From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 17A604AA1DA for ; Tue, 13 Oct 2026 18:52:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791917567; cv=none; b=QNv6c6FqJvJddIzmn6HfEeFq4zO29zA+SNeiX4UGN6Bwyp5g8KdZb16lyCw7+U+HNVmxNkcdrruGJvnhpo9M5QkedEgZfviALlZppQp9aKcBTYGuehVKYCuqLgucwV11JJ+sV++gw73eoPdXZO3XEeaphUO4lxiOzbOsWneP4xw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791917567; c=relaxed/simple; bh=tK5jkLBlA0zm79mlSVQzCyJ8U5ZK/eHqzo6F538UgQI=; h=Date:To:From:Subject:Message-Id; b=HtPhJO1lyid9ICD6LA53ZGQ0j4ERuTB8fsiuwJt5lMbsVpQKqXMmo4Q3qnoD86Clk6d8esxqUGPAKhDWR8RGBUIxyPvKy8CMJiilS7OYvACc0uzFr5DeSvofrKfy/XzzPlSdEhc0/zRu98G+bRNfqPfRTGGWwGbuYw6+DEkCW5Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=Y0u1I9oB; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="Y0u1I9oB" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DEC021F000FF; Tue, 13 Oct 2026 18:52:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1791917565; bh=iMU8SJua8WKX0QF9yPwZSh8Hoj3zwdAVh3xJFytQ2PY=; h=Date:To:From:Subject; b=Y0u1I9oBAQUpB2Bs9NGxmfTsHj6PSqpF0shnPWxUTMnSP1qZ/UIGAc3wYk5s/DLfA E3DENFAf36ZlF5rAeSV6PtxrgLAT58sVfzD8S7X3QEEKq01DB2ste7i9W8SELnkNuN 2WGis09mnyWiEJ5VcbsjE1nYq3qkz7gohkn6qIgo= Date: Tue, 13 Oct 2026 11:52:44 -0700 To: mm-commits@vger.kernel.org,ljs@kernel.org,akpm@linux-foundation.org From: Andrew Morton Subject: + mm-vma-introduce-vma_is_mm_backed.patch added to mm-unstable branch Message-Id: <20261013185244.DEC021F000FF@smtp.kernel.org> Precedence: bulk X-Mailing-List: mm-commits@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: The patch titled Subject: mm/vma: introduce vma[_flags]_is_mm_backed() has been added to the -mm mm-unstable branch. Its filename is mm-vma-introduce-vma_is_mm_backed.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-vma-introduce-vma_is_mm_backed.patch This patch will later appear in the mm-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: "Lorenzo Stoakes (ARM)" Subject: mm/vma: introduce vma[_flags]_is_mm_backed() Date: Tue, 13 Oct 2026 16:05:10 +0100 Introduce vma[_flags]_is_mm_backed() for the purposes of identifying mappings which are mm-managed and whose contents were placed there by core mm's own fault path - rather than a custom ->fault handler. Mappings not managed by core mm do not fall into this category, as they are populated by their owner, and nor of course does memory-mapped I/O. We exclude fixed mappings as these have a layout core mm cannot assume ordinary fault semantics over. hugetlb mappings are fixed mappings, but core mm owns them entirely, so they are explicitly carved out as mm-backed, as the MADV_DODUMP check already does. Use this functionality to update the madvise MADV_DODUMP check to test for this rather than open-coding it. Also update vma_flags_can_merge() so it is written in terms of vma_flags_is_mm_backed() - all mm-backed mappings can be merged except hugetlb mappings, whose flags and fields do not completely describe them. Also update __thp_vma_allowable_orders() to use vma_is_mm_backed() rather than testing for mergeability, which is irrelevant to this function. This replaces the VM_SPECIAL check which means it no longer checks for VMA_IO_BIT, however this is safe as we have established the invariant that mm-managed mappings may not set VMA_IO_BIT, so we implicitly include these. No functional change intended. Link: https://lore.kernel.org/20261013-b4-mmap-prepare-vma-flag-sanify-v6-30-1aa3c9b139f9@kernel.org Signed-off-by: Lorenzo Stoakes (ARM) Signed-off-by: Andrew Morton Acked-by: Zi Yan Acked-by: David Hildenbrand (Arm) Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Jann Horn Cc: Pedro Falcato Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Michal Hocko Cc: Jonathan Corbet Cc: Greg Kroah-Hartman Cc: Dennis Dalessandro Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: Paul Moore Cc: Stephen Smalley Cc: Jaroslav Kysela Cc: Takashi Iwai Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Andrii Nakryiko Cc: Eduard Zingerman Cc: Kumar Kartikeya Dwivedi Cc: Baolin Wang Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lance Yang Cc: Usama Arif Cc: Kiryl Shutsemau Cc: Doug Gilbert Cc: James Bottomley Cc: Martin K. Petersen Cc: Simona Vetter Cc: Helge Deller Cc: Sebastian Reichel Cc: John Hubbard Cc: Peter Xu Cc: Masami Hiramatsu Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Mark Rutland Cc: Rik van Riel Cc: Harry Yoo Cc: Juri Lelli Cc: Vincent Guittot Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: David Airlie Cc: Will Deacon Cc: Aneesh Kumar K.V Cc: Nicholas Piggin Cc: Arnd Bergmann Cc: Muchun Song Cc: Oscar Salvador Cc: Matthew Wilcox (Oracle) Cc: Jan Kara Cc: Marc Zyngier Cc: Oliver Upton Cc: Catalin Marinas Cc: Madhavan Srinivasan Cc: Anup Patel Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Albert Ou Cc: Christian Borntraeger Cc: Janosch Frank Cc: Claudio Imbrenda Cc: Alexander Gordeev Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Vasily Gorbik Cc: David S. Miller Cc: Andreas Larsson Cc: Al Viro Cc: Christian Brauner Cc: Matthew Brost Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Chris Li Cc: Kairui Song Cc: Kemeng Shi Cc: Nhat Pham Cc: Baoquan He Cc: Youngjun Park Cc: Johannes Weiner Cc: Qi Zheng Cc: Shakeel Butt Cc: Axel Rasmussen Cc: Yuanchu Xie Cc: Wei Xu Cc: Chengming Zhou Cc: Michal Hocko Cc: Miklos Szeredi Cc: Xu Xin Cc: Ihor Solodrai Cc: Bert Karwatzki --- include/linux/mm.h | 66 +++++++++++++++++++++++++----- mm/huge_memory.c | 7 +-- mm/madvise.c | 7 ++- tools/testing/vma/include/dup.h | 44 +++++++++++++++----- 4 files changed, 100 insertions(+), 24 deletions(-) --- a/include/linux/mm.h~mm-vma-introduce-vma_is_mm_backed +++ a/include/linux/mm.h @@ -1703,6 +1703,54 @@ static inline bool vma_is_fixed_mapping( } /** + * vma_flags_is_mm_backed() - Do the specified VMA flags imply the mapping is + * backed by core mm? + * @flags: The VMA flags to test. + * + * An mm-backed mapping is one managed by core mm (see + * vma_flags_is_mm_managed()) whose contents are established by core mm's own + * fault path rather than a custom ->fault handler. + * + * Mappings not managed by core mm are populated by their owner, and fixed + * mappings may be mm-managed but have their contents established by a custom + * ->fault handler, so neither are mm-backed. hugetlb mappings are fixed, but + * core mm owns them entirely, so they are. + * + * These are the only mappings which can sensibly be merged, locked, dumped or + * be subject to uffd faulting, as all of these assume core mm and core mm + * alone manages their contents. + * + * Returns: true if the flags imply an mm-backed mapping, otherwise false. + */ +static inline bool vma_flags_is_mm_backed(const vma_flags_t *flags) +{ + /* hugetlb is a fixed mapping, but core mm owns it entirely. */ + if (vma_flags_is_hugetlb(flags)) + return true; + /* + * Mappings not managed by core mm are populated by their owner. + * + * Fixed mappings may be mm-managed, but their contents are established + * by a custom ->fault handler, so core mm cannot assume ordinary fault + * semantics over them. + */ + return vma_flags_is_mm_managed(flags) && !vma_flags_is_fixed_mapping(flags); +} + +/** + * vma_is_mm_backed() - Is @vma backed by core mm? + * @vma: The VMA to test. + * + * See vma_flags_is_mm_backed() for details. + * + * Returns: true if the VMA is mm-backed, otherwise false. + */ +static inline bool vma_is_mm_backed(const struct vm_area_struct *vma) +{ + return vma_flags_is_mm_backed(&vma->flags); +} + +/** * vma_flags_can_merge() - Do the specified VMA flags permit the VMA to be * merged with another? * @flags: The VMA flags to test. @@ -1712,21 +1760,21 @@ static inline bool vma_flags_can_merge(c { /* * VMA merging assumes that a VMA's flags and fields completely describe - * its state. + * its state, which is only the case for mm-backed mappings. * - * However, mappings which are not mm-managed may have established state - * upon mapping not embodied in any attribute of the VMA. + * Mappings which are not mm-managed may have established state upon + * mapping not embodied in any attribute of the VMA. * * Additionally, private (CoW) PFN maps encode the source PFN of the * range in vma->vm_pgoff, which may otherwise cause spurious merges. */ - if (!vma_flags_is_mm_managed(flags)) + if (!vma_flags_is_mm_backed(flags)) return false; - /* VMA explicitly marked as being unmergeable. */ - if (vma_flags_is_fixed_mapping(flags)) - return false; - - return true; + /* + * hugetlb mappings contain per-VMA state, so their flags and fields do + * not completely describe them. + */ + return !vma_flags_is_hugetlb(flags); } /** --- a/mm/huge_memory.c~mm-vma-introduce-vma_is_mm_backed +++ a/mm/huge_memory.c @@ -215,11 +215,10 @@ unsigned long __thp_vma_allowable_orders * khugepaged moves data from VMAs once collapsed, after they have been * faulted in, relying on refaulting for file-backed memory. * - * Mappings not managed by core mm cannot be reliably reconstructed from - * page faults, and fixed mappings (including hugetlb) may well be - * mm-managed - precisely the mappings which cannot be merged. + * Only mm-backed mappings can be reliably reconstructed from page + * faults, and hugetlb mappings cannot be collapsed. */ - if (!in_pf && !smaps && !vma_can_merge(vma)) + if (!in_pf && !smaps && (!vma_is_mm_backed(vma) || vma_is_hugetlb(vma))) return 0; /* --- a/mm/madvise.c~mm-vma-introduce-vma_is_mm_backed +++ a/mm/madvise.c @@ -1415,8 +1415,11 @@ static int madvise_vma_behavior(struct m new_flags |= VM_DONTDUMP; break; case MADV_DODUMP: - if ((!vma_is_hugetlb(vma) && (new_flags & VM_SPECIAL)) || - (new_flags & VM_DROPPABLE)) + /* Only mm-backed memory can be meaningfully dumped. */ + if (!vma_is_mm_backed(vma)) + return -EINVAL; + /* Core mm may discard droppable memory at any time. */ + if (new_flags & VM_DROPPABLE) return -EINVAL; new_flags &= ~VM_DONTDUMP; break; --- a/tools/testing/vma/include/dup.h~mm-vma-introduce-vma_is_mm_backed +++ a/tools/testing/vma/include/dup.h @@ -1689,23 +1689,49 @@ static inline bool vma_is_fixed_mapping( return vma_flags_is_fixed_mapping(&vma->flags); } +static inline bool vma_flags_is_hugetlb(const vma_flags_t *flags) +{ + return IS_ENABLED(CONFIG_HUGETLB_PAGE) && + vma_flags_test(flags, VMA_HUGETLB_BIT); +} + +static inline bool vma_flags_is_mm_backed(const vma_flags_t *flags) +{ + /* hugetlb is a fixed mapping, but core mm owns it entirely. */ + if (vma_flags_is_hugetlb(flags)) + return true; + /* + * Mappings not managed by core mm are populated by their owner. + * + * Fixed mappings may be mm-managed, but their contents are established + * by a custom ->fault handler, so core mm cannot assume ordinary fault + * semantics over them. + */ + return vma_flags_is_mm_managed(flags) && !vma_flags_is_fixed_mapping(flags); +} + +static inline bool vma_is_mm_backed(const struct vm_area_struct *vma) +{ + return vma_flags_is_mm_backed(&vma->flags); +} + static inline bool vma_flags_can_merge(const vma_flags_t *flags) { /* * VMA merging assumes that a VMA's flags and fields completely describe - * its state. + * its state, which is only the case for mm-backed mappings. * - * However, mappings which are not mm-managed may have established state - * upon mapping not embodied in any attribute of the VMA. + * Mappings which are not mm-managed may have established state upon + * mapping not embodied in any attribute of the VMA. * * Additionally, private (CoW) PFN maps encode the source PFN of the * range in vma->vm_pgoff, which may otherwise cause spurious merges. */ - if (!vma_flags_is_mm_managed(flags)) + if (!vma_flags_is_mm_backed(flags)) return false; - /* VMA explicitly marked as being unmergeable. */ - if (vma_flags_is_fixed_mapping(flags)) - return false; - - return true; + /* + * hugetlb mappings contain per-VMA state, so their flags and fields do + * not completely describe them. + */ + return !vma_flags_is_hugetlb(flags); } _ Patches currently in -mm which might be from ljs@kernel.org are mm-vma-fix-mmap_prepare-file-handling-remove-file_doesnt_need_get.patch mm-vma-introduce-and-use-vma_can_merge.patch mm-consistently-validate-vma-state-after-mmap-hooks.patch mm-vma-ensure-mmap_prepare-doesnt-set-actions-on-a-mergeable-vma.patch mm-make-map_kernel_pages_-internal-and-unexported.patch mm-vma-tidy-up-map-kernel-pages-enum-values.patch mm-assert-mmap-lock-held-use-new-flags-api-in-vm_insert_page.patch mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch docs-filesystems-update-mmap_prepare-docs-for-discontig-kernel-pgs.patch drivers-usb-mon-update-to-use-mmap_prepare-map-kernel-pages.patch infiniband-update-hfi1-to-use-remap_vmalloc_range.patch selinux-reject-writable-opens-of-policy-file-drop-mmap-shared-write-check.patch alsa-pcm-use-vm_insert_page-to-map-pcm-status-page.patch bpf-arena-mark-arena_map_mmap-mappings-vm_mixedmap.patch mm-vma-add-vma_is_mm_managed-predicates.patch mm-vma-only-allow-mmap-to-clear-vma_maywrite_bit-if-not-mm-managed.patch mm-vma-add-and-use-vma__is_fixed_mapping.patch scsi-sg-convert-mmap-hook-to-mmap_prepare-and-rework.patch fbdev-defio-assert-fbinfo_virtfb-drop-vm_io-add-vm_mixedmap.patch hsi-cmt_speech-convert-mmap-hook-to-mmap_prepare-refactor.patch mm-gup-error-out-early-on-vma_mayread_bit-vmas.patch uprobes-remove-vm_io-set-vm_mixedmap-for-mapped-kernel-pages.patch mm-mlock-clear-vma_locked_mask-over-mmap-callback.patch mm-mlock-eliminate-weird-vma_io_bit-abuse-and-simplify.patch mm-vma-enforce-that-mm-managed-mappings-may-not-set-vma_io_bit.patch mm-remove-vma_io_bit-check-in-vma_is_mm_managed.patch mm-remove-hugetlb_inlineh.patch mm-rename-is_vm_hugetlb_page-to-vma_is_hugetlb.patch mm-drop-some-redundant-checks-around-hugetlb-vmas.patch mm-vma-introduce-vma_is_mm_backed.patch mm-madvise-update-is_valid_guard_vma-to-use-vma_is_mm_backed.patch mm-uffd-use-predicates-for-userfaultfd-checks.patch mm-madvise-use-predicates-for-madvise-madv_dofork.patch mm-eliminate-vma_special_flags-usage-when-hugetlb-explicitly-tested.patch mm-eliminate-vma_special_flags-check-in-lru_gen_look_around.patch mm-avoid-use-of-vma_special_flags-in-migrate_vma_setup.patch mm-eliminate-vm_special-vma_special_flags.patch fuse-dax-do-not-set-vm_mixedmap.patch mm-huge_memory-remove-vma_is_special_huge.patch mm-vma-const-ify-vma_assert_stabilised-and-associated-functions.patch mm-implement-and-use-vma_has_anon_rmap-silence-kcsan.patch mm-update-comments-to-refer-to-anon-rmap-rather-than-anon_vma.patch mm-vma-dont-remove-vma-from-rmap-if-pgoff-unchanged.patch