| Age | Commit message (Collapse) | Author |
|---|
|
On some models, e.g. the UX5400EA, the screenpad power state cannot be
read back: DSTS(ASUS_WMI_DEVID_SCREENPAD_POWER) never sets
ASUS_WMI_DSTS_STATUS_BIT, so asus_wmi_get_devstate_simple() reports the
panel as powered off regardless of its real state.
The DSDT shows DSTS 0x00050031 (POWER) and DSTS 0x00050032 (LIGHT)
both read the same two-byte EC register, each returning a different
byte: byte 0 is a raw EC status byte, which is 0xa0 when the panel is
powered and 0x00 when it is off, and byte 1 is the brightness. Read
the power state from the low byte instead of
ASUS_WMI_DSTS_STATUS_BIT: firmware reporting the power through the
status bit is covered too, since ASUS_WMI_DSTS_STATUS_BIT lies inside
ASUS_WMI_DSTS_BRIGHTNESS_MASK.
Reuse read_screenpad_backlight_power() in asus_screenpad_init() in
place of the raw devstate read. This makes the brightness read
reachable on models like the UX5400EA, so mask the SCREENPAD_LIGHT
value with ASUS_WMI_DSTS_BRIGHTNESS_MASK before storing it: the
unmasked devstate (0x0001ffa0 when the panel is on) would otherwise be
exposed to userspace as an out-of-range brightness (max_brightness is
255) which systemd-backlight then persists.
While at it, pass asus_wmi_get_devstate() the u32 it expects.
Fixes: 130d29c5627c ("platform/x86: asus-wmi: adjust screenpad power/brightness handling")
Reported-by: Hugo Baigue <hugobaigue2004@gmail.com>
Closes: https://lore.kernel.org/all/CAO84+x+P2_xyHP89+nGVSMV6bL+dy0P9=vyEEfZGnFhv0hBNWw@mail.gmail.com/
Suggested-by: Hugo Baigue <hugobaigue2004@gmail.com>
Tested-by: Hugo Baigue <hugobaigue2004@gmail.com>
Cc: stable@vger.kernel.org
Assisted-by: zcode:glm-5.3-flash
Signed-off-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20260916143838.170950-3-denis.benato@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
The bd->props.power is checked in parts of the driver correctly
comparing with BACKLIGHT_POWER_ON, while in others with a raw usage
of bd->props.power and !bd->props.power, moreover in certain checks
the logic has been inverted due to BACKLIGHT_POWER_ON being defined
as 0: fix both the wrong usage and the inconsistencies by using
proper comparisons.
Fixes: 130d29c5627c ("platform/x86: asus-wmi: adjust screenpad power/brightness handling")
Closes: https://lore.kernel.org/all/178362762638.911488.8564892548331679884@eldamar.lan/
Closes: https://lore.kernel.org/all/ea9c63d1-4776-49d5-9dc4-6c09498f99c9@linux.dev/
Tested-by: Hugo Baigue <hugobaigue2004@gmail.com>
Tested-by: Ponali <ponali2k@gmail.com>
Cc: stable@vger.kernel.org
Assisted-by: zcode:glm-5.3-flash
Signed-off-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20260916143838.170950-2-denis.benato@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
On certain 2025 Lenovo laptops, such as the Yoga Pro 7 14ASP10 and Legion
Pro 7 16AFR10H, the F11 key includes a symbol showing a laptop, a tablet
and a smartphone. According to the user manual, the key starts the Lenovo
Smart Connect app, which connects the laptop to phones and tablets.
These laptops send WMI hotkey event 0x48 (scancode 0x148) when the key
is pressed, which is currently reported as KEY_UNKNOWN. Map it to
KEY_LINK_PHONE as the closest match, as thinkpad_acpi does for the
Microsoft Phone Link and Intel Unison keys, see
commit 7ba618e893a4 ("platform/x86: thinkpad_acpi: Add support for new
phone link hotkey") and commit b511bbfe4242 ("platform/x86: thinkpad_acpi:
handle HKEY 0x1402 event").
Signed-off-by: Marco Giunta <marco_giunta@outlook.it>
Link: https://patch.msgid.link/SN6PR19MB2303EBD5288E51BA50D904EFFCB92@SN6PR19MB2303.namprd19.prod.outlook.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
Build testing with -Wpadded shows a structure that is incompatible
between 32-bit and 64-bit x86 userspace:
./usr/include/linux/amd-pmf.h:202:1: error: padding struct size to alignment boundary with 4 bytes [-Werror=padded]
Use the 64-bit padded on all architectures here to avoid both
the warning and allow compat ioctl handling.
Fixes: 98432eec3180 ("platform/x86/amd/pmf: Add util layer and userspace character device interface")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260915202535.3689880-1-arnd@kernel.org
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
Add support for WMI device 0x0004001c and register it as the
platform::mute LED using the audio-mute trigger.
The device ID is present in the PM3406CKA DSDT and is also used
by GHelper for controlling the same LED.
Tested on ASUS ExpertBook PM3406CKA.
Signed-off-by: Patryk Dańków <patryk.dankow@protonmail.com>
Reviewed-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20260915174110.67871-2-patryk.dankow@protonmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
The L440 (BIOS J4ET93WW) reports its fan as stopped: /proc/acpi/ibm/fan
shows "status: disabled" and "speed: 0", and hwmon fan1_input is 0 under
any load. EC registers 0x2F and 0x84/0x85 always read 0 on this model.
The EC uses the 0x93/0x95 layout handled by TPACPI_FAN_NS. 0x93 reads 4
(FAN_NS_CTRL_STATUS) and 0x95 goes from 255 at idle to about 111 at full
speed. The DSDT has no fan methods.
Add the J4 BIOS family to fan_quirk_table. The fan then reads about
1900 RPM at idle and 2900 RPM under load. The L540 shares the J4 BIOS
and the same EC firmware, so it is covered by the same entry.
Tested on a ThinkPad L440 20ASS20200 with BIOS J4ET93WW and EC J4HT30WW.
Link: https://github.com/lm-sensors/lm-sensors/issues/510
Signed-off-by: Daniel Salmun <salmundani@gmail.com>
Link: https://patch.msgid.link/20260915021154.23252-1-salmundani@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
The metrics table doesn't increment for all cases that can cause an
intermediate wakeup if the cycle is very fast. This can make the intent
from commit 9f5595d5f03fd ("platform/x86/amd: pmc: Require at least 2.5
seconds between HW sleep cycles") not work properly.
That commit originally was measured to work properly, but it was
accidental due to a logic error. The logic error was fixed in
commit 4dbd11796f3a8 ("platform/x86/amd: pmc: Clear metrics table at
start of cycle") but this now masked the table doesn't always update.
Since that code was introduced, Daniel Gibson added a number of changes
to the logic which includes a state variable introduced in
commit 037f0b03c663a ("platform/x86/amd/pmc: Don't log during
intermediate wakeups").
Utilize that state variable to instead decide if a single sequence has
started.
Cc: Daniel Gibson <daniel@gibson.sh>
Cc: stable@vger.kernel.org # 7.1.y: 037f0b03c663a platform/x86/amd/pmc: Don't log during intermediate wakeups
Cc: stable@vger.kernel.org # 6.18.y: 037f0b03c663a platform/x86/amd/pmc: Don't log during intermediate wakeups
Fixes: 4dbd11796f3a8 ("platform/x86/amd: pmc: Clear metrics table at start of cycle")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Tested-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
Link: https://patch.msgid.link/20260914141734.2703545-1-mario.limonciello@amd.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
On the HP Laptop 15-fd1xxx (motherboard ID 8DE1), hp-wmi currently falls
back to the legacy HPWMI_FAN_SPEED_GET_QUERY (0x11) command because the
board is not listed in hp_wmi_feature_boards[].
In HP BIOS DSDT table (e.g. BIOS F.26), method GM11 (query 0x11) is a
dummy stub that returns 4 bytes of 0x00 with return code 0 (success),
causing the driver to report 0 RPM via hwmon even while the fan is
actively spinning.
However, the DSDT implements method GM2D (query 0x2D / Victus S fan
interface), which reads the active fan tachometer directly from the
Embedded Controller (EC0) registers RPM1/RPM2 and reports accurate fan
speed.
Add board ID "8DE1" to hp_wmi_feature_boards[] mapped to
victus_s_board_params so hp-wmi uses the working query 0x2D interface.
Signed-off-by: Walid Elonok <walidelonk@gmail.com>
Link: https://patch.msgid.link/20260913054645.58692-1-walidelonk@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
Add power limit data for the ASUS ROG Zephyrus Duo GX651AR.
The GX651AR uses the following limits:
- CPU PL1: 30-75 W
- CPU PL2: 38-80 W
- NVIDIA Dynamic Boost: 5-25 W
- NVIDIA TGP: 80-115 W
- NVIDIA temperature target: 75-87 C
The same CPU limits and temperature target are available on DC power.
Signed-off-by: Cymirk <Cymirk@icloud.com>
Signed-off-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20260910205032.153165-1-denis.benato@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
Remove the local str_supported() function and use the common
str_supported_unsupported() helper.
Debug messages now use "unsupported" instead of "not supported".
Signed-off-by: Thorsten Blum <blum@kernel.org>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Link: https://patch.msgid.link/20260907084319.351688-6-blum@kernel.org
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
Add str_supported_unsupported() to return "supported" or "unsupported"
depending on the boolean argument. Also add the inverse
str_unsupported_supported().
Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Thorsten Blum <blum@kernel.org>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Link: https://patch.msgid.link/20260907084319.351688-5-blum@kernel.org
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
The HP Laptop 14-fq1xxx (board 887C, BIOS F.38) takes about 10.2
seconds in noirq device resume from s2idle. Its firmware uses the NVMe
SMI path already handled by amd_pmc_skip_nvme_smi_handler().
Add the system to fwbug_list with the combined Cezanne quirk so the
existing spurious 8042 workaround remains enabled. This reduced noirq
device resume from 10195/10242 ms to 27 ms in testing.
Signed-off-by: Murat Bayraktar <bob65536@proton.me>
Link: https://patch.msgid.link/20260906-hp-887c-s2idle-quirk-v1-1-e470e36fb01d@proton.me
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
The driver evaluates the PALC0001 _DSM with revision 1 only. Extend it
to also support firmware implementing revision 0, as found on Slate PTL
CS 14, Yukon PTL CSLW 14 and Yukon PTL 360 14.
The supported revision is detected once during probe. Revision 1 is
checked first so that existing systems keep their current behaviour, and
the accepted revision is then used for evaluating the reset _DSM.
Signed-off-by: Jack Wu <jackbb_wu@compal.com>
Link: https://patch.msgid.link/20260904-dw5826e-acpi-reset-add-revision-v1-1-1be7153c3453@compal.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
The static slider APTS state index is supplied by the BIOS as an 8-bit
value, but apts_config_store contains only APTS_MAX_STATES entries. An
invalid firmware value can therefore cause amd_pmf_update_slider_v2() to
read beyond the end of the array.
Validate the selected index before applying the slider values and return
an error when it is out of range.
Fixes: 8362e862fb87 ("platform/x86/amd/pmf: Update sps power thermals according to the platform-profiles")
Cc: stable@vger.kernel.org
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260903182927.3556274-1-mario.limonciello@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
The HP Omen 16-am0xxx (board ID: 8D3F) has the same WMI interface as
other Victus S boards, but requires quirks for correctly switching
thermal profile.
Add the DMI board name to hp_wmi_feature_boards[] table and
map it to omen_v1_legacy_board_params.
Testing on board 8D3F confirmed that platform profile is registered
successfully and fan RPMs are readable and controllable.
Tested-by: Jan Ziobro <ziobrojan79@gmail.com>
Signed-off-by: Krishna Chomal <krishna.chomal108@gmail.com>
Link: https://patch.msgid.link/20260829071843.62902-1-krishna.chomal108@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
Add the Alienware Area-51 (2025 desktop, model AAT2250) to the AWCC DMI
table. G-Mode is not applicable to this desktop, so generic_quirks is
used. The full product name is matched to avoid colliding with the
"Alienware Area-51m" and "Alienware 16/18 Area-51" laptop entries.
Tested on hardware with BIOS 1.6.0: loading with
force_platform_profile=1 force_hwmon=1 exposes a working platform
profile (quiet/balanced/balanced-performance/custom) and a fully
functional hwmon interface (6 fans - CPU, 3 top, 2 front - with fan
boost control and temperature sensors).
Signed-off-by: Rickey Bartlett <subtexel@gmail.com>
Reviewed-by: Kurt Borja <kuurtb@gmail.com>
Link: https://patch.msgid.link/20260828145756.341733-1-subtexel@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
The email for Shravan Sudhakar is bouncing. There are no remaining
maintainers for int1092, so mark it as an orphan.
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Hans de Goede <hansg@kernel.org>
Cc: "Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>
Cc: platform-driver-x86@vger.kernel.org
Link: https://patch.msgid.link/20260827155053.2334792-1-dave.hansen@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
The HP OMEN Slim 16t-an000 (board ID: 8D40) uses the existing OMEN v1
WMI interface but does not use the standard EC thermal profile
parameters.
Furthermore, it is the closest sibling of board 8D41 and 8D42, which
are already included in the table with omen_v1_no_ec_board_params.
Add the DMI board name to hp_wmi_feature_boards[] and map it to
omen_v1_no_ec_board_params.
This enables the existing board-specific handling for 8D40, including
platform profile and fan control support.
(Tested-by tag not included due to invalid email address, see the
github link below.)
Link: https://github.com/CachyOS/kernel-patches/issues/157
Signed-off-by: Suryansh Singh <technosfan14@gmail.com>
Link: https://patch.msgid.link/20260827152226.35186-1-technosfan14@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
The AMDI0112 ID is used to bind the PMF driver to some platforms.
It doesn't have any Linux side code changes relative to the most
similar AMDI0105.
Cc: stable@vger.kernel.org
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260826163611.2268377-1-mario.limonciello@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
quirk tables
The Lenovo ThinkPad X9-14 Gen 1 uses a non-standard Embedded Controller
firmware (ECFW) whose thermal and fan registers are not located at the
classic addresses. On this model the thermal registers sit at 0xA8-0xAF /
0xB8-0xBF and the fan registers use the non-standard offsets, instead of
the legacy 0x78-0x7F / 0xC0-0xC7 (thermal) and 0x2f / 0x84 (fan).
Because the model is not covered by the existing quirk tables, the driver
probes the legacy thermal addresses during init, reads back 0x00 from
every register, concludes the EC is "misbehaving" and disables all
thermal sensor access:
thinkpad_acpi: ThinkPad ACPI EC access misbehaving, disabling thermal
sensors access
Fan access is affected the same way, leaving fan1/fan2 reporting 0 RPM.
The infrastructure for these non-standard ECFW models is already in place
(commit 301c1904d638 ("platform/x86: thinkpad_acpi: Fix to correct wrong
temp reporting on some ThinkPads")); the X9-14 Gen 1 simply was not added
to the model lists yet. Add its BIOS model code N4D to both the thermal
and fan quirk tables so that:
- thermal_read_mode_check() selects TPACPI_THERMAL_TPEC_12 and reads
the 0xA8/0xB8 registers, and
- fan_init() selects the non-standard fan register addresses.
Reported-by: thisisamirv <thisisamirv@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221228
Signed-off-by: Huang Wei <huangwei@kylinos.cn>
Link: https://patch.msgid.link/20260918161539.2676619-1-huangwei@kylinos.cn
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
On the T14s, the EC already steps the keyboard backlight when you press
Fn+Space: off, then low, then high.
We report that change with t14s_kbd_bl_update() (brightness_hw_changed).
We then also send KEY_KBDILLUMTOGGLE.
The extra key is the problem. Desktops treat it as "please toggle the
light." GNOME calls Keyboard.Toggle() and changes the LED itself. That
fights the EC's three steps. The on-screen bar also stays empty,
because Toggle() always returns 0%.
thinkpad_acpi on x86 already skips the key when the firmware changed
the light. It only uses brightness_hw_changed. Do the same here: keep
the LED update, do not send KEY_KBDILLUMTOGGLE.
Tested on a Lenovo ThinkPad T14s Gen 6 (21N1, Snapdragon X Elite) with
GNOME. After this change the OSD bar tracks off / 50% / 100%.
Signed-off-by: David Stephenson <git@davidstephenson.net>
Reviewed-by: Sebastian Reichel <sre@kernel.org>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Link: https://patch.msgid.link/20260825193556.133277-1-git@davidstephenson.net
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
|
|
When message interleaving is enabled, the first send waits for association
establishment before building its data chunks. The wait drops the socket
lock, and handshake processing can reduce the output stream count to the
peer-advertised inbound stream count. sctp_stream_init() then frees the
extension of every removed stream.
The sender resumes with the stream that it checked before the wait. If the
peer removed that stream, sctp_outq_tail() later dereferences its NULL
extension. Fatal-oops policies then panic the host.
KASAN: null-ptr-deref in range [0x38-0x3f]
RIP: sctp_outq_tail+0x49e/0xaa0
Call Trace:
sctp_primitive_SEND
sctp_sendmsg_to_asoc
sctp_sendmsg
A range check alone is insufficient. Stream reconfiguration can grow the
output count again while the lock is released without recreating extensions
freed by the earlier shrink. The stream can then be in range while its
extension remains NULL. The send-buffer wait has the same issue.
Factor the range and extension checks into a helper and repeat both after
each send-path wait that drops the socket lock. Once the lock is
reacquired, the validation remains stable through data creation and
queueing.
If validation fails after the connect wait, the auto-created association is
already established. Return ESRCH so the existing caller path keeps it
under state-machine ownership instead of freeing it directly, which would
leave protocol, counter and socket state inconsistent.
Fixes: 668c9beb9020 ("sctp: implement assign_number for sctp_stream_interleave")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20261007035739.3472432-1-4ncienth@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
https://gitlab.freedesktop.org/drm/rust/kernel into drm-next
DRM Rust changes for v7.4-rc1
- Cross-subsystem:
- I/O (shared from driver-core tree via signed tag rust-io-7.4-rc1):
- Reimplement register!() as a procedural macro, require matching
base types for register access, and replace relative registers
with typed I/O projections. Convert Nova, Tyr and the PCI sample
- Add AsRepr/AsReprMut conversions for I/O on compatible wrapper
types and transmute helpers with deferred size checks
- DMA (shared from driver-core tree via signed tag rust-dma-7.4-rc1):
- Tie Coherent, CoherentBox and CoherentHandle to the device's bound
lifetime, and allow scoped debugfs files backed by non-'static
data
- Allow auxiliary registration-data closures to return covariant
sub-fields and add UserSliceWriter::write_truncated()
- Implement Send and Sync for MapleTree
- Add PCI resource_flags() and IORESOURCE_MEM_64, and convert PCI IRQ
flags to impl_flags!()
- Add I/O view cast() with compile-time size and alignment checks
- DRM:
- Add Rust dma_fence abstractions with separate producer (DriverFence)
and consumer (Fence) types, per-context sequencing, signal callbacks
and preallocation. Additional backend operations remain follow-up
work.
- Initialize DRM registrations and their data in place, removing a
separate allocation
- Drop the unused flags argument from drm::Registration::new()
- Nova:
- UAPI and Cross Module API:
- Add NovaCoreApi and a lifetime-bound handle for auxiliary child
drivers, carried in nova-drm registration data
- Expose a render node and extensible INFO ioctl reporting GPU
architecture, opaque chip ID, usable VRAM and VRAM BAR sizes,
full and short GPU names, and GID, with size discovery and
truncation to the userspace buffer size
- Move BAR-size queries into GPU info, removing GETPARAM and
changing the UAPI
- PRAMIN access:
- Add typed CPU access to VRAM through the movable 1 MiB BAR0
PRAMIN window, with per-architecture support from Turing through
Blackwell
- Add GpuMm centralized memory manager, VramAddress type, aperture
documentation and optional probe-time self-tests under
CONFIG_NOVA_CORE_SELFTESTS
- GPU virtual memory and BAR1:
- Add VRAM buddy allocation, TLB flushing, MMU v2/v3 page-table
types with trait-based generics (PteOps, PdeOps, DualPdeOps,
MmuConfig) and a generic walker
- Add maple-tree virtual address tracking and multi-page mapping,
separating allocation from mapping execution
- Add CPU access to mapped VRAM through BAR1 and memory-management
self-tests; handle 64-bit BAR0 when locating BAR1
- GPU interrupts and GSP events:
- Add GIN (GPU Interrupt and Notification) interrupt-tree support
with MSI-X, MSI fallback and per-architecture rearming
- Drain GSP events between commands via a threaded SWGEN0 handler
- Report OS errors, robust-channel notifications and unknown
messages without aborting command waits; hold the queue lock and
use one deadline per wait
- Disable GSP event interrupts on persistent falcon faults or
drain errors
- Add a delivery/rearm self-test, interrupt-tree KUnit coverage
and interrupt-controller documentation
- GSP messaging fixes:
- Queue setup RPCs before GSP-RM boot
- Correct DMA barriers in both queue directions
- Firmware and transport:
- Extract a reusable radix3 buffer mapper; zero-pad page-table
levels to whole pages to prevent booter reads of stale padding
- Correct GSP-FMC naming and boot-flow documentation
- Set MCTP header version 1 for FSP messages and retain the
command queue's BAR0 reference
- Resource handling:
- Replace unnecessary BarUser reference counting with in-place
ownership and borrowed access; consolidate probe initialization
- Declare an unlimited DMA maximum segment size
- Tyr:
- Use bitfield!() for firmware section flags and memory attributes
that do not describe registers
- Zero unsupported and newly added GPU-info fields, and limit the
doorbell array to 17 entries to fit the mapped register region
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: "Danilo Krummrich" <dakr@kernel.org>
Link: https://patch.msgid.link/DM371PN4TBJT.3LY1B0EYWSI4@kernel.org
|
|
A KASAN slab-use-after-free read was reported in submit_audio_out_urb()
when generating an impulse test signal:
BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline]
BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249
Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785
Allocated by task 11:
kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144
line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158
line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329
line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728
Freed by task 7785:
kfree+0xf8/0x390 mm/slub.c:6566
line6_buffer_release sound/usb/line6/pcm.c:176 [inline]
line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170
__line6_pcm_release sound/usb/line6/pcm.c:305 [inline]
line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313
snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183
line6pcm->prev_fbuf points into the capture PCM stream buffer
(line6pcm->in.buffer), which is updated during audio_in_callback() to
feed rate synchronization, software monitoring, and impulse test signal
generation on playback side.
When all capture streams are closed, line6_buffer_release() frees
pstr->buffer with kfree(). However, it does not clear line6pcm->prev_fbuf.
If playback is subsequently started (e.g. via impulse test signal
volume control snd_line6_impulse_volume_put()), submit_audio_out_urb()
dereferences the stale pointer line6pcm->prev_fbuf under in.lock,
resulting in a slab-use-after-free read.
Clear prev_fbuf and prev_fsize in line6_buffer_release() when releasing
the capture stream buffer under in.lock, ensuring that no stale buffer
pointer can be accessed by submit_audio_out_urb().
Fixes: 63e20df1e5b2 ("ALSA: line6: Reorganize PCM stream handling")
Cc: stable@vger.kernel.org
Co-developed-by: Bin Yu <byu@xidian.edu.cn>
Signed-off-by: Bin Yu <byu@xidian.edu.cn>
Co-developed-by: Cheng Wen <wencheng@xidian.edu.cn>
Signed-off-by: Cheng Wen <wencheng@xidian.edu.cn>
Signed-off-by: YuanZhe Liu <25031212351@stu.xidian.edu.cn>
Link: https://patch.msgid.link/20261013063554.571-1-25031212351@stu.xidian.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
If the delayed probe fails, azx_probe_work() frees the card and clears
the drvdata. azx_remove() reads the card before it waits for the probe
work with cancel_delayed_work_sync() so when the device is removed while
the probe work is running, it frees the card again after the work has
already freed it.
Only disconnect the card in the work so that its slot is released right
away and leave freeing it to azx_remove().
Fixes: 39173303c838 ("ALSA: hda: Free card instance properly at probe errors")
Reported-by: syzbot+40b06a86af225236fdb4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=40b06a86af225236fdb4
Signed-off-by: Ali Ahmet Memiş <aliamemis@disroot.org>
Link: https://patch.msgid.link/20261012162841.1879278-1-aliamemis@disroot.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
Jack debugfs files store a raw snd_jack_kctl pointer, so their
callbacks must be drained before the attachment is freed.
snd_jack_dev_free() unlinks and frees the attachments before calling
snd_jack_dev_disconnect(). Its late snd_jack_remove_debugfs() call
then has no entries left to traverse.
With CONFIG_SND_JACK_INJECTION_DEBUG and input support enabled, an
HDA codec rebind on a live card can publish a non-phantom jack's type
file while its component is still in SNDRV_DEV_BUILD. A later
jack-control allocation failure permits the following order:
1. hda_codec_driver_probe() creates a jack and publishes its debugfs
files before reaching snd_card_register().
2. A later control-build failure calls
snd_hda_codec_cleanup_for_unbind(), then snd_hda_jack_tbl_clear()
and snd_device_free(). __snd_device_disconnect() skips BUILD
components. snd_jack_dev_free() frees the attachment before its
late disconnect, leaving the debugfs files published.
3. After cleanup, a reader opens the surviving type file and
jack_type_read() dereferences the freed attachment's jack pointer.
The card's debugfs root remains live throughout this sequence. The
result is a use-after-free even without an overlapping read. An
already admitted callback is also not drained by this cleanup.
Call snd_jack_remove_debugfs() before unlinking any controls in the
free callback. The existing debugfs_remove() rundown blocks new
accesses and waits for active callbacks while the attachment, control
and jack remain valid. Roots cleared by an earlier disconnect are
NULL, so repeating the removal is harmless.
KASAN report as below:
==================================================================
BUG: KASAN: slab-use-after-free in jack_type_read+0x1da/0x1f0
Read of size 8 at addr ffff8881085f9da0 by task python3/429
CPU: 2 UID: 0 PID: 429 Comm: python3 Not tainted 7.2.0-rc6-pmb-alsa-functional-v2+ #1 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x93/0xd0
print_report+0xce/0x630
? jack_type_read+0x1da/0x1f0
? srso_alias_return_thunk+0x5/0xfbef5
? __virt_addr_valid+0x20d/0x410
? jack_type_read+0x1da/0x1f0
kasan_report+0xe0/0x110
? jack_type_read+0x1da/0x1f0
jack_type_read+0x1da/0x1f0
? __pfx_jack_type_read+0x10/0x10
? __pfx___debugfs_file_get+0x10/0x10
? __pfx_cp_new_stat+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? selinux_file_permission+0x122/0x570
full_proxy_read+0x11f/0x180
? __pfx_full_proxy_read+0x10/0x10
vfs_read+0x1a0/0xc20
? __pfx_vfs_read+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __do_sys_newfstat+0xa6/0x100
? find_held_lock+0x2b/0x80
? __pfx___do_sys_newfstat+0x10/0x10
ksys_read+0x111/0x200
? __pfx_ksys_read+0x10/0x10
? full_proxy_llseek+0x11e/0x170
do_syscall_64+0x115/0x6a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7e392e7687
Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fff5f7b9180 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f7e39253780 RCX: 00007f7e392e7687
RDX: 0000000000002000 RSI: 000000003d2e9b00 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007f7e39253700
R13: 0000000000002000 R14: 00007f7e38d7e2c0 R15: 0000000000a55b98
</TASK>
Allocated by task 425:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
__kmalloc_cache_noprof+0x251/0x610
snd_jack_kctl_new+0x80/0x180
snd_jack_new+0x4b/0x490
snd_hda_jack_add_kctl_mst+0x19b/0x610
add_jack_kctl+0x204/0x320
snd_hda_jack_add_kctls+0x212/0x910
snd_hda_gen_build_controls+0x233/0x600
snd_hda_codec_build_controls+0x2e4/0x9f0
hda_codec_driver_probe+0x26e/0x590
really_probe+0x21f/0xa90
__driver_probe_device+0x1ec/0x490
device_driver_attach+0xdc/0x210
bind_store+0xec/0x180
drv_attr_store+0x79/0xb0
sysfs_kf_write+0xed/0x140
kernfs_fop_write_iter+0x34b/0x500
vfs_write+0x637/0x1010
ksys_write+0x111/0x200
do_syscall_64+0x115/0x6a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 425:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x307/0x580
snd_jack_kctl_private_free+0x153/0x200
__snd_ctl_remove+0x29f/0x3b0
snd_ctl_remove+0x46/0x70
snd_jack_dev_free+0x1b1/0x370
__snd_device_free+0x193/0x3f0
snd_device_free+0xcf/0x190
snd_hda_jack_tbl_clear+0x159/0x2e0
snd_hda_codec_cleanup_for_unbind+0x37e/0x9c0
hda_codec_driver_probe+0x3ae/0x590
really_probe+0x21f/0xa90
__driver_probe_device+0x1ec/0x490
device_driver_attach+0xdc/0x210
bind_store+0xec/0x180
drv_attr_store+0x79/0xb0
sysfs_kf_write+0xed/0x140
kernfs_fop_write_iter+0x34b/0x500
vfs_write+0x637/0x1010
ksys_write+0x111/0x200
do_syscall_64+0x115/0x6a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff8881085f9d80
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 32 bytes inside of
freed 64-byte region [ffff8881085f9d80, ffff8881085f9dc0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1085f9
flags: 0x200000000000000(node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000000 ffff8881000428c0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881085f9c80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
ffff8881085f9d00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8881085f9d80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff8881085f9e00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8881085f9e80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
Fixes: 495000a38634 ("ALSA: core: Remove debugfs at disconnection")
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Link: https://patch.msgid.link/pm-pmb-e1e7490bbe7ba1b3c44a-v2-3e3b6315a18c02ced60d@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
The unused huge shrinklist shares the default list_lru lock class with the
dentry LRU. Although they use distinct lock instances, lockdep conflates
their dependencies and reports a circular locking dependency:
WARNING: possible circular locking dependency detected
Give the unused huge shrinklist a dedicated lock class to fix this
false-positive lockdep warning.
Link: https://lore.kernel.org/20261011045956.30277-1-qi.zheng@linux.dev
Fixes: b9b1861d4f7a ("mm: shmem: make unused huge shrinker memcg aware")
Signed-off-by: Qi Zheng <qi.zheng@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: kernel test robot <yi1.lai@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202610091403.d1d8080b-lkp@intel.com
Cc: Hugh Dickins <hughd@google.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Usama Arif <usama.arif@linux.dev>
|
|
The page reclaim isolates a batch of folios from the tail of an LRU list
and works on them one by one. For a suitable swap-backed folio on an
async swap device, it queues the folio for writeback and, after finishing
the batch, puts the folio back to the head of the original LRU list.
Meanwhile the page writeback flushes the queued folios in its own,
independent batches. For each folio it writes back it calls
folio_rotate_reclaimable(), which tries to rotate the folio to the LRU
tail. But folio_rotate_reclaimable() only takes effect once the folio has
been put back by reclaim. If the async swap device is fast enough, the
writeback can complete a folio while reclaim is still working on the rest
of the batch that contains it. In that case the folio stays near the head
and reclaim will not revisit it before wrapping around, causing a cold/hot
inversion: a clean, written-back folio that should be a prime reclaim
candidate is kept ahead of hotter folios.
commit 359a5e1416ca ("mm: multi-gen LRU: retry folios written back while
isolated") addressed this for MGLRU only. The traditional active/inactive
LRU has the same problem, reported at [1]. A reproducer is available at
[2].
Rather than re-reclaiming those folios (which would drop the swap cache
that may still be useful for a future hit [4]), restore the rotation that
was missed: when move_folios_to_lru() puts a folio back, add it to the LRU
tail if it looks like it missed folio_rotate_reclaimable() (inactive, not
mapped, not dirty and not under writeback). A referenced folio is left at
the head so it still gets a second chance, and a folio with an unexpected
reference (e.g. a GUP or speculative pin) is left at the head because it
cannot be reclaimed yet anyway. A new do_rotate parameter gates this so
it only applies on the reclaim put-back path (shrink_inactive_list()), not
on shrink_active_list() where the list order is already deliberate. This
approach was suggested by Barry Song [3].
Only the traditional LRU is handled here. MGLRU already retries such
folios via its own clean-list retry pass in evict_folios(), so it is left
unchanged. The same do_rotate scheme could later replace that retry pass
to unify both LRUs, which is left for a follow-up.
Test result with [2]:
Without patch:
cat memory.usage_in_bytes
1073700864
cat memory.memsw.usage_in_bytes
1413124096
free -h
total used free
Mem: 1.6Gi 1.2Gi 299Mi
Swap: 1.0Gi 678Mi 346Mi
With patch:
cat memory.usage_in_bytes
1071140864
cat memory.memsw.usage_in_bytes
1413423104
free -h
total used free
Mem: 1.6Gi 1.2Gi 322Mi
Swap: 1.0Gi 328Mi 695Mi
After applying the patch, the difference between
memory.memsw.usage_in_bytes and memory.usage_in_bytes is close to the swap
"used" value reported by 'free -h'.
Link: https://lore.kernel.org/20260920132519.3369946-1-ridong.chen@linux.dev
Link: https://lore.kernel.org/linux-kernel/20241010081802.290893-1-chenridong@huaweicloud.com/ [1]
Link: https://lore.kernel.org/lkml/46037a37-4cf6-448e-a94b-30a4d16e8814@linux.dev/ [2]
Link: https://lore.kernel.org/linux-mm/20260911121341.178028-1-alex@ghiti.fr/ [4]
Signed-off-by: Ridong Chen <chenridong@xiaomi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Barry Song <baohua@kernel.org>
Link: https://lore.kernel.org/lkml/CAGsJ_4zwP3_+EYY5Ug9EJ+yD1UdxsBSGr25u8s1K3u_i7LH3Zg@mail.gmail.com/ [3]
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Baoquan He <baoquan.he@linux.dev>
|
|
scan_zone_pages() scans the struct page array one page per scan_block()
call:
if (scan_block(page, page + 1, NULL))
scan_block() takes kmemleak_lock with interrupts disabled for the
duration of the call, so this acquires the lock once per online PFN to
scan a single struct page.
Gather runs of adjacent eligible struct pages and pass each run to
scan_block() in one call, capped at MAX_SCAN_SIZE.
The longest kmemleak_lock hold duration is now MAX_SCAN_SIZE worth of
bytes. The same bound scan_large_block() already applies to the data
sections and the per-CPU areas.
This can make the scan faster. On an arm64 VM with 24 GiB and ~17 GiB
in use, the struct page phase goes from 4390k scan_block() calls down
to 69k for the same 4390k pages scanned, and the whole scan about 20%
faster (on debug kernel). The win is in the per-acquisition cost, so on
a kernel built without the lock debugging options the scan time is
unchanged. I don't think it will be a problem doing more on
scan_block(), given we have the scan_should_stop() protection.
Coverage is unchanged: a temporary assertion comparing the number of
eligible pages against the number actually passed to scan_block()
matched on every zone of every scan, including while memory was being
freed underneath the scan.
Link: https://lore.kernel.org/20260921-b4-kmemleak-page-scan-v1-2-fb97d4801b3a@debian.org
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
|
|
Patch series "mm: kmemleak: batch the struct page scan".
kmemleak walks the struct page array as a scan root and hands it to
scan_block() one page at a time.
scan_block() takes kmemleak_lock with interrupts disabled for the duration
of the call, so the scanner acquires the lock once per online PFN in order
to look at a single 64-byte struct page.
Batching adjacent pages up to that size keeps exactly the same pages under
the same maximum lock hold time, with MAX_SCAN_SIZE / pagesize fewer
acquisitions.
Patch 1 lifts the loop out of __kmemleak_scan() into scan_zone_pages()
with no functional change. Patch 2 does the batching, which is then
contained in that one function.
This improves the performance due to less atomic operations, which is not
a big deal on a regular machine, but, given kmemleak usually comes with
extra debug options, such as PROVE_LOCKING, DEBUG_SPINLOCK, etc.
For instance, measuring Meta's "debug kernel flavor" on an arm64 hosts,
this improve the scan time by 20%.
It is safe to get more work into scan_block(), given it has the
protections, added by commit eb11f56eeca560 ("mm/kmemleak: stop the task
stack scan early when interrupted")
MAX_SCAN_SIZE is also not a new maximum for a single scan_block() call.
kmemleak_scan_task_stacks() already hands it a whole task stack in one go.
On arm64 and x86_64 THREAD_SIZE is never below 16 KiB, four times
MAX_SCAN_SIZE, and it is 64 KiB on arm64 with 64K pages.
This patch (of 2):
The struct page scanning loop sits inline in __kmemleak_scan(), nested
three levels deep and sharing the caller's "stop" variable with the
zone walk around it. Move it into scan_zone_pages(), which scans one
zone and returns 1 if scanning should stop.
No functional change; this only makes room for changing how the pages
are handed to scan_block().
Link: https://lore.kernel.org/20260921-b4-kmemleak-page-scan-v1-1-fb97d4801b3a@debian.org
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
|
|
damon_set_attrs() accepts sample_interval == 0. This was reported as a
bug in v1 of this patch (rejecting it in damon_set_attrs()). A similar
patch was already declined for the same reason: a zero interval is
intentionally supported [1].
Document the behavior instead of changing it.
Link: https://lore.kernel.org/20260921151547.78472-5-sj@kernel.org
Link: https://lore.kernel.org/all/20260722094304.3132750-1-dayou5941@163.com/ [1]
Signed-off-by: Karthikeyan KS <karthiproffesional@gmail.com>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Adrian Huang <adrianhuang0701@gmail.com>
Cc: Liew Rui Yan <aethernet65535@gmail.com>
Cc: Xuewen Wang <wangxuewen@kylinos.cn>
Cc: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
|
|
Correct spelling mistakes. No functional changes.
Link: https://lore.kernel.org/20260921151547.78472-4-sj@kernel.org
Signed-off-by: Adrian Huang (Lenovo) <adrianhuang0701@gmail.com>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Karthikeyan KS <karthiproffesional@gmail.com>
Cc: Liew Rui Yan <aethernet65535@gmail.com>
Cc: Xuewen Wang <wangxuewen@kylinos.cn>
|
|
damon_sysfs_turn_damon_on() ignored the return value of damon_call() for
the repeat call control registration and always returned the stale result
of damon_start() (0 at that point). When damon_call() fails, e.g., the
kdamond is already exiting, the user still gets success from the state
file write while monitoring is not actually on.
Save and return the damon_call() result instead. No rollback of
damon_start() is needed since a failed damon_call() guarantees the context
is stopped.
Link: https://lore.kernel.org/20260921151547.78472-3-sj@kernel.org
Signed-off-by: Xuewen Wang <wangxuewen@kylinos.cn>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Adrian Huang <adrianhuang0701@gmail.com>
Cc: Karthikeyan KS <karthiproffesional@gmail.com>
Cc: Liew Rui Yan <aethernet65535@gmail.com>
Cc: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
|
|
Patch series "mm/damon: improvements in efficiency, error handling,
documents".
Four various improvements. Patch 1 from Liew Rui Yan skips unnecessary
quota setup work when relevant. Patch 2 from Xuewen Wang propagates
ignored damon_call() error to sysfs users. Patch 3 from Adrian Huang
(Lenovo) fixes typos in comments. Patch 4 from Karthikeyan KS clarifies
zero sample interval acceptance on kernel-doc comment.
This patch (of 4):
In damos_adjust_quota(), the quota could already be full.
In this situation, damos_adjust_quota() will still calculates
quota->min_score. However, this min_score will not be used in this
window, because in damon_do_apply_schemes(), damos_quota_is_full() will
always returns true, preventing the scheme from being applied to any
region.
Therefore, add a short circuit for 'esz < min_region_sz' schemes to early
return from damos_adjust_quota() before calculating min_score.
Link: https://lore.kernel.org/20260921151547.78472-1-sj@kernel.org
Link: https://lore.kernel.org/20260921151547.78472-2-sj@kernel.org
Signed-off-by: Liew Rui Yan <aethernet65535@gmail.com>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Adrian Huang <adrianhuang0701@gmail.com>
Cc: Karthikeyan KS <karthiproffesional@gmail.com>
Cc: Xuewen Wang <wangxuewen@kylinos.cn>
Cc: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
|
|
damos_test_filter_out() checks that an address range filter splits a
region at the filter boundary, and stops there. Nothing checks what
damos_apply_scheme() then charges to the quota and reports as tried.
damos_test_apply_scheme_filtered_sz() covers the two ways such a filter
trims a region: one that starts before the filter's range, and one that
starts inside it.
damos_test_apply_scheme_filter_sz_unchanged() and
damos_test_apply_scheme_quota_sz() cover the cases whose accounting must
not change: a region wholly inside a reject range, one wholly inside an
allow range, two filters trimming in a single call, a filter type that
never splits, no filter at all, a region the quota trims, and a quota
remainder too small for one region.
Link: https://lore.kernel.org/20260921152443.80132-3-sj@kernel.org
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <david@davidgow.net>
Cc: <stable@vger.kernel.org>
|
|
Patch series "mm/damon/core: fix the size charged for a filter-trimmed
region", v2.
An address range DAMOS filter that partially overlaps a monitoring region
splits it, so the scheme action reaches only one side of the boundary.
damos_apply_scheme() reads the region size before that split and never
re-reads it, so the quota charge and schemes/<S>/stats/sz_tried account
for the whole original region.
Patch 1 re-reads the size after the core filters have run. Patch 2 adds
KUnit coverage for what the function charges and reports, for the trimmed
cases and for the cases that must not change.
This patch (of 2):
An address range DAMOS filter that partially overlaps a monitoring region
splits the region at the filter boundary, so the scheme action is applied
to only one side of it. damos_apply_scheme() reads the region size once
on entry, before damos_core_filter_out() performs that split.
The quota charge and the statistics update therefore account for the
region as it was before the trim. schemes/<S>/stats/sz_tried counts
memory the filter excluded, which Documentation/mm/damon/design.rst says
is not counted as tried, and with quotas/bytes set the excluded part is
charged against the budget, throttling the scheme to a fraction of what
was configured.
User impact is that DAMOS could unexpectedly slowly run, due to
over-charged quota. DAMOS stat could also be confusing. No critical
events such as crashes or leask happen.
Re-read the region size after the core filters have run.
Link: https://lore.kernel.org/20260921152443.80132-1-sj@kernel.org
Link: https://lore.kernel.org/20260921152443.80132-2-sj@kernel.org
Fixes: ab9bda001b68 ("mm/damon/core: introduce address range type damos filter")
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <david@davidgow.net>
Cc: <stable@vger.kernel.org>
|
|
Handling the huge/shared zeropage correctly in vmf_insert_pfn_pmd() and
vmf_insert_pfn_prot() is more involved. We would need to check whether
the VMA allows it and keep the mapping read-only, similar to the checks in
vm_mixed_ok().
No in-tree user needs that support, so reject these mappings with
VM_FAULT_SIGBUS rather than complicate the code for now.
Link: https://lore.kernel.org/20260921054225.28537-1-lance.yang@linux.dev
Link: https://lore.kernel.org/all/20260917121010.60966-1-lance.yang@linux.dev/
Signed-off-by: Lance Yang <lance.yang@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Suggested-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Liam Howlett <liam@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: "Mike Rapoport (IBM)" <rppt@kernel.org>
Cc: Nico Pache (Red Hat) <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
|
|
The harness's MADV_DONTNEED thread zaps 1 to 32 pages at a time, never a
whole PMD-aligned area, and only a zap that covers a full table frees the
table itself (CONFIG_PT_RECLAIM).
Make the thread zap a whole PMD-aligned area about one iteration in 64,
and keep the fine-grained zaps as the common case. The new case frees
page tables, racing that against a collapse walking the same table.
Link: https://lore.kernel.org/20260919002451.496763-20-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Assisted-by: LLM
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: "David Hildenbrand (arm)" <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickens <hughd@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: kernel-team@meta.com
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Nico Pache (Red Hat) <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
|
|
The harness races collapse against faults, pins, fork, mremap and
MADV_DONTNEED, but nothing in it runs reclaim or compaction against the
collapse.
Add two more threads, and run every mode and occupancy limit both with and
without them:
- pageout: cycles MADV_PAGEOUT over a region of its own, faults it back
in and checks the content each round, since a page's pattern must
survive the trip through swap. Left out when the host has no swap,
because then there is no anon reclaim to drive.
- compactor: writes /proc/sys/vm/compact_memory in a loop. Compaction
isolates and migrates folios, so it competes with a collapse for the
pages it is gathering, with refcount elevations and migration entries
of its own.
Each result says whether it ran under pressure:
ok 2 stepped/strict/pressure: 5s, 88 steps, no corruption
A full run is now twelve combinations; -m picks one mode, -d shortens
each run.
Link: https://lore.kernel.org/20260919002451.496763-19-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Assisted-by: LLM
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: "David Hildenbrand (arm)" <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickens <hughd@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: kernel-team@meta.com
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Nico Pache (Red Hat) <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
|
|
The harness pins max_ptes_none to 0, so khugepaged only collapses a window
once every PTE in it is present. A window with holes takes a different
route, and never gets raced. A hole is zero-filled in the new folio
rather than copied. Which slots count as holes keeps moving under the
racing MADV_DONTNEED, right up to the moment the PMD is detached.
Run both ends of the occupancy scale for every driver mode, one after the
other. mTHP collapse supports only those two, 0 and HPAGE_PMD_NR - 1, and
coerces anything between them to 0. Each result says which end it ran:
ok 1 stepped/strict: 5s, 231 steps, no corruption
ok 2 stepped/holes: 5s, 194 steps, no corruption
Link: https://lore.kernel.org/20260919002451.496763-18-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Assisted-by: LLM
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: "David Hildenbrand (arm)" <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickens <hughd@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: kernel-team@meta.com
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Nico Pache (Red Hat) <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
|
|
Collapse serialises against faults, GUP, fork, mremap and zapping through
a protocol of locks, TLB flushes and refcount checks. No khugepaged
selftest exercises any of it under contention.
Add khugepaged_race. Six racing threads work the same address space:
- two faulters
- an MADV_DONTNEED thread
- a transient FOLL_PIN thread (gup_test)
- a forker
- an mremap thread
One of three drivers collapses under them:
stepped khugepaged, one full pass at a time via
khugepaged_full_pass(), so each step covers a known extent;
free khugepaged left to run (scan_sleep_millisecs=0), for soak;
madvise an MADV_COLLAPSE and MADV_DONTNEED loop.
Every mode runs in turn unless -m names one, five seconds each. Every
supported anon THP order is set to inherit and max_ptes_none is 0, so a
window collapses only once fully populated and the racing MADV_DONTNEED
steers selection across orders.
The rule is that a racing page reads as its pattern or as zero, never
anything else. The faulters and fork children check it throughout, and a
final sweep checks it again. The other half of the check is the kernel's
own assertions, so read dmesg too.
The pin thread goes through gup_test, so the harness skips without
CONFIG_GUP_TEST or root. The default playground is three shared PMD-sized
areas plus the mremap thread's, over two gigabytes at a 512M PMD; -a
shrinks it.
Link: https://lore.kernel.org/20260919002451.496763-17-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Assisted-by: LLM
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: "David Hildenbrand (arm)" <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickens <hughd@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: kernel-team@meta.com
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Nico Pache (Red Hat) <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
|
|
khugepaged_full_pass() drives the daemon through sysfs: a store to
scan_sleep_millisecs wakes it, and full_scans advancing by two marks one
pass that started after setup. Every mTHP collapse result in the suite
rests on that pair, and nothing checks it.
Add khugepaged_sync_check. Each step:
- prepare one aligned window
- record its source PFNs from pagemap
- run one khugepaged_full_pass() barrier
- require the window came out collapsed, with exactly one collapse
attempt attributed to it
The anon events carry no virtual address, so an attempt is matched by the
source folio PFN and order that the mm_collapse_huge_page_isolate
tracepoint reports.
Reading the trace buffer takes four small helpers in vm_util: open an
event subsystem's enable file, flip it, clear the buffer, and open it for
reading.
scan_sleep_millisecs is set to a minute, so a step that took a sleep
instead of a wake would blow the budget.
Passes 5/5 on x86-64 4K and arm64 64K.
Link: https://lore.kernel.org/20260919002451.496763-16-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Assisted-by: LLM
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: "David Hildenbrand (arm)" <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickens <hughd@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: kernel-team@meta.com
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Nico Pache (Red Hat) <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
|
|
The mTHP collapse cases only run when the caller names both the context
and an order, so a plain ./khugepaged covers the PMD contexts on anon and
nothing else. run_vmtests.sh pinned order 4 and covered no other.
Run the mTHP cases once per supported anon THP order below the PMD when -c
is absent, and pull that context into both the no-argument invocation and
"all". Also:
- -c still pins one order, and now says what is wrong instead of
printing the usage text.
- Both orders end up as array indices and shift counts, so -s and -c
are range-checked before they get there.
- The mTHP context has only anon cases, so a run that names a different
mem_type -- "all:shmem", say -- drops it again rather than refusing
to start. Naming both explicitly still refuses.
- A case carries the order it was registered at, so a result names it:
# Run test: collapse_single_mthp (mthp_khugepaged:anon, order 6)
On x86-64 with 4K pages that is orders 2 through 8, and ./khugepaged goes
from 29 results in 17 seconds to 77 in 29, so run_vmtests.sh can drop its
pinned order-4 line.
Link: https://lore.kernel.org/20260919002451.496763-15-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Tested-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Assisted-by: LLM
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Barry Song <baohua@kernel.org>
Cc: "David Hildenbrand (arm)" <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickens <hughd@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: kernel-team@meta.com
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Nico Pache (Red Hat) <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
|
|
collapse_fork() checks that a fork-shared range collapses in the child
while the parent keeps its own pages, but the parent sits still while that
happens. Nothing checks that CoW isolation survives a collapse racing
with writes to the shared source.
Add a case where the parent writes to the shared range throughout the
child's collapse. CoW has to keep the two apart: the child must see the
content from before the fork, and the parent only its own writes.
The parent unshares one page every 10ms, starting only once the child says
it is about to collapse. Writing the range in a burst would break CoW on
all of it before the collapse begins, leaving the child to collapse pages
that are already exclusive to it.
Preparation for changing how collapse handles fork-shared sources.
Link: https://lore.kernel.org/20260919002451.496763-14-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Assisted-by: LLM
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: "David Hildenbrand (arm)" <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickens <hughd@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: kernel-team@meta.com
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Nico Pache (Red Hat) <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
|
|
collapse_order_mixed_sources() faults its region as order-2 folios and
collapses them to the -c target. Order 2 is below the contpte size on
every arm64 page size, so nothing in this suite collapses a contpte-mapped
source on purpose.
Let -s name the source order alongside -c. The case then faults at that
order, keeping order 2 when -s is absent, and the source order has to be a
supported mTHP order below the target. The other mTHP cases are
unaffected: mthp_push_target_order() enables only the target order.
A -c at or below -s is refused before any case runs: the sources would
already be the size being asked for. Without the check the generic cases
fail on that one by one instead of saying why.
"-s 5 -c 7" on arm64/64K then collapses contpte-mapped sources into a
larger mTHP.
Link: https://lore.kernel.org/20260919002451.496763-13-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Tested-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Assisted-by: LLM
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Barry Song <baohua@kernel.org>
Cc: "David Hildenbrand (arm)" <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickens <hughd@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: kernel-team@meta.com
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Nico Pache (Red Hat) <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
|
|
The mthp_khugepaged context runs the generic cases at a sub-PMD order,
which answers how many folios of that order a range ends up with. It
cannot say which order-sized window they landed in, so "the populated
window collapsed" and "the empty window next to it collapsed instead" look
alike.
Add four cases that check each window on its own, with the folio-order
helpers in vm_util:
- collapse_order_single_window(): only the populated window collapses;
- collapse_order_partial_window(): the default max_ptes_none lets a window
with one present PTE collapse;
- collapse_order_max_ptes_none(): with max_ptes_none=0 a full window
collapses and one missing a page does not;
- collapse_order_mixed_sources(): sources that are already large folios of
a smaller order collapse to the target.
Each case faults its region before MADV_HUGEPAGE with only the target
order enabled, so the sources are order 0 and the result can only come
from khugepaged. They wait for a full pass rather than for the result to
appear: without a completed pass, "not collapsed" and "not scanned yet"
are the same thing.
Link: https://lore.kernel.org/20260919002451.496763-12-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Tested-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Assisted-by: LLM
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Barry Song <baohua@kernel.org>
Cc: "David Hildenbrand (arm)" <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickens <hughd@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: kernel-team@meta.com
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Nico Pache (Red Hat) <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
|
|
A khugepaged test has to tell "not collapsed" from "not scanned yet", and
nothing in the selftests can. wait_for_scan() in khugepaged.c comes
closest: it polls full_scans until the counter has advanced by two, since
the pass in progress may already have passed the test's mm. But it only
returns in time if scan_sleep_millisecs happens to be short, and it is
private to that one test.
Add khugepaged_full_pass() to hugepage_settings, built on the same
advance-by-two wait but driven through sysfs: a store to
scan_sleep_millisecs wakes the daemon, so the barrier completes whatever
the scan cadence. A store made while the daemon is scanning rather than
sleeping is lost, so the helper keeps storing until the pass lands.
One wake completes one pass only if pages_to_scan covers every mm on the
list, so callers need it large.
Settings pushes must not start passes of their own. A store to either
sleep knob wakes the daemon, so thp_write_settings() now writes a
khugepaged knob only when its value changes.
Link: https://lore.kernel.org/20260919002451.496763-11-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Assisted-by: LLM
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Barry Song <baohua@kernel.org>
Cc: "David Hildenbrand (arm)" <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickens <hughd@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: kernel-team@meta.com
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Nico Pache (Red Hat) <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
|
|
The khugepaged mTHP tests detect collapse results with the vm_util
folio-order helpers rather than smaps AnonHugePages, which only sees PMD
mappings. If those helpers are wrong, every case built on them is wrong
the same way, and nothing says so.
Check them directly. For every anon THP order the kernel supports, fault
memory in with only that order enabled. Require the helpers to classify
the backing as exactly that order: not the order below it, and base-page
memory as order 0.
Run it in the thp category, ahead of ./khugepaged, so a broken helper is
reported as itself rather than as a collapse failure. Verified on x86-64
4K (orders 0, 2-9) and arm64 64K (orders 0, 2-13).
The test needs ALIGN(), which hmm-tests.c and migration.c each defined
privately. Move it to vm_util.h and drop both copies.
Link: https://lore.kernel.org/20260919002451.496763-10-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Assisted-by: LLM
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: "David Hildenbrand (arm)" <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickens <hughd@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: kernel-team@meta.com
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Nico Pache (Red Hat) <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
|
|
An mTHP collapse test needs to know that a range is backed by folios of
the target order, and that they sit where a collapse would put them.
Nothing answers both: is_backed_by_folio() classifies the folio behind a
single page, and check_huge_anon() counts the folios of an order in a
range without saying where they start.
Add is_range_backed_by_order(). It requires every folio-sized, folio-
aligned part of the range to map one folio of that order, head to tail,
with the head at the start of the part.
A part backed by two smaller folios fails, and so does a folio mapped off
its natural alignment. The mTHP cases need both to tell a collapsed range
from the one beside it.
Link: https://lore.kernel.org/20260919002451.496763-9-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Assisted-by: LLM
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: "David Hildenbrand (arm)" <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickens <hughd@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: kernel-team@meta.com
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nico Pache (Red Hat) <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
|
|
Checking that an address range is backed by a folio of a given order is
useful to any test that builds or collapses large folios. mTHP collapse
coverage in the khugepaged selftest needs exactly that.
split_huge_page_test.c already has the building block:
is_backed_by_folio() reads the compound head and tail flags from
/proc/kpageflags to classify the folio behind a page.
Move it into vm_util so other tests can use it. No functional change.
Link: https://lore.kernel.org/20260919002451.496763-8-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Assisted-by: LLM
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Barry Song <baohua@kernel.org>
Cc: "David Hildenbrand (arm)" <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickens <hughd@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: kernel-team@meta.com
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nico Pache (Red Hat) <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: "Vlastimil Babka (SUSE)" <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
|
