[PATCH v4 15/15] KVM: selftests: test userfaultfd missing for guest_memfd

Mike Rapoport
2026-04-02T04:13:52Z

From: Nikita Kalyazin <kalyazin@amazon.com>

The test demonstrates that a missing userfaultfd event in guest_memfd can
be resolved via a UFFDIO_COPY ioctl.

Signed-off-by: Nikita Kalyazin <kalyazin@amazon.com>
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
.../testing/selftests/kvm/guest_memfd_test.c | 80 ++++++++++++++++++-
1 file changed, 79 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/kvm/guest_memfd_test.c b/tools/testing/selftests/kvm/guest_memfd_test.c
index 29f8d686c09f..eb29ee5d2991 100644
--- a/tools/testing/selftests/kvm/guest_memfd_test.c
+++ b/tools/testing/selftests/kvm/guest_memfd_test.c
@@ -439,6 +439,82 @@ static void test_uffd_minor(int fd, size_t total_size)
close(uffd);
}

+static void test_uffd_missing(int fd, size_t total_size)
+{
+ struct uffdio_register uffd_reg;
+ struct uffdio_copy uffd_copy;
+ struct uffd_msg msg;
+ struct fault_args args;
+ pthread_t fault_thread;
+ void *mem, *buf = NULL;
+ int uffd, ret;
+ off_t offset = page_size;
+ void *fault_addr;
+ const char test_val = 0xab;
+
+ ret = posix_memalign(&buf, page_size, total_size);
+ TEST_ASSERT_EQ(ret, 0);
+ memset(buf, test_val, total_size);
+
+ uffd = syscall(__NR_userfaultfd, O_CLOEXEC);
+ TEST_ASSERT(uffd != -1, "userfaultfd creation should succeed");
+
+ struct uffdio_api uffdio_api = {
+ .api = UFFD_API,
+ .features = 0,
+ };
+ ret = ioctl(uffd, UFFDIO_API, &uffdio_api);
+ TEST_ASSERT(ret != -1, "ioctl(UFFDIO_API) should succeed");
+
+ mem = mmap(NULL, total_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
+ TEST_ASSERT(mem != MAP_FAILED, "mmap should succeed");
+
+ uffd_reg.range.start = (unsigned long)mem;
+ uffd_reg.range.len = total_size;
+ uffd_reg.mode = UFFDIO_REGISTER_MODE_MISSING;
+ ret = ioctl(uffd, UFFDIO_REGISTER, &uffd_reg);
+ TEST_ASSERT(ret != -1, "ioctl(UFFDIO_REGISTER) should succeed");
+
+ fault_addr = mem + offset;
+ args.addr = fault_addr;
+
+ ret = pthread_create(&fault_thread, NULL, fault_thread_fn, &args);
+ TEST_ASSERT(ret == 0, "pthread_create should succeed");
+
+ ret = read(uffd, &msg, sizeof(msg));
+ TEST_ASSERT(ret != -1, "read from userfaultfd should succeed");
+ TEST_ASSERT(msg.event == UFFD_EVENT_PAGEFAULT, "event type should be pagefault");
+ TEST_ASSERT((void *)(msg.arg.pagefault.address & ~(page_size - 1)) == fault_addr,
+ "pagefault should occur at expected address");
+ TEST_ASSERT(!(msg.arg.pagefault.flags & UFFD_PAGEFAULT_FLAG_WP),
+ "pagefault should not be write-protect");
+
+ uffd_copy.dst = (unsigned long)fault_addr;
+ uffd_copy.src = (unsigned long)(buf + offset);
+ uffd_copy.len = page_size;
+ uffd_copy.mode = 0;
+ ret = ioctl(uffd, UFFDIO_COPY, &uffd_copy);
+ TEST_ASSERT(ret != -1, "ioctl(UFFDIO_COPY) should succeed");
+
+ /* Wait for the faulting thread to complete - this provides the memory barrier */
+ ret = pthread_join(fault_thread, NULL);
+ TEST_ASSERT(ret == 0, "pthread_join should succeed");
+
+ /*
+ * Now it's safe to check args.value - the thread has completed
+ * and memory is synchronized
+ */
+ TEST_ASSERT(args.value == test_val,
+ "memory should contain the value that was copied");
+ TEST_ASSERT(*(char *)(mem + offset) == test_val,
+ "no further fault is expected");
+
+ ret = munmap(mem, total_size);
+ TEST_ASSERT(!ret, "munmap should succeed");
+ free(buf);
+ close(uffd);
+}
+
static void test_guest_memfd_flags(struct kvm_vm *vm)
{
uint64_t valid_flags = vm_check_cap(vm, KVM_CAP_GUEST_MEMFD_FLAGS);
@@ -494,8 +570,10 @@ static void __test_guest_memfd(struct kvm_vm *vm, uint64_t flags)
gmem_test(fallocate, vm, flags);
gmem_test(invalid_punch_hole, vm, flags);

- if (flags & GUEST_MEMFD_FLAG_INIT_SHARED)
+ if (flags & GUEST_MEMFD_FLAG_INIT_SHARED) {
gmem_test(uffd_minor, vm, flags);
+ gmem_test(uffd_missing, vm, flags);
+ }
}

static void test_guest_memfd(unsigned long vm_type)
--
2.53.0