Re: [PATCH v2 1/2] mm/memory: reuse 16 PTEs of an exclusive large folio on a write fault

["David Hildenbrand (Arm)" <david@kernel.org>]

On 9/19/26 09:31, Yuan-Hao Hsu wrote:
> fork() maps the anonymous pages of the parent read-only and clears
> PageAnonExclusive on them.  Once the child has exec'ed or exited, the
> parent's write fault takes the reuse path of do_wp_page():
> wp_can_reuse_anon_folio() finds that all references to the folio come
> from this MM, the page is marked exclusive again and its PTE is made
> writable.
> 
> For a large folio that check is about the folio and holds for every
> page of it, but only the page that faulted is marked exclusive and
> made writable.  Each other page takes a write fault of its own and
> takes the large mapcount lock to find out the same thing again: 16
> faults for a 64K folio.  The same THP mapped by a PMD is reused by one
> fault in do_huge_pmd_wp_page(), and do_swap_page() maps all PTEs of an
> exclusive large folio writable at once.
> 
> Barry proposed reusing the whole mTHP from one fault in 2024 [1].  The
> reservations then were the latency of the individual write fault and
> how far to go around the faulting PTE: a contpte-sized block was fine,
> anything bigger not yet convincing (David's replies, linked below).
> Commit 1da190f4d0a6 ("mm: Copy-on-Write (COW) reuse support for
> PTE-mapped THP") then added the per-folio check and left faulting
> around for later.

I'm fine with the original idea of limiting this to reasonable chunk
sizes, reducing the work we do in a single page fault.

The patch needs work. I disagree with various decisions
either you or the LLM came up with like

* Uglifying do_wp_page
* Not handling unshare
* Calling wp_reuse_large_anon_folio() to do some batching to then call 
  wp_reuse_page in same page fault
* Batching multiple pieces in a loop
* Using can_change_pte_writable()

I tried to see how to implement it cleaner. I think we should definitely
start with:

From 3d16faebcbbd1b970edb51ef2f710ca51e9709af Mon Sep 17 00:00:00 2001
From: "David Hildenbrand (Arm)" <david@kernel.org>
Date: Thu, 24 Sep 2026 19:43:15 +0200
Subject: [PATCH 1/2] mm/memory: factor out anon reuse logic into
 wp_try_reuse_anon_page()

Let's move the core logic from do_wp_page() into
wp_try_reuse_anon_page() to prepare for further changes.

No functional change intended.

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
 mm/memory.c | 45 +++++++++++++++++++++++++++++----------------
 1 file changed, 29 insertions(+), 16 deletions(-)

diff --git a/mm/memory.c b/mm/memory.c
index 338fce99e7119..67fcf67bc64fd 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4414,6 +4414,34 @@ static bool wp_can_reuse_anon_folio(struct folio *folio,
 	return true;
 }
 
+static bool wp_try_reuse_anon_page(struct vm_fault *vmf, struct folio *folio)
+	__cond_releases(true, vmf->ptl)
+{
+	const bool unshare = vmf->flags & FAULT_FLAG_UNSHARE;
+
+	VM_WARN_ON_ONCE(!folio_test_anon(folio));
+
+	/*
+	 * Private mapping: create an exclusive anonymous page copy if reuse
+	 * is impossible. We might miss VM_WRITE for FOLL_FORCE handling.
+	 *
+	 * If we encounter a page that is marked exclusive, we must reuse
+	 * the page without further checks.
+	 */
+	if (!PageAnonExclusive(vmf->page)) {
+		if (!wp_can_reuse_anon_folio(folio, vmf->vma))
+			return false;
+		SetPageAnonExclusive(vmf->page);
+	}
+
+	if (unlikely(unshare)) {
+		pte_unmap_unlock(vmf->pte, vmf->ptl);
+		return true;
+	}
+	wp_page_reuse(vmf, folio);
+	return true;
+}
+
 /*
  * This routine handles present pages, when
  * * users try to write to a shared page (FAULT_FLAG_WRITE)
@@ -4499,24 +4527,9 @@ static vm_fault_t do_wp_page(struct vm_fault *vmf)
 		return wp_page_shared(vmf, folio);
 	}
 
-	/*
-	 * Private mapping: create an exclusive anonymous page copy if reuse
-	 * is impossible. We might miss VM_WRITE for FOLL_FORCE handling.
-	 *
-	 * If we encounter a page that is marked exclusive, we must reuse
-	 * the page without further checks.
-	 */
 	if (folio && folio_test_anon(folio) &&
-	    (PageAnonExclusive(vmf->page) || wp_can_reuse_anon_folio(folio, vma))) {
-		if (!PageAnonExclusive(vmf->page))
-			SetPageAnonExclusive(vmf->page);
-		if (unlikely(unshare)) {
-			pte_unmap_unlock(vmf->pte, vmf->ptl);
-			return 0;
-		}
-		wp_page_reuse(vmf, folio);
+	    wp_try_reuse_anon_page(vmf, folio))
 		return 0;
-	}
 	/*
 	 * Ok, we need to copy. Oh, well..
 	 */
-- 
2.43.0


And the maybe go into this direction, where we really only try to
batch exactly once, and include in that patch out PTE of interest. IOW, optimize
for the common case and also take care of unsharing.


Some things I am not sure about
* Hardcoding WP_REUSE_MAX_NR_PTES, likely should be determine differently.
* Marking all 16 PTEs young+dirty. It's somewhat the same thing as we do in
  map_anon_folio_pte_pf(). On arm64 it's already fuzzy with cont-pte. With
  transparent coalescing we'd actually allow it directly. So it does feel like the right thing.

I also wonder whether some part of the function could be factored out as helpers for
other code to use in the future. I also suspect that there are more cleanups to be had.

Long story short, needs more work, but I am out of time.

Entirely untested:


From 1db2c61661cc854eabb8619a2717d1ddf43a95f5 Mon Sep 17 00:00:00 2001
From: "David Hildenbrand (Arm)" <david@kernel.org>
Date: Thu, 24 Sep 2026 20:03:01 +0200
Subject: [PATCH 2/2] mm/memory: reuse 16 PTEs of an exclusive large folio on a
 write fault

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
 mm/memory.c | 120 +++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 115 insertions(+), 5 deletions(-)

diff --git a/mm/memory.c b/mm/memory.c
index 67fcf67bc64fd..dab2a274783bf 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4414,10 +4414,78 @@ static bool wp_can_reuse_anon_folio(struct folio *folio,
 	return true;
 }
 
+#define WP_REUSE_MAX_NR_PTES	16
+
+static unsigned int wp_anon_folio_pte_batch(struct vm_fault *vmf,
+		struct folio *folio, unsigned long *addr, struct page **page,
+		pte_t *pte, pte_t **ptep)
+{
+	/* modify_prot_start_ptes() needs most PTE bits to match. */
+	const fpb_t flags = FPB_RESPECT_WRITE | FPB_RESPECT_SOFT_DIRTY;
+	struct vm_area_struct *vma = vmf->vma;
+	unsigned long batch_start_addr, batch_size, folio_idx, nr_before;
+	unsigned int batch_nr_pages;
+	pte_t *batch_start_ptep;
+	pte_t batch_start_pte, expected_pte;
+
+	if (!IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) ||
+	    !folio_test_large(folio))
+		return 1;
+
+	/*
+	 * We'll try batching in a naturally aligned block surrounding our
+	 * faulting PTE.
+	 */
+	batch_nr_pages = min(folio_large_nr_pages(folio), WP_REUSE_MAX_NR_PTES);
+	batch_size = batch_nr_pages << PAGE_SHIFT;
+	batch_start_addr = ALIGN_DOWN(*addr, batch_size);
+	folio_idx = folio_page_idx(folio, *page);
+	nr_before = (*addr - batch_start_addr) >> PAGE_SHIFT;
+
+	/* Stay within the folio. */
+	if (nr_before > folio_idx ||
+	    folio_idx - nr_before + batch_nr_pages > folio_large_nr_pages(folio))
+		return 1;
+
+	/* Stay within the VMA. */
+	if (batch_start_addr < vma->vm_start ||
+	    batch_start_addr + batch_size > vma->vm_end)
+		return 1;
+
+	batch_start_ptep = *ptep - nr_before;
+	batch_start_pte = ptep_get(batch_start_ptep);
+
+	expected_pte = pte_advance_pfn(batch_start_pte, nr_before);
+	if (!pte_same(__pte_batch_clear_ignored(expected_pte, flags),
+		      __pte_batch_clear_ignored(*pte, flags)))
+		return 1;
+
+	if (folio_pte_batch_flags(folio, NULL, batch_start_ptep,
+				  &batch_start_pte, batch_nr_pages,
+				  flags) != batch_nr_pages)
+		return 1;
+
+	/*
+	 * Our faulting PTE is guaranteed to be part of the batch, and all
+	 * PTE bits are compatible.
+	 */
+	*addr = batch_start_addr;
+	*page = *page - nr_before;
+	*pte = batch_start_pte;
+	*ptep = batch_start_ptep;
+	return batch_nr_pages;
+}
+
 static bool wp_try_reuse_anon_page(struct vm_fault *vmf, struct folio *folio)
 	__cond_releases(true, vmf->ptl)
 {
 	const bool unshare = vmf->flags & FAULT_FLAG_UNSHARE;
+	struct vm_area_struct *vma = vmf->vma;
+	unsigned long addr = vmf->address;
+	struct page *page = vmf->page;
+	pte_t new_pte, pte = vmf->orig_pte;
+	pte_t *ptep = vmf->pte;
+	unsigned int i, nr = 1;
 
 	VM_WARN_ON_ONCE(!folio_test_anon(folio));
 
@@ -4426,14 +4494,56 @@ static bool wp_try_reuse_anon_page(struct vm_fault *vmf, struct folio *folio)
 	 * is impossible. We might miss VM_WRITE for FOLL_FORCE handling.
 	 *
 	 * If we encounter a page that is marked exclusive, we must reuse
-	 * the page without further checks.
+	 * the page without further checks. Don't process more than a single
+	 * PTE in that case.
 	 */
-	if (!PageAnonExclusive(vmf->page)) {
-		if (!wp_can_reuse_anon_folio(folio, vmf->vma))
-			return false;
-		SetPageAnonExclusive(vmf->page);
+	if (PageAnonExclusive(page))
+		goto reuse_single_page;
+
+	if (!wp_can_reuse_anon_folio(folio, vma))
+		return false;
+
+	/* We can use any folio page that is mapped in this page table. */
+	nr = wp_anon_folio_pte_batch(vmf, folio, &addr, &page, &pte, &ptep);
+	if (nr == 1) {
+		SetPageAnonExclusive(page);
+		goto reuse_single_page;
 	}
 
+	for (i = 0; i < nr; i++)
+		if (!PageAnonExclusive(page + i))
+			SetPageAnonExclusive(page + i);
+
+	/* Careful: don't mark unrelated PTEs soft-dirty by batching. */
+	if (unlikely(pte_needs_soft_dirty_wp(vma, pte)))
+		goto reuse_single_page;
+
+	if (unlikely(unshare)) {
+		pte_unmap_unlock(vmf->pte, vmf->ptl);
+		return true;
+	}
+
+	/* See wp_page_reuse() */
+	folio_xchg_last_cpupid(folio, (1 << LAST_CPUPID_SHIFT) - 1);
+
+	for (i = 0; i < nr; i++)
+		flush_cache_page(vma, addr + (i << PAGE_SHIFT), pte_pfn(pte) + i);
+
+	pte = modify_prot_start_ptes(vma, addr, ptep, nr);
+	new_pte = maybe_mkwrite(pte_mkdirty(pte_mkyoung(pte)), vmf->vma);
+	modify_prot_commit_ptes(vma, addr, ptep, pte, new_pte, nr);
+
+	/* Remove stale read-only TLB entry for the faulting PTE only. */
+	flush_tlb_fix_spurious_fault(vma, vmf->address, vmf->pte);
+
+	/* But update the MMU cache of all changed PTEs. */
+	update_mmu_cache_range(vmf, vma, addr, ptep, nr);
+
+	pte_unmap_unlock(vmf->pte, vmf->ptl);
+	count_vm_event(PGREUSE);
+	return true;
+
+reuse_single_page:
 	if (unlikely(unshare)) {
 		pte_unmap_unlock(vmf->pte, vmf->ptl);
 		return true;
-- 
2.43.0



-- 
Cheers,

David