[PATCH] iommupt/kunit: Unmap in the tests before freeing the domain

From: Yuanhe Shu

Date: Mon Aug 31 2026 - 02:43:22 EST


test_increase_level(), test_pgsize_boundary() and test_mixed() leave
their mappings installed and let pt_kunit_iommu_exit() free the whole
table, while the other cases unmap and then check that the table is
empty.

Besides being inconsistent, the mappings which survive into
pt_iommu_deinit() keep the IOMMU_DEBUG_PAGEALLOC references that
iommu_map() took on the mapped pages. Nothing drops them, so with
iommu.debug_pagealloc=1 the pages behind the hard-coded test OAs stay
counted as IOMMU-mapped and every later allocation or free of one of
them reports:

WARNING: drivers/iommu/iommu-debug-pagealloc.c:91 at __iommu_debug_check_unmapped+0x4e/0x70, CPU#0: init/1
iommu: Detected page leak!

Unmap what these tests map, and check in pt_kunit_iommu_exit() that
nothing was left behind so this does not come back. KUNIT_EXPECT is
used there rather than KUNIT_ASSERT because a failing assert aborts the
rest of the cleanup, which leaves pt_kunit_dev registered and cascades
into the following test cases.

Verified with the generic_pt kunit suite (tools/testing/kunit/kunit.py
--arch=x86_64, drivers/iommu/generic_pt/.kunitconfig), which covers the
amdv1, vtdss, riscv64 and x86_64 formats: the pt_kunit_iommu_exit() check
on its own, without the unmaps, makes exactly these three cases fail and
nothing else (23 of 227 results); with the unmaps there are no failures,
214 passed and 13 skipped.

Suggested-by: Jason Gunthorpe <jgg@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20260827161828.GA3769797@xxxxxxxx
Signed-off-by: Yuanhe Shu <xiangzao@xxxxxxxxxxxxxxxxx>
---
drivers/iommu/generic_pt/kunit_iommu_pt.h | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/drivers/iommu/generic_pt/kunit_iommu_pt.h b/drivers/iommu/generic_pt/kunit_iommu_pt.h
index ece1c9b8c55d..a9c414951637 100644
--- a/drivers/iommu/generic_pt/kunit_iommu_pt.h
+++ b/drivers/iommu/generic_pt/kunit_iommu_pt.h
@@ -119,19 +119,22 @@ static void test_increase_level(struct kunit *test)
/* Add every possible level to the max */
while (common->max_vasz_lg2 != pt_top_range(common).max_vasz_lg2) {
struct pt_range top_range = pt_top_range(common);
+ pt_vaddr_t va;

if (top_range.va == 0)
- do_map(test, top_range.last_va + 1, 0,
- priv->smallest_pgsz);
+ va = top_range.last_va + 1;
else
- do_map(test, top_range.va - priv->smallest_pgsz, 0,
- priv->smallest_pgsz);
+ va = top_range.va - priv->smallest_pgsz;
+ do_map(test, va, 0, priv->smallest_pgsz);

KUNIT_ASSERT_EQ(test, pt_top_range(common).top_level,
top_range.top_level + 1);
KUNIT_ASSERT_GE(test, common->max_vasz_lg2,
pt_top_range(common).max_vasz_lg2);
+
+ do_unmap(test, va, priv->smallest_pgsz);
}
+ KUNIT_ASSERT_EQ(test, count_valids(test), 0);
}

static void test_map_simple(struct kunit *test)
@@ -404,6 +407,8 @@ static void test_pgsize_boundary(struct kunit *test)
kunit_skip(test, "Format does not have the required range");

do_map(test, 0xfef80000, 0x208b95d000, 0xfef9ffff - 0xfef80000 + 1);
+ do_unmap(test, 0xfef80000, 0xfef9ffff - 0xfef80000 + 1);
+ KUNIT_ASSERT_EQ(test, count_valids(test), 0);
}

/* See https://lore.kernel.org/r/20250826143816.38686-1-eugkoira@xxxxxxxxxx */
@@ -425,6 +430,8 @@ static void test_mixed(struct kunit *test)
/* 14 2M, 3 1G, 3 2M */
KUNIT_ASSERT_EQ(test, count_valids(test), 20);
check_iova(test, start, oa, len);
+ do_unmap(test, start, len);
+ KUNIT_ASSERT_EQ(test, count_valids(test), 0);
}

static struct kunit_case iommu_test_cases[] = {
@@ -465,6 +472,12 @@ static void pt_kunit_iommu_exit(struct kunit *test)
if (!test->priv)
return;

+ /*
+ * The tests are expected to unmap what they map. Use EXPECT so a
+ * failure here does not abort the rest of the cleanup.
+ */
+ KUNIT_EXPECT_EQ(test, count_valids(test), 0);
+
pt_iommu_deinit(priv->iommu);
/*
* Look for memory leaks, assumes kunit is running isolated and nothing

base-commit: 45c13f3f9e3bb15fd89ff2864c6f627a3b4b4229
--
2.43.7