On 2026/6/30 20:46, Breno Leitao wrote: > Add a destructive selftest that verifies > vm.panic_on_unrecoverable_memory_failure actually panics when a > hwpoison error hits a kernel-owned page. > > Three "kinds" of kernel-owned page can be targeted, selectable via > the script's first positional argument (default: rodata): > > rodata - a PG_reserved page in the kernel rodata range, sourced > from the "Kernel rodata" sub-resource of "System RAM" in > /proc/iomem. That entry is reported on every major > architecture and guarantees the chosen PFN is backed by > struct page (an online System RAM range, not a firmware > hole), is PG_reserved, and is read-only -- so even if > the panic fails to fire for some reason, the resulting > PG_hwpoison marker on rodata does not corrupt writable > kernel state. > > slab - a slab page found by walking /proc/kpageflags for the > first PFN with KPF_SLAB set (and KPF_HWPOISON / KPF_NOPAGE > / KPF_COMPOUND_TAIL clear). Exercises the get_any_page() > path on a non PG_reserved kernel-owned page and so > catches regressions where get_any_page() collapses > kernel-owned pages into a transient -EIO instead of > -ENOTRECOVERABLE. > > pgtable - same as slab, but the PFN is selected via KPF_PGTABLE. > > PageLargeKmalloc, the fourth page type matched by > is_kernel_owned_page(), is intentionally not covered: it is a > PAGE_TYPE_OPS flag with no /proc/kpageflags bit, so selecting such > a PFN from userspace is not feasible. The slab and pgtable > variants already exercise the same get_any_page() positive-check > branch. > > The script enables the sysctl and writes the selected physical > address to /sys/devices/system/memory/hard_offline_page. A > successful run crashes the kernel with > > Memory failure: <pfn>: unrecoverable page > > A return from the inject means no panic fired. Before reporting, the > script restores the sysctl and best-effort unpoisons the target PFN > through the hwpoison debugfs interface (hard_offline_page() injects > with MF_SW_SIMULATED, so the page stays unpoisonable), then re-reads > /proc/kpageflags: a PFN that is still the kernel-owned type it selected > is a genuine failure, while one that raced to a different type before > the inject is skipped as inconclusive. Test outcome is therefore > observed externally (serial console, kdump) rather than from the > script's own exit code. > > The script is intentionally NOT wired into run_vmtests.sh: every > successful run panics the kernel, which is incompatible with the > sequential "run each category in the same VM" model that > run_vmtests.sh assumes. It is also not registered as a TEST_PROGS / > ksft_* wrapper so a default kselftest run does not opt itself into > a panic. The script is meant to be executed manually inside a > disposable VM (e.g. virtme-ng), one variant per VM boot, and > requires RUN_DESTRUCTIVE=1 in the environment as a safety net. > > Signed-off-by: Breno Leitao <[email protected]>
With Mike's comment addressed: Acked-by: Miaohe Lin <[email protected]> Thanks. .
