summaryrefslogtreecommitdiff
path: root/tools/testing
AgeCommit message (Collapse)Author
2026-08-03selftests/bpf: Test __szk precision with a NULL nullable bufferAmery Hung
When a nullable buffer is passed as NULL, check_mem_size_reg() is skipped, so the __szk memory size must be marked precise through the scalar argument path instead. Exercise this with bpf_dynptr_slice() and a NULL buffer. Signed-off-by: Amery Hung <ameryhung@gmail.com> Link: https://lore.kernel.org/bpf/20260801074633.1595644-12-ameryhung@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-03bpf: Rename ARG_CONST_SIZE{,_OR_ZERO} to ARG_MEM_SIZE{,_OR_ZERO}Amery Hung
ARG_CONST_SIZE does not require a constant: check_mem_size_reg() accepts any bounded scalar and verifies the memory access against its maximum (reg_umax). Rename ARG_CONST_SIZE and ARG_CONST_SIZE_OR_ZERO to ARG_MEM_SIZE and ARG_MEM_SIZE_OR_ZERO to reflect that. ARG_CONST_ALLOC_ SIZE_OR_ZERO, which does require a constant, is left unchanged. Pure rename, no functional change. Signed-off-by: Amery Hung <ameryhung@gmail.com> Link: https://lore.kernel.org/bpf/20260801074633.1595644-10-ameryhung@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-03selftests/bpf: Test map lookup result refinementAmery Hung
A map-of-maps lookup value is refined to a map pointer (map_ptr_or_null) at lookup time by refine_map_lookup_value(). Test that it is rejected wherever a raw map value would be read as bytes, so the inner map descriptor cannot leak. Signed-off-by: Amery Hung <ameryhung@gmail.com> Link: https://lore.kernel.org/bpf/20260801074633.1595644-8-ameryhung@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-03bpf: Resolve map lookup result type at lookup timeEduard Zingerman
bpf_map_lookup_elem() is typed to return PTR_TO_MAP_VALUE for every map, but for some map kinds the looked up value is actually a different object: an inner map, a socket or an xsk socket. Until now this reinterpretation happened once the pointer was converted from its NULL-able form to a concrete value. Such reinterpretation logic placement led to mark_ptr_not_null_reg() being called for a temporary register copy in check_mem_reg() and check_kfunc_mem_size_reg() (check_mem_size_reg() was buggy because of not calling it). The temporary copy was necessary to pass reinterpreted parameters as nullable helper and kfunc arguments. Avoid this complication by refining map lookup result type right away. The test case verifier_map_in_map/on_the_inner_map_pointer needs an update because the verifier now prints a concrete NULL-able type for the lookup. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Amery Hung <ameryhung@gmail.com> Link: https://lore.kernel.org/bpf/20260801074633.1595644-6-ameryhung@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-02selftests/cgroup: add user_usec sanity check in test_cpucg_niceShaojie Sun
In test_cpucg_nice, after the child process exits, user_usec is read from cpu.stat but the value is not checked. Add a sanity check to ensure user_usec > 0, analogous to test_cpucg_stats(), so that the test fails early if CPU usage wasn't properly accounted. Signed-off-by: Shaojie Sun <sunshaojie@kylinos.cn> Reviewed-by: Michal Koutný <mkoutny@suse.com> Acked-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-02kselftest/arm64: Don't write to P0 in irritator on SME only systemsMark Brown
Commit 3e360ef0c0a1f ("kselftest/arm64: Corrupt P0 in the irritator when testing SSVE") added corruption of P0 to the sve-test case in order to ensure that the predicate registers were covered as part of the corruption. On SME only systems this results in an illegal instruction since signal handlers are run out of streaming mode and the predicate registers do not exist out of streaming mode without SVE. Switch to entering and exiting streaming mode in the irritator, this will reset all relevant registers to 0 if they somehow weren't already by the signal entry. Fixes: 3e360ef0c0a1f ("kselftest/arm64: Corrupt P0 in the irritator when testing SSVE") Reported-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-02kselftest/arm64: Add testcase for SECCOMP_RET_TRACE orig_x0 bypassJinjie Ruan
Add a selftest that verifies the kernel re-evaluates a seccomp filter with the correct (ptrace-modified) first argument after a SECCOMP_RET_TRACE stop. On arm64, syscall_get_arguments() reads the first argument from orig_x0, which may be stale if the tracer modified regs->regs[0] but orig_x0 was not synced. This can cause the filter to see an old argument and incorrectly allow a syscall that it should have rejected. The child installs a filter that: - TRACEs write() when fd == 2 - returns ERRNO(EPERM) when fd == 1 The parent catches the SECCOMP event, changes x0 (fd) from 2 to 1, and resumes the child. If the seccomp re-evaluation sees the stale orig_x0 (fd=2) the filter returns TRACE again and the kernel (with recheck_after_trace=true) allows the syscall to proceed – write succeeds and the child exits 0. If the seccomp re-evaluation sees the new value (fd=1) the filter returns ERRNO(EPERM), write fails and the child exits non-zero. The test passes only when the write fails (child exit != 0). Before the fix: # ./seccomp_ret_trace_x0_bypass TAP version 13 1..1 not ok 1 write succeeded, orig_x0 bypass likely # Totals: pass:0 fail:1 xfail:0 xpass:0 skip:0 error:0 After the fix: # ./seccomp_ret_trace_x0_bypass TAP version 13 1..1 ok 1 seccomp correctly denied modified syscall # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 Cc: Kees Cook <kees@kernel.org> Cc: Will Deacon <will@kernel.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Mark Rutland <mark.rutland@arm.com> Link: https://lore.kernel.org/all/20260717182758.17111-1-will@kernel.org/ Link: https://lore.kernel.org/all/20260716120640.6590-1-will@kernel.org/ Link: https://lore.kernel.org/all/202607152004.DEA95D63@keescook/ Suggested-by: Kees Cook <kees@kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-02kselftest/arm64: Add seccomp ptrace x0 bypass testJinjie Ruan
As Kees suggested, add a test that verifies that seccomp observes the correct first argument after a ptracer modifies x0 at a syscall-enter-stop on arm64. The first syscall argument and the return value share register x0. The original value is saved in orig_x0 on entry and used by syscall_get_arguments(), but ptrace changes to x0 were not automatically reflected there. This test checks the kernel re-syncs orig_x0 after a ptrace stop so that seccomp sees the modified argument. A seccomp filter allows write(2,...) and kills the task for any other fd. The tracer changes fd from 2 to 1 at entry. If orig_x0 remains stale, the child exits normally (bypass, test fails). If orig_x0 is correctly updated, the child is killed by SIGSYS (test passes). Before the fix: ./seccomp_ptrace_x0_bypass TAP version 13 1..1 not ok 1 seccomp_ptrace_x0_bypass # Totals: pass:0 fail:1 xfail:0 xpass:0 skip:0 error:0 After the fix: # ./seccomp_ptrace_x0_bypass TAP version 13 1..1 [ 19.475951] audit: type=1326 audit(1784254846.284:2): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=227 comm="seccomp_ptrace_" exe="/mnt/seccomp0 [ 19.477852] audit: type=1701 audit(1784254846.284:3): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=227 comm="seccomp_ptrace_" exe="/mnt/seccomp1 ok 1 seccomp_ptrace_x0_bypass # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 Cc: Kees Cook <kees@kernel.org> Cc: Will Deacon <will@kernel.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Mark Rutland <mark.rutland@arm.com> Link: https://lore.kernel.org/all/20260716120640.6590-1-will@kernel.org/ Link: https://lore.kernel.org/all/202607152004.DEA95D63@keescook/ Suggested-by: Kees Cook <kees@kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-02kselftest/arm64: fp-ptrace: Fix checks for inactive SVE and SSVE regsetsKarl Mehltretter
The checks on the header size reported for the inactive regset of the NT_ARM_SVE/NT_ARM_SSVE pair compare it against sizeof(sve), but sve is a struct user_sve_header *, so this is 8 rather than the intended 16. The kernel carried the identical typo when filling in the header, so kernel and test agreed on the wrong value and the test passed. Compare against sizeof(*sve), stop after the header checks for an inactive regset since it has no payload to compare, and prefill the buffer with a sentinel to verify that reading an inactive regset leaves everything after the header untouched. This also covers the getter's return value, which determines how many bytes ptrace copies back to userspace. Fixes: 864f3ddcd715 ("kselftest/arm64: fp-ptrace: Adjust to new inactive mode behaviour") Assisted-by: Claude:claude-opus-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-02tools/nolibc: add support for AlphaThomas Weißschuh
A straightforward new architecture. Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Acked-by: Willy Tarreau <w@1wt.eu> Tested-by: Michael Cree <mcree@orcon.net.nz> Link: https://patch.msgid.link/20260722-nolibc-alpha-v2-1-4970e48eb7bf@weissschuh.net
2026-08-01selftests/bpf: Add tests for >8 byte return value and 128-bit argumentsYonghong Song
The BPF trampoline preserves only 8 bytes of the target's return value (R0), so attaching an fexit/fmod_ret/fsession program to a function that returns a >8 byte value is now rejected by the verifier. Add a bpf_testmod function returning __int128 and an fexit program that targets it. The program is expected to fail to load with the "with a >8 byte return value is not supported for this attach type" message. A 128-bit __int128 argument is passed in a register pair and occupies two trampoline context slots. Add a bpf_testmod function taking a leading __int128 argument followed by an int and a long, and an fexit program that reads those two trailing arguments and the return value, verifying that the trampoline reserves enough stack for the 128-bit argument and places the following arguments and the return value at the right context slots. __int128 is only available on 64-bit targets (where the compiler defines __SIZEOF_INT128__). The argument test additionally depends on the calling convention: x86_64 and arm64 pass an __int128 in a register pair as the trampoline expects, while other architectures pass it differently (e.g. s390x passes larger arguments by reference), so that subtest runs only on x86_64 and arm64 and is skipped elsewhere. Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Acked-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/bpf/20260729050209.2587581-1-yonghong.song@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-31KVM: selftests: Add a test for KVM_CREATE_VM VM type enforcementHemanth Selam
KVM_CAP_VM_TYPES advertises the bitmap of VM types that KVM_CREATE_VM accepts, but nothing verified that the ioctl actually enforces it: that every advertised type can be created and every non-advertised type is rejected. sev_init2_tests carried a TODO for this ("check that unsupported types cannot be created. Probably a separate selftest"), but the check is not specific to SEV or KVM_SEV_INIT2, and not even to x86. Add a standalone test that walks the type space and, for each value, asserts that KVM_CREATE_VM succeeds iff the corresponding bit is set in KVM_CAP_VM_TYPES, and otherwise fails with -EINVAL. The walk extends past bit 31 so that out-of-range type values, which can never be advertised in the u32 bitmap, are also confirmed to be rejected. The test only depends on KVM_CAP_VM_TYPES, so it lives in the common set and is skipped on architectures that don't advertise the capability. Drop the now-addressed TODO from sev_init2_tests.c. Tested on an AMD SEV-SNP capable host. With KVM_CAP_VM_TYPES=0x15 (DEFAULT/SEV/SNP), only the advertised types are created and everything else is rejected: $ strace -e trace=ioctl ./vm_types_test 2>&1 | grep KVM_CREATE_VM ioctl(3, KVM_CREATE_VM, 0) = 4 # DEFAULT ioctl(3, KVM_CREATE_VM, 0x1) = -1 EINVAL # SW_PROTECTED ioctl(3, KVM_CREATE_VM, 0x2) = 4 # SEV ioctl(3, KVM_CREATE_VM, 0x3) = -1 EINVAL # SEV-ES ioctl(3, KVM_CREATE_VM, 0x4) = 4 # SNP ioctl(3, KVM_CREATE_VM, 0x5) = -1 EINVAL # TDX ... 0x6..0x3f all -1 EINVAL ... Reloading kvm_amd with sev_snp=0 drops the bitmap to 0x5 and only types 0 and 2 are then created, confirming the test tracks the advertised set rather than hard-coded types. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Link: https://patch.msgid.link/20260710050442.826777-1-hemanth.selam@gmail.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Extend the invalid nVMX guest state test to cover RSMHao Zhang
Extend the invalid nVMX guest state to cover RSM, i.e. to validate that KVM synthesizes SHUTDOWN for L1 if SMRAM is clobbered with invalid guest state during an L2 => SMI => RSM => L2 sequence. Note, unlike the existing testcase, clobbering SMRAM should result in L1, not L2, getting SHUTDOWN / TRIPLE_FAULT, as RSM is architecturally defined to trigger shutdown if the CPU detects invalid state. Signed-off-by: Hao Zhang <hao_zhang_kdev@163.com> Co-developed-by: Sean Christopherson <seanjc@google.com> Link: https://patch.msgid.link/20260731173340.2644656-7-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Refactor invalid nVMX state test to prepare for RSM testcaseSean Christopherson
In the invalid nVMX guest state test, extract the creation of the VM and initial running of the vCPU to get to L2 into helpers so that the common code can be reused to extend the test to also cover RSM. Eliminate the unnecessary global "vm", and opportunistically free the VM after the testcase as there's zero reason not to. Opportunistically assert that L2 is never resumed after the I/O exit to L1, e.g. to guard against false passes. Link: https://patch.msgid.link/20260731173340.2644656-6-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Use port 0x80 in invalid nVMX guest state testSean Christopherson
Use port 0x80 instead of 0x2000 to trigger an L2 => L0 VM-Exit in the nVMX invalid guest state test, so that the test can be expanded to cover RSM in the L2 => SMI => L2 path without having to manually encode a MOV to DX (the immediate form of IN only supports an imm8). Use port 0x80 as it's a well-known port and is used by other tests, e.g. in the coalesced I/O test. Link: https://patch.msgid.link/20260731173340.2644656-5-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Add KVM syscall wrappers for pthread_{g,s}etaffinity_np()Sean Christopherson
Add and use KVM wrappers for pthread_{g,s}etaffinity_np() so that selftests don't need to manually assert that the syscalls succeeded, and so that they don't need to manually pass in sizeof(cpu_set_t) for the size. Link: https://patch.msgid.link/20260731195612.2697986-12-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Clean up global constants in hardware disable testSean Christopherson
Rename the global constants in the hardware disable test to better capture what they control, and open code the literal number of sleeping tasks and iterations instead of using power-of-2 math to express values that are 100% arbitrary. Opportunistically tag the global semaphore with "static". No functional change intended. Link: https://patch.msgid.link/20260731195612.2697986-13-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Add helper APIs to cancel+join pthreadsSean Christopherson
Deduplicate test code that does cancel()+join() on pthreads by adding a collection of syscall wrappers. The tests that asynchronously cancel pthreads, i.e. use PTHREAD_CANCEL_ASYNCHRONOUS, are particularly ugly, especially since it's not immediately obvious why those tests assert on the thread being CANCELED, whereas others do not. No functional change intended. Link: https://patch.msgid.link/20260731195612.2697986-11-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Add KVM syscall wrappers for pthread_{cancel,join}()Sean Christopherson
Add and use KVM wrappers for pthread_{cancel,join}() so that selftests don't need to manually assert that the syscalls succeeded. Note, the vast majority tests don't actually assert success, but they all obviously rely on the syscall to succeed. Other than explicitly failing if a syscall fails, no functional change intended. Link: https://patch.msgid.link/20260731195612.2697986-10-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Add KVM syscall wrapper for pthread_create()Sean Christopherson
Add and use a KVM wrapper for pthread_create() syscall so that selftests don't need to manually assert that the syscall succeeded. Note, most tests don't actually assert success, but they all obviously rely on the syscall to succeed. Other than explicitly failing if pthread_create() fails, no functional change intended. Link: https://patch.msgid.link/20260731195612.2697986-9-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Drop unreachable, dead code from hardware disable testSean Christopherson
Drop all of the code that is unreachable in the hardware disable test, as it adds a lot of noise that makes the test seem far more complicated than it actually is. Link: https://patch.msgid.link/20260731195612.2697986-8-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Affine threads to random CPUs in hardware disable testSean Christopherson
Affine the worker threads to random CPUs in the hardware disable test, and honor the starting CPU set in the process. Hardcoding to CPUs 0-3 is both wrong and less interesting than running on random CPUs. Opportunistically convert the local 'i' to an int, as the macros it tests against are signed, and using 'i' as an iterator is conventionally declared as an int. Link: https://patch.msgid.link/20260731195612.2697986-7-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Extract picking of random CPU from cpu_set_t to separate APISean Christopherson
Extract kvm_pick_random_cpu() out of pin_task_to_random_cpu() so that tests can choose a random CPU without having to immediately pin a task to that CPU. No functional change intended. Link: https://patch.msgid.link/20260731195612.2697986-6-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Return the target CPU from pin_task_to_random_cpu()Sean Christopherson
When pinning a task to a random CPU, return which CPU the task was pinned to so that the caller can do things like avoid running other tasks on the target CPU. Link: https://patch.msgid.link/20260731195612.2697986-5-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Pre-set threads affinity in hardware disable test when possibleSean Christopherson
When building against a libc that provides pthread_attr_setaffinity_np(), pre-set the grandchildren threads CPU affinity in the hardware disable test to further reduce the perceived latency of pthread_create(). On large NUMA systems, this reduces the average runtime from ~10s to ~5s. Link: https://patch.msgid.link/20260731195612.2697986-4-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Set threads CPU affinity before doing work in hardware ↵Sean Christopherson
disable test Affine worker threads to their target pCPU set *before* doing any work in the hardware disable test. When running a preemptible kernel on a NUMA system with a large number of CPUs (100+ of CPUs), waiting to set the affinity of the grandchildren until after the grandchild is fully spun up results in total test runtimes of over a minute, presumably due to cross-node NUMA penalties and scheduler lock contention. E.g. from the perspective of the caller, when waiting to affine the tasks, pthread_create() takes ~100x longer. Link: https://patch.msgid.link/20260731195612.2697986-3-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: selftests: Add a KVM syscall wrapper for sched_setaffinity()Sean Christopherson
Add and use a KVM wrapper for sched_setaffinity() so that selftests don't need to manually assert that the syscall succeeded. No functional change intended. Link: https://patch.msgid.link/20260731195612.2697986-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31selftests/bpf: Cover commuted pointer state propagationYiyang Chen
Add verifier coverage for the three cases affected by preserving the full pointer state across scalar += pointer: stack frame number inheritance, readonly-untrusted memory access, and dynptr data-slice invalidation. Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn> Tested-by: Daniel Wade <danjwade95@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260729-c3-035-public-bpf-v4-v4-4-8ee297e2346b@mails.tsinghua.edu.cn Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-31KVM: selftests: Only link to VFIO library on x86Sean Christopherson
Link to the VFIO library only on architectures where it's actually needed, i.e. only on architectures that support irq_test, which is currently x86-only. The irq_test series, which pulled in VFIO support, effectively raced with commit e65f1bf8a2db ("vfio: selftests: Extend container/iommufd setup for passing vf_token"). I.e. when the KVM test was posted, pulling in libvfio.mk didn't require linking to any new libraries other than VFIO itself. Now that libvfio.mk pulls in luuid, unconditionally linking in support for VFIO is quite onerous, especially when cross-compiling, as it requires installing what is effectively an unused library on four architectures. Eventually KVM selftests will likely support irq_test and thus need to link to VFIO on architectures other than x86, but at least then there will be some amount of gain for the pain. Fixes: a262fc49e0aa ("KVM: selftests: Build and link selftests/vfio/lib into KVM selftests") Cc: David Matlack <dmatlack@google.com> Cc: Josh Hilke <jrhilke@google.com> Link: https://patch.msgid.link/20260730165159.1988017-1-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31Merge tag 'mm-hotfixes-stable-2026-07-30-19-30' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "12 hotfixes. 6 are cc:stable. 9 are for MM. There's a two-patch series from Nico which fixes a couple of PMD level mTHP accounting bugs and a two-patch series from Chris Gellermann which addresses mishandling of getline() in selftests. All the remainder are singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-07-30-19-30' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: selftests/mm: fix potential wild pointer access of getline due to missing init selftests/clone3: fix wild pointer access of getline due to missing init mm/page_reporting: use system_freezable_wq to fix UAF during suspend mm: vmscan: abort proactive reclaim early when freezing for suspend MAINTAINERS: update Nico Pache's email address arm64, mailmap: update email address for Peter Collingbourne MAINTAINERS: update address for Burak Emir mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios riscv/mm: use physical alignment for vmemmap_start_pfn mm/migrate: exclude hugetlb folios from MTHP_STAT_NR_ANON accounting mm: decrement MTHP_STAT_NR_ANON in free_zone_device_folio() mm: memcg: initialize *locked in memcg1_oom_prepare() stub
2026-07-31selftests/verification: Add selftests for deadline and stall monitorsGabriele Monaco
Add selftests to verify deadline monitors don't fail under expected conditions and the stall monitor report violations only when expected. Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://lore.kernel.org/r/20260723074534.43521-18-gmonaco@redhat.com Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
2026-07-31selftests/verification: Rearrange the wwnr_printk testGabriele Monaco
The wwnr_printk test expects no reactions in some situations, after fixing the bash assertion, the test is failing because expecting no reaction after a previous step had reactions is flaky without making sure all buffers are flushed. Wait for reactions to be over when expected by polling dmesg for an interval without any rv message. Also simplify the load function to stop loads as soon as a reaction occurs, this limits the number of lines to flush and makes tests overall faster and more stable. Reviewed-by: Wen Yang <wen.yang@linux.dev> Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://lore.kernel.org/r/20260723074534.43521-17-gmonaco@redhat.com Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
2026-07-31selftests/verification: Fix wrong errexit assumptionGabriele Monaco
RV selftest rely on bash errexit (set -e) to terminate with error, when a step is expected to return false, the following syntax is used: ! cmd This however prevents the test from exiting when cmd is false (desired) but doesn't exit if cmd is true, since commands prefixed with ! are explicitly excluded from errexit. Use the syntax ! cmd || false Which ends up checking the exit value of ! cmd and supplies a false command for errexit to evaluate. Reviewed-by: Wen Yang <wen.yang@linux.dev> Acked-by: Nam Cao <namcao@linutronix.de> Link: https://lore.kernel.org/r/20260723074534.43521-16-gmonaco@redhat.com Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
2026-07-31selftests: ntsync: test absolute MONOTONIC waits under time namespacesIván Ezequiel Rodriguez
Cover the timens conversion in ntsync_schedule(): with a negative CLOCK_MONOTONIC offset, a 100 ms absolute wait must not return immediately against the host clock. Suggested-by: Maoyi Xie <maoyixie.tju@gmail.com> Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com> Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com> Signed-off-by: Elizabeth Figura <zfigura@codeweavers.com> Link: https://patch.msgid.link/20260723201301.11826-6-zfigura@codeweavers.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31selftests: ntsync: add wait argument validation testsIván Ezequiel Rodriguez
Add coverage for documented EINVAL cases: zero owner on wait any/all, non-zero pad, and objects from a different /dev/ntsync instance. Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com> Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com> Signed-off-by: Elizabeth Figura <zfigura@codeweavers.com> Link: https://patch.msgid.link/20260723201301.11826-3-zfigura@codeweavers.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31selftests: ntsync: fix wake_all CREATE_EVENT fd expectationIván Ezequiel Rodriguez
wake_all used EXPECT_EQ(0, objs[3]) after NTSYNC_IOC_CREATE_EVENT. The ioctl returns a non-negative file descriptor on success; check EXPECT_LE(0, objs[3]) like the other CREATE_* paths. The incorrect expectation was noted on list (Mar 2025) but is still present in mainline. Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com> Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com> Signed-off-by: Elizabeth Figura <zfigura@codeweavers.com> Link: https://patch.msgid.link/20260723201301.11826-2-zfigura@codeweavers.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31Merge branch 'perf/urgent' into perf/core, to pick up fixesIngo Molnar
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2026-07-31selftests/filesystems: add mntns cleanup testNoah Orlando
Verify that destroying a mount namespace keeps its mounts connected. Signed-off-by: Noah Orlando <Noah.Orlando@deshaw.com> Link: https://patch.msgid.link/20260706182559.2496448-4-Noah.Orlando@deshaw.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-07-31selftests/statmount: Fix file descriptor leak in setup_namespaceMalaya Kumar Rout
In setup_namespace(), f_mountinfo is opened with fopen() at line 115 but is never closed. Multiple ksft_exit_fail_msg() calls exit the program without closing this file descriptor, and the cleanup_namespace() function registered with atexit() also doesn't close it. Add fclose(f_mountinfo) in cleanup_namespace() to ensure the file descriptor is properly closed on both normal and error exit paths, since cleanup_namespace() is already registered as an atexit handler. Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com> Link: https://patch.msgid.link/20260704120437.99851-1-malayarout91@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-07-31selftests/filesystems: fix spelling error in statmount test commentWang Yan
Fix typo "didnt't" -> "didn't" in statmount_test.c comment. Signed-off-by: Wang Yan <wangyan01@kylinos.cn> Link: https://patch.msgid.link/20260702015428.363642-1-wangyan01@kylinos.cn Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-07-31KVM: arm64: selftest: Add NVHCR_EL2 to get-reg-listMarc Zyngier
Since we now expose a new system register on NV3-capable HW when the guest is exposed to it, add it to the existing checker. FWIW. Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260730071022.296811-29-maz@kernel.org Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-07-31KVM: arm64: selftests: Add stage-2 block transition testFuad Tabba
Add a test for the two stage-2 granularity changes dirty logging forces at fault time, asserting the guest completes with no KVM_RUN error. The first scenario collapses a page into a hugetlb-backed block: it writes under logging, re-write-protects the page via GET_DIRTY_LOG, then writes again with logging off. The second splits blocks: it faults in several non-executable 2M blocks, enables logging, then executes in each block so an execute permission fault splits it. It is skipped when CTR_EL0.DIC is set, since mappings are then executable and no execute fault occurs. Both paths make the fault handler allocate under mmu_lock, so a backend that fails to stage that memory returns a KVM_RUN error or crashes the host. The property holds on any host. On a pKVM host, where a non-protected guest uses the pkvm_pgtable_*() backend, it also guards that backend's fault-time staging. Assisted-by: Antigravity:gemini-3.1-pro Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Tested-by: Bradley Morgan <include@grrlz.net> # On QEMU arm64 host Test: Bradley Morgan <include@grrlz.net> # On QEMU arm64 host Link: https://patch.msgid.link/20260717130317.1953574-8-fuad.tabba@linux.dev Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-07-30KVM: arm64: selftests: Add a userspace watchpoint testFuad Tabba
debug-exceptions covers guest self-hosted debug and userspace single-step, but not a userspace (KVM_GUESTDBG_USE_HW) watchpoint, whose KVM_EXIT_DEBUG reports the accessed address in debug.arch.far. Add a test that installs a host-directed write watchpoint and checks that the reported address matches the accessed variable. Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20260726143643.303456-3-fuad.tabba@linux.dev Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-07-30KVM: arm64: Expose PMMIR_EL1.SLOTS under strict PMUv3 UAPICongkai Tan
Introduce a new field pmmir_slots in struct kvm_arch to store PMMIR_EL1.SLOTS. It only saves the actual hardware PMU value when the VMM explicitly selects a PMU under KVM_ARM_VCPU_PMU_V3_STRICT. Otherwise, it stays 0 after allocation. Use this field to implement guest access, userspace get, and userspace set for PMMIR_EL1: - access_pmmir(): uses the value in kvm->arch.pmmir_slots directly. If the VMM selected a PMU and KVM_ARM_VCPU_PMU_V3_STRICT is set, the guest can correctly read the underlying core's SLOTS. Otherwise, it continues to read 0 since the true SLOTS value can be nondeterministic. - get_pmmir(): same as access_pmmir(). - set_pmmir(): only the SLOTS field is writable; a value setting any other bit is rejected with -EINVAL, since get_pmmir() returns SLOTS zero-extended. A value of 0 resets kvm->arch.pmmir_slots to 0 for backward compatibility, as the register is RAZ in older KVM, a value matching the current SLOTS is accepted as a no-op, and anything else is rejected with -EINVAL. Once the VM has run PMMIR_EL1 is immutable, so a mismatching write then returns -EBUSY. The register is now exposed via KVM_GET_REG_LIST for PMUv3 vCPUs, so add it to the get-reg-list selftest's PMU register list. Signed-off-by: Congkai Tan <congkai@amazon.com> Reviewed-by: Geoff Blake <blakgeof@amazon.com> Reviewed-by: Haris Okanovic <harisokn@amazon.com> Reviewed-by: Stanislav Spassov <stanspas@amazon.de> Co-developed-by: Oliver Upton <oupton@kernel.org> Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev> Tested-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20260722202702.4165917-2-congkai@amazon.com Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-07-30selftests/damon/drgn_dump_damon_status: do not dump nr_accesses_bpSJ Park
drgn_dump_damon_status is dumping nr_accesses_bp field for future use case. nr_accesses_bp is not being used for a real purpose, though. Hence there will be no future test for it. Do not dump it. Link: https://lore.kernel.org/20260630040812.149729-13-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: Brendan Higgins <brendan.higgins@linux.dev> Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-30selftests/mm/uffd: don't treat UFFDIO_COPY -ENOENT as a failureMike Rapoport (Microsoft)
Non-cooperarive uffd events are inherently racy and can happen in parallel with other userfaultfd operations. During event tests in uffd-unit-tests, the uffd monitor calls UFFDIO_UNREGISTER upon receiving UFFD_EVENT_REMOVE. In parallel, the faulting_process() verifies that the removed memory is actually zeroed. If a verification read wins the race with UFFDIO_UNREGISTER, it causes a missing fault that uffd monitor would receive after UFFDIO_UNREGISTER is complete. The monitor resolves the fault using UFFDIO_COPY that fails with -ENOENT which means that VMA has been changed (see commit 27d02568f529 ("userfaultfd: mcopy_atomic: return -ENOENT when no compatible VMA found")). Treat -ENOENT returned by UFFDIO_COPY as non-fatal, the same way -EEXIST is treated for concurrent faults, and don't fail the test. Link: https://lore.kernel.org/20260701200932.1470525-1-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Peter Xu <peterx@redhat.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-30selftests/mm: fix clone cleartid race in pkey sighandler testsHongfu Li
Passing a stack-local child_pid to clone() with CLONE_CHILD_CLEARTID is unsafe: the kernel clears that address when the child exits, which may happen after the test function has returned and the stack slot has been reused. Neither testcase uses the settid/cleartid pointers for synchronization. Drop CLONE_PARENT_SETTID and CLONE_CHILD_CLEARTID and pass NULL for the clone tid arguments. Wait for the clone child to exit via tkill in test_sigsegv_handler_with_different_pkey_for_stack(), matching test_pkru_sigreturn(), so the detached thread cannot overlap with the next testcase. Link: https://lore.kernel.org/20260706081600.3570203-7-lihongfu@kylinos.cn Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Cc: David Hildenbrand <david@kernel.org> Cc: Joey Gouly <joey.gouly@arm.com> Cc: John Hubbard <jhubbard@nvidia.com> Cc: Keith Lucas <keith.lucas@oracle.com> Cc: Kevin Brodsky <kevin.brodsky@arm.com> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport (Microsoft) <rppt@kernel.org> Cc: Muhammad Usama Anjum <usama.anjum@collabora.com> Cc: Ross Zwisler <zwisler@google.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Yury Khrustalev <yury.khrustalev@arm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-30selftests/mm: add missing pthread_create() return checks in pkey testsHongfu Li
Add missing pthread_create() return checks in pkey sighandler tests to avoid hanging in pthread_cond_wait() when thread creation fails. Link: https://lore.kernel.org/20260706081600.3570203-6-lihongfu@kylinos.cn Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Acked-by: Liam R. Howlett (Oracle) <liam@infradead.org> Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com> Tested-by: Kevin Brodsky <kevin.brodsky@arm.com> Cc: David Hildenbrand <david@kernel.org> Cc: Joey Gouly <joey.gouly@arm.com> Cc: John Hubbard <jhubbard@nvidia.com> Cc: Keith Lucas <keith.lucas@oracle.com> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Muhammad Usama Anjum <usama.anjum@collabora.com> Cc: Ross Zwisler <zwisler@google.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Yury Khrustalev <yury.khrustalev@arm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-30selftests/mm: add missing mmap() return checks in pkey testsHongfu Li
Add missing checks against mmap() return value, replace (void *)-1 with MAP_FAILED for better readability and consistency. Link: https://lore.kernel.org/20260706081600.3570203-5-lihongfu@kylinos.cn Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Acked-by: Liam R. Howlett (Oracle) <liam@infradead.org> Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com> Tested-by: Kevin Brodsky <kevin.brodsky@arm.com> Cc: David Hildenbrand <david@kernel.org> Cc: Joey Gouly <joey.gouly@arm.com> Cc: John Hubbard <jhubbard@nvidia.com> Cc: Keith Lucas <keith.lucas@oracle.com> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Muhammad Usama Anjum <usama.anjum@collabora.com> Cc: Ross Zwisler <zwisler@google.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Yury Khrustalev <yury.khrustalev@arm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-30selftests/mm: use pkey_assert on clone_raw failure in pkey testHongfu Li
Use pkey_assert(0) instead of perror("clone") when clone_raw() fails. The old path only printed an error and continued; the test now exits via pkey_assert() on failure so it does not hang or proceed with an invalid child. Link: https://lore.kernel.org/20260706081600.3570203-4-lihongfu@kylinos.cn Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Acked-by: Liam R. Howlett (Oracle) <liam@infradead.org> Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com> Tested-by: Kevin Brodsky <kevin.brodsky@arm.com> Cc: David Hildenbrand <david@kernel.org> Cc: Joey Gouly <joey.gouly@arm.com> Cc: John Hubbard <jhubbard@nvidia.com> Cc: Keith Lucas <keith.lucas@oracle.com> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Muhammad Usama Anjum <usama.anjum@collabora.com> Cc: Ross Zwisler <zwisler@google.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Yury Khrustalev <yury.khrustalev@arm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>