[PATCH v3 0/2] userfaultfd: clear the inherited uffd bit in move_swap_pte()

[PATCH v3 0/2] userfaultfd: clear the inherited uffd bit in move_swap_pte()

[Donggeun Yoo]

UFFDIO_MOVE on a swapped-out page installs the source PTE at the
destination unchanged, so a uffd bit set on a write-protected or
RWP-protected source lands in a destination VMA that was never
registered for either, and nothing clears it afterwards.  Patch 1 clears the bit, then re-arms it if
the destination is RWP-registered, which is what the present-page and
zeropage move paths already do.  Patch 2 adds the tests that catch it.

v1: https://lore.kernel.org/all/20260919004630.1159895-1-donggeunyoo.kernel@gmail.com/
v2: https://lore.kernel.org/all/20260925042907.2330519-1-donggeunyoo.kernel@gmail.com/

Changes in v3:
 - patch 1: describe the userspace-visible effects and the backport
   (Andrew Morton, David Hildenbrand)
 - patch 2: drop the MADV_PAGEOUT retry loop (David Hildenbrand)
 - patch 2: add an RWP case (David Hildenbrand)

Changes in v2:
 - patch 1: clear the bit unconditionally (Kiryl Shutsemau)
 - patch 1: rewrite the changelog for readability (Mike Rapoport)
 - add Assisted-by: LLM (Mike Rapoport)

x86_64 defconfig plus USERFAULTFD, TRANSPARENT_HUGEPAGE,
PAGE_TABLE_CHECK_ENFORCED and a swap device, under QEMU, on
6812ce4e4379:

  uffd-unit-tests                    before   after
  move-swap-wp on anon               not ok   ok
  move-swap-rwp on anon              not ok   ok
  the other 103 unit tests           ok       ok
  uffd-wp-mremap, 38 tests           ok       ok

  11 unit tests skip on both, as CONFIG_GUP_TEST is not set.

  pagemap bit 57 at the destination  before   after
  swapped page, dst not armed        set      clear
  swapped page, dst WP-armed         set      clear
  swapped page, dst RWP-armed        set      set
  resident page, dst WP-armed        clear    clear

  MADV_COLLAPSE over 2 MB at dst     EINVAL   0
  fault on the moved page at dst     WARNING  none

Donggeun Yoo (2):
  userfaultfd: clear the inherited uffd bit in move_swap_pte()
  selftests/mm: add tests for UFFDIO_MOVE of a uffd-protected swap entry

 mm/userfaultfd.c                             |  1 +
 tools/testing/selftests/mm/uffd-unit-tests.c | 84 ++++++++++++++++++++
 2 files changed, 85 insertions(+)

-- 
2.53.0

[PATCH v3 1/2] userfaultfd: clear the inherited uffd bit in move_swap_pte()

[Donggeun Yoo]

UFFDIO_MOVE on a swapped-out page installs the source PTE at the
destination unchanged, so a uffd bit set on a write-protected or
RWP-protected source lands in a destination VMA that was never
registered for either.  Nothing clears it there, and userspace sees:

 - /proc/<pid>/pagemap reports the page as uffd-tracked (bit 57), both
   while it is swapped out and after it is faulted back in.
 - MADV_COLLAPSE fails with EINVAL on a range containing it, because the
   collapse scan bails on a swap entry with the uffd bit set.
 - With CONFIG_PAGE_TABLE_CHECK, faulting the page in warns.
   do_swap_page() carries the bit into the present PTE and, since the
   destination isn't WP-registered, also makes it writable:

   WARNING: mm/page_table_check.c:202 at __page_table_check_ptes_set+0x185/0x1e0
   Call Trace:
    set_ptes+0x67/0xc0
    do_swap_page+0x990/0xfe0
    __handle_mm_fault+0x7d0/0xeb0
    handle_mm_fault+0x9c/0x250
    do_user_addr_fault+0x207/0x650
    exc_page_fault+0x65/0x150
    asm_exc_page_fault+0x26/0x30

Reaching it takes UFFDIO_MOVE out of a WP- or RWP-protected area into
one that isn't, on a page that is swapped out at the time.  It hasn't
been seen in practice.

A resident page doesn't carry the bit, because move_present_ptes() builds
the destination PTE from dst_vma->vm_page_prot.  Clear it on the moved
swap entry as well, then re-arm it if the destination is RWP-registered.

The WP case has been there since v6.8, where UFFDIO_MOVE was added.

Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Cc: <stable@vger.kernel.org>
Assisted-by: LLM
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
---
 mm/userfaultfd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 74f04c323c50f..f39f109f17989 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -1449,6 +1449,7 @@ static int move_swap_pte(struct mm_struct *mm, struct vm_area_struct *dst_vma,
 	orig_src_pte = ptep_get_and_clear(mm, src_addr, src_pte);
 	if (pgtable_supports_soft_dirty())
 		orig_src_pte = pte_swp_mksoft_dirty(orig_src_pte);
+	orig_src_pte = pte_swp_clear_uffd(orig_src_pte);
 	/* Re-arm RWP on the moved swap entry if dst_vma is RWP-registered. */
 	if (userfaultfd_rwp(dst_vma))
 		orig_src_pte = pte_swp_mkuffd(orig_src_pte);
-- 
2.53.0

[PATCH v3 2/2] selftests/mm: add tests for UFFDIO_MOVE of a uffd-protected swap entry

[Donggeun Yoo]

Move a swapped-out page out of a write-protected or RWP-protected area into
a destination registered for missing faults only, and read pagemap bit 57
at the destination.  The destination was never protected, so the bit must
be clear.

Assisted-by: LLM
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
---
 tools/testing/selftests/mm/uffd-unit-tests.c | 84 ++++++++++++++++++++
 1 file changed, 84 insertions(+)

diff --git a/tools/testing/selftests/mm/uffd-unit-tests.c b/tools/testing/selftests/mm/uffd-unit-tests.c
index ef9b3956bdcfd..580178630eded 100644
--- a/tools/testing/selftests/mm/uffd-unit-tests.c
+++ b/tools/testing/selftests/mm/uffd-unit-tests.c
@@ -2037,6 +2037,75 @@ static void uffd_move_pmd_split_test(uffd_global_test_opts_t *gopts, uffd_test_a
 			      uffd_move_pmd_handle_fault);
 }
 
+/*
+ * Moving a swapped-out page out of a write-protected or RWP-protected area
+ * must not carry the uffd bit into a destination registered for missing
+ * faults only: such a bit is never cleared afterwards, so pagemap keeps
+ * reporting the page as uffd-tracked.
+ *
+ * Needs a swap device; skipped if MADV_PAGEOUT cannot evict the page.
+ */
+static void uffd_move_swap_test_common(uffd_global_test_opts_t *gopts,
+				       bool rwp)
+{
+	unsigned long page_size = gopts->page_size;
+	struct uffdio_move move = { };
+	int pagemap_fd;
+
+	if (rwp) {
+		if (uffd_register_rwp(gopts->uffd, gopts->area_src, page_size))
+			err("register src failure");
+	} else if (uffd_register(gopts->uffd, gopts->area_src, page_size,
+				 false, true, false)) {
+		err("register src failure");
+	}
+	if (uffd_register(gopts->uffd, gopts->area_dst, page_size,
+			  true, false, false))
+		err("register dst failure");
+
+	if (rwp)
+		rwprotect_range(gopts->uffd, (unsigned long)gopts->area_src,
+				page_size, true);
+	else
+		wp_range(gopts->uffd, (unsigned long)gopts->area_src,
+			 page_size, true);
+
+	pagemap_fd = pagemap_open();
+	if (madvise(gopts->area_src, page_size, MADV_PAGEOUT))
+		err("MADV_PAGEOUT");
+	if (!pagemap_is_swapped(pagemap_fd, gopts->area_src)) {
+		uffd_test_skip("MADV_PAGEOUT did not swap the page; is swap enabled?");
+		goto out;
+	}
+
+	move.dst = (unsigned long)gopts->area_dst;
+	move.src = (unsigned long)gopts->area_src;
+	move.len = page_size;
+	if (ioctl(gopts->uffd, UFFDIO_MOVE, &move))
+		err("UFFDIO_MOVE");
+
+	if (pagemap_get_entry(pagemap_fd, gopts->area_dst) & PM_UFFD_WP)
+		uffd_test_fail("uffd bit moved into an area registered for missing faults only");
+	else
+		uffd_test_pass();
+out:
+	close(pagemap_fd);
+	uffd_unregister(gopts->uffd, gopts->area_src, page_size);
+	uffd_unregister(gopts->uffd, gopts->area_dst, page_size);
+}
+
+static void uffd_move_swap_wp_test(uffd_global_test_opts_t *gopts,
+				   uffd_test_args_t *targs)
+{
+	uffd_move_swap_test_common(gopts, false);
+}
+
+static void uffd_move_swap_rwp_test(uffd_global_test_opts_t *gopts,
+				    uffd_test_args_t *targs)
+{
+	uffd_move_swap_test_common(gopts, true);
+}
+
 static bool
 uffdio_verify_results(const char *name, int ret, int error, long result)
 {
@@ -2359,6 +2428,21 @@ uffd_test_case_t uffd_tests[] = {
 		.uffd_feature_required = UFFD_FEATURE_MOVE,
 		.test_case_ops = &uffd_move_test_pmd_case_ops,
 	},
+	{
+		.name = "move-swap-wp",
+		.uffd_fn = uffd_move_swap_wp_test,
+		.mem_targets = MEM_ANON,
+		.uffd_feature_required = UFFD_FEATURE_MOVE |
+		UFFD_FEATURE_PAGEFAULT_FLAG_WP,
+		.test_case_ops = &uffd_move_test_case_ops,
+	},
+	{
+		.name = "move-swap-rwp",
+		.uffd_fn = uffd_move_swap_rwp_test,
+		.mem_targets = MEM_ANON,
+		.uffd_feature_required = UFFD_FEATURE_MOVE | UFFD_FEATURE_RWP,
+		.test_case_ops = &uffd_move_test_case_ops,
+	},
 	{
 		.name = "wp-fork",
 		.uffd_fn = uffd_wp_fork_test,
-- 
2.53.0

Re: [PATCH v3 1/2] userfaultfd: clear the inherited uffd bit in move_swap_pte()

[Andrew Morton]

On Sat, 26 Sep 2026 21:41:44 +0900 Donggeun Yoo <donggeunyoo.kernel@gmail.com> wrote:

> UFFDIO_MOVE on a swapped-out page installs the source PTE at the
> destination unchanged, so a uffd bit set on a write-protected or
> RWP-protected source lands in a destination VMA that was never
> registered for either.  Nothing clears it there, and userspace sees:
> 
>  - /proc/<pid>/pagemap reports the page as uffd-tracked (bit 57), both
>    while it is swapped out and after it is faulted back in.
>  - MADV_COLLAPSE fails with EINVAL on a range containing it, because the
>    collapse scan bails on a swap entry with the uffd bit set.
>  - With CONFIG_PAGE_TABLE_CHECK, faulting the page in warns.
>    do_swap_page() carries the bit into the present PTE and, since the
>    destination isn't WP-registered, also makes it writable:
> 
>    WARNING: mm/page_table_check.c:202 at __page_table_check_ptes_set+0x185/0x1e0
>    Call Trace:
>     set_ptes+0x67/0xc0
>     do_swap_page+0x990/0xfe0
>     __handle_mm_fault+0x7d0/0xeb0
>     handle_mm_fault+0x9c/0x250
>     do_user_addr_fault+0x207/0x650
>     exc_page_fault+0x65/0x150
>     asm_exc_page_fault+0x26/0x30
> 
> Reaching it takes UFFDIO_MOVE out of a WP- or RWP-protected area into
> one that isn't, on a page that is swapped out at the time.  It hasn't
> been seen in practice.
> 
> A resident page doesn't carry the bit, because move_present_ptes() builds
> the destination PTE from dst_vma->vm_page_prot.  Clear it on the moved
> swap entry as well, then re-arm it if the destination is RWP-registered.
> 
> The WP case has been there since v6.8, where UFFDIO_MOVE was added.

Thanks.  This is triggerable by unprivileged userspace, so can
reviewers please prioritize.

> Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
> Cc: <stable@vger.kernel.org>

This should be whizzed into 7.3-rcX pretty promptly.

It's not really appropriate to give the selftest such treatment - I'm
never really sure how to handle that.  I guess I'll keep things as you
presented them - both for current -rc, [1/2] gets backported, [2/2]
does not.

> --- a/mm/userfaultfd.c
> +++ b/mm/userfaultfd.c
> @@ -1449,6 +1449,7 @@ static int move_swap_pte(struct mm_struct *mm, struct vm_area_struct *dst_vma,
>  	orig_src_pte = ptep_get_and_clear(mm, src_addr, src_pte);
>  	if (pgtable_supports_soft_dirty())
>  		orig_src_pte = pte_swp_mksoft_dirty(orig_src_pte);
> +	orig_src_pte = pte_swp_clear_uffd(orig_src_pte);
>  	/* Re-arm RWP on the moved swap entry if dst_vma is RWP-registered. */
>  	if (userfaultfd_rwp(dst_vma))
>  		orig_src_pte = pte_swp_mkuffd(orig_src_pte);
> -- 
> 2.53.0

Re: [PATCH v3 1/2] userfaultfd: clear the inherited uffd bit in move_swap_pte()

[David Hildenbrand (Arm)]

On 9/27/26 22:54, Andrew Morton wrote:
> On Sat, 26 Sep 2026 21:41:44 +0900 Donggeun Yoo <donggeunyoo.kernel@gmail.com> wrote:
> 
>> UFFDIO_MOVE on a swapped-out page installs the source PTE at the
>> destination unchanged, so a uffd bit set on a write-protected or
>> RWP-protected source lands in a destination VMA that was never
>> registered for either.  Nothing clears it there, and userspace sees:
>>
>>  - /proc/<pid>/pagemap reports the page as uffd-tracked (bit 57), both
>>    while it is swapped out and after it is faulted back in.
>>  - MADV_COLLAPSE fails with EINVAL on a range containing it, because the
>>    collapse scan bails on a swap entry with the uffd bit set.
>>  - With CONFIG_PAGE_TABLE_CHECK, faulting the page in warns.
>>    do_swap_page() carries the bit into the present PTE and, since the
>>    destination isn't WP-registered, also makes it writable:
>>
>>    WARNING: mm/page_table_check.c:202 at __page_table_check_ptes_set+0x185/0x1e0
>>    Call Trace:
>>     set_ptes+0x67/0xc0
>>     do_swap_page+0x990/0xfe0
>>     __handle_mm_fault+0x7d0/0xeb0
>>     handle_mm_fault+0x9c/0x250
>>     do_user_addr_fault+0x207/0x650
>>     exc_page_fault+0x65/0x150
>>     asm_exc_page_fault+0x26/0x30
>>
>> Reaching it takes UFFDIO_MOVE out of a WP- or RWP-protected area into
>> one that isn't, on a page that is swapped out at the time.  It hasn't
>> been seen in practice.
>>
>> A resident page doesn't carry the bit, because move_present_ptes() builds
>> the destination PTE from dst_vma->vm_page_prot.  Clear it on the moved
>> swap entry as well, then re-arm it if the destination is RWP-registered.
>>
>> The WP case has been there since v6.8, where UFFDIO_MOVE was added.
> 
> Thanks.  This is triggerable by unprivileged userspace, so can
> reviewers please prioritize.

I assume most production kernels don't have CONFIG_PAGE_TABLE_CHECK enabled in
the config. And if enabled, not active at runtime.

I'd assume mostly only debug kernels have that config ever enabled. So it might
be less problematic than it seems at first. (at least the WARNING bit)

> 
>> Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
>> Cc: <stable@vger.kernel.org>
> 
> This should be whizzed into 7.3-rcX pretty promptly.
> 
> It's not really appropriate to give the selftest such treatment - I'm
> never really sure how to handle that.  I guess I'll keep things as you
> presented them - both for current -rc, [1/2] gets backported, [2/2]
> does not.

Make sense.

> 
>> --- a/mm/userfaultfd.c
>> +++ b/mm/userfaultfd.c
>> @@ -1449,6 +1449,7 @@ static int move_swap_pte(struct mm_struct *mm, struct vm_area_struct *dst_vma,
>>  	orig_src_pte = ptep_get_and_clear(mm, src_addr, src_pte);
>>  	if (pgtable_supports_soft_dirty())
>>  		orig_src_pte = pte_swp_mksoft_dirty(orig_src_pte);
>> +	orig_src_pte = pte_swp_clear_uffd(orig_src_pte);
>>  	/* Re-arm RWP on the moved swap entry if dst_vma is RWP-registered. */
>>  	if (userfaultfd_rwp(dst_vma))
>>  		orig_src_pte = pte_swp_mkuffd(orig_src_pte);
>> -- 
>> 2.53.0

Acked-by: David Hildenbrand (Arm) <david@kernel.org>

-- 
Cheers,

David

Re: [PATCH v3 2/2] selftests/mm: add tests for UFFDIO_MOVE of a uffd-protected swap entry

[David Hildenbrand (Arm)]

On 9/26/26 14:41, Donggeun Yoo wrote:
> Move a swapped-out page out of a write-protected or RWP-protected area into
> a destination registered for missing faults only, and read pagemap bit 57
> at the destination.  The destination was never protected, so the bit must
> be clear.
> 
> Assisted-by: LLM
> Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
> ---
>  tools/testing/selftests/mm/uffd-unit-tests.c | 84 ++++++++++++++++++++
>  1 file changed, 84 insertions(+)
> 
> diff --git a/tools/testing/selftests/mm/uffd-unit-tests.c b/tools/testing/selftests/mm/uffd-unit-tests.c
> index ef9b3956bdcfd..580178630eded 100644
> --- a/tools/testing/selftests/mm/uffd-unit-tests.c
> +++ b/tools/testing/selftests/mm/uffd-unit-tests.c
> @@ -2037,6 +2037,75 @@ static void uffd_move_pmd_split_test(uffd_global_test_opts_t *gopts, uffd_test_a
>  			      uffd_move_pmd_handle_fault);
>  }
>  
> +/*
> + * Moving a swapped-out page out of a write-protected or RWP-protected area
> + * must not carry the uffd bit into a destination registered for missing
> + * faults only: such a bit is never cleared afterwards, so pagemap keeps
> + * reporting the page as uffd-tracked.
> + *
> + * Needs a swap device; skipped if MADV_PAGEOUT cannot evict the page.
> + */
> +static void uffd_move_swap_test_common(uffd_global_test_opts_t *gopts,
> +				       bool rwp)
> +{
> +	unsigned long page_size = gopts->page_size;
> +	struct uffdio_move move = { };
> +	int pagemap_fd;
> +
> +	if (rwp) {
> +		if (uffd_register_rwp(gopts->uffd, gopts->area_src, page_size))
> +			err("register src failure");
> +	} else if (uffd_register(gopts->uffd, gopts->area_src, page_size,
> +				 false, true, false)) {
> +		err("register src failure");
> +	}

if ()

> +	if (uffd_register(gopts->uffd, gopts->area_dst, page_size,
> +			  true, false, false))
> +		err("register dst failure");
> +
> +	if (rwp)
> +		rwprotect_range(gopts->uffd, (unsigned long)gopts->area_src,
> +				page_size, true);
> +	else
> +		wp_range(gopts->uffd, (unsigned long)gopts->area_src,
> +			 page_size, true);
> +
> +	pagemap_fd = pagemap_open();
> +	if (madvise(gopts->area_src, page_size, MADV_PAGEOUT))
> +		err("MADV_PAGEOUT");
> +	if (!pagemap_is_swapped(pagemap_fd, gopts->area_src)) {
> +		uffd_test_skip("MADV_PAGEOUT did not swap the page; is swap enabled?");
> +		goto out;
> +	}
> +
> +	move.dst = (unsigned long)gopts->area_dst;
> +	move.src = (unsigned long)gopts->area_src;
> +	move.len = page_size;
> +	if (ioctl(gopts->uffd, UFFDIO_MOVE, &move))
> +		err("UFFDIO_MOVE");
> +
> +	if (pagemap_get_entry(pagemap_fd, gopts->area_dst) & PM_UFFD_WP)
> +		uffd_test_fail("uffd bit moved into an area registered for missing faults only");
> +	else
> +		uffd_test_pass();
> +out:
> +	close(pagemap_fd);
> +	uffd_unregister(gopts->uffd, gopts->area_src, page_size);
> +	uffd_unregister(gopts->uffd, gopts->area_dst, page_size);
> +}
> +
> +static void uffd_move_swap_wp_test(uffd_global_test_opts_t *gopts,
> +				   uffd_test_args_t *targs)
> +{
> +	uffd_move_swap_test_common(gopts, false);
> +}
> +
> +static void uffd_move_swap_rwp_test(uffd_global_test_opts_t *gopts,
> +				    uffd_test_args_t *targs)
> +{
> +	uffd_move_swap_test_common(gopts, true);
> +}
> +
>  static bool
>  uffdio_verify_results(const char *name, int ret, int error, long result)
>  {
> @@ -2359,6 +2428,21 @@ uffd_test_case_t uffd_tests[] = {
>  		.uffd_feature_required = UFFD_FEATURE_MOVE,
>  		.test_case_ops = &uffd_move_test_pmd_case_ops,
>  	},
> +	{
> +		.name = "move-swap-wp",
> +		.uffd_fn = uffd_move_swap_wp_test,
> +		.mem_targets = MEM_ANON,
> +		.uffd_feature_required = UFFD_FEATURE_MOVE |
> +		UFFD_FEATURE_PAGEFAULT_FLAG_WP,
> +		.test_case_ops = &uffd_move_test_case_ops,
> +	},
> +	{
> +		.name = "move-swap-rwp",
> +		.uffd_fn = uffd_move_swap_rwp_test,
> +		.mem_targets = MEM_ANON,
> +		.uffd_feature_required = UFFD_FEATURE_MOVE | UFFD_FEATURE_RWP,
> +		.test_case_ops = &uffd_move_test_case_ops,
> +	},
>  	{
>  		.name = "wp-fork",
>  		.uffd_fn = uffd_wp_fork_test,


-- 
Cheers,

David

Re: [PATCH v3 2/2] selftests/mm: add tests for UFFDIO_MOVE of a uffd-protected swap entry

[David Hildenbrand (Arm)]

On 9/28/26 10:53, David Hildenbrand (Arm) wrote:
> On 9/26/26 14:41, Donggeun Yoo wrote:
>> Move a swapped-out page out of a write-protected or RWP-protected area into
>> a destination registered for missing faults only, and read pagemap bit 57
>> at the destination.  The destination was never protected, so the bit must
>> be clear.
>>
>> Assisted-by: LLM
>> Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
>> ---
>>  tools/testing/selftests/mm/uffd-unit-tests.c | 84 ++++++++++++++++++++
>>  1 file changed, 84 insertions(+)
>>
>> diff --git a/tools/testing/selftests/mm/uffd-unit-tests.c b/tools/testing/selftests/mm/uffd-unit-tests.c
>> index ef9b3956bdcfd..580178630eded 100644
>> --- a/tools/testing/selftests/mm/uffd-unit-tests.c
>> +++ b/tools/testing/selftests/mm/uffd-unit-tests.c
>> @@ -2037,6 +2037,75 @@ static void uffd_move_pmd_split_test(uffd_global_test_opts_t *gopts, uffd_test_a
>>  			      uffd_move_pmd_handle_fault);
>>  }
>>  
>> +/*
>> + * Moving a swapped-out page out of a write-protected or RWP-protected area
>> + * must not carry the uffd bit into a destination registered for missing
>> + * faults only: such a bit is never cleared afterwards, so pagemap keeps
>> + * reporting the page as uffd-tracked.
>> + *
>> + * Needs a swap device; skipped if MADV_PAGEOUT cannot evict the page.
>> + */
>> +static void uffd_move_swap_test_common(uffd_global_test_opts_t *gopts,
>> +				       bool rwp)
>> +{
>> +	unsigned long page_size = gopts->page_size;
>> +	struct uffdio_move move = { };
>> +	int pagemap_fd;
>> +
>> +	if (rwp) {
>> +		if (uffd_register_rwp(gopts->uffd, gopts->area_src, page_size))
>> +			err("register src failure");
>> +	} else if (uffd_register(gopts->uffd, gopts->area_src, page_size,
>> +				 false, true, false)) {
>> +		err("register src failure");
>> +	}
> 
> if ()

Clicked sent by accident ... let me reply once more.

-- 
Cheers,

David

Re: [PATCH v3 2/2] selftests/mm: add tests for UFFDIO_MOVE of a uffd-protected swap entry

[David Hildenbrand (Arm)]

On 9/26/26 14:41, Donggeun Yoo wrote:
> Move a swapped-out page out of a write-protected or RWP-protected area into
> a destination registered for missing faults only, and read pagemap bit 57
> at the destination.  The destination was never protected, so the bit must
> be clear.
> 
> Assisted-by: LLM
> Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
> ---
>  tools/testing/selftests/mm/uffd-unit-tests.c | 84 ++++++++++++++++++++
>  1 file changed, 84 insertions(+)
> 
> diff --git a/tools/testing/selftests/mm/uffd-unit-tests.c b/tools/testing/selftests/mm/uffd-unit-tests.c
> index ef9b3956bdcfd..580178630eded 100644
> --- a/tools/testing/selftests/mm/uffd-unit-tests.c
> +++ b/tools/testing/selftests/mm/uffd-unit-tests.c
> @@ -2037,6 +2037,75 @@ static void uffd_move_pmd_split_test(uffd_global_test_opts_t *gopts, uffd_test_a
>  			      uffd_move_pmd_handle_fault);
>  }
>  
> +/*
> + * Moving a swapped-out page out of a write-protected or RWP-protected area
> + * must not carry the uffd bit into a destination registered for missing
> + * faults only: such a bit is never cleared afterwards, so pagemap keeps
> + * reporting the page as uffd-tracked.
> + *
> + * Needs a swap device; skipped if MADV_PAGEOUT cannot evict the page.
> + */
> +static void uffd_move_swap_test_common(uffd_global_test_opts_t *gopts,
> +				       bool rwp)
> +{
> +	unsigned long page_size = gopts->page_size;
> +	struct uffdio_move move = { };
> +	int pagemap_fd;
> +
> +	if (rwp) {
> +		if (uffd_register_rwp(gopts->uffd, gopts->area_src, page_size))
> +			err("register src failure");
> +	} else if (uffd_register(gopts->uffd, gopts->area_src, page_size,
> +				 false, true, false)) {
> +		err("register src failure");
> +	}

Why not combine it with the protection?


	if (rwp) {
		if (uffd_register_rwp(gopts->uffd, gopts->area_src, page_size))
			err("register src failure");
		rwprotect_range(gopts->uffd, (unsigned long)gopts->area_src,
				page_size, true);
	} else {
		if (uffd_register(gopts->uffd, gopts->area_src, page_size,
				 false, true, false))
			err("register src failure");
		wp_range(gopts->uffd, (unsigned long)gopts->area_src,
			 page_size, true);
	}


> +	if (uffd_register(gopts->uffd, gopts->area_dst, page_size,
> +			  true, false, false))
> +		err("register dst failure");
> +
> +	if (rwp)
> +		rwprotect_range(gopts->uffd, (unsigned long)gopts->area_src,
> +				page_size, true);
> +	else
> +		wp_range(gopts->uffd, (unsigned long)gopts->area_src,
> +			 page_size, true);
> +
> +	pagemap_fd = pagemap_open();

Why not do that at the very top?

	int pagemap_fd = pagemap_open();

> +	if (madvise(gopts->area_src, page_size, MADV_PAGEOUT))
> +		err("MADV_PAGEOUT");
> +	if (!pagemap_is_swapped(pagemap_fd, gopts->area_src)) {
> +		uffd_test_skip("MADV_PAGEOUT did not swap the page; is swap enabled?");
> +		goto out;
> +	}
> +
> +	move.dst = (unsigned long)gopts->area_dst;
> +	move.src = (unsigned long)gopts->area_src;
> +	move.len = page_size;

You can set that all already when initializing aboce

struct uffdio_move move = {
	.dst = (unsigned long)gopts->area_dst,
	[...]
};

> +	if (ioctl(gopts->uffd, UFFDIO_MOVE, &move))
> +		err("UFFDIO_MOVE");
BTW, why do we fail the entire test here instead of only this test case?

-- 
Cheers,

David