* [PATCH v4 12/30] liveupdate: luo_ioctl: add user interface
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Introduce the user-space interface for the Live Update Orchestrator
via ioctl commands, enabling external control over the live update
process and management of preserved resources.
The idea is that there is going to be a single userspace agent driving
the live update, therefore, only a single process can ever hold this
device opened at a time.
The following ioctl commands are introduced:
LIVEUPDATE_IOCTL_GET_STATE
Allows userspace to query the current state of the LUO state machine
(e.g., NORMAL, PREPARED, UPDATED).
LIVEUPDATE_IOCTL_SET_EVENT
Enables userspace to drive the LUO state machine by sending global
events. This includes:
LIVEUPDATE_PREPARE
To begin the state-saving process.
LIVEUPDATE_FINISH
To signal completion of restoration in the new kernel.
LIVEUPDATE_CANCEL
To abort a prepared update.
LIVEUPDATE_IOCTL_CREATE_SESSION
Provides a way for userspace to create a named session for grouping file
descriptors that need to be preserved. It returns a new file descriptor
representing the session.
LIVEUPDATE_IOCTL_RETRIEVE_SESSION
Allows the userspace agent in the new kernel to reclaim a preserved
session by its name, receiving a new file descriptor to manage the
restored resources.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
include/uapi/linux/liveupdate.h | 199 ++++++++++++++++++++++++++++++
kernel/liveupdate/luo_internal.h | 20 +++
kernel/liveupdate/luo_ioctl.c | 201 +++++++++++++++++++++++++++++++
3 files changed, 420 insertions(+)
diff --git a/include/uapi/linux/liveupdate.h b/include/uapi/linux/liveupdate.h
index e8c0c210a790..2e38ef3094aa 100644
--- a/include/uapi/linux/liveupdate.h
+++ b/include/uapi/linux/liveupdate.h
@@ -14,6 +14,32 @@
#include <linux/ioctl.h>
#include <linux/types.h>
+/**
+ * DOC: General ioctl format
+ *
+ * The ioctl interface follows a general format to allow for extensibility. Each
+ * ioctl is passed in a structure pointer as the argument providing the size of
+ * the structure in the first u32. The kernel checks that any structure space
+ * beyond what it understands is 0. This allows userspace to use the backward
+ * compatible portion while consistently using the newer, larger, structures.
+ *
+ * ioctls use a standard meaning for common errnos:
+ *
+ * - ENOTTY: The IOCTL number itself is not supported at all
+ * - E2BIG: The IOCTL number is supported, but the provided structure has
+ * non-zero in a part the kernel does not understand.
+ * - EOPNOTSUPP: The IOCTL number is supported, and the structure is
+ * understood, however a known field has a value the kernel does not
+ * understand or support.
+ * - EINVAL: Everything about the IOCTL was understood, but a field is not
+ * correct.
+ * - ENOENT: A provided token does not exist.
+ * - ENOMEM: Out of memory.
+ * - EOVERFLOW: Mathematics overflowed.
+ *
+ * As well as additional errnos, within specific ioctls.
+ */
+
/**
* enum liveupdate_state - Defines the possible states of the live update
* orchestrator.
@@ -94,4 +120,177 @@ enum liveupdate_event {
/* The maximum length of session name including null termination */
#define LIVEUPDATE_SESSION_NAME_LENGTH 56
+/* The ioctl type, documented in ioctl-number.rst */
+#define LIVEUPDATE_IOCTL_TYPE 0xBA
+
+/* The /dev/liveupdate ioctl commands */
+enum {
+ LIVEUPDATE_CMD_BASE = 0x00,
+ LIVEUPDATE_CMD_GET_STATE = LIVEUPDATE_CMD_BASE,
+ LIVEUPDATE_CMD_SET_EVENT = 0x01,
+ LIVEUPDATE_CMD_CREATE_SESSION = 0x02,
+ LIVEUPDATE_CMD_RETRIEVE_SESSION = 0x03,
+};
+
+/**
+ * struct liveupdate_ioctl_get_state - ioctl(LIVEUPDATE_IOCTL_GET_STATE)
+ * @size: Input; sizeof(struct liveupdate_ioctl_get_state)
+ * @state: Output; The current live update state.
+ *
+ * Query the current state of the live update orchestrator.
+ *
+ * The kernel fills the @state with the current
+ * state of the live update subsystem. Possible states are:
+ *
+ * - %LIVEUPDATE_STATE_NORMAL: Default state; no live update operation is
+ * currently in progress.
+ * - %LIVEUPDATE_STATE_PREPARED: The preparation phase (triggered by
+ * %LIVEUPDATE_PREPARE) has completed
+ * successfully. The system is ready for the
+ * reboot transition. Note that some
+ * device operations (e.g., unbinding, new DMA
+ * mappings) might be restricted in this state.
+ * - %LIVEUPDATE_STATE_UPDATED: The system has successfully rebooted into the
+ * new kernel via live update. It is now running
+ * the new kernel code and is awaiting the
+ * completion signal from user space via
+ * %LIVEUPDATE_FINISH after restoration tasks are
+ * done.
+ *
+ * See the definition of &enum liveupdate_state for more details on each state.
+ *
+ * Return: 0 on success, negative error code on failure.
+ */
+struct liveupdate_ioctl_get_state {
+ __u32 size;
+ __u32 state;
+};
+
+#define LIVEUPDATE_IOCTL_GET_STATE \
+ _IO(LIVEUPDATE_IOCTL_TYPE, LIVEUPDATE_CMD_GET_STATE)
+
+/**
+ * struct liveupdate_ioctl_set_event - ioctl(LIVEUPDATE_IOCTL_SET_EVENT)
+ * @size: Input; sizeof(struct liveupdate_ioctl_set_event)
+ * @event: Input; The live update event.
+ *
+ * Notify live update orchestrator about global event, that causes a state
+ * transition.
+ *
+ * Event, can be one of the following:
+ *
+ * - %LIVEUPDATE_PREPARE: Initiates the live update preparation phase. This
+ * typically triggers the saving process for items marked
+ * via the PRESERVE ioctls. This typically occurs
+ * *before* the "blackout window", while user
+ * applications (e.g., VMs) may still be running. Kernel
+ * subsystems receiving the %LIVEUPDATE_PREPARE event
+ * should serialize necessary state. This command does
+ * not transfer data.
+ * - %LIVEUPDATE_FINISH: Signal restoration completion and triggercleanup.
+ *
+ * Signals that user space has completed all necessary
+ * restoration actions in the new kernel (after a live
+ * update reboot). Calling this ioctl triggers the
+ * cleanup phase: any resources that were successfully
+ * preserved but were *not* subsequently restored
+ * (reclaimed) via the RESTORE ioctls will have their
+ * preserved state discarded and associated kernel
+ * resources released. Involved devices may be reset. All
+ * desired restorations *must* be completed *before*
+ * this. Kernel callbacks for the %LIVEUPDATE_FINISH
+ * event must not fail. Successfully completing this
+ * phase transitions the system state from
+ * %LIVEUPDATE_STATE_UPDATED back to
+ * %LIVEUPDATE_STATE_NORMAL. This command does
+ * not transfer data.
+ * - %LIVEUPDATE_CANCEL: Cancel the live update preparation phase.
+ *
+ * Notifies the live update subsystem to abort the
+ * preparation sequence potentially initiated by
+ * %LIVEUPDATE_PREPARE event.
+ *
+ * When triggered, subsystems receiving the
+ * %LIVEUPDATE_CANCEL event should revert any state
+ * changes or actions taken specifically for the aborted
+ * prepare phase (e.g., discard partially serialized
+ * state). The kernel releases resources allocated
+ * specifically for this *aborted preparation attempt*.
+ *
+ * This operation cancels the current *attempt* to
+ * prepare for a live update but does **not** remove
+ * previously validated items from the internal list
+ * of potentially preservable resources.
+ *
+ * This command does not transfer data. Kernel callbacks
+ * for the %LIVEUPDATE_CANCEL event must not fail.
+ *
+ * See the definition of &enum liveupdate_event for more details on each state.
+ *
+ * Return: 0 on success, negative error code on failure.
+ */
+struct liveupdate_ioctl_set_event {
+ __u32 size;
+ __u32 event;
+};
+
+#define LIVEUPDATE_IOCTL_SET_EVENT \
+ _IO(LIVEUPDATE_IOCTL_TYPE, LIVEUPDATE_CMD_SET_EVENT)
+
+/**
+ * struct liveupdate_ioctl_create_session - ioctl(LIVEUPDATE_IOCTL_CREATE_SESSION)
+ * @size: Input; sizeof(struct liveupdate_ioctl_create_session)
+ * @fd: Output; The new file descriptor for the created session.
+ * @name: Input; A null-terminated string for the session name, max
+ * length %LIVEUPDATE_SESSION_NAME_LENGTH including termination
+ * char.
+ *
+ * Creates a new live update session for managing preserved resources.
+ * This ioctl can only be called on the main /dev/liveupdate device.
+ *
+ * Return: 0 on success, negative error code on failure.
+ */
+struct liveupdate_ioctl_create_session {
+ __u32 size;
+ __s32 fd;
+ __u8 name[LIVEUPDATE_SESSION_NAME_LENGTH];
+};
+
+#define LIVEUPDATE_IOCTL_CREATE_SESSION \
+ _IO(LIVEUPDATE_IOCTL_TYPE, LIVEUPDATE_CMD_CREATE_SESSION)
+
+/**
+ * struct liveupdate_ioctl_retrieve_session - ioctl(LIVEUPDATE_IOCTL_RETRIEVE_SESSION)
+ * @size: Input; sizeof(struct liveupdate_ioctl_retrieve_session)
+ * @fd: Output; The new file descriptor for the retrieved session.
+ * @name: Input; A null-terminated string identifying the session to retrieve.
+ * The name must exactly match the name used when the session was
+ * created in the previous kernel.
+ *
+ * Retrieves a handle (a new file descriptor) for a preserved session by its
+ * name. This is the primary mechanism for a userspace agent to regain control
+ * of its preserved resources after a live update.
+ *
+ * The userspace application provides the null-terminated `name` of a session
+ * it created before the live update. If a preserved session with a matching
+ * name is found, the kernel instantiates it and returns a new file descriptor
+ * in the `fd` field. This new session FD can then be used for all file-specific
+ * operations, such as restoring individual file descriptors with
+ * LIVEUPDATE_SESSION_RESTORE_FD.
+ *
+ * It is the responsibility of the userspace application to know the names of
+ * the sessions it needs to retrieve. If no session with the given name is
+ * found, the ioctl will fail with -ENOENT.
+ *
+ * This ioctl can only be called on the main /dev/liveupdate device when the
+ * system is in the LIVEUPDATE_STATE_UPDATED state.
+ */
+struct liveupdate_ioctl_retrieve_session {
+ __u32 size;
+ __s32 fd;
+ __u8 name[64];
+};
+
+#define LIVEUPDATE_IOCTL_RETRIEVE_SESSION \
+ _IO(LIVEUPDATE_IOCTL_TYPE, LIVEUPDATE_CMD_RETRIEVE_SESSION)
#endif /* _UAPI_LIVEUPDATE_H */
diff --git a/kernel/liveupdate/luo_internal.h b/kernel/liveupdate/luo_internal.h
index 9223f71844ca..a14e0b685ccb 100644
--- a/kernel/liveupdate/luo_internal.h
+++ b/kernel/liveupdate/luo_internal.h
@@ -17,6 +17,26 @@
*/
#define luo_restore_fail(__fmt, ...) panic(__fmt, ##__VA_ARGS__)
+struct luo_ucmd {
+ void __user *ubuffer;
+ u32 user_size;
+ void *cmd;
+};
+
+static inline int luo_ucmd_respond(struct luo_ucmd *ucmd,
+ size_t kernel_cmd_size)
+{
+ /*
+ * Copy the minimum of what the user provided and what we actually
+ * have.
+ */
+ if (copy_to_user(ucmd->ubuffer, ucmd->cmd,
+ min_t(size_t, ucmd->user_size, kernel_cmd_size))) {
+ return -EFAULT;
+ }
+ return 0;
+}
+
int luo_cancel(void);
int luo_prepare(void);
int luo_freeze(void);
diff --git a/kernel/liveupdate/luo_ioctl.c b/kernel/liveupdate/luo_ioctl.c
index fc2afb450ad5..01ccb8a6d3f4 100644
--- a/kernel/liveupdate/luo_ioctl.c
+++ b/kernel/liveupdate/luo_ioctl.c
@@ -5,6 +5,25 @@
* Pasha Tatashin <pasha.tatashin@soleen.com>
*/
+/**
+ * DOC: LUO ioctl Interface
+ *
+ * The IOCTL user-space control interface for the LUO subsystem.
+ * It registers a character device, typically found at ``/dev/liveupdate``,
+ * which allows a userspace agent to manage the LUO state machine and its
+ * associated resources, such as preservable file descriptors.
+ *
+ * To ensure that the state machine is controlled by a single entity, access
+ * to this device is exclusive: only one process is permitted to have
+ * ``/dev/liveupdate`` open at any given time. Subsequent open attempts will
+ * fail with -EBUSY until the first process closes its file descriptor.
+ * This singleton model simplifies state management by preventing conflicting
+ * commands from multiple userspace agents.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/atomic.h>
#include <linux/errno.h>
#include <linux/file.h>
#include <linux/fs.h>
@@ -19,10 +38,191 @@
struct luo_device_state {
struct miscdevice miscdev;
+ atomic_t in_use;
+};
+
+static int luo_ioctl_get_state(struct luo_ucmd *ucmd)
+{
+ struct liveupdate_ioctl_get_state *argp = ucmd->cmd;
+
+ argp->state = liveupdate_get_state();
+
+ return luo_ucmd_respond(ucmd, sizeof(*argp));
+}
+
+static int luo_ioctl_set_event(struct luo_ucmd *ucmd)
+{
+ struct liveupdate_ioctl_set_event *argp = ucmd->cmd;
+ int ret;
+
+ switch (argp->event) {
+ case LIVEUPDATE_PREPARE:
+ ret = luo_prepare();
+ break;
+ case LIVEUPDATE_FINISH:
+ ret = luo_finish();
+ break;
+ case LIVEUPDATE_CANCEL:
+ ret = luo_cancel();
+ break;
+ default:
+ ret = -EOPNOTSUPP;
+ }
+
+ return ret;
+}
+
+static int luo_ioctl_create_session(struct luo_ucmd *ucmd)
+{
+ struct liveupdate_ioctl_create_session *argp = ucmd->cmd;
+ struct file *file;
+ int ret;
+
+ argp->fd = get_unused_fd_flags(O_CLOEXEC);
+ if (argp->fd < 0)
+ return argp->fd;
+
+ ret = luo_session_create(argp->name, &file);
+ if (ret)
+ return ret;
+
+ ret = luo_ucmd_respond(ucmd, sizeof(*argp));
+ if (ret) {
+ fput(file);
+ put_unused_fd(argp->fd);
+ return ret;
+ }
+
+ fd_install(argp->fd, file);
+
+ return 0;
+}
+
+static int luo_ioctl_retrieve_session(struct luo_ucmd *ucmd)
+{
+ struct liveupdate_ioctl_retrieve_session *argp = ucmd->cmd;
+ struct file *file;
+ int ret;
+
+ argp->fd = get_unused_fd_flags(O_CLOEXEC);
+ if (argp->fd < 0)
+ return argp->fd;
+
+ ret = luo_session_retrieve(argp->name, &file);
+ if (ret < 0) {
+ put_unused_fd(argp->fd);
+
+ return ret;
+ }
+
+ ret = luo_ucmd_respond(ucmd, sizeof(*argp));
+ if (ret) {
+ fput(file);
+ put_unused_fd(argp->fd);
+ return ret;
+ }
+
+ fd_install(argp->fd, file);
+
+ return 0;
+}
+
+static int luo_open(struct inode *inodep, struct file *filep)
+{
+ struct luo_device_state *ldev = container_of(filep->private_data,
+ struct luo_device_state,
+ miscdev);
+
+ if (atomic_cmpxchg(&ldev->in_use, 0, 1))
+ return -EBUSY;
+
+ return 0;
+}
+
+static int luo_release(struct inode *inodep, struct file *filep)
+{
+ struct luo_device_state *ldev = container_of(filep->private_data,
+ struct luo_device_state,
+ miscdev);
+ atomic_set(&ldev->in_use, 0);
+
+ return 0;
+}
+
+union ucmd_buffer {
+ struct liveupdate_ioctl_create_session create;
+ struct liveupdate_ioctl_get_state state;
+ struct liveupdate_ioctl_retrieve_session retrieve;
+ struct liveupdate_ioctl_set_event event;
};
+struct luo_ioctl_op {
+ unsigned int size;
+ unsigned int min_size;
+ unsigned int ioctl_num;
+ int (*execute)(struct luo_ucmd *ucmd);
+};
+
+#define IOCTL_OP(_ioctl, _fn, _struct, _last) \
+ [_IOC_NR(_ioctl) - LIVEUPDATE_CMD_BASE] = { \
+ .size = sizeof(_struct) + \
+ BUILD_BUG_ON_ZERO(sizeof(union ucmd_buffer) < \
+ sizeof(_struct)), \
+ .min_size = offsetofend(_struct, _last), \
+ .ioctl_num = _ioctl, \
+ .execute = _fn, \
+ }
+
+static const struct luo_ioctl_op luo_ioctl_ops[] = {
+ IOCTL_OP(LIVEUPDATE_IOCTL_CREATE_SESSION, luo_ioctl_create_session,
+ struct liveupdate_ioctl_create_session, name),
+ IOCTL_OP(LIVEUPDATE_IOCTL_GET_STATE, luo_ioctl_get_state,
+ struct liveupdate_ioctl_get_state, state),
+ IOCTL_OP(LIVEUPDATE_IOCTL_RETRIEVE_SESSION, luo_ioctl_retrieve_session,
+ struct liveupdate_ioctl_retrieve_session, name),
+ IOCTL_OP(LIVEUPDATE_IOCTL_SET_EVENT, luo_ioctl_set_event,
+ struct liveupdate_ioctl_set_event, event),
+};
+
+static long luo_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+{
+ const struct luo_ioctl_op *op;
+ struct luo_ucmd ucmd = {};
+ union ucmd_buffer buf;
+ unsigned int nr;
+ int ret;
+
+ nr = _IOC_NR(cmd);
+ if (nr < LIVEUPDATE_CMD_BASE ||
+ (nr - LIVEUPDATE_CMD_BASE) >= ARRAY_SIZE(luo_ioctl_ops)) {
+ return -EINVAL;
+ }
+
+ ucmd.ubuffer = (void __user *)arg;
+ ret = get_user(ucmd.user_size, (u32 __user *)ucmd.ubuffer);
+ if (ret)
+ return ret;
+
+ op = &luo_ioctl_ops[nr - LIVEUPDATE_CMD_BASE];
+ if (op->ioctl_num != cmd)
+ return -ENOIOCTLCMD;
+ if (ucmd.user_size < op->min_size)
+ return -EINVAL;
+
+ ucmd.cmd = &buf;
+ ret = copy_struct_from_user(ucmd.cmd, op->size, ucmd.ubuffer,
+ ucmd.user_size);
+ if (ret)
+ return ret;
+
+ return op->execute(&ucmd);
+}
+
static const struct file_operations luo_fops = {
.owner = THIS_MODULE,
+ .open = luo_open,
+ .release = luo_release,
+ .unlocked_ioctl = luo_ioctl,
};
static struct luo_device_state luo_dev = {
@@ -31,6 +231,7 @@ static struct luo_device_state luo_dev = {
.name = "liveupdate",
.fops = &luo_fops,
},
+ .in_use = ATOMIC_INIT(0),
};
static int __init liveupdate_init(void)
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 13/30] liveupdate: luo_file: implement file systems callbacks
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Implements the core logic within luo_file.c to invoke the prepare,
reboot, finish, and cancel callbacks for preserved file instances,
replacing the previous stub implementations. It also handles
the persistence and retrieval of the u64 data payload associated with
each file via the LUO FDT.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
include/linux/liveupdate.h | 79 ++++
kernel/liveupdate/Makefile | 1 +
kernel/liveupdate/luo_file.c | 599 +++++++++++++++++++++++++++++++
kernel/liveupdate/luo_internal.h | 14 +
4 files changed, 693 insertions(+)
create mode 100644 kernel/liveupdate/luo_file.c
diff --git a/include/linux/liveupdate.h b/include/linux/liveupdate.h
index 4c378a986cfe..c0a7f8c40719 100644
--- a/include/linux/liveupdate.h
+++ b/include/linux/liveupdate.h
@@ -13,6 +13,72 @@
#include <uapi/linux/liveupdate.h>
struct liveupdate_subsystem;
+struct liveupdate_file_handler;
+struct file;
+
+/**
+ * struct liveupdate_file_ops - Callbacks for live-updatable files.
+ * @prepare: Optional. Saves state for a specific file instance @file,
+ * before update, potentially returning value via @data.
+ * Returns 0 on success, negative errno on failure.
+ * @freeze: Optional. Performs final actions just before kernel
+ * transition, potentially reading/updating the handle via
+ * @data.
+ * Returns 0 on success, negative errno on failure.
+ * @cancel: Optional. Cleans up state/resources if update is aborted
+ * after prepare/freeze succeeded, using the @data handle (by
+ * value) from the successful prepare. Returns void.
+ * @finish: Optional. Performs final cleanup in the new kernel using the
+ * preserved @data handle (by value). Returns void.
+ * @retrieve: Retrieve the preserved file. Must be called before finish.
+ * @can_preserve: callback to determine if @file can be preserved by this
+ * handler.
+ * Return bool (true if preservable, false otherwise).
+ * @owner: Module reference
+ */
+struct liveupdate_file_ops {
+ int (*prepare)(struct liveupdate_file_handler *handler,
+ struct file *file, u64 *data);
+ int (*freeze)(struct liveupdate_file_handler *handler,
+ struct file *file, u64 *data);
+ void (*cancel)(struct liveupdate_file_handler *handler,
+ struct file *file, u64 data);
+ void (*finish)(struct liveupdate_file_handler *handler,
+ struct file *file, u64 data, bool reclaimed);
+ int (*retrieve)(struct liveupdate_file_handler *handler,
+ u64 data, struct file **file);
+ bool (*can_preserve)(struct liveupdate_file_handler *handler,
+ struct file *file);
+ struct module *owner;
+};
+
+/* The max size is set so it can be reliably used during in serialization */
+#define LIVEUPDATE_HNDL_COMPAT_LENGTH 48
+
+/**
+ * struct liveupdate_file_handler - Represents a handler for a live-updatable
+ * file type.
+ * @ops: Callback functions
+ * @compatible: The compatibility string (e.g., "memfd-v1", "vfiofd-v1")
+ * that uniquely identifies the file type this handler supports.
+ * This is matched against the compatible string associated with
+ * individual &struct liveupdate_file instances.
+ * @list: used for linking this handler instance into a global list of
+ * registered file handlers.
+ * @count: Atomic counter of number of files that are preserved and use
+ * this handler.
+ *
+ * Modules that want to support live update for specific file types should
+ * register an instance of this structure. LUO uses this registration to
+ * determine if a given file can be preserved and to find the appropriate
+ * operations to manage its state across the update.
+ */
+struct liveupdate_file_handler {
+ const struct liveupdate_file_ops *ops;
+ const char compatible[LIVEUPDATE_HNDL_COMPAT_LENGTH];
+ struct list_head list;
+ atomic_t count;
+};
/**
* struct liveupdate_subsystem_ops - LUO events callback functions
@@ -83,6 +149,9 @@ int liveupdate_register_subsystem(struct liveupdate_subsystem *h);
int liveupdate_unregister_subsystem(struct liveupdate_subsystem *h);
int liveupdate_get_subsystem_data(struct liveupdate_subsystem *h, u64 *data);
+int liveupdate_register_file_handler(struct liveupdate_file_handler *h);
+int liveupdate_unregister_file_handler(struct liveupdate_file_handler *h);
+
#else /* CONFIG_LIVEUPDATE */
static inline int liveupdate_reboot(void)
@@ -126,5 +195,15 @@ static inline int liveupdate_get_subsystem_data(struct liveupdate_subsystem *h,
return -ENODATA;
}
+static inline int liveupdate_register_file_handler(struct liveupdate_file_handler *h)
+{
+ return 0;
+}
+
+static inline int liveupdate_unregister_file_handler(struct liveupdate_file_handler *h)
+{
+ return 0;
+}
+
#endif /* CONFIG_LIVEUPDATE */
#endif /* _LINUX_LIVEUPDATE_H */
diff --git a/kernel/liveupdate/Makefile b/kernel/liveupdate/Makefile
index f64cfc92cbf0..282d36a18993 100644
--- a/kernel/liveupdate/Makefile
+++ b/kernel/liveupdate/Makefile
@@ -2,6 +2,7 @@
luo-y := \
luo_core.o \
+ luo_file.o \
luo_ioctl.o \
luo_session.o \
luo_subsystems.o
diff --git a/kernel/liveupdate/luo_file.c b/kernel/liveupdate/luo_file.c
new file mode 100644
index 000000000000..69f3acf90da5
--- /dev/null
+++ b/kernel/liveupdate/luo_file.c
@@ -0,0 +1,599 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright (c) 2025, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+/**
+ * DOC: LUO file descriptors
+ *
+ * LUO provides the infrastructure necessary to preserve
+ * specific types of stateful file descriptors across a kernel live
+ * update transition. The primary goal is to allow workloads, such as virtual
+ * machines using vfio, memfd, or iommufd to retain access to their essential
+ * resources without interruption after the underlying kernel is updated.
+ *
+ * The framework operates based on handler registration and instance tracking:
+ *
+ * 1. Handler Registration: Kernel modules responsible for specific file
+ * types (e.g., memfd, vfio) register a &struct liveupdate_file_handler
+ * handler. This handler contains callbacks
+ * (&liveupdate_file_handler.ops->prepare,
+ * &liveupdate_file_handler.ops->freeze,
+ * &liveupdate_file_handler.ops->finish, etc.) and a unique 'compatible' string
+ * identifying the file type. Registration occurs via
+ * liveupdate_register_file_handler().
+ *
+ * 2. File Instance Tracking: When a potentially preservable file needs to be
+ * managed for live update, the core LUO logic (luo_preserve_file()) finds a
+ * compatible registered handler using its
+ * &liveupdate_file_handler.ops->can_preserve callback. If found, an internal
+ * &struct luo_file instance is created, assigned a unique u64 'token', and
+ * added to a list.
+ *
+ * 3. State Persistence ...
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/atomic.h>
+#include <linux/err.h>
+#include <linux/file.h>
+#include <linux/kexec_handover.h>
+#include <linux/liveupdate.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/rwsem.h>
+#include <linux/sizes.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/xarray.h>
+#include "luo_internal.h"
+
+/* Registered files. */
+static DECLARE_RWSEM(luo_file_handler_list_rwsem);
+static LIST_HEAD(luo_file_handler_list);
+
+/**
+ * struct luo_file_ser - Represents the serialized preserves files.
+ * @compatible: File handler compatabile string.
+ * @files: Private data
+ * @token: User provided token for this file
+ *
+ * If this structure is modified, LUO_SESSION_COMPATIBLE must be updated.
+ */
+struct luo_file_ser {
+ char compatible[LIVEUPDATE_HNDL_COMPAT_LENGTH];
+ u64 data;
+ u64 token;
+} __packed;
+
+/**
+ * struct luo_file - Represents a file descriptor instance preserved
+ * across live update.
+ * @fh: Pointer to the &struct liveupdate_file_handler containing
+ * the implementation of prepare, freeze, cancel, and finish
+ * operations specific to this file's type.
+ * @file: A pointer to the kernel's &struct file object representing
+ * the open file descriptor that is being preserved.
+ * @private_data: Internal storage used by the live update core framework
+ * between phases.
+ * @reclaimed: Flag indicating whether this preserved file descriptor has
+ * been successfully 'reclaimed' (e.g., requested via an ioctl)
+ * by user-space or the owning kernel subsystem in the new
+ * kernel after the live update.
+ * @state: The current state of file descriptor, it is allowed to
+ * prepare, freeze, and finish FDs before the global state
+ * switch.
+ * @mutex: Lock to protect FD state, and allow independently to change
+ * the FD state compared to global state.
+ *
+ * This structure holds the necessary callbacks and context for managing a
+ * specific open file descriptor throughout the different phases of a live
+ * update process. Instances of this structure are typically allocated,
+ * populated with file-specific details (&file, &arg, callbacks, compatibility
+ * string, token), and linked into a central list managed by the LUO. The
+ * private_data field is used internally by the core logic to store state
+ * between phases.
+ */
+struct luo_file {
+ struct liveupdate_file_handler *fh;
+ struct file *file;
+ u64 private_data;
+ bool reclaimed;
+ enum liveupdate_state state;
+ struct mutex mutex;
+};
+
+static int luo_file_prepare_one(struct luo_file *h)
+{
+ int ret = 0;
+
+ guard(mutex)(&h->mutex);
+ if (h->state == LIVEUPDATE_STATE_NORMAL) {
+ if (h->fh->ops->prepare) {
+ ret = h->fh->ops->prepare(h->fh, h->file,
+ &h->private_data);
+ }
+ if (!ret)
+ h->state = LIVEUPDATE_STATE_PREPARED;
+ } else {
+ WARN_ON_ONCE(h->state != LIVEUPDATE_STATE_PREPARED &&
+ h->state != LIVEUPDATE_STATE_FROZEN);
+ }
+
+ return ret;
+}
+
+static int luo_file_freeze_one(struct luo_file *h)
+{
+ int ret = 0;
+
+ guard(mutex)(&h->mutex);
+ if (h->state == LIVEUPDATE_STATE_PREPARED) {
+ if (h->fh->ops->freeze) {
+ ret = h->fh->ops->freeze(h->fh, h->file,
+ &h->private_data);
+ }
+ if (!ret)
+ h->state = LIVEUPDATE_STATE_FROZEN;
+ } else {
+ WARN_ON_ONCE(h->state != LIVEUPDATE_STATE_FROZEN);
+ }
+
+ return ret;
+}
+
+static void luo_file_finish_one(struct luo_file *h)
+{
+ guard(mutex)(&h->mutex);
+ if (h->state == LIVEUPDATE_STATE_UPDATED) {
+ if (h->fh->ops->finish) {
+ h->fh->ops->finish(h->fh, h->file, h->private_data,
+ h->reclaimed);
+ }
+ h->state = LIVEUPDATE_STATE_NORMAL;
+ } else {
+ WARN_ON_ONCE(h->state != LIVEUPDATE_STATE_NORMAL);
+ }
+}
+
+static void luo_file_cancel_one(struct luo_file *h)
+{
+ guard(mutex)(&h->mutex);
+ if (h->state == LIVEUPDATE_STATE_NORMAL)
+ return;
+
+ if (WARN_ON_ONCE(h->state != LIVEUPDATE_STATE_PREPARED &&
+ h->state != LIVEUPDATE_STATE_FROZEN)) {
+ return;
+ }
+
+ if (h->fh->ops->cancel)
+ h->fh->ops->cancel(h->fh, h->file, h->private_data);
+
+ h->private_data = 0;
+ h->state = LIVEUPDATE_STATE_NORMAL;
+}
+
+static void __luo_file_cancel(struct luo_session *session)
+{
+ unsigned long token;
+ struct luo_file *h;
+
+ xa_for_each(&session->files_xa, token, h)
+ luo_file_cancel_one(h);
+}
+
+int luo_file_prepare(struct luo_session *session)
+{
+ struct luo_file *luo_file;
+ struct luo_file_ser *ser;
+ unsigned long token;
+ size_t ser_size;
+ int ret = 0;
+ int i;
+
+ if (!session->count)
+ return 0;
+
+ ser_size = session->count * sizeof(struct luo_file_ser);
+ ser = luo_contig_alloc_preserve(ser_size);
+ if (IS_ERR(ser))
+ return PTR_ERR(ser);
+
+ i = 0;
+ xa_for_each(&session->files_xa, token, luo_file) {
+ ret = luo_file_prepare_one(luo_file);
+ if (ret < 0) {
+ pr_err("Prepare failed for session[%s] token[%#0llx] handler[%s] ret[%d]\n",
+ session->name, (u64)token, luo_file->fh->compatible, ret);
+ goto exit_cleanup;
+ }
+
+ strscpy(ser[i].compatible, luo_file->fh->compatible,
+ sizeof(ser[i].compatible));
+ ser[i].data = luo_file->private_data;
+ ser[i].token = token;
+ i++;
+ }
+
+ session->files = __pa(ser);
+
+ return 0;
+
+exit_cleanup:
+ __luo_file_cancel(session);
+ luo_contig_free_unpreserve(ser, ser_size);
+
+ return ret;
+}
+
+int luo_file_freeze(struct luo_session *session)
+{
+ struct luo_file *luo_file;
+ struct luo_file_ser *ser;
+ unsigned long token;
+ size_t ser_size;
+ int ret = 0;
+ int i;
+
+ if (!session->count)
+ return 0;
+
+ if (WARN_ON(!session->files))
+ return -EINVAL;
+
+ ser = __va(session->files);
+
+ i = 0;
+ xa_for_each(&session->files_xa, token, luo_file) {
+ ret = luo_file_freeze_one(luo_file);
+ if (ret < 0) {
+ pr_err("Freeze failed for session[%s] token[%#0llx] handler[%s] ret[%d]\n",
+ session->name, (u64)token, luo_file->fh->compatible, ret);
+ goto exit_cleanup;
+ }
+ ser[i].data = luo_file->private_data;
+ i++;
+ }
+
+ return 0;
+
+exit_cleanup:
+ __luo_file_cancel(session);
+ ser_size = session->count * sizeof(struct luo_file_ser);
+ luo_contig_free_unpreserve(ser, ser_size);
+
+ return ret;
+}
+
+void luo_file_finish(struct luo_session *session)
+{
+ struct luo_file *luo_file;
+ struct luo_file_ser *ser;
+ unsigned long token;
+ size_t ser_size;
+
+ if (!session->count)
+ return;
+
+ xa_for_each(&session->files_xa, token, luo_file)
+ luo_file_finish_one(luo_file);
+
+ ser_size = session->count * sizeof(struct luo_file_ser);
+ ser = __va(session->files);
+ luo_contig_free_restore(ser, ser_size);
+}
+
+void luo_file_cancel(struct luo_session *session)
+{
+ struct luo_file_ser *ser;
+ size_t ser_size;
+
+ if (!session->count)
+ return;
+
+ __luo_file_cancel(session);
+
+ if (session->files) {
+ ser = __va(session->files);
+ ser_size = session->count * sizeof(struct luo_file_ser);
+ luo_contig_free_unpreserve(ser, ser_size);
+ session->files = 0;
+ }
+}
+
+void luo_file_deserialize(struct luo_session *session)
+{
+ struct luo_file_ser *ser;
+ u64 i;
+
+ if (!session->files)
+ return;
+
+ guard(rwsem_read)(&luo_file_handler_list_rwsem);
+ ser = __va(session->files);
+ for (i = 0; i < session->count; i++) {
+ struct liveupdate_file_handler *fh;
+ bool handler_found = false;
+ struct luo_file *luo_file;
+ int ret;
+
+ if (xa_load(&session->files_xa, ser[i].token)) {
+ luo_restore_fail("Duplicate token %llu found in incoming FDT for file descriptors.\n",
+ ser[i].token);
+ }
+
+ list_for_each_entry(fh, &luo_file_handler_list, list) {
+ if (!strcmp(fh->compatible, ser[i].compatible)) {
+ handler_found = true;
+ break;
+ }
+ }
+
+ if (!handler_found) {
+ luo_restore_fail("No registered handler for compatible '%s'\n",
+ ser[i].compatible);
+ }
+
+ luo_file = kzalloc(sizeof(*luo_file),
+ GFP_KERNEL | __GFP_NOFAIL);
+ luo_file->fh = fh;
+ luo_file->file = NULL;
+ luo_file->private_data = ser[i].data;
+ luo_file->reclaimed = false;
+ mutex_init(&luo_file->mutex);
+ luo_file->state = LIVEUPDATE_STATE_UPDATED;
+ ret = xa_err(xa_store(&session->files_xa, ser[i].token,
+ luo_file, GFP_KERNEL | __GFP_NOFAIL));
+ if (ret < 0) {
+ luo_restore_fail("Failed to store luo_file for token %llu in XArray: %d\n",
+ ser[i].token, ret);
+ }
+ }
+}
+
+/**
+ * luo_preserve_file - Register a file descriptor for live update management.
+ * @token: Token value for this file descriptor.
+ * @fd: file descriptor to be preserved.
+ *
+ * Context: Must be called when LUO is in 'normal' state.
+ *
+ * Return: 0 on success. Negative errno on failure.
+ */
+int luo_preserve_file(struct luo_session *session, u64 token, int fd)
+{
+ struct liveupdate_file_handler *fh;
+ struct luo_file *luo_file;
+ bool found = false;
+ int ret = -ENOENT;
+ struct file *file;
+
+ file = fget(fd);
+ if (!file) {
+ pr_err("Bad file descriptor\n");
+ return -EBADF;
+ }
+
+ guard(rwsem_read)(&luo_file_handler_list_rwsem);
+ list_for_each_entry(fh, &luo_file_handler_list, list) {
+ if (fh->ops->can_preserve(fh, file)) {
+ found = true;
+ break;
+ }
+ }
+
+ if (!found)
+ goto exit_cleanup;
+
+ luo_file = kzalloc(sizeof(*luo_file), GFP_KERNEL);
+ if (!luo_file) {
+ ret = -ENOMEM;
+ goto exit_cleanup;
+ }
+
+ luo_file->private_data = 0;
+ luo_file->reclaimed = false;
+
+ luo_file->file = file;
+ luo_file->fh = fh;
+ mutex_init(&luo_file->mutex);
+ luo_file->state = LIVEUPDATE_STATE_NORMAL;
+
+ if (xa_load(&session->files_xa, token)) {
+ ret = -EEXIST;
+ pr_warn("Token %llu is already taken\n", token);
+ mutex_destroy(&luo_file->mutex);
+ kfree(luo_file);
+ goto exit_cleanup;
+ }
+
+ ret = xa_err(xa_store(&session->files_xa, token, luo_file,
+ GFP_KERNEL));
+ if (ret < 0) {
+ pr_warn("Failed to store file for token %llu in XArray: %d\n",
+ token, ret);
+ mutex_destroy(&luo_file->mutex);
+ kfree(luo_file);
+ goto exit_cleanup;
+ }
+ atomic_inc(&luo_file->fh->count);
+ session->count++;
+
+exit_cleanup:
+ if (ret)
+ fput(file);
+
+ return ret;
+}
+
+/**
+ * luo_unpreserve_file - Unregister a file instance using its token.
+ * @token: The unique token of the file instance to unregister.
+ *
+ * Finds the &struct luo_file associated with the @token in the
+ * global list and removes it. This function *only* removes the entry from the
+ * list; it does *not* free the memory allocated for the &struct luo_file
+ * itself. The caller is responsible for freeing the structure after this
+ * function returns successfully.
+ *
+ * Context: Can be called when a preserved file descriptor is closed or
+ * no longer needs live update management.
+ *
+ * Return: 0 on success. Negative errno on failure.
+ */
+int luo_unpreserve_file(struct luo_session *session, u64 token)
+{
+ struct luo_file *luo_file;
+
+ luo_file = xa_erase(&session->files_xa, token);
+ if (!luo_file)
+ return -ENOENT;
+
+ if (luo_file->file)
+ fput(luo_file->file);
+ mutex_destroy(&luo_file->mutex);
+ scoped_guard(rwsem_read, &luo_file_handler_list_rwsem)
+ atomic_dec(&luo_file->fh->count);
+ kfree(luo_file);
+ session->count--;
+
+ return 0;
+}
+
+/**
+ * luo_retrieve_file - Find a registered file instance by its token.
+ * @token: The unique token of the file instance to retrieve.
+ * @filep: Output parameter. On success (return value 0), this will point
+ * to the retrieved "struct file".
+ *
+ * Searches the global list for a &struct luo_file matching the @token. Uses a
+ * read lock, allowing concurrent retrievals.
+ *
+ * Return: 0 on success. Negative errno on failure.
+ */
+int luo_retrieve_file(struct luo_session *session, u64 token,
+ struct file **filep)
+{
+ struct luo_file *luo_file;
+ int ret = 0;
+
+ luo_file = xa_load(&session->files_xa, token);
+ if (!luo_file)
+ return -ENOENT;
+
+ if (luo_file->reclaimed)
+ return -EADDRINUSE;
+
+ guard(mutex)(&luo_file->mutex);
+ if (luo_file->reclaimed)
+ return -EADDRINUSE;
+
+ ret = luo_file->fh->ops->retrieve(luo_file->fh, luo_file->private_data,
+ filep);
+ if (!ret) {
+ /* Get a reference so, we can keep this file in LUO */
+ luo_file->file = *filep;
+ get_file(luo_file->file);
+ luo_file->reclaimed = true;
+ }
+
+ return ret;
+}
+
+void luo_file_unpreserve_all_files(struct luo_session *session)
+{
+ unsigned long token;
+ struct luo_file *h;
+
+ xa_for_each(&session->files_xa, token, h)
+ luo_unpreserve_file(session, token);
+}
+
+void luo_file_unpreserve_unreclaimed_files(struct luo_session *session)
+{
+ unsigned long token;
+ struct luo_file *h;
+
+ xa_for_each(&session->files_xa, token, h) {
+ if (!h->reclaimed) {
+ pr_err("Unpreserving unreclaimed file, session[%s] token[%#0llx] handler[%s]\n",
+ session->name, (u64)token, h->fh->compatible);
+ luo_unpreserve_file(session, token);
+ }
+ }
+}
+
+/**
+ * liveupdate_register_file_handler - Register a file handler with LUO.
+ * @fh: Pointer to a caller-allocated &struct liveupdate_file_handler.
+ * The caller must initialize this structure, including a unique
+ * 'compatible' string and a valid 'fh' callbacks. This function adds the
+ * handler to the global list of supported file handlers.
+ *
+ * Context: Typically called during module initialization for file types that
+ * support live update preservation.
+ *
+ * Return: 0 on success. Negative errno on failure.
+ */
+int liveupdate_register_file_handler(struct liveupdate_file_handler *fh)
+{
+ struct liveupdate_file_handler *fh_iter;
+
+ guard(rwsem_read)(&luo_state_rwsem);
+ if (!liveupdate_state_normal() && !liveupdate_state_updated())
+ return -EBUSY;
+
+ guard(rwsem_write)(&luo_file_handler_list_rwsem);
+ list_for_each_entry(fh_iter, &luo_file_handler_list, list) {
+ if (!strcmp(fh_iter->compatible, fh->compatible)) {
+ pr_err("File handler registration failed: Compatible string '%s' already registered.\n",
+ fh->compatible);
+ return -EEXIST;
+ }
+ }
+
+ if (!try_module_get(fh->ops->owner))
+ return -EAGAIN;
+
+ INIT_LIST_HEAD(&fh->list);
+ atomic_set(&fh->count, 0);
+ list_add_tail(&fh->list, &luo_file_handler_list);
+
+ return 0;
+}
+
+/**
+ * liveupdate_unregister_file - Unregister a file handler.
+ * @fh: Pointer to the specific &struct liveupdate_file_handler instance
+ * that was previously returned by or passed to
+ * liveupdate_register_file_handler.
+ *
+ * Removes the specified handler instance @fh from the global list of
+ * registered file handlers. This function only removes the entry from the
+ * list; it does not free the memory associated with @fh itself. The caller
+ * is responsible for freeing the structure memory after this function returns
+ * successfully.
+ *
+ * Return: 0 on success. Negative errno on failure.
+ */
+int liveupdate_unregister_file_handler(struct liveupdate_file_handler *fh)
+{
+ guard(rwsem_read)(&luo_state_rwsem);
+ if (!liveupdate_state_normal() && !liveupdate_state_updated())
+ return -EBUSY;
+
+ guard(rwsem_write)(&luo_file_handler_list_rwsem);
+ if (atomic_read(&fh->count)) {
+ pr_warn("Unable to unregister file handler, files are preserved\n");
+ return -EBUSY;
+ }
+
+ list_del_init(&fh->list);
+ module_put(fh->ops->owner);
+
+ return 0;
+}
diff --git a/kernel/liveupdate/luo_internal.h b/kernel/liveupdate/luo_internal.h
index a14e0b685ccb..c9bce82aac22 100644
--- a/kernel/liveupdate/luo_internal.h
+++ b/kernel/liveupdate/luo_internal.h
@@ -8,6 +8,8 @@
#ifndef _LINUX_LUO_INTERNAL_H
#define _LINUX_LUO_INTERNAL_H
+#include <linux/liveupdate.h>
+
/*
* Handles a deserialization failure: devices and memory is in unpredictable
* state.
@@ -93,4 +95,16 @@ int luo_do_subsystems_freeze_calls(void);
void luo_do_subsystems_finish_calls(void);
void luo_do_subsystems_cancel_calls(void);
+int luo_retrieve_file(struct luo_session *session, u64 token, struct file **filep);
+int luo_preserve_file(struct luo_session *session, u64 token, int fd);
+int luo_unpreserve_file(struct luo_session *session, u64 token);
+void luo_file_unpreserve_all_files(struct luo_session *session);
+void luo_file_unpreserve_unreclaimed_files(struct luo_session *session);
+
+int luo_file_prepare(struct luo_session *session);
+int luo_file_freeze(struct luo_session *session);
+void luo_file_finish(struct luo_session *session);
+void luo_file_cancel(struct luo_session *session);
+void luo_file_deserialize(struct luo_session *session);
+
#endif /* _LINUX_LUO_INTERNAL_H */
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 14/30] liveupdate: luo_session: Add ioctls for file preservation and state management
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Introducing the userspace interface and internal logic required to
manage the lifecycle of file descriptors within a session. Previously, a
session was merely a container; this change makes it a functional
management unit.
The following capabilities are added:
A new set of ioctl commands are added, which operate on the file
descriptor returned by CREATE_SESSION. This allows userspace to:
- LIVEUPDATE_SESSION_PRESERVE_FD: Add a file descriptor to a session
to be preserved across the live update.
- LIVEUPDATE_SESSION_UNPRESERVE_FD: Remove a previously added file
descriptor from the session.
- LIVEUPDATE_SESSION_RESTORE_FD: Retrieve a preserved file in the
new kernel using its unique token.
A state machine for each individual session, distinct from the global
LUO state. This enables more granular control, allowing userspace to
prepare or freeze specific sessions independently. This is managed via:
- LIVEUPDATE_SESSION_SET_EVENT: An ioctl to send PREPARE, FREEZE,
CANCEL, or FINISH events to a single session.
- LIVEUPDATE_SESSION_GET_STATE: An ioctl to query the current state
of a single session.
The global subsystem callbacks (luo_session_prepare, luo_session_freeze)
are updated to iterate through all existing sessions. They now trigger
the appropriate per-session state transitions for any sessions that
haven't already been transitioned individually by userspace.
The session's .release handler is enhanced to be state-aware. When a
session's file descriptor is closed, it now correctly cancels or
finishes the session based on its current state before freeing all
associated file resources, preventing resource leaks.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
include/uapi/linux/liveupdate.h | 164 ++++++++++++++++++
kernel/liveupdate/luo_session.c | 284 +++++++++++++++++++++++++++++++-
2 files changed, 446 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/liveupdate.h b/include/uapi/linux/liveupdate.h
index 2e38ef3094aa..59a0f561d148 100644
--- a/include/uapi/linux/liveupdate.h
+++ b/include/uapi/linux/liveupdate.h
@@ -132,6 +132,16 @@ enum {
LIVEUPDATE_CMD_RETRIEVE_SESSION = 0x03,
};
+/* ioctl commands for session file descriptors */
+enum {
+ LIVEUPDATE_CMD_SESSION_BASE = 0x40,
+ LIVEUPDATE_CMD_SESSION_PRESERVE_FD = LIVEUPDATE_CMD_SESSION_BASE,
+ LIVEUPDATE_CMD_SESSION_UNPRESERVE_FD = 0x41,
+ LIVEUPDATE_CMD_SESSION_RESTORE_FD = 0x42,
+ LIVEUPDATE_CMD_SESSION_GET_STATE = 0x43,
+ LIVEUPDATE_CMD_SESSION_SET_EVENT = 0x44,
+};
+
/**
* struct liveupdate_ioctl_get_state - ioctl(LIVEUPDATE_IOCTL_GET_STATE)
* @size: Input; sizeof(struct liveupdate_ioctl_get_state)
@@ -293,4 +303,158 @@ struct liveupdate_ioctl_retrieve_session {
#define LIVEUPDATE_IOCTL_RETRIEVE_SESSION \
_IO(LIVEUPDATE_IOCTL_TYPE, LIVEUPDATE_CMD_RETRIEVE_SESSION)
+
+/* Session specific IOCTLs */
+
+/**
+ * struct liveupdate_session_preserve_fd - ioctl(LIVEUPDATE_SESSION_PRESERVE_FD)
+ * @size: Input; sizeof(struct liveupdate_session_preserve_fd)
+ * @fd: Input; The user-space file descriptor to be preserved.
+ * @token: Input; An opaque, unique token for preserved resource.
+ *
+ * Holds parameters for preserving Validate and initiate preservation for a file
+ * descriptor.
+ *
+ * User sets the @fd field identifying the file descriptor to preserve
+ * (e.g., memfd, kvm, iommufd, VFIO). The kernel validates if this FD type
+ * and its dependencies are supported for preservation. If validation passes,
+ * the kernel marks the FD internally and *initiates the process* of preparing
+ * its state for saving. The actual snapshotting of the state typically occurs
+ * during the subsequent %LIVEUPDATE_IOCTL_PREPARE execution phase, though
+ * some finalization might occur during freeze.
+ * On successful validation and initiation, the kernel uses the @token
+ * field with an opaque identifier representing the resource being preserved.
+ * This token confirms the FD is targeted for preservation and is required for
+ * the subsequent %LIVEUPDATE_SESSION_RESTORE_FD call after the live update.
+ *
+ * Return: 0 on success (validation passed, preservation initiated), negative
+ * error code on failure (e.g., unsupported FD type, dependency issue,
+ * validation failed).
+ */
+struct liveupdate_session_preserve_fd {
+ __u32 size;
+ __s32 fd;
+ __aligned_u64 token;
+};
+
+#define LIVEUPDATE_SESSION_PRESERVE_FD \
+ _IO(LIVEUPDATE_IOCTL_TYPE, LIVEUPDATE_CMD_SESSION_PRESERVE_FD)
+
+/**
+ * struct liveupdate_session_unpreserve_FD - ioctl(LIVEUPDATE_SESSION_UNPRESERVE_FD)
+ * @size: Input; sizeof(struct liveupdate_session_unpreserve_fd)
+ * @reserved: Must be zero.
+ * @token: Input; A token for resource to be unpreserved.
+ *
+ * Remove a file descriptor from the preservation list.
+ *
+ * Allows user space to explicitly remove a file descriptor from the set of
+ * items marked as potentially preservable. User space provides a @token that
+ * was previously used by a successful %LIVEUPDATE_SESSION_PRESERVE_FD call
+ * (potentially from a prior, possibly canceled, live update attempt). The
+ * kernel reads the token value from the provided user-space address.
+ *
+ * On success, the kernel removes the corresponding entry (identified by the
+ * token value read from the user pointer) from its internal preservation list.
+ * The provided @token (representing the now-removed entry) becomes invalid
+ * after this call.
+ *
+ * Return: 0 on success, negative error code on failure (e.g., -EBUSY or -EINVAL
+ * if bad address provided, invalid token value read, token not found).
+ */
+struct liveupdate_session_unpreserve_fd {
+ __u32 size;
+ __u32 reserved;
+ __aligned_u64 token;
+};
+
+#define LIVEUPDATE_SESSION_UNPRESERVE_FD \
+ _IO(LIVEUPDATE_IOCTL_TYPE, LIVEUPDATE_CMD_SESSION_UNPRESERVE_FD)
+
+/**
+ * struct liveupdate_session_restore_fd - ioctl(LIVEUPDATE_SESSION_RESTORE_FD)
+ * @size: Input; sizeof(struct liveupdate_session_restore_fd)
+ * @fd: Output; The new file descriptor representing the fully restored
+ * kernel resource.
+ * @token: Input; An opaque, token that was used to preserve the resource.
+ *
+ * Restore a previously preserved file descriptor.
+ *
+ * User sets the @token field to the value obtained from a successful
+ * %LIVEUPDATE_IOCTL_FD_PRESERVE call before the live update. On success,
+ * the kernel restores the state (saved during the PREPARE/FREEZE phases)
+ * associated with the token and populates the @fd field with a new file
+ * descriptor referencing the restored resource in the current (new) kernel.
+ * This operation must be performed *before* signaling completion via
+ * %LIVEUPDATE_IOCTL_FINISH.
+ *
+ * Return: 0 on success, negative error code on failure (e.g., invalid token).
+ */
+struct liveupdate_session_restore_fd {
+ __u32 size;
+ __s32 fd;
+ __aligned_u64 token;
+};
+
+#define LIVEUPDATE_SESSION_RESTORE_FD \
+ _IO(LIVEUPDATE_IOCTL_TYPE, LIVEUPDATE_CMD_SESSION_RESTORE_FD)
+
+/**
+ * struct liveupdate_session_get_state - ioctl(LIVEUPDATE_SESSION_GET_STATE)
+ * @size: Input; sizeof(struct liveupdate_session_get_state)
+ * @incoming: Input; If 1, query the state of a restored file from the incoming
+ * (previous kernel's) set. If 0, query a file being prepared for
+ * preservation in the current set.
+ * @reserved: Must be zero.
+ * @state: Output; The live update state of this FD.
+ *
+ * Query the current live update state of a specific preserved file descriptor.
+ *
+ * - %LIVEUPDATE_STATE_NORMAL: Default state
+ * - %LIVEUPDATE_STATE_PREPARED: Prepare callback has been performed on this FD.
+ * - %LIVEUPDATE_STATE_FROZEN: Freeze callback ahs been performed on this FD.
+ * - %LIVEUPDATE_STATE_UPDATED: The system has successfully rebooted into the
+ * new kernel.
+ *
+ * See the definition of &enum liveupdate_state for more details on each state.
+ *
+ * Return: 0 on success, negative error code on failure.
+ */
+struct liveupdate_session_get_state {
+ __u32 size;
+ __u8 incoming;
+ __u8 reserved[3];
+ __u32 state;
+};
+
+#define LIVEUPDATE_SESSION_GET_STATE \
+ _IO(LIVEUPDATE_IOCTL_TYPE, LIVEUPDATE_CMD_SESSION_GET_STATE)
+
+/**
+ * struct liveupdate_session_set_event - ioctl(LIVEUPDATE_SESSION_SET_EVENT)
+ * @size: Input; sizeof(struct liveupdate_session_set_event)
+ * @event: Input; The live update event.
+ *
+ * Notify a specific preserved file descriptor of an event, that causes a state
+ * transition for that file descriptor.
+ *
+ * Event, can be one of the following:
+ *
+ * - %LIVEUPDATE_PREPARE: Initiates the FD live update preparation phase.
+ * - %LIVEUPDATE_FREEZE: Initiates the FD live update freeze phase.
+ * - %LIVEUPDATE_CANCEL: Cancel the FD preparation or freeze phase.
+ * - %LIVEUPDATE_FINISH: FD Restoration completion and trigger cleanup.
+ *
+ * See the definition of &enum liveupdate_event for more details on each state.
+ *
+ * Return: 0 on success, negative error code on failure.
+ */
+struct liveupdate_session_set_event {
+ __u32 size;
+ __u32 event;
+};
+
+#define LIVEUPDATE_SESSION_SET_EVENT \
+ _IO(LIVEUPDATE_IOCTL_TYPE, LIVEUPDATE_CMD_SESSION_SET_EVENT)
+
#endif /* _UAPI_LIVEUPDATE_H */
diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
index 74dee42e24b7..966b68532d79 100644
--- a/kernel/liveupdate/luo_session.c
+++ b/kernel/liveupdate/luo_session.c
@@ -188,17 +188,66 @@ static void luo_session_remove(struct luo_session *session)
/* One session switches from the updated state to normal state */
static void luo_session_finish_one(struct luo_session *session)
{
+ scoped_guard(mutex, &session->mutex) {
+ if (session->state != LIVEUPDATE_STATE_UPDATED)
+ return;
+ luo_file_finish(session);
+ session->files = 0;
+ luo_file_unpreserve_unreclaimed_files(session);
+ session->state = LIVEUPDATE_STATE_NORMAL;
+ }
}
/* Cancel one session from frozen or prepared state, back to normal */
static void luo_session_cancel_one(struct luo_session *session)
{
+ guard(mutex)(&session->mutex);
+ if (session->state == LIVEUPDATE_STATE_FROZEN ||
+ session->state == LIVEUPDATE_STATE_PREPARED) {
+ luo_file_cancel(session);
+ session->state = LIVEUPDATE_STATE_NORMAL;
+ session->files = 0;
+ session->ser = NULL;
+ }
}
/* One session is changed from normal to prepare state */
static int luo_session_prepare_one(struct luo_session *session)
{
- return 0;
+ int ret;
+
+ guard(mutex)(&session->mutex);
+ if (session->state != LIVEUPDATE_STATE_NORMAL)
+ return -EBUSY;
+
+ ret = luo_file_prepare(session);
+ if (!ret)
+ session->state = LIVEUPDATE_STATE_PREPARED;
+
+ return ret;
+}
+
+/* One session is changed from prepared to frozen state */
+static int luo_session_freeze_one(struct luo_session *session)
+{
+ int ret;
+
+ guard(mutex)(&session->mutex);
+ if (session->state != LIVEUPDATE_STATE_PREPARED)
+ return -EBUSY;
+
+ ret = luo_file_freeze(session);
+
+ /*
+ * If fail, freeze is cancel, and as a side effect, we go back to normal
+ * state
+ */
+ if (!ret)
+ session->state = LIVEUPDATE_STATE_FROZEN;
+ else
+ session->state = LIVEUPDATE_STATE_NORMAL;
+
+ return ret;
}
static int luo_session_release(struct inode *inodep, struct file *filep)
@@ -220,6 +269,8 @@ static int luo_session_release(struct inode *inodep, struct file *filep)
session->state == LIVEUPDATE_STATE_FROZEN) {
luo_session_cancel_one(session);
}
+ scoped_guard(mutex, &session->mutex)
+ luo_file_unpreserve_all_files(session);
scoped_guard(rwsem_write, &luo_session_global.rwsem)
luo_session_remove(session);
@@ -228,9 +279,219 @@ static int luo_session_release(struct inode *inodep, struct file *filep)
return 0;
}
+static int luo_session_preserve_fd(struct luo_session *session,
+ struct luo_ucmd *ucmd)
+{
+ struct liveupdate_session_preserve_fd *argp = ucmd->cmd;
+ int ret;
+
+ guard(rwsem_read)(&luo_state_rwsem);
+ if (!liveupdate_state_normal() && !liveupdate_state_updated()) {
+ pr_warn("File can be preserved only in normal or updated state\n");
+ return -EBUSY;
+ }
+
+ guard(mutex)(&session->mutex);
+
+ if (session->state != LIVEUPDATE_STATE_NORMAL)
+ return -EBUSY;
+
+ ret = luo_preserve_file(session, argp->token, argp->fd);
+ if (ret)
+ return ret;
+
+ ret = luo_ucmd_respond(ucmd, sizeof(*argp));
+ if (ret)
+ pr_warn("The file was successfully preserved, but response to user failed\n");
+
+ return ret;
+}
+
+static int luo_session_unpreserve_fd(struct luo_session *session,
+ struct luo_ucmd *ucmd)
+{
+ struct liveupdate_session_unpreserve_fd *argp = ucmd->cmd;
+ int ret;
+
+ if (argp->reserved)
+ return -EOPNOTSUPP;
+
+ guard(rwsem_read)(&luo_state_rwsem);
+ if (!liveupdate_state_normal() && !liveupdate_state_updated()) {
+ pr_warn("File can be preserved only in normal or updated state\n");
+ return -EBUSY;
+ }
+
+ guard(mutex)(&session->mutex);
+
+ if (session->state != LIVEUPDATE_STATE_NORMAL)
+ return -EBUSY;
+
+ ret = luo_unpreserve_file(session, argp->token);
+ if (ret)
+ return ret;
+
+ ret = luo_ucmd_respond(ucmd, sizeof(*argp));
+ if (ret)
+ pr_warn("The file was successfully unpreserved, but response to user failed\n");
+
+ return ret;
+}
+
+static int luo_session_restore_fd(struct luo_session *session,
+ struct luo_ucmd *ucmd)
+{
+ struct liveupdate_session_restore_fd *argp = ucmd->cmd;
+ struct file *file;
+ int ret;
+
+ guard(rwsem_read)(&luo_state_rwsem);
+ if (!liveupdate_state_updated())
+ return -EBUSY;
+
+ argp->fd = get_unused_fd_flags(O_CLOEXEC);
+ if (argp->fd < 0)
+ return argp->fd;
+
+ guard(mutex)(&session->mutex);
+
+ /* Session might have already finished independatly from global state */
+ if (session->state != LIVEUPDATE_STATE_UPDATED)
+ return -EBUSY;
+
+ ret = luo_retrieve_file(session, argp->token, &file);
+ if (ret < 0) {
+ put_unused_fd(argp->fd);
+
+ return ret;
+ }
+
+ ret = luo_ucmd_respond(ucmd, sizeof(*argp));
+ if (ret)
+ return ret;
+
+ fd_install(argp->fd, file);
+
+ return 0;
+}
+
+static int luo_session_get_state(struct luo_session *session,
+ struct luo_ucmd *ucmd)
+{
+ struct liveupdate_session_get_state *argp = ucmd->cmd;
+
+ if (argp->reserved[0] | argp->reserved[1] | argp->reserved[2])
+ return -EOPNOTSUPP;
+
+ argp->state = READ_ONCE(session->state);
+
+ return luo_ucmd_respond(ucmd, sizeof(*argp));
+}
+
+static int luo_session_set_event(struct luo_session *session,
+ struct luo_ucmd *ucmd)
+{
+ struct liveupdate_session_set_event *argp = ucmd->cmd;
+ int ret = 0;
+
+ switch (argp->event) {
+ case LIVEUPDATE_PREPARE:
+ ret = luo_session_prepare_one(session);
+ break;
+ case LIVEUPDATE_FREEZE:
+ ret = luo_session_freeze_one(session);
+ break;
+ case LIVEUPDATE_FINISH:
+ luo_session_finish_one(session);
+ break;
+ case LIVEUPDATE_CANCEL:
+ luo_session_cancel_one(session);
+ break;
+ default:
+ ret = -EINVAL;
+ }
+
+ return ret;
+}
+
+union ucmd_buffer {
+ struct liveupdate_session_get_state state;
+ struct liveupdate_session_preserve_fd preserve;
+ struct liveupdate_session_restore_fd restore;
+ struct liveupdate_session_set_event event;
+ struct liveupdate_session_unpreserve_fd unpreserve;
+};
+
+struct luo_ioctl_op {
+ unsigned int size;
+ unsigned int min_size;
+ unsigned int ioctl_num;
+ int (*execute)(struct luo_session *session, struct luo_ucmd *ucmd);
+};
+
+#define IOCTL_OP(_ioctl, _fn, _struct, _last) \
+ [_IOC_NR(_ioctl) - LIVEUPDATE_CMD_SESSION_BASE] = { \
+ .size = sizeof(_struct) + \
+ BUILD_BUG_ON_ZERO(sizeof(union ucmd_buffer) < \
+ sizeof(_struct)), \
+ .min_size = offsetofend(_struct, _last), \
+ .ioctl_num = _ioctl, \
+ .execute = _fn, \
+ }
+
+static const struct luo_ioctl_op luo_session_ioctl_ops[] = {
+ IOCTL_OP(LIVEUPDATE_SESSION_GET_STATE, luo_session_get_state,
+ struct liveupdate_session_get_state, state),
+ IOCTL_OP(LIVEUPDATE_SESSION_PRESERVE_FD, luo_session_preserve_fd,
+ struct liveupdate_session_preserve_fd, token),
+ IOCTL_OP(LIVEUPDATE_SESSION_RESTORE_FD, luo_session_restore_fd,
+ struct liveupdate_session_restore_fd, token),
+ IOCTL_OP(LIVEUPDATE_SESSION_SET_EVENT, luo_session_set_event,
+ struct liveupdate_session_set_event, event),
+ IOCTL_OP(LIVEUPDATE_SESSION_UNPRESERVE_FD, luo_session_unpreserve_fd,
+ struct liveupdate_session_unpreserve_fd, token),
+};
+
+static long luo_session_ioctl(struct file *filep, unsigned int cmd,
+ unsigned long arg)
+{
+ struct luo_session *session = filep->private_data;
+ const struct luo_ioctl_op *op;
+ struct luo_ucmd ucmd = {};
+ union ucmd_buffer buf;
+ unsigned int nr;
+ int ret;
+
+ nr = _IOC_NR(cmd);
+ if (nr < LIVEUPDATE_CMD_SESSION_BASE || (nr - LIVEUPDATE_CMD_SESSION_BASE) >=
+ ARRAY_SIZE(luo_session_ioctl_ops)) {
+ return -EINVAL;
+ }
+
+ ucmd.ubuffer = (void __user *)arg;
+ ret = get_user(ucmd.user_size, (u32 __user *)ucmd.ubuffer);
+ if (ret)
+ return ret;
+
+ op = &luo_session_ioctl_ops[nr - LIVEUPDATE_CMD_SESSION_BASE];
+ if (op->ioctl_num != cmd)
+ return -ENOIOCTLCMD;
+ if (ucmd.user_size < op->min_size)
+ return -EINVAL;
+
+ ucmd.cmd = &buf;
+ ret = copy_struct_from_user(ucmd.cmd, op->size, ucmd.ubuffer,
+ ucmd.user_size);
+ if (ret)
+ return ret;
+
+ return op->execute(session, &ucmd);
+}
+
static const struct file_operations luo_session_fops = {
.owner = THIS_MODULE,
.release = luo_session_release,
+ .unlocked_ioctl = luo_session_ioctl,
};
static void luo_session_deserialize(void)
@@ -267,6 +528,7 @@ static void luo_session_deserialize(void)
session->state = LIVEUPDATE_STATE_UPDATED;
session->count = luo_session_global.ser[i].count;
session->files = luo_session_global.ser[i].files;
+ luo_file_deserialize(session);
}
}
@@ -501,7 +763,25 @@ static int luo_session_prepare(struct liveupdate_subsystem *h, u64 *data)
static int luo_session_freeze(struct liveupdate_subsystem *h, u64 *data)
{
- return 0;
+ struct luo_session *it;
+ int ret;
+
+ WARN_ON(!luo_session_global.fdt);
+
+ scoped_guard(rwsem_read, &luo_session_global.rwsem) {
+ list_for_each_entry(it, &luo_session_global.list, list) {
+ if (it->state == LIVEUPDATE_STATE_PREPARED) {
+ ret = luo_session_freeze_one(it);
+ if (ret)
+ break;
+ }
+ }
+ }
+
+ if (ret)
+ luo_session_cancel(h, 0);
+
+ return ret;
}
/*
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 15/30] reboot: call liveupdate_reboot() before kexec
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Modify the reboot() syscall handler in kernel/reboot.c to call
liveupdate_reboot() when processing the LINUX_REBOOT_CMD_KEXEC
command.
This ensures that the Live Update Orchestrator is notified just
before the kernel executes the kexec jump. The liveupdate_reboot()
function triggers the final LIVEUPDATE_FREEZE event, allowing
participating subsystems to perform last-minute state saving within
the blackout window, and transitions the LUO state machine to FROZEN.
The call is placed immediately before kernel_kexec() to ensure LUO
finalization happens at the latest possible moment before the kernel
transition.
If liveupdate_reboot() returns an error (indicating a failure during
LUO finalization), the kexec operation is aborted to prevent proceeding
with an inconsistent state.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
kernel/reboot.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/reboot.c b/kernel/reboot.c
index ec087827c85c..bdeb04a773db 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -13,6 +13,7 @@
#include <linux/kexec.h>
#include <linux/kmod.h>
#include <linux/kmsg_dump.h>
+#include <linux/liveupdate.h>
#include <linux/reboot.h>
#include <linux/suspend.h>
#include <linux/syscalls.h>
@@ -797,6 +798,9 @@ SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,
#ifdef CONFIG_KEXEC_CORE
case LINUX_REBOOT_CMD_KEXEC:
+ ret = liveupdate_reboot();
+ if (ret)
+ break;
ret = kernel_kexec();
break;
#endif
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 16/30] kho: move kho debugfs directory to liveupdate
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Now, that LUO and KHO both live under kernel/liveupdate, it makes
sense to also move the kho debugfs files to liveupdate/
The old names:
/sys/kernel/debug/kho/out/
/sys/kernel/debug/kho/in/
The new names:
/sys/kernel/debug/liveupdate/kho_out/
/sys/kernel/debug/liveupdate/kho_in/
Also, export the liveupdate_debufs_root, so LUO selftests could use
it as well.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
kernel/liveupdate/kexec_handover_debug.c | 11 ++++++-----
kernel/liveupdate/luo_internal.h | 4 ++++
2 files changed, 10 insertions(+), 5 deletions(-)
diff --git a/kernel/liveupdate/kexec_handover_debug.c b/kernel/liveupdate/kexec_handover_debug.c
index af4bad225630..f06d6cdfeab3 100644
--- a/kernel/liveupdate/kexec_handover_debug.c
+++ b/kernel/liveupdate/kexec_handover_debug.c
@@ -14,8 +14,9 @@
#include <linux/libfdt.h>
#include <linux/mm.h>
#include "kexec_handover_internal.h"
+#include "luo_internal.h"
-static struct dentry *debugfs_root;
+struct dentry *liveupdate_debugfs_root;
struct fdt_debugfs {
struct list_head list;
@@ -120,7 +121,7 @@ __init void kho_in_debugfs_init(struct kho_debugfs *dbg, const void *fdt)
INIT_LIST_HEAD(&dbg->fdt_list);
- dir = debugfs_create_dir("in", debugfs_root);
+ dir = debugfs_create_dir("in", liveupdate_debugfs_root);
if (IS_ERR(dir)) {
err = PTR_ERR(dir);
goto err_out;
@@ -180,7 +181,7 @@ __init int kho_out_debugfs_init(struct kho_debugfs *dbg)
INIT_LIST_HEAD(&dbg->fdt_list);
- dir = debugfs_create_dir("out", debugfs_root);
+ dir = debugfs_create_dir("out", liveupdate_debugfs_root);
if (IS_ERR(dir))
return -ENOMEM;
@@ -214,8 +215,8 @@ __init int kho_out_debugfs_init(struct kho_debugfs *dbg)
__init int kho_debugfs_init(void)
{
- debugfs_root = debugfs_create_dir("kho", NULL);
- if (IS_ERR(debugfs_root))
+ liveupdate_debugfs_root = debugfs_create_dir("liveupdate", NULL);
+ if (IS_ERR(liveupdate_debugfs_root))
return -ENOENT;
return 0;
}
diff --git a/kernel/liveupdate/luo_internal.h b/kernel/liveupdate/luo_internal.h
index c9bce82aac22..083b80754c9e 100644
--- a/kernel/liveupdate/luo_internal.h
+++ b/kernel/liveupdate/luo_internal.h
@@ -107,4 +107,8 @@ void luo_file_finish(struct luo_session *session);
void luo_file_cancel(struct luo_session *session);
void luo_file_deserialize(struct luo_session *session);
+#ifdef CONFIG_KEXEC_HANDOVER_DEBUG
+extern struct dentry *liveupdate_debugfs_root;
+#endif
+
#endif /* _LINUX_LUO_INTERNAL_H */
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 17/30] liveupdate: add selftests for subsystems un/registration
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Introduce a self-test mechanism for the LUO to allow verification of
core subsystem management functionality. This is primarily intended
for developers and system integrators validating the live update
feature.
The tests are enabled via the new Kconfig option
CONFIG_LIVEUPDATE_SELFTESTS (default 'n') and are triggered through
a new ioctl command, LIVEUPDATE_IOCTL_SELFTESTS, added to the
/dev/liveupdate device node.
This ioctl accepts commands defined in luo_selftests.h to:
- LUO_CMD_SUBSYSTEM_REGISTER: Creates and registers a dummy LUO
subsystem using the liveupdate_register_subsystem() function. It
allocates a data page and copies initial data from userspace.
- LUO_CMD_SUBSYSTEM_UNREGISTER: Unregisters the specified dummy
subsystem using the liveupdate_unregister_subsystem() function and
cleans up associated test resources.
- LUO_CMD_SUBSYSTEM_GETDATA: Copies the data page associated with a
registered test subsystem back to userspace, allowing verification of
data potentially modified or preserved by test callbacks.
This provides a way to test the fundamental registration and
unregistration flows within the LUO framework from userspace without
requiring a full live update sequence.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
kernel/liveupdate/Kconfig | 15 ++
kernel/liveupdate/Makefile | 1 +
kernel/liveupdate/luo_selftests.c | 345 ++++++++++++++++++++++++++++++
kernel/liveupdate/luo_selftests.h | 84 ++++++++
4 files changed, 445 insertions(+)
create mode 100644 kernel/liveupdate/luo_selftests.c
create mode 100644 kernel/liveupdate/luo_selftests.h
diff --git a/kernel/liveupdate/Kconfig b/kernel/liveupdate/Kconfig
index f6b0bde188d9..8311c2593d32 100644
--- a/kernel/liveupdate/Kconfig
+++ b/kernel/liveupdate/Kconfig
@@ -29,6 +29,21 @@ config LIVEUPDATE
If unsure, say N.
+config LIVEUPDATE_SELFTESTS
+ bool "Live Update Orchestrator - self-tests"
+ depends on LIVEUPDATE
+ help
+ Say Y here to build self-tests for the LUO framework. When enabled,
+ these tests can be initiated via the ioctl interface to help verify
+ the core live update functionality.
+
+ This option is primarily intended for developers working on the
+ live update feature or for validation purposes during system
+ integration.
+
+ If you are unsure or are building a production kernel where size
+ or attack surface is a concern, say N.
+
config KEXEC_HANDOVER
bool "kexec handover"
depends on ARCH_SUPPORTS_KEXEC_HANDOVER && ARCH_SUPPORTS_KEXEC_FILE
diff --git a/kernel/liveupdate/Makefile b/kernel/liveupdate/Makefile
index 282d36a18993..2df7dfdf45c1 100644
--- a/kernel/liveupdate/Makefile
+++ b/kernel/liveupdate/Makefile
@@ -11,3 +11,4 @@ obj-$(CONFIG_KEXEC_HANDOVER) += kexec_handover.o
obj-$(CONFIG_KEXEC_HANDOVER_DEBUG) += kexec_handover_debug.o
obj-$(CONFIG_LIVEUPDATE) += luo.o
+obj-$(CONFIG_LIVEUPDATE_SELFTESTS) += luo_selftests.o
diff --git a/kernel/liveupdate/luo_selftests.c b/kernel/liveupdate/luo_selftests.c
new file mode 100644
index 000000000000..a476b88468fa
--- /dev/null
+++ b/kernel/liveupdate/luo_selftests.c
@@ -0,0 +1,345 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright (c) 2025, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+/**
+ * DOC: LUO Selftests
+ *
+ * We provide ioctl-based selftest interface for the LUO. It provides a
+ * mechanism to test core LUO functionality, particularly the registration,
+ * unregistration, and data handling aspects of LUO subsystems, without
+ * requiring a full live update event sequence.
+ *
+ * The tests are intended primarily for developers working on the LUO framework
+ * or for validation purposes during system integration. This functionality is
+ * conditionally compiled based on the `CONFIG_LIVEUPDATE_SELFTESTS` Kconfig
+ * option and should typically be disabled in production kernels.
+ *
+ * Interface:
+ * The selftests are accessed via the `/dev/liveupdate` character device using
+ * the `LIVEUPDATE_IOCTL_SELFTESTS` ioctl command. The argument to the ioctl
+ * is a pointer to a `struct liveupdate_selftest` structure (defined in
+ * `uapi/linux/liveupdate.h`), which contains:
+ * - `cmd`: The specific selftest command to execute (e.g.,
+ * `LUO_CMD_SUBSYSTEM_REGISTER`).
+ * - `arg`: A pointer to a command-specific argument structure. For subsystem
+ * tests, this points to a `struct luo_arg_subsystem` (defined in
+ * `luo_selftests.h`).
+ *
+ * Commands:
+ * - `LUO_CMD_SUBSYSTEM_REGISTER`:
+ * Registers a new dummy LUO subsystem. It allocates kernel memory for test
+ * data, copies initial data from the user-provided `data_page`, sets up
+ * simple logging callbacks, and calls the core
+ * `liveupdate_register_subsystem()`
+ * function. Requires `arg` pointing to `struct luo_arg_subsystem`.
+ * - `LUO_CMD_SUBSYSTEM_UNREGISTER`:
+ * Unregisters a previously registered dummy subsystem identified by `name`.
+ * It calls the core `liveupdate_unregister_subsystem()` function and then
+ * frees the associated kernel memory and internal tracking structures.
+ * Requires `arg` pointing to `struct luo_arg_subsystem` (only `name` used).
+ * - `LUO_CMD_SUBSYSTEM_GETDATA`:
+ * Copies the content of the kernel data page associated with the specified
+ * dummy subsystem (`name`) back to the user-provided `data_page`. This allows
+ * userspace to verify the state of the data after potential test operations.
+ * Requires `arg` pointing to `struct luo_arg_subsystem`.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/debugfs.h>
+#include <linux/errno.h>
+#include <linux/gfp.h>
+#include <linux/kexec_handover.h>
+#include <linux/liveupdate.h>
+#include <linux/mutex.h>
+#include <linux/uaccess.h>
+#include <uapi/linux/liveupdate.h>
+#include "luo_internal.h"
+#include "luo_selftests.h"
+
+static struct luo_subsystems {
+ struct liveupdate_subsystem handle;
+ char name[LUO_NAME_LENGTH];
+ void *data;
+ bool in_use;
+ bool preserved;
+} luo_subsystems[LUO_MAX_SUBSYSTEMS];
+
+/* Only allow one selftest ioctl operation at a time */
+static DEFINE_MUTEX(luo_ioctl_mutex);
+
+static int luo_subsystem_prepare(struct liveupdate_subsystem *h, u64 *data)
+{
+ struct luo_subsystems *s = container_of(h, struct luo_subsystems,
+ handle);
+ unsigned long phys_addr = __pa(s->data);
+ int ret;
+
+ ret = kho_preserve_pages(phys_to_page(phys_addr), 1);
+ if (ret)
+ return ret;
+
+ s->preserved = true;
+ *data = phys_addr;
+ pr_info("Subsystem '%s' prepare data[%lx]\n",
+ s->name, phys_addr);
+
+ if (strstr(s->name, NAME_PREPARE_FAIL))
+ return -EAGAIN;
+
+ return 0;
+}
+
+static int luo_subsystem_freeze(struct liveupdate_subsystem *h, u64 *data)
+{
+ struct luo_subsystems *s = container_of(h, struct luo_subsystems,
+ handle);
+
+ pr_info("Subsystem '%s' freeze data[%llx]\n", s->name, *data);
+
+ return 0;
+}
+
+static void luo_subsystem_cancel(struct liveupdate_subsystem *h, u64 data)
+{
+ struct luo_subsystems *s = container_of(h, struct luo_subsystems,
+ handle);
+
+ pr_info("Subsystem '%s' canel data[%llx]\n", s->name, data);
+ s->preserved = false;
+ WARN_ON(kho_unpreserve_pages(phys_to_page(data), 1));
+}
+
+static void luo_subsystem_finish(struct liveupdate_subsystem *h, u64 data)
+{
+ struct luo_subsystems *s = container_of(h, struct luo_subsystems,
+ handle);
+
+ pr_info("Subsystem '%s' finish data[%llx]\n", s->name, data);
+}
+
+static const struct liveupdate_subsystem_ops luo_selftest_subsys_ops = {
+ .prepare = luo_subsystem_prepare,
+ .freeze = luo_subsystem_freeze,
+ .cancel = luo_subsystem_cancel,
+ .finish = luo_subsystem_finish,
+ .owner = THIS_MODULE,
+};
+
+static int luo_subsystem_idx(char *name)
+{
+ int i;
+
+ for (i = 0; i < LUO_MAX_SUBSYSTEMS; i++) {
+ if (luo_subsystems[i].in_use &&
+ !strcmp(luo_subsystems[i].name, name))
+ break;
+ }
+
+ if (i == LUO_MAX_SUBSYSTEMS) {
+ pr_warn("Subsystem with name '%s' is not registred\n", name);
+
+ return -EINVAL;
+ }
+
+ return i;
+}
+
+static void luo_put_and_free_subsystem(char *name)
+{
+ int i = luo_subsystem_idx(name);
+
+ if (i < 0)
+ return;
+
+ if (luo_subsystems[i].preserved)
+ kho_unpreserve_pages(virt_to_page(luo_subsystems[i].data), 1);
+ free_page((unsigned long)luo_subsystems[i].data);
+ luo_subsystems[i].in_use = false;
+ luo_subsystems[i].preserved = false;
+}
+
+static int luo_get_and_alloc_subsystem(char *name, void __user *data,
+ struct liveupdate_subsystem **hp)
+{
+ unsigned long page_addr, i;
+
+ page_addr = get_zeroed_page(GFP_KERNEL);
+ if (!page_addr) {
+ pr_warn("Failed to allocate memory for subsystem data\n");
+ return -ENOMEM;
+ }
+
+ if (copy_from_user((void *)page_addr, data, PAGE_SIZE)) {
+ free_page(page_addr);
+ return -EFAULT;
+ }
+
+ for (i = 0; i < LUO_MAX_SUBSYSTEMS; i++) {
+ if (!luo_subsystems[i].in_use)
+ break;
+ }
+
+ if (i == LUO_MAX_SUBSYSTEMS) {
+ pr_warn("Maximum number of subsystems registered\n");
+ free_page(page_addr);
+ return -ENOMEM;
+ }
+
+ luo_subsystems[i].in_use = true;
+ luo_subsystems[i].handle.ops = &luo_selftest_subsys_ops;
+ luo_subsystems[i].handle.name = luo_subsystems[i].name;
+ strscpy(luo_subsystems[i].name, name, LUO_NAME_LENGTH);
+ luo_subsystems[i].data = (void *)page_addr;
+
+ *hp = &luo_subsystems[i].handle;
+
+ return 0;
+}
+
+static int luo_cmd_subsystem_unregister(void __user *argp)
+{
+ struct luo_arg_subsystem arg;
+ int ret, i;
+
+ if (copy_from_user(&arg, argp, sizeof(arg)))
+ return -EFAULT;
+
+ i = luo_subsystem_idx(arg.name);
+ if (i < 0)
+ return i;
+
+ ret = liveupdate_unregister_subsystem(&luo_subsystems[i].handle);
+ if (ret)
+ return ret;
+
+ luo_put_and_free_subsystem(arg.name);
+
+ return 0;
+}
+
+static int luo_cmd_subsystem_register(void __user *argp)
+{
+ struct liveupdate_subsystem *h;
+ struct luo_arg_subsystem arg;
+ int ret;
+
+ if (copy_from_user(&arg, argp, sizeof(arg)))
+ return -EFAULT;
+
+ ret = luo_get_and_alloc_subsystem(arg.name,
+ (void __user *)arg.data_page, &h);
+ if (ret)
+ return ret;
+
+ ret = liveupdate_register_subsystem(h);
+ if (ret)
+ luo_put_and_free_subsystem(arg.name);
+
+ return ret;
+}
+
+static int luo_cmd_subsystem_getdata(void __user *argp)
+{
+ struct luo_arg_subsystem arg;
+ int i;
+
+ if (copy_from_user(&arg, argp, sizeof(arg)))
+ return -EFAULT;
+
+ i = luo_subsystem_idx(arg.name);
+ if (i < 0)
+ return i;
+
+ if (copy_to_user(arg.data_page, luo_subsystems[i].data,
+ PAGE_SIZE)) {
+ return -EFAULT;
+ }
+
+ return 0;
+}
+
+static int luo_ioctl_selftests(void __user *argp)
+{
+ struct liveupdate_selftest luo_st;
+ void __user *cmd_argp;
+ int ret = 0;
+
+ if (copy_from_user(&luo_st, argp, sizeof(luo_st)))
+ return -EFAULT;
+
+ cmd_argp = (void __user *)luo_st.arg;
+
+ mutex_lock(&luo_ioctl_mutex);
+ switch (luo_st.cmd) {
+ case LUO_CMD_SUBSYSTEM_REGISTER:
+ ret = luo_cmd_subsystem_register(cmd_argp);
+ break;
+
+ case LUO_CMD_SUBSYSTEM_UNREGISTER:
+ ret = luo_cmd_subsystem_unregister(cmd_argp);
+ break;
+
+ case LUO_CMD_SUBSYSTEM_GETDATA:
+ ret = luo_cmd_subsystem_getdata(cmd_argp);
+ break;
+
+ default:
+ pr_warn("ioctl: unknown self-test command nr: 0x%llx\n",
+ luo_st.cmd);
+ ret = -ENOTTY;
+ break;
+ }
+ mutex_unlock(&luo_ioctl_mutex);
+
+ return ret;
+}
+
+static long luo_selftest_ioctl(struct file *filep, unsigned int cmd,
+ unsigned long arg)
+{
+ int ret = 0;
+
+ if (_IOC_TYPE(cmd) != LIVEUPDATE_IOCTL_TYPE)
+ return -ENOTTY;
+
+ switch (cmd) {
+ case LIVEUPDATE_IOCTL_FREEZE:
+ ret = luo_freeze();
+ break;
+
+ case LIVEUPDATE_IOCTL_SELFTESTS:
+ ret = luo_ioctl_selftests((void __user *)arg);
+ break;
+
+ default:
+ pr_warn("ioctl: unknown command nr: 0x%x\n", _IOC_NR(cmd));
+ ret = -ENOTTY;
+ break;
+ }
+
+ return ret;
+}
+
+static const struct file_operations luo_selftest_fops = {
+ .open = nonseekable_open,
+ .unlocked_ioctl = luo_selftest_ioctl,
+};
+
+static int __init luo_seltesttest_init(void)
+{
+ if (!liveupdate_debugfs_root) {
+ pr_err("liveupdate root is not set\n");
+ return 0;
+ }
+ debugfs_create_file_unsafe("luo_selftest", 0600,
+ liveupdate_debugfs_root, NULL,
+ &luo_selftest_fops);
+ return 0;
+}
+
+late_initcall(luo_seltesttest_init);
diff --git a/kernel/liveupdate/luo_selftests.h b/kernel/liveupdate/luo_selftests.h
new file mode 100644
index 000000000000..098f2e9e6a78
--- /dev/null
+++ b/kernel/liveupdate/luo_selftests.h
@@ -0,0 +1,84 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/*
+ * Copyright (c) 2025, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+#ifndef _LINUX_LUO_SELFTESTS_H
+#define _LINUX_LUO_SELFTESTS_H
+
+#include <linux/ioctl.h>
+#include <linux/types.h>
+
+/* Maximum number of subsystem self-test can register */
+#define LUO_MAX_SUBSYSTEMS 16
+#define LUO_NAME_LENGTH 32
+
+#define LUO_CMD_SUBSYSTEM_REGISTER 0
+#define LUO_CMD_SUBSYSTEM_UNREGISTER 1
+#define LUO_CMD_SUBSYSTEM_GETDATA 2
+struct luo_arg_subsystem {
+ char name[LUO_NAME_LENGTH];
+ void *data_page;
+};
+
+/*
+ * Test name prefixes:
+ * normal: prepare and freeze callbacks do not fail
+ * prepare_fail: prepare callback fails for this test.
+ * freeze_fail: freeze callback fails for this test
+ */
+#define NAME_NORMAL "ksft_luo"
+#define NAME_PREPARE_FAIL "ksft_prepare_fail"
+#define NAME_FREEZE_FAIL "ksft_freeze_fail"
+
+/**
+ * struct liveupdate_selftest - Holds directions for the self-test operations.
+ * @cmd: Selftest comman defined in luo_selftests.h.
+ * @arg: Argument for the self test command.
+ *
+ * This structure is used only for the selftest purposes.
+ */
+struct liveupdate_selftest {
+ __u64 cmd;
+ __u64 arg;
+};
+
+/**
+ * LIVEUPDATE_IOCTL_FREEZE - Notify subsystems of imminent reboot
+ * transition.
+ *
+ * Argument: None.
+ *
+ * Notifies the live update subsystem and associated components that the kernel
+ * is about to execute the final reboot transition into the new kernel (e.g.,
+ * via kexec). This action triggers the internal %LIVEUPDATE_FREEZE kernel
+ * event. This event provides subsystems a final, brief opportunity (within the
+ * "blackout window") to save critical state or perform last-moment quiescing.
+ * Any remaining or deferred state saving for items marked via the PRESERVE
+ * ioctls typically occurs in response to the %LIVEUPDATE_FREEZE event.
+ *
+ * This ioctl should only be called when the system is in the
+ * %LIVEUPDATE_STATE_PREPARED state. This command does not transfer data.
+ *
+ * Return: 0 if the notification is successfully processed by the kernel (but
+ * reboot follows). Returns a negative error code if the notification fails
+ * or if the system is not in the %LIVEUPDATE_STATE_PREPARED state.
+ */
+#define LIVEUPDATE_IOCTL_FREEZE \
+ _IO(LIVEUPDATE_IOCTL_TYPE, 0x05)
+
+/**
+ * LIVEUPDATE_IOCTL_SELFTESTS - Interface for the LUO selftests
+ *
+ * Argument: Pointer to &struct liveupdate_selftest.
+ *
+ * Use by LUO selftests, commands are declared in luo_selftests.h
+ *
+ * Return: 0 on success, negative error code on failure (e.g., invalid token).
+ */
+#define LIVEUPDATE_IOCTL_SELFTESTS \
+ _IOWR(LIVEUPDATE_IOCTL_TYPE, 0x08, struct liveupdate_selftest)
+
+#endif /* _LINUX_LUO_SELFTESTS_H */
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 18/30] selftests/liveupdate: add subsystem/state tests
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Introduces a new set of userspace selftests for the LUO. These tests
verify the functionality LUO by using the kernel-side selftest ioctls
provided by the LUO module, primarily focusing on subsystem management
and basic LUO state transitions.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
tools/testing/selftests/Makefile | 1 +
tools/testing/selftests/liveupdate/.gitignore | 1 +
tools/testing/selftests/liveupdate/Makefile | 7 +
tools/testing/selftests/liveupdate/config | 6 +
.../testing/selftests/liveupdate/liveupdate.c | 348 ++++++++++++++++++
5 files changed, 363 insertions(+)
create mode 100644 tools/testing/selftests/liveupdate/.gitignore
create mode 100644 tools/testing/selftests/liveupdate/Makefile
create mode 100644 tools/testing/selftests/liveupdate/config
create mode 100644 tools/testing/selftests/liveupdate/liveupdate.c
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index c46ebdb9b8ef..56e44a98d6a5 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -54,6 +54,7 @@ TARGETS += kvm
TARGETS += landlock
TARGETS += lib
TARGETS += livepatch
+TARGETS += liveupdate
TARGETS += lkdtm
TARGETS += lsm
TARGETS += membarrier
diff --git a/tools/testing/selftests/liveupdate/.gitignore b/tools/testing/selftests/liveupdate/.gitignore
new file mode 100644
index 000000000000..af6e773cf98f
--- /dev/null
+++ b/tools/testing/selftests/liveupdate/.gitignore
@@ -0,0 +1 @@
+/liveupdate
diff --git a/tools/testing/selftests/liveupdate/Makefile b/tools/testing/selftests/liveupdate/Makefile
new file mode 100644
index 000000000000..2a573c36016e
--- /dev/null
+++ b/tools/testing/selftests/liveupdate/Makefile
@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: GPL-2.0-only
+CFLAGS += -Wall -O2 -Wno-unused-function
+CFLAGS += $(KHDR_INCLUDES)
+
+TEST_GEN_PROGS += liveupdate
+
+include ../lib.mk
diff --git a/tools/testing/selftests/liveupdate/config b/tools/testing/selftests/liveupdate/config
new file mode 100644
index 000000000000..382c85b89570
--- /dev/null
+++ b/tools/testing/selftests/liveupdate/config
@@ -0,0 +1,6 @@
+CONFIG_KEXEC_FILE=y
+CONFIG_KEXEC_HANDOVER=y
+CONFIG_KEXEC_HANDOVER_DEBUG=y
+CONFIG_LIVEUPDATE=y
+CONFIG_LIVEUPDATE_SYSFS_API=y
+CONFIG_LIVEUPDATE_SELFTESTS=y
diff --git a/tools/testing/selftests/liveupdate/liveupdate.c b/tools/testing/selftests/liveupdate/liveupdate.c
new file mode 100644
index 000000000000..7c0ceaac0283
--- /dev/null
+++ b/tools/testing/selftests/liveupdate/liveupdate.c
@@ -0,0 +1,348 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+/*
+ * Copyright (c) 2025, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+
+#include <linux/liveupdate.h>
+
+#include "../kselftest.h"
+#include "../kselftest_harness.h"
+#include "../../../../kernel/liveupdate/luo_selftests.h"
+
+struct subsystem_info {
+ void *data_page;
+ void *verify_page;
+ char test_name[LUO_NAME_LENGTH];
+ bool registered;
+};
+
+FIXTURE(subsystem) {
+ int fd;
+ int fd_dbg;
+ struct subsystem_info si[LUO_MAX_SUBSYSTEMS];
+};
+
+FIXTURE(state) {
+ int fd;
+ int fd_dbg;
+};
+
+#define LUO_DEVICE "/dev/liveupdate"
+#define LUO_DBG_DEVICE "/sys/kernel/debug/liveupdate/luo_selftest"
+static size_t page_size;
+
+const char *const luo_state_str[] = {
+ [LIVEUPDATE_STATE_UNDEFINED] = "undefined",
+ [LIVEUPDATE_STATE_NORMAL] = "normal",
+ [LIVEUPDATE_STATE_PREPARED] = "prepared",
+ [LIVEUPDATE_STATE_FROZEN] = "frozen",
+ [LIVEUPDATE_STATE_UPDATED] = "updated",
+};
+
+static int run_luo_selftest_cmd(int fd_dbg, __u64 cmd_code,
+ struct luo_arg_subsystem *subsys_arg)
+{
+ struct liveupdate_selftest k_arg;
+
+ k_arg.cmd = cmd_code;
+ k_arg.arg = (__u64)(unsigned long)subsys_arg;
+
+ return ioctl(fd_dbg, LIVEUPDATE_IOCTL_SELFTESTS, &k_arg);
+}
+
+static int register_subsystem(int fd_dbg, struct subsystem_info *si)
+{
+ struct luo_arg_subsystem subsys_arg;
+ int ret;
+
+ memset(&subsys_arg, 0, sizeof(subsys_arg));
+ snprintf(subsys_arg.name, LUO_NAME_LENGTH, "%s", si->test_name);
+ subsys_arg.data_page = si->data_page;
+
+ ret = run_luo_selftest_cmd(fd_dbg, LUO_CMD_SUBSYSTEM_REGISTER,
+ &subsys_arg);
+ if (!ret)
+ si->registered = true;
+
+ return ret;
+}
+
+static int unregister_subsystem(int fd_dbg, struct subsystem_info *si)
+{
+ struct luo_arg_subsystem subsys_arg;
+ int ret;
+
+ memset(&subsys_arg, 0, sizeof(subsys_arg));
+ snprintf(subsys_arg.name, LUO_NAME_LENGTH, "%s", si->test_name);
+
+ ret = run_luo_selftest_cmd(fd_dbg, LUO_CMD_SUBSYSTEM_UNREGISTER,
+ &subsys_arg);
+ if (!ret)
+ si->registered = false;
+
+ return ret;
+}
+
+FIXTURE_SETUP(state)
+{
+ page_size = sysconf(_SC_PAGE_SIZE);
+ self->fd = open(LUO_DEVICE, O_RDWR);
+ if (self->fd < 0)
+ SKIP(return, "open(%s) failed [%d]", LUO_DEVICE, errno);
+
+ self->fd_dbg = open(LUO_DBG_DEVICE, O_RDWR);
+ ASSERT_GE(self->fd_dbg, 0);
+}
+
+FIXTURE_TEARDOWN(state)
+{
+ struct liveupdate_ioctl_set_event cancel = {
+ .size = sizeof(cancel),
+ .event = LIVEUPDATE_CANCEL,
+ };
+ struct liveupdate_ioctl_get_state ligs = {.size = sizeof(ligs)};
+
+ ioctl(self->fd, LIVEUPDATE_IOCTL_GET_STATE, &ligs);
+ if (ligs.state != LIVEUPDATE_STATE_NORMAL)
+ ioctl(self->fd, LIVEUPDATE_IOCTL_SET_EVENT, &cancel);
+ close(self->fd);
+}
+
+FIXTURE_SETUP(subsystem)
+{
+ int i;
+
+ page_size = sysconf(_SC_PAGE_SIZE);
+ memset(&self->si, 0, sizeof(self->si));
+ self->fd = open(LUO_DEVICE, O_RDWR);
+ if (self->fd < 0)
+ SKIP(return, "open(%s) failed [%d]", LUO_DEVICE, errno);
+
+ self->fd_dbg = open(LUO_DBG_DEVICE, O_RDWR);
+ ASSERT_GE(self->fd_dbg, 0);
+
+ for (i = 0; i < LUO_MAX_SUBSYSTEMS; i++) {
+ snprintf(self->si[i].test_name, LUO_NAME_LENGTH,
+ NAME_NORMAL ".%d", i);
+
+ self->si[i].data_page = mmap(NULL, page_size,
+ PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS,
+ -1, 0);
+ ASSERT_NE(MAP_FAILED, self->si[i].data_page);
+ memset(self->si[i].data_page, 'A' + i, page_size);
+
+ self->si[i].verify_page = mmap(NULL, page_size,
+ PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS,
+ -1, 0);
+ ASSERT_NE(MAP_FAILED, self->si[i].verify_page);
+ memset(self->si[i].verify_page, 0, page_size);
+ }
+}
+
+FIXTURE_TEARDOWN(subsystem)
+{
+ struct liveupdate_ioctl_set_event cancel = {
+ .size = sizeof(cancel),
+ .event = LIVEUPDATE_CANCEL,
+ };
+ enum liveupdate_state state = LIVEUPDATE_STATE_NORMAL;
+ int i;
+
+ ioctl(self->fd, LIVEUPDATE_IOCTL_GET_STATE, &state);
+ if (state != LIVEUPDATE_STATE_NORMAL)
+ ioctl(self->fd, LIVEUPDATE_IOCTL_SET_EVENT, &cancel);
+
+ for (i = 0; i < LUO_MAX_SUBSYSTEMS; i++) {
+ if (self->si[i].registered)
+ unregister_subsystem(self->fd_dbg, &self->si[i]);
+ munmap(self->si[i].data_page, page_size);
+ munmap(self->si[i].verify_page, page_size);
+ }
+
+ close(self->fd);
+}
+
+TEST_F(state, normal)
+{
+ struct liveupdate_ioctl_get_state ligs = {.size = sizeof(ligs)};
+
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_GET_STATE, &ligs));
+ ASSERT_EQ(ligs.state, LIVEUPDATE_STATE_NORMAL);
+}
+
+TEST_F(state, prepared)
+{
+ struct liveupdate_ioctl_get_state ligs = {.size = sizeof(ligs)};
+ struct liveupdate_ioctl_set_event prepare = {
+ .size = sizeof(prepare),
+ .event = LIVEUPDATE_PREPARE,
+ };
+ struct liveupdate_ioctl_set_event cancel = {
+ .size = sizeof(cancel),
+ .event = LIVEUPDATE_CANCEL,
+ };
+
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_SET_EVENT, &prepare));
+
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_GET_STATE, &ligs));
+ ASSERT_EQ(ligs.state, LIVEUPDATE_STATE_PREPARED);
+
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_SET_EVENT, &cancel));
+
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_GET_STATE, &ligs));
+ ASSERT_EQ(ligs.state, LIVEUPDATE_STATE_NORMAL);
+}
+
+TEST_F(state, sysfs_prepared)
+{
+ struct liveupdate_ioctl_set_event prepare = {
+ .size = sizeof(prepare),
+ .event = LIVEUPDATE_PREPARE,
+ };
+ struct liveupdate_ioctl_set_event cancel = {
+ .size = sizeof(cancel),
+ .event = LIVEUPDATE_CANCEL,
+ };
+
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_SET_EVENT, &prepare));
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_SET_EVENT, &cancel));
+}
+
+TEST_F(state, sysfs_frozen)
+{
+ struct liveupdate_ioctl_set_event prepare = {
+ .size = sizeof(prepare),
+ .event = LIVEUPDATE_PREPARE,
+ };
+ struct liveupdate_ioctl_set_event cancel = {
+ .size = sizeof(cancel),
+ .event = LIVEUPDATE_CANCEL,
+ };
+
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_SET_EVENT, &prepare));
+ ASSERT_EQ(0, ioctl(self->fd_dbg, LIVEUPDATE_IOCTL_FREEZE, NULL));
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_SET_EVENT, &cancel));
+}
+
+TEST_F(subsystem, register_unregister)
+{
+ ASSERT_EQ(0, register_subsystem(self->fd_dbg, &self->si[0]));
+ ASSERT_EQ(0, unregister_subsystem(self->fd_dbg, &self->si[0]));
+}
+
+TEST_F(subsystem, double_unregister)
+{
+ ASSERT_EQ(0, register_subsystem(self->fd_dbg, &self->si[0]));
+ ASSERT_EQ(0, unregister_subsystem(self->fd_dbg, &self->si[0]));
+ EXPECT_NE(0, unregister_subsystem(self->fd_dbg, &self->si[0]));
+ EXPECT_TRUE(errno == EINVAL || errno == ENOENT);
+}
+
+TEST_F(subsystem, register_unregister_many)
+{
+ int i;
+
+ for (i = 0; i < LUO_MAX_SUBSYSTEMS; i++)
+ ASSERT_EQ(0, register_subsystem(self->fd_dbg, &self->si[i]));
+
+ for (i = 0; i < LUO_MAX_SUBSYSTEMS; i++)
+ ASSERT_EQ(0, unregister_subsystem(self->fd_dbg, &self->si[i]));
+}
+
+TEST_F(subsystem, getdata_verify)
+{
+ struct liveupdate_ioctl_get_state ligs = {.size = sizeof(ligs), .state = 0};
+ struct liveupdate_ioctl_set_event prepare = {
+ .size = sizeof(prepare),
+ .event = LIVEUPDATE_PREPARE,
+ };
+ struct liveupdate_ioctl_set_event cancel = {
+ .size = sizeof(cancel),
+ .event = LIVEUPDATE_CANCEL,
+ };
+ int i;
+
+ for (i = 0; i < LUO_MAX_SUBSYSTEMS; i++)
+ ASSERT_EQ(0, register_subsystem(self->fd_dbg, &self->si[i]));
+
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_SET_EVENT, &prepare));
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_GET_STATE, &ligs));
+ ASSERT_EQ(ligs.state, LIVEUPDATE_STATE_PREPARED);
+
+ for (i = 0; i < LUO_MAX_SUBSYSTEMS; i++) {
+ struct luo_arg_subsystem subsys_arg;
+
+ memset(&subsys_arg, 0, sizeof(subsys_arg));
+ snprintf(subsys_arg.name, LUO_NAME_LENGTH, "%s",
+ self->si[i].test_name);
+ subsys_arg.data_page = self->si[i].verify_page;
+
+ ASSERT_EQ(0, run_luo_selftest_cmd(self->fd_dbg,
+ LUO_CMD_SUBSYSTEM_GETDATA,
+ &subsys_arg));
+ ASSERT_EQ(0, memcmp(self->si[i].data_page,
+ self->si[i].verify_page,
+ page_size));
+ }
+
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_SET_EVENT, &cancel));
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_GET_STATE, &ligs));
+ ASSERT_EQ(ligs.state, LIVEUPDATE_STATE_NORMAL);
+
+ for (i = 0; i < LUO_MAX_SUBSYSTEMS; i++)
+ ASSERT_EQ(0, unregister_subsystem(self->fd_dbg, &self->si[i]));
+}
+
+TEST_F(subsystem, prepare_fail)
+{
+ struct liveupdate_ioctl_set_event prepare = {
+ .size = sizeof(prepare),
+ .event = LIVEUPDATE_PREPARE,
+ };
+ struct liveupdate_ioctl_set_event cancel = {
+ .size = sizeof(cancel),
+ .event = LIVEUPDATE_CANCEL,
+ };
+ int i;
+
+ snprintf(self->si[LUO_MAX_SUBSYSTEMS - 1].test_name, LUO_NAME_LENGTH,
+ NAME_PREPARE_FAIL ".%d", LUO_MAX_SUBSYSTEMS - 1);
+
+ for (i = 0; i < LUO_MAX_SUBSYSTEMS; i++)
+ ASSERT_EQ(0, register_subsystem(self->fd_dbg, &self->si[i]));
+
+ ASSERT_EQ(-1, ioctl(self->fd, LIVEUPDATE_IOCTL_SET_EVENT, &prepare));
+
+ for (i = 0; i < LUO_MAX_SUBSYSTEMS; i++)
+ ASSERT_EQ(0, unregister_subsystem(self->fd_dbg, &self->si[i]));
+
+ snprintf(self->si[LUO_MAX_SUBSYSTEMS - 1].test_name, LUO_NAME_LENGTH,
+ NAME_NORMAL ".%d", LUO_MAX_SUBSYSTEMS - 1);
+
+ for (i = 0; i < LUO_MAX_SUBSYSTEMS; i++)
+ ASSERT_EQ(0, register_subsystem(self->fd_dbg, &self->si[i]));
+
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_SET_EVENT, &prepare));
+ ASSERT_EQ(0, ioctl(self->fd_dbg, LIVEUPDATE_IOCTL_FREEZE, NULL));
+ ASSERT_EQ(0, ioctl(self->fd, LIVEUPDATE_IOCTL_SET_EVENT, &cancel));
+
+ for (i = 0; i < LUO_MAX_SUBSYSTEMS; i++)
+ ASSERT_EQ(0, unregister_subsystem(self->fd_dbg, &self->si[i]));
+}
+
+TEST_HARNESS_MAIN
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 19/30] docs: add luo documentation
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Add the documentation files for the Live Update Orchestrator
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
Documentation/core-api/index.rst | 1 +
Documentation/core-api/liveupdate.rst | 57 ++++++++++++++++++++++
Documentation/userspace-api/index.rst | 1 +
Documentation/userspace-api/liveupdate.rst | 25 ++++++++++
4 files changed, 84 insertions(+)
create mode 100644 Documentation/core-api/liveupdate.rst
create mode 100644 Documentation/userspace-api/liveupdate.rst
diff --git a/Documentation/core-api/index.rst b/Documentation/core-api/index.rst
index 6cbdcbfa79c3..5eb0fbbbc323 100644
--- a/Documentation/core-api/index.rst
+++ b/Documentation/core-api/index.rst
@@ -138,6 +138,7 @@ Documents that don't fit elsewhere or which have yet to be categorized.
:maxdepth: 1
librs
+ liveupdate
netlink
.. only:: subproject and html
diff --git a/Documentation/core-api/liveupdate.rst b/Documentation/core-api/liveupdate.rst
new file mode 100644
index 000000000000..7c1c3af6f960
--- /dev/null
+++ b/Documentation/core-api/liveupdate.rst
@@ -0,0 +1,57 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+========================
+Live Update Orchestrator
+========================
+:Author: Pasha Tatashin <pasha.tatashin@soleen.com>
+
+.. kernel-doc:: kernel/liveupdate/luo_core.c
+ :doc: Live Update Orchestrator (LUO)
+
+LUO Subsystems Participation
+============================
+.. kernel-doc:: kernel/liveupdate/luo_subsystems.c
+ :doc: LUO Subsystems support
+
+LUO Sessions
+============
+.. kernel-doc:: kernel/liveupdate/luo_session.c
+ :doc: LUO Sessions
+
+LUO Preserving File Descriptors
+===============================
+.. kernel-doc:: kernel/liveupdate/luo_file.c
+ :doc: LUO file descriptors
+
+Public API
+==========
+.. kernel-doc:: include/linux/liveupdate.h
+
+.. kernel-doc:: kernel/liveupdate/luo_core.c
+ :export:
+
+.. kernel-doc:: kernel/liveupdate/luo_subsystems.c
+ :export:
+
+.. kernel-doc:: kernel/liveupdate/luo_file.c
+ :export:
+
+Internal API
+============
+.. kernel-doc:: kernel/liveupdate/luo_core.c
+ :internal:
+
+.. kernel-doc:: kernel/liveupdate/luo_subsystems.c
+ :internal:
+
+.. kernel-doc:: kernel/liveupdate/luo_session.c
+ :internal:
+
+.. kernel-doc:: kernel/liveupdate/luo_file.c
+ :internal:
+
+See Also
+========
+
+- :doc:`Live Update uAPI </userspace-api/liveupdate>`
+- :doc:`/core-api/kho/concepts`
diff --git a/Documentation/userspace-api/index.rst b/Documentation/userspace-api/index.rst
index 0167e59b541e..64b0099ee161 100644
--- a/Documentation/userspace-api/index.rst
+++ b/Documentation/userspace-api/index.rst
@@ -61,6 +61,7 @@ Everything else
:maxdepth: 1
ELF
+ liveupdate
netlink/index
shadow_stack
sysfs-platform_profile
diff --git a/Documentation/userspace-api/liveupdate.rst b/Documentation/userspace-api/liveupdate.rst
new file mode 100644
index 000000000000..70b5017c0e3c
--- /dev/null
+++ b/Documentation/userspace-api/liveupdate.rst
@@ -0,0 +1,25 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+================
+Live Update uAPI
+================
+:Author: Pasha Tatashin <pasha.tatashin@soleen.com>
+
+ioctl interface
+===============
+.. kernel-doc:: kernel/liveupdate/luo_ioctl.c
+ :doc: LUO ioctl Interface
+
+ioctl uAPI
+===========
+.. kernel-doc:: include/uapi/linux/liveupdate.h
+
+LUO selftests ioctl
+===================
+.. kernel-doc:: kernel/liveupdate/luo_selftests.c
+ :doc: LUO Selftests
+
+See Also
+========
+
+- :doc:`Live Update Orchestrator </core-api/liveupdate>`
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 20/30] MAINTAINERS: add liveupdate entry
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Add a MAINTAINERS file entry for the new Live Update Orchestrator
introduced in previous patches.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
MAINTAINERS | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/MAINTAINERS b/MAINTAINERS
index e5c800ed4819..e99af6101d3c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -14431,6 +14431,18 @@ F: kernel/module/livepatch.c
F: samples/livepatch/
F: tools/testing/selftests/livepatch/
+LIVE UPDATE
+M: Pasha Tatashin <pasha.tatashin@soleen.com>
+L: linux-kernel@vger.kernel.org
+S: Maintained
+F: Documentation/ABI/testing/sysfs-kernel-liveupdate
+F: Documentation/core-api/liveupdate.rst
+F: Documentation/userspace-api/liveupdate.rst
+F: include/linux/liveupdate.h
+F: include/uapi/linux/liveupdate.h
+F: kernel/liveupdate/
+F: tools/testing/selftests/liveupdate/
+
LLC (802.2)
L: netdev@vger.kernel.org
S: Odd fixes
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 21/30] mm: shmem: use SHMEM_F_* flags instead of VM_* flags
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
From: Pratyush Yadav <ptyadav@amazon.de>
shmem_inode_info::flags can have the VM flags VM_NORESERVE and
VM_LOCKED. These are used to suppress pre-accounting or to lock the
pages in the inode respectively. Using the VM flags directly makes it
difficult to add shmem-specific flags that are unrelated to VM behavior
since one would need to find a VM flag not used by shmem and re-purpose
it.
Introduce SHMEM_F_NORESERVE and SHMEM_F_LOCKED which represent the same
information, but their bits are independent of the VM flags. Callers can
still pass VM_NORESERVE to shmem_get_inode(), but it gets transformed to
the shmem-specific flag internally.
No functional changes intended.
Signed-off-by: Pratyush Yadav <ptyadav@amazon.de>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
include/linux/shmem_fs.h | 6 ++++++
mm/shmem.c | 29 ++++++++++++++++-------------
2 files changed, 22 insertions(+), 13 deletions(-)
diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h
index 0e47465ef0fd..650874b400b5 100644
--- a/include/linux/shmem_fs.h
+++ b/include/linux/shmem_fs.h
@@ -10,6 +10,7 @@
#include <linux/xattr.h>
#include <linux/fs_parser.h>
#include <linux/userfaultfd_k.h>
+#include <linux/bits.h>
struct swap_iocb;
@@ -19,6 +20,11 @@ struct swap_iocb;
#define SHMEM_MAXQUOTAS 2
#endif
+/* Suppress pre-accounting of the entire object size. */
+#define SHMEM_F_NORESERVE BIT(0)
+/* Disallow swapping. */
+#define SHMEM_F_LOCKED BIT(1)
+
struct shmem_inode_info {
spinlock_t lock;
unsigned int seals; /* shmem seals */
diff --git a/mm/shmem.c b/mm/shmem.c
index b9081b817d28..ce3b912f62da 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -175,20 +175,20 @@ static inline struct shmem_sb_info *SHMEM_SB(struct super_block *sb)
*/
static inline int shmem_acct_size(unsigned long flags, loff_t size)
{
- return (flags & VM_NORESERVE) ?
+ return (flags & SHMEM_F_NORESERVE) ?
0 : security_vm_enough_memory_mm(current->mm, VM_ACCT(size));
}
static inline void shmem_unacct_size(unsigned long flags, loff_t size)
{
- if (!(flags & VM_NORESERVE))
+ if (!(flags & SHMEM_F_NORESERVE))
vm_unacct_memory(VM_ACCT(size));
}
static inline int shmem_reacct_size(unsigned long flags,
loff_t oldsize, loff_t newsize)
{
- if (!(flags & VM_NORESERVE)) {
+ if (!(flags & SHMEM_F_NORESERVE)) {
if (VM_ACCT(newsize) > VM_ACCT(oldsize))
return security_vm_enough_memory_mm(current->mm,
VM_ACCT(newsize) - VM_ACCT(oldsize));
@@ -206,7 +206,7 @@ static inline int shmem_reacct_size(unsigned long flags,
*/
static inline int shmem_acct_blocks(unsigned long flags, long pages)
{
- if (!(flags & VM_NORESERVE))
+ if (!(flags & SHMEM_F_NORESERVE))
return 0;
return security_vm_enough_memory_mm(current->mm,
@@ -215,7 +215,7 @@ static inline int shmem_acct_blocks(unsigned long flags, long pages)
static inline void shmem_unacct_blocks(unsigned long flags, long pages)
{
- if (flags & VM_NORESERVE)
+ if (flags & SHMEM_F_NORESERVE)
vm_unacct_memory(pages * VM_ACCT(PAGE_SIZE));
}
@@ -1551,7 +1551,7 @@ int shmem_writeout(struct folio *folio, struct swap_iocb **plug,
int nr_pages;
bool split = false;
- if ((info->flags & VM_LOCKED) || sbinfo->noswap)
+ if ((info->flags & SHMEM_F_LOCKED) || sbinfo->noswap)
goto redirty;
if (!total_swap_pages)
@@ -2907,15 +2907,15 @@ int shmem_lock(struct file *file, int lock, struct ucounts *ucounts)
* ipc_lock_object() when called from shmctl_do_lock(),
* no serialization needed when called from shm_destroy().
*/
- if (lock && !(info->flags & VM_LOCKED)) {
+ if (lock && !(info->flags & SHMEM_F_LOCKED)) {
if (!user_shm_lock(inode->i_size, ucounts))
goto out_nomem;
- info->flags |= VM_LOCKED;
+ info->flags |= SHMEM_F_LOCKED;
mapping_set_unevictable(file->f_mapping);
}
- if (!lock && (info->flags & VM_LOCKED) && ucounts) {
+ if (!lock && (info->flags & SHMEM_F_LOCKED) && ucounts) {
user_shm_unlock(inode->i_size, ucounts);
- info->flags &= ~VM_LOCKED;
+ info->flags &= ~SHMEM_F_LOCKED;
mapping_clear_unevictable(file->f_mapping);
}
retval = 0;
@@ -3059,7 +3059,8 @@ static struct inode *__shmem_get_inode(struct mnt_idmap *idmap,
spin_lock_init(&info->lock);
atomic_set(&info->stop_eviction, 0);
info->seals = F_SEAL_SEAL;
- info->flags = flags & VM_NORESERVE;
+ if (flags & VM_NORESERVE)
+ info->flags = SHMEM_F_NORESERVE;
info->i_crtime = inode_get_mtime(inode);
info->fsflags = (dir == NULL) ? 0 :
SHMEM_I(dir)->fsflags & SHMEM_FL_INHERITED;
@@ -5801,8 +5802,10 @@ static inline struct inode *shmem_get_inode(struct mnt_idmap *idmap,
/* common code */
static struct file *__shmem_file_setup(struct vfsmount *mnt, const char *name,
- loff_t size, unsigned long flags, unsigned int i_flags)
+ loff_t size, unsigned long vm_flags,
+ unsigned int i_flags)
{
+ unsigned long flags = (vm_flags & VM_NORESERVE) ? SHMEM_F_NORESERVE : 0;
struct inode *inode;
struct file *res;
@@ -5819,7 +5822,7 @@ static struct file *__shmem_file_setup(struct vfsmount *mnt, const char *name,
return ERR_PTR(-ENOMEM);
inode = shmem_get_inode(&nop_mnt_idmap, mnt->mnt_sb, NULL,
- S_IFREG | S_IRWXUGO, 0, flags);
+ S_IFREG | S_IRWXUGO, 0, vm_flags);
if (IS_ERR(inode)) {
shmem_unacct_size(flags, size);
return ERR_CAST(inode);
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 22/30] mm: shmem: allow freezing inode mapping
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
From: Pratyush Yadav <ptyadav@amazon.de>
To prepare a shmem inode for live update via the Live Update
Orchestrator (LUO), its index -> folio mappings must be serialized. Once
the mappings are serialized, they cannot change since it would cause the
serialized data to become inconsistent. This can be done by pinning the
folios to avoid migration, and by making sure no folios can be added to
or removed from the inode.
While mechanisms to pin folios already exist, the only way to stop
folios being added or removed are the grow and shrink file seals. But
file seals come with their own semantics, one of which is that they
can't be removed. This doesn't work with liveupdate since it can be
cancelled or error out, which would need the seals to be removed and the
file's normal functionality to be restored.
Introduce SHMEM_F_MAPPING_FROZEN to indicate this instead. It is
internal to shmem and is not directly exposed to userspace. It functions
similar to F_SEAL_GROW | F_SEAL_SHRINK, but additionally disallows hole
punching, and can be removed.
Signed-off-by: Pratyush Yadav <ptyadav@amazon.de>
Signed-off-by: Pasha Tatashin <pahsa.tatashin@soleen.com>
---
include/linux/shmem_fs.h | 17 +++++++++++++++++
mm/shmem.c | 12 +++++++++++-
2 files changed, 28 insertions(+), 1 deletion(-)
diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h
index 650874b400b5..a9f5db472a39 100644
--- a/include/linux/shmem_fs.h
+++ b/include/linux/shmem_fs.h
@@ -24,6 +24,14 @@ struct swap_iocb;
#define SHMEM_F_NORESERVE BIT(0)
/* Disallow swapping. */
#define SHMEM_F_LOCKED BIT(1)
+/*
+ * Disallow growing, shrinking, or hole punching in the inode. Combined with
+ * folio pinning, makes sure the inode's mapping stays fixed.
+ *
+ * In some ways similar to F_SEAL_GROW | F_SEAL_SHRINK, but can be removed and
+ * isn't directly visible to userspace.
+ */
+#define SHMEM_F_MAPPING_FROZEN BIT(2)
struct shmem_inode_info {
spinlock_t lock;
@@ -186,6 +194,15 @@ static inline bool shmem_file(struct file *file)
return shmem_mapping(file->f_mapping);
}
+/* Must be called with inode lock taken exclusive. */
+static inline void shmem_i_mapping_freeze(struct inode *inode, bool freeze)
+{
+ if (freeze)
+ SHMEM_I(inode)->flags |= SHMEM_F_MAPPING_FROZEN;
+ else
+ SHMEM_I(inode)->flags &= ~SHMEM_F_MAPPING_FROZEN;
+}
+
/*
* If fallocate(FALLOC_FL_KEEP_SIZE) has been used, there may be pages
* beyond i_size's notion of EOF, which fallocate has committed to reserving:
diff --git a/mm/shmem.c b/mm/shmem.c
index ce3b912f62da..bd7d9afe5a27 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1292,7 +1292,8 @@ static int shmem_setattr(struct mnt_idmap *idmap,
loff_t newsize = attr->ia_size;
/* protected by i_rwsem */
- if ((newsize < oldsize && (info->seals & F_SEAL_SHRINK)) ||
+ if ((info->flags & SHMEM_F_MAPPING_FROZEN) ||
+ (newsize < oldsize && (info->seals & F_SEAL_SHRINK)) ||
(newsize > oldsize && (info->seals & F_SEAL_GROW)))
return -EPERM;
@@ -3287,6 +3288,10 @@ shmem_write_begin(const struct kiocb *iocb, struct address_space *mapping,
return -EPERM;
}
+ if (unlikely((info->flags & SHMEM_F_MAPPING_FROZEN) &&
+ pos + len > inode->i_size))
+ return -EPERM;
+
ret = shmem_get_folio(inode, index, pos + len, &folio, SGP_WRITE);
if (ret)
return ret;
@@ -3660,6 +3665,11 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
inode_lock(inode);
+ if (info->flags & SHMEM_F_MAPPING_FROZEN) {
+ error = -EPERM;
+ goto out;
+ }
+
if (mode & FALLOC_FL_PUNCH_HOLE) {
struct address_space *mapping = file->f_mapping;
loff_t unmap_start = round_up(offset, PAGE_SIZE);
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 11/30] liveupdate: luo_session: Add sessions support
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Introduce concept of "Live Update Sessions" within the LUO framework.
LUO sessions provide a mechanism to group and manage `struct file *`
instances (representing file descriptors) that need to be preserved
across a kexec-based live update.
Each session is identified by a unique name and acts as a container
for file objects whose state is critical to a userspace workload, such
as a virtual machine or a high-performance database, aiming to maintain
their functionality across a kernel transition.
This groundwork establishes the framework for preserving file-backed
state across kernel updates, with the actual file data preservation
mechanisms to be implemented in subsequent patches.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
include/uapi/linux/liveupdate.h | 3 +
kernel/liveupdate/Makefile | 1 +
kernel/liveupdate/luo_internal.h | 34 ++
kernel/liveupdate/luo_session.c | 607 +++++++++++++++++++++++++++++++
4 files changed, 645 insertions(+)
create mode 100644 kernel/liveupdate/luo_session.c
diff --git a/include/uapi/linux/liveupdate.h b/include/uapi/linux/liveupdate.h
index 3cb09b2c4353..e8c0c210a790 100644
--- a/include/uapi/linux/liveupdate.h
+++ b/include/uapi/linux/liveupdate.h
@@ -91,4 +91,7 @@ enum liveupdate_event {
LIVEUPDATE_CANCEL = 3,
};
+/* The maximum length of session name including null termination */
+#define LIVEUPDATE_SESSION_NAME_LENGTH 56
+
#endif /* _UAPI_LIVEUPDATE_H */
diff --git a/kernel/liveupdate/Makefile b/kernel/liveupdate/Makefile
index 2881bab0c6df..f64cfc92cbf0 100644
--- a/kernel/liveupdate/Makefile
+++ b/kernel/liveupdate/Makefile
@@ -3,6 +3,7 @@
luo-y := \
luo_core.o \
luo_ioctl.o \
+ luo_session.o \
luo_subsystems.o
obj-$(CONFIG_KEXEC_HANDOVER) += kexec_handover.o
diff --git a/kernel/liveupdate/luo_internal.h b/kernel/liveupdate/luo_internal.h
index c62fbbb0790c..9223f71844ca 100644
--- a/kernel/liveupdate/luo_internal.h
+++ b/kernel/liveupdate/luo_internal.h
@@ -32,6 +32,40 @@ void *luo_contig_alloc_preserve(size_t size);
void luo_contig_free_unpreserve(void *mem, size_t size);
void luo_contig_free_restore(void *mem, size_t size);
+/**
+ * struct luo_session - Represents an active or incoming Live Update session.
+ * @name: A unique name for this session, used for identification and
+ * retrieval.
+ * @files_xa: An xarray used to store the files associated with this session.
+ * @ser: Pointer to the serialized data for this session.
+ * @count: A counter tracking the number of files currently stored in the
+ * @files_xa for this session.
+ * @list: A list_head member used to link this session into a global list
+ * of either outgoing (to be preserved) or incoming (restored from
+ * previous kernel) sessions.
+ * @retrieved: A boolean flag indicating whether this session has been retrieved
+ * by a consumer in the new kernel. Valid only during the
+ * LIVEUPDATE_STATE_UPDATED state.
+ * @mutex: Session lock, protects files_xa, and count.
+ * @state: State of this session: prepared/frozen/updated/normal.
+ * @files: The physical address of a contiguous memory block that holds
+ * the serialized state of files.
+ */
+struct luo_session {
+ char name[LIVEUPDATE_SESSION_NAME_LENGTH];
+ struct xarray files_xa;
+ struct luo_session_ser *ser;
+ long count;
+ struct list_head list;
+ bool retrieved;
+ struct mutex mutex;
+ enum liveupdate_state state;
+ u64 files;
+};
+
+int luo_session_create(const char *name, struct file **filep);
+int luo_session_retrieve(const char *name, struct file **filep);
+
void luo_subsystems_startup(void *fdt);
int luo_subsystems_fdt_setup(void *fdt);
int luo_do_subsystems_prepare_calls(void);
diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
new file mode 100644
index 000000000000..74dee42e24b7
--- /dev/null
+++ b/kernel/liveupdate/luo_session.c
@@ -0,0 +1,607 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright (c) 2025, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+/**
+ * DOC: LUO Sessions
+ *
+ * LUO Sessions provide the core mechanism for grouping and managing file
+ * descriptors that need to be preserved across a kexec-based live update.
+ * Each session acts as a named container for a set of file objects, allowing
+ * a userspace agent (e.g., a Live Update Orchestration Daemon) to manage the
+ * lifecycle of resources critical to a workload.
+ *
+ * Core Concepts:
+ *
+ * - Named Containers: Sessions are identified by a unique, user-provided name,
+ * which is used for both creation and retrieval.
+ *
+ * - Userspace Interface: Session management is driven from userspace via
+ * ioctls on /dev/liveupdate (e.g., CREATE_SESSION, RETRIEVE_SESSION).
+ *
+ * - Serialization: Session metadata is preserved using the KHO framework.
+ * During the 'prepare' phase, an array of `struct luo_session_ser` is
+ * allocated and preserved. An FDT node is also created, containing the
+ * count of sessions and the physical address of this array.
+ *
+ * Session Lifecycle and State Management:
+ *
+ * 1. Creation: A userspace agent calls `luo_session_create()` to create a new,
+ * empty session, receiving a file descriptor handle. This can be done in
+ * the NORMAL or UPDATED states.
+ *
+ * 2. Name Collision: In the UPDATED state, `luo_session_create()` checks for
+ * name conflicts against sessions preserved from the previous kernel to
+ * prevent ambiguity.
+ *
+ * 3. Preparation (`prepare` callback): When the global LUO PREPARE event is
+ * triggered, the list of all created sessions is serialized. The main
+ * `ser` array is allocated, and each active `struct luo_session` is given
+ * a direct pointer to its corresponding entry in this array.
+ *
+ * 4. Release After Prepare: When a session FD is closed *after* the PREPARE
+ * event, the `.release` handler uses the session's direct pointer to
+ * `memset(0)` its entry in the `ser` array. This effectively marks the
+ * session as defunct without needing to resize the already-preserved
+ * memory.
+ *
+ * 5. Boot (`boot` callback): In the new kernel, the FDT is read to locate
+ * the preserved `ser` array. The metadata (count, physical address) is
+ * stored in the `luo_session` global.
+ *
+ * 6. Lazy Deserialization: The actual `luo_session` list is populated on
+ * first use (e.g., by `retrieve`, `finish`, or `create`). During this
+ * process, any zeroed-out entries from step 4 are skipped.
+ *
+ * 7. Retrieval: The userspace agent calls `luo_session_retrieve()` in the new
+ * kernel to get a new FD handle for a preserved session by its name.
+ *
+ * 8. Finalization (`finish` callback): When the global LUO FINISH event is
+ * sent, any preserved sessions that were successfully retrieved are moved
+ * to the `luo_session_global` list, making them available for a subsequent
+ * live update. Any sessions that were not retrieved are considered stale
+ * and are cleaned up.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/anon_inodes.h>
+#include <linux/errno.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/libfdt.h>
+#include <linux/liveupdate.h>
+#include <uapi/linux/liveupdate.h>
+#include "luo_internal.h"
+
+#define LUO_SESSION_NODE_NAME "luo-session"
+#define LUO_SESSION_COMPATIBLE "luo-session-v1"
+
+/**
+ * struct luo_session_ser - Represents the serialized metadata for a LUO session.
+ * @name: The unique name of the session, copied from the `luo_session`
+ * structure.
+ * @files: The physical address of a contiguous memory block that holds
+ * the serialized state of files.
+ * @pgcnt: The number of pages occupied by the `files` memory block.
+ * @count: The total number of files that were part of this session during
+ * serialization. Used for iteration and validation during
+ * restoration.
+ *
+ * This structure is used to package session-specific metadata for transfer
+ * between kernels via Kexec Handover. An array of these structures (one per
+ * session) is created and passed to the new kernel, allowing it to reconstruct
+ * the session context.
+ *
+ * If this structure is modified, LUO_SESSION_COMPATIBLE must be updated.
+ */
+struct luo_session_ser {
+ char name[LIVEUPDATE_SESSION_NAME_LENGTH];
+ u64 files;
+ u64 pgcnt;
+ u64 count;
+} __packed;
+
+/**
+ * struct luo_session_global - Global container for managing LUO sessions.
+ * @count: The number of sessions currently tracked in the @list.
+ * @list: The head of the linked list of `struct luo_session` instances.
+ * @rwsem: A read-write semaphore providing synchronized access to the session
+ * list and other fields in this structure.
+ * @ser: A pointer to the contiguous block of memory holding the serialized
+ * session data (an array of `struct luo_session_ser`). For `_out`, this
+ * is allocated and populated during `prepare`. For `_in`, this points
+ * to the data restored from the previous kernel.
+ * @pgcnt: The size, in pages, of the memory block pointed to by @ser.
+ * @fdt: A pointer to the FDT blob that contains the metadata for this group
+ * of sessions. This FDT is what is ultimately passed to the parent LUO
+ * subsystem for preservation.
+ */
+struct luo_session_global {
+ long count;
+ struct list_head list;
+ struct rw_semaphore rwsem;
+ struct luo_session_ser *ser;
+ u64 pgcnt;
+ void *fdt;
+ long ser_count;
+};
+
+static struct luo_session_global luo_session_global;
+
+static struct luo_session *luo_session_alloc(const char *name)
+{
+ struct luo_session *session = kzalloc(sizeof(*session), GFP_KERNEL);
+
+ if (!session)
+ return NULL;
+
+ strscpy(session->name, name, sizeof(session->name));
+ xa_init(&session->files_xa);
+ session->count = 0;
+ INIT_LIST_HEAD(&session->list);
+ mutex_init(&session->mutex);
+ session->state = LIVEUPDATE_STATE_NORMAL;
+
+ return session;
+}
+
+static void luo_session_free(struct luo_session *session)
+{
+ WARN_ON(session->count);
+ xa_destroy(&session->files_xa);
+ mutex_destroy(&session->mutex);
+ kfree(session);
+}
+
+static int luo_session_insert(struct luo_session *session)
+{
+ struct luo_session *it;
+
+ lockdep_assert_held_write(&luo_session_global.rwsem);
+ /*
+ * For small number of sessions this loop won't hurt performance
+ * but if we ever start using a lot of sessions, this might
+ * become a bottle neck during deserialization time, as it would
+ * cause O(n*n) complexity.
+ */
+ list_for_each_entry(it, &luo_session_global.list, list) {
+ if (!strncmp(it->name, session->name, sizeof(it->name)))
+ return -EEXIST;
+ }
+ list_add_tail(&session->list, &luo_session_global.list);
+ luo_session_global.count++;
+
+ return 0;
+}
+
+static void luo_session_remove(struct luo_session *session)
+{
+ lockdep_assert_held_write(&luo_session_global.rwsem);
+ list_del(&session->list);
+ luo_session_global.count--;
+}
+
+/* One session switches from the updated state to normal state */
+static void luo_session_finish_one(struct luo_session *session)
+{
+}
+
+/* Cancel one session from frozen or prepared state, back to normal */
+static void luo_session_cancel_one(struct luo_session *session)
+{
+}
+
+/* One session is changed from normal to prepare state */
+static int luo_session_prepare_one(struct luo_session *session)
+{
+ return 0;
+}
+
+static int luo_session_release(struct inode *inodep, struct file *filep)
+{
+ struct luo_session *session = filep->private_data;
+
+ scoped_guard(rwsem_read, &luo_session_global.rwsem) {
+ scoped_guard(mutex, &session->mutex) {
+ if (session->ser) {
+ memset(session->ser, 0,
+ sizeof(struct luo_session_ser));
+ }
+ }
+ }
+
+ if (session->state == LIVEUPDATE_STATE_UPDATED)
+ luo_session_finish_one(session);
+ if (session->state == LIVEUPDATE_STATE_PREPARED ||
+ session->state == LIVEUPDATE_STATE_FROZEN) {
+ luo_session_cancel_one(session);
+ }
+
+ scoped_guard(rwsem_write, &luo_session_global.rwsem)
+ luo_session_remove(session);
+ luo_session_free(session);
+
+ return 0;
+}
+
+static const struct file_operations luo_session_fops = {
+ .owner = THIS_MODULE,
+ .release = luo_session_release,
+};
+
+static void luo_session_deserialize(void)
+{
+ static int visited;
+ int i;
+
+ if (visited)
+ return;
+
+ guard(rwsem_write)(&luo_session_global.rwsem);
+ if (visited)
+ return;
+ visited++;
+ for (i = 0; i < luo_session_global.ser_count; i++) {
+ struct luo_session *session;
+
+ /*
+ * If there is no name, this session was remove from
+ * preservation after prepare. So, skip it.
+ */
+ if (!luo_session_global.ser[i].name[0])
+ continue;
+
+ session = luo_session_alloc(luo_session_global.ser[i].name);
+ if (!session)
+ luo_restore_fail("Failed to allocate session on boot\n");
+
+ if (luo_session_insert(session)) {
+ luo_restore_fail("Failed to insert session due to name conflict [%s]\n",
+ session->name);
+ }
+
+ session->state = LIVEUPDATE_STATE_UPDATED;
+ session->count = luo_session_global.ser[i].count;
+ session->files = luo_session_global.ser[i].files;
+ }
+}
+
+/* Create a "struct file" for session, and delete it on case of failure */
+static int luo_session_getfile(struct luo_session *session, struct file **filep)
+{
+ char name_buf[128];
+ struct file *file;
+
+ scoped_guard(mutex, &session->mutex) {
+ lockdep_assert_held(&session->mutex);
+ snprintf(name_buf, sizeof(name_buf), "[luo_session] %s",
+ session->name);
+ file = anon_inode_getfile(name_buf, &luo_session_fops, session,
+ O_RDWR);
+ }
+ if (IS_ERR(file)) {
+ scoped_guard(rwsem_write, &luo_session_global.rwsem)
+ luo_session_remove(session);
+ luo_session_free(session);
+ return PTR_ERR(file);
+ }
+
+ *filep = file;
+ return 0;
+}
+
+int luo_session_create(const char *name, struct file **filep)
+{
+ struct luo_session *session;
+ int ret;
+
+ guard(rwsem_read)(&luo_state_rwsem);
+
+ /* New sessions cannot be added after prepared state */
+ if (!liveupdate_state_normal() && !liveupdate_state_updated())
+ return -EAGAIN;
+
+ session = luo_session_alloc(name);
+ if (!session)
+ return -ENOMEM;
+
+ scoped_guard(rwsem_write, &luo_session_global.rwsem)
+ ret = luo_session_insert(session);
+ if (ret) {
+ luo_session_free(session);
+ return ret;
+ }
+
+ return luo_session_getfile(session, filep);
+}
+
+int luo_session_retrieve(const char *name, struct file **filep)
+{
+ struct luo_session *session = NULL;
+ struct luo_session *it;
+
+ guard(rwsem_read)(&luo_state_rwsem);
+
+ /* Can only retrieve in the updated state */
+ if (!liveupdate_state_updated())
+ return -EAGAIN;
+
+ luo_session_deserialize();
+ scoped_guard(rwsem_read, &luo_session_global.rwsem) {
+ list_for_each_entry(it, &luo_session_global.list, list) {
+ if (!strncmp(it->name, name, sizeof(it->name))) {
+ session = it;
+ break;
+ }
+ }
+ }
+
+ if (!session)
+ return -ENOENT;
+
+ scoped_guard(mutex, &session->mutex) {
+ /*
+ * Session already retrieved or a session with the same name was
+ * created during updated state
+ */
+ if (session->retrieved || session->state != LIVEUPDATE_STATE_UPDATED)
+ return -EADDRINUSE;
+
+ session->retrieved = true;
+ }
+
+ return luo_session_getfile(session, filep);
+}
+
+static void luo_session_global_preserved_cleanup(void)
+{
+ lockdep_assert_held_write(&luo_session_global.rwsem);
+ if (luo_session_global.ser && !IS_ERR(luo_session_global.ser)) {
+ luo_contig_free_unpreserve(luo_session_global.ser,
+ luo_session_global.pgcnt << PAGE_SHIFT);
+ }
+ if (luo_session_global.fdt && !IS_ERR(luo_session_global.fdt))
+ luo_contig_free_unpreserve(luo_session_global.fdt, PAGE_SIZE);
+
+ luo_session_global.fdt = NULL;
+ luo_session_global.ser = NULL;
+ luo_session_global.ser_count = 0;
+ luo_session_global.pgcnt = 0;
+}
+
+static int luo_session_fdt_setup(void)
+{
+ u64 ser_pa;
+ int ret;
+
+ lockdep_assert_held_write(&luo_session_global.rwsem);
+ luo_session_global.pgcnt = DIV_ROUND_UP(luo_session_global.count *
+ sizeof(struct luo_session_ser), PAGE_SIZE);
+
+ if (luo_session_global.pgcnt > 0) {
+ size_t ser_size = luo_session_global.pgcnt << PAGE_SHIFT;
+
+ luo_session_global.ser = luo_contig_alloc_preserve(ser_size);
+ if (IS_ERR(luo_session_global.ser)) {
+ ret = PTR_ERR(luo_session_global.ser);
+ goto exit_cleanup;
+ }
+ }
+
+ luo_session_global.fdt = luo_contig_alloc_preserve(PAGE_SIZE);
+ if (IS_ERR(luo_session_global.fdt)) {
+ ret = PTR_ERR(luo_session_global.fdt);
+ goto exit_cleanup;
+ }
+
+ ret = fdt_create(luo_session_global.fdt, PAGE_SIZE);
+ if (ret < 0)
+ goto exit_cleanup;
+
+ ret = fdt_finish_reservemap(luo_session_global.fdt);
+ if (ret < 0)
+ goto exit_finish;
+
+ ret = fdt_begin_node(luo_session_global.fdt, LUO_SESSION_NODE_NAME);
+ if (ret < 0)
+ goto exit_finish;
+
+ ret = fdt_property_string(luo_session_global.fdt, "compatible",
+ LUO_SESSION_COMPATIBLE);
+ if (ret < 0)
+ goto exit_end_node;
+
+ ret = fdt_property_u64(luo_session_global.fdt, "count",
+ luo_session_global.count);
+ if (ret < 0)
+ goto exit_end_node;
+
+ ser_pa = luo_session_global.ser ? __pa(luo_session_global.ser) : 0;
+ ret = fdt_property_u64(luo_session_global.fdt, "data", ser_pa);
+ if (ret < 0)
+ goto exit_end_node;
+
+ ret = fdt_property_u64(luo_session_global.fdt, "pgcnt",
+ luo_session_global.pgcnt);
+ if (ret < 0)
+ goto exit_end_node;
+
+ ret = fdt_end_node(luo_session_global.fdt);
+ if (ret < 0)
+ goto exit_finish;
+
+ ret = fdt_finish(luo_session_global.fdt);
+ if (ret < 0)
+ goto exit_cleanup;
+
+ return 0;
+
+exit_end_node:
+ fdt_end_node(luo_session_global.fdt);
+exit_finish:
+ fdt_finish(luo_session_global.fdt);
+exit_cleanup:
+ luo_session_global_preserved_cleanup();
+
+ return ret;
+}
+
+/*
+ * Change all sessions to normal state: make every file within each session
+ * to be in the normal state.
+ */
+static void luo_session_cancel(struct liveupdate_subsystem *h, u64 data)
+{
+ struct luo_session *it;
+
+ guard(rwsem_write)(&luo_session_global.rwsem);
+ list_for_each_entry(it, &luo_session_global.list, list)
+ luo_session_cancel_one(it);
+ luo_session_global_preserved_cleanup();
+}
+
+static int luo_session_prepare(struct liveupdate_subsystem *h, u64 *data)
+{
+ struct luo_session_ser *ser;
+ struct luo_session *it;
+ int ret;
+
+ scoped_guard(rwsem_write, &luo_session_global.rwsem) {
+ ret = luo_session_fdt_setup();
+ if (ret)
+ return ret;
+
+ ser = luo_session_global.ser;
+ list_for_each_entry(it, &luo_session_global.list, list) {
+ if (it->state == LIVEUPDATE_STATE_NORMAL) {
+ ret = luo_session_prepare_one(it);
+ if (ret)
+ break;
+ }
+ strscpy(ser->name, it->name, sizeof(ser->name));
+ ser->count = it->count;
+ ser->files = it->files;
+ it->ser = ser;
+ ser++;
+ }
+
+ if (!ret)
+ *data = __pa(luo_session_global.fdt);
+ }
+
+ if (ret)
+ luo_session_cancel(h, 0);
+
+ return ret;
+}
+
+static int luo_session_freeze(struct liveupdate_subsystem *h, u64 *data)
+{
+ return 0;
+}
+
+/*
+ * Finish every file within each session. If session has not been reclaimed
+ * remove it, otherwise keep this session, so it can participate in the
+ * next live update.
+ */
+static void luo_session_finish(struct liveupdate_subsystem *h, u64 data)
+{
+ struct luo_session *session, *tmp;
+
+ luo_session_deserialize();
+
+ list_for_each_entry_safe(session, tmp, &luo_session_global.list, list) {
+ /*
+ * Skip sessions that were created in new kernel or have been
+ * finished already.
+ */
+ if (session->state != LIVEUPDATE_STATE_UPDATED)
+ continue;
+ luo_session_finish_one(session);
+ if (!session->retrieved) {
+ pr_warn("Removing unreclaimed session[%s]\n",
+ session->name);
+ scoped_guard(rwsem_write, &luo_session_global.rwsem)
+ luo_session_remove(session);
+ luo_session_free(session);
+ }
+ }
+
+ scoped_guard(rwsem_write, &luo_session_global.rwsem)
+ luo_session_global_preserved_cleanup();
+}
+
+static void luo_session_boot(struct liveupdate_subsystem *h, u64 data)
+{
+ u64 count, data_pa, pgcnt;
+ const void *prop;
+ int prop_len;
+ void *fdt;
+
+ fdt = __va(data);
+ if (fdt_node_check_compatible(fdt, 0, LUO_SESSION_COMPATIBLE))
+ luo_restore_fail("luo-session FDT incompatible\n");
+
+ prop = fdt_getprop(fdt, 0, "count", &prop_len);
+ if (!prop || prop_len != sizeof(u64))
+ luo_restore_fail("luo-session FDT missing or invalid 'count'\n");
+ count = be64_to_cpup(prop);
+
+ prop = fdt_getprop(fdt, 0, "data", &prop_len);
+ if (!prop || prop_len != sizeof(u64))
+ luo_restore_fail("luo-session FDT missing or invalid 'data'\n");
+ data_pa = be64_to_cpup(prop);
+
+ prop = fdt_getprop(fdt, 0, "pgcnt", &prop_len);
+ if (!prop || prop_len != sizeof(u64))
+ luo_restore_fail("luo-session FDT missing or invalid 'pgcnt'\n");
+ pgcnt = be64_to_cpup(prop);
+
+ if (!count)
+ return;
+
+ guard(rwsem_write)(&luo_session_global.rwsem);
+ luo_session_global.fdt = fdt;
+ luo_session_global.ser = __va(data_pa);
+ luo_session_global.ser_count = count;
+ luo_session_global.pgcnt = pgcnt;
+}
+
+static const struct liveupdate_subsystem_ops luo_session_subsys_ops = {
+ .prepare = luo_session_prepare,
+ .freeze = luo_session_freeze,
+ .cancel = luo_session_cancel,
+ .boot = luo_session_boot,
+ .finish = luo_session_finish,
+ .owner = THIS_MODULE,
+};
+
+static struct liveupdate_subsystem luo_session_subsys = {
+ .ops = &luo_session_subsys_ops,
+ .name = LUO_SESSION_COMPATIBLE,
+};
+
+static int __init luo_session_startup(void)
+{
+ int ret;
+
+ if (!liveupdate_enabled())
+ return 0;
+
+ init_rwsem(&luo_session_global.rwsem);
+ INIT_LIST_HEAD(&luo_session_global.list);
+
+ ret = liveupdate_register_subsystem(&luo_session_subsys);
+ if (ret) {
+ pr_warn("Failed to register luo_session subsystem [%d]\n", ret);
+ return ret;
+ }
+
+ return ret;
+}
+late_initcall(luo_session_startup);
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 23/30] mm: shmem: export some functions to internal.h
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
From: Pratyush Yadav <ptyadav@amazon.de>
shmem_inode_acct_blocks(), shmem_recalc_inode(), and
shmem_add_to_page_cache() are used by shmem_alloc_and_add_folio(). This
functionality will also be used in the future by Live Update
Orchestrator (LUO) to recreate memfd files after a live update.
Signed-off-by: Pratyush Yadav <ptyadav@amazon.de>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
mm/internal.h | 6 ++++++
mm/shmem.c | 10 +++++-----
2 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/mm/internal.h b/mm/internal.h
index 1561fc2ff5b8..4ba155524f80 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -1562,6 +1562,12 @@ void __meminit __init_page_from_nid(unsigned long pfn, int nid);
unsigned long shrink_slab(gfp_t gfp_mask, int nid, struct mem_cgroup *memcg,
int priority);
+int shmem_add_to_page_cache(struct folio *folio,
+ struct address_space *mapping,
+ pgoff_t index, void *expected, gfp_t gfp);
+int shmem_inode_acct_blocks(struct inode *inode, long pages);
+bool shmem_recalc_inode(struct inode *inode, long alloced, long swapped);
+
#ifdef CONFIG_SHRINKER_DEBUG
static inline __printf(2, 0) int shrinker_debugfs_name_alloc(
struct shrinker *shrinker, const char *fmt, va_list ap)
diff --git a/mm/shmem.c b/mm/shmem.c
index bd7d9afe5a27..4647a0b2831c 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -219,7 +219,7 @@ static inline void shmem_unacct_blocks(unsigned long flags, long pages)
vm_unacct_memory(pages * VM_ACCT(PAGE_SIZE));
}
-static int shmem_inode_acct_blocks(struct inode *inode, long pages)
+int shmem_inode_acct_blocks(struct inode *inode, long pages)
{
struct shmem_inode_info *info = SHMEM_I(inode);
struct shmem_sb_info *sbinfo = SHMEM_SB(inode->i_sb);
@@ -435,7 +435,7 @@ static void shmem_free_inode(struct super_block *sb, size_t freed_ispace)
*
* Return: true if swapped was incremented from 0, for shmem_writeout().
*/
-static bool shmem_recalc_inode(struct inode *inode, long alloced, long swapped)
+bool shmem_recalc_inode(struct inode *inode, long alloced, long swapped)
{
struct shmem_inode_info *info = SHMEM_I(inode);
bool first_swapped = false;
@@ -861,9 +861,9 @@ static void shmem_update_stats(struct folio *folio, int nr_pages)
/*
* Somewhat like filemap_add_folio, but error if expected item has gone.
*/
-static int shmem_add_to_page_cache(struct folio *folio,
- struct address_space *mapping,
- pgoff_t index, void *expected, gfp_t gfp)
+int shmem_add_to_page_cache(struct folio *folio,
+ struct address_space *mapping,
+ pgoff_t index, void *expected, gfp_t gfp)
{
XA_STATE_ORDER(xas, &mapping->i_pages, index, folio_order(folio));
unsigned long nr = folio_nr_pages(folio);
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 24/30] luo: allow preserving memfd
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
From: Pratyush Yadav <ptyadav@amazon.de>
The ability to preserve a memfd allows userspace to use KHO and LUO to
transfer its memory contents to the next kernel. This is useful in many
ways. For one, it can be used with IOMMUFD as the backing store for
IOMMU page tables. Preserving IOMMUFD is essential for performing a
hypervisor live update with passthrough devices. memfd support provides
the first building block for making that possible.
For another, applications with a large amount of memory that takes time
to reconstruct, reboots to consume kernel upgrades can be very
expensive. memfd with LUO gives those applications reboot-persistent
memory that they can use to quickly save and reconstruct that state.
While memfd is backed by either hugetlbfs or shmem, currently only
support on shmem is added. To be more precise, support for anonymous
shmem files is added.
The handover to the next kernel is not transparent. All the properties
of the file are not preserved; only its memory contents, position, and
size. The recreated file gets the UID and GID of the task doing the
restore, and the task's cgroup gets charged with the memory.
After LUO is in prepared state, the file cannot grow or shrink, and all
its pages are pinned to avoid migrations and swapping. The file can
still be read from or written to.
Co-developed-by: Changyuan Lyu <changyuanl@google.com>
Signed-off-by: Changyuan Lyu <changyuanl@google.com>
Co-developed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Signed-off-by: Pratyush Yadav <ptyadav@amazon.de>
---
MAINTAINERS | 2 +
mm/Makefile | 1 +
mm/memfd_luo.c | 523 +++++++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 526 insertions(+)
create mode 100644 mm/memfd_luo.c
diff --git a/MAINTAINERS b/MAINTAINERS
index e99af6101d3c..a17e4e077174 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -14433,6 +14433,7 @@ F: tools/testing/selftests/livepatch/
LIVE UPDATE
M: Pasha Tatashin <pasha.tatashin@soleen.com>
+R: Pratyush Yadav <pratyush@kernel.org>
L: linux-kernel@vger.kernel.org
S: Maintained
F: Documentation/ABI/testing/sysfs-kernel-liveupdate
@@ -14441,6 +14442,7 @@ F: Documentation/userspace-api/liveupdate.rst
F: include/linux/liveupdate.h
F: include/uapi/linux/liveupdate.h
F: kernel/liveupdate/
+F: mm/memfd_luo.c
F: tools/testing/selftests/liveupdate/
LLC (802.2)
diff --git a/mm/Makefile b/mm/Makefile
index 21abb3353550..7738ec416f00 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -100,6 +100,7 @@ obj-$(CONFIG_NUMA) += memory-tiers.o
obj-$(CONFIG_DEVICE_MIGRATION) += migrate_device.o
obj-$(CONFIG_TRANSPARENT_HUGEPAGE) += huge_memory.o khugepaged.o
obj-$(CONFIG_PAGE_COUNTER) += page_counter.o
+obj-$(CONFIG_LIVEUPDATE) += memfd_luo.o
obj-$(CONFIG_MEMCG_V1) += memcontrol-v1.o
obj-$(CONFIG_MEMCG) += memcontrol.o vmpressure.o
ifdef CONFIG_SWAP
diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
new file mode 100644
index 000000000000..221e31c1197e
--- /dev/null
+++ b/mm/memfd_luo.c
@@ -0,0 +1,523 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright (c) 2025, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ * Changyuan Lyu <changyuanl@google.com>
+ *
+ * Copyright (C) 2025 Amazon.com Inc. or its affiliates.
+ * Pratyush Yadav <ptyadav@amazon.de>
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/file.h>
+#include <linux/io.h>
+#include <linux/libfdt.h>
+#include <linux/liveupdate.h>
+#include <linux/kexec_handover.h>
+#include <linux/shmem_fs.h>
+#include <linux/bits.h>
+#include "internal.h"
+
+#define PRESERVED_PFN_MASK GENMASK(63, 12)
+#define PRESERVED_PFN_SHIFT 12
+#define PRESERVED_FLAG_DIRTY BIT(0)
+#define PRESERVED_FLAG_UPTODATE BIT(1)
+
+#define PRESERVED_FOLIO_PFN(desc) (((desc) & PRESERVED_PFN_MASK) >> PRESERVED_PFN_SHIFT)
+#define PRESERVED_FOLIO_FLAGS(desc) ((desc) & ~PRESERVED_PFN_MASK)
+#define PRESERVED_FOLIO_MKDESC(pfn, flags) (((pfn) << PRESERVED_PFN_SHIFT) | (flags))
+
+struct memfd_luo_preserved_folio {
+ /*
+ * The folio descriptor is made of 2 parts. The bottom 12 bits are used
+ * for storing flags, the others for storing the PFN.
+ */
+ u64 foliodesc;
+ u64 index;
+};
+
+static int memfd_luo_preserve_folios(struct memfd_luo_preserved_folio *pfolios,
+ struct folio **folios,
+ unsigned int nr_folios)
+{
+ int err;
+ long i;
+
+ for (i = 0; i < nr_folios; i++) {
+ struct memfd_luo_preserved_folio *pfolio = &pfolios[i];
+ struct folio *folio = folios[i];
+ unsigned int flags = 0;
+ unsigned long pfn;
+
+ err = kho_preserve_folio(folio);
+ if (err)
+ goto err_unpreserve;
+
+ pfn = folio_pfn(folio);
+ if (folio_test_dirty(folio))
+ flags |= PRESERVED_FLAG_DIRTY;
+ if (folio_test_uptodate(folio))
+ flags |= PRESERVED_FLAG_UPTODATE;
+
+ pfolio->foliodesc = PRESERVED_FOLIO_MKDESC(pfn, flags);
+ pfolio->index = folio->index;
+ }
+
+ return 0;
+
+err_unpreserve:
+ i--;
+ for (; i >= 0; i--)
+ WARN_ON_ONCE(kho_unpreserve_folio(folios[i]));
+ return err;
+}
+
+static void memfd_luo_unpreserve_folios(const struct memfd_luo_preserved_folio *pfolios,
+ unsigned int nr_folios)
+{
+ unsigned int i;
+
+ for (i = 0; i < nr_folios; i++) {
+ const struct memfd_luo_preserved_folio *pfolio = &pfolios[i];
+ struct folio *folio;
+
+ if (!pfolio->foliodesc)
+ continue;
+
+ folio = pfn_folio(PRESERVED_FOLIO_PFN(pfolio->foliodesc));
+
+ WARN_ON_ONCE(kho_unpreserve_folio(folio));
+ unpin_folio(folio);
+ }
+}
+
+static void *memfd_luo_create_fdt(unsigned long size)
+{
+ unsigned int order = get_order(size);
+ struct folio *fdt_folio;
+ int err = 0;
+ void *fdt;
+
+ if (order > MAX_PAGE_ORDER)
+ return NULL;
+
+ fdt_folio = folio_alloc(GFP_KERNEL | __GFP_ZERO, order);
+ if (!fdt_folio)
+ return NULL;
+
+ fdt = folio_address(fdt_folio);
+
+ err |= fdt_create(fdt, (1 << (order + PAGE_SHIFT)));
+ err |= fdt_finish_reservemap(fdt);
+ err |= fdt_begin_node(fdt, "");
+ if (err)
+ goto free;
+
+ return fdt;
+
+free:
+ folio_put(fdt_folio);
+ return NULL;
+}
+
+static int memfd_luo_finish_fdt(void *fdt)
+{
+ int err;
+
+ err = fdt_end_node(fdt);
+ if (err)
+ return err;
+
+ return fdt_finish(fdt);
+}
+
+static int memfd_luo_prepare(struct liveupdate_file_handler *handler,
+ struct file *file, u64 *data)
+{
+ struct memfd_luo_preserved_folio *preserved_folios;
+ struct inode *inode = file_inode(file);
+ unsigned int max_folios, nr_folios = 0;
+ int err = 0, preserved_size;
+ struct folio **folios;
+ long size, nr_pinned;
+ pgoff_t offset;
+ void *fdt;
+ u64 pos;
+
+ inode_lock(inode);
+ shmem_i_mapping_freeze(inode, true);
+
+ size = i_size_read(inode);
+ if ((PAGE_ALIGN(size) / PAGE_SIZE) > UINT_MAX) {
+ err = -E2BIG;
+ goto err_unlock;
+ }
+
+ /*
+ * Guess the number of folios based on inode size. Real number might end
+ * up being smaller if there are higher order folios.
+ */
+ max_folios = PAGE_ALIGN(size) / PAGE_SIZE;
+ folios = kvmalloc_array(max_folios, sizeof(*folios), GFP_KERNEL);
+ if (!folios) {
+ err = -ENOMEM;
+ goto err_unfreeze;
+ }
+
+ /*
+ * Pin the folios so they don't move around behind our back. This also
+ * ensures none of the folios are in CMA -- which ensures they don't
+ * fall in KHO scratch memory. It also moves swapped out folios back to
+ * memory.
+ *
+ * A side effect of doing this is that it allocates a folio for all
+ * indices in the file. This might waste memory on sparse memfds. If
+ * that is really a problem in the future, we can have a
+ * memfd_pin_folios() variant that does not allocate a page on empty
+ * slots.
+ */
+ nr_pinned = memfd_pin_folios(file, 0, size - 1, folios, max_folios,
+ &offset);
+ if (nr_pinned < 0) {
+ err = nr_pinned;
+ pr_err("failed to pin folios: %d\n", err);
+ goto err_free_folios;
+ }
+ /* nr_pinned won't be more than max_folios which is also unsigned int. */
+ nr_folios = (unsigned int)nr_pinned;
+
+ preserved_size = sizeof(struct memfd_luo_preserved_folio) * nr_folios;
+ if (check_mul_overflow(sizeof(struct memfd_luo_preserved_folio),
+ nr_folios, &preserved_size)) {
+ err = -E2BIG;
+ goto err_unpin;
+ }
+
+ /*
+ * Most of the space should be taken by preserved folios. So take its
+ * size, plus a page for other properties.
+ */
+ fdt = memfd_luo_create_fdt(PAGE_ALIGN(preserved_size) + PAGE_SIZE);
+ if (!fdt) {
+ err = -ENOMEM;
+ goto err_unpin;
+ }
+
+ pos = file->f_pos;
+ err = fdt_property(fdt, "pos", &pos, sizeof(pos));
+ if (err)
+ goto err_free_fdt;
+
+ err = fdt_property(fdt, "size", &size, sizeof(size));
+ if (err)
+ goto err_free_fdt;
+
+ err = fdt_property_placeholder(fdt, "folios", preserved_size,
+ (void **)&preserved_folios);
+ if (err) {
+ pr_err("Failed to reserve folios property in FDT: %s\n",
+ fdt_strerror(err));
+ err = -ENOMEM;
+ goto err_free_fdt;
+ }
+
+ err = memfd_luo_preserve_folios(preserved_folios, folios, nr_folios);
+ if (err)
+ goto err_free_fdt;
+
+ err = memfd_luo_finish_fdt(fdt);
+ if (err)
+ goto err_unpreserve;
+
+ err = kho_preserve_folio(virt_to_folio(fdt));
+ if (err)
+ goto err_unpreserve;
+
+ kvfree(folios);
+ inode_unlock(inode);
+
+ *data = virt_to_phys(fdt);
+ return 0;
+
+err_unpreserve:
+ memfd_luo_unpreserve_folios(preserved_folios, nr_folios);
+err_free_fdt:
+ folio_put(virt_to_folio(fdt));
+err_unpin:
+ unpin_folios(folios, nr_pinned);
+err_free_folios:
+ kvfree(folios);
+err_unfreeze:
+ shmem_i_mapping_freeze(inode, false);
+err_unlock:
+ inode_unlock(inode);
+ return err;
+}
+
+static int memfd_luo_freeze(struct liveupdate_file_handler *handler,
+ struct file *file, u64 *data)
+{
+ u64 pos = file->f_pos;
+ void *fdt;
+ int err;
+
+ if (WARN_ON_ONCE(!*data))
+ return -EINVAL;
+
+ fdt = phys_to_virt(*data);
+
+ /*
+ * The pos might have changed since prepare. Everything else stays the
+ * same.
+ */
+ err = fdt_setprop(fdt, 0, "pos", &pos, sizeof(pos));
+ if (err)
+ return err;
+
+ return 0;
+}
+
+static void memfd_luo_cancel(struct liveupdate_file_handler *handler,
+ struct file *file, u64 data)
+{
+ const struct memfd_luo_preserved_folio *pfolios;
+ struct inode *inode = file_inode(file);
+ struct folio *fdt_folio;
+ void *fdt;
+ int len;
+
+ if (WARN_ON_ONCE(!data))
+ return;
+
+ inode_lock(inode);
+ shmem_i_mapping_freeze(inode, false);
+
+ fdt = phys_to_virt(data);
+ fdt_folio = virt_to_folio(fdt);
+ pfolios = fdt_getprop(fdt, 0, "folios", &len);
+ if (pfolios)
+ memfd_luo_unpreserve_folios(pfolios, len / sizeof(*pfolios));
+
+ kho_unpreserve_folio(fdt_folio);
+ folio_put(fdt_folio);
+ inode_unlock(inode);
+}
+
+static struct folio *memfd_luo_get_fdt(u64 data)
+{
+ return kho_restore_folio((phys_addr_t)data);
+}
+
+static void memfd_luo_discard_folios(const struct memfd_luo_preserved_folio *pfolios,
+ unsigned int nr_folios)
+{
+ unsigned int i;
+
+ for (i = 0; i < nr_folios; i++) {
+ const struct memfd_luo_preserved_folio *pfolio = &pfolios[i];
+ struct folio *folio;
+ phys_addr_t phys;
+
+ if (!pfolio->foliodesc)
+ continue;
+
+ phys = PFN_PHYS(PRESERVED_FOLIO_PFN(pfolio->foliodesc));
+ folio = kho_restore_folio(phys);
+ if (!folio) {
+ pr_warn_ratelimited("Unable to restore folio at physical address: %llx\n",
+ phys);
+ continue;
+ }
+
+ folio_put(folio);
+ }
+}
+
+static void memfd_luo_finish(struct liveupdate_file_handler *handler,
+ struct file *file, u64 data, bool reclaimed)
+{
+ const struct memfd_luo_preserved_folio *pfolios;
+ struct folio *fdt_folio;
+ int len;
+
+ if (reclaimed)
+ return;
+
+ fdt_folio = memfd_luo_get_fdt(data);
+
+ pfolios = fdt_getprop(folio_address(fdt_folio), 0, "folios", &len);
+ if (pfolios)
+ memfd_luo_discard_folios(pfolios, len / sizeof(*pfolios));
+
+ folio_put(fdt_folio);
+}
+
+static int memfd_luo_retrieve(struct liveupdate_file_handler *handler, u64 data,
+ struct file **file_p)
+{
+ const struct memfd_luo_preserved_folio *pfolios;
+ int nr_pfolios, len, ret = 0, i = 0;
+ struct address_space *mapping;
+ struct folio *folio, *fdt_folio;
+ const u64 *pos, *size;
+ struct inode *inode;
+ struct file *file;
+ const void *fdt;
+
+ fdt_folio = memfd_luo_get_fdt(data);
+ if (!fdt_folio)
+ return -ENOENT;
+
+ fdt = page_to_virt(folio_page(fdt_folio, 0));
+
+ pfolios = fdt_getprop(fdt, 0, "folios", &len);
+ if (!pfolios || len % sizeof(*pfolios)) {
+ pr_err("invalid 'folios' property\n");
+ ret = -EINVAL;
+ goto put_fdt;
+ }
+ nr_pfolios = len / sizeof(*pfolios);
+
+ size = fdt_getprop(fdt, 0, "size", &len);
+ if (!size || len != sizeof(u64)) {
+ pr_err("invalid 'size' property\n");
+ ret = -EINVAL;
+ goto put_folios;
+ }
+
+ pos = fdt_getprop(fdt, 0, "pos", &len);
+ if (!pos || len != sizeof(u64)) {
+ pr_err("invalid 'pos' property\n");
+ ret = -EINVAL;
+ goto put_folios;
+ }
+
+ file = shmem_file_setup("", 0, VM_NORESERVE);
+
+ if (IS_ERR(file)) {
+ ret = PTR_ERR(file);
+ pr_err("failed to setup file: %d\n", ret);
+ goto put_folios;
+ }
+
+ inode = file->f_inode;
+ mapping = inode->i_mapping;
+ vfs_setpos(file, *pos, MAX_LFS_FILESIZE);
+
+ for (; i < nr_pfolios; i++) {
+ const struct memfd_luo_preserved_folio *pfolio = &pfolios[i];
+ phys_addr_t phys;
+ u64 index;
+ int flags;
+
+ if (!pfolio->foliodesc)
+ continue;
+
+ phys = PFN_PHYS(PRESERVED_FOLIO_PFN(pfolio->foliodesc));
+ folio = kho_restore_folio(phys);
+ if (!folio) {
+ pr_err("Unable to restore folio at physical address: %llx\n",
+ phys);
+ goto put_file;
+ }
+ index = pfolio->index;
+ flags = PRESERVED_FOLIO_FLAGS(pfolio->foliodesc);
+
+ /* Set up the folio for insertion. */
+ __folio_set_locked(folio);
+ __folio_set_swapbacked(folio);
+
+ ret = mem_cgroup_charge(folio, NULL, mapping_gfp_mask(mapping));
+ if (ret) {
+ pr_err("shmem: failed to charge folio index %d: %d\n",
+ i, ret);
+ goto unlock_folio;
+ }
+
+ ret = shmem_add_to_page_cache(folio, mapping, index, NULL,
+ mapping_gfp_mask(mapping));
+ if (ret) {
+ pr_err("shmem: failed to add to page cache folio index %d: %d\n",
+ i, ret);
+ goto unlock_folio;
+ }
+
+ if (flags & PRESERVED_FLAG_UPTODATE)
+ folio_mark_uptodate(folio);
+ if (flags & PRESERVED_FLAG_DIRTY)
+ folio_mark_dirty(folio);
+
+ ret = shmem_inode_acct_blocks(inode, 1);
+ if (ret) {
+ pr_err("shmem: failed to account folio index %d: %d\n",
+ i, ret);
+ goto unlock_folio;
+ }
+
+ shmem_recalc_inode(inode, 1, 0);
+ folio_add_lru(folio);
+ folio_unlock(folio);
+ folio_put(folio);
+ }
+
+ inode->i_size = *size;
+ *file_p = file;
+ folio_put(fdt_folio);
+ return 0;
+
+unlock_folio:
+ folio_unlock(folio);
+ folio_put(folio);
+put_file:
+ fput(file);
+ i++;
+put_folios:
+ for (; i < nr_pfolios; i++) {
+ const struct memfd_luo_preserved_folio *pfolio = &pfolios[i];
+
+ folio = kho_restore_folio(PRESERVED_FOLIO_PFN(pfolio->foliodesc));
+ if (folio)
+ folio_put(folio);
+ }
+
+put_fdt:
+ folio_put(fdt_folio);
+ return ret;
+}
+
+static bool memfd_luo_can_preserve(struct liveupdate_file_handler *handler,
+ struct file *file)
+{
+ struct inode *inode = file_inode(file);
+
+ return shmem_file(file) && !inode->i_nlink;
+}
+
+static const struct liveupdate_file_ops memfd_luo_file_ops = {
+ .prepare = memfd_luo_prepare,
+ .freeze = memfd_luo_freeze,
+ .cancel = memfd_luo_cancel,
+ .finish = memfd_luo_finish,
+ .retrieve = memfd_luo_retrieve,
+ .can_preserve = memfd_luo_can_preserve,
+ .owner = THIS_MODULE,
+};
+
+static struct liveupdate_file_handler memfd_luo_handler = {
+ .ops = &memfd_luo_file_ops,
+ .compatible = "memfd-v1",
+};
+
+static int __init memfd_luo_init(void)
+{
+ int err;
+
+ err = liveupdate_register_file_handler(&memfd_luo_handler);
+ if (err)
+ pr_err("Could not register luo filesystem handler: %d\n", err);
+
+ return err;
+}
+late_initcall(memfd_luo_init);
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 25/30] docs: add documentation for memfd preservation via LUO
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
From: Pratyush Yadav <ptyadav@amazon.de>
Add the documentation under the "Preserving file descriptors" section of
LUO's documentation. The doc describes the properties preserved,
behaviour of the file under different LUO states, serialization format,
and current limitations.
Signed-off-by: Pratyush Yadav <ptyadav@amazon.de>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
Documentation/core-api/liveupdate.rst | 7 ++
Documentation/mm/index.rst | 1 +
Documentation/mm/memfd_preservation.rst | 138 ++++++++++++++++++++++++
MAINTAINERS | 1 +
4 files changed, 147 insertions(+)
create mode 100644 Documentation/mm/memfd_preservation.rst
diff --git a/Documentation/core-api/liveupdate.rst b/Documentation/core-api/liveupdate.rst
index 7c1c3af6f960..b44710d75088 100644
--- a/Documentation/core-api/liveupdate.rst
+++ b/Documentation/core-api/liveupdate.rst
@@ -23,6 +23,13 @@ LUO Preserving File Descriptors
.. kernel-doc:: kernel/liveupdate/luo_file.c
:doc: LUO file descriptors
+The following types of file descriptors can be preserved
+
+.. toctree::
+ :maxdepth: 1
+
+ ../mm/memfd_preservation
+
Public API
==========
.. kernel-doc:: include/linux/liveupdate.h
diff --git a/Documentation/mm/index.rst b/Documentation/mm/index.rst
index ba6a8872849b..7aa2a8886908 100644
--- a/Documentation/mm/index.rst
+++ b/Documentation/mm/index.rst
@@ -48,6 +48,7 @@ documentation, or deleted if it has served its purpose.
hugetlbfs_reserv
ksm
memory-model
+ memfd_preservation
mmu_notifier
multigen_lru
numa
diff --git a/Documentation/mm/memfd_preservation.rst b/Documentation/mm/memfd_preservation.rst
new file mode 100644
index 000000000000..3fc612e1288c
--- /dev/null
+++ b/Documentation/mm/memfd_preservation.rst
@@ -0,0 +1,138 @@
+.. SPDX-License-Identifier: GPL-2.0-or-later
+
+==========================
+Memfd Preservation via LUO
+==========================
+
+Overview
+========
+
+Memory file descriptors (memfd) can be preserved over a kexec using the Live
+Update Orchestrator (LUO) file preservation. This allows userspace to transfer
+its memory contents to the next kernel after a kexec.
+
+The preservation is not intended to be transparent. Only select properties of
+the file are preserved. All others are reset to default. The preserved
+properties are described below.
+
+.. note::
+ The LUO API is not stabilized yet, so the preserved properties of a memfd are
+ also not stable and are subject to backwards incompatible changes.
+
+.. note::
+ Currently a memfd backed by Hugetlb is not supported. Memfds created
+ with ``MFD_HUGETLB`` will be rejected.
+
+Preserved Properties
+====================
+
+The following properties of the memfd are preserved across kexec:
+
+File Contents
+ All data stored in the file is preserved.
+
+File Size
+ The size of the file is preserved. Holes in the file are filled by allocating
+ pages for them during preservation.
+
+File Position
+ The current file position is preserved, allowing applications to continue
+ reading/writing from their last position.
+
+File Status Flags
+ memfds are always opened with ``O_RDWR`` and ``O_LARGEFILE``. This property is
+ maintained.
+
+Non-Preserved Properties
+========================
+
+All properties which are not preserved must be assumed to be reset to default.
+This section describes some of those properties which may be more of note.
+
+``FD_CLOEXEC`` flag
+ A memfd can be created with the ``MFD_CLOEXEC`` flag that sets the
+ ``FD_CLOEXEC`` on the file. This flag is not preserved and must be set again
+ after restore via ``fcntl()``.
+
+Seals
+ File seals are not preserved. The file is unsealed on restore and if needed,
+ must be sealed again via ``fcntl()``.
+
+Behavior with LUO states
+========================
+
+This section described the behavior of the memfd in the different LUO states.
+
+Normal Phase
+ During the normal phase, the memfd can be marked for preservation using the
+ ``LIVEUPDATE_SESSION_PRESERVE_FD`` ioctl. The memfd acts as a regular memfd
+ during this phase with no additional restrictions.
+
+Prepared Phase
+ After LUO enters ``LIVEUPDATE_STATE_PREPARED``, the memfd is serialized and
+ prepared for the next kernel. During this phase, the below things happen:
+
+ - All the folios are pinned. If some folios reside in ``ZONE_MIGRATE``, they
+ are migrated out. This ensures none of the preserved folios land in KHO
+ scratch area.
+ - Pages in swap are swapped in. Currently, there is no way to pass pages in
+ swap over KHO, so all swapped out pages are swapped back in and pinned.
+ - The memfd goes into "frozen mapping" mode. The file can no longer grow or
+ shrink, or punch holes. This ensures the serialized mappings stay in sync.
+ The file can still be read from or written to or mmap-ed.
+
+Freeze Phase
+ Updates the current file position in the serialized data to capture any
+ changes that occurred between prepare and freeze phases. After this, the FD is
+ not allowed to be accessed.
+
+Restoration Phase
+ After being restored, the memfd is functional as normal with the properties
+ listed above restored.
+
+Cancellation
+ If the liveupdate is cancelled after going into prepared phase, the memfd
+ functions like in normal phase.
+
+Serialization format
+====================
+
+The state is serialized in an FDT with the following structure::
+
+ /dts-v1/;
+
+ / {
+ compatible = "memfd-v1";
+ pos = <current_file_position>;
+ size = <file_size_in_bytes>;
+ folios = <array_of_preserved_folio_descriptors>;
+ };
+
+Each folio descriptor contains:
+
+- PFN + flags (8 bytes)
+
+ - Physical frame number (PFN) of the preserved folio (bits 63:12).
+ - Folio flags (bits 11:0):
+
+ - ``PRESERVED_FLAG_DIRTY`` (bit 0)
+ - ``PRESERVED_FLAG_UPTODATE`` (bit 1)
+
+- Folio index within the file (8 bytes).
+
+Limitations
+===========
+
+The current implementation has the following limitations:
+
+Size
+ Currently the size of the file is limited by the size of the FDT. The FDT can
+ be at of most ``MAX_PAGE_ORDER`` order. By default this is 4 MiB with 4K
+ pages. Each page in the file is tracked using 16 bytes. This limits the
+ maximum size of the file to 1 GiB.
+
+See Also
+========
+
+- :doc:`Live Update Orchestrator </core-api/liveupdate>`
+- :doc:`/core-api/kho/concepts`
diff --git a/MAINTAINERS b/MAINTAINERS
index a17e4e077174..a9941e920ef6 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -14438,6 +14438,7 @@ L: linux-kernel@vger.kernel.org
S: Maintained
F: Documentation/ABI/testing/sysfs-kernel-liveupdate
F: Documentation/core-api/liveupdate.rst
+F: Documentation/mm/memfd_preservation.rst
F: Documentation/userspace-api/liveupdate.rst
F: include/linux/liveupdate.h
F: include/uapi/linux/liveupdate.h
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 26/30] selftests/liveupdate: Add multi-kexec session lifecycle test
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Introduce multi-stage selftest, luo_multi_kexec, to validate the
end-to-end lifecycle of Live Update Orchestrator sessions
across multiple kexec reboots.
The test operates in three stages, using a preserved memfd within a
dedicated "state_session" to track its progress across reboots. This
avoids reliance on filesystem flags and tests the core preservation
mechanism itself.
The test validates the following critical LUO functionalities:
1. Initial Preservation (Stage 1 -> 2):
- Creates multiple sessions (session-A, session-B, session-C) and
populates them with memfd files containing unique data.
- Triggers a global LIVEUPDATE_PREPARE event and executes the first
kexec.
2. Intermediate State Management (Stage 2 -> 3):
- After the first reboot, it verifies that all sessions were correctly
preserved.
- It then tests divergent session lifecycles:
- Session A: Is retrieved and explicitly finalized with a
per-session LIVEUPDATE_FINISH event. This validates that a finished
session is not carried over to the next kexec.
- Session B: Is retrieved but left open. This validates that an
active, retrieved session is correctly re-preserved during the next
global PREPARE.
- Session C: Is deliberately not retrieved. This validates that the
global LIVEUPDATE_FINISH event correctly identifies and cleans up
stale, unreclaimed sessions.
- The state-tracking memfd is updated by un-preserving and re-preserving
it, testing in-place modification of a session's contents.
- A global FINISH followed by a global PREPARE is triggered before the
second kexec.
3. Final Verification (Stage 3):
- After the second reboot, it confirms the final state:
- Asserts that session-B (the re-preserved session) and the updated
state session have survived.
- Asserts that session-A (explicitly finished) and session-C
(unreclaimed) were correctly cleaned up and no longer exist.
Example output:
root@debian-vm:~/liveupdate$ ./luo_multi_kexec
LUO state is NORMAL. Starting Stage 1.
[STAGE 1] Creating state file for next stage (2)...
[STAGE 1] Setting up Sessions A, B, C for first kexec...
- Session 'session-A' created.
- Session 'session-B' created.
- Session 'session-C' created.
[STAGE 1] Triggering global PREPARE...
[STAGE 1] Executing kexec...
<---- cut reboot messages ---->
Debian GNU/Linux 12 debian-vm ttyS0
debian-vm login: root (automatic login)
root@debian-vm:~$ cd liveupdate/
root@debian-vm:~/liveupdate$ ./luo_multi_kexec
LUO state is UPDATED. Restoring state to determine stage...
State file indicates we are entering Stage 2.
[STAGE 2] Partially reclaiming and preparing for second kexec...
- Verifying session 'session-A'...
Success. All files verified.
- Verifying session 'session-B'...
Success. All files verified.
- Finishing state session to allow modification...
- Updating state file for next stage (3)...
- Session A verified. Sending per-session FINISH.
- Session B verified. Keeping FD open for next kexec.
- NOT retrieving Session C to test global finish cleanup.
[STAGE 2] Triggering global FINISH...
[STAGE 2] Triggering global PREPARE for next kexec...
[STAGE 2] Executing second kexec...
<---- cut reboot messages ---->
Debian GNU/Linux 12 debian-vm ttyS0
debian-vm login: root (automatic login)
root@debian-vm:~$ cd liveupdate/
root@debian-vm:~/liveupdate$ ./luo_multi_kexec
LUO state is UPDATED. Restoring state to determine stage...
State file indicates we are entering Stage 3.
[STAGE 3] Final verification...
[STAGE 3] Verifying surviving sessions...
- Verifying session 'session-B'...
Success. All files verified.
[STAGE 3] Verifying Session A was cleaned up...
Success. Session A not found as expected.
[STAGE 3] Verifying Session C was cleaned up...
Success. Session C not found as expected.
[STAGE 3] Triggering final global FINISH...
--- TEST PASSED ---
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
tools/testing/selftests/liveupdate/.gitignore | 1 +
tools/testing/selftests/liveupdate/Makefile | 31 +++
.../testing/selftests/liveupdate/do_kexec.sh | 6 +
.../selftests/liveupdate/luo_multi_kexec.c | 182 +++++++++++++
.../selftests/liveupdate/luo_test_utils.c | 241 ++++++++++++++++++
.../selftests/liveupdate/luo_test_utils.h | 51 ++++
6 files changed, 512 insertions(+)
create mode 100755 tools/testing/selftests/liveupdate/do_kexec.sh
create mode 100644 tools/testing/selftests/liveupdate/luo_multi_kexec.c
create mode 100644 tools/testing/selftests/liveupdate/luo_test_utils.c
create mode 100644 tools/testing/selftests/liveupdate/luo_test_utils.h
diff --git a/tools/testing/selftests/liveupdate/.gitignore b/tools/testing/selftests/liveupdate/.gitignore
index af6e773cf98f..de7ca45d3892 100644
--- a/tools/testing/selftests/liveupdate/.gitignore
+++ b/tools/testing/selftests/liveupdate/.gitignore
@@ -1 +1,2 @@
/liveupdate
+/luo_multi_kexec
diff --git a/tools/testing/selftests/liveupdate/Makefile b/tools/testing/selftests/liveupdate/Makefile
index 2a573c36016e..1cbc816ed5c5 100644
--- a/tools/testing/selftests/liveupdate/Makefile
+++ b/tools/testing/selftests/liveupdate/Makefile
@@ -1,7 +1,38 @@
# SPDX-License-Identifier: GPL-2.0-only
+
+KHDR_INCLUDES ?= -I../../../usr/include
CFLAGS += -Wall -O2 -Wno-unused-function
CFLAGS += $(KHDR_INCLUDES)
+LDFLAGS += -static
+
+# --- Test Configuration (Edit this section when adding new tests) ---
+LUO_SHARED_SRCS := luo_test_utils.c
+LUO_SHARED_HDRS += luo_test_utils.h
+
+LUO_MANUAL_TESTS += luo_multi_kexec
+
+TEST_FILES += do_kexec.sh
TEST_GEN_PROGS += liveupdate
+# --- Automatic Rule Generation (Do not edit below) ---
+
+TEST_GEN_PROGS_EXTENDED += $(LUO_MANUAL_TESTS)
+
+# Define the full list of sources for each manual test.
+$(foreach test,$(LUO_MANUAL_TESTS), \
+ $(eval $(test)_SOURCES := $(test).c $(LUO_SHARED_SRCS)))
+
+# This loop automatically generates an explicit build rule for each manual test.
+# It includes dependencies on the shared headers and makes the output
+# executable.
+# Note the use of '$$' to escape automatic variables for the 'eval' command.
+$(foreach test,$(LUO_MANUAL_TESTS), \
+ $(eval $(OUTPUT)/$(test): $($(test)_SOURCES) $(LUO_SHARED_HDRS) \
+ $(call msg,LINK,,$$@) ; \
+ $(Q)$(LINK.c) $$^ $(LDLIBS) -o $$@ ; \
+ $(Q)chmod +x $$@ \
+ ) \
+)
+
include ../lib.mk
diff --git a/tools/testing/selftests/liveupdate/do_kexec.sh b/tools/testing/selftests/liveupdate/do_kexec.sh
new file mode 100755
index 000000000000..bb396a92c3b8
--- /dev/null
+++ b/tools/testing/selftests/liveupdate/do_kexec.sh
@@ -0,0 +1,6 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+set -e
+
+kexec -l -s --reuse-cmdline /boot/bzImage
+kexec -e
diff --git a/tools/testing/selftests/liveupdate/luo_multi_kexec.c b/tools/testing/selftests/liveupdate/luo_multi_kexec.c
new file mode 100644
index 000000000000..1f350990ee67
--- /dev/null
+++ b/tools/testing/selftests/liveupdate/luo_multi_kexec.c
@@ -0,0 +1,182 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+/*
+ * Copyright (c) 2025, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+#include "luo_test_utils.h"
+
+#define KEXEC_SCRIPT "./do_kexec.sh"
+
+#define NUM_SESSIONS 3
+
+/* Helper to set up one session and all its files */
+static void setup_session(int luo_fd, struct session_info *s, int session_idx)
+{
+ int i;
+
+ snprintf(s->name, sizeof(s->name), "session-%c", 'A' + session_idx);
+
+ s->fd = luo_create_session(luo_fd, s->name);
+ if (s->fd < 0)
+ fail_exit("luo_create_session for %s", s->name);
+
+ for (i = 0; i < 2; i++) {
+ s->file_tokens[i] = (session_idx * 100) + i;
+ snprintf(s->file_data[i], sizeof(s->file_data[i]),
+ "Data for %.*s-File%d",
+ (int)sizeof(s->name), s->name, i);
+
+ if (create_and_preserve_memfd(s->fd, s->file_tokens[i],
+ s->file_data[i]) < 0)
+ fail_exit("create_and_preserve_memfd for token %d",
+ s->file_tokens[i]);
+ }
+}
+
+/* Run before the first kexec */
+static void run_stage_1(int luo_fd)
+{
+ struct session_info sessions[NUM_SESSIONS] = {0};
+ int i;
+
+ ksft_print_msg("[STAGE 1] Creating state file for next stage (2)...\n");
+ create_state_file(luo_fd, 2);
+
+ ksft_print_msg("[STAGE 1] Setting up Sessions A, B, C for first kexec...\n");
+ for (i = 0; i < NUM_SESSIONS; i++) {
+ setup_session(luo_fd, &sessions[i], i);
+ ksft_print_msg(" - Session '%s' created.\n", sessions[i].name);
+ }
+
+ ksft_print_msg("[STAGE 1] Triggering global PREPARE...\n");
+ if (luo_set_global_event(luo_fd, LIVEUPDATE_PREPARE) < 0)
+ fail_exit("luo_set_global_event(PREPARE)");
+
+ ksft_print_msg("[STAGE 1] Executing kexec...\n");
+ if (system(KEXEC_SCRIPT) != 0)
+ fail_exit("kexec script failed");
+
+ /* Should not be reached */
+ sleep(10);
+ exit(EXIT_FAILURE);
+}
+
+/* Run after first kexec, before second kexec */
+static void run_stage_2(int luo_fd, int state_session_fd)
+{
+ struct session_info sessions[NUM_SESSIONS] = {0};
+ int session_fd_A;
+
+ ksft_print_msg("[STAGE 2] Partially reclaiming and preparing for second kexec...\n");
+
+ reinit_all_sessions(sessions, NUM_SESSIONS);
+
+ session_fd_A = verify_session_and_get_fd(luo_fd, &sessions[0]);
+ verify_session_and_get_fd(luo_fd, &sessions[1]);
+
+ ksft_print_msg(" - Finishing state session to allow modification...\n");
+ if (luo_set_session_event(state_session_fd, LIVEUPDATE_FINISH) < 0)
+ fail_exit("luo_set_session_event(FINISH) for state_session");
+
+ ksft_print_msg(" - Updating state file for next stage (3)...\n");
+ update_state_file(state_session_fd, 3);
+
+ ksft_print_msg(" - Session A verified. Sending per-session FINISH.\n");
+ if (luo_set_session_event(session_fd_A, LIVEUPDATE_FINISH) < 0)
+ fail_exit("luo_set_session_event(FINISH) for Session A");
+ close(session_fd_A);
+
+ ksft_print_msg(" - Session B verified. Its FD will be auto-closed for next kexec.\n");
+ ksft_print_msg(" - NOT retrieving Session C to test global finish cleanup.\n");
+
+ ksft_print_msg("[STAGE 2] Triggering global FINISH...\n");
+ if (luo_set_global_event(luo_fd, LIVEUPDATE_FINISH) < 0)
+ fail_exit("luo_set_global_event(FINISH)");
+
+ ksft_print_msg("[STAGE 2] Triggering global PREPARE for next kexec...\n");
+ if (luo_set_global_event(luo_fd, LIVEUPDATE_PREPARE) < 0)
+ fail_exit("luo_set_global_event(PREPARE)");
+
+ ksft_print_msg("[STAGE 2] Executing second kexec...\n");
+ if (system(KEXEC_SCRIPT) != 0)
+ fail_exit("kexec script failed");
+
+ sleep(10);
+ exit(EXIT_FAILURE);
+}
+
+/* Run after second kexec */
+static void run_stage_3(int luo_fd)
+{
+ struct session_info sessions[NUM_SESSIONS] = {0};
+ int ret;
+
+ ksft_print_msg("[STAGE 3] Final verification...\n");
+
+ reinit_all_sessions(sessions, NUM_SESSIONS);
+
+ ksft_print_msg("[STAGE 3] Verifying surviving sessions...\n");
+ /* Session B */
+ verify_session_and_get_fd(luo_fd, &sessions[1]);
+
+ ksft_print_msg("[STAGE 3] Verifying Session A was cleaned up...\n");
+ ret = luo_retrieve_session(luo_fd, sessions[0].name);
+ if (ret != -ENOENT)
+ fail_exit("Expected ENOENT for Session A, but got %d", ret);
+ ksft_print_msg(" Success. Session A not found as expected.\n");
+
+ ksft_print_msg("[STAGE 3] Verifying Session C was cleaned up...\n");
+ ret = luo_retrieve_session(luo_fd, sessions[2].name);
+ if (ret != -ENOENT)
+ fail_exit("Expected ENOENT for Session C, but got %d", ret);
+ ksft_print_msg(" Success. Session C not found as expected.\n");
+
+ ksft_print_msg("[STAGE 3] Triggering final global FINISH...\n");
+ if (luo_set_global_event(luo_fd, LIVEUPDATE_FINISH) < 0)
+ fail_exit("luo_set_global_event(FINISH)");
+
+ ksft_print_msg("\n--- MULTI-KEXEC TEST PASSED ---\n");
+}
+
+int main(int argc, char *argv[])
+{
+ enum liveupdate_state state;
+ int luo_fd, stage = 0;
+
+ luo_fd = luo_open_device();
+ if (luo_fd < 0) {
+ ksft_exit_skip("Failed to open %s. Is the luo module loaded?\n",
+ LUO_DEVICE);
+ }
+
+ if (luo_get_global_state(luo_fd, &state) < 0)
+ fail_exit("luo_get_global_state");
+
+ if (state == LIVEUPDATE_STATE_NORMAL) {
+ ksft_print_msg("LUO state is NORMAL. Starting Stage 1.\n");
+ run_stage_1(luo_fd);
+ } else if (state == LIVEUPDATE_STATE_UPDATED) {
+ int state_session_fd;
+
+ ksft_print_msg("LUO state is UPDATED. Restoring state to determine stage...\n");
+ state_session_fd = restore_and_read_state(luo_fd, &stage);
+ if (state_session_fd < 0)
+ fail_exit("Could not restore test state");
+
+ if (stage == 2) {
+ ksft_print_msg("State file indicates we are entering Stage 2.\n");
+ run_stage_2(luo_fd, state_session_fd);
+ } else if (stage == 3) {
+ ksft_print_msg("State file indicates we are entering Stage 3.\n");
+ run_stage_3(luo_fd);
+ } else {
+ fail_exit("Invalid stage found in state file: %d",
+ stage);
+ }
+ }
+
+ close(luo_fd);
+ ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/liveupdate/luo_test_utils.c b/tools/testing/selftests/liveupdate/luo_test_utils.c
new file mode 100644
index 000000000000..c0840e6e66fd
--- /dev/null
+++ b/tools/testing/selftests/liveupdate/luo_test_utils.c
@@ -0,0 +1,241 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+/*
+ * Copyright (c) 2025, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+#define _GNU_SOURCE
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+#include <sys/syscall.h>
+#include <sys/mman.h>
+#include <errno.h>
+#include <stdarg.h>
+
+#include "luo_test_utils.h"
+#include "../kselftest.h"
+
+/* The fail_exit function is now a macro in the header. */
+
+int luo_open_device(void)
+{
+ return open(LUO_DEVICE, O_RDWR);
+}
+
+int luo_create_session(int luo_fd, const char *name)
+{
+ struct liveupdate_ioctl_create_session arg = { .size = sizeof(arg) };
+
+ snprintf((char *)arg.name, LIVEUPDATE_SESSION_NAME_LENGTH, "%.*s",
+ LIVEUPDATE_SESSION_NAME_LENGTH - 1, name);
+ if (ioctl(luo_fd, LIVEUPDATE_IOCTL_CREATE_SESSION, &arg) < 0)
+ return -errno;
+ return arg.fd;
+}
+
+int luo_retrieve_session(int luo_fd, const char *name)
+{
+ struct liveupdate_ioctl_retrieve_session arg = { .size = sizeof(arg) };
+
+ snprintf((char *)arg.name, LIVEUPDATE_SESSION_NAME_LENGTH, "%.*s",
+ LIVEUPDATE_SESSION_NAME_LENGTH - 1, name);
+ if (ioctl(luo_fd, LIVEUPDATE_IOCTL_RETRIEVE_SESSION, &arg) < 0)
+ return -errno;
+ return arg.fd;
+}
+
+int create_and_preserve_memfd(int session_fd, int token, const char *data)
+{
+ struct liveupdate_session_preserve_fd arg = { .size = sizeof(arg) };
+ long page_size = sysconf(_SC_PAGE_SIZE);
+ void *map = MAP_FAILED;
+ int mfd = -1, ret = -1;
+
+ mfd = memfd_create("test_mfd", 0);
+ if (mfd < 0)
+ return -errno;
+
+ if (ftruncate(mfd, page_size) != 0)
+ goto out;
+
+ map = mmap(NULL, page_size, PROT_WRITE, MAP_SHARED, mfd, 0);
+ if (map == MAP_FAILED)
+ goto out;
+
+ snprintf(map, page_size, "%s", data);
+ munmap(map, page_size);
+
+ arg.fd = mfd;
+ arg.token = token;
+ if (ioctl(session_fd, LIVEUPDATE_SESSION_PRESERVE_FD, &arg) < 0)
+ goto out;
+
+ ret = 0; /* Success */
+out:
+ if (ret != 0 && errno != 0)
+ ret = -errno;
+ if (mfd >= 0)
+ close(mfd);
+ return ret;
+}
+
+int restore_and_verify_memfd(int session_fd, int token,
+ const char *expected_data)
+{
+ struct liveupdate_session_restore_fd arg = { .size = sizeof(arg) };
+ long page_size = sysconf(_SC_PAGE_SIZE);
+ void *map = MAP_FAILED;
+ int mfd = -1, ret = -1;
+
+ arg.token = token;
+ if (ioctl(session_fd, LIVEUPDATE_SESSION_RESTORE_FD, &arg) < 0)
+ return -errno;
+ mfd = arg.fd;
+
+ map = mmap(NULL, page_size, PROT_READ, MAP_SHARED, mfd, 0);
+ if (map == MAP_FAILED)
+ goto out;
+
+ if (expected_data && strcmp(expected_data, map) != 0) {
+ ksft_print_msg("Data mismatch for token %d!\n", token);
+ ret = -EINVAL;
+ goto out_munmap;
+ }
+
+ ret = mfd; /* Success, return the new fd */
+out_munmap:
+ munmap(map, page_size);
+out:
+ if (ret < 0 && errno != 0)
+ ret = -errno;
+ if (ret < 0 && mfd >= 0)
+ close(mfd);
+ return ret;
+}
+
+int luo_set_session_event(int session_fd, enum liveupdate_event event)
+{
+ struct liveupdate_session_set_event arg = { .size = sizeof(arg) };
+
+ arg.event = event;
+ return ioctl(session_fd, LIVEUPDATE_SESSION_SET_EVENT, &arg);
+}
+
+int luo_set_global_event(int luo_fd, enum liveupdate_event event)
+{
+ struct liveupdate_ioctl_set_event arg = { .size = sizeof(arg) };
+
+ arg.event = event;
+ return ioctl(luo_fd, LIVEUPDATE_IOCTL_SET_EVENT, &arg);
+}
+
+int luo_get_global_state(int luo_fd, enum liveupdate_state *state)
+{
+ struct liveupdate_ioctl_get_state arg = { .size = sizeof(arg) };
+
+ if (ioctl(luo_fd, LIVEUPDATE_IOCTL_GET_STATE, &arg) < 0)
+ return -errno;
+ *state = arg.state;
+ return 0;
+}
+
+void create_state_file(int luo_fd, int next_stage)
+{
+ char buf[32];
+ int state_session_fd;
+
+ state_session_fd = luo_create_session(luo_fd, STATE_SESSION_NAME);
+ if (state_session_fd < 0)
+ fail_exit("luo_create_session failed");
+
+ snprintf(buf, sizeof(buf), "%d", next_stage);
+ if (create_and_preserve_memfd(state_session_fd,
+ STATE_MEMFD_TOKEN, buf) < 0) {
+ fail_exit("create_and_preserve_memfd failed");
+ }
+}
+
+int restore_and_read_state(int luo_fd, int *stage)
+{
+ char buf[32] = {0};
+ int state_session_fd, mfd;
+
+ state_session_fd = luo_retrieve_session(luo_fd, STATE_SESSION_NAME);
+ if (state_session_fd < 0)
+ return state_session_fd;
+
+ mfd = restore_and_verify_memfd(state_session_fd, STATE_MEMFD_TOKEN,
+ NULL);
+ if (mfd < 0)
+ fail_exit("failed to restore state memfd");
+
+ if (read(mfd, buf, sizeof(buf) - 1) < 0)
+ fail_exit("failed to read state mfd");
+
+ *stage = atoi(buf);
+
+ close(mfd);
+ return state_session_fd;
+}
+
+void update_state_file(int session_fd, int next_stage)
+{
+ char buf[32];
+ struct liveupdate_session_unpreserve_fd arg = { .size = sizeof(arg) };
+
+ arg.token = STATE_MEMFD_TOKEN;
+ if (ioctl(session_fd, LIVEUPDATE_SESSION_UNPRESERVE_FD, &arg) < 0)
+ fail_exit("unpreserve failed");
+
+ snprintf(buf, sizeof(buf), "%d", next_stage);
+ if (create_and_preserve_memfd(session_fd, STATE_MEMFD_TOKEN, buf) < 0)
+ fail_exit("create_and_preserve failed");
+}
+
+void reinit_all_sessions(struct session_info *sessions, int num)
+{
+ int i, j;
+
+ for (i = 0; i < num; i++) {
+ snprintf(sessions[i].name, sizeof(sessions[i].name),
+ "session-%c", 'A' + i);
+ for (j = 0; j < 2; j++) {
+ sessions[i].file_tokens[j] = (i * 100) + j;
+ snprintf(sessions[i].file_data[j],
+ sizeof(sessions[i].file_data[j]),
+ "Data for %.*s-File%d",
+ LIVEUPDATE_SESSION_NAME_LENGTH,
+ sessions[i].name, j);
+ }
+ }
+}
+
+int verify_session_and_get_fd(int luo_fd, struct session_info *s)
+{
+ int i, session_fd;
+
+ ksft_print_msg(" - Verifying session '%s'...\n", s->name);
+
+ session_fd = luo_retrieve_session(luo_fd, s->name);
+ if (session_fd < 0)
+ fail_exit("luo_retrieve_session for %s", s->name);
+
+ for (i = 0; i < 2; i++) {
+ int mfd = restore_and_verify_memfd(session_fd,
+ s->file_tokens[i],
+ s->file_data[i]);
+ if (mfd < 0) {
+ fail_exit("restore_and_verify_memfd for token %d",
+ s->file_tokens[i]);
+ }
+ close(mfd);
+ }
+ ksft_print_msg(" Success. All files verified.\n");
+ return session_fd;
+}
diff --git a/tools/testing/selftests/liveupdate/luo_test_utils.h b/tools/testing/selftests/liveupdate/luo_test_utils.h
new file mode 100644
index 000000000000..e30cfcb0a596
--- /dev/null
+++ b/tools/testing/selftests/liveupdate/luo_test_utils.h
@@ -0,0 +1,51 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/*
+ * Copyright (c) 2025, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+#ifndef LUO_TEST_UTILS_H
+#define LUO_TEST_UTILS_H
+
+#include <errno.h>
+#include <string.h>
+#include <linux/liveupdate.h>
+#include "../kselftest.h"
+
+#define LUO_DEVICE "/dev/liveupdate"
+#define STATE_SESSION_NAME "state_session"
+#define STATE_MEMFD_TOKEN 999
+
+#define MAX_FILES_PER_SESSION 5
+
+struct session_info {
+ char name[LIVEUPDATE_SESSION_NAME_LENGTH];
+ int fd;
+ int file_tokens[MAX_FILES_PER_SESSION];
+ char file_data[MAX_FILES_PER_SESSION][128];
+};
+
+#define fail_exit(fmt, ...) \
+ ksft_exit_fail_msg("[%s] " fmt " (errno: %s)\n", \
+ __func__, ##__VA_ARGS__, strerror(errno))
+
+int luo_open_device(void);
+
+int luo_create_session(int luo_fd, const char *name);
+int luo_retrieve_session(int luo_fd, const char *name);
+
+int create_and_preserve_memfd(int session_fd, int token, const char *data);
+int restore_and_verify_memfd(int session_fd, int token, const char *expected_data);
+int verify_session_and_get_fd(int luo_fd, struct session_info *s);
+
+int luo_set_session_event(int session_fd, enum liveupdate_event event);
+int luo_set_global_event(int luo_fd, enum liveupdate_event event);
+int luo_get_global_state(int luo_fd, enum liveupdate_state *state);
+
+void create_state_file(int luo_fd, int next_stage);
+int restore_and_read_state(int luo_fd, int *stage);
+void update_state_file(int session_fd, int next_stage);
+void reinit_all_sessions(struct session_info *sessions, int num);
+
+#endif /* LUO_TEST_UTILS_H */
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 27/30] selftests/liveupdate: Add multi-file and unreclaimed file test
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Introduce a new selftest, luo_multi_file, to validate two key aspects of
the Live Update Orchestrator file preservation mechanism: the ability to
handle multiple files within a single session, and the correct cleanup
of unreclaimed files.
The test implements a full kexec cycle with the following flow:
1. Pre-kexec:
- A single session is created.
- Three distinct memfd files (A, B, and C) are created, populated with
unique data, and preserved within this session.
- The global LIVEUPDATE_PREPARE event is triggered, and the system
reboots via kexec.
2. Post-kexec:
- The preserved session is retrieved.
- Files A and C are restored and their contents are verified to ensure
that multiple files can be successfully restored from a single
session.
- File B is intentionally not restored.
- The global LIVEUPDATE_FINISH event is triggered.
3. Verification:
- The test is considered successful if files A and C are verified
correctly.
- The user is prompted to check the kernel log (dmesg) for a message
confirming that the unreclaimed file (B) was identified and cleaned
up by the LUO core, thus validating the cleanup path.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
tools/testing/selftests/liveupdate/Makefile | 1 +
.../selftests/liveupdate/luo_multi_file.c | 119 ++++++++++++++++++
2 files changed, 120 insertions(+)
create mode 100644 tools/testing/selftests/liveupdate/luo_multi_file.c
diff --git a/tools/testing/selftests/liveupdate/Makefile b/tools/testing/selftests/liveupdate/Makefile
index 1cbc816ed5c5..f43b7d03e017 100644
--- a/tools/testing/selftests/liveupdate/Makefile
+++ b/tools/testing/selftests/liveupdate/Makefile
@@ -9,6 +9,7 @@ LDFLAGS += -static
LUO_SHARED_SRCS := luo_test_utils.c
LUO_SHARED_HDRS += luo_test_utils.h
+LUO_MANUAL_TESTS += luo_multi_file
LUO_MANUAL_TESTS += luo_multi_kexec
TEST_FILES += do_kexec.sh
diff --git a/tools/testing/selftests/liveupdate/luo_multi_file.c b/tools/testing/selftests/liveupdate/luo_multi_file.c
new file mode 100644
index 000000000000..ae38fe8aba4c
--- /dev/null
+++ b/tools/testing/selftests/liveupdate/luo_multi_file.c
@@ -0,0 +1,119 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+/*
+ * Copyright (c) 2025, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+#include "luo_test_utils.h"
+
+#define KEXEC_SCRIPT "./do_kexec.sh"
+
+#define SESSION_NAME "multi_file_session"
+#define TOKEN_A 101
+#define TOKEN_B 102
+#define TOKEN_C 103
+
+#define DATA_A "Alpha file data"
+#define DATA_B "Bravo file data which will be unreclaimed"
+#define DATA_C "Charlie file data"
+
+static void run_pre_kexec(int luo_fd)
+{
+ int session_fd;
+
+ ksft_print_msg("[PRE-KEXEC] Starting workload...\n");
+
+ session_fd = luo_create_session(luo_fd, SESSION_NAME);
+ if (session_fd < 0)
+ fail_exit("Failed to create session '%s'", SESSION_NAME);
+
+ ksft_print_msg("[PRE-KEXEC] Preserving 3 memfds (A, B, C)...\n");
+ if (create_and_preserve_memfd(session_fd, TOKEN_A, DATA_A) < 0)
+ fail_exit("Failed to preserve memfd A");
+ if (create_and_preserve_memfd(session_fd, TOKEN_B, DATA_B) < 0)
+ fail_exit("Failed to preserve memfd B");
+ if (create_and_preserve_memfd(session_fd, TOKEN_C, DATA_C) < 0)
+ fail_exit("Failed to preserve memfd C");
+ ksft_print_msg("[PRE-KEXEC] All memfds preserved.\n");
+
+ if (luo_set_global_event(luo_fd, LIVEUPDATE_PREPARE) < 0)
+ fail_exit("Failed to set global PREPARE event");
+
+ ksft_print_msg("[PRE-KEXEC] System is ready. Executing kexec...\n");
+ if (system(KEXEC_SCRIPT) != 0)
+ fail_exit("kexec script failed");
+
+ sleep(10); /* Should not be reached */
+ exit(EXIT_FAILURE);
+}
+
+static void run_post_kexec(int luo_fd)
+{
+ int session_fd, mfd_a, mfd_c;
+
+ ksft_print_msg("[POST-KEXEC] Starting workload...\n");
+
+ session_fd = luo_retrieve_session(luo_fd, SESSION_NAME);
+ if (session_fd < 0)
+ fail_exit("Failed to retrieve session '%s'", SESSION_NAME);
+
+ /* 1. VERIFY SUCCESS: Restore and verify memfd A. */
+ ksft_print_msg("[POST-KEXEC] Restoring and verifying memfd A (token %d)...\n",
+ TOKEN_A);
+ mfd_a = restore_and_verify_memfd(session_fd, TOKEN_A, DATA_A);
+ if (mfd_a < 0)
+ fail_exit("Failed to restore or verify memfd A");
+ close(mfd_a);
+ ksft_print_msg(" Success.\n");
+
+ /* 2. VERIFY SUCCESS: Restore and verify memfd C. */
+ ksft_print_msg("[POST-KEXEC] Restoring and verifying memfd C (token %d)...\n",
+ TOKEN_C);
+ mfd_c = restore_and_verify_memfd(session_fd, TOKEN_C, DATA_C);
+ if (mfd_c < 0)
+ fail_exit("Failed to restore or verify memfd C");
+ close(mfd_c);
+ ksft_print_msg(" Success.\n");
+
+ ksft_print_msg("[POST-KEXEC] NOT restoring memfd B (token %d) to test cleanup.\n",
+ TOKEN_B);
+
+ if (luo_set_global_event(luo_fd, LIVEUPDATE_FINISH) < 0)
+ fail_exit("Failed to set global FINISH event");
+
+ close(session_fd);
+
+ ksft_print_msg("\n--- TEST PASSED ---\n");
+ ksft_print_msg("Check dmesg for cleanup log of token %d in session '%s'.\n",
+ TOKEN_B, SESSION_NAME);
+}
+
+int main(int argc, char *argv[])
+{
+ enum liveupdate_state state;
+ int luo_fd;
+
+ luo_fd = luo_open_device();
+ if (luo_fd < 0) {
+ ksft_exit_skip("Failed to open %s. Is the luo module loaded?\n",
+ LUO_DEVICE);
+ }
+
+ if (luo_get_global_state(luo_fd, &state) < 0)
+ fail_exit("Failed to get LUO state");
+
+ switch (state) {
+ case LIVEUPDATE_STATE_NORMAL:
+ run_pre_kexec(luo_fd);
+ break;
+ case LIVEUPDATE_STATE_UPDATED:
+ run_post_kexec(luo_fd);
+ break;
+ default:
+ fail_exit("Test started in an unexpected state: %d", state);
+ }
+
+ close(luo_fd);
+ ksft_exit_pass();
+}
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 28/30] selftests/liveupdate: Add multi-session workflow and state interaction test
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Introduce a new, luo_multi_session, test to validate the orchestration
of multiple LUO sessions with differing lifecycles through a full kexec
reboot.
The test validates interactions between per-session and global state
transitions:
1. Mixed State Preparation: Before the first kexec, sessions are put
into different states to test the global PREPARE event's behavior:
- Session A & C: Are individually transitioned to PREPARED via a
per-session ioctl. The test verifies that the subsequent global
PREPARE correctly handles these already-prepared sessions.
- Session B: Is transitioned to PREPARED and then immediately back to
NORMAL via a per-session CANCEL. This validates the rollback
mechanism and ensures the session is correctly picked up and
prepared by the subsequent global PREPARE.
- Session D: Is left in the NORMAL state, verifying that the global
PREPARE correctly transitions sessions that have not been
individually managed.
2. Unreclaimed Session Cleanup:
- After the kexec reboot, sessions A, B, C, and D are all retrieved
and verified to ensure they were preserved correctly, regardless of
their pre-kexec transition path.
- Session E: Is intentionally not retrieved. This validates that the
global FINISH event correctly identifies and cleans up an entire
unreclaimed session and all of its preserved file resources,
preventing leaks.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
tools/testing/selftests/liveupdate/Makefile | 1 +
.../selftests/liveupdate/luo_multi_session.c | 155 ++++++++++++++++++
2 files changed, 156 insertions(+)
create mode 100644 tools/testing/selftests/liveupdate/luo_multi_session.c
diff --git a/tools/testing/selftests/liveupdate/Makefile b/tools/testing/selftests/liveupdate/Makefile
index f43b7d03e017..72892942dd61 100644
--- a/tools/testing/selftests/liveupdate/Makefile
+++ b/tools/testing/selftests/liveupdate/Makefile
@@ -11,6 +11,7 @@ LUO_SHARED_HDRS += luo_test_utils.h
LUO_MANUAL_TESTS += luo_multi_file
LUO_MANUAL_TESTS += luo_multi_kexec
+LUO_MANUAL_TESTS += luo_multi_session
TEST_FILES += do_kexec.sh
diff --git a/tools/testing/selftests/liveupdate/luo_multi_session.c b/tools/testing/selftests/liveupdate/luo_multi_session.c
new file mode 100644
index 000000000000..9ea96d7b997f
--- /dev/null
+++ b/tools/testing/selftests/liveupdate/luo_multi_session.c
@@ -0,0 +1,155 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+/*
+ * Copyright (c) 2025, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+#include "luo_test_utils.h"
+#include "../kselftest.h"
+
+#define KEXEC_SCRIPT "./do_kexec.sh"
+
+#define NUM_SESSIONS 5
+#define FILES_PER_SESSION 5
+
+/* Helper to manage one session and its files */
+static void setup_session(int luo_fd, struct session_info *s, int session_idx)
+{
+ int i;
+
+ snprintf(s->name, sizeof(s->name), "session-%c", 'A' + session_idx);
+
+ s->fd = luo_create_session(luo_fd, s->name);
+ if (s->fd < 0)
+ fail_exit("Failed to create session '%s'", s->name);
+
+ /* Create and preserve all files for this session */
+ for (i = 0; i < FILES_PER_SESSION; i++) {
+ s->file_tokens[i] = (session_idx * 100) + i;
+ snprintf(s->file_data[i], sizeof(s->file_data[i]),
+ "Data for %.*s-File%d",
+ LIVEUPDATE_SESSION_NAME_LENGTH,
+ s->name, i);
+
+ if (create_and_preserve_memfd(s->fd, s->file_tokens[i],
+ s->file_data[i]) < 0) {
+ fail_exit("Failed to preserve token %d in session '%s'",
+ s->file_tokens[i], s->name);
+ }
+ }
+}
+
+/* Helper to re-initialize the expected session data post-reboot */
+static void reinit_sessions(struct session_info *sessions)
+{
+ int i, j;
+
+ for (i = 0; i < NUM_SESSIONS; i++) {
+ snprintf(sessions[i].name, sizeof(sessions[i].name),
+ "session-%c", 'A' + i);
+ for (j = 0; j < FILES_PER_SESSION; j++) {
+ sessions[i].file_tokens[j] = (i * 100) + j;
+ snprintf(sessions[i].file_data[j],
+ sizeof(sessions[i].file_data[j]),
+ "Data for %.*s-File%d",
+ LIVEUPDATE_SESSION_NAME_LENGTH,
+ sessions[i].name, j);
+ }
+ }
+}
+
+static void run_pre_kexec(int luo_fd)
+{
+ struct session_info sessions[NUM_SESSIONS] = {0};
+ int i;
+
+ ksft_print_msg("[PRE-KEXEC] Starting workload...\n");
+
+ ksft_print_msg("[PRE-KEXEC] Setting up %d sessions with %d files each...\n",
+ NUM_SESSIONS, FILES_PER_SESSION);
+ for (i = 0; i < NUM_SESSIONS; i++)
+ setup_session(luo_fd, &sessions[i], i);
+ ksft_print_msg("[PRE-KEXEC] Setup complete.\n");
+
+ ksft_print_msg("[PRE-KEXEC] Performing individual session state transitions...\n");
+ ksft_print_msg(" - Preparing Session A...\n");
+ if (luo_set_session_event(sessions[0].fd, LIVEUPDATE_PREPARE) < 0)
+ fail_exit("Failed to prepare Session A");
+
+ ksft_print_msg(" - Preparing and then Canceling Session B...\n");
+ if (luo_set_session_event(sessions[1].fd, LIVEUPDATE_PREPARE) < 0)
+ fail_exit("Failed to prepare Session B");
+ if (luo_set_session_event(sessions[1].fd, LIVEUPDATE_CANCEL) < 0)
+ fail_exit("Failed to cancel Session B");
+
+ ksft_print_msg(" - Preparing Session C...\n");
+ if (luo_set_session_event(sessions[2].fd, LIVEUPDATE_PREPARE) < 0)
+ fail_exit("Failed to prepare Session C");
+
+ ksft_print_msg(" - Sessions D & E remain in NORMAL state.\n");
+
+ ksft_print_msg("[PRE-KEXEC] Triggering global PREPARE event...\n");
+ if (luo_set_global_event(luo_fd, LIVEUPDATE_PREPARE) < 0)
+ fail_exit("Failed to set global PREPARE event");
+
+ ksft_print_msg("[PRE-KEXEC] System is ready. Executing kexec...\n");
+ if (system(KEXEC_SCRIPT) != 0)
+ fail_exit("kexec script failed");
+
+ sleep(10);
+ exit(EXIT_FAILURE);
+}
+
+static void run_post_kexec(int luo_fd)
+{
+ struct session_info sessions[NUM_SESSIONS] = {0};
+
+ ksft_print_msg("[POST-KEXEC] Starting workload...\n");
+
+ reinit_sessions(sessions);
+
+ ksft_print_msg("[POST-KEXEC] Verifying preserved sessions (A, B, C, D)...\n");
+ verify_session_and_get_fd(luo_fd, &sessions[0]);
+ verify_session_and_get_fd(luo_fd, &sessions[1]);
+ verify_session_and_get_fd(luo_fd, &sessions[2]);
+ verify_session_and_get_fd(luo_fd, &sessions[3]);
+
+ ksft_print_msg("[POST-KEXEC] NOT retrieving session E to test cleanup.\n");
+
+ ksft_print_msg("[POST-KEXEC] Driving global state to FINISH...\n");
+ if (luo_set_global_event(luo_fd, LIVEUPDATE_FINISH) < 0)
+ fail_exit("Failed to set global FINISH event");
+
+ ksft_print_msg("\n--- TEST PASSED ---\n");
+ ksft_print_msg("Check dmesg for cleanup log of session E.\n");
+}
+
+int main(int argc, char *argv[])
+{
+ enum liveupdate_state state;
+ int luo_fd;
+
+ luo_fd = luo_open_device();
+ if (luo_fd < 0) {
+ ksft_exit_skip("Failed to open %s. Is the luo module loaded?\n",
+ LUO_DEVICE);
+ }
+
+ if (luo_get_global_state(luo_fd, &state) < 0)
+ fail_exit("Failed to get LUO state");
+
+ switch (state) {
+ case LIVEUPDATE_STATE_NORMAL:
+ run_pre_kexec(luo_fd);
+ break;
+ case LIVEUPDATE_STATE_UPDATED:
+ run_post_kexec(luo_fd);
+ break;
+ default:
+ fail_exit("Test started in an unexpected state: %d", state);
+ }
+
+ close(luo_fd);
+ ksft_exit_pass();
+}
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 29/30] selftests/liveupdate: Add test for unreclaimed resource cleanup
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Introduce a new selftest, luo_unreclaimed, to specifically validate that
the LUO framework correctly identifies and cleans up preserved
resources that are not restored by userspace after a kexec reboot.
Ensuring proper cleanup of unreclaimed (or "abandoned") resources is
critical for preventing resource leaks in the kernel. This test provides
a focused scenario to verify this cleanup path, which is a key aspect of
the LUO's robustness.
The test performs a full kexec cycle with the following simple flow:
1. Pre-kexec:
- A single session is created.
- Two memfd files are preserved: File A (which will be restored) and
File B (which will be abandoned).
- The global LIVEUPDATE_PREPARE event is triggered, and the system
reboots.
2. Post-kexec:
- The preserved session is retrieved.
- Only File A is restored and its contents are verified to confirm the
basic preservation mechanism is working.
- File B is intentionally not restored.
- The global LIVEUPDATE_FINISH event is triggered.
3. Verification:
- The test passes if File A is verified successfully.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
tools/testing/selftests/liveupdate/Makefile | 1 +
.../selftests/liveupdate/luo_unreclaimed.c | 107 ++++++++++++++++++
2 files changed, 108 insertions(+)
create mode 100644 tools/testing/selftests/liveupdate/luo_unreclaimed.c
diff --git a/tools/testing/selftests/liveupdate/Makefile b/tools/testing/selftests/liveupdate/Makefile
index 72892942dd61..ffce73233149 100644
--- a/tools/testing/selftests/liveupdate/Makefile
+++ b/tools/testing/selftests/liveupdate/Makefile
@@ -12,6 +12,7 @@ LUO_SHARED_HDRS += luo_test_utils.h
LUO_MANUAL_TESTS += luo_multi_file
LUO_MANUAL_TESTS += luo_multi_kexec
LUO_MANUAL_TESTS += luo_multi_session
+LUO_MANUAL_TESTS += luo_unreclaimed
TEST_FILES += do_kexec.sh
diff --git a/tools/testing/selftests/liveupdate/luo_unreclaimed.c b/tools/testing/selftests/liveupdate/luo_unreclaimed.c
new file mode 100644
index 000000000000..c3921b21b97b
--- /dev/null
+++ b/tools/testing/selftests/liveupdate/luo_unreclaimed.c
@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+/*
+ * Copyright (c) 2025, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+#include "luo_test_utils.h"
+#include "../kselftest.h"
+
+#define KEXEC_SCRIPT "./do_kexec.sh"
+
+#define SESSION_NAME "unreclaimed_session"
+#define TOKEN_A 100
+#define TOKEN_B 200
+#define DATA_A "This is file A, the one we retrieve."
+#define DATA_B "This is file B, the one we abandon."
+
+static void run_pre_kexec(int luo_fd)
+{
+ int session_fd;
+
+ ksft_print_msg("[PRE-KEXEC] Starting workload...\n");
+
+ session_fd = luo_create_session(luo_fd, SESSION_NAME);
+ if (session_fd < 0)
+ fail_exit("Failed to create session '%s'", SESSION_NAME);
+
+ ksft_print_msg("[PRE-KEXEC] Preserving memfd A (to be restored).\n");
+ if (create_and_preserve_memfd(session_fd, TOKEN_A, DATA_A) < 0)
+ fail_exit("Failed to preserve memfd A");
+
+ ksft_print_msg("[PRE-KEXEC] Preserving memfd B (to be abandoned).\n");
+ if (create_and_preserve_memfd(session_fd, TOKEN_B, DATA_B) < 0)
+ fail_exit("Failed to preserve memfd B");
+
+ if (luo_set_global_event(luo_fd, LIVEUPDATE_PREPARE) < 0)
+ fail_exit("Failed to set global PREPARE event");
+
+ ksft_print_msg("[PRE-KEXEC] System is ready. Executing kexec...\n");
+ if (system(KEXEC_SCRIPT) != 0)
+ fail_exit("kexec script failed");
+
+ sleep(10);
+ exit(EXIT_FAILURE);
+}
+
+static void run_post_kexec(int luo_fd)
+{
+ int session_fd, mfd_a;
+
+ ksft_print_msg("[POST-KEXEC] Starting workload...\n");
+
+ session_fd = luo_retrieve_session(luo_fd, SESSION_NAME);
+ if (session_fd < 0)
+ fail_exit("Failed to retrieve session '%s'", SESSION_NAME);
+
+ ksft_print_msg("[POST-KEXEC] Restoring and verifying memfd A (token %d)...\n",
+ TOKEN_A);
+ mfd_a = restore_and_verify_memfd(session_fd, TOKEN_A, DATA_A);
+ if (mfd_a < 0)
+ fail_exit("Failed to restore or verify memfd A");
+ close(mfd_a);
+ ksft_print_msg(" Data verification PASSED for memfd A.\n");
+
+ ksft_print_msg("[POST-KEXEC] NOT restoring memfd B (token %d) to test cleanup.\n",
+ TOKEN_B);
+
+ ksft_print_msg("[POST-KEXEC] Driving global state to FINISH...\n");
+ if (luo_set_global_event(luo_fd, LIVEUPDATE_FINISH) < 0)
+ fail_exit("Failed to set global FINISH event");
+
+ close(session_fd);
+
+ ksft_print_msg("\n--- TEST PASSED ---\n");
+ ksft_print_msg("Check dmesg for cleanup log of token %d in session '%s'.\n",
+ TOKEN_B, SESSION_NAME);
+}
+
+int main(int argc, char *argv[])
+{
+ enum liveupdate_state state;
+ int luo_fd;
+
+ luo_fd = luo_open_device();
+ if (luo_fd < 0) {
+ ksft_exit_skip("Failed to open %s. Is the luo module loaded?\n",
+ LUO_DEVICE);
+ }
+
+ if (luo_get_global_state(luo_fd, &state) < 0)
+ fail_exit("Failed to get LUO state");
+
+ switch (state) {
+ case LIVEUPDATE_STATE_NORMAL:
+ run_pre_kexec(luo_fd);
+ break;
+ case LIVEUPDATE_STATE_UPDATED:
+ run_post_kexec(luo_fd);
+ break;
+ default:
+ fail_exit("Test started in an unexpected state: %d", state);
+ }
+
+ close(luo_fd);
+ ksft_exit_pass();
+}
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* [PATCH v4 30/30] selftests/liveupdate: Add tests for per-session state and cancel cycles
From: Pasha Tatashin @ 2025-09-29 1:03 UTC (permalink / raw)
To: pratyush, jasonmiu, graf, changyuanl, pasha.tatashin, rppt,
dmatlack, rientjes, corbet, rdunlap, ilpo.jarvinen, kanie, ojeda,
aliceryhl, masahiroy, akpm, tj, yoann.congal, mmaurer,
roman.gushchin, chenridong, axboe, mark.rutland, jannh,
vincent.guittot, hannes, dan.j.williams, david, joel.granados,
rostedt, anna.schumaker, song, zhangguopeng, linux, linux-kernel,
linux-doc, linux-mm, gregkh, tglx, mingo, bp, dave.hansen, x86,
hpa, rafael, dakr, bartosz.golaszewski, cw00.choi, myungjoo.ham,
yesanishhere, Jonathan.Cameron, quic_zijuhu, aleksander.lobakin,
ira.weiny, andriy.shevchenko, leon, lukas, bhelgaas, wagi,
djeffery, stuart.w.hayes, ptyadav, lennart, brauner, linux-api,
linux-fsdevel, saeedm, ajayachandra, jgg, parav, leonro, witu,
hughd, skhawaja, chrisl, steven.sistare
In-Reply-To: <20250929010321.3462457-1-pasha.tatashin@soleen.com>
Introduce two new, non-kexec selftests to validate the state transition
logic for individual LUO sessions, with a focus on the PREPARE, FREEZE,
and CANCEL events. While other tests cover the full kexec lifecycle, it
is critical to also test the internal per-session state machine's logic
and rollback capabilities in isolation. These tests provide this focused
coverage, ensuring the core session management ioctls behave as
expected.
The new test cases are:
1. session_prepare_cancel_cycle:
- Verifies the fundamental NORMAL -> PREPARED -> NORMAL state
transition path.
- It creates a session, preserves a file, sends a per-session PREPARE
event, asserts the state is PREPARED, then sends a CANCEL event and
asserts the state has correctly returned to NORMAL.
2. session_freeze_cancel_cycle:
- Extends the first test by validating the more critical ... ->
FROZEN -> NORMAL rollback path.
- It follows the same steps but adds a FREEZE event after PREPARE,
asserting the session enters the FROZEN state.
- It then sends a CANCEL event, verifying that a session can be rolled
back even from this final pre-kexec state. This is essential for
robustly handling aborts.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
tools/testing/selftests/liveupdate/Makefile | 9 ++-
.../testing/selftests/liveupdate/liveupdate.c | 56 +++++++++++++++++++
2 files changed, 64 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/liveupdate/Makefile b/tools/testing/selftests/liveupdate/Makefile
index ffce73233149..25a6dec790bb 100644
--- a/tools/testing/selftests/liveupdate/Makefile
+++ b/tools/testing/selftests/liveupdate/Makefile
@@ -16,11 +16,18 @@ LUO_MANUAL_TESTS += luo_unreclaimed
TEST_FILES += do_kexec.sh
-TEST_GEN_PROGS += liveupdate
+LUO_MAIN_TESTS += liveupdate
# --- Automatic Rule Generation (Do not edit below) ---
TEST_GEN_PROGS_EXTENDED += $(LUO_MANUAL_TESTS)
+TEST_GEN_PROGS := $(LUO_MAIN_TESTS)
+
+liveupdate_SOURCES := liveupdate.c $(LUO_SHARED_SRCS)
+
+$(OUTPUT)/liveupdate: $(liveupdate_SOURCES) $(LUO_SHARED_HDRS)
+ $(call msg,LINK,,$@)
+ $(Q)$(LINK.c) $^ $(LDLIBS) -o $@
# Define the full list of sources for each manual test.
$(foreach test,$(LUO_MANUAL_TESTS), \
diff --git a/tools/testing/selftests/liveupdate/liveupdate.c b/tools/testing/selftests/liveupdate/liveupdate.c
index 7c0ceaac0283..804aa25ce5ae 100644
--- a/tools/testing/selftests/liveupdate/liveupdate.c
+++ b/tools/testing/selftests/liveupdate/liveupdate.c
@@ -17,6 +17,7 @@
#include <sys/mman.h>
#include <linux/liveupdate.h>
+#include "luo_test_utils.h"
#include "../kselftest.h"
#include "../kselftest_harness.h"
@@ -52,6 +53,16 @@ const char *const luo_state_str[] = {
[LIVEUPDATE_STATE_UPDATED] = "updated",
};
+static int get_session_state(int session_fd)
+{
+ struct liveupdate_session_get_state arg = { .size = sizeof(arg) };
+
+ if (ioctl(session_fd, LIVEUPDATE_SESSION_GET_STATE, &arg) < 0)
+ return -errno;
+
+ return arg.state;
+}
+
static int run_luo_selftest_cmd(int fd_dbg, __u64 cmd_code,
struct luo_arg_subsystem *subsys_arg)
{
@@ -345,4 +356,49 @@ TEST_F(subsystem, prepare_fail)
ASSERT_EQ(0, unregister_subsystem(self->fd_dbg, &self->si[i]));
}
+TEST_F(state, session_freeze_cancel_cycle)
+{
+ int session_fd;
+ const char *session_name = "freeze_cancel_session";
+ const int memfd_token = 5678;
+
+ session_fd = luo_create_session(self->fd, session_name);
+ ASSERT_GE(session_fd, 0);
+
+ ASSERT_EQ(0, create_and_preserve_memfd(session_fd, memfd_token,
+ "freeze test data"));
+
+ ASSERT_EQ(0, luo_set_session_event(session_fd, LIVEUPDATE_PREPARE));
+ ASSERT_EQ(get_session_state(session_fd), LIVEUPDATE_STATE_PREPARED);
+
+ ASSERT_EQ(0, luo_set_session_event(session_fd, LIVEUPDATE_FREEZE));
+ ASSERT_EQ(get_session_state(session_fd), LIVEUPDATE_STATE_FROZEN);
+
+ ASSERT_EQ(0, luo_set_session_event(session_fd, LIVEUPDATE_CANCEL));
+ ASSERT_EQ(get_session_state(session_fd), LIVEUPDATE_STATE_NORMAL);
+
+ close(session_fd);
+}
+
+TEST_F(state, session_prepare_cancel_cycle)
+{
+ const char *session_name = "prepare_cancel_session";
+ const int memfd_token = 1234;
+ int session_fd;
+
+ session_fd = luo_create_session(self->fd, session_name);
+ ASSERT_GE(session_fd, 0);
+
+ ASSERT_EQ(0, create_and_preserve_memfd(session_fd, memfd_token,
+ "prepare test data"));
+
+ ASSERT_EQ(0, luo_set_session_event(session_fd, LIVEUPDATE_PREPARE));
+ ASSERT_EQ(get_session_state(session_fd), LIVEUPDATE_STATE_PREPARED);
+
+ ASSERT_EQ(0, luo_set_session_event(session_fd, LIVEUPDATE_CANCEL));
+ ASSERT_EQ(get_session_state(session_fd), LIVEUPDATE_STATE_NORMAL);
+
+ close(session_fd);
+}
+
TEST_HARNESS_MAIN
--
2.51.0.536.g15c5d4f767-goog
^ permalink raw reply related
* Re: [PATCH-RFC] init: simplify initrd code (was Re: [PATCH RESEND 00/62] initrd: remove classic initrd support).
From: David Disseldorp @ 2025-09-29 9:13 UTC (permalink / raw)
To: nschichan
Cc: akpm, andy.shevchenko, axboe, brauner, cyphar, devicetree,
ecurtin, email2tema, graf, gregkh, hca, hch, hsiangkao, initramfs,
jack, julian.stecklina, kees, linux-acpi, linux-alpha, linux-api,
linux-arch, linux-arm-kernel, linux-block, linux-csky, linux-doc,
linux-efi, linux-ext4, linux-fsdevel, linux-hexagon, linux-kernel,
linux-m68k, linux-mips, linux-openrisc, linux-parisc, linux-riscv,
linux-s390, linux-sh, linux-snps-arc, linux-um, linuxppc-dev,
loongarch, mcgrof, mingo, monstr, mzxreary, patches, rob,
safinaskar, sparclinux, thomas.weissschuh, thorsten.blum,
torvalds, tytso, viro, x86
In-Reply-To: <20250925131055.3933381-1-nschichan@freebox.fr>
Hi Nicolas,
On Thu, 25 Sep 2025 15:10:56 +0200, nschichan@freebox.fr wrote:
> From: Nicolas Schichan <nschichan@freebox.fr>
>
> - drop prompt_ramdisk and ramdisk_start kernel parameters
> - drop compression support
> - drop image autodetection, the whole /initrd.image content is now
> copied into /dev/ram0
> - remove rd_load_disk() which doesn't seem to be used anywhere.
>
> There is now no more limitation on the type of initrd filesystem that
> can be loaded since the code trying to guess the initrd filesystem
> size is gone (the whole /initrd.image file is used).
>
> A few global variables in do_mounts_rd.c are now put as local
> variables in rd_load_image() since they do not need to be visible
> outside this function.
> ---
>
> Hello,
>
> Hopefully my email config is now better and reaches gmail users
> correctly.
>
> The patch below could probably split in a few patches, but I think
> this simplify the code greatly without removing the functionality we
> depend on (and this allows now to use EROFS initrd images).
>
> Coupled with keeping the function populate_initrd_image() in
> init/initramfs.c, this will keep what we need from the initrd code.
>
> This removes support of loading bzip/gz/xz/... compressed images as
> well, not sure if many user depend on this feature anymore.
>
> No signoff because I'm only seeking comments about those changes right
> now.
>
> init/do_mounts.h | 2 -
> init/do_mounts_rd.c | 243 +-------------------------------------------
> 2 files changed, 4 insertions(+), 241 deletions(-)
This seems like a reasonable improvement to me. FWIW, one alternative
approach to clean up the FS specific code here was proposed by Al:
https://lore.kernel.org/all/20250321020826.GB2023217@ZenIV/
...
> diff --git a/init/do_mounts_rd.c b/init/do_mounts_rd.c
> index ac021ae6e6fa..5a69ff43f5ee 100644
> --- a/init/do_mounts_rd.c
> +++ b/init/do_mounts_rd.c
> @@ -14,173 +14,9 @@
>
> #include <linux/decompress/generic.h>
>
> -static struct file *in_file, *out_file;
> -static loff_t in_pos, out_pos;
> -
> -static int __init prompt_ramdisk(char *str)
> -{
> - pr_warn("ignoring the deprecated prompt_ramdisk= option\n");
> - return 1;
> -}
> -__setup("prompt_ramdisk=", prompt_ramdisk);
> -
> -int __initdata rd_image_start; /* starting block # of image */
> -
> -static int __init ramdisk_start_setup(char *str)
> -{
> - rd_image_start = simple_strtol(str,NULL,0);
> - return 1;
> -}
> -__setup("ramdisk_start=", ramdisk_start_setup);
There are a couple of other places that mention these parameters, which
should also be cleaned up.
...
> static unsigned long nr_blocks(struct file *file)
> {
> - struct inode *inode = file->f_mapping->host;
> -
> - if (!S_ISBLK(inode->i_mode))
> - return 0;
> - return i_size_read(inode) >> 10;
> + return i_size_read(file->f_mapping->host) >> 10;
This should be >> BLOCK_SIZE_BITS, and dropped as a wrapper function
IMO.
^ permalink raw reply
* Re: [PATCH v5 7/8] man/man2/open_tree{,_attr}.2: document new open_tree_attr() API
From: Askar Safin @ 2025-10-01 0:38 UTC (permalink / raw)
To: cyphar
Cc: alx, brauner, dhowells, g.branden.robinson, jack, linux-api,
linux-fsdevel, linux-kernel, linux-man, mtk.manpages, viro
In-Reply-To: <20250925-new-mount-api-v5-7-028fb88023f2@cyphar.com>
Aleksa Sarai <cyphar@cyphar.com>:
> +mntfd2 = open_tree(mntfd1, "", OPEN_TREE_CLONE,
> + &attr, sizeof(attr));
Your whole so-called "open_tree_attr example" doesn't contain any open_tree_attr
calls. :)
I think you meant open_tree_attr here.
> +\&
> +/* Create a new copy with the id-mapping cleared */
> +memset(&attr, 0, sizeof(attr));
> +attr.attr_clr = MOUNT_ATTR_IDMAP;
> +mntfd3 = open_tree(mntfd1, "", OPEN_TREE_CLONE,
> + &attr, sizeof(attr));
And here.
Otherwise your whole patchset looks good. Add to whole patchset:
Reviewed-by: Askar Safin <safinaskar@gmail.com>
--
Askar Safin
^ permalink raw reply
* Re: [PATCH v5 7/8] man/man2/open_tree{,_attr}.2: document new open_tree_attr() API
From: Alejandro Colomar @ 2025-10-01 6:45 UTC (permalink / raw)
To: Askar Safin
Cc: cyphar, brauner, dhowells, g.branden.robinson, jack, linux-api,
linux-fsdevel, linux-kernel, linux-man, mtk.manpages, viro
In-Reply-To: <20251001003841.510494-1-safinaskar@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 1034 bytes --]
Hi Askar,
On Wed, Oct 01, 2025 at 03:38:41AM +0300, Askar Safin wrote:
> Aleksa Sarai <cyphar@cyphar.com>:
> > +mntfd2 = open_tree(mntfd1, "", OPEN_TREE_CLONE,
> > + &attr, sizeof(attr));
>
> Your whole so-called "open_tree_attr example" doesn't contain any open_tree_attr
> calls. :)
>
> I think you meant open_tree_attr here.
I'll wait for Aleksa to confirm before applying and amending.
> > +\&
> > +/* Create a new copy with the id-mapping cleared */
> > +memset(&attr, 0, sizeof(attr));
> > +attr.attr_clr = MOUNT_ATTR_IDMAP;
> > +mntfd3 = open_tree(mntfd1, "", OPEN_TREE_CLONE,
> > + &attr, sizeof(attr));
>
> And here.
>
> Otherwise your whole patchset looks good. Add to whole patchset:
> Reviewed-by: Askar Safin <safinaskar@gmail.com>
Thanks! I'll retro-fit that to the commits I've aplied already too, as
I haven't pushed them to master yet.
Have a lovely day!
Alex
--
<https://www.alejandro-colomar.es>
Use port 80 (that is, <...:80/>).
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply
* Re: [PATCH v5 7/8] man/man2/open_tree{,_attr}.2: document new open_tree_attr() API
From: Aleksa Sarai @ 2025-10-01 7:35 UTC (permalink / raw)
To: Askar Safin
Cc: alx, brauner, dhowells, g.branden.robinson, jack, linux-api,
linux-fsdevel, linux-kernel, linux-man, mtk.manpages, viro
In-Reply-To: <20251001003841.510494-1-safinaskar@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 856 bytes --]
On 2025-10-01, Askar Safin <safinaskar@gmail.com> wrote:
> Aleksa Sarai <cyphar@cyphar.com>:
> > +mntfd2 = open_tree(mntfd1, "", OPEN_TREE_CLONE,
> > + &attr, sizeof(attr));
>
> Your whole so-called "open_tree_attr example" doesn't contain any open_tree_attr
> calls. :)
>
> I think you meant open_tree_attr here.
Oops.
>
> > +\&
> > +/* Create a new copy with the id-mapping cleared */
> > +memset(&attr, 0, sizeof(attr));
> > +attr.attr_clr = MOUNT_ATTR_IDMAP;
> > +mntfd3 = open_tree(mntfd1, "", OPEN_TREE_CLONE,
> > + &attr, sizeof(attr));
>
> And here.
Oops x2.
> Otherwise your whole patchset looks good. Add to whole patchset:
> Reviewed-by: Askar Safin <safinaskar@gmail.com>
--
Aleksa Sarai
Senior Software Engineer (Containers)
SUSE Linux GmbH
https://www.cyphar.com/
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 265 bytes --]
^ permalink raw reply
* Re: [PATCH v5 7/8] man/man2/open_tree{,_attr}.2: document new open_tree_attr() API
From: Aleksa Sarai @ 2025-10-01 7:37 UTC (permalink / raw)
To: Alejandro Colomar
Cc: Askar Safin, brauner, dhowells, g.branden.robinson, jack,
linux-api, linux-fsdevel, linux-kernel, linux-man, mtk.manpages,
viro
In-Reply-To: <ugko3x7tuqrmbyb326aw3dvtvmdozvtps6hc6ff3lmtsijoube@aem2acyk6t2q>
[-- Attachment #1: Type: text/plain, Size: 1323 bytes --]
On 2025-10-01, Alejandro Colomar <alx@kernel.org> wrote:
> Hi Askar,
>
> On Wed, Oct 01, 2025 at 03:38:41AM +0300, Askar Safin wrote:
> > Aleksa Sarai <cyphar@cyphar.com>:
> > > +mntfd2 = open_tree(mntfd1, "", OPEN_TREE_CLONE,
> > > + &attr, sizeof(attr));
> >
> > Your whole so-called "open_tree_attr example" doesn't contain any open_tree_attr
> > calls. :)
> >
> > I think you meant open_tree_attr here.
>
> I'll wait for Aleksa to confirm before applying and amending.
Yeah, Askar is right, they were a copy-paste snafu.
> > > +\&
> > > +/* Create a new copy with the id-mapping cleared */
> > > +memset(&attr, 0, sizeof(attr));
> > > +attr.attr_clr = MOUNT_ATTR_IDMAP;
> > > +mntfd3 = open_tree(mntfd1, "", OPEN_TREE_CLONE,
> > > + &attr, sizeof(attr));
> >
> > And here.
> >
> > Otherwise your whole patchset looks good. Add to whole patchset:
> > Reviewed-by: Askar Safin <safinaskar@gmail.com>
>
> Thanks! I'll retro-fit that to the commits I've aplied already too, as
> I haven't pushed them to master yet.
>
>
> Have a lovely day!
> Alex
>
> --
> <https://www.alejandro-colomar.es>
> Use port 80 (that is, <...:80/>).
--
Aleksa Sarai
Senior Software Engineer (Containers)
SUSE Linux GmbH
https://www.cyphar.com/
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 265 bytes --]
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox