[PATCH 0/2] mm/damon: add kunit tests for probe_hits handling and probe params validation

[PATCH 0/2] mm/damon: add kunit tests for probe_hits handling and probe params validation

[Jason Angelov]

DAMON recently introduced probes and probe weights. Add kunit tests
for the propagation of probe_hits at region split and merge, and the
rejection of invalid probe parameters by damon_valid_probe_params().

Jason Angelov (2):
  mm/damon/core-kunit: test probe_hits handling at region split and
    merge
  mm/damon/core-kunit: test damon_valid_probe_params()

 mm/damon/tests/core-kunit.h | 64 +++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)


base-commit: 4b65683fd25fe596b5b5947d934bb176413d077b
-- 
2.43.0

[PATCH 1/2] mm/damon/core-kunit: test probe_hits handling at region split and merge

[Jason Angelov]

damon_split_region_at() copies probe_hits[] and last_probe_hits[] to
the new split region.
damon_merge_two_regions() sets probe_hits[] to the size-weighted
average of the merged regions.

Extend damon_test_split_at() and damon_test_merge_two() tests to
cover those fields.

Signed-off-by: Jason Angelov <jasonangelov@ucla.edu>
---
 mm/damon/tests/core-kunit.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
index 4a536d41cdb2..2db94d49c9ba 100644
--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -152,6 +152,8 @@ static void damon_test_split_at(struct kunit *test)
 	}
 	r->nr_accesses = 42;
 	r->last_nr_accesses = 15;
+	r->probe_hits[0] = 7;
+	r->last_probe_hits[0] = 3;
 	r->age = 10;
 	damon_add_region(r, t);
 	damon_split_region_at(t, r, 25);
@@ -168,6 +170,8 @@ static void damon_test_split_at(struct kunit *test)
 
 	KUNIT_EXPECT_EQ(test, r->nr_accesses, r_new->nr_accesses);
 	KUNIT_EXPECT_EQ(test, r->last_nr_accesses, r_new->last_nr_accesses);
+	KUNIT_EXPECT_EQ(test, r->probe_hits[0], r_new->probe_hits[0]);
+	KUNIT_EXPECT_EQ(test, r->last_probe_hits[0], r_new->last_probe_hits[0]);
 	KUNIT_EXPECT_EQ(test, r->age, r_new->age);
 
 out:
@@ -189,6 +193,7 @@ static void damon_test_merge_two(struct kunit *test)
 		kunit_skip(test, "region alloc fail");
 	}
 	r->nr_accesses = 10;
+	r->probe_hits[0] = 6;
 	r->age = 9;
 	damon_add_region(r, t);
 	r2 = damon_new_region(100, 300);
@@ -197,6 +202,7 @@ static void damon_test_merge_two(struct kunit *test)
 		kunit_skip(test, "second region alloc fail");
 	}
 	r2->nr_accesses = 20;
+	r2->probe_hits[0] = 14;
 	r2->age = 21;
 	damon_add_region(r2, t);
 
@@ -204,6 +210,7 @@ static void damon_test_merge_two(struct kunit *test)
 	KUNIT_EXPECT_EQ(test, r->ar.start, 0ul);
 	KUNIT_EXPECT_EQ(test, r->ar.end, 300ul);
 	KUNIT_EXPECT_EQ(test, r->nr_accesses, 16u);
+	KUNIT_EXPECT_EQ(test, r->probe_hits[0], 11);
 	KUNIT_EXPECT_EQ(test, r->age, 17u);
 
 	i = 0;
-- 
2.43.0

[PATCH 2/2] mm/damon/core-kunit: test damon_valid_probe_params()

[Jason Angelov]

damon_valid_probe_params() makes damon_commit_ctx() reject probe
configurations that could overflow a probe_hits counter, a single
(weight * probe_hits) product, or the sum of those products.

Add a kunit test covering each rejection at its boundary:

- samples per aggregation interval: U8_MAX is allowed, one more could
  overflow a probe_hits counter
- single weight: the largest whose product fits in unsigned int is
  allowed, one larger is rejected
- multiple probes: each product fits, but their sum overflows
- no weight set: the validation is skipped

Signed-off-by: Jason Angelov <jasonangelov@ucla.edu>
---
 mm/damon/tests/core-kunit.h | 57 +++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
index 2db94d49c9ba..b1ca4c8e03f0 100644
--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -1338,6 +1338,62 @@ static void damon_test_commit_ctx(struct kunit *test)
 	damon_destroy_ctx(dst);
 }
 
+static void damon_test_valid_probe_params(struct kunit *test)
+{
+	struct damon_ctx *ctx;
+	struct damon_probe *probe, *probe2;
+
+	ctx = damon_new_ctx();
+	if (!ctx)
+		kunit_skip(test, "ctx alloc fail");
+	probe = damon_new_probe();
+	if (!probe) {
+		damon_destroy_ctx(ctx);
+		kunit_skip(test, "probe alloc fail");
+	}
+	damon_add_probe(ctx, probe);
+
+	/* Parameters are validated only if any probe weight is set. */
+	ctx->attrs.sample_interval = 1;
+	ctx->attrs.aggr_interval = 1000000;
+	KUNIT_EXPECT_TRUE(test, damon_valid_probe_params(ctx));
+
+	/* Up to U8_MAX samples per aggregation interval are allowed. */
+	probe->weight = 100;
+	ctx->attrs.aggr_interval = 255;
+	KUNIT_EXPECT_TRUE(test, damon_valid_probe_params(ctx));
+
+	/* More samples could overflow the probe_hits counters. */
+	ctx->attrs.aggr_interval = 256;
+	KUNIT_EXPECT_FALSE(test, damon_valid_probe_params(ctx));
+
+	/* The largest weight whose weighted hit count fits in unsigned int. */
+	ctx->attrs.aggr_interval = 255;
+	probe->weight = UINT_MAX / 255;
+	KUNIT_EXPECT_TRUE(test, damon_valid_probe_params(ctx));
+
+	/* Any larger weight could overflow its weighted hit count. */
+	probe->weight = UINT_MAX / 255 + 1;
+	KUNIT_EXPECT_FALSE(test, damon_valid_probe_params(ctx));
+
+	/* With one sample per aggregation, even the largest weight fits. */
+	ctx->attrs.aggr_interval = 1;
+	probe->weight = UINT_MAX;
+	KUNIT_EXPECT_TRUE(test, damon_valid_probe_params(ctx));
+
+	/* The sum of all probes' weighted hit counts could also overflow. */
+	probe2 = damon_new_probe();
+	if (!probe2) {
+		damon_destroy_ctx(ctx);
+		kunit_skip(test, "probe2 alloc fail");
+	}
+	probe2->weight = 1;
+	damon_add_probe(ctx, probe2);
+	KUNIT_EXPECT_FALSE(test, damon_valid_probe_params(ctx));
+
+	damon_destroy_ctx(ctx);
+}
+
 static void damos_test_filter_out(struct kunit *test)
 {
 	struct damon_target *t;
@@ -1664,6 +1720,7 @@ static struct kunit_case damon_test_cases[] = {
 	KUNIT_CASE(damos_test_commit_migrate_hot),
 	KUNIT_CASE(damon_test_commit_target_regions),
 	KUNIT_CASE(damon_test_commit_ctx),
+	KUNIT_CASE(damon_test_valid_probe_params),
 	KUNIT_CASE(damos_test_filter_out),
 	KUNIT_CASE(damon_test_feed_loop_next_input),
 	KUNIT_CASE(damon_test_set_filters_default_reject),
-- 
2.43.0

Re: [PATCH 2/2] mm/damon/core-kunit: test damon_valid_probe_params()

[sashiko-bot]

> damon_valid_probe_params() makes damon_commit_ctx() reject probe
> configurations that could overflow a probe_hits counter, a single
> (weight * probe_hits) product, or the sum of those products.
> 
> Add a kunit test covering each rejection at its boundary:
> 
> - samples per aggregation interval: U8_MAX is allowed, one more could
>   overflow a probe_hits counter
> - single weight: the largest whose product fits in unsigned int is
>   allowed, one larger is rejected
> - multiple probes: each product fits, but their sum overflows
> - no weight set: the validation is skipped
> 
> Signed-off-by: Jason Angelov <jasonangelov@ucla.edu>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260818034552.11975-1-jasonangelov@ucla.edu?part=2

Re: [PATCH 1/2] mm/damon/core-kunit: test probe_hits handling at region split and merge

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but there is an integer overflow in damon_merge_two_regions() when calculating size-weighted averages on 32-bit architectures.
--

--- Patch [1]: [PATCH 1/2] mm/damon/core-kunit: test probe_hits handling at region split and merge ---
commit f275f8ec2d833d0e2eacc7a18ba7c56b04b7e599
Author: Jason Angelov <jasonangelov@ucla.edu>

mm/damon/core-kunit: test probe_hits handling at region split and merge

Extend damon_test_split_at() and damon_test_merge_two() tests to cover
handling of probe_hits and last_probe_hits arrays.

> diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
> index 4a536d41cdb2d..2db94d49c9bae 100644
> --- a/mm/damon/tests/core-kunit.h
> +++ b/mm/damon/tests/core-kunit.h
[ ... ]
> @@ -204,6 +210,7 @@ static void damon_test_merge_two(struct kunit *test)
>  	KUNIT_EXPECT_EQ(test, r->ar.start, 0ul);
>  	KUNIT_EXPECT_EQ(test, r->ar.end, 300ul);
>  	KUNIT_EXPECT_EQ(test, r->nr_accesses, 16u);
> +	KUNIT_EXPECT_EQ(test, r->probe_hits[0], 11);

[Severity: High]
This is a pre-existing issue, but does the size-weighted average logic
tested here overflow on 32-bit architectures?

Looking at mm/damon/core.c:damon_merge_two_regions(), the calculations
multiply values like nr_accesses and probe_hits by the region size in bytes:

mm/damon/core.c:damon_merge_two_regions() {
	...
	l->nr_accesses = (l->nr_accesses * sz_l + r->nr_accesses * sz_r) /
			(sz_l + sz_r);
	...
	for (i = 0; i < DAMON_MAX_PROBES; i++)
		l->probe_hits[i] = (l->probe_hits[i] * sz_l + r->probe_hits[i]
				* sz_r) / (sz_l + sz_r);
	...
}

On a 32-bit architecture, unsigned long is 32 bits (max ~4.29GB). If a
region is just 17MB and probe_hits is 255, the multiplication 
255 * 17,000,000 evaluates to ~4.33GB, which would silently truncate.

Could this wrap-around cause merged regions to inherit drastically incorrect
statistics, potentially misidentifying hot memory as cold and triggering
aggressive paging out of actively used pages?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260818034552.11975-1-jasonangelov@ucla.edu?part=1

Re: [PATCH 1/2] mm/damon/core-kunit: test probe_hits handling at region split and merge

[SJ Park]

On Tue, 18 Aug 2026 03:57:42 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] This problem wasn't introduced by this patch, but there is an integer overflow in damon_merge_two_regions() when calculating size-weighted averages on 32-bit architectures.
> --
> 
> --- Patch [1]: [PATCH 1/2] mm/damon/core-kunit: test probe_hits handling at region split and merge ---
> commit f275f8ec2d833d0e2eacc7a18ba7c56b04b7e599
> Author: Jason Angelov <jasonangelov@ucla.edu>
> 
> mm/damon/core-kunit: test probe_hits handling at region split and merge
> 
> Extend damon_test_split_at() and damon_test_merge_two() tests to cover
> handling of probe_hits and last_probe_hits arrays.
> 
> > diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
> > index 4a536d41cdb2d..2db94d49c9bae 100644
> > --- a/mm/damon/tests/core-kunit.h
> > +++ b/mm/damon/tests/core-kunit.h
> [ ... ]
> > @@ -204,6 +210,7 @@ static void damon_test_merge_two(struct kunit *test)
> >  	KUNIT_EXPECT_EQ(test, r->ar.start, 0ul);
> >  	KUNIT_EXPECT_EQ(test, r->ar.end, 300ul);
> >  	KUNIT_EXPECT_EQ(test, r->nr_accesses, 16u);
> > +	KUNIT_EXPECT_EQ(test, r->probe_hits[0], 11);
> 
> [Severity: High]
> This is a pre-existing issue, but does the size-weighted average logic
> tested here overflow on 32-bit architectures?
> 
> Looking at mm/damon/core.c:damon_merge_two_regions(), the calculations
> multiply values like nr_accesses and probe_hits by the region size in bytes:
> 
> mm/damon/core.c:damon_merge_two_regions() {
> 	...
> 	l->nr_accesses = (l->nr_accesses * sz_l + r->nr_accesses * sz_r) /
> 			(sz_l + sz_r);
> 	...
> 	for (i = 0; i < DAMON_MAX_PROBES; i++)
> 		l->probe_hits[i] = (l->probe_hits[i] * sz_l + r->probe_hits[i]
> 				* sz_r) / (sz_l + sz_r);
> 	...
> }
> 
> On a 32-bit architecture, unsigned long is 32 bits (max ~4.29GB). If a
> region is just 17MB and probe_hits is 255, the multiplication 
> 255 * 17,000,000 evaluates to ~4.33GB, which would silently truncate.
> 
> Could this wrap-around cause merged regions to inherit drastically incorrect
> statistics, potentially misidentifying hot memory as cold and triggering
> aggressive paging out of actively used pages?

Known low priority issue.  Users could use addr_unit to workaround this.

> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260818034552.11975-1-jasonangelov@ucla.edu?part=1


Thanks,
SJ

Re: [PATCH 1/2] mm/damon/core-kunit: test probe_hits handling at region split and merge

[SJ Park]

On Tue, 18 Aug 2026 03:45:51 +0000 Jason Angelov <jasonangelov@ucla.edu> wrote:

> damon_split_region_at() copies probe_hits[] and last_probe_hits[] to
> the new split region.
> damon_merge_two_regions() sets probe_hits[] to the size-weighted
> average of the merged regions.
> 
> Extend damon_test_split_at() and damon_test_merge_two() tests to
> cover those fields.

Thank you for adding these tests!

> 
> Signed-off-by: Jason Angelov <jasonangelov@ucla.edu>

Reviewed-by: SJ Park <sj@kernel.org>


Thanks,
SJ

[...]

Re: [PATCH 2/2] mm/damon/core-kunit: test damon_valid_probe_params()

[SJ Park]

On Tue, 18 Aug 2026 03:45:52 +0000 Jason Angelov <jasonangelov@ucla.edu> wrote:

> damon_valid_probe_params() makes damon_commit_ctx() reject probe
> configurations that could overflow a probe_hits counter, a single
> (weight * probe_hits) product, or the sum of those products.
> 
> Add a kunit test covering each rejection at its boundary:
> 
> - samples per aggregation interval: U8_MAX is allowed, one more could
>   overflow a probe_hits counter
> - single weight: the largest whose product fits in unsigned int is
>   allowed, one larger is rejected
> - multiple probes: each product fits, but their sum overflows
> - no weight set: the validation is skipped

Thank you for adding these tests.

> 
> Signed-off-by: Jason Angelov <jasonangelov@ucla.edu>

Reviewed-by: SJ Park <sj@kernel.org>


Thanks,
SJ

[...]

Re: [PATCH 0/2] mm/damon: add kunit tests for probe_hits handling and probe params validation

[SJ Park]

On Tue, 18 Aug 2026 03:45:50 +0000 Jason Angelov <jasonangelov@ucla.edu> wrote:

> DAMON recently introduced probes and probe weights. Add kunit tests
> for the propagation of probe_hits at region split and merge, and the
> rejection of invalid probe parameters by damon_valid_probe_params().

Thank you for this patch, Jason.  All patches look good to me.

I applied this series to damon/next [1] tree.  If this patch is not added to
mm.git in short term (a few weeks), I will ask mm.git maintainer (Andrew
Morton) to pick this.  So, no action from your side is needed for now.

Note that we are in the middle of the merge window for 7.3-rc1.  Andrew may be
too busy to pick this until the end of the merge window.  I will make the
action only after the end of the merge window.

If it seems I also forgot doing that or you cannot wait for my action, please
feel free to directly ask that to Andrew.

[1] https://origin.kernel.org/doc/html/latest/mm/damon/maintainer-profile.html#scm-trees


Thanks,
SJ

[...]