Received-SPF: pass (google.com: domain of linux-kernel+bounces-95417-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Precedence: bulk
MIME-Version: 1.0
References: <20240307061425.21013-1-ioworker0@gmail.com> <CAGsJ_4xcRvZGdpPh1qcFTnTnDUbwz6WreQ=L_UO+oU2iFm9EPg@mail.gmail.com>
 <CAK1f24k2G_DSEjuqqqPyY0f7+btpYbjfoyMH7btLfP8nkasCTQ@mail.gmail.com>
 <CAGsJ_4xREM-P1mFqeM-s3-cJ9czb6PXwizb-3hOhwaF6+QM5QA@mail.gmail.com>
 <03458c20-5544-411b-9b8d-b4600a9b802f@arm.com> <CAGsJ_4zp1MXTjG=4gBO+J3owg7sHDgDJ8Ut51i1RBSnKnK0BfQ@mail.gmail.com>
 <501c9f77-1459-467a-8619-78e86b46d300@arm.com> <8f84c7d6-982a-4933-a7a7-3f640df64991@redhat.com>
 <e6bc142e-113d-4034-b92c-746b951a27ed@redhat.com> <d24f8553-33f2-4ae7-a06d-badaf9462d84@arm.com>
In-Reply-To: <d24f8553-33f2-4ae7-a06d-badaf9462d84@arm.com>
From: Barry Song <21cnbao@gmail.com>
Date: Thu, 7 Mar 2024 19:26:49 +0800
Message-ID: <CAGsJ_4za-2xpg21phWi2WWLF1iPXhoc1xM__FDTwYYBBKsTPgw@mail.gmail.com>
Subject: Re: [PATCH v2 1/1] mm/madvise: enhance lazyfreeing with mTHP in madvise_free
To: Ryan Roberts <ryan.roberts@arm.com>
Cc: David Hildenbrand <david@redhat.com>, Lance Yang <ioworker0@gmail.com>, 
	Vishal Moola <vishal.moola@gmail.com>, akpm@linux-foundation.org, zokeefe@google.com, 
	shy828301@gmail.com, mhocko@suse.com, fengwei.yin@intel.com, 
	xiehuan09@gmail.com, wangkefeng.wang@huawei.com, songmuchun@bytedance.com, 
	peterx@redhat.com, minchan@kernel.org, linux-mm@kvack.org, 
	linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, Mar 7, 2024 at 7:13=E2=80=AFPM Ryan Roberts <ryan.roberts@arm.com> =
wrote:
>
> On 07/03/2024 10:54, David Hildenbrand wrote:
> > On 07.03.24 11:54, David Hildenbrand wrote:
> >> On 07.03.24 11:50, Ryan Roberts wrote:
> >>> On 07/03/2024 09:33, Barry Song wrote:
> >>>> On Thu, Mar 7, 2024 at 10:07=E2=80=AFPM Ryan Roberts <ryan.roberts@a=
rm.com> wrote:
> >>>>>
> >>>>> On 07/03/2024 08:10, Barry Song wrote:
> >>>>>> On Thu, Mar 7, 2024 at 9:00=E2=80=AFPM Lance Yang <ioworker0@gmail=
com> wrote:
> >>>>>>>
> >>>>>>> Hey Barry,
> >>>>>>>
> >>>>>>> Thanks for taking time to review!
> >>>>>>>
> >>>>>>> On Thu, Mar 7, 2024 at 3:00=E2=80=AFPM Barry Song <21cnbao@gmail.=
com> wrote:
> >>>>>>>>
> >>>>>>>> On Thu, Mar 7, 2024 at 7:15=E2=80=AFPM Lance Yang <ioworker0@gma=
il.com> wrote:
> >>>>>>>>>
> >>>>>>> [...]
> >>>>>>>>> +static inline bool can_mark_large_folio_lazyfree(unsigned long=
 addr,
> >>>>>>>>> +                                                struct folio *=
folio,
> >>>>>>>>> pte_t *start_pte)
> >>>>>>>>> +{
> >>>>>>>>> +       int nr_pages =3D folio_nr_pages(folio);
> >>>>>>>>> +       fpb_t flags =3D FPB_IGNORE_DIRTY | FPB_IGNORE_SOFT_DIRT=
Y;
> >>>>>>>>> +
> >>>>>>>>> +       for (int i =3D 0; i < nr_pages; i++)
> >>>>>>>>> +               if (page_mapcount(folio_page(folio, i)) !=3D 1)
> >>>>>>>>> +                       return false;
> >>>>>>>>
> >>>>>>>> we have moved to folio_estimated_sharers though it is not precis=
e, so
> >>>>>>>> we don't do
> >>>>>>>> this check with lots of loops and depending on the subpage's map=
count.
> >>>>>>>
> >>>>>>> If we don't check the subpage=E2=80=99s mapcount, and there is a =
cow folio
> >>>>>>> associated
> >>>>>>> with this folio and the cow folio has smaller size than this foli=
o,
> >>>>>>> should we still
> >>>>>>> mark this folio as lazyfree?
> >>>>>>
> >>>>>> I agree, this is true. However, we've somehow accepted the fact th=
at
> >>>>>> folio_likely_mapped_shared
> >>>>>> can result in false negatives or false positives to balance the
> >>>>>> overhead.  So I really don't know :-)
> >>>>>>
> >>>>>> Maybe David and Vishal can give some comments here.
> >>>>>>
> >>>>>>>
> >>>>>>>> BTW, do we need to rebase our work against David's changes[1]?
> >>>>>>>> [1]
> >>>>>>>> https://lore.kernel.org/linux-mm/20240227201548.857831-1-david@r=
edhat.com/
> >>>>>>>
> >>>>>>> Yes, we should rebase our work against David=E2=80=99s changes.
> >>>>>>>
> >>>>>>>>
> >>>>>>>>> +
> >>>>>>>>> +       return nr_pages =3D=3D folio_pte_batch(folio, addr, sta=
rt_pte,
> >>>>>>>>> +                                        ptep_get(start_pte), n=
r_pages,
> >>>>>>>>> flags, NULL);
> >>>>>>>>> +}
> >>>>>>>>> +
> >>>>>>>>>    static int madvise_free_pte_range(pmd_t *pmd, unsigned long =
addr,
> >>>>>>>>>                                   unsigned long end, struct mm_=
walk *walk)
> >>>>>>>>>
> >>>>>>>>> @@ -676,11 +690,45 @@ static int madvise_free_pte_range(pmd_t *=
pmd,
> >>>>>>>>> unsigned long addr,
> >>>>>>>>>                    */
> >>>>>>>>>                   if (folio_test_large(folio)) {
> >>>>>>>>>                           int err;
> >>>>>>>>> +                       unsigned long next_addr, align;
> >>>>>>>>>
> >>>>>>>>> -                       if (folio_estimated_sharers(folio) !=3D=
 1)
> >>>>>>>>> -                               break;
> >>>>>>>>> -                       if (!folio_trylock(folio))
> >>>>>>>>> -                               break;
> >>>>>>>>> +                       if (folio_estimated_sharers(folio) !=3D=
 1 ||
> >>>>>>>>> +                           !folio_trylock(folio))
> >>>>>>>>> +                               goto skip_large_folio;
> >>>>>>>>
> >>>>>>>>
> >>>>>>>> I don't think we can skip all the PTEs for nr_pages, as some of =
them
> >>>>>>>> might be
> >>>>>>>> pointing to other folios.
> >>>>>>>>
> >>>>>>>> for example, for a large folio with 16PTEs, you do MADV_DONTNEED=
(15-16),
> >>>>>>>> and write the memory of PTE15 and PTE16, you get page faults, th=
us PTE15
> >>>>>>>> and PTE16 will point to two different small folios. We can only =
skip
> >>>>>>>> when we
> >>>>>>>> are sure nr_pages =3D=3D folio_pte_batch() is sure.
> >>>>>>>
> >>>>>>> Agreed. Thanks for pointing that out.
> >>>>>>>
> >>>>>>>>
> >>>>>>>>> +
> >>>>>>>>> +                       align =3D folio_nr_pages(folio) * PAGE_=
SIZE;
> >>>>>>>>> +                       next_addr =3D ALIGN_DOWN(addr + align, =
align);
> >>>>>>>>> +
> >>>>>>>>> +                       /*
> >>>>>>>>> +                        * If we mark only the subpages as lazy=
free, or
> >>>>>>>>> +                        * cannot mark the entire large folio a=
s lazyfree,
> >>>>>>>>> +                        * then just split it.
> >>>>>>>>> +                        */
> >>>>>>>>> +                       if (next_addr > end || next_addr - addr=
 !=3D
> >>>>>>>>> align ||
> >>>>>>>>> +                           !can_mark_large_folio_lazyfree(addr=
, folio,
> >>>>>>>>> pte))
> >>>>>>>>> +                               goto split_large_folio;
> >>>>>>>>> +
> >>>>>>>>> +                       /*
> >>>>>>>>> +                        * Avoid unnecessary folio splitting if=
 the large
> >>>>>>>>> +                        * folio is entirely within the given r=
ange.
> >>>>>>>>> +                        */
> >>>>>>>>> +                       folio_clear_dirty(folio);
> >>>>>>>>> +                       folio_unlock(folio);
> >>>>>>>>> +                       for (; addr !=3D next_addr; pte++, addr=
 +=3D
> >>>>>>>>> PAGE_SIZE) {
> >>>>>>>>> +                               ptent =3D ptep_get(pte);
> >>>>>>>>> +                               if (pte_young(ptent) ||
> >>>>>>>>> pte_dirty(ptent)) {
> >>>>>>>>> +                                       ptent =3D ptep_get_and_=
clear_full(
> >>>>>>>>> +                                               mm, addr, pte,
> >>>>>>>>> tlb->fullmm);
> >>>>>>>>> +                                       ptent =3D pte_mkold(pte=
nt);
> >>>>>>>>> +                                       ptent =3D pte_mkclean(p=
tent);
> >>>>>>>>> +                                       set_pte_at(mm, addr, pt=
e, ptent);
> >>>>>>>>> +                                       tlb_remove_tlb_entry(tl=
b, pte,
> >>>>>>>>> addr);
> >>>>>>>>> +                               }
> >>>>>>>>
> >>>>>>>> Can we do this in batches? for a CONT-PTE mapped large folio, yo=
u are
> >>>>>>>> unfolding
> >>>>>>>> and folding again. It seems quite expensive.
> >>>>>
> >>>>> I'm not convinced we should be doing this in batches. We want the i=
nitial
> >>>>> folio_pte_batch() to be as loose as possible regarding permissions =
so that we
> >>>>> reduce our chances of splitting folios to the min. (e.g. ignore SW =
bits like
> >>>>> soft dirty, etc). I think it might be possible that some PTEs are R=
O and other
> >>>>> RW too (e.g. due to cow - although with the current cow impl, proba=
bly not.
> >>>>> But
> >>>>> its fragile to assume that). Anyway, if we do an initial batch that=
 ignores
> >>>>> all
> >>>>
> >>>> You are correct. I believe this scenario could indeed occur. For ins=
tance,
> >>>> if process A forks process B and then unmaps itself, leaving B as th=
e
> >>>> sole process owning the large folio.  The current wp_page_reuse() fu=
nction
> >>>> will reuse PTE one by one while the specific subpage is written.
> >>>
> >>> Hmm - I thought it would only reuse if the total mapcount for the fol=
io was 1.
> >>> And since it is a large folio with each page mapped once in proc B, I=
 thought
> >>> every subpage write would cause a copy except the last one? I haven't=
 looked at
> >>> the code for a while. But I had it in my head that this is an area we=
 need to
> >>> improve for mTHP.

So sad I am wrong again =F0=9F=98=A2

> >>
> >> wp_page_reuse() will currently reuse a PTE part of a large folio only =
if
> >> a single PTE remains mapped (refcount =3D=3D 0).
> >
> > ^ =3D=3D 1

seems this needs improvement. it is a waste the last subpage can
reuse the whole large folio. i was doing it in a quite different way,
if the large folio had only one subpage left, i would do copy and
released the large folio[1]. and if i could reuse the whole large folio
with CONT-PTE, i would reuse the whole large folio[2]. in mainline,
we don't have this cont-pte luxury exposed to mm, so i guess we can
not do [2] easily, but [1] seems to be an optimization.

[1] https://github.com/OnePlusOSS/android_kernel_oneplus_sm8650/blob/oneplu=
s/sm8650_u_14.0.0_oneplus12/mm/memory.c#L3977
[2] https://github.com/OnePlusOSS/android_kernel_oneplus_sm8650/blob/oneplu=
s/sm8650_u_14.0.0_oneplus12/mm/memory.c#L3812

>
> Ahh yes. That's what I meant. I got the behacviour vagulely right though.
>
> Anyway, regardless, I'm not sure we want to batch here. Or if we do, we w=
ant to
> batch function that will only clear access and dirty.
>

Thanks
Barry