FAILED: patch "[PATCH] mm/gup: fix always draining LRU caches in" failed to apply to 6.6-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 078e1a0fc41a42baaf113383b52dab8874c0b967
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090339-stapling-ecosystem-7341@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 078e1a0fc41a42baaf113383b52dab8874c0b967 Mon Sep 17 00:00:00 2001
From: "David Hildenbrand (Arm)" <[email protected]>
Date: Fri, 31 Jul 2026 22:27:53 +0200
Subject: [PATCH] mm/gup: fix always draining LRU caches in
collect_longterm_unpinnable_folios()
folio_may_be_lru_cached() is currently only true for small folios, and for small folios FOLL_PIN adds GUP_PIN_COUNTING_BIAS references instead of 1 in try_grab_folio()/try_grab_folio_fast().
Consequently, our
folio_ref_count(folio) != folio_expected_ref_count(folio) + 1
check in collect_longterm_unpinnable_folios() will currently always identify "reference mismatch" and first drain the local LRU cache to then drain the LRU cache on all CPUs, as collect_longterm_unpinnable_folios() is really called after pinning the folios with FOLL_PIN.
Add a comment because the current code is not quite intuitive: we used to drain only to make sure the folio_isolate_lru() would succeed. But then we also started draining to make later migration more reliable.
We'll refactor that code soon a bit, to also make it usable in other context where we really want to remove any references from LRU caches.
Let's add CC stable, because having an easy way for excessive LRU cache draining on all CPUs does not sound right. In common scenarios we don't expect to ever have to drain.
mm/gup.c +8 -2
@@ -2273,6 +2273,7 @@ static unsigned long collect_longterm_unpinnable_folios(for (folio =pofs_get_folio (pofs, i); folio; folio =pofs_next_folio (folio, pofs, &i)) { +const int pin_refs =folio_has_pincount (folio) ?1 :GUP_PIN_COUNTING_BIAS ;if (folio_is_longterm_pinnable (folio))continue ;
@@ -2287,15 +2288,20 @@ static unsigned long collect_longterm_unpinnable_folios(continue ; } +/* +* We drain not only to make the folio_isolate_lru() succeed, +* but also to remove any other folio references from LRU +* caches. +*/ if (drained ==0 &&folio_may_be_lru_cached (folio) &&folio_ref_count (folio) != -folio_expected_ref_count (folio) +1 ) { +folio_expected_ref_count (folio) + pin_refs) {lru_add_drain (); drained =1 ; }if (drained ==1 &&folio_may_be_lru_cached (folio) &&folio_ref_count (folio) != -folio_expected_ref_count (folio) +1 ) { +folio_expected_ref_count (folio) + pin_refs) {lru_add_drain_all (); drained =2 ; }
Sasha Levin
maintainerPATCH 1/3 mm: move hugetlb specific things in folio to page[3]
From: David Hildenbrand <[email protected]>
[ Upstream commit 4eeec8c89a0c4a8c20fb13a4e7093cc8efce383d ]
Let's just move the hugetlb specific stuff to a separate page, and stop letting it overlay other fields for now.
This frees up some space in page[2], which we will use on 32bit to free up some space in page[1]. While we could move these things to page[3] instead, it's cleaner to just move the hugetlb specific things out of the way and pack the core-folio stuff as tight as possible. ... and we can minimize the work required in dump_folio.
We can now avoid re-initializing &folio->_deferred_list in hugetlb code.
Hopefully dynamically allocating "strut folio" in the future will further clean this up.
Stable-dep-of: 078e1a0fc41a ("mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()")
--- include/linux/mm_types.h | 27 +++++++++++++++++---------- mm/hugetlb.c | 1 - mm/page_alloc.c | 5 +++++ 3 files changed, 22 insertions(+), 11 deletions(-)
include/linux/mm_types.h +17 -10
@@ -343,20 +343,23 @@ struct folio {unsigned long _flags_2;unsigned long _head_2;/* public: */ -void *_hugetlb_subpool; -void *_hugetlb_cgroup; -void *_hugetlb_cgroup_rsvd; -void *_hugetlb_hwpoison; +struct list_head _deferred_list;/* private: the union with struct page is transitional */ }; +struct page __page_2; + }; +union {struct { -unsigned long _flags_2a; -unsigned long _head_2a; +unsigned long _flags_3; +unsigned long _head_3;/* public: */ -struct list_head _deferred_list; +void *_hugetlb_subpool; +void *_hugetlb_cgroup; +void *_hugetlb_cgroup_rsvd; +void *_hugetlb_hwpoison;/* private: the union with struct page is transitional */ }; -struct page __page_2; +struct page __page_3; }; };
@@ -385,8 +388,12 @@ FOLIO_MATCH(compound_head, _head_1); offsetof(struct page, pg) + 2 * sizeof(struct page))FOLIO_MATCH (flags, _flags_2);FOLIO_MATCH (compound_head, _head_2); -FOLIO_MATCH (flags, _flags_2a); -FOLIO_MATCH (compound_head, _head_2a); +#undef FOLIO_MATCH +#define FOLIO_MATCH (pg, fl) \ + static_assert(offsetof(struct folio, fl) == \ + offsetof(struct page, pg) + 3 * sizeof(struct page)) +FOLIO_MATCH (flags, _flags_3); +FOLIO_MATCH (compound_head, _head_3);#undef FOLIO_MATCH/**
mm/hugetlb.c +0 -1
@@ -1798,7 +1798,6 @@ static void __update_and_free_hugetlb_folio(struct hstate *h,destroy_compound_gigantic_folio (folio,huge_page_order (h));free_gigantic_folio (folio,huge_page_order (h)); }else { -INIT_LIST_HEAD (&folio->_deferred_list);__free_pages (&folio->page,huge_page_order (h)); } }
mm/page_alloc.c +5 -0
@@ -1032,6 +1032,11 @@ static int free_tail_page_prepare(struct page *head_page, struct page *page) goto out; }break ; +case 3 : +/* the third tail page: hugetlb specifics overlap ->mappings */ +if (IS_ENABLED (CONFIG_HUGETLB_PAGE )) +break ; + fallthrough;default :if (page->mapping !=TAIL_MAPPING ) {bad_page (page,"corrupted mapping in tail page" );
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/3 mm: move _pincount in folio to page[2] on 32bit
From: David Hildenbrand <[email protected]>
[ Upstream commit 31a31da8a6187f1e5448ec73222e01d7d3fed4aa ]
Let's free up some space on 32bit in page[1] by moving the _pincount to page[2].
For order-1 folios (never anon folios!) on 32bit, we will now also use the GUP_PIN_COUNTING_BIAS approach. A fully-mapped order-1 folio requires 2 references. With GUP_PIN_COUNTING_BIAS being 1024, we'd detect such folios as "maybe pinned" with 512 full mappings, instead of 1024 for order-0. As anon folios are out of the picture (which are the most relevant users of checking for pinnings on *mapped* pages) and we are talking about 32bit, this is not expected to cause any trouble.
In __dump_page(), copy one additional folio page if we detect a folio with an order > 1, so we can dump the pincount on order > 1 folios reliably.
Note that THPs on 32bit are not particularly common (and we don't care too much about performance), but we want to keep it working reliably, because likely we want to use large folios there as well in the future, independent of PMD leaf support.
Once we dynamically allocate "struct folio", fortunately the 32bit specifics will likely go away again; even small folios could then have a pincount and folio_has_pincount() would essentially always return "true".
On 6.6, __dump_page() reads the live folio instead of taking the upstream snapshot. Guard the pincount read directly, so copying page[2] is neither applicable nor necessary. Express the pincount predicate as a macro because new functions are unsuitable for this backport and folio_order() is not const-qualified in this tree.
Keep the existing page-array GUP iterator, but give it the iterator spelling used by the target fix so that fix applies without the newer folio-array infrastructure.
Stable-dep-of: 078e1a0fc41a ("mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()")
--- include/linux/mm.h | 8 ++++++-- include/linux/mm_types.h | 7 +++++-- mm/debug.c | 7 ++++++- mm/gup.c | 42 ++++++++++++++++++++++++++-------------- mm/internal.h | 3 ++- mm/page_alloc.c | 14 +++++++++++--- 6 files changed, 57 insertions(+), 24 deletions(-)
include/linux/mm.h +6 -2
@@ -1908,6 +1908,10 @@ static inline struct folio *pfn_folio(unsigned long pfn)return page_folio (pfn_to_page (pfn)); } +#define folio_has_pincount (folio) \ + (IS_ENABLED(CONFIG_64BIT) ? folio_test_large(folio) : \ + folio_order(folio) > 1) +/** * folio_maybe_dma_pinned - Report if a folio may be pinned for DMA. * @folio: The folio.
@@ -1924,7 +1928,7 @@ static inline struct folio *pfn_folio(unsigned long pfn)* get that many refcounts, and b) all the callers of this routine are * expected to be able to deal gracefully with a false positive. * -* For large folios, the result will be exactly correct. That's because +* For most large folios, the result will be exactly correct. That's because * we have more tracking data available: the _pincount field is used * instead of the GUP_PIN_COUNTING_BIAS scheme. *
@@ -1935,7 +1939,7 @@ static inline struct folio *pfn_folio(unsigned long pfn)*/ static inline bool folio_maybe_dma_pinned (struct folio *folio) { -if (folio_test_large (folio)) +if (folio_has_pincount (folio))return atomic_read (&folio->_pincount) >0 ;/*
include/linux/mm_types.h +5 -2
@@ -330,10 +330,10 @@ struct folio {/* public: */ atomic_t _entire_mapcount;atomic_t _nr_pages_mapped; -atomic_t _pincount;#ifdef CONFIG_64BIT +atomic_t _pincount;unsigned int _folio_nr_pages; -#endif +#endif /* CONFIG_64BIT */ /* private: the union with struct page is transitional */ };struct page __page_1;
@@ -344,6 +344,9 @@ struct folio {unsigned long _head_2;/* public: */ struct list_head _deferred_list; +#ifndef CONFIG_64BIT +atomic_t _pincount; +#endif /* !CONFIG_64BIT */ /* private: the union with struct page is transitional */ };struct page __page_2;
mm/debug.c +6 -1
@@ -99,11 +99,16 @@ static void __dump_page(struct page *page) page,page_ref_count (head), mapcount, mapping, page_to_pgoff(page), page_to_pfn(page));if (compound) { +int pincount =0 ; + +if (folio_has_pincount (folio)) + pincount =atomic_read (&folio->_pincount); +pr_warn ("head:%p order:%u entire_mapcount:%d nr_pages_mapped:%d pincount:%d\n" , head,compound_order (head),folio_entire_mapcount (folio),folio_nr_pages_mapped (folio), -atomic_read (&folio->_pincount)); + pincount); }#ifdef CONFIG_MEMCG
mm/gup.c +27 -15
99 lines not on this page · raw message
mm/internal.h +2 -1
@@ -491,7 +491,8 @@ static inline void prep_compound_head(struct page *page, unsigned int order)folio_set_order (folio, order);atomic_set (&folio->_entire_mapcount,-1 );atomic_set (&folio->_nr_pages_mapped,0 ); -atomic_set (&folio->_pincount,0 ); +if (IS_ENABLED (CONFIG_64BIT ) || order >1 ) +atomic_set (&folio->_pincount,0 );if (order >1 )INIT_LIST_HEAD (&folio->_deferred_list); }
mm/page_alloc.c +11 -3
@@ -1020,9 +1020,11 @@ static int free_tail_page_prepare(struct page *head_page, struct page *page)bad_page (page,"nonzero nr_pages_mapped" ); goto out; } -if (unlikely (atomic_read (&folio->_pincount))) { -bad_page (page,"nonzero pincount" ); - goto out; +if (IS_ENABLED (CONFIG_64BIT )) { +if (unlikely (atomic_read (&folio->_pincount))) { +bad_page (page,"nonzero pincount" ); + goto out; + } }break ;case 2 :
@@ -1031,6 +1033,12 @@ static int free_tail_page_prepare(struct page *head_page, struct page *page)bad_page (page,"on deferred list" ); goto out; } +if (!IS_ENABLED (CONFIG_64BIT )) { +if (unlikely (atomic_read (&folio->_pincount))) { +bad_page (page,"nonzero pincount" ); + goto out; + } + }break ;case 3 :/* the third tail page: hugetlb specifics overlap ->mappings */
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 3/3 mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()
In reply to Sasha LevinFrom: "David Hildenbrand (Arm)" <[email protected]>
[ Upstream commit 078e1a0fc41a42baaf113383b52dab8874c0b967 ]
folio_may_be_lru_cached() is currently only true for small folios, and for small folios FOLL_PIN adds GUP_PIN_COUNTING_BIAS references instead of 1 in try_grab_folio()/try_grab_folio_fast().
Consequently, our
folio_ref_count(folio) != folio_expected_ref_count(folio) + 1
check in collect_longterm_unpinnable_folios() will currently always identify "reference mismatch" and first drain the local LRU cache to then drain the LRU cache on all CPUs, as collect_longterm_unpinnable_folios() is really called after pinning the folios with FOLL_PIN.
Add a comment because the current code is not quite intuitive: we used to drain only to make sure the folio_isolate_lru() would succeed. But then we also started draining to make later migration more reliable.
We'll refactor that code soon a bit, to also make it usable in other context where we really want to remove any references from LRU caches.
Let's add CC stable, because having an easy way for excessive LRU cache draining on all CPUs does not sound right. In common scenarios we don't expect to ever have to drain.
--- mm/gup.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
mm/gup.c +8 -2
@@ -1970,6 +1970,7 @@ static unsigned long collect_longterm_unpinnable_pages(for (folio =pofs_get_folio (pofs, i); folio; folio =pofs_next_folio (folio, pofs, &i)) { +const int pin_refs =folio_has_pincount (folio) ?1 :GUP_PIN_COUNTING_BIAS ;if (folio_is_longterm_pinnable (folio))continue ;
@@ -1984,15 +1985,20 @@ static unsigned long collect_longterm_unpinnable_pages(continue ; } +/* +* We drain not only to make the folio_isolate_lru() succeed, +* but also to remove any other folio references from LRU +* caches. +*/ if (drained ==0 &&folio_may_be_lru_cached (folio) &&folio_ref_count (folio) != -folio_expected_ref_count (folio) +1 ) { +folio_expected_ref_count (folio) + pin_refs) {lru_add_drain (); drained =1 ; }if (drained ==1 &&folio_may_be_lru_cached (folio) &&folio_ref_count (folio) != -folio_expected_ref_count (folio) +1 ) { +folio_expected_ref_count (folio) + pin_refs) {lru_add_drain_all (); drained =2 ; }
Signature · 1 line
2.53.0
Re: [PATCH 6.6.y 3/3] mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()
Quoted 28 lines · Sasha Levin
From: "David Hildenbrand (Arm)" <[email protected]>
[ Upstream commit
078e1a0fc41a42baaf113383b52dab8874c0b967]
folio_may_be_lru_cached()is currently only true for small folios, and for small foliosFOLL_PINaddsGUP_PIN_COUNTING_BIASreferences instead of 1 in try_grab_folio()/try_grab_folio_fast().Consequently, our
folio_ref_count(folio) != folio_expected_ref_count(folio) + 1check in
collect_longterm_unpinnable_folios()will currently always identify "reference mismatch" and first drain the local LRU cache to then drain the LRU cache on all CPUs, ascollect_longterm_unpinnable_folios()is really called after pinning the folios withFOLL_PIN.Add a comment because the current code is not quite intuitive: we used to drain only to make sure the
folio_isolate_lru()would succeed. But then we also started draining to make later migration more reliable.We'll refactor that code soon a bit, to also make it usable in other context where we really want to remove any references from LRU caches.
Let's add CC stable, because having an easy way for excessive LRU cache draining on all CPUs does not sound right. In common scenarios we don't expect to ever have to drain.
Quoted 13 lines
Link https://lore.kernel.org/20260731-check_and_migrate_movable_folios-v1-1-e0002d7b791e@kernel.org open hereFixes 98c6d259319e ("mm/gup: check ref_count instead of lru before migration")Fixes a09a8a1fbb37 ("mm/gup: local lru_add_drain() to avoid lru_add_drain_all()")Signed-off-by David Hildenbrand (Arm) <[email protected]>Acked-by Hugh Dickins <[email protected]>Cc Ackerley Tng <[email protected]>Cc Jason Gunthorpe <[email protected]>Cc John Hubbard <[email protected]>Cc Kiryl Shutsemau <[email protected]>Cc Peter Xu <[email protected]>Cc <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Sasha Levin <[email protected]>
Same as with the 6.12 version, please hold off on these until there's explicit Ack from David.
Hugh
Quoted 41 lines
--- mm/gup.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)mm/gup.c +8
-2@@ -1970,6 +1970,7 @@ static unsigned long collect_longterm_unpinnable_pages(for (folio =pofs_get_folio (pofs, i); folio; folio =pofs_next_folio (folio, pofs, &i)) { +const int pin_refs =folio_has_pincount (folio) ?1 :GUP_PIN_COUNTING_BIAS ;if (folio_is_longterm_pinnable (folio))continue ;@@ -1984,15 +1985,20 @@ static unsigned long collect_longterm_unpinnable_pages(continue ; } +/* +* We drain not only to make the folio_isolate_lru() succeed, +* but also to remove any other folio references from LRU +* caches. +*/ if (drained ==0 &&folio_may_be_lru_cached (folio) &&folio_ref_count (folio) != -folio_expected_ref_count (folio) +1 ) { +folio_expected_ref_count (folio) + pin_refs) {lru_add_drain (); drained =1 ; }if (drained ==1 &&folio_may_be_lru_cached (folio) &&folio_ref_count (folio) != -folio_expected_ref_count (folio) +1 ) { +folio_expected_ref_count (folio) + pin_refs) {lru_add_drain_all (); drained =2 ; }Signature · 1 line
2.53.0