AI Trajectory

null

{
  "EnableConfigs": [
    "MEMORY_HOTPLUG",
    "MEMORY_HOTREMOVE"
  ],
  "FocusSymbols": [
    "try_offline_node",
    "sync_vm_stats",
    "vmstat_fold_work"
  ],
  "Reasoning": "The patch adds a call to sync_vm_stats() in try_offline_node() to fold pending per-cpu vmstat diffs into global counters before a NUMA node is offlined. This prevents the periodic vmstat fold from skipping the offlined node and orphaning the residual stats. This is a functional change in the core memory hotplug and vmstat logic, and it is reachable from userspace via sysfs memory hotplug interfaces. Fuzzing this could uncover race conditions or scheduling issues during node offlining.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 68acf84816afb615b08d954fb5860fdf4d6a9e93\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sat Jun 27 07:52:03 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/include/linux/vmstat.h b/include/linux/vmstat.h\nindex 3c9c266cf782ad..ea10174278111e 100644\n--- a/include/linux/vmstat.h\n+++ b/include/linux/vmstat.h\n@@ -293,6 +293,7 @@ extern void __dec_node_state(struct pglist_data *, enum node_stat_item);\n \n void quiet_vmstat(void);\n void cpu_vm_stats_fold(int cpu);\n+void sync_vm_stats(void);\n void refresh_zone_stat_thresholds(void);\n \n void drain_zonestat(struct zone *zone, struct per_cpu_zonestat *);\n@@ -397,6 +398,7 @@ static inline void __dec_node_page_state(struct page *page,\n \n static inline void refresh_zone_stat_thresholds(void) { }\n static inline void cpu_vm_stats_fold(int cpu) { }\n+static inline void sync_vm_stats(void) { }\n static inline void quiet_vmstat(void) { }\n static inline void vmstat_flush_workqueue(void) { }\n \ndiff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c\nindex 7ac19fab226324..dab4831667439f 100644\n--- a/mm/memory_hotplug.c\n+++ b/mm/memory_hotplug.c\n@@ -2208,8 +2208,11 @@ void try_offline_node(int nid)\n \n \t/*\n \t * all memory/cpu of this node are removed, we can offline this\n-\t * node now.\n+\t * node now.  Fold any pending per-cpu vmstat diffs into the global\n+\t * counters first: once the node leaves the online set the periodic\n+\t * fold skips it, orphaning the residual on a later online.\n \t */\n+\tsync_vm_stats();\n \tnode_set_offline(nid);\n \tunregister_node(nid);\n }\ndiff --git a/mm/vmstat.c b/mm/vmstat.c\nindex f534972f517de0..ad77343212d378 100644\n--- a/mm/vmstat.c\n+++ b/mm/vmstat.c\n@@ -941,6 +941,16 @@ void cpu_vm_stats_fold(int cpu)\n \tfold_diff(global_zone_diff, global_node_diff);\n }\n \n+static void vmstat_fold_work(struct work_struct *w)\n+{\n+\trefresh_cpu_vm_stats(false);\n+}\n+\n+void sync_vm_stats(void)\n+{\n+\tschedule_on_each_cpu(vmstat_fold_work);\n+}\n+\n /*\n  * this is only called if !populated_zone(zone), which implies no other users of\n  * pset-\u003evm_stat_diff[] exist.\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "MEMORY_HOTPLUG",
    "MEMORY_HOTREMOVE"
  ],
  "FocusSymbols": [
    "try_offline_node",
    "sync_vm_stats",
    "vmstat_fold_work"
  ],
  "Reasoning": "The patch adds a call to sync_vm_stats() in try_offline_node() to fold pending per-cpu vmstat diffs into global counters before a NUMA node is offlined. This prevents the periodic vmstat fold from skipping the offlined node and orphaning the residual stats. This is a functional change in the core memory hotplug and vmstat logic, and it is reachable from userspace via sysfs memory hotplug interfaces. Fuzzing this could uncover race conditions or scheduling issues during node offlining.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 68acf84816afb615b08d954fb5860fdf4d6a9e93
Author: syz-cluster <triage@syzkaller.com>
Date:   Sat Jun 27 07:52:03 2026 +0000

    syz-cluster: applied patch under review

diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
index 3c9c266cf782ad..ea10174278111e 100644
--- a/include/linux/vmstat.h
+++ b/include/linux/vmstat.h
@@ -293,6 +293,7 @@ extern void __dec_node_state(struct pglist_data *, enum node_stat_item);
 
 void quiet_vmstat(void);
 void cpu_vm_stats_fold(int cpu);
+void sync_vm_stats(void);
 void refresh_zone_stat_thresholds(void);
 
 void drain_zonestat(struct zone *zone, struct per_cpu_zonestat *);
@@ -397,6 +398,7 @@ static inline void __dec_node_page_state(struct page *page,
 
 static inline void refresh_zone_stat_thresholds(void) { }
 static inline void cpu_vm_stats_fold(int cpu) { }
+static inline void sync_vm_stats(void) { }
 static inline void quiet_vmstat(void) { }
 static inline void vmstat_flush_workqueue(void) { }
 
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 7ac19fab226324..dab4831667439f 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -2208,8 +2208,11 @@ void try_offline_node(int nid)
 
 	/*
 	 * all memory/cpu of this node are removed, we can offline this
-	 * node now.
+	 * node now.  Fold any pending per-cpu vmstat diffs into the global
+	 * counters first: once the node leaves the online set the periodic
+	 * fold skips it, orphaning the residual on a later online.
 	 */
+	sync_vm_stats();
 	node_set_offline(nid);
 	unregister_node(nid);
 }
diff --git a/mm/vmstat.c b/mm/vmstat.c
index f534972f517de0..ad77343212d378 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -941,6 +941,16 @@ void cpu_vm_stats_fold(int cpu)
 	fold_diff(global_zone_diff, global_node_diff);
 }
 
+static void vmstat_fold_work(struct work_struct *w)
+{
+	refresh_cpu_vm_stats(false);
+}
+
+void sync_vm_stats(void)
+{
+	schedule_on_each_cpu(vmstat_fold_work);
+}
+
 /*
  * this is only called if !populated_zone(zone), which implies no other users of
  * pset->vm_stat_diff[] exist.

gemini-3.1-pro-preview

null

null

							input: 2397
							output: 19
							thoughts: 244
						

**Analyzing a Memory Hotplug Patch**

Okay, so I'm looking at this patch and it's touching `mm/memory_hotplug.c` and `mm/vmstat.c`. Right, in `mm/memory_hotplug.c`, I see `try_offline_node` calls `sync_vm_stats()`. And then, flipping over to `mm/vmstat.c`, `sync_vm_stats()` is implemented with that `schedule_on_each_cpu(vmstat_fold_work)` call, which then goes to `refresh_cpu_vm_stats(false)`.

This looks like a functional change in the memory hotplug process, specifically when offlining a NUMA node. The question now becomes: is this patch fuzzable? Memory hotplug is a critical feature, obviously, but it's typically triggered by sysfs interactions or specific hardware events, right? Can I trigger this from userspace? Yes, definitely. I can use sysfs, something like `/sys/devices/system/node/nodeX/online` or even memory blocks.

And, can this even be reached in a virtualized environment? I think it is, memory hotplug is supported in QEMU, so that shouldn't be a problem.

Let me just check `try_offline_node` in `mm/memory_hotplug.c` again... gotta make sure I understand the full context.

{
  "Expression": "try_offline_node"
}

{
  "Output": "drivers/acpi/acpi_processor.c=476=static void acpi_processor_post_eject(struct acpi_device *device)\n--\ndrivers/acpi/acpi_processor.c-511-\ndrivers/acpi/acpi_processor.c:512:\ttry_offline_node(cpu_to_node(pr-\u003eid));\ndrivers/acpi/acpi_processor.c-513-\n--\ninclude/linux/memory_hotplug.h=259=static inline void pgdat_resize_init(struct pglist_data *pgdat) {}\n--\ninclude/linux/memory_hotplug.h-263-\ninclude/linux/memory_hotplug.h:264:extern void try_offline_node(int nid);\ninclude/linux/memory_hotplug.h-265-extern int offline_pages(unsigned long start_pfn, unsigned long nr_pages,\n--\ninclude/linux/memory_hotplug.h=269=extern int offline_and_remove_memory(u64 start, u64 size);\n--\ninclude/linux/memory_hotplug.h-271-#else\ninclude/linux/memory_hotplug.h:272:static inline void try_offline_node(int nid) {}\ninclude/linux/memory_hotplug.h-273-\n--\nmm/memory_hotplug.c=2164=static int check_no_memblock_for_node_cb(struct memory_block *mem, void *arg)\n--\nmm/memory_hotplug.c-2176-/**\nmm/memory_hotplug.c:2177: * try_offline_node\nmm/memory_hotplug.c-2178- * @nid: the node ID\n--\nmm/memory_hotplug.c-2184- */\nmm/memory_hotplug.c:2185:void try_offline_node(int nid)\nmm/memory_hotplug.c-2186-{\n--\nmm/memory_hotplug.c-2218-}\nmm/memory_hotplug.c:2219:EXPORT_SYMBOL(try_offline_node);\nmm/memory_hotplug.c-2220-\n--\nmm/memory_hotplug.c=2241=static int try_remove_memory(u64 start, u64 size)\n--\nmm/memory_hotplug.c-2287-\tif (nid != NUMA_NO_NODE)\nmm/memory_hotplug.c:2288:\t\ttry_offline_node(nid);\nmm/memory_hotplug.c-2289-\n--\nmm/memory_hotplug.c-2300- * and online/offline operations before this call, as required by\nmm/memory_hotplug.c:2301: * try_offline_node().\nmm/memory_hotplug.c-2302- */\n"
}

gemini-3.1-pro-preview

null

null

							input: 3695
							output: 19
							thoughts: 132
						

**Analyzing Memory Removal Paths**

Okay, so I'm tracing the memory removal process in the kernel, and it looks like `try_offline_node` is the starting point in a couple of key areas. I see that it's called from two distinct functions: `try_remove_memory` within `mm/memory_hotplug.c` – which is expected – and surprisingly, from `acpi_processor_post_eject` in `drivers/acpi/acpi_processor.c`. That ACPI call is interesting, it implies hardware removal of memory is tied into processor removal events somehow.

Digging deeper into the calling structure, `try_remove_memory` itself is called by both `offline_and_remove_memory` and just plain `remove_memory`. And *that* `remove_memory` function is exported, which means it's a publicly accessible interface for other parts of the kernel. This is important because that likely means a variety of device drivers rely on it to gracefully handle memory being taken offline. And indeed, the text mentions that it’s being used by things like virtio-mem, dax, and ACPI.

I should check the implementation of `try_remove_memory` itself in `mm/memory_hotplug.c` now to understand the logic. That's the core of this operation.

{
  "Expression": "try_remove_memory"
}

{
  "Output": "mm/memory_hotplug.c=2221=static int memory_blocks_have_altmaps(u64 start, u64 size)\n--\nmm/memory_hotplug.c-2240-\nmm/memory_hotplug.c:2241:static int try_remove_memory(u64 start, u64 size)\nmm/memory_hotplug.c-2242-{\n--\nmm/memory_hotplug.c=2303=void __remove_memory(u64 start, u64 size)\n--\nmm/memory_hotplug.c-2309-\t */\nmm/memory_hotplug.c:2310:\tif (try_remove_memory(start, size))\nmm/memory_hotplug.c-2311-\t\tBUG();\n--\nmm/memory_hotplug.c=2318=int remove_memory(u64 start, u64 size)\n--\nmm/memory_hotplug.c-2322-\tlock_device_hotplug();\nmm/memory_hotplug.c:2323:\trc = try_remove_memory(start, size);\nmm/memory_hotplug.c-2324-\tunlock_device_hotplug();\n--\nmm/memory_hotplug.c=2383=int offline_and_remove_memory(u64 start, u64 size)\n--\nmm/memory_hotplug.c-2418-\tif (!rc) {\nmm/memory_hotplug.c:2419:\t\trc = try_remove_memory(start, size);\nmm/memory_hotplug.c-2420-\t\tif (rc)\n"
}

gemini-3.1-pro-preview

null

null

							input: 4560
							output: 21
							thoughts: 146
						

**My Analysis of Memory Removal Entry Points**

Okay, let's break this down. My initial focus is on the functions `remove_memory` and `offline_and_remove_memory` – those are the key entry points for memory removal. My primary question is whether these are even *accessible* from userspace. Are they directly exposed, or are they buried behind other mechanisms?

I need to consider the context in which memory hotplug events are triggered. I know it can be initiated through ACPI events, virtio-mem, or even dax. The question is, can *syzkaller* be used to trigger one of these hotplugging events which will then, hopefully, lead to the removal of memory?

Syzkaller can trigger memory hotplug operations, specifically if it has access to locations like `/sys/devices/system/memory/memoryX/state`. But from my experience, that often results in simply offlining and onlining memory blocks – not actual *removal*. This is a crucial distinction.

Wait... something clicked. I remember `try_offline_node` gets called when a node goes offline. Now, the key is to determine if `try_offline_node` can be reached and triggered via sysfs. This is where I'll focus my investigation now. I need to trace this path.

{
  "Expression": "offline_and_remove_memory"
}

{
  "Output": "drivers/virtio/virtio_mem.c=724=static int virtio_mem_sbm_remove_mb(struct virtio_mem *vm, unsigned long mb_id)\n--\ndrivers/virtio/virtio_mem.c-739- */\ndrivers/virtio/virtio_mem.c:740:static int virtio_mem_offline_and_remove_memory(struct virtio_mem *vm,\ndrivers/virtio/virtio_mem.c-741-\t\t\t\t\t\tuint64_t addr,\n--\ndrivers/virtio/virtio_mem.c-749-\ndrivers/virtio/virtio_mem.c:750:\trc = offline_and_remove_memory(addr, size);\ndrivers/virtio/virtio_mem.c-751-\tif (!rc) {\n--\ndrivers/virtio/virtio_mem.c-769-/*\ndrivers/virtio/virtio_mem.c:770: * See virtio_mem_offline_and_remove_memory(): Try offlining and removing\ndrivers/virtio/virtio_mem.c-771- * a single Linux memory block.\n--\ndrivers/virtio/virtio_mem.c=773=static int virtio_mem_sbm_offline_and_remove_mb(struct virtio_mem *vm,\n--\ndrivers/virtio/virtio_mem.c-778-\ndrivers/virtio/virtio_mem.c:779:\treturn virtio_mem_offline_and_remove_memory(vm, addr, size);\ndrivers/virtio/virtio_mem.c-780-}\n--\ndrivers/virtio/virtio_mem.c=788=static int virtio_mem_sbm_try_remove_unplugged_mb(struct virtio_mem *vm,\n--\ndrivers/virtio/virtio_mem.c-799-\ndrivers/virtio/virtio_mem.c:800:\t/* offline_and_remove_memory() works for online and offline memory. */\ndrivers/virtio/virtio_mem.c-801-\tmutex_unlock(\u0026vm-\u003ehotplug_mutex);\n--\ndrivers/virtio/virtio_mem.c-810-/*\ndrivers/virtio/virtio_mem.c:811: * See virtio_mem_offline_and_remove_memory(): Try to offline and remove a\ndrivers/virtio/virtio_mem.c-812- * all Linux memory blocks covered by the big block.\n--\ndrivers/virtio/virtio_mem.c=814=static int virtio_mem_bbm_offline_and_remove_bb(struct virtio_mem *vm,\n--\ndrivers/virtio/virtio_mem.c-819-\ndrivers/virtio/virtio_mem.c:820:\treturn virtio_mem_offline_and_remove_memory(vm, addr, size);\ndrivers/virtio/virtio_mem.c-821-}\n--\ninclude/linux/memory_hotplug.h=268=extern void __remove_memory(u64 start, u64 size);\ninclude/linux/memory_hotplug.h:269:extern int offline_and_remove_memory(u64 start, u64 size);\ninclude/linux/memory_hotplug.h-270-\n--\nmm/memory_hotplug.c=2359=static int try_reonline_memory_block(struct memory_block *mem, void *arg)\n--\nmm/memory_hotplug.c-2382- */\nmm/memory_hotplug.c:2383:int offline_and_remove_memory(u64 start, u64 size)\nmm/memory_hotplug.c-2384-{\n--\nmm/memory_hotplug.c-2437-}\nmm/memory_hotplug.c:2438:EXPORT_SYMBOL_GPL(offline_and_remove_memory);\nmm/memory_hotplug.c-2439-#endif /* CONFIG_MEMORY_HOTREMOVE */\n"
}

gemini-3.1-pro-preview

null

null

							input: 6021
							output: 17
							thoughts: 8
						

Okay, here's my attempt at summarizing the thought process, tailored for an expert audience, and written in the first person:

**Navigating the Memory Management Labyrinth**

Okay, I'm thinking about the memory management aspect of this system. We're clearly dealing with some form of persistent storage or state.  The current approach has likely considered several methods, but what about a particular approach, in this instance? I'm particularly interested in the command and concept of `remove_memory`. This suggests we're not just appending data or overwriting in-place. We need to consider how this function would impact the overall system. Specifically, I need to evaluate the implications of removal. For example, what would be the impact in terms of cascading effects? Are there any dependencies on the data being removed? How does it interact with any caching or indexing mechanisms that might be in place? I need to think this through carefully, especially regarding consistency and avoiding data corruption or orphaned references.

{
  "Expression": "remove_memory"
}

{
  "Output": "\nFull output is too long, showing 500 out of 508 lines.\nUse more precise expression if possible.\n\narch/arm64/mm/mmu.c=1984=int arch_add_memory(int nid, u64 start, u64 size,\n--\narch/arm64/mm/mmu.c-2018-\narch/arm64/mm/mmu.c:2019:void arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap,\narch/arm64/mm/mmu.c-2020-\t\t\tstruct dev_pagemap *pgmap)\n--\narch/loongarch/mm/init.c=107=int arch_add_memory(int nid, u64 start, u64 size, struct mhp_params *params)\n--\narch/loongarch/mm/init.c-121-\narch/loongarch/mm/init.c:122:void arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap,\narch/loongarch/mm/init.c-123-\t\t\tstruct dev_pagemap *pgmap)\n--\narch/powerpc/mm/mem.c=145=int __ref arch_add_memory(int nid, u64 start, u64 size,\n--\narch/powerpc/mm/mem.c-160-\narch/powerpc/mm/mem.c:161:void __ref arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap,\narch/powerpc/mm/mem.c-162-\t\t\t      struct dev_pagemap *pgmap)\n--\narch/powerpc/platforms/pseries/hotplug-memory.c=233=static int pseries_remove_memblock(unsigned long base, unsigned long memblock_size)\n--\narch/powerpc/platforms/pseries/hotplug-memory.c-248-\tfor (i = 0; i \u003c sections_per_block; i++) {\narch/powerpc/platforms/pseries/hotplug-memory.c:249:\t\t__remove_memory(base, MIN_MEMORY_BLOCK_SIZE);\narch/powerpc/platforms/pseries/hotplug-memory.c-250-\t\tbase += MIN_MEMORY_BLOCK_SIZE;\n--\narch/powerpc/platforms/pseries/hotplug-memory.c=302=static int dlpar_remove_lmb(struct drmem_lmb *lmb)\n--\narch/powerpc/platforms/pseries/hotplug-memory.c-319-\narch/powerpc/platforms/pseries/hotplug-memory.c:320:\t__remove_memory(lmb-\u003ebase_addr, memory_block_size);\narch/powerpc/platforms/pseries/hotplug-memory.c-321-\tmemory_block_put(mem_block);\n--\narch/powerpc/platforms/pseries/hotplug-memory.c=564=static int dlpar_add_lmb(struct drmem_lmb *lmb)\n--\narch/powerpc/platforms/pseries/hotplug-memory.c-596-\t\tpr_err(\"Failed to online LMB 0x%x on node %u\\n\", lmb-\u003edrc_index, nid);\narch/powerpc/platforms/pseries/hotplug-memory.c:597:\t\t__remove_memory(lmb-\u003ebase_addr, block_sz);\narch/powerpc/platforms/pseries/hotplug-memory.c-598-\t\tinvalidate_lmb_associativity_index(lmb);\n--\narch/riscv/mm/init.c=1713=int __ref arch_add_memory(int nid, u64 start, u64 size, struct mhp_params *params)\n--\narch/riscv/mm/init.c-1731-\narch/riscv/mm/init.c:1732:void __ref arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap,\narch/riscv/mm/init.c-1733-\t\t\t      struct dev_pagemap *pgmap)\n--\narch/s390/mm/init.c=260=int arch_add_memory(int nid, u64 start, u64 size,\n--\narch/s390/mm/init.c-280-\narch/s390/mm/init.c:281:void arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap,\narch/s390/mm/init.c-282-\t\t\tstruct dev_pagemap *pgmap)\n--\narch/x86/mm/init_64.c=1295=kernel_physical_mapping_remove(unsigned long start, unsigned long end)\n--\narch/x86/mm/init_64.c-1302-\narch/x86/mm/init_64.c:1303:void __ref arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap,\narch/x86/mm/init_64.c-1304-\t\t\t      struct dev_pagemap *pgmap)\n--\ndrivers/acpi/acpi_memhotplug.c=168=static int acpi_memory_enable_device(struct acpi_memory_device *mem_device)\n--\ndrivers/acpi/acpi_memhotplug.c-252-\ndrivers/acpi/acpi_memhotplug.c:253:static void acpi_memory_remove_memory(struct acpi_memory_device *mem_device)\ndrivers/acpi/acpi_memhotplug.c-254-{\n--\ndrivers/acpi/acpi_memhotplug.c-261-\t\tacpi_unbind_memory_blocks(info);\ndrivers/acpi/acpi_memhotplug.c:262:\t\t__remove_memory(info-\u003estart_addr, info-\u003elength);\ndrivers/acpi/acpi_memhotplug.c-263-\t\tlist_del(\u0026info-\u003elist);\n--\ndrivers/acpi/acpi_memhotplug.c=325=static void acpi_memory_device_remove(struct acpi_device *device)\n--\ndrivers/acpi/acpi_memhotplug.c-332-\tmem_device = acpi_driver_data(device);\ndrivers/acpi/acpi_memhotplug.c:333:\tacpi_memory_remove_memory(mem_device);\ndrivers/acpi/acpi_memhotplug.c-334-\tacpi_memory_device_free(mem_device);\n--\ndrivers/base/memory.c=781=static int add_memory_block(unsigned long block_id, int nid, unsigned long state,\n--\ndrivers/base/memory.c-826-\ndrivers/base/memory.c:827:static void remove_memory_block(struct memory_block *memory)\ndrivers/base/memory.c-828-{\n--\ndrivers/base/memory.c=851=int create_memory_block_devices(unsigned long start, unsigned long size,\n--\ndrivers/base/memory.c-876-\t\t\t\tcontinue;\ndrivers/base/memory.c:877:\t\t\tremove_memory_block(mem);\ndrivers/base/memory.c-878-\t\t}\n--\ndrivers/base/memory.c-889- */\ndrivers/base/memory.c:890:void remove_memory_block_devices(unsigned long start, unsigned long size)\ndrivers/base/memory.c-891-{\n--\ndrivers/base/memory.c-906-\t\tunregister_memory_block_under_nodes(mem);\ndrivers/base/memory.c:907:\t\tremove_memory_block(mem);\ndrivers/base/memory.c-908-\t}\n--\ndrivers/char/agp/agp.h=97=struct agp_bridge_driver {\n--\ndrivers/char/agp/agp.h-114-\tint (*insert_memory)(struct agp_memory *, off_t, int);\ndrivers/char/agp/agp.h:115:\tint (*remove_memory)(struct agp_memory *, off_t, int);\ndrivers/char/agp/agp.h-116-\tstruct agp_memory *(*alloc_by_type) (size_t, int);\n--\ndrivers/char/agp/agp.h=192=int agp_generic_insert_memory(struct agp_memory *mem, off_t pg_start, int type);\ndrivers/char/agp/agp.h:193:int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type);\ndrivers/char/agp/agp.h-194-struct agp_memory *agp_generic_alloc_by_type(size_t page_count, int type);\n--\ndrivers/char/agp/ali-agp.c=202=static const struct agp_bridge_driver ali_generic_bridge = {\n--\ndrivers/char/agp/ali-agp.c-218-\t.insert_memory\t\t= agp_generic_insert_memory,\ndrivers/char/agp/ali-agp.c:219:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/ali-agp.c-220-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/ali-agp.c=227=static const struct agp_bridge_driver ali_m1541_bridge = {\n--\ndrivers/char/agp/ali-agp.c-242-\t.insert_memory\t\t= agp_generic_insert_memory,\ndrivers/char/agp/ali-agp.c:243:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/ali-agp.c-244-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/alpha-agp.c=84=static int alpha_core_agp_insert_memory(struct agp_memory *mem, off_t pg_start,\n--\ndrivers/char/agp/alpha-agp.c-105-\ndrivers/char/agp/alpha-agp.c:106:static int alpha_core_agp_remove_memory(struct agp_memory *mem, off_t pg_start,\ndrivers/char/agp/alpha-agp.c-107-\t\t\t\t\tint type)\n--\ndrivers/char/agp/alpha-agp.c=122=struct agp_bridge_driver alpha_core_agp_driver = {\n--\ndrivers/char/agp/alpha-agp.c-139-\t.insert_memory\t\t= alpha_core_agp_insert_memory,\ndrivers/char/agp/alpha-agp.c:140:\t.remove_memory\t\t= alpha_core_agp_remove_memory,\ndrivers/char/agp/alpha-agp.c-141-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/amd-k7-agp.c=284=static int amd_insert_memory(struct agp_memory *mem, off_t pg_start, int type)\n--\ndrivers/char/agp/amd-k7-agp.c-325-\ndrivers/char/agp/amd-k7-agp.c:326:static int amd_remove_memory(struct agp_memory *mem, off_t pg_start, int type)\ndrivers/char/agp/amd-k7-agp.c-327-{\n--\ndrivers/char/agp/amd-k7-agp.c=363=static const struct agp_bridge_driver amd_irongate_driver = {\n--\ndrivers/char/agp/amd-k7-agp.c-379-\t.insert_memory\t\t= amd_insert_memory,\ndrivers/char/agp/amd-k7-agp.c:380:\t.remove_memory\t\t= amd_remove_memory,\ndrivers/char/agp/amd-k7-agp.c-381-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/amd64-agp.c=216=static const struct agp_bridge_driver amd_8151_driver = {\n--\ndrivers/char/agp/amd64-agp.c-232-\t.insert_memory\t\t= amd64_insert_memory,\ndrivers/char/agp/amd64-agp.c:233:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/amd64-agp.c-234-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/ati-agp.c=258=static int ati_insert_memory(struct agp_memory * mem,\n--\ndrivers/char/agp/ati-agp.c-305-\ndrivers/char/agp/ati-agp.c:306:static int ati_remove_memory(struct agp_memory * mem, off_t pg_start,\ndrivers/char/agp/ati-agp.c-307-\t\t\t     int type)\n--\ndrivers/char/agp/ati-agp.c=411=static const struct agp_bridge_driver ati_generic_bridge = {\n--\ndrivers/char/agp/ati-agp.c-427-\t.insert_memory\t\t= ati_insert_memory,\ndrivers/char/agp/ati-agp.c:428:\t.remove_memory\t\t= ati_remove_memory,\ndrivers/char/agp/ati-agp.c-429-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/efficeon-agp.c=237=static int efficeon_insert_memory(struct agp_memory * mem, off_t pg_start, int type)\n--\ndrivers/char/agp/efficeon-agp.c-285-\ndrivers/char/agp/efficeon-agp.c:286:static int efficeon_remove_memory(struct agp_memory * mem, off_t pg_start, int type)\ndrivers/char/agp/efficeon-agp.c-287-{\n--\ndrivers/char/agp/efficeon-agp.c-289-\ndrivers/char/agp/efficeon-agp.c:290:\tprintk(KERN_DEBUG PFX \"efficeon_remove_memory(%lx, %d)\\n\", pg_start, count);\ndrivers/char/agp/efficeon-agp.c-291-\n--\ndrivers/char/agp/efficeon-agp.c=313=static const struct agp_bridge_driver efficeon_driver = {\n--\ndrivers/char/agp/efficeon-agp.c-330-\t.insert_memory\t\t= efficeon_insert_memory,\ndrivers/char/agp/efficeon-agp.c:331:\t.remove_memory\t\t= efficeon_remove_memory,\ndrivers/char/agp/efficeon-agp.c-332-\t.cant_use_aperture\t= false,\t// true might be faster?\n--\ndrivers/char/agp/generic.c=448=int agp_unbind_memory(struct agp_memory *curr)\n--\ndrivers/char/agp/generic.c-459-\ndrivers/char/agp/generic.c:460:\tret_val = curr-\u003ebridge-\u003edriver-\u003eremove_memory(curr, curr-\u003epg_start, curr-\u003etype);\ndrivers/char/agp/generic.c-461-\n--\ndrivers/char/agp/generic.c=1104=EXPORT_SYMBOL(agp_generic_insert_memory);\n--\ndrivers/char/agp/generic.c-1106-\ndrivers/char/agp/generic.c:1107:int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)\ndrivers/char/agp/generic.c-1108-{\n--\ndrivers/char/agp/generic.c-1142-}\ndrivers/char/agp/generic.c:1143:EXPORT_SYMBOL(agp_generic_remove_memory);\ndrivers/char/agp/generic.c-1144-\n--\ndrivers/char/agp/intel-agp.c=450=static const struct agp_bridge_driver intel_generic_driver = {\n--\ndrivers/char/agp/intel-agp.c-466-\t.insert_memory\t\t= agp_generic_insert_memory,\ndrivers/char/agp/intel-agp.c:467:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/intel-agp.c-468-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/intel-agp.c=477=static const struct agp_bridge_driver intel_815_driver = {\n--\ndrivers/char/agp/intel-agp.c-493-\t.insert_memory\t\t= agp_generic_insert_memory,\ndrivers/char/agp/intel-agp.c:494:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/intel-agp.c-495-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/intel-agp.c=504=static const struct agp_bridge_driver intel_820_driver = {\n--\ndrivers/char/agp/intel-agp.c-520-\t.insert_memory\t\t= agp_generic_insert_memory,\ndrivers/char/agp/intel-agp.c:521:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/intel-agp.c-522-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/intel-agp.c=531=static const struct agp_bridge_driver intel_830mp_driver = {\n--\ndrivers/char/agp/intel-agp.c-547-\t.insert_memory\t\t= agp_generic_insert_memory,\ndrivers/char/agp/intel-agp.c:548:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/intel-agp.c-549-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/intel-agp.c=558=static const struct agp_bridge_driver intel_840_driver = {\n--\ndrivers/char/agp/intel-agp.c-574-\t.insert_memory\t\t= agp_generic_insert_memory,\ndrivers/char/agp/intel-agp.c:575:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/intel-agp.c-576-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/intel-agp.c=585=static const struct agp_bridge_driver intel_845_driver = {\n--\ndrivers/char/agp/intel-agp.c-601-\t.insert_memory\t\t= agp_generic_insert_memory,\ndrivers/char/agp/intel-agp.c:602:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/intel-agp.c-603-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/intel-agp.c=612=static const struct agp_bridge_driver intel_850_driver = {\n--\ndrivers/char/agp/intel-agp.c-628-\t.insert_memory\t\t= agp_generic_insert_memory,\ndrivers/char/agp/intel-agp.c:629:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/intel-agp.c-630-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/intel-agp.c=639=static const struct agp_bridge_driver intel_860_driver = {\n--\ndrivers/char/agp/intel-agp.c-655-\t.insert_memory\t\t= agp_generic_insert_memory,\ndrivers/char/agp/intel-agp.c:656:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/intel-agp.c-657-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/intel-agp.c=666=static const struct agp_bridge_driver intel_7505_driver = {\n--\ndrivers/char/agp/intel-agp.c-682-\t.insert_memory\t\t= agp_generic_insert_memory,\ndrivers/char/agp/intel-agp.c:683:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/intel-agp.c-684-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/intel-gtt.c=1206=static const struct agp_bridge_driver intel_fake_agp_driver = {\n--\ndrivers/char/agp/intel-gtt.c-1218-\t.insert_memory\t\t= intel_fake_agp_insert_entries,\ndrivers/char/agp/intel-gtt.c:1219:\t.remove_memory\t\t= intel_fake_agp_remove_entries,\ndrivers/char/agp/intel-gtt.c-1220-\t.alloc_by_type\t\t= intel_fake_agp_alloc_by_type,\n--\ndrivers/char/agp/nvidia-agp.c=202=static int nvidia_insert_memory(struct agp_memory *mem, off_t pg_start, int type)\n--\ndrivers/char/agp/nvidia-agp.c-240-\ndrivers/char/agp/nvidia-agp.c:241:static int nvidia_remove_memory(struct agp_memory *mem, off_t pg_start, int type)\ndrivers/char/agp/nvidia-agp.c-242-{\n--\ndrivers/char/agp/nvidia-agp.c=311=static const struct agp_bridge_driver nvidia_driver = {\n--\ndrivers/char/agp/nvidia-agp.c-327-\t.insert_memory\t\t= nvidia_insert_memory,\ndrivers/char/agp/nvidia-agp.c:328:\t.remove_memory\t\t= nvidia_remove_memory,\ndrivers/char/agp/nvidia-agp.c-329-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/parisc-agp.c=173=static int\ndrivers/char/agp/parisc-agp.c:174:parisc_agp_remove_memory(struct agp_memory *mem, off_t pg_start, int type)\ndrivers/char/agp/parisc-agp.c-175-{\n--\ndrivers/char/agp/parisc-agp.c=227=static const struct agp_bridge_driver parisc_agp_driver = {\n--\ndrivers/char/agp/parisc-agp.c-239-\t.insert_memory\t\t= parisc_agp_insert_memory,\ndrivers/char/agp/parisc-agp.c:240:\t.remove_memory\t\t= parisc_agp_remove_memory,\ndrivers/char/agp/parisc-agp.c-241-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/sis-agp.c=122=static struct agp_bridge_driver sis_driver = {\n--\ndrivers/char/agp/sis-agp.c-138-\t.insert_memory\t\t= agp_generic_insert_memory,\ndrivers/char/agp/sis-agp.c:139:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/sis-agp.c-140-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/sworks-agp.c=316=static int serverworks_insert_memory(struct agp_memory *mem,\n--\ndrivers/char/agp/sworks-agp.c-356-\ndrivers/char/agp/sworks-agp.c:357:static int serverworks_remove_memory(struct agp_memory *mem, off_t pg_start,\ndrivers/char/agp/sworks-agp.c-358-\t\t\t     int type)\n--\ndrivers/char/agp/sworks-agp.c=419=static const struct agp_bridge_driver sworks_driver = {\n--\ndrivers/char/agp/sworks-agp.c-434-\t.insert_memory\t\t= serverworks_insert_memory,\ndrivers/char/agp/sworks-agp.c:435:\t.remove_memory\t\t= serverworks_remove_memory,\ndrivers/char/agp/sworks-agp.c-436-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/uninorth-agp.c=150=static int uninorth_insert_memory(struct agp_memory *mem, off_t pg_start, int type)\n--\ndrivers/char/agp/uninorth-agp.c-199-\ndrivers/char/agp/uninorth-agp.c:200:static int uninorth_remove_memory(struct agp_memory *mem, off_t pg_start, int type)\ndrivers/char/agp/uninorth-agp.c-201-{\n--\ndrivers/char/agp/uninorth-agp.c=509=const struct agp_bridge_driver uninorth_agp_driver = {\n--\ndrivers/char/agp/uninorth-agp.c-524-\t.insert_memory\t\t= uninorth_insert_memory,\ndrivers/char/agp/uninorth-agp.c:525:\t.remove_memory\t\t= uninorth_remove_memory,\ndrivers/char/agp/uninorth-agp.c-526-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/uninorth-agp.c=537=const struct agp_bridge_driver u3_agp_driver = {\n--\ndrivers/char/agp/uninorth-agp.c-552-\t.insert_memory\t\t= uninorth_insert_memory,\ndrivers/char/agp/uninorth-agp.c:553:\t.remove_memory\t\t= uninorth_remove_memory,\ndrivers/char/agp/uninorth-agp.c-554-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/via-agp.c=170=static const struct agp_bridge_driver via_agp3_driver = {\n--\ndrivers/char/agp/via-agp.c-186-\t.insert_memory\t\t= agp_generic_insert_memory,\ndrivers/char/agp/via-agp.c:187:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/via-agp.c-188-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/char/agp/via-agp.c=197=static const struct agp_bridge_driver via_driver = {\n--\ndrivers/char/agp/via-agp.c-213-\t.insert_memory\t\t= agp_generic_insert_memory,\ndrivers/char/agp/via-agp.c:214:\t.remove_memory\t\t= agp_generic_remove_memory,\ndrivers/char/agp/via-agp.c-215-\t.alloc_by_type\t\t= agp_generic_alloc_by_type,\n--\ndrivers/dax/kmem.c=209=static void dev_dax_kmem_remove(struct dev_dax *dev_dax)\n--\ndrivers/dax/kmem.c-217-\t * We have one shot for removing memory, if some memory blocks were not\ndrivers/dax/kmem.c:218:\t * offline prior to calling this function remove_memory() will fail, and\ndrivers/dax/kmem.c-219-\t * there is no way to hotremove this memory until reboot because device\n--\ndrivers/dax/kmem.c-235-\ndrivers/dax/kmem.c:236:\t\trc = remove_memory(range.start, range_len(\u0026range));\ndrivers/dax/kmem.c-237-\t\tif (rc == 0) {\n--\ndrivers/firmware/efi/libstub/efistub.h=405=union efi_dxe_services_table {\n--\ndrivers/firmware/efi/libstub/efistub.h-410-\t\tvoid *free_memory_space;\ndrivers/firmware/efi/libstub/efistub.h:411:\t\tvoid *remove_memory_space;\ndrivers/firmware/efi/libstub/efistub.h-412-\t\tefi_status_t (__efiapi *get_memory_space_descriptor)(efi_physical_addr_t,\n--\ndrivers/firmware/efi/libstub/efistub.h-433-\t\tu32 free_memory_space;\ndrivers/firmware/efi/libstub/efistub.h:434:\t\tu32 remove_memory_space;\ndrivers/firmware/efi/libstub/efistub.h-435-\t\tu32 get_memory_space_descriptor;\n--\ndrivers/s390/char/sclp_mem.c=189=static ssize_t sclp_config_mem_store(struct kobject *kobj, struct kobj_attribute *attr,\n--\ndrivers/s390/char/sclp_mem.c-247-\t\tsclp_mem_change_state(addr, block_size, 0);\ndrivers/s390/char/sclp_mem.c:248:\t\t__remove_memory(addr, block_size);\ndrivers/s390/char/sclp_mem.c-249-#ifdef CONFIG_KASAN\n--\ndrivers/virtio/virtio_mem.c=683=static int virtio_mem_bbm_add_bb(struct virtio_mem *vm, unsigned long bb_id)\n--\ndrivers/virtio/virtio_mem.c-699- */\ndrivers/virtio/virtio_mem.c:700:static int virtio_mem_remove_memory(struct virtio_mem *vm, uint64_t addr,\ndrivers/virtio/virtio_mem.c-701-\t\t\t\t    uint64_t size)\n--\ndrivers/virtio/virtio_mem.c-706-\t\taddr + size - 1);\ndrivers/virtio/virtio_mem.c:707:\trc = remove_memory(addr, size);\ndrivers/virtio/virtio_mem.c-708-\tif (!rc) {\n--\ndrivers/virtio/virtio_mem.c-721-/*\ndrivers/virtio/virtio_mem.c:722: * See virtio_mem_remove_memory(): Try removing a single Linux memory block.\ndrivers/virtio/virtio_mem.c-723- */\ndrivers/virtio/virtio_mem.c=724=static int virtio_mem_sbm_remove_mb(struct virtio_mem *vm, unsigned long mb_id)\n--\ndrivers/virtio/virtio_mem.c-728-\ndrivers/virtio/virtio_mem.c:729:\treturn virtio_mem_remove_memory(vm, addr, size);\ndrivers/virtio/virtio_mem.c-730-}\n--\ndrivers/virtio/virtio_mem.c-739- */\ndrivers/virtio/virtio_mem.c:740:static int virtio_mem_offline_and_remove_memory(struct virtio_mem *vm,\ndrivers/virtio/virtio_mem.c-741-\t\t\t\t\t\tuint64_t addr,\n--\ndrivers/virtio/virtio_mem.c-749-\ndrivers/virtio/virtio_mem.c:750:\trc = offline_and_remove_memory(addr, size);\ndrivers/virtio/virtio_mem.c-751-\tif (!rc) {\n--\ndrivers/virtio/virtio_mem.c-769-/*\ndrivers/virtio/virtio_mem.c:770: * See virtio_mem_offline_and_remove_memory(): Try offlining and removing\ndrivers/virtio/virtio_mem.c-771- * a single Linux memory block.\n--\ndrivers/virtio/virtio_mem.c=773=static int virtio_mem_sbm_offline_and_remove_mb(struct virtio_mem *vm,\n--\ndrivers/virtio/virtio_mem.c-778-\ndrivers/virtio/virtio_mem.c:779:\treturn virtio_mem_offline_and_remove_memory(vm, addr, size);\ndrivers/virtio/virtio_mem.c-780-}\n--\ndrivers/virtio/virtio_mem.c=788=static int virtio_mem_sbm_try_remove_unplugged_mb(struct virtio_mem *vm,\n--\ndrivers/virtio/virtio_mem.c-799-\ndrivers/virtio/virtio_mem.c:800:\t/* offline_and_remove_memory() works for online and offline memory. */\ndrivers/virtio/virtio_mem.c-801-\tmutex_unlock(\u0026vm-\u003ehotplug_mutex);\n--\ndrivers/virtio/virtio_mem.c-810-/*\ndrivers/virtio/virtio_mem.c:811: * See virtio_mem_offline_and_remove_memory(): Try to offline and remove a\ndrivers/virtio/virtio_mem.c-812- * all Linux memory blocks covered by the big block.\n--\ndrivers/virtio/virtio_mem.c=814=static int virtio_mem_bbm_offline_and_remove_bb(struct virtio_mem *vm,\n--\ndrivers/virtio/virtio_mem.c-819-\ndrivers/virtio/virtio_mem.c:820:\treturn virtio_mem_offline_and_remove_memory(vm, addr, size);\ndrivers/virtio/virtio_mem.c-821-}\n--\ninclude/linux/memory.h=155=int create_memory_block_devices(unsigned long start, unsigned long size,\n--\ninclude/linux/memory.h-157-\t\t\t\tstruct memory_group *group);\ninclude/linux/memory.h:158:void remove_memory_block_devices(unsigned long start, unsigned long size);\ninclude/linux/memory.h-159-extern void memory_dev_init(void);\n--\ninclude/linux/memory_hotplug.h=133=static inline bool movable_node_is_enabled(void)\n--\ninclude/linux/memory_hotplug.h-137-\ninclude/linux/memory_hotplug.h:138:extern void arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap,\ninclude/linux/memory_hotplug.h-139-\t\t\t       struct dev_pagemap *pgmap);\n--\ninclude/linux/memory_hotplug.h=265=extern int offline_pages(unsigned long start_pfn, unsigned long nr_pages,\ninclude/linux/memory_hotplug.h-266-\t\t\t struct zone *zone, struct memory_group *group);\ninclude/linux/memory_hotplug.h:267:extern int remove_memory(u64 start, u64 size);\ninclude/linux/memory_hotplug.h:268:extern void __remove_memory(u64 start, u64 size);\ninclude/linux/memory_hotplug.h:269:extern int offline_and_remove_memory(u64 start, u64 size);\ninclude/linux/memory_hotplug.h-270-\n--\ninclude/linux/memory_hotplug.h=274=static inline int offline_pages(unsigned long start_pfn, unsigned long nr_pages,\n--\ninclude/linux/memory_hotplug.h-279-\ninclude/linux/memory_hotplug.h:280:static inline int remove_memory(u64 start, u64 size)\ninclude/linux/memory_hotplug.h-281-{\n--\ninclude/linux/memory_hotplug.h-284-\ninclude/linux/memory_hotplug.h:285:static inline void __remove_memory(u64 start, u64 size) {}\ninclude/linux/memory_hotplug.h-286-#endif /* CONFIG_MEMORY_HOTREMOVE */\n--\nmm/memory_hotplug.c=1406=static void altmap_free(struct vmem_altmap *altmap)\n--\nmm/memory_hotplug.c-1411-\nmm/memory_hotplug.c:1412:static void remove_memory_blocks_and_altmaps(u64 start, u64 size)\nmm/memory_hotplug.c-1413-{\n--\nmm/memory_hotplug.c-1433-\nmm/memory_hotplug.c:1434:\t\tremove_memory_block_devices(cur_start, memblock_size);\nmm/memory_hotplug.c:1435:\t\tarch_remove_memory(cur_start, memblock_size, altmap, NULL);\nmm/memory_hotplug.c-1436-\t\taltmap_free(altmap);\n--\nmm/memory_hotplug.c=1440=static int create_altmaps_and_memory_blocks(int nid, struct memory_group *group,\n--\nmm/memory_hotplug.c-1474-\t\tif (ret) {\nmm/memory_hotplug.c:1475:\t\t\tarch_remove_memory(cur_start, memblock_size, params.altmap, NULL);\nmm/memory_hotplug.c-1476-\t\t\taltmap_free(params.altmap);\n--\nmm/memory_hotplug.c-1483-\tif (ret \u0026\u0026 cur_start != start)\nmm/memory_hotplug.c:1484:\t\tremove_memory_blocks_and_altmaps(start, cur_start - start);\nmm/memory_hotplug.c-1485-\treturn ret;\n--\nmm/memory_hotplug.c=1494=int add_memory_resource(int nid, struct resource *res, mhp_t mhp_flags)\n--\nmm/memory_hotplug.c-1560-\t\tif (ret) {\nmm/memory_hotplug.c:1561:\t\t\tarch_remove_memory(start, size, params.altmap, NULL);\nmm/memory_hotplug.c-1562-\t\t\tgoto error;\n--\nmm/memory_hotplug.c=2221=static int memory_blocks_have_altmaps(u64 start, u64 size)\n--\nmm/memory_hotplug.c-2240-\nmm/memory_hotplug.c:2241:static int try_remove_memory(u64 start, u64 size)\nmm/memory_hotplug.c-2242-{\n--\nmm/memory_hotplug.c-2274-\t\t */\nmm/memory_hotplug.c:2275:\t\tremove_memory_block_devices(start, size);\nmm/memory_hotplug.c:2276:\t\tarch_remove_memory(start, size, NULL, NULL);\nmm/memory_hotplug.c-2277-\t} else {\nmm/memory_hotplug.c-2278-\t\t/* all memblocks in the range have altmaps */\nmm/memory_hotplug.c:2279:\t\tremove_memory_blocks_and_altmaps(start, size);\nmm/memory_hotplug.c-2280-\t}\n--\nmm/memory_hotplug.c-2294-/**\nmm/memory_hotplug.c:2295: * __remove_memory - Remove memory if every memory block is offline\nmm/memory_hotplug.c-2296- * @start: physical address of the region to remove\n--\nmm/memory_hotplug.c-2302- */\nmm/memory_hotplug.c:2303:void __remove_memory(u64 start, u64 size)\nmm/memory_hotplug.c-2304-{\n--\nmm/memory_hotplug.c-2309-\t */\nmm/memory_hotplug.c:2310:\tif (try_remove_memory(start, size))\nmm/memory_hotplug.c-2311-\t\tBUG();\n--\nmm/memory_hotplug.c-2317- */\nmm/memory_hotplug.c:2318:int remove_memory(u64 start, u64 size)\nmm/memory_hotplug.c-2319-{\n--\nmm/memory_hotplug.c-2322-\tlock_device_hotplug();\nmm/memory_hotplug.c:2323:\trc = try_remove_memory(start, size);\nmm/memory_hotplug.c-2324-\tunlock_device_hotplug();\n--\nmm/memory_hotplug.c-2327-}\nmm/memory_hotplug.c:2328:EXPORT_SYMBOL_GPL(remove_memory);\nmm/memory_hotplug.c-2329-\n--\nmm/memory_hotplug.c=2359=static int try_reonline_memory_block(struct memory_block *mem, void *arg)\n--\nmm/memory_hotplug.c-2382- */\nmm/memory_hotplug.c:2383:int offline_and_remove_memory(u64 start, u64 size)\nmm/memory_hotplug.c-2384-{\n--\nmm/memory_hotplug.c-2418-\tif (!rc) {\nmm/memory_hotplug.c:2419:\t\trc = try_remove_memory(start, size);\nmm/memory_hotplug.c-2420-\t\tif (rc)\n--\nmm/memory_hotplug.c-2437-}\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 17419
							output: 21
							thoughts: 275
						

**Analyzing a Kernel Memory Hotplug Patch**

Okay, so I'm looking at this code and I see `remove_memory` and `offline_and_remove_memory` are exported. I'm also seeing `try_offline_node` get called from `acpi_processor_post_eject` – interesting. Wait, `try_offline_node` gets called when a node has *no* memory or CPUs left, right? So the crucial question is, is `try_offline_node` actually *reachable* in this context? Ah, yes, memory hotplug makes it reachable.

But, and this is important, this patch specifically introduces `sync_vm_stats()` before `node_set_offline(nid)`. The commit message is very clear: "Fold any pending per-cpu vmstat diffs into the global counters first: once the node leaves the online set the periodic fold skips it, orphaning the residual on a later online." That makes sense, they're preventing orphaned vmstat diffs. This is definitely a *functional* change; we're fixing a potential bug where these diffs could be lost.

So, is it worth fuzzing? Absolutely, this is core kernel logic. Given this, I need to focus on a few key functions: `try_offline_node`, `sync_vm_stats`, and `vmstat_fold_work`.

And of course, what configs are needed to make this code active? I need `CONFIG_MEMORY_HOTPLUG` and `CONFIG_MEMORY_HOTREMOVE`. I'll double-check `mm/memory_hotplug.c` and `mm/vmstat.c` to make sure I'm not missing anything.

{
  "Expression": "CONFIG_MEMORY_HOTPLUG"
}

{
  "Output": "\nFull output is too long, showing 500 out of 745 lines.\nUse more precise expression if possible.\n\nDocumentation/admin-guide/mm/memory-hotplug.rst=276=The following files are currently defined:\n--\nDocumentation/admin-guide/mm/memory-hotplug.rst-300-\nDocumentation/admin-guide/mm/memory-hotplug.rst:301:\t\t       Availability depends on the CONFIG_MEMORY_HOTPLUG kernel\nDocumentation/admin-guide/mm/memory-hotplug.rst-302-\t\t       configuration option.\n--\nDocumentation/mm/physical_memory.rst=210=General\n--\nDocumentation/mm/physical_memory.rst-246-  A lock that protects the fields defining the node extents. Only defined when\nDocumentation/mm/physical_memory.rst:247:  at least one of ``CONFIG_MEMORY_HOTPLUG`` or\nDocumentation/mm/physical_memory.rst-248-  ``CONFIG_DEFERRED_STRUCT_PAGE_INIT`` configuration options are enabled.\nDocumentation/mm/physical_memory.rst-249-  ``pgdat_resize_lock()`` and ``pgdat_resize_unlock()`` are provided to\nDocumentation/mm/physical_memory.rst:250:  manipulate ``node_size_lock`` without checking for ``CONFIG_MEMORY_HOTPLUG``\nDocumentation/mm/physical_memory.rst-251-  or ``CONFIG_DEFERRED_STRUCT_PAGE_INIT``.\n--\nDocumentation/mm/physical_memory.rst=377=General\n--\nDocumentation/mm/physical_memory.rst-488-  early boot, excluding hotplugged memory. Defined only when\nDocumentation/mm/physical_memory.rst:489:  ``CONFIG_MEMORY_HOTPLUG`` is enabled and initialized by\nDocumentation/mm/physical_memory.rst-490-  ``calculate_node_totalpages()``.\n--\nDocumentation/mm/physical_memory.rst-508-  the main allocator path. However, the seqlock is written quite infrequently.\nDocumentation/mm/physical_memory.rst:509:  Defined only when ``CONFIG_MEMORY_HOTPLUG`` is enabled.\nDocumentation/mm/physical_memory.rst-510-\n--\nDocumentation/translations/zh_CN/mm/physical_memory.rst=205=node_zonelists引用。\n--\nDocumentation/translations/zh_CN/mm/physical_memory.rst-234-``node_size_lock``\nDocumentation/translations/zh_CN/mm/physical_memory.rst:235:一个保护定义节点范围字段的锁。仅在开启了 ``CONFIG_MEMORY_HOTPLUG`` 或\nDocumentation/translations/zh_CN/mm/physical_memory.rst-236-``CONFIG_DEFERRED_STRUCT_PAGE_INIT`` 配置选项中的某一个时才定义。提\nDocumentation/translations/zh_CN/mm/physical_memory.rst-237-供了 ``pgdat_resize_lock()`` 和 ``pgdat_resize_unlock()`` 用来操作\nDocumentation/translations/zh_CN/mm/physical_memory.rst:238:``node_size_lock``，而无需检查 ``CONFIG_MEMORY_HOTPLUG`` 或\nDocumentation/translations/zh_CN/mm/physical_memory.rst-239-``CONFIG_DEFERRED_STRUCT_PAGE_INIT`` 选项。\n--\narch/arm64/configs/defconfig=130=CONFIG_BLK_INLINE_ENCRYPTION=y\n--\narch/arm64/configs/defconfig-132-# CONFIG_COMPAT_BRK is not set\narch/arm64/configs/defconfig:133:CONFIG_MEMORY_HOTPLUG=y\narch/arm64/configs/defconfig-134-CONFIG_MEMORY_HOTREMOVE=y\n--\narch/arm64/mm/mmu.c=1425=void __init paging_init(void)\n--\narch/arm64/mm/mmu.c-1434-\narch/arm64/mm/mmu.c:1435:#ifdef CONFIG_MEMORY_HOTPLUG\narch/arm64/mm/mmu.c-1436-static void free_hotplug_page_range(struct page *page, size_t size,\n--\narch/arm64/mm/mmu.c=1784=int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,\n--\narch/arm64/mm/mmu.c-1797-\narch/arm64/mm/mmu.c:1798:#ifdef CONFIG_MEMORY_HOTPLUG\narch/arm64/mm/mmu.c-1799-void vmemmap_free(unsigned long start, unsigned long end,\n--\narch/arm64/mm/mmu.c-1806-}\narch/arm64/mm/mmu.c:1807:#endif /* CONFIG_MEMORY_HOTPLUG */\narch/arm64/mm/mmu.c-1808-\n--\narch/arm64/mm/mmu.c=1891=int pud_free_pmd_page(pud_t *pudp, unsigned long addr)\n--\narch/arm64/mm/mmu.c-1939-\narch/arm64/mm/mmu.c:1940:#ifdef CONFIG_MEMORY_HOTPLUG\narch/arm64/mm/mmu.c-1941-static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)\n--\narch/loongarch/configs/loongson32_defconfig=97=CONFIG_ZSMALLOC=y\narch/loongarch/configs/loongson32_defconfig-98-# CONFIG_COMPAT_BRK is not set\narch/loongarch/configs/loongson32_defconfig:99:CONFIG_MEMORY_HOTPLUG=y\narch/loongarch/configs/loongson32_defconfig-100-# CONFIG_MHP_DEFAULT_ONLINE_TYPE_OFFLINE is not set\n--\narch/loongarch/configs/loongson64_defconfig=112=CONFIG_ZSMALLOC=y\narch/loongarch/configs/loongson64_defconfig-113-# CONFIG_COMPAT_BRK is not set\narch/loongarch/configs/loongson64_defconfig:114:CONFIG_MEMORY_HOTPLUG=y\narch/loongarch/configs/loongson64_defconfig-115-# CONFIG_MHP_DEFAULT_ONLINE_TYPE_OFFLINE is not set\n--\narch/loongarch/mm/init.c=64=void __init fixrange_init(unsigned long start, unsigned long end, pgd_t *pgd_base)\n--\narch/loongarch/mm/init.c-105-\narch/loongarch/mm/init.c:106:#ifdef CONFIG_MEMORY_HOTPLUG\narch/loongarch/mm/init.c-107-int arch_add_memory(int nid, u64 start, u64 size, struct mhp_params *params)\n--\narch/loongarch/mm/init.c=143=int __meminit vmemmap_populate(unsigned long start, unsigned long end,\n--\narch/loongarch/mm/init.c-152-\narch/loongarch/mm/init.c:153:#ifdef CONFIG_MEMORY_HOTPLUG\narch/loongarch/mm/init.c-154-void vmemmap_free(unsigned long start, unsigned long end, struct vmem_altmap *altmap)\n--\narch/powerpc/configs/powernv_defconfig=57=CONFIG_NUMA=y\narch/powerpc/configs/powernv_defconfig:58:CONFIG_MEMORY_HOTPLUG=y\narch/powerpc/configs/powernv_defconfig-59-CONFIG_MEMORY_HOTREMOVE=y\n--\narch/powerpc/configs/ppc64_defconfig=86=CONFIG_SHUFFLE_PAGE_ALLOCATOR=y\narch/powerpc/configs/ppc64_defconfig-87-# CONFIG_COMPAT_BRK is not set\narch/powerpc/configs/ppc64_defconfig:88:CONFIG_MEMORY_HOTPLUG=y\narch/powerpc/configs/ppc64_defconfig-89-CONFIG_MEMORY_HOTREMOVE=y\n--\narch/powerpc/include/asm/book3s/64/pgtable.h=1015=static inline int __meminit vmemmap_create_mapping(unsigned long start,\n--\narch/powerpc/include/asm/book3s/64/pgtable.h-1023-\narch/powerpc/include/asm/book3s/64/pgtable.h:1024:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/include/asm/book3s/64/pgtable.h-1025-static inline void vmemmap_remove_mapping(unsigned long start,\n--\narch/powerpc/include/asm/book3s/64/radix.h=333=static inline unsigned long radix__get_tree_size(void)\n--\narch/powerpc/include/asm/book3s/64/radix.h-348-\narch/powerpc/include/asm/book3s/64/radix.h:349:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/include/asm/book3s/64/radix.h-350-int radix__create_section_mapping(unsigned long start, unsigned long end,\n--\narch/powerpc/include/asm/book3s/64/radix.h=352=int radix__remove_section_mapping(unsigned long start, unsigned long end);\narch/powerpc/include/asm/book3s/64/radix.h:353:#endif /* CONFIG_MEMORY_HOTPLUG */\narch/powerpc/include/asm/book3s/64/radix.h-354-\n--\narch/powerpc/include/asm/machdep.h=26=struct machdep_calls {\n--\narch/powerpc/include/asm/machdep.h-33-#endif\narch/powerpc/include/asm/machdep.h:34:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/include/asm/machdep.h-35-\tunsigned long\t(*memory_block_size)(void);\n--\narch/powerpc/include/asm/mmzone.h=28=extern cpumask_var_t node_to_cpumask_map[];\narch/powerpc/include/asm/mmzone.h:29:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/include/asm/mmzone.h-30-extern unsigned long max_pfn;\n--\narch/powerpc/include/asm/sparsemem.h-14-\narch/powerpc/include/asm/sparsemem.h:15:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/include/asm/sparsemem.h-16-extern int remove_section_mapping(unsigned long start, unsigned long end);\n--\narch/powerpc/include/asm/sparsemem.h=23=static inline int hot_add_scn_to_nid(unsigned long scn_addr)\n--\narch/powerpc/include/asm/sparsemem.h-27-#endif /* CONFIG_NUMA */\narch/powerpc/include/asm/sparsemem.h:28:#endif /* CONFIG_MEMORY_HOTPLUG */\narch/powerpc/include/asm/sparsemem.h-29-#endif /* __KERNEL__ */\n--\narch/powerpc/kernel/setup_64.c=832=void __init setup_per_cpu_areas(void)\n--\narch/powerpc/kernel/setup_64.c-881-\narch/powerpc/kernel/setup_64.c:882:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/kernel/setup_64.c-883-unsigned long memory_block_size_bytes(void)\n--\narch/powerpc/kexec/crash.c=472=unsigned int arch_crash_get_elfcorehdr_size(void)\n--\narch/powerpc/kexec/crash.c-477-\tphdr_cnt = num_possible_cpus() + 1;\narch/powerpc/kexec/crash.c:478:\tif (IS_ENABLED(CONFIG_MEMORY_HOTPLUG))\narch/powerpc/kexec/crash.c-479-\t\tphdr_cnt += CONFIG_CRASH_MAX_MEMORY_RANGES;\n--\narch/powerpc/kexec/file_load_64.c=377=static unsigned int kdump_extra_elfcorehdr_size(struct crash_mem *cmem)\narch/powerpc/kexec/file_load_64.c-378-{\narch/powerpc/kexec/file_load_64.c:379:#if defined(CONFIG_CRASH_HOTPLUG) \u0026\u0026 defined(CONFIG_MEMORY_HOTPLUG)\narch/powerpc/kexec/file_load_64.c-380-\tunsigned int extra_sz = 0;\n--\narch/powerpc/mm/book3s64/hash_pgtable.c=107=int __meminit hash__vmemmap_create_mapping(unsigned long start,\n--\narch/powerpc/mm/book3s64/hash_pgtable.c-129-\narch/powerpc/mm/book3s64/hash_pgtable.c:130:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/mm/book3s64/hash_pgtable.c-131-void hash__vmemmap_remove_mapping(unsigned long start,\n--\narch/powerpc/mm/book3s64/hash_utils.c=1196=static unsigned long __init htab_get_table_size(void)\n--\narch/powerpc/mm/book3s64/hash_utils.c-1210-\narch/powerpc/mm/book3s64/hash_utils.c:1211:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/mm/book3s64/hash_utils.c-1212-static int resize_hpt_for_hotplug(unsigned long new_mem_size)\n--\narch/powerpc/mm/book3s64/hash_utils.c=1262=int hash__remove_section_mapping(unsigned long start, unsigned long end)\n--\narch/powerpc/mm/book3s64/hash_utils.c-1275-}\narch/powerpc/mm/book3s64/hash_utils.c:1276:#endif /* CONFIG_MEMORY_HOTPLUG */\narch/powerpc/mm/book3s64/hash_utils.c-1277-\n--\narch/powerpc/mm/book3s64/pgtable.c=275=notrace void mmu_cleanup_all(void)\n--\narch/powerpc/mm/book3s64/pgtable.c-284-\narch/powerpc/mm/book3s64/pgtable.c:285:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/mm/book3s64/pgtable.c-286-int __meminit create_section_mapping(unsigned long start, unsigned long end,\n--\narch/powerpc/mm/book3s64/pgtable.c=295=int __meminit remove_section_mapping(unsigned long start, unsigned long end)\n--\narch/powerpc/mm/book3s64/pgtable.c-301-}\narch/powerpc/mm/book3s64/pgtable.c:302:#endif /* CONFIG_MEMORY_HOTPLUG */\narch/powerpc/mm/book3s64/pgtable.c-303-\n--\narch/powerpc/mm/book3s64/radix_pgtable.c=679=notrace void radix__mmu_cleanup_all(void)\n--\narch/powerpc/mm/book3s64/radix_pgtable.c-691-\narch/powerpc/mm/book3s64/radix_pgtable.c:692:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/mm/book3s64/radix_pgtable.c-693-static void free_pte_table(pte_t *pte_start, pmd_t *pmd)\n--\narch/powerpc/mm/book3s64/radix_pgtable.c=946=int __meminit radix__remove_section_mapping(unsigned long start, unsigned long end)\n--\narch/powerpc/mm/book3s64/radix_pgtable.c-950-}\narch/powerpc/mm/book3s64/radix_pgtable.c:951:#endif /* CONFIG_MEMORY_HOTPLUG */\narch/powerpc/mm/book3s64/radix_pgtable.c-952-\n--\narch/powerpc/mm/book3s64/radix_pgtable.c=1306=int __meminit vmemmap_populate_compound_pages(unsigned long start_pfn,\n--\narch/powerpc/mm/book3s64/radix_pgtable.c-1413-\narch/powerpc/mm/book3s64/radix_pgtable.c:1414:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/mm/book3s64/radix_pgtable.c-1415-void __meminit radix__vmemmap_remove_mapping(unsigned long start, unsigned long page_size)\n--\narch/powerpc/mm/init_64.c=276=int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,\n--\narch/powerpc/mm/init_64.c-287-\narch/powerpc/mm/init_64.c:288:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/mm/init_64.c-289-static unsigned long vmemmap_list_free(unsigned long start)\n--\narch/powerpc/mm/init_64.c=466=static int __init dt_scan_mmu_pid_width(unsigned long node,\n--\narch/powerpc/mm/init_64.c-498- */\narch/powerpc/mm/init_64.c:499:#ifndef CONFIG_MEMORY_HOTPLUG\narch/powerpc/mm/init_64.c-500-#define DEFAULT_MEMORY_BLOCK_SIZE\tSZ_16M\n--\narch/powerpc/mm/mem.c=52=EXPORT_SYMBOL(__phys_mem_access_prot);\narch/powerpc/mm/mem.c-53-\narch/powerpc/mm/mem.c:54:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/mm/mem.c-55-static DEFINE_MUTEX(linear_mapping_mutex);\n--\narch/powerpc/mm/mmu_decl.h=174=static inline bool debug_pagealloc_enabled_or_kfence(void)\n--\narch/powerpc/mm/mmu_decl.h-178-\narch/powerpc/mm/mmu_decl.h:179:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/mm/mmu_decl.h-180-int create_section_mapping(unsigned long start, unsigned long end,\n--\narch/powerpc/mm/nohash/book3e_pgtable.c=23=int __meminit vmemmap_create_mapping(unsigned long start,\n--\narch/powerpc/mm/nohash/book3e_pgtable.c-46-\narch/powerpc/mm/nohash/book3e_pgtable.c:47:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/mm/nohash/book3e_pgtable.c-48-void vmemmap_remove_mapping(unsigned long start,\n--\narch/powerpc/mm/numa.c=1241=early_param(\"numa\", early_numa);\narch/powerpc/mm/numa.c-1242-\narch/powerpc/mm/numa.c:1243:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/mm/numa.c-1244-/*\n--\narch/powerpc/mm/numa.c=1365=u64 memory_hotplug_max(void)\n--\narch/powerpc/mm/numa.c-1368-}\narch/powerpc/mm/numa.c:1369:#endif /* CONFIG_MEMORY_HOTPLUG */\narch/powerpc/mm/numa.c-1370-\n--\narch/powerpc/platforms/powernv/setup.c=437=static void pnv_kexec_cpu_down(int crash_shutdown, int secondary)\n--\narch/powerpc/platforms/powernv/setup.c-482-\narch/powerpc/platforms/powernv/setup.c:483:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/platforms/powernv/setup.c-484-static unsigned long pnv_memory_block_size(void)\n--\narch/powerpc/platforms/powernv/setup.c=569=define_machine(powernv) {\n--\narch/powerpc/platforms/powernv/setup.c-584-#endif\narch/powerpc/platforms/powernv/setup.c:585:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/platforms/powernv/setup.c-586-\t.memory_block_size\t= pnv_memory_block_size,\n--\narch/powerpc/platforms/pseries/Makefile=17=obj-$(CONFIG_HOTPLUG_CPU)\t+= hotplug-cpu.o\narch/powerpc/platforms/pseries/Makefile:18:obj-$(CONFIG_MEMORY_HOTPLUG)\t+= hotplug-memory.o pmem.o\narch/powerpc/platforms/pseries/Makefile-19-\n--\narch/powerpc/platforms/pseries/iommu.c=1286=static phys_addr_t ddw_memory_hotplug_max(void)\n--\narch/powerpc/platforms/pseries/iommu.c-1289-\narch/powerpc/platforms/pseries/iommu.c:1290:#if defined(CONFIG_NUMA) \u0026\u0026 defined(CONFIG_MEMORY_HOTPLUG)\narch/powerpc/platforms/pseries/iommu.c-1291-\tmax_addr = hot_add_drconf_memory_max();\n--\narch/powerpc/platforms/pseries/pseries.h=60=int handle_dlpar_errorlog(struct pseries_hp_errorlog *hp_errlog);\narch/powerpc/platforms/pseries/pseries.h-61-\narch/powerpc/platforms/pseries/pseries.h:62:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/platforms/pseries/pseries.h-63-int dlpar_memory(struct pseries_hp_errorlog *hp_elog);\n--\narch/powerpc/platforms/pseries/setup.c=1118=static int pSeries_pci_probe_mode(struct pci_bus *bus)\n--\narch/powerpc/platforms/pseries/setup.c-1124-\narch/powerpc/platforms/pseries/setup.c:1125:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/platforms/pseries/setup.c-1126-static unsigned long pseries_memory_block_size(void)\n--\narch/powerpc/platforms/pseries/setup.c=1139=define_machine(pseries) {\n--\narch/powerpc/platforms/pseries/setup.c-1161-#endif\narch/powerpc/platforms/pseries/setup.c:1162:#ifdef CONFIG_MEMORY_HOTPLUG\narch/powerpc/platforms/pseries/setup.c-1163-\t.memory_block_size\t= pseries_memory_block_size,\n--\narch/riscv/mm/init.c=1429=void __init pgtable_cache_init(void)\n--\narch/riscv/mm/init.c-1433-\t\tpreallocate_pgd_pages_range(MODULES_VADDR, MODULES_END, \"bpf/modules\");\narch/riscv/mm/init.c:1434:\tif (IS_ENABLED(CONFIG_MEMORY_HOTPLUG)) {\narch/riscv/mm/init.c-1435-\t\tpreallocate_pgd_pages_range(VMEMMAP_START, VMEMMAP_END, \"vmemmap\");\n--\narch/riscv/mm/init.c=1447=struct execmem_info __init *execmem_arch_setup(void)\n--\narch/riscv/mm/init.c-1476-\narch/riscv/mm/init.c:1477:#ifdef CONFIG_MEMORY_HOTPLUG\narch/riscv/mm/init.c-1478-static void __meminit free_pte_table(pte_t *pte_start, pmd_t *pmd)\n--\narch/riscv/mm/init.c=1740=void __ref vmemmap_free(unsigned long start, unsigned long end, struct vmem_altmap *altmap)\n--\narch/riscv/mm/init.c-1743-}\narch/riscv/mm/init.c:1744:#endif /* CONFIG_MEMORY_HOTPLUG */\n--\narch/s390/configs/debug_defconfig=103=CONFIG_SLUB_STATS=y\narch/s390/configs/debug_defconfig-104-# CONFIG_COMPAT_BRK is not set\narch/s390/configs/debug_defconfig:105:CONFIG_MEMORY_HOTPLUG=y\narch/s390/configs/debug_defconfig-106-CONFIG_MEMORY_HOTREMOVE=y\n--\narch/s390/configs/defconfig=96=CONFIG_SLAB_BUCKETS=y\narch/s390/configs/defconfig-97-# CONFIG_COMPAT_BRK is not set\narch/s390/configs/defconfig:98:CONFIG_MEMORY_HOTPLUG=y\narch/s390/configs/defconfig-99-CONFIG_MEMORY_HOTREMOVE=y\n--\narch/s390/mm/init.c=188=void __init setup_per_cpu_areas(void)\n--\narch/s390/mm/init.c-209-\narch/s390/mm/init.c:210:#ifdef CONFIG_MEMORY_HOTPLUG\narch/s390/mm/init.c-211-\n--\narch/s390/mm/init.c=281=void arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap,\n--\narch/s390/mm/init.c-289-}\narch/s390/mm/init.c:290:#endif /* CONFIG_MEMORY_HOTPLUG */\narch/s390/mm/init.c-291-\n--\narch/s390/mm/vmem.c=513=int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,\n--\narch/s390/mm/vmem.c-526-\narch/s390/mm/vmem.c:527:#ifdef CONFIG_MEMORY_HOTPLUG\narch/s390/mm/vmem.c-528-\n--\narch/x86/kernel/crash.c=416=int crash_load_segments(struct kimage *image)\n--\narch/x86/kernel/crash.c-436-\t */\narch/x86/kernel/crash.c:437:\tif (IS_ENABLED(CONFIG_MEMORY_HOTPLUG))\narch/x86/kernel/crash.c-438-\t\tpnum = 2 + CONFIG_NR_CPUS_DEFAULT + CONFIG_CRASH_MAX_MEMORY_RANGES;\n--\narch/x86/kernel/crash.c=494=unsigned int arch_crash_get_elfcorehdr_size(void)\n--\narch/x86/kernel/crash.c-499-\tsz = 2 + CONFIG_NR_CPUS_DEFAULT;\narch/x86/kernel/crash.c:500:\tif (IS_ENABLED(CONFIG_MEMORY_HOTPLUG))\narch/x86/kernel/crash.c-501-\t\tsz += CONFIG_CRASH_MAX_MEMORY_RANGES;\n--\narch/x86/kernel/e820.c=909=__init static int parse_memopt(char *p)\n--\narch/x86/kernel/e820.c-934-\narch/x86/kernel/e820.c:935:#ifdef CONFIG_MEMORY_HOTPLUG\narch/x86/kernel/e820.c-936-\tmax_mem_size = mem_size;\n--\narch/x86/kernel/e820.c=1288=__init void e820__memblock_setup(void)\n--\narch/x86/kernel/e820.c-1292-\narch/x86/kernel/e820.c:1293:#ifdef CONFIG_MEMORY_HOTPLUG\narch/x86/kernel/e820.c-1294-\t/*\n--\narch/x86/mm/init_64.c=854=static void __meminit vmemmap_flush_unused_pmd(void)\n--\narch/x86/mm/init_64.c-865-\narch/x86/mm/init_64.c:866:#ifdef CONFIG_MEMORY_HOTPLUG\narch/x86/mm/init_64.c-867-/* Returns true if the PMD is completely unused and thus it can be freed */\n--\narch/x86/mm/init_64.c=918=static void __meminit vmemmap_use_new_sub_pmd(unsigned long start, unsigned long end)\n--\narch/x86/mm/init_64.c-947- */\narch/x86/mm/init_64.c:948:#ifdef CONFIG_MEMORY_HOTPLUG\narch/x86/mm/init_64.c-949-/*\n--\narch/x86/mm/init_64.c=1303=void __ref arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap,\n--\narch/x86/mm/init_64.c-1311-}\narch/x86/mm/init_64.c:1312:#endif /* CONFIG_MEMORY_HOTPLUG */\narch/x86/mm/init_64.c-1313-\n--\narch/x86/xen/setup.c=537=static void __init xen_align_and_add_e820_region(phys_addr_t start,\n--\narch/x86/xen/setup.c-545-\t\tend \u0026= ~((phys_addr_t)PAGE_SIZE - 1);\narch/x86/xen/setup.c:546:#ifdef CONFIG_MEMORY_HOTPLUG\narch/x86/xen/setup.c-547-\t\t/*\n--\narch/x86/xen/setup.c=794=char * __init xen_memory_setup(void)\n--\narch/x86/xen/setup.c-813-\narch/x86/xen/setup.c:814:#if defined(CONFIG_MEMORY_HOTPLUG) \u0026\u0026 defined(CONFIG_XEN_BALLOON)\narch/x86/xen/setup.c-815-\txen_saved_max_mem_size = max_mem_size;\n--\ndrivers/acpi/numa/srat.c=359=acpi_parse_memory_affinity(union acpi_subtable_headers *header,\n--\ndrivers/acpi/numa/srat.c-379-\t\treturn 0;\ndrivers/acpi/numa/srat.c:380:\thotpluggable = IS_ENABLED(CONFIG_MEMORY_HOTPLUG) \u0026\u0026\ndrivers/acpi/numa/srat.c-381-\t\t(ma-\u003eflags \u0026 ACPI_SRAT_MEM_HOT_PLUGGABLE);\n--\ndrivers/acpi/pci_root.c=428=static u32 calculate_support(void)\n--\ndrivers/acpi/pci_root.c-451- * Background on hotplug support, and making it depend on only\ndrivers/acpi/pci_root.c:452: * CONFIG_HOTPLUG_PCI_PCIE vs. also considering CONFIG_MEMORY_HOTPLUG:\ndrivers/acpi/pci_root.c-453- *\ndrivers/acpi/pci_root.c:454: * CONFIG_ACPI_HOTPLUG_MEMORY does depend on CONFIG_MEMORY_HOTPLUG, but\ndrivers/acpi/pci_root.c-455- * there is no existing _OSC for memory hotplug support. The reason is that\n--\ndrivers/acpi/pci_root.c-470- * not support blocking hotplug, is to require the memory device to be\ndrivers/acpi/pci_root.c:471: * disabled before hotplug is attempted. When CONFIG_MEMORY_HOTPLUG is\ndrivers/acpi/pci_root.c-472- * disabled that step will fail and the remove attempt cancelled by the\ndrivers/acpi/pci_root.c-473- * user. If that is not honored and the card is removed anyway then it\ndrivers/acpi/pci_root.c:474: * does not matter if CONFIG_MEMORY_HOTPLUG is enabled or not, it will\ndrivers/acpi/pci_root.c-475- * cause a crash and other badness.\n--\ndrivers/base/Makefile=15=obj-$(CONFIG_NUMA)\t+= node.o\ndrivers/base/Makefile:16:obj-$(CONFIG_MEMORY_HOTPLUG) += memory.o\ndrivers/base/Makefile-17-ifeq ($(CONFIG_SYSFS),y)\n--\ndrivers/base/memory.c=207=int memory_notify(enum memory_block_state state, void *v)\n--\ndrivers/base/memory.c-211-\ndrivers/base/memory.c:212:#if defined(CONFIG_MEMORY_FAILURE) \u0026\u0026 defined(CONFIG_MEMORY_HOTPLUG)\ndrivers/base/memory.c-213-static unsigned long memblk_nr_poison(struct memory_block *mem);\n--\ndrivers/base/memory.c=1196=int walk_dynamic_memory_groups(int nid, walk_memory_groups_func_t func,\n--\ndrivers/base/memory.c-1217-\ndrivers/base/memory.c:1218:#if defined(CONFIG_MEMORY_FAILURE) \u0026\u0026 defined(CONFIG_MEMORY_HOTPLUG)\ndrivers/base/memory.c-1219-void memblk_nr_poison_inc(unsigned long pfn)\n--\ndrivers/base/node.c=109=static const struct attribute_group *node_access_node_groups[] = {\n--\ndrivers/base/node.c-114-\ndrivers/base/node.c:115:#ifdef CONFIG_MEMORY_HOTPLUG\ndrivers/base/node.c-116-static BLOCKING_NOTIFIER_HEAD(node_chain);\n--\ndrivers/base/node.c=764=int unregister_cpu_under_node(unsigned int cpu, unsigned int nid)\n--\ndrivers/base/node.c-782-\ndrivers/base/node.c:783:#ifdef CONFIG_MEMORY_HOTPLUG\ndrivers/base/node.c-784-static void do_register_memory_block_under_node(int nid,\n--\ndrivers/base/node.c=864=void register_memory_blocks_under_node_hotplug(int nid, unsigned long start_pfn,\n--\ndrivers/base/node.c-870-}\ndrivers/base/node.c:871:#endif /* CONFIG_MEMORY_HOTPLUG */\ndrivers/base/node.c-872-\n--\ndrivers/hv/hv_balloon.c=579=static void disable_page_reporting(void);\ndrivers/hv/hv_balloon.c-580-\ndrivers/hv/hv_balloon.c:581:#ifdef CONFIG_MEMORY_HOTPLUG\ndrivers/hv/hv_balloon.c-582-static inline bool has_pfn_is_backed(struct hv_hotadd_state *has,\n--\ndrivers/hv/hv_balloon.c=968=static void hot_add_req(struct work_struct *dummy)\n--\ndrivers/hv/hv_balloon.c-970-\tstruct dm_hot_add_response resp;\ndrivers/hv/hv_balloon.c:971:#ifdef CONFIG_MEMORY_HOTPLUG\ndrivers/hv/hv_balloon.c-972-\tunsigned long pg_start, pfn_cnt;\n--\ndrivers/hv/hv_balloon.c-980-\ndrivers/hv/hv_balloon.c:981:#ifdef CONFIG_MEMORY_HOTPLUG\ndrivers/hv/hv_balloon.c-982-\tpg_start = dm-\u003eha_wrk.ha_page_range.finfo.start_page;\n--\ndrivers/hv/hv_balloon.c=1936=static int balloon_probe(struct hv_device *dev,\n--\ndrivers/hv/hv_balloon.c-1944-\ndrivers/hv/hv_balloon.c:1945:#ifdef CONFIG_MEMORY_HOTPLUG\ndrivers/hv/hv_balloon.c-1946-\t/*\n--\ndrivers/hv/hv_balloon.c-1975-\ndrivers/hv/hv_balloon.c:1976:#ifdef CONFIG_MEMORY_HOTPLUG\ndrivers/hv/hv_balloon.c-1977-\tset_online_page_callback(\u0026hv_online_page);\n--\ndrivers/hv/hv_balloon.c-2007-connect_error:\ndrivers/hv/hv_balloon.c:2008:#ifdef CONFIG_MEMORY_HOTPLUG\ndrivers/hv/hv_balloon.c-2009-\tunregister_memory_notifier(\u0026hv_memory_nb);\n--\ndrivers/hv/hv_balloon.c=2015=static void balloon_remove(struct hv_device *dev)\n--\ndrivers/hv/hv_balloon.c-2038-\t\tvmbus_close(dev-\u003echannel);\ndrivers/hv/hv_balloon.c:2039:#ifdef CONFIG_MEMORY_HOTPLUG\ndrivers/hv/hv_balloon.c-2040-\t\tunregister_memory_notifier(\u0026hv_memory_nb);\n--\ndrivers/hv/hv_balloon.c=2076=static int balloon_resume(struct hv_device *dev)\n--\ndrivers/hv/hv_balloon.c-2101-\tdisable_page_reporting();\ndrivers/hv/hv_balloon.c:2102:#ifdef CONFIG_MEMORY_HOTPLUG\ndrivers/hv/hv_balloon.c-2103-\tunregister_memory_notifier(\u0026hv_memory_nb);\n--\ndrivers/s390/char/Makefile=20=obj-y += ctrlchar.o keyboard.o defkeymap.o sclp.o sclp_rw.o sclp_quiesce.o \\\n--\ndrivers/s390/char/Makefile-23-\ndrivers/s390/char/Makefile:24:obj-$(CONFIG_MEMORY_HOTPLUG) += sclp_mem.o\ndrivers/s390/char/Makefile-25-obj-$(CONFIG_TN3270) += raw3270.o con3270.o\n--\ndrivers/xen/xen-balloon.c-53-\ndrivers/xen/xen-balloon.c:54:#ifdef CONFIG_MEMORY_HOTPLUG\ndrivers/xen/xen-balloon.c-55-u64 xen_saved_max_mem_size = 0;\n--\ndrivers/xen/xen-balloon.c=63=static void watch_target(struct xenbus_watch *watch,\n--\ndrivers/xen/xen-balloon.c-70-\ndrivers/xen/xen-balloon.c:71:#ifdef CONFIG_MEMORY_HOTPLUG\ndrivers/xen/xen-balloon.c-72-\t/* The balloon driver will take care of adding memory now. */\n--\ninclude/linux/init.h-80-\ninclude/linux/init.h:81:#ifdef CONFIG_MEMORY_HOTPLUG\ninclude/linux/init.h-82-#define __meminit\n--\ninclude/linux/ioport.h=394=extern void release_mem_region_adjustable(resource_size_t, resource_size_t);\ninclude/linux/ioport.h-395-#endif\ninclude/linux/ioport.h:396:#ifdef CONFIG_MEMORY_HOTPLUG\ninclude/linux/ioport.h-397-extern void merge_system_ram_resource(struct resource *res);\n--\ninclude/linux/memory.h=78=struct memory_block {\n--\ninclude/linux/memory.h-93-\tstruct list_head group_next;\t/* next block inside memory group */\ninclude/linux/memory.h:94:#if defined(CONFIG_MEMORY_FAILURE) \u0026\u0026 defined(CONFIG_MEMORY_HOTPLUG)\ninclude/linux/memory.h-95-\tatomic_long_t nr_hwpoison;\n--\ninclude/linux/memory.h=109=struct mem_section;\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 28613
							output: 20
							thoughts: 50
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Memory Hotplug Configuration Investigation**

Alright, so `CONFIG_MEMORY_HOTPLUG` is the primary switch. That's the given. Now, the next question is always: do I *also* need `CONFIG_MEMORY_HOTREMOVE`? Are those functionally distinct or just logically different? I need to clarify the relationship there.

To answer that, I'm thinking I should dive straight into the code. The standard go-to in these situations is `mm/memory_hotplug.c`. That's where all the core memory hotplug logic usually resides. Specifically, I'm going to look for the implementation of `try_offline_node`. That function is critical; it’s the gateway to taking a node offline. Understanding its checks and preconditions will give me a very clear picture of when hotremove functionality is actually *required* to exist and be enabled and the relationship that has with the base hotplug configuration. This should clarify the configuration dependencies quickly.

{
  "Expression": "CONFIG_MEMORY_HOTREMOVE"
}

{
  "Output": "Documentation/admin-guide/mm/memory-hotplug.rst=336=The following files are currently defined:\n--\nDocumentation/admin-guide/mm/memory-hotplug.rst-377-\nDocumentation/admin-guide/mm/memory-hotplug.rst:378:\t\t    Availability depends on the CONFIG_MEMORY_HOTREMOVE\nDocumentation/admin-guide/mm/memory-hotplug.rst-379-\t\t    kernel configuration option.\n--\narch/arm64/configs/defconfig=133=CONFIG_MEMORY_HOTPLUG=y\narch/arm64/configs/defconfig:134:CONFIG_MEMORY_HOTREMOVE=y\narch/arm64/configs/defconfig-135-CONFIG_KSM=y\n--\narch/arm64/mm/mmu.c=2246=static int __init prevent_memory_remove_init(void)\n--\narch/arm64/mm/mmu.c-2249-\narch/arm64/mm/mmu.c:2250:\tif (!IS_ENABLED(CONFIG_MEMORY_HOTREMOVE))\narch/arm64/mm/mmu.c-2251-\t\treturn ret;\n--\narch/loongarch/configs/loongson32_defconfig=101=CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO=y\n--\narch/loongarch/configs/loongson32_defconfig-103-# CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_MOVABLE is not set\narch/loongarch/configs/loongson32_defconfig:104:CONFIG_MEMORY_HOTREMOVE=y\narch/loongarch/configs/loongson32_defconfig-105-CONFIG_KSM=y\n--\narch/loongarch/configs/loongson64_defconfig=116=CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO=y\n--\narch/loongarch/configs/loongson64_defconfig-118-# CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_MOVABLE is not set\narch/loongarch/configs/loongson64_defconfig:119:CONFIG_MEMORY_HOTREMOVE=y\narch/loongarch/configs/loongson64_defconfig-120-CONFIG_KSM=y\n--\narch/powerpc/configs/powernv_defconfig=58=CONFIG_MEMORY_HOTPLUG=y\narch/powerpc/configs/powernv_defconfig:59:CONFIG_MEMORY_HOTREMOVE=y\narch/powerpc/configs/powernv_defconfig-60-CONFIG_KSM=y\n--\narch/powerpc/configs/ppc64_defconfig=88=CONFIG_MEMORY_HOTPLUG=y\narch/powerpc/configs/ppc64_defconfig:89:CONFIG_MEMORY_HOTREMOVE=y\narch/powerpc/configs/ppc64_defconfig-90-CONFIG_KSM=y\n--\narch/powerpc/platforms/pseries/hotplug-memory.c=222=static int dlpar_online_lmb(struct drmem_lmb *lmb)\n--\narch/powerpc/platforms/pseries/hotplug-memory.c-226-\narch/powerpc/platforms/pseries/hotplug-memory.c:227:#ifdef CONFIG_MEMORY_HOTREMOVE\narch/powerpc/platforms/pseries/hotplug-memory.c-228-static int dlpar_offline_lmb(struct drmem_lmb *lmb)\n--\narch/powerpc/platforms/pseries/hotplug-memory.c=558=static int dlpar_memory_remove_by_ic(u32 lmbs_to_remove, u32 drc_index)\n--\narch/powerpc/platforms/pseries/hotplug-memory.c-561-}\narch/powerpc/platforms/pseries/hotplug-memory.c:562:#endif /* CONFIG_MEMORY_HOTREMOVE */\narch/powerpc/platforms/pseries/hotplug-memory.c-563-\n--\narch/s390/configs/debug_defconfig=105=CONFIG_MEMORY_HOTPLUG=y\narch/s390/configs/debug_defconfig:106:CONFIG_MEMORY_HOTREMOVE=y\narch/s390/configs/debug_defconfig-107-CONFIG_KSM=y\n--\narch/s390/configs/defconfig=98=CONFIG_MEMORY_HOTPLUG=y\narch/s390/configs/defconfig:99:CONFIG_MEMORY_HOTREMOVE=y\narch/s390/configs/defconfig-100-CONFIG_KSM=y\n--\narch/x86/boot/compressed/acpi.c=157=acpi_physical_address get_rsdp_addr(void)\n--\narch/x86/boot/compressed/acpi.c-171-\narch/x86/boot/compressed/acpi.c:172:#if defined(CONFIG_RANDOMIZE_BASE) \u0026\u0026 defined(CONFIG_MEMORY_HOTREMOVE)\narch/x86/boot/compressed/acpi.c-173-/*\n--\narch/x86/boot/compressed/acpi.c=270=int count_immovable_mem_regions(void)\n--\narch/x86/boot/compressed/acpi.c-316-}\narch/x86/boot/compressed/acpi.c:317:#endif /* CONFIG_RANDOMIZE_BASE \u0026\u0026 CONFIG_MEMORY_HOTREMOVE */\n--\narch/x86/boot/compressed/kaslr.c=596=static bool process_mem_region(struct mem_vector *region,\n--\narch/x86/boot/compressed/kaslr.c-614-\narch/x86/boot/compressed/kaslr.c:615:#if defined(CONFIG_MEMORY_HOTREMOVE) \u0026\u0026 defined(CONFIG_ACPI)\narch/x86/boot/compressed/kaslr.c-616-\t/*\n--\narch/x86/boot/compressed/misc.h=171=static inline acpi_physical_address get_rsdp_addr(void) { return 0; }\n--\narch/x86/boot/compressed/misc.h-173-\narch/x86/boot/compressed/misc.h:174:#if defined(CONFIG_RANDOMIZE_BASE) \u0026\u0026 defined(CONFIG_MEMORY_HOTREMOVE) \u0026\u0026 defined(CONFIG_ACPI)\narch/x86/boot/compressed/misc.h-175-extern struct mem_vector immovable_mem[MAX_NUMNODES*2];\n--\ndrivers/base/memory.c=158=static ssize_t phys_index_show(struct device *dev,\n--\ndrivers/base/memory.c-167- * Legacy interface that we cannot remove. Always indicate \"removable\"\ndrivers/base/memory.c:168: * with CONFIG_MEMORY_HOTREMOVE - bad heuristic.\ndrivers/base/memory.c-169- */\ndrivers/base/memory.c=170=static ssize_t removable_show(struct device *dev, struct device_attribute *attr,\n--\ndrivers/base/memory.c-172-{\ndrivers/base/memory.c:173:\treturn sysfs_emit(buf, \"%d\\n\", (int)IS_ENABLED(CONFIG_MEMORY_HOTREMOVE));\ndrivers/base/memory.c-174-}\n--\ndrivers/base/memory.c=441=static ssize_t phys_device_show(struct device *dev,\n--\ndrivers/base/memory.c-450-\ndrivers/base/memory.c:451:#ifdef CONFIG_MEMORY_HOTREMOVE\ndrivers/base/memory.c-452-static int print_allowed_zone(char *buf, int len, int nid,\n--\ndrivers/base/memory.c=662=static struct attribute *memory_memblk_attrs[] = {\n--\ndrivers/base/memory.c-666-\t\u0026dev_attr_removable.attr,\ndrivers/base/memory.c:667:#ifdef CONFIG_MEMORY_HOTREMOVE\ndrivers/base/memory.c-668-\t\u0026dev_attr_valid_zones.attr,\n--\ndrivers/dax/kmem.c=68=static int dev_dax_kmem_probe(struct dev_dax *dev_dax)\n--\ndrivers/dax/kmem.c-207-\ndrivers/dax/kmem.c:208:#ifdef CONFIG_MEMORY_HOTREMOVE\ndrivers/dax/kmem.c-209-static void dev_dax_kmem_remove(struct dev_dax *dev_dax)\n--\ndrivers/dax/kmem.c=266=static void dev_dax_kmem_remove(struct dev_dax *dev_dax)\n--\ndrivers/dax/kmem.c-276-}\ndrivers/dax/kmem.c:277:#endif /* CONFIG_MEMORY_HOTREMOVE */\ndrivers/dax/kmem.c-278-\n--\ninclude/linux/ioport.h=391=extern void __release_region(struct resource *, resource_size_t,\ninclude/linux/ioport.h-392-\t\t\t\tresource_size_t);\ninclude/linux/ioport.h:393:#ifdef CONFIG_MEMORY_HOTREMOVE\ninclude/linux/ioport.h-394-extern void release_mem_region_adjustable(resource_size_t, resource_size_t);\n--\ninclude/linux/memory_hotplug.h=259=static inline void pgdat_resize_init(struct pglist_data *pgdat) {}\n--\ninclude/linux/memory_hotplug.h-261-\ninclude/linux/memory_hotplug.h:262:#ifdef CONFIG_MEMORY_HOTREMOVE\ninclude/linux/memory_hotplug.h-263-\n--\ninclude/linux/memory_hotplug.h=285=static inline void __remove_memory(u64 start, u64 size) {}\ninclude/linux/memory_hotplug.h:286:#endif /* CONFIG_MEMORY_HOTREMOVE */\ninclude/linux/memory_hotplug.h-287-\n--\nkernel/configs/xen.config=15=CONFIG_MEMORY_HOTPLUG=y\nkernel/configs/xen.config:16:CONFIG_MEMORY_HOTREMOVE=y\nkernel/configs/xen.config-17-CONFIG_ZONE_DEVICE=y\n--\nkernel/resource.c=1446=EXPORT_SYMBOL(__release_region);\nkernel/resource.c-1447-\nkernel/resource.c:1448:#ifdef CONFIG_MEMORY_HOTREMOVE\nkernel/resource.c-1449-static void append_child_to_parent(struct resource *new_parent, struct resource *new_child)\n--\nkernel/resource.c=1507=void release_mem_region_adjustable(resource_size_t start, resource_size_t size)\n--\nkernel/resource.c-1596-}\nkernel/resource.c:1597:#endif\t/* CONFIG_MEMORY_HOTREMOVE */\nkernel/resource.c-1598-\n--\nmm/ksm.c=3269=void folio_migrate_ksm(struct folio *newfolio, struct folio *folio)\n--\nmm/ksm.c-3292-\nmm/ksm.c:3293:#ifdef CONFIG_MEMORY_HOTREMOVE\nmm/ksm.c-3294-static void wait_while_offlining(void)\n--\nmm/ksm.c=3417=static void wait_while_offlining(void)\n--\nmm/ksm.c-3419-}\nmm/ksm.c:3420:#endif /* CONFIG_MEMORY_HOTREMOVE */\nmm/ksm.c-3421-\n--\nmm/ksm.c=3977=static int __init ksm_init(void)\n--\nmm/ksm.c-4009-\nmm/ksm.c:4010:#ifdef CONFIG_MEMORY_HOTREMOVE\nmm/ksm.c-4011-\t/* There is no significance to this priority 100 */\n--\nmm/memory_hotplug.c=1721=bool mhp_range_allowed(u64 start, u64 size, bool need_mapping)\n--\nmm/memory_hotplug.c-1733-\nmm/memory_hotplug.c:1734:#ifdef CONFIG_MEMORY_HOTREMOVE\nmm/memory_hotplug.c-1735-/*\n--\nmm/memory_hotplug.c=2438=EXPORT_SYMBOL_GPL(offline_and_remove_memory);\nmm/memory_hotplug.c:2439:#endif /* CONFIG_MEMORY_HOTREMOVE */\n--\nmm/page_alloc.c=4374=static unsigned int zonelist_iter_begin(void)\nmm/page_alloc.c-4375-{\nmm/page_alloc.c:4376:\tif (IS_ENABLED(CONFIG_MEMORY_HOTREMOVE))\nmm/page_alloc.c-4377-\t\treturn read_seqbegin(\u0026zonelist_update_seq);\n--\nmm/page_alloc.c=4382=static unsigned int check_retry_zonelist(unsigned int seq)\nmm/page_alloc.c-4383-{\nmm/page_alloc.c:4384:\tif (IS_ENABLED(CONFIG_MEMORY_HOTREMOVE))\nmm/page_alloc.c-4385-\t\treturn read_seqretry(\u0026zonelist_update_seq, seq);\n--\nmm/page_alloc.c=7517=void zone_pcp_reset(struct zone *zone)\n--\nmm/page_alloc.c-7535-\nmm/page_alloc.c:7536:#ifdef CONFIG_MEMORY_HOTREMOVE\nmm/page_alloc.c-7537-/*\n--\ntools/testing/selftests/bpf/config.aarch64=90=CONFIG_MEMORY_HOTPLUG=y\ntools/testing/selftests/bpf/config.aarch64:91:CONFIG_MEMORY_HOTREMOVE=y\ntools/testing/selftests/bpf/config.aarch64-92-CONFIG_NAMESPACES=y\n--\ntools/testing/selftests/bpf/config.s390x=76=CONFIG_MEMORY_HOTPLUG=y\ntools/testing/selftests/bpf/config.s390x:77:CONFIG_MEMORY_HOTREMOVE=y\ntools/testing/selftests/bpf/config.s390x-78-CONFIG_NAMESPACES=y\n--\ntools/testing/selftests/memory-hotplug/config=3=CONFIG_MEMORY_NOTIFIER_ERROR_INJECT=m\ntools/testing/selftests/memory-hotplug/config:4:CONFIG_MEMORY_HOTREMOVE=y\n--\ntools/testing/selftests/vsock/config=109=CONFIG_MEMORY_HOTPLUG=y\ntools/testing/selftests/vsock/config:110:CONFIG_MEMORY_HOTREMOVE=y\ntools/testing/selftests/vsock/config-111-CONFIG_ZONE_DEVICE=y\n"
}

gemini-3.1-pro-preview

null

null

							input: 32697
							output: 35
							thoughts: 59
						

Okay, let's break this down.

**Diving into the `memory_hotplug` Code**

Alright, so I'm thinking about `try_offline_node`. That function is definitely tied to memory hot-remove functionality. I'm pretty sure I saw it in `include/linux/memory_hotplug.h` under that `#ifdef CONFIG_MEMORY_HOTREMOVE` guard. It's a key function for offlining a node, so it makes sense it's conditional like that.

Just to be absolutely certain, I should quickly jump to that header file and double check the context. Specifically, I'm going to look around line 262 to get the precise location and make sure my mental map is accurate. I want to see how that function interacts with the other definitions around it. Gotta get the full picture, even for something I *think* I already know! Better safe than sorry when you're dealing with memory management at this level.

{
  "Expression": "try_offline_node",
  "PathPrefix": "include/linux/memory_hotplug.h"
}

{
  "Output": "include/linux/memory_hotplug.h=259=static inline void pgdat_resize_init(struct pglist_data *pgdat) {}\n--\ninclude/linux/memory_hotplug.h-263-\ninclude/linux/memory_hotplug.h:264:extern void try_offline_node(int nid);\ninclude/linux/memory_hotplug.h-265-extern int offline_pages(unsigned long start_pfn, unsigned long nr_pages,\n--\ninclude/linux/memory_hotplug.h=269=extern int offline_and_remove_memory(u64 start, u64 size);\n--\ninclude/linux/memory_hotplug.h-271-#else\ninclude/linux/memory_hotplug.h:272:static inline void try_offline_node(int nid) {}\ninclude/linux/memory_hotplug.h-273-\n"
}

gemini-3.1-pro-preview

null

null

							input: 33227
							output: 19
							thoughts: 337
						

**Analyzing Memory Hotplug and VM Statistics**

Okay, so I've confirmed that `try_offline_node` is only defined if `CONFIG_MEMORY_HOTREMOVE` is enabled. Seems pretty obvious, but always good to check. Therefore, it obviously needs `CONFIG_MEMORY_HOTREMOVE` to be enabled, and since memory hotremove implies hotplug, `CONFIG_MEMORY_HOTPLUG` is also necessary.

Now, I was looking at `sync_vm_stats`, and it's located in `mm/vmstat.c`. I know that file is always compiled in, so that's not a conditional dependency. The interesting thing is that `try_offline_node` *calls* `sync_vm_stats`, which means `sync_vm_stats` is part of the conditional path.

Let me circle back to `try_offline_node` and trace the execution path. Right, so `try_offline_node` calls `sync_vm_stats()`. Then `sync_vm_stats()` calls `schedule_on_each_cpu(vmstat_fold_work)`. And that function, `vmstat_fold_work`, calls `refresh_cpu_vm_stats(false)`.

Is this actually something I should try fuzzing? Yes, it's a functional change, specifically scheduling work on *every* CPU during memory hotplug. It's related to a fix for orphaned per-CPU vmstat diffs. So, fuzzing could potentially uncover issues with scheduling on multiple CPUs during memory hotplug operations, or perhaps some race conditions related to how the vmstat folding process happens. Sounds pretty promising.

I'm focusing my attention on the following symbols: `try_offline_node`, `sync_vm_stats`, and `vmstat_fold_work`.

And the necessary configs to enable this are `MEMORY_HOTPLUG` and `MEMORY_HOTREMOVE`.

Let me just double check one last thing: is `try_offline_node` *definitely* the *only* caller of `sync_vm_stats`? It's always worth verifying those assumptions.

{
  "Expression": "sync_vm_stats"
}

{
  "Output": "include/linux/vmstat.h=295=void cpu_vm_stats_fold(int cpu);\ninclude/linux/vmstat.h:296:void sync_vm_stats(void);\ninclude/linux/vmstat.h-297-void refresh_zone_stat_thresholds(void);\n--\ninclude/linux/vmstat.h=400=static inline void cpu_vm_stats_fold(int cpu) { }\ninclude/linux/vmstat.h:401:static inline void sync_vm_stats(void) { }\ninclude/linux/vmstat.h-402-static inline void quiet_vmstat(void) { }\n--\nmm/memory_hotplug.c=2185=void try_offline_node(int nid)\n--\nmm/memory_hotplug.c-2214-\t */\nmm/memory_hotplug.c:2215:\tsync_vm_stats();\nmm/memory_hotplug.c-2216-\tnode_set_offline(nid);\n--\nmm/vmstat.c=944=static void vmstat_fold_work(struct work_struct *w)\n--\nmm/vmstat.c-948-\nmm/vmstat.c:949:void sync_vm_stats(void)\nmm/vmstat.c-950-{\n"
}

gemini-3.1-pro-preview

null

null

							input: 34378
							output: 33
							thoughts: 103
						

**Analyzing the `try_offline_node` Function**

Okay, so I'm digging into this `try_offline_node` function, and it looks like it's only called by one place, which simplifies the debugging process. That's a good starting point.

Now, I'm wondering about the surrounding configuration. Are there any other config options that might be relevant? I know `CONFIG_SMP` is definitely required, because of the `schedule_on_each_cpu` call within, but that's pretty much a given in the syzkaller context, since it's enabled by default. My gut feeling is that `CONFIG_NUMA` might be *more* interesting here, since this function operates on nodes. If NUMA isn't enabled, is the function even going to be doing anything substantial? That could be a critical piece to understand.

Alright, let's just go straight to the source and get a clearer picture. I'll need to check the definition of `try_offline_node` in `mm/memory_hotplug.c` to see how it operates and if my hypotheses around `CONFIG_NUMA` are correct. Time to get my hands dirty.

{
  "Expression": "try_offline_node",
  "PathPrefix": "mm/memory_hotplug.c"
}

{
  "Output": "mm/memory_hotplug.c=2164=static int check_no_memblock_for_node_cb(struct memory_block *mem, void *arg)\n--\nmm/memory_hotplug.c-2176-/**\nmm/memory_hotplug.c:2177: * try_offline_node\nmm/memory_hotplug.c-2178- * @nid: the node ID\n--\nmm/memory_hotplug.c-2184- */\nmm/memory_hotplug.c:2185:void try_offline_node(int nid)\nmm/memory_hotplug.c-2186-{\n--\nmm/memory_hotplug.c-2218-}\nmm/memory_hotplug.c:2219:EXPORT_SYMBOL(try_offline_node);\nmm/memory_hotplug.c-2220-\n--\nmm/memory_hotplug.c=2241=static int try_remove_memory(u64 start, u64 size)\n--\nmm/memory_hotplug.c-2287-\tif (nid != NUMA_NO_NODE)\nmm/memory_hotplug.c:2288:\t\ttry_offline_node(nid);\nmm/memory_hotplug.c-2289-\n--\nmm/memory_hotplug.c-2300- * and online/offline operations before this call, as required by\nmm/memory_hotplug.c:2301: * try_offline_node().\nmm/memory_hotplug.c-2302- */\n"
}

gemini-3.1-pro-preview

null

null

							input: 35170
							output: 178
							thoughts: 216
						

**My Reasoning on Memory Hotplug and VM Statistics**

Okay, so `try_offline_node` is the key function here, and it's being exported. The code requires `CONFIG_MEMORY_HOTREMOVE`, which makes sense. I'll need to enable both `MEMORY_HOTPLUG` and `MEMORY_HOTREMOVE` for this to work correctly.

Let me think through the implications. The patch introduces a call to `sync_vm_stats()` within `try_offline_node()`. The purpose of this seems to be to ensure that any pending per-CPU VM statistics are correctly incorporated into the global counters *before* a NUMA node goes offline. This prevents the regular VM statistics folding mechanism from missing the offline node, which would leave its stats stranded. It’s a functional change affecting the core memory hotplug and VM statistic logic. The critical point is, this is exposed to userspace through the sysfs memory hotplug interfaces.

Given that it involves memory hotplug and the potential for concurrent operations, fuzzing this area seems like a very good idea. There are likely opportunities to identify race conditions or scheduling problems that could arise during the process of offlining a node.

I'll keep a close eye on these symbols: `try_offline_node`, `sync_vm_stats`, and `vmstat_fold_work`, as they are the core components of this change.

Now, let's set the results and move forward.

{
  "EnableConfigs": [
    "MEMORY_HOTPLUG",
    "MEMORY_HOTREMOVE"
  ],
  "FocusSymbols": [
    "try_offline_node",
    "sync_vm_stats",
    "vmstat_fold_work"
  ],
  "Reasoning": "The patch adds a call to sync_vm_stats() in try_offline_node() to fold pending per-cpu vmstat diffs into global counters before a NUMA node is offlined. This prevents the periodic vmstat fold from skipping the offlined node and orphaning the residual stats. This is a functional change in the core memory hotplug and vmstat logic, and it is reachable from userspace via sysfs memory hotplug interfaces. Fuzzing this could uncover race conditions or scheduling issues during node offlining.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "MEMORY_HOTPLUG",
    "MEMORY_HOTREMOVE"
  ],
  "FocusSymbols": [
    "try_offline_node",
    "sync_vm_stats",
    "vmstat_fold_work"
  ],
  "Reasoning": "The patch adds a call to sync_vm_stats() in try_offline_node() to fold pending per-cpu vmstat diffs into global counters before a NUMA node is offlined. This prevents the periodic vmstat fold from skipping the offlined node and orphaning the residual stats. This is a functional change in the core memory hotplug and vmstat logic, and it is reachable from userspace via sysfs memory hotplug interfaces. Fuzzing this could uncover race conditions or scheduling issues during node offlining.",
  "WorthFuzzing": true
}