mirror of
https://github.com/torvalds/linux.git
synced 2026-09-24 06:24:02 +02:00
master
961 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
a52a93358a |
14 hotfixes. 10 are cc:stable. 11 are for MM.
Five are DAMON fixes. One fixes an arm64 contpte bug where DAMON can write past the end of a page-table page, resulting in memory corruption and possible crashes. Two are hugetlb fixes. One fixes an mremap() address calculation bug which can panic x86-64. There's also a missing anon_vma publication barrier which can result in hung tasks, and a writeback fix to keep long cgroup writeback drains from delaying Tasks-RCU grace periods. The remainder are smaller fixes and maintenance changes. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCarHHNAAKCRDdBJ7gKXxA jhb7AP4yE/k7RrZC6zWg4M9ejI3fVlHI9+EG1mCLGiV57jZ4mAEA9LLSZryOD6Nc zsaeCtZhHcEdxW6EhO18hMfH4b7oJA0= =alhC -----END PGP SIGNATURE----- Merge tag 'mm-hotfixes-stable-2026-09-21-17-08' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM fixes from Andrew Morton: "14 hotfixes. 10 are cc:stable. 11 are for MM. Five DAMON fixes: one fixes an arm64 contpte bug where DAMON can write past the end of a page-table page, resulting in memory corruption and possible crashes. Two hugetlb fixes: one fixes an mremap() address calculation bug which can panic x86-64. There's also a missing anon_vma publication barrier which can result in hung tasks, and a writeback fix to keep long cgroup writeback drains from delaying Tasks-RCU grace periods. The remainder are smaller fixes and maintenance changes" * tag 'mm-hotfixes-stable-2026-09-21-17-08' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: MAINTAINERS: update Xu Xin's email writeback: report a Tasks-RCU quiescent state per cgwb drain pass mm/damon/core: reset invalid quota->charge_target_from MAINTAINERS: add Baoquan and Baolin as MGLRU reviewers mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish mm/hugetlb: preserve mremap address delta when skipping page tables mm/damon/core: fix unconditionally skip last region mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() mm/damon/core: allow esz to be set to zero mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold() ocfs2: make ocfs2_calc_xattr_init() return void mailmap: update Haowen Bai's email address selftests/cgroup: account for zswap shrinker writeback mm/hugetlb: do not dissolve gigantic pages without runtime support |
||
|
SJ Park
|
eb64948249 |
mm/damon/core: reset invalid quota->charge_target_from
DAMOS can suddenly stop working if a target process that the quota is just
fully charged on is terminated. Fix by catching and processing the corner
case.
When DAMOS quota is fully charged, the target and the region to continue
applying the action in the next round is saved in
damos_quota->charge_{target,addr}_from. In the next round, DAMOS iterates
targets and regions from the beginning. It skips applying the action to
the regions until it visits and skips the saved target/region.
Virtual address space targets become invalid if the process is terminated.
Trying to apply the scheme to invalid target is just a waste of time.
Hence commit
|
||
|
Liew Rui Yan
|
b3723b596b |
mm/damon/core: fix unconditionally skip last region
Once quota set, the charge_{target,addr}_from unconditionally skips and
resets at the last region of the tracked target, so the last region can be
skipped even when it has not been processed.
Example:
1. Target has 2 regions: R1 (0-100 bytes) and R2 (100-200 bytes).
2. Quota is configured to process only 100 bytes per window.
3. Window 1: Processes R1 (0-100). Quota is full. charge_{target,
addr}_from is saved at (Target, 100).
4. Window 2: The loop reaches R2. Because R2 is
damon_last_region(t), the old code unconditionally returns true,
skipping R2 entirely and resetting the charge_{target,addr}_from.
Result: R2 is permanently skipped even though it has never been
processed.
However, it is important to note that this is a very minor issue. This is
because it is triggered only when the previous window saved/kept
charge_{target,addr}_from, and in the next window, all regions except the
last region were skipped by damos_skip_charged_region().
Fix this by only resetting the charge_{target,addr}_from when last region
is reached, only skipping when it is applied or cannot split.
Link: https://lore.kernel.org/20260908134739.96919-1-sj@kernel.org
Fixes:
|
||
|
SJ Park
|
39c0ceedd5 |
mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
damon_hugetlb_mkold() reads the page table entry into a local variable,
unsets the accessed bit in the variable, and updates the page table entry
with the updated variable value. If hardware updates the same page table
entry in parallel, the hw updates could be lost. For example,
hardware-updated dirty bits might be lost.
Avoid the parallel updates by clearing the page table entry when reading
it together, using huge_ptep_get_and_clear(). If a parallel write to the
memory is made after the clearing, the hw will see the page table entry is
cleared, trigger page fault and wait until it is handled. The page fault
handling will wait for damon_hugetlb_mkold() due to the page table lock.
Because hugetlbfs is an in-memory file system and hugetlb pages cannot be
reclaimed, no critical issue is expected to my best knowledge. But
definitely this is a nasty bug that should be fixed sooner rather than
later.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260907170358.100168-1-sj@kernel.org
Link: https://lore.kernel.org/20260830160545.98969-1-sj@kernel.org [1]
Fixes:
|
||
|
Liew Rui Yan
|
90179da203 |
mm/damon/core: allow esz to be set to zero
When the temporal quota goal tuner determines that the goal has been
achieved (score >= 10000), it sets esz_bp to zero so that the esz becomes
zero. However, damos_set_effective_quota() clamps the esz to
min_region_sz when quota->ms is set.
This is a minor issue, the main problem is that it doesn't match the
description in the documentation, which state that if the goal has already
been [over-]achieved, the quota will be set to zero.
Fix this by set quota (esz) as minimum as possible.
Link: https://lore.kernel.org/20260908135413.97570-1-sj@kernel.org
Fixes:
|
||
|
Nathan Gao
|
f166586f74 |
mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()
__damon_va_prepare_access_check() picks a random byte address within the
region and stores it in r->sampling_addr. damon_va_mkold() passes it into
a page table walk, which hands it to damon_ptep_mkold() as the address of
the page to sample:
damon_va_mkold(mm, r->sampling_addr)
damon_va_walk_page_range(mm, addr, addr + 1)
damon_mkold_pmd_entry()
damon_ptep_mkold(pte, vma, addr)
ptep_test_and_clear_young(vma, addr, pte)
mmu_notifier_clear_young(mm, addr, addr + PAGE_SIZE)
For arm64, before commit
|
||
|
Kees Cook
|
3a2c4d55e3 |
treewide: refresh kmalloc_obj() conversions
This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook <kees+treewide@kernel.org> |
||
|
Linus Torvalds
|
ed3b875bea |
mm.git review status for mm-hotfixes-stable..mm-stable
Everything:
Total patches: 501
Reviews/patch: 1.66
Reviewed rate: 70%
Excluding DAMON:
Total patches: 356
Reviews/patch: 2.26
Reviewed rate: 90%
Excluding DAMON and selftests:
Total patches: 329
Reviews/patch: 2.31
Reviewed rate: 92%
Excluding DAMON, selftests and maple_tree:
Total patches: 328
Reviews/patch: 2.31
Reviewed rate: 92%
Summary of patch series in this merge:
- The 2 patch series "mm: drop "sub" prefix from various places" from
Dev Jain implements some page->folio conversion and a naming cleanup.
- The 2 patch series "mm/kasan: remove redundant initialization for
kasan_flag_write_only" from Igor Putko provides some KASAN cleanup work.
- The 2 patch series "mm/filemap: reduce unnecessary xarray lookups"
from Chi Zhiling provides a small speedup in the pagecaache read code.
- The 4 patch series "mm/percpu: Fix possible NOFS/NOIO reclaim
recursion" from Kaitao Cheng improves a few things in the vmalloc code -
mainly the avoidance of GFP_KERNEL allocations when the caller asked for
GFP_NOFS or GFP_NOIO.
- The 3 patch series "mm/kmemleak: avoid soft lockup when scanning task
stacks" from Breno Leitao avoids a soft lockup watchdog trigger from the
kmemleak scanning code in extreme situations.
- The 6 patch series "mm/page_owner: misc cleanups" from Ye Liu is a
collection of unrelated cleanups to the page_owner code. For some
reason lots of people have been working on the page_owner code this
cycle.
- The 4 patch series "mm: convert to walk_page_range_vma() to eliminate
find_vma()" from Kefeng Wang simplifies and accelerates the page walking
library function.
- The 3 patch series "mm/migrate: preparatory cleanups for batch copy
and offload" from Shivank Garg implements cleanups in the migration
code.
- The 4 patch series "mm/page_owner: add per-fd filter infrastructure
for print_mode and NUMA filtering" from Zhen Ni provides per-fd
filtering to page_owner in order to reduce the sometimes vast amount of
output it can produce.
- The 19 patch series "mm: Refactor bootmem gigantic hugepage
allocation" from Muchun Song is a "set of fixes and preparatory cleanups
around bootmem HugeTLB handling, sparse initialization ordering, and
related vmemmap setup".
- The 4 patch series "mm/zsmalloc: reduce lock contention in zs_free()"
from Wenchao Hao reduces lock contention in zs_free(), which dominates
the unmap path under memory pressure on Android (LMK kills) and on x86
servers running zswap-heavy workloads. Up to 1.83x improvement in
microbenchmarking.
- The 2 patch series "move alloc_tag.c file under mm/" from Suren
Baghdasaryan does that.
- The 6 patch series "samples/damon: handle damon_{start,stop}()
failures" from SJ Park fixes improper handling of damon_start(),
damon_stop(), and damon_call() failures across DAMON sample modules to
prevent potential memory leaks, operation disruptions and use-after-free
bugs.
- The 11 patch series "mm/damon/sysfs: kobject_del() directories that
users can create/remove" from SJ Park resolves an issue where delayed
sysfs directory removal under CONFIG_DEBUG_KOBJECT_RELEASE causes
creation failures due to duplicate directory names by adding missing
kobject_del() calls before creating new directories.
- The 3 patch series "mm: cleanup clear_not_present_full_ptes()" from
David Hildenbrand cleans up the core pte handling code.
- The 3 patch series "selftests/damon: misc fixes for test bugs" from
Kunwu Chan fixes several bugs in the DAMON selftests.
- The 2 patch series "selftests/damon: fix memcg_path staging handling"
from Cheng Nie fixes a bug in _damon_sysfs.py for damos_filter
memcg_path setup, and adds a test case for it in sysfs.py.
- The 2 patch series "selftests/damon: test kdamond refresh_ms" from
Ruslan Valiyev introduces selftest coverage for DAMON's refresh_ms sysfs
feature by updating the test control module and verifying that scheme
stats update automatically without manual intervention.
- The 5 patch series "mm/damon: five misc fixups" from Akinobu Mita
contains miscellaneous DAMON fixups.
- The 2 patch series "mm/damon/core: detect internal variation above
max_nr_regions/2" from Jiayuan Chen fixes DAMON's region splitting
behavior when region counts exceed half the maximum budget by
dynamically scaling down the split fraction as the limit approaches,
preventing large regions from staying un-split, and adds corresponding
KUnit test coverage.
- The 6 patch series "mm: preparatory patches for PMD level swap
entries" from Usama Arif refactors and cleans up PMD softleaf helpers,
call sites, and architecture flags to lay the groundwork for a follow-up
series that introduces PMD page table swap entries.
- The 11 patch series "mm/damon: update, optimize, and clean up doc,
tests, and code" from SJ Park updates DAMON design and ABI
documentation, expands unit and selftest coverage, optimizes
damon_commit_target_regions(), and cleans up recently added sysfs
interface code for better readability.
- The 2 patch series "mm/vmpressure: reduce CPU, memory and code
overhead on cgroup v2" from Usama Arif optimizes vmpressure() by
skipping unnecessary work on cgroup v2 for userspace event notifications
and refactors v1-only eventfd handling into mm/memcontrol-v1.c to reduce
memory overhead and code complexity.
- The 10 patch series "selftests/mm: refactor pkey helpers and fix mmap
error handling" from Hongfu Li refactors pkeys shared tracing and
assertion helpers into a common file, unifies protection key selftests
to use consistent diagnostic logging and assertions, and enforces
standardized MAP_FAILED return checks for mmap() calls across the tests.
- The 18 patch series "mm/damon: optimize out nr_accesses_bp" from SJ
Park replaces the error-prone, continuously updated nr_accesses_bp field
in damon_region with an on-demand moving sum function
(damon_nr_accesses_mvsum()), reducing structure memory overhead and
avoiding state corruption bugs.
- The 6 patch series "Open HugeTLB allocation routine for more generic
use" from Ackerley Tng decouples HugeTLB folio allocation from VMA
dependencies by introducing hugetlb_alloc_folio(), enabling subsystems
like guest_memfd to allocate HugeTLB folios without standard VMA
reservations or pseudo-VMAs.
- The 3 patch series "mm/damon: provide pseudo moving sum probe_hits"
from SJ Park integrates DAMON's probe_hits attribute counter into the
pseudo moving sum infrastructure, enabling real-time, online monitoring
without waiting for full aggregation intervals.
- The 18 patch series "mm: Some cleanups for page allocator APIs" from
Brendan Jackman simplifies and refactors the page allocator entry points
and flags by unifying allocation paths, adding internal alloc_flags
arguments, and eliminating redundant __ prefixed alloc_pages variants.
- The 5 patch series "Fix incorrect access of hugetlb pte entries" from
Dev Jain enforces the consistent use of huge_ptep_get() instead of
ptep_get() for HugeTLB entries and fixes an unaligned address issue in
arm64's huge_ptep_get() implementation.
- The 8 patch series "mm/damon: validate all parameters in the core"
from SJ Park consolidates parameter validation into the DAMON core
specifically within damon_start() and damon_commit_ctx() to centralize
error checking, eliminate caller-side redundant checks and to improve
maintenance efficiency.
- The 3 patch series "tools/mm/page_owner_sort: fix filtering and
cleanup issues" from Yichong Chen renames is_need() to filter_record()
for clearer return semantics, fixes per-record allocation memory leaks
and bounds output copies in search_pattern() to address an existing
buffer issue.
- The 4 patch series "memcg: bail out reclaim when memcg is dying" from
Jiayuan Chen mitigates a system-wide stall which occurs when a cgroup is
removed while one of its memory control files is doing synchronous
reclaim.
- The 5 patch series "mm/memory-failure: add panic option for
unrecoverable pages" from Breno Leitao introduces an opt-in
vm.panic_on_unrecoverable_memory_failure sysctl that immediately panics
the kernel on unrecoverable memory errors in kernel-owned pages to
preserve error context and prevent delayed, silent data corruption.
- The 11 patch series "mm/damon: refactor damon_{start,stop,commit}()
for simple error handling" from SJ Park refactors the DAMON core API
functions to guarantee that all contexts are fully stopped when
damon_start(), damon_stop(), or damon_commit() fail, eliminating the
need for complex and error-prone caller-side cleanup code.
- The 5 patch series "Keep tail page private zero at free and folio
split" from Zi Yan adds checks to ensure tail_page->private is zero when
freeing compound or high-order pages and when promoting tail pages
during large folio splits. By validating these fields at free and split
time, it allows the removal of redundant private field clearing inside
prep_compound_tail().
- The 4 patch series "mm: drop redundant lru_add_drain in anon folio
reuse paths" from Barry Song eliminates redundant lru_add_drain() calls
in wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
contention and system overhead.
By validating folio refcounts against the LRU cache before draining
and removing unnecessary drains in the swap path, it achieves up to a
30.5% reduction in drain calls during heavy swap workloads.
- The 3 patch series "mm: clean up folio LRU and swap declarations" from
Jianyue Wu reorganizes folio LRU and swap code by relocating
page-cluster state to mm/swap_state.c, renaming mm/swap.c to mm/folio.c,
and moving MM-internal reclaim declarations into mm/internal.h.
- The 15 patch series "userfaultfd: working set tracking for VM guest
memory" from Kiryl Shutsemau adds userfaultfd support for tracking the
working set of VM guest memory, so a VMM can identify hot pages and
reclaim cold ones to tiered or remote storage.
- The 10 patch series "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part
2)" from David Hildenbrand removes the remaining pieces of
CONFIG_HAVE_BOOTMEM_INFO_NODE, performing some smaller cleanups around
freeing of reserved vmemmap pages on the way.
- The 7 patch series "mm/damon: update probe hits for runtime parameter
commits" from SJ Park ensures that DAMON's probe_hits attribute counter
is properly updated when monitoring intervals are changed at runtime,
matching the behavior of nr_accesses. To achieve this, it refactors and
renames existing helper functions for shared use, applies the updates to
probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
maintain measurement accuracy.
- The 3 patch series "KSM: performance optimizations for rmap_walk_ksm"
from xu xin resolves a severe KSM reverse-mapping performance bottleneck
where thousands of split VMAs sharing a single anon_vma cause extended
lock contention. By adding an interval-filtering check during the rmap
walk, it reduces worst-case anon_vma lock hold times from over 500ms
down to under 2ms, preventing application freezes and latency spikes
under memory pressure.
- The 3 patch series "mm: split a couple of headers from internal.h"
from Mike Rapoport splits declarations related to mm_init, memblock,
vmalloc and sparse into new headers.
- The 2 patch series "KSM: use linear_page_index in collect_procs_ksm()"
from xu xin applies the interval tree optimization from rmap_walk_ksm()
to collect_procs_ksm() to avoid iterating over non-matching VMAs during
KSM memory error handling. It hoists loop-invariant address
initialization and restricts the anon_vma_interval_tree_foreach walk to
a targeted page offset range, reducing redundant checks and improving
lookup efficiency.
- The 3 patch series "selftests/mm: avoid false failures in hugetlb and
KSM tests" from Sayali Patil fixes issues in the hugetlb and KSM MM
selftest categories that can report failures when the prerequisites for
the tests are not satisfied.
- The 19 patch series "mm/damon: introduce data attributes only
monitoring" from SJ Park introduces attribute-weighted region management
in DAMON, allowing users to prioritize specific data attributes (such as
page sizes or cgroups) over or instead of access monitoring.
By assigning weights to attribute probes, DAMON can completely disable
access tracking and adjust monitoring regions based on weighted
probe-hit counters to optimize monitoring quality for attribute-focused
workloads.
- The 8 patch series "mm/hmm: Add mmap lock-drop support for
userfaultfd-backed mappings" from Stanislav Kinsburskii extends
hmm_range_fault() to support userfaultfd-backed regions by allowing the
mmap lock to be dropped during fault handling via a new
hmm_range_fault_locked() helper.
By accepting a locked pointer and signaling retry status when lock
release occurs, it enables page fault resolution in userfaultfd regions
while preserving backward compatibility for existing callers.
- The 33 patch series "mm: make VMA page offset handling more
consistent" from Lorenzo Stoakes cleans up and standardizes how
vma->vm_pgoff is accessed and manipulated across file-backed and
anonymous mappings in the kernel.
It introduces dedicated helper functions such as vma_start_pgoff(),
vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while renaming
rmap interval tree helpers to better reflect their functionality.
These changes establish a cleaner foundation for future work that will
unify virtual page offset indexing for all anonymous and CoW'd folios.
- The 3 patch series "mm: handle device-private PMDs in walk callbacks"
from Usama Arif addresses kernel panics and state corruption caused by
MM walk callbacks reaching non-present device-private PMD swap entries
created during HMM migrations.
It ensures that functions which acquire pmd_trans_huge_lock() properly
recognize device-private PMDs instead of assuming a present THP or a
standard migration entry.
- The 5 patch series "mm/rmap: Refactor try_to_unmap_one" from Dev Jain
refactors try_to_unmap_one by modularizing Hugetlb, anonymous-lazyfree,
and anonymous-swapbacked logic into dedicated functions, laying the
structural groundwork for batched anonymous large folio unmapping.
- The 4 patch series "Docs/ABI/damon: sysfs ABI document fixes and
additions" from Song Hu fixes typos and fills in missing entries in the
DAMON sysfs ABI document.
- The 10 patch series "dax/kmem: atomic whole-device hotplug via sysfs"
from Gregory Price introduces an atomic sysfs state attribute and
supporting DAX/MM infrastructure to prevent userland races when
offlining and removing entire memory regions.
By adding an unplugged state alongside standard online modes, it
enables whole-device atomic hotplug control while preserving backward
compatibility.
- The 13 patch series "mm: convert more vm_flags_t users to vma_flags_t"
from Lorenzo Stoakes continues transitioning the kernel from the
deprecated vm_flags_t type to vma_flags_t across core memory management
infrastructure.
It replaces legacy type usage in core functions such as do_mmap(),
unmapped area allocation, mm->def_vma_flags, and VMA operations like
mlock, mprotect, and mremap.
- The 2 patch series "Two small patches to clean up mm/mm_slot.h" from
xu xin refactors mm_slot.h by introducing mm_slot_remove() to unify
duplicate slot deletion sequences in khugepaged and KSM. It also adds
code documentation explaining why mm_slot_lookup and mm_slot_insert must
remain as preprocessor macros rather than static inline functions.
- The 10 patch series "mm/damon/core: hide core-private struct fields"
from SJ Park cleans up DAMON core structures by consistently marking
internal-only fields with private: comment tags to prevent improper
direct access from outer layers.
It enforces encapsulation across core structures including
damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
interact through approved access APIs instead of exposing raw struct
members.
- The 6 patch series "mm/damon: unurgent fixes for infinite loop, NULL
de-ref and races" from SJ Park addresses potential infinite loops, NULL
dereferences, and race conditions identified in DAMON.
It fixes an infinite loop triggered by extreme user configurations, a
NULL pointer dereference within unit tests and minor monitoring
accuracy degradation caused by subtle runtime races.
- The 2 patch series "mm/page_alloc: fixes for free_pages_nolock() on
RT/UP" from Brendan Jackman fixes an NMI safety flaw in
__free_frozen_pages() where freeing pages on non-SMP or PREEMPT_RT
kernels can bypass can_spin_trylock() checks via non-PCP or isolated
migration paths.
It also resolves potential kernel crashes and privilege escalation
risks triggered when BPF tracing runs in NMI context alongside memory
hotplug or large allocation frees.
- The 4 patch series "mm/page_alloc: couple of followups for recent
cleanups" from Brendan Jackman cleans up and updates page allocator
nomenclature, documentation, and debug assertions.
It aligns internal FPI_ flags with the public "nolock" naming
convention, removes outdated internal implementation details from
high-level page allocator comments, and eliminates obsolete VM_BUG_ON()
assertions in allocation paths.
- The 3 patch series "mm/mseal: further cleanups" from Lorenzo Stoakes
refactors and simplifies the mseal implementation by clarifying API
boundaries and removing unnecessary code complexity.
It replaces generic do_mseal() usage outside the syscall with a
dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO, eliminates
mm_struct parameters to enforce that sealing applies only to
current->mm, and streamlines overall logic and comments with no
functional changes intended.
- The 4 patch series "mm/vmscan: fix swappiness=max and clean up
per-node proactive reclaim" from Ridong Chen resolves reclaim behavior
bugs and cleans up function parameters across memory reclaim paths.
It fixes swappiness=max in both standard reclaim and MGLRU so
unswappable anonymous memory no longer falls back to evicting page
cache, ensures reclaim_store() returns accurate error codes instead of
collapsing all failures into -EAGAIN, and removes the obsolete gfp_mask
parameter from __node_reclaim().
- The 6 patch series "mm: mincore: misc cleanups" from Kefeng Wang
cleans up and simplifies the mincore code. Most importantly, it removes
the historical special behavior that always reports VM_PFNMAP pages as
non-resident.
- The 2 patch series "mm/huge_memory: drop dead split helper variants"
from Kiryl Shutsemau implements two trivial cleanups in the folio split
API.
- The 7 patch series "mm/damon: fix uninitialized DAMOS field and kunit
exec expectation bugs" from SJ Park resolves minor operational and
testing bugs in DAMON identified by Sashiko. It initializes the
damos->last_applied field to prevent occasional efficiency degradation
and fixes invalid memory accesses in DAMON KUnit tests during test
failure handling.
- The 3 patch series "cleanup for stable_page_flags()" from Jinjiang Tu
cleans up and refactors stable_page_flags() used by /proc/kpageflags
without altering functionality.
It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
bits, converts folio-specific flag checks to standard folio_test_*()
helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.
- The 3 patch series "Batch unmap of uffd-wp file folios" from Dev Jain
extends batched folio unmapping support to file folios within
userfaultfd write-protect (uffd-wp) VMAs by adding batching capabilities
to pte_install_uffd_wp_if_needed().
This removes special-case restrictions on uffd-wp VMAs in
try_to_unmap_one(), significantly simplifying the function's control
flow and complexity.
- The 3 patch series "mm/early_ioremap: clarify and clean up
early_ioremap_reset()" from Sang-Heon Jeon clarifies and cleans up the
architecture-specific usage of __late_set_fixmap() and
__late_clear_fixmap() after early_ioremap_reset().
It adds explicit documentation regarding when early_ioremap_reset()
must be called and removes redundant macro definitions and reset calls
in the RISC-V and ARM64 architectures.
- The 4 patch series "mm: fix reclaim storms in defrag_mode" from
Johannes Weiner addresses severe performance regressions, swap storms,
and spurious OOMs caused by vm.defrag_mode=1 under high memory pressure
in Meta production.
It updates the page allocator slowpath so non-movable allocation
requests actively trigger direct reclaim and direct compaction at
pageblock_order scale, allowing them to claim whole pageblocks rather
than spinning unproductively.
- The 2 patch series "zram: lockmap tweaks" from Sebastian Siewior
optimizes and fixes lockdep tracking for zram devices by consolidating
per-entry lockmaps and isolating lock classes across multiple instances.
It reduces memory overhead by replacing per-entry lockdep_map instances
with a single map per struct zram, and assigns a dynamic lock_class_key
to each instance to prevent false deadlock reports when different zram
devices are backed by distinct filesystems.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaoUJbQAKCRDdBJ7gKXxA
jqrzAP9WoPU0hiK4qS/kSjhtoZxhjpS5eLSUCy/utKuEvZbfGgEAu1zA+LH+X9Tm
THK5ex4iUZxiFbXpWfLMxE/Q9PmQYQ8=
=QTyb
-----END PGP SIGNATURE-----
Merge tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull MM updates from Andrew Morton:
- "mm: drop "sub" prefix from various places" (Dev Jain)
page->folio conversion and a naming cleanup
- "mm/kasan: remove redundant initialization for kasan_flag_write_only"
(Igor Putko)
KASAN cleanup work
- "mm/filemap: reduce unnecessary xarray lookups" (Chi Zhiling)
Small speedup in the pagecaache read code
- "mm/percpu: Fix possible NOFS/NOIO reclaim recursion" (Kaitao Cheng)
Improve the vmalloc code - mainly the avoidance of GFP_KERNEL
allocations when the caller asked for GFP_NOFS or GFP_NOIO
- "mm/kmemleak: avoid soft lockup when scanning task stacks" (Breno
Leitao)
Avoid a soft lockup watchdog trigger from the kmemleak scanning code
in extreme situations
- "mm/page_owner: misc cleanups" (Ye Liu)
Cleanups to the page_owner code. For some reason lots of people have
been working on the page_owner code this cycle.
- "mm: convert to walk_page_range_vma() to eliminate find_vma()"
(Kefeng Wang)
Simplify and accelerate the page walking library function
- "mm/migrate: preparatory cleanups for batch copy and offload"
(Shivank Garg)
Cleanups in the migration code
- "mm/page_owner: add per-fd filter infrastructure for print_mode and
NUMA filtering" (Zhen Ni)
Per-fd filtering to page_owner in order to reduce the sometimes vast
amount of output it can produce
- "mm: Refactor bootmem gigantic hugepage allocation" (Muchun Song)
Fixes and preparatory cleanups around bootmem HugeTLB handling,
sparse initialization ordering, and related vmemmap setup
- "mm/zsmalloc: reduce lock contention in zs_free()" (Wenchao Hao)
Reduce lock contention in zs_free(), which dominates the unmap path
under memory pressure on Android (LMK kills) and on x86 servers
running zswap-heavy workloads.
Up to 1.83x improvement in microbenchmarking.
- "move alloc_tag.c file under mm/" (Suren Baghdasaryan)
- "samples/damon: handle damon_{start,stop}() failures" (SJ Park)
Fix improper handling of damon_start(), damon_stop(), and
damon_call() failures across DAMON sample modules to prevent
potential memory leaks, operation disruptions and use-after-free
bugs
- "mm/damon/sysfs: kobject_del() directories that users can
create/remove" (SJ Park)
Fix delayed sysfs directory removal under DEBUG_KOBJECT_RELEASE
causeing creation failures due to duplicate directory names by adding
missing kobject_del() calls before creating new directories
- "mm: cleanup clear_not_present_full_ptes()" (David Hildenbrand)
Clean up the core pte handling code
- "selftests/damon: misc fixes for test bugs" (Kunwu Chan)
Fix several bugs in the DAMON selftests
- "selftests/damon: fix memcg_path staging handling" (Cheng Nie)
Fix a bug in _damon_sysfs.py for damos_filter memcg_path setup, and
add a test case for it in sysfs.py.
- "selftests/damon: test kdamond refresh_ms" (Ruslan Valiyev)
Selftest coverage for DAMON's refresh_ms sysfs feature by updating
the test control module and verifying that scheme stats update
automatically without manual intervention
- "mm/damon: five misc fixups" (Akinobu Mita)
Miscellaneous DAMON fixups.
- "mm/damon/core: detect internal variation above max_nr_regions/2"
(Jiayuan Chen)
Fix DAMON's region splitting behavior when region counts exceed half
the maximum budget by dynamically scaling down the split fraction as
the limit approaches, preventing large regions from staying un-split,
and add corresponding KUnit test coverage
- "mm: preparatory patches for PMD level swap entries" (Usama Arif)
Refactor and clean up PMD softleaf helpers, call sites, and
architecture flags to lay the groundwork for a follow-up series that
introduces PMD page table swap entries
- "mm/damon: update, optimize, and clean up doc, tests, and code" (SJ
Park)
Update DAMON design and ABI documentation, expands unit and selftest
coverage, optimize damon_commit_target_regions(), and clean up
recently added sysfs interface code for better readability
- "mm/vmpressure: reduce CPU, memory and code overhead on cgroup v2"
(Usama Arif)
Optimize vmpressure() by skipping unnecessary work on cgroup v2 for
userspace event notifications and refactor v1-only eventfd handling
into mm/memcontrol-v1.c to reduce memory overhead and code complexity
- "selftests/mm: refactor pkey helpers and fix mmap error handling"
(Hongfu Li)
Refactor pkeys shared tracing and assertion helpers into a common
file, unify protection key selftests to use consistent diagnostic
logging and assertions, and enforce standardized MAP_FAILED return
checks for mmap() calls across the tests
- "mm/damon: optimize out nr_accesses_bp" (SJ Park)
Replace the error-prone, continuously updated nr_accesses_bp field in
damon_region with an on-demand moving sum function, reducing
structure memory overhead and avoiding state corruption bugs
- "Open HugeTLB allocation routine for more generic use" (Ackerley Tng)
Decouple HugeTLB folio allocation from VMA dependencies by
introducing hugetlb_alloc_folio(), enabling subsystems like
guest_memfd to allocate HugeTLB folios without standard VMA
reservations or pseudo-VMAs
- "mm/damon: provide pseudo moving sum probe_hits" (SJ Park)
Integrate DAMON's probe_hits attribute counter into the pseudo moving
sum infrastructure, enabling real-time, online monitoring without
waiting for full aggregation intervals
- "mm: Some cleanups for page allocator APIs" (Brendan Jackman)
Simplify and refactor the page allocator entry points and flags by
unifying allocation paths, adding internal alloc_flags arguments, and
eliminating redundant __ prefixed alloc_pages variants.
- "Fix incorrect access of hugetlb pte entries" (Dev Jain)
Enforce the consistent use of huge_ptep_get() instead of ptep_get()
for HugeTLB entries and fixes an unaligned address issue in arm64's
huge_ptep_get() implementation
- "mm/damon: validate all parameters in the core" (SJ Park)
Consolidate parameter validation into the DAMON core specifically
within damon_start() and damon_commit_ctx() to centralize error
checking, eliminate caller-side redundant checks and to improve
maintenance efficiency
- "tools/mm/page_owner_sort: fix filtering and cleanup issues" (Yichong
Chen)
Rename is_need() to filter_record() for clearer return semantics, fix
per-record allocation memory leaks and bound output copies in
search_pattern() to address an existing buffer issue
- "memcg: bail out reclaim when memcg is dying" (Jiayuan Chen)
Mitigate a system-wide stall which occurs when a cgroup is removed
while one of its memory control files is doing synchronous reclaim
- "mm/memory-failure: add panic option for unrecoverable pages" (Breno
Leitao)
Introduce an opt-in vm.panic_on_unrecoverable_memory_failure sysctl
that immediately panics the kernel on unrecoverable memory errors in
kernel-owned pages to preserve error context and prevent delayed,
silent data corruption
- "mm/damon: refactor damon_{start,stop,commit}() for simple error
handling" (SJ Park)
Refactor the DAMON core API functions to guarantee that all contexts
are fully stopped when damon_start(), damon_stop(), or damon_commit()
fail, eliminating the need for complex and error-prone caller-side
cleanup code
- "Keep tail page private zero at free and folio split" (Zi Yan)
Add checks to ensure tail_page->private is zero when freeing compound
or high-order pages and when promoting tail pages during large folio
splits. By validating these fields at free and split time, it allows
the removal of redundant private field clearing inside
prep_compound_tail()
- "mm: drop redundant lru_add_drain in anon folio reuse paths" (Barry
Song)
Eliminate redundant lru_add_drain() calls in
wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
contention and system overhead
By validating folio refcounts against the LRU cache before draining
and removing unnecessary drains in the swap path, it achieves up to a
30.5% reduction in drain calls during heavy swap workloads
- "mm: clean up folio LRU and swap declarations" (Jianyue Wu)
Reorganize folio LRU and swap code by relocating page-cluster state
to mm/swap_state.c, renaming mm/swap.c to mm/folio.c, and moving
MM-internal reclaim declarations into mm/internal.h.
- "userfaultfd: working set tracking for VM guest memory" (Kiryl
Shutsemau)
Add userfaultfd support for tracking the working set of VM guest
memory, so a VMM can identify hot pages and reclaim cold ones to
tiered or remote storage
- "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)" (David
Hildenbrand)
Remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE,
performing some smaller cleanups around freeing of reserved vmemmap
pages on the way.
- "mm/damon: update probe hits for runtime parameter commits" (SJ Park)
Ensure that DAMON's probe_hits attribute counter is properly updated
when monitoring intervals are changed at runtime, matching the
behavior of nr_accesses. To achieve this, it refactors and renames
existing helper functions for shared use, applies the updates to
probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
maintain measurement accuracy.
- "KSM: performance optimizations for rmap_walk_ksm" (xu xin)
Resolve a severe KSM reverse-mapping performance bottleneck where
thousands of split VMAs sharing a single anon_vma cause extended lock
contention.
By adding an interval-filtering check during the rmap walk, it
reduces worst-case anon_vma lock hold times from over 500ms down to
under 2ms, preventing application freezes and latency spikes under
memory pressure.
- "mm: split a couple of headers from internal.h" (Mike Rapoport)
Split declarations related to mm_init, memblock, vmalloc and sparse
into new headers
- "KSM: use linear_page_index in collect_procs_ksm()" (xu xin)
Apply the interval tree optimization from rmap_walk_ksm() to
collect_procs_ksm() to avoid iterating over non-matching VMAs during
KSM memory error handling.
It hoists loop-invariant address initialization and restricts the
anon_vma_interval_tree_foreach walk to a targeted page offset range,
reducing redundant checks and improving lookup efficiency.
- "selftests/mm: avoid false failures in hugetlb and KSM tests" (Sayali
Patil)
Fix issues in the hugetlb and KSM MM selftest categories that can
report failures when the prerequisites for the tests are not
satisfied
- "mm/damon: introduce data attributes only monitoring" (SJ Park)
Introduce attribute-weighted region management in DAMON, allowing
users to prioritize specific data attributes (such as page sizes or
cgroups) over or instead of access monitoring.
By assigning weights to attribute probes, DAMON can completely
disable access tracking and adjust monitoring regions based on
weighted probe-hit counters to optimize monitoring quality for
attribute-focused workloads.
- "mm/hmm: Add mmap lock-drop support for userfaultfd-backed mappings"
(Stanislav Kinsburskii)
Extend hmm_range_fault() to support userfaultfd-backed regions by
allowing the mmap lock to be dropped during fault handling via a new
hmm_range_fault_locked() helper.
By accepting a locked pointer and signaling retry status when lock
release occurs, it enables page fault resolution in userfaultfd
regions while preserving backward compatibility for existing callers.
- "mm: make VMA page offset handling more consistent" (Lorenzo Stoakes)
Clean up and standardize how vma->vm_pgoff is accessed and
manipulated across file-backed and anonymous mappings in the kernel
It introduces dedicated helper functions such as vma_start_pgoff(),
vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while
renaming rmap interval tree helpers to better reflect their
functionality.
These changes establish a cleaner foundation for future work that
will unify virtual page offset indexing for all anonymous and CoW'd
folios.
- "mm: handle device-private PMDs in walk callbacks" (Usama Arif)
Address kernel panics and state corruption caused by MM walk
callbacks reaching non-present device-private PMD swap entries
created during HMM migrations
It ensures that functions which acquire pmd_trans_huge_lock()
properly recognize device-private PMDs instead of assuming a present
THP or a standard migration entry.
- "mm/rmap: Refactor try_to_unmap_one" (Dev Jain)
Refactor try_to_unmap_one by modularizing Hugetlb,
anonymous-lazyfree, and anonymous-swapbacked logic into dedicated
functions, laying the structural groundwork for batched anonymous
large folio unmapping.
- "Docs/ABI/damon: sysfs ABI document fixes and additions" (Song Hu)
Fix typos and fills in missing entries in the DAMON sysfs ABI
document
- "dax/kmem: atomic whole-device hotplug via sysfs" (Gregory Price)
Introduce an atomic sysfs state attribute and supporting DAX/MM
infrastructure to prevent userland races when offlining and removing
entire memory regions
By adding an unplugged state alongside standard online modes, it
enables whole-device atomic hotplug control while preserving backward
compatibility.
- "mm: convert more vm_flags_t users to vma_flags_t" (Lorenzo Stoakes)
Continue transitioning the kernel from the deprecated vm_flags_t type
to vma_flags_t across core memory management infrastructure.
It replaces legacy type usage in core functions such as do_mmap(),
unmapped area allocation, mm->def_vma_flags, and VMA operations like
mlock, mprotect, and mremap.
- "Two small patches to clean up mm/mm_slot.h" (xu xin)
Refactor mm_slot.h by introducing mm_slot_remove() to unify duplicate
slot deletion sequences in khugepaged and KSM. It also adds code
documentation explaining why mm_slot_lookup and mm_slot_insert must
remain as preprocessor macros rather than static inline functions.
- "mm/damon/core: hide core-private struct fields" (SJ Park)
Clean up DAMON core structures by consistently marking internal-only
fields with private: comment tags to prevent improper direct access
from outer layers.
It enforces encapsulation across core structures including
damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
interact through approved access APIs instead of exposing raw struct
members.
- "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races"
(SJ Park)
Address potential infinite loops, NULL dereferences, and race
conditions identified in DAMON
It fixes an infinite loop triggered by extreme user configurations, a
NULL pointer dereference within unit tests and minor monitoring
accuracy degradation caused by subtle runtime races.
- "mm/page_alloc: fixes for free_pages_nolock() on RT/UP" (Brendan
Jackman)
Fix an NMI safety flaw in __free_frozen_pages() where freeing pages
on non-SMP or PREEMPT_RT kernels can bypass can_spin_trylock() checks
via non-PCP or isolated migration paths.
It also resolves potential kernel crashes and privilege escalation
risks triggered when BPF tracing runs in NMI context alongside memory
hotplug or large allocation frees.
- "mm/page_alloc: couple of followups for recent cleanups" (Brendan
Jackman)
Clean up and update page allocator nomenclature, documentation, and
debug assertions.
It aligns internal FPI_ flags with the public "nolock" naming
convention, removes outdated internal implementation details from
high-level page allocator comments, and eliminates obsolete
VM_BUG_ON() assertions in allocation paths.
- "mm/mseal: further cleanups" (Lorenzo Stoakes)
Refactor and simplify the mseal implementation by clarifying API
boundaries and removing unnecessary code complexity.
It replaces generic do_mseal() usage outside the syscall with a
dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO,
eliminates mm_struct parameters to enforce that sealing applies only
to current->mm, and streamlines overall logic and comments with no
functional changes intended.
- "mm/vmscan: fix swappiness=max and clean up per-node proactive
reclaim" (Ridong Chen)
Resolve reclaim behavior bugs and clean up function parameters across
memory reclaim paths
It fixes swappiness=max in both standard reclaim and MGLRU so
unswappable anonymous memory no longer falls back to evicting page
cache, ensures reclaim_store() returns accurate error codes instead
of collapsing all failures into -EAGAIN, and removes the obsolete
gfp_mask parameter from __node_reclaim().
- "mm: mincore: misc cleanups" (Kefeng Wang)
Clean up and simplifies the mincore code. Most importantly, it
removes the historical special behavior that always reports VM_PFNMAP
pages as non-resident.
- "mm/huge_memory: drop dead split helper variants" (Kiryl Shutsemau)
Two trivial cleanups in the folio split API
- "mm/damon: fix uninitialized DAMOS field and kunit exec expectation
bugs" (SJ Park)
Resolve minor operational and testing bugs in DAMON identified by
Sashiko. It initializes the damos->last_applied field to prevent
occasional efficiency degradation and fixes invalid memory accesses
in DAMON KUnit tests during test failure handling.
- "cleanup for stable_page_flags()" (Jinjiang Tu)
Clean up and refactor stable_page_flags() used by /proc/kpageflags
without altering functionality.
It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
bits, converts folio-specific flag checks to standard folio_test_*()
helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.
- "Batch unmap of uffd-wp file folios" (Dev Jain)
Extend batched folio unmapping support to file folios within
userfaultfd write-protect (uffd-wp) VMAs by adding batching
capabilities to pte_install_uffd_wp_if_needed().
This removes special-case restrictions on uffd-wp VMAs in
try_to_unmap_one(), significantly simplifying the function's control
flow and complexity.
- "mm/early_ioremap: clarify and clean up early_ioremap_reset()"
(Sang-Heon Jeon)
Clarify and clean up the architecture-specific usage of
__late_set_fixmap() and __late_clear_fixmap() after
early_ioremap_reset()
It adds explicit documentation regarding when early_ioremap_reset()
must be called and removes redundant macro definitions and reset
calls in the RISC-V and ARM64 architectures.
- "mm: fix reclaim storms in defrag_mode" (Johannes Weiner)
Address severe performance regressions, swap storms, and spurious
OOMs caused by vm.defrag_mode=1 under high memory pressure in Meta
production
It updates the page allocator slowpath so non-movable allocation
requests actively trigger direct reclaim and direct compaction at
pageblock_order scale, allowing them to claim whole pageblocks rather
than spinning unproductively.
- "zram: lockmap tweaks" (Sebastian Siewior)
Optimize and fix lockdep tracking for zram devices by consolidating
per-entry lockmaps and isolate lock classes across multiple instances
This reduces memory overhead by replacing per-entry lockdep_map
instances with a single map per struct zram, and assigns a dynamic
lock_class_key to each instance to prevent false deadlock reports
when different zram devices are backed by distinct filesystems.
* tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (501 commits)
selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check
selftests/mm: unpoison pages in memory-failure teardown
mm/shmem: downgrade final i_blocks check in shmem_evict_inode() to pr_warn()
mm/khugepaged: replace mutex_lock/mutex_unlock usage with guard macro
mm/zsmalloc: fix release order of locks in zs_page_migrate()
Documentation: zram: remove sections numbering
ksm: stop iterating VMAs when ksm_test_exit returns true
mm: fold userfaultfd_rwp() to false without CONFIG_ARCH_HAS_PTE_PROTNONE
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
zram: use a custom key for each zram object
zram: move lockmap to be per-zram instead per table
selftests/mm: fix gup_longterm EINVAL error message
mm: page_alloc: fix non-movable reclaim storm in defrag_mode
mm: page_alloc: move capture_control to the page allocator
mm: compaction: support non-movable compaction for pageblock requests
mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
hugetlb: evaluate subpool free state while locked
mm/damon: remove trailing semicolons after function definitions
mm/damon/ops-common: prevent migration fallback to non-target nodes
mm/damon: update outdated comment about DAMOS filter handling
...
|
||
|
Xuewen Wang
|
64a853c9a6 |
mm/damon: remove trailing semicolons after function definitions
Three function definitions terminate with '};' instead of '}', which is unnecessary and inconsistent with kernel coding style: - damon_pa_initcall() in paddr.c - damon_va_initcall() in vaddr.c - damos_get_some_mem_psi_total() in core.c No functional change intended. Link: https://lore.kernel.org/20260721135333.241106-1-sj@kernel.org Signed-off-by: Xuewen Wang <wangxuewen@kylinos.cn> Reviewed-by: SJ Park <sj@kernel.org> Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Jiahui Zhang
|
613c2d5552 |
mm/damon/ops-common: prevent migration fallback to non-target nodes
DAMOS_MIGRATE_{HOT,COLD} passes a target NUMA node to migrate_pages().
But alloc_migration_target() only treats mtc->nid as a preferred node
unless __GFP_THISNODE is set. Hence target allocation can fall back to
another node, and migrate_pages() can report success without placing the
folio on the requested target node.
Consider a two-node tiered system where node 0 is a fast tier and node 1
is a CPU-less slow tier such as CXL memory, and the user wants to promote
hot regions from node 1 to node 0 with a command like:
sudo damo start --ops vaddr --target_pid ${workload_pid} \
--damos_action migrate_hot 0 \
--damos_access_rate 70% max
Without the __GFP_THISNODE flag, when the memory allocator finds that node
0 is nearly full, it can fall back to node 1 without waking up kswapd.
Then the pages allocated for migrate_pages() are still on node 1, and the
regions that are expected to be promoted to node 0 are only moved to
different physical pages on node 1.
Meanwhile, both the mm_migrate_pages tracepoint and DAMOS's own sz_applied
statistics (reported via the damos_stat_after_apply_interval tracepoint)
show the migrations as successful, which makes the failure practically
invisible and hard to investigate.
Running a demotion-purpose DAMOS scheme alongside the promotion scheme
does not fully avoid this either. If demotion cannot keep up with the
promotion rate, allocation can still fall back to node 1 during promotion,
and the same misleading statistics show up.
Make DAMON's migration target allocation strict by setting __GFP_THISNODE,
so that a failed allocation on the target node is reported as a failure
instead of silently landing on a different node. This is consistent with
alloc_misplaced_dst_folio(), alloc_demote_folio(), and with
do_move_pages_to_node(), which all use __GFP_THISNODE for migrations to an
explicit destination node.
Link: https://lore.kernel.org/20260721135607.251869-1-sj@kernel.org
Signed-off-by: Jiahui Zhang <jiahuitry@outlook.com>
Reviewed-by: SJ Park <sj@kernel.org>
Signed-off-by: SJ Park <sj@kernel.org>
Cc: Honggyu Kim <honggyu.kim@sk.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
||
|
SJ Park
|
c608748607 |
mm/damon/core: handle region split failure in apply_min_nr_regions()
damon_apply_min_nr_regions() repeatedly split each region until its size
becomes small enough to meet the user-defined low limit of the number of
regions. The loop assumes the split operation (damon_split_region_at())
will always succeed and create the new region. But the operation could
silently fail for memory allocation failures, for example.
If such failure happens and the region was the last region, the linked
list-based next region fetching returns invalid pointer. As a result,
invalid memory dereference and corruption could happen. Even if the
corner case is handled, it imposes stress to the allocator by trying split
regions for other targets. Fix the issue by breaking all the loops for
any region split failure.
This means there could be a min_nr_regions violation. It will only rarely
happen since the allocation is arguably too small to fail. Even if it
happens, it is only temporal. damon_apply_min_nr_regions() will be called
again after the aggregation interval.
The user impact of the issue should be minor, since the allocation is
arguably too small to fail. But, it could still theoretically happen, and
the consequence is very bad.
This issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260719155442.88794-1-sj@kernel.org
Link: https://lore.kernel.org/20260717011834.120715-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
6c25083f7a |
mm/damon/ops-common: use nr_accesses moving sum for quota score
Since commit |
||
|
Enze Li
|
a43ea999c5 |
mm/damon/ops-common: remove redundant local variable in damon_migrate_folio_list()
In damon_migrate_folio_list(), we're redeclaring folio inside the first while loop, but it just shadows the outer one. Since the second loop uses the outer folio anyway, the inner declaration is pointless. Remove it to consistently reuse the same variable throughout the function and improve readability. Link: https://lore.kernel.org/20260718002125.637104-1-lienze@kylinos.cn Signed-off-by: Enze Li <lienze@kylinos.cn> Reviewed-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
488cf81c49 |
mm/damon/core-kunit: skip wrong region walk in commit_target_regions()
damon_test_commit_target_regions_for() traverses expected values array
after damon_commit_target_regions() call. It assumes
damon_commit_target_regions() made expected number of regions. It might
not. Because the traversal is made based on the region count, it could do
out of bounds access to the expectation value array.
The consequent user impact (out-of-bound access) is quite bad. The
realistic user impact would be limited, though. It would affect only test
run setups.
Fix it by testing if the number of regions was also changed as expected
and exit early for the failure.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260718001442.87129-8-sj@kernel.org
Link: https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
867bbe6dbd |
mm/damon/core-kunit: skip wrong quota goal walk in commit_quota_goals()
damos_test_commit_quota_goals_for() traverses damos quota goals after
damos_commit_quota_goals() call. It assumes damos_commit_quota_goals()
made expected numbers of goals. It might not. Because the traversal is
made based on destination struct length, it could do out of bounds access
for source expectation value array.
The consequent user impact (out-of-bound access ) is quite bad. The
realistic user impact would be limited though. It would affect only test
run setups.
Fix it by testing if the number of goals was also changed as expected and
exit early for the failure.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260718001442.87129-7-sj@kernel.org
Link: https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
7e2f2c41b2 |
mm/damon/core-kunit: skip wrong dest walk in commit_dests_for()
damos_test_commit_dests_for() traverse damos action destinations after
damos_commit_dests(). It assumes damos_commit_dests() made expected
numbers of destinations for source and destination structures. It might
not. Because the traversal is made based on destination struct length, it
could do out of bounds access for source value expectation.
The consequent user impact (out-of-bound access ) is quite bad. The
realistic user impact would be limited, though. It would affect only test
run setups.
Fix it by exiting early for the number of regions test failure.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260718001442.87129-6-sj@kernel.org
Link: https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
3423fe7039 |
mm/damon/core-kunit: handle region split failure in filter_out()
damos_test_filter_out() test checks if damos_filter_match() of an address
filter splits the region as expected under a given condition. But, the
test continued regardless of the split successes. As a result, the later
part of the test could dereference invalid pointers that returned from
damon_next_region(). Further, it could corrupt memory from
damon_destroy_region().
The consequent user impact (memory corruption) is quite bad. The
realistic user impact would be limited, though. It would affect only test
run setups.
Fix it by exiting early for the number of regions test failure.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260718001442.87129-5-sj@kernel.org
Link: https://lore.kernel.org/20260714142352.100478-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
5fea07e460 |
mm/damon/vaddr-kunit: check region count in three_regions test
damon_do_test_apply_three_regions() iterates regions after
damon_set_regions() call assuming the function would succeed at setting
the number of regions the same to the expected one. It might have failed.
In this case, __nth_region_of() in the iteration could return NULL and
NULL dereference can happen in the test.
The consequent user impact (NULL dereference) is quite bad. The realistic
user impact would be limited, though. It would affect only test run
setups.
Fix it by testing if the number of regions was also changed as expected
and exit early for the failure.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260718001442.87129-4-sj@kernel.org
Link: https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
9b18ef3c3a |
mm/damon/core-kunit: check region count before testing in split_at()
damon_test_split_at() test next region that is assumed to be created by
damon_split_region_at() invocation. But the split might fail. In this
case, the succeeding test may dereference invalid pointers returned by
damon_next_region().
The invalid pointer may not cause a really bad user impact, because of the
implementation detail. It would only read wrong contents in the belonging
damon_target struct. Depending on the future change of the offset from
the link header to the accessing field, this could also be really
dangerous, though. Still, the realistic user impact would be limited. It
would affect only test run setups.
Fix it by testing if the number of regions was also changed as expected
and exit early for the failure.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260718001442.87129-3-sj@kernel.org
Link: https://lore.kernel.org/20260714142352.100478-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
af5f76aeb9 |
mm/damon/core: initialize damos->last_applied
Patch series "mm/damon: fix uninitialized DAMOS field and kunit exec
expectation bugs".
Fix a few Sashiko-found unurgent bugs. Patch 1 fixes use of uninitialized
damos->last_applied field. Patches 2-7 fix DAMON kunit tests that do
invalid memory access under test failures.
The bugs are better to be fixed and eventually merged into stable@ kernel.
That said, the fixes are arguably not urgent. Patch 1 only introduces
negligible DAMOS efficiency degradation in occasional cases. Kunit fixes
could introduce quite bad consequences but those are test code that affect
only test run setups.
This patch (of 7):
Multiple DAMON regions could exist across a folio. If they fulfill the
condition to apply a DAMOS scheme, the scheme could be applied multiple
times to the folio. To avoid this, each DAMOS scheme stores the folio
that the scheme was applied to last time in the damos->last_applied field
and skips repeatedly applying the same scheme to the same folio.
The field is being used without initialization, though. Hence, the
mechanism could wrongly skip applying a scheme to a folio at the very
first time of DAMOS run.
The user impact is trivial. DAMON might unexpectedly skip applying DAMOS
action for one folio for the first time per scheme. In the DAMON's
best-effort world, this is never a real problem. No critical consequences
such as kernel panic or memory corruption happen.
It is a clear bug, though, and the fix is straightforward. Fix the issue
by initializing the field in DAMOS scheme creation function,
damon_new_scheme().
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260718001442.87129-1-sj@kernel.org
Link: https://lore.kernel.org/20260718001442.87129-2-sj@kernel.org
Link: https://lore.kernel.org/20260714055436.120034-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
5adaaa28be |
mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()
damon_sysfs_apply_inputs() reads ops_id twice. It could race with
ops_id_store(). As a result, the min_region_sz could wrongly be set up.
Read it once.
The user impact is trivial. Sane users ain't update the parameter in
parallel. Even if it happens, the DAMON core layer handles the wrong
min_region_sz (!is_power_of_2()). Even if somehow the race ended up
making a min_region_sz that is different from the user's intention but
still valid, only monitoring itself runs differently than expected. No
critical consequences like kernel panic or memory corruption happen
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260715031002.108504-7-sj@kernel.org
Link: https://lore.kernel.org/20260703172417.95426-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
ab4d9358e3 |
mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs()
damon_sysfs_apply_inputs() reads addr_unit twice. It could race with
addr_unit_store(). As a result, the min_region_sz could wrongly be set
up. Read it once.
The user impact is trivial. Sane users ain't update the parameter in
parallel. Even if it happens, the DAMON core layer handles the wrong
min_region_sz (!is_power_of_2()). Even if somehow the race ended up
making a min_region_sz that is different from the user's intention but
still valid, only monitoring itself runs differently than expected. No
critical consequences like kernel panic or memory corruption happen.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260715031002.108504-6-sj@kernel.org
Link: https://lore.kernel.org/20260714142950.100711-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
f23f0aa62b |
mm/damon/paddr: drop last same folio access check reuse optimization
It can race when multiple kdamonds are being used. The problem from the
race is doubtful, but the gain from the optimization is also doubtful.
Simply drop the optimization in favor of code simplicity.
The user impact is doubtfully trivial. After all, this kind of
interference can happen only by intentional user setup. Even if it
happens, it will be rare, and the consequence is degradation of the
best-effort monitoring results. No critical consequences like kernel
panic or memory corruption happen.
The race was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260715031002.108504-5-sj@kernel.org
Link: https://lore.kernel.org/20260621204050.10993-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
831846078c |
mm/damon/vaddr: drop last same folio access check optimization
The optimization can race when multiple kdamonds are running. Meanwhile,
the impact of the optimization is quite doubtful. Just remove it.
The user impact of the issue should be quite trivial. After all, the race
can happen only when the user intentionally setup DAMON in the way. Even
if it happens, it would be rare and only degrade the best-effort
monitoring results. No critical consequences like kernel panic or memory
corruption happen.
The race possibility was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260715031002.108504-4-sj@kernel.org
Link: https://lore.kernel.org/20260621204050.10993-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
b640708929 |
mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
KUNIT_EXPECT_EQ() does not abort the execution of test code when the
expectation is not met. But damon_test_merge_regions_of() code after its
initial KUNIT_EXPECT_EQ() call assumes the expectation is met. It does a
per-region test with a hard-coded number of regions that is correct only
if the expectation was met. As a result, __nth_region_of() could return
NULL, and the test code can dereference NULL pointers. Fix the issue by
catching the expectation failure and skip the per-region tests.
The user impact on realistic setups should be negligible, as it is a unit
test.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260715031002.108504-3-sj@kernel.org
Link: https://lore.kernel.org/20260710144937.26981-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
123e4619ab |
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
Patch series "mm/damon: unurgent fixes for infinite loop, NULL de-ref and
races", v1.1.
Sashiko found a few issues in DAMON that could cause infinite loop, NULL
dereference and monitoring results degradation. The first two sounds
scary but the infinite loop happens only under unreasonable user setup.
The NULL dereference is only in a unit test. Monitoring results
degradation is trivial since it is only best-effort, and those happens
from only unlikely races. Still those are bugs that better to fix if
possible. Fix those.
This patch (of 6):
Due to online parameter update like events, the number of DAMON regions
could be higher than the user-set upper limit. kdamond_merge_regions()
repeats merge regions until the number meets the limit, while doubling the
merge threshold up to the theoretical maximum threshold. It is tried only
up to the theoretical maximum threshold because even the aggressive
merging can fail from reducing the number of regions under the
user-defined upper limit. For example, there could be many user-defined
non-contiguous regions that cannot be merged.
The threshold based loop break condition is evaluated by comparing the
threshold for the next merging try against the theoretical maximum
threshold. If max_thres is larger than UINT_MAX / 2, doubling the
threshold could make it overflow, and bypass the loop break condition. In
the case, if the number of regions cannot be reduced under the upper limit
like explained above, the loop will run infinitely.
Prevent the case by doing the break condition check before doubling the
threshold. Also, prevent the threshold exceeding the maximum threshold,
as it could overflow and apply the wrong merge threshold.
This issue is unlikely to occur in real world, since having the max_thres
higher than UINT_MAX / 2 require unrealistically large aggregation
intervals compared to the sampling interval. Also, it requires an
unrealistically large number of uncontiguous regions setup. Nonetheless,
the consequence is bad and the fix is simple.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260715031002.108504-1-sj@kernel.org
Link: https://lore.kernel.org/20260715031002.108504-2-sj@kernel.org
Link: https://lore.kernel.org/20260709145425.96247-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
131c20823e |
mm/damon/sysfs: do not directly access damon_ctx->ops
damon_ctx->ops field is intended to be used by only the DAMON core layer. DAMON_SYSFS is directly reading the field to find if it is for physical address monitoring, though. Use the API function for the purpose, damon_target_has_pid(), instead. Link: https://lore.kernel.org/20260714143544.101305-10-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
0250dbe08c |
mm/damon/core: skip aging from repeated aggressive merging
The number of DAMON regions could temporarily exceed the user-defined
maximum number of regions limit for corner cases. For example, users
could lower the limit via runtime parameters update. For such a case,
kdamond_merge_regions() repeats merging regions in the case doubling the
merge threshold. The repeated merge operation could update the age of
regions multiple times. This corrupts the monitoring results. Fix the
issue by asking the merge operation to skip aging for the corner case.
The user impact is degradation of the monitoring quality. The impact
should be mild, since the degradation is only temporal, and it is not
common to happen in realistic setups.
The issue was discovered [1,2] by Sashiko.
Link: https://lore.kernel.org/20260712165432.87609-1-sj@kernel.org
Link: https://lore.kernel.org/20260621203548.10718-1-sj@kernel.org [1]
Link: https://lore.kernel.org/20260709145425.96247-1-sj@kernel.org [2]
Fixes:
|
||
|
Song Hu
|
169c0a1ec4 |
mm/damon/tests/core-kunit: test damon_nr_accesses_mvsum()
damon_nr_accesses_mvsum() wraps damon_mvsum() with the monitoring intervals of the context to compute the pseudo moving sum of a region's access frequency, with a special case for when the whole aggregation window remains. damon_mvsum() itself is already covered by damon_test_mvsum(), but the wrapper is not. Add a table-driven KUnit test that exercises the full-window-remaining boundary (with both reset and not-yet-reset nr_accesses), partially elapsed windows, and the no-window-remaining case. Link: https://lore.kernel.org/20260713094648.897239-1-husong@kylinos.cn Signed-off-by: Song Hu <husong@kylinos.cn> Reviewed-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
1ec0e6b6f7 |
mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
Callers of migrate_pages() should adjust NR_MIGRATED_{ANON,FILE} for
isolations and putback of the folios. That for migration succeeded folios
is done by migrate_pages(), in migrate_folio_done(). That for MR_DEMOTION
reason is an exception though.
DAMOS_MIGRATE_{HOT,COLD} call migrate_pages() but mistakenly not doing the
stat adjustment. As a result, use of DAMOS_MIGRATE_{HOT,COLD} could
corrupt the stat. It could confuse too_many_isolated(), make compaction
and reclaim to behave in unexpected ways. The stat corruption can be
reproduced and confirmed using DAMON user-space tool [1] on NUMA systems,
like below.
$ numactl --hardware
available: 2 nodes (0-1)
[...]
$ sudo ./damo start --damos_action migrate_hot 1
$ sudo cat /proc/sys/vm/stat_refresh
$ sudo dmesg
[...]
[ 80.215554] vmstat_refresh: nr_isolated_anon -5578
[ 80.216842] vmstat_refresh: nr_isolated_file -34400
This issue was discovered [2] by Sashiko.
Link: https://lore.kernel.org/20260728140404.94476-1-sj@kernel.org
Link: https://github.com/damonitor/damo [1]
Link: https://lore.kernel.org/20260726164356.87940-1-sj@kernel.org [2]
Fixes:
|
||
|
liyouhong
|
5deb65c34e |
mm/damon/ops-common: putback folios on invalid migrate nid
damon_pa_migrate() and damos_va_migrate() isolate folios into a local list
and then call damon_migrate_pages(). When target_nid is invalid
(including the scheme default NUMA_NO_NODE / -1), damon_migrate_pages()
returns early without putting the folios back to the LRU.
Callers then discard the list head while those folios remain isolated with
an extra reference taken by folio_isolate_lru(). The pages stay off the
LRU for as long as the mapping exists (anon active+inactive counts drop
while RSS does not), and the leftover references can pin the pages after
the mapping is gone.
Put the folios back on the invalid-nid path so ignored migration requests
still return them to the LRU.
Link: https://lore.kernel.org/20260726014815.1280757-1-dayou5941@163.com
Fixes:
|
||
|
SJ Park
|
0f18683103 |
mm/damon/lru_sort: skip damon_call() if ctx has not started
DAMON_LRU_SORT calls damon_call() for commit_inputs parameter user input
if the DAMON context is initialized. The context could be initialized,
but not yet successfully started. In the case, damon_call() could
indefinitely hang. Read the comment on damon_call() for more detail. Fix
the problem by memorizing if the DAMON context has ever successfully
started, and skip damon_call() if it has not.
This issue can easily be reproduced by writing Y to the commit_inputs
parameter file on a system that DAMON_LRU_SORT has not turned on before.
Link: https://lore.kernel.org/20260803134646.16640-3-sj@kernel.org
Fixes:
|
||
|
SJ Park
|
b9b6bad94c |
mm/damon/reclaim: skip damon_call() if ctx has not started
Patch series "mm/damon/{reclaim,lru_sort}: fix commit_inputs infinite
hang".
Writing 'Y' to commit_inputs parameters of DAMON_RECLAIM and
DAMON_LRU_SORT before the modules were ever turned on causes infinite
hang. Fix those.
The issue was discovered [1] by Sashiko.
This patch (of 2):
DAMON_RECLAIM calls damon_call() for commit_inputs parameter user input if
the DAMON context is initialized. The context could be initialized, but
not yet successfully started. In the case, damon_call() could
indefinitely hang. Read the comment on damon_call() for more detail. Fix
the problem by memorizing if the DAMON context has ever successfully
started, and skip damon_call() if it has not.
This issue can easily be reproduced by writing Y to commit_inputs on a
system that DAMON_RECLAIM was not turned on before.
Link: https://lore.kernel.org/20260803134646.16640-1-sj@kernel.org
Link: https://lore.kernel.org/20260803134646.16640-2-sj@kernel.org
Link: https://lore.kernel.org/20260802173021.762-1-sj@kernel.org [1]
Fixes:
|
||
|
SJ Park
|
06befa61c4 |
mm/damon/lru_sort: error out for >10000 active_mem_bp
damos_quota_score() can trigger division by zero if the target value is
zero. DAMON_LRU_SORT lets users set the target value for the hot memory
scheme via active_mem_bp parameter. It avoids setting it as the target
value if the parameter value is zero. However, it also sets the cold
memory scheme with a target value that is calculated as '10000 -
active_mem_bp + 2'. Hence, if a user sets active_mem_bp 10002, the cold
memory scheme's quota goal target value can be zero. As a result,
division by zero can be triggered. Fix by returning an error when the
user tries to start DAMON with >10000 active_mem_bp parameter value.
It makes no sense to set active_mem_bp with 10002. It also requires
module parameters write permission to reproduce the issue. That said, the
consequence is quite bad.
One reliable way to reproduce the issue is like below:
# cd /sys/module/damon_lru_sort/parameters
# echo 1000 > wmarks_high
# echo 995 > wmarks_mid
# echo 0 > wmarks_low
# echo 10002 > active_mem_bp
# echo Y > enabled
# dmesg -w
[...]
[ 597.421247] Oops: divide error: 0000 [#1] SMP NOPTI
[ 597.428848] RIP: 0010:damos_quota_score+0x6f/0x480
This issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260803134034.15217-3-sj@kernel.org
Link: https://lore.kernel.org/20260801213028.5127-1-sj@kernel.org [1]
Fixes:
|
||
|
Lorenzo Stoakes
|
5872168de5 |
mm/vma: use vma_start_pgoff(), linear_page_index() in mm code
There are many instances in which linear_page_index() (as well as linear_page_delta()) is open-coded, which is confusing and inconsistent. Additionally, vma->vm_pgoff doesn't necessarily make it clear that this is the page offset of the start of the VMA range. Doing so also aids greppability. So use vma_start_pgoff() in favour of directly accessing vma->vm_pgoff, and linear_page_index() where we can. This also lays the ground for future changes which will add an anonymous page offset in order to be able to index MAP_PRIVATE-file backed anon folios in terms of their virtual page offset. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-18-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: SJ Park <sj@kernel.org> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
2430a8d517 |
mm/damon/sysfs: implement probe/weight file
Implement a new sysfs file, 'weight', under probe directory. Users will be able to set the probe weight and enable the attributes only monitoring using it. Link: https://lore.kernel.org/20260710134651.18084-17-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
8d5e0ebac9 |
mm/damon/core: implement damon_has_probe_weight()
DAMON monitors only data attributes when probe weights are set. However, the function for detecting it is intentionally returning false always. The intention was to make changes for complete support of the mode in a safe and incremental way. Now all the building blocks are made. Complete the mode detection function so that the mode can really start working. Link: https://lore.kernel.org/20260710134651.18084-16-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
db697312bb |
mm/damon/core: get merge threshold from probe hits when weights are set
When probe weights are set, DAMON merges regions based on their probe hits weighted sum. But the merge threshold is calculated based on the access frequency. Update it to retrieve the maximum probe hits weighted sum in the snapshot from apply_probes() ops callback, and generate the threshold based on it. Link: https://lore.kernel.org/20260710134651.18084-15-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
b9bc678bfb |
mm/damon/core: s/max_nr_accesses/max_merge_score/ in kdamond_fn()
When probe weights are set, DAMON merge logic works with the probe hits weighted sum. The core logic is setting the merge threshold based on the access frequency, though. Before using probe hits based threshold, rename the variables to look more general. Link: https://lore.kernel.org/20260710134651.18084-14-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
a8ba965a4c |
mm/damon/core: set samples in apply_probes() if probe weights are set
When probe weights are set, the prepare_access_checks() ops callback is not invoked, so sampling addresses of regions are unset. Ask apply_probes() to set those together in the case. Link: https://lore.kernel.org/20260710134651.18084-13-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
05c978da7f |
mm/damon/core: disable access monitoring when probe weights are set
When users set probe weights, they are interested in the data attributes. Not necessarily they are interested in data access patterns. Disable the data access monitoring in the case. Link: https://lore.kernel.org/20260710134651.18084-12-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
23c0623f80 |
mm/damon/core: validate params for probe hits weighted sum overflow
damon_probe_hits_wsum() could overflow in weird setups. Users could set the weight unreasonably high. They could also set the aggregation interval unreasonably high compared to the sampling interval. Such user setup is unlikely. Even if such setup is used, damon_has_probe_weights() always returns false, so the overflow cannot happen. The function may be completed in future, though. Even if the overflow happens, the consequence is degraded monitoring results for the unreasonable setup. It is just a trivial user experience issue. It is still better to be prevented unless the cost is expensive. Avoid the overflow by adding the parameter validation in the core layer parameters validation function. Link: https://lore.kernel.org/20260710134651.18084-11-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
93508425db |
mm/damon/core: disallow probe_hits overflow on attrs only monitoring
When any damon_probe->weight is set, DAMON will do only probe monitoring. probe_hits is 'unsigned char'. It could overflow when the aggregation interval is larger than the sampling interval times 256. damon_as_probe_weights() always return false, so such overflow cannot happen. Even if it happens, it only degrades the monitoring results. That said, the overflow is not intentional. It is better to be prevented as long as the cost is not expensive. Disallow the overflow by adding a validation logic on the core layer parameters validation function. Link: https://lore.kernel.org/20260710134651.18084-10-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
0d1daaed8b |
mm/damon/core: extend merge function to work with probe hits
When probe weights are set, users may want DAMON monitoring results to be optimized for the weights. For that, regions adjustment should work for the weighted sum of probe hits. Extend damon_merge_regions_of() to detect if the weights are set, and work with probe hits in the case. The weights setup detection function is incomplete. It always returns false. It is intentional, so that more changes to completely support weights can be made in an incremental but safe way. Until the function is completed, all changes depend on it is no-op, so DAMON works in the current mode. Link: https://lore.kernel.org/20260710134651.18084-9-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
e1f150d415 |
mm/damon/core: use abs_diff() instead of abs()
Use of abs() in damon_merge_regions_of() could cause a silent integer overflow since the macro casts unsigned int to signed int. It is unlikely to have such a large value for nr_accesses. Even though it happens, the user impact is just degraded monitoring results. Users showing bad monitoring results for weird setup is quite trivial. But the code is obviously wrong. Use abs_diff() instead. The issue was discovered [1] by Sashiko. Link: https://lore.kernel.org/20260710134651.18084-8-sj@kernel.org Link: https://lore.kernel.org/20260705213817.100841-1-sj@kernel.org/ [1] Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
3858025f48 |
mm/damon/paddr: respect return_max_wsum
apply_probes() ops implementation in DAMON_PADDR is ignoring return_max_wsum. Respect it. Link: https://lore.kernel.org/20260710134651.18084-7-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
cfe9e8c738 |
mm/damon/core: implement damon_probe_hits_wsum()
When damon_probe->weight is set, the weighted sum of probe hits will be useful. It will be useful for not only the users but also DAMON internal logics like regions merging. Implement a function for calculating it. Link: https://lore.kernel.org/20260710134651.18084-6-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
d235513a7c |
mm/damon/core: ask apply_probe() to return max probe hits weighted sum
check_accesses() DAMON ops callback returns the maximum nr_accesses of regions. DAMON core uses it to calculate a reasonable region merge threshold. The core will need to adjust regions for not nr_accesses but probe hits weighted sum in future. For that, the core needs to know the maximum weighted sum of the regions. Update the protocol for the task. Link: https://lore.kernel.org/20260710134651.18084-5-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
a75de62a5f |
mm/damon/paddr: set samples in apply_probes() if requested
apply_probe() callback implementation in DAMON_PADDR is ignoring set_samples parameter. Respect it. Link: https://lore.kernel.org/20260710134651.18084-4-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
SJ Park
|
1138ec78dc |
mm/damon/core: ask apply_probes() ops callback to set sampling address
prepare_access_checks() DAMON ops callback sets the monitoring sampling address per region. In future, DAMON will be able to call only apply_probes(). In this case, applyy_probes() may need to do the sampling address setup, to minimize unnecessary regions iteration. Update the protocol for the request. Link: https://lore.kernel.org/20260710134651.18084-3-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |