[Japabu]

Stacked on #1250 (base spawnperf, head e343eb5, on main 29c5f2d): this PR's diff is two commits, the batch
29585b5 and the records commit 3eef788 (the batch built, and what it owes on metal). It is retargeted to main
once #1250 lands.

Problem

Every frame a shared-memory region or a fault's populated run drew took the frame allocator's one lock on its own:
512 holds for a 2 MiB region, up to 16 for a fault. The spawn diagnosis (#1265, boot 3) measured what that costs the
all-CPU build: with one build child a CPU the lock is 99 % of every contended lock wait, its waits 1.05 of the T14's 8
CPUs and 7.1 of the AMD bench's 16 for the whole round, 82 % of the spin in the children's SHM_CREATEs (by inference
from the SDK, their 2 MiB directory windows) and 13 to 14 % in their faults. Lock spin is a third of the children's
growth in CPU on the T14 and 72 % on the AMD bench, so the gain expected on the T14 is the smaller.

Behavior

• Frames::alloc_promised_each(count, each) draws count promised frames in one call, asserting first that as many
  are promised (for the message); promises and ledgers move exactly as for as many alloc_promiseds.
• pmm::alloc_promised_many(count) draws a region's zeroed frames and pmm::alloc_promised_into(slots) (mm's own,
  as unzeroed draws are since A spawn reserves its stack once, and a committed page's frame is written once #1250) a run's unzeroed ones, each at most a superframe's worth (512 frames) to a hold
  of the lock, so a large region still lets other CPUs' draws in between. Both give their frames back through
  free_drawn or discard, as A spawn reserves its stack once, and a committed page's frame is written once #1250 states. Nothing allocates under the lock: the region's list is reserved first, a run's slots
  are on the stack. Frames are zeroed after the lock is let go.
• SharedMemObject::create takes each piece in one call. A fault counts its run's empty pages, draws them together
  and writes each as its page starts (fill_new, A spawn reserves its stack once, and a committed page's frame is written once #1250's owned_frame without its draw), which replaces owned_frame
  and pmm::alloc_promised_unzeroed.
• Frees already went back in batches (free_all, free_drawn) and are unchanged. Per-CPU frame caches are held until
  this is measured (the orchestrator's decision, recorded in issues: the all-CPU build waits on the frame allocator's lock, for the 2 MiB windows #1265). When a region's frames are drawn at first touch
  (the next PR), alloc_promised_many loses its region caller; the fault's run keeps the batch.

No loom or concurrency model: every draw and free still happens under the one allocator lock, as before, so a batch
meets concurrent frees exactly as consecutive single draws did. The lock-free part, the pin counts, decides only which
freed frames return to the free map (Pins::defer, release), which a draw never reads.

Checks

• Landing evidence: one run at the stack's top, 43173093523 at A shared-memory region draws each page's frame at its first touch #1270's head e37586c (which contains this PR's
  head), pending: testcases_members_exit_0 and shared_debug_members_exit_0 (every shared member, abuse_spawn_maps
  among them) and a_spawn_from_an_image_frees_it_when_the_child_ends, osbench_capability_groups_exit_0,
  virt_user_mode, virt_smp. The earlier row runs no longer cover the landed heads.

• Rebased onto main 29c5f2d (2026-11-12), with A spawn reserves its stack once, and a committed page's frame is written once #1250's member fix e343eb5: abuse_spawn_maps's past-the-object
  range names backing: SpawnBacking::Copy, the field A memory object's range is mapped where the caller says, and an immutable one is shared and executable: /system text is ROOT's own pages #1259 added after the case was written (no earlier run
  compiled it: it is a shared member). At each head the testcases image builds, vm:: and frames:: pass and the
  kernel's clippy shapes exit 0; every guest member compiles (rebase5-checks.log in the evidence).

• Rebased onto main 3c5c555 (after A switch loads only what the incoming thread does not already have #1251 and The shared boots run as guest rows, each member judged by its own exit #1271, 2026-11-12) at 5931031: comment-only. A switch loads only what the incoming thread does not already have #1251 added "no CPU holds
  its root" to the doc on impl Drop for AddressSpace, which A spawn reserves its stack once, and a committed page's frame is written once #1250 rewrote; both stand. Every other commit is
  unchanged (rebase4-range-diff.txt in the evidence).

• Rebased onto main a7ca8ad (after An unmap walks no futex bucket while no thread of its space is in a futex wait #1223 and A poll belongs to the handle it was made through, and a ring to its one submitter #1261, 2026-11-12) at c2e8b9f. No conflict of its own; its
  commits are unchanged, on A spawn reserves its stack once, and a committed page's frame is written once #1250's new head. At c2e8b9f: vm:: and frames::
  exit 0, kernel clippy for x86_64-unknown-none, with boot-actuators,test-actuators, for
  aarch64-unknown-none-softfloat and the library's tests, exit 0 each (rebase3-* in the evidence).

• Rebased onto main 75bdec3 (after A memory object's range is mapped where the caller says, and an immutable one is shared and executable: /system text is ROOT's own pages #1259, 2026-11-12). The one conflict was kernel/pure/vm.rs's tests: A memory object's range is mapped where the caller says, and an immutable one is shared and executable: /system text is ROOT's own pages #1259's
  an_object_maps_as_what_it_is and this stack's copied-page tests both stay. At e23c2d6: vm:: and frames:: exit 0,
  kernel clippy for x86_64-unknown-none, with boot-actuators,test-actuators, for aarch64-unknown-none-softfloat
  and the library's tests, exit 0 each.
  Targeted (kernel frames, mm, object::shm):

• At 1047f13 (review r1: docs, and the test of the up-front check deleted, since a draw past the promises already
  panics): cargo test -p kernel --lib --features sched-check frames:: exit 0 (40 passed,
  a_batch_of_promised_frames_draws_each_promise_once among them) and vm:: exit 0 (16 passed); clippy with the
  adopted lints and -D warnings of the library's tests and of the kernel for x86_64-unknown-none, exit 0 each.

• At 2cfa788 (the same code but for those docs, that test and A spawn reserves its stack once, and a committed page's frame is written once #1250's r2 docs and test table): clippy, exit 0 each,
  for the kernel with boot-actuators,test-actuators and for aarch64-unknown-none-softfloat.

• Rebased with A spawn reserves its stack once, and a committed page's frame is written once #1250 onto main 8188095 (2026-11-12) at c00a628. Conflicts: kernel/src/mm/space.rs, where main's
  populate fills a run in a restructured arm (A paged read takes two passes of its pager's lock and populates nothing ahead #1245); the batched draw of a private or copied run moves into it as it
  was. And the frame allocator's record, which issues: the all-CPU build waits on the frame allocator's lock, for the 2 MiB windows #1265 rewrote: it now says the batched draw is built (issues: the all-CPU build waits on the frame allocator's lock, for the 2 MiB windows #1265 landed
  first), drops the names of code this changes, and keeps the owed bullet. At c00a628: vm:: exit 0 (16 passed),
  frames:: exit 0 (40 passed), kernel clippy for x86_64-unknown-none, with boot-actuators,test-actuators, for
  aarch64-unknown-none-softfloat and the library's tests, exit 0 each.

• Guest rows, run 43135817474 at c2e8b9f (code-identical to 5931031, which a comment-only rebase made; the old head is kept on hold-*), pending: x86 a_spawn_from_an_image_frees_it_when_the_child_ends and
  osbench_capability_groups_exit_0, aarch64 virt_user_mode and virt_smp (the fault path and region creation are
  shared by both architectures and under every program). (43081124750 named a shared-boot member and failed before
  running; 43110114582 at the pre-rebase head was cancelled unrun.)

• Evidence: https://github.com/ToyOSOrg/evidence/tree/804cbbf0148a7b0b0b67ac421bb795035ed742d6/pmm-batch

Metal (owed, not run)

The benches are down, so this lands on review, the host checks and the guest rows, and the speed-up is not yet
measured on metal. Owed on metal, recorded in the frame allocator's record:

• an A/B of main before and after this on the T14 and the AMD bench, of osbench work (work.build_shaped.j1, and
  .j8 on the T14 and .j16 on the AMD bench), spawn_cost and osbench procs: main after must show
  work.build_shaped.j<cpus> faster on both benches and no j1 or proc row slower beyond the before run's spread;
• the build-shaped set's lock census (the diagnosis's boot 3 instrument, spawnperf-split, carried onto main after):
  the allocator lock's share of contended waits, 99 % before, fallen on both.

The A/B that was staged (request5.txt in the evidence) stays as the record; its images are deleted.

Risks

• A region's creation now holds the allocator's lock for up to 512 draws at a time instead of one; what one hold
  costs is not measured. A region of 2 MiB or less takes one hold.

🤖 Generated with Claude Code

[Japabu]

Review of #1268 at 2cfa788 (base spawnperf = #1250 at 1d151cb)

Architecture

The owner and the shape are right.

• One primitive in the allocator. Frames::alloc_promised_each draws single promised frames in a loop under the caller's one hold, so the rules for promises and ledgers stay in one place.
• pmm bounds each hold. The limit is a superframe's worth (DRAWS_A_HOLD). That is a property of the lock, so it belongs in pmm and not at each caller.
• Two callers, one each. A region takes zeroed Frames. A fault's run takes unzeroed raw frames, and fill_new writes each one as its page starts. This keeps A spawn reserves its stack once, and a committed page's frame is written once #1250's single write per frame.
• Nothing else changes. There is no new state and no new lock, and frees are unchanged.

Holding per-CPU caches until this is measured is the right order.

Line counts: production about +48 (frames +11, pmm +31, space +10, shm −4); tests +23.

The questions asked

• Concurrent frees and promises. Each batch is atomic under FRAMES.
  • Between the holds of a region larger than 2 MiB, other CPUs draw only against their own promises.
  • The region's undrawn frames stay counted in promised until they are drawn.
  • admit keeps what is promised within the free frames, and A spawn reserves its stack once, and a committed page's frame is written once #1250's discard assert keeps every repromise backed by a free frame.
  • So every later hold finds its frames, just as consecutive single draws did. No model is needed, because nothing lock-free changed.
• Every frame is written before it is mapped.
  • Fault path: fill_new runs inside fill's closure, before the leaf is stored (LeafTable::fill on both architectures).
  • Region path: alloc_promised_many zeroes every frame before it returns.
  • The run's count matches what fill fills. The empty count (space.rs:794) and fill's visits (:799) cover the same empty leaves of [lo, hi) under &mut self, and nothing between them writes a leaf. So the expect cannot fire, and no drawn frame is left unmapped.
• Error paths: none is partial.
  • Every page of the run is empty and belongs to one committed entry, so each holds a promise. The draw can panic only on a kernel accounting bug.
  • fill_new cannot fail except at read's bound, which is a kernel bug that A spawn reserves its stack once, and a committed page's frame is written once #1250's B1 closed.
  • A region calls pmm::promise(job, pages) before drawing anything and returns on refusal before any draw.
  • No Err can orphan a drawn frame.
• The lock hold is bounded.
  • A hold makes at most 512 take_frame calls. Each scans at most 8 words, with at most about one superframe carve per 512 draws.
  • Nothing allocates under the lock: the region's Vec capacity is reserved beforehand, and a run's slots are on the stack.
  • Zeroing and the pages' writes happen after the lock is released.
  • The hold's duration is not measured; a few µs is my inference. The PR's Risks section says so, and the A/B reads throughput rather than hold time.

Findings

BLOCKER 1 (inherited from #1250). kernel/src/mm/pmm.rs:138: free_drawn's Safety section requires "a frame [Frame::into_raw] gave up". alloc_promised_into's doc (:333-334) now sends raw frames to it as well. #1250's BLOCKER 1 fixes it, and the rebase brings the fix here. Make alloc_promised_into's "gives them back through [free_drawn]" agree with the fixed text; a page's frame also goes back through discard.

BLOCKER 2. kernel/pure/frames.rs:773-776 and :1369-1375: the test of the up-front check shows nothing beyond its message.

• alloc_promised already panics on a draw when nothing is promised (frames.rs:765).
• The evidence's control confirms this. Without the check, a_batch_past_its_promises_is_a_panic still panics, at the eleventh single draw, and fails only because the message differs: "frames: a promised frame drawn and none was promised" against the expected "11 promised frames drawn of 10 promised".
• "Before any is taken" has no consequence: a kernel panic does not unwind, and no caller recovers from it.
• So the test can expose no defect, and root's testing policy says not to test what inspection establishes.
• Fix: delete the test and the doc's "before any is taken" sentence. The assert may stay for its clearer message, or go.
• The PR body's "Negative control" bullet goes with it; correcting the body is the orchestrator's job.

SUGGESTION. When this lands, the first decision in #1265's allocator record is built. Whichever of the two lands second should update that record to say so, so that only its measurement stays owed. They merge cleanly (git merge-tree exits 0).

Evidence

• Host checks. checks-and-stage.log at rev 2cfa788:
  • frames::: 41 passed, exit 0. vm::: 17 passed, exit 0.
  • The mutation exits 101 and is reverted; see BLOCKER 2 for what it shows.
  • Clippy exits 0 for x86, x86 with the actuator features, aarch64 and the library's tests.
  • This covers the touched pure modules, as the testing policy asks. The region path has no host test; the guest rows cover it.
• Guest. Run 43081124750 at 2cfa788 is queued.
  • Rows: x86 a_spawn_from_an_image_frees_it_when_the_child_ends, osbench_capability_groups_exit_0 and abuse_spawn_maps; aarch64 virt_user_mode and virt_smp.
  • The selection is right. Both architectures share the mm code, and abuse_spawn_maps now exercises A spawn reserves its stack once, and a committed page's frame is written once #1250's past-the-object page through the batched run.
• Metal A/B.
  • The sides are the PR heads. git diff pmm-batch-ab-a pmm-batch-ab-b is byte-identical to 2cfa788's diff. A is 1d151cb plus tests/toyos.rs (only the batch_ab registration), so both kernels are exactly the PR heads.
  • The procedure follows request5's rule: A B B A on each bench, two boots a side, the bench running alone, one image per side, and separate readback directories.
  • Gap 1: it waits on the guest runs. request5 names no guest run. Under the orchestrator's rule, A waits on 43080189189 and B on 43081124750, and both are still queued. The handoff says the T14 run has already been requested.
  • Gap 2: it does not read lock waits. The rows measure the throughput of work.build_shaped, spawn_cost and procs. The A/B can support a throughput claim, not a change in the lock's share of the waits, and the PR body does not claim the latter. The allocator record's exit ("lock waits read again") still needs a census boot later.

SEND BACK for BLOCKER 1 (carried by #1250's fix) and BLOCKER 2 (delete one test and one sentence). Once both are fixed, this is LAND pending guest run 43081124750 and the metal A/B, after #1250.

[Japabu]

Review round 3 of #1268 at 1047f13 (base #1250 at 8245c9d; focused on round 2's points)

Architecture

Nothing structural changed. git range-diff against round 2's commit (2cfa788 on 1d151cb) shows two changes only:

• alloc_promised_each's doc loses "before any is taken";
• the test a_batch_past_its_promises_is_a_panic is deleted;
• the rest of the difference is A spawn reserves its stack once, and a committed page's frame is written once #1250's round-3 commit underneath.

The PR's own net growth falls by 10 lines.

Round-2 points

• BLOCKER 1 resolved.
  • free_drawn's Safety (pmm.rs:138-139) comes from A spawn reserves its stack once, and a committed page's frame is written once #1250's fix, which I checked on A spawn reserves its stack once, and a committed page's frame is written once #1250.
  • alloc_promised_into's doc (:331-334) now says "gives them back through [free_drawn] or [discard]".
• BLOCKER 2 resolved.
  • The test is gone.
  • alloc_promised_each's doc (frames.rs:772-774) no longer promises an ordering that has no consequence.
  • The assert stays (:776) for its message, as the PR body states.
• PR body.
  • The Negative-control bullet is gone.
  • The body was edited after the benches-down ruling. Its Metal section now lists what is owed, says plainly that the speed-up is not yet measured on metal, and points to the allocator record.

Findings

None.

Evidence

• Host, implementer. batch/checks-r1.log at 1047f13:
  • frames:: 40 passed and vm:: 16 passed, exit 0 each.
  • Clippy exits 0 for the library's tests and for the kernel on x86_64-unknown-none.
• Host, this review. review-r3/checks-r3-1268.log at 1047f13, compiled from this tree:
  • vm:: 16 passed and frames:: 40 passed, exit 0 each. The second count includes a_batch_of_promised_frames_draws_each_promise_once.
  • Library clippy with the adopted lints and -D warnings exits 0.
  • My first attempt shared a target directory with the A spawn reserves its stack once, and a committed page's frame is written once #1250 tree, and cargo reused A spawn reserves its stack once, and a committed page's frame is written once #1250's build, so I discarded it.
• Bare-target clippy. The x86 actuator and aarch64 runs at 2cfa788 stand.
  • Apart from comments and #[cfg(test)] code, 2cfa788 and 1047f13 differ only in Frames::discard's assert message, which comes from A spawn reserves its stack once, and a committed page's frame is written once #1250.
  • The body's "the same code but for those docs, that test and A spawn reserves its stack once, and a committed page's frame is written once #1250's r2 docs and test table" leaves out that message. Nothing depends on it.
• Guest. Run 43081124750 is still queued at 2cfa788.
  • Rows: x86 a_spawn_from_an_image_frees_it_when_the_child_ends, osbench_capability_groups_exit_0 and abuse_spawn_maps; aarch64 virt_user_mode and virt_smp.
  • The same comparison holds: comments, tests and one assert message, which no harness reads.
  • No row needs rerunning. Landing waits for this run, and for A spawn reserves its stack once, and a committed page's frame is written once #1250's run 43080189189, to pass.
• Metal. Under the ruling, metal is not a landing condition. The owed A/B and lock census are recorded.

Since the specified head

pmm-batch has moved to 82555fb:

• 642233f is the same commit. It is 1047f13 rebased onto A spawn reserves its stack once, and a committed page's frame is written once #1250's records-only 8be9cc4; range-diff shows =.
• 82555fb is records only. It adds an Owed on metal: bullet to the allocator record. The bullet names the A/B rows, both benches, what main must show, and the lock census.
• A conflict with issues: the all-CPU build waits on the frame allocator's lock, for the 2 MiB windows #1265. That bullet, and the spawn-record bullet inherited from A spawn reserves its stack once, and a committed page's frame is written once #1250, conflict textually with issues: the all-CPU build waits on the frame allocator's lock, for the 2 MiB windows #1265 (git merge-tree 82555fbde 3e79317c8 exits 1 in both records). Whichever lands second resolves them.
• git merge-tree with main e10b6fd exits 0.

LAND after #1250, once guest runs 43080189189 and 43081124750 pass.

[Japabu]

Review of #1268's rebase onto #1250 at 4e9f6f2 (main 8188095), at c00a628 (focused on the resolution)

Architecture

Nothing structural changed since round 3's LAND. The rebase only resolves conflicts, plus the record update that round 3 suggested. The PR's diff over #1250 is +110/−39 lines over 5 files.

The resolution

• git range-diff 45935f4b9..82555fbde 818809583..c00a628f1.
  • Commits 1 to 6 are A spawn reserves its stack once, and a committed page's frame is written once #1250's, which I reviewed there.
  • Commit 7 (7f59a08) is unchanged. Compared whitespace-insensitively with 642233f, with hunk headers stripped, it differs only in context: A paged read takes two passes of its pager's lock and populates nothing ahead #1245's phys(page) / } above the arm, and the around line, which main moved out of the arm. No added or removed line differs. The batched draw sits one level deeper and is otherwise byte-identical.
  • Commit 8 replaces 82555fb with the records update below.
• The batch composes with A paged read takes two passes of its pager's lock and populates nothing ahead #1245's run for every range kind and run length.
  • Which kind draws. (lo, hi) is computed once, before the kind match (space.rs:837). Only the private-or-copied arm draws frames. The object arm fills unowned leaves from the object, and an uncommitted reservation is unreachable!, as on main.
  • A run never crosses into an object range. vm::around clamps to [start, entry.end) of the touched entry (vm.rs:30-35), and alike neighbours join, so an adjacent object range is a different entry.
  • The count fits the slots. [lo, hi) is a lone page or part of one aligned AROUND run. That is at most 16 pages inside the touched page's 2 MiB leaf table, so 1 <= empty <= 16 = drawn.len(). It is at least 1 because the arm is reached only for an Empty leaf at page.
  • The count is what fill visits. Both fill (x86_64/paging.rs:792-798, aarch64/paging.rs:551-559) and the count decode the same slots of the same table as Empty, under &mut self. So the expect cannot fire and no drawn frame is left over.
  • Each counted page holds a promise. An Empty leaf of a committed private or copied range holds one, so alloc_promised_each's assert holds.
  • No lock is held across a read. fill_new's source.read runs after alloc_promised_into has released FRAMES, as before.
• The allocator record.
  • issues: the all-CPU build waits on the frame allocator's lock, for the 2 MiB windows #1265's attribution and figures stay. The verbs move to the past tense, and the owned_frame name that this PR deletes goes.
  • The decision paragraph keeps the orchestrator's decision in bold, adds "and built (A draw of many promised frames takes the allocator's lock once #1268)", and states what was built (alloc_promised_many, alloc_promised_into, a superframe's worth to a hold).
  • The owed bullet is word for word as at 82555fb.
  • Exit is issues: the all-CPU build waits on the frame allocator's lock, for the 2 MiB windows #1265's, including "the all-CPU build's lock waits read again with the batched draw".
  • This is round 3's suggestion carried out by the PR that landed second. The spawn record, inherited from A spawn reserves its stack once, and a committed page's frame is written once #1250, is unchanged here.
• No stale names. No source or record in the tree names owned_frame or alloc_promised_unzeroed.

Findings

None. One cosmetic point, optional: line 77 of the allocator record runs two wrapped lines into one long line ("…has to reach them. The second, …"). It renders the same.

Evidence

• Host, this review, at c00a628 in its own detached worktree and target directory (checks-1268.log):
  • vm:: 16 passed and frames:: 40 passed, exit 0 each. a_batch_of_promised_frames_draws_each_promise_once is among them.
  • Clippy with the adopted lints and -D warnings exits 0 for:
    • the library's tests with sched-check;
    • x86_64-unknown-none, with and without boot-actuators,test-actuators;
    • aarch64-unknown-none-softfloat, with and without boot-actuators,test-actuators.
  • The implementer's rebase-checks.log agrees.
• Guest. Run 43112790573 is still queued.
  • It runs at c00a628 (headSha), on x86 a_spawn_from_an_image_frees_it_when_the_child_ends and osbench_capability_groups_exit_0, and on aarch64 virt_user_mode and virt_smp.
  • The rows reach both the batched fault run beside A paged read takes two passes of its pager's lock and populates nothing ahead #1245's object runs and the batched region draw on both architectures.
• Metal. Not a landing condition while the benches are down. The owed A/B and lock census are recorded.

LAND after #1250, once guest runs 43112778072 and 43112790573 pass.