[RFC PATCH V2 00/10] x86/Hyper-V: Add Dynamic memory hot-remove function

[RFC PATCH V2 00/10] x86/Hyper-V: Add Dynamic memory hot-remove function

[lantianyu1986]

From: Tianyu Lan <Tianyu.Lan@microsoft.com>

Hyper-V provides dynamic memory hot add/remove function.
Memory hot-add has already enabled in Hyper-V balloon driver.
Now add memory hot-remove function.

This patchset is based on the David Hildenbrand's "virtio-mem:
paravirtualized memory" RFC V4 version and use new interface
offline_and_remove_memory().
https://lkml.org/lkml/2019/12/12/681

Change since V1:
	- Split patch into small patch for review.
	- Convert ha_lock from spin lock to mutex.
	- Add a common work to handle all mem hot plug and
	balloon msg
	- Use offline_and_remove_memory() to offline and remove
	memory.

Tianyu Lan (10):
  mm/resource: Move child to new resource when release mem region.
  mm: expose is_mem_section_removable() symbol
  x86/Hyper-V/Balloon: Replace hot-add and balloon up works with a
    common work
  x86/Hyper-V/Balloon: Convert spin lock ha_lock to mutex
  x86/Hyper-V/Balloon: Avoid releasing ha_lock when traverse
    ha_region_list
  x86/Hyper-V/Balloon: Enable mem hot-remove capability
  x86/Hyper-V/Balloon: Handle mem hot-remove request
  x86/Hyper-V/Balloon: Handle request with non-aligned page number
  x86/Hyper-V/Balloon: Hot add mem in the gaps of hot add region
  x86/Hyper-V: Workaround Hyper-V unballoon msg bug

 drivers/hv/hv_balloon.c | 754 ++++++++++++++++++++++++++++++++++++++++--------
 kernel/resource.c       |  38 ++-
 mm/memory_hotplug.c     |   1 +
 3 files changed, 673 insertions(+), 120 deletions(-)

-- 
2.14.5

[RFC PATCH V2 1/10] mm/resource: Move child to new resource when release mem region.

[lantianyu1986]

From: Tianyu Lan <Tianyu.Lan@microsoft.com>

When release mem region, old mem region may be splited to
two regions. Current allocate new struct resource for high
end mem region but not move child resources whose ranges are
in the high end range to new resource. When adjust old mem
region's range, adjust_resource() detects child region's range
is out of new range and return error. Move child resources to
high end resource before adjusting old mem range.

Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
---
 kernel/resource.c | 38 ++++++++++++++++++++++++++++++++++----
 1 file changed, 34 insertions(+), 4 deletions(-)

diff --git a/kernel/resource.c b/kernel/resource.c
index 76036a41143b..1c7362825134 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -181,6 +181,38 @@ static struct resource *alloc_resource(gfp_t flags)
 	return res;
 }
 
+static void move_child_to_newresource(struct resource *old,
+				      struct resource *new)
+{
+	struct resource *tmp, **p, **np;
+
+	if (!old->child)
+		return;
+
+	p = &old->child;
+	np = &new->child;
+
+	for (;;) {
+		tmp = *p;
+		if (!tmp)
+			break;
+
+		if (tmp->start >= new->start && tmp->end <= new->end) {
+			tmp->parent = new;
+			*np = tmp;
+			np = &tmp->sibling;
+			*p = tmp->sibling;
+
+			if (!tmp->sibling)
+				*np = NULL;
+			continue;
+		}
+
+		p = &tmp->sibling;
+	}
+}
+
+
 /* Return the conflict entry if you can't request it */
 static struct resource * __request_resource(struct resource *root, struct resource *new)
 {
@@ -1246,9 +1278,6 @@ EXPORT_SYMBOL(__release_region);
  * Note:
  * - Additional release conditions, such as overlapping region, can be
  *   supported after they are confirmed as valid cases.
- * - When a busy memory resource gets split into two entries, the code
- *   assumes that all children remain in the lower address entry for
- *   simplicity.  Enhance this logic when necessary.
  */
 int release_mem_region_adjustable(struct resource *parent,
 				  resource_size_t start, resource_size_t size)
@@ -1331,11 +1360,12 @@ int release_mem_region_adjustable(struct resource *parent,
 			new_res->sibling = res->sibling;
 			new_res->child = NULL;
 
+			move_child_to_newresource(res, new_res);
+			res->sibling = new_res;
 			ret = __adjust_resource(res, res->start,
 						start - res->start);
 			if (ret)
 				break;
-			res->sibling = new_res;
 			new_res = NULL;
 		}
 
-- 
2.14.5

RE: [RFC PATCH V2 1/10] mm/resource: Move child to new resource when release mem region.

[Michael Kelley]

From: Tianyu Lan <Tianyu.Lan@microsoft.com> Sent: Tuesday, January 7, 2020 5:10 AM
> 
> When release mem region, old mem region may be splited to
> two regions. Current allocate new struct resource for high
> end mem region but not move child resources whose ranges are
> in the high end range to new resource. When adjust old mem
> region's range, adjust_resource() detects child region's range
> is out of new range and return error. Move child resources to
> high end resource before adjusting old mem range.
> 
> Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
> ---
>  kernel/resource.c | 38 ++++++++++++++++++++++++++++++++++----
>  1 file changed, 34 insertions(+), 4 deletions(-)
> 
> diff --git a/kernel/resource.c b/kernel/resource.c
> index 76036a41143b..1c7362825134 100644
> --- a/kernel/resource.c
> +++ b/kernel/resource.c
> @@ -181,6 +181,38 @@ static struct resource *alloc_resource(gfp_t flags)
>  	return res;
>  }
> 
> +static void move_child_to_newresource(struct resource *old,
> +				      struct resource *new)
> +{
> +	struct resource *tmp, **p, **np;
> +
> +	if (!old->child)
> +		return;

I don't think the above test is needed.  This case is handled by the first
three lines of the "for" loop.

> +
> +	p = &old->child;
> +	np = &new->child;
> +
> +	for (;;) {
> +		tmp = *p;
> +		if (!tmp)
> +			break;
> +
> +		if (tmp->start >= new->start && tmp->end <= new->end) {
> +			tmp->parent = new;
> +			*np = tmp;
> +			np = &tmp->sibling;
> +			*p = tmp->sibling;
> +
> +			if (!tmp->sibling)
> +				*np = NULL;

I don't think the above two lines are right.  They seem tautological.  If the ! were
removed it would be clearing the sibling link for the child as it exists under its new
parent, which should be done.  But the child that is moved to the new parent always
becomes the last entry in the new parent's child list.  So could you just unconditionally
do tmp->sibling = NULL?   That link will get fixed up if another child is moved.

Michael

> +			continue;
> +		}
> +
> +		p = &tmp->sibling;
> +	}
> +}
> +
> +
>  /* Return the conflict entry if you can't request it */
>  static struct resource * __request_resource(struct resource *root, struct resource *new)
>  {
> @@ -1246,9 +1278,6 @@ EXPORT_SYMBOL(__release_region);
>   * Note:
>   * - Additional release conditions, such as overlapping region, can be
>   *   supported after they are confirmed as valid cases.
> - * - When a busy memory resource gets split into two entries, the code
> - *   assumes that all children remain in the lower address entry for
> - *   simplicity.  Enhance this logic when necessary.
>   */
>  int release_mem_region_adjustable(struct resource *parent,
>  				  resource_size_t start, resource_size_t size)
> @@ -1331,11 +1360,12 @@ int release_mem_region_adjustable(struct resource *parent,
>  			new_res->sibling = res->sibling;
>  			new_res->child = NULL;
> 
> +			move_child_to_newresource(res, new_res);
> +			res->sibling = new_res;
>  			ret = __adjust_resource(res, res->start,
>  						start - res->start);
>  			if (ret)
>  				break;
> -			res->sibling = new_res;
>  			new_res = NULL;
>  		}
> 
> --
> 2.14.5

RE: [RFC PATCH V2 1/10] mm/resource: Move child to new resource when release mem region.

[Michael Kelley]

From: Tianyu Lan <Tianyu.Lan@microsoft.com> Sent: Tuesday, January 7, 2020 5:10 AM
> 
> When release mem region, old mem region may be splited to
> two regions. Current allocate new struct resource for high
> end mem region but not move child resources whose ranges are
> in the high end range to new resource. When adjust old mem
> region's range, adjust_resource() detects child region's range
> is out of new range and return error. Move child resources to
> high end resource before adjusting old mem range.

Let me also suggests some wording improvements to the commit message:

When releasing a mem region, the old mem region may need to be
split into two regions.  In this case, the current code allocates the new
region and adjust the original region to specify a smaller range.  But child
regions that fall into the range of the new region are not moved to that
new region.  Consequently, when running __adjust_resource() on the
original region, it detects that the child region's range is out of the new
range, and returns an error.

Fix this by moving appropriate child resources to the new region before
adjusting the original mem region range.

> 
> Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
> ---
>  kernel/resource.c | 38 ++++++++++++++++++++++++++++++++++----
>  1 file changed, 34 insertions(+), 4 deletions(-)
> 

[RFC PATCH V2 2/10] mm: expose is_mem_section_removable() symbol

[lantianyu1986]

From: Tianyu Lan <Tianyu.Lan@microsoft.com>

Hyper-V balloon driver will use is_mem_section_removable() to
check whether memory block is removable or not when receive
memory hot remove msg. Expose it.

Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
---
 mm/memory_hotplug.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index d04369e6d3cc..a4ebfc5c48b3 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1179,6 +1179,7 @@ bool is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
 	/* All pageblocks in the memory block are likely to be hot-removable */
 	return true;
 }
+EXPORT_SYMBOL_GPL(is_mem_section_removable);
 
 /*
  * Confirm all pages in a range [start, end) belong to the same zone.
-- 
2.14.5

Re: [RFC PATCH V2 2/10] mm: expose is_mem_section_removable() symbol

[Michal Hocko]

On Tue 07-01-20 21:09:42, lantianyu1986@gmail.com wrote:
> From: Tianyu Lan <Tianyu.Lan@microsoft.com>
> 
> Hyper-V balloon driver will use is_mem_section_removable() to
> check whether memory block is removable or not when receive
> memory hot remove msg. Expose it.

I do not think this is a good idea. The check is inherently racy. Why
cannot the balloon driver simply hotremove the region when asked?
-- 
Michal Hocko
SUSE Labs

Re: [RFC PATCH V2 2/10] mm: expose is_mem_section_removable() symbol

[David Hildenbrand]

On 07.01.20 14:36, Michal Hocko wrote:
> On Tue 07-01-20 21:09:42, lantianyu1986@gmail.com wrote:
>> From: Tianyu Lan <Tianyu.Lan@microsoft.com>
>>
>> Hyper-V balloon driver will use is_mem_section_removable() to
>> check whether memory block is removable or not when receive
>> memory hot remove msg. Expose it.
> 
> I do not think this is a good idea. The check is inherently racy. Why
> cannot the balloon driver simply hotremove the region when asked?
> 

It's not only racy, it also gives no guarantees. False postives and
false negatives are possible.

If you want to avoid having to loop forever trying to offline when
calling offline_and_remove_memory(), you could try to
alloc_contig_range() the memory first and then play the
PG_offline+notifier game like virtio-mem.

I don't remember clearly, but I think pinned pages can make offlining
loop for a long time. And I remember there were other scenarios as well
(including out of memory conditions and similar).

I sent an RFC [1] for powerpc/memtrace that does the same (just error
handling is more complicated as it wants to offline and remove multiple
consecutive memory blocks) - if you want to try to go down that path.

[1] https://lkml.kernel.org/r/20191217123851.8854-1-david@redhat.com

-- 
Thanks,

David / dhildenb

RE: [EXTERNAL] Re: [RFC PATCH V2 2/10] mm: expose is_mem_section_removable() symbol

[Tianyu Lan]

> From: David Hildenbrand <david@redhat.com>
> Sent: Friday, January 10, 2020 9:42 PM
> To: Michal Hocko <mhocko@kernel.org>; lantianyu1986@gmail.com
> Cc: KY Srinivasan <kys@microsoft.com>; Haiyang Zhang
> <haiyangz@microsoft.com>; Stephen Hemminger <sthemmin@microsoft.com>;
> sashal@kernel.org; akpm@linux-foundation.org; Michael Kelley
> <mikelley@microsoft.com>; Tianyu Lan <Tianyu.Lan@microsoft.com>; linux-
> hyperv@vger.kernel.org; linux-kernel@vger.kernel.org; linux-mm@kvack.org;
> vkuznets <vkuznets@redhat.com>; eric.devolder@oracle.com; vbabka@suse.cz;
> osalvador@suse.de; Pasha Tatashin <Pavel.Tatashin@microsoft.com>;
> rppt@linux.ibm.com
> Subject: [EXTERNAL] Re: [RFC PATCH V2 2/10] mm: expose
> is_mem_section_removable() symbol
> 
> On 07.01.20 14:36, Michal Hocko wrote:
> > On Tue 07-01-20 21:09:42, lantianyu1986@gmail.com wrote:
> >> From: Tianyu Lan <Tianyu.Lan@microsoft.com>
> >>
> >> Hyper-V balloon driver will use is_mem_section_removable() to check
> >> whether memory block is removable or not when receive memory hot
> >> remove msg. Expose it.
> >
> > I do not think this is a good idea. The check is inherently racy. Why
> > cannot the balloon driver simply hotremove the region when asked?
> >
> 
> It's not only racy, it also gives no guarantees. False postives and false negatives
> are possible.
> 
> If you want to avoid having to loop forever trying to offline when calling
> offline_and_remove_memory(), you could try to
> alloc_contig_range() the memory first and then play the PG_offline+notifier
> game like virtio-mem.
> 
> I don't remember clearly, but I think pinned pages can make offlining loop for a
> long time. And I remember there were other scenarios as well (including out of
> memory conditions and similar).
> 
> I sent an RFC [1] for powerpc/memtrace that does the same (just error
> handling is more complicated as it wants to offline and remove multiple
> consecutive memory blocks) - if you want to try to go down that path.
> 
Hi David & Michal:
	Thanks for your review. Some memory blocks are not suitable for hot-plug.
If not check memory block's removable, offline_pages() will report some failure error
e.g, "failed due to memory holes" and  "failure to isolate range". I think the check maybe
added into offline_and_remove_memory()? This may help to not create/expose a new
interface to do such check in module.

Re: [EXTERNAL] Re: [RFC PATCH V2 2/10] mm: expose is_mem_section_removable() symbol

[David Hildenbrand]

On 13.01.20 15:49, Tianyu Lan wrote:
>> From: David Hildenbrand <david@redhat.com>
>> Sent: Friday, January 10, 2020 9:42 PM
>> To: Michal Hocko <mhocko@kernel.org>; lantianyu1986@gmail.com
>> Cc: KY Srinivasan <kys@microsoft.com>; Haiyang Zhang
>> <haiyangz@microsoft.com>; Stephen Hemminger <sthemmin@microsoft.com>;
>> sashal@kernel.org; akpm@linux-foundation.org; Michael Kelley
>> <mikelley@microsoft.com>; Tianyu Lan <Tianyu.Lan@microsoft.com>; linux-
>> hyperv@vger.kernel.org; linux-kernel@vger.kernel.org; linux-mm@kvack.org;
>> vkuznets <vkuznets@redhat.com>; eric.devolder@oracle.com; vbabka@suse.cz;
>> osalvador@suse.de; Pasha Tatashin <Pavel.Tatashin@microsoft.com>;
>> rppt@linux.ibm.com
>> Subject: [EXTERNAL] Re: [RFC PATCH V2 2/10] mm: expose
>> is_mem_section_removable() symbol
>>
>> On 07.01.20 14:36, Michal Hocko wrote:
>>> On Tue 07-01-20 21:09:42, lantianyu1986@gmail.com wrote:
>>>> From: Tianyu Lan <Tianyu.Lan@microsoft.com>
>>>>
>>>> Hyper-V balloon driver will use is_mem_section_removable() to check
>>>> whether memory block is removable or not when receive memory hot
>>>> remove msg. Expose it.
>>>
>>> I do not think this is a good idea. The check is inherently racy. Why
>>> cannot the balloon driver simply hotremove the region when asked?
>>>
>>
>> It's not only racy, it also gives no guarantees. False postives and false negatives
>> are possible.
>>
>> If you want to avoid having to loop forever trying to offline when calling
>> offline_and_remove_memory(), you could try to
>> alloc_contig_range() the memory first and then play the PG_offline+notifier
>> game like virtio-mem.
>>
>> I don't remember clearly, but I think pinned pages can make offlining loop for a
>> long time. And I remember there were other scenarios as well (including out of
>> memory conditions and similar).
>>
>> I sent an RFC [1] for powerpc/memtrace that does the same (just error
>> handling is more complicated as it wants to offline and remove multiple
>> consecutive memory blocks) - if you want to try to go down that path.
>>
> Hi David & Michal:
> 	Thanks for your review. Some memory blocks are not suitable for hot-plug.
> If not check memory block's removable, offline_pages() will report some failure error
> e.g, "failed due to memory holes" and  "failure to isolate range". I think the check maybe
> added into offline_and_remove_memory()? This may help to not create/expose a new
> interface to do such check in module.

So it's all about the logging output. Duplicating these checks feels
very wrong. And you will still get plenty of page dumps (read below), so
that won't help.

We have pr_debug() for these "failure ..." message. that should
therefore not be an issue on production systems, right?

However, you will see dump_page()s quite often, which logs via pr_warn().

Of course, we could add a mechanism to temporarily disable logging
output for these call paths, but it might actually be helpful for
debugging. We might just want to convert everything that is not actually
a warning to pr_debug() - especially in dump_page().

-- 
Thanks,

David / dhildenb

Re: [EXTERNAL] Re: [RFC PATCH V2 2/10] mm: expose is_mem_section_removable() symbol

[Michal Hocko]

On Mon 13-01-20 14:49:38, Tianyu Lan wrote:
> Hi David & Michal:
> 	Thanks for your review. Some memory blocks are not suitable for hot-plug.
> If not check memory block's removable, offline_pages() will report some failure error
> e.g, "failed due to memory holes" and  "failure to isolate range". I think the check maybe
> added into offline_and_remove_memory()? This may help to not create/expose a new
> interface to do such check in module.

Why is a log message a problem in the first place. The operation has
failed afterall. Does the driver try to offline an arbitrary memory?
Could you describe your usecase in more details please?
-- 
Michal Hocko
SUSE Labs

RE: [EXTERNAL] Re: [RFC PATCH V2 2/10] mm: expose is_mem_section_removable() symbol

[Tianyu Lan]

> From: Michal Hocko <mhocko@kernel.org>
> Sent: Tuesday, January 14, 2020 5:51 PM
> To: Tianyu Lan <Tianyu.Lan@microsoft.com>
> Cc: David Hildenbrand <david@redhat.com>; lantianyu1986@gmail.com; KY
> Srinivasan <kys@microsoft.com>; Haiyang Zhang <haiyangz@microsoft.com>;
> Stephen Hemminger <sthemmin@microsoft.com>; sashal@kernel.org;
> akpm@linux-foundation.org; Michael Kelley <mikelley@microsoft.com>; linux-
> hyperv@vger.kernel.org; linux-kernel@vger.kernel.org; linux-mm@kvack.org;
> vkuznets <vkuznets@redhat.com>; eric.devolder@oracle.com; vbabka@suse.cz;
> osalvador@suse.de; Pasha Tatashin <Pavel.Tatashin@microsoft.com>;
> rppt@linux.ibm.com
> Subject: Re: [EXTERNAL] Re: [RFC PATCH V2 2/10] mm: expose
> is_mem_section_removable() symbol
> 
> On Mon 13-01-20 14:49:38, Tianyu Lan wrote:
> > Hi David & Michal:
> > 	Thanks for your review. Some memory blocks are not suitable for hot-
> plug.
> > If not check memory block's removable, offline_pages() will report
> > some failure error e.g, "failed due to memory holes" and  "failure to
> > isolate range". I think the check maybe added into
> > offline_and_remove_memory()? This may help to not create/expose a new
> interface to do such check in module.
> 
> Why is a log message a problem in the first place. The operation has failed
> afterall. Does the driver try to offline an arbitrary memory?

Yes.

> Could you describe your usecase in more details please?

Hyper-V sends hot-remove request message which just contains requested
page number but not provide detail range. So Hyper-V driver needs to search
suitable memory block in system memory to return back to host if there is no
memory hot-add before. So I used the is_mem_section_removable() do such check.

Re: [EXTERNAL] Re: [RFC PATCH V2 2/10] mm: expose is_mem_section_removable() symbol

[Michal Hocko]

On Fri 17-01-20 16:35:03, Tianyu Lan wrote:
[...]
> > Could you describe your usecase in more details please?
> 
> Hyper-V sends hot-remove request message which just contains requested
> page number but not provide detail range. So Hyper-V driver needs to search
> suitable memory block in system memory to return back to host if there is no
> memory hot-add before. So I used the is_mem_section_removable() do such check.

As David described, you would be much better of by using
alloc_contig_range to find a memory that would be suitable for
hotremoving without any races.
-- 
Michal Hocko
SUSE Labs