[PATCH 1/2] sched/numa: do not let the per-VMA PID filter gate promotion

[Gregory Price <gourry@gourry.net>]

task_numa_work() will not scan a VMA that vma_is_accessed() rejects:

  if (!vma_pids_forced && !vma_is_accessed(mm, vma)) {
      vma_pids_skipped = true;
      trace_sched_skip_vma_numa(mm, vma, NUMAB_SKIP_PID_INACTIVE);
      continue;
  }

vma_is_accessed() wants the scanning thread's hash bit in
vma->numab_state->pids_active[].  Those bits have one setter,
vma_set_access_pid_bit(), called on a NUMA hint fault.

The PROT_NONE scan is the only source of hint faults, so a VMA the
task has not hint-faulted looks untouched - preventing new scans
from causing faults for potentially hours or days.

The existing escape mechanisms do not solve this problem:

  numa_scan_offset      - rescues only the VMA holding the scan cursor

  get_nr_threads()      - the horizon from commit f22cde4371f3
                          ("sched/numa: Fix the vma scan starving issue")
                          costs nr_threads scan sequences, which
                          can be incredibly large.

  vma_pids_forced retry - fires only at the end of the VMA list, and then
                          scans exactly one VMA

Observed effect in the following environment:

  - 768G DRAM + 256G CXL Host
  - two ~430GB highly-threaded database workload
  - a single large (300GB+) shmem/tmpfs VMA in each workload
  - numa_balancing = 2   (default tuning)

In this environment, the large shmem VMAs held the cursor for 100% of a
scan, while 84G across 2537 other VMAs were skipped due to "inactivity".

Among them, a 20G hash table ended up 100% on CXL.  After this patch it
was consistently split 50:50 between DRAM and CXL.

Scan the rejected VMAs, looking only at folios on non-toptier nodes.
Promotion candidates then come from the whole address space, while toptier
folios are only marked where vma_is_accessed() already allowed it, so
top-tier marking is unchanged in every mode.

A restricted scan reaches the end of the VMA but may not completely scan
it, so it leaves prev_scan_seq alone.  Setting it there would permanently
disarm the get_nr_threads() horizon above.

Before this change:

  DRAM Bandwidth utilization dropped from 200GB/s to 150GB/s
  CXL Bandwidth utilization increased from 5GB/s to 45GB/s (capped)
  Request Latency increases from 800us to 5ms tracked with CXL bandwidth

After this change:

  DRAM Bandwidth maintains between 200GB/s and 250GB/s
  CXL Bandwidth maintains at ~7-10GB/s
  Request Latency hovers between 800us-2ms tracked with request load.

commit d230991493b5 ("mm: mempolicy: fix automatic numa balancing for shmem")
surfaced this issue when it fixed shmem numa balance scanning.

Fixes: fc137c0ddab2 ("sched/numa: enhance vma scanning logic")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Assisted-by: Claude:claude-opus-5
---
 include/linux/mm_types.h |  7 +++++++
 kernel/sched/fair.c      | 25 ++++++++++++++++++++-----
 mm/mempolicy.c           |  9 +++++----
 3 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 5413bd10fff2..d986fcab9c8f 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -803,6 +803,13 @@ struct vma_numab_state {
 	 * A VMA is not eligible for scanning if prev_scan_seq == numa_scan_seq
 	 */
 	int prev_scan_seq;
+
+	/*
+	 * Set by the scanner for the duration of a scan of this VMA when only
+	 * folios on non-toptier nodes should be made NUMA hintable, because
+	 * the scanning task has not accessed the VMA recently.
+	 */
+	bool slow_only;
 };
 
 #ifdef __HAVE_PFNMAP_TRACKING
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 6d881e530f89..990af0e45d69 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -4297,11 +4297,20 @@ static void task_numa_work(struct callback_head *work)
 		/*
 		 * Do not scan the VMA if task has not accessed it, unless no other
 		 * VMA candidate exists.
+		 *
+		 * Force-scan only slow-tier folios when in tiering mode, as a large
+		 * VMA can cause others to become "permanently unaccessed" if a scan
+		 * cycle is consumed entirely by the large VMA.
 		 */
+		vma->numab_state->slow_only = false;
 		if (!vma_pids_forced && !vma_is_accessed(mm, vma)) {
-			vma_pids_skipped = true;
-			trace_sched_skip_vma_numa(mm, vma, NUMAB_SKIP_PID_INACTIVE);
-			continue;
+			if (!(sysctl_numa_balancing_mode &
+			      NUMA_BALANCING_MEMORY_TIERING)) {
+				vma_pids_skipped = true;
+				trace_sched_skip_vma_numa(mm, vma, NUMAB_SKIP_PID_INACTIVE);
+				continue;
+			}
+			vma->numab_state->slow_only = true;
 		}
 
 		do {
@@ -4329,8 +4338,14 @@ static void task_numa_work(struct callback_head *work)
 			cond_resched();
 		} while (end != vma->vm_end);
 
-		/* VMA scan is complete, do not scan until next sequence. */
-		vma->numab_state->prev_scan_seq = mm->numa_scan_seq;
+		/*
+		 * VMA scan is complete, do not scan until next sequence.
+		 * A restricted scan reached the end of the VMA but may not
+		 * have completely scanned it - it must not disarm the sequence
+		 * counting horizon in vma_is_accessed() for this VMA.
+		 */
+		if (!vma->numab_state->slow_only)
+			vma->numab_state->prev_scan_seq = mm->numa_scan_seq;
 
 		/*
 		 * Only force scan within one VMA at a time, to limit the
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index ce10ce437464..e3fe08c4f109 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -887,11 +887,12 @@ bool folio_can_map_prot_numa(struct folio *folio, struct vm_area_struct *vma,
 		return false;
 
 	/*
-	 * Skip scanning top tier node if normal numa
-	 * balancing is disabled
+	 * Skip scanning top tier node if normal numa balancing is disabled,
+	 * or if the scanner only wants promotion candidates out of this VMA.
 	 */
-	if (!(sysctl_numa_balancing_mode & NUMA_BALANCING_NORMAL) &&
-	    node_is_toptier(nid))
+	if (node_is_toptier(nid) &&
+	    (!(sysctl_numa_balancing_mode & NUMA_BALANCING_NORMAL) ||
+	     (vma->numab_state && vma->numab_state->slow_only)))
 		return false;
 
 	if (folio_use_access_time(folio))
-- 
2.55.0