* + mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch added to mm-unstable branch
@ 2026-09-17 21:24 Andrew Morton
0 siblings, 0 replies; 5+ messages in thread
From: Andrew Morton @ 2026-09-17 21:24 UTC (permalink / raw)
To: mm-commits, ljs, akpm
The patch titled
Subject: mm: add mmap action for discontiguous kernel page mapping
has been added to the -mm mm-unstable branch. Its filename is
mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
This patch will later appear in the mm-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days
------------------------------------------------------
From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Subject: mm: add mmap action for discontiguous kernel page mapping
Date: Thu, 17 Sep 2026 17:22:17 +0100
The existing kernel page mapping mmap actions allow for partial and full
mapping of an array of struct page pointers.
However some drivers require the mapping of discontiguous ranges. Permit
this by providing discontig_kernel_page_ops which allows a driver to
specify how the operation should begin and how batches of pages should be
retrieved.
It uses the minimum exposed interface to do so, providing address, page
offset and both vm_private_data state and a local private state object.
ops->init can establish state for the operation, and ops->get outputs the
pages to map and their count. Should an error arise the core unmaps the
VMA, invoking vm_ops->close, which is therefore where any state
established by ops->init is released.
Batches may not exceed the VMA, but may map less than its full range in
case the driver wishes to allow the user to map an area larger than the
available data.
To use it, users invoke mmap_action_map_discontig_kernel_pages() with
initial local private state and a set of operations.
Users can then use one of the provided helper functions to perform an
action:
* discontig_kernel_map_abort() - Abort and leave the mapping as it has
been accumulated so far.
* discontig_kernel_map_page() - Map a single page, or a compound page given
its head page.
* discontig_kernel_map_page_range() - Maps a struct page ** array of a
specified count.
The userland VMA tests are updated accordingly.
Link: https://lore.kernel.org/20260917-b4-mmap-prepare-vma-flag-sanify-v3-8-4583d8a23bca@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Andreas Larsson <andreas@gaisler.com>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@kernel.org>
Cc: Anup Patel <anup@brainfault.org>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Barry Song <baohua@kernel.org>
Cc: "Borislav Petkov (AMD)" <bp@alien8.de>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Chris Li <chrisl@kernel.org>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Claudio Imbrenda <imbrenda@linux.ibm.com>
Cc: Dave Airlie <airlied@gmail.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: David S. Miller <davem@davemloft.net>
Cc: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Doug Gilbert <dgilbert@interlog.com>
Cc: Eduard Zingerman <eddyz87@gmail.com>
Cc: Emil Tsalapatis <emil@etsalapatis.com>
Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Gregory Price <gourry@gourry.net>
Cc: Harry Yoo <harry@kernel.org>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Helge Deller <deller@gmx.de>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Bottomley <james.bottomley@HansenPartnership.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Jann Horn <jannh@google.com>
Cc: Janosch Frank <frankja@linux.ibm.com>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Jaya Kumar <jayalk@intworks.biz>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Marc Rutland <mark.rutland@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Namhyung kim <namhyung@kernel.org>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Peter Xu <peterx@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Sebastian Reichel <sre@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Takashi Iwai (SUSE) <tiwai@suse.de>
Cc: Takashi Iwai <tiwai@suse.com>
Cc: Thomas Zimemrmann <tzimmermann@suse.de>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Wei Xu <weixugc@google.com>
Cc: Will Deacon <will@kernel.org>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Zi Yan <ziy@nvidia.com>
---
include/linux/mm.h | 45 ++++++++++++
include/linux/mm_types.h | 44 +++++++++++-
mm/internal.h | 3
mm/memory.c | 108 ++++++++++++++++++++++++++++--
mm/util.c | 7 +
tools/testing/vma/include/dup.h | 11 ++-
6 files changed, 209 insertions(+), 9 deletions(-)
--- a/include/linux/mm.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/include/linux/mm.h
@@ -4654,10 +4654,55 @@ static inline void mmap_action_map_kerne
vma_desc_pages(desc));
}
+static inline
+void mmap_action_map_discontig_kernel_pages(struct vm_area_desc *desc,
+ void *init_private, const struct discontig_kernel_page_ops *ops)
+{
+ struct mmap_action *action = &desc->action;
+
+ action->type = MMAP_DISCONTIG_KERNEL_PAGES;
+ action->map_kernel_discontig.init_private = init_private;
+ action->map_kernel_discontig.ops = ops;
+}
+
int mmap_action_prepare(struct vm_area_desc *desc);
int mmap_action_complete(struct vm_area_struct *vma,
struct mmap_action *action, bool is_compat);
+static inline void
+discontig_kernel_map_abort(struct discontig_kernel_page_state *state)
+{
+ state->action = DISCONTIG_KERNEL_PAGE_ABORT;
+}
+
+static inline void
+discontig_kernel_map_page(struct discontig_kernel_page_state *state,
+ struct page *page)
+{
+ struct folio *folio = page_folio(page);
+
+ if (folio_test_large(folio)) {
+ VM_WARN_ON_ONCE(page != folio_page(folio, 0));
+ state->action = DISCONTIG_KERNEL_PAGE_MAP_COMPOUND_PAGE;
+ state->__folio = folio;
+ state->__nr_pages = min(state->nr_pages_remain,
+ folio_nr_pages(folio));
+ } else {
+ state->action = DISCONTIG_KERNEL_PAGE_MAP_PAGE;
+ state->__page = page;
+ state->__nr_pages = 1;
+ }
+}
+
+static inline void
+discontig_kernel_map_page_range(struct discontig_kernel_page_state *state,
+ struct page **page_arr, unsigned long nr_pages)
+{
+ state->action = DISCONTIG_KERNEL_PAGE_MAP_PAGE_RANGE;
+ state->__page_arr = page_arr;
+ state->__nr_pages = nr_pages;
+}
+
/* Look up the first VMA which exactly match the interval vm_start ... vm_end */
static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
unsigned long vm_start, unsigned long vm_end)
--- a/include/linux/mm_types.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/include/linux/mm_types.h
@@ -818,8 +818,44 @@ enum mmap_action_type {
MMAP_NOTHING,
MMAP_REMAP_PFN,
MMAP_IO_REMAP_PFN,
- MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
- MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
+ MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_DISCONTIG_KERNEL_PAGES, /* Map kernel discontig page range. */
+};
+
+enum discontig_kernel_page_action {
+ DISCONTIG_KERNEL_PAGE_ABORT,
+ DISCONTIG_KERNEL_PAGE_MAP_PAGE,
+ DISCONTIG_KERNEL_PAGE_MAP_COMPOUND_PAGE,
+ DISCONTIG_KERNEL_PAGE_MAP_PAGE_RANGE,
+};
+
+struct discontig_kernel_page_state {
+ /* Map state. */
+ const unsigned long start; /* Start address of VMA. */
+ const unsigned long end; /* End address of VMA. */
+ unsigned long addr; /* The current address to be mapped. */
+ pgoff_t pgoff; /* The current pgoff to be mapped. */
+ unsigned long nr_pages_mapped; /* The number of pages mapped. */
+ unsigned long nr_pages_remain; /* The number of pages remaining. */
+
+ /* User-defined state. */
+ void *vm_private_data; /* VMA private data. */
+ void *private; /* Mapping private data. */
+
+ /* Users should not touch these, use discontig_kernel_map_*() helpers. */
+ enum discontig_kernel_page_action action;
+ union {
+ struct page *__page;
+ struct folio *__folio;
+ struct page **__page_arr;
+ };
+ unsigned long __nr_pages;
+};
+
+struct discontig_kernel_page_ops {
+ int (*init)(void *vm_private_data, void **private);
+ int (*get)(struct discontig_kernel_page_state *state);
};
/*
@@ -844,6 +880,10 @@ struct mmap_action {
unsigned long nr_pages;
pgoff_t pgoff;
} map_kernel;
+ struct {
+ void *init_private;
+ const struct discontig_kernel_page_ops *ops;
+ } map_kernel_discontig;
};
enum mmap_action_type type;
--- a/mm/internal.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/internal.h
@@ -1518,6 +1518,9 @@ int simple_ioremap_prepare(struct vm_are
int map_kernel_pages_prepare(struct vm_area_desc *desc);
int map_kernel_pages_complete(struct vm_area_struct *vma,
struct mmap_action *action);
+int map_discontig_kernel_pages_prepare(struct vm_area_desc *desc);
+int map_discontig_kernel_pages_complete(struct vm_area_struct *vma,
+ struct mmap_action *action);
static inline int io_remap_pfn_range_prepare(struct vm_area_desc *desc)
{
--- a/mm/memory.c~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/memory.c
@@ -2609,17 +2609,23 @@ int vm_insert_pages(struct vm_area_struc
}
EXPORT_SYMBOL(vm_insert_pages);
+static void __map_kernel_pages_prepare(struct vm_area_desc *desc)
+{
+ if (vma_desc_test(desc, VMA_MIXEDMAP_BIT))
+ return;
+
+ VM_WARN_ON_ONCE(mmap_read_trylock(desc->mm));
+ VM_WARN_ON_ONCE(vma_desc_test(desc, VMA_PFNMAP_BIT));
+ vma_desc_set_flags(desc, VMA_MIXEDMAP_BIT);
+}
+
int map_kernel_pages_prepare(struct vm_area_desc *desc)
{
const struct mmap_action *action = &desc->action;
const unsigned long addr = action->map_kernel.start;
unsigned long nr_pages, end;
- if (!vma_desc_test(desc, VMA_MIXEDMAP_BIT)) {
- VM_WARN_ON_ONCE(mmap_read_trylock(desc->mm));
- VM_WARN_ON_ONCE(vma_desc_test(desc, VMA_PFNMAP_BIT));
- vma_desc_set_flags(desc, VMA_MIXEDMAP_BIT);
- }
+ __map_kernel_pages_prepare(desc);
nr_pages = action->map_kernel.nr_pages;
end = addr + PAGE_SIZE * nr_pages;
@@ -2640,6 +2646,98 @@ int map_kernel_pages_complete(struct vm_
&nr_pages, vma->vm_page_prot);
}
+int map_discontig_kernel_pages_prepare(struct vm_area_desc *desc)
+{
+ const struct mmap_action *action = &desc->action;
+ const struct discontig_kernel_page_ops *ops =
+ action->map_kernel_discontig.ops;
+
+ /* At minimum need to be able to get pages. */
+ if (WARN_ON_ONCE(!ops || !ops->get))
+ return -EINVAL;
+
+ __map_kernel_pages_prepare(desc);
+ return 0;
+}
+
+static int apply_discontig_action(struct vm_area_struct *vma,
+ struct discontig_kernel_page_state *state)
+{
+ unsigned long nr_pages = state->__nr_pages;
+ unsigned long addr = state->addr;
+ unsigned long i;
+
+ if (state->action == DISCONTIG_KERNEL_PAGE_MAP_PAGE)
+ return insert_page(vma, addr, state->__page,
+ vma->vm_page_prot, /*mkwrite=*/false);
+ if (state->action == DISCONTIG_KERNEL_PAGE_MAP_PAGE_RANGE)
+ return insert_pages(vma, addr, state->__page_arr,
+ &nr_pages, vma->vm_page_prot);
+
+ /* Compound folio - have to iterate through each page. */
+ for (i = 0; i < nr_pages; i++, addr += PAGE_SIZE) {
+ struct page *page = folio_page(state->__folio, i);
+ int err;
+
+ err = insert_page(vma, addr, page, vma->vm_page_prot,
+ /*mkwrite=*/false);
+ if (err)
+ return err;
+ }
+ return 0;
+}
+
+int map_discontig_kernel_pages_complete(struct vm_area_struct *vma,
+ struct mmap_action *action)
+{
+ const struct discontig_kernel_page_ops *ops =
+ action->map_kernel_discontig.ops;
+ struct discontig_kernel_page_state state = {
+ .start = vma->vm_start,
+ .end = vma->vm_end,
+ .addr = vma->vm_start,
+ .pgoff = vma->vm_pgoff,
+ .nr_pages_mapped = 0,
+ .nr_pages_remain = vma_pages(vma),
+ .vm_private_data = vma->vm_private_data,
+ .private = action->map_kernel_discontig.init_private,
+ };
+ int err = 0;
+
+ if (ops->init)
+ err = ops->init(vma->vm_private_data, &state.private);
+ if (err)
+ return err;
+
+ do {
+ unsigned long end, pgoff_end;
+ unsigned long nr_pages;
+
+ /* Default to abort. */
+ state.action = DISCONTIG_KERNEL_PAGE_ABORT;
+ err = ops->get(&state);
+ if (err || state.action == DISCONTIG_KERNEL_PAGE_ABORT)
+ return err;
+ nr_pages = state.__nr_pages;
+
+ if (!nr_pages || nr_pages > state.nr_pages_remain)
+ return -EINVAL;
+ end = state.addr + PAGE_SIZE * nr_pages;
+ pgoff_end = state.pgoff + nr_pages;
+
+ err = apply_discontig_action(vma, &state);
+ if (err)
+ return err;
+
+ state.addr = end;
+ state.pgoff = pgoff_end;
+ state.nr_pages_mapped += nr_pages;
+ state.nr_pages_remain -= nr_pages;
+ } while (state.addr < vma->vm_end);
+
+ return 0;
+}
+
/**
* vm_insert_page - insert single page into user vma
* @vma: user vma to map to
--- a/mm/util.c~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/util.c
@@ -1469,6 +1469,8 @@ int mmap_action_prepare(struct vm_area_d
return simple_ioremap_prepare(desc);
case MMAP_KERNEL_PAGES:
return map_kernel_pages_prepare(desc);
+ case MMAP_DISCONTIG_KERNEL_PAGES:
+ return map_discontig_kernel_pages_prepare(desc);
}
WARN_ON_ONCE(1);
@@ -1501,6 +1503,9 @@ int mmap_action_complete(struct vm_area_
case MMAP_KERNEL_PAGES:
err = map_kernel_pages_complete(vma, action);
break;
+ case MMAP_DISCONTIG_KERNEL_PAGES:
+ err = map_discontig_kernel_pages_complete(vma, action);
+ break;
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
/* Should have been delegated. */
@@ -1522,6 +1527,7 @@ int mmap_action_prepare(struct vm_area_d
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
case MMAP_KERNEL_PAGES:
+ case MMAP_DISCONTIG_KERNEL_PAGES:
WARN_ON_ONCE(1); /* nommu cannot handle these. */
break;
}
@@ -1543,6 +1549,7 @@ int mmap_action_complete(struct vm_area_
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
case MMAP_KERNEL_PAGES:
+ case MMAP_DISCONTIG_KERNEL_PAGES:
WARN_ON_ONCE(1); /* nommu cannot handle this. */
err = -EINVAL;
--- a/tools/testing/vma/include/dup.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/tools/testing/vma/include/dup.h
@@ -457,14 +457,17 @@ enum mmap_action_type {
MMAP_NOTHING,
MMAP_REMAP_PFN,
MMAP_IO_REMAP_PFN,
- MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
- MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
+ MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_DISCONTIG_KERNEL_PAGES, /* Map kernel discontig page range. */
};
/*
* Describes an action an mmap_prepare hook can instruct to be taken to complete
* the mapping of a VMA. Specified in vm_area_desc.
*/
+struct discontig_kernel_page_ops;
+
struct mmap_action {
union {
struct {
@@ -483,6 +486,10 @@ struct mmap_action {
unsigned long nr_pages;
pgoff_t pgoff;
} map_kernel;
+ struct {
+ void *init_private;
+ const struct discontig_kernel_page_ops *ops;
+ } map_kernel_discontig;
};
enum mmap_action_type type;
_
Patches currently in -mm which might be from ljs@kernel.org are
mm-vmpressure-remove-window-size-todo.patch
tools-testing-selftests-mm-add-missing-gitignore-entries.patch
mm-move-drivers-char-memc-to-mm-char-memc.patch
mm-implement-file_is_dev_zero-to-uniquely-identify-dev-zero.patch
mm-vma-only-permit-map_private-dev-zero-to-be-mapped-anonymous.patch
mm-vma-make-map_private-mapped-dev-zero-mappings-truly-anonymous.patch
tools-testing-vma-add-test-to-assert-map_private-dev-zero-is-anon.patch
tools-testing-selftests-mm-add-map_private-dev-zero-merge-tests.patch
mm-madvise-swap-in-cowd-map_private-file-mappings-on-madv_willneed.patch
mm-huge_memory-zap-deposited-page-tables-after-an-rcu-grace-period.patch
mm-enable-mmu_gather_rcu_table_free-for-most-2-level-architectures.patch
mm-enable-mmu_gather_rcu_table_free-for-mmu-riscv.patch
mm-enable-mmu_gather_rcu_table_free-for-mmu-arm.patch
mm-enable-mmu_gather_rcu_table_free-for-arc-microblaze-xtensa.patch
mm-enable-mmu_gather_rcu_table_free-for-sparc64.patch
mm-enable-mmu_gather_rcu_table_free-for-m68k-coldfire.patch
mm-enable-mmu_gather_rcu_table_free-for-sh-x2.patch
mm-enable-mmu_gather_rcu_table_free-for-m68k-motorola.patch
mm-enable-mmu_gather_rcu_table_free-for-sparc32.patch
mm-make-userland-page-table-freeing-rcu-safe.patch
mm-change-the-contract-for-free_pgtables-update-docs.patch
mm-vma-fix-mmap_prepare-file-handling-remove-file_doesnt_need_get.patch
mm-vma-predicate-setting-mmap_prepare-vma-fields-on-new-vma-alloc.patch
mm-vma-introduce-and-use-vma_can_merge.patch
mm-consistently-validate-vma-state-after-mmap-hooks.patch
mm-vma-ensure-mmap_prepare-doesnt-set-actions-on-a-mergeable-vma.patch
mm-make-map_kernel_pages_-internal-and-unexported.patch
mm-vma-tidy-up-map-kernel-pages-enum-values.patch
mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
docs-filesystems-update-mmap_prepare-docs-for-discontig-kernel-pgs.patch
drivers-usb-mon-update-to-use-mmap_prepare-map-kernel-pages.patch
infiniband-update-hfi1-to-use-remap_vmalloc_range.patch
selinux-reject-writable-opens-of-policy-file-drop-mmap-shared-write-check.patch
alsa-pcm-use-vm_insert_page-to-map-pcm-status-page.patch
bpf-arena-mark-arena_map_mmap-mappings-vm_mixedmap.patch
mm-vma-add-vma_is_kernel_owned-predicates.patch
mm-vma-only-allow-mmap-to-clear-vma_maywrite_bit-if-kernel-owned.patch
mm-vma-add-and-use-vma__is_fixed_mapping.patch
scsi-sg-convert-mmap-hook-to-mmap_prepare-and-rework.patch
fbdev-defio-assert-fbinfo_virtfb-drop-vm_io-add-vm_mixedmap.patch
hsi-cmt_speech-convert-mmap-hook-to-mmap_prepare-refactor.patch
mm-gup-error-out-early-on-vma_mayread_bit-vmas.patch
uprobes-remove-vm_io-set-vm_mixedmap-for-mapped-kernel-pages.patch
mm-mlock-clear-vma_locked_mask-over-mmap-callback.patch
mm-mlock-eliminate-weird-vma_io_bit-abuse-and-simplify.patch
mm-vma-enforce-that-only-kernel-owned-mappings-may-set-vma_io_bit.patch
mm-remove-vma_io_bit-check-in-vma_is_kernel_owned.patch
mm-remove-hugetlb_inlineh.patch
mm-rename-is_vm_hugetlb_page-to-vma_is_hugetlb.patch
mm-drop-some-redundant-checks-around-hugetlb-vmas.patch
mm-madvise-update-is_valid_guard_vma-to-use-vma_can_merge.patch
mm-vma-introduce-vma_is_persistent.patch
mm-uffd-use-predicates-for-userfaultfd-checks.patch
mm-madvise-use-predicates-for-madvise-madv_dofork.patch
mm-eliminate-vma_special_flags-usage-when-hugetlb-explicitly-tested.patch
mm-eliminate-vma_special_flags-check-in-lru_gen_look_around.patch
mm-avoid-use-of-vma_special_flags-in-migrate_vma_setup.patch
mm-eliminate-vm_special-vma_special_flags.patch
fuse-dax-do-not-set-vm_mixedmap.patch
mm-huge_memory-remove-vma_is_special_huge.patch
mm-vma-introduce-and-use-vma_can_gup.patch
mm-vma-const-ify-vma_assert_stabilised-and-associated-functions.patch
mm-implement-and-use-vma_has_anon_rmap-silence-kcsan.patch
mm-update-comments-to-refer-to-anon-rmap-rather-than-anon_vma.patch
^ permalink raw reply [flat|nested] 5+ messages in thread
* + mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch added to mm-unstable branch
@ 2026-10-03 23:34 Andrew Morton
0 siblings, 0 replies; 5+ messages in thread
From: Andrew Morton @ 2026-10-03 23:34 UTC (permalink / raw)
To: mm-commits, ljs, akpm
The patch titled
Subject: mm: add mmap action for discontiguous kernel page mapping
has been added to the -mm mm-unstable branch. Its filename is
mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
This patch will later appear in the mm-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days
------------------------------------------------------
From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Subject: mm: add mmap action for discontiguous kernel page mapping
Date: Sat, 03 Oct 2026 17:32:38 +0100
The existing kernel page mapping mmap actions allow for partial and full
mapping of an array of struct page pointers.
However some drivers require the mapping of discontiguous ranges. Permit
this by providing discontig_kernel_page_ops which allows a driver to
specify how the operation should begin and how batches of pages should be
retrieved.
It uses the minimum exposed interface to do so, providing address, page
offset and both vm_private_data state and a local private state object.
ops->init can establish state for the operation, and ops->get outputs the
pages to map and their count. Should an error arise the core unmaps the
VMA, invoking vm_ops->close, which is therefore where any state established
by ops->init is released.
Also update the compatibility layer to do this too via
compat_mmap_action_abort().
Batches may not exceed the VMA, but may map less than its full range in
case the driver wishes to allow the user to map an area larger than the
available data.
To use it, users invoke mmap_action_map_discontig_kernel_pages() with
initial local private state and a set of operations.
Users can then use one of the provided helper functions to perform an
action:
* discontig_kernel_map_abort() - Abort and leave the mapping as it has
been accumulated so far.
* discontig_kernel_map_page() - Map a single page, or a compound page given
its head page.
* discontig_kernel_map_page_range() - Maps a struct page ** array of a
specified count, mapping only those pages which fit in the VMA.
The userland VMA tests are updated accordingly.
Link: https://lore.kernel.org/20261003-b4-mmap-prepare-vma-flag-sanify-v4-7-a1f052500fd7@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Zi Yan <ziy@nvidia.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: David Hildenbrand <david@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: Eduard Zingerman <eddyz87@gmail.com>
Cc: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Nico Pache <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Doug Gilbert <dgilbert@interlog.com>
Cc: James Bottomley <james.bottomley@hansenpartnership.com>
Cc: Martin K. Petersen <mkp@kernel.org>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Helge Deller <deller@gmx.de>
Cc: Sebastian Reichel <sre@kernel.org>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Harry Yoo <harry@kernel.org>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@gmail.com>
Cc: Will Deacon <will@kernel.org>
Cc: Aneesh Kumar K.V <aneesh.kumar@kernel.org>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Oliver Upton <oupton@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Anup Patel <anup@brainfault.org>
Cc: Paul Walmsley <pjw@kernel.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: Janosch Frank <frankja@linux.ibm.com>
Cc: Claudio Imbrenda <imbrenda@linux.ibm.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Andreas Larsson <andreas@gaisler.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Chris Li <chrisl@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Youngjun Park <youngjun.park@lge.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Xu Xin <xu.xin@linux.dev>
---
include/linux/mm.h | 45 ++++++++++++
include/linux/mm_types.h | 44 +++++++++++-
mm/internal.h | 3
mm/memory.c | 108 ++++++++++++++++++++++++++++--
mm/util.c | 27 ++++++-
tools/testing/vma/include/dup.h | 11 ++-
6 files changed, 224 insertions(+), 14 deletions(-)
--- a/include/linux/mm.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/include/linux/mm.h
@@ -4654,10 +4654,55 @@ static inline void mmap_action_map_kerne
vma_desc_pages(desc));
}
+static inline
+void mmap_action_map_discontig_kernel_pages(struct vm_area_desc *desc,
+ void *init_private, const struct discontig_kernel_page_ops *ops)
+{
+ struct mmap_action *action = &desc->action;
+
+ action->type = MMAP_DISCONTIG_KERNEL_PAGES;
+ action->map_kernel_discontig.init_private = init_private;
+ action->map_kernel_discontig.ops = ops;
+}
+
int mmap_action_prepare(struct vm_area_desc *desc);
int mmap_action_complete(struct vm_area_struct *vma,
struct mmap_action *action, bool is_compat);
+static inline void
+discontig_kernel_map_abort(struct discontig_kernel_page_state *state)
+{
+ state->action = DISCONTIG_KERNEL_PAGE_ABORT;
+}
+
+static inline void
+discontig_kernel_map_page(struct discontig_kernel_page_state *state,
+ struct page *page)
+{
+ struct folio *folio = page_folio(page);
+
+ if (folio_test_large(folio)) {
+ VM_WARN_ON_ONCE(page != folio_page(folio, 0));
+ state->action = DISCONTIG_KERNEL_PAGE_MAP_COMPOUND_PAGE;
+ state->__folio = folio;
+ state->__nr_pages = min(state->nr_pages_remain,
+ folio_nr_pages(folio));
+ } else {
+ state->action = DISCONTIG_KERNEL_PAGE_MAP_PAGE;
+ state->__page = page;
+ state->__nr_pages = 1;
+ }
+}
+
+static inline void
+discontig_kernel_map_page_range(struct discontig_kernel_page_state *state,
+ struct page **page_arr, unsigned long nr_pages)
+{
+ state->action = DISCONTIG_KERNEL_PAGE_MAP_PAGE_RANGE;
+ state->__page_arr = page_arr;
+ state->__nr_pages = min(nr_pages, state->nr_pages_remain);
+}
+
/* Look up the first VMA which exactly match the interval vm_start ... vm_end */
static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
unsigned long vm_start, unsigned long vm_end)
--- a/include/linux/mm_types.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/include/linux/mm_types.h
@@ -818,8 +818,44 @@ enum mmap_action_type {
MMAP_NOTHING,
MMAP_REMAP_PFN,
MMAP_IO_REMAP_PFN,
- MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
- MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
+ MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_DISCONTIG_KERNEL_PAGES, /* Map kernel discontig page range. */
+};
+
+enum discontig_kernel_page_action {
+ DISCONTIG_KERNEL_PAGE_ABORT,
+ DISCONTIG_KERNEL_PAGE_MAP_PAGE,
+ DISCONTIG_KERNEL_PAGE_MAP_COMPOUND_PAGE,
+ DISCONTIG_KERNEL_PAGE_MAP_PAGE_RANGE,
+};
+
+struct discontig_kernel_page_state {
+ /* Map state. */
+ const unsigned long start; /* Start address of VMA. */
+ const unsigned long end; /* End address of VMA. */
+ unsigned long addr; /* The current address to be mapped. */
+ pgoff_t pgoff; /* The current pgoff to be mapped. */
+ unsigned long nr_pages_mapped; /* The number of pages mapped. */
+ unsigned long nr_pages_remain; /* The number of pages remaining. */
+
+ /* User-defined state. */
+ void *vm_private_data; /* VMA private data. */
+ void *private; /* Mapping private data. */
+
+ /* Users should not touch these, use discontig_kernel_map_*() helpers. */
+ enum discontig_kernel_page_action action;
+ union {
+ struct page *__page;
+ struct folio *__folio;
+ struct page **__page_arr;
+ };
+ unsigned long __nr_pages;
+};
+
+struct discontig_kernel_page_ops {
+ int (*init)(void *vm_private_data, void **private);
+ int (*get)(struct discontig_kernel_page_state *state);
};
/*
@@ -844,6 +880,10 @@ struct mmap_action {
unsigned long nr_pages;
pgoff_t pgoff;
} map_kernel;
+ struct {
+ void *init_private;
+ const struct discontig_kernel_page_ops *ops;
+ } map_kernel_discontig;
};
enum mmap_action_type type;
--- a/mm/internal.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/internal.h
@@ -1517,6 +1517,9 @@ int simple_ioremap_prepare(struct vm_are
int map_kernel_pages_prepare(struct vm_area_desc *desc);
int map_kernel_pages_complete(struct vm_area_struct *vma,
struct mmap_action *action);
+int map_discontig_kernel_pages_prepare(struct vm_area_desc *desc);
+int map_discontig_kernel_pages_complete(struct vm_area_struct *vma,
+ struct mmap_action *action);
static inline int io_remap_pfn_range_prepare(struct vm_area_desc *desc)
{
--- a/mm/memory.c~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/memory.c
@@ -2609,17 +2609,23 @@ int vm_insert_pages(struct vm_area_struc
}
EXPORT_SYMBOL(vm_insert_pages);
+static void __map_kernel_pages_prepare(struct vm_area_desc *desc)
+{
+ if (vma_desc_test(desc, VMA_MIXEDMAP_BIT))
+ return;
+
+ VM_WARN_ON_ONCE(mmap_read_trylock(desc->mm));
+ VM_WARN_ON_ONCE(vma_desc_test(desc, VMA_PFNMAP_BIT));
+ vma_desc_set_flags(desc, VMA_MIXEDMAP_BIT);
+}
+
int map_kernel_pages_prepare(struct vm_area_desc *desc)
{
const struct mmap_action *action = &desc->action;
const unsigned long addr = action->map_kernel.start;
unsigned long nr_pages, end;
- if (!vma_desc_test(desc, VMA_MIXEDMAP_BIT)) {
- VM_WARN_ON_ONCE(mmap_read_trylock(desc->mm));
- VM_WARN_ON_ONCE(vma_desc_test(desc, VMA_PFNMAP_BIT));
- vma_desc_set_flags(desc, VMA_MIXEDMAP_BIT);
- }
+ __map_kernel_pages_prepare(desc);
nr_pages = action->map_kernel.nr_pages;
end = addr + PAGE_SIZE * nr_pages;
@@ -2640,6 +2646,98 @@ int map_kernel_pages_complete(struct vm_
&nr_pages, vma->vm_page_prot);
}
+int map_discontig_kernel_pages_prepare(struct vm_area_desc *desc)
+{
+ const struct mmap_action *action = &desc->action;
+ const struct discontig_kernel_page_ops *ops =
+ action->map_kernel_discontig.ops;
+
+ /* At minimum need to be able to get pages. */
+ if (WARN_ON_ONCE(!ops || !ops->get))
+ return -EINVAL;
+
+ __map_kernel_pages_prepare(desc);
+ return 0;
+}
+
+static int apply_discontig_action(struct vm_area_struct *vma,
+ struct discontig_kernel_page_state *state)
+{
+ unsigned long nr_pages = state->__nr_pages;
+ unsigned long addr = state->addr;
+ unsigned long i;
+
+ if (state->action == DISCONTIG_KERNEL_PAGE_MAP_PAGE)
+ return insert_page(vma, addr, state->__page,
+ vma->vm_page_prot, /*mkwrite=*/false);
+ if (state->action == DISCONTIG_KERNEL_PAGE_MAP_PAGE_RANGE)
+ return insert_pages(vma, addr, state->__page_arr,
+ &nr_pages, vma->vm_page_prot);
+
+ /* Compound folio - have to iterate through each page. */
+ for (i = 0; i < nr_pages; i++, addr += PAGE_SIZE) {
+ struct page *page = folio_page(state->__folio, i);
+ int err;
+
+ err = insert_page(vma, addr, page, vma->vm_page_prot,
+ /*mkwrite=*/false);
+ if (err)
+ return err;
+ }
+ return 0;
+}
+
+int map_discontig_kernel_pages_complete(struct vm_area_struct *vma,
+ struct mmap_action *action)
+{
+ const struct discontig_kernel_page_ops *ops =
+ action->map_kernel_discontig.ops;
+ struct discontig_kernel_page_state state = {
+ .start = vma->vm_start,
+ .end = vma->vm_end,
+ .addr = vma->vm_start,
+ .pgoff = vma->vm_pgoff,
+ .nr_pages_mapped = 0,
+ .nr_pages_remain = vma_pages(vma),
+ .vm_private_data = vma->vm_private_data,
+ .private = action->map_kernel_discontig.init_private,
+ };
+ int err = 0;
+
+ if (ops->init)
+ err = ops->init(vma->vm_private_data, &state.private);
+ if (err)
+ return err;
+
+ do {
+ unsigned long end, pgoff_end;
+ unsigned long nr_pages;
+
+ /* Default to abort. */
+ state.action = DISCONTIG_KERNEL_PAGE_ABORT;
+ err = ops->get(&state);
+ if (err || state.action == DISCONTIG_KERNEL_PAGE_ABORT)
+ return err;
+ nr_pages = state.__nr_pages;
+
+ if (!nr_pages || nr_pages > state.nr_pages_remain)
+ return -EINVAL;
+ end = state.addr + PAGE_SIZE * nr_pages;
+ pgoff_end = state.pgoff + nr_pages;
+
+ err = apply_discontig_action(vma, &state);
+ if (err)
+ return err;
+
+ state.addr = end;
+ state.pgoff = pgoff_end;
+ state.nr_pages_mapped += nr_pages;
+ state.nr_pages_remain -= nr_pages;
+ } while (state.addr < vma->vm_end);
+
+ return 0;
+}
+
/**
* vm_insert_page - insert single page into user vma
* @vma: user vma to map to
--- a/mm/util.c~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/util.c
@@ -1401,6 +1401,15 @@ static int call_vma_mapped(struct vm_are
return 0;
}
+/* An mmap action failed under the compatibility layer - unmap and close. */
+static void compat_mmap_action_abort(struct vm_area_struct *vma)
+{
+#ifdef CONFIG_MMU
+ zap_vma_range(vma, vma->vm_start, vma_pages(vma) << PAGE_SHIFT);
+#endif
+ vma_close(vma);
+}
+
static int mmap_action_finish(struct vm_area_struct *vma,
struct mmap_action *action, int err,
bool is_compat)
@@ -1412,12 +1421,13 @@ static int mmap_action_finish(struct vm_
/* do_munmap() might take rmap lock, so release if held. */
maybe_rmap_unlock_action(vma, action);
- /*
- * If this is invoked from the compatibility layer, post-mmap() hook
- * logic will handle cleanup for us.
- */
- if (!err || is_compat)
+ if (!err)
+ return 0;
+
+ if (is_compat) {
+ compat_mmap_action_abort(vma);
return err;
+ }
/*
* If an error occurs, unmap the VMA altogether and return an error. We
@@ -1469,6 +1479,8 @@ int mmap_action_prepare(struct vm_area_d
return simple_ioremap_prepare(desc);
case MMAP_KERNEL_PAGES:
return map_kernel_pages_prepare(desc);
+ case MMAP_DISCONTIG_KERNEL_PAGES:
+ return map_discontig_kernel_pages_prepare(desc);
}
WARN_ON_ONCE(1);
@@ -1501,6 +1513,9 @@ int mmap_action_complete(struct vm_area_
case MMAP_KERNEL_PAGES:
err = map_kernel_pages_complete(vma, action);
break;
+ case MMAP_DISCONTIG_KERNEL_PAGES:
+ err = map_discontig_kernel_pages_complete(vma, action);
+ break;
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
/* Should have been delegated. */
@@ -1522,6 +1537,7 @@ int mmap_action_prepare(struct vm_area_d
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
case MMAP_KERNEL_PAGES:
+ case MMAP_DISCONTIG_KERNEL_PAGES:
WARN_ON_ONCE(1); /* nommu cannot handle these. */
break;
}
@@ -1543,6 +1559,7 @@ int mmap_action_complete(struct vm_area_
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
case MMAP_KERNEL_PAGES:
+ case MMAP_DISCONTIG_KERNEL_PAGES:
WARN_ON_ONCE(1); /* nommu cannot handle this. */
err = -EINVAL;
--- a/tools/testing/vma/include/dup.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/tools/testing/vma/include/dup.h
@@ -457,14 +457,17 @@ enum mmap_action_type {
MMAP_NOTHING,
MMAP_REMAP_PFN,
MMAP_IO_REMAP_PFN,
- MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
- MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
+ MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_DISCONTIG_KERNEL_PAGES, /* Map kernel discontig page range. */
};
/*
* Describes an action an mmap_prepare hook can instruct to be taken to complete
* the mapping of a VMA. Specified in vm_area_desc.
*/
+struct discontig_kernel_page_ops;
+
struct mmap_action {
union {
struct {
@@ -483,6 +486,10 @@ struct mmap_action {
unsigned long nr_pages;
pgoff_t pgoff;
} map_kernel;
+ struct {
+ void *init_private;
+ const struct discontig_kernel_page_ops *ops;
+ } map_kernel_discontig;
};
enum mmap_action_type type;
_
Patches currently in -mm which might be from ljs@kernel.org are
mm-mremap-fix-locked_vm-leak-from-mremap_dontunmap-self-merge.patch
mm-mremap-fix-locked_vm-leak-by-splitting-vma-for-mremap_dontunmap.patch
drivers-char-mem-mmap-readonly-map_shared-dev-zero-correctly.patch
mm-vmpressure-remove-window-size-todo.patch
tools-testing-selftests-mm-add-missing-gitignore-entries.patch
mm-move-drivers-char-memc-to-mm-char-memc.patch
mm-implement-file_is_dev_zero-to-uniquely-identify-dev-zero.patch
mm-vma-only-permit-map_private-dev-zero-to-be-mapped-anonymous.patch
mm-vma-make-map_private-mapped-dev-zero-mappings-truly-anonymous.patch
tools-testing-vma-add-test-to-assert-map_private-dev-zero-is-anon.patch
tools-testing-selftests-mm-add-map_private-dev-zero-merge-tests.patch
mm-madvise-swap-in-cowd-map_private-file-mappings-on-madv_willneed.patch
mm-khugepaged-deposit-a-newly-allocated-page-table-on-collapse.patch
mm-enable-mmu_gather_rcu_table_free-for-most-2-level-architectures.patch
mm-enable-mmu_gather_rcu_table_free-for-mmu-riscv.patch
mm-enable-mmu_gather_rcu_table_free-for-mmu-arm.patch
mm-enable-mmu_gather_rcu_table_free-for-arc-microblaze-xtensa.patch
mm-enable-mmu_gather_rcu_table_free-for-sparc64.patch
mm-enable-mmu_gather_rcu_table_free-for-m68k-coldfire.patch
mm-enable-mmu_gather_rcu_table_free-for-sh-x2.patch
mm-enable-mmu_gather_rcu_table_free-for-m68k-motorola.patch
mm-enable-mmu_gather_rcu_table_free-for-sparc32.patch
mm-userland-pgtable-freeing-is-rcu-safe-now-remove-leftover-bits.patch
mm-change-the-contract-for-free_pgtables-update-docs.patch
mm-vma-fix-mmap_prepare-file-handling-remove-file_doesnt_need_get.patch
mm-vma-introduce-and-use-vma_can_merge.patch
mm-consistently-validate-vma-state-after-mmap-hooks.patch
mm-vma-ensure-mmap_prepare-doesnt-set-actions-on-a-mergeable-vma.patch
mm-make-map_kernel_pages_-internal-and-unexported.patch
mm-vma-tidy-up-map-kernel-pages-enum-values.patch
mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
docs-filesystems-update-mmap_prepare-docs-for-discontig-kernel-pgs.patch
drivers-usb-mon-update-to-use-mmap_prepare-map-kernel-pages.patch
infiniband-update-hfi1-to-use-remap_vmalloc_range.patch
selinux-reject-writable-opens-of-policy-file-drop-mmap-shared-write-check.patch
alsa-pcm-use-vm_insert_page-to-map-pcm-status-page.patch
bpf-arena-mark-arena_map_mmap-mappings-vm_mixedmap.patch
mm-vma-add-vma_is_mm_managed-predicates.patch
mm-vma-only-allow-mmap-to-clear-vma_maywrite_bit-if-not-mm-managed.patch
mm-vma-add-and-use-vma__is_fixed_mapping.patch
scsi-sg-convert-mmap-hook-to-mmap_prepare-and-rework.patch
fbdev-defio-assert-fbinfo_virtfb-drop-vm_io-add-vm_mixedmap.patch
hsi-cmt_speech-convert-mmap-hook-to-mmap_prepare-refactor.patch
mm-gup-error-out-early-on-vma_mayread_bit-vmas.patch
uprobes-remove-vm_io-set-vm_mixedmap-for-mapped-kernel-pages.patch
mm-mlock-clear-vma_locked_mask-over-mmap-callback.patch
mm-mlock-eliminate-weird-vma_io_bit-abuse-and-simplify.patch
mm-vma-enforce-that-mm-managed-mappings-may-not-set-vma_io_bit.patch
mm-remove-vma_io_bit-check-in-vma_is_mm_managed.patch
mm-remove-hugetlb_inlineh.patch
mm-rename-is_vm_hugetlb_page-to-vma_is_hugetlb.patch
mm-drop-some-redundant-checks-around-hugetlb-vmas.patch
mm-madvise-update-is_valid_guard_vma-to-use-vma_can_merge.patch
mm-vma-introduce-vma_is_mm_backed.patch
mm-uffd-use-predicates-for-userfaultfd-checks.patch
mm-madvise-use-predicates-for-madvise-madv_dofork.patch
mm-eliminate-vma_special_flags-usage-when-hugetlb-explicitly-tested.patch
mm-eliminate-vma_special_flags-check-in-lru_gen_look_around.patch
mm-avoid-use-of-vma_special_flags-in-migrate_vma_setup.patch
mm-eliminate-vm_special-vma_special_flags.patch
fuse-dax-do-not-set-vm_mixedmap.patch
mm-huge_memory-remove-vma_is_special_huge.patch
mm-vma-const-ify-vma_assert_stabilised-and-associated-functions.patch
mm-implement-and-use-vma_has_anon_rmap-silence-kcsan.patch
mm-update-comments-to-refer-to-anon-rmap-rather-than-anon_vma.patch
mm-vma-dont-remove-vma-from-rmap-if-pgoff-unchanged.patch
^ permalink raw reply [flat|nested] 5+ messages in thread
* + mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch added to mm-unstable branch
@ 2026-10-03 23:59 Andrew Morton
0 siblings, 0 replies; 5+ messages in thread
From: Andrew Morton @ 2026-10-03 23:59 UTC (permalink / raw)
To: mm-commits, ljs, akpm
The patch titled
Subject: mm: add mmap action for discontiguous kernel page mapping
has been added to the -mm mm-unstable branch. Its filename is
mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
This patch will later appear in the mm-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days
------------------------------------------------------
From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Subject: mm: add mmap action for discontiguous kernel page mapping
Date: Sat, 03 Oct 2026 17:32:38 +0100
The existing kernel page mapping mmap actions allow for partial and full
mapping of an array of struct page pointers.
However some drivers require the mapping of discontiguous ranges. Permit
this by providing discontig_kernel_page_ops which allows a driver to
specify how the operation should begin and how batches of pages should be
retrieved.
It uses the minimum exposed interface to do so, providing address, page
offset and both vm_private_data state and a local private state object.
ops->init can establish state for the operation, and ops->get outputs the
pages to map and their count. Should an error arise the core unmaps the
VMA, invoking vm_ops->close, which is therefore where any state established
by ops->init is released.
Also update the compatibility layer to do this too via
compat_mmap_action_abort().
Batches may not exceed the VMA, but may map less than its full range in
case the driver wishes to allow the user to map an area larger than the
available data.
To use it, users invoke mmap_action_map_discontig_kernel_pages() with
initial local private state and a set of operations.
Users can then use one of the provided helper functions to perform an
action:
* discontig_kernel_map_abort() - Abort and leave the mapping as it has
been accumulated so far.
* discontig_kernel_map_page() - Map a single page, or a compound page given
its head page.
* discontig_kernel_map_page_range() - Maps a struct page ** array of a
specified count, mapping only those pages which fit in the VMA.
The userland VMA tests are updated accordingly.
Link: https://lore.kernel.org/20261003-b4-mmap-prepare-vma-flag-sanify-v4-7-a1f052500fd7@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Zi Yan <ziy@nvidia.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: David Hildenbrand <david@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: Eduard Zingerman <eddyz87@gmail.com>
Cc: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Nico Pache <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Doug Gilbert <dgilbert@interlog.com>
Cc: James Bottomley <james.bottomley@hansenpartnership.com>
Cc: Martin K. Petersen <mkp@kernel.org>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Helge Deller <deller@gmx.de>
Cc: Sebastian Reichel <sre@kernel.org>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Harry Yoo <harry@kernel.org>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@gmail.com>
Cc: Will Deacon <will@kernel.org>
Cc: Aneesh Kumar K.V <aneesh.kumar@kernel.org>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Oliver Upton <oupton@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Anup Patel <anup@brainfault.org>
Cc: Paul Walmsley <pjw@kernel.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: Janosch Frank <frankja@linux.ibm.com>
Cc: Claudio Imbrenda <imbrenda@linux.ibm.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Andreas Larsson <andreas@gaisler.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Chris Li <chrisl@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Youngjun Park <youngjun.park@lge.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Xu Xin <xu.xin@linux.dev>
---
include/linux/mm.h | 45 ++++++++++++
include/linux/mm_types.h | 44 +++++++++++-
mm/internal.h | 3
mm/memory.c | 108 ++++++++++++++++++++++++++++--
mm/util.c | 27 ++++++-
tools/testing/vma/include/dup.h | 11 ++-
6 files changed, 224 insertions(+), 14 deletions(-)
--- a/include/linux/mm.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/include/linux/mm.h
@@ -4654,10 +4654,55 @@ static inline void mmap_action_map_kerne
vma_desc_pages(desc));
}
+static inline
+void mmap_action_map_discontig_kernel_pages(struct vm_area_desc *desc,
+ void *init_private, const struct discontig_kernel_page_ops *ops)
+{
+ struct mmap_action *action = &desc->action;
+
+ action->type = MMAP_DISCONTIG_KERNEL_PAGES;
+ action->map_kernel_discontig.init_private = init_private;
+ action->map_kernel_discontig.ops = ops;
+}
+
int mmap_action_prepare(struct vm_area_desc *desc);
int mmap_action_complete(struct vm_area_struct *vma,
struct mmap_action *action, bool is_compat);
+static inline void
+discontig_kernel_map_abort(struct discontig_kernel_page_state *state)
+{
+ state->action = DISCONTIG_KERNEL_PAGE_ABORT;
+}
+
+static inline void
+discontig_kernel_map_page(struct discontig_kernel_page_state *state,
+ struct page *page)
+{
+ struct folio *folio = page_folio(page);
+
+ if (folio_test_large(folio)) {
+ VM_WARN_ON_ONCE(page != folio_page(folio, 0));
+ state->action = DISCONTIG_KERNEL_PAGE_MAP_COMPOUND_PAGE;
+ state->__folio = folio;
+ state->__nr_pages = min(state->nr_pages_remain,
+ folio_nr_pages(folio));
+ } else {
+ state->action = DISCONTIG_KERNEL_PAGE_MAP_PAGE;
+ state->__page = page;
+ state->__nr_pages = 1;
+ }
+}
+
+static inline void
+discontig_kernel_map_page_range(struct discontig_kernel_page_state *state,
+ struct page **page_arr, unsigned long nr_pages)
+{
+ state->action = DISCONTIG_KERNEL_PAGE_MAP_PAGE_RANGE;
+ state->__page_arr = page_arr;
+ state->__nr_pages = min(nr_pages, state->nr_pages_remain);
+}
+
/* Look up the first VMA which exactly match the interval vm_start ... vm_end */
static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
unsigned long vm_start, unsigned long vm_end)
--- a/include/linux/mm_types.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/include/linux/mm_types.h
@@ -818,8 +818,44 @@ enum mmap_action_type {
MMAP_NOTHING,
MMAP_REMAP_PFN,
MMAP_IO_REMAP_PFN,
- MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
- MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
+ MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_DISCONTIG_KERNEL_PAGES, /* Map kernel discontig page range. */
+};
+
+enum discontig_kernel_page_action {
+ DISCONTIG_KERNEL_PAGE_ABORT,
+ DISCONTIG_KERNEL_PAGE_MAP_PAGE,
+ DISCONTIG_KERNEL_PAGE_MAP_COMPOUND_PAGE,
+ DISCONTIG_KERNEL_PAGE_MAP_PAGE_RANGE,
+};
+
+struct discontig_kernel_page_state {
+ /* Map state. */
+ const unsigned long start; /* Start address of VMA. */
+ const unsigned long end; /* End address of VMA. */
+ unsigned long addr; /* The current address to be mapped. */
+ pgoff_t pgoff; /* The current pgoff to be mapped. */
+ unsigned long nr_pages_mapped; /* The number of pages mapped. */
+ unsigned long nr_pages_remain; /* The number of pages remaining. */
+
+ /* User-defined state. */
+ void *vm_private_data; /* VMA private data. */
+ void *private; /* Mapping private data. */
+
+ /* Users should not touch these, use discontig_kernel_map_*() helpers. */
+ enum discontig_kernel_page_action action;
+ union {
+ struct page *__page;
+ struct folio *__folio;
+ struct page **__page_arr;
+ };
+ unsigned long __nr_pages;
+};
+
+struct discontig_kernel_page_ops {
+ int (*init)(void *vm_private_data, void **private);
+ int (*get)(struct discontig_kernel_page_state *state);
};
/*
@@ -844,6 +880,10 @@ struct mmap_action {
unsigned long nr_pages;
pgoff_t pgoff;
} map_kernel;
+ struct {
+ void *init_private;
+ const struct discontig_kernel_page_ops *ops;
+ } map_kernel_discontig;
};
enum mmap_action_type type;
--- a/mm/internal.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/internal.h
@@ -1517,6 +1517,9 @@ int simple_ioremap_prepare(struct vm_are
int map_kernel_pages_prepare(struct vm_area_desc *desc);
int map_kernel_pages_complete(struct vm_area_struct *vma,
struct mmap_action *action);
+int map_discontig_kernel_pages_prepare(struct vm_area_desc *desc);
+int map_discontig_kernel_pages_complete(struct vm_area_struct *vma,
+ struct mmap_action *action);
static inline int io_remap_pfn_range_prepare(struct vm_area_desc *desc)
{
--- a/mm/memory.c~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/memory.c
@@ -2609,17 +2609,23 @@ int vm_insert_pages(struct vm_area_struc
}
EXPORT_SYMBOL(vm_insert_pages);
+static void __map_kernel_pages_prepare(struct vm_area_desc *desc)
+{
+ if (vma_desc_test(desc, VMA_MIXEDMAP_BIT))
+ return;
+
+ VM_WARN_ON_ONCE(mmap_read_trylock(desc->mm));
+ VM_WARN_ON_ONCE(vma_desc_test(desc, VMA_PFNMAP_BIT));
+ vma_desc_set_flags(desc, VMA_MIXEDMAP_BIT);
+}
+
int map_kernel_pages_prepare(struct vm_area_desc *desc)
{
const struct mmap_action *action = &desc->action;
const unsigned long addr = action->map_kernel.start;
unsigned long nr_pages, end;
- if (!vma_desc_test(desc, VMA_MIXEDMAP_BIT)) {
- VM_WARN_ON_ONCE(mmap_read_trylock(desc->mm));
- VM_WARN_ON_ONCE(vma_desc_test(desc, VMA_PFNMAP_BIT));
- vma_desc_set_flags(desc, VMA_MIXEDMAP_BIT);
- }
+ __map_kernel_pages_prepare(desc);
nr_pages = action->map_kernel.nr_pages;
end = addr + PAGE_SIZE * nr_pages;
@@ -2640,6 +2646,98 @@ int map_kernel_pages_complete(struct vm_
&nr_pages, vma->vm_page_prot);
}
+int map_discontig_kernel_pages_prepare(struct vm_area_desc *desc)
+{
+ const struct mmap_action *action = &desc->action;
+ const struct discontig_kernel_page_ops *ops =
+ action->map_kernel_discontig.ops;
+
+ /* At minimum need to be able to get pages. */
+ if (WARN_ON_ONCE(!ops || !ops->get))
+ return -EINVAL;
+
+ __map_kernel_pages_prepare(desc);
+ return 0;
+}
+
+static int apply_discontig_action(struct vm_area_struct *vma,
+ struct discontig_kernel_page_state *state)
+{
+ unsigned long nr_pages = state->__nr_pages;
+ unsigned long addr = state->addr;
+ unsigned long i;
+
+ if (state->action == DISCONTIG_KERNEL_PAGE_MAP_PAGE)
+ return insert_page(vma, addr, state->__page,
+ vma->vm_page_prot, /*mkwrite=*/false);
+ if (state->action == DISCONTIG_KERNEL_PAGE_MAP_PAGE_RANGE)
+ return insert_pages(vma, addr, state->__page_arr,
+ &nr_pages, vma->vm_page_prot);
+
+ /* Compound folio - have to iterate through each page. */
+ for (i = 0; i < nr_pages; i++, addr += PAGE_SIZE) {
+ struct page *page = folio_page(state->__folio, i);
+ int err;
+
+ err = insert_page(vma, addr, page, vma->vm_page_prot,
+ /*mkwrite=*/false);
+ if (err)
+ return err;
+ }
+ return 0;
+}
+
+int map_discontig_kernel_pages_complete(struct vm_area_struct *vma,
+ struct mmap_action *action)
+{
+ const struct discontig_kernel_page_ops *ops =
+ action->map_kernel_discontig.ops;
+ struct discontig_kernel_page_state state = {
+ .start = vma->vm_start,
+ .end = vma->vm_end,
+ .addr = vma->vm_start,
+ .pgoff = vma->vm_pgoff,
+ .nr_pages_mapped = 0,
+ .nr_pages_remain = vma_pages(vma),
+ .vm_private_data = vma->vm_private_data,
+ .private = action->map_kernel_discontig.init_private,
+ };
+ int err = 0;
+
+ if (ops->init)
+ err = ops->init(vma->vm_private_data, &state.private);
+ if (err)
+ return err;
+
+ do {
+ unsigned long end, pgoff_end;
+ unsigned long nr_pages;
+
+ /* Default to abort. */
+ state.action = DISCONTIG_KERNEL_PAGE_ABORT;
+ err = ops->get(&state);
+ if (err || state.action == DISCONTIG_KERNEL_PAGE_ABORT)
+ return err;
+ nr_pages = state.__nr_pages;
+
+ if (!nr_pages || nr_pages > state.nr_pages_remain)
+ return -EINVAL;
+ end = state.addr + PAGE_SIZE * nr_pages;
+ pgoff_end = state.pgoff + nr_pages;
+
+ err = apply_discontig_action(vma, &state);
+ if (err)
+ return err;
+
+ state.addr = end;
+ state.pgoff = pgoff_end;
+ state.nr_pages_mapped += nr_pages;
+ state.nr_pages_remain -= nr_pages;
+ } while (state.addr < vma->vm_end);
+
+ return 0;
+}
+
/**
* vm_insert_page - insert single page into user vma
* @vma: user vma to map to
--- a/mm/util.c~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/util.c
@@ -1401,6 +1401,15 @@ static int call_vma_mapped(struct vm_are
return 0;
}
+/* An mmap action failed under the compatibility layer - unmap and close. */
+static void compat_mmap_action_abort(struct vm_area_struct *vma)
+{
+#ifdef CONFIG_MMU
+ zap_vma_range(vma, vma->vm_start, vma_pages(vma) << PAGE_SHIFT);
+#endif
+ vma_close(vma);
+}
+
static int mmap_action_finish(struct vm_area_struct *vma,
struct mmap_action *action, int err,
bool is_compat)
@@ -1412,12 +1421,13 @@ static int mmap_action_finish(struct vm_
/* do_munmap() might take rmap lock, so release if held. */
maybe_rmap_unlock_action(vma, action);
- /*
- * If this is invoked from the compatibility layer, post-mmap() hook
- * logic will handle cleanup for us.
- */
- if (!err || is_compat)
+ if (!err)
+ return 0;
+
+ if (is_compat) {
+ compat_mmap_action_abort(vma);
return err;
+ }
/*
* If an error occurs, unmap the VMA altogether and return an error. We
@@ -1469,6 +1479,8 @@ int mmap_action_prepare(struct vm_area_d
return simple_ioremap_prepare(desc);
case MMAP_KERNEL_PAGES:
return map_kernel_pages_prepare(desc);
+ case MMAP_DISCONTIG_KERNEL_PAGES:
+ return map_discontig_kernel_pages_prepare(desc);
}
WARN_ON_ONCE(1);
@@ -1501,6 +1513,9 @@ int mmap_action_complete(struct vm_area_
case MMAP_KERNEL_PAGES:
err = map_kernel_pages_complete(vma, action);
break;
+ case MMAP_DISCONTIG_KERNEL_PAGES:
+ err = map_discontig_kernel_pages_complete(vma, action);
+ break;
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
/* Should have been delegated. */
@@ -1522,6 +1537,7 @@ int mmap_action_prepare(struct vm_area_d
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
case MMAP_KERNEL_PAGES:
+ case MMAP_DISCONTIG_KERNEL_PAGES:
WARN_ON_ONCE(1); /* nommu cannot handle these. */
break;
}
@@ -1543,6 +1559,7 @@ int mmap_action_complete(struct vm_area_
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
case MMAP_KERNEL_PAGES:
+ case MMAP_DISCONTIG_KERNEL_PAGES:
WARN_ON_ONCE(1); /* nommu cannot handle this. */
err = -EINVAL;
--- a/tools/testing/vma/include/dup.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/tools/testing/vma/include/dup.h
@@ -457,14 +457,17 @@ enum mmap_action_type {
MMAP_NOTHING,
MMAP_REMAP_PFN,
MMAP_IO_REMAP_PFN,
- MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
- MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
+ MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_DISCONTIG_KERNEL_PAGES, /* Map kernel discontig page range. */
};
/*
* Describes an action an mmap_prepare hook can instruct to be taken to complete
* the mapping of a VMA. Specified in vm_area_desc.
*/
+struct discontig_kernel_page_ops;
+
struct mmap_action {
union {
struct {
@@ -483,6 +486,10 @@ struct mmap_action {
unsigned long nr_pages;
pgoff_t pgoff;
} map_kernel;
+ struct {
+ void *init_private;
+ const struct discontig_kernel_page_ops *ops;
+ } map_kernel_discontig;
};
enum mmap_action_type type;
_
Patches currently in -mm which might be from ljs@kernel.org are
mm-mremap-fix-locked_vm-leak-from-mremap_dontunmap-self-merge.patch
mm-mremap-fix-locked_vm-leak-by-splitting-vma-for-mremap_dontunmap.patch
drivers-char-mem-mmap-readonly-map_shared-dev-zero-correctly.patch
mm-vmpressure-remove-window-size-todo.patch
tools-testing-selftests-mm-add-missing-gitignore-entries.patch
mm-move-drivers-char-memc-to-mm-char-memc.patch
mm-implement-file_is_dev_zero-to-uniquely-identify-dev-zero.patch
mm-vma-only-permit-map_private-dev-zero-to-be-mapped-anonymous.patch
mm-vma-make-map_private-mapped-dev-zero-mappings-truly-anonymous.patch
tools-testing-vma-add-test-to-assert-map_private-dev-zero-is-anon.patch
tools-testing-selftests-mm-add-map_private-dev-zero-merge-tests.patch
mm-madvise-swap-in-cowd-map_private-file-mappings-on-madv_willneed.patch
mm-khugepaged-deposit-a-newly-allocated-page-table-on-collapse.patch
mm-enable-mmu_gather_rcu_table_free-for-most-2-level-architectures.patch
mm-enable-mmu_gather_rcu_table_free-for-mmu-riscv.patch
mm-enable-mmu_gather_rcu_table_free-for-mmu-arm.patch
mm-enable-mmu_gather_rcu_table_free-for-arc-microblaze-xtensa.patch
mm-enable-mmu_gather_rcu_table_free-for-sparc64.patch
mm-enable-mmu_gather_rcu_table_free-for-m68k-coldfire.patch
mm-enable-mmu_gather_rcu_table_free-for-sh-x2.patch
mm-enable-mmu_gather_rcu_table_free-for-m68k-motorola.patch
mm-enable-mmu_gather_rcu_table_free-for-sparc32.patch
mm-userland-pgtable-freeing-is-rcu-safe-now-remove-leftover-bits.patch
mm-change-the-contract-for-free_pgtables-update-docs.patch
mm-vma-fix-mmap_prepare-file-handling-remove-file_doesnt_need_get.patch
mm-vma-introduce-and-use-vma_can_merge.patch
mm-consistently-validate-vma-state-after-mmap-hooks.patch
mm-vma-ensure-mmap_prepare-doesnt-set-actions-on-a-mergeable-vma.patch
mm-make-map_kernel_pages_-internal-and-unexported.patch
mm-vma-tidy-up-map-kernel-pages-enum-values.patch
mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
docs-filesystems-update-mmap_prepare-docs-for-discontig-kernel-pgs.patch
drivers-usb-mon-update-to-use-mmap_prepare-map-kernel-pages.patch
infiniband-update-hfi1-to-use-remap_vmalloc_range.patch
selinux-reject-writable-opens-of-policy-file-drop-mmap-shared-write-check.patch
alsa-pcm-use-vm_insert_page-to-map-pcm-status-page.patch
bpf-arena-mark-arena_map_mmap-mappings-vm_mixedmap.patch
mm-vma-add-vma_is_mm_managed-predicates.patch
mm-vma-only-allow-mmap-to-clear-vma_maywrite_bit-if-not-mm-managed.patch
mm-vma-add-and-use-vma__is_fixed_mapping.patch
scsi-sg-convert-mmap-hook-to-mmap_prepare-and-rework.patch
fbdev-defio-assert-fbinfo_virtfb-drop-vm_io-add-vm_mixedmap.patch
hsi-cmt_speech-convert-mmap-hook-to-mmap_prepare-refactor.patch
mm-gup-error-out-early-on-vma_mayread_bit-vmas.patch
uprobes-remove-vm_io-set-vm_mixedmap-for-mapped-kernel-pages.patch
mm-mlock-clear-vma_locked_mask-over-mmap-callback.patch
mm-mlock-eliminate-weird-vma_io_bit-abuse-and-simplify.patch
mm-vma-enforce-that-mm-managed-mappings-may-not-set-vma_io_bit.patch
mm-remove-vma_io_bit-check-in-vma_is_mm_managed.patch
mm-remove-hugetlb_inlineh.patch
mm-rename-is_vm_hugetlb_page-to-vma_is_hugetlb.patch
mm-drop-some-redundant-checks-around-hugetlb-vmas.patch
mm-madvise-update-is_valid_guard_vma-to-use-vma_can_merge.patch
mm-vma-introduce-vma_is_mm_backed.patch
mm-uffd-use-predicates-for-userfaultfd-checks.patch
mm-madvise-use-predicates-for-madvise-madv_dofork.patch
mm-eliminate-vma_special_flags-usage-when-hugetlb-explicitly-tested.patch
mm-eliminate-vma_special_flags-check-in-lru_gen_look_around.patch
mm-avoid-use-of-vma_special_flags-in-migrate_vma_setup.patch
mm-eliminate-vm_special-vma_special_flags.patch
fuse-dax-do-not-set-vm_mixedmap.patch
mm-huge_memory-remove-vma_is_special_huge.patch
mm-vma-const-ify-vma_assert_stabilised-and-associated-functions.patch
mm-implement-and-use-vma_has_anon_rmap-silence-kcsan.patch
mm-update-comments-to-refer-to-anon-rmap-rather-than-anon_vma.patch
mm-vma-dont-remove-vma-from-rmap-if-pgoff-unchanged.patch
^ permalink raw reply [flat|nested] 5+ messages in thread
* + mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch added to mm-unstable branch
@ 2026-10-10 22:01 Andrew Morton
0 siblings, 0 replies; 5+ messages in thread
From: Andrew Morton @ 2026-10-10 22:01 UTC (permalink / raw)
To: mm-commits, ljs, akpm
The patch titled
Subject: mm: add mmap action for discontiguous kernel page mapping
has been added to the -mm mm-unstable branch. Its filename is
mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
This patch will later appear in the mm-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days
------------------------------------------------------
From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Subject: mm: add mmap action for discontiguous kernel page mapping
Date: Fri, 09 Oct 2026 19:04:01 +0100
The existing kernel page mapping mmap actions allow for partial and full
mapping of an array of struct page pointers.
However some drivers require the mapping of discontiguous ranges. Permit
this by providing discontig_kernel_page_ops which allows a driver to
specify how the operation should begin and how batches of pages should be
retrieved.
It uses the minimum exposed interface to do so, providing address, page
offset and both vm_private_data state and a local private state object.
ops->init can establish state for the operation, and ops->get outputs the
pages to map and their count. Should an error arise the core unmaps the
VMA, invoking vm_ops->close, which is therefore where any state established
by ops->init is released.
Also update the compatibility layer to do this too via
compat_mmap_action_abort().
Batches may not exceed the VMA, but may map less than its full range in
case the driver wishes to allow the user to map an area larger than the
available data.
To use it, users invoke mmap_action_map_discontig_kernel_pages() with
initial local private state and a set of operations.
Users can then use one of the provided helper functions to perform an
action:
* discontig_kernel_map_abort() - Abort and leave the mapping as it has
been accumulated so far.
* discontig_kernel_map_page() - Map a single page, or a compound page given
its head page.
* discontig_kernel_map_page_range() - Maps a struct page ** array of a
specified count, mapping only those pages which fit in the VMA.
While here, update vm_insert_page() and vm_insert_pages() to assert the
mmap write lock is held rather than the bizarre assert !mmap_read_trylock()
and use the new VMA API so all code paths are consistent.
Also convert a BUG_ON() to a VM_WARN_ON_ONCE() in vm_insert_page().
The userland VMA tests are updated accordingly.
Link: https://lore.kernel.org/20261009-b4-mmap-prepare-vma-flag-sanify-v5-7-923b70125b1e@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Zi Yan <ziy@nvidia.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: David Hildenbrand <david@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: Eduard Zingerman <eddyz87@gmail.com>
Cc: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Nico Pache <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Doug Gilbert <dgilbert@interlog.com>
Cc: James Bottomley <james.bottomley@hansenpartnership.com>
Cc: Martin K. Petersen <mkp@kernel.org>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Helge Deller <deller@gmx.de>
Cc: Sebastian Reichel <sre@kernel.org>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Harry Yoo <harry@kernel.org>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@gmail.com>
Cc: Will Deacon <will@kernel.org>
Cc: Aneesh Kumar K.V <aneesh.kumar@kernel.org>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Oliver Upton <oupton@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Anup Patel <anup@brainfault.org>
Cc: Paul Walmsley <pjw@kernel.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: Janosch Frank <frankja@linux.ibm.com>
Cc: Claudio Imbrenda <imbrenda@linux.ibm.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Andreas Larsson <andreas@gaisler.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Chris Li <chrisl@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Youngjun Park <youngjun.park@lge.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Xu Xin <xu.xin@linux.dev>
Cc: Ihor Solodrai <ihor.solodrai@linux.dev>
Cc: Bert Karwatzki <spasswolf@web.de>
---
include/linux/mm.h | 45 ++++++++++
include/linux/mm_types.h | 44 ++++++++++
mm/internal.h | 3
mm/memory.c | 126 ++++++++++++++++++++++++++----
mm/util.c | 27 +++++-
tools/testing/vma/include/dup.h | 11 ++
6 files changed, 234 insertions(+), 22 deletions(-)
--- a/include/linux/mm.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/include/linux/mm.h
@@ -4654,10 +4654,55 @@ static inline void mmap_action_map_kerne
vma_desc_pages(desc));
}
+static inline
+void mmap_action_map_discontig_kernel_pages(struct vm_area_desc *desc,
+ void *init_private, const struct discontig_kernel_page_ops *ops)
+{
+ struct mmap_action *action = &desc->action;
+
+ action->type = MMAP_DISCONTIG_KERNEL_PAGES;
+ action->map_kernel_discontig.init_private = init_private;
+ action->map_kernel_discontig.ops = ops;
+}
+
int mmap_action_prepare(struct vm_area_desc *desc);
int mmap_action_complete(struct vm_area_struct *vma,
struct mmap_action *action, bool is_compat);
+static inline void
+discontig_kernel_map_abort(struct discontig_kernel_page_state *state)
+{
+ state->action = DISCONTIG_KERNEL_PAGE_ABORT;
+}
+
+static inline void
+discontig_kernel_map_page(struct discontig_kernel_page_state *state,
+ struct page *page)
+{
+ struct folio *folio = page_folio(page);
+
+ if (folio_test_large(folio)) {
+ VM_WARN_ON_ONCE(page != folio_page(folio, 0));
+ state->action = DISCONTIG_KERNEL_PAGE_MAP_COMPOUND_PAGE;
+ state->__folio = folio;
+ state->__nr_pages = min(state->nr_pages_remain,
+ folio_nr_pages(folio));
+ } else {
+ state->action = DISCONTIG_KERNEL_PAGE_MAP_PAGE;
+ state->__page = page;
+ state->__nr_pages = 1;
+ }
+}
+
+static inline void
+discontig_kernel_map_page_range(struct discontig_kernel_page_state *state,
+ struct page **page_arr, unsigned long nr_pages)
+{
+ state->action = DISCONTIG_KERNEL_PAGE_MAP_PAGE_RANGE;
+ state->__page_arr = page_arr;
+ state->__nr_pages = min(nr_pages, state->nr_pages_remain);
+}
+
/* Look up the first VMA which exactly match the interval vm_start ... vm_end */
static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
unsigned long vm_start, unsigned long vm_end)
--- a/include/linux/mm_types.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/include/linux/mm_types.h
@@ -818,8 +818,44 @@ enum mmap_action_type {
MMAP_NOTHING,
MMAP_REMAP_PFN,
MMAP_IO_REMAP_PFN,
- MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
- MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
+ MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_DISCONTIG_KERNEL_PAGES, /* Map kernel discontig page range. */
+};
+
+enum discontig_kernel_page_action {
+ DISCONTIG_KERNEL_PAGE_ABORT,
+ DISCONTIG_KERNEL_PAGE_MAP_PAGE,
+ DISCONTIG_KERNEL_PAGE_MAP_COMPOUND_PAGE,
+ DISCONTIG_KERNEL_PAGE_MAP_PAGE_RANGE,
+};
+
+struct discontig_kernel_page_state {
+ /* Map state. */
+ const unsigned long start; /* Start address of VMA. */
+ const unsigned long end; /* End address of VMA. */
+ unsigned long addr; /* The current address to be mapped. */
+ pgoff_t pgoff; /* The current pgoff to be mapped. */
+ unsigned long nr_pages_mapped; /* The number of pages mapped. */
+ unsigned long nr_pages_remain; /* The number of pages remaining. */
+
+ /* User-defined state. */
+ void *vm_private_data; /* VMA private data. */
+ void *private; /* Mapping private data. */
+
+ /* Users should not touch these, use discontig_kernel_map_*() helpers. */
+ enum discontig_kernel_page_action action;
+ union {
+ struct page *__page;
+ struct folio *__folio;
+ struct page **__page_arr;
+ };
+ unsigned long __nr_pages;
+};
+
+struct discontig_kernel_page_ops {
+ int (*init)(void *vm_private_data, void **private);
+ int (*get)(struct discontig_kernel_page_state *state);
};
/*
@@ -844,6 +880,10 @@ struct mmap_action {
unsigned long nr_pages;
pgoff_t pgoff;
} map_kernel;
+ struct {
+ void *init_private;
+ const struct discontig_kernel_page_ops *ops;
+ } map_kernel_discontig;
};
enum mmap_action_type type;
--- a/mm/internal.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/internal.h
@@ -1517,6 +1517,9 @@ int simple_ioremap_prepare(struct vm_are
int map_kernel_pages_prepare(struct vm_area_desc *desc);
int map_kernel_pages_complete(struct vm_area_struct *vma,
struct mmap_action *action);
+int map_discontig_kernel_pages_prepare(struct vm_area_desc *desc);
+int map_discontig_kernel_pages_complete(struct vm_area_struct *vma,
+ struct mmap_action *action);
static inline int io_remap_pfn_range_prepare(struct vm_area_desc *desc)
{
--- a/mm/memory.c~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/memory.c
@@ -2610,27 +2610,34 @@ int vm_insert_pages(struct vm_area_struc
if (!range_in_vma(vma, addr, end))
return -EFAULT;
- if (!(vma->vm_flags & VM_MIXEDMAP)) {
- VM_WARN_ON_ONCE(mmap_read_trylock(vma->vm_mm));
- VM_WARN_ON_ONCE(vma->vm_flags & VM_PFNMAP);
- vm_flags_set(vma, VM_MIXEDMAP);
+ if (!vma_test(vma, VMA_MIXEDMAP_BIT)) {
+ mmap_assert_write_locked(vma->vm_mm);
+ VM_WARN_ON_ONCE(vma_test(vma, VMA_PFNMAP_BIT));
+ vma_start_write(vma);
+ vma_set_flags(vma, VMA_MIXEDMAP_BIT);
}
/* Defer page refcount checking till we're about to map that page. */
return insert_pages(vma, addr, pages, num, vma->vm_page_prot);
}
EXPORT_SYMBOL(vm_insert_pages);
+static void __map_kernel_pages_prepare(struct vm_area_desc *desc)
+{
+ if (vma_desc_test(desc, VMA_MIXEDMAP_BIT))
+ return;
+
+ mmap_assert_write_locked(desc->mm);
+ VM_WARN_ON_ONCE(vma_desc_test(desc, VMA_PFNMAP_BIT));
+ vma_desc_set_flags(desc, VMA_MIXEDMAP_BIT);
+}
+
int map_kernel_pages_prepare(struct vm_area_desc *desc)
{
const struct mmap_action *action = &desc->action;
const unsigned long addr = action->map_kernel.start;
unsigned long nr_pages, end;
- if (!vma_desc_test(desc, VMA_MIXEDMAP_BIT)) {
- VM_WARN_ON_ONCE(mmap_read_trylock(desc->mm));
- VM_WARN_ON_ONCE(vma_desc_test(desc, VMA_PFNMAP_BIT));
- vma_desc_set_flags(desc, VMA_MIXEDMAP_BIT);
- }
+ __map_kernel_pages_prepare(desc);
nr_pages = action->map_kernel.nr_pages;
end = addr + PAGE_SIZE * nr_pages;
@@ -2651,6 +2658,98 @@ int map_kernel_pages_complete(struct vm_
&nr_pages, vma->vm_page_prot);
}
+int map_discontig_kernel_pages_prepare(struct vm_area_desc *desc)
+{
+ const struct mmap_action *action = &desc->action;
+ const struct discontig_kernel_page_ops *ops =
+ action->map_kernel_discontig.ops;
+
+ /* At minimum need to be able to get pages. */
+ if (WARN_ON_ONCE(!ops || !ops->get))
+ return -EINVAL;
+
+ __map_kernel_pages_prepare(desc);
+ return 0;
+}
+
+static int apply_discontig_action(struct vm_area_struct *vma,
+ struct discontig_kernel_page_state *state)
+{
+ unsigned long nr_pages = state->__nr_pages;
+ unsigned long addr = state->addr;
+ unsigned long i;
+
+ if (state->action == DISCONTIG_KERNEL_PAGE_MAP_PAGE)
+ return insert_page(vma, addr, state->__page,
+ vma->vm_page_prot, /*mkwrite=*/false);
+ if (state->action == DISCONTIG_KERNEL_PAGE_MAP_PAGE_RANGE)
+ return insert_pages(vma, addr, state->__page_arr,
+ &nr_pages, vma->vm_page_prot);
+
+ /* Compound folio - have to iterate through each page. */
+ for (i = 0; i < nr_pages; i++, addr += PAGE_SIZE) {
+ struct page *page = folio_page(state->__folio, i);
+ int err;
+
+ err = insert_page(vma, addr, page, vma->vm_page_prot,
+ /*mkwrite=*/false);
+ if (err)
+ return err;
+ }
+ return 0;
+}
+
+int map_discontig_kernel_pages_complete(struct vm_area_struct *vma,
+ struct mmap_action *action)
+{
+ const struct discontig_kernel_page_ops *ops =
+ action->map_kernel_discontig.ops;
+ struct discontig_kernel_page_state state = {
+ .start = vma->vm_start,
+ .end = vma->vm_end,
+ .addr = vma->vm_start,
+ .pgoff = vma->vm_pgoff,
+ .nr_pages_mapped = 0,
+ .nr_pages_remain = vma_pages(vma),
+ .vm_private_data = vma->vm_private_data,
+ .private = action->map_kernel_discontig.init_private,
+ };
+ int err = 0;
+
+ if (ops->init)
+ err = ops->init(vma->vm_private_data, &state.private);
+ if (err)
+ return err;
+
+ do {
+ unsigned long end, pgoff_end;
+ unsigned long nr_pages;
+
+ /* Default to abort. */
+ state.action = DISCONTIG_KERNEL_PAGE_ABORT;
+ err = ops->get(&state);
+ if (err || state.action == DISCONTIG_KERNEL_PAGE_ABORT)
+ return err;
+ nr_pages = state.__nr_pages;
+
+ if (!nr_pages || nr_pages > state.nr_pages_remain)
+ return -EINVAL;
+ end = state.addr + PAGE_SIZE * nr_pages;
+ pgoff_end = state.pgoff + nr_pages;
+
+ err = apply_discontig_action(vma, &state);
+ if (err)
+ return err;
+
+ state.addr = end;
+ state.pgoff = pgoff_end;
+ state.nr_pages_mapped += nr_pages;
+ state.nr_pages_remain -= nr_pages;
+ } while (state.addr < vma->vm_end);
+
+ return 0;
+}
+
/**
* vm_insert_page - insert single page into user vma
* @vma: user vma to map to
@@ -2686,10 +2785,11 @@ int vm_insert_page(struct vm_area_struct
{
if (addr < vma->vm_start || addr >= vma->vm_end)
return -EFAULT;
- if (!(vma->vm_flags & VM_MIXEDMAP)) {
- BUG_ON(mmap_read_trylock(vma->vm_mm));
- BUG_ON(vma->vm_flags & VM_PFNMAP);
- vm_flags_set(vma, VM_MIXEDMAP);
+ if (!vma_test(vma, VMA_MIXEDMAP_BIT)) {
+ mmap_assert_write_locked(vma->vm_mm);
+ VM_WARN_ON_ONCE(vma_test(vma, VMA_PFNMAP_BIT));
+ vma_start_write(vma);
+ vma_set_flags(vma, VMA_MIXEDMAP_BIT);
}
return insert_page(vma, addr, page, vma->vm_page_prot, false);
}
--- a/mm/util.c~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/util.c
@@ -1401,6 +1401,15 @@ static int call_vma_mapped(struct vm_are
return 0;
}
+/* An mmap action failed under the compatibility layer - unmap and close. */
+static void compat_mmap_action_abort(struct vm_area_struct *vma)
+{
+#ifdef CONFIG_MMU
+ zap_vma_range(vma, vma->vm_start, vma_pages(vma) << PAGE_SHIFT);
+#endif
+ vma_close(vma);
+}
+
static int mmap_action_finish(struct vm_area_struct *vma,
struct mmap_action *action, int err,
bool is_compat)
@@ -1412,12 +1421,13 @@ static int mmap_action_finish(struct vm_
/* do_munmap() might take rmap lock, so release if held. */
maybe_rmap_unlock_action(vma, action);
- /*
- * If this is invoked from the compatibility layer, post-mmap() hook
- * logic will handle cleanup for us.
- */
- if (!err || is_compat)
+ if (!err)
+ return 0;
+
+ if (is_compat) {
+ compat_mmap_action_abort(vma);
return err;
+ }
/*
* If an error occurs, unmap the VMA altogether and return an error. We
@@ -1469,6 +1479,8 @@ int mmap_action_prepare(struct vm_area_d
return simple_ioremap_prepare(desc);
case MMAP_KERNEL_PAGES:
return map_kernel_pages_prepare(desc);
+ case MMAP_DISCONTIG_KERNEL_PAGES:
+ return map_discontig_kernel_pages_prepare(desc);
}
WARN_ON_ONCE(1);
@@ -1501,6 +1513,9 @@ int mmap_action_complete(struct vm_area_
case MMAP_KERNEL_PAGES:
err = map_kernel_pages_complete(vma, action);
break;
+ case MMAP_DISCONTIG_KERNEL_PAGES:
+ err = map_discontig_kernel_pages_complete(vma, action);
+ break;
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
/* Should have been delegated. */
@@ -1522,6 +1537,7 @@ int mmap_action_prepare(struct vm_area_d
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
case MMAP_KERNEL_PAGES:
+ case MMAP_DISCONTIG_KERNEL_PAGES:
WARN_ON_ONCE(1); /* nommu cannot handle these. */
break;
}
@@ -1543,6 +1559,7 @@ int mmap_action_complete(struct vm_area_
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
case MMAP_KERNEL_PAGES:
+ case MMAP_DISCONTIG_KERNEL_PAGES:
WARN_ON_ONCE(1); /* nommu cannot handle this. */
err = -EINVAL;
--- a/tools/testing/vma/include/dup.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/tools/testing/vma/include/dup.h
@@ -457,14 +457,17 @@ enum mmap_action_type {
MMAP_NOTHING,
MMAP_REMAP_PFN,
MMAP_IO_REMAP_PFN,
- MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
- MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
+ MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_DISCONTIG_KERNEL_PAGES, /* Map kernel discontig page range. */
};
/*
* Describes an action an mmap_prepare hook can instruct to be taken to complete
* the mapping of a VMA. Specified in vm_area_desc.
*/
+struct discontig_kernel_page_ops;
+
struct mmap_action {
union {
struct {
@@ -483,6 +486,10 @@ struct mmap_action {
unsigned long nr_pages;
pgoff_t pgoff;
} map_kernel;
+ struct {
+ void *init_private;
+ const struct discontig_kernel_page_ops *ops;
+ } map_kernel_discontig;
};
enum mmap_action_type type;
_
Patches currently in -mm which might be from ljs@kernel.org are
mm-vma-fix-mmap_prepare-file-handling-remove-file_doesnt_need_get.patch
mm-vma-introduce-and-use-vma_can_merge.patch
mm-consistently-validate-vma-state-after-mmap-hooks.patch
mm-vma-ensure-mmap_prepare-doesnt-set-actions-on-a-mergeable-vma.patch
mm-make-map_kernel_pages_-internal-and-unexported.patch
mm-vma-tidy-up-map-kernel-pages-enum-values.patch
mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
docs-filesystems-update-mmap_prepare-docs-for-discontig-kernel-pgs.patch
drivers-usb-mon-update-to-use-mmap_prepare-map-kernel-pages.patch
infiniband-update-hfi1-to-use-remap_vmalloc_range.patch
selinux-reject-writable-opens-of-policy-file-drop-mmap-shared-write-check.patch
alsa-pcm-use-vm_insert_page-to-map-pcm-status-page.patch
bpf-arena-mark-arena_map_mmap-mappings-vm_mixedmap.patch
mm-vma-add-vma_is_mm_managed-predicates.patch
mm-vma-only-allow-mmap-to-clear-vma_maywrite_bit-if-not-mm-managed.patch
mm-vma-add-and-use-vma__is_fixed_mapping.patch
scsi-sg-convert-mmap-hook-to-mmap_prepare-and-rework.patch
fbdev-defio-assert-fbinfo_virtfb-drop-vm_io-add-vm_mixedmap.patch
hsi-cmt_speech-convert-mmap-hook-to-mmap_prepare-refactor.patch
mm-gup-error-out-early-on-vma_mayread_bit-vmas.patch
uprobes-remove-vm_io-set-vm_mixedmap-for-mapped-kernel-pages.patch
mm-mlock-clear-vma_locked_mask-over-mmap-callback.patch
mm-mlock-eliminate-weird-vma_io_bit-abuse-and-simplify.patch
mm-vma-enforce-that-mm-managed-mappings-may-not-set-vma_io_bit.patch
mm-remove-vma_io_bit-check-in-vma_is_mm_managed.patch
mm-remove-hugetlb_inlineh.patch
mm-rename-is_vm_hugetlb_page-to-vma_is_hugetlb.patch
mm-drop-some-redundant-checks-around-hugetlb-vmas.patch
mm-madvise-update-is_valid_guard_vma-to-use-vma_can_merge.patch
mm-vma-introduce-vma_is_mm_backed.patch
mm-uffd-use-predicates-for-userfaultfd-checks.patch
mm-madvise-use-predicates-for-madvise-madv_dofork.patch
mm-eliminate-vma_special_flags-usage-when-hugetlb-explicitly-tested.patch
mm-eliminate-vma_special_flags-check-in-lru_gen_look_around.patch
mm-avoid-use-of-vma_special_flags-in-migrate_vma_setup.patch
mm-eliminate-vm_special-vma_special_flags.patch
fuse-dax-do-not-set-vm_mixedmap.patch
mm-huge_memory-remove-vma_is_special_huge.patch
mm-vma-const-ify-vma_assert_stabilised-and-associated-functions.patch
mm-implement-and-use-vma_has_anon_rmap-silence-kcsan.patch
mm-update-comments-to-refer-to-anon-rmap-rather-than-anon_vma.patch
mm-vma-dont-remove-vma-from-rmap-if-pgoff-unchanged.patch
^ permalink raw reply [flat|nested] 5+ messages in thread
* + mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch added to mm-unstable branch
@ 2026-10-13 18:51 Andrew Morton
0 siblings, 0 replies; 5+ messages in thread
From: Andrew Morton @ 2026-10-13 18:51 UTC (permalink / raw)
To: mm-commits, ljs, akpm
The patch titled
Subject: mm: add mmap action for discontiguous kernel page mapping
has been added to the -mm mm-unstable branch. Its filename is
mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
This patch will later appear in the mm-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days
------------------------------------------------------
From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Subject: mm: add mmap action for discontiguous kernel page mapping
Date: Tue, 13 Oct 2026 16:04:48 +0100
The existing kernel page mapping mmap actions allow for partial and full
mapping of an array of struct page pointers.
However some drivers require the mapping of discontiguous ranges. Permit
this by providing discontig_kernel_page_ops which allows a driver to
specify how the operation should begin and how batches of pages should be
retrieved.
It uses the minimum exposed interface to do so, providing address, page
offset and both vm_private_data state and a local private state object.
ops->init can establish state for the operation, and ops->get outputs the
pages to map and their count. Should an error arise the core unmaps the
VMA, invoking vm_ops->close, which is therefore where any state established
by ops->init is released.
Also update the compatibility layer to do this too via
compat_mmap_action_abort().
Batches may not exceed the VMA, but may map less than its full range in
case the driver wishes to allow the user to map an area larger than the
available data.
To use it, users invoke mmap_action_map_discontig_kernel_pages() with
initial local private state and a set of operations.
Users can then use one of the provided helper functions to perform an
action:
* discontig_kernel_map_abort() - Abort and leave the mapping as it has
been accumulated so far.
* discontig_kernel_map_page() - Map a single page, or a compound page given
its head page, as 1..N contiguous pages.
* discontig_kernel_map_pages() - Map a struct page ** array of a specified
count, mapping only those pages which fit in the VMA.
The userland VMA tests are updated accordingly.
Link: https://lore.kernel.org/20261013-b4-mmap-prepare-vma-flag-sanify-v6-8-1aa3c9b139f9@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Zi Yan <ziy@nvidia.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: Eduard Zingerman <eddyz87@gmail.com>
Cc: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Nico Pache <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Doug Gilbert <dgilbert@interlog.com>
Cc: James Bottomley <james.bottomley@hansenpartnership.com>
Cc: Martin K. Petersen <mkp@kernel.org>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Helge Deller <deller@gmx.de>
Cc: Sebastian Reichel <sre@kernel.org>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Harry Yoo <harry@kernel.org>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@gmail.com>
Cc: Will Deacon <will@kernel.org>
Cc: Aneesh Kumar K.V <aneesh.kumar@kernel.org>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Oliver Upton <oupton@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Anup Patel <anup@brainfault.org>
Cc: Paul Walmsley <pjw@kernel.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: Janosch Frank <frankja@linux.ibm.com>
Cc: Claudio Imbrenda <imbrenda@linux.ibm.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Andreas Larsson <andreas@gaisler.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Chris Li <chrisl@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Youngjun Park <youngjun.park@lge.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Xu Xin <xu.xin@linux.dev>
Cc: Ihor Solodrai <ihor.solodrai@linux.dev>
Cc: Bert Karwatzki <spasswolf@web.de>
---
include/linux/mm.h | 43 ++++++++++++
include/linux/mm_types.h | 42 +++++++++++
mm/internal.h | 3
mm/memory.c | 106 ++++++++++++++++++++++++++++--
mm/util.c | 27 ++++++-
tools/testing/vma/include/dup.h | 11 ++-
6 files changed, 218 insertions(+), 14 deletions(-)
--- a/include/linux/mm.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/include/linux/mm.h
@@ -4654,10 +4654,53 @@ static inline void mmap_action_map_kerne
vma_desc_pages(desc));
}
+static inline
+void mmap_action_map_discontig_kernel_pages(struct vm_area_desc *desc,
+ void *init_private, const struct discontig_kernel_page_ops *ops)
+{
+ struct mmap_action *action = &desc->action;
+
+ action->type = MMAP_DISCONTIG_KERNEL_PAGES;
+ action->map_kernel_discontig.init_private = init_private;
+ action->map_kernel_discontig.ops = ops;
+}
+
int mmap_action_prepare(struct vm_area_desc *desc);
int mmap_action_complete(struct vm_area_struct *vma,
struct mmap_action *action, bool is_compat);
+static inline void
+discontig_kernel_map_abort(struct discontig_kernel_page_state *state)
+{
+ state->action = DISCONTIG_KERNEL_PAGE_ABORT;
+}
+
+static inline void
+discontig_kernel_map_page(struct discontig_kernel_page_state *state,
+ struct page *page)
+{
+ struct folio *folio = page_folio(page);
+ unsigned long nr_pages = 1;
+
+ if (folio_test_large(folio)) {
+ VM_WARN_ON_ONCE(page != folio_page(folio, 0));
+ nr_pages = folio_nr_pages(folio);
+ }
+
+ state->action = DISCONTIG_KERNEL_PAGE_MAP_CONTIG_PAGES;
+ state->__page = page;
+ state->__nr_pages = min(nr_pages, state->nr_pages_remain);
+}
+
+static inline void
+discontig_kernel_map_pages(struct discontig_kernel_page_state *state,
+ struct page **page_arr, unsigned long nr_pages)
+{
+ state->action = DISCONTIG_KERNEL_PAGE_MAP_PAGES;
+ state->__page_arr = page_arr;
+ state->__nr_pages = min(nr_pages, state->nr_pages_remain);
+}
+
/* Look up the first VMA which exactly match the interval vm_start ... vm_end */
static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
unsigned long vm_start, unsigned long vm_end)
--- a/include/linux/mm_types.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/include/linux/mm_types.h
@@ -818,8 +818,42 @@ enum mmap_action_type {
MMAP_NOTHING,
MMAP_REMAP_PFN,
MMAP_IO_REMAP_PFN,
- MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
- MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
+ MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_DISCONTIG_KERNEL_PAGES, /* Map kernel discontig page range. */
+};
+
+enum discontig_kernel_page_action {
+ DISCONTIG_KERNEL_PAGE_ABORT,
+ DISCONTIG_KERNEL_PAGE_MAP_PAGES, /* Array of individual pages. */
+ DISCONTIG_KERNEL_PAGE_MAP_CONTIG_PAGES, /* 1..N contiguous pages. */
+};
+
+struct discontig_kernel_page_state {
+ /* Map state. */
+ const unsigned long start; /* Start address of VMA. */
+ const unsigned long end; /* End address of VMA. */
+ unsigned long addr; /* The current address to be mapped. */
+ pgoff_t pgoff; /* The current pgoff to be mapped. */
+ unsigned long nr_pages_mapped; /* The number of pages mapped. */
+ unsigned long nr_pages_remain; /* The number of pages remaining. */
+
+ /* User-defined state. */
+ void *vm_private_data; /* VMA private data. */
+ void *private; /* Mapping private data. */
+
+ /* Users should not touch these, use discontig_kernel_map_*() helpers. */
+ enum discontig_kernel_page_action action;
+ union {
+ struct page *__page;
+ struct page **__page_arr;
+ };
+ unsigned long __nr_pages;
+};
+
+struct discontig_kernel_page_ops {
+ int (*init)(void *vm_private_data, void **private);
+ int (*get)(struct discontig_kernel_page_state *state);
};
/*
@@ -844,6 +878,10 @@ struct mmap_action {
unsigned long nr_pages;
pgoff_t pgoff;
} map_kernel;
+ struct {
+ void *init_private;
+ const struct discontig_kernel_page_ops *ops;
+ } map_kernel_discontig;
};
enum mmap_action_type type;
--- a/mm/internal.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/internal.h
@@ -1517,6 +1517,9 @@ int simple_ioremap_prepare(struct vm_are
int map_kernel_pages_prepare(struct vm_area_desc *desc);
int map_kernel_pages_complete(struct vm_area_struct *vma,
struct mmap_action *action);
+int map_discontig_kernel_pages_prepare(struct vm_area_desc *desc);
+int map_discontig_kernel_pages_complete(struct vm_area_struct *vma,
+ struct mmap_action *action);
static inline int io_remap_pfn_range_prepare(struct vm_area_desc *desc)
{
--- a/mm/memory.c~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/memory.c
@@ -2621,17 +2621,23 @@ int vm_insert_pages(struct vm_area_struc
}
EXPORT_SYMBOL(vm_insert_pages);
+static void __map_kernel_pages_prepare(struct vm_area_desc *desc)
+{
+ if (vma_desc_test(desc, VMA_MIXEDMAP_BIT))
+ return;
+
+ mmap_assert_write_locked(desc->mm);
+ VM_WARN_ON_ONCE(vma_desc_test(desc, VMA_PFNMAP_BIT));
+ vma_desc_set_flags(desc, VMA_MIXEDMAP_BIT);
+}
+
int map_kernel_pages_prepare(struct vm_area_desc *desc)
{
const struct mmap_action *action = &desc->action;
const unsigned long addr = action->map_kernel.start;
unsigned long nr_pages, end;
- if (!vma_desc_test(desc, VMA_MIXEDMAP_BIT)) {
- VM_WARN_ON_ONCE(mmap_read_trylock(desc->mm));
- VM_WARN_ON_ONCE(vma_desc_test(desc, VMA_PFNMAP_BIT));
- vma_desc_set_flags(desc, VMA_MIXEDMAP_BIT);
- }
+ __map_kernel_pages_prepare(desc);
nr_pages = action->map_kernel.nr_pages;
end = addr + PAGE_SIZE * nr_pages;
@@ -2652,6 +2658,96 @@ int map_kernel_pages_complete(struct vm_
&nr_pages, vma->vm_page_prot);
}
+int map_discontig_kernel_pages_prepare(struct vm_area_desc *desc)
+{
+ const struct mmap_action *action = &desc->action;
+ const struct discontig_kernel_page_ops *ops =
+ action->map_kernel_discontig.ops;
+
+ /* At minimum need to be able to get pages. */
+ if (WARN_ON_ONCE(!ops || !ops->get))
+ return -EINVAL;
+
+ __map_kernel_pages_prepare(desc);
+ return 0;
+}
+
+static int apply_discontig_action(struct vm_area_struct *vma,
+ struct discontig_kernel_page_state *state)
+{
+ unsigned long nr_pages = state->__nr_pages;
+ unsigned long addr = state->addr;
+ unsigned long i;
+
+ if (state->action == DISCONTIG_KERNEL_PAGE_MAP_PAGES)
+ return insert_pages(vma, addr, state->__page_arr,
+ &nr_pages, vma->vm_page_prot);
+
+ VM_WARN_ON_ONCE(state->action != DISCONTIG_KERNEL_PAGE_MAP_CONTIG_PAGES);
+ /* Contiguous pages - have to iterate through each one. */
+ for (i = 0; i < nr_pages; i++, addr += PAGE_SIZE) {
+ struct page *page = state->__page + i;
+ int err;
+
+ err = insert_page(vma, addr, page, vma->vm_page_prot,
+ /*mkwrite=*/false);
+ if (err)
+ return err;
+ }
+ return 0;
+}
+
+int map_discontig_kernel_pages_complete(struct vm_area_struct *vma,
+ struct mmap_action *action)
+{
+ const struct discontig_kernel_page_ops *ops =
+ action->map_kernel_discontig.ops;
+ struct discontig_kernel_page_state state = {
+ .start = vma->vm_start,
+ .end = vma->vm_end,
+ .addr = vma->vm_start,
+ .pgoff = vma->vm_pgoff,
+ .nr_pages_mapped = 0,
+ .nr_pages_remain = vma_pages(vma),
+ .vm_private_data = vma->vm_private_data,
+ .private = action->map_kernel_discontig.init_private,
+ };
+ int err = 0;
+
+ if (ops->init)
+ err = ops->init(vma->vm_private_data, &state.private);
+ if (err)
+ return err;
+
+ do {
+ unsigned long end, pgoff_end;
+ unsigned long nr_pages;
+
+ /* Default to abort. */
+ state.action = DISCONTIG_KERNEL_PAGE_ABORT;
+ err = ops->get(&state);
+ if (err || state.action == DISCONTIG_KERNEL_PAGE_ABORT)
+ return err;
+ nr_pages = state.__nr_pages;
+
+ if (!nr_pages || nr_pages > state.nr_pages_remain)
+ return -EINVAL;
+ end = state.addr + PAGE_SIZE * nr_pages;
+ pgoff_end = state.pgoff + nr_pages;
+
+ err = apply_discontig_action(vma, &state);
+ if (err)
+ return err;
+
+ state.addr = end;
+ state.pgoff = pgoff_end;
+ state.nr_pages_mapped += nr_pages;
+ state.nr_pages_remain -= nr_pages;
+ } while (state.addr < vma->vm_end);
+
+ return 0;
+}
+
/**
* vm_insert_page - insert single page into user vma
* @vma: user vma to map to
--- a/mm/util.c~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/mm/util.c
@@ -1401,6 +1401,15 @@ static int call_vma_mapped(struct vm_are
return 0;
}
+/* An mmap action failed under the compatibility layer - unmap and close. */
+static void compat_mmap_action_abort(struct vm_area_struct *vma)
+{
+#ifdef CONFIG_MMU
+ zap_vma_range(vma, vma->vm_start, vma_pages(vma) << PAGE_SHIFT);
+#endif
+ vma_close(vma);
+}
+
static int mmap_action_finish(struct vm_area_struct *vma,
struct mmap_action *action, int err,
bool is_compat)
@@ -1412,12 +1421,13 @@ static int mmap_action_finish(struct vm_
/* do_munmap() might take rmap lock, so release if held. */
maybe_rmap_unlock_action(vma, action);
- /*
- * If this is invoked from the compatibility layer, post-mmap() hook
- * logic will handle cleanup for us.
- */
- if (!err || is_compat)
+ if (!err)
+ return 0;
+
+ if (is_compat) {
+ compat_mmap_action_abort(vma);
return err;
+ }
/*
* If an error occurs, unmap the VMA altogether and return an error. We
@@ -1469,6 +1479,8 @@ int mmap_action_prepare(struct vm_area_d
return simple_ioremap_prepare(desc);
case MMAP_KERNEL_PAGES:
return map_kernel_pages_prepare(desc);
+ case MMAP_DISCONTIG_KERNEL_PAGES:
+ return map_discontig_kernel_pages_prepare(desc);
}
WARN_ON_ONCE(1);
@@ -1501,6 +1513,9 @@ int mmap_action_complete(struct vm_area_
case MMAP_KERNEL_PAGES:
err = map_kernel_pages_complete(vma, action);
break;
+ case MMAP_DISCONTIG_KERNEL_PAGES:
+ err = map_discontig_kernel_pages_complete(vma, action);
+ break;
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
/* Should have been delegated. */
@@ -1522,6 +1537,7 @@ int mmap_action_prepare(struct vm_area_d
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
case MMAP_KERNEL_PAGES:
+ case MMAP_DISCONTIG_KERNEL_PAGES:
WARN_ON_ONCE(1); /* nommu cannot handle these. */
break;
}
@@ -1543,6 +1559,7 @@ int mmap_action_complete(struct vm_area_
case MMAP_IO_REMAP_PFN:
case MMAP_SIMPLE_IO_REMAP:
case MMAP_KERNEL_PAGES:
+ case MMAP_DISCONTIG_KERNEL_PAGES:
WARN_ON_ONCE(1); /* nommu cannot handle this. */
err = -EINVAL;
--- a/tools/testing/vma/include/dup.h~mm-add-mmap-action-for-discontiguous-kernel-page-mapping
+++ a/tools/testing/vma/include/dup.h
@@ -457,14 +457,17 @@ enum mmap_action_type {
MMAP_NOTHING,
MMAP_REMAP_PFN,
MMAP_IO_REMAP_PFN,
- MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
- MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_SIMPLE_IO_REMAP, /* I/O remap with guardrails. */
+ MMAP_KERNEL_PAGES, /* Map kernel page range from array. */
+ MMAP_DISCONTIG_KERNEL_PAGES, /* Map kernel discontig page range. */
};
/*
* Describes an action an mmap_prepare hook can instruct to be taken to complete
* the mapping of a VMA. Specified in vm_area_desc.
*/
+struct discontig_kernel_page_ops;
+
struct mmap_action {
union {
struct {
@@ -483,6 +486,10 @@ struct mmap_action {
unsigned long nr_pages;
pgoff_t pgoff;
} map_kernel;
+ struct {
+ void *init_private;
+ const struct discontig_kernel_page_ops *ops;
+ } map_kernel_discontig;
};
enum mmap_action_type type;
_
Patches currently in -mm which might be from ljs@kernel.org are
mm-vma-fix-mmap_prepare-file-handling-remove-file_doesnt_need_get.patch
mm-vma-introduce-and-use-vma_can_merge.patch
mm-consistently-validate-vma-state-after-mmap-hooks.patch
mm-vma-ensure-mmap_prepare-doesnt-set-actions-on-a-mergeable-vma.patch
mm-make-map_kernel_pages_-internal-and-unexported.patch
mm-vma-tidy-up-map-kernel-pages-enum-values.patch
mm-assert-mmap-lock-held-use-new-flags-api-in-vm_insert_page.patch
mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch
docs-filesystems-update-mmap_prepare-docs-for-discontig-kernel-pgs.patch
drivers-usb-mon-update-to-use-mmap_prepare-map-kernel-pages.patch
infiniband-update-hfi1-to-use-remap_vmalloc_range.patch
selinux-reject-writable-opens-of-policy-file-drop-mmap-shared-write-check.patch
alsa-pcm-use-vm_insert_page-to-map-pcm-status-page.patch
bpf-arena-mark-arena_map_mmap-mappings-vm_mixedmap.patch
mm-vma-add-vma_is_mm_managed-predicates.patch
mm-vma-only-allow-mmap-to-clear-vma_maywrite_bit-if-not-mm-managed.patch
mm-vma-add-and-use-vma__is_fixed_mapping.patch
scsi-sg-convert-mmap-hook-to-mmap_prepare-and-rework.patch
fbdev-defio-assert-fbinfo_virtfb-drop-vm_io-add-vm_mixedmap.patch
hsi-cmt_speech-convert-mmap-hook-to-mmap_prepare-refactor.patch
mm-gup-error-out-early-on-vma_mayread_bit-vmas.patch
uprobes-remove-vm_io-set-vm_mixedmap-for-mapped-kernel-pages.patch
mm-mlock-clear-vma_locked_mask-over-mmap-callback.patch
mm-mlock-eliminate-weird-vma_io_bit-abuse-and-simplify.patch
mm-vma-enforce-that-mm-managed-mappings-may-not-set-vma_io_bit.patch
mm-remove-vma_io_bit-check-in-vma_is_mm_managed.patch
mm-remove-hugetlb_inlineh.patch
mm-rename-is_vm_hugetlb_page-to-vma_is_hugetlb.patch
mm-drop-some-redundant-checks-around-hugetlb-vmas.patch
mm-vma-introduce-vma_is_mm_backed.patch
mm-madvise-update-is_valid_guard_vma-to-use-vma_is_mm_backed.patch
mm-uffd-use-predicates-for-userfaultfd-checks.patch
mm-madvise-use-predicates-for-madvise-madv_dofork.patch
mm-eliminate-vma_special_flags-usage-when-hugetlb-explicitly-tested.patch
mm-eliminate-vma_special_flags-check-in-lru_gen_look_around.patch
mm-avoid-use-of-vma_special_flags-in-migrate_vma_setup.patch
mm-eliminate-vm_special-vma_special_flags.patch
fuse-dax-do-not-set-vm_mixedmap.patch
mm-huge_memory-remove-vma_is_special_huge.patch
mm-vma-const-ify-vma_assert_stabilised-and-associated-functions.patch
mm-implement-and-use-vma_has_anon_rmap-silence-kcsan.patch
mm-update-comments-to-refer-to-anon-rmap-rather-than-anon_vma.patch
mm-vma-dont-remove-vma-from-rmap-if-pgoff-unchanged.patch
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-13 18:51 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-17 21:24 + mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch added to mm-unstable branch Andrew Morton
-- strict thread matches above, loose matches on Subject: below --
2026-10-03 23:34 Andrew Morton
2026-10-03 23:59 Andrew Morton
2026-10-10 22:01 Andrew Morton
2026-10-13 18:51 Andrew Morton
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.