Re: [PATCH v6 03/12] mm: add PMD swap entry splitting support

[Kiryl Shutsemau <kas@kernel.org>]

On Tue, Aug 18, 2026 at 06:09:44AM -0700, Usama Arif wrote:
> Add a swap branch in __split_huge_pmd_locked() that splits a PMD swap
> entry into 512 PTE swap entries. No folio reference is needed because
> swap entries point to swap slots rather than pages. Each PTE inherits
> the correct sub-slot offset and preserves soft_dirty, uffd_wp, and
> exclusive flags.
> 
> The folio_remove_rmap_pmd() gate at the end must inspect old_pmd
> rather than *pmd: for a present THP split, *pmd has already been
> cleared by pmdp_invalidate(), and that invalidated bit pattern can
> decode as a plausible swap entry.

Hm. On x86, pmd_present() recognises !_PAGE_PRESENT | _PAGE_PSE PMDs as
present. Other archs do similar thing. pmdp_invalidate() clears present
bit, but keeps PSE around, so it is present from SW PoV.

pmd_is_migration_entry() should work correctly on pmdp_invalidate()ed
entries.

> This branch is reached from the explicit __split_huge_pmd() callers
> that hit a non-present PMD: partial-range mprotect / munmap, the
> wp_huge_pmd() PMD-COW fallback, and the swap-in / swapoff fallbacks
> added in later patches when the cached folio is no longer PMD-sized.
> page_vma_mapped_walk() does not iterate PMD swap entries, so
> try_to_unmap_one() and try_to_migrate_one() do not reach this branch
> and freeze=true cannot occur in this branch today.  page and folio
> are therefore left uninitialized in the swap branch; a
> VM_WARN_ON_ONCE(freeze) catches any future caller that breaks this
> invariant before the freeze path dereferences page_to_pfn(page + i)
> or put_page(page).
> 
> Signed-off-by: Usama Arif <usama.arif@linux.dev>
> ---
>  mm/huge_memory.c | 29 ++++++++++++++++++++++++++++-
>  1 file changed, 28 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 1b6b0aa2baa3b..a473e85d30f51 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -3252,6 +3252,14 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
>  			folio_add_anon_rmap_ptes(folio, page, HPAGE_PMD_NR,
>  						 vma, haddr, rmap_flags);
>  		}
> +	} else if (pmd_is_swap_entry(*pmd)) {
> +		VM_WARN_ON_ONCE(freeze);
> +		/* Swap entries have no page for the migration freeze path. */
> +		freeze = false;
> +		old_pmd = *pmd;

PTL protects us from value drifting under us if compiler decides to load
it multiple times, right? Same pattern as the migration/device-private
branches above, so not a new concern, just checking.

BTW, do we want VM_WARN_ON_ONCE(pmd_is_swap_entry(old_pmd)) in
!vma_is_anonymous() branch to avoid surprises?

-- 
  Kiryl Shutsemau / Kirill A. Shutemov