* [PATCH v1 29/32] docs: add documentation for memfd preservation via LUO
From: Pasha Tatashin @ 2025-06-25 23:18 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel
In-Reply-To: <20250625231838.1897085-1-pasha.tatashin@soleen.com>
From: Pratyush Yadav <ptyadav@amazon.de>
Add the documentation under the "Preserving file descriptors" section of
LUO's documentation. The doc describes the properties preserved,
behaviour of the file under different LUO states, serialization format,
and current limitations.
Signed-off-by: Pratyush Yadav <ptyadav@amazon.de>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
Documentation/core-api/liveupdate.rst | 7 ++
Documentation/mm/index.rst | 1 +
Documentation/mm/memfd_preservation.rst | 138 ++++++++++++++++++++++++
MAINTAINERS | 1 +
4 files changed, 147 insertions(+)
create mode 100644 Documentation/mm/memfd_preservation.rst
diff --git a/Documentation/core-api/liveupdate.rst b/Documentation/core-api/liveupdate.rst
index 41c4b76cd3ec..232d5f623992 100644
--- a/Documentation/core-api/liveupdate.rst
+++ b/Documentation/core-api/liveupdate.rst
@@ -18,6 +18,13 @@ LUO Preserving File Descriptors
.. kernel-doc:: kernel/liveupdate/luo_files.c
:doc: LUO file descriptors
+The following types of file descriptors can be preserved
+
+.. toctree::
+ :maxdepth: 1
+
+ ../mm/memfd_preservation
+
Public API
==========
.. kernel-doc:: include/linux/liveupdate.h
diff --git a/Documentation/mm/index.rst b/Documentation/mm/index.rst
index d3ada3e45e10..97267567ef80 100644
--- a/Documentation/mm/index.rst
+++ b/Documentation/mm/index.rst
@@ -47,6 +47,7 @@ documentation, or deleted if it has served its purpose.
hugetlbfs_reserv
ksm
memory-model
+ memfd_preservation
mmu_notifier
multigen_lru
numa
diff --git a/Documentation/mm/memfd_preservation.rst b/Documentation/mm/memfd_preservation.rst
new file mode 100644
index 000000000000..416cd1dafc97
--- /dev/null
+++ b/Documentation/mm/memfd_preservation.rst
@@ -0,0 +1,138 @@
+.. SPDX-License-Identifier: GPL-2.0-or-later
+
+==========================
+Memfd Preservation via LUO
+==========================
+
+Overview
+========
+
+Memory file descriptors (memfd) can be preserved over a kexec using the Live
+Update Orchestrator (LUO) file preservation. This allows userspace to transfer
+its memory contents to the next kernel after a kexec.
+
+The preservation is not intended to be transparent. Only select properties of
+the file are preserved. All others are reset to default. The preserved
+properties are described below.
+
+.. note::
+ The LUO API is not stabilized yet, so the preserved properties of a memfd are
+ also not stable and are subject to backwards incompatible changes.
+
+.. note::
+ Currently a memfd backed by Hugetlb is not supported. Memfds created
+ with ``MFD_HUGETLB`` will be rejected.
+
+Preserved Properties
+====================
+
+The following properties of the memfd are preserved across kexec:
+
+File Contents
+ All data stored in the file is preserved.
+
+File Size
+ The size of the file is preserved. Holes in the file are filled by allocating
+ pages for them during preservation.
+
+File Position
+ The current file position is preserved, allowing applications to continue
+ reading/writing from their last position.
+
+File Status Flags
+ memfds are always opened with ``O_RDWR`` and ``O_LARGEFILE``. This property is
+ maintained.
+
+Non-Preserved Properties
+========================
+
+All properties which are not preserved must be assumed to be reset to default.
+This section describes some of those properties which may be more of note.
+
+``FD_CLOEXEC`` flag
+ A memfd can be created with the ``MFD_CLOEXEC`` flag that sets the
+ ``FD_CLOEXEC`` on the file. This flag is not preserved and must be set again
+ after restore via ``fcntl()``.
+
+Seals
+ File seals are not preserved. The file is unsealed on restore and if needed,
+ must be sealed again via ``fcntl()``.
+
+Behavior with LUO states
+========================
+
+This section described the behavior of the memfd in the different LUO states.
+
+Normal Phase
+ During the normal phase, the memfd can be marked for preservation using the
+ ``LIVEUPDATE_IOCTL_FD_PRESERVE`` ioctl. The memfd acts as a regular memfd
+ during this phase with no additional restrictions.
+
+Prepared Phase
+ After LUO enters ``LIVEUPDATE_STATE_PREPARED``, the memfd is serialized and
+ prepared for the next kernel. During this phase, the below things happen:
+
+ - All the folios are pinned. If some folios reside in ``ZONE_MIGRATE``, they
+ are migrated out. This ensures none of the preserved folios land in KHO
+ scratch area.
+ - Pages in swap are swapped in. Currently, there is no way to pass pages in
+ swap over KHO, so all swapped out pages are swapped back in and pinned.
+ - The memfd goes into "frozen mapping" mode. The file can no longer grow or
+ shrink, or punch holes. This ensures the serialized mappings stay in sync.
+ The file can still be read from or written to or mmap-ed.
+
+Freeze Phase
+ Updates the current file position in the serialized data to capture any
+ changes that occurred between prepare and freeze phases. After this, the FD is
+ not allowed to be accessed.
+
+Restoration Phase
+ After being restored, the memfd is functional as normal with the properties
+ listed above restored.
+
+Cancellation
+ If the liveupdate is canceled after going into prepared phase, the memfd
+ functions like in normal phase.
+
+Serialization format
+====================
+
+The state is serialized in an FDT with the following structure::
+
+ /dts-v1/;
+
+ / {
+ compatible = "memfd-v1";
+ pos = <current_file_position>;
+ size = <file_size_in_bytes>;
+ folios = <array_of_preserved_folio_descriptors>;
+ };
+
+Each folio descriptor contains:
+
+- PFN + flags (8 bytes)
+
+ - Physical frame number (PFN) of the preserved folio (bits 63:12).
+ - Folio flags (bits 11:0):
+
+ - ``PRESERVED_FLAG_DIRTY`` (bit 0)
+ - ``PRESERVED_FLAG_UPTODATE`` (bit 1)
+
+- Folio index within the file (8 bytes).
+
+Limitations
+===========
+
+The current implementation has the following limitations:
+
+Size
+ Currently the size of the file is limited by the size of the FDT. The FDT can
+ be at of most ``MAX_PAGE_ORDER`` order. By default this is 4 MiB with 4K
+ pages. Each page in the file is tracked using 16 bytes. This limits the
+ maximum size of the file to 1 GiB.
+
+See Also
+========
+
+- :doc:`Live Update Orchestrator </admin-guide/liveupdate>`
+- :doc:`/core-api/kho/concepts`
diff --git a/MAINTAINERS b/MAINTAINERS
index 163f38cd55b5..8114ce1be57b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -14017,6 +14017,7 @@ S: Maintained
F: Documentation/ABI/testing/sysfs-kernel-liveupdate
F: Documentation/admin-guide/liveupdate.rst
F: Documentation/core-api/liveupdate.rst
+F: Documentation/mm/memfd_preservation.rst
F: Documentation/userspace-api/liveupdate.rst
F: include/linux/liveupdate.h
F: include/uapi/linux/liveupdate.h
--
2.50.0.727.gbf7dc18ff4-goog
^ permalink raw reply related
* [RFC v1 30/32] tools: introduce libluo
From: Pasha Tatashin @ 2025-06-25 23:18 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel
In-Reply-To: <20250625231838.1897085-1-pasha.tatashin@soleen.com>
From: Pratyush Yadav <ptyadav@amazon.de>
LibLUO is a C library for interacting with the Live Update
Orchestrator (LUO) subsystem. It provides a set of APIs for applications
to interact with LUO, avoiding the need to directly calling the LUO
ioctls. It provides APIs for controlling the LUO state and preserve and
restore file descriptors across live updates.
Signed-off-by: Pratyush Yadav <ptyadav@amazon.de>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
MAINTAINERS | 1 +
tools/lib/luo/LICENSE | 165 ++++++++++++++++++
tools/lib/luo/Makefile | 37 ++++
tools/lib/luo/README.md | 166 ++++++++++++++++++
tools/lib/luo/include/libluo.h | 128 ++++++++++++++
tools/lib/luo/include/liveupdate.h | 265 +++++++++++++++++++++++++++++
tools/lib/luo/libluo.c | 203 ++++++++++++++++++++++
7 files changed, 965 insertions(+)
create mode 100644 tools/lib/luo/LICENSE
create mode 100644 tools/lib/luo/Makefile
create mode 100644 tools/lib/luo/README.md
create mode 100644 tools/lib/luo/include/libluo.h
create mode 100644 tools/lib/luo/include/liveupdate.h
create mode 100644 tools/lib/luo/libluo.c
diff --git a/MAINTAINERS b/MAINTAINERS
index 8114ce1be57b..2b42b66404b5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -14023,6 +14023,7 @@ F: include/linux/liveupdate.h
F: include/uapi/linux/liveupdate.h
F: kernel/liveupdate/
F: mm/memfd_luo.c
+F: tools/lib/luo/
F: tools/testing/selftests/liveupdate/
LLC (802.2)
diff --git a/tools/lib/luo/LICENSE b/tools/lib/luo/LICENSE
new file mode 100644
index 000000000000..0a041280bd00
--- /dev/null
+++ b/tools/lib/luo/LICENSE
@@ -0,0 +1,165 @@
+ GNU LESSER GENERAL PUBLIC LICENSE
+ Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+ This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+ 0. Additional Definitions.
+
+ As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+ "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+ An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+ A "Combined Work" is a work produced by combining or linking an
+Application with the Library. The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+ The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+ The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+ 1. Exception to Section 3 of the GNU GPL.
+
+ You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+ 2. Conveying Modified Versions.
+
+ If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+ a) under this License, provided that you make a good faith effort to
+ ensure that, in the event an Application does not supply the
+ function or data, the facility still operates, and performs
+ whatever part of its purpose remains meaningful, or
+
+ b) under the GNU GPL, with none of the additional permissions of
+ this License applicable to that copy.
+
+ 3. Object Code Incorporating Material from Library Header Files.
+
+ The object code form of an Application may incorporate material from
+a header file that is part of the Library. You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+ a) Give prominent notice with each copy of the object code that the
+ Library is used in it and that the Library and its use are
+ covered by this License.
+
+ b) Accompany the object code with a copy of the GNU GPL and this license
+ document.
+
+ 4. Combined Works.
+
+ You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+ a) Give prominent notice with each copy of the Combined Work that
+ the Library is used in it and that the Library and its use are
+ covered by this License.
+
+ b) Accompany the Combined Work with a copy of the GNU GPL and this license
+ document.
+
+ c) For a Combined Work that displays copyright notices during
+ execution, include the copyright notice for the Library among
+ these notices, as well as a reference directing the user to the
+ copies of the GNU GPL and this license document.
+
+ d) Do one of the following:
+
+ 0) Convey the Minimal Corresponding Source under the terms of this
+ License, and the Corresponding Application Code in a form
+ suitable for, and under terms that permit, the user to
+ recombine or relink the Application with a modified version of
+ the Linked Version to produce a modified Combined Work, in the
+ manner specified by section 6 of the GNU GPL for conveying
+ Corresponding Source.
+
+ 1) Use a suitable shared library mechanism for linking with the
+ Library. A suitable mechanism is one that (a) uses at run time
+ a copy of the Library already present on the user's computer
+ system, and (b) will operate properly with a modified version
+ of the Library that is interface-compatible with the Linked
+ Version.
+
+ e) Provide Installation Information, but only if you would otherwise
+ be required to provide such information under section 6 of the
+ GNU GPL, and only to the extent that such information is
+ necessary to install and execute a modified version of the
+ Combined Work produced by recombining or relinking the
+ Application with a modified version of the Linked Version. (If
+ you use option 4d0, the Installation Information must accompany
+ the Minimal Corresponding Source and Corresponding Application
+ Code. If you use option 4d1, you must provide the Installation
+ Information in the manner specified by section 6 of the GNU GPL
+ for conveying Corresponding Source.)
+
+ 5. Combined Libraries.
+
+ You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+ a) Accompany the combined library with a copy of the same work based
+ on the Library, uncombined with any other library facilities,
+ conveyed under the terms of this License.
+
+ b) Give prominent notice with the combined library that part of it
+ is a work based on the Library, and explaining where to find the
+ accompanying uncombined form of the same work.
+
+ 6. Revised Versions of the GNU Lesser General Public License.
+
+ The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+ Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+ If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.
diff --git a/tools/lib/luo/Makefile b/tools/lib/luo/Makefile
new file mode 100644
index 000000000000..e851c37d3d0a
--- /dev/null
+++ b/tools/lib/luo/Makefile
@@ -0,0 +1,37 @@
+# SPDX-License-Identifier: LGPL-3.0-or-later
+SRCS = libluo.c
+OBJS = $(SRCS:.c=.o)
+INCLUDE_DIR = include
+HEADERS = $(wildcard $(INCLUDE_DIR)/*.h)
+
+CC = gcc
+AR = ar
+CFLAGS = -Wall -Wextra -fPIC -O2 -g -I$(INCLUDE_DIR)
+LDFLAGS = -shared
+
+LIB_NAME = libluo
+STATIC_LIB = $(LIB_NAME).a
+SHARED_LIB = $(LIB_NAME).so
+
+.PHONY: all clean install
+
+all: $(STATIC_LIB) $(SHARED_LIB)
+
+$(STATIC_LIB): $(OBJS)
+ $(AR) rcs $@ $^
+
+$(SHARED_LIB): $(OBJS)
+ $(CC) $(LDFLAGS) -o $@ $^
+
+%.o: %.c $(HEADERS)
+ $(CC) $(CFLAGS) -c $< -o $@
+
+clean:
+ rm -f $(OBJS) $(STATIC_LIB) $(SHARED_LIB)
+
+install: all
+ install -d $(DESTDIR)/usr/local/lib
+ install -d $(DESTDIR)/usr/local/include
+ install -m 644 $(STATIC_LIB) $(DESTDIR)/usr/local/lib
+ install -m 755 $(SHARED_LIB) $(DESTDIR)/usr/local/lib
+ install -m 644 $(HEADERS) $(DESTDIR)/usr/local/include
diff --git a/tools/lib/luo/README.md b/tools/lib/luo/README.md
new file mode 100644
index 000000000000..a716ccb2992c
--- /dev/null
+++ b/tools/lib/luo/README.md
@@ -0,0 +1,166 @@
+# LibLUO - Live Update Orchestrator Library
+
+A C library for interacting with the Linux Live Update Orchestrator (LUO) subsystem.
+
+## Overview
+
+LibLUO provides a set of APIs for applications to interact with LUO, avoiding
+the need to directly calling the LUO ioctls. It provides APIs for controlling
+the LUO state and preserve and restore file descriptors across live updates.
+
+## Features
+
+- Initialize and manage connection to the LUO device.
+- Preserve file descriptors before a live update.
+- Restore file descriptors after a live update.
+- Control the live update state machine (prepare, cancel, finish).
+- Query the current state of the LUO subsystem.
+- The library also includes a test suite for testing both LibLUO and the kernel
+ LUO interface.
+
+## Building
+
+```bash
+make
+```
+
+This will build both static (`libluo.a`) and shared (`libluo.so`) versions of the library.
+
+To build the tests, do
+
+``` bash
+make tests
+```
+
+This will build the `tests/test` binary.
+
+## Installation
+
+```bash
+sudo make install
+```
+
+This will install the library to `/usr/local/lib` and the header file to `/usr/local/include`.
+
+## Usage
+
+### Preserving a file descriptor
+
+```c
+#include <libluo.h>
+#include <stdio.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+int main() {
+ int ret;
+ uint64_t token;
+ int fd, new_fd;
+ enum luo_state state;
+
+ // Initialize the library
+ ret = luo_init();
+ if (ret < 0) {
+ fprintf(stderr, "Failed to initialize LibLUO: %d\n", ret);
+ return 1;
+ }
+
+ // Check if LUO is available
+ if (!luo_is_available()) {
+ fprintf(stderr, "LUO is not available on this system\n");
+ return 1;
+ }
+
+ // Get the current LUO state
+ ret = luo_get_state(&state);
+ if (ret < 0) {
+ fprintf(stderr, "Failed to get LUO state: %d\n", ret);
+ luo_cleanup();
+ return 1;
+ }
+
+ printf("Current LUO state: %s\n", luo_state_to_string(state));
+
+ // Open a file descriptor to preserve
+ fd = memfd_create("luo_memfd", 0);
+ if (fd < 0) {
+ perror("Failed to open memfd");
+ luo_cleanup();
+ return 1;
+ }
+
+ // Preserve the file descriptor
+ ret = luo_fd_preserve(fd, &token);
+ if (ret < 0) {
+ fprintf(stderr, "Failed to preserve FD: %d\n", ret);
+ close(fd);
+ luo_cleanup();
+ return 1;
+ }
+
+ printf("FD %d preserved with token %lu\n", fd, token);
+
+ // After a live update, restore the file descriptor
+ if (state == LUO_STATE_UPDATED) {
+ ret = luo_fd_restore(token, &new_fd);
+ if (ret < 0) {
+ fprintf(stderr, "Failed to restore FD: %d\n", ret);
+ } else {
+ printf("FD restored: %d\n", new_fd);
+ close(new_fd);
+ }
+
+ // Signal completion of restoration
+ luo_finish();
+ }
+
+ close(fd);
+ luo_cleanup();
+ return 0;
+}
+```
+
+### Controlling the Live Update Process
+
+```c
+#include <libluo.h>
+#include <stdio.h>
+
+int main() {
+ int ret;
+
+ ret = luo_init();
+ if (ret < 0) {
+ return 1;
+ }
+
+ // Initiate the preparation phase
+ ret = luo_prepare();
+ if (ret < 0) {
+ fprintf(stderr, "Failed to prepare for live update: %d\n", ret);
+ luo_cleanup();
+ return 1;
+ }
+
+ // At this point, the system is ready for kexec reboot
+ // The freeze operation is handled internally by the kernel
+ // during kexec.
+
+ // After reboot, in the new kernel
+ // Signal completion of restoration
+ ret = luo_finish();
+ if (ret < 0) {
+ fprintf(stderr, "Failed to finish live update: %d\n", ret);
+ luo_cleanup();
+ return 1;
+ }
+
+ luo_cleanup();
+ return 0;
+}
+```
+
+## License
+
+This library is provided under the terms of the GNU Lesser General Public
+License version 3.0, or (at your option) any later version.
diff --git a/tools/lib/luo/include/libluo.h b/tools/lib/luo/include/libluo.h
new file mode 100644
index 000000000000..86b277e8e4f6
--- /dev/null
+++ b/tools/lib/luo/include/libluo.h
@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: LGPL-3.0-or-later
+/**
+ * @file libluo.h
+ * @brief Library for interacting with the Linux Live Update Orchestrator (LUO)
+ *
+ * This library provides a simple interface for applications to interact with
+ * the Linux Live Update Orchestrator (LUO) subsystem, allowing them to preserve
+ * and restore file descriptors across live kernel updates.
+ *
+ * Copyright (C) 2025 Amazon.com Inc. or its affiliates.
+ * Author: Pratyush Yadav <ptyadav@amazon.de>
+ */
+
+#ifndef _LIBLUO_H
+#define _LIBLUO_H
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <liveupdate.h>
+
+/**
+ * @brief Initialize the LUO library
+ *
+ * Opens the LUO device file and prepares the library for use.
+ *
+ * @return 0 on success, negative error code on failure
+ */
+int luo_init(void);
+
+/**
+ * @brief Clean up and release resources used by the LUO library
+ *
+ * Closes the LUO device file and releases any resources allocated by the
+ * library.
+ */
+void luo_cleanup(void);
+
+/**
+ * @brief Get the current state of the LUO subsystem
+ *
+ * @param[out] state Pointer to store the current LUO state
+ * @return 0 on success, negative error code on failure
+ */
+int luo_get_state(enum liveupdate_state *state);
+
+/**
+ * @brief Preserve a file descriptor for restoration after a live update
+ *
+ * Marks the specified file descriptor for preservation across a live update.
+ * The kernel validates if the FD type is supported for preservation.
+ *
+ * @param[in] fd The file descriptor to preserve
+ * @param[in] token Token to associate fd with. Must be unique.
+ * @return 0 on success, negative error code on failure
+ */
+int luo_fd_preserve(int fd, uint64_t token);
+
+/**
+ * @brief Cancel preservation of a previously preserved file descriptor
+ *
+ * Removes a file descriptor from the preservation list using its token.
+ *
+ * @param[in] token The token used to preserve fd previously.
+ * @return 0 on success, negative error code on failure
+ */
+int luo_fd_unpreserve(uint64_t token);
+
+/**
+ * @brief Restore a previously preserved file descriptor
+ *
+ * Restores a file descriptor that was preserved before the live update.
+ * This must be called after the system has rebooted into the new kernel.
+ *
+ * @param[in] token The token returned by luo_fd_preserve before the update
+ * @param[out] fd Pointer to store the new file descriptor
+ * @return 0 on success, negative error code on failure
+ */
+int luo_fd_restore(uint64_t token, int *fd);
+
+/**
+ * @brief Initiate the preparation phase for a live update
+ *
+ * Triggers the PREPARE phase in the LUO subsystem, which begins the
+ * state saving process for items marked for preservation.
+ *
+ * @return 0 on success, negative error code on failure
+ */
+int luo_prepare(void);
+
+/**
+ * @brief Cancel the live update preparation phase
+ *
+ * Aborts the preparation sequence and returns the system to normal state.
+ *
+ * @return 0 on success, negative error code on failure
+ */
+int luo_cancel(void);
+
+/**
+ * @brief Signal completion of restoration after a live update
+ *
+ * Notifies the LUO subsystem that all necessary restoration actions
+ * have been completed in the new kernel.
+ *
+ * @return 0 on success, negative error code on failure
+ */
+int luo_finish(void);
+
+/**
+ * @brief Check if the LUO subsystem is available
+ *
+ * Tests if the LUO device file exists and can be opened.
+ *
+ * @return true if LUO is available, false otherwise
+ */
+bool luo_is_available(void);
+
+/**
+ * @brief Convert a liveupdate_state enum value to a string
+ *
+ * Returns a string representation of the given LUO state.
+ *
+ * @param[in] state The LUO state to convert
+ * @return A constant string representing the state
+ */
+const char *luo_state_to_string(enum liveupdate_state state);
+
+#endif /* _LIBLUO_H */
diff --git a/tools/lib/luo/include/liveupdate.h b/tools/lib/luo/include/liveupdate.h
new file mode 100644
index 000000000000..7b12a1073c3c
--- /dev/null
+++ b/tools/lib/luo/include/liveupdate.h
@@ -0,0 +1,265 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+
+/*
+ * Userspace interface for /dev/liveupdate
+ * Live Update Orchestrator
+ *
+ * Copyright (c) 2025, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+#ifndef _UAPI_LIVEUPDATE_H
+#define _UAPI_LIVEUPDATE_H
+
+#include <linux/ioctl.h>
+#include <linux/types.h>
+
+/**
+ * enum liveupdate_state - Defines the possible states of the live update
+ * orchestrator.
+ * @LIVEUPDATE_STATE_UNDEFINED: State has not yet been initialized.
+ * @LIVEUPDATE_STATE_NORMAL: Default state, no live update in progress.
+ * @LIVEUPDATE_STATE_PREPARED: Live update is prepared for reboot; the
+ * LIVEUPDATE_PREPARE callbacks have completed
+ * successfully.
+ * Devices might operate in a limited state
+ * for example the participating devices might
+ * not be allowed to unbind, and also the
+ * setting up of new DMA mappings might be
+ * disabled in this state.
+ * @LIVEUPDATE_STATE_FROZEN: The final reboot event
+ * (%LIVEUPDATE_FREEZE) has been sent, and the
+ * system is performing its final state saving
+ * within the "blackout window". User
+ * workloads must be suspended. The actual
+ * reboot (kexec) into the next kernel is
+ * imminent.
+ * @LIVEUPDATE_STATE_UPDATED: The system has rebooted into the next
+ * kernel via live update the system is now
+ * running the next kernel, awaiting the
+ * finish event.
+ *
+ * These states track the progress and outcome of a live update operation.
+ */
+enum liveupdate_state {
+ LIVEUPDATE_STATE_UNDEFINED = 0,
+ LIVEUPDATE_STATE_NORMAL = 1,
+ LIVEUPDATE_STATE_PREPARED = 2,
+ LIVEUPDATE_STATE_FROZEN = 3,
+ LIVEUPDATE_STATE_UPDATED = 4,
+};
+
+/**
+ * struct liveupdate_fd - Holds parameters for preserving and restoring file
+ * descriptors across live update.
+ * @fd: Input for %LIVEUPDATE_IOCTL_FD_PRESERVE: The user-space file
+ * descriptor to be preserved.
+ * Output for %LIVEUPDATE_IOCTL_FD_RESTORE: The new file descriptor
+ * representing the fully restored kernel resource.
+ * @flags: Unused, reserved for future expansion, must be set to 0.
+ * @token: Input for %LIVEUPDATE_IOCTL_FD_PRESERVE: An opaque, unique token
+ * preserved for preserved resource.
+ * Input for %LIVEUPDATE_IOCTL_FD_RESTORE: The token previously
+ * provided to the preserve ioctl for the resource to be restored.
+ *
+ * This structure is used as the argument for the %LIVEUPDATE_IOCTL_FD_PRESERVE
+ * and %LIVEUPDATE_IOCTL_FD_RESTORE ioctls. These ioctls allow specific types
+ * of file descriptors (for example memfd, kvm, iommufd, and VFIO) to have their
+ * underlying kernel state preserved across a live update cycle.
+ *
+ * To preserve an FD, user space passes this struct to
+ * %LIVEUPDATE_IOCTL_FD_PRESERVE with the @fd field set. On success, the
+ * kernel uses the @token field to uniquly associate the preserved FD.
+ *
+ * After the live update transition, user space passes the struct populated with
+ * the *same* @token to %LIVEUPDATE_IOCTL_FD_RESTORE. The kernel uses the @token
+ * to find the preserved state and, on success, populates the @fd field with a
+ * new file descriptor referring to the restored resource.
+ */
+struct liveupdate_fd {
+ int fd;
+ __u32 flags;
+ __aligned_u64 token;
+};
+
+/* The ioctl type, documented in ioctl-number.rst */
+#define LIVEUPDATE_IOCTL_TYPE 0xBA
+
+/**
+ * LIVEUPDATE_IOCTL_FD_PRESERVE - Validate and initiate preservation for a file
+ * descriptor.
+ *
+ * Argument: Pointer to &struct liveupdate_fd.
+ *
+ * User sets the @fd field identifying the file descriptor to preserve
+ * (e.g., memfd, kvm, iommufd, VFIO). The kernel validates if this FD type
+ * and its dependencies are supported for preservation. If validation passes,
+ * the kernel marks the FD internally and *initiates the process* of preparing
+ * its state for saving. The actual snapshotting of the state typically occurs
+ * during the subsequent %LIVEUPDATE_IOCTL_PREPARE execution phase, though
+ * some finalization might occur during freeze.
+ * On successful validation and initiation, the kernel uses the @token
+ * field with an opaque identifier representing the resource being preserved.
+ * This token confirms the FD is targeted for preservation and is required for
+ * the subsequent %LIVEUPDATE_IOCTL_FD_RESTORE call after the live update.
+ *
+ * Return: 0 on success (validation passed, preservation initiated), negative
+ * error code on failure (e.g., unsupported FD type, dependency issue,
+ * validation failed).
+ */
+#define LIVEUPDATE_IOCTL_FD_PRESERVE \
+ _IOW(LIVEUPDATE_IOCTL_TYPE, 0x00, struct liveupdate_fd)
+
+/**
+ * LIVEUPDATE_IOCTL_FD_UNPRESERVE - Remove a file descriptor from the
+ * preservation list.
+ *
+ * Argument: Pointer to __u64 token.
+ *
+ * Allows user space to explicitly remove a file descriptor from the set of
+ * items marked as potentially preservable. User space provides a pointer to the
+ * __u64 @token that was previously returned by a successful
+ * %LIVEUPDATE_IOCTL_FD_PRESERVE call (potentially from a prior, possibly
+ * cancelled, live update attempt). The kernel reads the token value from the
+ * provided user-space address.
+ *
+ * On success, the kernel removes the corresponding entry (identified by the
+ * token value read from the user pointer) from its internal preservation list.
+ * The provided @token (representing the now-removed entry) becomes invalid
+ * after this call.
+ *
+ * Return: 0 on success, negative error code on failure (e.g., -EBUSY or -EINVAL
+ * if not in %LIVEUPDATE_STATE_NORMAL, bad address provided, invalid token value
+ * read, token not found).
+ */
+#define LIVEUPDATE_IOCTL_FD_UNPRESERVE \
+ _IOW(LIVEUPDATE_IOCTL_TYPE, 0x01, __u64)
+
+/**
+ * LIVEUPDATE_IOCTL_FD_RESTORE - Restore a previously preserved file descriptor.
+ *
+ * Argument: Pointer to &struct liveupdate_fd.
+ *
+ * User sets the @token field to the value obtained from a successful
+ * %LIVEUPDATE_IOCTL_FD_PRESERVE call before the live update. On success,
+ * the kernel restores the state (saved during the PREPARE/FREEZE phases)
+ * associated with the token and populates the @fd field with a new file
+ * descriptor referencing the restored resource in the current (new) kernel.
+ * This operation must be performed *before* signaling completion via
+ * %LIVEUPDATE_IOCTL_FINISH.
+ *
+ * Return: 0 on success, negative error code on failure (e.g., invalid token).
+ */
+#define LIVEUPDATE_IOCTL_FD_RESTORE \
+ _IOWR(LIVEUPDATE_IOCTL_TYPE, 0x02, struct liveupdate_fd)
+
+/**
+ * LIVEUPDATE_IOCTL_GET_STATE - Query the current state of the live update
+ * orchestrator.
+ *
+ * Argument: Pointer to &enum liveupdate_state.
+ *
+ * The kernel fills the enum value pointed to by the argument with the current
+ * state of the live update subsystem. Possible states are:
+ *
+ * - %LIVEUPDATE_STATE_NORMAL: Default state; no live update operation is
+ * currently in progress.
+ * - %LIVEUPDATE_STATE_PREPARED: The preparation phase (triggered by
+ * %LIVEUPDATE_IOCTL_PREPARE) has completed
+ * successfully. The system is ready for the
+ * reboot transition. Note that some
+ * device operations (e.g., unbinding, new DMA
+ * mappings) might be restricted in this state.
+ * - %LIVEUPDATE_STATE_UPDATED: The system has successfully rebooted into the
+ * new kernel via live update. It is now running
+ * the new kernel code and is awaiting the
+ * completion signal from user space via
+ * %LIVEUPDATE_IOCTL_FINISH after
+ * restoration tasks are done.
+ *
+ * See the definition of &enum liveupdate_state for more details on each state.
+ *
+ * Return: 0 on success, negative error code on failure.
+ */
+#define LIVEUPDATE_IOCTL_GET_STATE \
+ _IOR(LIVEUPDATE_IOCTL_TYPE, 0x03, enum liveupdate_state)
+
+/**
+ * LIVEUPDATE_IOCTL_PREPARE - Initiate preparation phase and trigger state
+ * saving.
+ *
+ * Argument: None.
+ *
+ * Initiates the live update preparation phase. This action corresponds to
+ * the internal %LIVEUPDATE_PREPARE. This typically triggers the saving process
+ * for items marked via the PRESERVE ioctls. This typically occurs *before*
+ * the "blackout window", while user applications (e.g., VMs) may still be
+ * running. Kernel subsystems receiving the %LIVEUPDATE_PREPARE event should
+ * serialize necessary state. This command does not transfer data.
+ *
+ * Return: 0 on success, negative error code on failure. Transitions state
+ * towards %LIVEUPDATE_STATE_PREPARED on success.
+ */
+#define LIVEUPDATE_IOCTL_PREPARE \
+ _IO(LIVEUPDATE_IOCTL_TYPE, 0x04)
+
+/**
+ * LIVEUPDATE_IOCTL_CANCEL - Cancel the live update preparation phase.
+ *
+ * Argument: None.
+ *
+ * Notifies the live update subsystem to abort the preparation sequence
+ * potentially initiated by %LIVEUPDATE_IOCTL_PREPARE. This action
+ * typically corresponds to the internal %LIVEUPDATE_CANCEL kernel event,
+ * which might also be triggered automatically if the PREPARE stage fails
+ * internally.
+ *
+ * When triggered, subsystems receiving the %LIVEUPDATE_CANCEL event should
+ * revert any state changes or actions taken specifically for the aborted
+ * prepare phase (e.g., discard partially serialized state). The kernel
+ * releases resources allocated specifically for this *aborted preparation
+ * attempt*.
+ *
+ * This operation cancels the current *attempt* to prepare for a live update
+ * but does **not** remove previously validated items from the internal list
+ * of potentially preservable resources. Consequently, preservation tokens
+ * previously generated by successful %LIVEUPDATE_IOCTL_FD_PRESERVE or calls
+ * generally **remain valid** as identifiers for those potentially preservable
+ * resources. However, since the system state returns towards
+ * %LIVEUPDATE_STATE_NORMAL, user space must initiate a new live update sequence
+ * (starting with %LIVEUPDATE_IOCTL_PREPARE) to proceed with an update
+ * using these (or other) tokens.
+ *
+ * This command does not transfer data. Kernel callbacks for the
+ * %LIVEUPDATE_CANCEL event must not fail.
+ *
+ * Return: 0 on success, negative error code on failure. Transitions state back
+ * towards %LIVEUPDATE_STATE_NORMAL on success.
+ */
+#define LIVEUPDATE_IOCTL_CANCEL \
+ _IO(LIVEUPDATE_IOCTL_TYPE, 0x06)
+
+/**
+ * LIVEUPDATE_IOCTL_EVENT_FINISH - Signal restoration completion and trigger
+ * cleanup.
+ *
+ * Argument: None.
+ *
+ * Signals that user space has completed all necessary restoration actions in
+ * the new kernel (after a live update reboot). This action corresponds to the
+ * internal %LIVEUPDATE_FINISH kernel event. Calling this ioctl triggers the
+ * cleanup phase: any resources that were successfully preserved but were *not*
+ * subsequently restored (reclaimed) via the RESTORE ioctls will have their
+ * preserved state discarded and associated kernel resources released. Involved
+ * devices may be reset. All desired restorations *must* be completed *before*
+ * this. Kernel callbacks for the %LIVEUPDATE_FINISH event must not fail.
+ * Successfully completing this phase transitions the system state from
+ * %LIVEUPDATE_STATE_UPDATED back to %LIVEUPDATE_STATE_NORMAL. This command does
+ * not transfer data.
+ *
+ * Return: 0 on success, negative error code on failure.
+ */
+#define LIVEUPDATE_IOCTL_FINISH \
+ _IO(LIVEUPDATE_IOCTL_TYPE, 0x07)
+
+#endif /* _UAPI_LIVEUPDATE_H */
diff --git a/tools/lib/luo/libluo.c b/tools/lib/luo/libluo.c
new file mode 100644
index 000000000000..7de4bf01de16
--- /dev/null
+++ b/tools/lib/luo/libluo.c
@@ -0,0 +1,203 @@
+// SPDX-License-Identifier: LGPL-3.0-or-later
+/*
+ * Copyright (C) 2025 Amazon.com Inc. or its affiliates.
+ * Author: Pratyush Yadav <ptyadav@amazon.de>
+ */
+#include <libluo.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+
+/*
+ * The liveupdate header is not mainline right now, so it is not available on
+ * the system include path. It is copied from Linux tree and put in include/.
+ *
+ * This can be removed when liveupdate hits mainline.
+ */
+#include <liveupdate.h>
+
+#define LUO_DEVICE_PATH "/dev/liveupdate"
+
+/* File descriptor for the LUO device */
+static int luo_fd = -1;
+
+#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
+
+int luo_init(void)
+{
+ if (luo_fd >= 0)
+ /* Already initialized */
+ return 0;
+
+ luo_fd = open(LUO_DEVICE_PATH, O_RDWR);
+ if (luo_fd < 0) {
+ int err = -errno;
+
+ fprintf(stderr, "Failed to open %s: %s\n",
+ LUO_DEVICE_PATH, strerror(errno));
+ return err;
+ }
+
+ return 0;
+}
+
+void luo_cleanup(void)
+{
+ if (luo_fd >= 0) {
+ close(luo_fd);
+ luo_fd = -1;
+ }
+}
+
+bool luo_is_available(void)
+{
+ struct stat st;
+
+ /* Use stat() to check if the device file exists and is accessible */
+ if (stat(LUO_DEVICE_PATH, &st) < 0)
+ return false;
+
+ /* Verify it's a character device file. */
+ if (!S_ISCHR(st.st_mode))
+ return false;
+
+ return true;
+}
+
+int luo_get_state(enum liveupdate_state *state)
+{
+ int ret;
+
+ if (!state)
+ return -EINVAL;
+
+ if (luo_fd < 0)
+ return -EBADF;
+
+ ret = ioctl(luo_fd, LIVEUPDATE_IOCTL_GET_STATE, state);
+ if (ret < 0)
+ return -errno;
+
+ return 0;
+}
+
+int luo_fd_preserve(int fd, uint64_t token)
+{
+ struct liveupdate_fd fd_data;
+ int ret;
+
+ if (fd < 0)
+ return -EINVAL;
+
+ if (luo_fd < 0)
+ return -EBADF;
+
+ fd_data.fd = fd;
+ fd_data.flags = 0; /* Must be set to 0 as per API documentation */
+ fd_data.token = token;
+
+ ret = ioctl(luo_fd, LIVEUPDATE_IOCTL_FD_PRESERVE, &fd_data);
+ if (ret < 0)
+ return -errno;
+
+ return 0;
+}
+
+int luo_fd_unpreserve(uint64_t token)
+{
+ int ret;
+
+ if (luo_fd < 0)
+ return -EBADF;
+
+ ret = ioctl(luo_fd, LIVEUPDATE_IOCTL_FD_UNPRESERVE, &token);
+ if (ret < 0)
+ return -errno;
+
+ return 0;
+}
+
+int luo_fd_restore(uint64_t token, int *fd)
+{
+ struct liveupdate_fd fd_data;
+ int ret;
+
+ if (!fd)
+ return -EINVAL;
+
+ if (luo_fd < 0)
+ return -EBADF;
+
+ fd_data.fd = -1; /* Will be filled by the kernel */
+ fd_data.flags = 0; /* Must be set to 0 as per API documentation */
+ fd_data.token = token;
+
+ ret = ioctl(luo_fd, LIVEUPDATE_IOCTL_FD_RESTORE, &fd_data);
+ if (ret < 0)
+ return -errno;
+
+ *fd = fd_data.fd;
+ return 0;
+}
+
+int luo_prepare(void)
+{
+ int ret;
+
+ if (luo_fd < 0)
+ return -EBADF;
+
+ ret = ioctl(luo_fd, LIVEUPDATE_IOCTL_PREPARE);
+ if (ret < 0)
+ return -errno;
+
+ return 0;
+}
+
+int luo_cancel(void)
+{
+ int ret;
+
+ if (luo_fd < 0)
+ return -EBADF;
+
+ ret = ioctl(luo_fd, LIVEUPDATE_IOCTL_CANCEL);
+ if (ret < 0)
+ return -errno;
+
+ return 0;
+}
+
+int luo_finish(void)
+{
+ int ret;
+
+ if (luo_fd < 0)
+ return -EBADF;
+
+ ret = ioctl(luo_fd, LIVEUPDATE_IOCTL_FINISH);
+ if (ret < 0)
+ return -errno;
+
+ return 0;
+}
+
+const char *luo_state_to_string(enum liveupdate_state state)
+{
+ static const char * const state_strings[] = {
+ [LIVEUPDATE_STATE_UNDEFINED] = "undefined",
+ [LIVEUPDATE_STATE_NORMAL] = "normal",
+ [LIVEUPDATE_STATE_PREPARED] = "prepared",
+ [LIVEUPDATE_STATE_FROZEN] = "frozen",
+ [LIVEUPDATE_STATE_UPDATED] = "updated"
+ };
+
+ if (state >= 0 && state < ARRAY_SIZE(state_strings) && state_strings[state])
+ return state_strings[state];
+
+ return "UNKNOWN";
+}
--
2.50.0.727.gbf7dc18ff4-goog
^ permalink raw reply related
* [RFC v1 31/32] libluo: introduce luoctl
From: Pasha Tatashin @ 2025-06-25 23:18 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel
In-Reply-To: <20250625231838.1897085-1-pasha.tatashin@soleen.com>
From: Pratyush Yadav <ptyadav@amazon.de>
luoctl is a utility to interact with the LUO state machine. It currently
supports viewing and change the current state of LUO. This can be used
by scripts, tools, or developers to control LUO state during the live
update process.
Example usage:
$ luoctl state
normal
$ luoctl prepare
$ luoctl state
prepared
$ luoctl cancel
$ luoctl state
normal
Signed-off-by: Pratyush Yadav <ptyadav@amazon.de>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
tools/lib/luo/Makefile | 6 +-
tools/lib/luo/cli/.gitignore | 1 +
tools/lib/luo/cli/Makefile | 18 ++++
tools/lib/luo/cli/luoctl.c | 178 +++++++++++++++++++++++++++++++++++
4 files changed, 202 insertions(+), 1 deletion(-)
create mode 100644 tools/lib/luo/cli/.gitignore
create mode 100644 tools/lib/luo/cli/Makefile
create mode 100644 tools/lib/luo/cli/luoctl.c
diff --git a/tools/lib/luo/Makefile b/tools/lib/luo/Makefile
index e851c37d3d0a..e8f6bd3b9e85 100644
--- a/tools/lib/luo/Makefile
+++ b/tools/lib/luo/Makefile
@@ -13,7 +13,7 @@ LIB_NAME = libluo
STATIC_LIB = $(LIB_NAME).a
SHARED_LIB = $(LIB_NAME).so
-.PHONY: all clean install
+.PHONY: all clean install cli
all: $(STATIC_LIB) $(SHARED_LIB)
@@ -26,8 +26,12 @@ $(SHARED_LIB): $(OBJS)
%.o: %.c $(HEADERS)
$(CC) $(CFLAGS) -c $< -o $@
+cli: $(STATIC_LIB)
+ $(MAKE) -C cli
+
clean:
rm -f $(OBJS) $(STATIC_LIB) $(SHARED_LIB)
+ $(MAKE) -C cli clean
install: all
install -d $(DESTDIR)/usr/local/lib
diff --git a/tools/lib/luo/cli/.gitignore b/tools/lib/luo/cli/.gitignore
new file mode 100644
index 000000000000..3a5e2d287f60
--- /dev/null
+++ b/tools/lib/luo/cli/.gitignore
@@ -0,0 +1 @@
+/luoctl
diff --git a/tools/lib/luo/cli/Makefile b/tools/lib/luo/cli/Makefile
new file mode 100644
index 000000000000..6c0cbf92a420
--- /dev/null
+++ b/tools/lib/luo/cli/Makefile
@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: LGPL-3.0-or-later
+LUOCTL = luoctl
+INCLUDE_DIR = ../include
+HEADERS = $(wildcard $(INCLUDE_DIR)/*.h)
+
+CC = gcc
+CFLAGS = -Wall -Wextra -O2 -g -I$(INCLUDE_DIR)
+LDFLAGS = -L.. -l:libluo.a
+
+.PHONY: all clean
+
+all: $(LUOCTL)
+
+luoctl: luoctl.c ../libluo.a $(HEADERS)
+ $(CC) $(CFLAGS) -o $@ $< $(LDFLAGS)
+
+clean:
+ rm -f $(LUOCTL)
diff --git a/tools/lib/luo/cli/luoctl.c b/tools/lib/luo/cli/luoctl.c
new file mode 100644
index 000000000000..39ba0bdd44f0
--- /dev/null
+++ b/tools/lib/luo/cli/luoctl.c
@@ -0,0 +1,178 @@
+// SPDX-License-Identifier: LGPL-3.0-or-later
+/**
+ * @file luoctl.c
+ * @brief Simple utility to interact with LUO
+ *
+ * This utility allows viewing and controlling LUO state.
+ *
+ * Copyright (C) 2025 Amazon.com Inc. or its affiliates.
+ * Author: Pratyush Yadav <ptyadav@amazon.de>
+ */
+
+#include <libluo.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+#include <getopt.h>
+
+#define fatal(fmt, ...) \
+ do { \
+ fprintf(stderr, "Error: " fmt, ##__VA_ARGS__); \
+ exit(1); \
+ } while (0)
+
+struct command {
+ char *name;
+ int (*handler)(void);
+};
+
+static void usage(const char *prog_name)
+{
+ printf("Usage: %s [command]\n\n", prog_name);
+ printf("Commands:\n");
+ printf(" state - Show current LUO state\n");
+ printf(" prepare - Prepare for live update\n");
+ printf(" cancel - Cancel live update preparation\n");
+ printf(" finish - Signal completion of restoration\n");
+}
+
+static enum liveupdate_state get_state(void)
+{
+ enum liveupdate_state state;
+ int ret;
+
+ ret = luo_get_state(&state);
+ if (ret)
+ fatal("failed to get LUO state: %s\n", strerror(-ret));
+
+ return state;
+}
+
+static int show_state(void)
+{
+ enum liveupdate_state state;
+
+ state = get_state();
+ printf("%s\n", luo_state_to_string(state));
+ return 0;
+}
+
+static int do_prepare(void)
+{
+ enum liveupdate_state state;
+ int ret;
+
+ state = get_state();
+ if (state != LIVEUPDATE_STATE_NORMAL)
+ fatal("can only switch to prepared state from normal state. Current state: %s\n",
+ luo_state_to_string(state));
+
+ ret = luo_prepare();
+ if (ret)
+ fatal("failed to prepare for live update: %s\n", strerror(-ret));
+
+ return 0;
+}
+
+static int do_cancel(void)
+{
+ enum liveupdate_state state;
+ int ret;
+
+ state = get_state();
+ if (state != LIVEUPDATE_STATE_PREPARED)
+ fatal("can only cancel from normal state. Current state: %s\n",
+ luo_state_to_string(state));
+
+ ret = luo_cancel();
+ if (ret)
+ fatal("failed to cancel live update: %s\n", strerror(-ret));
+
+ return 0;
+}
+
+static int do_finish(void)
+{
+ enum liveupdate_state state;
+ int ret;
+
+ state = get_state();
+ if (state != LIVEUPDATE_STATE_UPDATED)
+ fatal("can only finish from updated state. Current state: %s\n",
+ luo_state_to_string(state));
+
+ ret = luo_finish();
+ if (ret)
+ fatal("failed to finish live update: %s\n", strerror(-ret));
+
+ return 0;
+}
+
+static struct command commands[] = {
+ {"state", show_state},
+ {"prepare", do_prepare},
+ {"cancel", do_cancel},
+ {"finish", do_finish},
+ {NULL, NULL},
+};
+
+int main(int argc, char *argv[])
+{
+ struct option long_options[] = {
+ {"help", no_argument, 0, 'h'},
+ {0, 0, 0, 0}
+ };
+ struct command *command;
+ int ret = -EINVAL, opt;
+ char *cmd;
+
+ if (!luo_is_available()) {
+ fprintf(stderr, "LUO is not available on this system\n");
+ return 1;
+ }
+
+ while ((opt = getopt_long(argc, argv, "ht:e:", long_options, NULL)) != -1) {
+ switch (opt) {
+ case 'h':
+ usage(argv[0]);
+ return 0;
+ default:
+ fprintf(stderr, "Try '%s --help' for more information.\n", argv[0]);
+ return 1;
+ }
+ }
+
+ if (argc - optind != 1) {
+ usage(argv[0]);
+ return 1;
+ }
+
+ cmd = argv[optind];
+
+ ret = luo_init();
+ if (ret < 0) {
+ fprintf(stderr, "Failed to initialize LibLUO: %s\n", strerror(-ret));
+ return 1;
+ }
+
+ command = &commands[0];
+ while (command->name) {
+ if (!strcmp(cmd, command->name)) {
+ ret = command->handler();
+ break;
+ }
+ command++;
+ }
+
+ if (!command->name) {
+ fprintf(stderr, "Unknown command %s. Try '%s --help' for more information\n",
+ cmd, argv[0]);
+ ret = -EINVAL;
+ }
+
+ luo_cleanup();
+ return (ret < 0) ? 1 : 0;
+}
--
2.50.0.727.gbf7dc18ff4-goog
^ permalink raw reply related
* [RFC v1 32/32] libluo: add tests
From: Pasha Tatashin @ 2025-06-25 23:18 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel
In-Reply-To: <20250625231838.1897085-1-pasha.tatashin@soleen.com>
From: Pratyush Yadav <ptyadav@amazon.de>
Add a test suite for libluo itself, and for the kernel LUO interface.
The below tests are added:
1. init - Tests the initialization and cleanup functions of libluo.
2. state - Tests the luo_get_state() API, which in turn tests the
LIVEUPDATE_IOCTL_GET_STATE ioctl
3. preserve - Creates a memfd, preserves it, puts LUO in prepared state,
cancels liveupdate, and makes sure memfd is functional.
4. prepared - Puts a memfd in LUO enters prepared state. Then it
makes sure the memfd stays functional but remains in restricted mode. It
makes sure the memfd can't grow or shrink, but can be read from or
written to.
5. transitions - Tests transitions from normal to prepared to cancel
state work.
6. error - Tests error handling of the library on invalid inputs.
7. kexec - Tests the main functionality of LUO -- preserving a FD over
kexec. It creates a memfd with random data, saves the data to a file on
disk, and then preserves the FD and goes into prepared state. Now the
test runner must perform a kexec. Once rebooted, running the test again
resumes the test. It fetches the memfd back, nd compares its content
with the saved data on disk.
A specific test can be selected or excluded uring the -t or -e arguments.
Sample run:
$ ./test
LibLUO Test Suite
=================
Testing initialization and cleanup... PASSED
Testing get_state... PASSED (current state: normal)
Testing state transitions... PASSED
Testing fd_preserve with freeze and cancel... PASSED
Testing operations on prepared memfd... PASSED
Testing error handling... PASSED
Testing fd preserve for kexec... READY FOR KEXEC (token: 3)
Run kexec now and then run this test again to complete.
All requested tests completed.
Signed-off-by: Pratyush Yadav <ptyadav@amazon.de>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
tools/lib/luo/Makefile | 4 +
tools/lib/luo/tests/.gitignore | 1 +
tools/lib/luo/tests/Makefile | 18 +
tools/lib/luo/tests/test.c | 848 +++++++++++++++++++++++++++++++++
4 files changed, 871 insertions(+)
create mode 100644 tools/lib/luo/tests/.gitignore
create mode 100644 tools/lib/luo/tests/Makefile
create mode 100644 tools/lib/luo/tests/test.c
diff --git a/tools/lib/luo/Makefile b/tools/lib/luo/Makefile
index e8f6bd3b9e85..ef4c489efcc5 100644
--- a/tools/lib/luo/Makefile
+++ b/tools/lib/luo/Makefile
@@ -29,9 +29,13 @@ $(SHARED_LIB): $(OBJS)
cli: $(STATIC_LIB)
$(MAKE) -C cli
+tests: $(STATIC_LIB)
+ $(MAKE) -C tests
+
clean:
rm -f $(OBJS) $(STATIC_LIB) $(SHARED_LIB)
$(MAKE) -C cli clean
+ $(MAKE) -C tests clean
install: all
install -d $(DESTDIR)/usr/local/lib
diff --git a/tools/lib/luo/tests/.gitignore b/tools/lib/luo/tests/.gitignore
new file mode 100644
index 000000000000..ee4c92682341
--- /dev/null
+++ b/tools/lib/luo/tests/.gitignore
@@ -0,0 +1 @@
+/test
diff --git a/tools/lib/luo/tests/Makefile b/tools/lib/luo/tests/Makefile
new file mode 100644
index 000000000000..7f4689722ff6
--- /dev/null
+++ b/tools/lib/luo/tests/Makefile
@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: LGPL-3.0-or-later
+TESTS = test
+INCLUDE_DIR = ../include
+HEADERS = $(wildcard $(INCLUDE_DIR)/*.h)
+
+CC = gcc
+CFLAGS = -Wall -Wextra -O2 -g -I$(INCLUDE_DIR)
+LDFLAGS = -L.. -l:libluo.a
+
+.PHONY: all clean
+
+all: $(TESTS)
+
+test: test.c ../libluo.a $(HEADERS)
+ $(CC) $(CFLAGS) -o $@ $< $(LDFLAGS)
+
+clean:
+ rm -f $(TESTS)
diff --git a/tools/lib/luo/tests/test.c b/tools/lib/luo/tests/test.c
new file mode 100644
index 000000000000..7963ae8ebadf
--- /dev/null
+++ b/tools/lib/luo/tests/test.c
@@ -0,0 +1,848 @@
+// SPDX-License-Identifier: LGPL-3.0-or-later
+#define _GNU_SOURCE
+/**
+ * @file test.c
+ * @brief Test program for the LibLUO library
+ *
+ * This program tests the basic functionality of the LibLUO library.
+ *
+ * Copyright (C) 2025 Amazon.com Inc. or its affiliates.
+ * Author: Pratyush Yadav <ptyadav@amazon.de>
+ */
+
+#include <libluo.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <errno.h>
+#include <sys/mman.h>
+#include <getopt.h>
+
+/* Path to store token for kexec test */
+#define TOKEN_FILE "libluo_test_token"
+#define TEST_DATA_FILE "libluo_test_data"
+#define MEMFD_NAME "libluo_test_memfd"
+
+/* Size of the random data buffer (1 MiB) */
+#define RANDOM_BUFFER_SIZE (1 << 20)
+static char random_buffer[RANDOM_BUFFER_SIZE];
+
+/* Test IDs */
+#define TEST_INIT_CLEANUP (1 << 0)
+#define TEST_GET_STATE (1 << 1)
+#define TEST_FD_PRESERVE (1 << 2)
+#define TEST_ERROR_HANDLING (1 << 3)
+#define TEST_FD_KEXEC (1 << 4)
+#define TEST_FD_PREPARED (1 << 5)
+#define TEST_STATE_TRANSITIONS (1 << 6)
+#define TEST_ALL (TEST_INIT_CLEANUP | TEST_GET_STATE | \
+ TEST_FD_PRESERVE | TEST_ERROR_HANDLING | \
+ TEST_FD_KEXEC | TEST_FD_PREPARED | \
+ TEST_STATE_TRANSITIONS)
+
+/*
+ * luo_fd_preserve() needs a unique token. Generate a monotonically increasing
+ * token.
+ */
+static uint64_t next_token()
+{
+ static uint64_t token = 0;
+
+ return token++;
+}
+
+/* Read exactly specified size from fd. Any less results in error. */
+static int read_size(int fd, char *buffer, size_t size)
+{
+ size_t remain = size;
+ ssize_t bytes_read;
+
+ while (remain) {
+ bytes_read = read(fd, buffer, remain);
+ if (bytes_read == 0)
+ return -ENODATA;
+ if (bytes_read < 0)
+ return -errno;
+
+ remain -= bytes_read;
+ }
+
+ return 0;
+}
+
+/* Write exactly specified size from fd. Any less results in error. */
+static int write_size(int fd, const char *buffer, size_t size)
+{
+ size_t remain = size;
+ ssize_t written;
+
+ while (remain) {
+ written = write(fd, buffer, remain);
+ if (written == 0)
+ return -EIO;
+ if (written < 0)
+ return -errno;
+
+ remain -= written;
+ }
+
+ return 0;
+}
+
+static int generate_random_data(char *buffer, size_t size)
+{
+ int fd, ret;
+
+ fd = open("/dev/urandom", O_RDONLY);
+ if (fd < 0)
+ return -errno;
+
+ ret = read_size(fd, buffer, size);
+ close(fd);
+ return ret;
+}
+
+static int save_test_data(const char *buffer, size_t size)
+{
+ int fd, ret;
+
+ fd = open(TEST_DATA_FILE, O_RDWR);
+ if (fd < 0)
+ return -errno;
+
+ ret = write_size(fd, buffer, size);
+ close(fd);
+ return ret;
+}
+
+static int load_test_data(char *buffer, size_t size)
+{
+ int fd, ret;
+
+ fd = open(TEST_DATA_FILE, O_RDONLY);
+ if (fd < 0)
+ return -errno;
+
+ ret = read_size(fd, buffer, size);
+ close(fd);
+ return ret;
+}
+
+/* Create and initialize a memfd with random data. */
+static int create_test_fd(const char *memfd_name, char *buffer, size_t size)
+{
+ int fd;
+ int ret;
+
+ fd = memfd_create(memfd_name, 0);
+ if (fd < 0)
+ return -errno;
+
+ ret = generate_random_data(buffer, size);
+ if (ret < 0) {
+ close(fd);
+ return ret;
+ }
+
+ if (write_size(fd, buffer, size) < 0) {
+ close(fd);
+ return -errno;
+ }
+
+ /* Reset file position to beginning */
+ if (lseek(fd, 0, SEEK_SET) < 0) {
+ close(fd);
+ return -errno;
+ }
+
+ return fd;
+}
+
+/*
+ * Make sure fd contains expected data up to size. Returns 0 on success, 1 on
+ * data mismatch, -errno on error.
+ */
+static int verify_fd_content(int fd, const char *expected_data, size_t size)
+{
+ char buffer[size];
+ int ret;
+
+ /* Reset file position to beginning */
+ if (lseek(fd, 0, SEEK_SET) < 0)
+ return -errno;
+
+ ret = read_size(fd, buffer, size);
+ if (ret < 0)
+ return ret;
+
+ if (memcmp(buffer, expected_data, size) != 0)
+ return 1;
+
+ return 0;
+}
+
+/* Save token to file for kexec test. */
+static int save_token(uint64_t token)
+{
+ FILE *file = fopen(TOKEN_FILE, "w");
+
+ if (!file)
+ return -errno;
+
+ if (fprintf(file, "%lu", token) < 0) {
+ fclose(file);
+ return -errno;
+ }
+
+ fclose(file);
+ return 0;
+}
+
+/* Load token from file for kexec test. */
+static int load_token(uint64_t *token)
+{
+ FILE *file = fopen(TOKEN_FILE, "r");
+
+ if (!file)
+ return -errno;
+
+ if (fscanf(file, "%lu", token) != 1) {
+ fclose(file);
+ return -EINVAL;
+ }
+
+ fclose(file);
+ return 0;
+}
+
+/* Test initialization and cleanup */
+static void test_init_cleanup(void)
+{
+ int ret;
+
+ printf("Testing initialization and cleanup... ");
+
+ ret = luo_init();
+ if (ret < 0) {
+ printf("FAILED (init: %s)\n", strerror(-ret));
+ return;
+ }
+
+ luo_cleanup();
+ printf("PASSED\n");
+}
+
+/* Test getting LUO state */
+static void test_get_state(void)
+{
+ int ret;
+ enum liveupdate_state state;
+
+ printf("Testing get_state... ");
+
+ ret = luo_init();
+ if (ret < 0) {
+ printf("FAILED (init: %s)\n", strerror(-ret));
+ return;
+ }
+
+ ret = luo_get_state(&state);
+ if (ret < 0) {
+ printf("FAILED (get_state: %s)\n", strerror(-ret));
+ luo_cleanup();
+ return;
+ }
+
+ printf("PASSED (current state: %s)\n", luo_state_to_string(state));
+ luo_cleanup();
+}
+
+/* Test preserving and unpreserving a file descriptor with prepare and cancel */
+static void test_fd_preserve_unpreserve(void)
+{
+ uint64_t token = next_token();
+ int ret, fd = -1;
+
+ printf("Testing fd_preserve with freeze and cancel... ");
+
+ ret = luo_init();
+ if (ret < 0) {
+ printf("FAILED (init: %s)\n", strerror(-ret));
+ return;
+ }
+
+ fd = create_test_fd(MEMFD_NAME, random_buffer, sizeof(random_buffer));
+ if (fd < 0) {
+ ret = fd;
+ printf("FAILED (create_test_fd: %s)\n", strerror(-ret));
+ goto out_cleanup;
+ }
+
+ ret = luo_fd_preserve(fd, token);
+ if (ret < 0) {
+ printf("FAILED (preserve: %s)\n", strerror(-ret));
+ goto out_close_fd;
+ }
+
+ ret = luo_prepare();
+ if (ret < 0) {
+ printf("FAILED (prepare: %s)\n", strerror(-ret));
+ goto out_unpreserve;
+ }
+
+ ret = luo_cancel();
+ if (ret < 0) {
+ printf("FAILED (cancel: %s)\n", strerror(-ret));
+ goto out_unpreserve;
+ }
+
+ ret = luo_fd_unpreserve(token);
+ if (ret < 0) {
+ printf("FAILED (unpreserve: %s)\n", strerror(-ret));
+ goto out_close_fd;
+ }
+
+ ret = verify_fd_content(fd, random_buffer, sizeof(random_buffer));
+ if (ret < 0) {
+ printf("FAILED (verify_fd_content: %s)\n",
+ ret == 1 ? "data mismatch" : strerror(-ret));
+ goto out_close_fd;
+ }
+
+ printf("PASSED\n");
+ goto out_close_fd;
+
+out_unpreserve:
+ luo_fd_unpreserve(token);
+out_close_fd:
+ close(fd);
+out_cleanup:
+ luo_cleanup();
+}
+
+/* Test error handling with invalid inputs. */
+static void test_error_handling(void)
+{
+ int ret;
+
+ printf("Testing error handling... ");
+
+ ret = luo_init();
+ if (ret < 0) {
+ printf("FAILED (init: %s)\n", strerror(-ret));
+ return;
+ }
+
+ /* Test with invalid file descriptor */
+ ret = luo_fd_preserve(-1, next_token());
+ if (ret != -EINVAL) {
+ printf("FAILED (expected EINVAL for invalid fd, got %d)\n", ret);
+ luo_cleanup();
+ return;
+ }
+
+ /* Test with NULL state pointer */
+ ret = luo_get_state(NULL);
+ if (ret != -EINVAL) {
+ printf("FAILED (expected EINVAL for NULL state, got %d)\n", ret);
+ luo_cleanup();
+ return;
+ }
+
+ luo_cleanup();
+ printf("PASSED\n");
+}
+
+/* Test preserving a file descriptor for kexec reboot */
+static void test_fd_preserve_for_kexec(void)
+{
+ enum liveupdate_state state;
+ int fd = -1, ret;
+ uint64_t token;
+
+ ret = luo_init();
+ if (ret < 0) {
+ printf("FAILED (init: %s)\n", strerror(-ret));
+ return;
+ }
+
+ /* Check if we're in post-kexec state */
+ ret = luo_get_state(&state);
+ if (ret < 0) {
+ printf("FAILED (get_state: %s)\n", strerror(-ret));
+ goto out_cleanup;
+ }
+
+ if (state == LIVEUPDATE_STATE_UPDATED) {
+ /* Post-kexec: restore the file descriptor */
+ printf("Testing memfd restore after kexec... ");
+
+ ret = load_token(&token);
+ if (ret < 0) {
+ printf("FAILED (load_token: %s)\n", strerror(-ret));
+ goto out_cleanup;
+ }
+
+ ret = load_test_data(random_buffer, RANDOM_BUFFER_SIZE);
+ if (ret < 0) {
+ printf("FAILED (load_test_data: %s)\n", strerror(-ret));
+ goto out_cleanup;
+ }
+
+ ret = luo_fd_restore(token, &fd);
+ if (ret < 0) {
+ printf("FAILED (restore: %s)\n", strerror(-ret));
+ goto out_cleanup;
+ }
+
+ /* Verify the file descriptor content with stored data. */
+ ret = verify_fd_content(fd, random_buffer, RANDOM_BUFFER_SIZE);
+ if (ret) {
+ printf("FAILED (verify_fd_content: %s)\n",
+ ret == 1 ? "data mismatch" : strerror(-ret));
+ goto out_close_fd;
+ }
+
+ ret = luo_finish();
+ if (ret < 0) {
+ printf("FAILED (finish: %s)\n", strerror(-ret));
+ goto out_close_fd;
+ }
+
+ printf("PASSED\n");
+ goto out_close_fd;
+ } else {
+ /* Pre-kexec: preserve the file descriptor */
+ printf("Testing fd preserve for kexec... ");
+
+ fd = create_test_fd(MEMFD_NAME, random_buffer, RANDOM_BUFFER_SIZE);
+ if (fd < 0) {
+ ret = fd;
+ printf("FAILED (create_test_fd: %s)\n", strerror(-ret));
+ goto out_cleanup;
+ }
+
+ /* Save random data to file for post-kexec verification */
+ ret = save_test_data(random_buffer, RANDOM_BUFFER_SIZE);
+ if (ret < 0) {
+ printf("FAILED (save_test_data: %s)\n", strerror(-ret));
+ goto out_close_fd;
+ }
+
+ token = next_token();
+ ret = luo_fd_preserve(fd, token);
+ if (ret < 0) {
+ printf("FAILED (preserve: %s)\n", strerror(-ret));
+ goto out_close_fd;
+ }
+
+ /* Save token to file for post-kexec restoration */
+ ret = save_token(token);
+ if (ret < 0) {
+ printf("FAILED (save_token: %s)\n", strerror(-ret));
+ goto out_unpreserve;
+ }
+
+ ret = luo_prepare();
+ if (ret < 0) {
+ printf("FAILED (prepare: %s)\n", strerror(-ret));
+ goto out_unpreserve;
+ }
+
+ printf("READY FOR KEXEC (token: %lu)\n", token);
+ printf("Run kexec now and then run this test again to complete.\n");
+
+ /* Note: At this point, the system should perform kexec reboot.
+ * The test will continue in the new kernel with the
+ * LIVEUPDATE_STATE_UPDATED state.
+ *
+ * Since the FD is now preserved, we can close it.
+ */
+ goto out_close_fd;
+ }
+
+out_unpreserve:
+ luo_fd_unpreserve(token);
+out_close_fd:
+ close(fd);
+out_cleanup:
+ luo_cleanup();
+}
+
+/*
+ * Test that prepared memfd can't grow or shrink, but reads and writes still
+ * work.
+ */
+static void test_fd_prepared_operations(void)
+{
+ char write_buffer[128] = {'A'};
+ size_t initial_size, file_size;
+ int ret, fd = -1;
+ uint64_t token;
+
+ printf("Testing operations on prepared memfd... ");
+
+ ret = luo_init();
+ if (ret < 0) {
+ printf("FAILED (init: %s)\n", strerror(-ret));
+ return;
+ }
+
+ /* Create and initialize test file descriptor */
+ fd = create_test_fd(MEMFD_NAME, random_buffer, sizeof(random_buffer));
+ if (fd < 0) {
+ ret = fd;
+ printf("FAILED (create_test_fd: %s)\n", strerror(-ret));
+ goto out_cleanup;
+ }
+
+ /* Get initial file size */
+ ret = lseek(fd, 0, SEEK_END);
+ if (ret < 0) {
+ printf("FAILED (lseek to end: %s)\n", strerror(errno));
+ goto out_close_fd;
+ }
+ initial_size = (size_t)ret;
+
+ token = next_token();
+ ret = luo_fd_preserve(fd, token);
+ if (ret < 0) {
+ printf("FAILED (preserve: %s)\n", strerror(-ret));
+ goto out_close_fd;
+ }
+
+ ret = luo_prepare();
+ if (ret < 0) {
+ printf("FAILED (prepare: %s)\n", strerror(-ret));
+ goto out_unpreserve;
+ }
+
+ /* Test 1: Write to the prepared file descriptor (within existing size) */
+ if (lseek(fd, 0, SEEK_SET) < 0) {
+ printf("FAILED (lseek before write: %s)\n", strerror(errno));
+ goto out_cancel;
+ }
+
+ /* Write buffer is smaller than total file size. */
+ ret = write_size(fd, write_buffer, sizeof(write_buffer));
+ if (ret < 0) {
+ printf("FAILED (write to prepared fd: %s)\n", strerror(errno));
+ goto out_cancel;
+ }
+
+ ret = verify_fd_content(fd, write_buffer, sizeof(write_buffer));
+ if (ret) {
+ printf("FAILED (verify_fd_content after write: %s)\n",
+ ret == 1 ? "data mismatch" : strerror(-ret));
+ goto out_cancel;
+ }
+
+ /* Test 2: Try to grow the file using write(). */
+
+ /* First, seek to one byte behind initial size. */
+ ret = lseek(fd, initial_size - 1, SEEK_SET);
+ if (ret < 0) {
+ printf("FAILED: (lseek after write verification: %s)\n",
+ strerror(errno));
+ }
+
+ /*
+ * Then, write some data that should increase the file size. This should
+ * fail.
+ */
+ ret = write_size(fd, write_buffer, sizeof(write_buffer));
+ if (ret == 0) {
+ printf("FAILED: (write beyond initial size succeeded)\n");
+ goto out_cancel;
+ }
+
+ ret = lseek(fd, 0, SEEK_END);
+ if (ret < 0) {
+ printf("FAILED (lseek after larger write: %s)\n", strerror(errno));
+ goto out_cancel;
+ }
+ file_size = (size_t)ret;
+
+ if (file_size != initial_size) {
+ printf("FAILED (file grew beyond initial size: %zu != %zu)\n",
+ (size_t)file_size, initial_size);
+ goto out_cancel;
+ }
+
+ /* Test 3: Try to shrink the file using truncate */
+ ret = ftruncate(fd, initial_size / 2);
+ if (ret == 0) {
+ printf("FAILED (file was truncated)\n");
+ goto out_cancel;
+ }
+
+ ret = lseek(fd, 0, SEEK_END);
+ if (ret < 0) {
+ printf("FAILED (lseek after shrink attempt: %s)\n", strerror(errno));
+ goto out_cancel;
+ }
+ file_size = (size_t)ret;
+
+ if (file_size != initial_size) {
+ printf("FAILED (file shrunk from initial size: %zu != %zu)\n",
+ (size_t)file_size, initial_size);
+ goto out_cancel;
+ }
+
+ ret = luo_cancel();
+ if (ret < 0) {
+ printf("FAILED (cancel: %s)\n", strerror(-ret));
+ goto out_unpreserve;
+ }
+
+ ret = luo_fd_unpreserve(token);
+ if (ret < 0) {
+ printf("FAILED (unpreserve: %s)\n", strerror(-ret));
+ goto out_close_fd;
+ }
+
+ printf("PASSED\n");
+ goto out_close_fd;
+
+out_cancel:
+ luo_cancel();
+out_unpreserve:
+ luo_fd_unpreserve(token);
+out_close_fd:
+ close(fd);
+out_cleanup:
+ luo_cleanup();
+}
+
+static int test_prepare_cancel_sequence(const char *sequence_name)
+{
+ int ret;
+ enum liveupdate_state state;
+
+ /* Initial state should be NORMAL */
+ ret = luo_get_state(&state);
+ if (ret < 0) {
+ printf("FAILED (%s get initial state failed: %s)\n",
+ sequence_name, strerror(-ret));
+ return ret;
+ }
+
+ if (state != LIVEUPDATE_STATE_NORMAL) {
+ printf("FAILED (%s unexpected initial state: %s)\n",
+ sequence_name, luo_state_to_string(state));
+ return -EINVAL;
+ }
+
+ /* Test NORMAL -> PREPARED transition */
+ ret = luo_prepare();
+ if (ret < 0) {
+ printf("FAILED (%s prepare failed: %s)\n",
+ sequence_name, strerror(-ret));
+ return ret;
+ }
+
+ ret = luo_get_state(&state);
+ if (ret < 0) {
+ printf("FAILED (%s get state after prepare failed: %s)\n",
+ sequence_name, strerror(-ret));
+ goto out_cancel;
+ }
+
+ if (state != LIVEUPDATE_STATE_PREPARED) {
+ printf("FAILED (%s expected PREPARED state, got %s)\n",
+ sequence_name, luo_state_to_string(state));
+ ret = -EINVAL;
+ goto out_cancel;
+ }
+
+ /* Test PREPARED -> NORMAL transition via cancel */
+ ret = luo_cancel();
+ if (ret < 0) {
+ printf("FAILED (%s cancel failed: %s)\n",
+ sequence_name, strerror(-ret));
+ return ret;
+ }
+
+ ret = luo_get_state(&state);
+ if (ret < 0) {
+ printf("FAILED (%s get state after cancel failed: %s)\n",
+ sequence_name, strerror(-ret));
+ return ret;
+ }
+
+ if (state != LIVEUPDATE_STATE_NORMAL) {
+ printf("FAILED (%s expected NORMAL state after cancel, got %s)\n",
+ sequence_name, luo_state_to_string(state));
+ return -EINVAL;
+ }
+
+ return 0;
+
+out_cancel:
+ luo_cancel();
+ return ret;
+}
+
+/* Test all state transitions */
+static void test_state_transitions(void)
+{
+ int ret;
+
+ printf("Testing state transitions... ");
+
+ ret = luo_init();
+ if (ret < 0) {
+ printf("FAILED (init failed: %s)\n", strerror(-ret));
+ return;
+ }
+
+ /* Test first prepare -> cancel sequence */
+ ret = test_prepare_cancel_sequence("first");
+ if (ret < 0)
+ goto out;
+
+ /*
+ * Test second prepare -> freeze -> cancel sequence in case the
+ * previous cancellation left some side effects.
+ */
+ ret = test_prepare_cancel_sequence("second");
+ if (ret < 0)
+ goto out;
+
+ printf("PASSED\n");
+
+out:
+ luo_cleanup();
+}
+
+/* Test name to flag mapping */
+struct test {
+ const char *name;
+ void (*fn)(void);
+ unsigned int flag;
+};
+
+/* Array of test names and their corresponding flags */
+static struct test tests[] = {
+ {"init", test_init_cleanup, TEST_INIT_CLEANUP},
+ {"state", test_get_state, TEST_GET_STATE},
+ {"transitions", test_state_transitions, TEST_STATE_TRANSITIONS},
+ {"preserve", test_fd_preserve_unpreserve, TEST_FD_PRESERVE},
+ {"prepared", test_fd_prepared_operations, TEST_FD_PREPARED},
+ {"error", test_error_handling, TEST_ERROR_HANDLING},
+ {"kexec", test_fd_preserve_for_kexec, TEST_FD_KEXEC},
+ {NULL, NULL, 0}
+};
+
+static int parse_test_names(char *arg, unsigned int *flags)
+{
+ char *name;
+ struct test *test;
+
+ *flags = 0;
+ name = strtok(arg, ",");
+
+ while (name != NULL) {
+ test = tests;
+ while (test->name) {
+ if (strcmp(name, test->name) == 0) {
+ *flags |= test->flag;
+ break;
+ }
+ test++;
+ }
+
+ /* Check if we found a match */
+ if (!test->name) {
+ printf("Unknown test: %s\n", name);
+ return 1;
+ }
+
+ name = strtok(NULL, ",");
+ }
+
+ return 0;
+}
+
+static void usage(const char *program_name)
+{
+ printf("Usage: %s [options]\n", program_name);
+ printf("Options:\n");
+ printf(" -h, --help Show this help message\n");
+ printf(" -t, --test=TEST_ID Run specific test(s)\n");
+ printf(" -e, --exclude=TEST_ID Exclude specific test(s)\n");
+ printf("\n");
+ printf("Test IDs:\n");
+ printf(" init - Test initialization and cleanup\n");
+ printf(" state - Test getting LUO state\n");
+ printf(" preserve - Test memfd preserve/unpreserve with freeze/cancel\n");
+ printf(" prepared - Test memfd functions can read/write but not grow after prepare\n");
+ printf(" transitions - Test all state transitions (NORMAL->PREPARED->FROZEN->NORMAL)\n");
+ printf(" error - Test error handling\n");
+ printf(" kexec - Test memfd preserve for kexec\n");
+ printf("\n");
+ printf("Multiple tests can be specified with comma separation.\n");
+ printf("Example: %s --test=init,state --exclude=kexec\n", program_name);
+ printf("By default, all tests are run.\n");
+}
+
+int main(int argc, char *argv[])
+{
+ unsigned int tests_to_run = TEST_ALL;
+ unsigned int tests_to_exclude = 0;
+ struct option long_options[] = {
+ {"help", no_argument, 0, 'h'},
+ {"test", required_argument, 0, 't'},
+ {"exclude", required_argument, 0, 'e'},
+ {0, 0, 0, 0}
+ };
+ struct test *test;
+ int opt;
+
+ printf("LibLUO Test Suite\n");
+ printf("=================\n\n");
+
+ if (!luo_is_available()) {
+ printf("LUO is not available on this system. Skipping tests.\n");
+ return 0;
+ }
+
+ while ((opt = getopt_long(argc, argv, "ht:e:", long_options, NULL)) != -1) {
+ switch (opt) {
+ case 'h':
+ usage(argv[0]);
+ return 0;
+ case 't':
+ if (parse_test_names(optarg, &tests_to_run))
+ return 1;
+ break;
+ case 'e':
+ if (parse_test_names(optarg, &tests_to_exclude))
+ return 1;
+ break;
+ default:
+ printf("Try '%s --help' for more information.\n", argv[0]);
+ return 1;
+ }
+ }
+
+ /* Apply exclusions to the tests to run */
+ tests_to_run &= ~tests_to_exclude;
+ if (!tests_to_run) {
+ printf("ERROR: all tests excluded\n");
+ return 1;
+ }
+
+ /* Run selected tests */
+ test = tests;
+ while (test->name) {
+ if (tests_to_run & test->flag)
+ test->fn();
+ test++;
+ }
+
+ printf("\nAll requested tests completed.\n");
+ return 0;
+}
--
2.50.0.727.gbf7dc18ff4-goog
^ permalink raw reply related
* Re: [PATCH v1 00/32] Live Update Orchestrator
From: Benjamin LaHaise @ 2025-06-25 23:26 UTC (permalink / raw)
To: Pasha Tatashin
Cc: pratyush, jasonmiu, graf, changyuanl, rppt, dmatlack, rientjes,
corbet, rdunlap, ilpo.jarvinen, kanie, ojeda, aliceryhl,
masahiroy, akpm, tj, yoann.congal, mmaurer, roman.gushchin,
chenridong, axboe, mark.rutland, jannh, vincent.guittot, hannes,
dan.j.williams, david, joel.granados, rostedt, anna.schumaker,
song, zhangguopeng, linux, linux-kernel, linux-doc, linux-mm,
gregkh, tglx, mingo, bp, dave.hansen, x86, hpa, rafael, dakr,
bartosz.golaszewski, cw00.choi, myungjoo.ham, yesanishhere,
Jonathan.Cameron, quic_zijuhu, aleksander.lobakin, ira.weiny,
andriy.shevchenko, leon, lukas, bhelgaas, wagi, djeffery,
stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel
In-Reply-To: <20250625231838.1897085-1-pasha.tatashin@soleen.com>
FYI: Every one of your emails to the list for this series was bounced by
all the recipients using @gmail.com email addresses.
-ben (owner-linux-mm)
On Wed, Jun 25, 2025 at 11:17:47PM +0000, Pasha Tatashin wrote:
> This series introduces the LUO, a kernel subsystem designed to
> facilitate live kernel updates with minimal downtime,
> particularly in cloud delplyoments aiming to update without fully
> disrupting running virtual machines.
>
> This series builds upon KHO framework by adding programmatic
> control over KHO's lifecycle and leveraging KHO for persisting LUO's
> own metadata across the kexec boundary. The git branch for this series
> can be found at:
>
> https://github.com/googleprodkernel/linux-liveupdate/tree/luo/v1
>
> Changelog from rfc-v2:
> - Addressed review comments from Mike Rapoport, Pratyush Yadav,
> David Matlack
> - Moved everything under kernel/liveupdate including KHO.
> - Added a number fixes to KHO that were discovered.
> - luo_files is not a registred as a subsystem.
> - Added sessions support to preserved files.
> - Added support for memfd (Pratyush Yadav)
> - Added libluo (proposed as RFC) (Pratyush Yadav)
> - Removed notifiers from KHO (Mike Rapoport)
>
> What is Live Update?
> Live Update is a kexec based reboot process where selected kernel
> resources (memory, file descriptors, and eventually devices) are kept
> operational or their state preserved across a kernel transition. For
> certain resources, DMA and interrupt activity might continue with
> minimal interruption during the kernel reboot.
>
> LUO provides a framework for coordinating live updates. It features:
> State Machine: Manages the live update process through states:
> NORMAL, PREPARED, FROZEN, UPDATED.
>
> KHO Integration:
>
> LUO programmatically drives KHO's finalization and abort sequences.
> KHO's debugfs interface is now optional configured via
> CONFIG_KEXEC_HANDOVER_DEBUG.
>
> LUO preserves its own metadata via KHO's kho_add_subtree and
> kho_preserve_phys() mechanisms.
>
> Subsystem Participation: A callback API liveupdate_register_subsystem()
> allows kernel subsystems (e.g., KVM, IOMMU, VFIO, PCI) to register
> handlers for LUO events (PREPARE, FREEZE, FINISH, CANCEL) and persist a
> u64 payload via the LUO FDT.
>
> File Descriptor Preservation: Infrastructure
> liveupdate_register_filesystem, luo_register_file, luo_retrieve_file to
> allow specific types of file descriptors (e.g., memfd, vfio) to be
> preserved and restored.
>
> Handlers for specific file types can be registered to manage their
> preservation and restoration, storing a u64 payload in the LUO FDT.
>
> User-space Interface:
>
> ioctl (/dev/liveupdate): The primary control interface for
> triggering LUO state transitions (prepare, freeze, finish, cancel)
> and managing the preservation/restoration of file descriptors.
> Access requires CAP_SYS_ADMIN.
>
> sysfs (/sys/kernel/liveupdate/state): A read-only interface for
> monitoring the current LUO state. This allows userspace services to
> track progress and coordinate actions.
>
> Selftests: Includes kernel-side hooks and userspace selftests to
> verify core LUO functionality, particularly subsystem registration and
> basic state transitions.
>
> LUO State Machine and Events:
>
> NORMAL: Default operational state.
> PREPARED: Initial preparation complete after LIVEUPDATE_PREPARE
> event. Subsystems have saved initial state.
> FROZEN: Final "blackout window" state after LIVEUPDATE_FREEZE
> event, just before kexec. Workloads must be suspended.
> UPDATED: Next kernel has booted via live update. Awaiting restoration
> and LIVEUPDATE_FINISH.
>
> Events:
> LIVEUPDATE_PREPARE: Prepare for reboot, serialize state.
> LIVEUPDATE_FREEZE: Final opportunity to save state before kexec.
> LIVEUPDATE_FINISH: Post-reboot cleanup in the next kernel.
> LIVEUPDATE_CANCEL: Abort prepare or freeze, revert changes.
>
> RFC v1: https://lore.kernel.org/all/20250320024011.2995837-1-pasha.tatashin@soleen.com
> RFC v2: https://lore.kernel.org/all/20250515182322.117840-1-pasha.tatashin@soleen.com/
>
> Changyuan Lyu (1):
> kho: add interfaces to unpreserve folios and physical memory ranges
>
> Mike Rapoport (Microsoft) (1):
> kho: drop notifiers
>
> Pasha Tatashin (22):
> kho: init new_physxa->phys_bits to fix lockdep
> kho: mm: Don't allow deferred struct page with KHO
> kho: warn if KHO is disabled due to an error
> kho: allow to drive kho from within kernel
> kho: make debugfs interface optional
> kho: don't unpreserve memory during abort
> liveupdate: kho: move to kernel/liveupdate
> liveupdate: luo_core: Live Update Orchestrator
> liveupdate: luo_core: integrate with KHO
> liveupdate: luo_subsystems: add subsystem registration
> liveupdate: luo_subsystems: implement subsystem callbacks
> liveupdate: luo_files: add infrastructure for FDs
> liveupdate: luo_files: implement file systems callbacks
> liveupdate: luo_ioctl: add ioctl interface
> liveupdate: luo_sysfs: add sysfs state monitoring
> reboot: call liveupdate_reboot() before kexec
> liveupdate: luo_files: luo_ioctl: session-based file descriptor
> tracking
> kho: move kho debugfs directory to liveupdate
> liveupdate: add selftests for subsystems un/registration
> selftests/liveupdate: add subsystem/state tests
> docs: add luo documentation
> MAINTAINERS: add liveupdate entry
>
> Pratyush Yadav (8):
> mm: shmem: use SHMEM_F_* flags instead of VM_* flags
> mm: shmem: allow freezing inode mapping
> mm: shmem: export some functions to internal.h
> luo: allow preserving memfd
> docs: add documentation for memfd preservation via LUO
> tools: introduce libluo
> libluo: introduce luoctl
> libluo: add tests
>
> .../ABI/testing/sysfs-kernel-liveupdate | 51 +
> Documentation/admin-guide/index.rst | 1 +
> Documentation/admin-guide/liveupdate.rst | 16 +
> Documentation/core-api/index.rst | 1 +
> Documentation/core-api/kho/concepts.rst | 2 +-
> Documentation/core-api/liveupdate.rst | 57 ++
> Documentation/mm/index.rst | 1 +
> Documentation/mm/memfd_preservation.rst | 138 +++
> Documentation/userspace-api/index.rst | 1 +
> .../userspace-api/ioctl/ioctl-number.rst | 2 +
> Documentation/userspace-api/liveupdate.rst | 25 +
> MAINTAINERS | 20 +-
> include/linux/kexec_handover.h | 53 +-
> include/linux/liveupdate.h | 235 +++++
> include/linux/shmem_fs.h | 23 +
> include/uapi/linux/liveupdate.h | 265 +++++
> init/Kconfig | 2 +
> kernel/Kconfig.kexec | 14 -
> kernel/Makefile | 2 +-
> kernel/liveupdate/Kconfig | 90 ++
> kernel/liveupdate/Makefile | 13 +
> kernel/{ => liveupdate}/kexec_handover.c | 556 +++++-----
> kernel/liveupdate/kexec_handover_debug.c | 222 ++++
> kernel/liveupdate/kexec_handover_internal.h | 45 +
> kernel/liveupdate/luo_core.c | 525 ++++++++++
> kernel/liveupdate/luo_files.c | 946 ++++++++++++++++++
> kernel/liveupdate/luo_internal.h | 47 +
> kernel/liveupdate/luo_ioctl.c | 192 ++++
> kernel/liveupdate/luo_selftests.c | 344 +++++++
> kernel/liveupdate/luo_selftests.h | 84 ++
> kernel/liveupdate/luo_subsystems.c | 420 ++++++++
> kernel/liveupdate/luo_sysfs.c | 92 ++
> kernel/reboot.c | 4 +
> mm/Makefile | 1 +
> mm/internal.h | 6 +
> mm/memblock.c | 56 +-
> mm/memfd_luo.c | 501 ++++++++++
> mm/shmem.c | 46 +-
> tools/lib/luo/LICENSE | 165 +++
> tools/lib/luo/Makefile | 45 +
> tools/lib/luo/README.md | 166 +++
> tools/lib/luo/cli/.gitignore | 1 +
> tools/lib/luo/cli/Makefile | 18 +
> tools/lib/luo/cli/luoctl.c | 178 ++++
> tools/lib/luo/include/libluo.h | 128 +++
> tools/lib/luo/include/liveupdate.h | 265 +++++
> tools/lib/luo/libluo.c | 203 ++++
> tools/lib/luo/tests/.gitignore | 1 +
> tools/lib/luo/tests/Makefile | 18 +
> tools/lib/luo/tests/test.c | 848 ++++++++++++++++
> tools/testing/selftests/Makefile | 1 +
> tools/testing/selftests/liveupdate/.gitignore | 1 +
> tools/testing/selftests/liveupdate/Makefile | 7 +
> tools/testing/selftests/liveupdate/config | 6 +
> .../testing/selftests/liveupdate/liveupdate.c | 356 +++++++
> 55 files changed, 7091 insertions(+), 415 deletions(-)
> create mode 100644 Documentation/ABI/testing/sysfs-kernel-liveupdate
> create mode 100644 Documentation/admin-guide/liveupdate.rst
> create mode 100644 Documentation/core-api/liveupdate.rst
> create mode 100644 Documentation/mm/memfd_preservation.rst
> create mode 100644 Documentation/userspace-api/liveupdate.rst
> create mode 100644 include/linux/liveupdate.h
> create mode 100644 include/uapi/linux/liveupdate.h
> create mode 100644 kernel/liveupdate/Kconfig
> create mode 100644 kernel/liveupdate/Makefile
> rename kernel/{ => liveupdate}/kexec_handover.c (74%)
> create mode 100644 kernel/liveupdate/kexec_handover_debug.c
> create mode 100644 kernel/liveupdate/kexec_handover_internal.h
> create mode 100644 kernel/liveupdate/luo_core.c
> create mode 100644 kernel/liveupdate/luo_files.c
> create mode 100644 kernel/liveupdate/luo_internal.h
> create mode 100644 kernel/liveupdate/luo_ioctl.c
> create mode 100644 kernel/liveupdate/luo_selftests.c
> create mode 100644 kernel/liveupdate/luo_selftests.h
> create mode 100644 kernel/liveupdate/luo_subsystems.c
> create mode 100644 kernel/liveupdate/luo_sysfs.c
> create mode 100644 mm/memfd_luo.c
> create mode 100644 tools/lib/luo/LICENSE
> create mode 100644 tools/lib/luo/Makefile
> create mode 100644 tools/lib/luo/README.md
> create mode 100644 tools/lib/luo/cli/.gitignore
> create mode 100644 tools/lib/luo/cli/Makefile
> create mode 100644 tools/lib/luo/cli/luoctl.c
> create mode 100644 tools/lib/luo/include/libluo.h
> create mode 100644 tools/lib/luo/include/liveupdate.h
> create mode 100644 tools/lib/luo/libluo.c
> create mode 100644 tools/lib/luo/tests/.gitignore
> create mode 100644 tools/lib/luo/tests/Makefile
> create mode 100644 tools/lib/luo/tests/test.c
> create mode 100644 tools/testing/selftests/liveupdate/.gitignore
> create mode 100644 tools/testing/selftests/liveupdate/Makefile
> create mode 100644 tools/testing/selftests/liveupdate/config
> create mode 100644 tools/testing/selftests/liveupdate/liveupdate.c
>
> --
> 2.50.0.727.gbf7dc18ff4-goog
>
--
"Thought is the essence of where you are now."
^ permalink raw reply
* Re: [PATCH v1 00/32] Live Update Orchestrator
From: pasha.tatashin @ 2025-06-25 23:44 UTC (permalink / raw)
To: Benjamin LaHaise
Cc: pratyush, jasonmiu, graf, changyuanl, rppt, dmatlack, rientjes,
corbet, rdunlap, ilpo.jarvinen, kanie, ojeda, aliceryhl,
masahiroy, akpm, tj, yoann.congal, mmaurer, roman.gushchin,
chenridong, axboe, mark.rutland, jannh, vincent.guittot, hannes,
dan.j.williams, david, joel.granados, rostedt, anna.schumaker,
song, zhangguopeng, linux, linux-kernel, linux-doc, linux-mm,
gregkh, tglx, mingo, bp, dave.hansen, x86, hpa, rafael, dakr,
bartosz.golaszewski, cw00.choi, myungjoo.ham, yesanishhere,
Jonathan.Cameron, quic_zijuhu, aleksander.lobakin, ira.weiny,
andriy.shevchenko, leon, lukas, bhelgaas, wagi, djeffery,
stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel
In-Reply-To: <20250625232653.GJ369@kvack.org>
On Wed, Jun 25, 2025 at 7:26 PM Benjamin LaHaise <bcrl@kvack.org> wrote:
>
> FYI: Every one of your emails to the list for this series was bounced by
> all the recipients using @gmail.com email addresses.
>
> -ben (owner-linux-mm)
This is extremely annoying, I will need to figure out why this is
happening. soleen.com uses google workspace.
Pasha
>
> On Wed, Jun 25, 2025 at 11:17:47PM +0000, Pasha Tatashin wrote:
> > This series introduces the LUO, a kernel subsystem designed to
> > facilitate live kernel updates with minimal downtime,
> > particularly in cloud delplyoments aiming to update without fully
> > disrupting running virtual machines.
> >
> > This series builds upon KHO framework by adding programmatic
> > control over KHO's lifecycle and leveraging KHO for persisting LUO's
> > own metadata across the kexec boundary. The git branch for this series
> > can be found at:
> >
> > https://github.com/googleprodkernel/linux-liveupdate/tree/luo/v1
> >
> > Changelog from rfc-v2:
> > - Addressed review comments from Mike Rapoport, Pratyush Yadav,
> > David Matlack
> > - Moved everything under kernel/liveupdate including KHO.
> > - Added a number fixes to KHO that were discovered.
> > - luo_files is not a registred as a subsystem.
> > - Added sessions support to preserved files.
> > - Added support for memfd (Pratyush Yadav)
> > - Added libluo (proposed as RFC) (Pratyush Yadav)
> > - Removed notifiers from KHO (Mike Rapoport)
> >
> > What is Live Update?
> > Live Update is a kexec based reboot process where selected kernel
> > resources (memory, file descriptors, and eventually devices) are kept
> > operational or their state preserved across a kernel transition. For
> > certain resources, DMA and interrupt activity might continue with
> > minimal interruption during the kernel reboot.
> >
> > LUO provides a framework for coordinating live updates. It features:
> > State Machine: Manages the live update process through states:
> > NORMAL, PREPARED, FROZEN, UPDATED.
> >
> > KHO Integration:
> >
> > LUO programmatically drives KHO's finalization and abort sequences.
> > KHO's debugfs interface is now optional configured via
> > CONFIG_KEXEC_HANDOVER_DEBUG.
> >
> > LUO preserves its own metadata via KHO's kho_add_subtree and
> > kho_preserve_phys() mechanisms.
> >
> > Subsystem Participation: A callback API liveupdate_register_subsystem()
> > allows kernel subsystems (e.g., KVM, IOMMU, VFIO, PCI) to register
> > handlers for LUO events (PREPARE, FREEZE, FINISH, CANCEL) and persist a
> > u64 payload via the LUO FDT.
> >
> > File Descriptor Preservation: Infrastructure
> > liveupdate_register_filesystem, luo_register_file, luo_retrieve_file to
> > allow specific types of file descriptors (e.g., memfd, vfio) to be
> > preserved and restored.
> >
> > Handlers for specific file types can be registered to manage their
> > preservation and restoration, storing a u64 payload in the LUO FDT.
> >
> > User-space Interface:
> >
> > ioctl (/dev/liveupdate): The primary control interface for
> > triggering LUO state transitions (prepare, freeze, finish, cancel)
> > and managing the preservation/restoration of file descriptors.
> > Access requires CAP_SYS_ADMIN.
> >
> > sysfs (/sys/kernel/liveupdate/state): A read-only interface for
> > monitoring the current LUO state. This allows userspace services to
> > track progress and coordinate actions.
> >
> > Selftests: Includes kernel-side hooks and userspace selftests to
> > verify core LUO functionality, particularly subsystem registration and
> > basic state transitions.
> >
> > LUO State Machine and Events:
> >
> > NORMAL: Default operational state.
> > PREPARED: Initial preparation complete after LIVEUPDATE_PREPARE
> > event. Subsystems have saved initial state.
> > FROZEN: Final "blackout window" state after LIVEUPDATE_FREEZE
> > event, just before kexec. Workloads must be suspended.
> > UPDATED: Next kernel has booted via live update. Awaiting restoration
> > and LIVEUPDATE_FINISH.
> >
> > Events:
> > LIVEUPDATE_PREPARE: Prepare for reboot, serialize state.
> > LIVEUPDATE_FREEZE: Final opportunity to save state before kexec.
> > LIVEUPDATE_FINISH: Post-reboot cleanup in the next kernel.
> > LIVEUPDATE_CANCEL: Abort prepare or freeze, revert changes.
> >
> > RFC v1: https://lore.kernel.org/all/20250320024011.2995837-1-pasha.tatashin@soleen.com
> > RFC v2: https://lore.kernel.org/all/20250515182322.117840-1-pasha.tatashin@soleen.com/
> >
> > Changyuan Lyu (1):
> > kho: add interfaces to unpreserve folios and physical memory ranges
> >
> > Mike Rapoport (Microsoft) (1):
> > kho: drop notifiers
> >
> > Pasha Tatashin (22):
> > kho: init new_physxa->phys_bits to fix lockdep
> > kho: mm: Don't allow deferred struct page with KHO
> > kho: warn if KHO is disabled due to an error
> > kho: allow to drive kho from within kernel
> > kho: make debugfs interface optional
> > kho: don't unpreserve memory during abort
> > liveupdate: kho: move to kernel/liveupdate
> > liveupdate: luo_core: Live Update Orchestrator
> > liveupdate: luo_core: integrate with KHO
> > liveupdate: luo_subsystems: add subsystem registration
> > liveupdate: luo_subsystems: implement subsystem callbacks
> > liveupdate: luo_files: add infrastructure for FDs
> > liveupdate: luo_files: implement file systems callbacks
> > liveupdate: luo_ioctl: add ioctl interface
> > liveupdate: luo_sysfs: add sysfs state monitoring
> > reboot: call liveupdate_reboot() before kexec
> > liveupdate: luo_files: luo_ioctl: session-based file descriptor
> > tracking
> > kho: move kho debugfs directory to liveupdate
> > liveupdate: add selftests for subsystems un/registration
> > selftests/liveupdate: add subsystem/state tests
> > docs: add luo documentation
> > MAINTAINERS: add liveupdate entry
> >
> > Pratyush Yadav (8):
> > mm: shmem: use SHMEM_F_* flags instead of VM_* flags
> > mm: shmem: allow freezing inode mapping
> > mm: shmem: export some functions to internal.h
> > luo: allow preserving memfd
> > docs: add documentation for memfd preservation via LUO
> > tools: introduce libluo
> > libluo: introduce luoctl
> > libluo: add tests
> >
> > .../ABI/testing/sysfs-kernel-liveupdate | 51 +
> > Documentation/admin-guide/index.rst | 1 +
> > Documentation/admin-guide/liveupdate.rst | 16 +
> > Documentation/core-api/index.rst | 1 +
> > Documentation/core-api/kho/concepts.rst | 2 +-
> > Documentation/core-api/liveupdate.rst | 57 ++
> > Documentation/mm/index.rst | 1 +
> > Documentation/mm/memfd_preservation.rst | 138 +++
> > Documentation/userspace-api/index.rst | 1 +
> > .../userspace-api/ioctl/ioctl-number.rst | 2 +
> > Documentation/userspace-api/liveupdate.rst | 25 +
> > MAINTAINERS | 20 +-
> > include/linux/kexec_handover.h | 53 +-
> > include/linux/liveupdate.h | 235 +++++
> > include/linux/shmem_fs.h | 23 +
> > include/uapi/linux/liveupdate.h | 265 +++++
> > init/Kconfig | 2 +
> > kernel/Kconfig.kexec | 14 -
> > kernel/Makefile | 2 +-
> > kernel/liveupdate/Kconfig | 90 ++
> > kernel/liveupdate/Makefile | 13 +
> > kernel/{ => liveupdate}/kexec_handover.c | 556 +++++-----
> > kernel/liveupdate/kexec_handover_debug.c | 222 ++++
> > kernel/liveupdate/kexec_handover_internal.h | 45 +
> > kernel/liveupdate/luo_core.c | 525 ++++++++++
> > kernel/liveupdate/luo_files.c | 946 ++++++++++++++++++
> > kernel/liveupdate/luo_internal.h | 47 +
> > kernel/liveupdate/luo_ioctl.c | 192 ++++
> > kernel/liveupdate/luo_selftests.c | 344 +++++++
> > kernel/liveupdate/luo_selftests.h | 84 ++
> > kernel/liveupdate/luo_subsystems.c | 420 ++++++++
> > kernel/liveupdate/luo_sysfs.c | 92 ++
> > kernel/reboot.c | 4 +
> > mm/Makefile | 1 +
> > mm/internal.h | 6 +
> > mm/memblock.c | 56 +-
> > mm/memfd_luo.c | 501 ++++++++++
> > mm/shmem.c | 46 +-
> > tools/lib/luo/LICENSE | 165 +++
> > tools/lib/luo/Makefile | 45 +
> > tools/lib/luo/README.md | 166 +++
> > tools/lib/luo/cli/.gitignore | 1 +
> > tools/lib/luo/cli/Makefile | 18 +
> > tools/lib/luo/cli/luoctl.c | 178 ++++
> > tools/lib/luo/include/libluo.h | 128 +++
> > tools/lib/luo/include/liveupdate.h | 265 +++++
> > tools/lib/luo/libluo.c | 203 ++++
> > tools/lib/luo/tests/.gitignore | 1 +
> > tools/lib/luo/tests/Makefile | 18 +
> > tools/lib/luo/tests/test.c | 848 ++++++++++++++++
> > tools/testing/selftests/Makefile | 1 +
> > tools/testing/selftests/liveupdate/.gitignore | 1 +
> > tools/testing/selftests/liveupdate/Makefile | 7 +
> > tools/testing/selftests/liveupdate/config | 6 +
> > .../testing/selftests/liveupdate/liveupdate.c | 356 +++++++
> > 55 files changed, 7091 insertions(+), 415 deletions(-)
> > create mode 100644 Documentation/ABI/testing/sysfs-kernel-liveupdate
> > create mode 100644 Documentation/admin-guide/liveupdate.rst
> > create mode 100644 Documentation/core-api/liveupdate.rst
> > create mode 100644 Documentation/mm/memfd_preservation.rst
> > create mode 100644 Documentation/userspace-api/liveupdate.rst
> > create mode 100644 include/linux/liveupdate.h
> > create mode 100644 include/uapi/linux/liveupdate.h
> > create mode 100644 kernel/liveupdate/Kconfig
> > create mode 100644 kernel/liveupdate/Makefile
> > rename kernel/{ => liveupdate}/kexec_handover.c (74%)
> > create mode 100644 kernel/liveupdate/kexec_handover_debug.c
> > create mode 100644 kernel/liveupdate/kexec_handover_internal.h
> > create mode 100644 kernel/liveupdate/luo_core.c
> > create mode 100644 kernel/liveupdate/luo_files.c
> > create mode 100644 kernel/liveupdate/luo_internal.h
> > create mode 100644 kernel/liveupdate/luo_ioctl.c
> > create mode 100644 kernel/liveupdate/luo_selftests.c
> > create mode 100644 kernel/liveupdate/luo_selftests.h
> > create mode 100644 kernel/liveupdate/luo_subsystems.c
> > create mode 100644 kernel/liveupdate/luo_sysfs.c
> > create mode 100644 mm/memfd_luo.c
> > create mode 100644 tools/lib/luo/LICENSE
> > create mode 100644 tools/lib/luo/Makefile
> > create mode 100644 tools/lib/luo/README.md
> > create mode 100644 tools/lib/luo/cli/.gitignore
> > create mode 100644 tools/lib/luo/cli/Makefile
> > create mode 100644 tools/lib/luo/cli/luoctl.c
> > create mode 100644 tools/lib/luo/include/libluo.h
> > create mode 100644 tools/lib/luo/include/liveupdate.h
> > create mode 100644 tools/lib/luo/libluo.c
> > create mode 100644 tools/lib/luo/tests/.gitignore
> > create mode 100644 tools/lib/luo/tests/Makefile
> > create mode 100644 tools/lib/luo/tests/test.c
> > create mode 100644 tools/testing/selftests/liveupdate/.gitignore
> > create mode 100644 tools/testing/selftests/liveupdate/Makefile
> > create mode 100644 tools/testing/selftests/liveupdate/config
> > create mode 100644 tools/testing/selftests/liveupdate/liveupdate.c
> >
> > --
> > 2.50.0.727.gbf7dc18ff4-goog
> >
>
> --
> "Thought is the essence of where you are now."
^ permalink raw reply
* Re: [PATCH v1 00/32] Live Update Orchestrator
From: Benjamin LaHaise @ 2025-06-25 23:56 UTC (permalink / raw)
To: pasha.tatashin
Cc: pratyush, jasonmiu, graf, changyuanl, rppt, dmatlack, rientjes,
corbet, rdunlap, ilpo.jarvinen, kanie, ojeda, aliceryhl,
masahiroy, akpm, tj, yoann.congal, mmaurer, roman.gushchin,
chenridong, axboe, mark.rutland, jannh, vincent.guittot, hannes,
dan.j.williams, david, joel.granados, rostedt, anna.schumaker,
song, zhangguopeng, linux, linux-kernel, linux-doc, linux-mm,
gregkh, tglx, mingo, bp, dave.hansen, x86, hpa, rafael, dakr,
bartosz.golaszewski, cw00.choi, myungjoo.ham, yesanishhere,
Jonathan.Cameron, quic_zijuhu, aleksander.lobakin, ira.weiny,
andriy.shevchenko, leon, lukas, bhelgaas, wagi, djeffery,
stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel
In-Reply-To: <CA+CK2bAsz4Zz2_Kp8QMKxG5taY52ykhhykROd0di85ax5eeOrw@mail.gmail.com>
On Wed, Jun 25, 2025 at 07:44:12PM -0400, pasha.tatashin wrote:
> On Wed, Jun 25, 2025 at 7:26 PM Benjamin LaHaise <bcrl@kvack.org> wrote:
> >
> > FYI: Every one of your emails to the list for this series was bounced by
> > all the recipients using @gmail.com email addresses.
> >
> > -ben (owner-linux-mm)
>
> This is extremely annoying, I will need to figure out why this is
> happening. soleen.com uses google workspace.
I'm close to kicking all the @gmail.com subscribers off the mailing lists
given how bad this is getting. My general advice to anyone posting to
mailing lists these days is to assume that anyone reading email via any of
Google's service isn't going to see your mailing list posts. It keeps
getting worse, and nobody at the platform companies seems to care.
-ben
> Pasha
>
> >
> > On Wed, Jun 25, 2025 at 11:17:47PM +0000, Pasha Tatashin wrote:
> > > This series introduces the LUO, a kernel subsystem designed to
> > > facilitate live kernel updates with minimal downtime,
> > > particularly in cloud delplyoments aiming to update without fully
> > > disrupting running virtual machines.
> > >
> > > This series builds upon KHO framework by adding programmatic
> > > control over KHO's lifecycle and leveraging KHO for persisting LUO's
> > > own metadata across the kexec boundary. The git branch for this series
> > > can be found at:
> > >
> > > https://github.com/googleprodkernel/linux-liveupdate/tree/luo/v1
> > >
> > > Changelog from rfc-v2:
> > > - Addressed review comments from Mike Rapoport, Pratyush Yadav,
> > > David Matlack
> > > - Moved everything under kernel/liveupdate including KHO.
> > > - Added a number fixes to KHO that were discovered.
> > > - luo_files is not a registred as a subsystem.
> > > - Added sessions support to preserved files.
> > > - Added support for memfd (Pratyush Yadav)
> > > - Added libluo (proposed as RFC) (Pratyush Yadav)
> > > - Removed notifiers from KHO (Mike Rapoport)
> > >
> > > What is Live Update?
> > > Live Update is a kexec based reboot process where selected kernel
> > > resources (memory, file descriptors, and eventually devices) are kept
> > > operational or their state preserved across a kernel transition. For
> > > certain resources, DMA and interrupt activity might continue with
> > > minimal interruption during the kernel reboot.
> > >
> > > LUO provides a framework for coordinating live updates. It features:
> > > State Machine: Manages the live update process through states:
> > > NORMAL, PREPARED, FROZEN, UPDATED.
> > >
> > > KHO Integration:
> > >
> > > LUO programmatically drives KHO's finalization and abort sequences.
> > > KHO's debugfs interface is now optional configured via
> > > CONFIG_KEXEC_HANDOVER_DEBUG.
> > >
> > > LUO preserves its own metadata via KHO's kho_add_subtree and
> > > kho_preserve_phys() mechanisms.
> > >
> > > Subsystem Participation: A callback API liveupdate_register_subsystem()
> > > allows kernel subsystems (e.g., KVM, IOMMU, VFIO, PCI) to register
> > > handlers for LUO events (PREPARE, FREEZE, FINISH, CANCEL) and persist a
> > > u64 payload via the LUO FDT.
> > >
> > > File Descriptor Preservation: Infrastructure
> > > liveupdate_register_filesystem, luo_register_file, luo_retrieve_file to
> > > allow specific types of file descriptors (e.g., memfd, vfio) to be
> > > preserved and restored.
> > >
> > > Handlers for specific file types can be registered to manage their
> > > preservation and restoration, storing a u64 payload in the LUO FDT.
> > >
> > > User-space Interface:
> > >
> > > ioctl (/dev/liveupdate): The primary control interface for
> > > triggering LUO state transitions (prepare, freeze, finish, cancel)
> > > and managing the preservation/restoration of file descriptors.
> > > Access requires CAP_SYS_ADMIN.
> > >
> > > sysfs (/sys/kernel/liveupdate/state): A read-only interface for
> > > monitoring the current LUO state. This allows userspace services to
> > > track progress and coordinate actions.
> > >
> > > Selftests: Includes kernel-side hooks and userspace selftests to
> > > verify core LUO functionality, particularly subsystem registration and
> > > basic state transitions.
> > >
> > > LUO State Machine and Events:
> > >
> > > NORMAL: Default operational state.
> > > PREPARED: Initial preparation complete after LIVEUPDATE_PREPARE
> > > event. Subsystems have saved initial state.
> > > FROZEN: Final "blackout window" state after LIVEUPDATE_FREEZE
> > > event, just before kexec. Workloads must be suspended.
> > > UPDATED: Next kernel has booted via live update. Awaiting restoration
> > > and LIVEUPDATE_FINISH.
> > >
> > > Events:
> > > LIVEUPDATE_PREPARE: Prepare for reboot, serialize state.
> > > LIVEUPDATE_FREEZE: Final opportunity to save state before kexec.
> > > LIVEUPDATE_FINISH: Post-reboot cleanup in the next kernel.
> > > LIVEUPDATE_CANCEL: Abort prepare or freeze, revert changes.
> > >
> > > RFC v1: https://lore.kernel.org/all/20250320024011.2995837-1-pasha.tatashin@soleen.com
> > > RFC v2: https://lore.kernel.org/all/20250515182322.117840-1-pasha.tatashin@soleen.com/
> > >
> > > Changyuan Lyu (1):
> > > kho: add interfaces to unpreserve folios and physical memory ranges
> > >
> > > Mike Rapoport (Microsoft) (1):
> > > kho: drop notifiers
> > >
> > > Pasha Tatashin (22):
> > > kho: init new_physxa->phys_bits to fix lockdep
> > > kho: mm: Don't allow deferred struct page with KHO
> > > kho: warn if KHO is disabled due to an error
> > > kho: allow to drive kho from within kernel
> > > kho: make debugfs interface optional
> > > kho: don't unpreserve memory during abort
> > > liveupdate: kho: move to kernel/liveupdate
> > > liveupdate: luo_core: Live Update Orchestrator
> > > liveupdate: luo_core: integrate with KHO
> > > liveupdate: luo_subsystems: add subsystem registration
> > > liveupdate: luo_subsystems: implement subsystem callbacks
> > > liveupdate: luo_files: add infrastructure for FDs
> > > liveupdate: luo_files: implement file systems callbacks
> > > liveupdate: luo_ioctl: add ioctl interface
> > > liveupdate: luo_sysfs: add sysfs state monitoring
> > > reboot: call liveupdate_reboot() before kexec
> > > liveupdate: luo_files: luo_ioctl: session-based file descriptor
> > > tracking
> > > kho: move kho debugfs directory to liveupdate
> > > liveupdate: add selftests for subsystems un/registration
> > > selftests/liveupdate: add subsystem/state tests
> > > docs: add luo documentation
> > > MAINTAINERS: add liveupdate entry
> > >
> > > Pratyush Yadav (8):
> > > mm: shmem: use SHMEM_F_* flags instead of VM_* flags
> > > mm: shmem: allow freezing inode mapping
> > > mm: shmem: export some functions to internal.h
> > > luo: allow preserving memfd
> > > docs: add documentation for memfd preservation via LUO
> > > tools: introduce libluo
> > > libluo: introduce luoctl
> > > libluo: add tests
> > >
> > > .../ABI/testing/sysfs-kernel-liveupdate | 51 +
> > > Documentation/admin-guide/index.rst | 1 +
> > > Documentation/admin-guide/liveupdate.rst | 16 +
> > > Documentation/core-api/index.rst | 1 +
> > > Documentation/core-api/kho/concepts.rst | 2 +-
> > > Documentation/core-api/liveupdate.rst | 57 ++
> > > Documentation/mm/index.rst | 1 +
> > > Documentation/mm/memfd_preservation.rst | 138 +++
> > > Documentation/userspace-api/index.rst | 1 +
> > > .../userspace-api/ioctl/ioctl-number.rst | 2 +
> > > Documentation/userspace-api/liveupdate.rst | 25 +
> > > MAINTAINERS | 20 +-
> > > include/linux/kexec_handover.h | 53 +-
> > > include/linux/liveupdate.h | 235 +++++
> > > include/linux/shmem_fs.h | 23 +
> > > include/uapi/linux/liveupdate.h | 265 +++++
> > > init/Kconfig | 2 +
> > > kernel/Kconfig.kexec | 14 -
> > > kernel/Makefile | 2 +-
> > > kernel/liveupdate/Kconfig | 90 ++
> > > kernel/liveupdate/Makefile | 13 +
> > > kernel/{ => liveupdate}/kexec_handover.c | 556 +++++-----
> > > kernel/liveupdate/kexec_handover_debug.c | 222 ++++
> > > kernel/liveupdate/kexec_handover_internal.h | 45 +
> > > kernel/liveupdate/luo_core.c | 525 ++++++++++
> > > kernel/liveupdate/luo_files.c | 946 ++++++++++++++++++
> > > kernel/liveupdate/luo_internal.h | 47 +
> > > kernel/liveupdate/luo_ioctl.c | 192 ++++
> > > kernel/liveupdate/luo_selftests.c | 344 +++++++
> > > kernel/liveupdate/luo_selftests.h | 84 ++
> > > kernel/liveupdate/luo_subsystems.c | 420 ++++++++
> > > kernel/liveupdate/luo_sysfs.c | 92 ++
> > > kernel/reboot.c | 4 +
> > > mm/Makefile | 1 +
> > > mm/internal.h | 6 +
> > > mm/memblock.c | 56 +-
> > > mm/memfd_luo.c | 501 ++++++++++
> > > mm/shmem.c | 46 +-
> > > tools/lib/luo/LICENSE | 165 +++
> > > tools/lib/luo/Makefile | 45 +
> > > tools/lib/luo/README.md | 166 +++
> > > tools/lib/luo/cli/.gitignore | 1 +
> > > tools/lib/luo/cli/Makefile | 18 +
> > > tools/lib/luo/cli/luoctl.c | 178 ++++
> > > tools/lib/luo/include/libluo.h | 128 +++
> > > tools/lib/luo/include/liveupdate.h | 265 +++++
> > > tools/lib/luo/libluo.c | 203 ++++
> > > tools/lib/luo/tests/.gitignore | 1 +
> > > tools/lib/luo/tests/Makefile | 18 +
> > > tools/lib/luo/tests/test.c | 848 ++++++++++++++++
> > > tools/testing/selftests/Makefile | 1 +
> > > tools/testing/selftests/liveupdate/.gitignore | 1 +
> > > tools/testing/selftests/liveupdate/Makefile | 7 +
> > > tools/testing/selftests/liveupdate/config | 6 +
> > > .../testing/selftests/liveupdate/liveupdate.c | 356 +++++++
> > > 55 files changed, 7091 insertions(+), 415 deletions(-)
> > > create mode 100644 Documentation/ABI/testing/sysfs-kernel-liveupdate
> > > create mode 100644 Documentation/admin-guide/liveupdate.rst
> > > create mode 100644 Documentation/core-api/liveupdate.rst
> > > create mode 100644 Documentation/mm/memfd_preservation.rst
> > > create mode 100644 Documentation/userspace-api/liveupdate.rst
> > > create mode 100644 include/linux/liveupdate.h
> > > create mode 100644 include/uapi/linux/liveupdate.h
> > > create mode 100644 kernel/liveupdate/Kconfig
> > > create mode 100644 kernel/liveupdate/Makefile
> > > rename kernel/{ => liveupdate}/kexec_handover.c (74%)
> > > create mode 100644 kernel/liveupdate/kexec_handover_debug.c
> > > create mode 100644 kernel/liveupdate/kexec_handover_internal.h
> > > create mode 100644 kernel/liveupdate/luo_core.c
> > > create mode 100644 kernel/liveupdate/luo_files.c
> > > create mode 100644 kernel/liveupdate/luo_internal.h
> > > create mode 100644 kernel/liveupdate/luo_ioctl.c
> > > create mode 100644 kernel/liveupdate/luo_selftests.c
> > > create mode 100644 kernel/liveupdate/luo_selftests.h
> > > create mode 100644 kernel/liveupdate/luo_subsystems.c
> > > create mode 100644 kernel/liveupdate/luo_sysfs.c
> > > create mode 100644 mm/memfd_luo.c
> > > create mode 100644 tools/lib/luo/LICENSE
> > > create mode 100644 tools/lib/luo/Makefile
> > > create mode 100644 tools/lib/luo/README.md
> > > create mode 100644 tools/lib/luo/cli/.gitignore
> > > create mode 100644 tools/lib/luo/cli/Makefile
> > > create mode 100644 tools/lib/luo/cli/luoctl.c
> > > create mode 100644 tools/lib/luo/include/libluo.h
> > > create mode 100644 tools/lib/luo/include/liveupdate.h
> > > create mode 100644 tools/lib/luo/libluo.c
> > > create mode 100644 tools/lib/luo/tests/.gitignore
> > > create mode 100644 tools/lib/luo/tests/Makefile
> > > create mode 100644 tools/lib/luo/tests/test.c
> > > create mode 100644 tools/testing/selftests/liveupdate/.gitignore
> > > create mode 100644 tools/testing/selftests/liveupdate/Makefile
> > > create mode 100644 tools/testing/selftests/liveupdate/config
> > > create mode 100644 tools/testing/selftests/liveupdate/liveupdate.c
> > >
> > > --
> > > 2.50.0.727.gbf7dc18ff4-goog
> > >
> >
> > --
> > "Thought is the essence of where you are now."
>
--
"Thought is the essence of where you are now."
^ permalink raw reply
* Re: [PATCH v1 03/32] kho: warn if KHO is disabled due to an error
From: Randy Dunlap @ 2025-06-25 23:56 UTC (permalink / raw)
To: Pasha Tatashin, pratyush, jasonmiu, graf, changyuanl, rppt,
dmatlack, rientjes, corbet, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel
In-Reply-To: <20250625231838.1897085-4-pasha.tatashin@soleen.com>
On 6/25/25 4:17 PM, Pasha Tatashin wrote:
> During boot scratch area is allocated based on command line
> parameters or auto calculated. However, scratch area may fail
> to allocate, and in that case KHO is disabled. Currently,
> no warning is printed that KHO is disabled, which makes it
> confusing for the end user to figure out why KHO is not
> available. Add the missing warning message.
Are users even going to know what "KHO" means in the warning message?
>
> Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
> ---
> kernel/kexec_handover.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/kernel/kexec_handover.c b/kernel/kexec_handover.c
> index 1ff6b242f98c..069d5890841c 100644
> --- a/kernel/kexec_handover.c
> +++ b/kernel/kexec_handover.c
> @@ -565,6 +565,7 @@ static void __init kho_reserve_scratch(void)
> err_free_scratch_desc:
> memblock_free(kho_scratch, kho_scratch_cnt * sizeof(*kho_scratch));
> err_disable_kho:
> + pr_warn("Failed to reserve scratch area, disabling KHO\n");
> kho_enable = false;
> }
>
--
~Randy
^ permalink raw reply
* Re: [PATCH v1 21/32] liveupdate: add selftests for subsystems un/registration
From: Randy Dunlap @ 2025-06-26 0:06 UTC (permalink / raw)
To: Pasha Tatashin, pratyush, jasonmiu, graf, changyuanl, rppt,
dmatlack, rientjes, corbet, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel
In-Reply-To: <20250625231838.1897085-22-pasha.tatashin@soleen.com>
On 6/25/25 4:18 PM, Pasha Tatashin wrote:
> diff --git a/kernel/liveupdate/Kconfig b/kernel/liveupdate/Kconfig
> index 75a17ca8a592..db7bbff3edec 100644
> --- a/kernel/liveupdate/Kconfig
> +++ b/kernel/liveupdate/Kconfig
> @@ -47,6 +47,21 @@ config LIVEUPDATE_SYSFS_API
>
> If unsure, say N.
>
> +config LIVEUPDATE_SELFTESTS
> + bool "Live Update Orchestrator - self tests"
self-tests"
as below...
> + depends on LIVEUPDATE
> + help
> + Say Y here to build self-tests for the LUO framework. When enabled,
> + these tests can be initiated via the ioctl interface to help verify
> + the core live update functionality.
> +
> + This option is primarily intended for developers working on the
> + live update feature or for validation purposes during system
> + integration.
> +
> + If you are unsure or are building a production kernel where size
> + or attack surface is a concern, say N.
--
~Randy
^ permalink raw reply
* Re: [PATCH v1 17/32] liveupdate: luo_sysfs: add sysfs state monitoring
From: Randy Dunlap @ 2025-06-26 0:29 UTC (permalink / raw)
To: Pasha Tatashin, pratyush, jasonmiu, graf, changyuanl, rppt,
dmatlack, rientjes, corbet, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel
In-Reply-To: <20250625231838.1897085-18-pasha.tatashin@soleen.com>
Hi,
On 6/25/25 4:18 PM, Pasha Tatashin wrote:
> diff --git a/Documentation/ABI/testing/sysfs-kernel-liveupdate b/Documentation/ABI/testing/sysfs-kernel-liveupdate
> new file mode 100644
> index 000000000000..4cd4a4fe2f93
> --- /dev/null
> +++ b/Documentation/ABI/testing/sysfs-kernel-liveupdate
> @@ -0,0 +1,51 @@
> +What: /sys/kernel/liveupdate/
> +Date: May 2025
> +KernelVersion: 6.16.0
> +Contact: pasha.tatashin@soleen.com
> +Description: Directory containing interfaces to query the live
> + update orchestrator. Live update is the ability to reboot the
> + host kernel (e.g., via kexec, without a full power cycle) while
> + keeping specifically designated devices operational ("alive")
> + across the transition. After the new kernel boots, these devices
> + can be re-attached to their original workloads (e.g., virtual
> + machines) with their state preserved. This is particularly
> + useful, for example, for quick hypervisor updates without
> + terminating running virtual machines.
> +
> +
> +What: /sys/kernel/liveupdate/state
> +Date: May 2025
> +KernelVersion: 6.16.0
> +Contact: pasha.tatashin@soleen.com
> +Description: Read-only file that displays the current state of the live
> + update orchestrator as a string. Possible values are:
> +
> + "normal": No live update operation is in progress. This is
> + the default operational state.
Just an opinion, but the ':'s after each possible value aren't needed
and just add noise.
You could just drop the ':'s -- or you could make a table here, like
Documentation/ABI/testing/sysfs-hypervisor-xen does, by adding
=========== ================================================
> + "prepared": The live update preparation phase has completed
> + successfully (e.g., triggered via the
> + /dev/liveupdate event). Kernel subsystems have
> + been notified via the %LIVEUPDATE_PREPARE
> + event/callback and should have initiated state
> + saving. User workloads (e.g., VMs) are generally
> + still running, but some operations (like device
> + unbinding or new DMA mappings) might be
> + restricted. The system is ready for the reboot
> + trigger.
> +
> + "frozen": The final reboot notification has been sent
> + (e.g., triggered via the 'reboot()' syscall),
> + corresponding to the %LIVEUPDATE_REBOOT kernel
> + event. Subsystems have had their final chance to
> + save state. User workloads must be suspended.
> + The system is about to execute the reboot into
> + the new kernel (imminent kexec). This state
> + corresponds to the "blackout window".
> +
> + "updated": The system has successfully rebooted into the
> + new kernel via live update. Restoration of
> + preserved resources can now occur (typically via
> + ioctl commands). The system is awaiting the
> + final 'finish' signal after user space completes
> + restoration tasks.
and
=========== ================================================
Or just disagree or ignore. :)
--
~Randy
^ permalink raw reply
* Re: [PATCH v1 29/32] docs: add documentation for memfd preservation via LUO
From: Randy Dunlap @ 2025-06-26 2:42 UTC (permalink / raw)
To: Pasha Tatashin, pratyush, jasonmiu, graf, changyuanl, rppt,
dmatlack, rientjes, corbet, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel
In-Reply-To: <20250625231838.1897085-30-pasha.tatashin@soleen.com>
On 6/25/25 4:18 PM, Pasha Tatashin wrote:
> +Cancellation
> + If the liveupdate is canceled after going into prepared phase, the memfd
> + functions like in normal phase.
We accept one 'l' or two 'l's in cancel[l]ing words, but it would be nice to be
consistent here.
--
~Randy
^ permalink raw reply
* Re: [RFC 00/19] Kernel API Specification Framework
From: Dmitry Vyukov @ 2025-06-26 8:32 UTC (permalink / raw)
To: Sasha Levin; +Cc: kees, elver, linux-api, linux-kernel, tools, workflows
In-Reply-To: <aFwb_3EE2VMEV_tf@lappy>
On Wed, 25 Jun 2025 at 17:55, Sasha Levin <sashal@kernel.org> wrote:
>
> On Wed, Jun 25, 2025 at 10:52:46AM +0200, Dmitry Vyukov wrote:
> >On Tue, 24 Jun 2025 at 22:04, Sasha Levin <sashal@kernel.org> wrote:
> >
> >> >6. What's the goal of validation of the input arguments?
> >> >Kernel code must do this validation anyway, right.
> >> >Any non-trivial validation is hard, e.g. even for open the validation function
> >> >for file name would need to have access to flags and check file precense for
> >> >some flags combinations. That may add significant amount of non-trivial code
> >> >that duplicates main syscall logic, and that logic may also have bugs and
> >> >memory leaks.
> >>
> >> Mostly to catch divergence from the spec: think of a scenario where
> >> someone added a new param/flag/etc but forgot to update the spec - this
> >> will help catch it.
> >
> >How exactly is this supposed to work?
> >Even if we run with a unit test suite, a test suite may include some
> >incorrect inputs to check for error conditions. The framework will
> >report violations on these incorrect inputs. These are not bugs in the
> >API specifications, nor in the test suite (read false positives).
>
> Right now it would be something along the lines of the test checking for
> an expected failure message in dmesg, something along the lines of:
>
> https://github.com/linux-test-project/ltp/blob/0c99c7915f029d32de893b15b0a213ff3de210af/testcases/commands/sysctl/sysctl02.sh#L67
>
> I'm not opposed to coming up with a better story...
Oh, you mean special tests for this framework (rather than existing tests).
I don't think this is going to work in practice. Besides writing all
these specifications, we will also need to write dozens of tests per
each specification (e.g. for each fd arg one needs at least 3 tests:
-1, valid fd, inclid fd; an enum may need 5 various inputs of
something; let alone netlink specifications).
^ permalink raw reply
* Re: [RFC 00/19] Kernel API Specification Framework
From: Dmitry Vyukov @ 2025-06-26 8:37 UTC (permalink / raw)
To: Sasha Levin; +Cc: kees, elver, linux-api, linux-kernel, tools, workflows
In-Reply-To: <CACT4Y+b9u6_wx9BU0hH0L6ogGKN_+R5T7OsgJVFAWm8yeD0E7Q@mail.gmail.com>
On Thu, 26 Jun 2025 at 10:32, Dmitry Vyukov <dvyukov@google.com> wrote:
>
> On Wed, 25 Jun 2025 at 17:55, Sasha Levin <sashal@kernel.org> wrote:
> >
> > On Wed, Jun 25, 2025 at 10:52:46AM +0200, Dmitry Vyukov wrote:
> > >On Tue, 24 Jun 2025 at 22:04, Sasha Levin <sashal@kernel.org> wrote:
> > >
> > >> >6. What's the goal of validation of the input arguments?
> > >> >Kernel code must do this validation anyway, right.
> > >> >Any non-trivial validation is hard, e.g. even for open the validation function
> > >> >for file name would need to have access to flags and check file precense for
> > >> >some flags combinations. That may add significant amount of non-trivial code
> > >> >that duplicates main syscall logic, and that logic may also have bugs and
> > >> >memory leaks.
> > >>
> > >> Mostly to catch divergence from the spec: think of a scenario where
> > >> someone added a new param/flag/etc but forgot to update the spec - this
> > >> will help catch it.
> > >
> > >How exactly is this supposed to work?
> > >Even if we run with a unit test suite, a test suite may include some
> > >incorrect inputs to check for error conditions. The framework will
> > >report violations on these incorrect inputs. These are not bugs in the
> > >API specifications, nor in the test suite (read false positives).
> >
> > Right now it would be something along the lines of the test checking for
> > an expected failure message in dmesg, something along the lines of:
> >
> > https://github.com/linux-test-project/ltp/blob/0c99c7915f029d32de893b15b0a213ff3de210af/testcases/commands/sysctl/sysctl02.sh#L67
> >
> > I'm not opposed to coming up with a better story...
If the goal of validation is just indirectly validating correctness of
the specification itself, then I would look for other ways of
validating correctness of the spec.
Either removing duplication between specification and actual code
(i.e. generating it from SYSCALL_DEFINE, or the other way around) ,
then spec is correct by construction. Or, cross-validating it with
info automatically extracted from the source (using
clang/dwarf/pahole).
This would be more scalable (O(1) work, rather than thousands more
manually written tests).
> Oh, you mean special tests for this framework (rather than existing tests).
> I don't think this is going to work in practice. Besides writing all
> these specifications, we will also need to write dozens of tests per
> each specification (e.g. for each fd arg one needs at least 3 tests:
> -1, valid fd, inclid fd; an enum may need 5 various inputs of
> something; let alone netlink specifications).
^ permalink raw reply
* Re: [PATCH RFT v17 3/8] selftests: Provide helper header for shadow stack testing
From: Catalin Marinas @ 2025-06-26 11:50 UTC (permalink / raw)
To: Mark Brown
Cc: Rick P. Edgecombe, Deepak Gupta, Szabolcs Nagy, H.J. Lu,
Florian Weimer, Thomas Gleixner, Ingo Molnar, Borislav Petkov,
Dave Hansen, x86, H. Peter Anvin, Peter Zijlstra, Juri Lelli,
Vincent Guittot, Dietmar Eggemann, Steven Rostedt, Ben Segall,
Mel Gorman, Valentin Schneider, Christian Brauner, Shuah Khan,
linux-kernel, Will Deacon, jannh, Yury Khrustalev, Wilco Dijkstra,
linux-kselftest, linux-api, Kees Cook, Shuah Khan
In-Reply-To: <20250609-clone3-shadow-stack-v17-3-8840ed97ff6f@kernel.org>
On Mon, Jun 09, 2025 at 01:54:04PM +0100, Mark Brown wrote:
> While almost all users of shadow stacks should be relying on the dynamic
> linker and libc to enable the feature there are several low level test
> programs where it is useful to enable without any libc support, allowing
> testing without full system enablement. This low level testing is helpful
> during bringup of the support itself, and also in enabling coverage by
> automated testing without needing all system components in the target root
> filesystems to have enablement.
>
> Provide a header with helpers for this purpose, intended for use only by
> test programs directly exercising shadow stack interfaces.
>
> Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
> Reviewed-by: Kees Cook <kees@kernel.org>
> Tested-by: Kees Cook <kees@kernel.org>
> Acked-by: Shuah Khan <skhan@linuxfoundation.org>
> Signed-off-by: Mark Brown <broonie@kernel.org>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
^ permalink raw reply
* Re: [PATCH v1 25/32] mm: shmem: use SHMEM_F_* flags instead of VM_* flags
From: Pratyush Yadav @ 2025-06-26 13:00 UTC (permalink / raw)
To: Pasha Tatashin
Cc: pratyush, jasonmiu, graf, changyuanl, rppt, dmatlack, rientjes,
corbet, rdunlap, ilpo.jarvinen, kanie, ojeda, aliceryhl,
masahiroy, akpm, tj, yoann.congal, mmaurer, roman.gushchin,
chenridong, axboe, mark.rutland, jannh, vincent.guittot, hannes,
dan.j.williams, david, joel.granados, rostedt, anna.schumaker,
song, zhangguopeng, linux, linux-kernel, linux-doc, linux-mm,
gregkh, tglx, mingo, bp, dave.hansen, x86, hpa, rafael, dakr,
bartosz.golaszewski, cw00.choi, myungjoo.ham, yesanishhere,
Jonathan.Cameron, quic_zijuhu, aleksander.lobakin, ira.weiny,
andriy.shevchenko, leon, lukas, bhelgaas, wagi, djeffery,
stuart.w.hayes, lennart, brauner, linux-api, linux-fsdevel
In-Reply-To: <20250625231838.1897085-26-pasha.tatashin@soleen.com>
Hi all,
On Wed, Jun 25 2025, Pasha Tatashin wrote:
> From: Pratyush Yadav <ptyadav@amazon.de>
>
> shmem_inode_info::flags can have the VM flags VM_NORESERVE and
> VM_LOCKED. These are used to suppress pre-accounting or to lock the
> pages in the inode respectively. Using the VM flags directly makes it
> difficult to add shmem-specific flags that are unrelated to VM behavior
> since one would need to find a VM flag not used by shmem and re-purpose
> it.
>
> Introduce SHMEM_F_NORESERVE and SHMEM_F_LOCKED which represent the same
> information, but their bits are independent of the VM flags. Callers can
> still pass VM_NORESERVE to shmem_get_inode(), but it gets transformed to
> the shmem-specific flag internally.
>
> No functional changes intended.
I was reading through this patch again and just realized that I missed a
spot. __shmem_file_setup() passes VM flags to shmem_{un,}acct_size(),
even though it now expects SHMEM_F flag. Below fixup patch should fix
that.
--- 8< ---
From d027524e390de15af1c6d9310bf6bea0194be79f Mon Sep 17 00:00:00 2001
From: Pratyush Yadav <ptyadav@amazon.de>
Date: Thu, 26 Jun 2025 14:50:27 +0200
Subject: [PATCH] fixup! mm: shmem: use SHMEM_F_* flags instead of VM_* flags
Signed-off-by: Pratyush Yadav <ptyadav@amazon.de>
---
mm/shmem.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/mm/shmem.c b/mm/shmem.c
index 6b13eb40e7dc2..83ae446f779ef 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -5809,8 +5809,10 @@ static inline struct inode *shmem_get_inode(struct mnt_idmap *idmap,
/* common code */
static struct file *__shmem_file_setup(struct vfsmount *mnt, const char *name,
- loff_t size, unsigned long flags, unsigned int i_flags)
+ loff_t size, unsigned long vm_flags,
+ unsigned int i_flags)
{
+ unsigned long flags = (vm_flags & VM_NORESERVE) ? SHMEM_F_NORESERVE : 0;
struct inode *inode;
struct file *res;
@@ -5827,7 +5829,7 @@ static struct file *__shmem_file_setup(struct vfsmount *mnt, const char *name,
return ERR_PTR(-ENOMEM);
inode = shmem_get_inode(&nop_mnt_idmap, mnt->mnt_sb, NULL,
- S_IFREG | S_IRWXUGO, 0, flags);
+ S_IFREG | S_IRWXUGO, 0, vm_flags);
if (IS_ERR(inode)) {
shmem_unacct_size(flags, size);
return ERR_CAST(inode);
--
Regards,
Pratyush Yadav
^ permalink raw reply related
* Re: [RFC 00/19] Kernel API Specification Framework
From: Sasha Levin @ 2025-06-26 16:23 UTC (permalink / raw)
To: Dmitry Vyukov; +Cc: kees, elver, linux-api, linux-kernel, tools, workflows
In-Reply-To: <CACT4Y+b1Sou9bzhsuJ_LAjwCtynWN1iNRnaUkkTecNWxLUfMUw@mail.gmail.com>
On Thu, Jun 26, 2025 at 10:37:33AM +0200, Dmitry Vyukov wrote:
>On Thu, 26 Jun 2025 at 10:32, Dmitry Vyukov <dvyukov@google.com> wrote:
>>
>> On Wed, 25 Jun 2025 at 17:55, Sasha Levin <sashal@kernel.org> wrote:
>> >
>> > On Wed, Jun 25, 2025 at 10:52:46AM +0200, Dmitry Vyukov wrote:
>> > >On Tue, 24 Jun 2025 at 22:04, Sasha Levin <sashal@kernel.org> wrote:
>> > >
>> > >> >6. What's the goal of validation of the input arguments?
>> > >> >Kernel code must do this validation anyway, right.
>> > >> >Any non-trivial validation is hard, e.g. even for open the validation function
>> > >> >for file name would need to have access to flags and check file precense for
>> > >> >some flags combinations. That may add significant amount of non-trivial code
>> > >> >that duplicates main syscall logic, and that logic may also have bugs and
>> > >> >memory leaks.
>> > >>
>> > >> Mostly to catch divergence from the spec: think of a scenario where
>> > >> someone added a new param/flag/etc but forgot to update the spec - this
>> > >> will help catch it.
>> > >
>> > >How exactly is this supposed to work?
>> > >Even if we run with a unit test suite, a test suite may include some
>> > >incorrect inputs to check for error conditions. The framework will
>> > >report violations on these incorrect inputs. These are not bugs in the
>> > >API specifications, nor in the test suite (read false positives).
>> >
>> > Right now it would be something along the lines of the test checking for
>> > an expected failure message in dmesg, something along the lines of:
>> >
>> > https://github.com/linux-test-project/ltp/blob/0c99c7915f029d32de893b15b0a213ff3de210af/testcases/commands/sysctl/sysctl02.sh#L67
>> >
>> > I'm not opposed to coming up with a better story...
>
>If the goal of validation is just indirectly validating correctness of
>the specification itself, then I would look for other ways of
>validating correctness of the spec.
>Either removing duplication between specification and actual code
>(i.e. generating it from SYSCALL_DEFINE, or the other way around) ,
>then spec is correct by construction. Or, cross-validating it with
>info automatically extracted from the source (using
>clang/dwarf/pahole).
>This would be more scalable (O(1) work, rather than thousands more
>manually written tests).
>
>> Oh, you mean special tests for this framework (rather than existing tests).
>> I don't think this is going to work in practice. Besides writing all
>> these specifications, we will also need to write dozens of tests per
>> each specification (e.g. for each fd arg one needs at least 3 tests:
>> -1, valid fd, inclid fd; an enum may need 5 various inputs of
>> something; let alone netlink specifications).
I didn't mean just for the framework: being able to specify the APIs in
machine readable format will enable us to automatically generate
exhaustive tests for each such API.
I've been playing with the kapi tool (see last patch) which already
supports different formatters. Right now it outputs human readable
output, but I have proof-of-concept code that outputs testcases for
specced APIs.
The dream here is to be able to automatically generate
hundreds/thousands of tests for each API in an automated fashion, and
verify the results with:
1. Simply checking expected return value.
2. Checking that the actual action happened (i.e. we called close(fd),
verify that `fd` is really closed).
3. Check for side effects (i.e. close(fd) isn't supposed to allocate
memory - verify that it didn't allocate memory).
4. Code coverage: our tests are supposed to cover 100% of the code in
that APIs call chain, do we have code that didn't run (missing/incorrect
specs).
--
Thanks,
Sasha
^ permalink raw reply
* [PATCH v5 0/7] futex: Create set_robust_list2
From: André Almeida @ 2025-06-26 17:11 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Peter Zijlstra, Darren Hart,
Davidlohr Bueso, Shuah Khan, Arnd Bergmann,
Sebastian Andrzej Siewior, Waiman Long
Cc: linux-kernel, linux-kselftest, linux-api, kernel-dev,
André Almeida
This patch adds a new robust_list() syscall. The current syscall
can't be expanded to cover the following use case, so a new one is
needed. This new syscall allows users to set multiple robust lists per
process and to have either 32bit or 64bit pointers in the list.
* Use case
FEX-Emu[1] is an application that runs x86 and x86-64 binaries on an
AArch64 Linux host. One of the tasks of FEX-Emu is to translate syscalls
from one platform to another. Existing set_robust_list() can't be easily
translated because of two limitations:
1) x86 apps can have 32bit pointers robust lists. For a x86-64 kernel
this is not a problem, because of the compat entry point. But there's
no such compat entry point for AArch64, so the kernel would do the
pointer arithmetic wrongly. Is also unviable to userspace to keep
track every addition/removal to the robust list and keep a 64bit
version of it somewhere else to feed the kernel. Thus, the new
interface has an option of telling the kernel if the list is filled
with 32bit or 64bit pointers.
2) Apps can set just one robust list (in theory, x86-64 can set two if
they also use the compat entry point). That means that when a x86 app
asks FEX-Emu to call set_robust_list(), FEX have two options: to
overwrite their own robust list pointer and make the app robust, or
to ignore the app robust list and keep the emulator robust. The new
interface allows for multiple robust lists per application, solving
this.
* Interface
This is the proposed interface:
long set_robust_list2(void *head, int index, unsigned int flags)
`head` is the head of the userspace struct robust_list_head, just as old
set_robust_list(). It needs to be a void pointer since it can point to a normal
robust_list_head or a compat_robust_list_head.
`flags` can be used for defining the list type:
enum robust_list_type {
ROBUST_LIST_32BIT,
ROBUST_LIST_64BIT,
};
`index` is the index in the internal robust_list's linked list (the naming
starts to get confusing, I reckon). If `index == -1`, that means that user wants
to set a new robust_list, and the kernel will append it in the end of the list,
assign a new index and return this index to the user. If `index >= 0`, that
means that user wants to re-set `*head` of an already existing list (similarly
to what happens when you call set_robust_list() twice with different `*head`).
If `index` is out of range, or it points to a non-existing robust_list, or if
the internal list is full, an error is returned.
* Implementation
The implementation re-uses most of the existing robust list interface as
possible. The new task_struct member `struct list_head robust_list2` is just a
linked list where new lists are appended as the user requests more lists, and by
futex_cleanup(), the kernel walks through the internal list feeding
exit_robust_list() with the robust_list's.
This implementation supports up to 10 lists (defined at ROBUST_LISTS_PER_TASK),
but it was an arbitrary number for this RFC. For the described use case above, 4
should be enough, I'm not sure which should be the limit.
It doesn't support list removal (should it support?). It doesn't have a proper
get_robust_list2() yet as well, but I can add it in a next revision. We could
also have a generic robust_list() syscall that can be used to set/get and be
controlled by flags.
The new interface has a `unsigned int flags` argument, making it
extensible for future use cases as well.
It refuses unaligned `head` addresses. It doesn't have a limit for elements in a
single list (like ROBUST_LIST_LIMIT), it destroys the list as it is parsed to be
safe against circular lists.
* Testing
This patcheset has a selftest patch that expands this one:
https://lore.kernel.org/lkml/20250212131123.37431-1-andrealmeid@igalia.com/
Also, FEX-Emu added support for this interface to validate it:
https://github.com/FEX-Emu/FEX/pull/3966
Feedback is very welcomed!
Thanks,
André
[1] https://github.com/FEX-Emu/FEX
Changelog:
- Fixed compilation issues when CONFIG_COMPAT or CONFIG_FUTEX are not
set
- Rebased on top of new futex work (private hash)
v4: https://lore.kernel.org/lkml/20250225183531.682556-1-andrealmeid@igalia.com/
- Refuse unaligned head pointers
- Ignore ROBUST_LIST_LIMIT for lists created with this interface and make it
robust against circular lists
- Fix a get_robust_list() syscall bug for getting the list from another thread
- Adapt selftest to use the new interface
v3: https://lore.kernel.org/lkml/20241217174958.477692-1-andrealmeid@igalia.com/
- Old syscall set_robust_list() adds new head to the internal linked list of
robust lists pointers, instead of having a field just for them. Remove
tsk->robust_list and use only tsk->robust_list2
v2: https://lore.kernel.org/lkml/20241101162147.284993-1-andrealmeid@igalia.com/
- Added a patch to properly deal with exit_robust_list() in 64bit vs 32bit
- Wired-up syscall for all archs
- Added more of the cover letter to the commit message
v1: https://lore.kernel.org/lkml/20241024145735.162090-1-andrealmeid@igalia.com/
---
André Almeida (7):
selftests/futex: Add ASSERT_ macros
selftests/futex: Create test for robust list
futex: Use explicit sizes for compat_exit_robust_list
futex: Create set_robust_list2
futex: Remove the limit of elements for sys_set_robust_list2 lists
futex: Wire up set_robust_list2 syscall
selftests: futex: Expand robust list test for the new interface
arch/alpha/kernel/syscalls/syscall.tbl | 1 +
arch/arm/tools/syscall.tbl | 1 +
arch/m68k/kernel/syscalls/syscall.tbl | 1 +
arch/microblaze/kernel/syscalls/syscall.tbl | 1 +
arch/mips/kernel/syscalls/syscall_n32.tbl | 1 +
arch/mips/kernel/syscalls/syscall_n64.tbl | 1 +
arch/mips/kernel/syscalls/syscall_o32.tbl | 1 +
arch/parisc/kernel/syscalls/syscall.tbl | 1 +
arch/powerpc/kernel/syscalls/syscall.tbl | 1 +
arch/s390/kernel/syscalls/syscall.tbl | 1 +
arch/sh/kernel/syscalls/syscall.tbl | 1 +
arch/sparc/kernel/syscalls/syscall.tbl | 1 +
arch/x86/entry/syscalls/syscall_32.tbl | 1 +
arch/x86/entry/syscalls/syscall_64.tbl | 1 +
arch/xtensa/kernel/syscalls/syscall.tbl | 1 +
include/linux/compat.h | 12 +-
include/linux/futex.h | 30 +-
include/linux/sched.h | 5 +-
include/uapi/asm-generic/unistd.h | 2 +
include/uapi/linux/futex.h | 10 +
kernel/futex/core.c | 156 ++++-
kernel/futex/futex.h | 5 +
kernel/futex/syscalls.c | 85 ++-
kernel/sys_ni.c | 1 +
scripts/syscall.tbl | 1 +
.../testing/selftests/futex/functional/.gitignore | 1 +
tools/testing/selftests/futex/functional/Makefile | 3 +-
.../selftests/futex/functional/robust_list.c | 706 +++++++++++++++++++++
tools/testing/selftests/futex/include/logging.h | 38 ++
29 files changed, 1021 insertions(+), 49 deletions(-)
---
base-commit: a24cc6ce1933eade12aa2b9859de0fcd2dac2c06
change-id: 20250225-tonyk-robust_futex-60adeedac695
Best regards,
--
André Almeida <andrealmeid@igalia.com>
^ permalink raw reply
* [PATCH v5 1/7] selftests/futex: Add ASSERT_ macros
From: André Almeida @ 2025-06-26 17:11 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Peter Zijlstra, Darren Hart,
Davidlohr Bueso, Shuah Khan, Arnd Bergmann,
Sebastian Andrzej Siewior, Waiman Long
Cc: linux-kernel, linux-kselftest, linux-api, kernel-dev,
André Almeida
In-Reply-To: <20250626-tonyk-robust_futex-v5-0-179194dbde8f@igalia.com>
Create ASSERT_{EQ, NE, TRUE, FALSE} macros to make test creation easier.
Signed-off-by: André Almeida <andrealmeid@igalia.com>
---
tools/testing/selftests/futex/include/logging.h | 38 +++++++++++++++++++++++++
1 file changed, 38 insertions(+)
diff --git a/tools/testing/selftests/futex/include/logging.h b/tools/testing/selftests/futex/include/logging.h
index 874c69ce5cce9efa3a9d6de246f5972a75437dbf..a19755622a877932884570c8f58aaee7371d5f8f 100644
--- a/tools/testing/selftests/futex/include/logging.h
+++ b/tools/testing/selftests/futex/include/logging.h
@@ -23,6 +23,44 @@
#include <linux/futex.h>
#include "kselftest.h"
+#define ASSERT_EQ(var, value) \
+do { \
+ if (var != value) { \
+ ksft_test_result_fail("%s: expected %ld, but %s has %ld\n", \
+ __func__, (long) value, #var, \
+ (long) var); \
+ return; \
+ } \
+} while (0)
+
+#define ASSERT_NE(var, value) \
+do { \
+ if (var == value) { \
+ ksft_test_result_fail("%s: expected not %ld, but %s has %ld\n", \
+ __func__, (long) value, #var, \
+ (long) var); \
+ return; \
+ } \
+} while (0)
+
+#define ASSERT_TRUE(var) \
+do { \
+ if ((var) == 0) { \
+ ksft_test_result_fail("%s: expected %s to be true\n", \
+ __func__, #var); \
+ return; \
+ } \
+} while (0)
+
+#define ASSERT_FALSE(var) \
+do { \
+ if (var) { \
+ ksft_test_result_fail("%s: expected %s to be false\n", \
+ __func__, #var); \
+ return; \
+ } \
+} while (0)
+
/*
* Define PASS, ERROR, and FAIL strings with and without color escape
* sequences, default to no color.
--
2.49.0
^ permalink raw reply related
* [PATCH v5 2/7] selftests/futex: Create test for robust list
From: André Almeida @ 2025-06-26 17:11 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Peter Zijlstra, Darren Hart,
Davidlohr Bueso, Shuah Khan, Arnd Bergmann,
Sebastian Andrzej Siewior, Waiman Long
Cc: linux-kernel, linux-kselftest, linux-api, kernel-dev,
André Almeida
In-Reply-To: <20250626-tonyk-robust_futex-v5-0-179194dbde8f@igalia.com>
Create a test for the robust list mechanism. Test the following uAPI
operations:
- Creating a robust mutex where the lock waiter is wake by the kernel
when the lock owner died
- Setting a robust list to the current task
- Getting a robust list from the current task
- Getting a robust list from another task
- Using the list_op_pending field from robust_list_head struct to test
robustness when the lock owner dies before completing the locking
- Setting a invalid size for syscall argument `len`
- Adding multiple elements to a robust list wait waiting for each of
them
- Creating a circular list and checking that the kernel does not get
stuck in an infinity loop
This is the expected output:
TAP version 13
1..7
ok 1 test_robustness
ok 2 test_set_robust_list_invalid_size
ok 3 test_get_robust_list_self
ok 4 test_get_robust_list_child
ok 5 test_set_list_op_pending
ok 6 test_robust_list_multiple_elements
ok 7 test_circular_list
# Totals: pass:7 fail:0 xfail:0 xpass:0 skip:0 error:0
Signed-off-by: André Almeida <andrealmeid@igalia.com>
---
.../testing/selftests/futex/functional/.gitignore | 1 +
tools/testing/selftests/futex/functional/Makefile | 3 +-
.../selftests/futex/functional/robust_list.c | 554 +++++++++++++++++++++
3 files changed, 557 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/futex/functional/.gitignore b/tools/testing/selftests/futex/functional/.gitignore
index 7b24ae89594a9db211d4b8469ebcef8d1f7012d8..7f447ebfbc62bbad9add0dc86a75abcdb8a4d9a7 100644
--- a/tools/testing/selftests/futex/functional/.gitignore
+++ b/tools/testing/selftests/futex/functional/.gitignore
@@ -11,3 +11,4 @@ futex_wait_timeout
futex_wait_uninitialized_heap
futex_wait_wouldblock
futex_waitv
+robust_list
diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile
index 8cfb87f7f7c5059c82f1e6290c076d3f13f5ea41..e6fa66e622dee4de74c31c8b9b486ca01de35737 100644
--- a/tools/testing/selftests/futex/functional/Makefile
+++ b/tools/testing/selftests/futex/functional/Makefile
@@ -20,7 +20,8 @@ TEST_GEN_PROGS := \
futex_priv_hash \
futex_numa_mpol \
futex_waitv \
- futex_numa
+ futex_numa \
+ robust_list
TEST_PROGS := run.sh
diff --git a/tools/testing/selftests/futex/functional/robust_list.c b/tools/testing/selftests/futex/functional/robust_list.c
new file mode 100644
index 0000000000000000000000000000000000000000..42690b2440fd29a9b12c46f67f9645ccc93d1147
--- /dev/null
+++ b/tools/testing/selftests/futex/functional/robust_list.c
@@ -0,0 +1,554 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2024 Igalia S.L.
+ *
+ * Robust list test by André Almeida <andrealmeid@igalia.com>
+ *
+ * The robust list uAPI allows userspace to create "robust" locks, in the sense
+ * that if the lock holder thread dies, the remaining threads that are waiting
+ * for the lock won't block forever, waiting for a lock that will never be
+ * released.
+ *
+ * This is achieve by userspace setting a list where a thread can enter all the
+ * locks (futexes) that it is holding. The robust list is a linked list, and
+ * userspace register the start of the list with the syscall set_robust_list().
+ * If such thread eventually dies, the kernel will walk this list, waking up one
+ * thread waiting for each futex and marking the futex word with the flag
+ * FUTEX_OWNER_DIED.
+ *
+ * See also
+ * man set_robust_list
+ * Documententation/locking/robust-futex-ABI.rst
+ * Documententation/locking/robust-futexes.rst
+ */
+
+#define _GNU_SOURCE
+
+#include "futextest.h"
+#include "logging.h"
+
+#include <errno.h>
+#include <pthread.h>
+#include <signal.h>
+#include <stdatomic.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <sys/mman.h>
+#include <sys/wait.h>
+
+#define STACK_SIZE (1024 * 1024)
+
+#define FUTEX_TIMEOUT 3
+
+static pthread_barrier_t barrier, barrier2;
+
+int set_robust_list(struct robust_list_head *head, size_t len)
+{
+ return syscall(SYS_set_robust_list, head, len);
+}
+
+int get_robust_list(int pid, struct robust_list_head **head, size_t *len_ptr)
+{
+ return syscall(SYS_get_robust_list, pid, head, len_ptr);
+}
+
+/*
+ * Basic lock struct, contains just the futex word and the robust list element
+ * Real implementations have also a *prev to easily walk in the list
+ */
+struct lock_struct {
+ _Atomic(unsigned int) futex;
+ struct robust_list list;
+};
+
+/*
+ * Helper function to spawn a child thread. Returns -1 on error, pid on success
+ */
+static int create_child(int (*fn)(void *arg), void *arg)
+{
+ char *stack;
+ pid_t pid;
+
+ stack = mmap(NULL, STACK_SIZE, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0);
+ if (stack == MAP_FAILED)
+ return -1;
+
+ stack += STACK_SIZE;
+
+ pid = clone(fn, stack, CLONE_VM | SIGCHLD, arg);
+
+ if (pid == -1)
+ return -1;
+
+ return pid;
+}
+
+/*
+ * Helper function to prepare and register a robust list
+ */
+static int set_list(struct robust_list_head *head)
+{
+ int ret;
+
+ ret = set_robust_list(head, sizeof(struct robust_list_head));
+ if (ret)
+ return ret;
+
+ head->futex_offset = (size_t) offsetof(struct lock_struct, futex) -
+ (size_t) offsetof(struct lock_struct, list);
+ head->list.next = &head->list;
+ head->list_op_pending = NULL;
+
+ return 0;
+}
+
+/*
+ * A basic (and incomplete) mutex lock function with robustness
+ */
+static int mutex_lock(struct lock_struct *lock, struct robust_list_head *head, bool error_inject)
+{
+ _Atomic(unsigned int) *futex = &lock->futex;
+ unsigned int zero = 0;
+ int ret = -1;
+ pid_t tid = gettid();
+
+ /*
+ * Set list_op_pending before starting the lock, so the kernel can catch
+ * the case where the thread died during the lock operation
+ */
+ head->list_op_pending = &lock->list;
+
+ if (atomic_compare_exchange_strong(futex, &zero, tid)) {
+ /*
+ * We took the lock, insert it in the robust list
+ */
+ struct robust_list *list = &head->list;
+
+ /* Error injection to test list_op_pending */
+ if (error_inject)
+ return 0;
+
+ while (list->next != &head->list)
+ list = list->next;
+
+ list->next = &lock->list;
+ lock->list.next = &head->list;
+
+ ret = 0;
+ } else {
+ /*
+ * We didn't take the lock, wait until the owner wakes (or dies)
+ */
+ struct timespec to;
+
+ to.tv_sec = FUTEX_TIMEOUT;
+ to.tv_nsec = 0;
+
+ tid = atomic_load(futex);
+ /* Kernel ignores futexes without the waiters flag */
+ tid |= FUTEX_WAITERS;
+ atomic_store(futex, tid);
+
+ ret = futex_wait((futex_t *) futex, tid, &to, 0);
+
+ /*
+ * A real mutex_lock() implementation would loop here to finally
+ * take the lock. We don't care about that, so we stop here.
+ */
+ }
+
+ head->list_op_pending = NULL;
+
+ return ret;
+}
+
+/*
+ * This child thread will succeed taking the lock, and then will exit holding it
+ */
+static int child_fn_lock(void *arg)
+{
+ struct lock_struct *lock = (struct lock_struct *) arg;
+ struct robust_list_head head;
+ int ret;
+
+ ret = set_list(&head);
+ if (ret)
+ ksft_test_result_fail("set_robust_list error\n");
+
+ ret = mutex_lock(lock, &head, false);
+ if (ret)
+ ksft_test_result_fail("mutex_lock error\n");
+
+ pthread_barrier_wait(&barrier);
+
+ /*
+ * There's a race here: the parent thread needs to be inside
+ * futex_wait() before the child thread dies, otherwise it will miss the
+ * wakeup from handle_futex_death() that this child will emit. We wait a
+ * little bit just to make sure that this happens.
+ */
+ sleep(1);
+
+ return 0;
+}
+
+/*
+ * Spawns a child thread that will set a robust list, take the lock, register it
+ * in the robust list and die. The parent thread will wait on this futex, and
+ * should be waken up when the child exits.
+ */
+static void test_robustness(void)
+{
+ struct lock_struct lock = { .futex = 0 };
+ struct robust_list_head head;
+ _Atomic(unsigned int) *futex = &lock.futex;
+ int ret;
+
+ ret = set_list(&head);
+ ASSERT_EQ(ret, 0);
+
+ /*
+ * Lets use a barrier to ensure that the child thread takes the lock
+ * before the parent
+ */
+ ret = pthread_barrier_init(&barrier, NULL, 2);
+ ASSERT_EQ(ret, 0);
+
+ ret = create_child(&child_fn_lock, &lock);
+ ASSERT_NE(ret, -1);
+
+ pthread_barrier_wait(&barrier);
+ ret = mutex_lock(&lock, &head, false);
+
+ /*
+ * futex_wait() should return 0 and the futex word should be marked with
+ * FUTEX_OWNER_DIED
+ */
+ ASSERT_EQ(ret, 0);
+ if (ret != 0)
+ printf("futex wait returned %d", errno);
+
+ ASSERT_TRUE(*futex | FUTEX_OWNER_DIED);
+
+ wait(NULL);
+ pthread_barrier_destroy(&barrier);
+
+ ksft_test_result_pass("%s\n", __func__);
+}
+
+/*
+ * The only valid value for len is sizeof(*head)
+ */
+static void test_set_robust_list_invalid_size(void)
+{
+ struct robust_list_head head;
+ size_t head_size = sizeof(struct robust_list_head);
+ int ret;
+
+ ret = set_robust_list(&head, head_size);
+ ASSERT_EQ(ret, 0);
+
+ ret = set_robust_list(&head, head_size * 2);
+ ASSERT_EQ(ret, -1);
+ ASSERT_EQ(errno, EINVAL);
+
+ ret = set_robust_list(&head, head_size - 1);
+ ASSERT_EQ(ret, -1);
+ ASSERT_EQ(errno, EINVAL);
+
+ ret = set_robust_list(&head, 0);
+ ASSERT_EQ(ret, -1);
+ ASSERT_EQ(errno, EINVAL);
+
+ ksft_test_result_pass("%s\n", __func__);
+}
+
+/*
+ * Test get_robust_list with pid = 0, getting the list of the running thread
+ */
+static void test_get_robust_list_self(void)
+{
+ struct robust_list_head head, head2, *get_head;
+ size_t head_size = sizeof(struct robust_list_head), len_ptr;
+ int ret;
+
+ ret = set_robust_list(&head, head_size);
+ ASSERT_EQ(ret, 0);
+
+ ret = get_robust_list(0, &get_head, &len_ptr);
+ ASSERT_EQ(ret, 0);
+ ASSERT_EQ(get_head, &head);
+ ASSERT_EQ(head_size, len_ptr);
+
+ ret = set_robust_list(&head2, head_size);
+ ASSERT_EQ(ret, 0);
+
+ ret = get_robust_list(0, &get_head, &len_ptr);
+ ASSERT_EQ(ret, 0);
+ ASSERT_EQ(get_head, &head2);
+ ASSERT_EQ(head_size, len_ptr);
+
+ ksft_test_result_pass("%s\n", __func__);
+}
+
+static int child_list(void *arg)
+{
+ struct robust_list_head *head = (struct robust_list_head *) arg;
+ int ret;
+
+ ret = set_robust_list(head, sizeof(struct robust_list_head));
+ if (ret)
+ ksft_test_result_fail("set_robust_list error\n");
+
+ pthread_barrier_wait(&barrier);
+ pthread_barrier_wait(&barrier2);
+
+ return 0;
+}
+
+/*
+ * Test get_robust_list from another thread. We use two barriers here to ensure
+ * that:
+ * 1) the child thread set the list before we try to get it from the
+ * parent
+ * 2) the child thread still alive when we try to get the list from it
+ */
+static void test_get_robust_list_child(void)
+{
+ pid_t tid;
+ int ret;
+ struct robust_list_head head, *get_head;
+ size_t len_ptr;
+
+ ret = pthread_barrier_init(&barrier, NULL, 2);
+ ret = pthread_barrier_init(&barrier2, NULL, 2);
+ ASSERT_EQ(ret, 0);
+
+ tid = create_child(&child_list, &head);
+ ASSERT_NE(tid, -1);
+
+ pthread_barrier_wait(&barrier);
+
+ ret = get_robust_list(tid, &get_head, &len_ptr);
+ ASSERT_EQ(ret, 0);
+ ASSERT_EQ(&head, get_head);
+
+ pthread_barrier_wait(&barrier2);
+
+ wait(NULL);
+ pthread_barrier_destroy(&barrier);
+ pthread_barrier_destroy(&barrier2);
+
+ ksft_test_result_pass("%s\n", __func__);
+}
+
+static int child_fn_lock_with_error(void *arg)
+{
+ struct lock_struct *lock = (struct lock_struct *) arg;
+ struct robust_list_head head;
+ int ret;
+
+ ret = set_list(&head);
+ if (ret)
+ ksft_test_result_fail("set_robust_list error\n");
+
+ ret = mutex_lock(lock, &head, true);
+ if (ret)
+ ksft_test_result_fail("mutex_lock error\n");
+
+ pthread_barrier_wait(&barrier);
+
+ sleep(1);
+
+ return 0;
+}
+
+/*
+ * Same as robustness test, but inject an error where the mutex_lock() exits
+ * earlier, just after setting list_op_pending and taking the lock, to test the
+ * list_op_pending mechanism
+ */
+static void test_set_list_op_pending(void)
+{
+ struct lock_struct lock = { .futex = 0 };
+ struct robust_list_head head;
+ _Atomic(unsigned int) *futex = &lock.futex;
+ int ret;
+
+ ret = set_list(&head);
+ ASSERT_EQ(ret, 0);
+
+ ret = pthread_barrier_init(&barrier, NULL, 2);
+ ASSERT_EQ(ret, 0);
+
+ ret = create_child(&child_fn_lock_with_error, &lock);
+ ASSERT_NE(ret, -1);
+
+ pthread_barrier_wait(&barrier);
+ ret = mutex_lock(&lock, &head, false);
+
+ ASSERT_EQ(ret, 0);
+ if (ret != 0)
+ printf("futex wait returned %d", errno);
+
+ ASSERT_TRUE(*futex | FUTEX_OWNER_DIED);
+
+ wait(NULL);
+ pthread_barrier_destroy(&barrier);
+
+ ksft_test_result_pass("%s\n", __func__);
+}
+
+#define CHILD_NR 10
+
+static int child_lock_holder(void *arg)
+{
+ struct lock_struct *locks = (struct lock_struct *) arg;
+ struct robust_list_head head;
+ int i;
+
+ set_list(&head);
+
+ for (i = 0; i < CHILD_NR; i++) {
+ locks[i].futex = 0;
+ mutex_lock(&locks[i], &head, false);
+ }
+
+ pthread_barrier_wait(&barrier);
+ pthread_barrier_wait(&barrier2);
+
+ sleep(1);
+ return 0;
+}
+
+static int child_wait_lock(void *arg)
+{
+ struct lock_struct *lock = (struct lock_struct *) arg;
+ struct robust_list_head head;
+ int ret;
+
+ pthread_barrier_wait(&barrier2);
+ ret = mutex_lock(lock, &head, false);
+
+ if (ret)
+ ksft_test_result_fail("mutex_lock error\n");
+
+ if (!(lock->futex | FUTEX_OWNER_DIED))
+ ksft_test_result_fail("futex not marked with FUTEX_OWNER_DIED\n");
+
+ return 0;
+}
+
+/*
+ * Test a robust list of more than one element. All the waiters should wake when
+ * the holder dies
+ */
+static void test_robust_list_multiple_elements(void)
+{
+ struct lock_struct locks[CHILD_NR];
+ int i, ret;
+
+ ret = pthread_barrier_init(&barrier, NULL, 2);
+ ASSERT_EQ(ret, 0);
+ ret = pthread_barrier_init(&barrier2, NULL, CHILD_NR + 1);
+ ASSERT_EQ(ret, 0);
+
+ create_child(&child_lock_holder, &locks);
+
+ /* Wait until the locker thread takes the look */
+ pthread_barrier_wait(&barrier);
+
+ for (i = 0; i < CHILD_NR; i++)
+ create_child(&child_wait_lock, &locks[i]);
+
+ /* Wait for all children to return */
+ while (wait(NULL) > 0);
+
+ pthread_barrier_destroy(&barrier);
+ pthread_barrier_destroy(&barrier2);
+
+ ksft_test_result_pass("%s\n", __func__);
+}
+
+static int child_circular_list(void *arg)
+{
+ static struct robust_list_head head;
+ struct lock_struct a, b, c;
+ int ret;
+
+ ret = set_list(&head);
+ if (ret)
+ ksft_test_result_fail("set_list error\n");
+
+ head.list.next = &a.list;
+
+ /*
+ * The last element should point to head list, but we short circuit it
+ */
+ a.list.next = &b.list;
+ b.list.next = &c.list;
+ c.list.next = &a.list;
+
+ return 0;
+}
+
+/*
+ * Create a circular robust list. The kernel should be able to destroy the list
+ * while processing it so it won't be trapped in an infinite loop while handling
+ * a process exit
+ */
+static void test_circular_list(void)
+{
+ create_child(child_circular_list, NULL);
+
+ wait(NULL);
+
+ ksft_test_result_pass("%s\n", __func__);
+}
+
+void usage(char *prog)
+{
+ printf("Usage: %s\n", prog);
+ printf(" -c Use color\n");
+ printf(" -h Display this help message\n");
+ printf(" -v L Verbosity level: %d=QUIET %d=CRITICAL %d=INFO\n",
+ VQUIET, VCRITICAL, VINFO);
+}
+
+int main(int argc, char *argv[])
+{
+ int c;
+
+ while ((c = getopt(argc, argv, "cht:v:")) != -1) {
+ switch (c) {
+ case 'c':
+ log_color(1);
+ break;
+ case 'h':
+ usage(basename(argv[0]));
+ exit(0);
+ case 'v':
+ log_verbosity(atoi(optarg));
+ break;
+ default:
+ usage(basename(argv[0]));
+ exit(1);
+ }
+ }
+
+ ksft_print_header();
+ ksft_set_plan(7);
+
+ test_robustness();
+
+ test_set_robust_list_invalid_size();
+ test_get_robust_list_self();
+ test_get_robust_list_child();
+ test_set_list_op_pending();
+ test_robust_list_multiple_elements();
+ test_circular_list();
+
+ ksft_print_cnts();
+ return 0;
+}
--
2.49.0
^ permalink raw reply related
* [PATCH v5 3/7] futex: Use explicit sizes for compat_exit_robust_list
From: André Almeida @ 2025-06-26 17:11 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Peter Zijlstra, Darren Hart,
Davidlohr Bueso, Shuah Khan, Arnd Bergmann,
Sebastian Andrzej Siewior, Waiman Long
Cc: linux-kernel, linux-kselftest, linux-api, kernel-dev,
André Almeida
In-Reply-To: <20250626-tonyk-robust_futex-v5-0-179194dbde8f@igalia.com>
There are two functions for handling robust lists during the task
exit: exit_robust_list() and compat_exit_robust_list(). The first one
handles either 64bit or 32bit lists, depending if it's a 64bit or 32bit
kernel. The compat_exit_robust_list() only exists in 64bit kernels that
supports 32bit syscalls, and handles 32bit lists.
For the new syscall set_robust_list2(), 64bit kernels need to be able to
handle 32bit lists despite having or not support for 32bit syscalls, so
make compat_exit_robust_list() exist regardless of compat_ config.
Also, use explicitly sizing, otherwise in a 32bit kernel both
exit_robust_list() and compat_exit_robust_list() would be the exactly
same function, with none of them dealing with 64bit robust lists.
Signed-off-by: André Almeida <andrealmeid@igalia.com>
---
include/linux/compat.h | 12 +-----------
include/linux/futex.h | 10 ++++++++++
include/linux/sched.h | 2 +-
kernel/futex/core.c | 48 ++++++++++++++++++++++++++++++++----------------
kernel/futex/syscalls.c | 4 ++--
5 files changed, 46 insertions(+), 30 deletions(-)
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 56cebaff0c910fda853a0e2b3d6d0517e55f8b38..968a9135ff486cf9c8be2a18b80cd4c46e890236 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -385,16 +385,6 @@ struct compat_ifconf {
compat_caddr_t ifcbuf;
};
-struct compat_robust_list {
- compat_uptr_t next;
-};
-
-struct compat_robust_list_head {
- struct compat_robust_list list;
- compat_long_t futex_offset;
- compat_uptr_t list_op_pending;
-};
-
#ifdef CONFIG_COMPAT_OLD_SIGACTION
struct compat_old_sigaction {
compat_uptr_t sa_handler;
@@ -672,7 +662,7 @@ asmlinkage long compat_sys_waitid(int, compat_pid_t,
struct compat_siginfo __user *, int,
struct compat_rusage __user *);
asmlinkage long
-compat_sys_set_robust_list(struct compat_robust_list_head __user *head,
+compat_sys_set_robust_list(struct robust_list_head32 __user *head,
compat_size_t len);
asmlinkage long
compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
diff --git a/include/linux/futex.h b/include/linux/futex.h
index b37193653e6b5d7d562ac08f93d4ee41eb8e72a2..c5b6976909c7d51360e1831e017f4d1544c258fa 100644
--- a/include/linux/futex.h
+++ b/include/linux/futex.h
@@ -55,6 +55,16 @@ union futex_key {
#define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = 0ULL } }
+struct robust_list32 {
+ u32 next;
+};
+
+struct robust_list_head32 {
+ struct robust_list32 list;
+ s32 futex_offset;
+ u32 list_op_pending;
+};
+
#ifdef CONFIG_FUTEX
enum {
FUTEX_STATE_OK,
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 4f78a64beb52c425e46c66427b2f608ba30b3d99..b0f64029d53e8b2ab56f24f77054aa7645a185c5 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1333,7 +1333,7 @@ struct task_struct {
#ifdef CONFIG_FUTEX
struct robust_list_head __user *robust_list;
#ifdef CONFIG_COMPAT
- struct compat_robust_list_head __user *compat_robust_list;
+ struct robust_list_head32 __user *compat_robust_list;
#endif
struct list_head pi_state_list;
struct futex_pi_state *pi_state_cache;
diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index 90d53fb0ee9e1563c355ef0499df441367e1a46c..f0ac4b897ddbb667fa85daf5853cb47c749d512d 100644
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -1144,15 +1144,16 @@ static inline int fetch_robust_entry(struct robust_list __user **entry,
return 0;
}
+#ifdef CONFIG_64BIT
/*
* Walk curr->robust_list (very carefully, it's a userspace list!)
* and mark any locks found there dead, and notify any waiters.
*
* We silently return on any sign of list-walking problem.
*/
-static void exit_robust_list(struct task_struct *curr)
+static void exit_robust_list64(struct task_struct *curr,
+ struct robust_list_head __user *head)
{
- struct robust_list_head __user *head = curr->robust_list;
struct robust_list __user *entry, *next_entry, *pending;
unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
unsigned int next_pi;
@@ -1211,8 +1212,15 @@ static void exit_robust_list(struct task_struct *curr)
curr, pip, HANDLE_DEATH_PENDING);
}
}
+#else
+static void exit_robust_list64(struct task_struct *curr,
+ struct robust_list_head __user *head)
+{
+ pr_warn("32bit kernel should not allow ROBUST_LIST_64BIT");
+}
+#endif
-#ifdef CONFIG_COMPAT
+#if defined(CONFIG_COMPAT) || !defined(CONFIG_64BIT)
static void __user *futex_uaddr(struct robust_list __user *entry,
compat_long_t futex_offset)
{
@@ -1226,13 +1234,13 @@ static void __user *futex_uaddr(struct robust_list __user *entry,
* Fetch a robust-list pointer. Bit 0 signals PI futexes:
*/
static inline int
-compat_fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry,
- compat_uptr_t __user *head, unsigned int *pi)
+fetch_robust_entry32(u32 *uentry, struct robust_list __user **entry,
+ u32 __user *head, unsigned int *pi)
{
if (get_user(*uentry, head))
return -EFAULT;
- *entry = compat_ptr((*uentry) & ~1);
+ *entry = (void __user *)(unsigned long)((*uentry) & ~1);
*pi = (unsigned int)(*uentry) & 1;
return 0;
@@ -1244,21 +1252,21 @@ compat_fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **ent
*
* We silently return on any sign of list-walking problem.
*/
-static void compat_exit_robust_list(struct task_struct *curr)
+static void exit_robust_list32(struct task_struct *curr,
+ struct robust_list_head32 __user *head)
{
- struct compat_robust_list_head __user *head = curr->compat_robust_list;
struct robust_list __user *entry, *next_entry, *pending;
unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
unsigned int next_pi;
- compat_uptr_t uentry, next_uentry, upending;
- compat_long_t futex_offset;
+ u32 uentry, next_uentry, upending;
+ s32 futex_offset;
int rc;
/*
* Fetch the list head (which was registered earlier, via
* sys_set_robust_list()):
*/
- if (compat_fetch_robust_entry(&uentry, &entry, &head->list.next, &pi))
+ if (fetch_robust_entry32((u32 *)&uentry, &entry, (u32 *)&head->list.next, &pi))
return;
/*
* Fetch the relative futex offset:
@@ -1269,7 +1277,7 @@ static void compat_exit_robust_list(struct task_struct *curr)
* Fetch any possibly pending lock-add first, and handle it
* if it exists:
*/
- if (compat_fetch_robust_entry(&upending, &pending,
+ if (fetch_robust_entry32(&upending, &pending,
&head->list_op_pending, &pip))
return;
@@ -1279,8 +1287,8 @@ static void compat_exit_robust_list(struct task_struct *curr)
* Fetch the next entry in the list before calling
* handle_futex_death:
*/
- rc = compat_fetch_robust_entry(&next_uentry, &next_entry,
- (compat_uptr_t __user *)&entry->next, &next_pi);
+ rc = fetch_robust_entry32(&next_uentry, &next_entry,
+ (u32 __user *)&entry->next, &next_pi);
/*
* A pending lock might already be on the list, so
* dont process it twice:
@@ -1406,14 +1414,22 @@ static inline void exit_pi_state_list(struct task_struct *curr) { }
static void futex_cleanup(struct task_struct *tsk)
{
+#ifdef CONFIG_64BIT
if (unlikely(tsk->robust_list)) {
- exit_robust_list(tsk);
+ exit_robust_list64(tsk, tsk->robust_list);
tsk->robust_list = NULL;
}
+#else
+ if (unlikely(tsk->robust_list)) {
+ exit_robust_list32(tsk,
+ (struct robust_list_head32 __user *) tsk->robust_list);
+ tsk->robust_list = NULL;
+ }
+#endif
#ifdef CONFIG_COMPAT
if (unlikely(tsk->compat_robust_list)) {
- compat_exit_robust_list(tsk);
+ exit_robust_list32(tsk, tsk->compat_robust_list);
tsk->compat_robust_list = NULL;
}
#endif
diff --git a/kernel/futex/syscalls.c b/kernel/futex/syscalls.c
index 4b6da9116aa6c33db9796e3055ce0c90b02d7b91..dba193dfd216cc929c8f4d979aa2bcd99237e2d8 100644
--- a/kernel/futex/syscalls.c
+++ b/kernel/futex/syscalls.c
@@ -440,7 +440,7 @@ SYSCALL_DEFINE4(futex_requeue,
#ifdef CONFIG_COMPAT
COMPAT_SYSCALL_DEFINE2(set_robust_list,
- struct compat_robust_list_head __user *, head,
+ struct robust_list_head32 __user *, head,
compat_size_t, len)
{
if (unlikely(len != sizeof(*head)))
@@ -455,7 +455,7 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
compat_uptr_t __user *, head_ptr,
compat_size_t __user *, len_ptr)
{
- struct compat_robust_list_head __user *head;
+ struct robust_list_head32 __user *head;
unsigned long ret;
struct task_struct *p;
--
2.49.0
^ permalink raw reply related
* [PATCH v5 4/7] futex: Create set_robust_list2
From: André Almeida @ 2025-06-26 17:11 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Peter Zijlstra, Darren Hart,
Davidlohr Bueso, Shuah Khan, Arnd Bergmann,
Sebastian Andrzej Siewior, Waiman Long
Cc: linux-kernel, linux-kselftest, linux-api, kernel-dev,
André Almeida
In-Reply-To: <20250626-tonyk-robust_futex-v5-0-179194dbde8f@igalia.com>
Create a new robust_list() syscall. The current syscall can't be
expanded to cover the following use case, so a new one is needed. This
new syscall allows users to set multiple robust lists per process and to
have either 32bit or 64bit pointers in the list.
* Interface
This is the proposed interface:
long set_robust_list2(void *head, int index, unsigned int flags)
`head` is the head of the userspace struct robust_list_head, just as old
set_robust_list(). It needs to be a void pointer since it can point to a
normal robust_list_head or a compat_robust_list_head.
`flags` can be used for defining the list type:
enum robust_list_type {
ROBUST_LIST_32BIT,
ROBUST_LIST_64BIT,
};
`index` is the index in the internal robust_list's linked list (the
naming starts to get confusing, I reckon). If `index == -1`, that means
that user wants to set a new robust_list, and the kernel will append it
in the end of the list, assign a new index and return this index to the
user. If `index >= 0`, that means that user wants to re-set `*head` of
an already existing list (similarly to what happens when you call
set_robust_list() twice with different `*head`).
If `index` is out of range, or it points to a non-existing robust_list,
or if the internal list is full, an error is returned.
Unaligned `head` addresses are refused by the kernel with -EINVAL.
User cannot remove lists.
* Implementation
The old syscall's set/get_robust_list() are converted to use the linked
list as well. When using only the old syscalls user shouldn't any
difference as the internal code will handle the linked list insertion as
usual. When mixing old and new interfaces users should be aware that one
of the elements of the list was created by another syscall and they
should have special care handling this element index.
On exit, the linked list is parsed and all robust lists regardless of
which interface it was used to create them are handled.
Signed-off-by: André Almeida <andrealmeid@igalia.com>
---
include/linux/futex.h | 20 +++++++-
include/linux/sched.h | 5 +-
include/uapi/asm-generic/unistd.h | 2 +
include/uapi/linux/futex.h | 10 ++++
kernel/futex/core.c | 103 +++++++++++++++++++++++++++++++-------
kernel/futex/futex.h | 5 ++
kernel/futex/syscalls.c | 81 ++++++++++++++++++++++++++++--
7 files changed, 199 insertions(+), 27 deletions(-)
diff --git a/include/linux/futex.h b/include/linux/futex.h
index c5b6976909c7d51360e1831e017f4d1544c258fa..a8db1ed27373083330ae37d429ddf343f8a0d130 100644
--- a/include/linux/futex.h
+++ b/include/linux/futex.h
@@ -66,6 +66,21 @@ struct robust_list_head32 {
};
#ifdef CONFIG_FUTEX
+/*
+ * This is an entry of a linked list of robust lists.
+ *
+ * @head: can point to a 64bit list or a 32bit list
+ * @list_type: determine the size of the futex pointers in the list
+ * @index: the index of this entry in the list
+ * @list: linked list element
+ */
+struct robust_list2_entry {
+ void __user *head;
+ enum robust_list2_type list_type;
+ unsigned int index;
+ struct list_head list;
+};
+
enum {
FUTEX_STATE_OK,
FUTEX_STATE_EXITING,
@@ -74,10 +89,11 @@ enum {
static inline void futex_init_task(struct task_struct *tsk)
{
- tsk->robust_list = NULL;
+ tsk->robust_list_index = -1;
#ifdef CONFIG_COMPAT
- tsk->compat_robust_list = NULL;
+ tsk->compat_robust_list_index = -1;
#endif
+ INIT_LIST_HEAD(&tsk->robust_list2);
INIT_LIST_HEAD(&tsk->pi_state_list);
tsk->pi_state_cache = NULL;
tsk->futex_state = FUTEX_STATE_OK;
diff --git a/include/linux/sched.h b/include/linux/sched.h
index b0f64029d53e8b2ab56f24f77054aa7645a185c5..e97d1ade05211e7e02b8e36326f41c6a8a7f99b8 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1331,10 +1331,11 @@ struct task_struct {
u32 rmid;
#endif
#ifdef CONFIG_FUTEX
- struct robust_list_head __user *robust_list;
+ int robust_list_index;
#ifdef CONFIG_COMPAT
- struct robust_list_head32 __user *compat_robust_list;
+ int compat_robust_list_index;
#endif
+ struct list_head robust_list2;
struct list_head pi_state_list;
struct futex_pi_state *pi_state_cache;
struct mutex futex_exit_mutex;
diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h
index 2892a45023af6d3eb941623d4fed04841ab07e02..ebe68c2c88eb5390dda184ce9268a8d3a606c9e5 100644
--- a/include/uapi/asm-generic/unistd.h
+++ b/include/uapi/asm-generic/unistd.h
@@ -852,6 +852,8 @@ __SYSCALL(__NR_removexattrat, sys_removexattrat)
#define __NR_open_tree_attr 467
__SYSCALL(__NR_open_tree_attr, sys_open_tree_attr)
+#define __NR_set_robust_list2 467
+
#undef __NR_syscalls
#define __NR_syscalls 468
diff --git a/include/uapi/linux/futex.h b/include/uapi/linux/futex.h
index 7e2744ec89336a260e89883e95222eda199eeb7f..a8d8d4b1306ba56041046647bfb12146cf1ae4cb 100644
--- a/include/uapi/linux/futex.h
+++ b/include/uapi/linux/futex.h
@@ -153,6 +153,16 @@ struct robust_list_head {
struct robust_list __user *list_op_pending;
};
+#define ROBUST_LISTS_PER_TASK 10
+
+enum robust_list2_type {
+ ROBUST_LIST_32BIT,
+ ROBUST_LIST_64BIT,
+};
+
+#define ROBUST_LIST_TYPE_MASK (ROBUST_LIST_32BIT | ROBUST_LIST_64BIT)
+
+
/*
* Are there any waiters for this robust futex:
*/
diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index f0ac4b897ddbb667fa85daf5853cb47c749d512d..1049f8ef3ce3c611b3be0ca12df34a98f710121d 100644
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -1220,7 +1220,6 @@ static void exit_robust_list64(struct task_struct *curr,
}
#endif
-#if defined(CONFIG_COMPAT) || !defined(CONFIG_64BIT)
static void __user *futex_uaddr(struct robust_list __user *entry,
compat_long_t futex_offset)
{
@@ -1319,7 +1318,70 @@ static void exit_robust_list32(struct task_struct *curr,
handle_futex_death(uaddr, curr, pip, HANDLE_DEATH_PENDING);
}
}
-#endif
+
+long do_set_robust_list2(struct robust_list_head __user *head,
+ int index, unsigned int type)
+{
+ struct list_head *list2 = ¤t->robust_list2;
+ struct robust_list2_entry *prev, *new = NULL;
+
+ if (index == -1) {
+ if (list_empty(list2)) {
+ index = 0;
+ } else {
+ prev = list_last_entry(list2, struct robust_list2_entry, list);
+ index = prev->index + 1;
+ }
+
+ if (index >= ROBUST_LISTS_PER_TASK)
+ return -EINVAL;
+
+ new = kmalloc(sizeof(struct robust_list2_entry), GFP_KERNEL);
+ if (!new)
+ return -ENOMEM;
+
+ list_add_tail(&new->list, list2);
+ new->index = index;
+
+ } else if (index >= 0) {
+ struct robust_list2_entry *curr;
+
+ if (list_empty(list2))
+ return -ENOENT;
+
+ list_for_each_entry(curr, list2, list) {
+ if (index == curr->index) {
+ new = curr;
+ break;
+ }
+ }
+
+ if (!new)
+ return -ENOENT;
+ }
+
+ BUG_ON(!new);
+ new->head = head;
+ new->list_type = type;
+
+ return index;
+}
+
+struct robust_list_head __user *get_robust_list2(int index, struct task_struct *task)
+{
+ struct list_head *list2 = &task->robust_list2;
+ struct robust_list2_entry *curr;
+
+ if (list_empty(list2) || index == -1)
+ return NULL;
+
+ list_for_each_entry(curr, list2, list) {
+ if (index == curr->index)
+ return curr->head;
+ }
+
+ return NULL;
+}
#ifdef CONFIG_FUTEX_PI
@@ -1414,25 +1476,28 @@ static inline void exit_pi_state_list(struct task_struct *curr) { }
static void futex_cleanup(struct task_struct *tsk)
{
-#ifdef CONFIG_64BIT
- if (unlikely(tsk->robust_list)) {
- exit_robust_list64(tsk, tsk->robust_list);
- tsk->robust_list = NULL;
- }
-#else
- if (unlikely(tsk->robust_list)) {
- exit_robust_list32(tsk,
- (struct robust_list_head32 __user *) tsk->robust_list);
- tsk->robust_list = NULL;
- }
-#endif
+ struct robust_list2_entry *curr, *n;
+ struct list_head *list2 = &tsk->robust_list2;
-#ifdef CONFIG_COMPAT
- if (unlikely(tsk->compat_robust_list)) {
- exit_robust_list32(tsk, tsk->compat_robust_list);
- tsk->compat_robust_list = NULL;
+ /*
+ * Walk through the linked list, parsing robust lists and freeing the
+ * allocated lists
+ */
+ if (unlikely(!list_empty(list2))) {
+ list_for_each_entry_safe(curr, n, list2, list) {
+ if (curr->head != NULL) {
+ if (curr->list_type == ROBUST_LIST_64BIT)
+ exit_robust_list64(tsk, curr->head);
+ else if (curr->list_type == ROBUST_LIST_32BIT)
+ exit_robust_list32(tsk, curr->head);
+ curr->head = NULL;
+ }
+ list_del_init(&curr->list);
+ kfree(curr);
+ }
}
-#endif
+
+ tsk->robust_list_index = -1;
if (unlikely(!list_empty(&tsk->pi_state_list)))
exit_pi_state_list(tsk);
diff --git a/kernel/futex/futex.h b/kernel/futex/futex.h
index fcd1617212eed0e3c2367d2b463a0e019eda6d13..67201e51fa1798a21ff68f60b1e35977b9bd267b 100644
--- a/kernel/futex/futex.h
+++ b/kernel/futex/futex.h
@@ -467,6 +467,11 @@ extern int __futex_wait(u32 __user *uaddr, unsigned int flags, u32 val,
extern int futex_wait(u32 __user *uaddr, unsigned int flags, u32 val,
ktime_t *abs_time, u32 bitset);
+extern long do_set_robust_list2(struct robust_list_head __user *head,
+ int index, unsigned int type);
+
+extern struct robust_list_head __user *get_robust_list2(int index, struct task_struct *task);
+
/**
* struct futex_vector - Auxiliary struct for futex_waitv()
* @w: Userspace provided data
diff --git a/kernel/futex/syscalls.c b/kernel/futex/syscalls.c
index dba193dfd216cc929c8f4d979aa2bcd99237e2d8..56ee1123cbd8ea26c8d22aa74e5faed2974ec577 100644
--- a/kernel/futex/syscalls.c
+++ b/kernel/futex/syscalls.c
@@ -20,6 +20,18 @@
* the list. There can only be one such pending lock.
*/
+#ifdef CONFIG_64BIT
+static inline int robust_list_native_type(void)
+{
+ return ROBUST_LIST_64BIT;
+}
+#else
+static inline int robust_list_native_type(void)
+{
+ return ROBUST_LIST_32BIT;
+}
+#endif
+
/**
* sys_set_robust_list() - Set the robust-futex list head of a task
* @head: pointer to the list-head
@@ -28,17 +40,63 @@
SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
size_t, len)
{
+ unsigned int type = robust_list_native_type();
+ int ret;
+
/*
* The kernel knows only one size for now:
*/
if (unlikely(len != sizeof(*head)))
return -EINVAL;
- current->robust_list = head;
+ ret = do_set_robust_list2(head, current->robust_list_index, type);
+ if (ret < 0)
+ return ret;
+
+ current->robust_list_index = ret;
return 0;
}
+#define ROBUST_LIST_FLAGS ROBUST_LIST_TYPE_MASK
+
+/*
+ * sys_set_robust_list2()
+ *
+ * When index == -1, create a new list for user. When index >= 0, try to find
+ * the corresponding list and re-set the head there.
+ *
+ * Return values:
+ * >= 0: success, index of the robust list
+ * -EINVAL: invalid flags, invalid index
+ * -ENOENT: requested index no where to be found
+ * -ENOMEM: error allocating new list
+ * -ESRCH: too many allocated lists
+ */
+SYSCALL_DEFINE3(set_robust_list2, struct robust_list_head __user *, head,
+ int, index, unsigned int, flags)
+{
+ unsigned int type;
+
+ type = flags & ROBUST_LIST_TYPE_MASK;
+
+ if (index < -1 || index >= ROBUST_LISTS_PER_TASK)
+ return -EINVAL;
+
+ if ((flags & ~ROBUST_LIST_FLAGS) != 0)
+ return -EINVAL;
+
+ if (((uintptr_t) head % sizeof(u32)) != 0)
+ return -EINVAL;
+
+#ifndef CONFIG_64BIT
+ if (type == ROBUST_LIST_64BIT)
+ return -EINVAL;
+#endif
+
+ return do_set_robust_list2(head, index, type);
+}
+
/**
* sys_get_robust_list() - Get the robust-futex list head of a task
* @pid: pid of the process [zero for current task]
@@ -52,6 +110,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
struct robust_list_head __user *head;
unsigned long ret;
struct task_struct *p;
+ int index;
rcu_read_lock();
@@ -68,9 +127,11 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
goto err_unlock;
- head = p->robust_list;
+ index = p->robust_list_index;
rcu_read_unlock();
+ head = get_robust_list2(index, p);
+
if (put_user(sizeof(*head), len_ptr))
return -EFAULT;
return put_user(head, head_ptr);
@@ -443,10 +504,19 @@ COMPAT_SYSCALL_DEFINE2(set_robust_list,
struct robust_list_head32 __user *, head,
compat_size_t, len)
{
+ unsigned int type = ROBUST_LIST_32BIT;
+ int ret;
+
if (unlikely(len != sizeof(*head)))
return -EINVAL;
- current->compat_robust_list = head;
+ ret = do_set_robust_list2((struct robust_list_head __user *) head,
+ current->robust_list_index, type);
+ if (ret < 0)
+ return ret;
+
+ current->robust_list_index = ret;
+
return 0;
}
@@ -458,6 +528,7 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
struct robust_list_head32 __user *head;
unsigned long ret;
struct task_struct *p;
+ int index;
rcu_read_lock();
@@ -474,9 +545,11 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
goto err_unlock;
- head = p->compat_robust_list;
+ index = p->compat_robust_list_index;
rcu_read_unlock();
+ head = (struct robust_list_head32 __user *) get_robust_list2(index, p);
+
if (put_user(sizeof(*head), len_ptr))
return -EFAULT;
return put_user(ptr_to_compat(head), head_ptr);
--
2.49.0
^ permalink raw reply related
* [PATCH v5 5/7] futex: Remove the limit of elements for sys_set_robust_list2 lists
From: André Almeida @ 2025-06-26 17:11 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Peter Zijlstra, Darren Hart,
Davidlohr Bueso, Shuah Khan, Arnd Bergmann,
Sebastian Andrzej Siewior, Waiman Long
Cc: linux-kernel, linux-kselftest, linux-api, kernel-dev,
André Almeida
In-Reply-To: <20250626-tonyk-robust_futex-v5-0-179194dbde8f@igalia.com>
Remove the limit of ROBUST_LIST_LIMIT elements that a robust list can
have, for the ones created with the new interface. This is done by
overwritten the list as it's proceeded in a way that we avoid circular
lists.
For the old interface, we keep the limited behavior to avoid changing
the API.
Signed-off-by: André Almeida <andrealmeid@igalia.com>
---
kernel/futex/core.c | 37 +++++++++++++++++++++++++++++--------
1 file changed, 29 insertions(+), 8 deletions(-)
diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index 1049f8ef3ce3c611b3be0ca12df34a98f710121d..942b66facdea16cd7be2235d95c2bbbae8d7cc63 100644
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -1152,7 +1152,8 @@ static inline int fetch_robust_entry(struct robust_list __user **entry,
* We silently return on any sign of list-walking problem.
*/
static void exit_robust_list64(struct task_struct *curr,
- struct robust_list_head __user *head)
+ struct robust_list_head __user *head,
+ bool destroyable)
{
struct robust_list __user *entry, *next_entry, *pending;
unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
@@ -1196,13 +1197,17 @@ static void exit_robust_list64(struct task_struct *curr,
}
if (rc)
return;
- entry = next_entry;
- pi = next_pi;
+
/*
* Avoid excessively long or circular lists:
*/
- if (!--limit)
+ if (!destroyable && !--limit)
break;
+ else
+ put_user(&head->list, &entry->next);
+
+ entry = next_entry;
+ pi = next_pi;
cond_resched();
}
@@ -1214,7 +1219,8 @@ static void exit_robust_list64(struct task_struct *curr,
}
#else
static void exit_robust_list64(struct task_struct *curr,
- struct robust_list_head __user *head)
+ struct robust_list_head __user *head,
+ bool destroyable)
{
pr_warn("32bit kernel should not allow ROBUST_LIST_64BIT");
}
@@ -1252,7 +1258,8 @@ fetch_robust_entry32(u32 *uentry, struct robust_list __user **entry,
* We silently return on any sign of list-walking problem.
*/
static void exit_robust_list32(struct task_struct *curr,
- struct robust_list_head32 __user *head)
+ struct robust_list_head32 __user *head,
+ bool destroyable)
{
struct robust_list __user *entry, *next_entry, *pending;
unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
@@ -1474,10 +1481,19 @@ static void exit_pi_state_list(struct task_struct *curr)
static inline void exit_pi_state_list(struct task_struct *curr) { }
#endif
+/*
+ * futex_cleanup - After the task exists, process the robust lists
+ *
+ * Walk through the linked list, parsing robust lists and freeing the
+ * allocated lists. Lists created with the set_robust_list2 don't have a limit
+ * for sizing and can be destroyed while we walk on it to avoid circular list.
+ */
static void futex_cleanup(struct task_struct *tsk)
{
struct robust_list2_entry *curr, *n;
struct list_head *list2 = &tsk->robust_list2;
+ bool destroyable = true;
+ int i = 0;
/*
* Walk through the linked list, parsing robust lists and freeing the
@@ -1485,15 +1501,20 @@ static void futex_cleanup(struct task_struct *tsk)
*/
if (unlikely(!list_empty(list2))) {
list_for_each_entry_safe(curr, n, list2, list) {
+ destroyable = true;
+ if (tsk->robust_list_index == i)
+ destroyable = false;
+
if (curr->head != NULL) {
if (curr->list_type == ROBUST_LIST_64BIT)
- exit_robust_list64(tsk, curr->head);
+ exit_robust_list64(tsk, curr->head, destroyable);
else if (curr->list_type == ROBUST_LIST_32BIT)
- exit_robust_list32(tsk, curr->head);
+ exit_robust_list32(tsk, curr->head, destroyable);
curr->head = NULL;
}
list_del_init(&curr->list);
kfree(curr);
+ i++;
}
}
--
2.49.0
^ permalink raw reply related
* [PATCH v5 6/7] futex: Wire up set_robust_list2 syscall
From: André Almeida @ 2025-06-26 17:11 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Peter Zijlstra, Darren Hart,
Davidlohr Bueso, Shuah Khan, Arnd Bergmann,
Sebastian Andrzej Siewior, Waiman Long
Cc: linux-kernel, linux-kselftest, linux-api, kernel-dev,
André Almeida
In-Reply-To: <20250626-tonyk-robust_futex-v5-0-179194dbde8f@igalia.com>
Wire up the new set_robust_list2 syscall in all available architectures.
Signed-off-by: André Almeida <andrealmeid@igalia.com>
---
arch/alpha/kernel/syscalls/syscall.tbl | 1 +
arch/arm/tools/syscall.tbl | 1 +
arch/m68k/kernel/syscalls/syscall.tbl | 1 +
arch/microblaze/kernel/syscalls/syscall.tbl | 1 +
arch/mips/kernel/syscalls/syscall_n32.tbl | 1 +
arch/mips/kernel/syscalls/syscall_n64.tbl | 1 +
arch/mips/kernel/syscalls/syscall_o32.tbl | 1 +
arch/parisc/kernel/syscalls/syscall.tbl | 1 +
arch/powerpc/kernel/syscalls/syscall.tbl | 1 +
arch/s390/kernel/syscalls/syscall.tbl | 1 +
arch/sh/kernel/syscalls/syscall.tbl | 1 +
arch/sparc/kernel/syscalls/syscall.tbl | 1 +
arch/x86/entry/syscalls/syscall_32.tbl | 1 +
arch/x86/entry/syscalls/syscall_64.tbl | 1 +
arch/xtensa/kernel/syscalls/syscall.tbl | 1 +
kernel/sys_ni.c | 1 +
scripts/syscall.tbl | 1 +
17 files changed, 17 insertions(+)
diff --git a/arch/alpha/kernel/syscalls/syscall.tbl b/arch/alpha/kernel/syscalls/syscall.tbl
index 2dd6340de6b4efddc406f0c235701c15cf02f650..aecc167ac7706d25da73db8099f0813e268b820c 100644
--- a/arch/alpha/kernel/syscalls/syscall.tbl
+++ b/arch/alpha/kernel/syscalls/syscall.tbl
@@ -507,3 +507,4 @@
575 common listxattrat sys_listxattrat
576 common removexattrat sys_removexattrat
577 common open_tree_attr sys_open_tree_attr
+578 common set_robust_list2 sys_robust_list2
diff --git a/arch/arm/tools/syscall.tbl b/arch/arm/tools/syscall.tbl
index 27c1d5ebcd91c8c296dc6676307f66bfdf4ab78d..2e47ae5dc9a426d8e5e9dacf29caa54223cf2f5a 100644
--- a/arch/arm/tools/syscall.tbl
+++ b/arch/arm/tools/syscall.tbl
@@ -482,3 +482,4 @@
465 common listxattrat sys_listxattrat
466 common removexattrat sys_removexattrat
467 common open_tree_attr sys_open_tree_attr
+468 common set_robust_list2 sys_set_robust_list2
diff --git a/arch/m68k/kernel/syscalls/syscall.tbl b/arch/m68k/kernel/syscalls/syscall.tbl
index 9fe47112c586f152662af38a9a7f90957cb96cf8..7bcc8cc628c80a44fea2b53d5c69ab5e5f10a1d2 100644
--- a/arch/m68k/kernel/syscalls/syscall.tbl
+++ b/arch/m68k/kernel/syscalls/syscall.tbl
@@ -467,3 +467,4 @@
465 common listxattrat sys_listxattrat
466 common removexattrat sys_removexattrat
467 common open_tree_attr sys_open_tree_attr
+468 common set_robust_list2 sys_set_robust_list2
diff --git a/arch/microblaze/kernel/syscalls/syscall.tbl b/arch/microblaze/kernel/syscalls/syscall.tbl
index 7b6e97828e552d4da90046ddfcd4a55723e522bb..cd23608afe7e7dadfbf8e21df0486b85bfcb99ce 100644
--- a/arch/microblaze/kernel/syscalls/syscall.tbl
+++ b/arch/microblaze/kernel/syscalls/syscall.tbl
@@ -473,3 +473,4 @@
465 common listxattrat sys_listxattrat
466 common removexattrat sys_removexattrat
467 common open_tree_attr sys_open_tree_attr
+468 common set_robust_list2 sys_set_robust_list2
diff --git a/arch/mips/kernel/syscalls/syscall_n32.tbl b/arch/mips/kernel/syscalls/syscall_n32.tbl
index aa70e371bb54ab5d9c8dd8923b6ecf9693ee914d..0a31452ef6ed8fee8f1e2ead5d44acfbbe275fe9 100644
--- a/arch/mips/kernel/syscalls/syscall_n32.tbl
+++ b/arch/mips/kernel/syscalls/syscall_n32.tbl
@@ -406,3 +406,4 @@
465 n32 listxattrat sys_listxattrat
466 n32 removexattrat sys_removexattrat
467 n32 open_tree_attr sys_open_tree_attr
+468 n32 set_robust_list2 sys_set_robust_list2
diff --git a/arch/mips/kernel/syscalls/syscall_n64.tbl b/arch/mips/kernel/syscalls/syscall_n64.tbl
index 1e8c44c7b61492eabf00c777831e457a7a6e579c..4cb5a72256338f6fb407f940f1883d523113d609 100644
--- a/arch/mips/kernel/syscalls/syscall_n64.tbl
+++ b/arch/mips/kernel/syscalls/syscall_n64.tbl
@@ -382,3 +382,4 @@
465 n64 listxattrat sys_listxattrat
466 n64 removexattrat sys_removexattrat
467 n64 open_tree_attr sys_open_tree_attr
+468 n64 set_robust_list2 sys_set_robust_list2
diff --git a/arch/mips/kernel/syscalls/syscall_o32.tbl b/arch/mips/kernel/syscalls/syscall_o32.tbl
index 114a5a1a62302e32dd74d1679ff423a2d57c3c6b..c46238e9edd00d2861edcfa87c5ce7a62bfdc3d4 100644
--- a/arch/mips/kernel/syscalls/syscall_o32.tbl
+++ b/arch/mips/kernel/syscalls/syscall_o32.tbl
@@ -455,3 +455,4 @@
465 o32 listxattrat sys_listxattrat
466 o32 removexattrat sys_removexattrat
467 o32 open_tree_attr sys_open_tree_attr
+468 o32 set_robust_list2 sys_set_robust_list2
diff --git a/arch/parisc/kernel/syscalls/syscall.tbl b/arch/parisc/kernel/syscalls/syscall.tbl
index 94df3cb957e9d547d192e8732c0cf23ef2b5ce5d..71071489a18375013bbfbe26578a634283c1e07b 100644
--- a/arch/parisc/kernel/syscalls/syscall.tbl
+++ b/arch/parisc/kernel/syscalls/syscall.tbl
@@ -466,3 +466,4 @@
465 common listxattrat sys_listxattrat
466 common removexattrat sys_removexattrat
467 common open_tree_attr sys_open_tree_attr
+468 common set_robust_list2 sys_set_robust_list2
diff --git a/arch/powerpc/kernel/syscalls/syscall.tbl b/arch/powerpc/kernel/syscalls/syscall.tbl
index 9a084bdb892694bc562f514b55212d167cbac12f..edc4d0bef3f1c7ab826ea8180e7f5ceba4774c07 100644
--- a/arch/powerpc/kernel/syscalls/syscall.tbl
+++ b/arch/powerpc/kernel/syscalls/syscall.tbl
@@ -558,3 +558,4 @@
465 common listxattrat sys_listxattrat
466 common removexattrat sys_removexattrat
467 common open_tree_attr sys_open_tree_attr
+468 common set_robust_list2 sys_set_robust_list2
diff --git a/arch/s390/kernel/syscalls/syscall.tbl b/arch/s390/kernel/syscalls/syscall.tbl
index a4569b96ef06c54ce7aa795d039541c90a38284f..ff8c594073ec8c3486cc61544d14a338d3f3a906 100644
--- a/arch/s390/kernel/syscalls/syscall.tbl
+++ b/arch/s390/kernel/syscalls/syscall.tbl
@@ -470,3 +470,4 @@
465 common listxattrat sys_listxattrat sys_listxattrat
466 common removexattrat sys_removexattrat sys_removexattrat
467 common open_tree_attr sys_open_tree_attr sys_open_tree_attr
+468 common set_robust_list2 sys_set_robust_list2 sys_set_robust_list2
diff --git a/arch/sh/kernel/syscalls/syscall.tbl b/arch/sh/kernel/syscalls/syscall.tbl
index 52a7652fcff6394b96ace1f3b0ed72250ee5e669..507789194570a9e7b492b210be30bb41021be289 100644
--- a/arch/sh/kernel/syscalls/syscall.tbl
+++ b/arch/sh/kernel/syscalls/syscall.tbl
@@ -471,3 +471,4 @@
465 common listxattrat sys_listxattrat
466 common removexattrat sys_removexattrat
467 common open_tree_attr sys_open_tree_attr
+468 common set_robust_list2 sys_set_robust_list2
diff --git a/arch/sparc/kernel/syscalls/syscall.tbl b/arch/sparc/kernel/syscalls/syscall.tbl
index 83e45eb6c095a36baaf749927628e6052fe900e6..8d1122c2235b8d5082a11392e68787efe55f58be 100644
--- a/arch/sparc/kernel/syscalls/syscall.tbl
+++ b/arch/sparc/kernel/syscalls/syscall.tbl
@@ -513,3 +513,4 @@
465 common listxattrat sys_listxattrat
466 common removexattrat sys_removexattrat
467 common open_tree_attr sys_open_tree_attr
+468 common set_robust_list2 sys_set_robust_list2
diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl
index ac007ea00979dc28b0ef7c002a0615ce86dd3101..cbc0c469e66ecf7b8a61e82c38b07ecc63f6fe23 100644
--- a/arch/x86/entry/syscalls/syscall_32.tbl
+++ b/arch/x86/entry/syscalls/syscall_32.tbl
@@ -473,3 +473,4 @@
465 i386 listxattrat sys_listxattrat
466 i386 removexattrat sys_removexattrat
467 i386 open_tree_attr sys_open_tree_attr
+468 i386 set_robust_list2 sys_set_robust_list2
diff --git a/arch/x86/entry/syscalls/syscall_64.tbl b/arch/x86/entry/syscalls/syscall_64.tbl
index cfb5ca41e30de1a4e073750096f5b51a2ec137d2..b420217c72fc50ad90f291812972019606c5ff69 100644
--- a/arch/x86/entry/syscalls/syscall_64.tbl
+++ b/arch/x86/entry/syscalls/syscall_64.tbl
@@ -391,6 +391,7 @@
465 common listxattrat sys_listxattrat
466 common removexattrat sys_removexattrat
467 common open_tree_attr sys_open_tree_attr
+468 common set_robust_list2 sys_set_robust_list2
#
# Due to a historical design error, certain syscalls are numbered differently
diff --git a/arch/xtensa/kernel/syscalls/syscall.tbl b/arch/xtensa/kernel/syscalls/syscall.tbl
index f657a77314f8667fa019a01e10c84ea270024adc..6b852ee8a1621c7dd24f6cd37fd990f5ff8d8527 100644
--- a/arch/xtensa/kernel/syscalls/syscall.tbl
+++ b/arch/xtensa/kernel/syscalls/syscall.tbl
@@ -438,3 +438,4 @@
465 common listxattrat sys_listxattrat
466 common removexattrat sys_removexattrat
467 common open_tree_attr sys_open_tree_attr
+468 common set_robust_list2 sys_set_robust_list2
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index c00a86931f8c6cb30d35a9d56cbcc5994add90e1..71fbac6176c8886f4fa8dd437b0aedd5f14e9f74 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -195,6 +195,7 @@ COND_SYSCALL(move_pages);
COND_SYSCALL(set_mempolicy_home_node);
COND_SYSCALL(cachestat);
COND_SYSCALL(mseal);
+COND_SYSCALL(set_robust_list2);
COND_SYSCALL(perf_event_open);
COND_SYSCALL(accept4);
diff --git a/scripts/syscall.tbl b/scripts/syscall.tbl
index 580b4e246aecd5f07d542943ba68fc4ed5961660..07d7e776d0329659e70a9a55ffff7ac18eb3ff87 100644
--- a/scripts/syscall.tbl
+++ b/scripts/syscall.tbl
@@ -408,3 +408,4 @@
465 common listxattrat sys_listxattrat
466 common removexattrat sys_removexattrat
467 common open_tree_attr sys_open_tree_attr
+468 common set_robust_list2 sys_set_robust_list2
--
2.49.0
^ permalink raw reply related
* [PATCH v5 7/7] selftests: futex: Expand robust list test for the new interface
From: André Almeida @ 2025-06-26 17:11 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Peter Zijlstra, Darren Hart,
Davidlohr Bueso, Shuah Khan, Arnd Bergmann,
Sebastian Andrzej Siewior, Waiman Long
Cc: linux-kernel, linux-kselftest, linux-api, kernel-dev,
André Almeida
In-Reply-To: <20250626-tonyk-robust_futex-v5-0-179194dbde8f@igalia.com>
Expand the current robust list test for the new set_robust_list2
syscall. Create an option to make it possible to run the same tests
using the new syscall, and also add two new relevant test: test long
lists (bigger than ROBUST_LIST_LIMIT) and for unaligned addresses.
Signed-off-by: André Almeida <andrealmeid@igalia.com>
---
.../selftests/futex/functional/robust_list.c | 160 ++++++++++++++++++++-
1 file changed, 156 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/futex/functional/robust_list.c b/tools/testing/selftests/futex/functional/robust_list.c
index 42690b2440fd29a9b12c46f67f9645ccc93d1147..004ad79ff6171c411fd47e699e3c38889544218e 100644
--- a/tools/testing/selftests/futex/functional/robust_list.c
+++ b/tools/testing/selftests/futex/functional/robust_list.c
@@ -35,16 +35,45 @@
#include <stddef.h>
#include <sys/mman.h>
#include <sys/wait.h>
+#include <stdint.h>
#define STACK_SIZE (1024 * 1024)
#define FUTEX_TIMEOUT 3
+#define SYS_set_robust_list2 468
+
+enum robust_list2_type {
+ ROBUST_LIST_32BIT,
+ ROBUST_LIST_64BIT,
+};
+
static pthread_barrier_t barrier, barrier2;
+bool robust2 = false;
+
int set_robust_list(struct robust_list_head *head, size_t len)
{
- return syscall(SYS_set_robust_list, head, len);
+ int ret, flags;
+
+ if (!robust2) {
+ return syscall(SYS_set_robust_list, head, len);
+ }
+
+ if (sizeof(head) == 8)
+ flags = ROBUST_LIST_64BIT;
+ else
+ flags = ROBUST_LIST_32BIT;
+
+ /*
+ * We act as we have just one list here. We try to use the first slot,
+ * but if it hasn't been alocated yet we allocate it.
+ */
+ ret = syscall(SYS_set_robust_list2, head, 0, flags);
+ if (ret == -1 && errno == ENOENT)
+ ret = syscall(SYS_set_robust_list2, head, -1, flags);
+
+ return ret;
}
int get_robust_list(int pid, struct robust_list_head **head, size_t *len_ptr)
@@ -246,6 +275,11 @@ static void test_set_robust_list_invalid_size(void)
size_t head_size = sizeof(struct robust_list_head);
int ret;
+ if (robust2) {
+ ksft_test_result_skip("This test is only for old robust interface\n");
+ return;
+ }
+
ret = set_robust_list(&head, head_size);
ASSERT_EQ(ret, 0);
@@ -321,6 +355,11 @@ static void test_get_robust_list_child(void)
struct robust_list_head head, *get_head;
size_t len_ptr;
+ if (robust2) {
+ ksft_test_result_skip("Not implemented in the new robust interface\n");
+ return;
+ }
+
ret = pthread_barrier_init(&barrier, NULL, 2);
ret = pthread_barrier_init(&barrier2, NULL, 2);
ASSERT_EQ(ret, 0);
@@ -332,7 +371,7 @@ static void test_get_robust_list_child(void)
ret = get_robust_list(tid, &get_head, &len_ptr);
ASSERT_EQ(ret, 0);
- ASSERT_EQ(&head, get_head);
+ ASSERT_EQ(get_head, &head);
pthread_barrier_wait(&barrier2);
@@ -507,11 +546,119 @@ static void test_circular_list(void)
ksft_test_result_pass("%s\n", __func__);
}
+#define ROBUST_LIST_LIMIT 2048
+#define CHILD_LIST_LIMIT (ROBUST_LIST_LIMIT + 10)
+
+static int child_robust_list_limit(void *arg)
+{
+ struct lock_struct *locks;
+ struct robust_list *list;
+ struct robust_list_head head;
+ int ret, i;
+
+ locks = (struct lock_struct *) arg;
+
+ ret = set_list(&head);
+ if (ret)
+ ksft_test_result_fail("set_list error\n");
+
+ /*
+ * Create a very long list of locks
+ */
+ head.list.next = &locks[0].list;
+
+ list = head.list.next;
+ for (i = 0; i < CHILD_LIST_LIMIT - 1; i++) {
+ list->next = &locks[i+1].list;
+ list = list->next;
+ }
+ list->next = &head.list;
+
+ /*
+ * Grab the lock in the last one, and die without releasing it
+ */
+ mutex_lock(&locks[CHILD_LIST_LIMIT], &head, false);
+ pthread_barrier_wait(&barrier);
+
+ sleep(1);
+
+ return 0;
+}
+
+/*
+ * The old robust list used to have a limit of 2048 items from the kernel side.
+ * After this limit the kernel stops walking the list and ignore the other
+ * futexes, causing deadlocks.
+ *
+ * For the new interface, test if we can wait for a list of more than 2048
+ * elements.
+ */
+static void test_robust_list_limit(void)
+{
+ struct lock_struct locks[CHILD_LIST_LIMIT + 1];
+ _Atomic(unsigned int) *futex = &locks[CHILD_LIST_LIMIT].futex;
+ struct robust_list_head head;
+ int ret;
+
+ if (!robust2) {
+ ksft_test_result_skip("This test is only for new robust interface\n");
+ return;
+ }
+
+ *futex = 0;
+
+ ret = set_list(&head);
+ ASSERT_EQ(ret, 0);
+
+ ret = pthread_barrier_init(&barrier, NULL, 2);
+ ASSERT_EQ(ret, 0);
+
+ create_child(child_robust_list_limit, locks);
+
+ /*
+ * After the child thread creates the very long list of locks, wait on
+ * the last one.
+ */
+ pthread_barrier_wait(&barrier);
+ ret = mutex_lock(&locks[CHILD_LIST_LIMIT], &head, false);
+
+ if (ret != 0)
+ printf("futex wait returned %d\n", errno);
+ ASSERT_EQ(ret, 0);
+
+ ASSERT_TRUE(*futex | FUTEX_OWNER_DIED);
+
+ wait(NULL);
+ pthread_barrier_destroy(&barrier);
+
+ ksft_test_result_pass("%s\n", __func__);
+}
+
+/*
+ * The kernel should refuse an unaligned head pointer
+ */
+static void test_unaligned_address(void)
+{
+ struct robust_list_head head, *h;
+ int ret;
+
+ if (!robust2) {
+ ksft_test_result_skip("This test is only for new robust interface\n");
+ return;
+ }
+
+ h = (struct robust_list_head *) ((uintptr_t) &head + 1);
+ ret = set_list(h);
+ ASSERT_EQ(ret, -1);
+ ASSERT_EQ(errno, EINVAL);
+}
+
void usage(char *prog)
{
printf("Usage: %s\n", prog);
printf(" -c Use color\n");
printf(" -h Display this help message\n");
+ printf(" -n Use robust2 syscall\n");
printf(" -v L Verbosity level: %d=QUIET %d=CRITICAL %d=INFO\n",
VQUIET, VCRITICAL, VINFO);
}
@@ -520,7 +667,7 @@ int main(int argc, char *argv[])
{
int c;
- while ((c = getopt(argc, argv, "cht:v:")) != -1) {
+ while ((c = getopt(argc, argv, "chnt:v:")) != -1) {
switch (c) {
case 'c':
log_color(1);
@@ -531,6 +678,9 @@ int main(int argc, char *argv[])
case 'v':
log_verbosity(atoi(optarg));
break;
+ case 'n':
+ robust2 = true;
+ break;
default:
usage(basename(argv[0]));
exit(1);
@@ -538,7 +688,7 @@ int main(int argc, char *argv[])
}
ksft_print_header();
- ksft_set_plan(7);
+ ksft_set_plan(8);
test_robustness();
@@ -548,6 +698,8 @@ int main(int argc, char *argv[])
test_set_list_op_pending();
test_robust_list_multiple_elements();
test_circular_list();
+ test_robust_list_limit();
+ test_unaligned_address();
ksft_print_cnts();
return 0;
--
2.49.0
^ permalink raw reply related
* Re: [PATCH v5 1/7] selftests/futex: Add ASSERT_ macros
From: Thomas Gleixner @ 2025-06-26 22:07 UTC (permalink / raw)
To: André Almeida, Ingo Molnar, Peter Zijlstra, Darren Hart,
Davidlohr Bueso, Shuah Khan, Arnd Bergmann,
Sebastian Andrzej Siewior, Waiman Long
Cc: linux-kernel, linux-kselftest, linux-api, kernel-dev,
André Almeida
In-Reply-To: <20250626-tonyk-robust_futex-v5-1-179194dbde8f@igalia.com>
On Thu, Jun 26 2025 at 14:11, André Almeida wrote:
> Create ASSERT_{EQ, NE, TRUE, FALSE} macros to make test creation easier.
What's so futex special about this that it can't use the same muck in
tools/testing/selftests/kselftest_harness.h
or at least share the implementation in some way?
Thanks,
tglx
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox