Re: [PATCH 6/6] tools/testing/selftests/mm: add MAP_PRIVATE-/dev/zero merge tests

["Lorenzo Stoakes (ARM)" <ljs@kernel.org>]

On Mon, Sep 07, 2026 at 07:08:48PM +0200, David Hildenbrand (Arm) wrote:
> On 9/2/26 20:00, Lorenzo Stoakes (ARM) wrote:
> > Assert that MAP_PRIVATE-mapped /dev/zero mappings behave like they are
> > anonymous.
> >
> > We test both unfaulted and faulted/unfaulted merges - each with the regions
> > having page offset of 0, which would not merge if the mappings were treated
> > as if they were file-backed.
> >
> > With the recent change that makes them behave as pure anonymous mappings,
> > the merges should succeed as their page offsets are equal to their
> > anonymous page offsets.
> >
> > Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
> > ---
> >  tools/testing/selftests/mm/merge.c | 104 +++++++++++++++++++++++++++++++++++++
> >  1 file changed, 104 insertions(+)
> >
> > diff --git a/tools/testing/selftests/mm/merge.c b/tools/testing/selftests/mm/merge.c
> > index 52b8727b6628..7c528d470404 100644
> > --- a/tools/testing/selftests/mm/merge.c
> > +++ b/tools/testing/selftests/mm/merge.c
> > @@ -1362,6 +1362,110 @@ TEST_F(merge, anon_and_page_offset_mismatch_memfd)
> >  	ASSERT_EQ(procmap->query.vma_end, (unsigned long)ptr + 5 * page_size);
> >  }
> >
> > +TEST_F(merge, merge_map_private_dev_zero_unfaulted)
> > +{
> > +	struct procmap_fd *procmap = &self->procmap;
> > +	unsigned int page_size = self->page_size;
> > +	char *carveout = self->carveout;
> > +	char *ptr, *ptr2;
> > +	int fd_zero;
> > +
> > +	if (access("/dev/zero", F_OK))
> > +		SKIP(return, "No /dev/zero.");
> > +	fd_zero = open("/dev/zero", O_RDWR);
> > +	ASSERT_NE(fd_zero, -1);
> > +
> > +	/*
> > +	 * Map two MAP_PRIVATE-/dev/zero VMAs next to one another with offset 0
> > +	 * each.
> > +	 *
> > +	 * With these being made truly anonymous upon mapping, they will
> > +	 * merge. If they were file-backed VMAs the page offsets would prevent
> > +	 * merge:
>
> Nit: "the" merge? You're the native speaker, so I don't know if what you have is
> just correct :)

You're right ;) native speakers are not immune from messing up grammar, as my
copy editor will tell you :P

Will fix up on respin.

>
> > +	 *
> > +	 * |-----||------|    |-------------|
> > +	 * | ptr || ptr2 | -> |     ptr     |
> > +	 * |-----||------|    |-------------|
> > +	 */
> > +	ptr = mmap(carveout, 5 * page_size, PROT_READ | PROT_WRITE,
> > +		   MAP_FIXED | MAP_PRIVATE, fd_zero, 0);
> > +	if (ptr == MAP_FAILED) {
> > +		close(fd_zero);
> > +		ASSERT_TRUE(false);
> > +	}
> > +	ptr2 = mmap(&carveout[5 * page_size], 5 * page_size,
> > +		   PROT_READ | PROT_WRITE, MAP_FIXED | MAP_PRIVATE, fd_zero, 0);
> > +	if (ptr2 == MAP_FAILED) {
> > +		close(fd_zero);
>
> Is the close() really required before the ASSERT?  After all, you're also not
> munmap'ing, so I wonder to which degree we have to clean up.
>
> So maybe this could just become a
>
> 	ASSERT_NE(ptr2, MAP_FAILED);
>
> Same for ptr above.
>
> You could likely also do
>
> ptr = mmap()
> ptr2 = mmap()
> close(fd_zero);
>
> ASSERT_NE(ptr, MAP_FAILED);
> ASSERT_NE(ptr2, MAP_FAILED);

Yeah that's easiest I think! Will fixup on respin.

>
> > +		ASSERT_TRUE(false);
> > +	}
> > +	close(fd_zero);
> > +
> > +	/* Assert that they merged. */
> > +	ASSERT_TRUE(find_vma_procmap(procmap, ptr));
> > +	ASSERT_EQ(procmap->query.vma_start, (unsigned long)ptr);
> > +	ASSERT_EQ(procmap->query.vma_end, (unsigned long)ptr + 10 * page_size);
> > +}
> > +
> > +TEST_F(merge, merge_map_private_dev_zero_faulted_unfaulted)
> > +{
> > +	struct procmap_fd *procmap = &self->procmap;
> > +	unsigned int page_size = self->page_size;
> > +	char *carveout = self->carveout;
> > +	char *ptr, *ptr2;
> > +	int fd_zero;
> > +
> > +	if (access("/dev/zero", F_OK))
> > +		SKIP(return, "No /dev/zero.");
> > +	fd_zero = open("/dev/zero", O_RDWR);
> > +	ASSERT_NE(fd_zero, -1);
> > +
> > +	/*
> > +	 * Map a MAP_PRIVATE mapping of /dev/zero with page offset 0, then fault
> > +	 * it in:
> > +	 *
> > +	 * |-------------------------------|
> > +	 * |           faulted             |
> > +	 * |-------------------------------|
> > +	 */
> > +	ptr = mmap(carveout, 15 * page_size, PROT_READ | PROT_WRITE,
> > +		   MAP_FIXED | MAP_PRIVATE, fd_zero, 0);
> > +	if (ptr == MAP_FAILED) {
> > +		close(fd_zero);
> > +		ASSERT_TRUE(false);
>
> Same question regarding cleanup requirements. The ASSERT_TRUE(false) looks a bit
> odd.

Yeah it does. This case is trickier as you then do a memset(), so maybe just
live with the 'leaked' fd in this case (the tests fail so it aborts the run at
that point anyway and tears down).

Fixed and will send respin!

>
> --
> Cheers,
>
> David

--
Cheers, Lorenzo