[PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[Zenghui Yu]

From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>

uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
chunks of chunk_size and moves them one by one.  On arm64 with 64K base
pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
the whole 32MB (UFFD_TEST_MEM_SIZE) test area:

  step_count = nr_pages / (chunk_size / page_size) == 0

Because chunk_size > page_size, the test then aligns both areas up to
512MB, which points far outside of the 32MB mappings, and decrements
step_count, which underflows to ULONG_MAX.  The verification loop then
runs away and the first dereference of area_src faults with a SIGSEGV.

Skip the test when a single chunk cannot fit into the test area.

Fixes: a2bf6a9ca805 ("selftests/mm: add UFFDIO_MOVE ioctl test")
Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
---
 tools/testing/selftests/mm/uffd-unit-tests.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/testing/selftests/mm/uffd-unit-tests.c b/tools/testing/selftests/mm/uffd-unit-tests.c
index ef9b3956bdcf..2a97ba1d6feb 100644
--- a/tools/testing/selftests/mm/uffd-unit-tests.c
+++ b/tools/testing/selftests/mm/uffd-unit-tests.c
@@ -1937,6 +1937,11 @@ uffd_move_test_common(uffd_global_test_opts_t *gopts,
 
 	args.gopts = gopts;
 
+	if (chunk_size > gopts->nr_pages * gopts->page_size) {
+		uffd_test_skip("chunk size does not fit in the test area");
+		return;
+	}
+
 	/* Prevent source pages from being mapped more than once */
 	if (madvise(gopts->area_src, gopts->nr_pages * gopts->page_size, MADV_DONTFORK))
 		err("madvise(MADV_DONTFORK) failure");
-- 
2.53.0

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[Sarthak Sharma]

Hi Zenghui!

On 10/11/26 10:05 PM, Zenghui Yu wrote:
> From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
> 
> uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
> chunks of chunk_size and moves them one by one.  On arm64 with 64K base
> pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
> the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
> 
>   step_count = nr_pages / (chunk_size / page_size) == 0
> 
> Because chunk_size > page_size, the test then aligns both areas up to
> 512MB, which points far outside of the 32MB mappings, and decrements
> step_count, which underflows to ULONG_MAX.  The verification loop then
> runs away and the first dereference of area_src faults with a SIGSEGV.
> 
> Skip the test when a single chunk cannot fit into the test area.
> 
> Fixes: a2bf6a9ca805 ("selftests/mm: add UFFDIO_MOVE ioctl test")
> Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
> ---

I run the test on a 64k kernel. Before the patch, a segmentation fault
occurred, which was fixed by the patch. So:

Tested-by: Sarthak Sharma <sarthak.sharma@arm.com>

Though Sashiko has a few nits [1] you might take a look at.

[1]
https://sashiko.dev/#/patchset/20261011163527.95988-1-zenghui.yu%40linux.dev

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[Jose A. Perez de Azpillaga]

On Mon, Oct 12, 2026 at 12:35:27AM +0800, Zenghui Yu wrote:
> From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
> 
> uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
> chunks of chunk_size and moves them one by one.  On arm64 with 64K base
> pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
> the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
> 
>   step_count = nr_pages / (chunk_size / page_size) == 0
> 
> Because chunk_size > page_size, the test then aligns both areas up to
> 512MB, which points far outside of the 32MB mappings, and decrements
> step_count, which underflows to ULONG_MAX.  The verification loop then
> runs away and the first dereference of area_src faults with a SIGSEGV.
> 
> Skip the test when a single chunk cannot fit into the test area.
> 
> Fixes: a2bf6a9ca805 ("selftests/mm: add UFFDIO_MOVE ioctl test")
> Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
> ---
>  tools/testing/selftests/mm/uffd-unit-tests.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/tools/testing/selftests/mm/uffd-unit-tests.c b/tools/testing/selftests/mm/uffd-unit-tests.c
> index ef9b3956bdcf..2a97ba1d6feb 100644
> --- a/tools/testing/selftests/mm/uffd-unit-tests.c
> +++ b/tools/testing/selftests/mm/uffd-unit-tests.c
> @@ -1937,6 +1937,11 @@ uffd_move_test_common(uffd_global_test_opts_t *gopts,
>  
>  	args.gopts = gopts;
>  
> +	if (chunk_size > gopts->nr_pages * gopts->page_size) {
> +		uffd_test_skip("chunk size does not fit in the test area");
> +		return;
> +	}
> +
>  	/* Prevent source pages from being mapped more than once */
>  	if (madvise(gopts->area_src, gopts->nr_pages * gopts->page_size, MADV_DONTFORK))
>  		err("madvise(MADV_DONTFORK) failure");
> -- 
> 2.53.0
> 
> 

LGTM.

Reviewed-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>

-- 
cheers,
jose a. p-a

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[David Hildenbrand (Arm)]

On 10/11/26 18:35, Zenghui Yu wrote:
> From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
> 
> uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
> chunks of chunk_size and moves them one by one.  On arm64 with 64K base
> pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
> the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
> 
>   step_count = nr_pages / (chunk_size / page_size) == 0
> 
> Because chunk_size > page_size, the test then aligns both areas up to
> 512MB, which points far outside of the 32MB mappings, and decrements
> step_count, which underflows to ULONG_MAX.  The verification loop then
> runs away and the first dereference of area_src faults with a SIGSEGV.
> 
> Skip the test when a single chunk cannot fit into the test area.

That leaves 64k untested, though? Why not adjust the chunk size accordingly?

-- 
Cheers,

David

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[Mike Rapoport]

On Tue, Oct 13, 2026 at 09:39:54AM +0200, David Hildenbrand (Arm) wrote:
> On 10/11/26 18:35, Zenghui Yu wrote:
> > From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
> > 
> > uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
> > chunks of chunk_size and moves them one by one.  On arm64 with 64K base
> > pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
> > the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
> > 
> >   step_count = nr_pages / (chunk_size / page_size) == 0
> > 
> > Because chunk_size > page_size, the test then aligns both areas up to
> > 512MB, which points far outside of the 32MB mappings, and decrements
> > step_count, which underflows to ULONG_MAX.  The verification loop then
> > runs away and the first dereference of area_src faults with a SIGSEGV.
> > 
> > Skip the test when a single chunk cannot fit into the test area.
> 
> That leaves 64k untested, though? Why not adjust the chunk size accordingly?

To test anything PMD on arm64 with 64k pages we need to adjust
UFFD_TEST_MEM_SIZE to have at least 4 pages, i.e 2G :)

Maybe we want UFFD_TEST_MEM_SIZE to scale with the page size?
 
> -- 
> Cheers,
> 
> David

-- 
Sincerely yours,
Mike.

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[David Hildenbrand (Arm)]

On 10/13/26 12:33, Mike Rapoport wrote:
> On Tue, Oct 13, 2026 at 09:39:54AM +0200, David Hildenbrand (Arm) wrote:
>> On 10/11/26 18:35, Zenghui Yu wrote:
>>> From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
>>>
>>> uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
>>> chunks of chunk_size and moves them one by one.  On arm64 with 64K base
>>> pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
>>> the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
>>>
>>>   step_count = nr_pages / (chunk_size / page_size) == 0
>>>
>>> Because chunk_size > page_size, the test then aligns both areas up to
>>> 512MB, which points far outside of the 32MB mappings, and decrements
>>> step_count, which underflows to ULONG_MAX.  The verification loop then
>>> runs away and the first dereference of area_src faults with a SIGSEGV.
>>>
>>> Skip the test when a single chunk cannot fit into the test area.
>>
>> That leaves 64k untested, though? Why not adjust the chunk size accordingly?
> 
> To test anything PMD on arm64 with 64k pages we need to adjust
> UFFD_TEST_MEM_SIZE to have at least 4 pages, i.e 2G :)
> 
> Maybe we want UFFD_TEST_MEM_SIZE to scale with the page size?

That was my thought. If you have 64k you better also have plenty of memory :)

-- 
Cheers,

David

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[Zenghui Yu]

Hi Sarthak,

On 10/12/26 2:13 PM, Sarthak Sharma wrote:
> Hi Zenghui!
> 
> On 10/11/26 10:05 PM, Zenghui Yu wrote:
> > From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
> >
> > uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
> > chunks of chunk_size and moves them one by one.  On arm64 with 64K base
> > pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
> > the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
> >
> >   step_count = nr_pages / (chunk_size / page_size) == 0
> >
> > Because chunk_size > page_size, the test then aligns both areas up to
> > 512MB, which points far outside of the 32MB mappings, and decrements
> > step_count, which underflows to ULONG_MAX.  The verification loop then
> > runs away and the first dereference of area_src faults with a SIGSEGV.
> >
> > Skip the test when a single chunk cannot fit into the test area.
> >
> > Fixes: a2bf6a9ca805 ("selftests/mm: add UFFDIO_MOVE ioctl test")
> > Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
> > ---
> 
> I run the test on a 64k kernel. Before the patch, a segmentation fault
> occurred, which was fixed by the patch. So:
> 
> Tested-by: Sarthak Sharma <sarthak.sharma@arm.com>

Thanks a lot!

> Though Sashiko has a few nits [1] you might take a look at.
> 
> [1]
> https://sashiko.dev/#/patchset/20261011163527.95988-1-zenghui.yu%40linux.dev

I think both of these comments are valid and worth fixing, but I don't have
much bandwidth to work on them in the next few days. If you are interested,
please feel free to fix them up and post the follow-up. I'm happy to review
and test it.

Thanks again,
Zenghui

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[Zenghui Yu]

Hi David,

On 10/13/26 3:39 PM, David Hildenbrand (Arm) wrote:
> On 10/11/26 18:35, Zenghui Yu wrote:
> > From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
> >
> > uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
> > chunks of chunk_size and moves them one by one.  On arm64 with 64K base
> > pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
> > the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
> >
> >   step_count = nr_pages / (chunk_size / page_size) == 0
> >
> > Because chunk_size > page_size, the test then aligns both areas up to
> > 512MB, which points far outside of the 32MB mappings, and decrements
> > step_count, which underflows to ULONG_MAX.  The verification loop then
> > runs away and the first dereference of area_src faults with a SIGSEGV.
> >
> > Skip the test when a single chunk cannot fit into the test area.
> 
> That leaves 64k untested, though? Why not adjust the chunk size accordingly?

Right. Apparently this has never been tested on 64k :)

I agree that scaling the chunk size is the better approach -- it gives us
actual test coverage on such configuration, instead of bailing out early.

If anyone is interested in it, please feel free to send a patch. Otherwise
I'll work on it when I get some spare time.

Thanks,
Zenghui

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[David Hildenbrand (Arm)]

On 10/29/26 14:37, Zenghui Yu wrote:
> Hi David,
> 
> On 10/13/26 3:39 PM, David Hildenbrand (Arm) wrote:
>> On 10/11/26 18:35, Zenghui Yu wrote:
>>> From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
>>>
>>> uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
>>> chunks of chunk_size and moves them one by one.  On arm64 with 64K base
>>> pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
>>> the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
>>>
>>>   step_count = nr_pages / (chunk_size / page_size) == 0
>>>
>>> Because chunk_size > page_size, the test then aligns both areas up to
>>> 512MB, which points far outside of the 32MB mappings, and decrements
>>> step_count, which underflows to ULONG_MAX.  The verification loop then
>>> runs away and the first dereference of area_src faults with a SIGSEGV.
>>>
>>> Skip the test when a single chunk cannot fit into the test area.
>>
>> That leaves 64k untested, though? Why not adjust the chunk size accordingly?
> 
> Right. Apparently this has never been tested on 64k :)

Yeah. And if we start supporting it we should properly test it :)

> 
> I agree that scaling the chunk size is the better approach -- it gives us
> actual test coverage on such configuration, instead of bailing out early.
> 
> If anyone is interested in it, please feel free to send a patch. Otherwise
> I'll work on it when I get some spare time.
I guess no rush on this one.

-- 
Cheers,

David

[PATCH] selftests/mm: scale uffd memory region contingent upon base page size

[John J. Coleman]

When executing the uffd-unit-test, the "move-pmd on anon" test will fail on
aarch64+64k with a segmentation fault because the initial allocated memory
region is too small.  This only happens with the move-pmd* tests because the
architecture base page size is still utilized even though the memory region is
specific to the size indicated by the pmd.

Patch 9f5c2aec3388 ("selftests/mm: fix uffd move-pmd test crash on 64K base page
systems") implements an initial fix to the segmentation fault by skipping the
test if the allocated memory region is not large enough for the number of pages
x page size requested.  But as this will skip over the aarch64+64k pmd tests, this
patch is intended to resolve the problem with 64k pages by scaling up the
initial allocated memory region subject to base page size of the architecture.

Fixes: a2bf6a9ca805 ("selftests/mm: add UFFDIO_MOVE ioctl test")

Signed-off-by: John J. Coleman <jocolema@redhat.com>
---

I too have been looking into a solution for aarch64+64k.  I wanted to gauge your 
thoughts on this patch to scale up memory allocation region size predicated on 
architecture base page sizes.

 tools/testing/selftests/mm/uffd-unit-tests.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/mm/uffd-unit-tests.c b/tools/testing/selftests/mm/uffd-unit-tests.c
index 2a97ba1d6feb1b35d6281449fd1917793a64fab1..c6cebb3c880d0b47e44c8afc4e3a4c3050cea579 100644
--- a/tools/testing/selftests/mm/uffd-unit-tests.c
+++ b/tools/testing/selftests/mm/uffd-unit-tests.c
@@ -13,8 +13,14 @@
 
 #ifdef __NR_userfaultfd
 
-/* The unit test doesn't need a large or random size, make it 32MB for now */
-#define  UFFD_TEST_MEM_SIZE               (32UL << 20)
+/*
+ * The unit test does not need a large or random size, but the allocation size
+ * needs to scale with base page size per architecture otherwise pmd alignment
+ * tests will fail for architectures like aarch64+64k.  For standard 4k pages, 
+ * this will allocate 64MiB, while allocating 1GiB for 64k page sizes.
+ */
+#define  PAGE_SIZE                        sysconf(_SC_PAGESIZE)
+#define  UFFD_TEST_MEM_SIZE               (PAGE_SIZE * (16 << 10))
 
 #define  MEM_ANON                         BIT_ULL(0)
 #define  MEM_SHMEM                        BIT_ULL(1)
-- 
2.56.0

Re: [PATCH] selftests/mm: scale uffd memory region contingent upon base page size

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [Medium] selftests/mm: global UFFD_TEST_MEM_SIZE scaling inflates all tests to 1 GiB
- [Medium] selftests/mm: 32-bit off_t and address space overflow in shmem_allocate_area()
- [Low] selftests/mm: PAGE_SIZE macro duplicates psize() and risks redefinition
--

commit 10ea7f3e59b6ab7f3100a4c6de93cabccc122a33
Author: John J. Coleman <jocolema@redhat.com>

selftests/mm: scale uffd memory region contingent upon base page size

This patch scales UFFD_TEST_MEM_SIZE in uffd-unit-tests.c based on the
architecture base page size so that move-pmd tests on aarch64 with 64K base
pages have a large enough memory region instead of being skipped.

> diff --git a/tools/testing/selftests/mm/uffd-unit-tests.c b/tools/testing/selftests/mm/uffd-unit-tests.c
> index 298609544445e..4037a7160b13d 100644
> --- a/tools/testing/selftests/mm/uffd-unit-tests.c
> +++ b/tools/testing/selftests/mm/uffd-unit-tests.c
> @@ -13,8 +13,14 @@
>  
>  #ifdef __NR_userfaultfd
>  
> -/* The unit test doesn't need a large or random size, make it 32MB for now */
> -#define  UFFD_TEST_MEM_SIZE               (32UL << 20)
> +/*
> + * The unit test does not need a large or random size, but the allocation size
> + * needs to scale with base page size per architecture otherwise pmd alignment
> + * tests will fail for architectures like aarch64+64k.  For standard 4k pages, 
> + * this will allocate 64MiB, while allocating 1GiB for 64k page sizes.
> + */
> +#define  PAGE_SIZE                        sysconf(_SC_PAGESIZE)

[Severity: Low]
This isn't a bug, but uffd-unit-tests.c already includes vm_util.h (via
uffd-common.h) and calls psize() in main():

tools/testing/selftests/mm/vm_util.h:psize() {
	if (!__page_size)
		__page_size = sysconf(_SC_PAGESIZE);
	return __page_size;
}

An unguarded PAGE_SIZE macro can also collide with system headers on libcs
such as musl (which defines PAGE_SIZE in limits.h under _GNU_SOURCE), and
sysconf(_SC_PAGESIZE) returns a signed long rather than an unsigned value.

Could this reuse psize() instead of defining a new PAGE_SIZE macro?

> +#define  UFFD_TEST_MEM_SIZE               (PAGE_SIZE * (16 << 10))

[Severity: Medium]
Does scaling UFFD_TEST_MEM_SIZE globally inflate memory allocation, runtime,
and HugeTLB reservations across the entire test suite?

In main(), UFFD_TEST_MEM_SIZE is applied to every test case and memory type:

tools/testing/selftests/mm/uffd-unit-tests.c:main() {
    ...
			/* Ensure we have at least 2 pages */
			gopts.nr_pages = MAX(UFFD_TEST_MEM_SIZE, gopts.page_size * 2)
				/ gopts.page_size;
    ...
}

And uffd_setup_hugetlb() reserves twice UFFD_TEST_MEM_SIZE in HugeTLB pages
up front for the entire test binary execution:

tools/testing/selftests/mm/uffd-unit-tests.c:uffd_setup_hugetlb() {
    ...
	/* need twice UFFD_TEST_MEM_SIZE, one for src area and one for dst */
	nr_hugepages = 2 * MAX(UFFD_TEST_MEM_SIZE, hp_size * 2) / hp_size;
	hugetlb_set_nr_default_pages(nr_hugepages);
    ...
}

On 64K base page systems, only the PMD-granularity tests (such as move-pmd
and move-pmd-split in uffd_move_test_common(), which align area_src and
area_dst up to pmd_psize()) need a buffer of at least 2 * pmd_psize().
Scaling UFFD_TEST_MEM_SIZE globally increases every test on 64K base pages
from 32 MiB (512 pages) to 1 GiB (16,384 pages) per area (2 GiB total for
area_src and area_dst), forcing every base-page test to fault in 16,384
pages and scan 1 GiB byte-by-byte in helpers like check_memory_contents().

It also raises the HugeTLB reservation in uffd_setup_hugetlb() from 64 MiB
to 2 GiB on 64K-page systems with 2 MiB or 16 MiB default hugepages (such as
powerpc64 or arm64 cont-PTE hugepages), which causes all hugetlb tests to be
skipped if 2 GiB of hugepages cannot be reserved, or pins 2 GiB of RAM in
 the HugeTLB pool while subsequent anon/shmem tests allocate another 2 GiB.
Additionally, PMD size is not a fixed multiple of base page size across
architectures (powerpc64 with 64K pages has a 2 MiB or 16 MiB PMD size, and
4K-page systems double from 32 MiB to 64 MiB).

Since struct uffd_test_case_ops provides a pre_alloc hook invoked in
uffd_test_ctx_init() before allocate_area(), would it be better to keep
UFFD_TEST_MEM_SIZE at 32 MiB and adjust gopts->nr_pages based on
2 * pmd_psize() in uffd_move_test_pmd_case_ops (and any other PMD-sized test)?

[Severity: Medium]
Can setting UFFD_TEST_MEM_SIZE to 1 GiB on 64K-page kernels overflow 32-bit
signed off_t and the 32-bit virtual address space when uffd-unit-tests is
built as a 32-bit binary (for example, a 32-bit compat binary on an
aarch64 or powerpc64 64K-page kernel, or 32-bit powerpc with 64K/256K pages)?

In main() -> uffd_test_ctx_init() -> shmem_allocate_area():

tools/testing/selftests/mm/uffd-common.c:shmem_allocate_area() {
	size_t bytes = gopts->nr_pages * gopts->page_size, hpage_size = pmd_psize();
	unsigned long offset = is_src ? 0 : bytes;
	char *p = NULL, *p_alias = NULL;
	int mem_fd = uffd_mem_fd_create(bytes * 2, false);
	size_t region_size = bytes * 2 + hpage_size;
    ...
}

Because tools/testing/selftests/mm/Makefile does not define
_FILE_OFFSET_BITS=64, off_t and size_t are 32-bit on 32-bit builds. When
bytes is 1 GiB (0x40000000), bytes * 2 is 0x80000000, which overflows the
32-bit signed off_t parameter of uffd_mem_fd_create(off_t mem_size, bool hugetlb)
to -2147483648 and causes ftruncate() to fail with EINVAL, while mapping two
regions of size bytes * 2 + hpage_size exceeds the 32-bit address space. On
256K base page kernels (CONFIG_PPC_256K_PAGES), PAGE_SIZE * (16 << 10) also
overflows a 32-bit signed long directly.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103202049.499206-1-jocolema@redhat.com?part=1

[PATCH v2] selftests/mm: scale uffd memory region contingent upon base page size

[John J. Coleman]

When executing the uffd-unit-test, the "move-pmd on anon" test will fail 
on aarch64+64k with a segmentation fault because the initial allocated 
memory region is too small.  This only happens with the move-pmd* tests 
because the architecture base page size is still utilized even though the 
memory region is specific to the size indicated by the pmd.

Patch 9f5c2aec3388 ("selftests/mm: fix uffd move-pmd test crash on 64K 
base page systems") implements an initial fix to the segmentation fault 
by skipping the test if the allocated memory region is not large enough 
for the number of pages x page size requested.  But as this will skip 
over the aarch64+64k pmd tests, this patch is intended to resolve the 
problem with 64k pages by scaling up the initial allocated memory region 
subject to base page size of the architecture.

Fixes: a2bf6a9ca805 ("selftests/mm: add UFFDIO_MOVE ioctl test")

Signed-off-by: John J. Coleman <jocolema@redhat.com>
---

I made some basic revisions, but as I am looking to gauge opinions on 
this email chain I am replying to the chain, I apologize if this is an
inconvenience.

Changes in v2:
 * Since psize() is included from vm_util.h through uffd-common.h, 
   PAGE_SIZE macro removed.
 * Added UL suffix to ensure integer is treated as unsigned long.

 tools/testing/selftests/mm/uffd-unit-tests.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/mm/uffd-unit-tests.c b/tools/testing/selftests/mm/uffd-unit-tests.c
index 2a97ba1d6feb1b35d6281449fd1917793a64fab1..3be227ed8d413f6e67e475862aba10ce13221446 100644
--- a/tools/testing/selftests/mm/uffd-unit-tests.c
+++ b/tools/testing/selftests/mm/uffd-unit-tests.c
@@ -13,8 +13,13 @@
 
 #ifdef __NR_userfaultfd
 
-/* The unit test doesn't need a large or random size, make it 32MB for now */
-#define  UFFD_TEST_MEM_SIZE               (32UL << 20)
+/*
+ * The unit test does not need a large or random size, but the allocation size
+ * needs to scale with base page size per architecture otherwise pmd alignment
+ * tests will fail for architectures like aarch64+64k.  For standard 4k pages, 
+ * this will allocate 64MiB, while allocating 1GiB for 64k page sizes.
+ */
+#define  UFFD_TEST_MEM_SIZE               (psize() * (16UL << 10))
 
 #define  MEM_ANON                         BIT_ULL(0)
 #define  MEM_SHMEM                        BIT_ULL(1)
-- 
2.56.0

Re: [PATCH v2] selftests/mm: scale uffd memory region contingent upon base page size

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [Medium] selftests/mm: global UFFD_TEST_MEM_SIZE scaling inflates all
  tests to 1 GiB
- [Medium] selftests/mm: 32-bit off_t and address space overflow in
  shmem_allocate_area()
--

commit a5aec08279d23de437082c277d91963fe8283b3a
Author: John J. Coleman <jocolema@redhat.com>

selftests/mm: scale uffd memory region contingent upon base page size

This commit scales UFFD_TEST_MEM_SIZE by the architecture base page size in
uffd-unit-tests.c so that PMD-granularity tests have a large enough memory
region on 64K base page systems.

> diff --git a/tools/testing/selftests/mm/uffd-unit-tests.c b/tools/testing/selftests/mm/uffd-unit-tests.c
> index 4d9df714d5018..99eda4eefb51d 100644
> --- a/tools/testing/selftests/mm/uffd-unit-tests.c
> +++ b/tools/testing/selftests/mm/uffd-unit-tests.c
> @@ -13,8 +13,13 @@
>  
>  #ifdef __NR_userfaultfd
>  
> -/* The unit test doesn't need a large or random size, make it 32MB for now */
> -#define  UFFD_TEST_MEM_SIZE               (32UL << 20)
> +/*
> + * The unit test does not need a large or random size, but the allocation size
> + * needs to scale with base page size per architecture otherwise pmd alignment
> + * tests will fail for architectures like aarch64+64k.  For standard 4k pages, 
> + * this will allocate 64MiB, while allocating 1GiB for 64k page sizes.
> + */
> +#define  UFFD_TEST_MEM_SIZE               (psize() * (16UL << 10))

[Severity: Medium]
As reported by Sashiko on v1 [1], does scaling UFFD_TEST_MEM_SIZE globally
inflate memory consumption and runtime for the entire test suite and reserve
2 GiB of HugeTLB pages on 64K page systems?

In main(), UFFD_TEST_MEM_SIZE is used for every test case and memory type:

tools/testing/selftests/mm/uffd-unit-tests.c:main() {
    ...
    /* Ensure we have at least 2 pages */
    gopts.nr_pages = MAX(UFFD_TEST_MEM_SIZE, gopts.page_size * 2)
        / gopts.page_size;
    ...
}

On 64K base page systems, this increases each test area from 32 MiB (512
pages) to 1 GiB (16,384 pages), allocating 2 GiB (area_src and area_dst) for
every test case, populating all 16,384 pages in uffd_test_ctx_init(), and
scanning 1 GiB byte-by-byte in tests that fault and verify area_dst. On 4K
base page systems, it doubles UFFD_TEST_MEM_SIZE from 32 MiB to 64 MiB.

In addition, uffd_setup_hugetlb() reserves twice UFFD_TEST_MEM_SIZE in
HugeTLB pages for the entire test run:

tools/testing/selftests/mm/uffd-unit-tests.c:uffd_setup_hugetlb() {
    ...
    /* need twice UFFD_TEST_MEM_SIZE, one for src area and one for dst */
    nr_hugepages = 2 * MAX(UFFD_TEST_MEM_SIZE, hp_size * 2) / hp_size;
    hugetlb_set_nr_default_pages(nr_hugepages);
    ...
}

On 64K base page systems where the default hugepage size is smaller than
512 MiB (such as powerpc64 with 2 MiB or 16 MiB hugepages, or arm64 with
2 MiB cont-PTE hugepages), the required HugeTLB reservation jumps from
64 MiB to 2 GiB. If 2 GiB of HugeTLB pages cannot be reserved, all hugetlb
and hugetlb-private tests are skipped; if it succeeds, pinning 2 GiB in
HugeTLB throughout the test run can starve the contiguous 512 MiB THP
allocations needed by move-pmd.

Only the PMD-granularity tests (such as move-pmd and move-pmd-split in
uffd_move_test_common()) require a buffer of at least 2 * pmd_psize() to
accommodate aligning area_src and area_dst up to chunk_size. Would it be
better to keep UFFD_TEST_MEM_SIZE at 32 MiB and instead use the pre_alloc
callback in struct uffd_test_case_ops (for example on
uffd_move_test_pmd_case_ops) to adjust gopts->nr_pages based on
2 * pmd_psize() for the PMD tests?

[Severity: Medium]
As reported by Sashiko on v1 [1], can setting UFFD_TEST_MEM_SIZE to
(psize() * (16UL << 10)) overflow 32-bit signed off_t and the 32-bit virtual
address space when running a 32-bit build on a 64K or 256K page kernel?

Neither tools/testing/selftests/mm/Makefile nor
tools/testing/selftests/lib.mk defines _FILE_OFFSET_BITS=64, so on 32-bit
builds unsigned long, size_t, and off_t are 32-bit. When psize() is 64K,
UFFD_TEST_MEM_SIZE is 0x40000000UL (1 GiB), and on 256K-page kernels
(CONFIG_PPC_256K_PAGES) 262144U * 16384UL overflows 32-bit unsigned long to
0.

In shmem_allocate_area(), bytes * 2 is passed to uffd_mem_fd_create():

tools/testing/selftests/mm/uffd-common.c:shmem_allocate_area() {
    size_t bytes = gopts->nr_pages * gopts->page_size, hpage_size = pmd_psize();
    unsigned long offset = is_src ? 0 : bytes;
    char *p = NULL, *p_alias = NULL;
    int mem_fd = uffd_mem_fd_create(bytes * 2, false);
    size_t region_size = bytes * 2 + hpage_size;
    ...
}

tools/testing/selftests/mm/uffd-common.c:uffd_mem_fd_create() {
    ...
    if (ftruncate(mem_fd, mem_size))
        err("ftruncate");
    ...
}

When bytes is 1 GiB (0x40000000UL), bytes * 2 (0x80000000UL) overflows the
32-bit signed off_t parameter mem_size in uffd_mem_fd_create() to
-2147483648 (and similarly for size * 2 in hugetlb_allocate_area()), causing
ftruncate() to fail with EINVAL and abort the test suite via
err("ftruncate"). Furthermore, allocating both area_src and area_dst in
shmem_allocate_area() reserves two virtual memory regions of size
bytes * 2 + hpage_size (>= 4 GiB total), which cannot fit in a 32-bit
virtual address space.

[1] https://lore.kernel.org/r/20261103202049.499206-1-jocolema@redhat.com

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105175407.638242-1-jocolema@redhat.com?part=1