[PATCH 6/8] selftests/mm: check MADV_COLD and MADV_PAGEOUT on partly advised THPs
From: Gregory Price (Meta)
Date: Wed Oct 14 2026 - 14:04:15 EST
Paging out a THP that the advised range fully covers must not corrupt it.
A THP that the range only partly covers must be split before reclaim, or
skipped, so that no page outside the range is reclaimed. MADV_COLD takes
the same split path.
Check that a whole PMD-mapped THP is swapped intact, that pages outside
the range stay resident after paging out a base page or half of a PMD- or
PTE-mapped THP, and that MADV_COLD on half of either THP preserves its
contents. Tests skip when PMD-sized THPs cannot be allocated, and with
/proc/kpageflags the PTE-mapped cases also confirm the folio stayed large.
Signed-off-by: Gregory Price (Meta) <gourry@xxxxxxxxxx>
---
tools/testing/selftests/mm/madvise.c | 234 +++++++++++++++++++++++++++
1 file changed, 234 insertions(+)
diff --git a/tools/testing/selftests/mm/madvise.c b/tools/testing/selftests/mm/madvise.c
index 0851f5428e3d..8822991eae4a 100644
--- a/tools/testing/selftests/mm/madvise.c
+++ b/tools/testing/selftests/mm/madvise.c
@@ -8,6 +8,7 @@
#include <sched.h>
#include <stdbool.h>
#include <stdint.h>
+#include <string.h>
#include <sys/ipc.h>
#include <sys/mman.h>
#include <sys/shm.h>
@@ -16,10 +17,15 @@
#include "kselftest_harness.h"
#include "vm_util.h"
+#ifndef MADV_COLLAPSE
+#define MADV_COLLAPSE 25
+#endif
+
/* Reclaim can fail transiently, so retry for up to a second. */
#define PAGEOUT_RETRIES 100
static size_t page_size;
+static size_t pmd_size;
FIXTURE(madvise)
{
@@ -31,6 +37,7 @@ FIXTURE(madvise)
FIXTURE_SETUP(madvise)
{
page_size = getpagesize();
+ pmd_size = read_pmd_pagesize();
self->pagemap_fd = open("/proc/self/pagemap", O_RDONLY);
ASSERT_GE(self->pagemap_fd, 0);
@@ -44,6 +51,111 @@ FIXTURE_TEARDOWN(madvise)
close(self->pagemap_fd);
}
+/*
+ * Reserve a PMD-aligned range, so that memory mapped over it with MAP_FIXED
+ * can be backed by PMD-mapped THPs.
+ */
+static char *reserve_aligned(struct __test_metadata *_metadata, size_t size)
+{
+ char *reservation, *aligned;
+
+ reservation = mmap(NULL, size + pmd_size, PROT_NONE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ ASSERT_NE(reservation, MAP_FAILED);
+
+ aligned = (char *)(((uintptr_t)reservation + pmd_size - 1) &
+ ~(pmd_size - 1));
+ if (aligned != reservation)
+ ASSERT_EQ(munmap(reservation, aligned - reservation), 0);
+ ASSERT_EQ(munmap(aligned + size, reservation + pmd_size - aligned), 0);
+
+ return aligned;
+}
+
+/* Map PMD-aligned anonymous memory filled with 1s. */
+static char *map_aligned_pages(struct __test_metadata *_metadata, size_t size)
+{
+ char *mapping = reserve_aligned(_metadata, size);
+
+ ASSERT_EQ(mmap(mapping, size, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0),
+ mapping);
+ memset(mapping, 1, size);
+
+ return mapping;
+}
+
+/*
+ * Collapse a PMD-aligned range into PMD-mapped anonymous THPs. MADV_COLLAPSE
+ * may fail transiently with EAGAIN.
+ */
+static bool collapse(char *mapping, size_t size)
+{
+ int nr_hpages = size / pmd_size;
+ int retry;
+
+ for (retry = 0; retry < 10; retry++) {
+ if (madvise(mapping, size, MADV_COLLAPSE)) {
+ if (errno != EAGAIN)
+ return false;
+ } else if (check_huge_anon(mapping, size, nr_hpages,
+ pmd_size)) {
+ return true;
+ }
+ usleep(10000);
+ }
+
+ return false;
+}
+
+/* Map a PMD-mapped anonymous THP filled with 1s, or return NULL. */
+static char *map_thp(struct __test_metadata *_metadata)
+{
+ char *mapping;
+
+ if (!pmd_size)
+ return NULL;
+ mapping = map_aligned_pages(_metadata, pmd_size);
+ if (collapse(mapping, pmd_size))
+ return mapping;
+ ASSERT_EQ(munmap(mapping, pmd_size), 0);
+ return NULL;
+}
+
+/*
+ * Changing the protection of one page PTE-maps a THP. When /proc/kpageflags
+ * is readable, also check that the folio is still large.
+ */
+static void pte_map_thp(struct __test_metadata *_metadata, char *mapping,
+ int pagemap_fd, int kpageflags_fd)
+{
+ unsigned long pfn;
+ uint64_t flags;
+
+ ASSERT_EQ(mprotect(mapping + page_size, page_size, PROT_READ), 0);
+ ASSERT_EQ(mprotect(mapping + page_size, page_size,
+ PROT_READ | PROT_WRITE), 0);
+ ASSERT_TRUE(check_huge_anon(mapping, pmd_size, 0, pmd_size));
+ if (kpageflags_fd < 0)
+ return;
+
+ pfn = pagemap_get_pfn(pagemap_fd, mapping);
+ ASSERT_NE(pfn, -1UL);
+ ASSERT_EQ(pageflags_get(pfn, kpageflags_fd, &flags), 0);
+ ASSERT_TRUE(flags & KPF_COMPOUND_HEAD);
+}
+
+static void assert_filled(struct __test_metadata *_metadata,
+ const char *mapping, size_t size)
+{
+ size_t offset;
+
+ for (offset = 0; offset < size; offset += page_size) {
+ ASSERT_EQ(mapping[offset], 1)
+ TH_LOG("memory changed at offset %zu", offset);
+ }
+}
+
/* Page out the range until its first page is swapped. */
static bool pageout_until_swapped(struct __test_metadata *_metadata,
char *mapping, size_t size, int pagemap_fd)
@@ -91,6 +203,11 @@ static void pin_to_current_cpu(struct __test_metadata *_metadata)
ASSERT_EQ(sched_setaffinity(0, sizeof(mask), &mask), 0);
}
+static bool page_is_present(int pagemap_fd, char *addr)
+{
+ return pagemap_get_entry(pagemap_fd, addr) & PM_PRESENT;
+}
+
/* Map a shared mapping of an unlinked, zero-filled temporary file. */
static char *map_temp_file(struct __test_metadata *_metadata, size_t size)
{
@@ -405,4 +522,121 @@ TEST_F(madvise, pageout_skips_unevictable_page)
ASSERT_EQ(shmdt(mapping), 0);
}
+/* MADV_PAGEOUT of a whole THP must swap it without corrupting it. */
+TEST_F(madvise, pageout_swaps_thp)
+{
+ char *mapping;
+
+ mapping = map_thp(_metadata);
+ if (!mapping)
+ SKIP(return, "could not allocate a PMD-sized THP");
+
+ if (!pageout_until_swapped(_metadata, mapping, pmd_size,
+ self->pagemap_fd))
+ SKIP(return, "MADV_PAGEOUT did not swap the THP");
+ assert_filled(_metadata, mapping, pmd_size);
+
+ ASSERT_EQ(munmap(mapping, pmd_size), 0);
+}
+
+/*
+ * MADV_PAGEOUT must not reclaim pages outside the advised range. kswapd or
+ * page migration could also unmap them, but neither should happen when the
+ * selftests run by themselves.
+ */
+TEST_F(madvise, pageout_stays_within_range)
+{
+ char *mapping;
+
+ mapping = mmap(NULL, 3 * page_size, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ ASSERT_NE(mapping, MAP_FAILED);
+ memset(mapping, 1, 3 * page_size);
+ if (!pageout_until_swapped(_metadata, mapping + page_size, page_size,
+ self->pagemap_fd))
+ SKIP(return, "MADV_PAGEOUT did not swap the page");
+
+ ASSERT_TRUE(page_is_present(self->pagemap_fd, mapping));
+ ASSERT_TRUE(page_is_present(self->pagemap_fd, mapping + 2 * page_size));
+ assert_filled(_metadata, mapping, 3 * page_size);
+
+ ASSERT_EQ(munmap(mapping, 3 * page_size), 0);
+}
+
+/*
+ * MADV_PAGEOUT must not reclaim the unadvised half of a THP: the THP must be
+ * split before reclaim, or skipped. See pageout_stays_within_range about
+ * other unmapping.
+ */
+static void pageout_half_thp(struct __test_metadata *_metadata, char *mapping,
+ int pagemap_fd)
+{
+ size_t offset;
+
+ if (!pageout_until_swapped(_metadata, mapping, pmd_size / 2,
+ pagemap_fd))
+ SKIP(return, "MADV_PAGEOUT did not swap the advised half");
+
+ for (offset = pmd_size / 2; offset < pmd_size; offset += page_size)
+ ASSERT_TRUE(page_is_present(pagemap_fd, mapping + offset));
+ assert_filled(_metadata, mapping, pmd_size);
+}
+
+TEST_F(madvise, pageout_stays_within_pmd_mapped_thp)
+{
+ char *mapping;
+
+ mapping = map_thp(_metadata);
+ if (!mapping)
+ SKIP(return, "could not allocate a PMD-sized THP");
+
+ pageout_half_thp(_metadata, mapping, self->pagemap_fd);
+
+ ASSERT_EQ(munmap(mapping, pmd_size), 0);
+}
+
+TEST_F(madvise, pageout_stays_within_pte_mapped_thp)
+{
+ char *mapping;
+
+ mapping = map_thp(_metadata);
+ if (!mapping)
+ SKIP(return, "could not allocate a PMD-sized THP");
+ pte_map_thp(_metadata, mapping, self->pagemap_fd, self->kpageflags_fd);
+
+ pageout_half_thp(_metadata, mapping, self->pagemap_fd);
+
+ ASSERT_EQ(munmap(mapping, pmd_size), 0);
+}
+
+/* MADV_COLD on part of a THP may split it, but must not change it. */
+TEST_F(madvise, cold_preserves_half_of_pmd_mapped_thp)
+{
+ char *mapping;
+
+ mapping = map_thp(_metadata);
+ if (!mapping)
+ SKIP(return, "could not allocate a PMD-sized THP");
+
+ ASSERT_EQ(madvise(mapping, pmd_size / 2, MADV_COLD), 0);
+ assert_filled(_metadata, mapping, pmd_size);
+
+ ASSERT_EQ(munmap(mapping, pmd_size), 0);
+}
+
+TEST_F(madvise, cold_preserves_half_of_pte_mapped_thp)
+{
+ char *mapping;
+
+ mapping = map_thp(_metadata);
+ if (!mapping)
+ SKIP(return, "could not allocate a PMD-sized THP");
+ pte_map_thp(_metadata, mapping, self->pagemap_fd, self->kpageflags_fd);
+
+ ASSERT_EQ(madvise(mapping, pmd_size / 2, MADV_COLD), 0);
+ assert_filled(_metadata, mapping, pmd_size);
+
+ ASSERT_EQ(munmap(mapping, pmd_size), 0);
+}
+
TEST_HARNESS_MAIN
--
2.56.0