summaryrefslogtreecommitdiff
path: root/tools/testing/selftests
AgeCommit message (Collapse)AuthorFilesLines
2026-03-12selftests/pidfd: add CLONE_PIDFD_AUTOKILL testsChristian Brauner1-0/+278
Add tests for CLONE_PIDFD_AUTOKILL: - autokill_basic: Verify closing the clone3 pidfd kills the child. - autokill_requires_pidfd: Verify AUTOKILL without CLONE_PIDFD fails. - autokill_requires_autoreap: Verify AUTOKILL without CLONE_AUTOREAP fails. - autokill_rejects_thread: Verify AUTOKILL with CLONE_THREAD fails. - autokill_pidfd_open_no_effect: Verify only the clone3 pidfd triggers autokill, not pidfd_open(). - autokill_requires_cap_sys_admin: Verify AUTOKILL without CLONE_NNP fails with -EPERM for an unprivileged caller. - autokill_without_nnp_with_cap: Verify AUTOKILL without CLONE_NNP succeeds with CAP_SYS_ADMIN. Link: https://patch.msgid.link/20260226-work-pidfs-autoreap-v5-6-d148b984a989@kernel.org Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-03-12selftests/pidfd: add CLONE_NNP testsChristian Brauner1-0/+126
Add tests for the new CLONE_NNP flag: - nnp_sets_no_new_privs: Verify a child created with CLONE_NNP has no_new_privs set while the parent does not. - nnp_rejects_thread: Verify CLONE_NNP | CLONE_THREAD is rejected with -EINVAL since threads share credentials. - autoreap_no_new_privs_unset: Verify a plain CLONE_AUTOREAP child does not get no_new_privs. Link: https://patch.msgid.link/20260226-work-pidfs-autoreap-v5-5-d148b984a989@kernel.org Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-03-12selftests/pidfd: add CLONE_AUTOREAP testsChristian Brauner3-1/+498
Add tests for the new CLONE_AUTOREAP clone3() flag: - autoreap_without_pidfd: CLONE_AUTOREAP without CLONE_PIDFD works (fire-and-forget) - autoreap_rejects_exit_signal: CLONE_AUTOREAP with non-zero exit_signal fails - autoreap_rejects_parent: CLONE_AUTOREAP with CLONE_PARENT fails - autoreap_rejects_thread: CLONE_AUTOREAP with CLONE_THREAD fails - autoreap_basic: child exits, pidfd poll works, PIDFD_GET_INFO returns correct exit code, waitpid() returns -ECHILD - autoreap_signaled: child killed by signal, exit info correct via pidfd - autoreap_reparent: autoreap grandchild reparented to subreaper still auto-reaps - autoreap_multithreaded: autoreap process with sub-threads auto-reaps after last thread exits - autoreap_no_inherit: grandchild forked without CLONE_AUTOREAP becomes a regular zombie Link: https://patch.msgid.link/20260226-work-pidfs-autoreap-v5-4-d148b984a989@kernel.org Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-03-12sched_ext: Fix incomplete help text usage stringsCheng-Yang Chou1-1/+1
Several demo schedulers and the selftest runner had usage strings that omitted options which are actually supported: - scx_central: add missing [-v] - scx_pair: add missing [-v] - scx_qmap: add missing [-S] and [-H] - scx_userland: add missing [-v] - scx_sdt: remove [-f] which no longer exists - runner.c: add missing [-s], [-l], [-q]; drop [-h] which none of the other sched_ext tools list in their usage lines Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-03-11selftests/bpf: Fix const qualifier warning in fexit_bpf2bpf.cVarun R Mallya1-1/+1
Building selftests with clang 23.0.0 (6fae863eba8a72cdd82f37e7111a46a70be525e0) triggers the following error: tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c:117:12: error: assigning to 'char *' from 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers] The variable `tgt_name` is declared as `char *`, but it stores the result of strstr(prog_name[i], "/"). Since `prog_name[i]` is a `const char *`, the returned pointer should also be treated as const-qualified. Update `tgt_name` to `const char *` to match the type of the underlying string and silence the compiler warning. Signed-off-by: Varun R Mallya <varunrmallya@gmail.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Acked-by: Menglong Dong <menglong.dong@linux.dev> Link: https://lore.kernel.org/bpf/20260305222132.470700-1-varunrmallya@gmail.com
2026-03-11selftests: kvm: add a test that VMX validates controls on RSMPaolo Bonzini2-0/+151
Add a test checking that invalid eVMCS contents are validated after an RSM instruction is emulated. The failure mode is simply that the RSM succeeds, because KVM virtualizes NMIs anyway while running L2; the two pin-based execution controls used by the test are entirely handled by KVM and not by the processor. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-03-11selftests: kvm: extract common functionality out of smm_test.cPaolo Bonzini3-25/+45
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-03-11KVM: selftests: Increase 'maxnode' for guest_memfd testsKai Huang1-1/+1
Increase 'maxnode' when using 'get_mempolicy' syscall in guest_memfd mmap and NUMA policy tests to fix a failure on one Intel GNR platform. On a CXL-capable platform, the memory affinity of CXL memory regions may not be covered by the SRAT. Since each CXL memory region is enumerated via a CFMWS table, at early boot the kernel parses all CFMWS tables to detect all CXL memory regions and assigns a 'faked' NUMA node for each of them, starting from the highest NUMA node ID enumerated via the SRAT. This increases the 'nr_node_ids'. E.g., on the aforementioned Intel GNR platform which has 4 NUMA nodes and 18 CFMWS tables, it increases to 22. This results in the 'get_mempolicy' syscall failure on that platform, because currently 'maxnode' is hard-coded to 8 but the 'get_mempolicy' syscall requires the 'maxnode' to be not smaller than the 'nr_node_ids'. Increase the 'maxnode' to the number of bits of 'nodemask', which is 'unsigned long', to fix this. This may not cover all systems. Perhaps a better way is to always set the 'nodemask' and 'maxnode' based on the actual maximum NUMA node ID on the system, but for now just do the simple way. Reported-by: Yi Lai <yi1.lai@intel.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221014 Closes: https://lore.kernel.org/all/bug-221014-28872@https.bugzilla.kernel.org%2F Signed-off-by: Kai Huang <kai.huang@intel.com> Reviewed-by: Yuan Yao <yaoyuan@linux.alibaba.com> Link: https://patch.msgid.link/20260302205158.178058-1-kai.huang@intel.com Signed-off-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-03-11selftests/bpf: Skip livepatch test when prerequisites are missingSun Jian1-2/+18
livepatch_trampoline relies on livepatch sysfs and livepatch-sample.ko. When CONFIG_LIVEPATCH is disabled or the samples module isn't built, the test fails with ENOENT and causes false failures in minimal CI configs. Skip the test when livepatch sysfs or the sample module is unavailable. Also avoid writing to livepatch sysfs when it's not present. Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/r/20260309104448.817401-1-sun.jian.kdev@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-11selftests/bpf: drop serial restrictionSun Jian1-2/+1
Patch 1/2 added PID filtering to the probe_user BPF program to avoid cross-test interference from the global connect() hooks. With the interference removed, drop the serial_ prefix and remove the stale TODO comment so the test can run in parallel. Tested: ./test_progs -t probe_user -v ./test_progs -j$(nproc) -t probe_user Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260306083330.518627-2-sun.jian.kdev@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-11selftests/bpf: filter by pid to avoid cross-test interferenceSun Jian2-3/+36
The test installs a kprobe on __sys_connect and checks that bpf_probe_write_user() can modify the syscall argument. However, any concurrent thread in any other test that calls connect() will also trigger the kprobe and have its sockaddr silently overwritten, causing flaky failures in unrelated tests. Constrain the hook to the current test process by filtering on a PID stored as a global variable in .bss. Initialize the .bss value from user space before bpf_object__load() using bpf_map__set_initial_value(), and validate the bss map value size to catch layout mismatches. No new map is introduced and the test keeps the existing non-skeleton flow. Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260306083330.518627-1-sun.jian.kdev@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-11selftests/bpf: Speed up module_attach testViktor Malik3-3/+9
The module_attach test contains subtests which check that unloading a module while there are BPF programs attached to its functions is not possible because the module is still referenced. The problem is that the test calls the generic unload_module() helper function which is used for module cleanup after test_progs terminate and tries to wait until all module references are released. This unnecessarily slows down the module_attach subtests since each unsuccessful call to unload_module() takes about 1 second. Introduce try_unload_module() which takes the number of retries as a parameter. Make unload_module() call it with the currently used amount of 10000 retries but call it with just 1 retry from module_attach tests as it is always expected to fail. This speeds up the module_attach() test significantly. Before: # time ./test_progs -t module_attach [...] Summary: 1/14 PASSED, 0 SKIPPED, 0 FAILED real 0m5.011s user 0m0.293s sys 0m0.108s After: # time ./test_progs -t module_attach [...] Summary: 1/14 PASSED, 0 SKIPPED, 0 FAILED real 0m0.350s user 0m0.197s sys 0m0.063s Signed-off-by: Viktor Malik <vmalik@redhat.com> Reviewed-by: Alan Maguire <alan.maguire@oracle.com> Tested-by: Alan Maguire <alan.maguire@oracle.com> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260306101628.3822284-1-vmalik@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-11selftests: vDSO: vdso_test_correctness: Add a test for time()Thomas Weißschuh1-0/+66
Extend the test to also cover the time() function. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/20260227-vdso-selftest-cleanups-v2-6-d84830fa8beb@linutronix.de
2026-03-11selftests: vDSO: vdso_test_correctness: Use facilities from parse_vdso.cThomas Weißschuh2-20/+14
The soname from the vDSO is not a public API. Furthermore it requires libc to implement dlsym() and friends. Use the facilities from parse_vdso.c instead which uses the official vDSO ABI to find it, aligned with the other vDSO selftests. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/20260227-vdso-selftest-cleanups-v2-5-d84830fa8beb@linutronix.de
2026-03-11selftests: vDSO: vdso_test_correctness: Handle different tv_usec typesThomas Weißschuh1-4/+4
On SPARC the field tv_usec of 'struct timespec' is not a 'long int', but only a regular int. In this case the format string is incorrect and will trigger compiler warnings. Avoid the warnings by casting to 'long long', similar to how it is done for the tv_sec and what the other similar selftests are doing. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Tested-by: Andreas Larsson <andreas@gaisler.com> Reviewed-by: Andreas Larsson <andreas@gaisler.com> Link: https://patch.msgid.link/20260227-vdso-selftest-cleanups-v2-4-d84830fa8beb@linutronix.de
2026-03-11selftests: vDSO: vdso_test_correctness: Drop SYS_getcpu fallbacksThomas Weißschuh1-8/+0
These fallbacks are only valid on x86 and unused in the first place. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/20260227-vdso-selftest-cleanups-v2-3-d84830fa8beb@linutronix.de
2026-03-11selftests: vDSO: vdso_test_gettimeofday: Remove nolibc checksThomas Weißschuh1-2/+0
nolibc now provides these headers, making the check unnecessary. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/20260227-vdso-selftest-cleanups-v2-2-d84830fa8beb@linutronix.de
2026-03-11Revert "selftests: vDSO: parse_vdso: Use UAPI headers instead of libc headers"Thomas Weißschuh2-4/+1
This reverts commit c9fbaa879508 ("selftests: vDSO: parse_vdso: Use UAPI headers instead of libc headers") The kernel headers were used to make parse_vdso.c compatible with nolibc. Unfortunately linux/elf.h is incompatible with glibc's sys/auxv.h. When using glibc it is therefore not possible build parse_vdso.c as part of the same compilation unit as its caller as sys/auxv.h is needed for getauxval(). In the meantime nolibc gained its own elf.h, providing compatibility with the documented libc interfaces. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/20260227-vdso-selftest-cleanups-v2-1-d84830fa8beb@linutronix.de
2026-03-11tracing: selftests: Add hypervisor trace remote testsVincent Donnefort5-0/+55
Run the trace remote selftests with the trace remote 'hypervisor', This trace remote is most likely created when the arm64 KVM nVHE/pKVM hypervisor is in use. Cc: Shuah Khan <skhan@linuxfoundation.org> Cc: linux-kselftest@vger.kernel.org Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Link: https://patch.msgid.link/20260309162516.2623589-31-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-11tools: ynl: add Python API for easier access to policiesJakub Kicinski1-3/+3
The format of Netlink policy dump is a bit curious with messages in the same dump carrying both attrs and mapping info. Plus each message carries a single piece of the puzzle the caller must then reassemble. I need to do this reassembly for a test, but I think it's generally useful. So let's add proper support to YnlFamily to return more user-friendly representation. See the various docs in the patch for more details. Link: https://patch.msgid.link/20260310005337.3594225-5-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-11selftests: drv-net: rss: Add retries to test_rss_key_indir to reduce flakesDimitri Daskalakis1-6/+23
The test generates 16 flows, and verifies that traffic is distributed across two queues via the NICs RSS indirection table. The likelihood of the flows skewing to a single queue is high, so we retry sending traffic up to 3 times. Alternatively, we could increase the number of generated flows. But debug kernels may struggle to ramp this many flows. During manual testing, the test passed for 10,000 consecutive runs. Signed-off-by: Dimitri Daskalakis <dimitri.daskalakis1@gmail.com> Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Link: https://patch.msgid.link/20260309204215.2110486-1-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-11selftests: rds: Fix tcpdump segfault in rds selftestsAllison Henderson1-10/+14
net/rds/test.py sees a segfault in tcpdump when executed through the ksft runner. [ 21.903713] tcpdump[1469]: segfault at 0 ip 000072100e99126d sp 00007ffccf740fd0 error 4 [ 21.903721] in libc.so.6[16a26d,7798b149a000+188000] [ 21.905074] in libc.so.6[16a26d,72100e84f000+188000] likely on CPU 5 (core 5, socket 0) [ 21.905084] Code: 00 0f 85 a0 00 00 00 48 83 c4 38 89 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 1f 44 00 00 48 8b 05 91 8b 09 00 8b 4d ac 64 89 08 <41> 0f b6 07 83 e8 2b a8 fd 0f 84 54 ff ff ff 49 8b 36 4c 89 ff e8 [ 21.906760] likely on CPU 9 (core 9, socket 0) [ 21.913469] Code: 00 0f 85 a0 00 00 00 48 83 c4 38 89 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 1f 44 00 00 48 8b 05 91 8b 09 00 8b 4d ac 64 89 08 <41> 0f b6 07 83 e8 2b a8 fd 0f 84 54 ff ff ff 49 8b 36 4c 89 ff e8 The os.fork() call creates extra complexity because it forks the entire process including the python interpreter. ip() then calls cmd() which creates a subprocess.Popen. We can avoid the extra layering by simply calling subprocess.Popen directly. Track the process handles directly and terminate them at cleanup rather than relying on killall. Further tcpdump's -Z flag attempts to change savefile ownership, which is not supported by the 9p protocol. Fix this by writing pcap captures to "/tmp" during the test and move them to the log directory after tcpdump exits. Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260308055835.1338257-4-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-11selftests: rds: Add ksft timeoutAllison Henderson3-2/+7
rds/run.sh sets a timer of 400s when calling test.py. However when tests are run through ksft, a default 45s timer is applied. Fix this by adding a ksft timeout in tools/testing/selftests/net/rds/settings Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260308055835.1338257-3-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-11selftests: rds: Fix pylint warningsAllison Henderson1-39/+45
Tidy up all exiting pylint errors in test.py. No functional changes are introduced in this patch Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260308055835.1338257-2-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-11selftests/bpf: Handle !CONFIG_SMC in bpf_smc.cAlan Maguire2-4/+30
Currently BPF selftests will fail to compile if CONFIG_SMC is not set. Use BPF CO-RE to work around the case where CONFIG_SMC is not set; use ___local variants of relevant structures and utilize bpf_core_field_exists() for net->smc. The test continues to pass where CONFIG_SMC=y CONFIG_SMC_HS_CTRL_BPF=y but these changes allow the selftests to build in the absence of CONFIG_SMC=y. Also ensure that we get a pure skip rather than a skip+fail by removing the SMC is unsupported part from the ASSERT_FALSE() in get_smc_nl_family(); doing this means we get a skip without a fail when CONFIG_SMC is not set: $ sudo ./test_progs -t bpf_smc Summary: 1/0 PASSED, 1 SKIPPED, 0 FAILED Fixes: beb3c67297d9 ("bpf/selftests: Add selftest for bpf_smc_hs_ctrl") Reported-by: Colm Harrington <colm.harrington@oracle.com> Signed-off-by: Alan Maguire <alan.maguire@oracle.com> Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org> Tested-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://patch.msgid.link/20260310111330.601765-1-alan.maguire@oracle.com
2026-03-10selftests/bpf: Fix pkg-config call on static buildsPaul Chaignon1-1/+1
For commit b0dcdcb9ae75 ("resolve_btfids: Fix linker flags detection"), I suggested setting HOSTPKG_CONFIG to $PKG_CONFIG when compiling resolve_btfids, but I forgot the quotes around that variable. As a result, when running vmtest.sh with static linking, it fails as follows: $ LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh [...] make: unrecognized option '--static' Usage: make [options] [target] ... [...] This worked when I tested it because HOSTPKG_CONFIG didn't have a default value in the resolve_btfids Makefile, but once it does, the quotes aren't preserved and it fails on the next make call. Fixes: b0dcdcb9ae75 ("resolve_btfids: Fix linker flags detection") Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> Acked-by: Mykyta Yatsenko <yatsenko@meta.com> Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/r/abADBwn_ykblpABE@mail.gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10selftests/bpf: Use bpf_core_enum_value for stats in cgroup_iter_memcgHui Zhu1-5/+12
Replace hardcoded enum values with bpf_core_enum_value() calls in cgroup_iter_memcg test to improve portability across different kernel versions. The change adds runtime enum value resolution for: - node_stat_item: NR_ANON_MAPPED, NR_SHMEM, NR_FILE_PAGES, NR_FILE_MAPPED - vm_event_item: PGFAULT This ensures the BPF program can adapt to enum value changes between kernel versions. Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Reviewed-by: JP Kobryn <jp.kobryn@linux.dev> Signed-off-by: Hui Zhu <zhuhui@kylinos.cn> Link: https://lore.kernel.org/r/ca6eb1a1a4fd7a17ffe995acf52c9a4ceb7bac13.1772505399.git.zhuhui@kylinos.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10selftests/bpf: Remove kmem subtest from cgroup_iter_memcgHui Zhu3-31/+0
When cgroup.memory=nokmem is set in the kernel command line, kmem accounting is disabled. This causes the test_kmem subtest in cgroup_iter_memcg to fail because it expects non-zero kmem values. Remove the kmem subtest altogether since the remaining subtests (shmem, file, pgfault) already provide sufficient coverage for the cgroup iter memcg functionality. Reviewed-by: JP Kobryn <jp.kobryn@linux.dev> Signed-off-by: Hui Zhu <zhuhui@kylinos.cn> Link: https://lore.kernel.org/r/35fa32a019361ec26265c8a789ee31e448d4dbda.1772505399.git.zhuhui@kylinos.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10selftests/bpf: tests to non_null ptr detection using register operand in JEQ/JNECupertino Miranda1-0/+54
This patch adds two tests to check non_null ptr detection when using JEQ and JNE have a register in second operand, and its value is known to be 0. Signed-off-by: Cupertino Miranda <cupertino.miranda@oracle.com> Cc: David Faust <david.faust@oracle.com> Cc: Jose Marchesi <jose.marchesi@oracle.com> Cc: Elena Zannoni <elena.zannoni@oracle.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260304195018.181396-4-cupertino.miranda@oracle.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10selftests/bpf: Add test for BPF_END register ID resetYazhou Tang1-0/+22
Add a test case to ensure that BPF_END operations correctly break register's scalar ID ties. The test creates a scenario where r1 is a copy of r0, r0 undergoes a byte swap, and then r0 is checked against a constant. - Without the fix in the verifier, the bounds learned from r0 are incorrectly propagated to r1, making the verifier believe r1 is bounded and wrongly allowing subsequent pointer arithmetic. - With the fix, r1 remains an unbounded scalar, and the verifier correctly rejects the arithmetic operation between the frame pointer and the unbounded register. Co-developed-by: Tianci Cao <ziye@zju.edu.cn> Signed-off-by: Tianci Cao <ziye@zju.edu.cn> Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260304083228.142016-3-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10vfio: selftests: fix crash in vfio_dma_mapping_mmio_testAlex Mastro1-1/+0
Remove the __iommu_unmap() call on a region that was never mapped. When __iommu_map() fails (expected for MMIO vaddrs in non-VFIO modes), the region is not added to the dma_regions list, leaving its list_head zero-initialized. If the unmap ioctl returns success, __iommu_unmap() calls list_del_init() on this zeroed node and crashes. This fixes the iommufd_compat_type1 and iommufd_compat_type1v2 test variants. Fixes: 080723f4d4c3 ("vfio: selftests: Add vfio_dma_mapping_mmio_test") Signed-off-by: Alex Mastro <amastro@fb.com> Reviewed-by: David Matlack <dmatlack@google.com> Reviewed-by: Yuan Yao <yaoyuan@linux.alibaba.com> Link: https://lore.kernel.org/r/20260303-fix-mmio-test-v1-1-78b4a9e46a4e@fb.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-03-10selftests/tc-testing: Adapt test's output to HFSC's iproute2 printing changesVictor Nogueira1-1/+1
To make the printing of HFSC's defcls consistent with HTB's, iproute2 is now printing defcls prepended with "0x". This commit adapts test a4c3 to this change. Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Victor Nogueira <victor@mojatatu.com> Link: https://patch.msgid.link/20260307220724.2501212-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-10selftests: fib_tests: fix link-local retrieval in fib6_nexthop()Alok Tiwari1-1/+1
fib6_nexthop() retrieves the link-local address for two interfaces used in the test. However, both lldummy and llv1 are obtained from dummy0. llv1 is expected to be retrieved from veth1, which is the interface used later in the test. The subsequent check and error message also expect the address to be retrieved from veth1. Fix this by retrieving llv1 from veth1. Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Link: https://patch.msgid.link/20260306180830.2329477-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-09tracing: selftests: Add trace remote testsVincent Donnefort6-0/+498
Exercise the tracefs interface for trace remote with a set of tests to check: * loading/unloading (unloading.tc) * reset (reset.tc) * size changes (buffer_size.tc) * consuming read (trace_pipe.tc) * non-consuming read (trace.tc) Cc: Shuah Khan <skhan@linuxfoundation.org> Cc: linux-kselftest@vger.kernel.org Link: https://patch.msgid.link/20260309162516.2623589-16-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-03-09selftests/bpf: Move sleepable refcounted_kptr tests to syscallsViktor Malik2-3/+3
Now that sleepable programs are always enabled on syscalls, let refcounted_kptr tests use syscalls rather than bpf_testmod_test_read, which is not sleepable with error injection disabled. The tests just check that the verifier can handle usage of RCU locks in sleepable programs and never actually attach. So, the attachment target doesn't matter (as long as it is sleepable) and with syscalls, the tests pass on kernels with disabled error injection. Signed-off-by: Viktor Malik <vmalik@redhat.com> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/8b6626eae384559855f7a0e846a16e83f25f06f6.1773055375.git.vmalik@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-09Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.0-rc3Alexei Starovoitov48-266/+1048
Cross-merge BPF and other fixes after downstream PR. No conflicts. Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-07Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds7-54/+224
Pull bpf fixes from Alexei Starovoitov: - Fix u32/s32 bounds when ranges cross min/max boundary (Eduard Zingerman) - Fix precision backtracking with linked registers (Eduard Zingerman) - Fix linker flags detection for resolve_btfids (Ihor Solodrai) - Fix race in update_ftrace_direct_add/del (Jiri Olsa) - Fix UAF in bpf_trampoline_link_cgroup_shim (Lang Xu) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: resolve_btfids: Fix linker flags detection selftests/bpf: add reproducer for spurious precision propagation through calls bpf: collect only live registers in linked regs Revert "selftests/bpf: Update reg_bound range refinement logic" selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary bpf: Fix u32/s32 bounds when ranges cross min/max boundary bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim ftrace: Add missing ftrace_lock to update_ftrace_direct_add/del
2026-03-07Merge tag 'rcu-fixes.v7.0-20260307a' of ↵Linus Torvalds17-18/+39
git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux Pull RCU selftest fixes from Boqun Feng: "Fix a regression in RCU torture test pre-defined scenarios caused by commit 7dadeaa6e851 ("sched: Further restrict the preemption modes") which limits PREEMPT_NONE to architectures that do not support preemption at all and PREEMPT_VOLUNTARY to those architectures that do not yet have PREEMPT_LAZY support. Since major architectures (e.g. x86 and arm64) no longer support CONFIG_PREEMPT_NONE and CONFIG_PREEMPT_VOLUNTARY, using them in rcutorture, rcuscale, refscale, and scftorture pre-defined scenarios causes config checking errors. Switch these kconfigs to PREEMPT_LAZY" * tag 'rcu-fixes.v7.0-20260307a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: scftorture: Update due to x86 not supporting none/voluntary preemption refscale: Update due to x86 not supporting none/voluntary preemption rcuscale: Update due to x86 not supporting none/voluntary preemption rcutorture: Update due to x86 not supporting none/voluntary preemption
2026-03-07resolve_btfids: Fix linker flags detectionIhor Solodrai1-0/+1
The "|| echo -lzstd" default makes zstd an unconditional link dependency of resolve_btfids. On systems where libzstd-dev is not installed and pkg-config fails, the linker fails: ld: cannot find -lzstd: No such file or directory libzstd is a transitive dependency of libelf, so the -lzstd flag is strictly necessary only for static builds [1]. Remove ZSTD_LIBS variable, and instead set LIBELF_LIBS depending on whether the build is static or not. Use $(HOSTPKG_CONFIG) as primary source of the flags list. Also add a default value for HOSTPKG_CONFIG in case it's not built via the toplevel Makefile. Pass it from selftests/bpf too. [1] https://lore.kernel.org/bpf/4ff82800-2daa-4b9f-95a9-6f512859ee70@linux.dev/ Reported-by: BPF CI Bot (Claude Opus 4.6) <bot+bpf-ci@kernel.org> Reported-by: Vitaly Chikunov <vt@altlinux.org> Closes: https://lore.kernel.org/bpf/aaWqMcK-2AQw5dx8@altlinux.org/ Fixes: 4021848a903e ("selftests/bpf: Pass through build flags to bpftool and resolve_btfids") Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Reviewed-by: Paul Chaignon <paul.chaignon@gmail.com> Link: https://lore.kernel.org/r/20260305014730.3123382-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-07selftests/bpf: add reproducer for spurious precision propagation through callsEduard Zingerman1-0/+64
Add a test for the scenario described in the previous commit: an iterator loop with two paths where one ties r2/r7 via shared scalar id and skips a call, while the other goes through the call. Precision marks from the linked registers get spuriously propagated to the call path via propagate_precision(), hitting "backtracking call unexpected regs" in backtrack_insn(). Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260306-linked-regs-and-propagate-precision-v1-2-18e859be570d@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-07bpf: collect only live registers in linked regsEduard Zingerman3-35/+63
Fix an inconsistency between func_states_equal() and collect_linked_regs(): - regsafe() uses check_ids() to verify that cached and current states have identical register id mapping. - func_states_equal() calls regsafe() only for registers computed as live by compute_live_registers(). - clean_live_states() is supposed to remove dead registers from cached states, but it can skip states belonging to an iterator-based loop. - collect_linked_regs() collects all registers sharing the same id, ignoring the marks computed by compute_live_registers(). Linked registers are stored in the state's jump history. - backtrack_insn() marks all linked registers for an instruction as precise whenever one of the linked registers is precise. The above might lead to a scenario: - There is an instruction I with register rY known to be dead at I. - Instruction I is reached via two paths: first A, then B. - On path A: - There is an id link between registers rX and rY. - Checkpoint C is created at I. - Linked register set {rX, rY} is saved to the jump history. - rX is marked as precise at I, causing both rX and rY to be marked precise at C. - On path B: - There is no id link between registers rX and rY, otherwise register states are sub-states of those in C. - Because rY is dead at I, check_ids() returns true. - Current state is considered equal to checkpoint C, propagate_precision() propagates spurious precision mark for register rY along the path B. - Depending on a program, this might hit verifier_bug() in the backtrack_insn(), e.g. if rY ∈ [r1..r5] and backtrack_insn() spots a function call. The reproducer program is in the next patch. This was hit by sched_ext scx_lavd scheduler code. Changes in tests: - verifier_scalar_ids.c selftests need modification to preserve some registers as live for __msg() checks. - exceptions_assert.c adjusted to match changes in the verifier log, R0 is dead after conditional instruction and thus does not get range. - precise.c adjusted to match changes in the verifier log, register r9 is dead after comparison and it's range is not important for test. Reported-by: Emil Tsalapatis <emil@etsalapatis.com> Fixes: 0fb3cf6110a5 ("bpf: use register liveness information for func_states_equal") Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260306-linked-regs-and-propagate-precision-v1-1-18e859be570d@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-07Merge tag 'arm64-fixes' of ↵Linus Torvalds1-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "The main changes are a fix to the way in which we manage the access flag setting for mappings using the contiguous bit and a fix for a hang on the kexec/hibernation path. Summary: - Fix kexec/hibernation hang due to bogus read-only mappings - Fix sparse warnings in our cmpxchg() implementation - Prevent runtime-const being used in modules, just like x86 - Fix broken elision of access flag modifications for contiguous entries on systems without support for hardware updates - Fix a broken SVE selftest that was testing the wrong instruction" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: selftest/arm64: Fix sve2p1_sigill() to hwcap test arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults arm64: make runtime const not usable by modules arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation arm64: Silence sparse warnings caused by the type casting in (cmp)xchg
2026-03-07selftests: net: make ovs-dpctl.py fail when pyroute2 is unsupportedAleksei Oladko1-1/+1
The pmtu.sh kselftest configures OVS using ovs-dpctl.py and falls back to ovs-vsctl only when ovs-dpctl.py fails. However, ovs-dpctl.py exits with a success status when the installed pyroute2 package version is lower than 0.6, even though the OVS datapath is not configured. As a result, pmtu.sh assumes that the setup was successful and continues running the test, which later fails due to the missing OVS configuration. Fix the exit code handling in ovs-dpctl.py so that pmtu.sh can detect that the setup did not complete successfully and fall back to ovs-vsctl. Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Link: https://patch.msgid.link/20260306000127.519064-3-aleksey.oladko@virtuozzo.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-07Revert "selftests/bpf: Update reg_bound range refinement logic"Eduard Zingerman1-14/+0
This reverts commit da653de268d32a80e135c9eb960a8147c186f1bc. Removed logic is now covered by range_refine_in_halves() which handles both 32-bit and 64-bit refinements. Suggested-by: Paul Chaignon <paul.chaignon@gmail.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260306-bpf-32-bit-range-overflow-v3-3-f7f67e060a6b@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-07selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundaryEduard Zingerman1-1/+38
Two test cases for signed/unsigned 32-bit bounds refinement when s32 range crosses the sign boundary: - s32 range [S32_MIN..1] overlapping with u32 range [3..U32_MAX], s32 range tail before sign boundary overlaps with u32 range. - s32 range [-3..5] overlapping with u32 range [0..S32_MIN+3], s32 range head after the sign boundary overlaps with u32 range. This covers both branches added in the __reg32_deduce_bounds(). Also, crossing_32_bit_signed_boundary_2() no longer triggers invariant violations. Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Reviewed-by: Paul Chaignon <paul.chaignon@gmail.com> Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260306-bpf-32-bit-range-overflow-v3-2-f7f67e060a6b@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-07bpf: Fix u32/s32 bounds when ranges cross min/max boundaryEduard Zingerman1-4/+58
Same as in __reg64_deduce_bounds(), refine s32/u32 ranges in __reg32_deduce_bounds() in the following situations: - s32 range crosses U32_MAX/0 boundary, positive part of the s32 range overlaps with u32 range: 0 U32_MAX | [xxxxxxxxxxxxxx u32 range xxxxxxxxxxxxxx] | |----------------------------|----------------------------| |xxxxx s32 range xxxxxxxxx] [xxxxxxx| 0 S32_MAX S32_MIN -1 - s32 range crosses U32_MAX/0 boundary, negative part of the s32 range overlaps with u32 range: 0 U32_MAX | [xxxxxxxxxxxxxx u32 range xxxxxxxxxxxxxx] | |----------------------------|----------------------------| |xxxxxxxxx] [xxxxxxxxxxxx s32 range | 0 S32_MAX S32_MIN -1 - No refinement if ranges overlap in two intervals. This helps for e.g. consider the following program: call %[bpf_get_prandom_u32]; w0 &= 0xffffffff; if w0 < 0x3 goto 1f; // on fall-through u32 range [3..U32_MAX] if w0 s> 0x1 goto 1f; // on fall-through s32 range [S32_MIN..1] if w0 s< 0x0 goto 1f; // range can be narrowed to [S32_MIN..-1] r10 = 0; 1: ...; The reg_bounds.c selftest is updated to incorporate identical logic, refinement based on non-overflowing range halves: ((x ∩ [0, smax]) ∩ (y ∩ [0, smax])) ∪ ((x ∩ [smin,-1]) ∩ (y ∩ [smin,-1])) Reported-by: Andrea Righi <arighi@nvidia.com> Reported-by: Emil Tsalapatis <emil@etsalapatis.com> Closes: https://lore.kernel.org/bpf/aakqucg4vcujVwif@gpd4/T/ Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260306-bpf-32-bit-range-overflow-v3-1-f7f67e060a6b@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-07selftests: net: forwarding: fix IPv6 address leak in cleanupAleksei Oladko4-4/+4
Several forwarding tests (e.g., gre_multipath.sh) initialize both IPv4 and IPv6 addresses using simple_if_init, but only clean up IPv4 in simple_if_fini. This leaves stale IPv6 addresses on the interfaces, which causes subsequent tests to fail when they encounter unexpected address configuration. The issue can be reproduced by running tests in sequence: # run_kselftest.sh -t net/forwarding:ipip_hier_gre.sh # run_kselftest.sh -t net/forwarding:min_max_mtu.sh TAP version 13 1..1 # timeout set to 0 # selftests: net/forwarding: min_max_mtu.sh # TEST: ping [ OK ] # TEST: ping6 [ OK ] # TEST: Test maximum MTU configuration [ OK ] # TEST: Test traffic, packet size is maximum MTU [FAIL] # Ping6, packet size: 65487 succeeded, but should have failed # TEST: Test minimum MTU configuration [ OK ] # TEST: Test traffic, packet size is minimum MTU [ OK ] not ok 1 selftests: net/forwarding: min_max_mtu.sh # exit=1 Fix this by removing the unused IPv6 argument from simple_if_init in tests that don't use IPv6 (gre_multipath.sh, ipip_lib.sh), and by adding the missing IPv6 argument to simple_if_fini in tests that use IPv6 (gre_multipath_nh.sh, gre_multipath_nh_res.sh). Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260305211000.515301-1-aleksey.oladko@virtuozzo.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-07selftests: drv-net: iou-zcrx: wait for memory cleanup of probe runDragos Tatulea1-0/+1
The large chunks test does a probe run of iou-zcrx before it runs the actual test. After the probe run finishes, the context will still exist until the deferred io_uring teardown. When running iou-zcrx the second time, io_uring_register_ifq() can return -EEXIST due to the existence of the old context. The fix is simple: wait for the context teardown using the new mp_clear_wait() utility before running the second instance of iou-zcrx. Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com> Link: https://patch.msgid.link/20260305080446.897628-2-dtatulea@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-07selftests/net: Add netkit container ping testDavid Wei3-0/+33
Add a basic ping test using NetDrvContEnv that sets up a netkit pair, with one end in a netns. Use LOCAL_PREFIX_V6 and nk_forward BPF program to ping from a remote host to the netkit in netns. Signed-off-by: David Wei <dw@davidwei.uk> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://patch.msgid.link/20260305181803.2912736-5-dw@davidwei.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-07selftests/net: Add env for container based testsDavid Wei4-6/+253
Add an env NetDrvContEnv for container based selftests. This automates the setup of a netns, netkit pair with one inside the netns, and a BPF program that forwards skbs from the NETIF host inside the container. Currently only netkit is used, but other virtual netdevs e.g. veth can be used too. Expect netkit container datapath selftests to have a publicly routable IP prefix to assign to netkit in a container, such that packets will land on eth0. The BPF skb forward program will then forward such packets from the host netns to the container netns. Signed-off-by: David Wei <dw@davidwei.uk> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://patch.msgid.link/20260305181803.2912736-4-dw@davidwei.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.39.0) at 2026-05-13 14:24:30 +0300