summaryrefslogtreecommitdiff
path: root/tools/testing
AgeCommit message (Collapse)Author
2026-10-12selftests/proc: add /proc/pid/smaps_rollup tearing testsSuren Baghdasaryan
During tearing tests, smaps_rollup Pss* metrics should stay constant. Extend /proc/pid/smaps tearing tests to also check for smaps_rollup consistency. Link: https://lore.kernel.org/20260918153318.758387-8-surenb@google.com Signed-off-by: Suren Baghdasaryan <surenb@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Jann Horn <jannh@google.com> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: "Paul E . McKenney" <paulmck@kernel.org> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Usama Arif <usama.arif@linux.dev> Cc: Vlastimil Babka <vbabka@kernel.org>
2026-10-12mm: selftests: Add shmem into memory failure testLisa Wang
Add a shmem memory failure selftest to test the shmem memory failure is correct after modifying shmem return value. Specifically, test the expected behavior under various scenarios combining page dirtiness (dirty vs clean) and failure types (hard vs soft): + Dirty + Hard: Trigger a SIGBUS on injection, and trigger another SIGBUS when reading the page again. + Dirty + Soft: No SIGBUS is triggered, and the original value can be read successfully. + Clean + Hard: No SIGBUS is triggered on injection, but trigger a SIGBUS when trying to read the page again. + Clean + Soft: No SIGBUS is triggered, and the page can be read successfully. [akpm@linux-foundation.org: fix comment typo, per Lisa] Link: https://lore.kernel.org/20260917-memory-failure-mf-delayed-fix-v6-5-4b00856b5364@google.com Signed-off-by: Lisa Wang <wyihan@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Acked-by: Miaohe Lin <linmiaohe@huawei.com> Cc: Ackerley Tng <ackerleytng@google.com> Cc: Andi Kleen <andi@firstfloor.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: David Rientjes <rientjes@google.com> Cc: Fuad Tabba <tabba@google.com> Cc: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com> Cc: Hugh Dickins <hughd@google.com> Cc: Isaku Yamahata <isaku.yamahata@intel.com> Cc: Jiaqi Yan <jiaqiyan@google.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michael Roth <michael.roth@amd.com> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Naoya Horiguchi <nao.horiguchi@gmail.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Rik van Riel <riel@redhat.com> Cc: Sean Christopherson <seanjc@google.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vishal Annapurve <vannapurve@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Xiaoyao Li <xiaoyao.li@intel.com> Cc: Yu Zhang <yu.c.zhang@linux.intel.com>
2026-10-12selftests/damon/sysfs_memcg_path_leak: fail only for real DAMON leakSJ Park
The selftest can fail for any leak if it happens while the test is running. Remove the false positive test failures by further checking if the expected leaking function is called out on the report. Link: https://lore.kernel.org/20260917142210.90829-10-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Cc: Asier Gutierrez <gutierrez.asier@huawei-partners.com> Cc: Brendan Higgins <brendan.higgins@linux.dev> Cc: David Gow <davidgow@davidgow.net> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Randy Dunlap <rdunlap@infradead.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org>
2026-10-12selftests/cgroup: ignore memory.reclaim -EAGAIN for zswap writeback testHarry Yoo (Meta)
The zswap_writeback_enabled test fails when a write to memory.reclaim returns -EAGAIN, which means less than the requested amount was reclaimed. attempt_writeback() propagates the -EAGAIN to the caller, and the test case is marked as failed even when zswap writeback did happen. This heavily depends on the performance of the backing swap device. Reclaim does not wait for writeback (on cgroup v2), does not count pages that are under writeback as reclaimed, and memory.reclaim gives up after MAX_RECLAIM_RETRIES passes without making progress. On a slow device where reclaim does not make any progress before writeback completes, a write to memory.reclaim fails. On a VM with zswap enabled, where IO delay was injected via dm-delay, the success rate of the zswap writeback test drops dramatically once the delay reaches 11 ms: 7% failures at 10 ms and 79% failures at 11 ms, n = 100. When zswap writeback is enabled, ignore -EAGAIN from memory.reclaim and determine pass/fail based on the zswpwb counter because that is what zswap_writeback_enabled actually wants to test. With this change, the test reliably passes even on a slow swap device (tested up to 1000 ms delay). This makes the test resilient against the performance of the swap device. Link: https://lore.kernel.org/20260914-test-zswap-wb-ignore-eagain-v1-1-6fb715c22cd8@kernel.org Fixes: 158863e5d7cc ("selftests: cgroup: add tests to verify the zswap writeback path") Signed-off-by: Harry Yoo (Meta) <harry@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: SJ Park <sj@kernel.org> Acked-by: Nhat Pham <nphamcs@gmail.com> Assisted-by: LLM Cc: Chengming Zhou <chengming.zhou@linux.dev> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Joshua Hahn <joshua.hahnjy@gmail.com> Cc: Kiryl Shutsemau <kas@kernel.org> Cc: Michal Koutný <mkoutny@suse.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Tejun Heo <tj@kernel.org> Cc: Usama Arif <usamaarif642@gmail.com>
2026-10-12selftests/damon: add script dir to sys.path for PYTHONSAFEPATH compatibilityEva Kurchatova
Running these tests under Python's safe path mode, either with -P on the interpreter command line or with PYTHONSAFEPATH set in the environment, stops the script's own directory being prepended to sys.path. Some distributions (RHEL, for example) build the tests with -P in the shebang. This breaks all 7 DAMON Python selftests that import the _damon_sysfs helper module located in the same directory: ModuleNotFoundError: No module named '_damon_sysfs' Fix this by explicitly adding the script's directory to sys.path before importing _damon_sysfs, following the same pattern used in commit c3b3eb565bd7 ("tools: ynl: add script dir to sys.path") which fixed the identical issue for the YNL tools. Link: https://lore.kernel.org/20260914141952.91465-4-sj@kernel.org Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com> Reviewed-by: SJ Park <sj@kernel.org> Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Cc: Brendan Higgins <brendan.higgins@linux.dev> Cc: David Gow <davidgow@davidgow.net> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Kunwu Chan <kunwu.chan@gmail.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lian Wang <lianux.mm@gmail.com> Cc: Liew Rui Yan <aethernet65535@gmail.com> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Randy Dunlap <rdunlap@infradead.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
2026-10-12selftests/damon: ignore test-generated damon_dump_outputZenghui Yu (Huawei)
sysfs.py and sysfs_no_op_commit_break.py dump the DAMON status collected via drgn_dump_damon_status.py into a damon_dump_output file in the working directory. Ignore it so that running the tests in-tree does not pollute git status. Link: https://lore.kernel.org/20260914141952.91465-3-sj@kernel.org Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev> Reviewed-by: SJ Park <sj@kernel.org> Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Cc: Brendan Higgins <brendan.higgins@linux.dev> Cc: David Gow <davidgow@davidgow.net> Cc: David Hildenbrand <david@kernel.org> Cc: Eva Kurchatova <eva.kurchatova@virtuozzo.com> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Kunwu Chan <kunwu.chan@gmail.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lian Wang <lianux.mm@gmail.com> Cc: Liew Rui Yan <aethernet65535@gmail.com> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Randy Dunlap <rdunlap@infradead.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org>
2026-10-12selftests/damon: stop kdamond on error exits of no-op commit testZenghui Yu (Huawei)
Patch series "mm/damon: misc improvements in tests and documents". Add various improvements to DAMON tests and documents. Patch 1 and 2 from Zenghui Yu (Huawei) let DAMON selftest to clean up its state and output after running the tests. Patch 3 from Eva Kurchatova makes a few selftest be able to run with Python's safe path mode. Patch 4 from Kunwu Chan improves coverage of DAMON kunit tests. Finally, patches 5 and 6 from Liew Rui Yan clarify and fix typos on documents for DAMOS quota behaviors. Below are notes that can be removed in the final commit message. This is a batched repost of DAMON patches that were individually posted. Please refer to each patch for changelog. This patch (of 6): The sysfs_no_op_commit_break test starts a kdamond via sysfs, but its error paths (e.g., drgn not installed) exit without stopping it. The leaked kdamond then makes subsequent tests, e.g. lru_sort.sh and reclaim.sh, skip with "Another kdamond is running". Wrap the post-start logic in try-finally so that kdamonds.stop() is executed on every exit path. Link: https://lore.kernel.org/20260914141952.91465-1-sj@kernel.org Link: https://lore.kernel.org/20260914141952.91465-2-sj@kernel.org Fixes: 10725cd2b09a ("selftests/damon: test no-op commit broke DAMON status") Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev> Reviewed-by: SJ Park <sj@kernel.org> Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Assisted-by: GLM-5.3 OpenCode Cc: Brendan Higgins <brendan.higgins@linux.dev> Cc: David Gow <davidgow@davidgow.net> Cc: David Hildenbrand <david@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Randy Dunlap <rdunlap@infradead.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Eva Kurchatova <eva.kurchatova@virtuozzo.com> Cc: Kunwu Chan <kunwu.chan@gmail.com> Cc: Lian Wang <lianux.mm@gmail.com> Cc: Liew Rui Yan <aethernet65535@gmail.com>
2026-10-12rcutorture: Add atomic SRCU cross-CPU IRQ context mismatch testKunwu Chan
Add testtype 7 to verify that lockdep detects an IRQ-context mismatch when an atomic SRCU read-side critical section is held with IRQs enabled on one CPU and synchronize_srcu_atomic() is called from an IPI handler on another CPU. This covers the cross-CPU case that cannot be detected by checking the current task's held locks. Co-developed-by: Zqiang <qiang.zhang@linux.dev> Signed-off-by: Zqiang <qiang.zhang@linux.dev> Signed-off-by: Kunwu Chan <kunwu.chan@gmail.com> Acked-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-10-12selftests/rcutorture: Fix double nerrs count in srcu_lockdep.shKunwu Chan
When CONFIG_PROVE_LOCKING is missing, the deadlock-detection loop and the mixed-SRCU-readers section each increment nerrs once in the configuration check and again in the common error path, counting the same error twice. Remove the stray increments so that each error advances nerrs by one. Signed-off-by: Kunwu Chan <kunwu.chan@gmail.com> Acked-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-10-12selftests/rcutorture: Wire atomic SRCU into srcu_lockdep.shKunwu Chan
Add testtypes 4 (atomic SRCU same-type deadlock) and 5 (atomic SRCU + raw_spinlock dependency cycle) to the deadlock-detection loop. Add a separate loop for testtype 6 (rcu_read_lock() → synchronize_srcu_atomic()), which also verifies via console.log that no lockdep warning is triggered. Co-developed-by: Zqiang <qiang.zhang@linux.dev> Signed-off-by: Zqiang <qiang.zhang@linux.dev> Signed-off-by: Kunwu Chan <kunwu.chan@gmail.com> Acked-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-10-12rcutorture: Fix kvm-again.sh re-run failure on ppc64Zhouyi Zhou
Discovered in the Open Source Lab of Oregon State University when running torture.sh on a ppc64le VM. Two bugs were exposed: 1. The kvm-transform.sh call hard-coded "bzImage" as the kernel image name. On ppc64, the boot image is vmlinux, not bzImage, so the re-run failed to find the image. Fix this by extracting the QEMU binary from the qemu-cmd file and passing it to identify_boot_image() to obtain the correct architecture-specific image name, the same way kvm.sh already does. 2. The rm -f invocation on re-run listed vmlinux among the files to delete. On ppc64 vmlinux is the boot image, so deleting it broke the re-run on that architecture. Drop vmlinux from the unconditional list, and instead conditionally delete it only when the boot image basename is not vmlinux. In addition, identify qemu_binary before the copy step so that on non-PowerPC systems (where vmlinux is not the boot image) the vmlinux file can be removed immediately after the run directory is copied, saving storage before any tests run. This also eliminates the per-iteration re-computation of qemu_binary and boot_image inside the qemu-cmd transform loop. Tested on a local x86_64 machine and on a PPC VM of the Open Source Lab of Oregon State University. Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com> Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-10-12torture: Allow specifying alternative ssh command to kvm-remote.shPaul E. McKenney
Some environments require use of alternative commands to access the test hosts. This commit therefore adds a KVM_REMOTE_SSH environment variable for this purpose. If this variable is unset, ssh is used. Any alternative ssh command must support the usual ssh arguments, including the command to be executed remotely. In some cases, you may need a wrapper script to make the alternative ssh-like command look enough like ssh to satisfy kvm-remote.sh. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-10-12rcutorture: Add atomic-SRCU support to torture.shKunwu Chan
Add the --do-atomic-srcu argument to torture.sh, which runs the SRCU-N, SRCU-P, and SRCU-T scenarios, thus covering both Tree SRCU (SRCU-N and SRCU-P) and Tiny SRCU (SRCU-T), with rcutorture.reader_flavor=0x10 appended to the boot parameters so that it takes precedence over each scenario's own reader-flavor setting. This exercises srcu_read_lock_atomic(), srcu_read_unlock_atomic(), and synchronize_srcu_atomic(). As with other torture.sh tests, the --do-kcsan argument runs a KCSAN+PROVE_LOCKING variant of this test. [ paulmck: Make --do-atomic-srcu be default-on. ] Signed-off-by: Kunwu Chan <kunwu.chan@gmail.com> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-10-12selftests: cgroup: make test_memcg_sock check flushed sock statsKonstantin Khorenko
test_memcg_sock compares memory.current with the "sock " entry of memory.stat. memory.current changes at charge time, "sock " only when the memcg stats are flushed: by a memory.stat read once enough updates are pending (MEMCG_CHARGE_BATCH per online CPU), or by a periodic, deferrable worker. Nothing in the test makes sure a flush happens: - tcp_client() takes 16 readings right after connect(). If no flush lands among them, "sock " reads 0, and the test either passes on 0 == 0 without checking anything or, once memory.current shows the first charge, cannot pass any more and fails: not ok 11 test_memcg_sock - The final check waits 3 seconds for "sock " to drop to 0, counting on the deferrable worker, which can run later than that on an idle machine. Make the test cause the flushes instead of waiting for them. Every page of socket or anonymous memory that comes and goes in the cgroup counts towards the flush threshold, and MEMCG_FLUSH_BYTES (twice the vmstat error test_kmem allows for) is enough to cross it. After that much, either another flush has reset the count or the next memory.stat read flushes. - tcp_client() sets a small receive buffer before it connects. Only the server's socket is charged to the test cgroup, and with a large receive window its data moves straight on to the client; with few CPUs the client then drains it between reads and "sock " stays near 0. A small window keeps the data queued in the server's socket. - tcp_client() then keeps reading, comparing after every read, until "sock " is nonzero and matches memory.current, for up to four times MEMCG_FLUSH_BYTES. A comparison can still miss after a flush: one that came midway leaves "sock " behind, and memory.current also holds the per-CPU charge stock. The budget leaves room for several flushes. - After the server has exited, the test allocates and frees MEMCG_FLUSH_BYTES of anonymous memory in the cgroup and reads "sock ", for up to three rounds until it reads 0. The socket memory is uncharged before the first round, so any flush that has gone through all CPUs since sees "sock " at 0. A flush still running in parallel can reset the count before it reaches the CPU that did the uncharge, and the read then misses the uncharge. That flush only has to finish its walk over the CPUs for the next read to see it, and each round gives it the time of another allocation. Three rounds are a margin for a flusher that gets rescheduled midway, not a guarantee: nothing bounds how long it can be held up. MEMCG_CHARGE_BATCH goes to cgroup_util.h, and test_kmem's MAX_VMSTAT_ERROR uses it too. Assisted-by: LLM Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-10-12selftests: cgroup: skip test_memcg_sock under cgroup.memory=nosocketKonstantin Khorenko
With cgroup.memory=nosocket the memory controller does not charge socket memory, so the "sock " entry of memory.stat stays 0 and memory.current moves only by the kernel objects accept() allocates. tcp_client() then passes on 0 == 0 without having checked any accounting, or fails if those objects took a fresh charge batch. Look for nosocket among the cgroup.memory= options on the kernel command line and skip the test there. Assisted-by: LLM Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-10-12cgroup: Merge branch 'for-7.3-fixes' into for-7.4Tejun Heo
Pull to receive 1765a153d985 ("cgroup/pids: Restore pids.events notifications in local mode") for the pids.events notification selftest. Signed-off-by: Tejun Heo <tj@kernel.org>
2026-10-12selftests/sched_ext: Fix build error in dequeue_remote selftestSamuele Mariotti
Building the dequeue_remote selftest with newer compilers (e.g., gcc 16) triggers the following error: dequeue_remote.c:39:32: error: variable ‘sum’ set but not used The 'volatile' qualifier prevents the writes from being optimized away, but does not silence the warning, since 'sum' is indeed only written and never read. Consume 'sum' via an empty asm() with a register input constraint, as already done for the dequeue selftest in commit 3788e3251653 ("selftests/sched_ext: Fix build error in dequeue selftest"). This forces the compiler to keep the accumulated value (preserving the CPU stress loop) and avoids the build error. Signed-off-by: Samuele Mariotti <smariotti@disroot.org> Reviewed-by: Kuba Piecuch <jpiecuch@google.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-10-12selftests/cgroup: Free the paths returned by cg_control()Sasha Levin
cg_control() returns a path allocated with malloc(). The two callers that pass it straight to inotify_add_watch() never free it, and pass NULL to it if the allocation fails. Keep the path in a local variable, check it, and free it when done. Assisted-by: LLM Signed-off-by: Sasha Levin <sashal@kernel.org> Acked-by: Michal Koutný <mkoutny@suse.com> Reviewed-by: T.J. Mercier <tjmercier@google.com> Acked-by: Shakeel Butt <shakeel.butt@linux.dev> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-10-12selftests: memcg: Don't close an uninitialized fdSasha Levin
test_memcg_inotify_delete_file() and test_memcg_inotify_delete_dir() jump to cleanup before the inotify fd is created when cg_name() or cg_create() fails, and cleanup then closes whatever fd holds: test_memcontrol.c:1685:6: warning: variable 'fd' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] Initialize fd to -1. Assisted-by: LLM Signed-off-by: Sasha Levin <sashal@kernel.org> Acked-by: Michal Koutný <mkoutny@suse.com> Reviewed-by: T.J. Mercier <tjmercier@google.com> Acked-by: Shakeel Butt <shakeel.butt@linux.dev> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-10-12cxl/mem: Configure dynamic capacity interruptsIra Weiny
Dynamic Capacity Devices (DCD) support extent change notifications through the event log mechanism. The interrupt mailbox commands were extended in CXL 3.1 to support these notifications. Firmware can't configure DCD events to be FW controlled but can retain control of memory events. Configure DCD event log interrupts on devices supporting dynamic capacity. Disable DCD if interrupts are not supported. The DCD event log is not drained here. cxl_event_drain_mask() reports only the logs the driver can service, and the DCD bit is added by the patch introducing DCD event handling. Until then a DCD interrupt wakes the event thread, which finds no log it owns and returns. Care is taken to preserve the interrupt policy set by the FW if FW first has been selected by the BIOS. Based on an original patch by Navneet Singh. Signed-off-by: Ira Weiny <iweiny@kernel.org> Co-developed-by: Anisa Su <anisa.su@samsung.com> Signed-off-by: Anisa Su <anisa.su@samsung.com> Tested-by: Wonjae Lee <wj28.lee@samsung.com> Tested-by: Junhee Park <jh9934.park@samsung.com> Tested-by: Heesoo Kim <habil.kim@samsung.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Link: https://patch.msgid.link/20261010225852.10727-7-anisa.su@samsung.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-10-12KVM: selftests: Support guest_memfd in-place conversionLisa Wang
With guest_memfd in-place conversion, the memory region can be set as shared, eliminating the need for dual-backed memory. By setting the region to shared initially, the KVM selftest framework can populate the mmap()-ed guest_memfd memory just like any standard memory provider. For CoCo VMs, pages that need to be private are explicitly set to private before executing the VM. Signed-off-by: Lisa Wang <wyihan@google.com> Link: https://patch.msgid.link/20261001-tdx-selftests-v15-13-7c62a5d8a992@google.com [sean: anchor comment to its relevant place, drop unnecessary code changes] Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-10-12selftests/filesystems: test OPEN_TREE_DROP_MNTNS_MOUNTSKir Kolyshkin
Pin a mount namespace below a tmpfs mount, the way snapd does under /run/snapd/ns, and attach a recursive clone of that tmpfs inside a younger mount namespace created with OPEN_TREE_NAMESPACE. Without OPEN_TREE_DROP_MNTNS_MOUNTS move_mount(2) fails with ELOOP; with it, it succeeds. Also check that the flag is rejected without OPEN_TREE_CLONE or OPEN_TREE_NAMESPACE, and accepted with the latter. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> Link: https://patch.msgid.link/20261006-nsfs-prune-rfc-v3-2-adb97ea52868@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12selftests/filesystems: Fix idmapped_tmpfile layer dir ownershipBjoern Doebel
The recent idmapped_tmpfile selftest creates a new directory in tmpfs owned by user ID 0. It then idmaps the mount as caller [0,10000) to disk [10000,20000). The original uid 0 owner does not exist in the mapped range. As a result, mapped_caller_creates_and_links fails at the O_TMPFILE open because inode_permission() rejects MAY_WRITE access: idmapped_tmpfile.c:145:mapped_caller_creates_and_links: Expected fd (-1) >= 0 (0) Chown the directory into the mapped range to satisfy the UID requirement. Fixes: d943e68edc5cb ("selftests/filesystems: test O_TMPFILE creation on idmapped mounts") Cc: stable@vger.kernel.org # 7.2+ Signed-off-by: Bjoern Doebel <doebel@amazon.de> Link: https://patch.msgid.link/20261001082411.1493072-1-doebel@amazon.de Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12selftests/namespaces: Wait for thread exit via pidfd in active-ref testsRicardo B. Marlière (SUSE)
pthread_join() returns once exit_mm() wakes the CLEARTID futex, but the exiting thread drops its namespace reference later, in exit_nsproxy_namespaces(). The joining thread can therefore still see the namespace as active, making the final open_by_handle_at() check in thread_ns_inactive_after_exit and thread_ns_fd_keeps_active fail intermittently. Have the thread open a PIDFD_THREAD pidfd on itself and poll it before pthread_join(). A pidfd becomes readable from exit_notify(), which runs after exit_nsproxy_namespaces(). Fixes: 29f083c49982 ("selftests/namespace: first threaded active reference count test") Fixes: ee861032381b ("selftests/namespace: second threaded active reference count test") Signed-off-by: Ricardo B. Marlière (SUSE) <ricardo@marliere.net> Link: https://patch.msgid.link/20261001-selftests-namespaces-nsid_race-v1-1-25f542cf0b9c@marliere.net Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12selftests: pid_namespace: test fork with dead ancestorSahaj Chaudhari
Add a regression test for fork() into a PID namespace whose parent namespace has lost its init process. Since the kernel cannot assign the new process a PID in that dead ancestor, fork() must fail with ENOMEM. Create the nested PID namespaces, keep the child namespace handle open after its init process exits, then enter it and verify fork() fails. Register the test with the PID namespace selftests and ignore its generated binary. Skip when namespace operations are denied or procfs cannot provide the pid_for_children handle. Signed-off-by: Sahaj Chaudhari <sahaj123.sc@gmail.com> Link: https://patch.msgid.link/20261007114914.1668934-1-sahaj123.sc@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12selftests/namespaces: add uid_map/gid_map range testsNatasha Klaus
Check that a uid_map or gid_map line with a value that does not fit in u32, or with a negative value, is rejected with EINVAL and installs nothing, for each of the three fields. Check that in-range lines are still accepted and read back unchanged: a plain single-id mapping, first id 0, the largest valid first id 4294967294, and a line with extra spaces between the fields. When run as root in the initial user namespace, also check that the largest count, "0 0 4294967295", is accepted when written by the parent into the uid_map of a child namespace; an unprivileged writer can only map a single id. Signed-off-by: Natasha Klaus <natalie.klaus@runtimeverification.com> Link: https://patch.msgid.link/20260930112854.373184-3-natalie.klaus@runtimeverification.com Acked-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12selftests/coredump: check the dumping thread's pidfdChristian Brauner
Crash from a non-leader thread and verify that the pidfd from SO_PEERPIDFD_THREAD on the coredump socket refers to that thread and reports the coredump like the thread-group leader's pidfd does. Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Signed-off-by: Andrew Halaney <andrew@amutable.com> Link: https://patch.msgid.link/20261005-work-unix-passpidfd-v4-10-350183b6e02a@amutable.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12selftests/net: SO_PEERPIDFD_THREADChristian Brauner
Add tests for SO_PEERPIDFD_THREAD. Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Signed-off-by: Andrew Halaney <andrew@amutable.com> Link: https://patch.msgid.link/20261005-work-unix-passpidfd-v4-8-350183b6e02a@amutable.com Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12selftests/net: SO_PASSPIDFD_THREADChristian Brauner
Extend the af_unix scm_pidfd selftest with SO_PASSPIDFD_THREAD tests. Co-developed-by: Andrew Halaney <andrew@amutable.com> Signed-off-by: Andrew Halaney <andrew@amutable.com> Link: https://patch.msgid.link/20261005-work-unix-passpidfd-v4-4-350183b6e02a@amutable.com Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12selftests/bpf: Test tracing_multi link with BTF ids of the same addressAlexei Starovoitov
The stub of a syscall without arguments is an alias of its __do_sys_ function. Find such pair where both have BTF ids. Which ones do depends on the compiler, so don't hard code the names. Check that each id can be attached and that the attach of both in one link fails with -EINVAL. With CONFIG_DEBUG_INFO_BTF_INLINE vmlinux BTF has 26 names with more than one BTF_KIND_FUNC: [117318] FUNC 'hash' type_id=76715 linkage=static [117319] FUNC 'hash' type_id=76722 linkage=static [117320] FUNC 'hash' type_id=76789 linkage=static while there is one 'hash' in kallsyms. tracing_multi_bench_attach skips the names that are not unique in kallsyms only and passes all three ids to the kernel. Take the first id of the name. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Leon Hwang <leon.hwang@linux.dev> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/bpf/20261011164836.2233874-3-alexei.starovoitov@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-10-12Merge branch 'for-linus' into for-nextTakashi Iwai
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-10-11nvdimm: ndtest: Return the string length from flags_show()Kees Cook
flags_show() build their output with a seq_buf and return seq_buf_used(), which may include the trailing NUL byte when the seq_buf has overflowed. Use seq_buf_strlen() instead. The flag names are far shorter than the PAGE_SIZE buffer sysfs provides, so this cannot overflow today. Build tested ARCH=x86_64 with GCC 16.2.0, built out of tree with make M=tools/testing/nvdimm: tools/testing/nvdimm/test/ndtest.o Assisted-by: LLM Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Alison Schofield <alison.schofield@intel.com> Link: https://patch.msgid.link/20261005155708.1471260-11-kees@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
2026-10-11selftests/nfsd: exercise the userspace-rpcbind listener_set flagJeff Layton
Cover the flag that moves rpcbind registration to the caller. rpcb_userspace_no_traffic is the one that matters. The errno says nothing about whether the kernel talked to rpcbind, but the stub counters do: a request that carries the flag must leave both at zero, which is what shows that svc_bind() and svc_register() were both skipped. The rest cover the reply and the ownership rule: - rpcb_userspace_reply. The ack flag, a non-empty program list, and the listener that came up. nfslocalio is hidden, so it must be absent. - rpcb_userspace_no_v4_udp. NFSv3 must be offered and must not carry no-udp; NFSv4 carries it, or the test skips where v4 is not built. - rpcb_userspace_nfsacl_follows_nfs. CONFIG_NFSD_V3_ACL is invisible to the test, so assert only that nfsacl v3 implies nfs v3. - rpcb_userspace_busy and rpcb_userspace_busy_reverse. Ownership cannot change under a live serv, in either direction. - rpcb_userspace_unflagged_teardown and its reverse. Teardown destroys the serv, so it is exempt from that rule in both directions. The follow-on listener_set is what proves the old serv went away rather than merely losing its listeners. - rpcb_userspace_portlist_busy. The legacy portlist add-fd write is refused against a flagged serv and still works against a kernel-owned one. nfsdfs is mounted in the test's netns, so the write cannot reach the host's nfsd. - rpcb_userspace_teardown. Create and destroy a flagged serv three times, then confirm that a kernel-owned serv still reaches rpcbind. An unbalanced rpcb_put_local() would break the last step. - rpcb_userspace_many_listeners. Forty listeners, which is more than GENLMSG_DEFAULT_SIZE would have held. A reply sized from that constant instead of from its contents returns -EMSGSIZE with every listener already up. genl_request_reply() grew an attribute argument, because listener_set now answers with a reply message rather than a bare ack. listener_set_rpcb() checks nlmsg_len against the recv() count before parsing. Forty listeners fit in its buffer, but a reply near NFSD_NL_LISTENER_MAX would not, and the parse loops trust nlmsg_len. Assisted-by: LLM Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260915-nfsd-norpcb-v3-5-3c60d49ade02@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-10-11selftests/bpf: Add a test verifying inline informationAlan Maguire
For bpf_testmod verify that we have inline info for an __always_inline'd function and it matches reasonable expectations (a single location parameter encoded in a register given that it cannot be compile-time optimized). Also verify that the offset of the LOCSEC descriptor makes sense, i.e. that it is in the range of the function where it was inlined. Because bpf_testmod is treated as an out-of-tree module, the inline information will be in btf_testmod.inline which is relocated using bpf_testmod.ko .BTF.base. Test is skipped if pahole does not encode inline info. Signed-off-by: Alan Maguire <alan.maguire@oracle.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261009112324.1442319-8-alan.maguire@oracle.com
2026-10-11selftests/bpf: Test BTF sysfs inline representationsAlan Maguire
Load vmlinux, vmlinux.inline and all module and module.inline entries in /sys/fs/btf; this will allow us to sanity-check - kernel and its inline representations - in-tree modules and their inline multi-split BTF representations - out-of-tree modules and the kernel relocation done for module and module inline BTF Since bpf_testmod.ko is built as an out-of-tree module, the combination of vmlinux, normal in-tree module BTF and out-of-tree testmod ensures we sanity check relocations for each case. Also test mmap for vmlinux.inline. Signed-off-by: Alan Maguire <alan.maguire@oracle.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261009112324.1442319-7-alan.maguire@oracle.com
2026-10-11resolve_btfids: Build separate main and inline BTF objectsEduard Zingerman
Extract .BTF.inline via the following logic: - Traverse all types reachable from LOC_PARAM, LOC_PROTO, LOCSEC entries and mark them as having LOC color. - Traverse all types reachable from the remaining types and mark them as having MAIN or SHARED. - Create a new base BTF object and copy all MAIN/SHARED types there. - Create a new .BTF.inline object with base set to the new base BTF object, and copy all LOC types there. This way .BTF.inline can refer to types and strings in the new base, and strings used only by .BTF.inline remain in it. Additionally, all BTF_KIND_FUNC types that map to ELF symbols with the same name are forced to be in the base BTF. Same for types referenced from BTF id sets. Regular types referenced only from .BTF.inline remain in the base BTF, and sizes are 5 and 9.5Mb for vmlinux and vmlinux.inline respectively. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Alan Maguire <alan.maguire@oracle.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261009112324.1442319-2-alan.maguire@oracle.com
2026-10-11selftests/bpf: Enable instruction array test for riscv64Chen Pei
As the riscv64 JIT now supports instruction array (gotox jump tables), enable the corresponding bpf selftest for riscv64. The guard is 64-bit only because the RV32 JIT does not implement gotox. Signed-off-by: Chen Pei <cp0613@linux.alibaba.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20260928071845.2432-5-cp0613@linux.alibaba.com
2026-10-11selftests/bpf: Enable gotox liveness test for riscv64Chen Pei
The riscv64 JIT now supports gotox, so enable the gotox liveness test in compute_live_registers.c on riscv64 as well. The guard is 64-bit only because the RV32 JIT does not implement gotox. Signed-off-by: Chen Pei <cp0613@linux.alibaba.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20260928071845.2432-4-cp0613@linux.alibaba.com
2026-10-11selftests/bpf: Enable gotox tests for riscv64Chen Pei
The riscv64 JIT now supports the gotox instruction and jump tables, so run the tests in verifier_gotox.c on riscv64 too, mirroring what was done for arm64 and powerpc. The guard is 64-bit only because the RV32 JIT does not implement gotox. Signed-off-by: Chen Pei <cp0613@linux.alibaba.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://patch.msgid.link/20260928071845.2432-3-cp0613@linux.alibaba.com
2026-10-11selftests/bpf: Update DENYLIST.riscv64Pu Lehui
Both probe_user and stacktrace_build_id fail on riscv64 due to riscv64's trap-based kprobe handling. For probe_user, kprobes on riscv64 are handled via traps where the entry path invokes irqentry_nmi_enter(). Because bpf_probe_write_user() rejects execution in NMI context, the test fails. Upstream discussions regarding NMI semantics on riscv are ongoing [0] and will be tracked. For stacktrace_build_id, under the kprobe trap context with interrupts disabled, bpf_get_stackid() obtains a valid build_id, but the queued irq_work is deferred. As a result, subsequent bpf_get_stack() fails to acquire mmap_read_trylock() and falls back to BPF_STACK_BUILD_ID_IP, causing an inconsistency between the two results. Since stacktrace_build_id is already included in the generic DENYLIST, only add probe_user to DENYLIST.riscv64. Signed-off-by: Pu Lehui <pulehui@huawei.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/linux-riscv/20230702025708.784106-1-guoren@kernel.org [0] Link: https://patch.msgid.link/20260930083522.1914145-5-pulehui@huaweicloud.com
2026-10-11selftests/bpf: Update qemu config for riscv64 in vmtest.shPu Lehui
When running vmtest.sh on riscv64, the kernel panic at boot due to an illegal instruction. This is because '-cpu rv64' only enables a baseline set of riscv extensions, whereas the kernel or toolchain requires newer extensions. Switch to '-cpu max' so qemu enables all supported extensions, and bump the required qemu version accordingly. Additionally, qemu's pmu emulation for riscv64 currently has issues, causing perf_event_open-related tests to fail. Temporarily disable the sscofpmf extension to bypass these failures for now, and will try to investigate and address it later. While at it, update the libbpf/ci branch in INDEX_URL from 'master' to 'main'. Signed-off-by: Pu Lehui <pulehui@huawei.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20260930083522.1914145-4-pulehui@huaweicloud.com
2026-10-11selftests/bpf: Avoid jiffies quantization error in setget_sockoptPu Lehui
The setget_sockopt selftest fails on kernels with HZ=250 (such as the default on riscv64), specifically in the TCP_BPF_DELACK_MAX and TCP_BPF_RTO_MIN sub-tests. The test sets a socket option value in microseconds via bpf_setsockopt() and immediately reads it back via bpf_getsockopt() to verify that it matches. However, the kernel converts the value to jiffies internally for storage and converts it back to microseconds upon retrieval. When HZ=250 (4000 us per jiffy), 30000 us cannot be divided evenly: usecs_to_jiffies(30000) -> 8 jiffies jiffies_to_usecs(8) -> 32000 us (!= 30000 us) This mismatch triggers an assertion failure. Change the test value from 30000 to 40000. 40000 us divides evenly across common kernel timer frequencies (HZ=100, HZ=250, and HZ=1000), avoiding quantization errors and making the test robust across different architectures. Signed-off-by: Pu Lehui <pulehui@huawei.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20260930083522.1914145-3-pulehui@huaweicloud.com
2026-10-11selftests/bpf: Enable callx related testcases for RV64Pu Lehui
Enable callx bpf selftests for RV64 now that the RV64 JIT supports indirect calls to subprogs. Signed-off-by: Pu Lehui <pulehui@huawei.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20260930064928.1909085-3-pulehui@huaweicloud.com
2026-10-11Merge branch kvm-arm64/rd-assignment-fixes into kvmarm-master/nextMarc Zyngier
* kvm-arm64/rd-assignment-fixes: : \ : Fixes for failed GICv3 RD assignment to vcpu rollback. : : Patches by Karl Mehltretter. : / KVM: arm64: selftests: Test VGICv3 redistributor region retry KVM: arm64: selftests: Pass guest code to vm_gic_create_with_vcpus() KVM: arm64: vgic-v3: Roll back assignments from the new region KVM: arm64: vgic-v3: Undo assignment on iodev registration failure Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-10-11Merge branch kvm-arm64/immutable-idregs-7.4 into kvmarm-master/nextMarc Zyngier
* kvm-arm64/immutable-idregs-7.4: : \ : Make ID registers immutable as soon as a vcpu has had a chance of : running, preventing userspace from altering them from under the guest's : feet. Patches courtesy of Mark Brown, selftest improvements by Fuad Tabba. : / KVM: arm64: selftests: Check ID regs are immutable after a failed run KVM: arm64: Block ID register changes after we rely on the values KVM: arm64: Finalize guest-wide sysregs prior to per-vCPU sysregs Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-10-11Merge branch kvm-arm64/misc-7.4 into kvmarm-master/nextMarc Zyngier
* kvm-arm64/misc-7.4: : \ : Misc KVM/arm64 fixes for 7.4: : : - Correctly report SMCCC_VERSION and SMCCC_ARCH_FEATURES as implemented : : - Don't register a page table dumper for pKVM VMs, as S2 is not : accessible when in protected mode : : - Drop PAGE_SIZE alignment requirement for hyp trace event sections : : - Tighten PMUv3 being disabled for the guest even if vcpus were created : with one. : : - Fix timer emulation when the HW doesn't support offsetting of the : counter. : / KVM: arm64: selftests: Test a timer set past the counter's wrap KVM: arm64: nv: Read a guest hypervisor's CNTV_CVAL_EL0 from memory on x1e KVM: arm64: timers: Compute an offset-applied CVAL from the current count KVM: arm64: Check ID_AA64DFR0_EL1.PMUVer in pmu_visibility() KVM: arm64: Handle ID_AA64DFR0_EL1.PMUVer == NI in __kvm_pmu_event_mask() KVM: arm64: Remove PAGE_SIZE alignment for hyp event ELF sections KVM: arm64: Disable stage-2 ptdump of pKVM KVM: arm64: selftests: Check the mandatory SMCCC_ARCH_FEATURES queries KVM: arm64: Report SMCCC_VERSION and SMCCC_ARCH_FEATURES as implemented Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-10-11Merge branch kvm-arm64/pre-faulting into kvmarm-master/nextMarc Zyngier
* kvm-arm64/pre-faulting: : \ : Enable stage-2 pre-faulting in the canonical IPA space, implementing the : KVM_PRE_FAULT_MEMORY API. Patches courtesy of Lorenzo Stoakes, and based : on an initial work by Jack Thomson. : / KVM: selftests: Add nested pre-fault test for arm64 KVM: selftests: Add option for different backing in pre-fault tests KVM: selftests: Enable pre_fault_memory_test for arm64 Documentation: KVM: document arm64 KVM_PRE_FAULT_MEMORY KVM: arm64: Implement KVM_PRE_FAULT_MEMORY KVM: arm64: Pass walk flags to kvm_pgtable_get_leaf() KVM: arm64: Propagate EHWPOISON in kvm_s2_fault_pin_pfn() KVM: arm64: Size the stage-2 memcache from the fault MMU KVM: arm64: Propagate and use kvm_s2_fault_result on S2 fault KVM: arm64: Propagate and use mmu in s2fd when handling guest aborts KVM: arm64: Propagate and use esr in s2fd when handling guest aborts KVM: arm64: Use ESR helpers in guest abort handling arm64: Add ESR fault helpers KVM: Allow architectures to disallow pre-fault Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-10-11Merge branch kvm-arm64/s2-rmap into kvmarm-master/nextMarc Zyngier
* kvm-arm64/s2-rmap: (31 commits) : \ : Add a per-shadow stage-2 reverse map tracking infrastructure, : considerably reducing the overhead of MMU notifiers when running L2 : guests. Also fixes issues with the shadow S2 MMU debugfs infrastrtcture. : : Patches courtesy of Wei-Lin Chang. : : This branch drags the kvmarm-fixes-7.3-1 tag, as this series depends : on some of the fixes. : / KVM: arm64: ptdump: Fix shadow ptdump sleep-in-atomic-context problem KVM: arm64: ptdump: Check the page tables aren't freed when accessing KVM: arm64: Refactor kvm_unmap_gfn_range() with common variables KVM: arm64: nv: Drop kvm_s2_mmu pointer from kvm_guest_s2_mapping KVM: arm64: nv: Avoid full shadow stage-2 unmap KVM: arm64: nv: Track guest stage-2 mapping removal KVM: arm64: nv: Track guest stage-2 mapping creation KVM: arm64: nv: Introduce guest stage-2 tracking structures KVM: arm64: Use a variable for the canonical IPA in kvm_s2_fault_map() KVM: arm64: Fix AArch32 DBGBXVR<n> handling KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP KVM: selftests: fix steal_time for arm64 with host page size > 4K KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction KVM: arm64: nv: Fix life cycle of the nested_mmus array KVM: arm64: Check every private mapping is hyp-owned at pKVM init KVM: arm64: Move the private VA allocation cursor to __io_map_next KVM: arm64: Match hyp text by physical address in fix_host_ownership() KVM: arm64: Transfer the hyp stack pages out of the host stage-2 KVM: arm64: selftests: Test empty SMCCC filter range at base 0 ... Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-10-11Merge branch kvm-arm64/gicv5-7.4 into kvmarm-master/nextMarc Zyngier
* kvm-arm64/gicv5-7.4: (52 commits) : \ : GICv5 IRS support, courtesy of Sascha Bischoff. From the cover letter: : : "This series builds on the initial vGICv5 support and adds support : for the GICv5 IRS, as described by the GICv5 (EAC0) specification. : With this, a GICv5 guest is no longer restricted to PPIs, and can make : use of SPIs and LPIs as well." : / KVM: arm64: vgic-v5: Correctly handle host ISTE __le32 conversion KVM: arm64: vgic-v5: Tidy-up programming of vpe descriptor address KVM: arm64: vgic-v5: Correctly reset h_lpi_ist to NULL KVM: arm64: vgic-v5: Drop __iomem attribute from {vmd,vpet}_base KVM: selftests: Add VGICv5 sparse vCPU IDs test KVM: selftests: Add VGICv5 IST save/restore coverage KVM: selftests: Add VGICv5 LPI delivery tests KVM: selftests: Add VGICv5 SPI injection tests KVM: selftests: Add VGICv5 CPU sysreg attribute tests KVM: selftests: Add VGICv5 USERSPACE_PPIS tests KVM: selftests: Add VGICv5 IST attribute tests KVM: selftests: Add VGICv5 IRS_REGS attribute tests KVM: selftests: Add VGICv5 NR_IRQS attribute tests KVM: selftests: Add VGICv5 IRS address attribute tests Documentation: KVM: Add the VGICv5 IRS save/restore sequences Documentation: KVM: Add docs for KVM_DEV_ARM_VGIC_GRP_IST Documentation: KVM: Add KVM_DEV_ARM_VGIC_GRP_IRS_REGS to VGICv5 docs Documentation: KVM: Document KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS for VGICv5 KVM: arm64: gic-v5: Implement save/restore mechanisms for ISTs KVM: arm64: gic-v5: Add VGICv5 IST save/restore UAPI ... Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-10-11Merge branch kvm-arm64/selftests-7.4 into kvmarm-master/nextMarc Zyngier
* kvm-arm64/selftests-7.4: : \ : Various fixes for selftests: : : - Render sea_to_user less braindead, though the utility of the test : itself is still debatable : : - Correctly skip testing FEAT_EASE when the feature isn't available : : - Check for consumption of a pended SError : / KVM: arm64: selftests: Check the pending SError state in external_aborts KVM: arm64: selftests: Skip sea_to_user when EINJ places no poison KVM: arm64: selftests: Skip sea_to_user without 1GB hugepages KVM: arm64: selftests: Fix EINJ handling in sea_to_user KVM: arm64: selftests: Fix VM leak in early return Signed-off-by: Marc Zyngier <maz@kernel.org>