showing that memfd-backed fork families actually merge with this change?

[TheusHen]

No problems.

I will verify and add right now.

[TheusHen]

Thanks, you were right to ask for the counters here.

I added bench/ksm-memfd/probe.py and ran it with KSM enabled from a privileged Docker container. The anonymous private control case does merge:

anonymous-private
  delta ={'pages_shared': 2, 'pages_sharing': 510, 'pages_unshared': 0, 'pages_volatile': 5069, 'full_scans': 2}

But the memfd MAP_SHARED case does not move the KSM counters at all:

memfd-map-shared-two-fds
  delta ={'pages_shared': 0, 'pages_sharing': 0, 'pages_unshared': 0, 'pages_volatile': 0, 'full_scans': 0}

So I removed the controller-side memfd MADV_MERGEABLE implementation rather than keeping a no-op populated mapping. The PR now keeps the useful forkd doctor KSM check and adds the probe/results as evidence that this memfd path is not the right #5 implementation.

[WaylandYang]

Thanks for checking the counters and changing direction. This version is much better: it removes the no-op runtime memfd hint, keeps the useful doctor signal, and leaves a reproducible probe/results trail for why the MAP_SHARED memfd path is not the right #5 implementation.

I checked the updated diff: no remaining runtime MADV_MERGEABLE path in forkd-vmm/controller, cargo fmt --check passes locally, and bench/ksm-memfd/probe.py passes py_compile.

[WaylandYang]

Merged this updated version into dev as ed4b7f8, keeping #266 already on dev as well.

Local checks:

• cargo fmt --check passed.
• Rust tests are still blocked on my Windows box by local Cargo 1.83 resolving a dependency that requires edition2024.
• Python syntax check could not run here because python is not on PATH in this shell; the probe is Linux/Docker-oriented and your reported Docker run is the relevant signal.

Leaving main unchanged until dev is promoted.