diff mbox series

[v4,3/3] mm/vmscan: avoid split lazyfree THP during shrink_folio_list()

Message ID 20240501042700.83974-4-ioworker0@gmail.com (mailing list archive)
State New
Headers show
Series Reclaim lazyfree THP without splitting | expand

Commit Message

Lance Yang May 1, 2024, 4:27 a.m. UTC
When the user no longer requires the pages, they would use
madvise(MADV_FREE) to mark the pages as lazy free. Subsequently, they
typically would not re-write to that memory again.

During memory reclaim, if we detect that the large folio and its PMD are
both still marked as clean and there are no unexpected references
(such as GUP), so we can just discard the memory lazily, improving the
efficiency of memory reclamation in this case.  On an Intel i5 CPU, reclaiming 1GiB of lazyfree THPs using
mem_cgroup_force_empty() results in the following runtimes in seconds
(shorter is better):

--------------------------------------------
|     Old       |      New       |  Change  |
--------------------------------------------
|   0.683426    |    0.049197    |  -92.80% |
--------------------------------------------

Suggested-by: Zi Yan <ziy@nvidia.com>
Suggested-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Lance Yang <ioworker0@gmail.com>
---
 include/linux/huge_mm.h |  9 +++++
 mm/huge_memory.c        | 73 +++++++++++++++++++++++++++++++++++++++++
 mm/rmap.c               |  3 ++
 3 files changed, 85 insertions(+)

Comments

Baolin Wang May 7, 2024, 4 a.m. UTC | #1
On 2024/5/1 12:27, Lance Yang wrote:
> When the user no longer requires the pages, they would use
> madvise(MADV_FREE) to mark the pages as lazy free. Subsequently, they
> typically would not re-write to that memory again.
> 
> During memory reclaim, if we detect that the large folio and its PMD are
> both still marked as clean and there are no unexpected references
> (such as GUP), so we can just discard the memory lazily, improving the
> efficiency of memory reclamation in this case.  On an Intel i5 CPU, reclaiming 1GiB of lazyfree THPs using
> mem_cgroup_force_empty() results in the following runtimes in seconds
> (shorter is better):
> 
> --------------------------------------------
> |     Old       |      New       |  Change  |
> --------------------------------------------
> |   0.683426    |    0.049197    |  -92.80% |
> --------------------------------------------
> 
> Suggested-by: Zi Yan <ziy@nvidia.com>
> Suggested-by: David Hildenbrand <david@redhat.com>
> Signed-off-by: Lance Yang <ioworker0@gmail.com>
> ---
>   include/linux/huge_mm.h |  9 +++++
>   mm/huge_memory.c        | 73 +++++++++++++++++++++++++++++++++++++++++
>   mm/rmap.c               |  3 ++
>   3 files changed, 85 insertions(+)
> 
> diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
> index 38c4b5537715..017cee864080 100644
> --- a/include/linux/huge_mm.h
> +++ b/include/linux/huge_mm.h
> @@ -411,6 +411,8 @@ static inline bool thp_migration_supported(void)
>   
>   void split_huge_pmd_locked(struct vm_area_struct *vma, unsigned long address,
>   			   pmd_t *pmd, bool freeze, struct folio *folio);
> +bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
> +			   pmd_t *pmdp, struct folio *folio);
>   
>   static inline void align_huge_pmd_range(struct vm_area_struct *vma,
>   					unsigned long *start,
> @@ -492,6 +494,13 @@ static inline void align_huge_pmd_range(struct vm_area_struct *vma,
>   					unsigned long *start,
>   					unsigned long *end) {}
>   
> +static inline bool unmap_huge_pmd_locked(struct vm_area_struct *vma,
> +					 unsigned long addr, pmd_t *pmdp,
> +					 struct folio *folio)
> +{
> +	return false;
> +}
> +
>   #define split_huge_pud(__vma, __pmd, __address)	\
>   	do { } while (0)
>   
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 145505a1dd05..90fdef847a88 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -2690,6 +2690,79 @@ static void unmap_folio(struct folio *folio)
>   	try_to_unmap_flush();
>   }
>   
> +static bool __discard_trans_pmd_locked(struct vm_area_struct *vma,
> +				       unsigned long addr, pmd_t *pmdp,
> +				       struct folio *folio)
> +{
> +	struct mm_struct *mm = vma->vm_mm;
> +	int ref_count, map_count;
> +	pmd_t orig_pmd = *pmdp;
> +	struct mmu_gather tlb;
> +	struct page *page;
> +
> +	if (pmd_dirty(orig_pmd) || folio_test_dirty(folio))
> +		return false;
> +	if (unlikely(!pmd_present(orig_pmd) || !pmd_trans_huge(orig_pmd)))
> +		return false;
> +
> +	page = pmd_page(orig_pmd);
> +	if (unlikely(page_folio(page) != folio))
> +		return false;
> +
> +	tlb_gather_mmu(&tlb, mm);
> +	orig_pmd = pmdp_huge_get_and_clear(mm, addr, pmdp);
> +	tlb_remove_pmd_tlb_entry(&tlb, pmdp, addr);
> +
> +	/*
> +	 * Syncing against concurrent GUP-fast:
> +	 * - clear PMD; barrier; read refcount
> +	 * - inc refcount; barrier; read PMD
> +	 */
> +	smp_mb();
> +
> +	ref_count = folio_ref_count(folio);
> +	map_count = folio_mapcount(folio);
> +
> +	/*
> +	 * Order reads for folio refcount and dirty flag
> +	 * (see comments in __remove_mapping()).
> +	 */
> +	smp_rmb();
> +
> +	/*
> +	 * If the PMD or folio is redirtied at this point, or if there are
> +	 * unexpected references, we will give up to discard this folio
> +	 * and remap it.
> +	 *
> +	 * The only folio refs must be one from isolation plus the rmap(s).
> +	 */
> +	if (ref_count != map_count + 1 || folio_test_dirty(folio) ||
> +	    pmd_dirty(orig_pmd)) {
> +		set_pmd_at(mm, addr, pmdp, orig_pmd);
> +		return false;
> +	}
> +
> +	folio_remove_rmap_pmd(folio, page, vma);
> +	zap_deposited_table(mm, pmdp);
> +	add_mm_counter(mm, MM_ANONPAGES, -HPAGE_PMD_NR);
> +	folio_put(folio);

IIUC, you missed handling mlock vma, see mlock_drain_local() in 
try_to_unmap_one().

> +
> +	return true;
> +}
> +
> +bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
> +			   pmd_t *pmdp, struct folio *folio)
> +{
> +	VM_WARN_ON_FOLIO(!folio_test_pmd_mappable(folio), folio);
> +	VM_WARN_ON_FOLIO(!folio_test_locked(folio), folio);
> +	VM_WARN_ON_ONCE(!IS_ALIGNED(addr, HPAGE_PMD_SIZE));
> +
> +	if (folio_test_anon(folio) && !folio_test_swapbacked(folio))
> +		return __discard_trans_pmd_locked(vma, addr, pmdp, folio);

Why add a new function, which is only used by unmap_huge_pmd_locked()? 
Seems can be folded in unmap_huge_pmd_locked(), but not a strong 
preference:)

> +
> +	return false;
> +}
> +
>   static void remap_page(struct folio *folio, unsigned long nr)
>   {
>   	int i = 0;
> diff --git a/mm/rmap.c b/mm/rmap.c
> index 432601154583..1d3d30cb752c 100644
> --- a/mm/rmap.c
> +++ b/mm/rmap.c
> @@ -1675,6 +1675,9 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma,
>   		}
>   
>   		if (!pvmw.pte && (flags & TTU_SPLIT_HUGE_PMD)) {
> +			if (unmap_huge_pmd_locked(vma, range.start, pvmw.pmd,
> +						  folio))
> +				goto walk_done;
>   			/*
>   			 * We temporarily have to drop the PTL and start once
>   			 * again from that now-PTE-mapped page table.
Lance Yang May 7, 2024, 6:32 a.m. UTC | #2
Hey Baolin,

Thanks a lot for taking time to review!

On Tue, May 7, 2024 at 12:01 PM Baolin Wang
<baolin.wang@linux.alibaba.com> wrote:
>
>
>
> On 2024/5/1 12:27, Lance Yang wrote:
> > When the user no longer requires the pages, they would use
> > madvise(MADV_FREE) to mark the pages as lazy free. Subsequently, they
> > typically would not re-write to that memory again.
> >
> > During memory reclaim, if we detect that the large folio and its PMD are
> > both still marked as clean and there are no unexpected references
> > (such as GUP), so we can just discard the memory lazily, improving the
> > efficiency of memory reclamation in this case.  On an Intel i5 CPU, reclaiming 1GiB of lazyfree THPs using
> > mem_cgroup_force_empty() results in the following runtimes in seconds
> > (shorter is better):
> >
> > --------------------------------------------
> > |     Old       |      New       |  Change  |
> > --------------------------------------------
> > |   0.683426    |    0.049197    |  -92.80% |
> > --------------------------------------------
> >
> > Suggested-by: Zi Yan <ziy@nvidia.com>
> > Suggested-by: David Hildenbrand <david@redhat.com>
> > Signed-off-by: Lance Yang <ioworker0@gmail.com>
> > ---
> >   include/linux/huge_mm.h |  9 +++++
> >   mm/huge_memory.c        | 73 +++++++++++++++++++++++++++++++++++++++++
> >   mm/rmap.c               |  3 ++
> >   3 files changed, 85 insertions(+)
> >
> > diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
> > index 38c4b5537715..017cee864080 100644
> > --- a/include/linux/huge_mm.h
> > +++ b/include/linux/huge_mm.h
> > @@ -411,6 +411,8 @@ static inline bool thp_migration_supported(void)
> >
> >   void split_huge_pmd_locked(struct vm_area_struct *vma, unsigned long address,
> >                          pmd_t *pmd, bool freeze, struct folio *folio);
> > +bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
> > +                        pmd_t *pmdp, struct folio *folio);
> >
> >   static inline void align_huge_pmd_range(struct vm_area_struct *vma,
> >                                       unsigned long *start,
> > @@ -492,6 +494,13 @@ static inline void align_huge_pmd_range(struct vm_area_struct *vma,
> >                                       unsigned long *start,
> >                                       unsigned long *end) {}
> >
> > +static inline bool unmap_huge_pmd_locked(struct vm_area_struct *vma,
> > +                                      unsigned long addr, pmd_t *pmdp,
> > +                                      struct folio *folio)
> > +{
> > +     return false;
> > +}
> > +
> >   #define split_huge_pud(__vma, __pmd, __address)     \
> >       do { } while (0)
> >
> > diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> > index 145505a1dd05..90fdef847a88 100644
> > --- a/mm/huge_memory.c
> > +++ b/mm/huge_memory.c
> > @@ -2690,6 +2690,79 @@ static void unmap_folio(struct folio *folio)
> >       try_to_unmap_flush();
> >   }
> >
> > +static bool __discard_trans_pmd_locked(struct vm_area_struct *vma,
> > +                                    unsigned long addr, pmd_t *pmdp,
> > +                                    struct folio *folio)
> > +{
> > +     struct mm_struct *mm = vma->vm_mm;
> > +     int ref_count, map_count;
> > +     pmd_t orig_pmd = *pmdp;
> > +     struct mmu_gather tlb;
> > +     struct page *page;
> > +
> > +     if (pmd_dirty(orig_pmd) || folio_test_dirty(folio))
> > +             return false;
> > +     if (unlikely(!pmd_present(orig_pmd) || !pmd_trans_huge(orig_pmd)))
> > +             return false;
> > +
> > +     page = pmd_page(orig_pmd);
> > +     if (unlikely(page_folio(page) != folio))
> > +             return false;
> > +
> > +     tlb_gather_mmu(&tlb, mm);
> > +     orig_pmd = pmdp_huge_get_and_clear(mm, addr, pmdp);
> > +     tlb_remove_pmd_tlb_entry(&tlb, pmdp, addr);
> > +
> > +     /*
> > +      * Syncing against concurrent GUP-fast:
> > +      * - clear PMD; barrier; read refcount
> > +      * - inc refcount; barrier; read PMD
> > +      */
> > +     smp_mb();
> > +
> > +     ref_count = folio_ref_count(folio);
> > +     map_count = folio_mapcount(folio);
> > +
> > +     /*
> > +      * Order reads for folio refcount and dirty flag
> > +      * (see comments in __remove_mapping()).
> > +      */
> > +     smp_rmb();
> > +
> > +     /*
> > +      * If the PMD or folio is redirtied at this point, or if there are
> > +      * unexpected references, we will give up to discard this folio
> > +      * and remap it.
> > +      *
> > +      * The only folio refs must be one from isolation plus the rmap(s).
> > +      */
> > +     if (ref_count != map_count + 1 || folio_test_dirty(folio) ||
> > +         pmd_dirty(orig_pmd)) {
> > +             set_pmd_at(mm, addr, pmdp, orig_pmd);
> > +             return false;
> > +     }
> > +
> > +     folio_remove_rmap_pmd(folio, page, vma);
> > +     zap_deposited_table(mm, pmdp);
> > +     add_mm_counter(mm, MM_ANONPAGES, -HPAGE_PMD_NR);
> > +     folio_put(folio);
>
> IIUC, you missed handling mlock vma, see mlock_drain_local() in
> try_to_unmap_one().

Good spot!

I suddenly realized that I overlooked another thing: If we detect that a
PMD-mapped THP is within the range of the VM_LOCKED VMA, we
should check whether the TTU_IGNORE_MLOCK flag is set in
try_to_unmap_one(). If the flag is set, we will remove the PMD mapping
from the folio. Otherwise, the folio should be mlocked, which avoids
splitting the folio and then mlocking each page again.

What do you think?

>
> > +
> > +     return true;
> > +}
> > +
> > +bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
> > +                        pmd_t *pmdp, struct folio *folio)
> > +{
> > +     VM_WARN_ON_FOLIO(!folio_test_pmd_mappable(folio), folio);
> > +     VM_WARN_ON_FOLIO(!folio_test_locked(folio), folio);
> > +     VM_WARN_ON_ONCE(!IS_ALIGNED(addr, HPAGE_PMD_SIZE));
> > +
> > +     if (folio_test_anon(folio) && !folio_test_swapbacked(folio))
> > +             return __discard_trans_pmd_locked(vma, addr, pmdp, folio);
>
> Why add a new function, which is only used by unmap_huge_pmd_locked()?
> Seems can be folded in unmap_huge_pmd_locked(), but not a strong
> preference:)

Thanks for the suggestion!

Personally, I prefer adding a new function, rather than folding
__discard_trans_pmd_locked() into unmap_huge_pmd_locked().

While unmap_huge_pmd_locked() currently only deals with lazyfree THP,
It could be expanded to support other types of large folios that are
PMD-mapped in the future if needed.

Thanks a lot again for the review!
Lance

>
> > +
> > +     return false;
> > +}
> > +
> >   static void remap_page(struct folio *folio, unsigned long nr)
> >   {
> >       int i = 0;
> > diff --git a/mm/rmap.c b/mm/rmap.c
> > index 432601154583..1d3d30cb752c 100644
> > --- a/mm/rmap.c
> > +++ b/mm/rmap.c
> > @@ -1675,6 +1675,9 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma,
> >               }
> >
> >               if (!pvmw.pte && (flags & TTU_SPLIT_HUGE_PMD)) {
> > +                     if (unmap_huge_pmd_locked(vma, range.start, pvmw.pmd,
> > +                                               folio))
> > +                             goto walk_done;
> >                       /*
> >                        * We temporarily have to drop the PTL and start once
> >                        * again from that now-PTE-mapped page table.
Lance Yang May 7, 2024, 8:26 a.m. UTC | #3
On Tue, May 7, 2024 at 2:32 PM Lance Yang <ioworker0@gmail.com> wrote:
>
> Hey Baolin,
>
> Thanks a lot for taking time to review!
>
> On Tue, May 7, 2024 at 12:01 PM Baolin Wang
> <baolin.wang@linux.alibaba.com> wrote:
> >
> >
> >
> > On 2024/5/1 12:27, Lance Yang wrote:
> > > When the user no longer requires the pages, they would use
> > > madvise(MADV_FREE) to mark the pages as lazy free. Subsequently, they
> > > typically would not re-write to that memory again.
> > >
> > > During memory reclaim, if we detect that the large folio and its PMD are
> > > both still marked as clean and there are no unexpected references
> > > (such as GUP), so we can just discard the memory lazily, improving the
> > > efficiency of memory reclamation in this case.  On an Intel i5 CPU, reclaiming 1GiB of lazyfree THPs using
> > > mem_cgroup_force_empty() results in the following runtimes in seconds
> > > (shorter is better):
> > >
> > > --------------------------------------------
> > > |     Old       |      New       |  Change  |
> > > --------------------------------------------
> > > |   0.683426    |    0.049197    |  -92.80% |
> > > --------------------------------------------
> > >
> > > Suggested-by: Zi Yan <ziy@nvidia.com>
> > > Suggested-by: David Hildenbrand <david@redhat.com>
> > > Signed-off-by: Lance Yang <ioworker0@gmail.com>
> > > ---
> > >   include/linux/huge_mm.h |  9 +++++
> > >   mm/huge_memory.c        | 73 +++++++++++++++++++++++++++++++++++++++++
> > >   mm/rmap.c               |  3 ++
> > >   3 files changed, 85 insertions(+)
> > >
> > > diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
> > > index 38c4b5537715..017cee864080 100644
> > > --- a/include/linux/huge_mm.h
> > > +++ b/include/linux/huge_mm.h
> > > @@ -411,6 +411,8 @@ static inline bool thp_migration_supported(void)
> > >
> > >   void split_huge_pmd_locked(struct vm_area_struct *vma, unsigned long address,
> > >                          pmd_t *pmd, bool freeze, struct folio *folio);
> > > +bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
> > > +                        pmd_t *pmdp, struct folio *folio);
> > >
> > >   static inline void align_huge_pmd_range(struct vm_area_struct *vma,
> > >                                       unsigned long *start,
> > > @@ -492,6 +494,13 @@ static inline void align_huge_pmd_range(struct vm_area_struct *vma,
> > >                                       unsigned long *start,
> > >                                       unsigned long *end) {}
> > >
> > > +static inline bool unmap_huge_pmd_locked(struct vm_area_struct *vma,
> > > +                                      unsigned long addr, pmd_t *pmdp,
> > > +                                      struct folio *folio)
> > > +{
> > > +     return false;
> > > +}
> > > +
> > >   #define split_huge_pud(__vma, __pmd, __address)     \
> > >       do { } while (0)
> > >
> > > diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> > > index 145505a1dd05..90fdef847a88 100644
> > > --- a/mm/huge_memory.c
> > > +++ b/mm/huge_memory.c
> > > @@ -2690,6 +2690,79 @@ static void unmap_folio(struct folio *folio)
> > >       try_to_unmap_flush();
> > >   }
> > >
> > > +static bool __discard_trans_pmd_locked(struct vm_area_struct *vma,
> > > +                                    unsigned long addr, pmd_t *pmdp,
> > > +                                    struct folio *folio)
> > > +{
> > > +     struct mm_struct *mm = vma->vm_mm;
> > > +     int ref_count, map_count;
> > > +     pmd_t orig_pmd = *pmdp;
> > > +     struct mmu_gather tlb;
> > > +     struct page *page;
> > > +
> > > +     if (pmd_dirty(orig_pmd) || folio_test_dirty(folio))
> > > +             return false;
> > > +     if (unlikely(!pmd_present(orig_pmd) || !pmd_trans_huge(orig_pmd)))
> > > +             return false;
> > > +
> > > +     page = pmd_page(orig_pmd);
> > > +     if (unlikely(page_folio(page) != folio))
> > > +             return false;
> > > +
> > > +     tlb_gather_mmu(&tlb, mm);
> > > +     orig_pmd = pmdp_huge_get_and_clear(mm, addr, pmdp);
> > > +     tlb_remove_pmd_tlb_entry(&tlb, pmdp, addr);
> > > +
> > > +     /*
> > > +      * Syncing against concurrent GUP-fast:
> > > +      * - clear PMD; barrier; read refcount
> > > +      * - inc refcount; barrier; read PMD
> > > +      */
> > > +     smp_mb();
> > > +
> > > +     ref_count = folio_ref_count(folio);
> > > +     map_count = folio_mapcount(folio);
> > > +
> > > +     /*
> > > +      * Order reads for folio refcount and dirty flag
> > > +      * (see comments in __remove_mapping()).
> > > +      */
> > > +     smp_rmb();
> > > +
> > > +     /*
> > > +      * If the PMD or folio is redirtied at this point, or if there are
> > > +      * unexpected references, we will give up to discard this folio
> > > +      * and remap it.
> > > +      *
> > > +      * The only folio refs must be one from isolation plus the rmap(s).
> > > +      */
> > > +     if (ref_count != map_count + 1 || folio_test_dirty(folio) ||
> > > +         pmd_dirty(orig_pmd)) {
> > > +             set_pmd_at(mm, addr, pmdp, orig_pmd);
> > > +             return false;
> > > +     }
> > > +
> > > +     folio_remove_rmap_pmd(folio, page, vma);
> > > +     zap_deposited_table(mm, pmdp);
> > > +     add_mm_counter(mm, MM_ANONPAGES, -HPAGE_PMD_NR);
> > > +     folio_put(folio);
> >
> > IIUC, you missed handling mlock vma, see mlock_drain_local() in
> > try_to_unmap_one().
>
> Good spot!
>
> I suddenly realized that I overlooked another thing: If we detect that a
> PMD-mapped THP is within the range of the VM_LOCKED VMA, we
> should check whether the TTU_IGNORE_MLOCK flag is set in
> try_to_unmap_one(). If the flag is set, we will remove the PMD mapping
> from the folio. Otherwise, the folio should be mlocked, which avoids
> splitting the folio and then mlocking each page again.

My previous response above is flawed - sorry :(

If we detect that a PMD-mapped THP is within the range of the
VM_LOCKED VMA.

1) If the TTU_IGNORE_MLOCK flag is set, we will try to remove the
PMD mapping from the folio, as this series has done.

2) If the flag is not set, the large folio should be mlocked to prevent it
from being picked during memory reclaim? Currently, we just leave it
as is and do not to mlock it, IIUC.

What do you think?

Thanks,
Lance

>
> What do you think?
>
> >
> > > +
> > > +     return true;
> > > +}
> > > +
> > > +bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
> > > +                        pmd_t *pmdp, struct folio *folio)
> > > +{
> > > +     VM_WARN_ON_FOLIO(!folio_test_pmd_mappable(folio), folio);
> > > +     VM_WARN_ON_FOLIO(!folio_test_locked(folio), folio);
> > > +     VM_WARN_ON_ONCE(!IS_ALIGNED(addr, HPAGE_PMD_SIZE));
> > > +
> > > +     if (folio_test_anon(folio) && !folio_test_swapbacked(folio))
> > > +             return __discard_trans_pmd_locked(vma, addr, pmdp, folio);
> >
> > Why add a new function, which is only used by unmap_huge_pmd_locked()?
> > Seems can be folded in unmap_huge_pmd_locked(), but not a strong
> > preference:)
>
> Thanks for the suggestion!
>
> Personally, I prefer adding a new function, rather than folding
> __discard_trans_pmd_locked() into unmap_huge_pmd_locked().
>
> While unmap_huge_pmd_locked() currently only deals with lazyfree THP,
> It could be expanded to support other types of large folios that are
> PMD-mapped in the future if needed.
>
> Thanks a lot again for the review!
> Lance
>
> >
> > > +
> > > +     return false;
> > > +}
> > > +
> > >   static void remap_page(struct folio *folio, unsigned long nr)
> > >   {
> > >       int i = 0;
> > > diff --git a/mm/rmap.c b/mm/rmap.c
> > > index 432601154583..1d3d30cb752c 100644
> > > --- a/mm/rmap.c
> > > +++ b/mm/rmap.c
> > > @@ -1675,6 +1675,9 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma,
> > >               }
> > >
> > >               if (!pvmw.pte && (flags & TTU_SPLIT_HUGE_PMD)) {
> > > +                     if (unmap_huge_pmd_locked(vma, range.start, pvmw.pmd,
> > > +                                               folio))
> > > +                             goto walk_done;
> > >                       /*
> > >                        * We temporarily have to drop the PTL and start once
> > >                        * again from that now-PTE-mapped page table.
Baolin Wang May 7, 2024, 9:33 a.m. UTC | #4
On 2024/5/7 16:26, Lance Yang wrote:
> On Tue, May 7, 2024 at 2:32 PM Lance Yang <ioworker0@gmail.com> wrote:
>>
>> Hey Baolin,
>>
>> Thanks a lot for taking time to review!
>>
>> On Tue, May 7, 2024 at 12:01 PM Baolin Wang
>> <baolin.wang@linux.alibaba.com> wrote:
>>>
>>>
>>>
>>> On 2024/5/1 12:27, Lance Yang wrote:
>>>> When the user no longer requires the pages, they would use
>>>> madvise(MADV_FREE) to mark the pages as lazy free. Subsequently, they
>>>> typically would not re-write to that memory again.
>>>>
>>>> During memory reclaim, if we detect that the large folio and its PMD are
>>>> both still marked as clean and there are no unexpected references
>>>> (such as GUP), so we can just discard the memory lazily, improving the
>>>> efficiency of memory reclamation in this case.  On an Intel i5 CPU, reclaiming 1GiB of lazyfree THPs using
>>>> mem_cgroup_force_empty() results in the following runtimes in seconds
>>>> (shorter is better):
>>>>
>>>> --------------------------------------------
>>>> |     Old       |      New       |  Change  |
>>>> --------------------------------------------
>>>> |   0.683426    |    0.049197    |  -92.80% |
>>>> --------------------------------------------
>>>>
>>>> Suggested-by: Zi Yan <ziy@nvidia.com>
>>>> Suggested-by: David Hildenbrand <david@redhat.com>
>>>> Signed-off-by: Lance Yang <ioworker0@gmail.com>
>>>> ---
>>>>    include/linux/huge_mm.h |  9 +++++
>>>>    mm/huge_memory.c        | 73 +++++++++++++++++++++++++++++++++++++++++
>>>>    mm/rmap.c               |  3 ++
>>>>    3 files changed, 85 insertions(+)
>>>>
>>>> diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
>>>> index 38c4b5537715..017cee864080 100644
>>>> --- a/include/linux/huge_mm.h
>>>> +++ b/include/linux/huge_mm.h
>>>> @@ -411,6 +411,8 @@ static inline bool thp_migration_supported(void)
>>>>
>>>>    void split_huge_pmd_locked(struct vm_area_struct *vma, unsigned long address,
>>>>                           pmd_t *pmd, bool freeze, struct folio *folio);
>>>> +bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
>>>> +                        pmd_t *pmdp, struct folio *folio);
>>>>
>>>>    static inline void align_huge_pmd_range(struct vm_area_struct *vma,
>>>>                                        unsigned long *start,
>>>> @@ -492,6 +494,13 @@ static inline void align_huge_pmd_range(struct vm_area_struct *vma,
>>>>                                        unsigned long *start,
>>>>                                        unsigned long *end) {}
>>>>
>>>> +static inline bool unmap_huge_pmd_locked(struct vm_area_struct *vma,
>>>> +                                      unsigned long addr, pmd_t *pmdp,
>>>> +                                      struct folio *folio)
>>>> +{
>>>> +     return false;
>>>> +}
>>>> +
>>>>    #define split_huge_pud(__vma, __pmd, __address)     \
>>>>        do { } while (0)
>>>>
>>>> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
>>>> index 145505a1dd05..90fdef847a88 100644
>>>> --- a/mm/huge_memory.c
>>>> +++ b/mm/huge_memory.c
>>>> @@ -2690,6 +2690,79 @@ static void unmap_folio(struct folio *folio)
>>>>        try_to_unmap_flush();
>>>>    }
>>>>
>>>> +static bool __discard_trans_pmd_locked(struct vm_area_struct *vma,
>>>> +                                    unsigned long addr, pmd_t *pmdp,
>>>> +                                    struct folio *folio)
>>>> +{
>>>> +     struct mm_struct *mm = vma->vm_mm;
>>>> +     int ref_count, map_count;
>>>> +     pmd_t orig_pmd = *pmdp;
>>>> +     struct mmu_gather tlb;
>>>> +     struct page *page;
>>>> +
>>>> +     if (pmd_dirty(orig_pmd) || folio_test_dirty(folio))
>>>> +             return false;
>>>> +     if (unlikely(!pmd_present(orig_pmd) || !pmd_trans_huge(orig_pmd)))
>>>> +             return false;
>>>> +
>>>> +     page = pmd_page(orig_pmd);
>>>> +     if (unlikely(page_folio(page) != folio))
>>>> +             return false;
>>>> +
>>>> +     tlb_gather_mmu(&tlb, mm);
>>>> +     orig_pmd = pmdp_huge_get_and_clear(mm, addr, pmdp);
>>>> +     tlb_remove_pmd_tlb_entry(&tlb, pmdp, addr);
>>>> +
>>>> +     /*
>>>> +      * Syncing against concurrent GUP-fast:
>>>> +      * - clear PMD; barrier; read refcount
>>>> +      * - inc refcount; barrier; read PMD
>>>> +      */
>>>> +     smp_mb();
>>>> +
>>>> +     ref_count = folio_ref_count(folio);
>>>> +     map_count = folio_mapcount(folio);
>>>> +
>>>> +     /*
>>>> +      * Order reads for folio refcount and dirty flag
>>>> +      * (see comments in __remove_mapping()).
>>>> +      */
>>>> +     smp_rmb();
>>>> +
>>>> +     /*
>>>> +      * If the PMD or folio is redirtied at this point, or if there are
>>>> +      * unexpected references, we will give up to discard this folio
>>>> +      * and remap it.
>>>> +      *
>>>> +      * The only folio refs must be one from isolation plus the rmap(s).
>>>> +      */
>>>> +     if (ref_count != map_count + 1 || folio_test_dirty(folio) ||
>>>> +         pmd_dirty(orig_pmd)) {
>>>> +             set_pmd_at(mm, addr, pmdp, orig_pmd);
>>>> +             return false;
>>>> +     }
>>>> +
>>>> +     folio_remove_rmap_pmd(folio, page, vma);
>>>> +     zap_deposited_table(mm, pmdp);
>>>> +     add_mm_counter(mm, MM_ANONPAGES, -HPAGE_PMD_NR);
>>>> +     folio_put(folio);
>>>
>>> IIUC, you missed handling mlock vma, see mlock_drain_local() in
>>> try_to_unmap_one().
>>
>> Good spot!
>>
>> I suddenly realized that I overlooked another thing: If we detect that a
>> PMD-mapped THP is within the range of the VM_LOCKED VMA, we
>> should check whether the TTU_IGNORE_MLOCK flag is set in
>> try_to_unmap_one(). If the flag is set, we will remove the PMD mapping
>> from the folio. Otherwise, the folio should be mlocked, which avoids
>> splitting the folio and then mlocking each page again.
> 
> My previous response above is flawed - sorry :(
> 
> If we detect that a PMD-mapped THP is within the range of the
> VM_LOCKED VMA.
> 
> 1) If the TTU_IGNORE_MLOCK flag is set, we will try to remove the
> PMD mapping from the folio, as this series has done.

Right.

> 2) If the flag is not set, the large folio should be mlocked to prevent it
> from being picked during memory reclaim? Currently, we just leave it

Yes. From commit 1acbc3f93614 ("mm: handle large folio when large folio 
in VM_LOCKED VMA range"), large folios of the mlocked VMA will be 
handled during page reclaim phase.

> as is and do not to mlock it, IIUC.

Original code already handle the mlock case after the PMD-mapped THP is 
split in try_to_unmap_one():
                 /*
                  * If the folio is in an mlock()d vma, we must not swap 
it out.
                  */
                 if (!(flags & TTU_IGNORE_MLOCK) &&
                     (vma->vm_flags & VM_LOCKED)) {
                         /* Restore the mlock which got missed */
                         if (!folio_test_large(folio))
                                 mlock_vma_folio(folio, vma);
                         page_vma_mapped_walk_done(&pvmw);
                         ret = false;
                         break;
                 }
Lance Yang May 7, 2024, 11:37 a.m. UTC | #5
On Tue, May 7, 2024 at 5:33 PM Baolin Wang
<baolin.wang@linux.alibaba.com> wrote:
>
>
>
> On 2024/5/7 16:26, Lance Yang wrote:
> > On Tue, May 7, 2024 at 2:32 PM Lance Yang <ioworker0@gmail.com> wrote:
> >>
> >> Hey Baolin,
> >>
> >> Thanks a lot for taking time to review!
> >>
> >> On Tue, May 7, 2024 at 12:01 PM Baolin Wang
> >> <baolin.wang@linux.alibaba.com> wrote:
> >>>
> >>>
> >>>
> >>> On 2024/5/1 12:27, Lance Yang wrote:
> >>>> When the user no longer requires the pages, they would use
> >>>> madvise(MADV_FREE) to mark the pages as lazy free. Subsequently, they
> >>>> typically would not re-write to that memory again.
> >>>>
> >>>> During memory reclaim, if we detect that the large folio and its PMD are
> >>>> both still marked as clean and there are no unexpected references
> >>>> (such as GUP), so we can just discard the memory lazily, improving the
> >>>> efficiency of memory reclamation in this case.  On an Intel i5 CPU, reclaiming 1GiB of lazyfree THPs using
> >>>> mem_cgroup_force_empty() results in the following runtimes in seconds
> >>>> (shorter is better):
> >>>>
> >>>> --------------------------------------------
> >>>> |     Old       |      New       |  Change  |
> >>>> --------------------------------------------
> >>>> |   0.683426    |    0.049197    |  -92.80% |
> >>>> --------------------------------------------
> >>>>
> >>>> Suggested-by: Zi Yan <ziy@nvidia.com>
> >>>> Suggested-by: David Hildenbrand <david@redhat.com>
> >>>> Signed-off-by: Lance Yang <ioworker0@gmail.com>
> >>>> ---
> >>>>    include/linux/huge_mm.h |  9 +++++
> >>>>    mm/huge_memory.c        | 73 +++++++++++++++++++++++++++++++++++++++++
> >>>>    mm/rmap.c               |  3 ++
> >>>>    3 files changed, 85 insertions(+)
> >>>>
> >>>> diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
> >>>> index 38c4b5537715..017cee864080 100644
> >>>> --- a/include/linux/huge_mm.h
> >>>> +++ b/include/linux/huge_mm.h
> >>>> @@ -411,6 +411,8 @@ static inline bool thp_migration_supported(void)
> >>>>
> >>>>    void split_huge_pmd_locked(struct vm_area_struct *vma, unsigned long address,
> >>>>                           pmd_t *pmd, bool freeze, struct folio *folio);
> >>>> +bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
> >>>> +                        pmd_t *pmdp, struct folio *folio);
> >>>>
> >>>>    static inline void align_huge_pmd_range(struct vm_area_struct *vma,
> >>>>                                        unsigned long *start,
> >>>> @@ -492,6 +494,13 @@ static inline void align_huge_pmd_range(struct vm_area_struct *vma,
> >>>>                                        unsigned long *start,
> >>>>                                        unsigned long *end) {}
> >>>>
> >>>> +static inline bool unmap_huge_pmd_locked(struct vm_area_struct *vma,
> >>>> +                                      unsigned long addr, pmd_t *pmdp,
> >>>> +                                      struct folio *folio)
> >>>> +{
> >>>> +     return false;
> >>>> +}
> >>>> +
> >>>>    #define split_huge_pud(__vma, __pmd, __address)     \
> >>>>        do { } while (0)
> >>>>
> >>>> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> >>>> index 145505a1dd05..90fdef847a88 100644
> >>>> --- a/mm/huge_memory.c
> >>>> +++ b/mm/huge_memory.c
> >>>> @@ -2690,6 +2690,79 @@ static void unmap_folio(struct folio *folio)
> >>>>        try_to_unmap_flush();
> >>>>    }
> >>>>
> >>>> +static bool __discard_trans_pmd_locked(struct vm_area_struct *vma,
> >>>> +                                    unsigned long addr, pmd_t *pmdp,
> >>>> +                                    struct folio *folio)
> >>>> +{
> >>>> +     struct mm_struct *mm = vma->vm_mm;
> >>>> +     int ref_count, map_count;
> >>>> +     pmd_t orig_pmd = *pmdp;
> >>>> +     struct mmu_gather tlb;
> >>>> +     struct page *page;
> >>>> +
> >>>> +     if (pmd_dirty(orig_pmd) || folio_test_dirty(folio))
> >>>> +             return false;
> >>>> +     if (unlikely(!pmd_present(orig_pmd) || !pmd_trans_huge(orig_pmd)))
> >>>> +             return false;
> >>>> +
> >>>> +     page = pmd_page(orig_pmd);
> >>>> +     if (unlikely(page_folio(page) != folio))
> >>>> +             return false;
> >>>> +
> >>>> +     tlb_gather_mmu(&tlb, mm);
> >>>> +     orig_pmd = pmdp_huge_get_and_clear(mm, addr, pmdp);
> >>>> +     tlb_remove_pmd_tlb_entry(&tlb, pmdp, addr);
> >>>> +
> >>>> +     /*
> >>>> +      * Syncing against concurrent GUP-fast:
> >>>> +      * - clear PMD; barrier; read refcount
> >>>> +      * - inc refcount; barrier; read PMD
> >>>> +      */
> >>>> +     smp_mb();
> >>>> +
> >>>> +     ref_count = folio_ref_count(folio);
> >>>> +     map_count = folio_mapcount(folio);
> >>>> +
> >>>> +     /*
> >>>> +      * Order reads for folio refcount and dirty flag
> >>>> +      * (see comments in __remove_mapping()).
> >>>> +      */
> >>>> +     smp_rmb();
> >>>> +
> >>>> +     /*
> >>>> +      * If the PMD or folio is redirtied at this point, or if there are
> >>>> +      * unexpected references, we will give up to discard this folio
> >>>> +      * and remap it.
> >>>> +      *
> >>>> +      * The only folio refs must be one from isolation plus the rmap(s).
> >>>> +      */
> >>>> +     if (ref_count != map_count + 1 || folio_test_dirty(folio) ||
> >>>> +         pmd_dirty(orig_pmd)) {
> >>>> +             set_pmd_at(mm, addr, pmdp, orig_pmd);
> >>>> +             return false;
> >>>> +     }
> >>>> +
> >>>> +     folio_remove_rmap_pmd(folio, page, vma);
> >>>> +     zap_deposited_table(mm, pmdp);
> >>>> +     add_mm_counter(mm, MM_ANONPAGES, -HPAGE_PMD_NR);
> >>>> +     folio_put(folio);
> >>>
> >>> IIUC, you missed handling mlock vma, see mlock_drain_local() in
> >>> try_to_unmap_one().
> >>
> >> Good spot!
> >>
> >> I suddenly realized that I overlooked another thing: If we detect that a
> >> PMD-mapped THP is within the range of the VM_LOCKED VMA, we
> >> should check whether the TTU_IGNORE_MLOCK flag is set in
> >> try_to_unmap_one(). If the flag is set, we will remove the PMD mapping
> >> from the folio. Otherwise, the folio should be mlocked, which avoids
> >> splitting the folio and then mlocking each page again.
> >
> > My previous response above is flawed - sorry :(
> >
> > If we detect that a PMD-mapped THP is within the range of the
> > VM_LOCKED VMA.
> >
> > 1) If the TTU_IGNORE_MLOCK flag is set, we will try to remove the
> > PMD mapping from the folio, as this series has done.
>
> Right.
>
> > 2) If the flag is not set, the large folio should be mlocked to prevent it
> > from being picked during memory reclaim? Currently, we just leave it
>
> Yes. From commit 1acbc3f93614 ("mm: handle large folio when large folio
> in VM_LOCKED VMA range"), large folios of the mlocked VMA will be
> handled during page reclaim phase.
>
> > as is and do not to mlock it, IIUC.
>
> Original code already handle the mlock case after the PMD-mapped THP is
> split in try_to_unmap_one():

Yep. But this series doesn't do the TTU_SPLIT_HUGE_PMD immediately.

>                  /*
>                   * If the folio is in an mlock()d vma, we must not swap
> it out.
>                   */
>                  if (!(flags & TTU_IGNORE_MLOCK) &&
>                      (vma->vm_flags & VM_LOCKED)) {
>                          /* Restore the mlock which got missed */

IIUC, we could detect a PMD-mapped THP here. So, I'm not sure if we
need to mlock it to prevent it from being picked again during memory
reclaim. The change is as follows:

diff --git a/mm/rmap.c b/mm/rmap.c
index ed7f82036986..2a9d037ab23c 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1673,7 +1673,8 @@ static bool try_to_unmap_one(struct folio
*folio, struct vm_area_struct *vma,
                if (!(flags & TTU_IGNORE_MLOCK) &&
                    (vma->vm_flags & VM_LOCKED)) {
                        /* Restore the mlock which got missed */
-                       if (!folio_test_large(folio))
+                       if (!folio_test_large(folio) ||
+                           (!pvmw.pte && (flags & TTU_SPLIT_HUGE_PMD)))
                                mlock_vma_folio(folio, vma);
                        goto walk_done_err;
                }

Thanks,
Lance


>                          if (!folio_test_large(folio))
>                                  mlock_vma_folio(folio, vma);
>                          page_vma_mapped_walk_done(&pvmw);
>                          ret = false;
>                          break;
>                  }
Zi Yan May 7, 2024, 4:20 p.m. UTC | #6
On 1 May 2024, at 0:27, Lance Yang wrote:

> When the user no longer requires the pages, they would use
> madvise(MADV_FREE) to mark the pages as lazy free. Subsequently, they
> typically would not re-write to that memory again.
>
> During memory reclaim, if we detect that the large folio and its PMD are
> both still marked as clean and there are no unexpected references
> (such as GUP), so we can just discard the memory lazily, improving the
> efficiency of memory reclamation in this case.  On an Intel i5 CPU, reclaiming 1GiB of lazyfree THPs using
> mem_cgroup_force_empty() results in the following runtimes in seconds
> (shorter is better):
>
> --------------------------------------------
> |     Old       |      New       |  Change  |
> --------------------------------------------
> |   0.683426    |    0.049197    |  -92.80% |
> --------------------------------------------
>
> Suggested-by: Zi Yan <ziy@nvidia.com>
> Suggested-by: David Hildenbrand <david@redhat.com>
> Signed-off-by: Lance Yang <ioworker0@gmail.com>
> ---
>  include/linux/huge_mm.h |  9 +++++
>  mm/huge_memory.c        | 73 +++++++++++++++++++++++++++++++++++++++++
>  mm/rmap.c               |  3 ++
>  3 files changed, 85 insertions(+)
>
> diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
> index 38c4b5537715..017cee864080 100644
> --- a/include/linux/huge_mm.h
> +++ b/include/linux/huge_mm.h
> @@ -411,6 +411,8 @@ static inline bool thp_migration_supported(void)
>
>  void split_huge_pmd_locked(struct vm_area_struct *vma, unsigned long address,
>  			   pmd_t *pmd, bool freeze, struct folio *folio);
> +bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
> +			   pmd_t *pmdp, struct folio *folio);
>
>  static inline void align_huge_pmd_range(struct vm_area_struct *vma,
>  					unsigned long *start,
> @@ -492,6 +494,13 @@ static inline void align_huge_pmd_range(struct vm_area_struct *vma,
>  					unsigned long *start,
>  					unsigned long *end) {}
>
> +static inline bool unmap_huge_pmd_locked(struct vm_area_struct *vma,
> +					 unsigned long addr, pmd_t *pmdp,
> +					 struct folio *folio)
> +{
> +	return false;
> +}
> +
>  #define split_huge_pud(__vma, __pmd, __address)	\
>  	do { } while (0)
>
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 145505a1dd05..90fdef847a88 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -2690,6 +2690,79 @@ static void unmap_folio(struct folio *folio)
>  	try_to_unmap_flush();
>  }
>
> +static bool __discard_trans_pmd_locked(struct vm_area_struct *vma,
> +				       unsigned long addr, pmd_t *pmdp,
> +				       struct folio *folio)
> +{
> +	struct mm_struct *mm = vma->vm_mm;
> +	int ref_count, map_count;
> +	pmd_t orig_pmd = *pmdp;
> +	struct mmu_gather tlb;
> +	struct page *page;
> +
> +	if (pmd_dirty(orig_pmd) || folio_test_dirty(folio))
> +		return false;
> +	if (unlikely(!pmd_present(orig_pmd) || !pmd_trans_huge(orig_pmd)))
> +		return false;
> +
> +	page = pmd_page(orig_pmd);
> +	if (unlikely(page_folio(page) != folio))
> +		return false;
> +
> +	tlb_gather_mmu(&tlb, mm);
> +	orig_pmd = pmdp_huge_get_and_clear(mm, addr, pmdp);
> +	tlb_remove_pmd_tlb_entry(&tlb, pmdp, addr);
> +
> +	/*
> +	 * Syncing against concurrent GUP-fast:
> +	 * - clear PMD; barrier; read refcount
> +	 * - inc refcount; barrier; read PMD
> +	 */
> +	smp_mb();
> +
> +	ref_count = folio_ref_count(folio);
> +	map_count = folio_mapcount(folio);
> +
> +	/*
> +	 * Order reads for folio refcount and dirty flag
> +	 * (see comments in __remove_mapping()).
> +	 */
> +	smp_rmb();
> +
> +	/*
> +	 * If the PMD or folio is redirtied at this point, or if there are
> +	 * unexpected references, we will give up to discard this folio
> +	 * and remap it.
> +	 *
> +	 * The only folio refs must be one from isolation plus the rmap(s).
> +	 */
> +	if (ref_count != map_count + 1 || folio_test_dirty(folio) ||
> +	    pmd_dirty(orig_pmd)) {
> +		set_pmd_at(mm, addr, pmdp, orig_pmd);
> +		return false;
> +	}
> +
> +	folio_remove_rmap_pmd(folio, page, vma);
> +	zap_deposited_table(mm, pmdp);
> +	add_mm_counter(mm, MM_ANONPAGES, -HPAGE_PMD_NR);
> +	folio_put(folio);
> +
> +	return true;
> +}
> +
> +bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
> +			   pmd_t *pmdp, struct folio *folio)
> +{
> +	VM_WARN_ON_FOLIO(!folio_test_pmd_mappable(folio), folio);
> +	VM_WARN_ON_FOLIO(!folio_test_locked(folio), folio);
> +	VM_WARN_ON_ONCE(!IS_ALIGNED(addr, HPAGE_PMD_SIZE));
> +
> +	if (folio_test_anon(folio) && !folio_test_swapbacked(folio))
> +		return __discard_trans_pmd_locked(vma, addr, pmdp, folio);
> +
> +	return false;
> +}
> +
>  static void remap_page(struct folio *folio, unsigned long nr)
>  {
>  	int i = 0;
> diff --git a/mm/rmap.c b/mm/rmap.c
> index 432601154583..1d3d30cb752c 100644
> --- a/mm/rmap.c
> +++ b/mm/rmap.c
> @@ -1675,6 +1675,9 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma,
>  		}
>
>  		if (!pvmw.pte && (flags & TTU_SPLIT_HUGE_PMD)) {
> +			if (unmap_huge_pmd_locked(vma, range.start, pvmw.pmd,
> +						  folio))
> +				goto walk_done;

You might not need to check (flags & TTU_SPLIT_HUGE_PMD) for
unmap_huge_pmd_locked(), since you are unmapping a PMD here.
TTU_SPLIT_HUGE_PMD is here because try_to_unmap_one() was not able to unmap
a PMD. You probably can remove it for callers that are unmapping
the folio but not the ones are swapping.



>  			/*
>  			 * We temporarily have to drop the PTL and start once
>  			 * again from that now-PTE-mapped page table.
> -- 
> 2.33.1


--
Best Regards,
Yan, Zi
Lance Yang May 8, 2024, 5:14 a.m. UTC | #7
Hey Zi,

Thanks for taking time to review!

On Wed, May 8, 2024 at 12:20 AM Zi Yan <ziy@nvidia.com> wrote:
>
> On 1 May 2024, at 0:27, Lance Yang wrote:
>
> > When the user no longer requires the pages, they would use
> > madvise(MADV_FREE) to mark the pages as lazy free. Subsequently, they
> > typically would not re-write to that memory again.
> >
> > During memory reclaim, if we detect that the large folio and its PMD are
> > both still marked as clean and there are no unexpected references
> > (such as GUP), so we can just discard the memory lazily, improving the
> > efficiency of memory reclamation in this case.  On an Intel i5 CPU, reclaiming 1GiB of lazyfree THPs using
> > mem_cgroup_force_empty() results in the following runtimes in seconds
> > (shorter is better):
> >
> > --------------------------------------------
> > |     Old       |      New       |  Change  |
> > --------------------------------------------
> > |   0.683426    |    0.049197    |  -92.80% |
> > --------------------------------------------
> >
> > Suggested-by: Zi Yan <ziy@nvidia.com>
> > Suggested-by: David Hildenbrand <david@redhat.com>
> > Signed-off-by: Lance Yang <ioworker0@gmail.com>
> > ---
> >  include/linux/huge_mm.h |  9 +++++
> >  mm/huge_memory.c        | 73 +++++++++++++++++++++++++++++++++++++++++
> >  mm/rmap.c               |  3 ++
> >  3 files changed, 85 insertions(+)
> >
> > diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
> > index 38c4b5537715..017cee864080 100644
> > --- a/include/linux/huge_mm.h
> > +++ b/include/linux/huge_mm.h
> > @@ -411,6 +411,8 @@ static inline bool thp_migration_supported(void)
> >
> >  void split_huge_pmd_locked(struct vm_area_struct *vma, unsigned long address,
> >                          pmd_t *pmd, bool freeze, struct folio *folio);
> > +bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
> > +                        pmd_t *pmdp, struct folio *folio);
> >
> >  static inline void align_huge_pmd_range(struct vm_area_struct *vma,
> >                                       unsigned long *start,
> > @@ -492,6 +494,13 @@ static inline void align_huge_pmd_range(struct vm_area_struct *vma,
> >                                       unsigned long *start,
> >                                       unsigned long *end) {}
> >
> > +static inline bool unmap_huge_pmd_locked(struct vm_area_struct *vma,
> > +                                      unsigned long addr, pmd_t *pmdp,
> > +                                      struct folio *folio)
> > +{
> > +     return false;
> > +}
> > +
> >  #define split_huge_pud(__vma, __pmd, __address)      \
> >       do { } while (0)
> >
> > diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> > index 145505a1dd05..90fdef847a88 100644
> > --- a/mm/huge_memory.c
> > +++ b/mm/huge_memory.c
> > @@ -2690,6 +2690,79 @@ static void unmap_folio(struct folio *folio)
> >       try_to_unmap_flush();
> >  }
> >
> > +static bool __discard_trans_pmd_locked(struct vm_area_struct *vma,
> > +                                    unsigned long addr, pmd_t *pmdp,
> > +                                    struct folio *folio)
> > +{
> > +     struct mm_struct *mm = vma->vm_mm;
> > +     int ref_count, map_count;
> > +     pmd_t orig_pmd = *pmdp;
> > +     struct mmu_gather tlb;
> > +     struct page *page;
> > +
> > +     if (pmd_dirty(orig_pmd) || folio_test_dirty(folio))
> > +             return false;
> > +     if (unlikely(!pmd_present(orig_pmd) || !pmd_trans_huge(orig_pmd)))
> > +             return false;
> > +
> > +     page = pmd_page(orig_pmd);
> > +     if (unlikely(page_folio(page) != folio))
> > +             return false;
> > +
> > +     tlb_gather_mmu(&tlb, mm);
> > +     orig_pmd = pmdp_huge_get_and_clear(mm, addr, pmdp);
> > +     tlb_remove_pmd_tlb_entry(&tlb, pmdp, addr);
> > +
> > +     /*
> > +      * Syncing against concurrent GUP-fast:
> > +      * - clear PMD; barrier; read refcount
> > +      * - inc refcount; barrier; read PMD
> > +      */
> > +     smp_mb();
> > +
> > +     ref_count = folio_ref_count(folio);
> > +     map_count = folio_mapcount(folio);
> > +
> > +     /*
> > +      * Order reads for folio refcount and dirty flag
> > +      * (see comments in __remove_mapping()).
> > +      */
> > +     smp_rmb();
> > +
> > +     /*
> > +      * If the PMD or folio is redirtied at this point, or if there are
> > +      * unexpected references, we will give up to discard this folio
> > +      * and remap it.
> > +      *
> > +      * The only folio refs must be one from isolation plus the rmap(s).
> > +      */
> > +     if (ref_count != map_count + 1 || folio_test_dirty(folio) ||
> > +         pmd_dirty(orig_pmd)) {
> > +             set_pmd_at(mm, addr, pmdp, orig_pmd);
> > +             return false;
> > +     }
> > +
> > +     folio_remove_rmap_pmd(folio, page, vma);
> > +     zap_deposited_table(mm, pmdp);
> > +     add_mm_counter(mm, MM_ANONPAGES, -HPAGE_PMD_NR);
> > +     folio_put(folio);
> > +
> > +     return true;
> > +}
> > +
> > +bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
> > +                        pmd_t *pmdp, struct folio *folio)
> > +{
> > +     VM_WARN_ON_FOLIO(!folio_test_pmd_mappable(folio), folio);
> > +     VM_WARN_ON_FOLIO(!folio_test_locked(folio), folio);
> > +     VM_WARN_ON_ONCE(!IS_ALIGNED(addr, HPAGE_PMD_SIZE));
> > +
> > +     if (folio_test_anon(folio) && !folio_test_swapbacked(folio))
> > +             return __discard_trans_pmd_locked(vma, addr, pmdp, folio);
> > +
> > +     return false;
> > +}
> > +
> >  static void remap_page(struct folio *folio, unsigned long nr)
> >  {
> >       int i = 0;
> > diff --git a/mm/rmap.c b/mm/rmap.c
> > index 432601154583..1d3d30cb752c 100644
> > --- a/mm/rmap.c
> > +++ b/mm/rmap.c
> > @@ -1675,6 +1675,9 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma,
> >               }
> >
> >               if (!pvmw.pte && (flags & TTU_SPLIT_HUGE_PMD)) {
> > +                     if (unmap_huge_pmd_locked(vma, range.start, pvmw.pmd,
> > +                                               folio))
> > +                             goto walk_done;
>
> You might not need to check (flags & TTU_SPLIT_HUGE_PMD) for
> unmap_huge_pmd_locked(), since you are unmapping a PMD here.
> TTU_SPLIT_HUGE_PMD is here because try_to_unmap_one() was not able to unmap
> a PMD. You probably can remove it for callers that are unmapping
> the folio but not the ones are swapping.

Thanks for the suggestion!

Ageed. For unmap_huge_pmd_locked(), there is no need to check the
TTU_SPLIT_HUGE_PMD flag. We only need to check the flag for
split_huge_pmd_locked().

Given this, if we fail to remove the PMD mapping and the flag is not set,
I think we should stop the walk. So we can also remove the
VM_BUG_ON_FOLIO() below.

/* Unexpected PMD-mapped THP? */
VM_BUG_ON_FOLIO(!pvmw.pte, folio);

Zi, what do you think?

Thanks,
Lance

>
>
>
> >                       /*
> >                        * We temporarily have to drop the PTL and start once
> >                        * again from that now-PTE-mapped page table.
> > --
> > 2.33.1
>
>
> --
> Best Regards,
> Yan, Zi
Baolin Wang May 9, 2024, 9:36 a.m. UTC | #8
On 2024/5/7 19:37, Lance Yang wrote:
> On Tue, May 7, 2024 at 5:33 PM Baolin Wang
> <baolin.wang@linux.alibaba.com> wrote:
>>
>>
>>
>> On 2024/5/7 16:26, Lance Yang wrote:
>>> On Tue, May 7, 2024 at 2:32 PM Lance Yang <ioworker0@gmail.com> wrote:
>>>>
>>>> Hey Baolin,
>>>>
>>>> Thanks a lot for taking time to review!
>>>>
>>>> On Tue, May 7, 2024 at 12:01 PM Baolin Wang
>>>> <baolin.wang@linux.alibaba.com> wrote:
>>>>>
>>>>>
>>>>>
>>>>> On 2024/5/1 12:27, Lance Yang wrote:
>>>>>> When the user no longer requires the pages, they would use
>>>>>> madvise(MADV_FREE) to mark the pages as lazy free. Subsequently, they
>>>>>> typically would not re-write to that memory again.
>>>>>>
>>>>>> During memory reclaim, if we detect that the large folio and its PMD are
>>>>>> both still marked as clean and there are no unexpected references
>>>>>> (such as GUP), so we can just discard the memory lazily, improving the
>>>>>> efficiency of memory reclamation in this case.  On an Intel i5 CPU, reclaiming 1GiB of lazyfree THPs using
>>>>>> mem_cgroup_force_empty() results in the following runtimes in seconds
>>>>>> (shorter is better):
>>>>>>
>>>>>> --------------------------------------------
>>>>>> |     Old       |      New       |  Change  |
>>>>>> --------------------------------------------
>>>>>> |   0.683426    |    0.049197    |  -92.80% |
>>>>>> --------------------------------------------
>>>>>>
>>>>>> Suggested-by: Zi Yan <ziy@nvidia.com>
>>>>>> Suggested-by: David Hildenbrand <david@redhat.com>
>>>>>> Signed-off-by: Lance Yang <ioworker0@gmail.com>
>>>>>> ---
>>>>>>     include/linux/huge_mm.h |  9 +++++
>>>>>>     mm/huge_memory.c        | 73 +++++++++++++++++++++++++++++++++++++++++
>>>>>>     mm/rmap.c               |  3 ++
>>>>>>     3 files changed, 85 insertions(+)
>>>>>>
>>>>>> diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
>>>>>> index 38c4b5537715..017cee864080 100644
>>>>>> --- a/include/linux/huge_mm.h
>>>>>> +++ b/include/linux/huge_mm.h
>>>>>> @@ -411,6 +411,8 @@ static inline bool thp_migration_supported(void)
>>>>>>
>>>>>>     void split_huge_pmd_locked(struct vm_area_struct *vma, unsigned long address,
>>>>>>                            pmd_t *pmd, bool freeze, struct folio *folio);
>>>>>> +bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
>>>>>> +                        pmd_t *pmdp, struct folio *folio);
>>>>>>
>>>>>>     static inline void align_huge_pmd_range(struct vm_area_struct *vma,
>>>>>>                                         unsigned long *start,
>>>>>> @@ -492,6 +494,13 @@ static inline void align_huge_pmd_range(struct vm_area_struct *vma,
>>>>>>                                         unsigned long *start,
>>>>>>                                         unsigned long *end) {}
>>>>>>
>>>>>> +static inline bool unmap_huge_pmd_locked(struct vm_area_struct *vma,
>>>>>> +                                      unsigned long addr, pmd_t *pmdp,
>>>>>> +                                      struct folio *folio)
>>>>>> +{
>>>>>> +     return false;
>>>>>> +}
>>>>>> +
>>>>>>     #define split_huge_pud(__vma, __pmd, __address)     \
>>>>>>         do { } while (0)
>>>>>>
>>>>>> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
>>>>>> index 145505a1dd05..90fdef847a88 100644
>>>>>> --- a/mm/huge_memory.c
>>>>>> +++ b/mm/huge_memory.c
>>>>>> @@ -2690,6 +2690,79 @@ static void unmap_folio(struct folio *folio)
>>>>>>         try_to_unmap_flush();
>>>>>>     }
>>>>>>
>>>>>> +static bool __discard_trans_pmd_locked(struct vm_area_struct *vma,
>>>>>> +                                    unsigned long addr, pmd_t *pmdp,
>>>>>> +                                    struct folio *folio)
>>>>>> +{
>>>>>> +     struct mm_struct *mm = vma->vm_mm;
>>>>>> +     int ref_count, map_count;
>>>>>> +     pmd_t orig_pmd = *pmdp;
>>>>>> +     struct mmu_gather tlb;
>>>>>> +     struct page *page;
>>>>>> +
>>>>>> +     if (pmd_dirty(orig_pmd) || folio_test_dirty(folio))
>>>>>> +             return false;
>>>>>> +     if (unlikely(!pmd_present(orig_pmd) || !pmd_trans_huge(orig_pmd)))
>>>>>> +             return false;
>>>>>> +
>>>>>> +     page = pmd_page(orig_pmd);
>>>>>> +     if (unlikely(page_folio(page) != folio))
>>>>>> +             return false;
>>>>>> +
>>>>>> +     tlb_gather_mmu(&tlb, mm);
>>>>>> +     orig_pmd = pmdp_huge_get_and_clear(mm, addr, pmdp);
>>>>>> +     tlb_remove_pmd_tlb_entry(&tlb, pmdp, addr);
>>>>>> +
>>>>>> +     /*
>>>>>> +      * Syncing against concurrent GUP-fast:
>>>>>> +      * - clear PMD; barrier; read refcount
>>>>>> +      * - inc refcount; barrier; read PMD
>>>>>> +      */
>>>>>> +     smp_mb();
>>>>>> +
>>>>>> +     ref_count = folio_ref_count(folio);
>>>>>> +     map_count = folio_mapcount(folio);
>>>>>> +
>>>>>> +     /*
>>>>>> +      * Order reads for folio refcount and dirty flag
>>>>>> +      * (see comments in __remove_mapping()).
>>>>>> +      */
>>>>>> +     smp_rmb();
>>>>>> +
>>>>>> +     /*
>>>>>> +      * If the PMD or folio is redirtied at this point, or if there are
>>>>>> +      * unexpected references, we will give up to discard this folio
>>>>>> +      * and remap it.
>>>>>> +      *
>>>>>> +      * The only folio refs must be one from isolation plus the rmap(s).
>>>>>> +      */
>>>>>> +     if (ref_count != map_count + 1 || folio_test_dirty(folio) ||
>>>>>> +         pmd_dirty(orig_pmd)) {
>>>>>> +             set_pmd_at(mm, addr, pmdp, orig_pmd);
>>>>>> +             return false;
>>>>>> +     }
>>>>>> +
>>>>>> +     folio_remove_rmap_pmd(folio, page, vma);
>>>>>> +     zap_deposited_table(mm, pmdp);
>>>>>> +     add_mm_counter(mm, MM_ANONPAGES, -HPAGE_PMD_NR);
>>>>>> +     folio_put(folio);
>>>>>
>>>>> IIUC, you missed handling mlock vma, see mlock_drain_local() in
>>>>> try_to_unmap_one().
>>>>
>>>> Good spot!
>>>>
>>>> I suddenly realized that I overlooked another thing: If we detect that a
>>>> PMD-mapped THP is within the range of the VM_LOCKED VMA, we
>>>> should check whether the TTU_IGNORE_MLOCK flag is set in
>>>> try_to_unmap_one(). If the flag is set, we will remove the PMD mapping
>>>> from the folio. Otherwise, the folio should be mlocked, which avoids
>>>> splitting the folio and then mlocking each page again.
>>>
>>> My previous response above is flawed - sorry :(
>>>
>>> If we detect that a PMD-mapped THP is within the range of the
>>> VM_LOCKED VMA.
>>>
>>> 1) If the TTU_IGNORE_MLOCK flag is set, we will try to remove the
>>> PMD mapping from the folio, as this series has done.
>>
>> Right.
>>
>>> 2) If the flag is not set, the large folio should be mlocked to prevent it
>>> from being picked during memory reclaim? Currently, we just leave it
>>
>> Yes. From commit 1acbc3f93614 ("mm: handle large folio when large folio
>> in VM_LOCKED VMA range"), large folios of the mlocked VMA will be
>> handled during page reclaim phase.
>>
>>> as is and do not to mlock it, IIUC.
>>
>> Original code already handle the mlock case after the PMD-mapped THP is
>> split in try_to_unmap_one():
> 
> Yep. But this series doesn't do the TTU_SPLIT_HUGE_PMD immediately.
> 
>>                   /*
>>                    * If the folio is in an mlock()d vma, we must not swap
>> it out.
>>                    */
>>                   if (!(flags & TTU_IGNORE_MLOCK) &&
>>                       (vma->vm_flags & VM_LOCKED)) {
>>                           /* Restore the mlock which got missed */
> 
> IIUC, we could detect a PMD-mapped THP here. So, I'm not sure if we
> need to mlock it to prevent it from being picked again during memory
> reclaim. The change is as follows:

For the page reclaim path, folio_check_references() should be able to 
help restore the mlock of the PMD-mapped THP. However, for other paths 
that call try_to_unmap(), I believe it is still necessary to check 
whether the mlock of the PMD-mapped THP was missed.

Below code looks reasonable to me from a quick glance.

> diff --git a/mm/rmap.c b/mm/rmap.c
> index ed7f82036986..2a9d037ab23c 100644
> --- a/mm/rmap.c
> +++ b/mm/rmap.c
> @@ -1673,7 +1673,8 @@ static bool try_to_unmap_one(struct folio
> *folio, struct vm_area_struct *vma,
>                  if (!(flags & TTU_IGNORE_MLOCK) &&
>                      (vma->vm_flags & VM_LOCKED)) {
>                          /* Restore the mlock which got missed */
> -                       if (!folio_test_large(folio))
> +                       if (!folio_test_large(folio) ||
> +                           (!pvmw.pte && (flags & TTU_SPLIT_HUGE_PMD)))
>                                  mlock_vma_folio(folio, vma);
>                          goto walk_done_err;
>                  }
>
Lance Yang May 9, 2024, 12:17 p.m. UTC | #9
On Thu, May 9, 2024 at 5:36 PM Baolin Wang
<baolin.wang@linux.alibaba.com> wrote:
>
>
>
> On 2024/5/7 19:37, Lance Yang wrote:
> > On Tue, May 7, 2024 at 5:33 PM Baolin Wang
> > <baolin.wang@linux.alibaba.com> wrote:
> >>
> >>
> >>
> >> On 2024/5/7 16:26, Lance Yang wrote:
> >>> On Tue, May 7, 2024 at 2:32 PM Lance Yang <ioworker0@gmail.com> wrote:
> >>>>
> >>>> Hey Baolin,
> >>>>
> >>>> Thanks a lot for taking time to review!
> >>>>
> >>>> On Tue, May 7, 2024 at 12:01 PM Baolin Wang
> >>>> <baolin.wang@linux.alibaba.com> wrote:
> >>>>>
> >>>>>
> >>>>>
> >>>>> On 2024/5/1 12:27, Lance Yang wrote:
> >>>>>> When the user no longer requires the pages, they would use
> >>>>>> madvise(MADV_FREE) to mark the pages as lazy free. Subsequently, they
> >>>>>> typically would not re-write to that memory again.
> >>>>>>
> >>>>>> During memory reclaim, if we detect that the large folio and its PMD are
> >>>>>> both still marked as clean and there are no unexpected references
> >>>>>> (such as GUP), so we can just discard the memory lazily, improving the
> >>>>>> efficiency of memory reclamation in this case.  On an Intel i5 CPU, reclaiming 1GiB of lazyfree THPs using
> >>>>>> mem_cgroup_force_empty() results in the following runtimes in seconds
> >>>>>> (shorter is better):
> >>>>>>
> >>>>>> --------------------------------------------
> >>>>>> |     Old       |      New       |  Change  |
> >>>>>> --------------------------------------------
> >>>>>> |   0.683426    |    0.049197    |  -92.80% |
> >>>>>> --------------------------------------------
> >>>>>>
> >>>>>> Suggested-by: Zi Yan <ziy@nvidia.com>
> >>>>>> Suggested-by: David Hildenbrand <david@redhat.com>
> >>>>>> Signed-off-by: Lance Yang <ioworker0@gmail.com>
> >>>>>> ---
> >>>>>>     include/linux/huge_mm.h |  9 +++++
> >>>>>>     mm/huge_memory.c        | 73 +++++++++++++++++++++++++++++++++++++++++
> >>>>>>     mm/rmap.c               |  3 ++
> >>>>>>     3 files changed, 85 insertions(+)
> >>>>>>
> >>>>>> diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
> >>>>>> index 38c4b5537715..017cee864080 100644
> >>>>>> --- a/include/linux/huge_mm.h
> >>>>>> +++ b/include/linux/huge_mm.h
> >>>>>> @@ -411,6 +411,8 @@ static inline bool thp_migration_supported(void)
> >>>>>>
> >>>>>>     void split_huge_pmd_locked(struct vm_area_struct *vma, unsigned long address,
> >>>>>>                            pmd_t *pmd, bool freeze, struct folio *folio);
> >>>>>> +bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
> >>>>>> +                        pmd_t *pmdp, struct folio *folio);
> >>>>>>
> >>>>>>     static inline void align_huge_pmd_range(struct vm_area_struct *vma,
> >>>>>>                                         unsigned long *start,
> >>>>>> @@ -492,6 +494,13 @@ static inline void align_huge_pmd_range(struct vm_area_struct *vma,
> >>>>>>                                         unsigned long *start,
> >>>>>>                                         unsigned long *end) {}
> >>>>>>
> >>>>>> +static inline bool unmap_huge_pmd_locked(struct vm_area_struct *vma,
> >>>>>> +                                      unsigned long addr, pmd_t *pmdp,
> >>>>>> +                                      struct folio *folio)
> >>>>>> +{
> >>>>>> +     return false;
> >>>>>> +}
> >>>>>> +
> >>>>>>     #define split_huge_pud(__vma, __pmd, __address)     \
> >>>>>>         do { } while (0)
> >>>>>>
> >>>>>> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> >>>>>> index 145505a1dd05..90fdef847a88 100644
> >>>>>> --- a/mm/huge_memory.c
> >>>>>> +++ b/mm/huge_memory.c
> >>>>>> @@ -2690,6 +2690,79 @@ static void unmap_folio(struct folio *folio)
> >>>>>>         try_to_unmap_flush();
> >>>>>>     }
> >>>>>>
> >>>>>> +static bool __discard_trans_pmd_locked(struct vm_area_struct *vma,
> >>>>>> +                                    unsigned long addr, pmd_t *pmdp,
> >>>>>> +                                    struct folio *folio)
> >>>>>> +{
> >>>>>> +     struct mm_struct *mm = vma->vm_mm;
> >>>>>> +     int ref_count, map_count;
> >>>>>> +     pmd_t orig_pmd = *pmdp;
> >>>>>> +     struct mmu_gather tlb;
> >>>>>> +     struct page *page;
> >>>>>> +
> >>>>>> +     if (pmd_dirty(orig_pmd) || folio_test_dirty(folio))
> >>>>>> +             return false;
> >>>>>> +     if (unlikely(!pmd_present(orig_pmd) || !pmd_trans_huge(orig_pmd)))
> >>>>>> +             return false;
> >>>>>> +
> >>>>>> +     page = pmd_page(orig_pmd);
> >>>>>> +     if (unlikely(page_folio(page) != folio))
> >>>>>> +             return false;
> >>>>>> +
> >>>>>> +     tlb_gather_mmu(&tlb, mm);
> >>>>>> +     orig_pmd = pmdp_huge_get_and_clear(mm, addr, pmdp);
> >>>>>> +     tlb_remove_pmd_tlb_entry(&tlb, pmdp, addr);
> >>>>>> +
> >>>>>> +     /*
> >>>>>> +      * Syncing against concurrent GUP-fast:
> >>>>>> +      * - clear PMD; barrier; read refcount
> >>>>>> +      * - inc refcount; barrier; read PMD
> >>>>>> +      */
> >>>>>> +     smp_mb();
> >>>>>> +
> >>>>>> +     ref_count = folio_ref_count(folio);
> >>>>>> +     map_count = folio_mapcount(folio);
> >>>>>> +
> >>>>>> +     /*
> >>>>>> +      * Order reads for folio refcount and dirty flag
> >>>>>> +      * (see comments in __remove_mapping()).
> >>>>>> +      */
> >>>>>> +     smp_rmb();
> >>>>>> +
> >>>>>> +     /*
> >>>>>> +      * If the PMD or folio is redirtied at this point, or if there are
> >>>>>> +      * unexpected references, we will give up to discard this folio
> >>>>>> +      * and remap it.
> >>>>>> +      *
> >>>>>> +      * The only folio refs must be one from isolation plus the rmap(s).
> >>>>>> +      */
> >>>>>> +     if (ref_count != map_count + 1 || folio_test_dirty(folio) ||
> >>>>>> +         pmd_dirty(orig_pmd)) {
> >>>>>> +             set_pmd_at(mm, addr, pmdp, orig_pmd);
> >>>>>> +             return false;
> >>>>>> +     }
> >>>>>> +
> >>>>>> +     folio_remove_rmap_pmd(folio, page, vma);
> >>>>>> +     zap_deposited_table(mm, pmdp);
> >>>>>> +     add_mm_counter(mm, MM_ANONPAGES, -HPAGE_PMD_NR);
> >>>>>> +     folio_put(folio);
> >>>>>
> >>>>> IIUC, you missed handling mlock vma, see mlock_drain_local() in
> >>>>> try_to_unmap_one().
> >>>>
> >>>> Good spot!
> >>>>
> >>>> I suddenly realized that I overlooked another thing: If we detect that a
> >>>> PMD-mapped THP is within the range of the VM_LOCKED VMA, we
> >>>> should check whether the TTU_IGNORE_MLOCK flag is set in
> >>>> try_to_unmap_one(). If the flag is set, we will remove the PMD mapping
> >>>> from the folio. Otherwise, the folio should be mlocked, which avoids
> >>>> splitting the folio and then mlocking each page again.
> >>>
> >>> My previous response above is flawed - sorry :(
> >>>
> >>> If we detect that a PMD-mapped THP is within the range of the
> >>> VM_LOCKED VMA.
> >>>
> >>> 1) If the TTU_IGNORE_MLOCK flag is set, we will try to remove the
> >>> PMD mapping from the folio, as this series has done.
> >>
> >> Right.
> >>
> >>> 2) If the flag is not set, the large folio should be mlocked to prevent it
> >>> from being picked during memory reclaim? Currently, we just leave it
> >>
> >> Yes. From commit 1acbc3f93614 ("mm: handle large folio when large folio
> >> in VM_LOCKED VMA range"), large folios of the mlocked VMA will be
> >> handled during page reclaim phase.
> >>
> >>> as is and do not to mlock it, IIUC.
> >>
> >> Original code already handle the mlock case after the PMD-mapped THP is
> >> split in try_to_unmap_one():
> >
> > Yep. But this series doesn't do the TTU_SPLIT_HUGE_PMD immediately.
> >
> >>                   /*
> >>                    * If the folio is in an mlock()d vma, we must not swap
> >> it out.
> >>                    */
> >>                   if (!(flags & TTU_IGNORE_MLOCK) &&
> >>                       (vma->vm_flags & VM_LOCKED)) {
> >>                           /* Restore the mlock which got missed */
> >
> > IIUC, we could detect a PMD-mapped THP here. So, I'm not sure if we
> > need to mlock it to prevent it from being picked again during memory
> > reclaim. The change is as follows:
>
> For the page reclaim path, folio_check_references() should be able to
> help restore the mlock of the PMD-mapped THP. However, for other paths

I understood, thanks for clarifying!

> that call try_to_unmap(), I believe it is still necessary to check
> whether the mlock of the PMD-mapped THP was missed.

Yeah, agreed!

The TTU_SPLIT_HUGE_PMD will no longer perform immediately, so we
might encounter a PMD-mapped THP missing the mlock in the VM_LOCKED
range during the pagewalk. It's likely necessary to mlock this THP to prevent
it from being picked up during page reclaim.

Given this, I'll include the change below in the next version.

>
> Below code looks reasonable to me from a quick glance.

Thanks again for the review!
Lance

>
> > diff --git a/mm/rmap.c b/mm/rmap.c
> > index ed7f82036986..2a9d037ab23c 100644
> > --- a/mm/rmap.c
> > +++ b/mm/rmap.c
> > @@ -1673,7 +1673,8 @@ static bool try_to_unmap_one(struct folio
> > *folio, struct vm_area_struct *vma,
> >                  if (!(flags & TTU_IGNORE_MLOCK) &&
> >                      (vma->vm_flags & VM_LOCKED)) {
> >                          /* Restore the mlock which got missed */
> > -                       if (!folio_test_large(folio))
> > +                       if (!folio_test_large(folio) ||
> > +                           (!pvmw.pte && (flags & TTU_SPLIT_HUGE_PMD)))
> >                                  mlock_vma_folio(folio, vma);
> >                          goto walk_done_err;
> >                  }
> >
>
diff mbox series

Patch

diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
index 38c4b5537715..017cee864080 100644
--- a/include/linux/huge_mm.h
+++ b/include/linux/huge_mm.h
@@ -411,6 +411,8 @@  static inline bool thp_migration_supported(void)
 
 void split_huge_pmd_locked(struct vm_area_struct *vma, unsigned long address,
 			   pmd_t *pmd, bool freeze, struct folio *folio);
+bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
+			   pmd_t *pmdp, struct folio *folio);
 
 static inline void align_huge_pmd_range(struct vm_area_struct *vma,
 					unsigned long *start,
@@ -492,6 +494,13 @@  static inline void align_huge_pmd_range(struct vm_area_struct *vma,
 					unsigned long *start,
 					unsigned long *end) {}
 
+static inline bool unmap_huge_pmd_locked(struct vm_area_struct *vma,
+					 unsigned long addr, pmd_t *pmdp,
+					 struct folio *folio)
+{
+	return false;
+}
+
 #define split_huge_pud(__vma, __pmd, __address)	\
 	do { } while (0)
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 145505a1dd05..90fdef847a88 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2690,6 +2690,79 @@  static void unmap_folio(struct folio *folio)
 	try_to_unmap_flush();
 }
 
+static bool __discard_trans_pmd_locked(struct vm_area_struct *vma,
+				       unsigned long addr, pmd_t *pmdp,
+				       struct folio *folio)
+{
+	struct mm_struct *mm = vma->vm_mm;
+	int ref_count, map_count;
+	pmd_t orig_pmd = *pmdp;
+	struct mmu_gather tlb;
+	struct page *page;
+
+	if (pmd_dirty(orig_pmd) || folio_test_dirty(folio))
+		return false;
+	if (unlikely(!pmd_present(orig_pmd) || !pmd_trans_huge(orig_pmd)))
+		return false;
+
+	page = pmd_page(orig_pmd);
+	if (unlikely(page_folio(page) != folio))
+		return false;
+
+	tlb_gather_mmu(&tlb, mm);
+	orig_pmd = pmdp_huge_get_and_clear(mm, addr, pmdp);
+	tlb_remove_pmd_tlb_entry(&tlb, pmdp, addr);
+
+	/*
+	 * Syncing against concurrent GUP-fast:
+	 * - clear PMD; barrier; read refcount
+	 * - inc refcount; barrier; read PMD
+	 */
+	smp_mb();
+
+	ref_count = folio_ref_count(folio);
+	map_count = folio_mapcount(folio);
+
+	/*
+	 * Order reads for folio refcount and dirty flag
+	 * (see comments in __remove_mapping()).
+	 */
+	smp_rmb();
+
+	/*
+	 * If the PMD or folio is redirtied at this point, or if there are
+	 * unexpected references, we will give up to discard this folio
+	 * and remap it.
+	 *
+	 * The only folio refs must be one from isolation plus the rmap(s).
+	 */
+	if (ref_count != map_count + 1 || folio_test_dirty(folio) ||
+	    pmd_dirty(orig_pmd)) {
+		set_pmd_at(mm, addr, pmdp, orig_pmd);
+		return false;
+	}
+
+	folio_remove_rmap_pmd(folio, page, vma);
+	zap_deposited_table(mm, pmdp);
+	add_mm_counter(mm, MM_ANONPAGES, -HPAGE_PMD_NR);
+	folio_put(folio);
+
+	return true;
+}
+
+bool unmap_huge_pmd_locked(struct vm_area_struct *vma, unsigned long addr,
+			   pmd_t *pmdp, struct folio *folio)
+{
+	VM_WARN_ON_FOLIO(!folio_test_pmd_mappable(folio), folio);
+	VM_WARN_ON_FOLIO(!folio_test_locked(folio), folio);
+	VM_WARN_ON_ONCE(!IS_ALIGNED(addr, HPAGE_PMD_SIZE));
+
+	if (folio_test_anon(folio) && !folio_test_swapbacked(folio))
+		return __discard_trans_pmd_locked(vma, addr, pmdp, folio);
+
+	return false;
+}
+
 static void remap_page(struct folio *folio, unsigned long nr)
 {
 	int i = 0;
diff --git a/mm/rmap.c b/mm/rmap.c
index 432601154583..1d3d30cb752c 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1675,6 +1675,9 @@  static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma,
 		}
 
 		if (!pvmw.pte && (flags & TTU_SPLIT_HUGE_PMD)) {
+			if (unmap_huge_pmd_locked(vma, range.start, pvmw.pmd,
+						  folio))
+				goto walk_done;
 			/*
 			 * We temporarily have to drop the PTL and start once
 			 * again from that now-PTE-mapped page table.