summaryrefslogtreecommitdiff
path: root/tools/testing
AgeCommit message (Collapse)Author
2026-08-06selftests/bpf: Test overlapping RCU protectionNing Ding
Add task kptr tests that keep RCU protection active after a spin or RCU unlock when preemption or IRQs remain disabled. Also test the reverse order with explicit RCU. Verify that task kptrs are rejected after leaving the final preemption-disabled or IRQ-disabled region. Signed-off-by: Ning Ding <dingning04@gmail.com> Link: https://lore.kernel.org/bpf/20260805233940.3966981-3-dingning04@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-06bpf: Account for preempt and IRQ state in RCU protectionNing Ding
Disabling preemption or local IRQs keeps the current CPU in an RCU read-side critical section, but in_rcu_cs() does not account for either state. The verifier therefore rejects safe kptr accesses and invalidates pointers when another RCU source ends. Include preemption-disabled and IRQ-disabled state in in_rcu_cs(). Invalidate RCU-protected pointers on RCU unlock, preempt enable, or IRQ restore only after the final protection ends. Signed-off-by: Ning Ding <dingning04@gmail.com> Link: https://lore.kernel.org/bpf/20260805233940.3966981-2-dingning04@gmail.com [ kkd: Simplify was_in_rcu_cs on spin unlock and adjust the selftest. ] Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-06selftests/tc-testing: add qdisc hierarchy depth testsZijie Huang
Add tdc coverage for the qdisc hierarchy depth limit. The tests verify that the deepest allowed hierarchy can still be created and that adding another child qdisc below it is rejected. Signed-off-by: Zijie Huang <milkory@outlook.com> Assisted-by: Codex:gpt-5.4 Signed-off-by: Ren Wei <enjou1224z@gmail.com> Reviewed-by: Victor Nogueira <victor@mojatatu.com> Link: https://patch.msgid.link/5cc2d26a7c8e553759cdd29a3116f843fabc25ba.1785434373.git.milkory@outlook.com Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06kselftest/arm64: Fix abi test compilation errorsJinjie Ruan
The arm64 ABI selftests fail to compile due to missing include paths for kernel headers, causing errors like incomplete type struct sock_filter and implicit BPF macro declarations. Add $(KHDR_INCLUDES) and -I$(top_srcdir)/tools/include to CFLAGS to resolve the header search path. Also remove the hardcoded __NR_write macro and include <asm/unistd.h> to obtain the correct syscall number. Fixes: 21e37da12071 ("kselftest/arm64: Add testcase for SECCOMP_RET_TRACE orig_x0 bypass") Fixes: 2fcbc4adf997 ("kselftest/arm64: Add seccomp ptrace x0 bypass test") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/r/202608021842.jp6IBrFi-lkp@intel.com/ Suggested-by: Mark Brown <broonie@kernel.org> Reviewed-by: Mark Brown <broonie@kernel.org> Tested-by: Mark Brown <broonie@kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06openvswitch: remove support for legacy tunnel typesIlya Maximets
ovs-vswitchd doesn't use OVS_VPORT_TYPE_GRE/VXLAN/GENEVE with the Linux kernel module since adding support for standard tunnel devices with COLLECT_METADATA back in 2017. The code to use them was only activated as a fallback for old kernels, so not used in practice. And it is now fully removed in the upcoming OVS 4.0 release. Modern way to use tunnels with OVS is to create standard tunnel ports with RTM_NEWLINK + COLLECT_METADATA and add them as OVS_VPORT_TYPE_NETDEV. Device reference management and the netlink options parsing for these legacy port types is complicated and was a CVE magnet in the previous release cycles. Existence of these modules also makes locking analysis for geneve module and other core tunnel devices unnecessarily more complicated, especially in light of migration to per-netns locking. Since there are no actual users for these port types for a very long time, let's just remove the support entirely. There is no practical reason to run OVS from 2017 on a recent kernel. While it's technically a uAPI change in some sense, from the user's perspective this removal looks indistinguishable from the kernel built with CONFIG_OPENVSWITCH_GENEVE/VXLAN/GRE disabled. And it seems like removal of unused drivers/modules is not a rare event these days. A comment is added to the uAPI header noting that standard RTM_NEWLINK with COLLECT_METADATA followed by OVS_VPORT_CMD_NEW with the simple OVS_VPORT_TYPE_NETDEV should be used instead. Modules responsible for these tunnel ports are removed as well as selftests covering this functionality. Further cleanups will follow. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-2-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06selftests/bpf: Test module kfunc calls under spin lockKaitao Cheng
The verifier uses kfunc registration flags to decide whether a kfunc may be called while a BPF program holds a bpf_spin_lock. Mark bpf_testmod_test_mod_kfunc() as KF_SPINLOCK_SAFE and verify that it can be called while holding a bpf_spin_lock. Also attempt to call the unmarked bpf_kfunc_trigger_ctx_check() under the lock and verify that the program is rejected. Signed-off-by: Kaitao Cheng <chengkaitao@kylinos.cn> Acked-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/bpf/20260805153340.34776-4-kaitao.cheng@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-05selftests: drv-net: print device info at the startJakub Kicinski
When a reviewer asks a developer to run an upstream test during code review, it's often ambiguous whether the test was actually run against a real device, or just against netdevsim. Print the driver name and ifname at the start of the test, e.g.: # Interface: enp0s13f0u1u4, driver: r8152 TAP version 13 1..1 ok 1 ... Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260803211944.2166211-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05selftests: drv-net: hw: reset HDS mode after netkit devmem testsJakub Kicinski
HDS mode has confusing semantics. On GET kernel reports effective mode. On SET kernel expects explicit config. Effective mode on GET means that we know the current state, but we don't know if it's a driver default or user setting. This matter because driver default can change automatically when e.g. XDP is attached. Explicit user setting must not be lost. With that in mind, we can't restore the HDS setting like we restore other NIC config. We should always reset to default ("unknown"). This fixes an issue with tests running after the devmem test not being able to attach XDP, e.g. Exception| File "./xdp_metadata.py", line 105, in test_xdp_rss_hash [...] Exception| net.lib.py.utils.CmdExitFailure: Command failed Exception| CMD: ip link set dev ens9np0 xdpdrv pinned /sys/fs/bpf/xdp_metadata_test/xdp_rss_hash Exception| EXIT: 2 Exception| STDERR: Error: unable to install XDP to device using tcp-data-split. not ok 1 xdp_metadata.test_xdp_rss_hash.tcp Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Breno Leitao <leitao@debian.org> Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com> Link: https://patch.msgid.link/20260804151040.2755153-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05KVM: x86/pmu: Clean up vPMU comments and stray blank linesLike Xu
Tidy up the x86 vPMU emulation code and its selftests by fixing comments that no longer reflect the code along with assorted spelling and grammar mistakes, and by dropping redundant blank lines reported by checkpatch. No functional change intended. Signed-off-by: Like Xu <likexu@tencent.com> Link: https://patch.msgid.link/20260625090155.6326-1-likexu@tencent.com [sean: keep quotes around "hit", shove sequences fix into separate patch] Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-08-05KVM: selftests: Test one random GP counter in PMU arch events testcaseSean Christopherson
To significantly reduce the PMU counter test's runtime, without sacrificing test coverage in the aggregate, test a random GP counter in the arch events testcase instead of testing every possible GP counter. Testing every PMC in every run of the test significantly increases the runtime of the test, without providing an equivalent increase in validation coverage, as the odds of a KVM having a bug that only affected a subset of counters and only when testing all other counters are extremely low. Opportunistically clean up kvm_random_u64_in_range() to eliminate unnecessary newlines. Link: https://patch.msgid.link/20260804210046.3413149-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-08-05Merge branch 'for-7.3/cxl-misc' into cxl-for-nextDave Jiang
cxl/test: Assign one mock memdev a full-width serial number cxl/core: Format the memdev serial number as unsigned in TP_printk cxl/pmem: Format the nvdimm serial number as unsigned decimal
2026-08-05cxl/test: Assign one mock memdev a full-width serial numberAlison Schofield
Mock memdev serial numbers have historically been derived from pdev->id, leaving them single-digit. As a result they never exercised either the decimal-vs-hex security-key lookup or unsigned formatting of large serial numbers. Give one mock memdev a full-width serial with bit 63 set. This mirrors real hardware (for example, Montage devices) and provides a test device that exposes both the hexadecimal-vs-decimal and signed-vs- unsigned formatting differences. pdev->id 7 is unused by the auto-region topology so the larger serial does not affect existing tests. This enables adding a new test case to cxl-security.sh that verify auto-unlock using a mock device whose serial exposes both formatting differences. Signed-off-by: Alison Schofield <alison.schofield@intel.com> Link: https://patch.msgid.link/3e569a748fce4424b8622032fbffc298d92153b9.1784924949.git.alison.schofield@intel.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-08-05selftests/bpf: Verify rejection of sleepable tracing progLeon Hwang
Add a test to verify that the sleepable tracing prog cannot attach to a '__x64_sys' prefix prog target. When CONFIG_FUNCTION_ERROR_INJECTION is disabled, without the fix, the test would trigger the BUG: [ 3.460756] BUG: sleeping function called from invalid context at kernel/bpf/trampoline.c:1324 Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260805150810.34907-3-leon.hwang@linux.dev
2026-08-05selftests/bpf: Add bpf_for() benchmarkPuranjay Mohan
Add a bpf_for() benchmark modelled on bench_bpf_loop so the per-iteration iterator cost can be measured and compared against bpf_loop. It runs an empty bpf_for(i, 0, nr_loops) loop 1000 times per trigger and accounts nr_loops hits per outer iteration: $ ./bench -p 1 --nr_loops 1000 bpf-for Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260804134601.2305303-7-puranjay@kernel.org
2026-08-05selftests/bpf: Verify inlined numeric iterator shape with __xlatedPuranjay Mohan
Add an __xlated test pinning the inlined bpf_iter_num_{new,next,destroy}() shapes. The program is __naked, so there is no compiler glue and the whole sequence is matched instruction for instruction. Gate it to x86_64 and arm64 (bpf_jit_needs_zext() == false); elsewhere the verifier interleaves "wN = wN" zero-extensions that would not match. The inlining is arch independent, so these two are enough. Suggested-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260804134601.2305303-6-puranjay@kernel.org
2026-08-05sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTLOleg Nesterov
CONFIG_SYSCTL used to make sense as a separate hidden bool before commit 61a47c1ad3a4 ("sysctl: Remove the sysctl system call"); it was selected by both CONFIG_SYSCTL_SYSCALL and CONFIG_PROC_SYSCTL. Today CONFIG_PROC_SYSCTL is the only selector, so the two are always equal. Kill the hidden bool, rename the PROC_SYSCTL prompt to SYSCTL, and s/CONFIG_PROC_SYSCTL/CONFIG_SYSCTL/ tree-wide. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Joel Granados <joel.granados@kernel.org>
2026-08-05selftests/bpf: Add load-acquire test for dst_reg == src_reg from ctxDaniel Borkmann
Add a verifier test that a load-acquire fetching into its own source register (dst_reg == src_reg) from a ctx pointer is rejected. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_load_acquire [...] #614/1 verifier_load_acquire/load-acquire, 8-bit:OK #614/2 verifier_load_acquire/load-acquire, 8-bit @unpriv:OK #614/3 verifier_load_acquire/load-acquire, 16-bit:OK #614/4 verifier_load_acquire/load-acquire, 16-bit @unpriv:OK #614/5 verifier_load_acquire/load-acquire, 32-bit:OK #614/6 verifier_load_acquire/load-acquire, 32-bit @unpriv:OK #614/7 verifier_load_acquire/load-acquire, 64-bit:OK #614/8 verifier_load_acquire/load-acquire, 64-bit @unpriv:OK #614/9 verifier_load_acquire/load-acquire with uninitialized src_reg:OK #614/10 verifier_load_acquire/load-acquire with uninitialized src_reg @unpriv:OK #614/11 verifier_load_acquire/load-acquire with non-pointer src_reg:OK #614/12 verifier_load_acquire/load-acquire with non-pointer src_reg @unpriv:OK #614/13 verifier_load_acquire/misaligned load-acquire:OK #614/14 verifier_load_acquire/misaligned load-acquire @unpriv:OK #614/15 verifier_load_acquire/load-acquire from ctx pointer:OK #614/16 verifier_load_acquire/load-acquire from ctx pointer @unpriv:OK #614/17 verifier_load_acquire/load-acquire from ctx pointer, same dst and src register:OK #614/18 verifier_load_acquire/load-acquire from ctx pointer, same dst and src register @unpriv:OK #614/19 verifier_load_acquire/load-acquire with invalid register R15:OK #614/20 verifier_load_acquire/load-acquire with invalid register R15 @unpriv:OK #614/21 verifier_load_acquire/load-acquire from pkt pointer:OK #614/22 verifier_load_acquire/load-acquire from flow_keys pointer:OK #614/23 verifier_load_acquire/load-acquire from sock pointer:OK #614 verifier_load_acquire:OK Summary: 1/23 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260804201917.253491-2-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-04selftests/mm: remove obsolete hugetlb vmemmap testMuchun Song
The hugetlb vmemmap selftest was added to check the old HVO layout where tail vmemmap pages reused the head page. That assumption no longer matches the current HVO mapping layout. HVO now keeps a private backing page for the head vmemmap page and remaps redundant tail vmemmap pages to a shared read-only backing page. The old page flag check is therefore testing an obsolete implementation detail rather than the current ABI or behavior. Remove the stale test and its build and run entries. [akpm@linux-foundation.org: don't clean old executables out of .gitignore] Link: https://lore.kernel.org/CAHk-=wiHK5_oBUdUiNAaevmN9f-ORe+QBqbRefAZaw-RbgEn3w@mail.gmail.com Link: https://lore.kernel.org/20260710092427.3459121-1-songmuchun@bytedance.com Signed-off-by: Muchun Song <songmuchun@bytedance.com> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: SJ Park <sj@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04tools/testing/vma: output compared expression on ASSERT_[EQ, NE]()Lorenzo Stoakes
Update the macros to output the compared values at hex for easier debugging when test asserts fail. We have to be careful not to re-evaluate expressions as they may have side-effects. So update the code to take local copies and use these for both the test and the debug output. Also remove unused IS_SET() macro. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-33-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Gregory Price <gourry@gourry.net> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Pedro Falcato <pfalcato@suse.de> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04tools/testing/vma: default VMA, mm flag bits to 64-bitLorenzo Stoakes
With all of the sanitisers turned on, setting the VMA and mm flag bits depth to 128 by default results in overly long build times. Reduce this to 64 - we can always manipulate these later for testing of larger bitmaps as needed. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-32-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Gregory Price <gourry@gourry.net> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Pedro Falcato <pfalcato@suse.de> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/vma: introduce and use vma_set_pgoff()Lorenzo Stoakes
In order to lay the foundation for work that permits us to track the virtual page offset of MAP_PRIVATE file-backed mappings, we abstract the assignment of vma->vm_pgoff to vma_set_pgoff(). We additionally add a lock check here using the newly introduced vma_assert_can_modify(). This asserts the VMA write lock if the VMA is attached. We also assert that, if this is an anonymous VMA and unfaulted, that its (virtual) page offset is equal to the page offset of the VMA's address. We must be careful about MAP_PRIVATE-/dev/zero which violates fundamental assumptions about anonymous memory, so we check for !vma->vm_file after using vma_is_anonymous() which these mappings satisfy. Additionally, we only perform the assert if CONFIG_MMU is defined, as nommu does not set vma->vm_pgoff = addr >> PAGE_SHIFT. This isn't really relevant to rmap as it has no anon rmap (nor needs it), but we must avoid it asserting falsely. All of this logic is kept in assert_sane_pgoff() to keep things clear. In order to maintain correctness given this assert, we also update __install_special_mapping() to invoke vma_set_range() after it's set vma->vm_ops (which determine whether the VMA is anonymous or not). We do not use vma_set_pgoff() in vm_area_init_from(), as at the point of forking, we don't necessarily have correct locking state. Updating vma_set_range() covers most cases, but in addition to this we also update insert_vm_struct(), compat_set_vma_from_desc() and nommu callers. We also update vma_add_pgoff() and vma_sub_pgoff() to use vma_set_pgoff(). While we're here, we drop a BUG_ON() and update insert_vm_struct()'s comment to reflect the fact anonymous mappings can be added here. Finally, we update the CONFIG_MMU, CONFIG_PER_VMA_LOCK defines in the VMA userland tests so IS_ENABLED() will work correctly with them. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-29-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/vma: update vma_shrink() to not pass start, pgoff parametersLorenzo Stoakes
vma_shrink() is only used by relocate_vma_down() to shrink the tail of a VMA. Therefore neither the start nor the pgoff parameters make any sense. It seemed we were passing the pgoff parameter solely to satisfy vma_set_range()'s requirement for pgoff being specified. Since vma_set_range() is now isolated to vma.c, we can simply introduce __vma_set_range() which sets only vma->vm_[start, end], and invoke this instead, removing start and pgoff from vma_shrink() altogether. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-26-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/vma: make vma_set_range() static, drop insert_vm_struct() declLorenzo Stoakes
With __install_special_mapping() moved to vma.c, vma_set_range() can be made into a static function there and is now completely isolated from the rest of mm. While we're here, we can also remove the insert_vm_struct() declaration from mm.h - the function is implemented in vma.c and already declared in vma.h, and has no users outside of mm. Also update the VMA userland tests to reflect this change. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-25-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/vma: introduce vma_assert_can_modify()Lorenzo Stoakes
vma_assert_write_locked() and vma_assert_attached() are useful for their own purposes, however VMA code absolutely does allow the modification of non-write locked VMAs if they are at that point detached (i.e. unreachable from anywhere). It's therefore useful to be able to assert that a VMA is either detached (modification doesn't matter) or write locked (you're explicitly locked for modification). Therefore introduce vma_assert_can_modify() for this purpose. While we're here, make vma_is_attached() available generally - if !CONFIG_PER_VMA_LOCK, then there's no sense in which a VMA is detached (vma_mark_detached() is a noop), so have this default to true in this case. Also update VMA userland tests to reflect this change, correcting the previously open-coded vma_assert_[attached,detached]() there. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-22-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Pedro Falcato <pfalcato@suse.de> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/vma: remove duplicative vma_pgoff_offset() helperLorenzo Stoakes
This is doing what linear_page_index() does, so eliminate it and replace it with linear_page_index(). Update the VMA userland tests to reflect this change. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-20-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/rmap: rename anon_vma_interval_tree_*() to anon_rmap_tree_*()Lorenzo Stoakes
To be consistent with the newly renamed mapping_rmap_tree_*(), rename the anon_vma_interval_tree_*() helpers to anon_rmap_tree_*(). No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-11-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Pedro Falcato <pfalcato@suse.de> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/rmap: parameterise anon_vma_interval_tree_*() by anon_vmaLorenzo Stoakes
Similar to what we did with mapping_rmap_tree*(), let's declare anon_vma_interval_tree*() in terms of anon_vma rather than rb_root_cached. In each case the rb tree referenced is &anon_vma->rb_root, so just pass anon_vma and the functions can figure this out themselves. Also update the VMA userland tests to reflect the change. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-9-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/rmap: rename vma_interval_tree_*() to mapping_rmap_tree_*()Lorenzo Stoakes
The family of vma_interval_tree_() functions manipulate the address_space (which, of course, is generally referred to as 'mapping') reverse mapping, but are named the 'VMA' interval tree. VMAs may be mapped by an anon_vma, an address_space, or both. Therefore calling the mapping interval tree a 'VMA' interval tree is rather confusing. This is also inconsistent with the anon_vma_interval_tree_*() functions which explicitly reference the rmap object to which they pertain. Rename the vma_interval_tree_*() functions to mapping_rmap_tree_*() to correct this. We will rename the anon rmap functions similarly in a subsequent patch. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-8-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Pedro Falcato <pfalcato@suse.de> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/rmap: parameterise vma_interval_tree_*() by address_spaceLorenzo Stoakes
The file-backed mapping interval tree functions vma_interval_tree_*() accept a raw rb_root_cached pointer to determine the tree in which they are operating. However, in each case, this is always associated with an address_space data type. So simply pass a pointer to that instead to simplify the code, and more clearly differentiate between these operations and those concerning anonymous mappings. While we're here, make the generated interval tree functions static as they do not need to be used externally (any previously existing external users have now been removed). We also rename VMA parameters from 'node' to 'vma' as calling this a node is simply confusing, update the input index types to pgoff_t since they reference page offsets and rename the parameters to pgoff_start and pgoff_last. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-6-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm: introduce and use vma_end_pgoff()Lorenzo Stoakes
We already have vma_last_pgoff() which retrieves the last page offset within a VMA. However, code often wishes to span a page offset range, which requires the exclusive end of this range. So provide this in vma_end_pgoff() and update vma_last_pgoff() to use this function. Also update the VMA userland tests to reflect the change. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-4-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04tools/testing/vma: use vma_start_pgoff() in merge testsLorenzo Stoakes
Now we have the vma_start_pgoff() helper, update the merge tests to make use of it for consistency. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-3-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Reviewed-by: Liam R. Howlett (Oracle) <liam@infradead.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm: move vma_start_pgoff() into mm.h and clean upLorenzo Stoakes
Patch series "mm: make VMA page offset handling more consistent", v2. This series performs a series of cleanups and improvements around how the vma->vm_pgoff field is used. Folios belonging to file-backed mappings are simply indexed by the page offset within the file they map (excepting pfnmap and driver mappings which sometimes do things different). However, anonymous folios belonging to pure anonymous mappings are indexed by their "virtual" page offset, which is equal to addr >> PAGE_SHIFT at the time at which the VMA was first faulted in. The page offset of a VMA is stored in vma->vm_pgoff and indicates the page offset of the start of the VMA range, whether it be file-backed or anonymous. The work here both cleans up how we reference this field, as well as laying the foundations for a future series which addresses the inconsistency of CoW'd folios in MAP_PRIVATE-file backed mappings, which are indexed as if they were file-backed but behave as if they were anonymous. This future series will make it such that all anonymous folios are indexed by virtual page offset whether belonging to VMAs who satisfy vma_is_anonymous() or MAP_PRIVATE-mapped file-backed mappings. This series: * Exposes vma_start_pgoff() and updates the kernel to use it consistently. * Adds and uses the useful vma_end_pgoff() helper. * Parameterises the file-backed mapping helpers vma_interval_tree_*() by address_space rather than rb_root_cached. * Renames: the misleadingly-named vma_interval_tree_*() helpers to mapping_rmap_tree_*() to be consistent with the renamed anon_rmap_tree_*(). * Parameterises anon_rmap_tree_*() by anon_vma. * Moves mm/interval_tree.c to the rmap section. * Adds vmg_*() helpers for page offset. * Clarifies the confusing vmg_adjust_set_range() function. * Introduces linear_page_delta() to provide relative pgoff within a VMA. * Replaces open-coded versions of linear_page_delta() and linear_page_index() with invocations of these functions. * Introduces and uses vma_assert_can_modify() to account for whether a VMA can be modified (detached or write locked). * Adds and uses vma_[add,sub]_pgoff() to adjust VMA page offset. * Moves __install_special_mapping() to vma.c. * Makes vma_set_range() static and internal to vma.c. * Introduces and makes use of vma_set_pgoff(). * Fixes incorrect vma.h header inclusion. * Defaults VMA userland tests to 64-bit vma flags size. * Updates VMA userland tests to give better output on failure. * Various smaller cleanups. * Updated the vma_set_pgoff() assert to account for MAP_PRIVATE /dev/zero correctly. This patch (of 33): vma_last_pgoff() already lives there, so it's a bit odd to keep vma_start_pgoff() in mm/interval_tree.c. Move them together. These each return unsigned long, which pgoff_t is typedef'd to. Make this consistent and have these functions return pgoff_t instead. Additionally, express vma_last_pgoff() in terms of vma_start_pgoff(), since we wrap the vma->vm_pgoff access, we may as well use it here. Also while we're here, const-ify the VMA and cleanup a bit. Also update the VMA userland tests to reflect the change. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-0-2a5aa403d977@kernel.org Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-1-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Gregory Price <gourry@gourry.net> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Reviewed-by: Liam R. Howlett (Oracle) <liam@infradead.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Cc: Ackerley Tng <ackerleytng@google.com> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04selftests/mm: add HMM test for mmap lock-dropping faultsStanislav Kinsburskii
Add test_hmm coverage for the HMM lock-dropping fault path. The test module gets a new HMM_DMIRROR_READ_UNLOCKED ioctl that calls hmm_range_fault_unlocked_timeout() with a timeout of 0, exercising the unbounded retry mode while allowing the mmap lock to be dropped during fault handling. Add a userfaultfd_read selftest that registers an anonymous mapping with UFFDIO_REGISTER_MODE_MISSING, services the faults from a handler thread with UFFDIO_COPY, and verifies that HMM can read back the data supplied by the handler. This exercises the path where handle_mm_fault() drops mmap_lock and hmm_range_fault_unlocked_timeout() restarts the walk internally. Assisted-by: GitHub-Copilot:claude-opus-4.6 Link: https://lore.kernel.org/20260723-hmm-v10-v11-3-c55b003a4b61@gmail.com Signed-off-by: Stanislav Kinsburskii <skinsburskii@gmail.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dexuan Cui <decui@microsoft.com> Cc: Haiyang Zhang <haiyangz@microsoft.com> Cc: Jason Gunthorpe <jgg@nvidia.com> Cc: Jonathan Corbet <corbet@lwn.net> Cc: K. Y. Srinivasan <kys@microsoft.com> Cc: Leon Romanovsky <leon@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lizhi Hou <lizhi.hou@amd.com> Cc: Long Li <longli@microsoft.com> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Lyude <lyude@redhat.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Oded Gabbay <ogabbay@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Thomas Zimemrmann <tzimmermann@suse.de> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Wei Liu <wei.liu@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04selftests/mm: fix ternary operator precedence in ksm_testsSayali Patil
The KSM selftest uses conditional expressions to skip accesses to merge_across_nodes on systems without NUMA support. However, the ternary operator is combined with logical OR without parentheses: a || numa_available() ? 0 : b || c Due to operator precedence rules, this is parsed as: (a || numa_available()) ? 0 : (b || c) instead of the intended: a || (numa_available() ? 0 : b) || c Add parentheses around the conditional expressions to ensure the correct evaluation order. Link: https://lore.kernel.org/ce859430287ed2642848c933a90eb9a69da361f0.1783446924.git.sayalip@linux.ibm.com Fixes: 9aa1af954db0 ("selftests: vm: check numa_available() before operating "merge_across_nodes" in ksm_tests") Signed-off-by: Sayali Patil <sayalip@linux.ibm.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Liam Howlett <liam@infradead.org> Cc: Miaohe Lin <linmiaohe@huawei.com> Cc: Michal Hocko <mhocko@kernel.org> Cc: Oscar Salvador <osalvador@suse.de> Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodesSayali Patil
The KSM NUMA merge test allocates identical pages on different NUMA nodes and verifies KSM behavior with merge_across_nodes enabled and disabled. On systems with memoryless NUMA nodes, for example: #numactl -H available: 2 nodes (0,4) ..... node 0 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 node 0 size: 14825 MB node 0 free: 1382 MB node 4 cpus: node 4 size: 0 MB node 4 free: 0 MB the test may attempt to allocate memory on a node without memory, causing numa_alloc_onnode() to fail and resulting in a spurious test failure. The test currently checks numa_num_configured_nodes() to determine whether sufficient NUMA nodes are available. However, configured nodes do not necessarily have memory. Reuse the existing get_first_mem_node() and get_next_mem_node() helpers to locate NUMA nodes that actually contain memory, and skip the test when fewer than two such nodes are available. Before patch: --------------------------- running ./ksm_tests -N -m 1 --------------------------- mbind: Invalid argument ok 1 KSM NUMA merging Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 [PASS] ok 1 ksm_tests -N -m 1 --------------------------- running ./ksm_tests -N -m 0 --------------------------- mbind: Invalid argument not ok 1 KSM NUMA merging Totals: pass:0 fail:1 xfail:0 xpass:0 skip:0 error:0 [FAIL] not ok 2 ksm_tests -N -m 0 # exit=1 After patch: --------------------------- running ./ksm_tests -N -m 1 --------------------------- At least 2 NUMA nodes with memory must be available ok 1 SKIP KSM NUMA merging Totals: pass:0 fail:0 xfail:0 xpass:0 skip:1 error:0 [PASS] ok 1 ksm_tests -N -m 1 --------------------------- running ./ksm_tests -N -m 0 --------------------------- At least 2 NUMA nodes with memory must be available ok 1 SKIP KSM NUMA merging Totals: pass:0 fail:0 xfail:0 xpass:0 skip:1 error:0 [PASS] ok 2 ksm_tests -N -m 0 Link: https://lore.kernel.org/78a3b0e3fb94004c0710872c5bab6f7381b7d63c.1783446924.git.sayalip@linux.ibm.com Fixes: e3820ab252dd ("selftest/vm: fix ksm selftest to run with different NUMA topologies") Co-developed-by: David Hildenbrand (Arm) <david@kernel.org> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org> Signed-off-by: Sayali Patil <sayalip@linux.ibm.com> Cc: Dev Jain <dev.jain@arm.com> Cc: Liam Howlett <liam@infradead.org> Cc: Miaohe Lin <linmiaohe@huawei.com> Cc: Michal Hocko <mhocko@kernel.org> Cc: Oscar Salvador <osalvador@suse.de> Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04selftests/mm: handle EINVAL when configuring gigantic hugepagesSayali Patil
Patch series "selftests/mm: avoid false failures in hugetlb and KSM tests", v3. This series fixes issues in the hugetlb and KSM MM selftest categories that can report failures when the prerequisites for the tests are not satisfied. Patch 1 updates the hugetlb selftest helpers to handle -EINVAL when attempting to configure gigantic HugeTLB pages via nr_hugepages. PowerPC hash MMU pSeries systems expose gigantic hugepage sizes but do not allow runtime allocation of such pages, causing the sysfs write to fail. Handle this case gracefully and continue running the test instead of aborting. Patch 2 fixes the KSM NUMA merge test on systems with memoryless NUMA nodes. The test currently relies on the number of configured NUMA nodes and may attempt allocations on nodes that have no memory, resulting in spurious failures. Use the existing helpers to identify NUMA nodes that contain memory and skip the test when fewer than two such nodes are available. Patch 3 fixes a pre-existing operator precedence issue in ksm_tests, where a ternary expression combined with logical OR operators could be evaluated differently than intended. Added parentheses to ensure the correct evaluation order. These changes improve handling of unsupported test configurations and unmet test prerequisites, avoiding spurious failures. This patch (of 3): Some MM selftests attempt to configure the amount of HugeTLB pages of different sizes by writing to nr_hugepages. PowerPC hash MMU pSeries systems advertise gigantic hugepage sizes but do not support runtime allocation of such pages, writes to the corresponding nr_hugepages file fail with -EINVAL. This causes the test to bail out even though the failure is due to a platform limitation rather than the functionality being tested. Ignore -EINVAL when configuring nr_hugepages so that tests continue to run on systems where gigantic hugepage allocation is unsupported. Before patch: ------------------------- running ./hugetlb-madvise ------------------------- TAP version 13 1..1 [INFO] detected hugetlb page size: 16777216 KiB [INFO] detected hugetlb page size: 16384 KiB ok 1 MADV_DONTNEED and MADV_REMOVE on hugetlb Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 Bail out! /sys/kernel/mm/hugepages/hugepages-16777216kB/nr_hugepages write(0) failed: Invalid argument Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:0 [FAIL] After patch: ------------------------- running ./hugetlb-madvise ------------------------- TAP version 13 1..1 [INFO] detected hugetlb page size: 16777216 KiB [INFO] detected hugetlb page size: 16384 KiB ok 1 MADV_DONTNEED and MADV_REMOVE on hugetlb Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 [PASS] Link: https://lore.kernel.org/cover.1783446924.git.sayalip@linux.ibm.com Link: https://lore.kernel.org/2e3b585cbb30b2fc495dcd49d75de6f6da61861c.1783446924.git.sayalip@linux.ibm.com Fixes: 27477b28b74f ("selftests/mm: hugepage_settings: add APIs to get and set nr_hugepages") Co-developed-by: David Hildenbrand (Arm) <david@kernel.org> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org> Signed-off-by: Sayali Patil <sayalip@linux.ibm.com> Cc: Dev Jain <dev.jain@arm.com> Cc: Liam Howlett <liam@infradead.org> Cc: Miaohe Lin <linmiaohe@huawei.com> Cc: Michal Hocko <mhocko@kernel.org> Cc: Oscar Salvador <osalvador@suse.de> Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04selftests/mm: fix memleak in migration benchmarkHongfu Li
Several early return paths in run_migration_benchmark() skip hmm_buffer_free(), leaking the buffer. Replace with a single cleanup label. Link: https://lore.kernel.org/20260709081843.1451202-1-lihongfu@kylinos.cn Fixes: 271a7b2e3c13 ("selftests/mm/hmm-tests: new throughput tests including THP") Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: SJ Park <sj@kernel.org> Acked-by: Balbir Singh <balbirs@nvidia.com> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Balbir Singh <balbirs@nvidia.com> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Cc: Hongfu Li <lihongfu@kylinos.cn> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: Leon Romanovsky <leon@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm: split out mm_init and memblock declarations from internal.hMike Rapoport (Microsoft)
Patch series "mm: split a couple of headers from internal.h", v2. mm/internal.h becomes more and more bloated. Split declarations related to mm_init, memblock, vmalloc and sparse into new headers. This patch (of 3): mm/internal.h becomes more and more bloated. Move declarations for related to mm/mm_init.c and mm/memblock.c to a new mm/mm_init.h header. No functional changes. [rppt@kernel.org: split stubfs from internal.h to mm_init.h] Link: https://lore.kernel.org/alJd1BLypyK9Mpaw@kernel.org Link: https://lore.kernel.org/20260709-internal-h-v2-0-695631425968@kernel.org Link: https://lore.kernel.org/20260709-internal-h-v2-1-695631425968@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Acked-by: Muchun Song <muchun.song@linux.dev> Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Acked-by: Lorenzo Stoakes <ljs@kernel.org> Acked-by: Pratyush Yadav <pratyush@kernel.org> Acked-by: SJ Park <sj@kernel.org> Cc: Alexander Graf <graf@amazon.com> Cc: Alexander Potapenko <glider@google.com> Cc: Brendan Jackman <jackmanb@google.com> Cc: Brendan Jackman <brendan.jackman@linux.dev> Cc: Dennis Zhou <dennis@kernel.org> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Marco Elver <elver@google.com> Cc: Michal Hocko <mhocko@suse.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pasha Tatashin <pasha.tatashin@soleen.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Tejun Heo <tj@kernel.org> Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04ksm: add mremap selftests for ksm_rmap_walkxu xin
The existing tools/testing/selftests/mm/rmap.c has already one testcase for ksm_rmap_walk in TEST_F(migrate, ksm), which takes use of migration of page from one NUMA node to another NUMA node. However, it just lacks the scenario of mremapped VMAs. We add the calling of mremap() and then trigger KSM to merge pages before migrating, which is specifically to test an optimization which is introduced by this patch ("ksm: Optimize rmap_walk_ksm by passing a suitable address pgoff"). This test can reproduce the issue that Hugh points out at https://lore.kernel.org/all/02e1b8df-d568-8cbb-b8f6-46d5476d9d75@google.com/ Link: https://lore.kernel.org/20260703162637070FU4ekl58Hw_Z7OSuJryZB@zte.com.cn Signed-off-by: xu xin <xu.xin16@zte.com.cn> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Chengming Zhou <chengming.zhou@linux.dev> Cc: Hugh Dickins <hughd@google.com> Cc: "Liam R. Howlett" <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Wang Yaxin <wang.yaxin@zte.com.cn> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04selftests/mm: add userfaultfd RWP testsKiryl Shutsemau (Meta)
Coverage for UFFDIO_REGISTER_MODE_RWP and UFFDIO_RWPROTECT: rwp-async async mode — touch pages, verify permissions are auto-restored without a message rwp-sync sync mode — access blocks, handler resolves via UFFDIO_RWPROTECT rwp-pagemap PAGEMAP_SCAN reports still-cold pages via inverted PAGE_IS_ACCESSED rwp-mprotect RWP survives mprotect(PROT_NONE) -> mprotect(PROT_READ|PROT_WRITE) round-trip rwp-gup GUP walks through a protnone RWP PTE (pipe write/read drives the GUP path) rwp-async-toggle UFFDIO_SET_MODE flips between sync and async without re-registering rwp-close closing the uffd restores page permissions rwp-fork RWP survives fork() with EVENT_FORK; child's PTEs keep the uffd bit rwp-fork-pin RWP survives fork() on an RO-longterm-pinned anon page (forces copy_present_page()); child read auto-resolves and clears the bit, proving PAGE_NONE was in place rwp-wp-exclusive register with MODE_WP|MODE_RWP returns -EINVAL All tests run against anon, shmem, shmem-private, hugetlb, and hugetlb-private memory, except rwp-fork-pin which is anon-only — copy_present_page() is the private-anon pinned-exclusive fork path. Snapshot the RWP additions into tools/include/uapi/linux/userfaultfd.h so the selftest builds without requiring "make headers" first, matching the mechanism established by commit 580ea358af0a ("selftests/mm: fix additional build errors for selftests"). Link: https://lore.kernel.org/ak-Z9KO2mP9HMOPW@thinkstation Signed-off-by: Kiryl Shutsemau <kas@kernel.org> Assisted-by: Claude:claude-opus-4-6 Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: David Hildenbrand <david@kernel.org> Cc: James Houghton <jthoughton@google.com> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Xu <peterx@redhat.com> Cc: Sean Christopherson <seanjc@google.com> Cc: SeongJae Park <sj@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04selftests/damon: check correct path in ensure_file() not_exist casewang wei
In the ensure_file() function, the "not_exist" code path checks whether $dir exists as a regular file. However, the intent is to verify that the target file ($file) does not exist, not the $dir. Testing $dir makes the existence check effectively useless -- it tests the wrong path and thus never catches the case where the file is unexpectedly present. Replace $dir with $file so the not_exist verification targets the correct path. Link: https://lore.kernel.org/20260706134305.5224-1-a929244872@163.com Signed-off-by: wang wei <a929244872@163.com> Reviewed-by: SJ Park <sj@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04Merge branch 'mm-hotfixes-stable' into mm-stable in order to pick upAndrew Morton
vmscan.c changes which are required by "memcg: bail out proactive reclaim when memcg is dying".
2026-08-05selftests/ftrace: refactor eprobes test to fix argument checksMartin Kaiser
The add/remove eprobe test installs an eprobe for the openat syscall and runs ls. It checks the filenames that were opened by ls against a whitelist and a blacklist. Commit 206b25c09080 ("tracing: eprobe: read the complete FILTER_PTR_STRING pointer") fixed access to some string fields in eprobes. This triggers test failures as the blacklist does not allow relative paths for the openat parameters. What makes this test unstable is the fact that the openat calls vary a lot between different systems. Refactor the test to make it more robust. "cd <directory>" will issue a chdir syscall with the target directory as parameter. Set an eprobe on the sys_enter_chdir event and filter for the exact directory name. Allow (fault) as fallback. Link: https://lore.kernel.org/all/20260804194705.760893-1-martin@kaiser.cx/ Fixes: 206b25c09080 ("tracing: eprobe: read the complete FILTER_PTR_STRING pointer") Reported-by: kernel test robot <oliver.sang@intel.com> Closes: https://lore.kernel.org/oe-lkp/202607151010.b68428e1-lkp@intel.com Signed-off-by: Martin Kaiser <martin@kaiser.cx> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-08-04selftests/xsk: Decouple xskxceiver and xdp apps from test_progs objectsTushar Vyavahare
Build xskxceiver, xdp_hw_metadata, and xdp_features from explicit source lists instead of reusing helper objects produced by test_progs rules. Reusing shared objects such as network_helpers.o and xsk.o can pull in test_progs-only dependency chains and trigger unrelated libarena builds when invoking a single target. Keep these standalone binaries self-contained so each target builds only its own required sources and BPF skeleton dependencies. Signed-off-by: Tushar Vyavahare <tushar.vyavahare@intel.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Tested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Link: https://lore.kernel.org/bpf/20260728115036.2049536-1-tushar.vyavahare@intel.com
2026-08-04selftests/bpf: Test RCU pointer invalidation after spin unlockNing Ding
The verifier previously accepted a task kptr after the final spin unlock ended its RCU protection in a sleepable program. The pointer could then be used after the task was freed. Add a negative test for that case. Add positive controls showing that the pointer remains valid in a non-sleepable program and while an explicit RCU read-side section is still active. Assisted-by: Codex:gpt-5.6-sol Assisted-by: ChatGPT:GPT-5.6-Pro Signed-off-by: Ning Ding <dingning04@gmail.com> Link: https://lore.kernel.org/bpf/20260803112615.3362122-3-dingning04@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-04memblock: always include KHO headersPratyush Yadav (Google)
In a coming commit, memblock will start using kho_scratch_overlap() without a compile guard. The compile guard for the function is in kexec_handover.h and provides a stub when CONFIG_KEXEC_HANDOVER is disabled. Since in memblock the call will exist unconditionally, always include the KHO headers. Including these headers unconditionally breaks memblock test compilation. Add stubs to fix that. Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-20-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04kho: expose kho_scratch_overlap() to kexec_handover.hPratyush Yadav (Google)
Support for discovering memory blocks with no preserved memory will be added in coming patches. These areas will also be marked as scratch to allow allocations from them. Memblock will switch to looking through the scratch array to decide the right migratetype. Expose kho_scratch_overlap() to KHO users. Since it is now used by non-debug code, move it out of kexec_handover_debug.c and into kexec_handover.c. Gate the overlap checks in kho_preserve_folio() and kho_preserve_pages() by IS_ENABLED(CONFIG_KEXEC_HANDOVER_DEBUG) instead. Since kexec_handover_debug.c is now empty, delete it. Add a stub for kho_scratch_overlap() to memblock tests to make sure it compiles. It will be used in memblock by a coming commit. No functional changes. Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-14-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-03selftests: ipc: change operation not supported error numberPaul White
The application doesn't know what ENOTSUPP means, as it is a kernelspace error code and the application doesn't have access to kernelspace error codes.I used EOPNOTSUPP in its place as that is an error number the application will recognize and know an operation is being attempted that it cannot support. Link: https://lore.kernel.org/20260720204001.1663473-1-paul.white.kernel@gmail.com Signed-off-by: Paul White <paul.white.kernel@gmail.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Wei Yang <richard.weiyang@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03selftests/acct: share netlink helpersYiyang Chen
Extract the duplicated generic netlink boilerplate (netlink_open, send_request, get_family_id, and NLA walker macros) from cgroupstats.c and taskstats_fill_stats_tgid.c into a shared netlink_helper.{h,c}. Link: https://lore.kernel.org/a2adf27308b5cd90d50b59e8519b87da49486bee.1783876192.git.cyyzero16@gmail.com Signed-off-by: Yiyang Chen <cyyzero16@gmail.com> Suggested-by: Andrew Morton <akpm@linux-foundation.org> Acked-by: Balbir Singh <balbirs@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03selftests/acct: add cgroupstats functional testYiyang Chen
Add a self-contained test for the CGROUPSTATS_CMD_GET genl command that covers three cases: - querying a cgroup v1 hierarchy and verifying the response contains non-zero task counts - rejecting an invalid fd without NLM_F_ACK - rejecting an invalid fd with NLM_F_ACK Link: https://lore.kernel.org/2a56921276f0962f97f00863e8c7d3c3f6893d5a.1783713230.git.cyyzero16@gmail.com Signed-off-by: Yiyang Chen <cyyzero16@gmail.com> Cc: Balbir Singh <balbirs@nvidia.com> Cc: Dr. Thomas Orgis <thomas.orgis@uni-hamburg.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>