[PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[Zenghui Yu]

From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>

uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
chunks of chunk_size and moves them one by one.  On arm64 with 64K base
pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
the whole 32MB (UFFD_TEST_MEM_SIZE) test area:

  step_count = nr_pages / (chunk_size / page_size) == 0

Because chunk_size > page_size, the test then aligns both areas up to
512MB, which points far outside of the 32MB mappings, and decrements
step_count, which underflows to ULONG_MAX.  The verification loop then
runs away and the first dereference of area_src faults with a SIGSEGV.

Skip the test when a single chunk cannot fit into the test area.

Fixes: a2bf6a9ca805 ("selftests/mm: add UFFDIO_MOVE ioctl test")
Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
---
 tools/testing/selftests/mm/uffd-unit-tests.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/testing/selftests/mm/uffd-unit-tests.c b/tools/testing/selftests/mm/uffd-unit-tests.c
index ef9b3956bdcf..2a97ba1d6feb 100644
--- a/tools/testing/selftests/mm/uffd-unit-tests.c
+++ b/tools/testing/selftests/mm/uffd-unit-tests.c
@@ -1937,6 +1937,11 @@ uffd_move_test_common(uffd_global_test_opts_t *gopts,
 
 	args.gopts = gopts;
 
+	if (chunk_size > gopts->nr_pages * gopts->page_size) {
+		uffd_test_skip("chunk size does not fit in the test area");
+		return;
+	}
+
 	/* Prevent source pages from being mapped more than once */
 	if (madvise(gopts->area_src, gopts->nr_pages * gopts->page_size, MADV_DONTFORK))
 		err("madvise(MADV_DONTFORK) failure");
-- 
2.53.0

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[Sarthak Sharma]

Hi Zenghui!

On 10/11/26 10:05 PM, Zenghui Yu wrote:
> From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
> 
> uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
> chunks of chunk_size and moves them one by one.  On arm64 with 64K base
> pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
> the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
> 
>   step_count = nr_pages / (chunk_size / page_size) == 0
> 
> Because chunk_size > page_size, the test then aligns both areas up to
> 512MB, which points far outside of the 32MB mappings, and decrements
> step_count, which underflows to ULONG_MAX.  The verification loop then
> runs away and the first dereference of area_src faults with a SIGSEGV.
> 
> Skip the test when a single chunk cannot fit into the test area.
> 
> Fixes: a2bf6a9ca805 ("selftests/mm: add UFFDIO_MOVE ioctl test")
> Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
> ---

I run the test on a 64k kernel. Before the patch, a segmentation fault
occurred, which was fixed by the patch. So:

Tested-by: Sarthak Sharma <sarthak.sharma@arm.com>

Though Sashiko has a few nits [1] you might take a look at.

[1]
https://sashiko.dev/#/patchset/20261011163527.95988-1-zenghui.yu%40linux.dev

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[Jose A. Perez de Azpillaga]

On Mon, Oct 12, 2026 at 12:35:27AM +0800, Zenghui Yu wrote:
> From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
> 
> uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
> chunks of chunk_size and moves them one by one.  On arm64 with 64K base
> pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
> the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
> 
>   step_count = nr_pages / (chunk_size / page_size) == 0
> 
> Because chunk_size > page_size, the test then aligns both areas up to
> 512MB, which points far outside of the 32MB mappings, and decrements
> step_count, which underflows to ULONG_MAX.  The verification loop then
> runs away and the first dereference of area_src faults with a SIGSEGV.
> 
> Skip the test when a single chunk cannot fit into the test area.
> 
> Fixes: a2bf6a9ca805 ("selftests/mm: add UFFDIO_MOVE ioctl test")
> Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
> ---
>  tools/testing/selftests/mm/uffd-unit-tests.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/tools/testing/selftests/mm/uffd-unit-tests.c b/tools/testing/selftests/mm/uffd-unit-tests.c
> index ef9b3956bdcf..2a97ba1d6feb 100644
> --- a/tools/testing/selftests/mm/uffd-unit-tests.c
> +++ b/tools/testing/selftests/mm/uffd-unit-tests.c
> @@ -1937,6 +1937,11 @@ uffd_move_test_common(uffd_global_test_opts_t *gopts,
>  
>  	args.gopts = gopts;
>  
> +	if (chunk_size > gopts->nr_pages * gopts->page_size) {
> +		uffd_test_skip("chunk size does not fit in the test area");
> +		return;
> +	}
> +
>  	/* Prevent source pages from being mapped more than once */
>  	if (madvise(gopts->area_src, gopts->nr_pages * gopts->page_size, MADV_DONTFORK))
>  		err("madvise(MADV_DONTFORK) failure");
> -- 
> 2.53.0
> 
> 

LGTM.

Reviewed-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>

-- 
cheers,
jose a. p-a

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[David Hildenbrand (Arm)]

On 10/11/26 18:35, Zenghui Yu wrote:
> From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
> 
> uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
> chunks of chunk_size and moves them one by one.  On arm64 with 64K base
> pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
> the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
> 
>   step_count = nr_pages / (chunk_size / page_size) == 0
> 
> Because chunk_size > page_size, the test then aligns both areas up to
> 512MB, which points far outside of the 32MB mappings, and decrements
> step_count, which underflows to ULONG_MAX.  The verification loop then
> runs away and the first dereference of area_src faults with a SIGSEGV.
> 
> Skip the test when a single chunk cannot fit into the test area.

That leaves 64k untested, though? Why not adjust the chunk size accordingly?

-- 
Cheers,

David

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[Mike Rapoport]

On Tue, Oct 13, 2026 at 09:39:54AM +0200, David Hildenbrand (Arm) wrote:
> On 10/11/26 18:35, Zenghui Yu wrote:
> > From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
> > 
> > uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
> > chunks of chunk_size and moves them one by one.  On arm64 with 64K base
> > pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
> > the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
> > 
> >   step_count = nr_pages / (chunk_size / page_size) == 0
> > 
> > Because chunk_size > page_size, the test then aligns both areas up to
> > 512MB, which points far outside of the 32MB mappings, and decrements
> > step_count, which underflows to ULONG_MAX.  The verification loop then
> > runs away and the first dereference of area_src faults with a SIGSEGV.
> > 
> > Skip the test when a single chunk cannot fit into the test area.
> 
> That leaves 64k untested, though? Why not adjust the chunk size accordingly?

To test anything PMD on arm64 with 64k pages we need to adjust
UFFD_TEST_MEM_SIZE to have at least 4 pages, i.e 2G :)

Maybe we want UFFD_TEST_MEM_SIZE to scale with the page size?
 
> -- 
> Cheers,
> 
> David

-- 
Sincerely yours,
Mike.

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[David Hildenbrand (Arm)]

On 10/13/26 12:33, Mike Rapoport wrote:
> On Tue, Oct 13, 2026 at 09:39:54AM +0200, David Hildenbrand (Arm) wrote:
>> On 10/11/26 18:35, Zenghui Yu wrote:
>>> From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
>>>
>>> uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
>>> chunks of chunk_size and moves them one by one.  On arm64 with 64K base
>>> pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
>>> the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
>>>
>>>   step_count = nr_pages / (chunk_size / page_size) == 0
>>>
>>> Because chunk_size > page_size, the test then aligns both areas up to
>>> 512MB, which points far outside of the 32MB mappings, and decrements
>>> step_count, which underflows to ULONG_MAX.  The verification loop then
>>> runs away and the first dereference of area_src faults with a SIGSEGV.
>>>
>>> Skip the test when a single chunk cannot fit into the test area.
>>
>> That leaves 64k untested, though? Why not adjust the chunk size accordingly?
> 
> To test anything PMD on arm64 with 64k pages we need to adjust
> UFFD_TEST_MEM_SIZE to have at least 4 pages, i.e 2G :)
> 
> Maybe we want UFFD_TEST_MEM_SIZE to scale with the page size?

That was my thought. If you have 64k you better also have plenty of memory :)

-- 
Cheers,

David

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[Zenghui Yu]

Hi Sarthak,

On 10/12/26 2:13 PM, Sarthak Sharma wrote:
> Hi Zenghui!
> 
> On 10/11/26 10:05 PM, Zenghui Yu wrote:
> > From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
> >
> > uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
> > chunks of chunk_size and moves them one by one.  On arm64 with 64K base
> > pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
> > the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
> >
> >   step_count = nr_pages / (chunk_size / page_size) == 0
> >
> > Because chunk_size > page_size, the test then aligns both areas up to
> > 512MB, which points far outside of the 32MB mappings, and decrements
> > step_count, which underflows to ULONG_MAX.  The verification loop then
> > runs away and the first dereference of area_src faults with a SIGSEGV.
> >
> > Skip the test when a single chunk cannot fit into the test area.
> >
> > Fixes: a2bf6a9ca805 ("selftests/mm: add UFFDIO_MOVE ioctl test")
> > Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
> > ---
> 
> I run the test on a 64k kernel. Before the patch, a segmentation fault
> occurred, which was fixed by the patch. So:
> 
> Tested-by: Sarthak Sharma <sarthak.sharma@arm.com>

Thanks a lot!

> Though Sashiko has a few nits [1] you might take a look at.
> 
> [1]
> https://sashiko.dev/#/patchset/20261011163527.95988-1-zenghui.yu%40linux.dev

I think both of these comments are valid and worth fixing, but I don't have
much bandwidth to work on them in the next few days. If you are interested,
please feel free to fix them up and post the follow-up. I'm happy to review
and test it.

Thanks again,
Zenghui

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[Zenghui Yu]

Hi David,

On 10/13/26 3:39 PM, David Hildenbrand (Arm) wrote:
> On 10/11/26 18:35, Zenghui Yu wrote:
> > From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
> >
> > uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
> > chunks of chunk_size and moves them one by one.  On arm64 with 64K base
> > pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
> > the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
> >
> >   step_count = nr_pages / (chunk_size / page_size) == 0
> >
> > Because chunk_size > page_size, the test then aligns both areas up to
> > 512MB, which points far outside of the 32MB mappings, and decrements
> > step_count, which underflows to ULONG_MAX.  The verification loop then
> > runs away and the first dereference of area_src faults with a SIGSEGV.
> >
> > Skip the test when a single chunk cannot fit into the test area.
> 
> That leaves 64k untested, though? Why not adjust the chunk size accordingly?

Right. Apparently this has never been tested on 64k :)

I agree that scaling the chunk size is the better approach -- it gives us
actual test coverage on such configuration, instead of bailing out early.

If anyone is interested in it, please feel free to send a patch. Otherwise
I'll work on it when I get some spare time.

Thanks,
Zenghui

Re: [PATCH] selftests/mm: fix uffd move-pmd test crash on 64K base page systems

[David Hildenbrand (Arm)]

On 10/29/26 14:37, Zenghui Yu wrote:
> Hi David,
> 
> On 10/13/26 3:39 PM, David Hildenbrand (Arm) wrote:
>> On 10/11/26 18:35, Zenghui Yu wrote:
>>> From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
>>>
>>> uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
>>> chunks of chunk_size and moves them one by one.  On arm64 with 64K base
>>> pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
>>> the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
>>>
>>>   step_count = nr_pages / (chunk_size / page_size) == 0
>>>
>>> Because chunk_size > page_size, the test then aligns both areas up to
>>> 512MB, which points far outside of the 32MB mappings, and decrements
>>> step_count, which underflows to ULONG_MAX.  The verification loop then
>>> runs away and the first dereference of area_src faults with a SIGSEGV.
>>>
>>> Skip the test when a single chunk cannot fit into the test area.
>>
>> That leaves 64k untested, though? Why not adjust the chunk size accordingly?
> 
> Right. Apparently this has never been tested on 64k :)

Yeah. And if we start supporting it we should properly test it :)

> 
> I agree that scaling the chunk size is the better approach -- it gives us
> actual test coverage on such configuration, instead of bailing out early.
> 
> If anyone is interested in it, please feel free to send a patch. Otherwise
> I'll work on it when I get some spare time.
I guess no rush on this one.

-- 
Cheers,

David

[PATCH] selftests/mm: scale uffd memory region contingent upon base page size

[John J. Coleman]

When executing the uffd-unit-test, the "move-pmd on anon" test will fail on
aarch64+64k with a segmentation fault because the initial allocated memory
region is too small.  This only happens with the move-pmd* tests because the
architecture base page size is still utilized even though the memory region is
specific to the size indicated by the pmd.

Patch 9f5c2aec3388 ("selftests/mm: fix uffd move-pmd test crash on 64K base page
systems") implements an initial fix to the segmentation fault by skipping the
test if the allocated memory region is not large enough for the number of pages
x page size requested.  But as this will skip over the aarch64+64k pmd tests, this
patch is intended to resolve the problem with 64k pages by scaling up the
initial allocated memory region subject to base page size of the architecture.

Fixes: a2bf6a9ca805 ("selftests/mm: add UFFDIO_MOVE ioctl test")

Signed-off-by: John J. Coleman <jocolema@redhat.com>
---

I too have been looking into a solution for aarch64+64k.  I wanted to gauge your 
thoughts on this patch to scale up memory allocation region size predicated on 
architecture base page sizes.

 tools/testing/selftests/mm/uffd-unit-tests.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/mm/uffd-unit-tests.c b/tools/testing/selftests/mm/uffd-unit-tests.c
index 2a97ba1d6feb1b35d6281449fd1917793a64fab1..c6cebb3c880d0b47e44c8afc4e3a4c3050cea579 100644
--- a/tools/testing/selftests/mm/uffd-unit-tests.c
+++ b/tools/testing/selftests/mm/uffd-unit-tests.c
@@ -13,8 +13,14 @@
 
 #ifdef __NR_userfaultfd
 
-/* The unit test doesn't need a large or random size, make it 32MB for now */
-#define  UFFD_TEST_MEM_SIZE               (32UL << 20)
+/*
+ * The unit test does not need a large or random size, but the allocation size
+ * needs to scale with base page size per architecture otherwise pmd alignment
+ * tests will fail for architectures like aarch64+64k.  For standard 4k pages, 
+ * this will allocate 64MiB, while allocating 1GiB for 64k page sizes.
+ */
+#define  PAGE_SIZE                        sysconf(_SC_PAGESIZE)
+#define  UFFD_TEST_MEM_SIZE               (PAGE_SIZE * (16 << 10))
 
 #define  MEM_ANON                         BIT_ULL(0)
 #define  MEM_SHMEM                        BIT_ULL(1)
-- 
2.56.0