[RFC PATCH 00/10] mm/damon: add optional debugging-purpose sanity checks

[RFC PATCH 00/10] mm/damon: add optional debugging-purpose sanity checks

[SeongJae Park]

DAMON code has a few assumptions that can be critical if violated.
Validating the assumptions in code can be useful at finding such
critical bugs.  I was actually adding some such additional sanity checks
in my personal tree, and those were useful at finding bugs that I made
during the development of new patches.  We also found [1] sometimes the
assumptions are misunderstood.  The validation can work as good
documentation for such cases.

Add some of such debugging purpose sanity checks.  Because those
additional checks can impose more overhead, make those only optional via
new config, CONFIG_DAMON_DEBUG_SANITY, that is recommended for only
development and test setups.  And as recommended, enable it for DAMON
kunit tests and selftests.

[1] https://lore.kernel.org/20251231070029.79682-1-sj@kernel.org

SeongJae Park (10):
  mm/damon: add CONFIG_DAMON_DEBUG_SANITY
  mm/damon/core: add damon_new_region() debug_sanity check
  mm/damon/core: add damon_del_region() debug_sanity check
  mm/damon/core: add damon_nr_regions() debug_sanity check
  mm/damon/core: add damon_merge_two_regions() debug_sanity check
  mm/damon/core: add damon_merge_regions_of() debug_sanity check
  mm/damon/core: add damon_split_region_at() debug_sanity check
  mm/damon/core: add damon_reset_aggregated() debug_sanity check
  mm/damon/tests/.kunitconifg: enable DAMON_DEBUG_SANITY
  tools/testing/selftests/damon/config: enable DAMON_DEBUG_SANITY

 mm/damon/Kconfig                     |  11 +++
 mm/damon/core.c                      | 139 +++++++++++++++++++++++++++
 mm/damon/tests/.kunitconfig          |   3 +
 tools/testing/selftests/damon/config |   1 +
 4 files changed, 154 insertions(+)


base-commit: e059221c54896e36c8fc320029648e9013b382ea
-- 
2.47.3

[RFC PATCH 01/10] mm/damon: add CONFIG_DAMON_DEBUG_SANITY

[SeongJae Park]

Add a new build config that will enable additional DAMON sanity checks.
It is recommended to be enabled on only development and test setups,
since it can impose additional overhead.

Signed-off-by: SeongJae Park <sj@kernel.org>
---
 mm/damon/Kconfig | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/mm/damon/Kconfig b/mm/damon/Kconfig
index 8c868f7035fce..413adbd8e4089 100644
--- a/mm/damon/Kconfig
+++ b/mm/damon/Kconfig
@@ -12,6 +12,17 @@ config DAMON
 	  See https://www.kernel.org/doc/html/latest/mm/damon/index.html for
 	  more information.
 
+config DAMON_DEBUG_SANITY
+	bool "Check sanity of DAMON code"
+	depends on DAMON
+	help
+	  This enables additional DAMON debugging-purpose sanity checks in
+	  DAMON code.  This can be useful for finding bugs, but impose
+	  additional overhead.  This is therefore recommended to be enable on
+	  only development and test setups.
+
+	  If unsure, say N.
+
 config DAMON_KUNIT_TEST
 	bool "Test for damon" if !KUNIT_ALL_TESTS
 	depends on DAMON && KUNIT=y
-- 
2.47.3

[RFC PATCH 02/10] mm/damon/core: add damon_new_region() debug_sanity check

[SeongJae Park]

damon_new_region() is supposed to be called with only valid address
range arguments.  Do the check under DAMON_DEBUG_SANITY.

Signed-off-by: SeongJae Park <sj@kernel.org>
---
 mm/damon/core.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index 602b85ef23597..a7f5748c1fe17 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -109,6 +109,22 @@ int damon_select_ops(struct damon_ctx *ctx, enum damon_ops_id id)
 	return err;
 }
 
+#ifdef CONFIG_DAMON_DEBUG_SANITY
+static void damon_verify_new_region(unsigned long start, unsigned long end)
+{
+
+	if (start < end)
+		return;
+	pr_err("damon_new_region() s called with start %lu >= end %lu!\n",
+			start, end);
+	WARN_ONCE();
+}
+#else
+static void damon_verify_new_region(unsigned long start, unsigned long end)
+{
+}
+#endif
+
 /*
  * Construct a damon_region struct
  *
@@ -122,6 +138,8 @@ struct damon_region *damon_new_region(unsigned long start, unsigned long end)
 	if (!region)
 		return NULL;
 
+	damon_verify_new_region(start, end);
+
 	region->ar.start = start;
 	region->ar.end = end;
 	region->nr_accesses = 0;
-- 
2.47.3

[RFC PATCH 03/10] mm/damon/core: add damon_del_region() debug_sanity check

[SeongJae Park]

damon_del_region() should be called for targets that have one or more
regions.  Add a sanity check for that under CONFIG_DAMON_DEBUG_SANITY.

Signed-off-by: SeongJae Park <sj@kernel.org>
---
 mm/damon/core.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index a7f5748c1fe17..7e03c3af03694 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -158,8 +158,25 @@ void damon_add_region(struct damon_region *r, struct damon_target *t)
 	t->nr_regions++;
 }
 
+#ifdef CONFIG_DAMON_DEBUG_SANITY
+static void damon_verify_del_region(struct damon_target *t)
+{
+	if (t->nr_regions > 0)
+		return;
+	pr_err("damon_del_region() called while t->nr_regions <= 0 (%u)\n",
+			t->nr_regions);
+	WARN_ONCE();
+}
+#else
+static void damon_verify_del_region(struct damon_target *t)
+{
+}
+#endif
+
 static void damon_del_region(struct damon_region *r, struct damon_target *t)
 {
+	damon_verify_del_region(t);
+
 	list_del(&r->list);
 	t->nr_regions--;
 }
-- 
2.47.3

[RFC PATCH 04/10] mm/damon/core: add damon_nr_regions() debug_sanity check

[SeongJae Park]

damon_target->nr_regions is introduced to get the number quickly without
having to iterate regions always.  Add a sanity check for that under
CONFIG_DAMON_DEBUG_SANITY.

Signed-off-by: SeongJae Park <sj@kernel.org>
---
 mm/damon/core.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index 7e03c3af03694..ede76e0789be3 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -556,8 +556,30 @@ void damon_destroy_target(struct damon_target *t, struct damon_ctx *ctx)
 	damon_free_target(t);
 }
 
+#ifdef CONFIG_DAMON_DEBUG_SANITY
+static void damon_verify_nr_regions(struct damon_target *t)
+{
+	struct damon_region *r;
+	unsigned int count = 0;
+
+	damon_for_each_region(r, t)
+		count++;
+	if (count == t->nr_regions)
+		return;
+	pr_err("damon_nr_regions(): t->nr_regions (%u) != real number (%u)\n",
+			t->nr_regions, count);
+	WARN_ONCE();
+}
+#else
+static void damon_verify_nr_regions(struct damon_target *t)
+{
+}
+#endif
+
 unsigned int damon_nr_regions(struct damon_target *t)
 {
+	damon_verify_nr_regions(t);
+
 	return t->nr_regions;
 }
 
-- 
2.47.3

[RFC PATCH 05/10] mm/damon/core: add damon_merge_two_regions() debug_sanity check

[SeongJae Park]

A data corruption could cause damon_merge_two_regions() creating zero
length DAMON regions.  Add a sanity check for that under
CONFIG_DAMON_DEBUG_SANITY.

Signed-off-by: SeongJae Park <sj@kernel.org>
---
 mm/damon/core.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index ede76e0789be3..291a847a8c9bb 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2507,6 +2507,25 @@ static void kdamond_apply_schemes(struct damon_ctx *c)
 	mutex_unlock(&c->walk_control_lock);
 }
 
+#ifdef CONFIG_DAMON_DEBUG_SANITY
+static void damon_verify_merge_two_regions(
+		struct damon_region *l, struct damon_region *r)
+{
+	if (l->ar.start < l->ar.end)
+		return;
+
+	pr_err("damn_merge_two_regions() created incorrect left region\n");
+	pr_err("l: %lu-%lu, r: %lu-%lu\n",
+			l->ar.start, l->ar.end, r->ar.start, r->ar.end);
+	WARN_ONCE();
+}
+#else
+static void damon_verify_merge_two_regions(
+		struct damon_region *l, struct damon_region *r)
+{
+}
+#endif
+
 /*
  * Merge two adjacent regions into one region
  */
@@ -2520,6 +2539,9 @@ static void damon_merge_two_regions(struct damon_target *t,
 	l->nr_accesses_bp = l->nr_accesses * 10000;
 	l->age = (l->age * sz_l + r->age * sz_r) / (sz_l + sz_r);
 	l->ar.end = r->ar.end;
+
+	damon_verify_merge_two_regions(l, r);
+
 	damon_destroy_region(r, t);
 }
 
-- 
2.47.3

[RFC PATCH 06/10] mm/damon/core: add damon_merge_regions_of() debug_sanity check

[SeongJae Park]

damon_merge_regions_of() should be called only after aggregation is
finished and therefore each region's nr_accesses and nr_accesses_bp
match.  There were bugs that broke the assumption, during development of
online DAMON parameter updates and monitoring results handling changes.
Add a sanity check for that under CONFIG_DAMON_DEBUG_SANITY.

Signed-off-by: SeongJae Park <sj@kernel.org>
---
 mm/damon/core.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index 291a847a8c9bb..94be598cafef1 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2545,6 +2545,22 @@ static void damon_merge_two_regions(struct damon_target *t,
 	damon_destroy_region(r, t);
 }
 
+#ifdef CONFIG_DAMON_DEBUG_SANITY
+static void damon_verify_merge_regions_of(struct damon_region *r)
+{
+	if (r->nr_accesses == r->nr_accesses_bp / 10000)
+		return;
+	pr_err("nr_accesses (%u) != nr_accesses_bp (%u)\n",
+			r->nr_accesses, r->nr_accesses_bp);
+	WARN_ONCE();
+}
+#else
+static void damon_verify_merge_regions_of(struct damon_region *r)
+{
+}
+#endif
+
+
 /*
  * Merge adjacent regions having similar access frequencies
  *
@@ -2565,6 +2581,8 @@ static void damon_merge_regions_of(struct damon_target *t, unsigned int thres,
 		else
 			r->age++;
 
+		damon_verify_merge_regions_of(r);
+
 		if (prev && prev->ar.end == r->ar.start &&
 		    abs(prev->nr_accesses - r->nr_accesses) <= thres &&
 		    damon_sz_region(prev) + damon_sz_region(r) <= sz_limit)
-- 
2.47.3

[RFC PATCH 07/10] mm/damon/core: add damon_split_region_at() debug_sanity check

[SeongJae Park]

damon_split_region_at() should be called with the correct address to
split on.  Add a sanity check for that under CONFIG_DAMON_DEBUG_SANITY.

Signed-off-by: SeongJae Park <sj@kernel.org>
---
 mm/damon/core.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index 94be598cafef1..16f7994903d6d 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2629,6 +2629,23 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,
 			threshold / 2 < max_thres);
 }
 
+#ifdef CONFIG_DAMON_DEBUG_SANITY
+static void damon_verify_split_region_at(struct damon_region *r,
+		unsigned long sz_r)
+{
+	if (sz_r > 0 && sz_r < damon_sz_region(r))
+		return;
+	pr_err("damon_split_region() call with r %lu-%lu (%lu), sz_r %lu\n",
+			r->ar.start, r->ar.end, damon_sz_region(r), sz_r);
+	WARN_ONCE();
+}
+#else
+static void damon_verify_split_region_at(struct damon_region *r,
+		unsigned long sz_r)
+{
+}
+#endif
+
 /*
  * Split a region in two
  *
@@ -2640,6 +2657,8 @@ static void damon_split_region_at(struct damon_target *t,
 {
 	struct damon_region *new;
 
+	damon_verify_split_region_at(r, sz_r);
+
 	new = damon_new_region(r->ar.start + sz_r, r->ar.end);
 	if (!new)
 		return;
-- 
2.47.3

[RFC PATCH 08/10] mm/damon/core: add damon_reset_aggregated() debug_sanity check

[SeongJae Park]

At time of damon_reset_aggregated(), aggregation of the interval should
be completed, and hence nr_accesses and nr_accesses_bp should match.  I
found a few bugs caused it to be broken in the past, from online
parameters update and complicated nr_accesses handling changes.  Add a
sanity check for that under CONFIG_DAMON_DEBUG_SANITY.

Signed-off-by: SeongJae Park <sj@kernel.org>
---
 mm/damon/core.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index 16f7994903d6d..4efe732e76c69 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -1681,6 +1681,28 @@ static void damon_warn_fix_nr_accesses_corruption(struct damon_region *r)
 	r->nr_accesses_bp = r->nr_accesses * 10000;
 }
 
+#ifdef CONFIG_DAMON_DEBUG_SANITY
+static void damon_verify_reset_aggregated(struct damon_region *r,
+		struct damon_ctx *c)
+{
+	if (r->nr_accesses_bp == r->last_nr_accesses * 10000)
+		return;
+	pr_err("reset time invalid region found!\n");
+	pr_err("nr_accesses_bp %u last_nr_acceses %u\n",
+			r->nr_accesses_bp, r->last_nr_accesses);
+	pr_err("passed_sis %lu next_aggregation_sis %lu\n",
+			c->passed_sample_intervals,
+			c->next_aggregation_sis);
+	WARN_ONCE();
+}
+#else
+static void damon_verify_reset_aggregated(struct damon_region *r,
+		struct damon_ctx *c)
+{
+}
+#endif
+
+
 /*
  * Reset the aggregated monitoring results ('nr_accesses' of each region).
  */
@@ -1697,6 +1719,7 @@ static void kdamond_reset_aggregated(struct damon_ctx *c)
 			damon_warn_fix_nr_accesses_corruption(r);
 			r->last_nr_accesses = r->nr_accesses;
 			r->nr_accesses = 0;
+			damon_verify_reset_aggregated(r, c);
 		}
 		ti++;
 	}
-- 
2.47.3

[RFC PATCH 09/10] mm/damon/tests/.kunitconifg: enable DAMON_DEBUG_SANITY

[SeongJae Park]

CONFIG_DAMON_DEBUG_SANITY is recommended for DAMON development and test
setups.  Enable it on the default configurations for DAMON kunit test
run.

Signed-off-by: SeongJae Park <sj@kernel.org>
---
 mm/damon/tests/.kunitconfig | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mm/damon/tests/.kunitconfig b/mm/damon/tests/.kunitconfig
index 36a450f57b581..144d27e6ecc5c 100644
--- a/mm/damon/tests/.kunitconfig
+++ b/mm/damon/tests/.kunitconfig
@@ -13,3 +13,6 @@ CONFIG_DAMON_VADDR_KUNIT_TEST=y
 CONFIG_SYSFS=y
 CONFIG_DAMON_SYSFS=y
 CONFIG_DAMON_SYSFS_KUNIT_TEST=y
+
+# enable DAMON_DEBUG_SANITY to catch any bug
+CONFIG_DAMON_DEBUG_SANITY=y
-- 
2.47.3

[RFC PATCH 10/10] tools/testing/selftests/damon/config: enable DAMON_DEBUG_SANITY

[SeongJae Park]

CONFIG_DAMON_DEBUG_SANITY is recommended for DAMON development and test
setups.  Enable it on the build config for DAMON selftests.

Signed-off-by: SeongJae Park <sj@kernel.org>
---
 tools/testing/selftests/damon/config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/damon/config b/tools/testing/selftests/damon/config
index a68a9fead5dca..6304adacb741c 100644
--- a/tools/testing/selftests/damon/config
+++ b/tools/testing/selftests/damon/config
@@ -4,3 +4,4 @@ CONFIG_DAMON_PADDR=y
 CONFIG_DAMON_VADDR=y
 CONFIG_DAMON_RECLAIM=y
 CONFIG_DAMON_LRU_SORT=y
+CONFIG_DAMON_DEBUG_SANITY=y
-- 
2.47.3

Re: [RFC PATCH 09/10] mm/damon/tests/.kunitconifg: enable DAMON_DEBUG_SANITY

[SeongJae Park]

On Sat, 21 Feb 2026 11:36:26 -0800 SeongJae Park <sj@kernel.org> wrote:

> CONFIG_DAMON_DEBUG_SANITY is recommended for DAMON development and test
> setups.  Enable it on the default configurations for DAMON kunit test
> run.
> 
> Signed-off-by: SeongJae Park <sj@kernel.org>
> ---
>  mm/damon/tests/.kunitconfig | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/mm/damon/tests/.kunitconfig b/mm/damon/tests/.kunitconfig
> index 36a450f57b581..144d27e6ecc5c 100644
> --- a/mm/damon/tests/.kunitconfig
> +++ b/mm/damon/tests/.kunitconfig
> @@ -13,3 +13,6 @@ CONFIG_DAMON_VADDR_KUNIT_TEST=y
>  CONFIG_SYSFS=y
>  CONFIG_DAMON_SYSFS=y
>  CONFIG_DAMON_SYSFS_KUNIT_TEST=y
> +
> +# enable DAMON_DEBUG_SANITY to catch any bug
> +CONFIG_DAMON_DEBUG_SANITY=y

And this makes kunit for DAMON fails, like below.

'''
$ ./tools/testing/kunit/kunit.py run --kunitconfig mm/damon/tests/
[11:57:20] Configuring KUnit Kernel ...
Regenerating .config ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
[11:57:24] Building KUnit Kernel ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
Building with:
$ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=8
ERROR:root:In file included from ../include/asm-generic/bug.h:7,
                 from ./arch/um/include/generated/asm/bug.h:1,
                 from ../arch/x86/include/asm/alternative.h:9,
                 from ../arch/x86/um/asm/barrier.h:6,
                 from ../include/linux/list.h:11,
                 from ../arch/um/include/linux/time-internal.h:9,
                 from ../arch/x86/um/asm/processor.h:4,
                 from ../include/linux/sched.h:13,
                 from ../include/linux/cgroup.h:12,
                 from ../include/linux/memcontrol.h:13,
                 from ../include/linux/damon.h:11,
                 from ../mm/damon/core.c:10:
../mm/damon/core.c: In function ‘damon_verify_new_region’:
../include/linux/once_lite.h:28:50: error: expected expression before ‘)’ token
   28 |                 bool __ret_do_once = !!(condition);                     \
      |                                                  ^
../include/asm-generic/bug.h:185:9: note: in expansion of macro ‘DO_ONCE_LITE_IF’
  185 |         DO_ONCE_LITE_IF(condition, WARN, 1, format)
      |         ^~~~~~~~~~~~~~~
../mm/damon/core.c:127:9: note: in expansion of macro ‘WARN_ONCE’
  127 |         WARN_ONCE();
      |         ^~~~~~~~~
'''

I changed BUG() to WARN_ONCE() on the last moment of this patch posting, so I
missed this failure.  I will fix this on the next revision.


Thanks,
SJ

[...]