Re: [PATCH 2/2] mm/vmalloc: Add attempt_larger_order_alloc parameter

[Ryan Roberts <ryan.roberts@arm.com>]

On 19/12/2025 00:34, Vishal Moola (Oracle) wrote:
> On Thu, Dec 18, 2025 at 11:53:00AM +0000, Ryan Roberts wrote:
>> On 18/12/2025 04:55, Dev Jain wrote:
>>>
>>> On 17/12/25 8:50 pm, Ryan Roberts wrote:
>>>> On 17/12/2025 12:02, Uladzislau Rezki wrote:
>>>>>> On 16/12/2025 21:19, Uladzislau Rezki (Sony) wrote:
>>>>>>> Introduce a module parameter to enable or disable the large-order
>>>>>>> allocation path in vmalloc. High-order allocations are disabled by
>>>>>>> default so far, but users may explicitly enable them at runtime if
>>>>>>> desired.
>>>>>>>
>>>>>>> High-order pages allocated for vmalloc are immediately split into
>>>>>>> order-0 pages and later freed as order-0, which means they do not
>>>>>>> feed the per-CPU page caches. As a result, high-order attempts tend
>>>>>>> to bypass the PCP fastpath and fall back to the buddy allocator that
>>>>>>> can affect performance.
>>>>>>>
>>>>>>> However, when the PCP caches are empty, high-order allocations may
>>>>>>> show better performance characteristics especially for larger
>>>>>>> allocation requests.
>>>>>> I wonder if a better solution would be "allocate order-0 if available in pcp,
>>>>>> else try large order, else fallback to order-0" Could that provide the best of
>>>>>> all worlds without needing a configuration knob?
>>>>>>
>>>>> I am not sure, to me it looks like a bit odd. 
>>>> Perhaps it would feel better if it was generalized to "first try allocation from
>>>> PCP list, highest to lowest order, then try allocation from the buddy, highest
>>>> to lowest order"?
>>>>
>>>>> Ideally it would be
>>>>> good just free it as high-order page and not order-0 peaces.
>>>> Yeah perhaps that's better. How about something like this (very lightly tested
>>>> and no performance results yet):
>>>>
>>>> (And I should admit I'm not 100% sure it is safe to call free_frozen_pages()
>>>> with a contiguous run of order-0 pages, but I'm not seeing any warnings or
>>>> memory leaks when running mm selftests...)
>>>
>>> Wow I wasn't aware that we can do this. I see that free_hotplug_page_range() in
>>> arm64/mmu.c already does this - it computes order from size and passes it to
>>> __free_pages().
>>
>> Hmm that looks dodgy to me. But I'm not sure I actually understand what is going
>> on...
>>
>> Prior to looking at this yesterday, my understanding was this: At the struct
>> page level, you can either allocate compond or non-compound. order-0 is
>> non-compound by definition. A high-order non-compound page is just a contiguous
>> set of order-0 pages, each with individual reference counts and other meta data.
>> A compound page is one where all the pages are tied together and managed as one
>> - the meta data is stored in the head page and all the tail pages point to the
>> head (this concept is wrapped by struct folio).
>>
>> But after looking through the comments in page_alloc.c, it would seem that a
>> non-compound high-order page is NOT just a set of order-0 pages, but they still
>> share some meta data, including a shared refcount?? alloc_pages() will return
>> one of these things, and __free_pages() requires the exact same unit to be
>> provided to it.
> 
> For high-order non-compound pages, the tail pages don't get initialized.
> They don't share anything, and its up to the caller to keep track of
> those tail pages.
> 
> Historically, we split the pages down to order-0 here to simplify things for
> the callers. See commit 3b8000ae185cb0 (stating some callers want to use
> some page fields).
> 
> Tail pages being uninitialized meant that when using page apis, we could
> easily hit 'bad' page states. Splitting to order-0, meant that each page
> is now completely independent, and *actually* initialized to an expected
> state.

Thanks for the explanation - consider my mental model of all of this to be
corrected!

> 
>> vmalloc calls alloc_pages() to get a non-compound high-order page, then calls
>> split_page() to convert to a set of order-0 pages. See this comment:
>>
>> /*
>>  * split_page takes a non-compound higher-order page, and splits it into
>>  * n (1<<order) sub-pages: page[0..n]
>>  * Each sub-page must be freed individually.
>>  *
>>  * Note: this is probably too low level an operation for use in drivers.
>>  * Please consult with lkml before using this in your driver.
>>  */
>> void split_page(struct page *page, unsigned int order)
>>
>> So just passing all the order-0 pages directly to __free_pages() in one go is
>> definitely not the right thing to do ("Each sub-page must be freed
>> individually"). They may have different reference counts so you can only
>> actually free the ones that go to zero surely?
>>
>> But it looked to me like free_frozen_pages() just wants a naturally aligned
>> power-of-2 number of pages to free, so my patch below is decrementing the
>> refcount on each struct page and accumulating the ones where the refcounts goto
>> zero into suitable blocks for free_frozen_pages().
> 
> Frozen pages are just pages without a refcount. I doubt this is the
> intended use, but it should work: you're effectively handling the
> refcount here instead of letting the page allocator do so.

Yep, agreed. thanks.

> 
>> So I *think* my patch is correct, but I'm not totally sure. 
> 
> I haven't looked at your patch yet, but I do like the idea of freeing
> the pages as larger orders together. My only concern is whether page
> migration could mess any of this up (I'm completely unfamiliar with that).

I'm not sure I see where migration comes into the picture. We have the struct
page pointers, so nothing can migrated, surely? This is vmalloc memory we are
talking about so it's all unmovable, right?

> 
>> Then we have the ___free_pages(), which I find very difficult to understand:
>>
>> static void ___free_pages(struct page *page, unsigned int order,
>> 			  fpi_t fpi_flags)
>> {
>> 	/* get PageHead before we drop reference */
>> 	int head = PageHead(page);
>> 	/* get alloc tag in case the page is released by others */
>> 	struct alloc_tag *tag = pgalloc_tag_get(page);
>>
>> 	if (put_page_testzero(page))
>> 		__free_frozen_pages(page, order, fpi_flags);
>>
>> We only test the refcount for the first page, then free all the pages. So that
>> implies that non-compound high-order pages share a single refcount? Or we just
>> ignore the refcount of all the other pages in a non-compound high-order page?
> 
> We ignore the refcount of all other pages - see __free_pages():
> 	 * This function can free multi-page allocations that are not compound
> 	 * pages.  It does not check that the @order passed in matches that of
> 	 * the allocation, so it is easy to leak memory.  Freeing more memory
> 	 * than was allocated will probably emit a warning.
> 
>> 	else if (!head) {
>>
>> What? If the first page still has references but but it's a non-compond
>> high-order page (i.e. no head page) then we free all the trailing sub-pages
>> without caring about their references?
> 
> I think this has to do with racy refcount stuff. For non-compound pages:
> if we take a reference with get_page() before put_page_testzero()
> happens, we will end up ONLY freeing that page once the caller reaches
> its put_page() call. So we're freeing the rest here to prevent leaking
> memory that way.

Yeah this makes sense now that I understand that the "tail" pages never got
initialized. Feels odd that get_page() should be allowed on the "head" page
though for this type of user-managed non-compound high-order page, but I won't
worry about that.

> 
>> 		pgalloc_tag_sub_pages(tag, (1 << order) - 1);
>> 		while (order-- > 0) {
>> 			/*
>> 			 * The "tail" pages of this non-compound high-order
>> 			 * page will have no code tags, so to avoid warnings
>> 			 * mark them as empty.
>> 			 */
>> 			clear_page_tag_ref(page + (1 << order));
>> 			__free_frozen_pages(page + (1 << order), order,
>> 					    fpi_flags);
>> 		}
>> 	}
>> }
>>
>> For the arm64 case that you point out, surely __free_pages() is the wrong thing
>> to call, because it's going to decrement the refcount. But we are freeing based
>> on their presence in the pagetable and we never took a reference in the first place.
>>
>> HELP!
>>
>>>
>>>>
>>>> ---8<---
>>>> commit caa3e5eb5bfade81a32fa62d1a8924df1eb0f619
>>>> Author: Ryan Roberts <ryan.roberts@arm.com>
>>>> Date:   Wed Dec 17 15:11:08 2025 +0000
>>>>
>>>>     WIP
>>>>
>>>>     Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
>>>>
>>>> diff --git a/include/linux/gfp.h b/include/linux/gfp.h
>>>> index b155929af5b1..d25f5b867e6b 100644
>>>> --- a/include/linux/gfp.h
>>>> +++ b/include/linux/gfp.h
>>>> @@ -383,6 +383,8 @@ extern void __free_pages(struct page *page, unsigned int order);
>>>>  extern void free_pages_nolock(struct page *page, unsigned int order);
>>>>  extern void free_pages(unsigned long addr, unsigned int order);
>>>>
>>>> +void free_pages_bulk(struct page *page, int nr_pages);
>>>> +
>>>>  #define __free_page(page) __free_pages((page), 0)
>>>>  #define free_page(addr) free_pages((addr), 0)
>>>>
>>>> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
>>>> index 822e05f1a964..5f11224cf353 100644
>>>> --- a/mm/page_alloc.c
>>>> +++ b/mm/page_alloc.c
>>>> @@ -5304,6 +5304,48 @@ static void ___free_pages(struct page *page, unsigned int
>>>> order,
>>>>  	}
>>>>  }
>>>>
>>>> +static void free_frozen_pages_bulk(struct page *page, int nr_pages)
>>>> +{
>>>> +	while (nr_pages) {
>>>> +		unsigned int fit_order, align_order, order;
>>>> +		unsigned long pfn;
>>>> +
>>>> +		pfn = page_to_pfn(page);
>>>> +		fit_order = ilog2(nr_pages);
>>>> +		align_order = pfn ? __ffs(pfn) : fit_order;
>>>> +		order = min3(fit_order, align_order, MAX_PAGE_ORDER);
>>>> +
>>>> +		free_frozen_pages(page, order);
>>>> +
>>>> +		page += 1U << order;
>>>> +		nr_pages -= 1U << order;
>>>> +	}
>>>> +}
>>>> +
>>>> +void free_pages_bulk(struct page *page, int nr_pages)
>>>> +{
>>>> +	struct page *start = NULL;
>>>> +	bool can_free;
>>>> +	int i;
>>>> +
>>>> +	for (i = 0; i < nr_pages; i++, page++) {
>>>> +		VM_BUG_ON_PAGE(PageHead(page), page);
>>>> +		VM_BUG_ON_PAGE(PageTail(page), page);
>>>> +
>>>> +		can_free = put_page_testzero(page);
>>>> +
>>>> +		if (!can_free && start) {
>>>> +			free_frozen_pages_bulk(start, page - start);
>>>> +			start = NULL;
>>>> +		} else if (can_free && !start) {
>>>> +			start = page;
>>>> +		}
>>>> +	}
>>>> +
>>>> +	if (start)
>>>> +		free_frozen_pages_bulk(start, page - start);
>>>> +}
>>>> +
>>>>  /**
>>>>   * __free_pages - Free pages allocated with alloc_pages().
>>>>   * @page: The page pointer returned from alloc_pages().
>>>> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
>>>> index ecbac900c35f..8f782bac1ece 100644
>>>> --- a/mm/vmalloc.c
>>>> +++ b/mm/vmalloc.c
>>>> @@ -3429,7 +3429,8 @@ void vfree_atomic(const void *addr)
>>>>  void vfree(const void *addr)
>>>>  {
>>>>  	struct vm_struct *vm;
>>>> -	int i;
>>>> +	struct page *start;
>>>> +	int i, nr;
>>>>
>>>>  	if (unlikely(in_interrupt())) {
>>>>  		vfree_atomic(addr);
>>>> @@ -3455,17 +3456,26 @@ void vfree(const void *addr)
>>>>  	/* All pages of vm should be charged to same memcg, so use first one. */
>>>>  	if (vm->nr_pages && !(vm->flags & VM_MAP_PUT_PAGES))
>>>>  		mod_memcg_page_state(vm->pages[0], MEMCG_VMALLOC, -vm->nr_pages);
>>>> -	for (i = 0; i < vm->nr_pages; i++) {
>>>> +
>>>> +	start = vm->pages[0];
>>>> +	BUG_ON(!start);
>>>> +	nr = 1;
>>>> +	for (i = 1; i < vm->nr_pages; i++) {
>>>>  		struct page *page = vm->pages[i];
>>>>
>>>>  		BUG_ON(!page);
>>>> -		/*
>>>> -		 * High-order allocs for huge vmallocs are split, so
>>>> -		 * can be freed as an array of order-0 allocations
>>>> -		 */
>>>> -		__free_page(page);
>>>> -		cond_resched();
>>>> +
>>>> +		if (start + nr != page) {
>>>> +			free_pages_bulk(start, nr);
>>>> +			start = page;
>>>> +			nr = 1;
>>>> +			cond_resched();
>>>> +		} else {
>>>> +			nr++;
>>>> +		}
>>>>  	}
>>>> +	free_pages_bulk(start, nr);
>>>> +
>>>>  	if (!(vm->flags & VM_MAP_PUT_PAGES))
>>>>  		atomic_long_sub(vm->nr_pages, &nr_vmalloc_pages);
>>>>  	kvfree(vm->pages);
>>>> ---8<---
>>>>
>>>>>>> Since the best strategy is workload-dependent, this patch adds a
>>>>>>> parameter letting users to choose whether vmalloc should try
>>>>>>> high-order allocations or stay strictly on the order-0 fastpath.
>>>>>>>
>>>>>>> Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
>>>>>>> ---
>>>>>>>  mm/vmalloc.c | 9 +++++++--
>>>>>>>  1 file changed, 7 insertions(+), 2 deletions(-)
>>>>>>>
>>>>>>> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
>>>>>>> index d3a4725e15ca..f66543896b16 100644
>>>>>>> --- a/mm/vmalloc.c
>>>>>>> +++ b/mm/vmalloc.c
>>>>>>> @@ -43,6 +43,7 @@
>>>>>>>  #include <asm/tlbflush.h>
>>>>>>>  #include <asm/shmparam.h>
>>>>>>>  #include <linux/page_owner.h>
>>>>>>> +#include <linux/moduleparam.h>
>>>>>>>  
>>>>>>>  #define CREATE_TRACE_POINTS
>>>>>>>  #include <trace/events/vmalloc.h>
>>>>>>> @@ -3671,6 +3672,9 @@ vm_area_alloc_pages_large_order(gfp_t gfp, int nid, unsigned int order,
>>>>>>>  	return nr_allocated;
>>>>>>>  }
>>>>>>>  
>>>>>>> +static int attempt_larger_order_alloc;
>>>>>>> +module_param(attempt_larger_order_alloc, int, 0644);
>>>>>> Would this be better as a bool? Docs say that you can then specify 0/1, y/n or
>>>>>> Y/N as the value; that's probably more intuitive?
>>>>>>
>>>>>> nit: I'd favour a shorter name. Perhaps large_order_alloc?
>>>>>>
>>>>> Thanks! We can switch to bool and use shorter name for sure.
>>>>>
>>>>> --
>>>>> Uladzislau Rezki
>>