Re: [LSF/MM/BPF TOPIC][RFC PATCH v4 00/27] Private Memory Nodes (w/ Compressed RAM)

David Hildenbrand (Arm)
2026-04-13T13:11:37Z

On 3/19/26 16:09, Gregory Price wrote:
> On Tue, Mar 17, 2026 at 02:25:29PM +0100, David Hildenbrand (Arm) wrote:
>> On 2/22/26 09:48, Gregory Price wrote:
>>> Topic type: MM
>>
>> Hi Gregory,
>>
>> stumbling over this again, some questions whereby I'll just ignore the
>> compressed RAM bits for now and focus on use cases where promotion etc
>> are not relevant :)
>
> A more concrete example up your alley:
>
> I've since been playing with a virtio-net private node.
>
> Normally cloud-hypervisor VMs with virtio-net can't be subject to KSM
> because the entire boot region gets marked shared.

What exactly do you mean with "mark shared". Do you mean, that "shared
memory" is used in the hypervisor for all boot memory?

> If virtio-net has
> its own private node / region separate from the boot region, the boot
> region is now free to be subject to KSM.

You mean, in the VM, memory usable by virtio-net can only be consumed
from a dedicated physical memory region, and that region would be a
separate node?

>
> I may have that up as an example sometime before LSF, but i need to
> clean up some networking stack hacks i've made to make it work.
>
>>>
>>> N_MEMORY_PRIVATE is all about isolating NUMA nodes and then punching
>>> explicit holes in that isolation to do useful things we couldn't do
>>> before without re-implementing entire portions of mm/ in a driver.
>>
>> Just to clarify: we don't currently have any mechanism to expose, say,
>> SPM/PMEM/whatsoever to the buddy allocator through the dax/kmem driver
>> and *not* have random allocations end up on it, correct?
>>
>> Assume we online the memory to ZONE_MOVABLE, still other (fallback)
>> allocations might end up on that memory.
>>
>
> Correct, when you hotplug memory into a node, it's a free for all.
> Fallbacks are going to happen.

Right, and I agree that having a mechanism to prevent that is reasonable.

>
> I see you saw below that one of the extensions is removing the nodes
> from the fallback list. That is part one, but it's insufficient to
> prevent complete leakage (someone might iterate over the nodes-possible
> list and try migrating memory).

Which code would do that?

>
>> How would we currently handle something like that? (do we have drivers
>> for that? I'd assume that drivers would only migrate some user memory to
>> ZONE_DEVICE memory.)
>>
>> Assuming we don't have such a mechanism, I assume that part of your
>> proposal would be very interesting: online the memory to a
>> "special"/"restricted" (you call it private) NUMA node, whereby all
>> memory of that NUMA node will only be consumable through
>> mbind() and friends.
>>
>
> Basically the only isolation mechanism we have today is ZONE_DEVICE.
>
> Either via mbind and friends, or even just the driver itself managing it
> directly via alloc_pages_node() and exposing some userland interface.

Would mbind() work here? I thought mbind() would not suddenly give
access to some ZONE_DEVICE memory.

>
> You can imagine a network driver providing an ioctl for a shared buffer
> or a driver exposing a mmap'able file descriptor as the trivial case.

Right.

>
>> Any other allocations (including automatic page migration etc) would not
>> end up on that memory.
>
> One of the complications of exposing this memory via mbind is that
> mempolicy.c has a lot of migration mechanics, just to name two:
>
> - migrate on mbind
> - cpuset rebinds
>
> So for a completely solution you need to support migration if you
> support mempolicy. But with the callbacks, you can control how/when
> migration occurs.
>
> tl;dr: many of mm/'s services are actually predicated on migration
> support, so you have to manage that somehow.

Agreed.

>
>>
>> Thinking of some "terribly slow" or "terribly fast" memory that we don't
>> want to involve in automatic memory tiering, being able to just let
>> selected workloads consume that memory sounds very helpful.
>>
>>
>> (wondering if there could be some way allocations might get migrated out
>> of the node, for example, during memory offlining etc, which might also
>> not be desirable)
>>
>
> in the NP_OPS_MIGRATION patch, this gets covered.

Right, but I am not sure if NP_OPS_MIGRATION is really the right
approach for that. Have to think about that.

>
> I'm not sure the NP_OPS_* pattern is what we actually want, it's just
> what i came up with to make it clear what's being enabled.
>
> Basically without NP_OPS_MIGRATION, this memory is completely
> non-migratable. The driver managing it therefore needs to control the
> lifetime, and if hotplug is requested - kill anyone using it (which by
> definition should not the kernel) and either release the pages or take
> them so they can be released while hotplug is spinning.
>
>> I am not sure if __GFP_PRIVATE etc is really required for that. But some
>> mechanism to make that work seems extremely helpful.
>>
>> Because ...
>>
>>> /* And now I can use mempolicy with my memory */
>>> buf = mmap(...);
>>> mbind(buf, len, mode, private_node, ...);
>>> buf[0] = 0xdeadbeef; /* Faults onto private node */
>>
>> ... just being able to consume that memory through mbind() and having
>> guarantees sounds extremely helpful.
>>
>
> Yes! :]
>
>>>
>>> - Filter allocation requests on __GFP_PRIVATE
>>> numa_zone_allowed() excludes them otherwise.
>>
>> I think we discussed that in the past, but why can't we find a way that
>> only people requesting __GFP_THISNODE could allocate that memory, for
>> example? I guess we'd have to remove it from all "default NUMA bitmaps"
>> somehow.
>>
>
> I experimented with this. There were two concerns:
>
> 1) as you note, removing it from the default bitmaps, which is actually
> hard. You can't remove it from the possible-node bitmap, so that
> just seemed non-tractable.

What about making people use a different set of bitmaps here? Quite some
work, but maybe that's the right direction given that we'll now treat
some nodes differently.

>
> 2) __GFP_THISNODE actually means (among other things) "don't fallback".
> And, in fact, there are some hotplug-time allocations that occur in
> SLAB (pglist_data) that target the private node that *must* fallback
> to successfully allocate for successful kernel operation.

Can you point me at the code?

>
> So separating PRIVATE from THISNODE and allowing some use of fallback
> mechanics resolves some problems here.
>
> I think #2 is a solvable problem, but #1 i don't think can be addressed.
> I need to investigate the slab interactions a little more.

I'll also have to think about this some more.

>
>>> - Use standard struct page / folio. No ZONE_DEVICE, no pgmap,
>>> no struct page metadata limitations.
>>
>> Good.
>
> Note: I've actually since explored merging this with pgmap, and
> rebranding it as node-scope pgmap.
>
> In that sense, you could think of this as NODE_DEVICE instead of
> NODE_PRIVATE - but maybe I'm inviting too much baggage :]

:)

NODE_DEVICE sounds interesting though.

>
>>>
>>> Re-use of ZONE_DEVICE Hooks
>>> ===
>>
>> I think all of that might not be required for the simplistic use case I
>> mentioned above (fast/slow memory only to be consumed by selected user
>> space that opts in through mbind() and friends).
>>
>> Or are there other use cases for these callbacks
>>
>
> Many `folio_is_zone_device()` hooks result in the operations being
> a no-op / failing. We need all those same hooks.
>
> Some hooks I added - such as migration hooks, are combined with the
> zone_device hooks via i helper to demonstrate the pattern is the same
> when the memory is opted into migration.
>
> I do not think all of these hooks are required, I would think of this
> more as an exploration of the whole space, and then we can throw what
> does not have an active use case.
>
> For the compressed ram component I've been designing, the needs are:
>
> - Migration
> - Reclaim
> - Demotion
> - Write Protect (maybe, possibly optional)
>
> But you could argue another user might want the same device to have:
> - Migration
> - Mempolicy
>
> Where they manage things from userland, rather than via reclaim.
>
> The flexibility is kind of the point :]

Yeah, but it would be interesting which minimal support we would need to
just let some special memory be managed by the kernel, allowing mbind()
users to use it, but not have any other fallback allocations end up on it.

Something very basic, on which we could build additional functionality.

>
>> [...]
>>>
>>>
>>> Flag-gated behavior (NP_OPS_*) controls:
>>> ===
>>>
>>> We use OPS flags to denote what mm/ services we want to allow on our
>>> private node. I've plumbed these through so far:
>>>
>>> NP_OPS_MIGRATION - Node supports migration
>>> NP_OPS_MEMPOLICY - Node supports mempolicy actions
>>> NP_OPS_DEMOTION - Node appears in demotion target lists
>>> NP_OPS_PROTECT_WRITE - Node memory is read-only (wrprotect)
>>> NP_OPS_RECLAIM - Node supports reclaim
>>> NP_OPS_NUMA_BALANCING - Node supports numa balancing
>>> NP_OPS_COMPACTION - Node supports compaction
>>> NP_OPS_LONGTERM_PIN - Node supports longterm pinning
>>> NP_OPS_OOM_ELIGIBLE - (MIGRATION | DEMOTION), node is reachable
>>> as normal system ram storage, so it should
>>> be considered in OOM pressure calculations.
>>
>> I have to think about all that, and whether that would be required as a
>> first step. I'd assume in a simplistic use case mentioned above we might
>> only forbid the memory to be used as a fallback for any oom etc.
>>
>> Whether reclaim (e.g., swapout) makes sense is a good question.
>>
>
> I would simply state: "That depends on the memory device"

Let's keep it very simple: just some memory that you mbind(), and you
only want the mbind() user to make use of that memory.

What would be the minimal set of hooks to guarantee that.

For example, I assume compaction could just be supported for such
memory? Similarly, longterm-pinning.

For some of the other hooks it's rather unclear how they would affect
the very simple mbind() rule. What is the effect of demotion or NUMA
balancing?

I'm afraid we're making things too complicated here or it might be the
wrong abstraction, if i cannot even figure out how to make the simplest
use case work.

Maybe I'm wrong :)

>
> Which is kind of the point. The ability to isolate and poke holes in
> that isolation explictly, while using the same mm/ code, creates a new
> design space we haven't had before.
>
> ---
>
> I think it would be fair to say all of these would not be required for
> an MVP interface, and should require a use case to merge. But the code
> is here because I wanted to explore just how far it can go.

That's absolutely fair. :)

--
Cheers,

David