| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/09/14 07:42 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch series only modifies KVM self-tests in tools/testing/selftests/kvm/ (specifically arm64 guest support and testing). These user-space test files do not modify the compiled kernel image (vmlinux) or any kernel modules, making them non-kernel changes that do not warrant kernel fuzzing.",
"WorthFuzzing": false
} |
| 1/1 | 2026/09/14 07:42 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit ba26a28fe93ffb9891222f163635d960b9799c7f\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Mon Sep 14 07:42:56 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selftests/kvm/Makefile.kvm\nindex 96bab7002d39e..1e9d059ffb24a 100644\n--- a/tools/testing/selftests/kvm/Makefile.kvm\n+++ b/tools/testing/selftests/kvm/Makefile.kvm\n@@ -179,6 +179,7 @@ TEST_GEN_PROGS_arm64 += arm64/hello_el2\n TEST_GEN_PROGS_arm64 += arm64/host_sve\n TEST_GEN_PROGS_arm64 += arm64/hypercalls\n TEST_GEN_PROGS_arm64 += arm64/external_aborts\n+TEST_GEN_PROGS_arm64 += arm64/lpa_test\n TEST_GEN_PROGS_arm64 += arm64/mmio_sign_ext\n TEST_GEN_PROGS_arm64 += arm64/page_fault_test\n TEST_GEN_PROGS_arm64 += arm64/psci_test\ndiff --git a/tools/testing/selftests/kvm/arm64/lpa_test.c b/tools/testing/selftests/kvm/arm64/lpa_test.c\nnew file mode 100644\nindex 0000000000000..8fe6f254db282\n--- /dev/null\n+++ b/tools/testing/selftests/kvm/arm64/lpa_test.c\n@@ -0,0 +1,124 @@\n+// SPDX-License-Identifier: GPL-2.0-only\n+/*\n+ * Higher virtual addresses read/write test\n+ */\n+#include \u003ctest_util.h\u003e\n+\n+#include \"kvm_syscalls.h\"\n+#include \"kvm_util.h\"\n+#include \"ucall_common.h\"\n+#include \"guest_modes.h\"\n+#include \"processor.h\"\n+\n+#define LOW_GVA\t\t0xc0000000\n+#define HIGH_GVA (LOW_GVA | BIT(48))\n+\n+static void guest_code(void)\n+{\n+\tu64 *low = (u64 *)LOW_GVA;\n+\tu64 *high = (u64 *)HIGH_GVA;\n+\n+\tWRITE_ONCE(*low, 1);\n+\tGUEST_ASSERT_EQ(READ_ONCE(*high), 1);\n+\tWRITE_ONCE(*high, 2);\n+\tGUEST_ASSERT_EQ(READ_ONCE(*low), 2);\n+\n+\tGUEST_SYNC(0);\n+\n+\tasm volatile(\"dsb sy\\n\\t\"\n+\t\t \"tlbi vmalle1is\\n\\t\"\n+\t\t \"dsb sy\\n\\t\"\n+\t\t \"isb\"\n+\t\t : : : \"memory\");\n+\n+\tGUEST_SYNC(1); /* Host installs HIGH_GVA -\u003e gpa_b. */\n+\n+\tasm volatile(\"dsb sy\\n\\t\"\n+\t\t \"isb\\n\\t\"\n+\t\t : : : \"memory\");\n+\n+\t/* low and high map to different GPAs. */\n+\tWRITE_ONCE(*low, 1);\n+\tWRITE_ONCE(*high, 2);\n+\n+\t/* Check both after both writes to detect accidental aliasing. */\n+\tGUEST_ASSERT_EQ(READ_ONCE(*low), 1);\n+\tGUEST_ASSERT_EQ(READ_ONCE(*high), 2);\n+\n+\t/* Updating the low mapping must not change the high mapping. */\n+\tWRITE_ONCE(*low, 3);\n+\n+\tGUEST_ASSERT_EQ(READ_ONCE(*low), 3);\n+\tGUEST_ASSERT_EQ(READ_ONCE(*high), 2);\n+\n+\tGUEST_DONE();\n+}\n+\n+static void run_test(enum vm_guest_mode mode, void *arg)\n+{\n+\tunsigned int *nr_tests = arg;\n+\tstruct kvm_vcpu_init init;\n+\tstruct kvm_vm *vm;\n+\tstruct kvm_vcpu *vcpu;\n+\tstruct ucall uc;\n+\n+\tif (mode != VM_MODE_P52V52_4K \u0026\u0026\n+\t mode != VM_MODE_P52V52_16K \u0026\u0026\n+\t mode != VM_MODE_P52V52_64K)\n+\t\treturn;\n+\n+\tvm = __vm_create(VM_SHAPE(mode), 1, 0);\n+\tkvm_get_default_vcpu_target(vm, \u0026init);\n+\tvcpu = aarch64_vcpu_add(vm, 0, \u0026init, guest_code);\n+\tkvm_arch_vm_finalize_vcpus(vm);\n+\n+\tvm_init_descriptor_tables(vm);\n+\tvcpu_init_descriptor_tables(vcpu);\n+\n+\tu64 gpa_a = vm_phy_pages_alloc(vm, 1, 0, 0);\n+\tu64 gpa_b = vm_phy_pages_alloc(vm, 1, 0, 0);\n+\n+\tvirt_pg_map(vm, LOW_GVA, gpa_a);\n+\tvirt_pg_map(vm, HIGH_GVA, gpa_a);\n+\n+\tfor (;;) {\n+\t\tvcpu_run(vcpu);\n+\t\tswitch (get_ucall(vcpu, \u0026uc)) {\n+\t\tcase UCALL_DONE:\n+\t\t\tgoto done;\n+\t\tcase UCALL_ABORT:\n+\t\t\tREPORT_GUEST_ASSERT(uc);\n+\t\t\tbreak;\n+\t\tcase UCALL_SYNC:\n+\t\t\tswitch (uc.args[1]) {\n+\t\t\tcase 0:\n+\t\t\t\tWRITE_ONCE(*virt_get_pte_hva(vm, HIGH_GVA), 0);\n+\t\t\t\tbreak;\n+\t\t\tcase 1:\n+\t\t\t\tvirt_pg_map(vm, HIGH_GVA, gpa_b);\n+\t\t\t\tbreak;\n+\t\t\tdefault:\n+\t\t\t\tTEST_FAIL(\"Unexpected sync stage: %lu\\n\", uc.args[1]);\n+\t\t\t}\n+\t\t\t/* Complete the host's PTE store before resuming the guest. */\n+\t\t\tasm volatile(\"dsb sy\" : : : \"memory\");\n+\t\t\tbreak;\n+\t\tdefault:\n+\t\t\tTEST_FAIL(\"Unhandled ucall: %ld\\n\", uc.cmd);\n+\t\t}\n+\t}\n+\n+done:\n+\tkvm_vm_free(vm);\n+\t(*nr_tests)++;\n+}\n+\n+int main(int argc, char **argv)\n+{\n+\tunsigned int nr_tests = 0;\n+\n+\tfor_each_guest_mode(run_test, \u0026nr_tests);\n+\tif (!nr_tests)\n+\t\tksft_exit_skip(\"No supported 52-bit VA guest mode; skipping test\\n\");\n+\treturn 0;\n+}\ndiff --git a/tools/testing/selftests/kvm/include/arm64/processor.h b/tools/testing/selftests/kvm/include/arm64/processor.h\nindex b8a902ba8573d..4ab00a7e6efb5 100644\n--- a/tools/testing/selftests/kvm/include/arm64/processor.h\n+++ b/tools/testing/selftests/kvm/include/arm64/processor.h\n@@ -113,6 +113,7 @@\n \n #define PTE_VALID\t\tBIT(0)\n #define PGD_TYPE_TABLE\t\tBIT(1)\n+#define P4D_TYPE_TABLE\t\tBIT(1)\n #define PUD_TYPE_TABLE\t\tBIT(1)\n #define PMD_TYPE_TABLE\t\tBIT(1)\n #define PTE_TYPE_PAGE\t\tBIT(1)\n@@ -168,7 +169,7 @@ enum {\n \t\t\t (v) == VECTOR_SYNC_LOWER_32)\n \n void aarch64_get_supported_page_sizes(u32 ipa, u32 *ipa4k,\n-\t\t\t\t u32 *ipa16k, u32 *ipa64k);\n+\t\t\t\t u32 *ipa16k, u32 *ipa64k, u32 *va64k);\n \n void vm_init_descriptor_tables(struct kvm_vm *vm);\n void vcpu_init_descriptor_tables(struct kvm_vcpu *vcpu);\ndiff --git a/tools/testing/selftests/kvm/include/kvm_util.h b/tools/testing/selftests/kvm/include/kvm_util.h\nindex 5a7a455b53875..1c268fa994aa9 100644\n--- a/tools/testing/selftests/kvm/include/kvm_util.h\n+++ b/tools/testing/selftests/kvm/include/kvm_util.h\n@@ -184,6 +184,9 @@ enum vm_guest_mode {\n \tVM_MODE_P52V48_4K,\n \tVM_MODE_P52V48_16K,\n \tVM_MODE_P52V48_64K,\n+\tVM_MODE_P52V52_4K,\n+\tVM_MODE_P52V52_16K,\n+\tVM_MODE_P52V52_64K,\n \tVM_MODE_P48V48_4K,\n \tVM_MODE_P48V48_16K,\n \tVM_MODE_P48V48_64K,\ndiff --git a/tools/testing/selftests/kvm/lib/arm64/processor.c b/tools/testing/selftests/kvm/lib/arm64/processor.c\nindex 01325bf4d36fc..9915f25f02874 100644\n--- a/tools/testing/selftests/kvm/lib/arm64/processor.c\n+++ b/tools/testing/selftests/kvm/lib/arm64/processor.c\n@@ -29,13 +29,25 @@ static u64 pgd_index(struct kvm_vm *vm, gva_t gva)\n \treturn (gva \u003e\u003e shift) \u0026 mask;\n }\n \n+static u64 p4d_index(struct kvm_vm *vm, gva_t gva)\n+{\n+\tunsigned int shift = 3 * (vm-\u003epage_shift - 3) + vm-\u003epage_shift;\n+\tu64 mask = (1UL \u003c\u003c (vm-\u003epage_shift - 3)) - 1;\n+\n+\tTEST_ASSERT(vm-\u003emmu.pgtable_levels == 5,\n+\t\t \"Mode %d does not have 5 page table levels\", vm-\u003emode);\n+\n+\treturn (gva \u003e\u003e shift) \u0026 mask;\n+}\n+\n static u64 pud_index(struct kvm_vm *vm, gva_t gva)\n {\n \tunsigned int shift = 2 * (vm-\u003epage_shift - 3) + vm-\u003epage_shift;\n \tu64 mask = (1UL \u003c\u003c (vm-\u003epage_shift - 3)) - 1;\n \n-\tTEST_ASSERT(vm-\u003emmu.pgtable_levels == 4,\n-\t\t\"Mode %d does not have 4 page table levels\", vm-\u003emode);\n+\tTEST_ASSERT(vm-\u003emmu.pgtable_levels \u003e= 4,\n+\t\t \"Mode %d does not have \u003e= 4 page table levels\",\n+\t\t vm-\u003emode);\n \n \treturn (gva \u003e\u003e shift) \u0026 mask;\n }\n@@ -147,6 +159,12 @@ static void _virt_pg_map(struct kvm_vm *vm, gva_t gva, gpa_t gpa,\n \t\t\t\t PGD_TYPE_TABLE | PTE_VALID);\n \n \tswitch (vm-\u003emmu.pgtable_levels) {\n+\tcase 5:\n+\t\tptep = addr_gpa2hva(vm, pte_addr(vm, *ptep)) + p4d_index(vm, gva) * 8;\n+\t\tif (!*ptep)\n+\t\t\t*ptep = addr_pte(vm, vm_alloc_page_table(vm),\n+\t\t\t\t\t P4D_TYPE_TABLE | PTE_VALID);\n+\t\t/* fall through */\n \tcase 4:\n \t\tptep = addr_gpa2hva(vm, pte_addr(vm, *ptep)) + pud_index(vm, gva) * 8;\n \t\tif (!*ptep)\n@@ -163,7 +181,7 @@ static void _virt_pg_map(struct kvm_vm *vm, gva_t gva, gpa_t gpa,\n \t\tptep = addr_gpa2hva(vm, pte_addr(vm, *ptep)) + pte_index(vm, gva) * 8;\n \t\tbreak;\n \tdefault:\n-\t\tTEST_FAIL(\"Page table levels must be 2, 3, or 4\");\n+\t\tTEST_FAIL(\"Page table levels must be 2, 3, 4, or 5\");\n \t}\n \n \tpg_attr = PTE_AF | PTE_ATTRINDX(attr_idx) | PTE_TYPE_PAGE | PTE_VALID;\n@@ -182,18 +200,35 @@ void virt_arch_pg_map(struct kvm_vm *vm, gva_t gva, gpa_t gpa)\n \n u64 *virt_get_pte_hva_at_level(struct kvm_vm *vm, gva_t gva, int level)\n {\n+\tint start_level = 4 - vm-\u003emmu.pgtable_levels;\n \tu64 *ptep;\n \n+\tTEST_ASSERT(level \u003e= start_level \u0026\u0026 level \u003c= 3,\n+\t\t \"Invalid translation level %d, valid range is %d-3\",\n+\t\t level, start_level);\n+\n \tif (!vm-\u003emmu.pgd_created)\n \t\tgoto unmapped_gva;\n \n \tptep = addr_gpa2hva(vm, vm-\u003emmu.pgd) + pgd_index(vm, gva) * 8;\n \tif (!ptep)\n \t\tgoto unmapped_gva;\n-\tif (level == 0)\n+\t/*\n+\t * Stage-1 translation starts at level -1 for a five-level page\n+\t * table, and at levels 0, 1, or 2 for four-, three-, or two-level\n+\t * page tables, respectively.\n+\t */\n+\tif (level == start_level)\n \t\treturn ptep;\n \n \tswitch (vm-\u003emmu.pgtable_levels) {\n+\tcase 5:\n+\t\tptep = addr_gpa2hva(vm, pte_addr(vm, *ptep)) + p4d_index(vm, gva) * 8;\n+\t\tif (!ptep)\n+\t\t\tgoto unmapped_gva;\n+\t\tif (level == 0)\n+\t\t\tbreak;\n+\t\t/* fall through */\n \tcase 4:\n \t\tptep = addr_gpa2hva(vm, pte_addr(vm, *ptep)) + pud_index(vm, gva) * 8;\n \t\tif (!ptep)\n@@ -214,7 +249,7 @@ u64 *virt_get_pte_hva_at_level(struct kvm_vm *vm, gva_t gva, int level)\n \t\t\tgoto unmapped_gva;\n \t\tbreak;\n \tdefault:\n-\t\tTEST_FAIL(\"Page table levels must be 2, 3, or 4\");\n+\t\tTEST_FAIL(\"Page table levels must be 2, 3, 4, or 5\");\n \t}\n \n \treturn ptep;\n@@ -321,12 +356,14 @@ void aarch64_vcpu_setup(struct kvm_vcpu *vcpu, struct kvm_vcpu_init *init)\n \tcase VM_MODE_PXXVYY_4K:\n \t\tTEST_FAIL(\"AArch64 does not support 4K sized pages \"\n \t\t\t \"with ANY-bit physical address ranges\");\n+\tcase VM_MODE_P52V52_64K:\n \tcase VM_MODE_P52V48_64K:\n \tcase VM_MODE_P48V48_64K:\n \tcase VM_MODE_P40V48_64K:\n \tcase VM_MODE_P36V48_64K:\n \t\ttcr_el1 |= TCR_TG0_64K;\n \t\tbreak;\n+\tcase VM_MODE_P52V52_16K:\n \tcase VM_MODE_P52V48_16K:\n \tcase VM_MODE_P48V48_16K:\n \tcase VM_MODE_P40V48_16K:\n@@ -334,6 +371,7 @@ void aarch64_vcpu_setup(struct kvm_vcpu *vcpu, struct kvm_vcpu_init *init)\n \tcase VM_MODE_P36V47_16K:\n \t\ttcr_el1 |= TCR_TG0_16K;\n \t\tbreak;\n+\tcase VM_MODE_P52V52_4K:\n \tcase VM_MODE_P52V48_4K:\n \tcase VM_MODE_P48V48_4K:\n \tcase VM_MODE_P40V48_4K:\n@@ -348,6 +386,9 @@ void aarch64_vcpu_setup(struct kvm_vcpu *vcpu, struct kvm_vcpu_init *init)\n \n \t/* Configure output size */\n \tswitch (vm-\u003emode) {\n+\tcase VM_MODE_P52V52_4K:\n+\tcase VM_MODE_P52V52_16K:\n+\tcase VM_MODE_P52V52_64K:\n \tcase VM_MODE_P52V48_4K:\n \tcase VM_MODE_P52V48_16K:\n \tcase VM_MODE_P52V48_64K:\n@@ -579,7 +620,7 @@ static u32 max_ipa_for_page_size(u32 vm_ipa, u32 gran,\n }\n \n void aarch64_get_supported_page_sizes(u32 ipa, u32 *ipa4k,\n-\t\t\t\t u32 *ipa16k, u32 *ipa64k)\n+\t\t\t\t u32 *ipa16k, u32 *ipa64k, u32 *va64k)\n {\n \tstruct kvm_vcpu_init preferred_init;\n \tint kvm_fd, vm_fd, vcpu_fd, err;\n@@ -617,6 +658,13 @@ void aarch64_get_supported_page_sizes(u32 ipa, u32 *ipa4k,\n \t*ipa16k = max_ipa_for_page_size(ipa, gran, ID_AA64MMFR0_EL1_TGRAN16_NI,\n \t\t\t\t\tID_AA64MMFR0_EL1_TGRAN16_52_BIT);\n \n+\treg.id = KVM_ARM64_SYS_REG(SYS_ID_AA64MMFR2_EL1);\n+\terr = ioctl(vcpu_fd, KVM_GET_ONE_REG, \u0026reg);\n+\tTEST_ASSERT(err == 0, KVM_IOCTL_ERROR(KVM_GET_ONE_REG, err));\n+\n+\t*va64k = FIELD_GET(ID_AA64MMFR2_EL1_VARange, val) \u003e=\n+\t\tID_AA64MMFR2_EL1_VARange_52 ? 52 : 48;\n+\n \tclose(vcpu_fd);\n \tclose(vm_fd);\n \tclose(kvm_fd);\ndiff --git a/tools/testing/selftests/kvm/lib/guest_modes.c b/tools/testing/selftests/kvm/lib/guest_modes.c\nindex 7a96c43b5704d..8d2748145f8f8 100644\n--- a/tools/testing/selftests/kvm/lib/guest_modes.c\n+++ b/tools/testing/selftests/kvm/lib/guest_modes.c\n@@ -20,11 +20,14 @@ void guest_modes_append_default(void)\n #ifdef __aarch64__\n \t{\n \t\tunsigned int limit = kvm_check_cap(KVM_CAP_ARM_VM_IPA_SIZE);\n-\t\tu32 ipa4k, ipa16k, ipa64k;\n+\t\tu32 ipa4k, ipa16k, ipa64k, va64k;\n \t\tint i;\n \n-\t\taarch64_get_supported_page_sizes(limit, \u0026ipa4k, \u0026ipa16k, \u0026ipa64k);\n+\t\taarch64_get_supported_page_sizes(limit, \u0026ipa4k, \u0026ipa16k, \u0026ipa64k, \u0026va64k);\n \n+\t\tguest_mode_append(VM_MODE_P52V52_4K, ipa4k \u003e= 52);\n+\t\tguest_mode_append(VM_MODE_P52V52_16K, ipa16k \u003e= 52);\n+\t\tguest_mode_append(VM_MODE_P52V52_64K, ipa64k \u003e= 52 \u0026\u0026 va64k \u003e= 52);\n \t\tguest_mode_append(VM_MODE_P52V48_4K, ipa4k \u003e= 52);\n \t\tguest_mode_append(VM_MODE_P52V48_16K, ipa16k \u003e= 52);\n \t\tguest_mode_append(VM_MODE_P52V48_64K, ipa64k \u003e= 52);\ndiff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c\nindex 9ddc047d5c275..bc3ed034e2036 100644\n--- a/tools/testing/selftests/kvm/lib/kvm_util.c\n+++ b/tools/testing/selftests/kvm/lib/kvm_util.c\n@@ -203,6 +203,9 @@ const char *vm_guest_mode_string(u32 i)\n \t\t[VM_MODE_P52V48_4K]\t= \"PA-bits:52, VA-bits:48, 4K pages\",\n \t\t[VM_MODE_P52V48_16K]\t= \"PA-bits:52, VA-bits:48, 16K pages\",\n \t\t[VM_MODE_P52V48_64K]\t= \"PA-bits:52, VA-bits:48, 64K pages\",\n+\t\t[VM_MODE_P52V52_4K]\t= \"PA-bits:52, VA-bits:52, 4K pages\",\n+\t\t[VM_MODE_P52V52_16K]\t= \"PA-bits:52, VA-bits:52, 16K pages\",\n+\t\t[VM_MODE_P52V52_64K]\t= \"PA-bits:52, VA-bits:52, 64K pages\",\n \t\t[VM_MODE_P48V48_4K]\t= \"PA-bits:48, VA-bits:48, 4K pages\",\n \t\t[VM_MODE_P48V48_16K]\t= \"PA-bits:48, VA-bits:48, 16K pages\",\n \t\t[VM_MODE_P48V48_64K]\t= \"PA-bits:48, VA-bits:48, 64K pages\",\n@@ -239,6 +242,9 @@ const struct vm_guest_mode_params vm_guest_mode_params[] = {\n \t[VM_MODE_P52V48_4K]\t= { 52, 48, 0x1000, 12 },\n \t[VM_MODE_P52V48_16K]\t= { 52, 48, 0x4000, 14 },\n \t[VM_MODE_P52V48_64K]\t= { 52, 48, 0x10000, 16 },\n+\t[VM_MODE_P52V52_4K]\t= { 52, 52, 0x1000, 12 },\n+\t[VM_MODE_P52V52_16K]\t= { 52, 52, 0x4000, 14 },\n+\t[VM_MODE_P52V52_64K]\t= { 52, 52, 0x10000, 16 },\n \t[VM_MODE_P48V48_4K]\t= { 48, 48, 0x1000, 12 },\n \t[VM_MODE_P48V48_16K]\t= { 48, 48, 0x4000, 14 },\n \t[VM_MODE_P48V48_64K]\t= { 48, 48, 0x10000, 16 },\n@@ -306,10 +312,14 @@ struct kvm_vm *____vm_create(struct vm_shape shape)\n \n \t/* Setup mode specific traits. */\n \tswitch (vm-\u003emode) {\n+\tcase VM_MODE_P52V52_4K:\n+\t\tvm-\u003emmu.pgtable_levels = 5;\n+\t\tbreak;\n \tcase VM_MODE_P52V48_4K:\n \t\tvm-\u003emmu.pgtable_levels = 4;\n \t\tbreak;\n \tcase VM_MODE_P52V48_64K:\n+\tcase VM_MODE_P52V52_64K:\n \t\tvm-\u003emmu.pgtable_levels = 3;\n \t\tbreak;\n \tcase VM_MODE_P48V48_4K:\n@@ -330,6 +340,7 @@ struct kvm_vm *____vm_create(struct vm_shape shape)\n \tcase VM_MODE_P48V48_16K:\n \tcase VM_MODE_P40V48_16K:\n \tcase VM_MODE_P36V48_16K:\n+\tcase VM_MODE_P52V52_16K:\n \t\tvm-\u003emmu.pgtable_levels = 4;\n \t\tbreak;\n \tcase VM_MODE_P47V47_16K:\n"
} |
| 2/1 | 2026/09/14 07:42 | agent | patch-evaluator |
0mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch series only modifies KVM self-tests in tools/testing/selftests/kvm/ (specifically arm64 guest support and testing). These user-space test files do not modify the compiled kernel image (vmlinux) or any kernel modules, making them non-kernel changes that do not warrant kernel fuzzing.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit ba26a28fe93ffb9891222f163635d960b9799c7f
Author: syz-cluster <triage@syzkaller.com>
Date: Mon Sep 14 07:42:56 2026 +0000
syz-cluster: applied patch under review
diff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selftests/kvm/Makefile.kvm
index 96bab7002d39e..1e9d059ffb24a 100644
--- a/tools/testing/selftests/kvm/Makefile.kvm
+++ b/tools/testing/selftests/kvm/Makefile.kvm
@@ -179,6 +179,7 @@ TEST_GEN_PROGS_arm64 += arm64/hello_el2
TEST_GEN_PROGS_arm64 += arm64/host_sve
TEST_GEN_PROGS_arm64 += arm64/hypercalls
TEST_GEN_PROGS_arm64 += arm64/external_aborts
+TEST_GEN_PROGS_arm64 += arm64/lpa_test
TEST_GEN_PROGS_arm64 += arm64/mmio_sign_ext
TEST_GEN_PROGS_arm64 += arm64/page_fault_test
TEST_GEN_PROGS_arm64 += arm64/psci_test
diff --git a/tools/testing/selftests/kvm/arm64/lpa_test.c b/tools/testing/selftests/kvm/arm64/lpa_test.c
new file mode 100644
index 0000000000000..8fe6f254db282
--- /dev/null
+++ b/tools/testing/selftests/kvm/arm64/lpa_test.c
@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Higher virtual addresses read/write test
+ */
+#include <test_util.h>
+
+#include "kvm_syscalls.h"
+#include "kvm_util.h"
+#include "ucall_common.h"
+#include "guest_modes.h"
+#include "processor.h"
+
+#define LOW_GVA 0xc0000000
+#define HIGH_GVA (LOW_GVA | BIT(48))
+
+static void guest_code(void)
+{
+ u64 *low = (u64 *)LOW_GVA;
+ u64 *high = (u64 *)HIGH_GVA;
+
+ WRITE_ONCE(*low, 1);
+ GUEST_ASSERT_EQ(READ_ONCE(*high), 1);
+ WRITE_ONCE(*high, 2);
+ GUEST_ASSERT_EQ(READ_ONCE(*low), 2);
+
+ GUEST_SYNC(0);
+
+ asm volatile("dsb sy\n\t"
+ "tlbi vmalle1is\n\t"
+ "dsb sy\n\t"
+ "isb"
+ : : : "memory");
+
+ GUEST_SYNC(1); /* Host installs HIGH_GVA -> gpa_b. */
+
+ asm volatile("dsb sy\n\t"
+ "isb\n\t"
+ : : : "memory");
+
+ /* low and high map to different GPAs. */
+ WRITE_ONCE(*low, 1);
+ WRITE_ONCE(*high, 2);
+
+ /* Check both after both writes to detect accidental aliasing. */
+ GUEST_ASSERT_EQ(READ_ONCE(*low), 1);
+ GUEST_ASSERT_EQ(READ_ONCE(*high), 2);
+
+ /* Updating the low mapping must not change the high mapping. */
+ WRITE_ONCE(*low, 3);
+
+ GUEST_ASSERT_EQ(READ_ONCE(*low), 3);
+ GUEST_ASSERT_EQ(READ_ONCE(*high), 2);
+
+ GUEST_DONE();
+}
+
+static void run_test(enum vm_guest_mode mode, void *arg)
+{
+ unsigned int *nr_tests = arg;
+ struct kvm_vcpu_init init;
+ struct kvm_vm *vm;
+ struct kvm_vcpu *vcpu;
+ struct ucall uc;
+
+ if (mode != VM_MODE_P52V52_4K &&
+ mode != VM_MODE_P52V52_16K &&
+ mode != VM_MODE_P52V52_64K)
+ return;
+
+ vm = __vm_create(VM_SHAPE(mode), 1, 0);
+ kvm_get_default_vcpu_target(vm, &init);
+ vcpu = aarch64_vcpu_add(vm, 0, &init, guest_code);
+ kvm_arch_vm_finalize_vcpus(vm);
+
+ vm_init_descriptor_tables(vm);
+ vcpu_init_descriptor_tables(vcpu);
+
+ u64 gpa_a = vm_phy_pages_alloc(vm, 1, 0, 0);
+ u64 gpa_b = vm_phy_pages_alloc(vm, 1, 0, 0);
+
+ virt_pg_map(vm, LOW_GVA, gpa_a);
+ virt_pg_map(vm, HIGH_GVA, gpa_a);
+
+ for (;;) {
+ vcpu_run(vcpu);
+ switch (get_ucall(vcpu, &uc)) {
+ case UCALL_DONE:
+ goto done;
+ case UCALL_ABORT:
+ REPORT_GUEST_ASSERT(uc);
+ break;
+ case UCALL_SYNC:
+ switch (uc.args[1]) {
+ case 0:
+ WRITE_ONCE(*virt_get_pte_hva(vm, HIGH_GVA), 0);
+ break;
+ case 1:
+ virt_pg_map(vm, HIGH_GVA, gpa_b);
+ break;
+ default:
+ TEST_FAIL("Unexpected sync stage: %lu\n", uc.args[1]);
+ }
+ /* Complete the host's PTE store before resuming the guest. */
+ asm volatile("dsb sy" : : : "memory");
+ break;
+ default:
+ TEST_FAIL("Unhandled ucall: %ld\n", uc.cmd);
+ }
+ }
+
+done:
+ kvm_vm_free(vm);
+ (*nr_tests)++;
+}
+
+int main(int argc, char **argv)
+{
+ unsigned int nr_tests = 0;
+
+ for_each_guest_mode(run_test, &nr_tests);
+ if (!nr_tests)
+ ksft_exit_skip("No supported 52-bit VA guest mode; skipping test\n");
+ return 0;
+}
diff --git a/tools/testing/selftests/kvm/include/arm64/processor.h b/tools/testing/selftests/kvm/include/arm64/processor.h
index b8a902ba8573d..4ab00a7e6efb5 100644
--- a/tools/testing/selftests/kvm/include/arm64/processor.h
+++ b/tools/testing/selftests/kvm/include/arm64/processor.h
@@ -113,6 +113,7 @@
#define PTE_VALID BIT(0)
#define PGD_TYPE_TABLE BIT(1)
+#define P4D_TYPE_TABLE BIT(1)
#define PUD_TYPE_TABLE BIT(1)
#define PMD_TYPE_TABLE BIT(1)
#define PTE_TYPE_PAGE BIT(1)
@@ -168,7 +169,7 @@ enum {
(v) == VECTOR_SYNC_LOWER_32)
void aarch64_get_supported_page_sizes(u32 ipa, u32 *ipa4k,
- u32 *ipa16k, u32 *ipa64k);
+ u32 *ipa16k, u32 *ipa64k, u32 *va64k);
void vm_init_descriptor_tables(struct kvm_vm *vm);
void vcpu_init_descriptor_tables(struct kvm_vcpu *vcpu);
diff --git a/tools/testing/selftests/kvm/include/kvm_util.h b/tools/testing/selftests/kvm/include/kvm_util.h
index 5a7a455b53875..1c268fa994aa9 100644
--- a/tools/testing/selftests/kvm/include/kvm_util.h
+++ b/tools/testing/selftests/kvm/include/kvm_util.h
@@ -184,6 +184,9 @@ enum vm_guest_mode {
VM_MODE_P52V48_4K,
VM_MODE_P52V48_16K,
VM_MODE_P52V48_64K,
+ VM_MODE_P52V52_4K,
+ VM_MODE_P52V52_16K,
+ VM_MODE_P52V52_64K,
VM_MODE_P48V48_4K,
VM_MODE_P48V48_16K,
VM_MODE_P48V48_64K,
diff --git a/tools/testing/selftests/kvm/lib/arm64/processor.c b/tools/testing/selftests/kvm/lib/arm64/processor.c
index 01325bf4d36fc..9915f25f02874 100644
--- a/tools/testing/selftests/kvm/lib/arm64/processor.c
+++ b/tools/testing/selftests/kvm/lib/arm64/processor.c
@@ -29,13 +29,25 @@ static u64 pgd_index(struct kvm_vm *vm, gva_t gva)
return (gva >> shift) & mask;
}
+static u64 p4d_index(struct kvm_vm *vm, gva_t gva)
+{
+ unsigned int shift = 3 * (vm->page_shift - 3) + vm->page_shift;
+ u64 mask = (1UL << (vm->page_shift - 3)) - 1;
+
+ TEST_ASSERT(vm->mmu.pgtable_levels == 5,
+ "Mode %d does not have 5 page table levels", vm->mode);
+
+ return (gva >> shift) & mask;
+}
+
static u64 pud_index(struct kvm_vm *vm, gva_t gva)
{
unsigned int shift = 2 * (vm->page_shift - 3) + vm->page_shift;
u64 mask = (1UL << (vm->page_shift - 3)) - 1;
- TEST_ASSERT(vm->mmu.pgtable_levels == 4,
- "Mode %d does not have 4 page table levels", vm->mode);
+ TEST_ASSERT(vm->mmu.pgtable_levels >= 4,
+ "Mode %d does not have >= 4 page table levels",
+ vm->mode);
return (gva >> shift) & mask;
}
@@ -147,6 +159,12 @@ static void _virt_pg_map(struct kvm_vm *vm, gva_t gva, gpa_t gpa,
PGD_TYPE_TABLE | PTE_VALID);
switch (vm->mmu.pgtable_levels) {
+ case 5:
+ ptep = addr_gpa2hva(vm, pte_addr(vm, *ptep)) + p4d_index(vm, gva) * 8;
+ if (!*ptep)
+ *ptep = addr_pte(vm, vm_alloc_page_table(vm),
+ P4D_TYPE_TABLE | PTE_VALID);
+ /* fall through */
case 4:
ptep = addr_gpa2hva(vm, pte_addr(vm, *ptep)) + pud_index(vm, gva) * 8;
if (!*ptep)
@@ -163,7 +181,7 @@ static void _virt_pg_map(struct kvm_vm *vm, gva_t gva, gpa_t gpa,
ptep = addr_gpa2hva(vm, pte_addr(vm, *ptep)) + pte_index(vm, gva) * 8;
break;
default:
- TEST_FAIL("Page table levels must be 2, 3, or 4");
+ TEST_FAIL("Page table levels must be 2, 3, 4, or 5");
}
pg_attr = PTE_AF | PTE_ATTRINDX(attr_idx) | PTE_TYPE_PAGE | PTE_VALID;
@@ -182,18 +200,35 @@ void virt_arch_pg_map(struct kvm_vm *vm, gva_t gva, gpa_t gpa)
u64 *virt_get_pte_hva_at_level(struct kvm_vm *vm, gva_t gva, int level)
{
+ int start_level = 4 - vm->mmu.pgtable_levels;
u64 *ptep;
+ TEST_ASSERT(level >= start_level && level <= 3,
+ "Invalid translation level %d, valid range is %d-3",
+ level, start_level);
+
if (!vm->mmu.pgd_created)
goto unmapped_gva;
ptep = addr_gpa2hva(vm, vm->mmu.pgd) + pgd_index(vm, gva) * 8;
if (!ptep)
goto unmapped_gva;
- if (level == 0)
+ /*
+ * Stage-1 translation starts at level -1 for a five-level page
+ * table, and at levels 0, 1, or 2 for four-, three-, or two-level
+ * page tables, respectively.
+ */
+ if (level == start_level)
return ptep;
switch (vm->mmu.pgtable_levels) {
+ case 5:
+ ptep = addr_gpa2hva(vm, pte_addr(vm, *ptep)) + p4d_index(vm, gva) * 8;
+ if (!ptep)
+ goto unmapped_gva;
+ if (level == 0)
+ break;
+ /* fall through */
case 4:
ptep = addr_gpa2hva(vm, pte_addr(vm, *ptep)) + pud_index(vm, gva) * 8;
if (!ptep)
@@ -214,7 +249,7 @@ u64 *virt_get_pte_hva_at_level(struct kvm_vm *vm, gva_t gva, int level)
goto unmapped_gva;
break;
default:
- TEST_FAIL("Page table levels must be 2, 3, or 4");
+ TEST_FAIL("Page table levels must be 2, 3, 4, or 5");
}
return ptep;
@@ -321,12 +356,14 @@ void aarch64_vcpu_setup(struct kvm_vcpu *vcpu, struct kvm_vcpu_init *init)
case VM_MODE_PXXVYY_4K:
TEST_FAIL("AArch64 does not support 4K sized pages "
"with ANY-bit physical address ranges");
+ case VM_MODE_P52V52_64K:
case VM_MODE_P52V48_64K:
case VM_MODE_P48V48_64K:
case VM_MODE_P40V48_64K:
case VM_MODE_P36V48_64K:
tcr_el1 |= TCR_TG0_64K;
break;
+ case VM_MODE_P52V52_16K:
case VM_MODE_P52V48_16K:
case VM_MODE_P48V48_16K:
case VM_MODE_P40V48_16K:
@@ -334,6 +371,7 @@ void aarch64_vcpu_setup(struct kvm_vcpu *vcpu, struct kvm_vcpu_init *init)
case VM_MODE_P36V47_16K:
tcr_el1 |= TCR_TG0_16K;
break;
+ case VM_MODE_P52V52_4K:
case VM_MODE_P52V48_4K:
case VM_MODE_P48V48_4K:
case VM_MODE_P40V48_4K:
@@ -348,6 +386,9 @@ void aarch64_vcpu_setup(struct kvm_vcpu *vcpu, struct kvm_vcpu_init *init)
/* Configure output size */
switch (vm->mode) {
+ case VM_MODE_P52V52_4K:
+ case VM_MODE_P52V52_16K:
+ case VM_MODE_P52V52_64K:
case VM_MODE_P52V48_4K:
case VM_MODE_P52V48_16K:
case VM_MODE_P52V48_64K:
@@ -579,7 +620,7 @@ static u32 max_ipa_for_page_size(u32 vm_ipa, u32 gran,
}
void aarch64_get_supported_page_sizes(u32 ipa, u32 *ipa4k,
- u32 *ipa16k, u32 *ipa64k)
+ u32 *ipa16k, u32 *ipa64k, u32 *va64k)
{
struct kvm_vcpu_init preferred_init;
int kvm_fd, vm_fd, vcpu_fd, err;
@@ -617,6 +658,13 @@ void aarch64_get_supported_page_sizes(u32 ipa, u32 *ipa4k,
*ipa16k = max_ipa_for_page_size(ipa, gran, ID_AA64MMFR0_EL1_TGRAN16_NI,
ID_AA64MMFR0_EL1_TGRAN16_52_BIT);
+ reg.id = KVM_ARM64_SYS_REG(SYS_ID_AA64MMFR2_EL1);
+ err = ioctl(vcpu_fd, KVM_GET_ONE_REG, ®);
+ TEST_ASSERT(err == 0, KVM_IOCTL_ERROR(KVM_GET_ONE_REG, err));
+
+ *va64k = FIELD_GET(ID_AA64MMFR2_EL1_VARange, val) >=
+ ID_AA64MMFR2_EL1_VARange_52 ? 52 : 48;
+
close(vcpu_fd);
close(vm_fd);
close(kvm_fd);
diff --git a/tools/testing/selftests/kvm/lib/guest_modes.c b/tools/testing/selftests/kvm/lib/guest_modes.c
index 7a96c43b5704d..8d2748145f8f8 100644
--- a/tools/testing/selftests/kvm/lib/guest_modes.c
+++ b/tools/testing/selftests/kvm/lib/guest_modes.c
@@ -20,11 +20,14 @@ void guest_modes_append_default(void)
#ifdef __aarch64__
{
unsigned int limit = kvm_check_cap(KVM_CAP_ARM_VM_IPA_SIZE);
- u32 ipa4k, ipa16k, ipa64k;
+ u32 ipa4k, ipa16k, ipa64k, va64k;
int i;
- aarch64_get_supported_page_sizes(limit, &ipa4k, &ipa16k, &ipa64k);
+ aarch64_get_supported_page_sizes(limit, &ipa4k, &ipa16k, &ipa64k, &va64k);
+ guest_mode_append(VM_MODE_P52V52_4K, ipa4k >= 52);
+ guest_mode_append(VM_MODE_P52V52_16K, ipa16k >= 52);
+ guest_mode_append(VM_MODE_P52V52_64K, ipa64k >= 52 && va64k >= 52);
guest_mode_append(VM_MODE_P52V48_4K, ipa4k >= 52);
guest_mode_append(VM_MODE_P52V48_16K, ipa16k >= 52);
guest_mode_append(VM_MODE_P52V48_64K, ipa64k >= 52);
diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
index 9ddc047d5c275..bc3ed034e2036 100644
--- a/tools/testing/selftests/kvm/lib/kvm_util.c
+++ b/tools/testing/selftests/kvm/lib/kvm_util.c
@@ -203,6 +203,9 @@ const char *vm_guest_mode_string(u32 i)
[VM_MODE_P52V48_4K] = "PA-bits:52, VA-bits:48, 4K pages",
[VM_MODE_P52V48_16K] = "PA-bits:52, VA-bits:48, 16K pages",
[VM_MODE_P52V48_64K] = "PA-bits:52, VA-bits:48, 64K pages",
+ [VM_MODE_P52V52_4K] = "PA-bits:52, VA-bits:52, 4K pages",
+ [VM_MODE_P52V52_16K] = "PA-bits:52, VA-bits:52, 16K pages",
+ [VM_MODE_P52V52_64K] = "PA-bits:52, VA-bits:52, 64K pages",
[VM_MODE_P48V48_4K] = "PA-bits:48, VA-bits:48, 4K pages",
[VM_MODE_P48V48_16K] = "PA-bits:48, VA-bits:48, 16K pages",
[VM_MODE_P48V48_64K] = "PA-bits:48, VA-bits:48, 64K pages",
@@ -239,6 +242,9 @@ const struct vm_guest_mode_params vm_guest_mode_params[] = {
[VM_MODE_P52V48_4K] = { 52, 48, 0x1000, 12 },
[VM_MODE_P52V48_16K] = { 52, 48, 0x4000, 14 },
[VM_MODE_P52V48_64K] = { 52, 48, 0x10000, 16 },
+ [VM_MODE_P52V52_4K] = { 52, 52, 0x1000, 12 },
+ [VM_MODE_P52V52_16K] = { 52, 52, 0x4000, 14 },
+ [VM_MODE_P52V52_64K] = { 52, 52, 0x10000, 16 },
[VM_MODE_P48V48_4K] = { 48, 48, 0x1000, 12 },
[VM_MODE_P48V48_16K] = { 48, 48, 0x4000, 14 },
[VM_MODE_P48V48_64K] = { 48, 48, 0x10000, 16 },
@@ -306,10 +312,14 @@ struct kvm_vm *____vm_create(struct vm_shape shape)
/* Setup mode specific traits. */
switch (vm->mode) {
+ case VM_MODE_P52V52_4K:
+ vm->mmu.pgtable_levels = 5;
+ break;
case VM_MODE_P52V48_4K:
vm->mmu.pgtable_levels = 4;
break;
case VM_MODE_P52V48_64K:
+ case VM_MODE_P52V52_64K:
vm->mmu.pgtable_levels = 3;
break;
case VM_MODE_P48V48_4K:
@@ -330,6 +340,7 @@ struct kvm_vm *____vm_create(struct vm_shape shape)
case VM_MODE_P48V48_16K:
case VM_MODE_P40V48_16K:
case VM_MODE_P36V48_16K:
+ case VM_MODE_P52V52_16K:
vm->mmu.pgtable_levels = 4;
break;
case VM_MODE_P47V47_16K:
|
| 3/2 | 2026/09/14 07:42 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 9639 output: 100 thoughts: 750 Thoughts: **Analysis of the Patch: WorthFuzzing = False**
Okay, let's break this down. First, the target architecture is amd64. I need to identify the modified files to determine if this patch warrants fuzzing. I've checked the file list:
* `tools/testing/selftests/kvm/Makefile.kvm`
* `tools/testing/selftests/kvm/arm64/lpa_test.c`
* `tools/testing/selftests/kvm/include/arm64/processor.h`
* `tools/testing/selftests/kvm/include/kvm_util.h`
* `tools/testing/selftests/kvm/lib/arm64/processor.c`
* `tools/testing/selftests/kvm/lib/guest_modes.c`
* `tools/testing/selftests/kvm/lib/kvm_util.c`
All the modified files are neatly contained within `tools/testing/selftests/kvm/`. That's a huge red flag – a good one! This is *textbook* self-test code, and the crucial point is that it is *not* impacting the kernel image or modules. I immediately refer to my mental checklist for these kinds of scenarios. The prompt explicitly states that changes limited to user-space directories, like `tools/testing/selftests`, which do not affect the compiled kernel image are a negative indicator, and that we return WorthFuzzing=false.
Let's double-check. I see no indication of kernel file modifications. The provided diff appears comprehensive. I can quickly confirm this; the list of files in the diff is all that is changed. I am certain that the KVM selftests do not affect the compiled kernel image.
Finally, consider the target architecture: amd64. The test code is arm64, meaning that this patch is specifically *not* for the target architecture. This gives us another reason to flag this as WorthFuzzing = false.
So, summing it up, my decision is:
* WorthFuzzing: false
* EnableConfigs: \[ ]
* FocusSymbols: \[ ]
* Reasoning: All changes are contained within user-space KVM self-tests and are for an architecture other than the target architecture.
It's an unambiguous "no go" for fuzzing. We're done.
|
| 4/2 | 2026/09/14 07:43 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch series only modifies KVM self-tests in tools/testing/selftests/kvm/ (specifically arm64 guest support and testing). These user-space test files do not modify the compiled kernel image (vmlinux) or any kernel modules, making them non-kernel changes that do not warrant kernel fuzzing.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch series only modifies KVM self-tests in tools/testing/selftests/kvm/ (specifically arm64 guest support and testing). These user-space test files do not modify the compiled kernel image (vmlinux) or any kernel modules, making them non-kernel changes that do not warrant kernel fuzzing.",
"WorthFuzzing": false
} |
| 5/1 | 2026/09/14 07:43 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|