* Re: [PATCH] tracing: Fix NULL pointer dereference in func_set_flag()
From: Steven Rostedt @ 2026-07-07 15:14 UTC (permalink / raw)
To: Yuanhe Shu
Cc: Masami Hiramatsu, Mathieu Desnoyers, linux-kernel,
linux-trace-kernel, sashiko-bot@kernel.org,
sashiko-reviews@lists.linux.dev
In-Reply-To: <20260624061715.1445655-1-xiangzao@linux.alibaba.com>
From: https://sashiko.dev/#/patchset/20260624061715.1445655-1-xiangzao%40linux.alibaba.com
> commit 2140381622b995438751cdb59eb4bae6923f6a60
> Author: Yuanhe Shu <xiangzao@linux.alibaba.com>
> tracing: Fix NULL pointer dereference in func_set_flag()
> This commit fixes a NULL pointer dereference in func_set_flag() by
> moving the tracer type check before dereferencing tr->current_trace_flags.
> > diff --git a/kernel/trace/trace_functions.c b/kernel/trace/trace_functions.c
> > index f283391a4dc80..cd37f20137581 100644
> > --- a/kernel/trace/trace_functions.c
> > +++ b/kernel/trace/trace_functions.c
> > @@ -458,12 +458,12 @@ func_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
> > ftrace_func_t func;
> > u32 new_flags;
> >
> > - /* Do nothing if already set. */
> > - if (!!set == !!(tr->current_trace_flags->val & bit))
> > + /* We can change this flag only when current tracer is function. */
> > + if (tr->current_trace != &function_trace)
> > return 0;
> >
> > - /* We can change this flag only when not running. */
> > - if (tr->current_trace != &function_trace)
> > + /* Do nothing if already set. */
> > + if (!!set == !!(tr->current_trace_flags->val & bit))
> > return 0;
>
> This isn't a bug introduced by this patch, but while reviewing this fix for
> tr->current_trace_flags, I noticed a similar NULL pointer dereference
> can occur in print_graph_function() in kernel/trace/trace_functions_graph.c.
> If a user enables the function_graph tracer, populating the ring buffer
> with graph events, and then switches to a tracer that lacks flags and
> does not automatically clear the ring buffer (such as hwlat, osnoise, or
> timerlat), tr->current_trace_flags becomes NULL.
> When the user subsequently reads the trace buffer, the fallback event handler
> calls print_graph_function(), which unconditionally dereferences
> tr->current_trace_flags:
>
> kernel/trace/trace_functions_graph.c:print_graph_function() {
> struct trace_array *tr = iter->tr;
> return print_graph_function_flags(iter, tr->current_trace_flags->val);
> }
>
> Does this unconditional dereference of tr->current_trace_flags->val also
> need a similar safety check to prevent a kernel crash?
No, because even though hwlat, osnoise and timerlat may not clear the main
ring buffer, it reads it differently. Thus the print_graph_function will
not be called.
Unless you can figure out a way to get to that function with one of those
other tracers?
-- Steve
^ permalink raw reply
* Re: [PATCH v2 4/4] mm/mlock: migrate folios out of CMA when mlocking a range
From: Lorenzo Stoakes @ 2026-07-07 14:57 UTC (permalink / raw)
To: Wandun
Cc: vbabka, david, rostedt, mhiramat, Alexander.Krabler, hughd, fvdl,
bigeasy, linux-mm, linux-kernel, linux-trace-kernel,
linux-rt-devel, akpm, surenb, mhocko, jackmanb, hannes, ziy, riel,
liam, harry, jannh, lance.yang, mathieu.desnoyers, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, apopple,
pfalcato
In-Reply-To: <bd88f65e-000b-4dde-92f7-28af6a34e977@gmail.com>
On Tue, Jul 07, 2026 at 09:36:17PM +0800, Wandun wrote:
<snip>
> > diff --git a/mm/mlock.c b/mm/mlock.c
> > index ac65de40b22b..f56c685533f5 100644
> > --- a/mm/mlock.c
> > +++ b/mm/mlock.c
<snip>
> > +static int mlock_collect_migratable_pte_range(pmd_t *pmd, unsigned long addr,
> > + unsigned long end, struct mm_walk *walk)
> > +{
> > + struct vm_area_struct *vma = walk->vma;
> > + struct list_head *folio_list = walk->private;
> > + spinlock_t *ptl;
> > + pte_t *start_pte, *pte;
> > + pte_t ptent;
> > + struct folio *folio;
> > + unsigned int step = 1;
> > +
> > + if (!(vma->vm_flags & VM_LOCKED))
> > + return 0;
> > +
> > + ptl = pmd_trans_huge_lock(pmd, vma);
> > + if (ptl) {
> > + if (!pmd_present(*pmd)) {
> > + if (unlikely(softleaf_is_migration(softleaf_from_pmd(*pmd)))) {
> > + spin_unlock(ptl);
> > + pmd_migration_entry_wait(vma->vm_mm, pmd);
> > + walk->action = ACTION_AGAIN;
> > + return 0;
> > + }
> > + goto out;
> > + }
> > + if (is_huge_zero_pmd(*pmd))
> > + goto out;
> > + folio = pmd_folio(*pmd);
> > + if (folio_is_zone_device(folio))
> > + goto out;
> > + if (is_migrate_cma_page(&folio->page))
> > + isolate_folio_to_list(folio, folio_list);
> > + goto out;
> > + }
> > +
> > + start_pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
> > + if (!start_pte) {
> > + walk->action = ACTION_AGAIN;
> > + return 0;
> > + }
> > +
> > + for (pte = start_pte; addr != end; pte += step, addr += step * PAGE_SIZE) {
> > + step = 1;
> > + ptent = ptep_get(pte);
> > + if (!pte_present(ptent)) {
> > + if (unlikely(softleaf_is_migration(softleaf_from_pte(ptent)))) {
> > + pte_unmap_unlock(start_pte, ptl);
> > + migration_entry_wait(vma->vm_mm, pmd, addr);
> > + walk->action = ACTION_AGAIN;
> > + return 0;
> > + }
> > + continue;
> > + }
> > + folio = vm_normal_folio(vma, addr, ptent);
> > + if (!folio || folio_is_zone_device(folio))
> > + continue;
> > + step = folio_mlock_step(folio, pte, addr, end);
> > + if (is_migrate_cma_page(&folio->page))
> Here should be, sorry about this.
> if (!is_migrate_cma_page(&folio->page))
> continue;
But above you do the:
if (is_migrate_cma_page(&folio->page))
isolate_folio_to_list(folio, folio_list);
Pattern :) so these should be consistent. But you're copy/pasting and need to
not do that so it's kind of by the by.
Anyway, yes I assumed you meant this. But see the main review, I am not really a
fan of the implementation, overall.
>
> Best regards
> Wandun
Thanks, Lorenzo
^ permalink raw reply
* Re: [PATCH v2 4/4] mm/mlock: migrate folios out of CMA when mlocking a range
From: Lorenzo Stoakes @ 2026-07-07 14:54 UTC (permalink / raw)
To: Wandun Chen
Cc: vbabka, david, rostedt, mhiramat, Alexander.Krabler, hughd, fvdl,
bigeasy, linux-mm, linux-kernel, linux-trace-kernel,
linux-rt-devel, akpm, surenb, mhocko, jackmanb, hannes, ziy, riel,
liam, harry, jannh, lance.yang, mathieu.desnoyers, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, apopple,
pfalcato
In-Reply-To: <20260707125925.3725177-5-chenwandun1@gmail.com>
On Tue, Jul 07, 2026 at 08:59:25PM +0800, Wandun Chen wrote:
> From: Wandun Chen <chenwandun@lixiang.com>
>
> The region covered by mlock[all] may contain CMA pages. cma_alloc installs
> migration entries in the page table, if a memory access occurs at this
> point, it must wait for the migration to complete, which may cause
> latency spikes on the RT kernels.
>
> Try to move the migration cost into the mlock[all] caller, which is
> typically a setup path. So reduce the chance of latency spikes on RT
> kernels by migrating the currently mapped CMA pages out of CMA region.
'reduce the chances of latency' so do you have any data to back this invasive
change or not?
And for RT, but nothing in here at all checks for RT? You're using this
compaction sysctl as an RT check somehow? That's gross.
This doesn't feel like the right solution.
>
> Suggested-by: Frank van der Linden <fvdl@google.com>
> Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
> Link: https://lore.kernel.org/all/CAPTztWZpnX1j8-7yeppVUsxE=O9hbVeqricDjZt8_pnN7a-kBQ@mail.gmail.com/#t
> ---
> mm/mlock.c | 119 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
> 1 file changed, 118 insertions(+), 1 deletion(-)
>
> diff --git a/mm/mlock.c b/mm/mlock.c
> index ac65de40b22b..f56c685533f5 100644
> --- a/mm/mlock.c
> +++ b/mm/mlock.c
> @@ -25,6 +25,7 @@
> #include <linux/memcontrol.h>
> #include <linux/mm_inline.h>
> #include <linux/secretmem.h>
> +#include <linux/migrate.h>
> #include <linux/compaction.h>
>
> #include "internal.h"
> @@ -428,6 +429,119 @@ static int mlock_pte_range(pmd_t *pmd, unsigned long addr,
> return 0;
> }
>
> +#ifdef CONFIG_CMA
Ugh yuck. This is horrible. Why are we polluting mlock.c with CMA stuff?
Also no comment?
> +static int mlock_collect_migratable_pte_range(pmd_t *pmd, unsigned long addr,
> + unsigned long end, struct mm_walk *walk)
> +{
You've literally copy/pasted mlock_pte_range(), this is disgusting.
Please don't copy/paste code like this, this isn't PHP, it's the kernel, it's
completely unacceptable.
> + struct vm_area_struct *vma = walk->vma;
> + struct list_head *folio_list = walk->private;
> + spinlock_t *ptl;
> + pte_t *start_pte, *pte;
> + pte_t ptent;
> + struct folio *folio;
> + unsigned int step = 1;
> +
> + if (!(vma->vm_flags & VM_LOCKED))
Once again vma_test(vma, VMA_LOCKED_BIT) please.
But also, again (since you copy/pasted), why? You're literally mlocking here...
You going for that 'mlocking already mlocked ranges' sweet spot or am I missing
something?
> + return 0;
> +
> + ptl = pmd_trans_huge_lock(pmd, vma);
> + if (ptl) {
> + if (!pmd_present(*pmd)) {
> + if (unlikely(softleaf_is_migration(softleaf_from_pmd(*pmd)))) {
OK so you're not actually checking for CMA here at all, you're just doing the
migration wait stuff... again here? What?
> + spin_unlock(ptl);
> + pmd_migration_entry_wait(vma->vm_mm, pmd);
> + walk->action = ACTION_AGAIN;
> + return 0;
> + }
> + goto out;
> + }
> + if (is_huge_zero_pmd(*pmd))
> + goto out;
> + folio = pmd_folio(*pmd);
> + if (folio_is_zone_device(folio))
> + goto out;
> + if (is_migrate_cma_page(&folio->page))
Err isn't this per-page, and you just checked that this is a huge folio, and
you're only checking the first page? That seems wrong?
> + isolate_folio_to_list(folio, folio_list);
Then you just take the whole folio?
It's really horrible that you're burying this in copy/pasted code from the rest.
> + goto out;
> + }
> +
> + start_pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
> + if (!start_pte) {
> + walk->action = ACTION_AGAIN;
> + return 0;
> + }
> +
> + for (pte = start_pte; addr != end; pte += step, addr += step * PAGE_SIZE) {
> + step = 1;
> + ptent = ptep_get(pte);
> + if (!pte_present(ptent)) {
> + if (unlikely(softleaf_is_migration(softleaf_from_pte(ptent)))) {
> + pte_unmap_unlock(start_pte, ptl);
> + migration_entry_wait(vma->vm_mm, pmd, addr);
BTW I also wonder if we have guaranteed forward progress here if say a migration
happened to migrate back and forth again across a range...?
> + walk->action = ACTION_AGAIN;
> + return 0;
> + }
Again, since you copy/pasted, same comment - this is disgusting.
And again I'm confused why you're waiting here again after you did it previously
due to the previous commit that already does it?
And why for a non-CMA range, if somebody happens to set CONFIG_CMA they now get
this done twice?
> + continue;
> + }
> + folio = vm_normal_folio(vma, addr, ptent);
> + if (!folio || folio_is_zone_device(folio))
> + continue;
> + step = folio_mlock_step(folio, pte, addr, end);
> + if (is_migrate_cma_page(&folio->page))
> + continue;
You mean ! surely?
Why are you inverting this vs. the above? you replied to the patch so maybe you
correct this there.
> + isolate_folio_to_list(folio, folio_list);
And again you bury the actual point of this in one easily missed line and zero
comments.
No.
> + }
> + pte_unmap(start_pte);
> +out:
> + spin_unlock(ptl);
> + cond_resched();
> + return 0;
> +}
Yeah this is just completely unacceptable. You have to find a way to deduplicate
code. Copy/paste code dumps are not ok.
But at the same time, you're dumping CMA crap in core mm mlock code which is
horrible, you've also dumped some migration code so you're really mixing things
up here horribly, and it doesn't seem justified?
> +
> +static const struct mm_walk_ops mlock_collect_migratable_ops = {
> + .pmd_entry = mlock_collect_migratable_pte_range,
> + .walk_lock = PGWALK_RDLOCK,
> +};
> +
> +static void mlock_migrate_cma_range(unsigned long start, unsigned long len)
> +{
> + struct mm_struct *mm = current->mm;
> + unsigned long end = start + len;
> + LIST_HEAD(folio_list);
> + struct migration_target_control mtc = {
> + .nid = NUMA_NO_NODE,
> + .gfp_mask = GFP_HIGHUSER | __GFP_NOWARN,
> + .reason = MR_SYSCALL,
> + };
> +
> + if (compaction_allow_unevictable())
> + return;
Again you're assuming compaction for some reason. Why?
It feels like you're just gating specific behaviour for your workload on this
flag and assuming that's ok.
> +
> + lru_cache_disable();
What, why?
> +
> + if (mmap_read_lock_killable(mm))
> + goto out;
OK so you got a fatal signal and you don't bother telling anybody about it and
just skip migration?...
> +
Weird whitespace...
> + walk_page_range(mm, start, end, &mlock_collect_migratable_ops,
> + &folio_list);
> + mmap_read_unlock(mm);
> +
> + if (list_empty(&folio_list))
> + goto out;
> +
> + if (migrate_pages(&folio_list, alloc_migration_target, NULL,
> + (unsigned long)&mtc, MIGRATE_SYNC, MR_SYSCALL, NULL))
> + putback_movable_pages(&folio_list);
> +out:
> + lru_cache_enable();
> +}
> +#else
> +static inline void mlock_migrate_cma_range(unsigned long start,
inline in a .c file? Why? Drop it.
> + unsigned long len)
> +{
> +}
> +#endif /* CONFIG_CMA */
> +
> /*
> * mlock_vma_pages_range() - mlock any pages already in the range,
> * or munlock all pages in the range.
> @@ -678,6 +792,7 @@ static __must_check int do_mlock(unsigned long start, size_t len, vm_flags_t fla
> error = __mm_populate(start, len, 0);
> if (error)
> return __mlock_posix_error_return(error);
> + mlock_migrate_cma_range(start, len);
Err, unconditionally?
> return 0;
> }
>
> @@ -790,8 +905,10 @@ SYSCALL_DEFINE1(mlockall, int, flags)
> capable(CAP_IPC_LOCK))
> ret = apply_mlockall_flags(flags);
> mmap_write_unlock(current->mm);
> - if (!ret && (flags & MCL_CURRENT))
> + if (!ret && (flags & MCL_CURRENT)) {
> mm_populate(0, TASK_SIZE);
> + mlock_migrate_cma_range(0, TASK_SIZE);
Err what? Why are you doing this? You're forcing a wait on migration of
literally everything across the whole of the process whether or not they're CMA
ranges, but as a one time thing?
> + }
>
> return ret;
> }
> --
> 2.43.0
>
In general this feels like the wrong solution for a specific workload that
sticks horrible stuff in core mm and I don't really love it :)
Thanks, Lorenzo
^ permalink raw reply
* Re: [PATCH 02/30] mm: add kdoc comments for vma_start/last_pgoff()
From: David Hildenbrand (Arm) @ 2026-07-07 14:46 UTC (permalink / raw)
To: Lorenzo Stoakes, Andrew Morton
Cc: Russell King, Dinh Nguyen, Simon Schuster,
James E . J . Bottomley, Helge Deller, Jarkko Sakkinen,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
Ian Abbott, H Hartley Sweeten, Lucas Stach, David Airlie,
Simona Vetter, Patrik Jakobsson, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, Rob Clark, Dmitry Baryshkov, Tomi Valkeinen,
Thierry Reding, Mikko Perttunen, Jonathan Hunter,
Christian Koenig, Huang Rui, Ankit Agrawal, Alex Williamson,
Alexander Viro, Christian Brauner, Dan Williams, Muchun Song,
Oscar Salvador, Suren Baghdasaryan, Liam R . Howlett,
Matthew Wilcox, Marek Szyprowski, Peter Zijlstra,
Arnaldo Carvalho de Melo, Namhyung Kim, Masami Hiramatsu,
Oleg Nesterov, Steven Rostedt, SeongJae Park, Miaohe Lin,
Hugh Dickins, Mike Rapoport, Kees Cook, Paolo Bonzini,
linux-kernel, linux-arm-kernel, linux-parisc, linux-sgx, etnaviv,
dri-devel, linux-arm-msm, freedreno, linux-tegra, kvm,
linux-fsdevel, nvdimm, linux-mm, iommu, linux-perf-users,
linux-trace-kernel, kasan-dev, damon, Pedro Falcato, Rik van Riel,
Harry Yoo, Jann Horn
In-Reply-To: <8c618dfd7de419e3b797b8bd1cd921d4c5b8878b.1782735110.git.ljs@kernel.org>
On 6/29/26 14:23, Lorenzo Stoakes wrote:
> Describe what vma_start_pgoff() and vma_last_pgoff() actually provide in
> detail.
>
> This is in order that we can differentiate this between functions that will
> be added in a subsequent patch which provide a different page offset.
>
> No functional change intended.
>
> Signed-off-by: Lorenzo Stoakes <ljs@kernel.org>
> ---
> include/linux/mm.h | 26 ++++++++++++++++++++++++++
> 1 file changed, 26 insertions(+)
>
> diff --git a/include/linux/mm.h b/include/linux/mm.h
> index 059144435729..2f00c75e66bd 100644
> --- a/include/linux/mm.h
> +++ b/include/linux/mm.h
> @@ -4278,11 +4278,37 @@ static inline unsigned long vma_pages(const struct vm_area_struct *vma)
> return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
> }
>
> +/**
> + * vma_start_pgoff() - Get the page offset of the start of @vma
> + * @vma: The VMA whose page offset is required.
> + *
> + * If the VMA is file-backed, this is the page offset into the file.
> + *
> + * If the VMA is anonymous, this is the virtual page offset of the start of the
> + * VMA - if unfaulted, then vma->vm_start >> PAGE_SHIFT, if faulted then the
> + * virtual page offset at the time of first fault.
> + *
> + * Note that if @vma is a MAP_PRIVATE file-backed mapping, then this returns the
> + * file offset.
There is the ugly case of @vma being a MAP_PRIVATE PFNMAP mapping, where it
returns something different.
(remap_pfn_range_prepare_vma() -> vma->vm_pgoff set to PFN)
--
Cheers,
David
^ permalink raw reply
* Re: [PATCH] tracing/user_events: fix use-after-free of enabler in user_event_mm_dup()
From: Michael Bommarito @ 2026-07-07 14:43 UTC (permalink / raw)
To: Steven Rostedt
Cc: Beau Belgrave, XIAO WU, Masami Hiramatsu, Mathieu Desnoyers,
linux-trace-kernel, linux-kernel, stable
In-Reply-To: <20260707104205.582db193@gandalf.local.home>
> Ah, you're going to send a new version. I'll drop the one I pulled then.
Saw your pull for-linus and I was just about to send a separate patch
set for the second UAF with a ktest (as 2/2). I can do either way,
just let me know which is easier
^ permalink raw reply
* Re: [PATCH] tracing/user_events: fix use-after-free of enabler in user_event_mm_dup()
From: Steven Rostedt @ 2026-07-07 14:42 UTC (permalink / raw)
To: Michael Bommarito
Cc: Beau Belgrave, XIAO WU, Masami Hiramatsu, Mathieu Desnoyers,
linux-trace-kernel, linux-kernel, stable
In-Reply-To: <CAJJ9bXzJpYRE-NjOjiArpuJWGnFXr+jq7ukbEEdEhK9YPCbYrQ@mail.gmail.com>
On Mon, 6 Jul 2026 16:11:03 -0400
Michael Bommarito <michael.bommarito@gmail.com> wrote:
> On Mon, Jul 6, 2026 at 4:06 PM Steven Rostedt <rostedt@goodmis.org> wrote:
> > I'm taking in the OP patch, but this looks like a separate issue.
> >
> > Any update on this?
>
> Sorry, had gone fishing. I'll have v2 in the next day or so
>
Ah, you're going to send a new version. I'll drop the one I pulled then.
-- Steve
^ permalink raw reply
* Re: [PATCH 01/30] mm: move vma_start_pgoff() into mm.h and clean up
From: David Hildenbrand (Arm) @ 2026-07-07 14:41 UTC (permalink / raw)
To: Lorenzo Stoakes, Andrew Morton
Cc: Russell King, Dinh Nguyen, Simon Schuster,
James E . J . Bottomley, Helge Deller, Jarkko Sakkinen,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
Ian Abbott, H Hartley Sweeten, Lucas Stach, David Airlie,
Simona Vetter, Patrik Jakobsson, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, Rob Clark, Dmitry Baryshkov, Tomi Valkeinen,
Thierry Reding, Mikko Perttunen, Jonathan Hunter,
Christian Koenig, Huang Rui, Ankit Agrawal, Alex Williamson,
Alexander Viro, Christian Brauner, Dan Williams, Muchun Song,
Oscar Salvador, Suren Baghdasaryan, Liam R . Howlett,
Matthew Wilcox, Marek Szyprowski, Peter Zijlstra,
Arnaldo Carvalho de Melo, Namhyung Kim, Masami Hiramatsu,
Oleg Nesterov, Steven Rostedt, SeongJae Park, Miaohe Lin,
Hugh Dickins, Mike Rapoport, Kees Cook, Paolo Bonzini,
linux-kernel, linux-arm-kernel, linux-parisc, linux-sgx, etnaviv,
dri-devel, linux-arm-msm, freedreno, linux-tegra, kvm,
linux-fsdevel, nvdimm, linux-mm, iommu, linux-perf-users,
linux-trace-kernel, kasan-dev, damon, Pedro Falcato, Rik van Riel,
Harry Yoo, Jann Horn
In-Reply-To: <b28b698df4c009e85c4728446ca5863d8e633164.1782735110.git.ljs@kernel.org>
On 6/29/26 14:23, Lorenzo Stoakes wrote:
> vma_last_pgoff() already lives there, so it's a bit odd to keep
> vma_start_pgoff() in mm/interval_tree.c. Move them together.
>
> These each return unsigned long, which pgoff_t is typedef'd to. Make this
> consistent and have these functions return pgoff_t instead.
>
> Additionally, express vma_last_pgoff() in terms of vma_start_pgoff(), since
> we wrap the vma->vm_pgoff access, we may as well use it here.
>
> Also while we're here, const-ify the VMA and cleanup a bit.
>
> No functional change intended.
>
> Signed-off-by: Lorenzo Stoakes <ljs@kernel.org>
> ---
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
--
Cheers,
David
^ permalink raw reply
* Re: [PATCH] ring-buffer: serialize read-page order with subbuffer resize
From: Steven Rostedt @ 2026-07-07 14:36 UTC (permalink / raw)
To: Yousef Alhouseen
Cc: mhiramat, mathieu.desnoyers, petr.pavlu, linux-trace-kernel,
linux-kernel
In-Reply-To: <CAMuQ4bUNbCM7oxnrXaT_oAoX+Guoo4_Bu0eO5dLR3OZ62Eu0Xg@mail.gmail.com>
On Tue, 30 Jun 2026 14:16:48 -0700
Yousef Alhouseen <alhouseenyousef@gmail.com> wrote:
> Agreed. I’ll add an explicit resize-in-progress flag, set it around
> the order transition, and make the external read-page
> allocation/free/read paths reject work while it is set. I’ll check the
> flag under the locks that serialize each path so it cannot race the
> transition, then compile and test the resulting v2.
Did you ever get around to sending a v2?
-- Steve
^ permalink raw reply
* Re: [PATCH v2 2/4] mm/mlock: wait for migration to finish when mlocking a folio
From: Lorenzo Stoakes @ 2026-07-07 14:33 UTC (permalink / raw)
To: Wandun Chen
Cc: vbabka, david, rostedt, mhiramat, Alexander.Krabler, hughd, fvdl,
bigeasy, linux-mm, linux-kernel, linux-trace-kernel,
linux-rt-devel, akpm, surenb, mhocko, jackmanb, hannes, ziy, riel,
liam, harry, jannh, lance.yang, mathieu.desnoyers, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, apopple,
pfalcato
In-Reply-To: <20260707125925.3725177-3-chenwandun1@gmail.com>
On Tue, Jul 07, 2026 at 08:59:23PM +0800, Wandun Chen wrote:
> From: Wandun Chen <chenwandun@lixiang.com>
>
> In RT kernels, sysctl_compact_unevictable_allowed is false by default,
> when the mlock/mlockall system call try to lock all the present page,
> the mlock_pte_range function skips non-present entries. If these
> non-present entries are migration entries, and the migration is not
> guaranteed to have completed before the mlock/mlockall, it may result
> in a page fault on subsequent access, which then waits for the
> migration to finish, causing spike latency in RT kernels.
Is this really noticable and measurable?
I suppose not too many ranges should be mock
>
> Fix it by waiting for the migration to complete during the mlock/mlockall
> syscall when sysctl_compact_unevictable_allowed is false.
Probably better to reference the sysctl itself rather than an arbitrary varible
name.
>
> Fixes: 90d07210ab55 ("mm: mlock: use folios and a folio batch internally")
Again I have no idea why you chose this as the fixes target, especially for
this?
But in any case, why is this separate from the previous commit? I sthis an
entirely separate fix?
> Suggested-by: Vlastimil Babka <vbabka@suse.cz>
> Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
> Link: https://lore.kernel.org/lkml/c8793c0f-7156-4cb7-9e6e-7909397e2fff@kernel.org/#t
A nit but please strip that #t.
> ---
> mm/mlock.c | 23 +++++++++++++++++++++--
> 1 file changed, 21 insertions(+), 2 deletions(-)
>
> diff --git a/mm/mlock.c b/mm/mlock.c
> index 97e49038d8d3..ac65de40b22b 100644
> --- a/mm/mlock.c
> +++ b/mm/mlock.c
> @@ -25,6 +25,7 @@
> #include <linux/memcontrol.h>
> #include <linux/mm_inline.h>
> #include <linux/secretmem.h>
> +#include <linux/compaction.h>
>
> #include "internal.h"
>
> @@ -361,8 +362,17 @@ static int mlock_pte_range(pmd_t *pmd, unsigned long addr,
>
> ptl = pmd_trans_huge_lock(pmd, vma);
> if (ptl) {
> - if (!pmd_present(*pmd))
> + if (!pmd_present(*pmd)) {
> + if (unlikely((vma->vm_flags & VM_LOCKED) &&
-> vma_test(vma, VMA_LOCKED_BIT)...
What is the basis for your unlikely()? Don't use likely()/unlikely() just
because it feels right. Leave them out unless you have actual profiling data to
prove it.
Remove it please.
But I'm also confused here - why are you checking for VMAs that already had
VMA_LOCKED_BIT set when you are about to set it?
Surely this shouldn't be predicated on VMA_LOCKED_BIT?
> + !compaction_allow_unevictable() &&
Why do we care about compaction here? Are we assuming the softleaf migration
entry is present only for compaction reasons?
So these migration entries could be there for any reason? Does it matter? Is it
such a big deal, on mlock, to wait for migration entries? I think probably not.
But then maybe some weird workload gets affected... hmm.
> + softleaf_is_migration(softleaf_from_pmd(*pmd)))) {
Use pmd_is_migration_entry()? :)
And technically you should use pmdp_get() I think? Maybe a situation where we
don't care/need the READ_ONCE() though.
> + spin_unlock(ptl);
> + pmd_migration_entry_wait(vma->vm_mm, pmd);
> + walk->action = ACTION_AGAIN;
> + return 0;
> + }
This code is really disgusting, let's please not just copy/paste open-coded
nested horror shows like this.
A good rule of thumb is if you see a bunch of code 'poking out' like this and
certainly if you copy/paste it or something very much like it, break it out into
a function.
So:
static bool wait_for_migration(const struct vm_area_struct *vma, softleaf_t entry)
{
>>>> As above I'm not sure should even be checking this?
if (!vma_test(vma, VMA_LOCKED_BIT))
return false;
>>>> As above I'm not sure this makes sense?
if (compaction_allowed_unevictable())
return false;
return softleaf_is_migration(entry);
}
Then call it like:
if (ptl) {
const pmd_t pmd = pmdp_get(pmd);
if (!pmd_present(pmd)) {
const softleaf_t entry = softleaf_from_pmd(pmd);
if (!wait_for_migration(vma, entry))
goto out;
spin_unlock(ptl);
pmd_migration_entry_wait(vma->vm_mm, pmd);
walk->action = ACTION_AGAIN;
return 0;
}
if (is_huge_zero_pmd(pmd))
goto out;
(etc. going *pmd -> pmd)
But we could probably do even better than that, and assuming your dubious checks
above aren't needed, we don't even need a helper then:
if (ptl) {
const pmd_t pmd = pmdp_get(pmd); // possibly just *pmd?
const softleaf_t entry = softleaf_from_pmd(pmd);
if (softleaf_is_migration(entry)) {
/* Wait for migration entries. */
spin_unlock(ptl);
pmd_migration_entry_wait(vma->vm_mm, pmd);
walk->action = ACTION_AGAIN;
return 0;
}
if (!pmd_present(pmd))
goto out;
etc.
And similar for the PTE stuff below.
This works because softleaf_from_pmd() (and pte) will give you a 'none' softleaf
if the entry is not a softlaf entry. So you can unconditionally call it on a
PMD.
> goto out;
> + }
> if (is_huge_zero_pmd(*pmd))
> goto out;
> folio = pmd_folio(*pmd);
> @@ -383,8 +393,17 @@ static int mlock_pte_range(pmd_t *pmd, unsigned long addr,
>
> for (pte = start_pte; addr != end; pte++, addr += PAGE_SIZE) {
> ptent = ptep_get(pte);
> - if (!pte_present(ptent))
> + if (!pte_present(ptent)) {
> + if (unlikely((vma->vm_flags & VM_LOCKED) &&
> + !compaction_allow_unevictable() &&
> + softleaf_is_migration(softleaf_from_pte(ptent)))) {
> + pte_unmap_unlock(start_pte, ptl);
> + migration_entry_wait(vma->vm_mm, pmd, addr);
> + walk->action = ACTION_AGAIN;
> + return 0;
> + }
> continue;
> + }
> folio = vm_normal_folio(vma, addr, ptent);
> if (!folio || folio_is_zone_device(folio))
> continue;
> --
> 2.43.0
>
Thanks, Lorenzo
^ permalink raw reply
* Re: [PATCH v3 04/11] arm64/mm: Add set_memory_device() and set_memory_normal()
From: Robin Murphy @ 2026-07-07 14:15 UTC (permalink / raw)
To: Mike Rapoport
Cc: Will Deacon, Thierry Reding, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Jonathan Hunter, David Airlie, Simona Vetter,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann,
Sowjanya Komatineni, Luca Ceresoli, Mikko Perttunen, Yury Norov,
Rasmus Villemoes, Russell King, Alexander Gordeev,
Gerald Schaefer, Heiko Carstens, Vasily Gorbik,
Christian Borntraeger, Sven Schnelle, Andrew Morton,
David Hildenbrand, Lorenzo Stoakes, Liam R. Howlett,
Vlastimil Babka, Suren Baghdasaryan, Michal Hocko,
Marek Szyprowski, Sumit Semwal, Benjamin Gaignard, Brian Starkey,
John Stultz, T.J. Mercier, Christian König, Steven Rostedt,
Masami Hiramatsu, Mathieu Desnoyers, Catalin Marinas,
Thierry Reding, devicetree, linux-tegra, linux-kernel, dri-devel,
linux-media, linux-arm-kernel, linux-s390, linux-mm, iommu,
linaro-mm-sig, linux-trace-kernel, Thierry Reding, Chun Ng
In-Reply-To: <ak0A6eLp0Pw8iKK0@kernel.org>
On 07/07/2026 2:36 pm, Mike Rapoport wrote:
> On Tue, Jul 07, 2026 at 02:17:29PM +0100, Robin Murphy wrote:
>>
>> Given the precedent of memblock_mark_nomap(), as long as the reusable
>> reserved-memory regions also get split into distinct memblocks, then it
>> seems like in principle we ought to be able to give them a new
>> MEMBLOCK_PTEMAP (or whatever) flag which could then be picked up in
>> map_mem() without needing to override force_pte_mapping() globally?
>
> Please don't. _nomap() caused enough pain.
Indeed I was there for pretty much the whole pfn_valid() saga :)
Bad example maybe - in this case the only actual similarity to nomap
would be the fact that it would also be set by the of_reserved_mem code
based on what it finds in DT; in all other aspects it should be
functionally closer to something like MEMBLOCK_RSRV_NOINIT, i.e. just
carrying information through the mm init phase, then ceasing to matter
at all once the linear mapping is done.
Cheers,
Robin.
^ permalink raw reply
* Re: [PATCH v2 1/4] mm/migrate: do not migrate folios mapped into VM_LOCKED VMAs under compaction
From: Lorenzo Stoakes @ 2026-07-07 13:55 UTC (permalink / raw)
To: Wandun Chen
Cc: vbabka, david, rostedt, mhiramat, Alexander.Krabler, hughd, fvdl,
bigeasy, linux-mm, linux-kernel, linux-trace-kernel,
linux-rt-devel, akpm, surenb, mhocko, jackmanb, hannes, ziy, riel,
liam, harry, jannh, lance.yang, mathieu.desnoyers, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, apopple,
pfalcato
In-Reply-To: <akz7ythMxfIZeT0d@lucifer>
On Tue, Jul 07, 2026 at 02:44:50PM +0100, Lorenzo Stoakes wrote:
> See above about deduplicating.
>
> > + ttu |= TTU_RESPECT_MLOCK;
>
> Hmm. I don't love 'respect mlock'. I guess we only know about the reason
> being compaction here.
>
> But I'm confused anyway. We have the folio, why aren't we just checking for
> PG_mlocked() here instead of getting the rmap to see if it's mapped
> anywhere with VMA_LOCKED_BIT?
Also, since compaction_allow_unevictable() is a function that is accessible
elsewhere, you could literally just have a TTU_MIGRATION here instead and have
the rmap logic call compaction_allow_unevictable() instead rather than this.
And then you could adapt the function I suggested before not to take a reason
parameter but rather a 'is_migration' one instead possibly and then pass (ttu &
TTU_MIGRATION) in.
BUT. I still question whether this is at all needed since you have the folio you
can check for PG_mlocked...
Cheers, Lorenzo
^ permalink raw reply
* Re: [PATCH v2 1/4] mm/migrate: do not migrate folios mapped into VM_LOCKED VMAs under compaction
From: Lorenzo Stoakes @ 2026-07-07 13:44 UTC (permalink / raw)
To: Wandun Chen
Cc: vbabka, david, rostedt, mhiramat, Alexander.Krabler, hughd, fvdl,
bigeasy, linux-mm, linux-kernel, linux-trace-kernel,
linux-rt-devel, akpm, surenb, mhocko, jackmanb, hannes, ziy, riel,
liam, harry, jannh, lance.yang, mathieu.desnoyers, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, apopple,
pfalcato
In-Reply-To: <20260707125925.3725177-2-chenwandun1@gmail.com>
(Being really nitty, your subject line is too long)
Please don't reference legacy VMA flags for newer patches 'do not migrate
folios mapped into mlocked VMAs...' works just as well.
On Tue, Jul 07, 2026 at 08:59:22PM +0800, Wandun Chen wrote:
> From: Wandun Chen <chenwandun@lixiang.com>
>
> When compact_unevictable_allowed=0, unevictable pages should not be
> migrated. However, mlock_folio_batch in the mlock[all] syscall introduces
> a race, mlock_folio() sets PG_mlocked immediately but defers PG_unevictable
> to mlock_folio_batch(), causing pages that are about to become unevictable
> to be migrated, which violates the intent of compact_unevictable_allowed,
> and causes spike latency in RT kernels [1].
>
> In order to fix this, migration is forbidden for pages mapped into VMAs
> marked with VM_LOCKED. In addition, two early-return paths are introduced,
Please don't reference legacy VMA flags. -> VMA_LOCKED_BIT.
> filter out mlocked pages, return early to avoid unnecessary operations.
>
> Fixes: 90d07210ab55 ("mm: mlock: use folios and a folio batch internally")
Hmmmm why do you think my patch caused this? That was just a folio conversion?
Also I didn't think we liked having fixes spotted about a series with non-fixes
tags?
> Reported-by: Alexander Krabler <Alexander.Krabler@kuka.com>
> Closes: https://lore.kernel.org/all/DU0PR01MB10385345F7153F334100981888259A@DU0PR01MB10385.eurprd01.prod.exchangelabs.com/ [1]
> Suggested-by: Vlastimil Babka <vbabka@suse.cz>
> Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
> Link: https://lore.kernel.org/linux-rt-users/33275585-f2db-4779-89f0-3ae24b455a67@suse.cz/#t
> ---
> include/linux/compaction.h | 6 ++++++
> include/linux/rmap.h | 3 +++
> mm/compaction.c | 8 +++++++-
> mm/migrate.c | 23 +++++++++++++++++++----
> mm/rmap.c | 12 +++++++++---
> 5 files changed, 44 insertions(+), 8 deletions(-)
>
> diff --git a/include/linux/compaction.h b/include/linux/compaction.h
> index f29ef0653546..04e60f65b976 100644
> --- a/include/linux/compaction.h
> +++ b/include/linux/compaction.h
> @@ -106,6 +106,7 @@ bool compaction_zonelist_suitable(struct alloc_context *ac, int order,
> extern void __meminit kcompactd_run(int nid);
> extern void __meminit kcompactd_stop(int nid);
> extern void wakeup_kcompactd(pg_data_t *pgdat, int order, int highest_zoneidx);
> +extern bool compaction_allow_unevictable(void);
Don't use extern. We remove extern as we go it's not needed.
>
> #else
> static inline void reset_isolation_suitable(pg_data_t *pgdat)
> @@ -131,6 +132,11 @@ static inline void wakeup_kcompactd(pg_data_t *pgdat,
> {
> }
>
> +static inline bool compaction_allow_unevictable(void)
> +{
> + return true;
> +}
> +
> #endif /* CONFIG_COMPACTION */
>
> struct node;
> diff --git a/include/linux/rmap.h b/include/linux/rmap.h
> index 8dc0871e5f00..359c7426b6b9 100644
> --- a/include/linux/rmap.h
> +++ b/include/linux/rmap.h
> @@ -102,6 +102,9 @@ enum ttu_flags {
> * do a final flush if necessary */
> TTU_RMAP_LOCKED = 0x80, /* do not grab rmap lock:
> * caller holds it */
> + TTU_RESPECT_MLOCK = 0x100,/* leave VM_LOCKED vmas mapped instead
-> VMA_LOCKED_BIT please. Also maybe just say mlock'd?
> + * of installing a migration entry
> + */
> };
>
> #ifdef CONFIG_MMU
> diff --git a/mm/compaction.c b/mm/compaction.c
> index f08765ade014..5d256930e389 100644
> --- a/mm/compaction.c
> +++ b/mm/compaction.c
> @@ -1116,7 +1116,8 @@ isolate_migratepages_block(struct compact_control *cc, unsigned long low_pfn,
> is_unevictable = folio_test_unevictable(folio);
>
> /* Compaction might skip unevictable pages but CMA takes them */
> - if (!(mode & ISOLATE_UNEVICTABLE) && is_unevictable)
> + if (!(mode & ISOLATE_UNEVICTABLE) &&
> + (is_unevictable || folio_test_mlocked(folio)))
Maybe just change is_unevictable to include this check?
Like:
is_unevictable = folio_test_unevictable(folio) ||
folio_test_mlocked(folio);
?
Also later you have:
if (((mode & ISOLATE_ASYNC_MIGRATE) && is_dirty) ||
(mapping && is_unevictable)) {
...
Which doesn't account for mlock as-is? Is that correct?
> goto isolate_fail_put;
>
> /*
> @@ -1898,6 +1899,11 @@ typedef enum {
> * compactable pages.
> */
> static int sysctl_compact_unevictable_allowed __read_mostly = CONFIG_COMPACT_UNEVICTABLE_DEFAULT;
> +
> +bool compaction_allow_unevictable(void)
> +{
> + return sysctl_compact_unevictable_allowed;
> +}
You add this helper but isolate_migratepages() still references
sysctl_compact_unevictable_allowed directly?
> /*
> * Tunable for proactive compaction. It determines how
> * aggressively the kernel should compact memory in the
> diff --git a/mm/migrate.c b/mm/migrate.c
> index a786549551e3..3a15eb13e82b 100644
> --- a/mm/migrate.c
> +++ b/mm/migrate.c
> @@ -1202,7 +1202,7 @@ static void migrate_folio_done(struct folio *src,
> static int migrate_folio_unmap(new_folio_t get_new_folio,
> free_folio_t put_new_folio, unsigned long private,
> struct folio *src, struct folio **dstp, enum migrate_mode mode,
> - struct list_head *ret)
> + struct list_head *ret, enum migrate_reason reason)
> {
> struct folio *dst;
> int rc = -EAGAIN;
> @@ -1210,6 +1210,7 @@ static int migrate_folio_unmap(new_folio_t get_new_folio,
> struct anon_vma *anon_vma = NULL;
> bool locked = false;
> bool dst_locked = false;
> + enum ttu_flags ttu = 0;
You reference ttu only in an if-block below no? So why are you declaring
this here? Move it to the if-block.
>
> dst = get_new_folio(src, private);
> if (!dst)
> @@ -1249,9 +1250,15 @@ static int migrate_folio_unmap(new_folio_t get_new_folio,
> folio_lock(src);
> }
> locked = true;
> - if (folio_test_mlocked(src))
> + if (folio_test_mlocked(src)) {
> old_folio_state |= FOLIO_WAS_MLOCKED;
>
> + if (reason == MR_COMPACTION && !compaction_allow_unevictable()) {
This should really be a helper since you repeat yourself and it's not
obvious what this is checking.
Like:
static migrate_mlock_allowed(enum migrate_reason reason)
{
/* Only compaction is disallowed. */
if (reason != MR_COMPACTION)
return true;
/* If we can compact unevictable folios, we are ok. */
if (compaction_allow_unevictable())
return true;
/* Conservative: if any folio could be mlock()'d, disallow. */
return false;
}
Then you could self-document what you're checking and avoid code duplication below.
> + rc = -EBUSY;
> + goto out;
> + }
> + }
> +
> if (folio_test_writeback(src)) {
> /*
> * Only in the case of a full synchronous migration is it
> @@ -1324,7 +1331,14 @@ static int migrate_folio_unmap(new_folio_t get_new_folio,
> /* Establish migration ptes */
> VM_BUG_ON_FOLIO(folio_test_anon(src) &&
> !folio_test_ksm(src) && !anon_vma, src);
Useful to convert VM_BUG_*() -> VM_WARN_*() (possibly _ONCE() here also) as we go!
> - try_to_migrate(src, mode == MIGRATE_ASYNC ? TTU_BATCH_FLUSH : 0);
> +
> + if (mode == MIGRATE_ASYNC)
> + ttu |= TTU_BATCH_FLUSH;
> +
> + if (reason == MR_COMPACTION && !compaction_allow_unevictable())
See above about deduplicating.
> + ttu |= TTU_RESPECT_MLOCK;
Hmm. I don't love 'respect mlock'. I guess we only know about the reason
being compaction here.
But I'm confused anyway. We have the folio, why aren't we just checking for
PG_mlocked() here instead of getting the rmap to see if it's mapped
anywhere with VMA_LOCKED_BIT?
> +
> + try_to_migrate(src, ttu);
> old_folio_state |= FOLIO_WAS_MAPPED;
> }
>
> @@ -1905,7 +1919,8 @@ static int migrate_pages_batch(struct list_head *from,
> }
>
> rc = migrate_folio_unmap(get_new_folio, put_new_folio,
> - private, folio, &dst, mode, ret_folios);
> + private, folio, &dst, mode, ret_folios,
> + reason);
> /*
> * The rules are:
> * 0: folio will be put on unmap_folios list,
> diff --git a/mm/rmap.c b/mm/rmap.c
> index 0fb7a1b82cf3..3cb7f6337d38 100644
> --- a/mm/rmap.c
> +++ b/mm/rmap.c
> @@ -2420,6 +2420,9 @@ static bool try_to_migrate_one(struct folio *folio, struct vm_area_struct *vma,
> unsigned long pfn;
> unsigned long hsz = 0;
>
> + if ((flags & TTU_RESPECT_MLOCK) && (vma->vm_flags & VM_LOCKED))
Please use the modern API for VMA flags. So:
if ((flags & TTU_RESPECT_MLOCK) && vma_test(VMA_LOCKED_BIT))
> + return false;
> +
> /*
> * When racing against e.g. zap_pte_range() on another cpu,
> * in between its ptep_get_and_clear_full() and folio_remove_rmap_*(),
> @@ -2741,11 +2744,14 @@ void try_to_migrate(struct folio *folio, enum ttu_flags flags)
> };
>
> /*
> - * Migration always ignores mlock and only supports TTU_RMAP_LOCKED and
> - * TTU_SPLIT_HUGE_PMD, TTU_SYNC, and TTU_BATCH_FLUSH flags.
> + * Migration normally ignores mlock, but TTU_RESPECT_MLOCK asks it to
> + * leave folios mapped into VM_LOCKED vmas alone. Only TTU_RMAP_LOCKED,
Again -> VMA_LOCKED_BIT.
> + * TTU_SPLIT_HUGE_PMD, TTU_SYNC, TTU_BATCH_FLUSH and TTU_RESPECT_MLOCK
> + * are supported.
> */
> if (WARN_ON_ONCE(flags & ~(TTU_RMAP_LOCKED | TTU_SPLIT_HUGE_PMD |
> - TTU_SYNC | TTU_BATCH_FLUSH)))
> + TTU_SYNC | TTU_BATCH_FLUSH |
> + TTU_RESPECT_MLOCK)))
> return;
>
> if (folio_is_zone_device(folio) &&
> --
> 2.43.0
>
Thanks, Lorenzo
^ permalink raw reply
* Re: [PATCH v3 04/11] arm64/mm: Add set_memory_device() and set_memory_normal()
From: Mike Rapoport @ 2026-07-07 13:36 UTC (permalink / raw)
To: Robin Murphy
Cc: Will Deacon, Thierry Reding, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Jonathan Hunter, David Airlie, Simona Vetter,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann,
Sowjanya Komatineni, Luca Ceresoli, Mikko Perttunen, Yury Norov,
Rasmus Villemoes, Russell King, Alexander Gordeev,
Gerald Schaefer, Heiko Carstens, Vasily Gorbik,
Christian Borntraeger, Sven Schnelle, Andrew Morton,
David Hildenbrand, Lorenzo Stoakes, Liam R. Howlett,
Vlastimil Babka, Suren Baghdasaryan, Michal Hocko,
Marek Szyprowski, Sumit Semwal, Benjamin Gaignard, Brian Starkey,
John Stultz, T.J. Mercier, Christian König, Steven Rostedt,
Masami Hiramatsu, Mathieu Desnoyers, Catalin Marinas,
Thierry Reding, devicetree, linux-tegra, linux-kernel, dri-devel,
linux-media, linux-arm-kernel, linux-s390, linux-mm, iommu,
linaro-mm-sig, linux-trace-kernel, Thierry Reding, Chun Ng
In-Reply-To: <b0a1bdd7-46ab-4025-8775-c9273892444e@arm.com>
On Tue, Jul 07, 2026 at 02:17:29PM +0100, Robin Murphy wrote:
>
> Given the precedent of memblock_mark_nomap(), as long as the reusable
> reserved-memory regions also get split into distinct memblocks, then it
> seems like in principle we ought to be able to give them a new
> MEMBLOCK_PTEMAP (or whatever) flag which could then be picked up in
> map_mem() without needing to override force_pte_mapping() globally?
Please don't. _nomap() caused enough pain.
> Cheers,
> Robin.
--
Sincerely yours,
Mike.
^ permalink raw reply
* Re: [PATCH v2 4/4] mm/mlock: migrate folios out of CMA when mlocking a range
From: Wandun @ 2026-07-07 13:36 UTC (permalink / raw)
To: vbabka, david, rostedt, mhiramat, Alexander.Krabler, hughd, fvdl,
bigeasy, linux-mm, linux-kernel, linux-trace-kernel,
linux-rt-devel
Cc: akpm, surenb, mhocko, jackmanb, hannes, ziy, ljs, riel, liam,
harry, jannh, lance.yang, mathieu.desnoyers, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, apopple,
pfalcato
In-Reply-To: <20260707125925.3725177-5-chenwandun1@gmail.com>
On 7/7/26 20:59, Wandun Chen wrote:
> From: Wandun Chen <chenwandun@lixiang.com>
>
> The region covered by mlock[all] may contain CMA pages. cma_alloc installs
> migration entries in the page table, if a memory access occurs at this
> point, it must wait for the migration to complete, which may cause
> latency spikes on the RT kernels.
>
> Try to move the migration cost into the mlock[all] caller, which is
> typically a setup path. So reduce the chance of latency spikes on RT
> kernels by migrating the currently mapped CMA pages out of CMA region.
>
> Suggested-by: Frank van der Linden <fvdl@google.com>
> Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
> Link: https://lore.kernel.org/all/CAPTztWZpnX1j8-7yeppVUsxE=O9hbVeqricDjZt8_pnN7a-kBQ@mail.gmail.com/#t
> ---
> mm/mlock.c | 119 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
> 1 file changed, 118 insertions(+), 1 deletion(-)
>
> diff --git a/mm/mlock.c b/mm/mlock.c
> index ac65de40b22b..f56c685533f5 100644
> --- a/mm/mlock.c
> +++ b/mm/mlock.c
> @@ -25,6 +25,7 @@
> #include <linux/memcontrol.h>
> #include <linux/mm_inline.h>
> #include <linux/secretmem.h>
> +#include <linux/migrate.h>
> #include <linux/compaction.h>
>
> #include "internal.h"
> @@ -428,6 +429,119 @@ static int mlock_pte_range(pmd_t *pmd, unsigned long addr,
> return 0;
> }
>
> +#ifdef CONFIG_CMA
> +static int mlock_collect_migratable_pte_range(pmd_t *pmd, unsigned long addr,
> + unsigned long end, struct mm_walk *walk)
> +{
> + struct vm_area_struct *vma = walk->vma;
> + struct list_head *folio_list = walk->private;
> + spinlock_t *ptl;
> + pte_t *start_pte, *pte;
> + pte_t ptent;
> + struct folio *folio;
> + unsigned int step = 1;
> +
> + if (!(vma->vm_flags & VM_LOCKED))
> + return 0;
> +
> + ptl = pmd_trans_huge_lock(pmd, vma);
> + if (ptl) {
> + if (!pmd_present(*pmd)) {
> + if (unlikely(softleaf_is_migration(softleaf_from_pmd(*pmd)))) {
> + spin_unlock(ptl);
> + pmd_migration_entry_wait(vma->vm_mm, pmd);
> + walk->action = ACTION_AGAIN;
> + return 0;
> + }
> + goto out;
> + }
> + if (is_huge_zero_pmd(*pmd))
> + goto out;
> + folio = pmd_folio(*pmd);
> + if (folio_is_zone_device(folio))
> + goto out;
> + if (is_migrate_cma_page(&folio->page))
> + isolate_folio_to_list(folio, folio_list);
> + goto out;
> + }
> +
> + start_pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
> + if (!start_pte) {
> + walk->action = ACTION_AGAIN;
> + return 0;
> + }
> +
> + for (pte = start_pte; addr != end; pte += step, addr += step * PAGE_SIZE) {
> + step = 1;
> + ptent = ptep_get(pte);
> + if (!pte_present(ptent)) {
> + if (unlikely(softleaf_is_migration(softleaf_from_pte(ptent)))) {
> + pte_unmap_unlock(start_pte, ptl);
> + migration_entry_wait(vma->vm_mm, pmd, addr);
> + walk->action = ACTION_AGAIN;
> + return 0;
> + }
> + continue;
> + }
> + folio = vm_normal_folio(vma, addr, ptent);
> + if (!folio || folio_is_zone_device(folio))
> + continue;
> + step = folio_mlock_step(folio, pte, addr, end);
> + if (is_migrate_cma_page(&folio->page))
Here should be, sorry about this.
if (!is_migrate_cma_page(&folio->page))
continue;
Best regards
Wandun
> + continue;
> + isolate_folio_to_list(folio, folio_list);
> + }
> + pte_unmap(start_pte);
> +out:
> + spin_unlock(ptl);
> + cond_resched();
> + return 0;
> +}
> +
> +static const struct mm_walk_ops mlock_collect_migratable_ops = {
> + .pmd_entry = mlock_collect_migratable_pte_range,
> + .walk_lock = PGWALK_RDLOCK,
> +};
> +
> +static void mlock_migrate_cma_range(unsigned long start, unsigned long len)
> +{
> + struct mm_struct *mm = current->mm;
> + unsigned long end = start + len;
> + LIST_HEAD(folio_list);
> + struct migration_target_control mtc = {
> + .nid = NUMA_NO_NODE,
> + .gfp_mask = GFP_HIGHUSER | __GFP_NOWARN,
> + .reason = MR_SYSCALL,
> + };
> +
> + if (compaction_allow_unevictable())
> + return;
> +
> + lru_cache_disable();
> +
> + if (mmap_read_lock_killable(mm))
> + goto out;
> +
> + walk_page_range(mm, start, end, &mlock_collect_migratable_ops,
> + &folio_list);
> + mmap_read_unlock(mm);
> +
> + if (list_empty(&folio_list))
> + goto out;
> +
> + if (migrate_pages(&folio_list, alloc_migration_target, NULL,
> + (unsigned long)&mtc, MIGRATE_SYNC, MR_SYSCALL, NULL))
> + putback_movable_pages(&folio_list);
> +out:
> + lru_cache_enable();
> +}
> +#else
> +static inline void mlock_migrate_cma_range(unsigned long start,
> + unsigned long len)
> +{
> +}
> +#endif /* CONFIG_CMA */
> +
> /*
> * mlock_vma_pages_range() - mlock any pages already in the range,
> * or munlock all pages in the range.
> @@ -678,6 +792,7 @@ static __must_check int do_mlock(unsigned long start, size_t len, vm_flags_t fla
> error = __mm_populate(start, len, 0);
> if (error)
> return __mlock_posix_error_return(error);
> + mlock_migrate_cma_range(start, len);
> return 0;
> }
>
> @@ -790,8 +905,10 @@ SYSCALL_DEFINE1(mlockall, int, flags)
> capable(CAP_IPC_LOCK))
> ret = apply_mlockall_flags(flags);
> mmap_write_unlock(current->mm);
> - if (!ret && (flags & MCL_CURRENT))
> + if (!ret && (flags & MCL_CURRENT)) {
> mm_populate(0, TASK_SIZE);
> + mlock_migrate_cma_range(0, TASK_SIZE);
> + }
>
> return ret;
> }
^ permalink raw reply
* [PATCH v2] tracing/synthetic: Free type string on error path
From: Yu Peng @ 2026-07-07 13:24 UTC (permalink / raw)
To: rostedt
Cc: mhiramat, mathieu.desnoyers, linux-trace-kernel, linux-kernel,
Yu Peng
parse_synth_field() builds a "__data_loc ..." type string before
assigning it to field->type. If the seq_buf check fails, the temporary
string is not owned by field and is leaked. Free it before leaving.
Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Yu Peng <pengyu@kylinos.cn>
---
Changes in v2:
- Use __free(kfree) and no_free_ptr() as suggested by Steven.
kernel/trace/trace_events_synth.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c
index e6871230bde96..ad2e70258291b 100644
--- a/kernel/trace/trace_events_synth.c
+++ b/kernel/trace/trace_events_synth.c
@@ -828,7 +828,7 @@ static struct synth_field *parse_synth_field(int argc, char **argv,
} else if (size == 0) {
if (synth_field_is_string(field->type) ||
synth_field_is_stack(field->type)) {
- char *type;
+ char *type __free(kfree) = NULL;
len = sizeof("__data_loc ") + strlen(field->type) + 1;
type = kzalloc(len, GFP_KERNEL);
@@ -844,7 +844,7 @@ static struct synth_field *parse_synth_field(int argc, char **argv,
s.buffer[s.len] = '\0';
kfree(field->type);
- field->type = type;
+ field->type = no_free_ptr(type);
field->is_dynamic = true;
size = sizeof(u64);
--
2.43.0
^ permalink raw reply related
* Re: [PATCH 2/2] tracing/synthetic: Free type string on error path
From: Yu Peng @ 2026-07-07 13:22 UTC (permalink / raw)
To: Steven Rostedt
Cc: Masami Hiramatsu, Mathieu Desnoyers, linux-trace-kernel,
linux-kernel
In-Reply-To: <20260706131534.70e602ef@gandalf.local.home>
On 7/7/2026 1:15 AM, Steven Rostedt wrote:
> Can you do this instead?
>
> diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c
> index cdd5b9332835..7ff0f00edbdd 100644
> --- a/kernel/trace/trace_events_synth.c
> +++ b/kernel/trace/trace_events_synth.c
> @@ -828,7 +828,7 @@ static struct synth_field *parse_synth_field(int argc, char **argv,
> } else if (size == 0) {
> if (synth_field_is_string(field->type) ||
> synth_field_is_stack(field->type)) {
> - char *type;
> + char *type __free(kfree) = NULL;
>
> len = sizeof("__data_loc ") + strlen(field->type) + 1;
> type = kzalloc(len, GFP_KERNEL);
> @@ -844,7 +844,7 @@ static struct synth_field *parse_synth_field(int argc, char **argv,
> s.buffer[s.len] = '\0';
>
> kfree(field->type);
> - field->type = type;
> + field->type = no_free_ptr(type);
>
> field->is_dynamic = true;
> size = sizeof(u64);
>
> -- Steve
Yes, that looks better. I'll fold it into v2.
Thanks,
Yu Peng
^ permalink raw reply
* Re: [PATCH v3 04/11] arm64/mm: Add set_memory_device() and set_memory_normal()
From: Robin Murphy @ 2026-07-07 13:17 UTC (permalink / raw)
To: Will Deacon, Thierry Reding
Cc: Rob Herring, Krzysztof Kozlowski, Conor Dooley, Jonathan Hunter,
David Airlie, Simona Vetter, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, Sowjanya Komatineni, Luca Ceresoli,
Mikko Perttunen, Yury Norov, Rasmus Villemoes, Russell King,
Alexander Gordeev, Gerald Schaefer, Heiko Carstens, Vasily Gorbik,
Christian Borntraeger, Sven Schnelle, Andrew Morton,
David Hildenbrand, Lorenzo Stoakes, Liam R. Howlett,
Vlastimil Babka, Mike Rapoport, Suren Baghdasaryan, Michal Hocko,
Marek Szyprowski, Sumit Semwal, Benjamin Gaignard, Brian Starkey,
John Stultz, T.J. Mercier, Christian König, Steven Rostedt,
Masami Hiramatsu, Mathieu Desnoyers, Catalin Marinas,
Thierry Reding, devicetree, linux-tegra, linux-kernel, dri-devel,
linux-media, linux-arm-kernel, linux-s390, linux-mm, iommu,
linaro-mm-sig, linux-trace-kernel, Thierry Reding, Chun Ng
In-Reply-To: <akzikTrmhMsvkNVY@willie-the-truck>
On 07/07/2026 12:27 pm, Will Deacon wrote:
> On Mon, Jul 06, 2026 at 03:49:24PM +0200, Thierry Reding wrote:
>> On Fri, Jul 03, 2026 at 06:13:31PM +0100, Will Deacon wrote:
>>> On Thu, Jul 02, 2026 at 06:41:23PM +0200, Thierry Reding wrote:
>>>> On Thu, Jul 02, 2026 at 03:46:44PM +0200, Thierry Reding wrote:
>>>>> On Thu, Jul 02, 2026 at 10:18:47AM +0100, Will Deacon wrote:
>>>>>> On Wed, Jul 01, 2026 at 06:08:15PM +0200, Thierry Reding wrote:
>>>>>>> From: Chun Ng <chunn@nvidia.com>
>>>>>>>
>>>>>>> Add helpers to swap PROT_NORMAL and PROT_DEVICE_nGnRnE protection bits
>>>>>>> on a kernel-linear-map range.
>>>>>>
>>>>>> That sounds like a really terrible idea. Why is this necessary and how
>>>>>> does it interact with things like load_unaligned_zeropad()?
>>>>>
>>>>> This is necessary because once the memory controller has walled off the
>>>>> new memory region the CPU must not access it under any circumstances or
>>>>> it'll cause the CPU to lock up (I think technically it'll hit an SError
>>>>> but in practice that just means it'll freeze, as far as I can tell).
>>>>>
>>>>> Probably doesn't interact well at all with load_unaligned_zeropad().
>>>>>
>>>>>> I think you should unmap the memory from the linear map and memremap()
>>>>>> it instead.
>>>>>
>>>>> Given that the memory can never be accessed by the CPU after the memory
>>>>> controller locks it down, I don't think we'll even need memremap(). The
>>>>> only thing we really need is the sg_table we hand out via the DMA BUFs
>>>>> so that they can be used by device drivers to program their DMA engines
>>>>> internally.
>>>>>
>>>>> Looking through some of the architecture code around this, shouldn't we
>>>>> simply be using set_memory_encrypted() and set_memory_decrypted() for
>>>>> this? While they might've been created for slightly other use-cases,
>>>>> they seem to be doing exactly what we want (i.e. remove the page range
>>>>> from the linear mapping and flushing it, or restoring the valid bit and
>>>>> standard permissions, respectively).
>>>>
>>>> Ah... I guess we can't do it because we're not in a realm world and so
>>>> the early checks in __set_memory_enc_dec() would return early and turn
>>>> it into a no-op.
>>>>
>>>> How about if I extract a common helper and provide set_memory_p() and
>>>> set_memory_np() in terms of those. Those are available on x86 and
>>>> PowerPC as well, so fairly standard. I suppose at that point we're
>>>> closer to set_memory_valid().
>>>
>>> Why not just call set_direct_map_invalid_noflush() +
>>> flush_tlb_kernel_range() for each page? We already have APIs for this.
>>
>> Having a "standard" helper with a fixed and documented purposed seemed
>> like a preferable approach for this particular case. We also may want to
>> make the driver that uses this buildable as a module, in which case we'd
>> need to export these rather low-level APIs. And then there's also the
>> fact that we typically call this on a rather large region of memory
>> (usually something like 512 MiB), so doing it page-by-page is rather
>> suboptimal.
>>
>>> The big challenge I see with any linear map manipulation, however, is
>>> that it will rely on can_set_direct_map() which likely means you need to
>>> give up some performance and/or security to make this work. Does memory
>>> become inaccesible dynamically at runtime? If not, the best bet would
>>> be to describe it as a carveout in the DT and mark it as "no-map" so
>>> we avoid mapping it in the first place.
>>
>> VPR exists in two modes: static and resizable. For static VPR we do
>> exactly that: describe it as carveout in DT with no-map and deal with it
>> accordingly in the driver. Resizable VPR is for device that have small
>> amounts of RAM. Content-protected video playback will in the worst case
>> consume around 1.8 GiB of RAM, so we want to be able to reuse for other
>> purposes when VPR is unused on those devices. In that case, the memory
>> is also described as a reserved-memory region in DT, but it is marked as
>> reusable so that it can be managed by CMA.
>>
>> The resize operation is fairly slow to begin with because we need to
>> stall the GPU and put it into reset before the operation, then take it
>> out of reset and resume it afterwards.
>>
>> What kind of performance impact do you expect?
>
> You'll need to measure it, but we've seen reports of double-digit
> percentage regressions in performance and power. As I said, the problem
> is that you need to split the linear map to 4k page at runtime to unmap
> the dynamic carveout, but that isn't something that can be done on most
> CPUs. Therefore you end up having to use page-granular mappings for the
> entire thing, similarly to how 'rodata_full' drives can_set_direct_map()
> and the perf/power hit affects everything.
>
> It's hard to know what to suggest... I wonder if any of the memory
> hotplug logic could help here?
Given the precedent of memblock_mark_nomap(), as long as the reusable
reserved-memory regions also get split into distinct memblocks, then it
seems like in principle we ought to be able to give them a new
MEMBLOCK_PTEMAP (or whatever) flag which could then be picked up in
map_mem() without needing to override force_pte_mapping() globally?
Cheers,
Robin.
^ permalink raw reply
* [PATCH v2 4/4] mm/mlock: migrate folios out of CMA when mlocking a range
From: Wandun Chen @ 2026-07-07 12:59 UTC (permalink / raw)
To: vbabka, david, rostedt, mhiramat, Alexander.Krabler, hughd, fvdl,
bigeasy, linux-mm, linux-kernel, linux-trace-kernel,
linux-rt-devel
Cc: akpm, surenb, mhocko, jackmanb, hannes, ziy, ljs, riel, liam,
harry, jannh, lance.yang, mathieu.desnoyers, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, apopple,
pfalcato
In-Reply-To: <20260707125925.3725177-1-chenwandun1@gmail.com>
From: Wandun Chen <chenwandun@lixiang.com>
The region covered by mlock[all] may contain CMA pages. cma_alloc installs
migration entries in the page table, if a memory access occurs at this
point, it must wait for the migration to complete, which may cause
latency spikes on the RT kernels.
Try to move the migration cost into the mlock[all] caller, which is
typically a setup path. So reduce the chance of latency spikes on RT
kernels by migrating the currently mapped CMA pages out of CMA region.
Suggested-by: Frank van der Linden <fvdl@google.com>
Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
Link: https://lore.kernel.org/all/CAPTztWZpnX1j8-7yeppVUsxE=O9hbVeqricDjZt8_pnN7a-kBQ@mail.gmail.com/#t
---
mm/mlock.c | 119 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 118 insertions(+), 1 deletion(-)
diff --git a/mm/mlock.c b/mm/mlock.c
index ac65de40b22b..f56c685533f5 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -25,6 +25,7 @@
#include <linux/memcontrol.h>
#include <linux/mm_inline.h>
#include <linux/secretmem.h>
+#include <linux/migrate.h>
#include <linux/compaction.h>
#include "internal.h"
@@ -428,6 +429,119 @@ static int mlock_pte_range(pmd_t *pmd, unsigned long addr,
return 0;
}
+#ifdef CONFIG_CMA
+static int mlock_collect_migratable_pte_range(pmd_t *pmd, unsigned long addr,
+ unsigned long end, struct mm_walk *walk)
+{
+ struct vm_area_struct *vma = walk->vma;
+ struct list_head *folio_list = walk->private;
+ spinlock_t *ptl;
+ pte_t *start_pte, *pte;
+ pte_t ptent;
+ struct folio *folio;
+ unsigned int step = 1;
+
+ if (!(vma->vm_flags & VM_LOCKED))
+ return 0;
+
+ ptl = pmd_trans_huge_lock(pmd, vma);
+ if (ptl) {
+ if (!pmd_present(*pmd)) {
+ if (unlikely(softleaf_is_migration(softleaf_from_pmd(*pmd)))) {
+ spin_unlock(ptl);
+ pmd_migration_entry_wait(vma->vm_mm, pmd);
+ walk->action = ACTION_AGAIN;
+ return 0;
+ }
+ goto out;
+ }
+ if (is_huge_zero_pmd(*pmd))
+ goto out;
+ folio = pmd_folio(*pmd);
+ if (folio_is_zone_device(folio))
+ goto out;
+ if (is_migrate_cma_page(&folio->page))
+ isolate_folio_to_list(folio, folio_list);
+ goto out;
+ }
+
+ start_pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
+ if (!start_pte) {
+ walk->action = ACTION_AGAIN;
+ return 0;
+ }
+
+ for (pte = start_pte; addr != end; pte += step, addr += step * PAGE_SIZE) {
+ step = 1;
+ ptent = ptep_get(pte);
+ if (!pte_present(ptent)) {
+ if (unlikely(softleaf_is_migration(softleaf_from_pte(ptent)))) {
+ pte_unmap_unlock(start_pte, ptl);
+ migration_entry_wait(vma->vm_mm, pmd, addr);
+ walk->action = ACTION_AGAIN;
+ return 0;
+ }
+ continue;
+ }
+ folio = vm_normal_folio(vma, addr, ptent);
+ if (!folio || folio_is_zone_device(folio))
+ continue;
+ step = folio_mlock_step(folio, pte, addr, end);
+ if (is_migrate_cma_page(&folio->page))
+ continue;
+ isolate_folio_to_list(folio, folio_list);
+ }
+ pte_unmap(start_pte);
+out:
+ spin_unlock(ptl);
+ cond_resched();
+ return 0;
+}
+
+static const struct mm_walk_ops mlock_collect_migratable_ops = {
+ .pmd_entry = mlock_collect_migratable_pte_range,
+ .walk_lock = PGWALK_RDLOCK,
+};
+
+static void mlock_migrate_cma_range(unsigned long start, unsigned long len)
+{
+ struct mm_struct *mm = current->mm;
+ unsigned long end = start + len;
+ LIST_HEAD(folio_list);
+ struct migration_target_control mtc = {
+ .nid = NUMA_NO_NODE,
+ .gfp_mask = GFP_HIGHUSER | __GFP_NOWARN,
+ .reason = MR_SYSCALL,
+ };
+
+ if (compaction_allow_unevictable())
+ return;
+
+ lru_cache_disable();
+
+ if (mmap_read_lock_killable(mm))
+ goto out;
+
+ walk_page_range(mm, start, end, &mlock_collect_migratable_ops,
+ &folio_list);
+ mmap_read_unlock(mm);
+
+ if (list_empty(&folio_list))
+ goto out;
+
+ if (migrate_pages(&folio_list, alloc_migration_target, NULL,
+ (unsigned long)&mtc, MIGRATE_SYNC, MR_SYSCALL, NULL))
+ putback_movable_pages(&folio_list);
+out:
+ lru_cache_enable();
+}
+#else
+static inline void mlock_migrate_cma_range(unsigned long start,
+ unsigned long len)
+{
+}
+#endif /* CONFIG_CMA */
+
/*
* mlock_vma_pages_range() - mlock any pages already in the range,
* or munlock all pages in the range.
@@ -678,6 +792,7 @@ static __must_check int do_mlock(unsigned long start, size_t len, vm_flags_t fla
error = __mm_populate(start, len, 0);
if (error)
return __mlock_posix_error_return(error);
+ mlock_migrate_cma_range(start, len);
return 0;
}
@@ -790,8 +905,10 @@ SYSCALL_DEFINE1(mlockall, int, flags)
capable(CAP_IPC_LOCK))
ret = apply_mlockall_flags(flags);
mmap_write_unlock(current->mm);
- if (!ret && (flags & MCL_CURRENT))
+ if (!ret && (flags & MCL_CURRENT)) {
mm_populate(0, TASK_SIZE);
+ mlock_migrate_cma_range(0, TASK_SIZE);
+ }
return ret;
}
--
2.43.0
^ permalink raw reply related
* [PATCH v2 3/4] mm/migrate: add tracepoint for folios unmapped during migration
From: Wandun Chen @ 2026-07-07 12:59 UTC (permalink / raw)
To: vbabka, david, rostedt, mhiramat, Alexander.Krabler, hughd, fvdl,
bigeasy, linux-mm, linux-kernel, linux-trace-kernel,
linux-rt-devel
Cc: akpm, surenb, mhocko, jackmanb, hannes, ziy, ljs, riel, liam,
harry, jannh, lance.yang, mathieu.desnoyers, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, apopple,
pfalcato
In-Reply-To: <20260707125925.3725177-1-chenwandun1@gmail.com>
From: Wandun Chen <chenwandun@lixiang.com>
Add mm_migrate_unmap_folio tracepoint, fired in try_to_migrate_one()
after a folio's mapping has been replaced by a migration entry.
It records the pfn, address, folio flags and vm_flags, making mlocked
folios under migration easy to observe.
Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
---
include/trace/events/migrate.h | 29 +++++++++++++++++++++++++++++
mm/rmap.c | 4 ++++
2 files changed, 33 insertions(+)
diff --git a/include/trace/events/migrate.h b/include/trace/events/migrate.h
index 15ee2ef201b5..1264593ecaee 100644
--- a/include/trace/events/migrate.h
+++ b/include/trace/events/migrate.h
@@ -6,6 +6,7 @@
#define _TRACE_MIGRATE_H
#include <linux/tracepoint.h>
+#include <trace/events/mmflags.h>
#define MIGRATE_MODE \
EM( MIGRATE_ASYNC, "MIGRATE_ASYNC") \
@@ -137,6 +138,34 @@ DEFINE_EVENT(migration_pte, set_migration_pte,
TP_ARGS(addr, pte, order)
);
+TRACE_EVENT(mm_migrate_unmap_folio,
+
+ TP_PROTO(unsigned long pfn, unsigned long addr,
+ unsigned long page_flags, unsigned long vm_flags),
+
+ TP_ARGS(pfn, addr, page_flags, vm_flags),
+
+ TP_STRUCT__entry(
+ __field(unsigned long, pfn)
+ __field(unsigned long, addr)
+ __field(unsigned long, page_flags)
+ __field(unsigned long, vm_flags)
+ ),
+
+ TP_fast_assign(
+ __entry->pfn = pfn;
+ __entry->addr = addr;
+ __entry->page_flags = page_flags;
+ __entry->vm_flags = vm_flags;
+ ),
+
+ TP_printk("pfn=0x%lx addr=0x%lx page_flags=%s vm_flags=%s",
+ __entry->pfn,
+ __entry->addr,
+ show_page_flags(__entry->page_flags & PAGEFLAGS_MASK),
+ show_vma_flags(__entry->vm_flags))
+);
+
DEFINE_EVENT(migration_pte, remove_migration_pte,
TP_PROTO(unsigned long addr, unsigned long pte, int order),
TP_ARGS(addr, pte, order)
diff --git a/mm/rmap.c b/mm/rmap.c
index 3cb7f6337d38..b110548bebae 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -2716,6 +2716,10 @@ static bool try_to_migrate_one(struct folio *folio, struct vm_area_struct *vma,
hugetlb_remove_rmap(folio);
else
folio_remove_rmap_pte(folio, subpage, vma);
+
+ trace_mm_migrate_unmap_folio(folio_pfn(folio), address,
+ folio->flags.f, vma->vm_flags);
+
if (vma->vm_flags & VM_LOCKED)
mlock_drain_local();
folio_put(folio);
--
2.43.0
^ permalink raw reply related
* [PATCH v2 2/4] mm/mlock: wait for migration to finish when mlocking a folio
From: Wandun Chen @ 2026-07-07 12:59 UTC (permalink / raw)
To: vbabka, david, rostedt, mhiramat, Alexander.Krabler, hughd, fvdl,
bigeasy, linux-mm, linux-kernel, linux-trace-kernel,
linux-rt-devel
Cc: akpm, surenb, mhocko, jackmanb, hannes, ziy, ljs, riel, liam,
harry, jannh, lance.yang, mathieu.desnoyers, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, apopple,
pfalcato
In-Reply-To: <20260707125925.3725177-1-chenwandun1@gmail.com>
From: Wandun Chen <chenwandun@lixiang.com>
In RT kernels, sysctl_compact_unevictable_allowed is false by default,
when the mlock/mlockall system call try to lock all the present page,
the mlock_pte_range function skips non-present entries. If these
non-present entries are migration entries, and the migration is not
guaranteed to have completed before the mlock/mlockall, it may result
in a page fault on subsequent access, which then waits for the
migration to finish, causing spike latency in RT kernels.
Fix it by waiting for the migration to complete during the mlock/mlockall
syscall when sysctl_compact_unevictable_allowed is false.
Fixes: 90d07210ab55 ("mm: mlock: use folios and a folio batch internally")
Suggested-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
Link: https://lore.kernel.org/lkml/c8793c0f-7156-4cb7-9e6e-7909397e2fff@kernel.org/#t
---
mm/mlock.c | 23 +++++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)
diff --git a/mm/mlock.c b/mm/mlock.c
index 97e49038d8d3..ac65de40b22b 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -25,6 +25,7 @@
#include <linux/memcontrol.h>
#include <linux/mm_inline.h>
#include <linux/secretmem.h>
+#include <linux/compaction.h>
#include "internal.h"
@@ -361,8 +362,17 @@ static int mlock_pte_range(pmd_t *pmd, unsigned long addr,
ptl = pmd_trans_huge_lock(pmd, vma);
if (ptl) {
- if (!pmd_present(*pmd))
+ if (!pmd_present(*pmd)) {
+ if (unlikely((vma->vm_flags & VM_LOCKED) &&
+ !compaction_allow_unevictable() &&
+ softleaf_is_migration(softleaf_from_pmd(*pmd)))) {
+ spin_unlock(ptl);
+ pmd_migration_entry_wait(vma->vm_mm, pmd);
+ walk->action = ACTION_AGAIN;
+ return 0;
+ }
goto out;
+ }
if (is_huge_zero_pmd(*pmd))
goto out;
folio = pmd_folio(*pmd);
@@ -383,8 +393,17 @@ static int mlock_pte_range(pmd_t *pmd, unsigned long addr,
for (pte = start_pte; addr != end; pte++, addr += PAGE_SIZE) {
ptent = ptep_get(pte);
- if (!pte_present(ptent))
+ if (!pte_present(ptent)) {
+ if (unlikely((vma->vm_flags & VM_LOCKED) &&
+ !compaction_allow_unevictable() &&
+ softleaf_is_migration(softleaf_from_pte(ptent)))) {
+ pte_unmap_unlock(start_pte, ptl);
+ migration_entry_wait(vma->vm_mm, pmd, addr);
+ walk->action = ACTION_AGAIN;
+ return 0;
+ }
continue;
+ }
folio = vm_normal_folio(vma, addr, ptent);
if (!folio || folio_is_zone_device(folio))
continue;
--
2.43.0
^ permalink raw reply related
* [PATCH v2 1/4] mm/migrate: do not migrate folios mapped into VM_LOCKED VMAs under compaction
From: Wandun Chen @ 2026-07-07 12:59 UTC (permalink / raw)
To: vbabka, david, rostedt, mhiramat, Alexander.Krabler, hughd, fvdl,
bigeasy, linux-mm, linux-kernel, linux-trace-kernel,
linux-rt-devel
Cc: akpm, surenb, mhocko, jackmanb, hannes, ziy, ljs, riel, liam,
harry, jannh, lance.yang, mathieu.desnoyers, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, apopple,
pfalcato
In-Reply-To: <20260707125925.3725177-1-chenwandun1@gmail.com>
From: Wandun Chen <chenwandun@lixiang.com>
When compact_unevictable_allowed=0, unevictable pages should not be
migrated. However, mlock_folio_batch in the mlock[all] syscall introduces
a race, mlock_folio() sets PG_mlocked immediately but defers PG_unevictable
to mlock_folio_batch(), causing pages that are about to become unevictable
to be migrated, which violates the intent of compact_unevictable_allowed,
and causes spike latency in RT kernels [1].
In order to fix this, migration is forbidden for pages mapped into VMAs
marked with VM_LOCKED. In addition, two early-return paths are introduced,
filter out mlocked pages, return early to avoid unnecessary operations.
Fixes: 90d07210ab55 ("mm: mlock: use folios and a folio batch internally")
Reported-by: Alexander Krabler <Alexander.Krabler@kuka.com>
Closes: https://lore.kernel.org/all/DU0PR01MB10385345F7153F334100981888259A@DU0PR01MB10385.eurprd01.prod.exchangelabs.com/ [1]
Suggested-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
Link: https://lore.kernel.org/linux-rt-users/33275585-f2db-4779-89f0-3ae24b455a67@suse.cz/#t
---
include/linux/compaction.h | 6 ++++++
include/linux/rmap.h | 3 +++
mm/compaction.c | 8 +++++++-
mm/migrate.c | 23 +++++++++++++++++++----
mm/rmap.c | 12 +++++++++---
5 files changed, 44 insertions(+), 8 deletions(-)
diff --git a/include/linux/compaction.h b/include/linux/compaction.h
index f29ef0653546..04e60f65b976 100644
--- a/include/linux/compaction.h
+++ b/include/linux/compaction.h
@@ -106,6 +106,7 @@ bool compaction_zonelist_suitable(struct alloc_context *ac, int order,
extern void __meminit kcompactd_run(int nid);
extern void __meminit kcompactd_stop(int nid);
extern void wakeup_kcompactd(pg_data_t *pgdat, int order, int highest_zoneidx);
+extern bool compaction_allow_unevictable(void);
#else
static inline void reset_isolation_suitable(pg_data_t *pgdat)
@@ -131,6 +132,11 @@ static inline void wakeup_kcompactd(pg_data_t *pgdat,
{
}
+static inline bool compaction_allow_unevictable(void)
+{
+ return true;
+}
+
#endif /* CONFIG_COMPACTION */
struct node;
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index 8dc0871e5f00..359c7426b6b9 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -102,6 +102,9 @@ enum ttu_flags {
* do a final flush if necessary */
TTU_RMAP_LOCKED = 0x80, /* do not grab rmap lock:
* caller holds it */
+ TTU_RESPECT_MLOCK = 0x100,/* leave VM_LOCKED vmas mapped instead
+ * of installing a migration entry
+ */
};
#ifdef CONFIG_MMU
diff --git a/mm/compaction.c b/mm/compaction.c
index f08765ade014..5d256930e389 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -1116,7 +1116,8 @@ isolate_migratepages_block(struct compact_control *cc, unsigned long low_pfn,
is_unevictable = folio_test_unevictable(folio);
/* Compaction might skip unevictable pages but CMA takes them */
- if (!(mode & ISOLATE_UNEVICTABLE) && is_unevictable)
+ if (!(mode & ISOLATE_UNEVICTABLE) &&
+ (is_unevictable || folio_test_mlocked(folio)))
goto isolate_fail_put;
/*
@@ -1898,6 +1899,11 @@ typedef enum {
* compactable pages.
*/
static int sysctl_compact_unevictable_allowed __read_mostly = CONFIG_COMPACT_UNEVICTABLE_DEFAULT;
+
+bool compaction_allow_unevictable(void)
+{
+ return sysctl_compact_unevictable_allowed;
+}
/*
* Tunable for proactive compaction. It determines how
* aggressively the kernel should compact memory in the
diff --git a/mm/migrate.c b/mm/migrate.c
index a786549551e3..3a15eb13e82b 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1202,7 +1202,7 @@ static void migrate_folio_done(struct folio *src,
static int migrate_folio_unmap(new_folio_t get_new_folio,
free_folio_t put_new_folio, unsigned long private,
struct folio *src, struct folio **dstp, enum migrate_mode mode,
- struct list_head *ret)
+ struct list_head *ret, enum migrate_reason reason)
{
struct folio *dst;
int rc = -EAGAIN;
@@ -1210,6 +1210,7 @@ static int migrate_folio_unmap(new_folio_t get_new_folio,
struct anon_vma *anon_vma = NULL;
bool locked = false;
bool dst_locked = false;
+ enum ttu_flags ttu = 0;
dst = get_new_folio(src, private);
if (!dst)
@@ -1249,9 +1250,15 @@ static int migrate_folio_unmap(new_folio_t get_new_folio,
folio_lock(src);
}
locked = true;
- if (folio_test_mlocked(src))
+ if (folio_test_mlocked(src)) {
old_folio_state |= FOLIO_WAS_MLOCKED;
+ if (reason == MR_COMPACTION && !compaction_allow_unevictable()) {
+ rc = -EBUSY;
+ goto out;
+ }
+ }
+
if (folio_test_writeback(src)) {
/*
* Only in the case of a full synchronous migration is it
@@ -1324,7 +1331,14 @@ static int migrate_folio_unmap(new_folio_t get_new_folio,
/* Establish migration ptes */
VM_BUG_ON_FOLIO(folio_test_anon(src) &&
!folio_test_ksm(src) && !anon_vma, src);
- try_to_migrate(src, mode == MIGRATE_ASYNC ? TTU_BATCH_FLUSH : 0);
+
+ if (mode == MIGRATE_ASYNC)
+ ttu |= TTU_BATCH_FLUSH;
+
+ if (reason == MR_COMPACTION && !compaction_allow_unevictable())
+ ttu |= TTU_RESPECT_MLOCK;
+
+ try_to_migrate(src, ttu);
old_folio_state |= FOLIO_WAS_MAPPED;
}
@@ -1905,7 +1919,8 @@ static int migrate_pages_batch(struct list_head *from,
}
rc = migrate_folio_unmap(get_new_folio, put_new_folio,
- private, folio, &dst, mode, ret_folios);
+ private, folio, &dst, mode, ret_folios,
+ reason);
/*
* The rules are:
* 0: folio will be put on unmap_folios list,
diff --git a/mm/rmap.c b/mm/rmap.c
index 0fb7a1b82cf3..3cb7f6337d38 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -2420,6 +2420,9 @@ static bool try_to_migrate_one(struct folio *folio, struct vm_area_struct *vma,
unsigned long pfn;
unsigned long hsz = 0;
+ if ((flags & TTU_RESPECT_MLOCK) && (vma->vm_flags & VM_LOCKED))
+ return false;
+
/*
* When racing against e.g. zap_pte_range() on another cpu,
* in between its ptep_get_and_clear_full() and folio_remove_rmap_*(),
@@ -2741,11 +2744,14 @@ void try_to_migrate(struct folio *folio, enum ttu_flags flags)
};
/*
- * Migration always ignores mlock and only supports TTU_RMAP_LOCKED and
- * TTU_SPLIT_HUGE_PMD, TTU_SYNC, and TTU_BATCH_FLUSH flags.
+ * Migration normally ignores mlock, but TTU_RESPECT_MLOCK asks it to
+ * leave folios mapped into VM_LOCKED vmas alone. Only TTU_RMAP_LOCKED,
+ * TTU_SPLIT_HUGE_PMD, TTU_SYNC, TTU_BATCH_FLUSH and TTU_RESPECT_MLOCK
+ * are supported.
*/
if (WARN_ON_ONCE(flags & ~(TTU_RMAP_LOCKED | TTU_SPLIT_HUGE_PMD |
- TTU_SYNC | TTU_BATCH_FLUSH)))
+ TTU_SYNC | TTU_BATCH_FLUSH |
+ TTU_RESPECT_MLOCK)))
return;
if (folio_is_zone_device(folio) &&
--
2.43.0
^ permalink raw reply related
* [PATCH v2 0/4] mm: honour compact_unevictable_allowed in mlock and CMA paths
From: Wandun Chen @ 2026-07-07 12:59 UTC (permalink / raw)
To: vbabka, david, rostedt, mhiramat, Alexander.Krabler, hughd, fvdl,
bigeasy, linux-mm, linux-kernel, linux-trace-kernel,
linux-rt-devel
Cc: akpm, surenb, mhocko, jackmanb, hannes, ziy, ljs, riel, liam,
harry, jannh, lance.yang, mathieu.desnoyers, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, apopple,
pfalcato
From: Wandun Chen <chenwandun@lixiang.com>
vm.compact_unevictable_allowed=0 (the default on RT) is meant to keep
compaction from touching unevictable folios. Several paths still migrate
folios that are about to become unevictable, or in CMA regions,
installing migration entries that a later access must wait on, then
causing latency spikes on RT kernels.
This series fixes those paths and adds a tracepoint for diagnosis. It is
a rework of the RFC [1] per review feedback, mainly from Vlastimil.
RFC --> v2:
1. On top of the isolate-path filtering, also filter by VM_LOCKED
during the migration unmap step.
2. Make mlock/mlockall wait for in-flight migration entries, ensuring
the folio is on the unevictable LRU before mlock[all] returns.
3. Dropped letting CMA migration take unevictable folios; instead
migrate CMA folios out during mlock[all], avoiding migration at
cma_alloc time.
4. Moved the tracepoint to the migration unmap path.
[1] https://lore.kernel.org/lkml/20260604023812.3700316-1-chenwandun1@gmail.com/
Wandun Chen (4):
mm/migrate: do not migrate folios mapped into VM_LOCKED VMAs under
compaction
mm/mlock: wait for migration to finish when mlocking a folio
mm/migrate: add tracepoint for folios unmapped during migration
mm/mlock: migrate folios out of CMA when mlocking a range
include/linux/compaction.h | 6 ++
include/linux/rmap.h | 3 +
include/trace/events/migrate.h | 29 +++++++
mm/compaction.c | 8 +-
mm/migrate.c | 23 +++++-
mm/mlock.c | 142 ++++++++++++++++++++++++++++++++-
mm/rmap.c | 16 +++-
7 files changed, 216 insertions(+), 11 deletions(-)
--
2.43.0
^ permalink raw reply
* Re: [PATCH v3 04/11] arm64/mm: Add set_memory_device() and set_memory_normal()
From: Robin Murphy @ 2026-07-07 12:15 UTC (permalink / raw)
To: Thierry Reding, Will Deacon
Cc: Rob Herring, Krzysztof Kozlowski, Conor Dooley, Jonathan Hunter,
David Airlie, Simona Vetter, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, Sowjanya Komatineni, Luca Ceresoli,
Mikko Perttunen, Yury Norov, Rasmus Villemoes, Russell King,
Alexander Gordeev, Gerald Schaefer, Heiko Carstens, Vasily Gorbik,
Christian Borntraeger, Sven Schnelle, Andrew Morton,
David Hildenbrand, Lorenzo Stoakes, Liam R. Howlett,
Vlastimil Babka, Mike Rapoport, Suren Baghdasaryan, Michal Hocko,
Marek Szyprowski, Sumit Semwal, Benjamin Gaignard, Brian Starkey,
John Stultz, T.J. Mercier, Christian König, Steven Rostedt,
Masami Hiramatsu, Mathieu Desnoyers, Catalin Marinas,
Thierry Reding, devicetree, linux-tegra, linux-kernel, dri-devel,
linux-media, linux-arm-kernel, linux-s390, linux-mm, iommu,
linaro-mm-sig, linux-trace-kernel, Thierry Reding, Chun Ng
In-Reply-To: <akuvyu1Pq0ZVMZV0@orome>
On 06/07/2026 2:49 pm, Thierry Reding wrote:
> On Fri, Jul 03, 2026 at 06:13:31PM +0100, Will Deacon wrote:
>> On Thu, Jul 02, 2026 at 06:41:23PM +0200, Thierry Reding wrote:
>>> On Thu, Jul 02, 2026 at 03:46:44PM +0200, Thierry Reding wrote:
>>>> On Thu, Jul 02, 2026 at 10:18:47AM +0100, Will Deacon wrote:
>>>>> On Wed, Jul 01, 2026 at 06:08:15PM +0200, Thierry Reding wrote:
>>>>>> From: Chun Ng <chunn@nvidia.com>
>>>>>>
>>>>>> Add helpers to swap PROT_NORMAL and PROT_DEVICE_nGnRnE protection bits
>>>>>> on a kernel-linear-map range.
>>>>>
>>>>> That sounds like a really terrible idea. Why is this necessary and how
>>>>> does it interact with things like load_unaligned_zeropad()?
>>>>
>>>> This is necessary because once the memory controller has walled off the
>>>> new memory region the CPU must not access it under any circumstances or
>>>> it'll cause the CPU to lock up (I think technically it'll hit an SError
>>>> but in practice that just means it'll freeze, as far as I can tell).
>>>>
>>>> Probably doesn't interact well at all with load_unaligned_zeropad().
>>>>
>>>>> I think you should unmap the memory from the linear map and memremap()
>>>>> it instead.
>>>>
>>>> Given that the memory can never be accessed by the CPU after the memory
>>>> controller locks it down, I don't think we'll even need memremap(). The
>>>> only thing we really need is the sg_table we hand out via the DMA BUFs
>>>> so that they can be used by device drivers to program their DMA engines
>>>> internally.
>>>>
>>>> Looking through some of the architecture code around this, shouldn't we
>>>> simply be using set_memory_encrypted() and set_memory_decrypted() for
>>>> this? While they might've been created for slightly other use-cases,
>>>> they seem to be doing exactly what we want (i.e. remove the page range
>>>> from the linear mapping and flushing it, or restoring the valid bit and
>>>> standard permissions, respectively).
>>>
>>> Ah... I guess we can't do it because we're not in a realm world and so
>>> the early checks in __set_memory_enc_dec() would return early and turn
>>> it into a no-op.
>>>
>>> How about if I extract a common helper and provide set_memory_p() and
>>> set_memory_np() in terms of those. Those are available on x86 and
>>> PowerPC as well, so fairly standard. I suppose at that point we're
>>> closer to set_memory_valid().
>>
>> Why not just call set_direct_map_invalid_noflush() +
>> flush_tlb_kernel_range() for each page? We already have APIs for this.
>
> Having a "standard" helper with a fixed and documented purposed seemed
> like a preferable approach for this particular case. We also may want to
> make the driver that uses this buildable as a module, in which case we'd
> need to export these rather low-level APIs. And then there's also the
> fact that we typically call this on a rather large region of memory
> (usually something like 512 MiB), so doing it page-by-page is rather
> suboptimal.
>
>> The big challenge I see with any linear map manipulation, however, is
>> that it will rely on can_set_direct_map() which likely means you need to
>> give up some performance and/or security to make this work. Does memory
>> become inaccesible dynamically at runtime? If not, the best bet would
>> be to describe it as a carveout in the DT and mark it as "no-map" so
>> we avoid mapping it in the first place.
>
> VPR exists in two modes: static and resizable. For static VPR we do
> exactly that: describe it as carveout in DT with no-map and deal with it
> accordingly in the driver. Resizable VPR is for device that have small
> amounts of RAM. Content-protected video playback will in the worst case
> consume around 1.8 GiB of RAM, so we want to be able to reuse for other
> purposes when VPR is unused on those devices. In that case, the memory
> is also described as a reserved-memory region in DT, but it is marked as
> reusable so that it can be managed by CMA.
OK, so this is dynamic TrustZone, which is essentially identical to CCA
delegation as far as we're concerned from the Non-Secure side. IIRC
there was some ongoing talk about explicitly keeping track of the state
of physical memory ranges in terms of being delegated to CoCo VMs or
not, so eventually plumbing a "delegated to TEE/other" state through all
the same mechanisms seems a pretty achievable goal.
For now, though, firstly I'll note we have seen this sort of thing before:
https://lore.kernel.org/dri-devel/20240515112308.10171-1-yong.wu@mediatek.com/
although that didn't seem to need explicit unmapping (likely it involved
a TrustZone controller that just made NS accesses RAZ/WI instead of
external-aborting).
If you want to be nice and start trying to build the general abstraction
for this, then as a first step I'd suggest following the shape of the
current CCA machinery - build a "delegate to TEE" operation around the
existing set_memory_valid() paradigm[1] with can_set_direct_map()
safeguards, and have something like a have_dynamic_tz() that echoes
is_realm_world() in terms of being set at boot when one of these regions
is detected by the early reserved-memory parsing, then considered in
force_pte_mapping() (such that it only matters if BBML3 doesn't already
have us covered).
Thanks,
Robin.
[1] Personally I'd be inclined to stay away from set_memory_*crypted()
until that mess gets sorted out properly, but the argument could also be
made the other way that the "delegated" state is currently mixed up in
"encrypted", so technically it wouldn't be entirely inaccurate to use,
it would just mean that we're intentionally adding more to that cleanup
effort. For now it seems nicer to me to keep a distinct "made invalid
(due to delegation)" state that can eventually converge into a proper
"delegated" state once that exists, rather than get mixed up in the
current
guest-shared/guest-private/host-shared/host-private/host-delegated mess
most of which is not relevant for non-CoCo uses.
> The resize operation is fairly slow to begin with because we need to
> stall the GPU and put it into reset before the operation, then take it
> out of reset and resume it afterwards.
>
> What kind of performance impact do you expect?
>
> Thierry
^ permalink raw reply
* [PATCH] riscv: ftrace: reject out-of-range non-direct targets
From: Rui Qi @ 2026-07-07 12:12 UTC (permalink / raw)
To: rostedt, mhiramat
Cc: mark.rutland, pjw, palmer, aou, alex, linux-kernel,
linux-trace-kernel, linux-riscv, Rui Qi
RISC-V initializes the AUIPC half of each ftrace callsite to reach
ftrace_caller and later only patches the JALR instruction. The old
ftrace_make_call() code redirected any requested target outside the
JALR immediate range back to FTRACE_ADDR.
That fallback is only valid for direct-call targets, where
ftrace_caller can still dispatch through op->direct_call. For an
ops-specific trampoline, the generic ftrace core requested a call to
ops->trampoline. Redirecting the site to FTRACE_ADDR instead enters
ftrace_caller and invokes op->func, bypassing that trampoline.
ftrace_modify_call() had the same issue more directly: it ignored
old_addr and addr and always validated and updated the site as
FTRACE_ADDR.
Add a helper to resolve call targets consistently. Keep targets that
fit in the existing AUIPC/JALR window, redirect only out-of-range
direct-call targets through FTRACE_ADDR, and reject other out-of-range
targets. Use the resolved old and new targets in ftrace_modify_call()
so the architecture implementation follows the generic contract.
Signed-off-by: Rui Qi <qirui.001@bytedance.com>
---
arch/riscv/kernel/ftrace.c | 79 +++++++++++++++++++++++++++++++-------
1 file changed, 65 insertions(+), 14 deletions(-)
diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c
index b430edfb83f4..26604bbc4bb5 100644
--- a/arch/riscv/kernel/ftrace.c
+++ b/arch/riscv/kernel/ftrace.c
@@ -46,16 +46,19 @@ void arch_ftrace_update_code(int command)
flush_icache_all();
}
-static int __ftrace_modify_call(unsigned long source, unsigned long target, bool validate)
+static int __ftrace_modify_call(unsigned long source, unsigned long old,
+ unsigned long target, bool validate)
{
- unsigned int call[2], offset;
+ unsigned int call[2], old_call[2], offset;
unsigned int replaced[2];
offset = target - source;
call[1] = to_jalr_t0(offset);
if (validate) {
- call[0] = to_auipc_t0(offset);
+ offset = old - source;
+ old_call[0] = to_auipc_t0(offset);
+ old_call[1] = to_jalr_t0(offset);
/*
* Read the text we want to modify;
* return must be -EFAULT on read error
@@ -63,9 +66,10 @@ static int __ftrace_modify_call(unsigned long source, unsigned long target, bool
if (copy_from_kernel_nofault(replaced, (void *)source, 2 * MCOUNT_INSN_SIZE))
return -EFAULT;
- if (replaced[0] != call[0]) {
- pr_err("%p: expected (%08x) but got (%08x)\n",
- (void *)source, call[0], replaced[0]);
+ if (replaced[0] != old_call[0] || replaced[1] != old_call[1]) {
+ pr_err("%p: expected (%08x %08x) but got (%08x %08x)\n",
+ (void *)source, old_call[0], old_call[1],
+ replaced[0], replaced[1]);
return -EINVAL;
}
}
@@ -77,6 +81,46 @@ static int __ftrace_modify_call(unsigned long source, unsigned long target, bool
return 0;
}
+static bool ftrace_call_target_in_range(unsigned long addr)
+{
+ unsigned long ftrace_addr = FTRACE_ADDR;
+ unsigned long distance;
+
+ distance = addr > ftrace_addr ? addr - ftrace_addr : ftrace_addr - addr;
+
+ return distance <= JALR_RANGE;
+}
+
+static int ftrace_resolve_call_addr(struct dyn_ftrace *rec, unsigned long addr,
+ unsigned long *target)
+{
+ unsigned long direct;
+
+ /*
+ * The AUIPC instruction is initialized for ftrace_caller and this
+ * implementation only patches the JALR instruction afterwards. Targets
+ * that fit in the existing AUIPC/JALR window can be called as-is.
+ */
+ if (ftrace_call_target_in_range(addr)) {
+ *target = addr;
+ return 0;
+ }
+
+ /*
+ * Out-of-range direct-call targets can still be reached through the
+ * ftrace_caller path, which dispatches via op->direct_call. Do not use
+ * this fallback for ops-specific trampolines, because ftrace_caller
+ * invokes op->func and would not preserve the requested trampoline.
+ */
+ direct = ftrace_find_rec_direct(rec->ip);
+ if (direct && addr == direct) {
+ *target = FTRACE_ADDR;
+ return 0;
+ }
+
+ return -EINVAL;
+}
+
#ifdef CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS
static const struct ftrace_ops *riscv64_rec_get_ops(struct dyn_ftrace *rec)
{
@@ -116,19 +160,18 @@ static int ftrace_rec_update_ops(struct dyn_ftrace *rec) { return 0; }
int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
{
- unsigned long distance, orig_addr, pc = rec->ip - MCOUNT_AUIPC_SIZE;
+ unsigned long pc = rec->ip - MCOUNT_AUIPC_SIZE;
int ret;
- ret = ftrace_rec_update_ops(rec);
+ ret = ftrace_resolve_call_addr(rec, addr, &addr);
if (ret)
return ret;
- orig_addr = (unsigned long)&ftrace_caller;
- distance = addr > orig_addr ? addr - orig_addr : orig_addr - addr;
- if (distance > JALR_RANGE)
- addr = FTRACE_ADDR;
+ ret = ftrace_rec_update_ops(rec);
+ if (ret)
+ return ret;
- return __ftrace_modify_call(pc, addr, false);
+ return __ftrace_modify_call(pc, 0, addr, false);
}
int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec, unsigned long addr)
@@ -215,11 +258,19 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
unsigned long caller = rec->ip - MCOUNT_AUIPC_SIZE;
int ret;
+ ret = ftrace_resolve_call_addr(rec, old_addr, &old_addr);
+ if (ret)
+ return ret;
+
+ ret = ftrace_resolve_call_addr(rec, addr, &addr);
+ if (ret)
+ return ret;
+
ret = ftrace_rec_update_ops(rec);
if (ret)
return ret;
- return __ftrace_modify_call(caller, FTRACE_ADDR, true);
+ return __ftrace_modify_call(caller, old_addr, addr, true);
}
#endif
--
2.20.1
^ permalink raw reply related
* Re: [PATCH v3 04/11] arm64/mm: Add set_memory_device() and set_memory_normal()
From: Will Deacon @ 2026-07-07 11:27 UTC (permalink / raw)
To: Thierry Reding
Cc: Rob Herring, Krzysztof Kozlowski, Conor Dooley, Jonathan Hunter,
David Airlie, Simona Vetter, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, Sowjanya Komatineni, Luca Ceresoli,
Mikko Perttunen, Yury Norov, Rasmus Villemoes, Russell King,
Alexander Gordeev, Gerald Schaefer, Heiko Carstens, Vasily Gorbik,
Christian Borntraeger, Sven Schnelle, Andrew Morton,
David Hildenbrand, Lorenzo Stoakes, Liam R. Howlett,
Vlastimil Babka, Mike Rapoport, Suren Baghdasaryan, Michal Hocko,
Marek Szyprowski, Robin Murphy, Sumit Semwal, Benjamin Gaignard,
Brian Starkey, John Stultz, T.J. Mercier, Christian König,
Steven Rostedt, Masami Hiramatsu, Mathieu Desnoyers,
Catalin Marinas, Thierry Reding, devicetree, linux-tegra,
linux-kernel, dri-devel, linux-media, linux-arm-kernel,
linux-s390, linux-mm, iommu, linaro-mm-sig, linux-trace-kernel,
Thierry Reding, Chun Ng
In-Reply-To: <akuvyu1Pq0ZVMZV0@orome>
On Mon, Jul 06, 2026 at 03:49:24PM +0200, Thierry Reding wrote:
> On Fri, Jul 03, 2026 at 06:13:31PM +0100, Will Deacon wrote:
> > On Thu, Jul 02, 2026 at 06:41:23PM +0200, Thierry Reding wrote:
> > > On Thu, Jul 02, 2026 at 03:46:44PM +0200, Thierry Reding wrote:
> > > > On Thu, Jul 02, 2026 at 10:18:47AM +0100, Will Deacon wrote:
> > > > > On Wed, Jul 01, 2026 at 06:08:15PM +0200, Thierry Reding wrote:
> > > > > > From: Chun Ng <chunn@nvidia.com>
> > > > > >
> > > > > > Add helpers to swap PROT_NORMAL and PROT_DEVICE_nGnRnE protection bits
> > > > > > on a kernel-linear-map range.
> > > > >
> > > > > That sounds like a really terrible idea. Why is this necessary and how
> > > > > does it interact with things like load_unaligned_zeropad()?
> > > >
> > > > This is necessary because once the memory controller has walled off the
> > > > new memory region the CPU must not access it under any circumstances or
> > > > it'll cause the CPU to lock up (I think technically it'll hit an SError
> > > > but in practice that just means it'll freeze, as far as I can tell).
> > > >
> > > > Probably doesn't interact well at all with load_unaligned_zeropad().
> > > >
> > > > > I think you should unmap the memory from the linear map and memremap()
> > > > > it instead.
> > > >
> > > > Given that the memory can never be accessed by the CPU after the memory
> > > > controller locks it down, I don't think we'll even need memremap(). The
> > > > only thing we really need is the sg_table we hand out via the DMA BUFs
> > > > so that they can be used by device drivers to program their DMA engines
> > > > internally.
> > > >
> > > > Looking through some of the architecture code around this, shouldn't we
> > > > simply be using set_memory_encrypted() and set_memory_decrypted() for
> > > > this? While they might've been created for slightly other use-cases,
> > > > they seem to be doing exactly what we want (i.e. remove the page range
> > > > from the linear mapping and flushing it, or restoring the valid bit and
> > > > standard permissions, respectively).
> > >
> > > Ah... I guess we can't do it because we're not in a realm world and so
> > > the early checks in __set_memory_enc_dec() would return early and turn
> > > it into a no-op.
> > >
> > > How about if I extract a common helper and provide set_memory_p() and
> > > set_memory_np() in terms of those. Those are available on x86 and
> > > PowerPC as well, so fairly standard. I suppose at that point we're
> > > closer to set_memory_valid().
> >
> > Why not just call set_direct_map_invalid_noflush() +
> > flush_tlb_kernel_range() for each page? We already have APIs for this.
>
> Having a "standard" helper with a fixed and documented purposed seemed
> like a preferable approach for this particular case. We also may want to
> make the driver that uses this buildable as a module, in which case we'd
> need to export these rather low-level APIs. And then there's also the
> fact that we typically call this on a rather large region of memory
> (usually something like 512 MiB), so doing it page-by-page is rather
> suboptimal.
>
> > The big challenge I see with any linear map manipulation, however, is
> > that it will rely on can_set_direct_map() which likely means you need to
> > give up some performance and/or security to make this work. Does memory
> > become inaccesible dynamically at runtime? If not, the best bet would
> > be to describe it as a carveout in the DT and mark it as "no-map" so
> > we avoid mapping it in the first place.
>
> VPR exists in two modes: static and resizable. For static VPR we do
> exactly that: describe it as carveout in DT with no-map and deal with it
> accordingly in the driver. Resizable VPR is for device that have small
> amounts of RAM. Content-protected video playback will in the worst case
> consume around 1.8 GiB of RAM, so we want to be able to reuse for other
> purposes when VPR is unused on those devices. In that case, the memory
> is also described as a reserved-memory region in DT, but it is marked as
> reusable so that it can be managed by CMA.
>
> The resize operation is fairly slow to begin with because we need to
> stall the GPU and put it into reset before the operation, then take it
> out of reset and resume it afterwards.
>
> What kind of performance impact do you expect?
You'll need to measure it, but we've seen reports of double-digit
percentage regressions in performance and power. As I said, the problem
is that you need to split the linear map to 4k page at runtime to unmap
the dynamic carveout, but that isn't something that can be done on most
CPUs. Therefore you end up having to use page-granular mappings for the
entire thing, similarly to how 'rodata_full' drives can_set_direct_map()
and the perf/power hit affects everything.
It's hard to know what to suggest... I wonder if any of the memory
hotplug logic could help here?
Will
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox