timely-util,compute-types: pool configuration and metrics behind dyncfgs#37719
Merged
Conversation
DAlperin
force-pushed
the
dov/pool-config
branch
2 times, most recently
from
July 20, 2026 21:53
de60200 to
92bfe1e
Compare
DAlperin
force-pushed
the
dov/ore-pool
branch
2 times, most recently
from
July 21, 2026 20:21
57e61a7 to
ba44852
Compare
DAlperin
force-pushed
the
dov/pool-config
branch
from
July 21, 2026 20:21
92bfe1e to
14da73e
Compare
DAlperin
force-pushed
the
dov/pool-config
branch
from
July 22, 2026 00:21
14da73e to
6100297
Compare
DAlperin
force-pushed
the
dov/pool-config
branch
from
July 22, 2026 16:10
6100297 to
71ebd19
Compare
DAlperin
force-pushed
the
dov/pool-config
branch
from
July 22, 2026 16:43
71ebd19 to
8bcdead
Compare
DAlperin
added a commit
that referenced
this pull request
Jul 22, 2026
…37718) ### Motivation Implements Layers 1 and 2 of the buffer-managed-state design (#37717) as a new `mz_ore::pool` module: the swap-backed, size-classed buffer manager that replaces the pager's blob spilling. The pool is dead code in this PR. Nothing constructs it; the wiring arrives in the next PR of the stack (#37719) and consumers land later. There is zero behavior change, and every commit builds `--locked`. ### Description Five commits, each buildable and tested on its own: 1. **The pool.** Size-classed anonymous regions, residency-scoped slots, copy-out reads under a per-chunk state lock, second-chance eviction banded by depth, spill threads for off-worker eviction I/O, warm slot reuse, budget enforcement. 2. **Observed pageout.** `MADV_PAGEOUT` is advisory, so the ledger trusts an observation of the mapping rather than the advice's return value, with a per-extent retry budget. 3. **Hot-chunk re-admission.** `read_into_admit` returns an evicted probe target to a slot from free-budget headroom or by stealing a clean backed victim's slot in place. Deadlock-free by try-lock discipline on the victim. 4. **Extent arena.** Extents move off the global allocator into pool-owned `MADV_NOHUGEPAGE` regions (jemalloc recycling of paged-out ranges caused major-fault storms and swap-slot churn). Retry-capped extents leave the enforcement queue onto an unreclaimable gauge so a kernel that declines reclaim cannot put a queue walk on every insert. Ledger fixes: budget enforced against evictable bytes, warm-slot trims and cooling, `MADV_DONTDUMP`, THP opt-out on sub-hugepage regions, cgroup v1 / nested-v2 memory detection. 5. **Page-table observation and budget-charged steals.** The pageout observation reads `/proc/self/pagemap` present bits rather than `mincore`, which counts the clean swap-cache copies of successfully reclaimed pages as resident and would retry-cap every extent on healthy async swap. A slot steal settles the ledger with the payload difference and a growing steal is charged against the budget like any other admission. ### Verification 68 unit and concurrency tests, all of which also run under Miri (data-race and provenance checking, including the spill-thread and admission-steal races). 6 Kani proof harnesses over the arithmetic the unsafe blocks rest on (size-class selection, slot-offset bounds, extent-ladder coverage, allocator disjointness). Linux-target cross-checks of the madvise, pagemap, and cgroup paths. The verification footprint is roughly one line per line of pool logic.
DAlperin
force-pushed
the
dov/pool-config
branch
from
July 22, 2026 20:32
8bcdead to
980e1e8
Compare
DAlperin
marked this pull request as ready for review
July 23, 2026 15:29
antiguru
approved these changes
Jul 23, 2026
| /// no effect beyond re-enabling, and lowering it to zero falls back to | ||
| /// inline eviction while spawned threads idle. | ||
| pub const COLUMN_PAGED_BATCHER_SPILL_WORKER_COUNT: Config<usize> = Config::new( | ||
| "column_paged_batcher_spill_worker_count", |
Member
There was a problem hiding this comment.
I was wondering if this should be a fraction of the size, but then I remembered that we can use replica-targeting to configure it!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Wires the
mz_ore::poolbuffer manager (#37718) to configuration andobservability. The pool stays consumer-less after this PR; chunk batchers adopt it
in later PRs of the stack. The design is #37717.
The top merge risk is behavior change under default configs, so the central
property is that a stock process behaves exactly as before: the pool is never
constructed and the legacy pager stays fully operational.
Description
apply_pool_configruns only when a spill gate(
enable_column_paged_batcher_spillorenable_upsert_paged_spill, both defaultfalse) is on. A process that never enables spilling never constructs the pool:no address-space reservation, no spill threads. The first config tick with a gate
on installs the pool; installation is one-way (documented), later ticks retune in
place.
memory limit, which includes swap on swap-provisioned nodes.
mz_column_pool_*computed gauges registered with literal namesand help strings the metrics-catalog generator reads.
doc/user/data/metrics.ymlis regenerated.
stay registered and stay in the Python test-flag lists, and its metrics stay in
the catalog. It is deleted at the end of the migration, not here.
Verification
cargo checkacross the touched crates.bin/lint-test-flagsand themetrics-catalog lint both pass (reproduced locally). The regenerated
metrics.ymlis byte-identical to generator output. No behavior change under default configs:
the pool is never installed and the legacy pager path is unchanged.