test_increase_level(), test_pgsize_boundary() and test_mixed() leave
their mappings installed and let pt_kunit_iommu_exit() free the whole
table, while the other cases unmap and then check that the table is
empty.

Besides being inconsistent, the mappings which survive into
pt_iommu_deinit() keep the IOMMU_DEBUG_PAGEALLOC references that
iommu_map() took on the mapped pages.  Nothing drops them, so with
iommu.debug_pagealloc=1 the pages behind the hard-coded test OAs stay
counted as IOMMU-mapped and every later allocation or free of one of
them reports:

    WARNING: drivers/iommu/iommu-debug-pagealloc.c:91 at __iommu_debug_check_unmapped+0x4e/0x70, CPU#0: init/1
    iommu: Detected page leak!

Unmap what these tests map, and check in pt_kunit_iommu_exit() that
nothing was left behind so this does not come back.  KUNIT_EXPECT is
used there rather than KUNIT_ASSERT because a failing assert aborts the
rest of the cleanup, which leaves pt_kunit_dev registered and cascades
into the following test cases.

Verified with the generic_pt kunit suite (tools/testing/kunit/kunit.py
--arch=x86_64, drivers/iommu/generic_pt/.kunitconfig), which covers the
amdv1, vtdss, riscv64 and x86_64 formats: the pt_kunit_iommu_exit() check
on its own, without the unmaps, makes exactly these three cases fail and
nothing else (23 of 227 results); with the unmaps there are no failures,
214 passed and 13 skipped.

Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20260827161828.GA3769797@ziepe.ca
Signed-off-by: Yuanhe Shu <xiangzao@linux.alibaba.com>
---
 drivers/iommu/generic_pt/kunit_iommu_pt.h | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/drivers/iommu/generic_pt/kunit_iommu_pt.h b/drivers/iommu/generic_pt/kunit_iommu_pt.h
index ece1c9b8c55d..a9c414951637 100644
--- a/drivers/iommu/generic_pt/kunit_iommu_pt.h
+++ b/drivers/iommu/generic_pt/kunit_iommu_pt.h
@@ -119,19 +119,22 @@ static void test_increase_level(struct kunit *test)
 	/* Add every possible level to the max */
 	while (common->max_vasz_lg2 != pt_top_range(common).max_vasz_lg2) {
 		struct pt_range top_range = pt_top_range(common);
+		pt_vaddr_t va;
 
 		if (top_range.va == 0)
-			do_map(test, top_range.last_va + 1, 0,
-			       priv->smallest_pgsz);
+			va = top_range.last_va + 1;
 		else
-			do_map(test, top_range.va - priv->smallest_pgsz, 0,
-			       priv->smallest_pgsz);
+			va = top_range.va - priv->smallest_pgsz;
+		do_map(test, va, 0, priv->smallest_pgsz);
 
 		KUNIT_ASSERT_EQ(test, pt_top_range(common).top_level,
 				top_range.top_level + 1);
 		KUNIT_ASSERT_GE(test, common->max_vasz_lg2,
 				pt_top_range(common).max_vasz_lg2);
+
+		do_unmap(test, va, priv->smallest_pgsz);
 	}
+	KUNIT_ASSERT_EQ(test, count_valids(test), 0);
 }
 
 static void test_map_simple(struct kunit *test)
@@ -404,6 +407,8 @@ static void test_pgsize_boundary(struct kunit *test)
 		kunit_skip(test, "Format does not have the required range");
 
 	do_map(test, 0xfef80000, 0x208b95d000, 0xfef9ffff - 0xfef80000 + 1);
+	do_unmap(test, 0xfef80000, 0xfef9ffff - 0xfef80000 + 1);
+	KUNIT_ASSERT_EQ(test, count_valids(test), 0);
 }
 
 /* See https://lore.kernel.org/r/20250826143816.38686-1-eugkoira@amazon.com */
@@ -425,6 +430,8 @@ static void test_mixed(struct kunit *test)
 	/* 14 2M, 3 1G, 3 2M */
 	KUNIT_ASSERT_EQ(test, count_valids(test), 20);
 	check_iova(test, start, oa, len);
+	do_unmap(test, start, len);
+	KUNIT_ASSERT_EQ(test, count_valids(test), 0);
 }
 
 static struct kunit_case iommu_test_cases[] = {
@@ -465,6 +472,12 @@ static void pt_kunit_iommu_exit(struct kunit *test)
 	if (!test->priv)
 		return;
 
+	/*
+	 * The tests are expected to unmap what they map. Use EXPECT so a
+	 * failure here does not abort the rest of the cleanup.
+	 */
+	KUNIT_EXPECT_EQ(test, count_valids(test), 0);
+
 	pt_iommu_deinit(priv->iommu);
 	/*
 	 * Look for memory leaks, assumes kunit is running isolated and nothing

base-commit: 45c13f3f9e3bb15fd89ff2864c6f627a3b4b4229
-- 
2.43.7

On Mon, 31 Aug 2026 14:42:56 +0800, Yuanhe Shu <xiangzao@linux.alibaba.com> wrote:
> test_increase_level(), test_pgsize_boundary() and test_mixed() leave
> their mappings installed and let pt_kunit_iommu_exit() free the whole
> table, while the other cases unmap and then check that the table is
> empty.
> 
> Besides being inconsistent, the mappings which survive into
> pt_iommu_deinit() keep the IOMMU_DEBUG_PAGEALLOC references that
> iommu_map() took on the mapped pages.  Nothing drops them, so with
> iommu.debug_pagealloc=1 the pages behind the hard-coded test OAs stay
> counted as IOMMU-mapped and every later allocation or free of one of
> them reports:
> 
> [...]

Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>

-- 
Jason