From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f74.google.com (mail-wr1-f74.google.com [209.85.221.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F1413371047 for ; Fri, 27 Feb 2026 10:56:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.74 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772189800; cv=none; b=gb9XXtAWOdL3umr05EKUkV0Bnq4RT6yyPgKlqdtLr5cldf9aFYGMUyW+wWhvbCg/6GZ0nxxGfgzu+hbGoo73sEXlro732hSCMtOdq/IqAlyDLb+dwkJyc6igAWQconOiHyo1guNf21ckFtoJIf7BdGphp50RMV3SWQmt5ojrqbg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772189800; c=relaxed/simple; bh=xDtqRKF0tvrS9tPaSQgnx+rbdnr6x17jPY+xOOOB33k=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=cvEHzaZhu0HS+nGJGGtkAbauYkKli1WlO2zGjTI7T/fHDLgx2OQqE4M4lhTrBB1ii2SLVt0gdB2Su59AdSQfW04hs5LFxMfPDVxuY9f9ZnHewUZBds+RYoYxoAwwNxPpd1r7dT3BtmoQ55zFGLBB6TrJjJP9MU27YkkMYxHIv7I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--jackmanb.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=nspx0CMd; arc=none smtp.client-ip=209.85.221.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--jackmanb.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="nspx0CMd" Received: by mail-wr1-f74.google.com with SMTP id ffacd0b85a97d-43992d6398fso1933242f8f.1 for ; Fri, 27 Feb 2026 02:56:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1772189796; x=1772794596; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=bGo8QZoLApXkf2JlvhH1g4xJEOldvoQquuaR7r0ubZ8=; b=nspx0CMdKoOQR6Ewt0YkiVdBBkXFWmJeUJDZSd6sV0ziPjSyA02vlpdP7XTPWScs0V JGaCzjmOey6mt1x2ed9AC8VSNMdw1WtHo/iL5Y+Z7xmHODqrB4eWHFMfIaDzvJ9NM1/g 3DLNzvcqEtFce2gMqQ+lFEjsjc5FuMHnr9WBLgcNOPTUxjMcgieUtYWPOAnsF8hNvQW9 5O85oL+TyVXKmSX0iPkem4csMMN5EAwnmKCBOAF96+YTYCfywokzsL1XTGnsbKSGQjuD vwA3qX2IZXTYIFl2w1B0xxOuPHorp9J7wkYkmOAD67CHzpD9UJKTDn+B3qCFtIYjxZ8W eHsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772189796; x=1772794596; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=bGo8QZoLApXkf2JlvhH1g4xJEOldvoQquuaR7r0ubZ8=; b=cMnPSrDId2yvAuh5HJTuQJrHnC+TcVR1WTZ4V0CK8hVplihR869MW9nCMFfTOgHJcL HS/kqjP2QIx64z5YM3p4OapTjuwlVgc/Rb+ecstNgRTosS0pJFXv0jkadLjCx76H6V1s /8vEnHe2x8vlEOgJvvhcteThNALiQ7TZgv4+cRKz7/zjvl3/Vzy2/5W0E1gQ7SggWpuN /VZ7AqeiwQd9WGODasDlZH7ZOVJoe+pg18tAZB4OJgZ7FhiQ/9TJnz+6sApisER6df2l 6sLHIXUTubBFc767QGv4gDD2eWTUodwb7l1e0U9JMAhr0zRg//V+LE1RKi/AZWDKEb28 oalQ== X-Forwarded-Encrypted: i=1; AJvYcCXxS8YEGaW4YXFSlne+rA6WM0Iz4zIhbFbL4/fopSS9LwSljjce5+tKDtAf/ZVYs+RJbsZlyUapUVXhed8=@vger.kernel.org X-Gm-Message-State: AOJu0YyRakMsEtladwo3AKPQfo6RYwR/S6Xx7NWudve79Sq5lZ/JrmV2 Jkx9boACdX1/BOrRNHC/zbz/wsDdgR10CkAq4c92zwlwYAEgd6dQtEK9gMMxdH7D6epR+HSIx1A G+74su4+2DRUPYQ== X-Received: from wrbei4.prod.google.com ([2002:a05:6000:4184:b0:439:7b98:f67e]) (user=jackmanb job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6000:18a9:b0:430:f3fb:35fa with SMTP id ffacd0b85a97d-4399de2d883mr3470141f8f.57.1772189795855; Fri, 27 Feb 2026 02:56:35 -0800 (PST) Date: Fri, 27 Feb 2026 10:56:35 +0000 In-Reply-To: <20260225-page_alloc-unmapped-v1-17-e8808a03cd66@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260225-page_alloc-unmapped-v1-0-e8808a03cd66@google.com> <20260225-page_alloc-unmapped-v1-17-e8808a03cd66@google.com> X-Mailer: aerc 0.21.0 Message-ID: Subject: Re: [PATCH RFC 17/19] mm/page_alloc: implement __GFP_UNMAPPED allocations From: Brendan Jackman To: Brendan Jackman , Borislav Petkov , Dave Hansen , Peter Zijlstra , Andrew Morton , David Hildenbrand , Lorenzo Stoakes , Vlastimil Babka , Wei Xu , Johannes Weiner , Zi Yan Cc: , , , , Sumit Garg , , , Will Deacon , , "Kalyazin, Nikita" , , "Itazuri, Takahiro" , Andy Lutomirski , David Kaplan , Thomas Gleixner , Yosry Ahmed Content-Type: text/plain; charset="UTF-8" More bugs found by AI... (I am not relaying all of the issues, just the interesting ones/ones in the most interesting bits of code). On Wed Feb 25, 2026 at 4:34 PM UTC, Brendan Jackman wrote: > +/* Try to allocate a page by mapping/unmapping a block from the direct map. */ > +static inline struct page * > +__rmqueue_direct_map(struct zone *zone, unsigned int request_order, > + unsigned int alloc_flags, freetype_t freetype) > +{ > + unsigned int ft_flags_other = freetype_flags(freetype) ^ FREETYPE_UNMAPPED; > + freetype_t ft_other = migrate_to_freetype(free_to_migratetype(freetype), > + ft_flags_other); > + bool want_mapped = !(freetype_flags(freetype) & FREETYPE_UNMAPPED); > + enum rmqueue_mode rmqm = RMQUEUE_NORMAL; > + unsigned long irq_flags; > + int nr_pageblocks; > + struct page *page; > + int alloc_order; > + int err; > + > + if (freetype_idx(ft_other) < 0) > + return NULL; > + > + /* > + * Might need a TLB shootdown. Even if IRQs are on this isn't > + * safe if the caller holds a lock (in case the other CPUs need that > + * lock to handle the shootdown IPI). > + */ > + if (alloc_flags & ALLOC_NOBLOCK) > + return NULL; > + > + if (!can_set_direct_map()) > + return NULL; > + > + lockdep_assert(!irqs_disabled() || unlikely(early_boot_irqs_disabled)); > + > + /* > + * Need to [un]map a whole pageblock (otherwise it might require > + * allocating pagetables). First allocate it. > + */ > + alloc_order = max(request_order, pageblock_order); > + nr_pageblocks = 1 << (alloc_order - pageblock_order); > + spin_lock_irqsave(&zone->lock, irq_flags); > + page = __rmqueue(zone, alloc_order, ft_other, alloc_flags, &rmqm); > + spin_unlock_irqrestore(&zone->lock, irq_flags); > + if (!page) > + return NULL; > + > + /* > + * Now that IRQs are on it's safe to do a TLB shootdown, and now that we > + * released the zone lock it's possible to allocate a pagetable if > + * needed to split up a huge page. > + * > + * Note that modifying the direct map may need to allocate pagetables. > + * What about unbounded recursion? Here are the assumptions that make it > + * safe: > + * > + * - The direct map starts out fully mapped at boot. (This is not really > + * an assumption" as its in direct control of page_alloc.c). > + * > + * - Once pages in the direct map are broken down, they are not > + * re-aggregated into larger pages again. > + * > + * - Pagetables are never allocated with __GFP_UNMAPPED. > + * > + * Under these assumptions, a pagetable might need to be allocated while > + * _unmapping_ stuff from the direct map during a __GFP_UNMAPPED > + * allocation. But, the allocation of that pagetable never requires > + * allocating a further pagetable. > + */ > + err = set_direct_map_valid_noflush(page, > + nr_pageblocks << pageblock_order, want_mapped); > + if (err == -ENOMEM || WARN_ONCE(err, "err=%d\n", err)) { > + __free_one_page(page, page_to_pfn(page), zone, > + alloc_order, freetype, FPI_SKIP_REPORT_NOTIFY); Forgot to take the zone lock. > + return NULL; > + } > + > + if (!want_mapped) { > + unsigned long start = (unsigned long)page_address(page); > + unsigned long end = start + (nr_pageblocks << (pageblock_order + PAGE_SHIFT)); > + > + flush_tlb_kernel_range(start, end); > + } > + > + for (int i = 0; i < nr_pageblocks; i++) { > + struct page *block_page = page + (pageblock_nr_pages * i); > + > + set_pageblock_freetype_flags(block_page, freetype_flags(freetype)); > + } > + > + if (request_order >= alloc_order) > + return page; > + > + /* Free any remaining pages in the block. */ > + spin_lock_irqsave(&zone->lock, irq_flags); > + for (unsigned int i = request_order; i < alloc_order; i++) { > + struct page *page_to_free = page + (1 << i); > + > + __free_one_page(page_to_free, page_to_pfn(page_to_free), zone, > + i, freetype, FPI_SKIP_REPORT_NOTIFY); > + } > + spin_unlock_irqrestore(&zone->lock, irq_flags); > + > + return page; > +}