Re: [PATCH v2 2/2] selftests/mm: add a test for UFFDIO_MOVE of a write-protected swap entry

["David Hildenbrand (Arm)" <david@kernel.org>]

On 9/25/26 06:29, Donggeun Yoo wrote:
> Move a swapped-out page out of a write-protected area into a destination
> registered for missing faults only, and read pagemap bit 57 at the
> destination.  The destination was never write-protected, so the bit must
> be clear.
> 
> Assisted-by: LLM
> Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
> ---
>  tools/testing/selftests/mm/uffd-unit-tests.c | 61 ++++++++++++++++++++
>  1 file changed, 61 insertions(+)
> 
> diff --git a/tools/testing/selftests/mm/uffd-unit-tests.c b/tools/testing/selftests/mm/uffd-unit-tests.c
> index ef9b3956bdcfd..ae8b718f0a278 100644
> --- a/tools/testing/selftests/mm/uffd-unit-tests.c
> +++ b/tools/testing/selftests/mm/uffd-unit-tests.c
> @@ -2037,6 +2037,59 @@ static void uffd_move_pmd_split_test(uffd_global_test_opts_t *gopts, uffd_test_a
>  			      uffd_move_pmd_handle_fault);
>  }
>  
> +/*
> + * Moving a swapped-out page out of a write-protected area must not carry the
> + * uffd-wp bit into a destination that is not write-protect registered: such a
> + * bit is never cleared afterwards, so pagemap keeps reporting the page as
> + * uffd-tracked.
> + *
> + * Needs a swap device; skipped if MADV_PAGEOUT cannot evict the page.
> + */
> +static void uffd_move_swap_wp_test(uffd_global_test_opts_t *gopts,
> +				   uffd_test_args_t *targs)
> +{
> +	unsigned long page_size = gopts->page_size;
> +	struct uffdio_move move = { };
> +	int pagemap_fd, i;
> +
> +	if (uffd_register(gopts->uffd, gopts->area_src, page_size,
> +			  false, true, false))
> +		err("register src failure");
> +	if (uffd_register(gopts->uffd, gopts->area_dst, page_size,
> +			  true, false, false))

Side note: this binary encoding of features is horrible.

> +		err("register dst failure");
> +
> +	wp_range(gopts->uffd, (unsigned long)gopts->area_src, page_size, true);
> +
> +	pagemap_fd = pagemap_open();
> +	for (i = 0; i < 100; i++) {
> +		if (madvise(gopts->area_src, page_size, MADV_PAGEOUT))
> +			err("MADV_PAGEOUT");
> +		if (pagemap_is_swapped(pagemap_fd, gopts->area_src))
> +			break;
> +		usleep(10000);
> +	}

Is this loop really required? I thought the page should just be unmapped from
the page table. It might still be in the swapcache and under writeback, but
that's irrelevant.

> +	if (!pagemap_is_swapped(pagemap_fd, gopts->area_src)) {
> +		uffd_test_skip("MADV_PAGEOUT did not swap the page; is swap enabled?");
> +		goto out;
> +	}
> +
> +	move.dst = (unsigned long)gopts->area_dst;
> +	move.src = (unsigned long)gopts->area_src;
> +	move.len = page_size;
> +	if (ioctl(gopts->uffd, UFFDIO_MOVE, &move))
> +		err("UFFDIO_MOVE");
> +
> +	if (pagemap_get_entry(pagemap_fd, gopts->area_dst) & PM_UFFD_WP)
> +		uffd_test_fail("uffd-wp bit moved into an area that is not write-protected");
> +	else
> +		uffd_test_pass();
> +out:
> +	close(pagemap_fd);
> +	uffd_unregister(gopts->uffd, gopts->area_src, page_size);
> +	uffd_unregister(gopts->uffd, gopts->area_dst, page_size);
> +}
> +
>  static bool
>  uffdio_verify_results(const char *name, int ret, int error, long result)
>  {
> @@ -2359,6 +2412,14 @@ uffd_test_case_t uffd_tests[] = {
>  		.uffd_feature_required = UFFD_FEATURE_MOVE,
>  		.test_case_ops = &uffd_move_test_pmd_case_ops,
>  	},
> +	{
> +		.name = "move-swap-wp",
> +		.uffd_fn = uffd_move_swap_wp_test,
> +		.mem_targets = MEM_ANON,
> +		.uffd_feature_required = UFFD_FEATURE_MOVE |
> +		UFFD_FEATURE_PAGEFAULT_FLAG_WP,
> +		.test_case_ops = &uffd_move_test_case_ops,
> +	},
Do we also want to check wrp? I'd assume it suffers from the same problem (did
not check carefully though)

-- 
Cheers,

David