Re: [PATCH v3 08/12] mm/collapse: separate scanning a PTE table from collapsing it

[Kiryl Shutsemau <kirill@shutemov.name>]

On Wed, Sep 23, 2026 at 03:04:05PM +0200, David Hildenbrand (Arm) wrote:
> On 9/16/26 11:31, Kiryl Shutsemau wrote:
> > From: "Kiryl Shutsemau (Meta)" <kas@kernel.org>
> > 
> > A collapse is two jobs.  One reads a PTE table under mmap_lock and decides
> > whether the range is worth collapsing.  The other allocates, isolates,
> > copies and flushes, and wants the lock given up first.
> > 
> > collapse_single_pmd() did both, so the boundary between them was somewhere
> > in the middle of a function.
> > 
> > Give each half its own function:
> > 
> >   - collapse_scan_pmd() scans one table and only reads.  The anonymous
> >     scan that used to carry that name keeps its body as
> >     collapse_scan_anon_pmd(), and collapse_scan_pmd() is now the entry
> >     that picks the anonymous or the file side.
> > 
> >   - collapse_run_pmd() does the collapse the scan asked for, and is
> >     handed what the scan returned.  SCAN_SUCCEED means there is
> >     something to collapse.  SCAN_PTE_MAPPED_HUGEPAGE means the page
> >     cache already holds the PMD folio and only the PTE table is left to
> >     retract.  Both are work for the run; anything else is why there is
> >     nothing to do.
> 
> Makes sense.
> 
> The naming is a bit suboptimal and inconsistent.
> 
> collapse_single_pmd
> -> collapse_scan_pmd()
> -> collapse_run_pmd()
> 
> Maybe it would be clearer:
> 
> collapse_pmd() ["single" is rather useless]
> -> collapse_scan_pmd()
> -> collapse_scanned_pmd()

Yes, the naming is awkward.

The problem is that collapse_ is the prefix of everything in the
interface, so it cannot double as the verb: collapse_pmd() says what the
function is about, not what it does, and collapse_scanned_pmd() has no
verb at all.

Each name needs one after the prefix, hence scan and run. I don't
particularly like it, but it seems better than scan and scanned, no?

collapse_single_pmd() itself goes away in the next patch. You asked
there why; I will answer there.

> > What the scan found and the run needs travels in collapse_control.  For
> > an anonymous table that is the orders and the referenced and swapped-out
> > counts, which mthp_collapse() and collapse_huge_page() now read from
> > there instead of taking as arguments.  For a file it is the file itself
> > and the offset in it.
> > 
> > The file side moves with the anonymous one.  collapse_scan_file() used to
> > run with mmap_lock already given up, and called collapse_file() itself
> > when the page cache looked worth it.  It now runs under the lock like the
> > anonymous scan and only reads; the run does the collapse.
> 
> So we add more locking to the file path to merge both paths cleanly? Or did I
> misunderstand that paragraph?

The lock is held over the scan now, but it is taken fewer times. The
current code drops mmap_lock before the file scan, before it knows if
there is anything to collapse. Most scans find nothing, and each of them
pays the cost of unlock and relock for nothing.

Dropping the lock only after a scan found work mirrors the anonymous
side, with the same batching shape.

> What do you mean with "and only reads"?

That it no longer calls collapse_file(). The scan looks at the page
cache and says whether there is work; collapse_file() is the run's job.

I will drop the wording. It does not help.

> >  A file
> > collapse works on the page cache and never sees a VMA, so the scan takes
> > the file reference while it still has one and the run gives it back.
> > 
> > That changes what a refused file table costs khugepaged.  Every file
> > table it scanned used to end its pass over that mm, because the lock had
> > been dropped to scan it; now only a table it goes on to collapse does.
> 
> The last sentence makes no sense. At least to me :)

It is also wrong, so I will rewrite it.

Before this patch collapse_single_pmd() set lock_dropped for every file
table, refused or not, and collapse_scan_mm_slot() bailed out on it.

The mm slot stays, so the next call comes back to the same mm at the
saved address, but every file table cost an unlock, a trip through
khugepaged_do_scan(), a relock and a VMA lookup.

Now only a table that gets collapsed pays that.

> > Two things on the file side stop being rescanned.  When the page cache
> > already holds the PMD folio, the scan says so and the run goes straight
> > to retracting the PTE table.  A run that refuses dirty pages and may
> > write them back retries collapse_file() alone.  The checks the scan makes
> > ahead of it are ones collapse_file() repeats under the page cache lock.
> 
> Is there any way we could move these changes into separate patches? These
> changes are bit squeezed into the last part of this description. And having to
> much happening at once makes this rather hard to grasp.

Ack.

> > Tracing changes with it.  mm_khugepaged_scan_pmd and
> > mm_khugepaged_scan_file used to fire after the collapse, so for an
> > accepted table their status field carried what the collapse made of it.
> > They now fire before it and read SCAN_SUCCEED for an accepted table.  What
> > the collapse then made of it is for mm_collapse_huge_page and
> > mm_khugepaged_collapse_file to report.
> > 
> > Assisted-by: LLM
> > Reviewed-by: Zi Yan <ziy@nvidia.com>
> > Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
> > ---
> >  mm/collapse.h   |  14 ++++
> >  mm/khugepaged.c | 166 +++++++++++++++++++++++++++++++++---------------
> >  2 files changed, 130 insertions(+), 50 deletions(-)
> 
> [...]
> 
> > -/*
> > - * Try to collapse a single PMD starting at a PMD aligned addr, and return
> > - * the results.
> > - */
> > -static enum scan_result collapse_single_pmd(unsigned long addr,
> > -		struct vm_area_struct *vma, bool *lock_dropped,
> > -		struct collapse_control *cc)
> > +static void collapse_control_init(struct collapse_control *cc)
> > +{
> > +	cc->progress = 0;
> > +	cc->scan_file = NULL;
> > +}
> > +
> > +/* A scan that took a file reference should have been run */
> > +static void collapse_put_scan_file(struct collapse_control *cc)
> > +{
> > +	if (WARN_ON_ONCE(cc->scan_file)) {
> > +		fput(cc->scan_file);
> > +		cc->scan_file = NULL;
> > +	}
> 
> See below regarding _release: having _put functions that are not supposed to put
> anything except with BUG is akward.
> 
> > +}
> > +
> > +static void collapse_control_release(struct collapse_control *cc)
> > +{
> > +	collapse_put_scan_file(cc);
> > +}
> 
> Do we really have to introduce collapse_control_release() just to perform some
> safety checks for BUGs? I'd rather keep the collapse interface minimal and not
> introduce _release semantics when there is actually nothing to be released?
> 
> Or will you add more into _release in later patches in this series?

Not in this series.

The engine I have on top of it gives both a job.

I will drop it from this series and add it with the engine. The shape
might change by the time the engine is posted.

The check at the top of collapse_scan_pmd() stays, open-coded: a scan
that found work on a file table holds a reference, and the next scan is
where one that was never run gets caught.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov