summaryrefslogtreecommitdiff
path: root/tools/testing
AgeCommit message (Collapse)Author
2026-10-16Merge tag 'kvm-x86-misc-7.4' of https://github.com/kvm-x86/linux into HEADPaolo Bonzini
KVM x86 misc changes for 7.4 - Mask off the address space ID when checking for illegal usage of kvm_set_internal_memslot() to prevent false negatives on the sanity check. - Explicitly zero reserved flags when delivering a SynIC message to avoid leaking a byte of stack information to the guest. - Rework TDX's handling of the canonical MMU root level to not rely on userspace to fill CPUID correctly, as doing so lets userspace trivially trigger a KVM_BUG_ON(). - Reject KVM_SET_NESTED_STATE if userspace "restores" L1 with EFER.LMA=1 && EFER.LME=0, which confuses KVM into trying to configure an 64-bit MMU without PAE. - Ignore EFER.LMA (clear it from KVM's cached save state) if EFER.LME=0 when preparing L2 state, to fix another way to confuse KVM's MMU (and because real hardware also ignores EFER.LMA). - Improve KVM's sanity checks for a misconfigured MMU to (hopefully) detect all of the ways KVM can botch EFER.LMA vs. CR4.PAE. - Remove the "full" out-param from kvm_x86_ops.flush_tlb_gva() as the param is only used to avoid what effectively amounts to a single memory write. - Fix a mostly-benign bug where KVM can write through a guest's read-only mapping due to not checking the error code when expediting emulated MMIO page faults. - Honor the guest's view of the "EFER.LMSLE must be zero" defeature so that userspace can provide migration compatibility between Rome and Milan+. - Pend a KVM_REQ_EVENT request when an exception is morphed into a nested VM-Exit, otherwise KVM can fail to actually deliver the nested VM-Exit, e.g. when injecting a page fault. - Add support for PML on SVM. - Add support for virtualizing Bus Lock Detect on SVM, and fix a number of DR6 bugs and warts along the way. - Misc fixes and cleanups.
2026-10-16Merge tag 'kvm-x86-coco-7.4' of https://github.com/kvm-x86/linux into HEADPaolo Bonzini
KVM guest_memfd and CoCo changes for 7.4 - Take the invalidate lock when unbinding a dying file to fix a race with kvm_gmem_invalidate_end() that results in KVM leaving the MMU invalidation count elevated. Not taking the lock in the first place was pure misguided paranoid. - When binding a memslot, purge the bindings if storing the new memslot fails, as Xarray's "store range" API can subtly fail partway through. - Establish memslot<=>guest_memfd bindings *after* the memslot is ready, as the memslot becomes reachable the instant the binding is installed. - Don't grab a page refcount when reloading an SNP VMSA and stop returning a "struct page" from guest_memfd's PFN lookup altogether, to ensure that KVM doesn't hold any unnecessary refcounts (the lifetime of the page is ensured by MMU notifiers and similar hooks). Preventing unnecessary refcounts greatly simplifies supporting in-place SHARED=>PRIVATE conversions. - Add support for in-place PRIVATE<=>SHARED conversion, i.e. allow a single guest_memfd instance to be used for both PRIVATE and SHARED variations of CoCo guests' memory (though not at the same time). This eliminates the need to double allocate guest memory for TDX and SNP, and is basically a hard requirement for pKVM, which relies on being able to preserve memory contents on conversions. - Hack-a-fix a deadlock bug in ->error_remove_folio() by returning -EBUSY if the filemap invalidate lock is contended. Punt on a proper fix for the moment, as a proper fix likely involves reworking truncate_error_folio(). - Add a pile of selftests for in-place conversions. - Misc guest_memfd cleanups Conflicts in arch/arm64/kvm/mmu.c: convert to use s2vi.
2026-10-16selftests/bpf: Unmount the bpffs that cgroup_hierarchical_stats mountedQiliang Yuan
setup_bpffs() mounts a bpffs on /sys/fs/bpf and records in mounted_bpffs whether it did, so that cleanup_bpffs() unmounts only a bpffs that the test mounted itself. cleanup_bpffs() checks the flag the other way around. As mounting on /sys/fs/bpf succeeds even when a bpffs is already there, the test never unmounts the bpffs it mounted, and every run leaves another one stacked on /sys/fs/bpf of the mount namespace that the test_progs worker keeps running later tests in. Unmount the bpffs only when setup_bpffs() mounted it. Fixes: 88886309d2e8 ("selftests/bpf: add a selftest for cgroup hierarchical stats collection") Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Yosry Ahmed <yosry@kernel.org> Link: https://patch.msgid.link/20261009-selftests-bpf-cgroup-stats-bpffs-v2-2-f93a111da992@gmail.com
2026-10-16selftests/bpf: Keep the bpffs of cgroup_hierarchical_stats privateQiliang Yuan
setup_hierarchy() mounts a bpffs on /sys/fs/bpf with setup_bpffs(), and then sets up the cgroups with setup_cgroups(), which moves the test into a private mount namespace. The bpffs thus lands in the mount namespace that test_progs shares with the tests running in parallel, on top of the bpffs already there, and hides what they pin. cleanup_bpffs() later runs in the private mount namespace and can't unmount it, so it stays there for good. bpftool_maps_access then fails to pin an iterator because /sys/fs/bpf/test_bpftool_map doesn't exist anymore, and bpftool_metadata can't find the program it pinned in /sys/fs/bpf/test_metadata. Set up the cgroups first, so that the bpffs is mounted in the private mount namespace. Fixes: 88886309d2e8 ("selftests/bpf: add a selftest for cgroup hierarchical stats collection") Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261009-selftests-bpf-cgroup-stats-bpffs-v2-1-f93a111da992@gmail.com
2026-10-15selftests: net: veth: test own ndo-xmit after peer GRO toggle while downTianyi Gao
Test that a veth device advertises ndo-xmit when GRO is enabled on its peer while both are down and only the device is brought up. Commit 7a6102aa6df0 ("veth: Update XDP feature set when bringing up device") made veth_open() set the flag in this case, and selftests were requested in its review [1]. The block now ends with GRO enabled while the peer is down, so the aggregation check that follows covers NAPI enabled by veth_open() again. Commit c017800af5c7 ("selftests: net: veth: test peer ndo-xmit after GRO toggle while down") had moved it to veth_set_features() [2]. Link: https://lore.kernel.org/all/155aabf8b873bb8cdcafbd6139c42b08513e5fe6.camel@redhat.com/ [1] Link: https://lore.kernel.org/all/179165459278.434549.1711113374323842550@kernel.org/ [2] Signed-off-by: Tianyi Gao <tianyi@cloudflare.com> Reviewed-by: Narcisa Vasile <narcisav.kernel@gmail.com> Link: https://patch.msgid.link/20261010192914.83651-1-tianyi@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-16selftests/bpf: Add task work BUSY window testYun Lu
Add a regression test for reusing a bpf_task_work context while its scheduling irq_work is still BUSY. A test that schedules from a thread pinned to one CPU never observes that window: irq_work_queue() self-IPIs the local CPU and the invocation completes before the thread's next syscall. Use an fexit program on task_work_add() to delay the scheduling handler's return with a time- and iteration-bounded busy-wait, after the first-round callback was published and before the handler's tail state transition. The target task attempts to reuse the same context from a later syscall, strictly after its own callback wrapper returned, so the context is STANDBY at that point. A valid window requires the fexit program to observe the attempt's acknowledgment before returning, which proves the attempt ran while the old handler, and thus the BUSY irq_work, was still in flight. With the map and program references held and no competing scheduler, the only possible source of -EBUSY for that attempt is the BUSY check in the acquire path. Check that the attempt is rejected with -EBUSY, that scheduling succeeds on a bounded retry once BUSY clears, and that the second callback runs exactly once. Each attempt uses dedicated workers and a fresh map value. Reset the shared slots before enabling the workers. Stop and join them at the end of the attempt, then wait for their TIDs to disappear from PID lookup before checking the final callback count or starting another attempt. join alone can return before exit_task_work(); a signal-zero tgkill probe still finds the worker until after its exit task_work has run. Bound that wait and fail on unexpected probe errors. Callback deliveries are also matched against the window's generation. Missed windows are counted and retried within a bounded attempt budget; hard failures fail the test. Record the busy-wait elapsed time after worker cleanup as a diagnostic, without asserting a wall-clock bound, since host vCPU preemption can stretch wall-clock time without affecting the gate behavior under test. Skip when fewer than two CPUs are available or when the loaded kconfig extern identifies CONFIG_PREEMPT_RT. Check that extern before attaching programs or starting workers. Load and attach errors fail the test instead of being inferred from tracefs file paths and reported as unsupported. Signed-off-by: Yun Lu <luyun@kylinos.cn> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261012061915.231254-5-luyun_611@163.com
2026-10-16selftests/bpf: Add task work cancellation race testYun Lu
Add cross-CPU stress coverage for the captured-task cancellation fix. Run scheduling and the target callback on different CPUs, rotating through three map-value lifetime patterns for 1500 rounds. Reuse rounds keep the map value and start the next generation after the callback records its completion. The next scheduling attempt can race with the remaining callback cleanup, checking that the context becomes reusable and subsequent generations make progress. Late-deletion rounds remove the value after the callback records its completion, racing deletion with the remaining callback cleanup and the scheduling handler's final state transition. Early-deletion rounds remove it once the BPF program announces that it is about to schedule, racing deletion with context acquisition and callback publication. These deletion variants stress the cancellation paths fixed by the captured-task change: on an unfixed kernel, a deletion observed by a delayed scheduling handler can route cancellation through an already cleared ctx->task. Publish the scheduling result together with its generation in one packed value, so a stale result cannot be mistaken for the current round's. The BPF program retries transient -EBUSY results without publishing them; in early-deletion rounds, accept -ENOENT when deletion removes the value before a retry looks it up. Check callback completion separately for each generation so that an earlier callback cannot satisfy a later round. This is stress coverage for task-work cancellation races; it does not force the exact faulting interleavings or validate rejection of context reuse while the scheduling irq_work is still BUSY. Signed-off-by: Yun Lu <luyun@kylinos.cn> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261012061915.231254-3-luyun_611@163.com
2026-10-16selftests/bpf: Skip compare_text subtest when stdout is not savedKaFai Wan
stdio_hijack_init() does not set subtest_state->stdout_saved when running with -v in non-parallel mode, since output goes straight to stdout. In that case subtest_state->log_buf is left NULL, so the compare_text_mismatch subtest crashes when inspecting it. Skip it when stdout was not saved. Fixes: bd71904697c6 ("selftests/bpf: Add compare_text_to_expected() helper") Signed-off-by: KaFai Wan <kafai.wan@linux.dev> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261012140202.2754552-4-kafai.wan@linux.dev
2026-10-16selftests/bpf: Skip expected_msgs subtests when stdout is not savedKaFai Wan
stdio_hijack_init() does not set subtest_state->stdout_saved when running with -v in non-parallel mode, since output goes straight to stdout. In that case subtest_state->log_buf is left NULL, so the expected-messages subtests crash when inspecting it. Skip them when stdout was not saved. Fixes: 34c513be3dad ("selftests/bpf: __not_msg() tag for test_loader framework") Signed-off-by: KaFai Wan <kafai.wan@linux.dev> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261012140202.2754552-3-kafai.wan@linux.dev
2026-10-16selftests/bpf: Fix prog_tests framework subtest count checksKaFai Wan
The hardcoded expected skip_cnt/error_cnt in test_prog_tests_framework() mismatch the real count when the binary is run with -t or -n filters, since some subtests are not selected. Count the executed subtests and compare against that value instead. Fixes: 2324257dbd68 ("selftests/bpf: Refactor prog_tests logging and test execution") Signed-off-by: KaFai Wan <kafai.wan@linux.dev> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261012140202.2754552-2-kafai.wan@linux.dev
2026-10-16bpf: htab: Reduce elem_size by 8 bytes for small key sizesT.J. Mercier
For standard and PCPU (non-LRU) hash maps with small key sizes (less than or equal to the word size), comparing keys requires only a single instruction. Storing a cached 32-bit hash value to shortcut full key comparisons provides no performance advantage for small keys, and consumes memory for every element. This memory can be saved by removing hash from struct htab_elem and placing it directly before struct htab_elem only for the new htab_elem_hashed type which is used only when keys are larger than the word size or for LRU maps. This reduces elem_size by 8 bytes for small keys while keeping key and hash at constant compile-time offsets from struct htab_elem across all map types and key sizes. All element variants requiring hashes get an anonymous htab_elem_hashed embedding, ensuring that the -8 byte hash offset is guaranteed for all element types by composition. Elements can be recycled without a RCU grace period. Before this commit, alloc_htab_elem() overwrote the key before initializing the value/pptr and wrote the hash last, so during value assignment on a recycled element, the new key was paired with the old hash preventing lockless readers from matching either the old key or the new key except when there was also a hash collision. When hashes are omitted for small keys, only the key field guards lookups. Writing the new key before value/pptr initialization would allow a concurrent lookup of the new key to match an uninitialized value or dereference a stale or freed pptr. So move the new key assignment to the end of alloc_htab_elem() where the hash assignment was done. Like the hash assignment it replaces, it does not enforce value store ordering before key stores on weakly ordered architectures for lockless readers that were already traversing l_new via a stale pointer before hlist_nulls_add_head_rcu(). Before this commit htab_mem_dtor() was invoked with the start of the allocation, which is no longer always the address of struct htab_elem now that elem_offset can be nonzero for non-preallocated, non-per-CPU maps. So the key_size field of struct htab_btf_record has been replaced with a value_offset computed at map creation and passed through bpf_ma_set_dtor(). That reduces the destructor to a call to bpf_obj_free_fields() at a fixed offset, which is exactly what rhtab_mem_dtor() did, so rhtab_mem_dtor() has been removed and replaced with the new implementation of htab_mem_dtor() for BPF_MAP_TYPE_RHASH. Together with the previous patch, this reduces the minimum standard and preallocated hash map element size from 64 bytes down to 32 bytes, and non-preallocated per-CPU element size from 64 bytes down to 40 bytes. Signed-off-by: T.J. Mercier <tjmercier@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261008104108.993791-3-tjmercier@google.com
2026-10-16bpf: htab: Split htab_elem_lru and htab_elem_pcpu off of htab_elemT.J. Mercier
The htab_elem struct is used as the per-element type for all BPF hash map types and includes bpf_lru_node in a union with a ptr_to_pptr pointer. For standard (non-LRU, non-PCPU) hash maps, the 24 byte union allocated for every element is entirely unused. For non-preallocated PCPU maps, ptr_to_pptr only requires 8 bytes, leaving 16 bytes of unused overhead in the union. For preallocated PCPU maps ptr_to_pptr is unused since elements are freed to the PCPU freelist. Eliminate this per-element memory overhead by splitting htab_elem into dedicated structures for each map type: - struct htab_elem: Minimal structure for standard hash maps and preallocated PCPU maps (saves 24 bytes per element). - struct htab_elem_pcpu: Structure for non-preallocated PCPU maps containing ptr_to_pptr (saves 16 bytes per element). - struct htab_elem_lru: Retains struct bpf_lru_node for LRU maps. Place lru_node and ptr_to_pptr before struct htab_elem in htab_elem_lru and htab_elem_pcpu respectively, and track the offset of htab_elem from the start of the element allocation in htab->elem_offset. This keeps key and value at constant compile-time offsets from struct htab_elem across all hash map types, avoiding dynamic key offset calculations on lookups. Use sizeof(struct htab_elem_lru) for the element size rollover check in htab_map_alloc_check() since it is now the largest element variant. Signed-off-by: T.J. Mercier <tjmercier@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Mykyta Yatsenko <yatsenko@meta.com> Link: https://patch.msgid.link/20261008104108.993791-2-tjmercier@google.com
2026-10-15selftests: ublk: add test for going live over canceled io commandsMing Lei
Add ublk_cancel_ready, a small liburing program which sends control commands with kublk's helpers from ctrl.c, and test_generic_18.sh, which runs its modes: mode what it does expected stop_start STOP_DEV before START_DEV START_DEV -EBUSY partial_fetch task A fetches tags 0-2 and START_DEV -EBUSY dies, then task B fetches tag 3 recovery in user recovery, queue 0's END_USER_RECOVERY task dies before queue 1 is -EBUSY ready stop_restart STOP_DEV on a new device, then START_DEV 0, a server starts it reads succeed stop_attached STOP_DEV after open, before FETCH ABORT and FETCH, then a new server START_DEV -EBUSY, then a new one works stop_live_restart STOP_DEV on a live device, then FETCH and START_DEV a new server starts it 0, reads succeed race_start STOP_DEV and START_DEV at the START_DEV 0 and same time, 50 times reads complete, or -EBUSY race_fetch STOP_DEV while a server opens START_DEV 0 and and fetches, then START_DEV, reads succeed, 50 times or -EBUSY race_async_fetch IOSQE_ASYNC FETCH while STOP_DEV no crash (KASAN cancels, then close the ring finds the bug) race_batch_stop STOP_DEV while kublk's batch kublk add returns, server prepares and fetches, started or not 20 times If the device goes live, the test reads it, so an unfixed kernel shows the oops in ublk_queue_cmd(). In stop_live_restart, an unfixed kernel doesn't reset the FETCH round in ublk_ch_release() once the disk is gone, so the new server's FETCH gets -EBUSY. A dying task is a child process which fetches and then calls exec(). exec() cancels the task's uring_cmds before it returns, so the cancel is done once the child is reaped, with no sleep. kublk can't be used: its failure injection kills the whole process, which closes /dev/ublkcN and starts a new round. Link: https://lore.kernel.org/linux-block/20260928-b4-ublk-cancel-stop-v1-0-4a4360232a46@toxicpanda.com/ Signed-off-by: Ming Lei <tom.leiming@gmail.com> Assisted-by: LLM Link: https://patch.msgid.link/20261011063555.1142277-12-tom.leiming@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-10-15selftests: ublk: stop a batch thread when PREP_IO_CMDS failsMing Lei
Since STOP_DEV turns the server away until it closes /dev/ublkcN, UBLK_U_IO_PREP_IO_CMDS can complete with UBLK_IO_RES_ABORT when it races STOP_DEV. kublk asserts that PREP succeeds, so the daemon aborts before it reports to `kublk add`, which then waits for the start event forever. Stop the thread like a failed FETCH_IO_CMDS does. The daemon's START_DEV then fails, and `kublk add` gets the error. Reported-by: Josef Bacik <josef@toxicpanda.com> Closes: https://lore.kernel.org/linux-block/63d8149c093169706e7478e779116b61.josef@toxicpanda.com/ Signed-off-by: Ming Lei <tom.leiming@gmail.com> Link: https://patch.msgid.link/20261011063555.1142277-11-tom.leiming@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-10-15selftests: ublk: move the control command helpers into ctrl.cMing Lei
Move the ublk_ctrl_*() helpers and ublk_setup_ring() out of kublk.c, so a small test program can send control commands without copying them. kublk still links every *.c file, ctrl.c included. ublk_ctrl_deinit() now also exits the control ring, and ublk_ctrl_init() checks the allocation and closes /dev/ublk-control when the ring setup fails. kublk calls them only around its own lifetime, but a test which opens a control handle per thread must not leak. No functional change for kublk. Signed-off-by: Ming Lei <tom.leiming@gmail.com> Tested-by: Josef Bacik <josef@toxicpanda.com> Link: https://patch.msgid.link/20261011063555.1142277-10-tom.leiming@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-10-15selftests: optionally record per-suite build and install resultsSasha Levin
By default the selftests build and installation succeed as long as one target succeeds, so that a single broken suite does not cost CI systems the coverage of all others; commit cad6f32665cb ("selftests: Deescalate error reporting") restored that policy after it had been tightened. The exit status of make therefore cannot tell which suites failed, and inspecting the installation is not reliable either: a suite whose compilation failed can still install its scripts. Add an opt-in report. When KSFT_BUILD_REPORT names an absolute file, the all and install rules append one tab-separated record per target with the phase, the target name and the exit status of its recursive make. Generating the runlist is recorded as part of the install phase. The records are written without changing which targets are built or installed or the exit status of make, also with FORCE_TARGETS. Nothing is recorded by make -n, -t or -q, including when the selftests are built through the kernel's kselftest targets, which clear MAKEFLAGS. The recording helper lives in a small fragment so that suites built from subdirectories can add records for them, and the variable is exported to sub-makes. A relative path is rejected, since every recursive make runs in a different directory. Keep the exit status of the runlist generation loop as before, and create an empty runlist for installations in which no target emits tests. Document the format, version 1, and how to read it. Link: https://lore.kernel.org/r/20261014200115.1363363-3-sashal@kernel.org Link: https://lore.kernel.org/r/20260416-selftests-deescalate-error-reporting-v1-1-38e7c0536227@kernel.org Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-10-15selftests: keep the build status from wrapping to successSasha Levin
The top-level all and install rules return failure only when every selected target fails, which commit cad6f32665cb ("selftests: Deescalate error reporting") deliberately kept as the default. They implement this by multiplying the exit statuses of the targets: ret=$$((ret * $$?)) A failing recursive make exits with status 2, so eight failing targets produce 256, and "exit 256" reports success. Building eight or more targets that all fail therefore succeeds, and install goes on to package an empty installation. Record a successful target instead of multiplying statuses. The rules still fail only when no target succeeds, and FORCE_TARGETS still stops at the first failure. Link: https://lore.kernel.org/r/20261014200115.1363363-2-sashal@kernel.org Fixes: 5f70bde26a48 ("selftests: fix build behaviour on targets' failures") Signed-off-by: Sasha Levin <sashal@kernel.org> Reviewed-by: Mark Brown <broonie@kernel.org> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-10-15Merge branches 'for-next/misc', 'for-next/be-gone', 'for-next/smccc-bus', ↵Catalin Marinas
'for-next/preemptible-this-cpu', 'for-next/cpu-errata', 'for-next/mpam', 'for-next/kselftest', 'for-next/efi', 'for-next/secondary-boot-prep', 'for-next/sysreg' and 'for-next/gcs', remote-tracking branch 'arm64/for-next/perf' into for-next/core * arm64/for-next/perf: (22 commits) drivers/perf: apple_m1: Add macOS 27 M2 Event perf/marvell: cn10k_tad: Publish the OF module alias perf: xgene: initialize lock before requesting IRQ perf: marvell: avoid large stack variables perf/dwc_pcie: Fix PCI device reference leak in probe coresight: perf: Suppress ITRACE start records perf: arm_spe: Suppress redundant ITRACE start records perf/core: Export perf_event_itrace_started() perf/cxl: Clear stale overflow status before using a counter perf/cxl: Don't log through pmu.dev in the overflow interrupt handler perf/cxl: Validate the hardware-reported counter width perf/cxl: Unfreeze counters after handling an overflow interrupt perf/cxl: Don't share the overflow interrupt, and keep it pinned cxl/pci: Add the PMUs after configuring events perf/cxl: Split the MSI vector out of info->irq perf/cxl: Accept an overflow interrupt on MSI message number 0 perf/cxl: Fix the counter overflow delta fixup perf/cxl: Clear stale event fields before reprogramming a counter perf/cxl: Program the requested event group on configurable counters drivers/perf: hisi: Add cycle event for new MN PMU ... * for-next/misc: arm64: cpufeature: Enable BBML2 for NVIDIA Rigel arm64: cputype: Add NVIDIA Rigel definitions arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA arm64/debug: mask debug exceptions when called from common code arm64: clear_page[s] using memset arm64/sve: Don't zero the SVE state buffer when the SVE state is live arm64/cpufeature: Drop redundant define(ID_AA64MMFR0..._SUPPORTED_LPA2) arm64: Use proper include variant arm64: include: fix repeated word 'to' in comment selftests: arm64: fix typo "hander" in comment arm64: fix typos in comments docs: arm64: Fix typo "initalised" in booting.rst arm64: alternative: Remove 'cfg' parameter arm64: mte-kasan: Use IS_ENABLED() rather than ALTERNATIVE() 'cfg' parameter arm64/cpufeature: Change description for ARM64_HAS_LPA2 * for-next/be-gone: drivers: Kconfig: Simplify dependencies on ARM64 && !CPU_BIG_ENDIAN arm64: Kbuild: Remove vestigial big-endian support gve: Add explicit ARM64 dependency to Kconfig crypto: hisilicon/sec2: Remove check of CONFIG_CPU_LITTLE_ENDIAN arm64: Remove all usage of __AARCH64EB__ arm64: Remove all usage of CONFIG_CPU_BIG_ENDIAN KVM: arm64: Remove support for a big-endian hypervisor object arm64: vdso32: Always build compat vDSO object as little-endian arm64: assembler: Remove endianness helper macros arm64: lib: Assume a little-endian kernel in optimised string routines arm64: lib: Assume a little-endian kernel in custom library routines arm64: crypto: Assume a little-endian kernel arm64: bpf: Remove big-endian support from the JIT compiler selftests/arm64: Remove big-endian support * for-next/smccc-bus: : Switch Arm SMCCC firmware services to an SMCCC bus arm64: rsi: Correct type of realm_config::hash_algo firmware: smccc: Pass only the required device probe arguments firmware: arm_rmm: Add SPDX and sort the Kconfig and Makefile entries coco: guest: arm64: Remove dummy CCA platform device coco: guest: arm64: Add sysfs ABI for CCA Realm guests firmware: smccc: arm-cca-guest: Bind the TSM provider to an SMCCC device virt: coco: arm-cca-guest: Rename TSM report source file arm64: realm: Move Realm memory encryption ops to RSI code firmware: arm_rmm: Move RSI support out of arch/arm64 firmware: hwrng: arm_smccc_trng: Register as an SMCCC device firmware: smccc: Add an Arm SMCCC bus * for-next/preemptible-this-cpu: : Preemptible this_cpu_*() operations arm64: percpu: Remove _pcp_protect*() wrappers arm64: percpu: Implement preemptible CMPXCHG128 ops arm64: percpu: Implement preemptible CMPXCHG ops arm64: percpu: Implement preemptible XCHG ops arm64: percpu: Implement preemptible return RMW ops arm64: percpu: Implement preemptible void RMW ops arm64: percpu: Implement preemptible read/write ops arm64: percpu: Add infrastructure for preemptible this_cpu_*() ops arm64: entry: sdei: Make 'tsk' available arm64: entry: sdei: Restore all clobberable GPRs arm64: gpr-num: add __GPR_NUM() helper arm64: gpr-num: Add wxN aliases for wN registers arm64: percpu: Factor out percpu offset asm arm64: ptrace: Always inline pt_regs_{read,write}_reg() arm64: preempt: Treat should_resched() as unlikely arm64: preempt: Simplify and optimize __preempt_count_dec_and_test() arm64: cmpxchg128: LSE: Remove redundant operands arm64: cmpxchg: LL/SC: Avoid redundant extension * for-next/cpu-errata: : Various CPU errata workarounds arm64: errata: Add NXP i.MX8QM/8QP workaround for A53 cache coherency issue arm64: cpufeature: Add ARM64_CPUCAP_SOC_ERRATUM for SoC-level errata * for-next/mpam: (30 commits) : MPAM updates arm_mpam: make the mon_sel guard conditional only arm_mpam: On saving mbwu state read the monitors before clearing CFG_MBWU_CTL arm_mpam: detect and enable MPAM-Fb PCC support arm_mpam: change MPAM-Fb error IRQ to use a threaded IRQ handler arm_mpam: add MPAM-Fb MSC firmware access support arm_mpam: prepare mon_sel locking for MPAM-Fb arm_mpam: propagate MSC access errors in mpam_reset_class_locked() arm_mpam: propagate MSC access errors for interrupt control arm_mpam: propagate MSC access errors for mpam_reprogram_ris_partid() arm_mpam: propagate MSC access errors for state saving function arm_mpam: propagate MSC access errors for __ris_msmon_read() arm_mpam: propagate MSC access errors for msmon helpers arm_mpam: propagate MSC access errors for MBWU counters arm_mpam: propagate MSC access errors for hw_probe functions arm_mpam: let low level MSC accessors return an error MAINTAINERS: Use linux-arm-kernel list for the MPAM driver MAINTAINERS: Add mpam.rst to the MPAM DRIVER entry arm_mpam: resctrl: Don't stop early when tearing down a class arm_mpam: Switch to kvzmalloc_objs() for allocation of component cfg arm_mpam: Don't loop forever if there is the maximum possible amount of PARTIDs ... * for-next/kselftest: : arm64 kselftest updates kselftest/arm64: signal: copy each test binary only once kselftest/arm64/mte: Use MTE safe memory accessors kselftest/arm64/mte: Introduce MTE safe memory accessors kselftest/arm64: Extend gcs-locking to cover cases where enable is unlocked * for-next/efi: : arm64 EFI updates/fixes arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO * for-next/secondary-boot-prep: : cpuinfo cleanup in preparation for parallel secondary bring-up arm64: smp: Defer RCU registration during secondary CPU bringup arm64: smp: Don't bother printing the I-cache policy for each CPU arm64: smp: Defer update of secondary CPU capabilities arm64: smp: Tidy up cpuinfo init and cpufeature updates arm64: smp: Tidy up smp_prepare_cpus() arm64: cpufeature: Store every ID register with its overrides applied arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu() arm64: cpufeature: Add read_cpuid_with_overrides() arm64: cpufeature: Check arm64_ftr_regs[] before the first store * for-next/sysreg: : sysreg updates perf: arm_brbe: Remove the check for TME transaction states arm64: sysreg: Mark fields the architecture dropped as RES0 arm64: sysreg: Fix the names of two misspelt fields arm64: sysreg: Fix three incorrect enum values * for-next/gcs: : GCS updates/fixes kselftest/arm64: Check for -EPERM not -EBUSY in the locking test arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures
2026-10-15kselftest/arm64: signal: copy each test binary only onceSasha Levin
The signal tests are built in testcases/ and then copied to the output directory. The copy rule lists every generated program as a target and copies all of them in each recipe: $(TEST_GEN_PROGS): $(PROGS) cp $(PROGS) $(OUTPUT)/ In a parallel build make runs that recipe once for each program, so several cp processes write the same destination files at the same time. cp then fails with "cannot create regular file ...: File exists", which fails the arm64 build even though every test compiled. A cross build of the arm64 signal tests at -j8 hit this in all of 8 runs. Use a static pattern rule so that each output depends on, and copies, only its own binary. Fixes: f96bf4340316 ("kselftest: arm64: mangle_pstate_invalid_compat_toggle and common utils") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-15iommupt: Do not allow PTEs to be split when dirty loggingJason Gunthorpe
If a single PTE cannot be stored in the current bitmap that should be a failure and reported back to userspace. Allowing a PTE to be split creates a possibility that dirty memory will be reported as clean. The gather must also cover the entire PTE that is being cleaned, not just the part that fits within the bitmap. Fix both issues by computing the full IOVA range of every PTE and using that to update the bitmap and the gather. The bitmap code now rejects ranges that don't fit in it, and the gather always combined ranges. The selftest quietly relied on a bug where the CONT was split, that is why the half page size for the mock domain saw alternating dirties. Increase the dirty test page size to PAGE_SIZE so it still works as intended. Cc: stable@vger.kernel.org Fixes: 4a00f9434891 ("iommupt: Add read_and_clear_dirty op") Reported-by: Samarth Narang <samarth.colleges@gmail.com> Closes: https://lore.kernel.org/all/20261013165814.309255 Link: https://patch.msgid.link/r/0-v1-5bb926ff73ec+576-iommufd_dirty_jgg@nvidia.com Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-10-15selftests/bpf: Accept unnamed dma-bufs in the dmabuf_iter default testQiliang Yuan
The dmabuf_collector iterator prints the inode, size, name and exporter of every dma-buf in the system on separate lines, with an empty name for the buffers that have none. The default_iter subtest parses that output and looks for the two buffers it created. It requires a name for every buffer, and sscanf() finds none on the empty line of an unnamed one. On a system that has such a buffer, like one exported by udmabuf without a name, the subtest fails before it gets to its own buffers. Take an empty name for a buffer without one. Fixes: ae5d2c59ecd7 ("selftests/bpf: Add test for dmabuf_iter") Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: T.J. Mercier <tjmercier@google.com> Link: https://lore.kernel.org/bpf/20261009-selftests-bpf-dmabuf-iter-unnamed-v1-1-962ee94f7a5e@gmail.com
2026-10-15selftests/bpf: Fix map fd leak in no-BTF wq testYun Lu
bpf_map__reuse_fd() duplicates the supplied file descriptor instead of taking ownership of it. test_failure_map_no_btf() closes the original map_fd only when reuse fails, leaking it when reuse succeeds, including when the test passes. Destroying the skeleton closes its own descriptor but leaves the original descriptor and its map reference alive. Close map_fd immediately after bpf_map__reuse_fd(), before checking its return value, to release the original descriptor on both success and failure. The skeleton retains its own descriptor for the subsequent program load. Fixes: bca2b74ea9a8 ("selftests/bpf: Add more bpf_wq tests") Reported-by: Jackie Liu <liuyun01@kylinos.cn> Signed-off-by: Yun Lu <luyun@kylinos.cn> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013030114.292157-1-luyun_611@163.com
2026-10-15Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc8). No conflicts. Adjacent changes: drivers/net/ethernet/microchip/lan865x/lan865x.c 2a3f6d2a9ac3 ("microchip: lan865x: move setting of netops to fix crash") 15358c2c3dca ("net: ethernet: oa_tc6: return ERR_PTR from oa_tc6_init()") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-15selftests/bpf: Create the vxlan devices of test_tunnel with their MACQiliang Yuan
The vxlan tests of test_tunnel create a tunnel device in the initial netns with "ip link add", and then give it the MAC address that the static neighbor entry at the other end points to with "ip link set". systemd-udevd assigns new devices of the initial netns a MAC address of its own, following its MACAddressPolicy, when it handles their uevent. When it gets to that after the test set the address, the replies sent to the configured MAC are dropped as meant for another host, and the ping of vxlan_tunnel fails after 10 seconds. Pass the address to "ip link add". udevd leaves alone the address of a device that was created with one. Fixes: 1ee7efd40abf ("selftests/bpf: Move vxlan tunnel testcases to test_progs") Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261009-selftests-bpf-tunnel-vxlan-mac-v1-1-624dd769c334@gmail.com
2026-10-15selftests/bpf: Clean up sa_family_t-stringifierMichal Luczaj
Following commit f3de1cf621f7 ("selftests/bpf: sockmap_listen cleanup: Drop af_unix redir tests") and commit 9266e49d608c ("selftests/bpf: sockmap_listen cleanup: Drop af_vsock redir tests"), sockmap_listen.c: family_str() becomes functionally identical to select_reuseport.c: family_str(). Move the logic to socket_helpers.h. Suggested-by: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Michal Luczaj <mhal@rbox.co> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://msgid.link/CAAVpQUDULzZh58oKkRaYqgM9bRToGb7wHrzT+cZNpRmAtM12Ow@mail.gmail.com Link: https://lore.kernel.org/bpf/20261008-selftests-sockmap_listen-cleanup-v1-1-f6d1a4ff540d@rbox.co
2026-10-15kselftest/arm64: Check for -EPERM not -EBUSY in the locking testMark Brown
The API has been updated to return the more descriptive -EPERM rather than -EBUSY, update the selftest to reflect this. Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-15selftests/ftrace: Add nice dependencyJaewon Jung
The tests use nice but do not list it as a requirement. Add nice to the requirements so the tests are unresolved, not failed, when it is not available. Link: https://lore.kernel.org/r/20261015022416.43534-1-jaewon8868@gmail.com` Signed-off-by: Jaewon Jung <jaewon8868@gmail.com> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-10-15selftests: kselftest_deps.sh: Support LLVMMark Brown
The kselftest_deps.sh script currently takes a compiler as the first argument and uses it to check that libraries needed by the selftests are installed. This works well for GCC where a separate binary is provided for each target architecture but is less of a good fit for LLVM where a single compiler binary can target all of the supported architetures. Extend the script to accept "LLVM" as the compiler with an additional optional ARCH= argument so that it can be used when building with LLVM in a similar fashion to how the actual build works. The duplication with the main Makefile isn't ideal here. Link: https://lore.kernel.org/r/20261013-kselftest-deps-llvm-v1-1-f2ee70ae1b79@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org> Acked-by: Nick Desaulniers <ndesaulniers@google.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-10-15selftests: lib.mk: Don't fail install if no modules were builtMark Brown
The install rule for TEST_GEN_MODS_DIR copies *.ko from the directory with rsync which fails if there are no modules, for example because the directory's Makefile skipped building them. Only run rsync if there is something to install. This currently affects the livepatch suite but it seems sensible to fix here for added robstness. Link: https://lore.kernel.org/r/20261014-kselftest-lib-no-modules-v1-1-e4f7208dcb56@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-10-15selftests/ftrace: Avoid unlink error on first runJaewon Jung
On the first run, ftracetest tries to unlink a symlink that does not exist. Use rm -f to avoid the "No such file or directory" error. Link: https://lore.kernel.org/r/20261014114839.6258-1-jaewon8868@gmail.com Fixes: 7dc1e125f07a ("ftrace/selftests: Add softlink to latest log directory") Signed-off-by: Jaewon Jung <jaewon8868@gmail.com> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-10-15tracing/selftests: Fix incorrect invocation of exit_failWoradorn Laodhanadhaworn
Replace all `exit fail` and `exit_fail;` with exit_fail to keep the usage of exit_fail consistent across the ftrace selftests. This also reduces warning messsege such as 'exit: Illegal number: fail' in test logs. Link: https://lore.kernel.org/linux-trace-kernel/20260918061913.28069-1-woradorn.laon@gmail.com Signed-off-by: Woradorn Laodhanadhaworn <woradorn.laon@gmail.com> Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-10-15selftests/lib.mk: run_tests: print summary at the endMatthieu Baerts (NGI0)
When there are many tests and/or many log lines, it is difficult to quickly find out how the different tests went when running: make -C tools/testing/selftests run_tests This run_tests target executes 'run_many' from runner.sh, which relies on ktap_helpers.sh. At the end of the execution, the KTAP_CNT_* counters have been populated, and the total can then be simply printed with the ktap_print_totals helper. Now a summary is printed at the end, e.g. here with the two last lines: $ make -sC tools/testing/selftests TARGETS=(...) run_tests # timeout set to (...) # selftests: (...) (...) ok 1 selftests: (...) # timeout set to (...) # selftests: (...) (...) ok 2 selftests: (...) # SKIP # timeout set to (...) # selftests: (...) (...) not ok 3 selftests: (...) # 1 skipped test(s) detected. Consider enabling relevant config options to improve coverage. # Totals: pass:1 fail:1 xfail:0 xpass:0 skip:1 error:0 This summary is printed, using '#' as prefix to be treated as a comment in the TAP format. The summary is also printed when summary=1 is used to redirect log lines in different files because it still looks useful when there are many tests, not to have to check each line. Note that this 'make' command will continue to exit without errors (returned code is 0) when the tests can be executed. I guess it is better not to change this behaviour to be able to continue detecting kselftests failures. Link: https://lore.kernel.org/r/20261005-sft-run-tests-print-totals-v2-1-29c45c0e2fe6@kernel.org Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-10-15selftests/fuse: add fuse readdir caching testLuis Henriques
This new test will check the caching behaviour using combinations of two opendir flags: FOPEN_KEEP_CACHE and FOPEN_CACHE_DIR. Signed-off-by: Luis Henriques <luis@igalia.com> Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-10-15selftests/fuse: add fuse symlink caching testLuis Henriques
This patch adds a simple test that allows to verify that, when resolving a symlink, user-space is called only the first time when caching is enabled or, if caching is disabled, every time the symlink resolution is requested. Signed-off-by: Luis Henriques <luis@igalia.com> Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-10-15selftests/fuse: add some extra ACL caching testsLuis Henriques
This adds some extra tests to ACL caching: - Verify that reading ACLs results in the expected number of requests being sent user-space, depending on whether cache is enabled or disabled - Verify caching behaviour on some caching invalidation scenarios While there, add test binary to .gitignore. Signed-off-by: Luis Henriques <luis@igalia.com> Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-10-15selftests/fuse: use dynamically allocated memory to store ACLsLuis Henriques
Instead of directly using static arrays for the ACL value, allocate memory for storing it. This will make it easier to implement ACL tests that also set the xattr dynamically. Signed-off-by: Luis Henriques <luis@igalia.com> Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-10-15selftests/fuse: factor-out test fixture setup/teardownLuis Henriques
In order to reduce new tests setup/teardown code duplication, factor-out these functions from the existing acl_cache test into a new fuse_common.c file that can be reused in other tests. While there, also move some of the FIXTURE members into a fuse_common_ctx structure that can be passed into setup/teardown instead of passing them by reference. Signed-off-by: Luis Henriques <luis@igalia.com> Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-10-15selftests/fuse: check that fusectlfs is mountedLuis Henriques
The control filesystem for FUSE needs to be mounted for the fusectl_test to be successfully run. Skip the test is that is not the case. Signed-off-by: Luis Henriques <luis@igalia.com> Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-10-15selftests/fuse: convert fusectl test to fuse3Luis Henriques
Since it is probably not worth adding new fuse kselftests based on fuse2, it is a good idea to convert the single existing test to fuse3. The conversion is trivial, as it only requires some changes to function signatures (the gettattr and truncate fuse operations), and to the filler() helper. Signed-off-by: Luis Henriques <luis@igalia.com> Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-10-15KVM: s390: selftests: Add IRQ injection selftestsGabriella Seifert
The IRQ injection selftests haven't been added to the selftests yet so let's do that now. We start off with a couple simple error checks for invalid data. Signed-off-by: Gabriella Seifert <gseifert@linux.ibm.com> [frankja@linux.ibm.com: Improved formatting and wording] Signed-off-by: Janosch Frank <frankja@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-10-15selftests/bpf: Expect at least one tp_recursion miss in missedQiliang Yuan
missed_tp_recursion attaches its tp programs to bpf_trace_printk and expects each of them to miss exactly one run, the one that its kprobe program on bpf_fentry_test1 triggers by calling bpf_printk(). The test is not serial, so tests running in parallel can add misses to the tp programs while they are attached: - The kprobe on bpf_fentry_test1 is global. Any other test that does bpf_prog_test_run() on a fentry/fexit program calls bpf_fentry_test1() and thereby fires the kprobe program, which calls bpf_printk() from kprobe context and makes the tp programs fail the bpf_prog_active check once more. - Any other program that runs under the bpf_prog_active check, such as a kprobe program or the perf event tracepoint program in legacy_printk, and calls bpf_printk() hits bpf_trace_printk the same way. Either way, test2_recursion_misses comes out as 2 instead of 1. Expect at least one miss, as missed_kprobe_recursion does since commit 08a7078feacf ("selftests/bpf: Improve missed_kprobe_recursion test robustness"). Fixes: 85981e0f9e9f ("selftests/bpf: Add test for recursion counts of perf event link tracepoint") Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261008-selftests-bpf-missed-tp-recursion-v1-1-0dd60471d655@gmail.com
2026-10-15Merge tag 'loongarch-kvm-7.4' of ↵Paolo Bonzini
git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD LoongArch KVM changes for v7.4 1. Add separate vmid support. 2. Simplify MSI interrupt injection. 3. Add crash hypercall support. 4. Allow to set pv_feature until vCPU run. 5. Enable HW page table walk automatically in selftests.
2026-10-15selftests/bpf: Report a failure to register the session key in test_progsQiliang Yuan
test_progs adds the key that verifies signed programs to the session keyring before it runs any test, and exits when that fails. It exits with 255 without printing anything. pam_keyinit revokes the session keyring on logout, so a test_progs started in the background from an ssh session that has been closed since leaves nothing but an empty log behind, with no hint of what went wrong. Print the error before exiting. Fixes: b720903e2b14 ("selftests/bpf: Enable signature verification for some lskel tests") Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261008-selftests-bpf-test-progs-session-key-v1-1-ec48e793639b@gmail.com
2026-10-15selftests/bpf: Use its own netns in flow_dissector_skb_less_direct_attachQiliang Yuan
test_flow_dissector_skb_less_direct_attach() and test_flow_dissector_skb_less_indirect_attach() each create a netns to run in, and test_progs may run the two at the same time. Both name their netns flow_dissector_skb_less_indirect_attach_ns. When the two tests overlap, one of them fails to create or open the netns, or loses it to the cleanup of the other one. Name the netns of the direct attach test after that test. Fixes: 2b044dd186f0 ("selftests/bpf: re-split main function into dedicated tests") Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com> Link: https://lore.kernel.org/bpf/20261008-selftests-bpf-flow-dissector-netns-v1-1-5d9889aaad84@gmail.com
2026-10-14selftests/exec: report the skipped binfmt_misc_bpf test on stderrSasha Levin
The exec Makefile announces that binfmt_misc_bpf is skipped with $(info), which writes to standard output whenever the Makefile is parsed. The selftests install target appends the standard output of "make -s emit_tests" to kselftest-list.txt, so on systems without the BPF toolchain the runlist gains a line that is not a test entry: exec selftests: skipping binfmt_misc_bpf, needs clang, bpftool, ... run_kselftest.sh and CI systems that parse the runlist then treat it as a malformed test entry. Use $(warning) so that the notice still appears in build logs but goes to standard error. Fixes: 277d787feb2e ("selftests/exec: add binfmt_misc bpf-backed handler test") Signed-off-by: Sasha Levin <sashal@kernel.org> Link: https://patch.msgid.link/20261014200135.1364053-1-sashal@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
2026-10-15selftests/bpf: Remove the old test_bpf moduleDaniel Borkmann
The instruction tests of the test_bpf module live in the BPF selftests now, as the jit_insns test of test_progs, which BPF CI runs on every architecture it covers, and its skb_segment tests have a KUnit successor in net/core/net_test.c. Remove the module together with its Kconfig entry, the test_kmod.sh and test_bpf.sh wrappers of the bpf and net selftests, the config fragments and defconfigs that enabled it, as well as all other references to it and symbol exports in core kernel. For archs wanting to support BPF JITs, it's time they move over to the BPF selftests for proper coverage. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013171230.523677-19-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-10-15selftests/bpf: Add JIT instruction testsDaniel Borkmann
Carry only the relevant instruction tests of the test_bpf kernel module over into test_progs, so that BPF CI runs them on every JIT: ALU, atomic, 64-bit immediate load and jump instructions for the power-of-two magnitudes and signs of the operands, all shift counts, all operand register combinations, the division and modulo by constants, jumps with staggered offsets, here in both directions and also for the 32-bit unconditional jump, and the maximal jump over instructions which expand in the JITs. Add sweeps for the instruction patterns a JIT has a shorter or faster native form for, with every register as operand. The families with an immediate run once more with constant blinding. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t jit_insns [...] #191/1 jit_insns/arena access with zero offset:OK #191/2 jit_insns/cast to a user address:OK #191/3 jit_insns/alu_imm:OK #191/4 jit_insns/alu_reg:OK #191/5 jit_insns/alu_imm_regs:OK #191/6 jit_insns/div_const:OK #191/7 jit_insns/alu_reg_pairs:OK #191/8 jit_insns/shifts:OK #191/9 jit_insns/atomics:OK #191/10 jit_insns/atomic_reg_pairs:OK #191/11 jit_insns/xadd_chain:OK #191/12 jit_insns/ld_imm64:OK #191/13 jit_insns/jmp_imm:OK #191/14 jit_insns/jmp_reg:OK #191/15 jit_insns/jmp_reg_pairs:OK #191/16 jit_insns/staggered_jumps:OK #191/17 jit_insns/max_jmp:OK #191/18 jit_insns/ldst_zero_off:OK #191/19 jit_insns/ldst_offsets:OK #191/20 jit_insns/acq_rel:OK #191/21 jit_insns/movsx:OK #191/22 jit_insns/jset_imm:OK #191/23 jit_insns/cmp_imm:OK #191/24 jit_insns/alu_consts:OK #191/25 jit_insns/bswap:OK #191/26 jit_insns/probe_mem:OK #191 jit_insns:OK #192/1 jit_insns_blinded/alu_imm:OK #192/2 jit_insns_blinded/alu_imm_regs:OK #192/3 jit_insns_blinded/div_const:OK #192/4 jit_insns_blinded/shifts:OK #192/5 jit_insns_blinded/xadd_chain:OK #192/6 jit_insns_blinded/ld_imm64:OK #192/7 jit_insns_blinded/jmp_imm:OK #192/8 jit_insns_blinded/ldst_zero_off:OK #192/9 jit_insns_blinded/ldst_offsets:OK #192/10 jit_insns_blinded/jset_imm:OK #192/11 jit_insns_blinded/cmp_imm:OK #192/12 jit_insns_blinded/alu_consts:OK #192 jit_insns_blinded:OK Summary: 2/38 PASSED, 0 SKIPPED, 0/0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013171230.523677-18-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-10-15selftests/bpf: BPF_F_ANY_ALIGNMENT for byte_array_size_spanning()Eduard Zingerman
The test case indexes inside `char bytes[32]` array with unaligned offset. Use BPF_F_ANY_ALIGNMENT flag to avoid the test rejection for unrelated reason. Fixes: e187fac8ac6b ("selftests/bpf: Tests for varying offset access to PTR_TO_BTF_ID") Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013-scev-minimal-v3-followups-v2-7-6d9d61965486@gmail.com
2026-10-15selftests/bpf: Harden __msg patterns for step_movsx_bounds_on_lineEduard Zingerman
The `{{.*}}` in the pattern for R5 below might hide the `step=...` logging from the __no_step annotation. Replace it with full expected log instead. Also drop __no_step for R3 above, where it is unnecessary. Fixes: 2db5837f9ada ("selftests/bpf: Tests for register base/step arithmetic") Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013-scev-minimal-v3-followups-v2-6-6d9d61965486@gmail.com
2026-10-15selftests/bpf: Harden __msg pattern for global_callee_btf_argEduard Zingerman
The original pattern: __msg("3: (85) call pc+{{[0-9]+}}\n") Is ambigous, as this line is printed on the main verification pass as well. Harden the test case by ensuring a __msg_next sequence matching the stack use/def results specifically. Fixes: 063c85f5d8c7 ("selftests/bpf: Tests for BTF-based global subprog stack liveness") Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013-scev-minimal-v3-followups-v2-5-6d9d61965486@gmail.com