442 lines · plain
1=====================================2Heterogeneous Memory Management (HMM)3=====================================4 5Provide infrastructure and helpers to integrate non-conventional memory (device6memory like GPU on board memory) into regular kernel path, with the cornerstone7of this being specialized struct page for such memory (see sections 5 to 7 of8this document).9 10HMM also provides optional helpers for SVM (Share Virtual Memory), i.e.,11allowing a device to transparently access program addresses coherently with12the CPU meaning that any valid pointer on the CPU is also a valid pointer13for the device. This is becoming mandatory to simplify the use of advanced14heterogeneous computing where GPU, DSP, or FPGA are used to perform various15computations on behalf of a process.16 17This document is divided as follows: in the first section I expose the problems18related to using device specific memory allocators. In the second section, I19expose the hardware limitations that are inherent to many platforms. The third20section gives an overview of the HMM design. The fourth section explains how21CPU page-table mirroring works and the purpose of HMM in this context. The22fifth section deals with how device memory is represented inside the kernel.23Finally, the last section presents a new migration helper that allows24leveraging the device DMA engine.25 26.. contents:: :local:27 28Problems of using a device specific memory allocator29====================================================30 31Devices with a large amount of on board memory (several gigabytes) like GPUs32have historically managed their memory through dedicated driver specific APIs.33This creates a disconnect between memory allocated and managed by a device34driver and regular application memory (private anonymous, shared memory, or35regular file backed memory). From here on I will refer to this aspect as split36address space. I use shared address space to refer to the opposite situation:37i.e., one in which any application memory region can be used by a device38transparently.39 40Split address space happens because devices can only access memory allocated41through a device specific API. This implies that all memory objects in a program42are not equal from the device point of view which complicates large programs43that rely on a wide set of libraries.44 45Concretely, this means that code that wants to leverage devices like GPUs needs46to copy objects between generically allocated memory (malloc, mmap private, mmap47share) and memory allocated through the device driver API (this still ends up48with an mmap but of the device file).49 50For flat data sets (array, grid, image, ...) this isn't too hard to achieve but51for complex data sets (list, tree, ...) it's hard to get right. Duplicating a52complex data set needs to re-map all the pointer relations between each of its53elements. This is error prone and programs get harder to debug because of the54duplicate data set and addresses.55 56Split address space also means that libraries cannot transparently use data57they are getting from the core program or another library and thus each library58might have to duplicate its input data set using the device specific memory59allocator. Large projects suffer from this and waste resources because of the60various memory copies.61 62Duplicating each library API to accept as input or output memory allocated by63each device specific allocator is not a viable option. It would lead to a64combinatorial explosion in the library entry points.65 66Finally, with the advance of high level language constructs (in C++ but in67other languages too) it is now possible for the compiler to leverage GPUs and68other devices without programmer knowledge. Some compiler identified patterns69are only doable with a shared address space. It is also more reasonable to use70a shared address space for all other patterns.71 72 73I/O bus, device memory characteristics74======================================75 76I/O buses cripple shared address spaces due to a few limitations. Most I/O77buses only allow basic memory access from device to main memory; even cache78coherency is often optional. Access to device memory from a CPU is even more79limited. More often than not, it is not cache coherent.80 81If we only consider the PCIE bus, then a device can access main memory (often82through an IOMMU) and be cache coherent with the CPUs. However, it only allows83a limited set of atomic operations from the device on main memory. This is worse84in the other direction: the CPU can only access a limited range of the device85memory and cannot perform atomic operations on it. Thus device memory cannot86be considered the same as regular memory from the kernel point of view.87 88Another crippling factor is the limited bandwidth (~32GBytes/s with PCIE 4.089and 16 lanes). This is 33 times less than the fastest GPU memory (1 TBytes/s).90The final limitation is latency. Access to main memory from the device has an91order of magnitude higher latency than when the device accesses its own memory.92 93Some platforms are developing new I/O buses or additions/modifications to PCIE94to address some of these limitations (OpenCAPI, CCIX). They mainly allow95two-way cache coherency between CPU and device and allow all atomic operations the96architecture supports. Sadly, not all platforms are following this trend and97some major architectures are left without hardware solutions to these problems.98 99So for shared address space to make sense, not only must we allow devices to100access any memory but we must also permit any memory to be migrated to device101memory while the device is using it (blocking CPU access while it happens).102 103 104Shared address space and migration105==================================106 107HMM intends to provide two main features. The first one is to share the address108space by duplicating the CPU page table in the device page table so the same109address points to the same physical memory for any valid main memory address in110the process address space.111 112To achieve this, HMM offers a set of helpers to populate the device page table113while keeping track of CPU page table updates. Device page table updates are114not as easy as CPU page table updates. To update the device page table, you must115allocate a buffer (or use a pool of pre-allocated buffers) and write GPU116specific commands in it to perform the update (unmap, cache invalidations, and117flush, ...). This cannot be done through common code for all devices. Hence118why HMM provides helpers to factor out everything that can be while leaving the119hardware specific details to the device driver.120 121The second mechanism HMM provides is a new kind of ZONE_DEVICE memory that122allows allocating a struct page for each page of device memory. Those pages123are special because the CPU cannot map them. However, they allow migrating124main memory to device memory using existing migration mechanisms and everything125looks like a page that is swapped out to disk from the CPU point of view. Using a126struct page gives the easiest and cleanest integration with existing mm127mechanisms. Here again, HMM only provides helpers, first to hotplug new ZONE_DEVICE128memory for the device memory and second to perform migration. Policy decisions129of what and when to migrate is left to the device driver.130 131Note that any CPU access to a device page triggers a page fault and a migration132back to main memory. For example, when a page backing a given CPU address A is133migrated from a main memory page to a device page, then any CPU access to134address A triggers a page fault and initiates a migration back to main memory.135 136With these two features, HMM not only allows a device to mirror process address137space and keeps both CPU and device page tables synchronized, but also138leverages device memory by migrating the part of the data set that is actively being139used by the device.140 141 142Address space mirroring implementation and API143==============================================144 145Address space mirroring's main objective is to allow duplication of a range of146CPU page table into a device page table; HMM helps keep both synchronized. A147device driver that wants to mirror a process address space must start with the148registration of a mmu_interval_notifier::149 150 int mmu_interval_notifier_insert(struct mmu_interval_notifier *interval_sub,151 struct mm_struct *mm, unsigned long start,152 unsigned long length,153 const struct mmu_interval_notifier_ops *ops);154 155During the ops->invalidate() callback the device driver must perform the156update action to the range (mark range read only, or fully unmap, etc.). The157device must complete the update before the driver callback returns.158 159When the device driver wants to populate a range of virtual addresses, it can160use::161 162 int hmm_range_fault(struct hmm_range *range);163 164It will trigger a page fault on missing or read-only entries if write access is165requested (see below). Page faults use the generic mm page fault code path just166like a CPU page fault. The usage pattern is::167 168 int driver_populate_range(...)169 {170 struct hmm_range range;171 ...172 173 range.notifier = &interval_sub;174 range.start = ...;175 range.end = ...;176 range.hmm_pfns = ...;177 178 if (!mmget_not_zero(interval_sub->notifier.mm))179 return -EFAULT;180 181 again:182 range.notifier_seq = mmu_interval_read_begin(&interval_sub);183 mmap_read_lock(mm);184 ret = hmm_range_fault(&range);185 if (ret) {186 mmap_read_unlock(mm);187 if (ret == -EBUSY)188 goto again;189 return ret;190 }191 mmap_read_unlock(mm);192 193 take_lock(driver->update);194 if (mmu_interval_read_retry(&ni, range.notifier_seq) {195 release_lock(driver->update);196 goto again;197 }198 199 /* Use pfns array content to update device page table,200 * under the update lock */201 202 release_lock(driver->update);203 return 0;204 }205 206The driver->update lock is the same lock that the driver takes inside its207invalidate() callback. That lock must be held before calling208mmu_interval_read_retry() to avoid any race with a concurrent CPU page table209update.210 211Leverage default_flags and pfn_flags_mask212=========================================213 214The hmm_range struct has 2 fields, default_flags and pfn_flags_mask, that specify215fault or snapshot policy for the whole range instead of having to set them216for each entry in the pfns array.217 218For instance if the device driver wants pages for a range with at least read219permission, it sets::220 221 range->default_flags = HMM_PFN_REQ_FAULT;222 range->pfn_flags_mask = 0;223 224and calls hmm_range_fault() as described above. This will fill fault all pages225in the range with at least read permission.226 227Now let's say the driver wants to do the same except for one page in the range for228which it wants to have write permission. Now driver set::229 230 range->default_flags = HMM_PFN_REQ_FAULT;231 range->pfn_flags_mask = HMM_PFN_REQ_WRITE;232 range->pfns[index_of_write] = HMM_PFN_REQ_WRITE;233 234With this, HMM will fault in all pages with at least read (i.e., valid) and for the235address == range->start + (index_of_write << PAGE_SHIFT) it will fault with236write permission i.e., if the CPU pte does not have write permission set then HMM237will call handle_mm_fault().238 239After hmm_range_fault completes the flag bits are set to the current state of240the page tables, ie HMM_PFN_VALID | HMM_PFN_WRITE will be set if the page is241writable.242 243 244Represent and manage device memory from core kernel point of view245=================================================================246 247Several different designs were tried to support device memory. The first one248used a device specific data structure to keep information about migrated memory249and HMM hooked itself in various places of mm code to handle any access to250addresses that were backed by device memory. It turns out that this ended up251replicating most of the fields of struct page and also needed many kernel code252paths to be updated to understand this new kind of memory.253 254Most kernel code paths never try to access the memory behind a page255but only care about struct page contents. Because of this, HMM switched to256directly using struct page for device memory which left most kernel code paths257unaware of the difference. We only need to make sure that no one ever tries to258map those pages from the CPU side.259 260Migration to and from device memory261===================================262 263Because the CPU cannot access device memory directly, the device driver must264use hardware DMA or device specific load/store instructions to migrate data.265The migrate_vma_setup(), migrate_vma_pages(), and migrate_vma_finalize()266functions are designed to make drivers easier to write and to centralize common267code across drivers.268 269Before migrating pages to device private memory, special device private270``struct page`` needs to be created. These will be used as special "swap"271page table entries so that a CPU process will fault if it tries to access272a page that has been migrated to device private memory.273 274These can be allocated and freed with::275 276 struct resource *res;277 struct dev_pagemap pagemap;278 279 res = request_free_mem_region(&iomem_resource, /* number of bytes */,280 "name of driver resource");281 pagemap.type = MEMORY_DEVICE_PRIVATE;282 pagemap.range.start = res->start;283 pagemap.range.end = res->end;284 pagemap.nr_range = 1;285 pagemap.ops = &device_devmem_ops;286 memremap_pages(&pagemap, numa_node_id());287 288 memunmap_pages(&pagemap);289 release_mem_region(pagemap.range.start, range_len(&pagemap.range));290 291There are also devm_request_free_mem_region(), devm_memremap_pages(),292devm_memunmap_pages(), and devm_release_mem_region() when the resources can293be tied to a ``struct device``.294 295The overall migration steps are similar to migrating NUMA pages within system296memory (see Documentation/mm/page_migration.rst) but the steps are split297between device driver specific code and shared common code:298 2991. ``mmap_read_lock()``300 301 The device driver has to pass a ``struct vm_area_struct`` to302 migrate_vma_setup() so the mmap_read_lock() or mmap_write_lock() needs to303 be held for the duration of the migration.304 3052. ``migrate_vma_setup(struct migrate_vma *args)``306 307 The device driver initializes the ``struct migrate_vma`` fields and passes308 the pointer to migrate_vma_setup(). The ``args->flags`` field is used to309 filter which source pages should be migrated. For example, setting310 ``MIGRATE_VMA_SELECT_SYSTEM`` will only migrate system memory and311 ``MIGRATE_VMA_SELECT_DEVICE_PRIVATE`` will only migrate pages residing in312 device private memory. If the latter flag is set, the ``args->pgmap_owner``313 field is used to identify device private pages owned by the driver. This314 avoids trying to migrate device private pages residing in other devices.315 Currently only anonymous private VMA ranges can be migrated to or from316 system memory and device private memory.317 318 One of the first steps migrate_vma_setup() does is to invalidate other319 device's MMUs with the ``mmu_notifier_invalidate_range_start(()`` and320 ``mmu_notifier_invalidate_range_end()`` calls around the page table321 walks to fill in the ``args->src`` array with PFNs to be migrated.322 The ``invalidate_range_start()`` callback is passed a323 ``struct mmu_notifier_range`` with the ``event`` field set to324 ``MMU_NOTIFY_MIGRATE`` and the ``owner`` field set to325 the ``args->pgmap_owner`` field passed to migrate_vma_setup(). This326 allows the device driver to skip the invalidation callback and only327 invalidate device private MMU mappings that are actually migrating.328 This is explained more in the next section.329 330 While walking the page tables, a ``pte_none()`` or ``is_zero_pfn()``331 entry results in a valid "zero" PFN stored in the ``args->src`` array.332 This lets the driver allocate device private memory and clear it instead333 of copying a page of zeros. Valid PTE entries to system memory or334 device private struct pages will be locked with ``lock_page()``, isolated335 from the LRU (if system memory since device private pages are not on336 the LRU), unmapped from the process, and a special migration PTE is337 inserted in place of the original PTE.338 migrate_vma_setup() also clears the ``args->dst`` array.339 3403. The device driver allocates destination pages and copies source pages to341 destination pages.342 343 The driver checks each ``src`` entry to see if the ``MIGRATE_PFN_MIGRATE``344 bit is set and skips entries that are not migrating. The device driver345 can also choose to skip migrating a page by not filling in the ``dst``346 array for that page.347 348 The driver then allocates either a device private struct page or a349 system memory page, locks the page with ``lock_page()``, and fills in the350 ``dst`` array entry with::351 352 dst[i] = migrate_pfn(page_to_pfn(dpage));353 354 Now that the driver knows that this page is being migrated, it can355 invalidate device private MMU mappings and copy device private memory356 to system memory or another device private page. The core Linux kernel357 handles CPU page table invalidations so the device driver only has to358 invalidate its own MMU mappings.359 360 The driver can use ``migrate_pfn_to_page(src[i])`` to get the361 ``struct page`` of the source and either copy the source page to the362 destination or clear the destination device private memory if the pointer363 is ``NULL`` meaning the source page was not populated in system memory.364 3654. ``migrate_vma_pages()``366 367 This step is where the migration is actually "committed".368 369 If the source page was a ``pte_none()`` or ``is_zero_pfn()`` page, this370 is where the newly allocated page is inserted into the CPU's page table.371 This can fail if a CPU thread faults on the same page. However, the page372 table is locked and only one of the new pages will be inserted.373 The device driver will see that the ``MIGRATE_PFN_MIGRATE`` bit is cleared374 if it loses the race.375 376 If the source page was locked, isolated, etc. the source ``struct page``377 information is now copied to destination ``struct page`` finalizing the378 migration on the CPU side.379 3805. Device driver updates device MMU page tables for pages still migrating,381 rolling back pages not migrating.382 383 If the ``src`` entry still has ``MIGRATE_PFN_MIGRATE`` bit set, the device384 driver can update the device MMU and set the write enable bit if the385 ``MIGRATE_PFN_WRITE`` bit is set.386 3876. ``migrate_vma_finalize()``388 389 This step replaces the special migration page table entry with the new390 page's page table entry and releases the reference to the source and391 destination ``struct page``.392 3937. ``mmap_read_unlock()``394 395 The lock can now be released.396 397Exclusive access memory398=======================399 400Some devices have features such as atomic PTE bits that can be used to implement401atomic access to system memory. To support atomic operations to a shared virtual402memory page such a device needs access to that page which is exclusive of any403userspace access from the CPU. The ``make_device_exclusive_range()`` function404can be used to make a memory range inaccessible from userspace.405 406This replaces all mappings for pages in the given range with special swap407entries. Any attempt to access the swap entry results in a fault which is408resolved by replacing the entry with the original mapping. A driver gets409notified that the mapping has been changed by MMU notifiers, after which point410it will no longer have exclusive access to the page. Exclusive access is411guaranteed to last until the driver drops the page lock and page reference, at412which point any CPU faults on the page may proceed as described.413 414Memory cgroup (memcg) and rss accounting415========================================416 417For now, device memory is accounted as any regular page in rss counters (either418anonymous if device page is used for anonymous, file if device page is used for419file backed page, or shmem if device page is used for shared memory). This is a420deliberate choice to keep existing applications, that might start using device421memory without knowing about it, running unimpacted.422 423A drawback is that the OOM killer might kill an application using a lot of424device memory and not a lot of regular system memory and thus not freeing much425system memory. We want to gather more real world experience on how applications426and system react under memory pressure in the presence of device memory before427deciding to account device memory differently.428 429 430Same decision was made for memory cgroup. Device memory pages are accounted431against same memory cgroup a regular page would be accounted to. This does432simplify migration to and from device memory. This also means that migration433back from device memory to regular memory cannot fail because it would434go above memory cgroup limit. We might revisit this choice later on once we435get more experience in how device memory is used and its impact on memory436resource control.437 438 439Note that device memory can never be pinned by a device driver nor through GUP440and thus such memory is always free upon process exit. Or when last reference441is dropped in case of shared memory or file backed memory.442