AI Trajectory


Trajectory: (Expand/Collapse All)
Seq Timestamp Type Name Duration
0/0 2026/07/06 09:09 flow patch-triage
0m Args: 
null

Results: 
{
  "EnableConfigs": [
    "HUGETLB_PAGE"
  ],
  "FocusSymbols": [
    "vmap",
    "vmap_pages_range_batched",
    "vmap_get_aligned_vm_area",
    "vmap_pages_range_noflush_walk",
    "__vmap_pages_range_noflush"
  ],
  "Reasoning": "The patch introduces batched contiguous mappings at the PTE level for vmap, modifying core virtual memory allocation logic. This is functional and reachable code.",
  "WorthFuzzing": true
}
1/1 2026/07/06 09:09 action read-patch-diff
0m Args: 
null

Results: 
{
  "PatchDiff": "commit b34798210c4209871d2211e2151606e9c1ef3db5\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Jul 6 09:09:18 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/arch/arm64/include/asm/vmalloc.h b/arch/arm64/include/asm/vmalloc.h\nindex 4ec1acd3c1b348..7d9c7dc795c42c 100644\n--- a/arch/arm64/include/asm/vmalloc.h\n+++ b/arch/arm64/include/asm/vmalloc.h\n@@ -23,6 +23,8 @@ static inline unsigned long arch_vmap_pte_range_map_size(unsigned long addr,\n \t\t\t\t\t\tunsigned long end, u64 pfn,\n \t\t\t\t\t\tunsigned int max_page_shift)\n {\n+\tunsigned long size;\n+\n \t/*\n \t * If the block is at least CONT_PTE_SIZE in size, and is naturally\n \t * aligned in both virtual and physical space, then we can pte-map the\n@@ -40,7 +42,9 @@ static inline unsigned long arch_vmap_pte_range_map_size(unsigned long addr,\n \tif (!IS_ALIGNED(PFN_PHYS(pfn), CONT_PTE_SIZE))\n \t\treturn PAGE_SIZE;\n \n-\treturn CONT_PTE_SIZE;\n+\tsize = min3(end - addr, 1UL \u003c\u003c max_page_shift, PMD_SIZE \u003e\u003e 1);\n+\tsize = rounddown_pow_of_two(size);\n+\treturn size;\n }\n \n #define arch_vmap_pte_range_unmap_size arch_vmap_pte_range_unmap_size\ndiff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c\nindex 30772a909aea3e..d600a6d751e295 100644\n--- a/arch/arm64/mm/hugetlbpage.c\n+++ b/arch/arm64/mm/hugetlbpage.c\n@@ -110,6 +110,12 @@ static inline int num_contig_ptes(unsigned long size, size_t *pgsize)\n \t\tcontig_ptes = CONT_PTES;\n \t\tbreak;\n \tdefault:\n+\t\tif (size \u003e 0 \u0026\u0026 size \u003c PMD_SIZE \u0026\u0026\n+\t\t\t\tIS_ALIGNED(size, CONT_PTE_SIZE)) {\n+\t\t\t*pgsize = PAGE_SIZE;\n+\t\t\tcontig_ptes = size \u003e\u003e PAGE_SHIFT;\n+\t\t\tbreak;\n+\t\t}\n \t\tWARN_ON(!__hugetlb_valid_size(size));\n \t}\n \n@@ -359,6 +365,10 @@ pte_t arch_make_huge_pte(pte_t entry, unsigned int shift, vm_flags_t flags)\n \tcase CONT_PTE_SIZE:\n \t\treturn pte_mkcont(entry);\n \tdefault:\n+\t\tif (pagesize \u003e 0 \u0026\u0026 pagesize \u003c PMD_SIZE \u0026\u0026\n+\t\t\t\tIS_ALIGNED(pagesize, CONT_PTE_SIZE))\n+\t\t\treturn pte_mkcont(entry);\n+\n \t\tbreak;\n \t}\n \tpr_warn(\"%s: unrecognized huge page size 0x%lx\\n\",\ndiff --git a/mm/vmalloc.c b/mm/vmalloc.c\nindex 12f4a39fdd0b3e..a088680c39fc12 100644\n--- a/mm/vmalloc.c\n+++ b/mm/vmalloc.c\n@@ -91,6 +91,33 @@ struct vfree_deferred {\n static DEFINE_PER_CPU(struct vfree_deferred, vfree_deferred);\n \n /*** Page table manipulation functions ***/\n+\n+/*\n+ * Try contiguous mappings at the PTE level for arches which support them, and if\n+ * requested by the caller. Fall back to PAGE_SIZE mappings otherwise.\n+ *\n+ * Return: mapping size.\n+ */\n+static __always_inline unsigned long vmap_set_ptes(pte_t *pte,\n+\t\tunsigned long addr, unsigned long end, u64 pfn,\n+\t\tpgprot_t prot, unsigned int max_page_shift)\n+{\n+#ifdef CONFIG_HUGETLB_PAGE\n+\tunsigned long size;\n+\n+\tsize = arch_vmap_pte_range_map_size(addr, end, pfn, max_page_shift);\n+\tif (size != PAGE_SIZE) {\n+\t\tpte_t entry = pfn_pte(pfn, prot);\n+\n+\t\tentry = arch_make_huge_pte(entry, ilog2(size), 0);\n+\t\tset_huge_pte_at(\u0026init_mm, addr, pte, entry, size);\n+\t\treturn size;\n+\t}\n+#endif\n+\tset_pte_at(\u0026init_mm, addr, pte, pfn_pte(pfn, prot));\n+\treturn PAGE_SIZE;\n+}\n+\n static int vmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,\n \t\t\tphys_addr_t phys_addr, pgprot_t prot,\n \t\t\tunsigned int max_page_shift, pgtbl_mod_mask *mask)\n@@ -98,7 +125,8 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,\n \tpte_t *pte;\n \tu64 pfn;\n \tstruct page *page;\n-\tunsigned long size = PAGE_SIZE;\n+\tunsigned long size;\n+\tunsigned int steps;\n \n \tif (WARN_ON_ONCE(!PAGE_ALIGNED(end - addr)))\n \t\treturn -EINVAL;\n@@ -119,20 +147,9 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,\n \t\t\tBUG();\n \t\t}\n \n-#ifdef CONFIG_HUGETLB_PAGE\n-\t\tsize = arch_vmap_pte_range_map_size(addr, end, pfn, max_page_shift);\n-\t\tif (size != PAGE_SIZE) {\n-\t\t\tpte_t entry = pfn_pte(pfn, prot);\n-\n-\t\t\tentry = arch_make_huge_pte(entry, ilog2(size), 0);\n-\t\t\tset_huge_pte_at(\u0026init_mm, addr, pte, entry, size);\n-\t\t\tpfn += PFN_DOWN(size);\n-\t\t\tcontinue;\n-\t\t}\n-#endif\n-\t\tset_pte_at(\u0026init_mm, addr, pte, pfn_pte(pfn, prot));\n-\t\tpfn++;\n-\t} while (pte += PFN_DOWN(size), addr += size, addr != end);\n+\t\tsize = vmap_set_ptes(pte, addr, end, pfn, prot, max_page_shift);\n+\t\tsteps = PFN_DOWN(size);\n+\t} while (pte += steps, pfn += steps, addr += size, addr != end);\n \n \tlazy_mmu_mode_disable();\n \t*mask |= PGTBL_PTE_MODIFIED;\n@@ -524,8 +541,10 @@ void vunmap_range(unsigned long addr, unsigned long end)\n \n static int vmap_pages_pte_range(pmd_t *pmd, unsigned long addr,\n \t\tunsigned long end, pgprot_t prot, struct page **pages, int *nr,\n-\t\tpgtbl_mod_mask *mask)\n+\t\tpgtbl_mod_mask *mask, unsigned int shift)\n {\n+\tunsigned long pfn, size;\n+\tunsigned int steps;\n \tint err = 0;\n \tpte_t *pte;\n \n@@ -556,9 +575,10 @@ static int vmap_pages_pte_range(pmd_t *pmd, unsigned long addr,\n \t\t\tbreak;\n \t\t}\n \n-\t\tset_pte_at(\u0026init_mm, addr, pte, mk_pte(page, prot));\n-\t\t(*nr)++;\n-\t} while (pte++, addr += PAGE_SIZE, addr != end);\n+\t\tpfn = page_to_pfn(page);\n+\t\tsize = vmap_set_ptes(pte, addr, end, pfn, prot, shift);\n+\t\tsteps = PFN_DOWN(size);\n+\t} while (pte += steps, *nr += steps, addr += size, addr != end);\n \n \tlazy_mmu_mode_disable();\n \t*mask |= PGTBL_PTE_MODIFIED;\n@@ -568,7 +588,7 @@ static int vmap_pages_pte_range(pmd_t *pmd, unsigned long addr,\n \n static int vmap_pages_pmd_range(pud_t *pud, unsigned long addr,\n \t\tunsigned long end, pgprot_t prot, struct page **pages, int *nr,\n-\t\tpgtbl_mod_mask *mask)\n+\t\tpgtbl_mod_mask *mask, unsigned int shift)\n {\n \tpmd_t *pmd;\n \tunsigned long next;\n@@ -578,7 +598,27 @@ static int vmap_pages_pmd_range(pud_t *pud, unsigned long addr,\n \t\treturn -ENOMEM;\n \tdo {\n \t\tnext = pmd_addr_end(addr, end);\n-\t\tif (vmap_pages_pte_range(pmd, addr, next, prot, pages, nr, mask))\n+\n+\t\tif (shift \u003e= PMD_SHIFT) {\n+\t\t\tstruct page *page = pages[*nr];\n+\t\t\tphys_addr_t phys_addr;\n+\n+\t\t\tif (WARN_ON(!page))\n+\t\t\t\treturn -ENOMEM;\n+\t\t\tif (WARN_ON(!pfn_valid(page_to_pfn(page))))\n+\t\t\t\treturn -EINVAL;\n+\n+\t\t\tphys_addr = page_to_phys(page);\n+\n+\t\t\tif (vmap_try_huge_pmd(pmd, addr, next, phys_addr, prot,\n+\t\t\t\t\t\tshift)) {\n+\t\t\t\t*mask |= PGTBL_PMD_MODIFIED;\n+\t\t\t\t*nr += 1 \u003c\u003c (PMD_SHIFT - PAGE_SHIFT);\n+\t\t\t\tcontinue;\n+\t\t\t}\n+\t\t}\n+\n+\t\tif (vmap_pages_pte_range(pmd, addr, next, prot, pages, nr, mask, shift))\n \t\t\treturn -ENOMEM;\n \t} while (pmd++, addr = next, addr != end);\n \treturn 0;\n@@ -586,7 +626,7 @@ static int vmap_pages_pmd_range(pud_t *pud, unsigned long addr,\n \n static int vmap_pages_pud_range(p4d_t *p4d, unsigned long addr,\n \t\tunsigned long end, pgprot_t prot, struct page **pages, int *nr,\n-\t\tpgtbl_mod_mask *mask)\n+\t\tpgtbl_mod_mask *mask, unsigned int shift)\n {\n \tpud_t *pud;\n \tunsigned long next;\n@@ -596,7 +636,7 @@ static int vmap_pages_pud_range(p4d_t *p4d, unsigned long addr,\n \t\treturn -ENOMEM;\n \tdo {\n \t\tnext = pud_addr_end(addr, end);\n-\t\tif (vmap_pages_pmd_range(pud, addr, next, prot, pages, nr, mask))\n+\t\tif (vmap_pages_pmd_range(pud, addr, next, prot, pages, nr, mask, shift))\n \t\t\treturn -ENOMEM;\n \t} while (pud++, addr = next, addr != end);\n \treturn 0;\n@@ -604,7 +644,7 @@ static int vmap_pages_pud_range(p4d_t *p4d, unsigned long addr,\n \n static int vmap_pages_p4d_range(pgd_t *pgd, unsigned long addr,\n \t\tunsigned long end, pgprot_t prot, struct page **pages, int *nr,\n-\t\tpgtbl_mod_mask *mask)\n+\t\tpgtbl_mod_mask *mask, unsigned int shift)\n {\n \tp4d_t *p4d;\n \tunsigned long next;\n@@ -614,14 +654,18 @@ static int vmap_pages_p4d_range(pgd_t *pgd, unsigned long addr,\n \t\treturn -ENOMEM;\n \tdo {\n \t\tnext = p4d_addr_end(addr, end);\n-\t\tif (vmap_pages_pud_range(p4d, addr, next, prot, pages, nr, mask))\n+\t\tif (vmap_pages_pud_range(p4d, addr, next, prot, pages, nr, mask, shift))\n \t\t\treturn -ENOMEM;\n \t} while (p4d++, addr = next, addr != end);\n \treturn 0;\n }\n \n-static int vmap_small_pages_range_noflush(unsigned long addr, unsigned long end,\n-\t\tpgprot_t prot, struct page **pages)\n+/*\n+ * It can take an array of pages which are not all contiguous, but it\n+ * may have contiguous chunks, as hinted by @shift.\n+ */\n+static int vmap_pages_range_noflush_walk(unsigned long addr, unsigned long end,\n+\t\tpgprot_t prot, struct page **pages, unsigned int shift)\n {\n \tunsigned long start = addr;\n \tpgd_t *pgd;\n@@ -636,7 +680,7 @@ static int vmap_small_pages_range_noflush(unsigned long addr, unsigned long end,\n \t\tnext = pgd_addr_end(addr, end);\n \t\tif (pgd_bad(*pgd))\n \t\t\tmask |= PGTBL_PGD_MODIFIED;\n-\t\terr = vmap_pages_p4d_range(pgd, addr, next, prot, pages, \u0026nr, \u0026mask);\n+\t\terr = vmap_pages_p4d_range(pgd, addr, next, prot, pages, \u0026nr, \u0026mask, shift);\n \t\tif (err)\n \t\t\tbreak;\n \t} while (pgd++, addr = next, addr != end);\n@@ -659,27 +703,12 @@ static int vmap_small_pages_range_noflush(unsigned long addr, unsigned long end,\n int __vmap_pages_range_noflush(unsigned long addr, unsigned long end,\n \t\tpgprot_t prot, struct page **pages, unsigned int page_shift)\n {\n-\tunsigned int i, nr = (end - addr) \u003e\u003e PAGE_SHIFT;\n-\n \tWARN_ON(page_shift \u003c PAGE_SHIFT);\n \n-\tif (!IS_ENABLED(CONFIG_HAVE_ARCH_HUGE_VMALLOC) ||\n-\t\t\tpage_shift == PAGE_SHIFT)\n-\t\treturn vmap_small_pages_range_noflush(addr, end, prot, pages);\n-\n-\tfor (i = 0; i \u003c nr; i += 1U \u003c\u003c (page_shift - PAGE_SHIFT)) {\n-\t\tint err;\n+\tif (!IS_ENABLED(CONFIG_HAVE_ARCH_HUGE_VMALLOC))\n+\t\tpage_shift = PAGE_SHIFT;\n \n-\t\terr = vmap_range_noflush(addr, addr + (1UL \u003c\u003c page_shift),\n-\t\t\t\t\tpage_to_phys(pages[i]), prot,\n-\t\t\t\t\tpage_shift);\n-\t\tif (err)\n-\t\t\treturn err;\n-\n-\t\taddr += 1UL \u003c\u003c page_shift;\n-\t}\n-\n-\treturn 0;\n+\treturn vmap_pages_range_noflush_walk(addr, end, prot, pages, page_shift);\n }\n \n int vmap_pages_range_noflush(unsigned long addr, unsigned long end,\n@@ -3279,6 +3308,14 @@ struct vm_struct *get_vm_area_caller(unsigned long size, unsigned long flags,\n \t\t\t\t  NUMA_NO_NODE, GFP_KERNEL, caller);\n }\n \n+static struct vm_struct *__get_vm_area_node_aligned_caller(unsigned long size,\n+\t\tunsigned long align, unsigned long flags, const void *caller)\n+{\n+\treturn __get_vm_area_node(size, align, PAGE_SHIFT, flags,\n+\t\t\t\t  VMALLOC_START, VMALLOC_END,\n+\t\t\t\t  NUMA_NO_NODE, GFP_KERNEL, caller);\n+}\n+\n /**\n  * find_vm_area - find a continuous kernel virtual area\n  * @addr:\t  base address\n@@ -3519,6 +3556,113 @@ void vunmap(const void *addr)\n }\n EXPORT_SYMBOL(vunmap);\n \n+static inline unsigned int vm_shift(pgprot_t prot, unsigned long size)\n+{\n+\tif (arch_vmap_pmd_supported(prot) \u0026\u0026 size \u003e= PMD_SIZE)\n+\t\treturn PMD_SHIFT;\n+\n+\treturn arch_vmap_pte_supported_shift(size);\n+}\n+\n+static inline int get_vmap_batch_order(struct page **pages,\n+\t\tpgprot_t prot, unsigned int max_steps, unsigned int idx)\n+{\n+\tunsigned int nr_contig;\n+\tint order;\n+\n+\tif (!IS_ENABLED(CONFIG_HAVE_ARCH_HUGE_VMAP))\n+\t\treturn 0;\n+\n+\tnr_contig = num_pages_contiguous(\u0026pages[idx], max_steps);\n+\tif (nr_contig \u003c 2)\n+\t\treturn 0;\n+\n+\torder = ilog2(nr_contig);\n+\n+\t/* Limit order by pfn alignment */\n+\torder = min_t(int, order, __ffs(page_to_pfn(pages[idx])));\n+\n+\tif (vm_shift(prot, PAGE_SIZE \u003c\u003c order) == PAGE_SHIFT)\n+\t\treturn 0;\n+\n+\treturn order;\n+}\n+\n+static int vmap_pages_range_batched(unsigned long addr, unsigned long end,\n+\t\tpgprot_t prot, struct page **pages)\n+{\n+\tunsigned int count = (end - addr) \u003e\u003e PAGE_SHIFT;\n+\tunsigned int prev_shift = 0, idx = 0;\n+\tunsigned long map_addr = addr, batch_end = addr;\n+\tint err;\n+\n+\terr = kmsan_vmap_pages_range_noflush(addr, end, prot, pages,\n+\t\t\t\t\t\tPAGE_SHIFT, GFP_KERNEL);\n+\tif (err)\n+\t\tgoto out;\n+\n+\tfor (unsigned int i = 0; i \u003c count; ) {\n+\t\tunsigned int shift = PAGE_SHIFT +\n+\t\t\tget_vmap_batch_order(pages, prot, count - i, i);\n+\n+\t\tif (!i)\n+\t\t\tprev_shift = shift;\n+\n+\t\tif (shift != prev_shift) {\n+\t\t\terr = vmap_pages_range_noflush_walk(map_addr, batch_end,\n+\t\t\t\t\tprot, pages + idx, prev_shift);\n+\t\t\tif (err)\n+\t\t\t\tgoto out;\n+\t\t\tprev_shift = shift;\n+\t\t\tmap_addr = batch_end;\n+\t\t\tidx = i;\n+\t\t}\n+\n+\t\t/*\n+\t\t * Once small pages are encountered, the remaining pages\n+\t\t * are likely small as well.\n+\t\t */\n+\t\tif (shift == PAGE_SHIFT)\n+\t\t\tbreak;\n+\n+\t\tbatch_end += 1UL \u003c\u003c shift;\n+\t\ti += 1U \u003c\u003c (shift - PAGE_SHIFT);\n+\t}\n+\n+\t/* Remaining */\n+\tif (map_addr \u003c end)\n+\t\terr = vmap_pages_range_noflush_walk(map_addr, end,\n+\t\t\t\tprot, pages + idx, prev_shift);\n+\n+out:\n+\tflush_cache_vmap(addr, end);\n+\treturn err;\n+}\n+\n+static struct vm_struct *vmap_get_aligned_vm_area(unsigned long size,\n+\t\tunsigned long flags, pgprot_t prot, const void *caller)\n+{\n+\tstruct vm_struct *vm_area;\n+\tunsigned int shift;\n+\n+\tif (arch_vmap_pmd_supported(prot) \u0026\u0026 size \u003e= PMD_SIZE) {\n+\t\tvm_area = __get_vm_area_node_aligned_caller(size, PMD_SIZE,\n+\t\t\t\tflags, caller);\n+\t\tif (vm_area)\n+\t\t\treturn vm_area;\n+\t}\n+\n+\tshift = arch_vmap_pte_supported_shift(size);\n+\tif (shift \u003e PAGE_SHIFT) {\n+\t\tvm_area = __get_vm_area_node_aligned_caller(size, 1UL \u003c\u003c shift,\n+\t\t\t\tflags, caller);\n+\t\tif (vm_area)\n+\t\t\treturn vm_area;\n+\t}\n+\n+\treturn __get_vm_area_node_aligned_caller(size, PAGE_SIZE, flags, caller);\n+}\n+\n /**\n  * vmap - map an array of pages into virtually contiguous space\n  * @pages: array of page pointers\n@@ -3557,13 +3701,14 @@ void *vmap(struct page **pages, unsigned int count,\n \t\treturn NULL;\n \n \tsize = (unsigned long)count \u003c\u003c PAGE_SHIFT;\n-\tarea = get_vm_area_caller(size, flags, __builtin_return_address(0));\n+\tarea = vmap_get_aligned_vm_area(size, flags, prot,\n+\t\t\t\t__builtin_return_address(0));\n \tif (!area)\n \t\treturn NULL;\n \n \taddr = (unsigned long)area-\u003eaddr;\n-\tif (vmap_pages_range(addr, addr + size, pgprot_nx(prot),\n-\t\t\t\tpages, PAGE_SHIFT) \u003c 0) {\n+\tif (vmap_pages_range_batched(addr, addr + size, pgprot_nx(prot),\n+\t\t\t\tpages) \u003c 0) {\n \t\tvunmap(area-\u003eaddr);\n \t\treturn NULL;\n \t}\n"
}
2/1 2026/07/06 09:09 agent patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
{
  "EnableConfigs": [
    "HUGETLB_PAGE"
  ],
  "FocusSymbols": [
    "vmap",
    "vmap_pages_range_batched",
    "vmap_get_aligned_vm_area",
    "vmap_pages_range_noflush_walk",
    "__vmap_pages_range_noflush"
  ],
  "Reasoning": "The patch introduces batched contiguous mappings at the PTE level for vmap, modifying core virtual memory allocation logic. This is functional and reachable code.",
  "WorthFuzzing": true
}

Instruction: 
You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt: 
For your convenience, here is the diff of the changes:
commit b34798210c4209871d2211e2151606e9c1ef3db5
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Jul 6 09:09:18 2026 +0000

    syz-cluster: applied patch under review

diff --git a/arch/arm64/include/asm/vmalloc.h b/arch/arm64/include/asm/vmalloc.h
index 4ec1acd3c1b348..7d9c7dc795c42c 100644
--- a/arch/arm64/include/asm/vmalloc.h
+++ b/arch/arm64/include/asm/vmalloc.h
@@ -23,6 +23,8 @@ static inline unsigned long arch_vmap_pte_range_map_size(unsigned long addr,
 						unsigned long end, u64 pfn,
 						unsigned int max_page_shift)
 {
+	unsigned long size;
+
 	/*
 	 * If the block is at least CONT_PTE_SIZE in size, and is naturally
 	 * aligned in both virtual and physical space, then we can pte-map the
@@ -40,7 +42,9 @@ static inline unsigned long arch_vmap_pte_range_map_size(unsigned long addr,
 	if (!IS_ALIGNED(PFN_PHYS(pfn), CONT_PTE_SIZE))
 		return PAGE_SIZE;
 
-	return CONT_PTE_SIZE;
+	size = min3(end - addr, 1UL << max_page_shift, PMD_SIZE >> 1);
+	size = rounddown_pow_of_two(size);
+	return size;
 }
 
 #define arch_vmap_pte_range_unmap_size arch_vmap_pte_range_unmap_size
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 30772a909aea3e..d600a6d751e295 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -110,6 +110,12 @@ static inline int num_contig_ptes(unsigned long size, size_t *pgsize)
 		contig_ptes = CONT_PTES;
 		break;
 	default:
+		if (size > 0 && size < PMD_SIZE &&
+				IS_ALIGNED(size, CONT_PTE_SIZE)) {
+			*pgsize = PAGE_SIZE;
+			contig_ptes = size >> PAGE_SHIFT;
+			break;
+		}
 		WARN_ON(!__hugetlb_valid_size(size));
 	}
 
@@ -359,6 +365,10 @@ pte_t arch_make_huge_pte(pte_t entry, unsigned int shift, vm_flags_t flags)
 	case CONT_PTE_SIZE:
 		return pte_mkcont(entry);
 	default:
+		if (pagesize > 0 && pagesize < PMD_SIZE &&
+				IS_ALIGNED(pagesize, CONT_PTE_SIZE))
+			return pte_mkcont(entry);
+
 		break;
 	}
 	pr_warn("%s: unrecognized huge page size 0x%lx\n",
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 12f4a39fdd0b3e..a088680c39fc12 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -91,6 +91,33 @@ struct vfree_deferred {
 static DEFINE_PER_CPU(struct vfree_deferred, vfree_deferred);
 
 /*** Page table manipulation functions ***/
+
+/*
+ * Try contiguous mappings at the PTE level for arches which support them, and if
+ * requested by the caller. Fall back to PAGE_SIZE mappings otherwise.
+ *
+ * Return: mapping size.
+ */
+static __always_inline unsigned long vmap_set_ptes(pte_t *pte,
+		unsigned long addr, unsigned long end, u64 pfn,
+		pgprot_t prot, unsigned int max_page_shift)
+{
+#ifdef CONFIG_HUGETLB_PAGE
+	unsigned long size;
+
+	size = arch_vmap_pte_range_map_size(addr, end, pfn, max_page_shift);
+	if (size != PAGE_SIZE) {
+		pte_t entry = pfn_pte(pfn, prot);
+
+		entry = arch_make_huge_pte(entry, ilog2(size), 0);
+		set_huge_pte_at(&init_mm, addr, pte, entry, size);
+		return size;
+	}
+#endif
+	set_pte_at(&init_mm, addr, pte, pfn_pte(pfn, prot));
+	return PAGE_SIZE;
+}
+
 static int vmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
 			phys_addr_t phys_addr, pgprot_t prot,
 			unsigned int max_page_shift, pgtbl_mod_mask *mask)
@@ -98,7 +125,8 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
 	pte_t *pte;
 	u64 pfn;
 	struct page *page;
-	unsigned long size = PAGE_SIZE;
+	unsigned long size;
+	unsigned int steps;
 
 	if (WARN_ON_ONCE(!PAGE_ALIGNED(end - addr)))
 		return -EINVAL;
@@ -119,20 +147,9 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
 			BUG();
 		}
 
-#ifdef CONFIG_HUGETLB_PAGE
-		size = arch_vmap_pte_range_map_size(addr, end, pfn, max_page_shift);
-		if (size != PAGE_SIZE) {
-			pte_t entry = pfn_pte(pfn, prot);
-
-			entry = arch_make_huge_pte(entry, ilog2(size), 0);
-			set_huge_pte_at(&init_mm, addr, pte, entry, size);
-			pfn += PFN_DOWN(size);
-			continue;
-		}
-#endif
-		set_pte_at(&init_mm, addr, pte, pfn_pte(pfn, prot));
-		pfn++;
-	} while (pte += PFN_DOWN(size), addr += size, addr != end);
+		size = vmap_set_ptes(pte, addr, end, pfn, prot, max_page_shift);
+		steps = PFN_DOWN(size);
+	} while (pte += steps, pfn += steps, addr += size, addr != end);
 
 	lazy_mmu_mode_disable();
 	*mask |= PGTBL_PTE_MODIFIED;
@@ -524,8 +541,10 @@ void vunmap_range(unsigned long addr, unsigned long end)
 
 static int vmap_pages_pte_range(pmd_t *pmd, unsigned long addr,
 		unsigned long end, pgprot_t prot, struct page **pages, int *nr,
-		pgtbl_mod_mask *mask)
+		pgtbl_mod_mask *mask, unsigned int shift)
 {
+	unsigned long pfn, size;
+	unsigned int steps;
 	int err = 0;
 	pte_t *pte;
 
@@ -556,9 +575,10 @@ static int vmap_pages_pte_range(pmd_t *pmd, unsigned long addr,
 			break;
 		}
 
-		set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
-		(*nr)++;
-	} while (pte++, addr += PAGE_SIZE, addr != end);
+		pfn = page_to_pfn(page);
+		size = vmap_set_ptes(pte, addr, end, pfn, prot, shift);
+		steps = PFN_DOWN(size);
+	} while (pte += steps, *nr += steps, addr += size, addr != end);
 
 	lazy_mmu_mode_disable();
 	*mask |= PGTBL_PTE_MODIFIED;
@@ -568,7 +588,7 @@ static int vmap_pages_pte_range(pmd_t *pmd, unsigned long addr,
 
 static int vmap_pages_pmd_range(pud_t *pud, unsigned long addr,
 		unsigned long end, pgprot_t prot, struct page **pages, int *nr,
-		pgtbl_mod_mask *mask)
+		pgtbl_mod_mask *mask, unsigned int shift)
 {
 	pmd_t *pmd;
 	unsigned long next;
@@ -578,7 +598,27 @@ static int vmap_pages_pmd_range(pud_t *pud, unsigned long addr,
 		return -ENOMEM;
 	do {
 		next = pmd_addr_end(addr, end);
-		if (vmap_pages_pte_range(pmd, addr, next, prot, pages, nr, mask))
+
+		if (shift >= PMD_SHIFT) {
+			struct page *page = pages[*nr];
+			phys_addr_t phys_addr;
+
+			if (WARN_ON(!page))
+				return -ENOMEM;
+			if (WARN_ON(!pfn_valid(page_to_pfn(page))))
+				return -EINVAL;
+
+			phys_addr = page_to_phys(page);
+
+			if (vmap_try_huge_pmd(pmd, addr, next, phys_addr, prot,
+						shift)) {
+				*mask |= PGTBL_PMD_MODIFIED;
+				*nr += 1 << (PMD_SHIFT - PAGE_SHIFT);
+				continue;
+			}
+		}
+
+		if (vmap_pages_pte_range(pmd, addr, next, prot, pages, nr, mask, shift))
 			return -ENOMEM;
 	} while (pmd++, addr = next, addr != end);
 	return 0;
@@ -586,7 +626,7 @@ static int vmap_pages_pmd_range(pud_t *pud, unsigned long addr,
 
 static int vmap_pages_pud_range(p4d_t *p4d, unsigned long addr,
 		unsigned long end, pgprot_t prot, struct page **pages, int *nr,
-		pgtbl_mod_mask *mask)
+		pgtbl_mod_mask *mask, unsigned int shift)
 {
 	pud_t *pud;
 	unsigned long next;
@@ -596,7 +636,7 @@ static int vmap_pages_pud_range(p4d_t *p4d, unsigned long addr,
 		return -ENOMEM;
 	do {
 		next = pud_addr_end(addr, end);
-		if (vmap_pages_pmd_range(pud, addr, next, prot, pages, nr, mask))
+		if (vmap_pages_pmd_range(pud, addr, next, prot, pages, nr, mask, shift))
 			return -ENOMEM;
 	} while (pud++, addr = next, addr != end);
 	return 0;
@@ -604,7 +644,7 @@ static int vmap_pages_pud_range(p4d_t *p4d, unsigned long addr,
 
 static int vmap_pages_p4d_range(pgd_t *pgd, unsigned long addr,
 		unsigned long end, pgprot_t prot, struct page **pages, int *nr,
-		pgtbl_mod_mask *mask)
+		pgtbl_mod_mask *mask, unsigned int shift)
 {
 	p4d_t *p4d;
 	unsigned long next;
@@ -614,14 +654,18 @@ static int vmap_pages_p4d_range(pgd_t *pgd, unsigned long addr,
 		return -ENOMEM;
 	do {
 		next = p4d_addr_end(addr, end);
-		if (vmap_pages_pud_range(p4d, addr, next, prot, pages, nr, mask))
+		if (vmap_pages_pud_range(p4d, addr, next, prot, pages, nr, mask, shift))
 			return -ENOMEM;
 	} while (p4d++, addr = next, addr != end);
 	return 0;
 }
 
-static int vmap_small_pages_range_noflush(unsigned long addr, unsigned long end,
-		pgprot_t prot, struct page **pages)
+/*
+ * It can take an array of pages which are not all contiguous, but it
+ * may have contiguous chunks, as hinted by @shift.
+ */
+static int vmap_pages_range_noflush_walk(unsigned long addr, unsigned long end,
+		pgprot_t prot, struct page **pages, unsigned int shift)
 {
 	unsigned long start = addr;
 	pgd_t *pgd;
@@ -636,7 +680,7 @@ static int vmap_small_pages_range_noflush(unsigned long addr, unsigned long end,
 		next = pgd_addr_end(addr, end);
 		if (pgd_bad(*pgd))
 			mask |= PGTBL_PGD_MODIFIED;
-		err = vmap_pages_p4d_range(pgd, addr, next, prot, pages, &nr, &mask);
+		err = vmap_pages_p4d_range(pgd, addr, next, prot, pages, &nr, &mask, shift);
 		if (err)
 			break;
 	} while (pgd++, addr = next, addr != end);
@@ -659,27 +703,12 @@ static int vmap_small_pages_range_noflush(unsigned long addr, unsigned long end,
 int __vmap_pages_range_noflush(unsigned long addr, unsigned long end,
 		pgprot_t prot, struct page **pages, unsigned int page_shift)
 {
-	unsigned int i, nr = (end - addr) >> PAGE_SHIFT;
-
 	WARN_ON(page_shift < PAGE_SHIFT);
 
-	if (!IS_ENABLED(CONFIG_HAVE_ARCH_HUGE_VMALLOC) ||
-			page_shift == PAGE_SHIFT)
-		return vmap_small_pages_range_noflush(addr, end, prot, pages);
-
-	for (i = 0; i < nr; i += 1U << (page_shift - PAGE_SHIFT)) {
-		int err;
+	if (!IS_ENABLED(CONFIG_HAVE_ARCH_HUGE_VMALLOC))
+		page_shift = PAGE_SHIFT;
 
-		err = vmap_range_noflush(addr, addr + (1UL << page_shift),
-					page_to_phys(pages[i]), prot,
-					page_shift);
-		if (err)
-			return err;
-
-		addr += 1UL << page_shift;
-	}
-
-	return 0;
+	return vmap_pages_range_noflush_walk(addr, end, prot, pages, page_shift);
 }
 
 int vmap_pages_range_noflush(unsigned long addr, unsigned long end,
@@ -3279,6 +3308,14 @@ struct vm_struct *get_vm_area_caller(unsigned long size, unsigned long flags,
 				  NUMA_NO_NODE, GFP_KERNEL, caller);
 }
 
+static struct vm_struct *__get_vm_area_node_aligned_caller(unsigned long size,
+		unsigned long align, unsigned long flags, const void *caller)
+{
+	return __get_vm_area_node(size, align, PAGE_SHIFT, flags,
+				  VMALLOC_START, VMALLOC_END,
+				  NUMA_NO_NODE, GFP_KERNEL, caller);
+}
+
 /**
  * find_vm_area - find a continuous kernel virtual area
  * @addr:	  base address
@@ -3519,6 +3556,113 @@ void vunmap(const void *addr)
 }
 EXPORT_SYMBOL(vunmap);
 
+static inline unsigned int vm_shift(pgprot_t prot, unsigned long size)
+{
+	if (arch_vmap_pmd_supported(prot) && size >= PMD_SIZE)
+		return PMD_SHIFT;
+
+	return arch_vmap_pte_supported_shift(size);
+}
+
+static inline int get_vmap_batch_order(struct page **pages,
+		pgprot_t prot, unsigned int max_steps, unsigned int idx)
+{
+	unsigned int nr_contig;
+	int order;
+
+	if (!IS_ENABLED(CONFIG_HAVE_ARCH_HUGE_VMAP))
+		return 0;
+
+	nr_contig = num_pages_contiguous(&pages[idx], max_steps);
+	if (nr_contig < 2)
+		return 0;
+
+	order = ilog2(nr_contig);
+
+	/* Limit order by pfn alignment */
+	order = min_t(int, order, __ffs(page_to_pfn(pages[idx])));
+
+	if (vm_shift(prot, PAGE_SIZE << order) == PAGE_SHIFT)
+		return 0;
+
+	return order;
+}
+
+static int vmap_pages_range_batched(unsigned long addr, unsigned long end,
+		pgprot_t prot, struct page **pages)
+{
+	unsigned int count = (end - addr) >> PAGE_SHIFT;
+	unsigned int prev_shift = 0, idx = 0;
+	unsigned long map_addr = addr, batch_end = addr;
+	int err;
+
+	err = kmsan_vmap_pages_range_noflush(addr, end, prot, pages,
+						PAGE_SHIFT, GFP_KERNEL);
+	if (err)
+		goto out;
+
+	for (unsigned int i = 0; i < count; ) {
+		unsigned int shift = PAGE_SHIFT +
+			get_vmap_batch_order(pages, prot, count - i, i);
+
+		if (!i)
+			prev_shift = shift;
+
+		if (shift != prev_shift) {
+			err = vmap_pages_range_noflush_walk(map_addr, batch_end,
+					prot, pages + idx, prev_shift);
+			if (err)
+				goto out;
+			prev_shift = shift;
+			map_addr = batch_end;
+			idx = i;
+		}
+
+		/*
+		 * Once small pages are encountered, the remaining pages
+		 * are likely small as well.
+		 */
+		if (shift == PAGE_SHIFT)
+			break;
+
+		batch_end += 1UL << shift;
+		i += 1U << (shift - PAGE_SHIFT);
+	}
+
+	/* Remaining */
+	if (map_addr < end)
+		err = vmap_pages_range_noflush_walk(map_addr, end,
+				prot, pages + idx, prev_shift);
+
+out:
+	flush_cache_vmap(addr, end);
+	return err;
+}
+
+static struct vm_struct *vmap_get_aligned_vm_area(unsigned long size,
+		unsigned long flags, pgprot_t prot, const void *caller)
+{
+	struct vm_struct *vm_area;
+	unsigned int shift;
+
+	if (arch_vmap_pmd_supported(prot) && size >= PMD_SIZE) {
+		vm_area = __get_vm_area_node_aligned_caller(size, PMD_SIZE,
+				flags, caller);
+		if (vm_area)
+			return vm_area;
+	}
+
+	shift = arch_vmap_pte_supported_shift(size);
+	if (shift > PAGE_SHIFT) {
+		vm_area = __get_vm_area_node_aligned_caller(size, 1UL << shift,
+				flags, caller);
+		if (vm_area)
+			return vm_area;
+	}
+
+	return __get_vm_area_node_aligned_caller(size, PAGE_SIZE, flags, caller);
+}
+
 /**
  * vmap - map an array of pages into virtually contiguous space
  * @pages: array of page pointers
@@ -3557,13 +3701,14 @@ void *vmap(struct page **pages, unsigned int count,
 		return NULL;
 
 	size = (unsigned long)count << PAGE_SHIFT;
-	area = get_vm_area_caller(size, flags, __builtin_return_address(0));
+	area = vmap_get_aligned_vm_area(size, flags, prot,
+				__builtin_return_address(0));
 	if (!area)
 		return NULL;
 
 	addr = (unsigned long)area->addr;
-	if (vmap_pages_range(addr, addr + size, pgprot_nx(prot),
-				pages, PAGE_SHIFT) < 0) {
+	if (vmap_pages_range_batched(addr, addr + size, pgprot_nx(prot),
+				pages) < 0) {
 		vunmap(area->addr);
 		return NULL;
 	}

3/2 2026/07/06 09:09 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 7119
							output: 24
							thoughts: 523

Thoughts: 
**Analyzing the `vmap` Patch for Fuzzing**

Alright, let's break this down. We have a patch that's fundamentally altering how `vmap` and its related functions in `mm/vmalloc.c` and a few architecture-specific files handle memory mapping. It seems they're introducing some batched contiguous mappings at the PTE level, specifically for architectures like ARM64 with `CONT_PTE_SIZE`. This is significant because `vmap` is a core, critical kernel API, heavily relied upon by numerous drivers and subsystems to map arrays of pages contiguously. So, the patch is aiming for optimization here, using huge pages or contiguous PTEs when feasible within `vmap`.

My initial thought? This is definitely functional and ripe for fuzzing. The patch is touching core memory management, so it's a high-value target.

Now, let's identify the key functions to focus the fuzzing efforts. Clearly, `vmap` itself is a prime candidate, given its widespread use, but it's *everywhere*. The patch is modifying `vmap`, it calls `vmap_pages_range_batched`, `vmap_get_aligned_vm_area`, and `vmap_pages_range_noflush_walk` (formerly `vmap_small_pages_range_noflush`), and of course, `vmap_set_ptes`, which is probably the heart of this batched PTE logic. These are static functions within `mm/vmalloc.c`, so while they're not directly exported, they're critical to the overall `vmap` flow. So, we'll hit `vmap`, the `vmap_pages_range_batched`, `vmap_pages_range_noflush_walk`, and `vmap_set_ptes` functions. Because of the main changes, we should also include the `vmap_pages_range_noflush`, `__vmap_pages_range_noflush`.

Finally, we need to understand the configuration context. We're seeing references to `CONFIG_HAVE_ARCH_HUGE_VMALLOC`, `CONFIG_HAVE_ARCH_HUGE_VMAP`, and `CONFIG_HUGETLB_PAGE`. I'll use `grepper` to quickly track down where these are defined. Understanding the configuration options that enable this new functionality is key to setting up effective fuzzing scenarios.

4/2 2026/07/06 09:09 tool grepper
0m Args: 
{
  "Expression": "HAVE_ARCH_HUGE_VMALLOC"
}

Results: 
{
  "Output": "arch/Kconfig=1092=config HAVE_ARCH_HUGE_VMAP\n--\narch/Kconfig-1099-#\narch/Kconfig:1100:config HAVE_ARCH_HUGE_VMALLOC\narch/Kconfig-1101-\tdepends on HAVE_ARCH_HUGE_VMAP\n--\narch/arm64/Kconfig=2=config ARM64\n--\narch/arm64/Kconfig-153-\tselect HAVE_ARCH_COMPILER_H\narch/arm64/Kconfig:154:\tselect HAVE_ARCH_HUGE_VMALLOC\narch/arm64/Kconfig-155-\tselect HAVE_ARCH_HUGE_VMAP\n--\narch/powerpc/Kconfig=118=config PPC\n--\narch/powerpc/Kconfig-218-\tselect HAVE_ARCH_AUDITSYSCALL\narch/powerpc/Kconfig:219:\tselect HAVE_ARCH_HUGE_VMALLOC\t\tif HAVE_ARCH_HUGE_VMAP\narch/powerpc/Kconfig-220-\tselect HAVE_ARCH_HUGE_VMAP\t\tif PPC_RADIX_MMU || PPC_8xx\n--\narch/riscv/Kconfig=13=config RISCV\n--\narch/riscv/Kconfig-131-\tselect HAVE_ARCH_BITREVERSE if RISCV_ISA_ZBKB \u0026\u0026 BITREVERSE\narch/riscv/Kconfig:132:\tselect HAVE_ARCH_HUGE_VMALLOC if HAVE_ARCH_HUGE_VMAP\narch/riscv/Kconfig-133-\tselect HAVE_ARCH_HUGE_VMAP if MMU \u0026\u0026 64BIT\n--\narch/x86/Kconfig=58=config X86\n--\narch/x86/Kconfig-192-\tselect HAVE_ARCH_HUGE_VMAP\t\tif X86_64 || X86_PAE\narch/x86/Kconfig:193:\tselect HAVE_ARCH_HUGE_VMALLOC\t\tif X86_64\narch/x86/Kconfig-194-\tselect HAVE_ARCH_JUMP_LABEL\n--\ninclude/linux/vmalloc.h=19=struct iov_iter;\t\t/* in uio.h */\n--\ninclude/linux/vmalloc.h-31-#define VM_MAP_PUT_PAGES\t0x00000200\t/* put pages and free array in vfree */\ninclude/linux/vmalloc.h:32:#define VM_ALLOW_HUGE_VMAP\t0x00000400      /* Allow for huge pages on archs with HAVE_ARCH_HUGE_VMALLOC */\ninclude/linux/vmalloc.h-33-\n--\ninclude/linux/vmalloc.h=52=struct vm_struct {\n--\ninclude/linux/vmalloc.h-61-\tstruct page\t\t**pages;\ninclude/linux/vmalloc.h:62:#ifdef CONFIG_HAVE_ARCH_HUGE_VMALLOC\ninclude/linux/vmalloc.h-63-\tunsigned int\t\tpage_order;\n--\ninclude/linux/vmalloc.h=258=static inline bool is_vm_area_hugepages(const void *addr)\n--\ninclude/linux/vmalloc.h-266-\t */\ninclude/linux/vmalloc.h:267:#ifdef CONFIG_HAVE_ARCH_HUGE_VMALLOC\ninclude/linux/vmalloc.h-268-\tstruct vm_struct *area = find_vm_area(addr);\n--\nmm/vmalloc.c=63=static const unsigned int ioremap_max_page_shift = PAGE_SHIFT;\n--\nmm/vmalloc.c-65-\nmm/vmalloc.c:66:#ifdef CONFIG_HAVE_ARCH_HUGE_VMALLOC\nmm/vmalloc.c-67-static bool __ro_after_init vmap_allow_huge = true;\n--\nmm/vmalloc.c=74=early_param(\"nohugevmalloc\", set_nohugevmalloc);\nmm/vmalloc.c:75:#else /* CONFIG_HAVE_ARCH_HUGE_VMALLOC */\nmm/vmalloc.c-76-static const bool vmap_allow_huge = false;\nmm/vmalloc.c:77:#endif\t/* CONFIG_HAVE_ARCH_HUGE_VMALLOC */\nmm/vmalloc.c-78-\n--\nmm/vmalloc.c=703=int __vmap_pages_range_noflush(unsigned long addr, unsigned long end,\n--\nmm/vmalloc.c-707-\nmm/vmalloc.c:708:\tif (!IS_ENABLED(CONFIG_HAVE_ARCH_HUGE_VMALLOC))\nmm/vmalloc.c-709-\t\tpage_shift = PAGE_SHIFT;\n--\nmm/vmalloc.c=3134=static inline unsigned int vm_area_page_order(struct vm_struct *vm)\nmm/vmalloc.c-3135-{\nmm/vmalloc.c:3136:#ifdef CONFIG_HAVE_ARCH_HUGE_VMALLOC\nmm/vmalloc.c-3137-\treturn vm-\u003epage_order;\n--\nmm/vmalloc.c=3148=static inline void set_vm_area_page_order(struct vm_struct *vm, unsigned int order)\nmm/vmalloc.c-3149-{\nmm/vmalloc.c:3150:#ifdef CONFIG_HAVE_ARCH_HUGE_VMALLOC\nmm/vmalloc.c-3151-\tvm-\u003epage_order = order;\n"
}
5/2 2026/07/06 09:09 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 9568
							output: 21
							thoughts: 71

Thoughts: 
**Examining the New Code's HugTLB Dependency**

Okay, so this patch introduces `vmap_set_ptes`, and the first thing that jumps out at me is that `#ifdef CONFIG_HUGETLB_PAGE`. Right away, this tells me we're dealing with HugeTLB pages, specifically within the virtual memory mapping context. I need to understand how this is connected to HugeTLBs. This also touches on `CONFIG_HAVE_ARCH_HUGE_VMAP` and `CONFIG_HAVE_ARCH_HUGE_VMALLOC`. That's interesting, as it indicates the architecture might have some specific support or requirements for handling huge virtual memory mappings. Seems like this is going to be relevant to virtual memory mapping with huge pages. My next step will be to dive deeper into the `CONFIG_HUGETLB_PAGE` definition to get a full picture of what this is all about.

6/2 2026/07/06 09:09 tool grepper
0m Args: 
{
  "Expression": "CONFIG_HUGETLB_PAGE"
}

Results: 
{
  "Output": "\nFull output is too long, showing 500 out of 1017 lines.\nUse more precise expression if possible.\n\nDocumentation/admin-guide/kernel-parameters.txt=95=Kernel parameters\n--\nDocumentation/admin-guide/kernel-parameters.txt-2085-\thugetlb_free_vmemmap=\nDocumentation/admin-guide/kernel-parameters.txt:2086:\t\t\t[KNL] Requires CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP\nDocumentation/admin-guide/kernel-parameters.txt-2087-\t\t\tenabled.\n--\nDocumentation/admin-guide/kernel-parameters.txt-2095-\nDocumentation/admin-guide/kernel-parameters.txt:2096:\t\t\tBuilt with CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON=y,\nDocumentation/admin-guide/kernel-parameters.txt-2097-\t\t\tthe default is on.\n--\nDocumentation/admin-guide/mm/hugetlbpage.rst=22=First the Linux kernel needs to be built with the CONFIG_HUGETLBFS\nDocumentation/admin-guide/mm/hugetlbpage.rst:23:(present under \"File systems\") and CONFIG_HUGETLB_PAGE (selected\nDocumentation/admin-guide/mm/hugetlbpage.rst-24-automatically when CONFIG_HUGETLBFS is selected) configuration\n--\nDocumentation/admin-guide/mm/hugetlbpage.rst=174=hugetlb_free_vmemmap\nDocumentation/admin-guide/mm/hugetlbpage.rst:175:\tWhen CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP is set, this enables HugeTLB\nDocumentation/admin-guide/mm/hugetlbpage.rst-176-\tVmemmap Optimization (HVO).\n--\narch/arm64/include/asm/mte.h=157=static inline int mte_ptrace_copy_tags(struct task_struct *child,\n--\narch/arm64/include/asm/mte.h-165-\narch/arm64/include/asm/mte.h:166:#if defined(CONFIG_HUGETLB_PAGE) \u0026\u0026 defined(CONFIG_ARM64_MTE)\narch/arm64/include/asm/mte.h-167-static inline void folio_set_hugetlb_mte_tagged(struct folio *folio)\n--\narch/arm64/mm/Makefile=6=obj-$(CONFIG_ARM64_CONTPTE)\t+= contpte.o\narch/arm64/mm/Makefile:7:obj-$(CONFIG_HUGETLB_PAGE)\t+= hugetlbpage.o\narch/arm64/mm/Makefile-8-obj-$(CONFIG_PTDUMP)\t\t+= ptdump.o\n--\narch/hexagon/include/asm/page.h-39- */\narch/hexagon/include/asm/page.h:40:#ifdef CONFIG_HUGETLB_PAGE\narch/hexagon/include/asm/page.h-41-#define HPAGE_SHIFT 22\n--\narch/hexagon/include/asm/pgtable.h=129=extern pgd_t swapper_pg_dir[PTRS_PER_PGD];  /* located in head.S */\n--\narch/hexagon/include/asm/pgtable.h-131-/*  HUGETLB not working currently  */\narch/hexagon/include/asm/pgtable.h:132:#ifdef CONFIG_HUGETLB_PAGE\narch/hexagon/include/asm/pgtable.h-133-#define pte_mkhuge(pte) __pte((pte_val(pte) \u0026 ~0x3) | HVM_HUGEPAGE_SIZE)\n--\narch/loongarch/mm/Makefile=10=obj-$(CONFIG_HIGHMEM)\t\t+= highmem.o\narch/loongarch/mm/Makefile:11:obj-$(CONFIG_HUGETLB_PAGE)\t+= hugetlbpage.o\narch/loongarch/mm/Makefile-12-obj-$(CONFIG_KASAN)\t\t+= kasan_init.o\n--\narch/loongarch/mm/tlb.c=138=static void __update_hugetlb(struct vm_area_struct *vma, unsigned long address, pte_t *ptep)\narch/loongarch/mm/tlb.c-139-{\narch/loongarch/mm/tlb.c:140:#ifdef CONFIG_HUGETLB_PAGE\narch/loongarch/mm/tlb.c-141-\tint idx;\n--\narch/mips/mm/Makefile=31=obj-$(CONFIG_HIGHMEM)\t\t+= highmem.o\narch/mips/mm/Makefile:32:obj-$(CONFIG_HUGETLB_PAGE)\t+= hugetlbpage.o\narch/mips/mm/Makefile-33-obj-$(CONFIG_DMA_NONCOHERENT)\t+= dma-noncoherent.o\n--\narch/parisc/include/asm/page.h=93=extern int npmem_ranges;\n--\narch/parisc/include/asm/page.h-147-\narch/parisc/include/asm/page.h:148:#ifdef CONFIG_HUGETLB_PAGE\narch/parisc/include/asm/page.h-149-#define HPAGE_SHIFT\t\tPMD_SHIFT /* fixed for transparent huge pages */\n--\narch/parisc/include/asm/page.h-163-#endif\narch/parisc/include/asm/page.h:164:#endif /* CONFIG_HUGETLB_PAGE */\narch/parisc/include/asm/page.h-165-\n--\narch/parisc/include/asm/pgtable.h=64=extern void __update_cache(pte_t pte);\n--\narch/parisc/include/asm/pgtable.h-170-#define _PAGE_USER_BIT     20   /* (0x800) Software: User accessible page */\narch/parisc/include/asm/pgtable.h:171:#ifdef CONFIG_HUGETLB_PAGE\narch/parisc/include/asm/pgtable.h-172-#define _PAGE_SPECIAL_BIT  _PAGE_DMB_BIT  /* DMB feature is currently unused */\n--\narch/parisc/include/asm/pgtable.h=315=static inline pte_t pte_mkspecial(pte_t pte)\t{ pte_val(pte) |= _PAGE_SPECIAL; return pte; }\n--\narch/parisc/include/asm/pgtable.h-319- */\narch/parisc/include/asm/pgtable.h:320:#ifdef CONFIG_HUGETLB_PAGE\narch/parisc/include/asm/pgtable.h-321-#define pte_huge(pte)           (pte_val(pte) \u0026 _PAGE_HUGE)\n--\narch/parisc/kernel/asm-offsets.c=41=int main(void)\n--\narch/parisc/kernel/asm-offsets.c-278-\t * and kernel data on physical huge pages */\narch/parisc/kernel/asm-offsets.c:279:#ifdef CONFIG_HUGETLB_PAGE\narch/parisc/kernel/asm-offsets.c-280-\tDEFINE(HUGEPAGE_SIZE, 1UL \u003c\u003c REAL_HPAGE_SHIFT);\n--\narch/parisc/kernel/entry.S-481-\t.macro\t\tconvert_for_tlb_insert20 pte,tmp\narch/parisc/kernel/entry.S:482:#ifdef CONFIG_HUGETLB_PAGE\narch/parisc/kernel/entry.S-483-\tcopy\t\t\\pte,\\tmp\n--\narch/parisc/kernel/setup.c=101=void __init setup_arch(char **cmdline_p)\n--\narch/parisc/kernel/setup.c-114-\t\t(int)(PAGE_SIZE / 1024));\narch/parisc/kernel/setup.c:115:#ifdef CONFIG_HUGETLB_PAGE\narch/parisc/kernel/setup.c-116-\tprintk(KERN_CONT \"enabled with %d MB physical and %d MB virtual size\",\n--\narch/parisc/mm/Makefile=6=obj-y\t := init.o fault.o ioremap.o fixmap.o\narch/parisc/mm/Makefile:7:obj-$(CONFIG_HUGETLB_PAGE) += hugetlbpage.o\n--\narch/powerpc/include/asm/book3s/64/hash-64k.h-74-\narch/powerpc/include/asm/book3s/64/hash-64k.h:75:#if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_HUGETLB_PAGE)\narch/powerpc/include/asm/book3s/64/hash-64k.h-76-#define H_PMD_FRAG_SIZE_SHIFT  (H_PMD_INDEX_SIZE + 3 + 1)\n--\narch/powerpc/include/asm/book3s/64/hash-64k.h=175=static inline int hash__remap_4k_pfn(struct vm_area_struct *vma, unsigned long addr,\n--\narch/powerpc/include/asm/book3s/64/hash-64k.h-186-#define H_PTE_TABLE_SIZE\tPTE_FRAG_SIZE\narch/powerpc/include/asm/book3s/64/hash-64k.h:187:#if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined (CONFIG_HUGETLB_PAGE)\narch/powerpc/include/asm/book3s/64/hash-64k.h-188-#define H_PMD_TABLE_SIZE\t((sizeof(pmd_t) \u003c\u003c PMD_INDEX_SIZE) + \\\n--\narch/powerpc/include/asm/book3s/64/hash-64k.h-192-#endif\narch/powerpc/include/asm/book3s/64/hash-64k.h:193:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/include/asm/book3s/64/hash-64k.h-194-#define H_PUD_TABLE_SIZE\t((sizeof(pud_t) \u003c\u003c PUD_INDEX_SIZE) +\t\\\n--\narch/powerpc/include/asm/book3s/64/hash.h-46- */\narch/powerpc/include/asm/book3s/64/hash.h:47:#if defined(CONFIG_HUGETLB_PAGE) \u0026\u0026  defined(CONFIG_PPC_64K_PAGES)\narch/powerpc/include/asm/book3s/64/hash.h-48-#define H_PUD_CACHE_INDEX\t(H_PUD_INDEX_SIZE + 1)\n--\narch/powerpc/include/asm/book3s/64/mmu-hash.h=712=struct hash_mm_context {\n--\narch/powerpc/include/asm/book3s/64/mmu-hash.h-722-\tstruct slice_mask mask_4k;\narch/powerpc/include/asm/book3s/64/mmu-hash.h:723:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/include/asm/book3s/64/mmu-hash.h-724-\tstruct slice_mask mask_16m;\n--\narch/powerpc/include/asm/book3s/64/mmu.h=169=static inline struct slice_mask *slice_mask_for_size(mm_context_t *ctx, int psize)\n--\narch/powerpc/include/asm/book3s/64/mmu.h-174-#endif\narch/powerpc/include/asm/book3s/64/mmu.h:175:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/include/asm/book3s/64/mmu.h-176-\tif (psize == MMU_PAGE_16M)\n--\narch/powerpc/include/asm/book3s/64/pgalloc.h=48=static inline pgd_t *pgd_alloc(struct mm_struct *mm)\n--\narch/powerpc/include/asm/book3s/64/pgalloc.h-73-\t */\narch/powerpc/include/asm/book3s/64/pgalloc.h:74:#if defined(CONFIG_HUGETLB_PAGE) \u0026\u0026 defined(CONFIG_PPC_64K_PAGES) \u0026\u0026 \\\narch/powerpc/include/asm/book3s/64/pgalloc.h-75-\t(H_PGD_INDEX_SIZE == H_PUD_CACHE_INDEX)\n--\narch/powerpc/include/asm/book3s/64/pgtable-64k.h-5-#ifndef __ASSEMBLER__\narch/powerpc/include/asm/book3s/64/pgtable-64k.h:6:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/include/asm/book3s/64/pgtable-64k.h-7-\narch/powerpc/include/asm/book3s/64/pgtable-64k.h:8:#endif /* CONFIG_HUGETLB_PAGE */\narch/powerpc/include/asm/book3s/64/pgtable-64k.h-9-\n--\narch/powerpc/include/asm/book3s/64/slice.h-7-#ifdef CONFIG_PPC_64S_HASH_MMU\narch/powerpc/include/asm/book3s/64/slice.h:8:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/include/asm/book3s/64/slice.h-9-#define HAVE_ARCH_HUGETLB_UNMAPPED_AREA\n--\narch/powerpc/include/asm/hugetlb.h-4-\narch/powerpc/include/asm/hugetlb.h:5:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/include/asm/hugetlb.h-6-#include \u003casm/page.h\u003e\n--\narch/powerpc/include/asm/hugetlb.h=67=int huge_ptep_set_access_flags(struct vm_area_struct *vma,\n--\narch/powerpc/include/asm/hugetlb.h-72-\narch/powerpc/include/asm/hugetlb.h:73:#else /* ! CONFIG_HUGETLB_PAGE */\narch/powerpc/include/asm/hugetlb.h-74-static inline void flush_hugetlb_page(struct vm_area_struct *vma,\n--\narch/powerpc/include/asm/hugetlb.h=79=static inline void __init hugetlbpage_init_defaultsize(void)\n--\narch/powerpc/include/asm/hugetlb.h-81-}\narch/powerpc/include/asm/hugetlb.h:82:#endif /* CONFIG_HUGETLB_PAGE */\narch/powerpc/include/asm/hugetlb.h-83-\n--\narch/powerpc/include/asm/page.h-26-#ifndef __ASSEMBLER__\narch/powerpc/include/asm/page.h:27:#ifndef CONFIG_HUGETLB_PAGE\narch/powerpc/include/asm/page.h-28-#define HPAGE_SHIFT PAGE_SHIFT\n--\narch/powerpc/include/asm/pgtable.h=144=static inline void update_mmu_cache_range(struct vm_fault *vmf,\n--\narch/powerpc/include/asm/pgtable.h-148-\tif ((mmu_has_feature(MMU_FTR_HPTE_TABLE) \u0026\u0026 !radix_enabled()) ||\narch/powerpc/include/asm/pgtable.h:149:\t    (IS_ENABLED(CONFIG_PPC_E500) \u0026\u0026 IS_ENABLED(CONFIG_HUGETLB_PAGE)))\narch/powerpc/include/asm/pgtable.h-150-\t\t__update_mmu_cache(vma, address, ptep);\n--\narch/powerpc/include/asm/pte-walk.h=10=static inline pte_t *find_linux_pte(pgd_t *pgdir, unsigned long ea,\n--\narch/powerpc/include/asm/pte-walk.h-18-#if defined(CONFIG_DEBUG_VM) \u0026\u0026\t\t\t\t\t\t\\\narch/powerpc/include/asm/pte-walk.h:19:\t!(defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE))\narch/powerpc/include/asm/pte-walk.h-20-\t/*\n--\narch/powerpc/kernel/fadump.c=549=int __init fadump_reserve_mem(void)\n--\narch/powerpc/kernel/fadump.c-594-\narch/powerpc/kernel/fadump.c:595:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/kernel/fadump.c-596-\t\t/*\n--\narch/powerpc/kernel/head_85xx.S=166=set_ivor:\n--\narch/powerpc/kernel/head_85xx.S-307- */\narch/powerpc/kernel/head_85xx.S:308:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/kernel/head_85xx.S-309-#define FIND_PTE\t\\\n--\narch/powerpc/kernel/head_85xx.S=666=finish_tlb_load:\narch/powerpc/kernel/head_85xx.S:667:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/kernel/head_85xx.S-668-\tcmpwi\t6, r10, 0\t\t\t/* check for huge page */\n--\narch/powerpc/kernel/head_85xx.S-718-\narch/powerpc/kernel/head_85xx.S:719:#endif /* CONFIG_HUGETLB_PAGE */\narch/powerpc/kernel/head_85xx.S-720-\n--\narch/powerpc/kernel/head_85xx.S=739=END_MMU_FTR_SECTION_IFSET(MMU_FTR_BIG_PHYS)\n--\narch/powerpc/kernel/head_85xx.S-742-\trlwimi\tr12, r11, 32-19, 27, 31\t/* extract WIMGE from pte */\narch/powerpc/kernel/head_85xx.S:743:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/kernel/head_85xx.S-744-\tbeq\t6, 3f\t\t\t/* don't mask if page isn't huge */\n--\narch/powerpc/kernel/head_85xx.S=753=tlb_write_entry:\n--\narch/powerpc/kernel/head_85xx.S-757-\tmfspr\tr10, SPRN_SPRG_THREAD\narch/powerpc/kernel/head_85xx.S:758:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/kernel/head_85xx.S-759-\tbeq\t6, 8f /* skip restore for 4k page faults */\n--\narch/powerpc/mm/Makefile=14=obj-$(CONFIG_NUMA) += numa.o\narch/powerpc/mm/Makefile:15:obj-$(CONFIG_HUGETLB_PAGE)\t+= hugetlbpage.o\narch/powerpc/mm/Makefile-16-obj-$(CONFIG_NOT_COHERENT_CACHE) += dma-noncoherent.o\n--\narch/powerpc/mm/book3s64/Makefile=12=endif\narch/powerpc/mm/book3s64/Makefile-13-\narch/powerpc/mm/book3s64/Makefile:14:obj-$(CONFIG_HUGETLB_PAGE)\t+= hugetlbpage.o\narch/powerpc/mm/book3s64/Makefile-15-\narch/powerpc/mm/book3s64/Makefile=16=obj-$(CONFIG_PPC_RADIX_MMU)\t+= radix_pgtable.o radix_tlb.o\narch/powerpc/mm/book3s64/Makefile:17:ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/mm/book3s64/Makefile-18-obj-$(CONFIG_PPC_RADIX_MMU)\t+= radix_hugetlbpage.o\n--\narch/powerpc/mm/book3s64/hash_tlb.c=41=void hpte_need_flush(struct mm_struct *mm, unsigned long addr,\n--\narch/powerpc/mm/book3s64/hash_tlb.c-62-\tif (huge) {\narch/powerpc/mm/book3s64/hash_tlb.c:63:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/mm/book3s64/hash_tlb.c-64-\t\tpsize = get_slice_psize(mm, addr);\n--\narch/powerpc/mm/book3s64/hash_utils.c=846=static int __init htab_dt_scan_page_sizes(unsigned long node,\n--\narch/powerpc/mm/book3s64/hash_utils.c-923-\narch/powerpc/mm/book3s64/hash_utils.c:924:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/mm/book3s64/hash_utils.c-925-/*\n--\narch/powerpc/mm/book3s64/hash_utils.c=929=static int __init htab_dt_scan_hugepage_blocks(unsigned long node,\n--\narch/powerpc/mm/book3s64/hash_utils.c-966-}\narch/powerpc/mm/book3s64/hash_utils.c:967:#endif /* CONFIG_HUGETLB_PAGE */\narch/powerpc/mm/book3s64/hash_utils.c-968-\n--\narch/powerpc/mm/book3s64/hash_utils.c=996=static void __init htab_scan_page_sizes(void)\n--\narch/powerpc/mm/book3s64/hash_utils.c-1019-\narch/powerpc/mm/book3s64/hash_utils.c:1020:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/mm/book3s64/hash_utils.c-1021-\tif (!hugetlb_disabled \u0026\u0026 !early_radix_enabled() ) {\n--\narch/powerpc/mm/book3s64/hash_utils.c-1024-\t}\narch/powerpc/mm/book3s64/hash_utils.c:1025:#endif /* CONFIG_HUGETLB_PAGE */\narch/powerpc/mm/book3s64/hash_utils.c-1026-}\n--\narch/powerpc/mm/book3s64/hash_utils.c=1718=int hash_page_mm(struct mm_struct *mm, unsigned long ea,\n--\narch/powerpc/mm/book3s64/hash_utils.c-1838-\t\t\t\t\t     trap, flags, ssize, psize);\narch/powerpc/mm/book3s64/hash_utils.c:1839:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/mm/book3s64/hash_utils.c-1840-\t\telse\n--\narch/powerpc/mm/book3s64/radix_tlb.c=626=void radix__local_flush_tlb_page(struct vm_area_struct *vma, unsigned long vmaddr)\narch/powerpc/mm/book3s64/radix_tlb.c-627-{\narch/powerpc/mm/book3s64/radix_tlb.c:628:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/mm/book3s64/radix_tlb.c-629-\t/* need the return fix for nohash.c */\n--\narch/powerpc/mm/book3s64/radix_tlb.c=945=void radix__flush_tlb_page(struct vm_area_struct *vma, unsigned long vmaddr)\narch/powerpc/mm/book3s64/radix_tlb.c-946-{\narch/powerpc/mm/book3s64/radix_tlb.c:947:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/mm/book3s64/radix_tlb.c-948-\tif (is_vm_hugetlb_page(vma))\n--\narch/powerpc/mm/book3s64/radix_tlb.c=1111=void radix__flush_tlb_range(struct vm_area_struct *vma, unsigned long start,\n--\narch/powerpc/mm/book3s64/radix_tlb.c-1114-{\narch/powerpc/mm/book3s64/radix_tlb.c:1115:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/mm/book3s64/radix_tlb.c-1116-\tif (is_vm_hugetlb_page(vma))\n--\narch/powerpc/mm/book3s64/slice.c=636=EXPORT_SYMBOL_GPL(slice_get_unmapped_area);\narch/powerpc/mm/book3s64/slice.c-637-\narch/powerpc/mm/book3s64/slice.c:638:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/mm/book3s64/slice.c-639-static int file_to_psize(struct file *file)\n--\narch/powerpc/mm/book3s64/slice.c=757=void slice_set_range_psize(struct mm_struct *mm, unsigned long start,\n--\narch/powerpc/mm/book3s64/slice.c-767-\narch/powerpc/mm/book3s64/slice.c:768:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/mm/book3s64/slice.c-769-/*\n--\narch/powerpc/mm/init_64.c=617=void __init mmu_early_init_devtree(void)\n--\narch/powerpc/mm/init_64.c-664-\narch/powerpc/mm/init_64.c:665:\tif (IS_ENABLED(CONFIG_HUGETLB_PAGE_SIZE_VARIABLE))\narch/powerpc/mm/init_64.c-666-\t\thugetlbpage_init_defaultsize();\n--\narch/powerpc/mm/nohash/Makefile=8=obj-$(CONFIG_RANDOMIZE_BASE)\t+= kaslr_booke.o\narch/powerpc/mm/nohash/Makefile:9:ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/mm/nohash/Makefile-10-obj-$(CONFIG_PPC_E500)\t+= e500_hugetlbpage.o\n--\narch/powerpc/mm/nohash/tlb.c=278=void flush_tlb_page(struct vm_area_struct *vma, unsigned long vmaddr)\narch/powerpc/mm/nohash/tlb.c-279-{\narch/powerpc/mm/nohash/tlb.c:280:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/mm/nohash/tlb.c-281-\tif (vma \u0026\u0026 is_vm_hugetlb_page(vma))\n--\narch/powerpc/mm/pgtable.c=255=int ptep_set_access_flags(struct vm_area_struct *vma, unsigned long address,\n--\narch/powerpc/mm/pgtable.c-268-\narch/powerpc/mm/pgtable.c:269:#ifdef CONFIG_HUGETLB_PAGE\narch/powerpc/mm/pgtable.c-270-int huge_ptep_set_access_flags(struct vm_area_struct *vma,\n--\narch/powerpc/mm/pgtable.c=353=void set_huge_pte_at(struct mm_struct *mm, unsigned long addr, pte_t *ptep,\n--\narch/powerpc/mm/pgtable.c-383-#endif\narch/powerpc/mm/pgtable.c:384:#endif /* CONFIG_HUGETLB_PAGE */\narch/powerpc/mm/pgtable.c-385-\n--\narch/riscv/mm/Makefile=19=obj-y += pmem.o\narch/riscv/mm/Makefile-20-\narch/riscv/mm/Makefile:21:obj-$(CONFIG_HUGETLB_PAGE) += hugetlbpage.o\narch/riscv/mm/Makefile-22-obj-$(CONFIG_PTDUMP) += ptdump.o\n--\narch/s390/include/asm/pgtable.h=1111=static inline pte_t pte_mkspecial(pte_t pte)\n--\narch/s390/include/asm/pgtable.h-1115-\narch/s390/include/asm/pgtable.h:1116:#ifdef CONFIG_HUGETLB_PAGE\narch/s390/include/asm/pgtable.h-1117-static inline pte_t pte_mkhuge(pte_t pte)\n--\narch/s390/include/asm/pgtable.h=1560=static inline pud_t pud_mkdirty(pud_t pud)\n--\narch/s390/include/asm/pgtable.h-1567-\narch/s390/include/asm/pgtable.h:1568:#if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_HUGETLB_PAGE)\narch/s390/include/asm/pgtable.h-1569-static inline unsigned long massage_pgprot_pmd(pgprot_t pgprot)\n--\narch/s390/include/asm/pgtable.h=1618=static inline pmd_t mk_pmd_phys(unsigned long physpage, pgprot_t pgprot)\n--\narch/s390/include/asm/pgtable.h-1622-\narch/s390/include/asm/pgtable.h:1623:#endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLB_PAGE */\narch/s390/include/asm/pgtable.h-1624-\n--\narch/s390/mm/Makefile=10=obj-$(CONFIG_DEBUG_VIRTUAL)\t+= physaddr.o\narch/s390/mm/Makefile:11:obj-$(CONFIG_HUGETLB_PAGE)\t+= hugetlbpage.o\narch/s390/mm/Makefile-12-obj-$(CONFIG_PTDUMP)\t\t+= dump_pagetables.o\n--\narch/sh/configs/apsh4ad0a_defconfig=25=CONFIG_MEMORY_SIZE=0x10000000\narch/sh/configs/apsh4ad0a_defconfig:26:CONFIG_HUGETLB_PAGE_SIZE_1MB=y\narch/sh/configs/apsh4ad0a_defconfig-27-CONFIG_KSM=y\n--\narch/sh/configs/r7785rp_defconfig=16=CONFIG_MEMORY_SIZE=0x08000000\narch/sh/configs/r7785rp_defconfig:17:CONFIG_HUGETLB_PAGE_SIZE_1MB=y\narch/sh/configs/r7785rp_defconfig-18-CONFIG_SH_STORE_QUEUES=y\n--\narch/sh/configs/sdk7786_defconfig=44=CONFIG_NUMA=y\narch/sh/configs/sdk7786_defconfig:45:CONFIG_HUGETLB_PAGE_SIZE_64MB=y\narch/sh/configs/sdk7786_defconfig-46-CONFIG_KSM=y\n--\narch/sh/configs/sh7785lcr_32bit_defconfig=17=CONFIG_PMB=y\narch/sh/configs/sh7785lcr_32bit_defconfig:18:CONFIG_HUGETLB_PAGE_SIZE_1MB=y\narch/sh/configs/sh7785lcr_32bit_defconfig-19-CONFIG_SH_STORE_QUEUES=y\n--\narch/sh/include/asm/page.h-14-\narch/sh/include/asm/page.h:15:#if defined(CONFIG_HUGETLB_PAGE_SIZE_64K)\narch/sh/include/asm/page.h-16-#define HPAGE_SHIFT\t16\narch/sh/include/asm/page.h:17:#elif defined(CONFIG_HUGETLB_PAGE_SIZE_256K)\narch/sh/include/asm/page.h-18-#define HPAGE_SHIFT\t18\narch/sh/include/asm/page.h:19:#elif defined(CONFIG_HUGETLB_PAGE_SIZE_1MB)\narch/sh/include/asm/page.h-20-#define HPAGE_SHIFT\t20\narch/sh/include/asm/page.h:21:#elif defined(CONFIG_HUGETLB_PAGE_SIZE_4MB)\narch/sh/include/asm/page.h-22-#define HPAGE_SHIFT\t22\narch/sh/include/asm/page.h:23:#elif defined(CONFIG_HUGETLB_PAGE_SIZE_64MB)\narch/sh/include/asm/page.h-24-#define HPAGE_SHIFT\t26\n--\narch/sh/include/asm/page.h-26-\narch/sh/include/asm/page.h:27:#ifdef CONFIG_HUGETLB_PAGE\narch/sh/include/asm/page.h-28-#define HPAGE_SIZE\t\t(1UL \u003c\u003c HPAGE_SHIFT)\n--\narch/sh/include/asm/pgtable_32.h=97=static inline unsigned long copy_ptea_attributes(unsigned long x)\n--\narch/sh/include/asm/pgtable_32.h-136-#if defined(CONFIG_X2TLB)\narch/sh/include/asm/pgtable_32.h:137:# if defined(CONFIG_HUGETLB_PAGE_SIZE_64K)\narch/sh/include/asm/pgtable_32.h-138-#  define _PAGE_SZHUGE\t(_PAGE_EXT_ESZ2)\narch/sh/include/asm/pgtable_32.h:139:# elif defined(CONFIG_HUGETLB_PAGE_SIZE_256K)\narch/sh/include/asm/pgtable_32.h-140-#  define _PAGE_SZHUGE\t(_PAGE_EXT_ESZ0 | _PAGE_EXT_ESZ2)\narch/sh/include/asm/pgtable_32.h:141:# elif defined(CONFIG_HUGETLB_PAGE_SIZE_1MB)\narch/sh/include/asm/pgtable_32.h-142-#  define _PAGE_SZHUGE\t(_PAGE_EXT_ESZ0 | _PAGE_EXT_ESZ1 | _PAGE_EXT_ESZ2)\narch/sh/include/asm/pgtable_32.h:143:# elif defined(CONFIG_HUGETLB_PAGE_SIZE_4MB)\narch/sh/include/asm/pgtable_32.h-144-#  define _PAGE_SZHUGE\t(_PAGE_EXT_ESZ3)\narch/sh/include/asm/pgtable_32.h:145:# elif defined(CONFIG_HUGETLB_PAGE_SIZE_64MB)\narch/sh/include/asm/pgtable_32.h-146-#  define _PAGE_SZHUGE\t(_PAGE_EXT_ESZ2 | _PAGE_EXT_ESZ3)\n--\narch/sh/include/asm/pgtable_32.h-149-#else\narch/sh/include/asm/pgtable_32.h:150:# if defined(CONFIG_HUGETLB_PAGE_SIZE_64K)\narch/sh/include/asm/pgtable_32.h-151-#  define _PAGE_SZHUGE\t(_PAGE_SZ1)\narch/sh/include/asm/pgtable_32.h:152:# elif defined(CONFIG_HUGETLB_PAGE_SIZE_1MB)\narch/sh/include/asm/pgtable_32.h-153-#  define _PAGE_SZHUGE\t(_PAGE_SZ0 | _PAGE_SZ1)\n--\narch/sh/mm/Makefile=37=obj-$(CONFIG_DEBUG_FS)\t\t+= $(debugfs-y)\narch/sh/mm/Makefile:38:obj-$(CONFIG_HUGETLB_PAGE)\t+= hugetlbpage.o\narch/sh/mm/Makefile-39-obj-$(CONFIG_PMB)\t\t+= pmb.o\n--\narch/sparc/include/asm/hugetlb.h-6-\narch/sparc/include/asm/hugetlb.h:7:#ifdef CONFIG_HUGETLB_PAGE\narch/sparc/include/asm/hugetlb.h-8-struct pud_huge_patch_entry {\n--\narch/sparc/include/asm/mmu_64.h=75=struct tsb_config {\n--\narch/sparc/include/asm/mmu_64.h-85-\narch/sparc/include/asm/mmu_64.h:86:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/include/asm/mmu_64.h-87-#define MM_TSB_HUGE\t1\n--\narch/sparc/include/asm/mmu_context_64.h=37=static inline void tsb_context_switch_ctx(struct mm_struct *mm,\n--\narch/sparc/include/asm/mmu_context_64.h-41-\t\t\t     \u0026mm-\u003econtext.tsb_block[MM_TSB_BASE],\narch/sparc/include/asm/mmu_context_64.h:42:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/include/asm/mmu_context_64.h-43-\t\t\t     (mm-\u003econtext.tsb_block[MM_TSB_HUGE].tsb ?\n--\narch/sparc/include/asm/page_64.h-23-\narch/sparc/include/asm/page_64.h:24:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/include/asm/page_64.h-25-#define HPAGE_SIZE\t\t(_AC(1,UL) \u003c\u003c HPAGE_SHIFT)\n--\narch/sparc/include/asm/page_64.h-34-\narch/sparc/include/asm/page_64.h:35:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/include/asm/page_64.h-36-struct pt_regs;\n--\narch/sparc/include/asm/pgtable_64.h=374=static inline unsigned long pte_write(pte_t pte)\n--\narch/sparc/include/asm/pgtable_64.h-391-\narch/sparc/include/asm/pgtable_64.h:392:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/include/asm/pgtable_64.h-393-pte_t arch_make_huge_pte(pte_t entry, unsigned int shift, vm_flags_t flags);\n--\narch/sparc/include/asm/pgtable_64.h=1156=asmlinkage void do_sparc64_fault(struct pt_regs *regs);\n--\narch/sparc/include/asm/pgtable_64.h-1159-\narch/sparc/include/asm/pgtable_64.h:1160:#ifdef CONFIG_HUGETLB_PAGE\narch/sparc/include/asm/pgtable_64.h-1161-\n--\narch/sparc/include/asm/pgtable_64.h=1169=extern unsigned long pte_leaf_size(pte_t pte);\narch/sparc/include/asm/pgtable_64.h-1170-\narch/sparc/include/asm/pgtable_64.h:1171:#endif /* CONFIG_HUGETLB_PAGE */\narch/sparc/include/asm/pgtable_64.h-1172-\n--\narch/sparc/include/asm/tsb.h=75=extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;\n--\narch/sparc/include/asm/tsb.h-206-\t */\narch/sparc/include/asm/tsb.h:207:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/include/asm/tsb.h-208-#define USER_PGTABLE_CHECK_PUD_HUGE(VADDR, REG1, REG2, FAIL_LABEL, PTE_LABEL) \\\n--\narch/sparc/include/asm/tsb.h-241-\t */\narch/sparc/include/asm/tsb.h:242:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/include/asm/tsb.h-243-#define USER_PGTABLE_CHECK_PMD_HUGE(VADDR, REG1, REG2, FAIL_LABEL, PTE_LABEL) \\\n--\narch/sparc/kernel/sun4v_tlb_miss.S=175=sun4v_tsb_miss_common:\n--\narch/sparc/kernel/sun4v_tlb_miss.S-179-\narch/sparc/kernel/sun4v_tlb_miss.S:180:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/kernel/sun4v_tlb_miss.S-181-\tmov\tSCRATCHPAD_UTSBREG2, %g5\n--\narch/sparc/kernel/tsb.S=51=tsb_miss_page_table_walk:\n--\narch/sparc/kernel/tsb.S-56-\t */\narch/sparc/kernel/tsb.S:57:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/kernel/tsb.S-58-\n--\narch/sparc/kernel/tsb.S=115=tsb_miss_page_table_walk_sun4v_fastpath:\n--\narch/sparc/kernel/tsb.S-119-\narch/sparc/kernel/tsb.S:120:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/kernel/tsb.S-121-\tsethi\t\t%uhi(_PAGE_PMD_HUGE | _PAGE_PUD_HUGE), %g7\n--\narch/sparc/mm/Makefile=11=obj-$(CONFIG_SPARC32)   += leon_mm.o\n--\narch/sparc/mm/Makefile-13-# Only used by sparc64\narch/sparc/mm/Makefile:14:obj-$(CONFIG_HUGETLB_PAGE) += hugetlbpage.o\narch/sparc/mm/Makefile-15-\n--\narch/sparc/mm/fault_64.c=79=static unsigned int get_user_insn(unsigned long tpc)\n--\narch/sparc/mm/fault_64.c-105-\narch/sparc/mm/fault_64.c:106:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/mm/fault_64.c-107-\tif (is_hugetlb_pmd(*pmdp)) {\n--\narch/sparc/mm/fault_64.c=267=asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)\n--\narch/sparc/mm/fault_64.c-472-\t\ttsb_grow(mm, MM_TSB_BASE, mm_rss);\narch/sparc/mm/fault_64.c:473:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/mm/fault_64.c-474-\tmm_rss = mm-\u003econtext.hugetlb_pte_count + mm-\u003econtext.thp_pte_count;\n--\narch/sparc/mm/init_64.c=313=static void __update_mmu_tsb_insert(struct mm_struct *mm, unsigned long tsb_index,\n--\narch/sparc/mm/init_64.c-328-\narch/sparc/mm/init_64.c:329:#ifdef CONFIG_HUGETLB_PAGE\narch/sparc/mm/init_64.c-330-static int __init hugetlbpage_init(void)\n--\narch/sparc/mm/init_64.c=354=bool __init arch_hugetlb_valid_size(unsigned long size)\n--\narch/sparc/mm/init_64.c-384-}\narch/sparc/mm/init_64.c:385:#endif\t/* CONFIG_HUGETLB_PAGE */\narch/sparc/mm/init_64.c-386-\narch/sparc/mm/init_64.c=387=void update_mmu_cache_range(struct vm_fault *vmf, struct vm_area_struct *vma,\n--\narch/sparc/mm/init_64.c-411-\tis_huge_tsb = false;\narch/sparc/mm/init_64.c:412:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/mm/init_64.c-413-\tif (mm-\u003econtext.hugetlb_pte_count || mm-\u003econtext.thp_pte_count) {\n--\narch/sparc/mm/init_64.c=2882=void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr,\n--\narch/sparc/mm/init_64.c-2912-\narch/sparc/mm/init_64.c:2913:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/mm/init_64.c-2914-static void context_reload(void *__data)\n--\narch/sparc/mm/tsb.c=83=static void __flush_tsb_one(struct tlb_batch *tb, unsigned long hash_shift,\n--\narch/sparc/mm/tsb.c-91-\narch/sparc/mm/tsb.c:92:#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)\narch/sparc/mm/tsb.c-93-static void __flush_huge_tsb_one_entry(unsigned long tsb, unsigned long v,\n\n"
}
7/2 2026/07/06 09:09 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 21998
							output: 123
							thoughts: 1659

Thoughts: 
**Analyzing the Virtual Mapping Changes**

Okay, so I'm looking at this patch and immediately, `CONFIG_HUGETLB_PAGE` jumps out. It's the primary configuration that controls the new functionality here. The changes touch `arch/arm64/include/asm/vmalloc.h`, `arch/arm64/mm/hugetlbpage.c`, and `mm/vmalloc.c`.

In `mm/vmalloc.c`, I see code guarded by `CONFIG_HUGETLB_PAGE` that's clearly related to handling huge page mappings within the vmalloc arena. The code checks for `HAVE_ARCH_HUGE_VMALLOC` and `HAVE_ARCH_HUGE_VMAP`, which appear to be architecture-specific features. On ARM64, these are implicitly enabled by `CONFIG_ARM64`, which means they're always active. The patch adds a check in `num_contig_ptes` to handle the size of a page being mapped.

Specifically, in `arch/arm64/include/asm/vmalloc.h`, `arch_vmap_pte_range_map_size` has been modified, likely to support contiguous PTE mappings. It determines the optimal size for a contiguous mapping based on alignment and the target architecture's capabilities.

Now, let's consider which functions are central to this change. `vmap_set_ptes` is `__always_inline`, so that's not a standalone function in the binary. `vmap_pages_range_batched`, `vmap_get_aligned_vm_area`, and `vmap_pages_range_noflush_walk` are all static, meaning they are likely internally called. However, these can still be fuzzed, depending on the fuzzing tool. Finally, `vmap`, `__vmap_pages_range_noflush`, and `vmap_pages_range_noflush` are all exported and represent the entry points.

Checking the configuration dependencies, `HUGETLB_PAGE` is the critical one. `HAVE_ARCH_HUGE_VMALLOC` and `HAVE_ARCH_HUGE_VMAP` are architecturally-selected and so we won't need to specify these. `CONFIG_HUGETLB_PAGE` is typically enabled if `CONFIG_HUGETLBFS` is enabled. Therefore, our "EnableConfigs" list will include "HUGETLB_PAGE".

I think we should concentrate on these functions: `vmap`, `vmap_pages_range_batched`, `vmap_get_aligned_vm_area`, `vmap_pages_range_noflush_walk`, and `__vmap_pages_range_noflush`. These are the core elements of the batched mapping logic, especially `vmap_pages_range_batched`, which appears to be the most novel part of the change.

Finally, regarding potential fuzzing, this change to virtual mapping is definitely worth targeting. It introduces new contiguous mappings at the PTE level which are functional and reachable from core virtual memory allocation logic. The functions involved aren't on any hot paths so these are likely safe to target in fuzzing.

8/2 2026/07/06 09:09 tool set-results
0m Args: 
{
  "EnableConfigs": [
    "HUGETLB_PAGE"
  ],
  "FocusSymbols": [
    "vmap",
    "vmap_pages_range_batched",
    "vmap_get_aligned_vm_area",
    "vmap_pages_range_noflush_walk",
    "__vmap_pages_range_noflush"
  ],
  "Reasoning": "The patch introduces batched contiguous mappings at the PTE level for vmap, modifying core virtual memory allocation logic. This is functional and reachable code.",
  "WorthFuzzing": true
}

Results: 
{
  "EnableConfigs": [
    "HUGETLB_PAGE"
  ],
  "FocusSymbols": [
    "vmap",
    "vmap_pages_range_batched",
    "vmap_get_aligned_vm_area",
    "vmap_pages_range_noflush_walk",
    "__vmap_pages_range_noflush"
  ],
  "Reasoning": "The patch introduces batched contiguous mappings at the PTE level for vmap, modifying core virtual memory allocation logic. This is functional and reachable code.",
  "WorthFuzzing": true
}
LLM Calls Summary:
Total Calls Total Tokens Avg Tokens Total Duration (Seconds) Avg Duration (Seconds)
Tool Calls Summary:
Total Calls Total Duration (Seconds) Avg Duration (Seconds)