* [PATCH v6 10/13] liveupdate: Remove limit on the number of files per session
From: Pasha Tatashin @ 2026-06-03 3:29 UTC (permalink / raw)
To: linux-kselftest, rppt, shuah, akpm, linux-mm, skhan, linux-doc,
linux-kernel, corbet, pasha.tatashin, dmatlack, kexec, pratyush,
skhawaja, graf
In-Reply-To: <20260603032905.344462-1-pasha.tatashin@soleen.com>
To remove the fixed limit on the number of preserved files per session,
transition the file metadata serialization from a single contiguous
memory block to a chain of linked blocks.
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
include/linux/kho/abi/luo.h | 13 +--
kernel/liveupdate/luo_file.c | 138 ++++++++++++++-----------------
kernel/liveupdate/luo_internal.h | 6 +-
3 files changed, 74 insertions(+), 83 deletions(-)
diff --git a/include/linux/kho/abi/luo.h b/include/linux/kho/abi/luo.h
index 79758d92ed5f..16df550ef143 100644
--- a/include/linux/kho/abi/luo.h
+++ b/include/linux/kho/abi/luo.h
@@ -35,8 +35,8 @@
*
* - struct luo_session_ser:
* Metadata for a single session, including its name and a physical pointer
- * to another preserved memory block containing an array of
- * `struct luo_file_ser` for all files in that session.
+ * to the first `struct kho_block_header_ser` for all files in that session.
+ * Multiple blocks are linked via the `next` field in the header.
*
* - struct luo_file_ser:
* Metadata for a single preserved file. Contains the `compatible` string to
@@ -65,7 +65,7 @@
* The LUO state is registered under this KHO entry name.
*/
#define LUO_KHO_ENTRY_NAME "LUO"
-#define LUO_COMPAT_BASE "luo-v3"
+#define LUO_COMPAT_BASE "luo-v4"
#define LUO_ABI_COMPATIBLE LUO_COMPAT_BASE "-" KHO_BLOCK_ABI_COMPATIBLE
#define LUO_ABI_COMPAT_LEN ALIGN(sizeof(LUO_ABI_COMPATIBLE), 8)
@@ -103,9 +103,10 @@ struct luo_file_ser {
/**
* struct luo_file_set_ser - Represents the serialized metadata for file set
- * @files: The physical address of a contiguous memory block that holds
- * the serialized state of files (array of luo_file_ser) in this file
- * set.
+ * @files: The physical address of the first `struct kho_block_header_ser`.
+ * This structure is the header for a block of memory containing
+ * an array of `struct luo_file_ser` entries. Multiple blocks are
+ * linked via the `next` field in the header.
* @count: The total number of files that were part of this session during
* serialization. Used for iteration and validation during
* restoration.
diff --git a/kernel/liveupdate/luo_file.c b/kernel/liveupdate/luo_file.c
index 9eec07a9e9fc..c39f96961a85 100644
--- a/kernel/liveupdate/luo_file.c
+++ b/kernel/liveupdate/luo_file.c
@@ -118,11 +118,6 @@ static LIST_HEAD(luo_file_handler_list);
/* Keep track of files being preserved by LUO */
static DEFINE_XARRAY(luo_preserved_files);
-/* 2 4K pages, give space for 128 files per file_set */
-#define LUO_FILE_PGCNT 2ul
-#define LUO_FILE_MAX \
- ((LUO_FILE_PGCNT << PAGE_SHIFT) / sizeof(struct luo_file_ser))
-
/**
* struct luo_file - Represents a single preserved file instance.
* @fh: Pointer to the &struct liveupdate_file_handler that manages
@@ -174,39 +169,6 @@ struct luo_file {
u64 token;
};
-static int luo_alloc_files_mem(struct luo_file_set *file_set)
-{
- size_t size;
- void *mem;
-
- if (file_set->files)
- return 0;
-
- WARN_ON_ONCE(file_set->count);
-
- size = LUO_FILE_PGCNT << PAGE_SHIFT;
- mem = kho_alloc_preserve(size);
- if (IS_ERR(mem))
- return PTR_ERR(mem);
-
- file_set->files = mem;
-
- return 0;
-}
-
-static void luo_free_files_mem(struct luo_file_set *file_set)
-{
- /* If file_set has files, no need to free preservation memory */
- if (file_set->count)
- return;
-
- if (!file_set->files)
- return;
-
- kho_unpreserve_free(file_set->files);
- file_set->files = NULL;
-}
-
static unsigned long luo_get_id(struct liveupdate_file_handler *fh,
struct file *file)
{
@@ -276,16 +238,15 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
if (luo_token_is_used(file_set, token))
return -EEXIST;
- if (file_set->count == LUO_FILE_MAX)
- return -ENOSPC;
+ err = kho_block_set_grow(&file_set->block_set, file_set->count + 1);
+ if (err)
+ return err;
file = fget(fd);
- if (!file)
- return -EBADF;
-
- err = luo_alloc_files_mem(file_set);
- if (err)
- goto err_fput;
+ if (!file) {
+ err = -EBADF;
+ goto err_shrink;
+ }
err = -ENOENT;
down_read(&luo_register_rwlock);
@@ -300,7 +261,7 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
/* err is still -ENOENT if no handler was found */
if (err)
- goto err_free_files_mem;
+ goto err_fput;
err = xa_insert(&luo_preserved_files, luo_get_id(fh, file),
file, GFP_KERNEL);
@@ -343,10 +304,10 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
xa_erase(&luo_preserved_files, luo_get_id(fh, file));
err_module_put:
module_put(fh->ops->owner);
-err_free_files_mem:
- luo_free_files_mem(file_set);
err_fput:
fput(file);
+err_shrink:
+ kho_block_set_shrink(&file_set->block_set, file_set->count);
return err;
}
@@ -392,13 +353,14 @@ void luo_file_unpreserve_files(struct luo_file_set *file_set)
list_del(&luo_file->list);
file_set->count--;
+ kho_block_set_shrink(&file_set->block_set, file_set->count);
fput(luo_file->file);
mutex_destroy(&luo_file->mutex);
kfree(luo_file);
}
- luo_free_files_mem(file_set);
+ kho_block_set_destroy(&file_set->block_set);
}
static int luo_file_freeze_one(struct luo_file_set *file_set,
@@ -454,7 +416,7 @@ static void __luo_file_unfreeze(struct luo_file_set *file_set,
luo_file_unfreeze_one(file_set, luo_file);
}
- memset(file_set->files, 0, LUO_FILE_PGCNT << PAGE_SHIFT);
+ kho_block_set_clear(&file_set->block_set);
}
/**
@@ -493,19 +455,24 @@ static void __luo_file_unfreeze(struct luo_file_set *file_set,
int luo_file_freeze(struct luo_file_set *file_set,
struct luo_file_set_ser *file_set_ser)
{
- struct luo_file_ser *file_ser = file_set->files;
struct luo_file *luo_file;
+ struct kho_block_set_it it;
int err;
- int i;
if (!file_set->count)
return 0;
- if (WARN_ON(!file_ser))
- return -EINVAL;
+ kho_block_set_it_init(&it, &file_set->block_set);
- i = 0;
list_for_each_entry(luo_file, &file_set->files_list, list) {
+ struct luo_file_ser *file_ser = kho_block_set_it_reserve_entry(&it);
+
+ /* This should not fail normally as blocks were pre-allocated */
+ if (WARN_ON_ONCE(!file_ser)) {
+ err = -ENOSPC;
+ goto err_unfreeze;
+ }
+
err = luo_file_freeze_one(file_set, luo_file);
if (err < 0) {
pr_warn("Freeze failed for token[%#0llx] handler[%s] err[%pe]\n",
@@ -514,16 +481,14 @@ int luo_file_freeze(struct luo_file_set *file_set,
goto err_unfreeze;
}
- strscpy(file_ser[i].compatible, luo_file->fh->compatible,
- sizeof(file_ser[i].compatible));
- file_ser[i].data = luo_file->serialized_data;
- file_ser[i].token = luo_file->token;
- i++;
+ strscpy(file_ser->compatible, luo_file->fh->compatible,
+ sizeof(file_ser->compatible));
+ file_ser->data = luo_file->serialized_data;
+ file_ser->token = luo_file->token;
}
file_set_ser->count = file_set->count;
- if (file_set->files)
- file_set_ser->files = virt_to_phys(file_set->files);
+ file_set_ser->files = kho_block_set_head_pa(&file_set->block_set);
return 0;
@@ -741,14 +706,12 @@ int luo_file_finish(struct luo_file_set *file_set)
module_put(luo_file->fh->ops->owner);
list_del(&luo_file->list);
file_set->count--;
+ kho_block_set_shrink(&file_set->block_set, file_set->count);
mutex_destroy(&luo_file->mutex);
kfree(luo_file);
}
- if (file_set->files) {
- kho_restore_free(file_set->files);
- file_set->files = NULL;
- }
+ kho_block_set_destroy(&file_set->block_set);
return 0;
}
@@ -822,16 +785,18 @@ int luo_file_deserialize(struct luo_file_set *file_set,
struct luo_file_set_ser *file_set_ser)
{
struct luo_file_ser *file_ser;
+ struct kho_block_set_it it;
int err;
- u64 i;
if (!file_set_ser->files) {
WARN_ON(file_set_ser->count);
return 0;
}
- file_set->count = file_set_ser->count;
- file_set->files = phys_to_virt(file_set_ser->files);
+ file_set->count = 0;
+ err = kho_block_set_restore(&file_set->block_set, file_set_ser->files);
+ if (err)
+ return err;
/*
* Note on error handling:
@@ -848,25 +813,50 @@ int luo_file_deserialize(struct luo_file_set *file_set,
* userspace to detect the failure and trigger a reboot, which will
* reliably reset devices and reclaim memory.
*/
- file_ser = file_set->files;
- for (i = 0; i < file_set->count; i++) {
- err = luo_file_deserialize_one(file_set, &file_ser[i]);
+ kho_block_set_it_init(&it, &file_set->block_set);
+ while ((file_ser = kho_block_set_it_read_entry(&it))) {
+ err = luo_file_deserialize_one(file_set, file_ser);
if (err)
- return err;
+ goto err_destroy_blocks;
+ file_set->count++;
+ }
+
+ if (file_set->count != file_set_ser->count) {
+ pr_warn("File count mismatch: expected %llu, found %llu\n",
+ file_set_ser->count, file_set->count);
+ err = -EINVAL;
+ goto err_destroy_blocks;
}
return 0;
+
+err_destroy_blocks:
+ while (!list_empty(&file_set->files_list)) {
+ struct luo_file *luo_file;
+
+ luo_file = list_first_entry(&file_set->files_list,
+ struct luo_file, list);
+ list_del(&luo_file->list);
+ module_put(luo_file->fh->ops->owner);
+ mutex_destroy(&luo_file->mutex);
+ kfree(luo_file);
+ }
+ file_set->count = 0;
+ kho_block_set_destroy(&file_set->block_set);
+ return err;
}
void luo_file_set_init(struct luo_file_set *file_set)
{
INIT_LIST_HEAD(&file_set->files_list);
+ kho_block_set_init(&file_set->block_set, sizeof(struct luo_file_ser));
}
void luo_file_set_destroy(struct luo_file_set *file_set)
{
WARN_ON(file_set->count);
WARN_ON(!list_empty(&file_set->files_list));
+ WARN_ON(!kho_block_set_is_empty(&file_set->block_set));
}
/**
diff --git a/kernel/liveupdate/luo_internal.h b/kernel/liveupdate/luo_internal.h
index ee18f9a11b91..64879ffe7378 100644
--- a/kernel/liveupdate/luo_internal.h
+++ b/kernel/liveupdate/luo_internal.h
@@ -10,6 +10,7 @@
#include <linux/liveupdate.h>
#include <linux/uaccess.h>
+#include <linux/kho_block.h>
struct luo_ucmd {
void __user *ubuffer;
@@ -44,14 +45,13 @@ static inline int luo_ucmd_respond(struct luo_ucmd *ucmd,
* struct luo_file_set - A set of files that belong to the same sessions.
* @files_list: An ordered list of files associated with this session, it is
* ordered by preservation time.
- * @files: The physically contiguous memory block that holds the serialized
- * state of files.
+ * @block_set: The set of serialization blocks.
* @count: A counter tracking the number of files currently stored in the
* @files_list for this session.
*/
struct luo_file_set {
struct list_head files_list;
- struct luo_file_ser *files;
+ struct kho_block_set block_set;
u64 count;
};
--
2.53.0
^ permalink raw reply related
* [PATCH v6 09/13] liveupdate: Remove limit on the number of sessions
From: Pasha Tatashin @ 2026-06-03 3:29 UTC (permalink / raw)
To: linux-kselftest, rppt, shuah, akpm, linux-mm, skhan, linux-doc,
linux-kernel, corbet, pasha.tatashin, dmatlack, kexec, pratyush,
skhawaja, graf
In-Reply-To: <20260603032905.344462-1-pasha.tatashin@soleen.com>
Currently, the number of LUO sessions is limited by a fixed number of
pre-allocated pages for serialization (16 pages, allowing for ~819
sessions).
This limitation is problematic if LUO is used to support things such as
systemd file descriptor store, and would be used not just as VM memory
but to save other states on the machine.
Remove this limit by transitioning to a linked-block approach for
session metadata serialization. Instead of a single contiguous block,
session metadata is now stored in a chain of 16-page blocks. Each block
starts with a header containing the physical address of the next block
and the number of session entries in the current block.
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
include/linux/kho/abi/luo.h | 24 +------
kernel/liveupdate/luo_session.c | 113 +++++++++++++++-----------------
2 files changed, 56 insertions(+), 81 deletions(-)
diff --git a/include/linux/kho/abi/luo.h b/include/linux/kho/abi/luo.h
index 9a4fe491812b..79758d92ed5f 100644
--- a/include/linux/kho/abi/luo.h
+++ b/include/linux/kho/abi/luo.h
@@ -33,11 +33,6 @@
* It includes the compatibility string, the liveupdate-number, and pointers
* to sessions and FLBs.
*
- * - struct luo_session_header_ser:
- * Header for the session array. Contains the total page count of the
- * preserved memory block and the number of `struct luo_session_ser`
- * entries that follow.
- *
* - struct luo_session_ser:
* Metadata for a single session, including its name and a physical pointer
* to another preserved memory block containing an array of
@@ -63,13 +58,15 @@
#define _LINUX_KHO_ABI_LUO_H
#include <linux/align.h>
+#include <linux/kho/abi/block.h>
#include <uapi/linux/liveupdate.h>
/*
* The LUO state is registered under this KHO entry name.
*/
#define LUO_KHO_ENTRY_NAME "LUO"
-#define LUO_ABI_COMPATIBLE "luo-v3"
+#define LUO_COMPAT_BASE "luo-v3"
+#define LUO_ABI_COMPATIBLE LUO_COMPAT_BASE "-" KHO_BLOCK_ABI_COMPATIBLE
#define LUO_ABI_COMPAT_LEN ALIGN(sizeof(LUO_ABI_COMPATIBLE), 8)
/**
@@ -118,21 +115,6 @@ struct luo_file_set_ser {
u64 count;
} __packed;
-/**
- * struct luo_session_header_ser - Header for the serialized session data block.
- * @count: The number of `struct luo_session_ser` entries that immediately
- * follow this header in the memory block.
- *
- * This structure is located at the beginning of a contiguous block of
- * physical memory preserved across the kexec. It provides the necessary
- * metadata to interpret the array of session entries that follow.
- *
- * If this structure is modified, `LUO_ABI_COMPATIBLE` must be updated.
- */
-struct luo_session_header_ser {
- u64 count;
-} __packed;
-
/**
* struct luo_session_ser - Represents the serialized metadata for a LUO session.
* @name: The unique name of the session, provided by the userspace at
diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
index 2411849a34e3..b79b2a488974 100644
--- a/kernel/liveupdate/luo_session.c
+++ b/kernel/liveupdate/luo_session.c
@@ -24,9 +24,10 @@
* ioctls on /dev/liveupdate.
*
* - Serialization: Session metadata is preserved using the KHO framework. When
- * a live update is triggered via kexec, an array of `struct luo_session_ser`
- * is populated and placed in a preserved memory region. The physical address
- * of this array is stored in the centralized `struct luo_ser` structure.
+ * a live update is triggered via kexec, session metadata is serialized into
+ * a chain of linked-blocks and placed in a preserved memory region. The
+ * physical address of the first block header is stored in the centralized
+ * `struct luo_ser` structure.
*
* Session Lifecycle:
*
@@ -89,6 +90,7 @@
#include <linux/fs.h>
#include <linux/io.h>
#include <linux/kexec_handover.h>
+#include <linux/kho_block.h>
#include <linux/kho/abi/luo.h>
#include <linux/list.h>
#include <linux/liveupdate.h>
@@ -98,23 +100,14 @@
#include <uapi/linux/liveupdate.h>
#include "luo_internal.h"
-/* 16 4K pages, give space for 744 sessions */
-#define LUO_SESSION_PGCNT 16ul
-#define LUO_SESSION_MAX (((LUO_SESSION_PGCNT << PAGE_SHIFT) - \
- sizeof(struct luo_session_header_ser)) / \
- sizeof(struct luo_session_ser))
-
static DECLARE_RWSEM(luo_session_serialize_rwsem);
-
/**
* struct luo_session_header - Header struct for managing LUO sessions.
* @count: The number of sessions currently tracked in the @list.
* @list: The head of the linked list of `struct luo_session` instances.
* @rwsem: A read-write semaphore providing synchronized access to the
* session list and other fields in this structure.
- * @header_ser: The header data of serialization array.
- * @ser: The serialized session data (an array of
- * `struct luo_session_ser`).
+ * @block_set: The set of serialization blocks.
* @sessions_pa: Points to the location of sessions_pa within struct luo_ser.
* @active: Set to true when first initialized. If previous kernel did not
* send session data, active stays false for incoming.
@@ -123,8 +116,7 @@ struct luo_session_header {
long count;
struct list_head list;
struct rw_semaphore rwsem;
- struct luo_session_header_ser *header_ser;
- struct luo_session_ser *ser;
+ struct kho_block_set block_set;
u64 *sessions_pa;
bool active;
};
@@ -143,10 +135,14 @@ static struct luo_session_global luo_session_global = {
.incoming = {
.list = LIST_HEAD_INIT(luo_session_global.incoming.list),
.rwsem = __RWSEM_INITIALIZER(luo_session_global.incoming.rwsem),
+ .block_set = KHO_BLOCK_SET_INIT(luo_session_global.incoming.block_set,
+ sizeof(struct luo_session_ser)),
},
.outgoing = {
.list = LIST_HEAD_INIT(luo_session_global.outgoing.list),
.rwsem = __RWSEM_INITIALIZER(luo_session_global.outgoing.rwsem),
+ .block_set = KHO_BLOCK_SET_INIT(luo_session_global.outgoing.block_set,
+ sizeof(struct luo_session_ser)),
},
};
@@ -173,25 +169,6 @@ static void luo_session_free(struct luo_session *session)
kfree(session);
}
-static int luo_session_grow_ser(struct luo_session_header *sh)
-{
- struct luo_session_header_ser *header_ser;
-
- if (sh->count == LUO_SESSION_MAX)
- return -ENOMEM;
-
- if (sh->header_ser)
- return 0;
-
- header_ser = kho_alloc_preserve(LUO_SESSION_PGCNT << PAGE_SHIFT);
- if (IS_ERR(header_ser))
- return PTR_ERR(header_ser);
-
- sh->header_ser = header_ser;
- sh->ser = (void *)(header_ser + 1);
- return 0;
-}
-
static int luo_session_insert(struct luo_session_header *sh,
struct luo_session *session)
{
@@ -205,7 +182,7 @@ static int luo_session_insert(struct luo_session_header *sh,
* for new session.
*/
if (sh == &luo_session_global.outgoing) {
- err = luo_session_grow_ser(sh);
+ err = kho_block_set_grow(&sh->block_set, sh->count + 1);
if (err)
return err;
}
@@ -232,6 +209,8 @@ static void luo_session_remove(struct luo_session_header *sh,
guard(rwsem_write)(&sh->rwsem);
list_del(&session->list);
sh->count--;
+ if (sh == &luo_session_global.outgoing)
+ kho_block_set_shrink(&sh->block_set, sh->count);
}
static int luo_session_finish_one(struct luo_session *session)
@@ -555,15 +534,17 @@ void __init luo_session_setup_outgoing(u64 *sessions_pa)
int __init luo_session_setup_incoming(u64 sessions_pa)
{
- struct luo_session_header_ser *header_ser;
+ struct luo_session_header *sh = &luo_session_global.incoming;
+ int err;
- if (sessions_pa) {
- header_ser = phys_to_virt(sessions_pa);
- luo_session_global.incoming.header_ser = header_ser;
- luo_session_global.incoming.ser = (void *)(header_ser + 1);
- luo_session_global.incoming.active = true;
- }
+ if (!sessions_pa)
+ return 0;
+ err = kho_block_set_restore(&sh->block_set, sessions_pa);
+ if (err)
+ return err;
+
+ sh->active = true;
return 0;
}
@@ -605,6 +586,8 @@ int luo_session_deserialize(void)
{
struct luo_session_header *sh = &luo_session_global.incoming;
static bool is_deserialized;
+ struct luo_session_ser *ser;
+ struct kho_block_set_it it;
static int saved_err;
int err;
@@ -631,18 +614,19 @@ int luo_session_deserialize(void)
* userspace to detect the failure and trigger a reboot, which will
* reliably reset devices and reclaim memory.
*/
- for (int i = 0; i < sh->header_ser->count; i++) {
- err = luo_session_deserialize_one(sh, &sh->ser[i]);
+ kho_block_set_it_init(&it, &sh->block_set);
+ while ((ser = kho_block_set_it_read_entry(&it))) {
+ err = luo_session_deserialize_one(sh, ser);
if (err)
goto save_err;
}
- kho_restore_free(sh->header_ser);
- sh->header_ser = NULL;
- sh->ser = NULL;
+ kho_block_set_destroy(&sh->block_set);
return 0;
+
save_err:
+ kho_block_set_destroy(&sh->block_set);
saved_err = err;
return err;
}
@@ -651,36 +635,45 @@ int luo_session_serialize(void)
{
struct luo_session_header *sh = &luo_session_global.outgoing;
struct luo_session *session;
- int i = 0;
+ struct kho_block_set_it it;
int err;
down_write(&luo_session_serialize_rwsem);
down_write(&sh->rwsem);
*sh->sessions_pa = 0;
+ kho_block_set_it_init(&it, &sh->block_set);
+
list_for_each_entry(session, &sh->list, list) {
- err = luo_session_freeze_one(session, &sh->ser[i]);
- if (err)
+ struct luo_session_ser *ser = kho_block_set_it_reserve_entry(&it);
+
+ /* This should not fail normally as blocks were pre-allocated */
+ if (WARN_ON_ONCE(!ser)) {
+ err = -ENOSPC;
goto err_undo;
+ }
- strscpy(sh->ser[i].name, session->name,
- sizeof(sh->ser[i].name));
- i++;
- }
+ err = luo_session_freeze_one(session, ser);
+ if (err) {
+ kho_block_set_it_prev(&it);
+ goto err_undo;
+ }
- if (sh->header_ser && sh->count > 0) {
- sh->header_ser->count = sh->count;
- *sh->sessions_pa = virt_to_phys(sh->header_ser);
+ strscpy(ser->name, session->name, sizeof(ser->name));
}
+
+ if (sh->count > 0)
+ *sh->sessions_pa = kho_block_set_head_pa(&sh->block_set);
up_write(&sh->rwsem);
return 0;
err_undo:
list_for_each_entry_continue_reverse(session, &sh->list, list) {
- i--;
- luo_session_unfreeze_one(session, &sh->ser[i]);
- memset(sh->ser[i].name, 0, sizeof(sh->ser[i].name));
+ struct luo_session_ser *ser = kho_block_set_it_prev(&it);
+
+ luo_session_unfreeze_one(session, ser);
+ memset(ser->name, 0, sizeof(ser->name));
}
up_write(&sh->rwsem);
up_write(&luo_session_serialize_rwsem);
--
2.53.0
^ permalink raw reply related
* [PATCH v6 08/13] liveupdate: defer session block allocation and physical address setting
From: Pasha Tatashin @ 2026-06-03 3:28 UTC (permalink / raw)
To: linux-kselftest, rppt, shuah, akpm, linux-mm, skhan, linux-doc,
linux-kernel, corbet, pasha.tatashin, dmatlack, kexec, pratyush,
skhawaja, graf
In-Reply-To: <20260603032905.344462-1-pasha.tatashin@soleen.com>
Currently, luo_session_setup_outgoing() allocates the session block and
sets its physical address in the header immediately. With upcoming
dynamic block-based session management, this makes the first block
different from the rest. Move the allocation to where it is first needed.
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
kernel/liveupdate/luo_core.c | 4 +-
kernel/liveupdate/luo_internal.h | 2 +-
kernel/liveupdate/luo_session.c | 68 ++++++++++++++++++++------------
3 files changed, 45 insertions(+), 29 deletions(-)
diff --git a/kernel/liveupdate/luo_core.c b/kernel/liveupdate/luo_core.c
index 69b00e7d0f8f..1b2bda22902d 100644
--- a/kernel/liveupdate/luo_core.c
+++ b/kernel/liveupdate/luo_core.c
@@ -165,9 +165,7 @@ static int __init luo_state_setup(void)
strscpy(luo_ser->compatible, LUO_ABI_COMPATIBLE, sizeof(luo_ser->compatible));
luo_ser->liveupdate_num = luo_global.liveupdate_num + 1;
- err = luo_session_setup_outgoing(&luo_ser->sessions_pa);
- if (err)
- goto exit_free_luo_ser;
+ luo_session_setup_outgoing(&luo_ser->sessions_pa);
err = luo_flb_setup_outgoing(&luo_ser->flbs_pa);
if (err)
diff --git a/kernel/liveupdate/luo_internal.h b/kernel/liveupdate/luo_internal.h
index fe22086bfbeb..ee18f9a11b91 100644
--- a/kernel/liveupdate/luo_internal.h
+++ b/kernel/liveupdate/luo_internal.h
@@ -79,7 +79,7 @@ extern struct rw_semaphore luo_register_rwlock;
int luo_session_create(const char *name, struct file **filep);
int luo_session_retrieve(const char *name, struct file **filep);
-int __init luo_session_setup_outgoing(u64 *sessions_pa);
+void __init luo_session_setup_outgoing(u64 *sessions_pa);
int __init luo_session_setup_incoming(u64 sessions_pa);
int luo_session_serialize(void);
int luo_session_deserialize(void);
diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
index 1cd315e0f6de..2411849a34e3 100644
--- a/kernel/liveupdate/luo_session.c
+++ b/kernel/liveupdate/luo_session.c
@@ -108,15 +108,16 @@ static DECLARE_RWSEM(luo_session_serialize_rwsem);
/**
* struct luo_session_header - Header struct for managing LUO sessions.
- * @count: The number of sessions currently tracked in the @list.
- * @list: The head of the linked list of `struct luo_session` instances.
- * @rwsem: A read-write semaphore providing synchronized access to the
- * session list and other fields in this structure.
- * @header_ser: The header data of serialization array.
- * @ser: The serialized session data (an array of
- * `struct luo_session_ser`).
- * @active: Set to true when first initialized. If previous kernel did not
- * send session data, active stays false for incoming.
+ * @count: The number of sessions currently tracked in the @list.
+ * @list: The head of the linked list of `struct luo_session` instances.
+ * @rwsem: A read-write semaphore providing synchronized access to the
+ * session list and other fields in this structure.
+ * @header_ser: The header data of serialization array.
+ * @ser: The serialized session data (an array of
+ * `struct luo_session_ser`).
+ * @sessions_pa: Points to the location of sessions_pa within struct luo_ser.
+ * @active: Set to true when first initialized. If previous kernel did not
+ * send session data, active stays false for incoming.
*/
struct luo_session_header {
long count;
@@ -124,6 +125,7 @@ struct luo_session_header {
struct rw_semaphore rwsem;
struct luo_session_header_ser *header_ser;
struct luo_session_ser *ser;
+ u64 *sessions_pa;
bool active;
};
@@ -171,10 +173,30 @@ static void luo_session_free(struct luo_session *session)
kfree(session);
}
+static int luo_session_grow_ser(struct luo_session_header *sh)
+{
+ struct luo_session_header_ser *header_ser;
+
+ if (sh->count == LUO_SESSION_MAX)
+ return -ENOMEM;
+
+ if (sh->header_ser)
+ return 0;
+
+ header_ser = kho_alloc_preserve(LUO_SESSION_PGCNT << PAGE_SHIFT);
+ if (IS_ERR(header_ser))
+ return PTR_ERR(header_ser);
+
+ sh->header_ser = header_ser;
+ sh->ser = (void *)(header_ser + 1);
+ return 0;
+}
+
static int luo_session_insert(struct luo_session_header *sh,
struct luo_session *session)
{
struct luo_session *it;
+ int err;
guard(rwsem_write)(&sh->rwsem);
@@ -183,8 +205,9 @@ static int luo_session_insert(struct luo_session_header *sh,
* for new session.
*/
if (sh == &luo_session_global.outgoing) {
- if (sh->count == LUO_SESSION_MAX)
- return -ENOMEM;
+ err = luo_session_grow_ser(sh);
+ if (err)
+ return err;
}
/*
@@ -524,21 +547,10 @@ int luo_session_retrieve(const char *name, struct file **filep)
return err;
}
-int __init luo_session_setup_outgoing(u64 *sessions_pa)
+void __init luo_session_setup_outgoing(u64 *sessions_pa)
{
- struct luo_session_header_ser *header_ser;
-
- header_ser = kho_alloc_preserve(LUO_SESSION_PGCNT << PAGE_SHIFT);
- if (IS_ERR(header_ser))
- return PTR_ERR(header_ser);
-
- *sessions_pa = virt_to_phys(header_ser);
-
- luo_session_global.outgoing.header_ser = header_ser;
- luo_session_global.outgoing.ser = (void *)(header_ser + 1);
+ luo_session_global.outgoing.sessions_pa = sessions_pa;
luo_session_global.outgoing.active = true;
-
- return 0;
}
int __init luo_session_setup_incoming(u64 sessions_pa)
@@ -644,6 +656,8 @@ int luo_session_serialize(void)
down_write(&luo_session_serialize_rwsem);
down_write(&sh->rwsem);
+ *sh->sessions_pa = 0;
+
list_for_each_entry(session, &sh->list, list) {
err = luo_session_freeze_one(session, &sh->ser[i]);
if (err)
@@ -653,7 +667,11 @@ int luo_session_serialize(void)
sizeof(sh->ser[i].name));
i++;
}
- sh->header_ser->count = sh->count;
+
+ if (sh->header_ser && sh->count > 0) {
+ sh->header_ser->count = sh->count;
+ *sh->sessions_pa = virt_to_phys(sh->header_ser);
+ }
up_write(&sh->rwsem);
return 0;
--
2.53.0
^ permalink raw reply related
* [PATCH v6 07/13] kho: add support for linked-block serialization
From: Pasha Tatashin @ 2026-06-03 3:28 UTC (permalink / raw)
To: linux-kselftest, rppt, shuah, akpm, linux-mm, skhan, linux-doc,
linux-kernel, corbet, pasha.tatashin, dmatlack, kexec, pratyush,
skhawaja, graf
In-Reply-To: <20260603032905.344462-1-pasha.tatashin@soleen.com>
Introduce a linked-block serialization mechanism for state handover.
Previously, LUO used contiguous memory blocks for serializing sessions
and files, which imposed limits on the total number of items that could
be preserved across a live update.
This commit adds the infrastructure for a more flexible, block-based
approach where serialized data is stored in a chain of linked blocks.
This is a generic KHO serialization block infrastructure that can be
used by multiple subsystems.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
Documentation/core-api/kho/abi.rst | 5 +
Documentation/core-api/kho/index.rst | 11 +
MAINTAINERS | 1 +
include/linux/kho/abi/block.h | 56 ++++
include/linux/kho_block.h | 106 +++++++
kernel/liveupdate/Makefile | 1 +
kernel/liveupdate/kho_block.c | 411 +++++++++++++++++++++++++++
7 files changed, 591 insertions(+)
create mode 100644 include/linux/kho/abi/block.h
create mode 100644 include/linux/kho_block.h
create mode 100644 kernel/liveupdate/kho_block.c
diff --git a/Documentation/core-api/kho/abi.rst b/Documentation/core-api/kho/abi.rst
index 799d743105a6..edeb5b311963 100644
--- a/Documentation/core-api/kho/abi.rst
+++ b/Documentation/core-api/kho/abi.rst
@@ -28,6 +28,11 @@ KHO persistent memory tracker ABI
.. kernel-doc:: include/linux/kho/abi/kexec_handover.h
:doc: KHO persistent memory tracker
+KHO serialization block ABI
+===========================
+
+.. kernel-doc:: include/linux/kho/abi/block.h
+
See Also
========
diff --git a/Documentation/core-api/kho/index.rst b/Documentation/core-api/kho/index.rst
index 0a2dee4f8e7d..320914a42178 100644
--- a/Documentation/core-api/kho/index.rst
+++ b/Documentation/core-api/kho/index.rst
@@ -83,6 +83,17 @@ Public API
.. kernel-doc:: kernel/liveupdate/kexec_handover.c
:export:
+KHO Serialization Blocks API
+============================
+
+.. kernel-doc:: kernel/liveupdate/kho_block.c
+ :doc: KHO Serialization Blocks
+
+.. kernel-doc:: include/linux/kho_block.h
+
+.. kernel-doc:: kernel/liveupdate/kho_block.c
+ :internal:
+
See Also
========
diff --git a/MAINTAINERS b/MAINTAINERS
index 9ec290e38b44..920ba7622afa 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -14208,6 +14208,7 @@ F: Documentation/admin-guide/mm/kho.rst
F: Documentation/core-api/kho/*
F: include/linux/kexec_handover.h
F: include/linux/kho/
+F: include/linux/kho_block.h
F: kernel/liveupdate/kexec_handover*
F: lib/test_kho.c
F: tools/testing/selftests/kho/
diff --git a/include/linux/kho/abi/block.h b/include/linux/kho/abi/block.h
new file mode 100644
index 000000000000..8641c20b379b
--- /dev/null
+++ b/include/linux/kho/abi/block.h
@@ -0,0 +1,56 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+/**
+ * DOC: KHO Serialization Blocks ABI
+ *
+ * Subsystems using the KHO Serialization Blocks framework rely on the stable
+ * Application Binary Interface defined below to pass serialized state from a
+ * pre-update kernel to a post-update kernel.
+ *
+ * This interface is a contract. Any modification to the structure fields,
+ * compatible strings, or the layout of the `__packed` serialization
+ * structures defined here constitutes a breaking change. Such changes require
+ * incrementing the version number in the `KHO_BLOCK_ABI_COMPATIBLE` string to
+ * prevent a new kernel from misinterpreting data from an old kernel.
+ *
+ * Changes are allowed provided the compatibility version is incremented;
+ * however, backward/forward compatibility is only guaranteed for kernels
+ * supporting the same ABI version.
+ */
+
+#ifndef _LINUX_KHO_ABI_BLOCK_H
+#define _LINUX_KHO_ABI_BLOCK_H
+
+#include <asm/page.h>
+#include <linux/types.h>
+
+#define KHO_BLOCK_ABI_COMPATIBLE "kho-block-v1"
+
+/**
+ * KHO_BLOCK_SIZE - The size of each serialization block.
+ *
+ * This is defined as PAGE_SIZE. PAGE_SIZE is ABI compliant because live
+ * update between kernels with different page sizes is not supported by KHO.
+ */
+#define KHO_BLOCK_SIZE PAGE_SIZE
+
+/**
+ * struct kho_block_header_ser - Header for the serialized data block.
+ * @next: Physical address of the next struct kho_block_header_ser.
+ * @count: The number of entries that immediately follow this header in the
+ * memory block.
+ *
+ * This structure is located at the beginning of a block of physical memory
+ * preserved across a kexec. It provides the necessary metadata to interpret
+ * the array of entries that follow.
+ */
+struct kho_block_header_ser {
+ u64 next;
+ u64 count;
+} __packed;
+
+#endif /* _LINUX_KHO_ABI_BLOCK_H */
diff --git a/include/linux/kho_block.h b/include/linux/kho_block.h
new file mode 100644
index 000000000000..93a7cc2be5f5
--- /dev/null
+++ b/include/linux/kho_block.h
@@ -0,0 +1,106 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+#ifndef _LINUX_KHO_BLOCK_H
+#define _LINUX_KHO_BLOCK_H
+
+#include <linux/list.h>
+#include <linux/types.h>
+#include <linux/kho/abi/block.h>
+
+/**
+ * struct kho_block - Internal representation of a serialization block.
+ * @list: List head for linking blocks in memory.
+ * @ser: Pointer to the serialized header in preserved memory.
+ */
+struct kho_block {
+ struct list_head list;
+ struct kho_block_header_ser *ser;
+};
+
+/**
+ * struct kho_block_set - A set of blocks containing serialized entries of the same type.
+ * @blocks: The list of serialization blocks (struct kho_block).
+ * @nblocks: The number of allocated serialization blocks.
+ * @head_pa: Physical address of the first block header.
+ * @entry_size: The size of each entry in the blocks.
+ * @count_per_block: The maximum number of entries each block can hold.
+ * @incoming: True if this block set was restored from the previous kernel.
+ *
+ * Note: Synchronization and locking are the responsibility of the caller.
+ * The block set structure itself is not internally synchronized.
+ */
+struct kho_block_set {
+ struct list_head blocks;
+ long nblocks;
+ u64 head_pa;
+ size_t entry_size;
+ u64 count_per_block;
+ bool incoming;
+};
+
+/**
+ * struct kho_block_set_it - Iterator for serializing entries into blocks.
+ * @bs: The block set being iterated.
+ * @block: The current block.
+ * @i: The current entry index within @block.
+ */
+struct kho_block_set_it {
+ struct kho_block_set *bs;
+ struct kho_block *block;
+ u64 i;
+};
+
+/**
+ * KHO_BLOCK_SET_INIT - Initialize a static kho_block_set.
+ * @_name: Name of the kho_block_set variable.
+ * @_entry_size: The size of each entry in the block set.
+ */
+#define KHO_BLOCK_SET_INIT(_name, _entry_size) { \
+ .blocks = LIST_HEAD_INIT((_name).blocks), \
+ .entry_size = _entry_size, \
+ .count_per_block = (KHO_BLOCK_SIZE - \
+ sizeof(struct kho_block_header_ser)) / \
+ (_entry_size), \
+}
+
+void kho_block_set_init(struct kho_block_set *bs, size_t entry_size);
+
+int kho_block_set_grow(struct kho_block_set *bs, u64 count);
+void kho_block_set_shrink(struct kho_block_set *bs, u64 count);
+
+int kho_block_set_restore(struct kho_block_set *bs, u64 head_pa);
+void kho_block_set_destroy(struct kho_block_set *bs);
+void kho_block_set_clear(struct kho_block_set *bs);
+
+/**
+ * kho_block_set_head_pa - Get the physical address of the first block header.
+ * @bs: The block set.
+ *
+ * Return: The physical address of the first block header, or 0 if empty.
+ */
+static inline u64 kho_block_set_head_pa(struct kho_block_set *bs)
+{
+ return bs->head_pa;
+}
+
+/**
+ * kho_block_set_is_empty - Check if the block set has no allocated blocks.
+ * @bs: The block set.
+ *
+ * Return: True if there are no blocks in the set, false otherwise.
+ */
+static inline bool kho_block_set_is_empty(struct kho_block_set *bs)
+{
+ return list_empty(&bs->blocks);
+}
+
+void kho_block_set_it_init(struct kho_block_set_it *it, struct kho_block_set *bs);
+void *kho_block_set_it_reserve_entry(struct kho_block_set_it *it);
+void *kho_block_set_it_read_entry(struct kho_block_set_it *it);
+void *kho_block_set_it_prev(struct kho_block_set_it *it);
+
+#endif /* _LINUX_KHO_BLOCK_H */
diff --git a/kernel/liveupdate/Makefile b/kernel/liveupdate/Makefile
index d2f779cbe279..eec9d3ae07eb 100644
--- a/kernel/liveupdate/Makefile
+++ b/kernel/liveupdate/Makefile
@@ -1,6 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
luo-y := \
+ kho_block.o \
luo_core.o \
luo_file.o \
luo_flb.o \
diff --git a/kernel/liveupdate/kho_block.c b/kernel/liveupdate/kho_block.c
new file mode 100644
index 000000000000..4f147c308e6b
--- /dev/null
+++ b/kernel/liveupdate/kho_block.c
@@ -0,0 +1,411 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright (c) 2026, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ */
+
+/**
+ * DOC: KHO Serialization Blocks
+ *
+ * KHO provides a mechanism to preserve stateful data across a kexec handover
+ * by serializing it into memory blocks, and provides the common
+ * infrastructure for managing these blocks.
+ *
+ * Each block consists of a header (struct kho_block_header_ser) followed by an
+ * array of serialized entries. Multiple blocks are linked together via a
+ * physical pointer in the header, forming a linked list that can be easily
+ * traversed in both the current and the next kernel.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/io.h>
+#include <linux/kexec_handover.h>
+#include <linux/kho/abi/block.h>
+#include <linux/kho_block.h>
+#include <linux/slab.h>
+
+/*
+ * Safeguard limit for the number of serialization blocks. This is used to
+ * prevent infinite loops and excessive memory allocation in case of memory
+ * corruption in the preserved state.
+ *
+ * With a 4KB page size, 10k blocks is about 40MB. For 32-byte entries
+ * (e.g. 4 u64s), each block holds up to 127 entries (accounting for the
+ * 16-byte header), allowing the block set to hold up to 1.27M entries.
+ */
+#define KHO_MAX_BLOCKS 10000
+
+/**
+ * kho_block_set_init - Initialize a block set.
+ * @bs: The block set to initialize.
+ * @entry_size: The size of each entry in the blocks.
+ */
+void kho_block_set_init(struct kho_block_set *bs, size_t entry_size)
+{
+ *bs = (struct kho_block_set)KHO_BLOCK_SET_INIT(*bs, entry_size);
+ WARN_ON_ONCE(!bs->count_per_block);
+}
+
+/* Serialized entries start immediately after the block header */
+static void *kho_block_entries(struct kho_block *block)
+{
+ return (void *)(block->ser + 1);
+}
+
+/* Get the address of the serialized entry at the specified index */
+static void *kho_block_entry(struct kho_block_set_it *it, u64 index)
+{
+ return kho_block_entries(it->block) + (index * it->bs->entry_size);
+}
+
+/* Free serialized data */
+static void kho_block_free_ser(struct kho_block_set *bs,
+ struct kho_block_header_ser *ser)
+{
+ if (bs->incoming)
+ kho_restore_free(ser);
+ else
+ kho_unpreserve_free(ser);
+}
+
+static struct kho_block_header_ser *kho_block_alloc_ser(struct kho_block_set *bs)
+{
+ WARN_ON_ONCE(bs->incoming);
+ return kho_alloc_preserve(KHO_BLOCK_SIZE);
+}
+
+static int kho_block_add(struct kho_block_set *bs,
+ struct kho_block_header_ser *ser)
+{
+ struct kho_block *block, *last;
+
+ if (bs->nblocks >= KHO_MAX_BLOCKS)
+ return -ENOSPC;
+
+ block = kzalloc_obj(*block);
+ if (!block)
+ return -ENOMEM;
+
+ block->ser = ser;
+ last = list_last_entry_or_null(&bs->blocks, struct kho_block, list);
+ list_add_tail(&block->list, &bs->blocks);
+ bs->nblocks++;
+
+ if (last)
+ last->ser->next = virt_to_phys(ser);
+ else
+ bs->head_pa = virt_to_phys(ser);
+
+ return 0;
+}
+
+static int kho_block_set_grow_one(struct kho_block_set *bs)
+{
+ struct kho_block_header_ser *ser;
+ int err;
+
+ ser = kho_block_alloc_ser(bs);
+ if (IS_ERR(ser))
+ return PTR_ERR(ser);
+
+ err = kho_block_add(bs, ser);
+ if (err) {
+ kho_block_free_ser(bs, ser);
+ return err;
+ }
+
+ return 0;
+}
+
+/**
+ * kho_block_set_grow - Expand the block set to accommodate the target count.
+ * @bs: The block set.
+ * @count: The target number of valid entries to accommodate.
+ *
+ * Acts as a runtime notifier when new resources (such as files or sessions)
+ * are registered. Dynamically preallocates and links preserved memory blocks
+ * if the target entry count exceeds the current total capacity of the set,
+ * ensuring they are available during serialization/deserialization.
+ *
+ * Context: Caller must hold a lock protecting the block set.
+ * Return: 0 on success, or a negative errno on failure.
+ */
+int kho_block_set_grow(struct kho_block_set *bs, u64 count)
+{
+ if (WARN_ON_ONCE(bs->incoming))
+ return -EINVAL;
+
+ while (count > bs->nblocks * bs->count_per_block) {
+ int err = kho_block_set_grow_one(bs);
+
+ if (err)
+ return err;
+ }
+
+ return 0;
+}
+
+static void kho_block_set_shrink_one(struct kho_block_set *bs)
+{
+ struct kho_block *last, *new_last;
+
+ if (list_empty(&bs->blocks))
+ return;
+
+ last = list_last_entry(&bs->blocks, struct kho_block, list);
+ list_del(&last->list);
+ bs->nblocks--;
+ kho_block_free_ser(bs, last->ser);
+ kfree(last);
+
+ new_last = list_last_entry_or_null(&bs->blocks, struct kho_block, list);
+ if (new_last)
+ new_last->ser->next = 0;
+ else
+ bs->head_pa = 0;
+}
+
+/**
+ * kho_block_set_shrink - Shrink the block set to accommodate the target count.
+ * @bs: The block set.
+ * @count: The target number of valid entries to accommodate.
+ *
+ * Acts as a runtime notifier when resources (such as files or sessions) are
+ * unregistered, allowing the block set to release and unallocate redundant
+ * preserved memory blocks. Checks if the last block in the set can be removed
+ * because the remaining entry count is fully accommodated by the preceding blocks.
+ *
+ * Note: It is the caller's responsibility to ensure that entries are removed
+ * in LIFO (last-in, first-out) order (the reverse order of their insertion).
+ * Because shrinking destroys the last block in the set, removing entries in
+ * any other order would corrupt active data.
+ *
+ * Context: Caller must hold a lock protecting the block set.
+ */
+void kho_block_set_shrink(struct kho_block_set *bs, u64 count)
+{
+ while (bs->nblocks > 0 && count <= (bs->nblocks - 1) * bs->count_per_block)
+ kho_block_set_shrink_one(bs);
+}
+
+/*
+ * kho_block_set_is_cyclic - Check for cycles in a linked list of blocks.
+ * Uses Floyd's cycle-finding algorithm to ensure sanity of the incoming list.
+ *
+ * Return: true if a cycle or corruption is detected, false otherwise.
+ */
+static bool kho_block_set_is_cyclic(struct kho_block_set *bs)
+{
+ struct kho_block_header_ser *fast;
+ struct kho_block_header_ser *slow;
+ int count = 0;
+
+ fast = phys_to_virt(bs->head_pa);
+ slow = fast;
+
+ while (fast) {
+ if (count++ >= KHO_MAX_BLOCKS) {
+ pr_err("Block set is corrupted\n");
+ return true;
+ }
+
+ if (!fast->next)
+ break;
+
+ fast = phys_to_virt(fast->next);
+ if (!fast->next)
+ break;
+
+ fast = phys_to_virt(fast->next);
+ slow = phys_to_virt(slow->next);
+
+ if (slow == fast) {
+ pr_err("Block set is corrupted\n");
+ return true;
+ }
+ }
+
+ return false;
+}
+
+/**
+ * kho_block_set_restore - Restore a block set from a physical address.
+ * @bs: The block set to restore.
+ * @head_pa: Physical address of the first block header.
+ *
+ * Restores a serialized block set from a given physical address. The caller is
+ * responsible for ensuring that the block set @bs has been allocated and
+ * initialized prior to calling this function.
+ *
+ * Return: 0 on success, or a negative errno on failure.
+ */
+int kho_block_set_restore(struct kho_block_set *bs, u64 head_pa)
+{
+ struct kho_block_header_ser *ser;
+ u64 next_pa = head_pa;
+ int err;
+
+ /* Restored block sets use size from the previous kernel */
+ bs->incoming = true;
+ if (!head_pa)
+ return 0;
+
+ bs->head_pa = head_pa;
+ if (kho_block_set_is_cyclic(bs)) {
+ bs->head_pa = 0;
+ return -EINVAL;
+ }
+
+ while (next_pa) {
+ ser = phys_to_virt(next_pa);
+ if (!ser->count || ser->count > bs->count_per_block) {
+ pr_warn("Block contains invalid entry count: %llu\n",
+ ser->count);
+ err = -EINVAL;
+ goto err_destroy;
+ }
+ err = kho_block_add(bs, ser);
+ if (err)
+ goto err_destroy;
+ next_pa = ser->next;
+ }
+
+ return 0;
+
+err_destroy:
+ kho_block_set_destroy(bs);
+
+ /* Free the remaining un-restored blocks in the physical chain */
+ while (next_pa) {
+ struct kho_block_header_ser *next_ser = phys_to_virt(next_pa);
+
+ next_pa = next_ser->next;
+ kho_block_free_ser(bs, next_ser);
+ }
+ return err;
+}
+
+/**
+ * kho_block_set_destroy - Destroy all blocks in a block set.
+ * @bs: The block set.
+ */
+void kho_block_set_destroy(struct kho_block_set *bs)
+{
+ struct kho_block *block, *tmp;
+
+ list_for_each_entry_safe(block, tmp, &bs->blocks, list) {
+ list_del(&block->list);
+ kho_block_free_ser(bs, block->ser);
+ kfree(block);
+ }
+ bs->nblocks = 0;
+ bs->head_pa = 0;
+}
+
+/**
+ * kho_block_set_clear - Clear all serialized data in a block set.
+ * @bs: The block set to clear.
+ */
+void kho_block_set_clear(struct kho_block_set *bs)
+{
+ struct kho_block *block;
+
+ list_for_each_entry(block, &bs->blocks, list) {
+ block->ser->count = 0;
+ memset(block->ser + 1, 0, KHO_BLOCK_SIZE - sizeof(*block->ser));
+ }
+}
+
+/**
+ * kho_block_set_it_init - Initialize a block set iterator.
+ * @it: The iterator to initialize.
+ * @bs: The block set to iterate over.
+ */
+void kho_block_set_it_init(struct kho_block_set_it *it, struct kho_block_set *bs)
+{
+ it->bs = bs;
+ it->block = list_first_entry_or_null(&bs->blocks, struct kho_block, list);
+ it->i = 0;
+}
+
+/**
+ * kho_block_set_it_reserve_entry - Reserve and return the next available slot for writing.
+ * @it: The block iterator.
+ *
+ * Reserves a slot in the current block during state serialization to add a new
+ * entry, advancing the internal index. If the current block is full, it
+ * automatically moves to the next block in the set.
+ *
+ * Return: A pointer to the reserved entry slot, or NULL if the block set's
+ * capacity is fully exhausted.
+ */
+void *kho_block_set_it_reserve_entry(struct kho_block_set_it *it)
+{
+ void *entry;
+
+ if (!it->block)
+ return NULL;
+
+ if (it->i == it->bs->count_per_block) {
+ if (list_is_last(&it->block->list, &it->bs->blocks))
+ return NULL;
+ it->block = list_next_entry(it->block, list);
+ it->i = 0;
+ }
+
+ entry = kho_block_entry(it, it->i++);
+ it->block->ser->count = it->i;
+ return entry;
+}
+
+/**
+ * kho_block_set_it_read_entry - Read the next serialized entry from the block set.
+ * @it: The block iterator.
+ *
+ * Iterates through previously written entries during state deserialization,
+ * respecting the actual count stored in each block's header.
+ *
+ * Return: A pointer to the next serialized entry, or NULL if all serialized
+ * entries have been read.
+ */
+void *kho_block_set_it_read_entry(struct kho_block_set_it *it)
+{
+ if (!it->block)
+ return NULL;
+
+ if (it->i == it->block->ser->count) {
+ if (list_is_last(&it->block->list, &it->bs->blocks))
+ return NULL;
+ it->block = list_next_entry(it->block, list);
+ it->i = 0;
+ }
+
+ return kho_block_entry(it, it->i++);
+}
+
+/**
+ * kho_block_set_it_prev - Return the previous entry slot in the block set.
+ * @it: The block iterator.
+ *
+ * If the current index is at the start of a block, it automatically moves to
+ * the end of the previous block.
+ *
+ * Return: A pointer to the previous entry slot, or NULL if at the very
+ * beginning of the block set.
+ */
+void *kho_block_set_it_prev(struct kho_block_set_it *it)
+{
+ if (!it->block)
+ return NULL;
+
+ if (it->i == 0) {
+ if (list_is_first(&it->block->list, &it->bs->blocks))
+ return NULL;
+ it->block = list_prev_entry(it->block, list);
+ it->i = it->bs->count_per_block;
+ }
+
+ return kho_block_entry(it, --it->i);
+}
--
2.53.0
^ permalink raw reply related
* [PATCH v6 06/13] liveupdate: Extract luo_session_deserialize_one helper
From: Pasha Tatashin @ 2026-06-03 3:28 UTC (permalink / raw)
To: linux-kselftest, rppt, shuah, akpm, linux-mm, skhan, linux-doc,
linux-kernel, corbet, pasha.tatashin, dmatlack, kexec, pratyush,
skhawaja, graf
In-Reply-To: <20260603032905.344462-1-pasha.tatashin@soleen.com>
Extract the logic for deserializing single entries for sessions into
separate helper functions. In preparation to a linked-block
serialization for sessions.
This is a pure code movement, no other changes intended.
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
kernel/liveupdate/luo_session.c | 63 +++++++++++++++++++--------------
1 file changed, 36 insertions(+), 27 deletions(-)
diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
index 85782c6f3d6c..1cd315e0f6de 100644
--- a/kernel/liveupdate/luo_session.c
+++ b/kernel/liveupdate/luo_session.c
@@ -555,6 +555,40 @@ int __init luo_session_setup_incoming(u64 sessions_pa)
return 0;
}
+static int luo_session_deserialize_one(struct luo_session_header *sh,
+ struct luo_session_ser *ser)
+{
+ struct luo_session *session;
+ int err;
+
+ session = luo_session_alloc(ser->name);
+ if (IS_ERR(session)) {
+ pr_warn("Failed to allocate session [%.*s] during deserialization %pe\n",
+ (int)sizeof(ser->name), ser->name, session);
+ return PTR_ERR(session);
+ }
+
+ err = luo_session_insert(sh, session);
+ if (err) {
+ pr_warn("Failed to insert session [%s] %pe\n",
+ session->name, ERR_PTR(err));
+ luo_session_free(session);
+ return err;
+ }
+
+ scoped_guard(mutex, &session->mutex) {
+ err = luo_file_deserialize(&session->file_set,
+ &ser->file_set_ser);
+ }
+ if (err) {
+ pr_warn("Failed to deserialize files for session [%s] %pe\n",
+ session->name, ERR_PTR(err));
+ return err;
+ }
+
+ return 0;
+}
+
int luo_session_deserialize(void)
{
struct luo_session_header *sh = &luo_session_global.incoming;
@@ -586,34 +620,9 @@ int luo_session_deserialize(void)
* reliably reset devices and reclaim memory.
*/
for (int i = 0; i < sh->header_ser->count; i++) {
- struct luo_session *session;
-
- session = luo_session_alloc(sh->ser[i].name);
- if (IS_ERR(session)) {
- pr_warn("Failed to allocate session [%.*s] during deserialization %pe\n",
- (int)sizeof(sh->ser[i].name),
- sh->ser[i].name, session);
- err = PTR_ERR(session);
- goto save_err;
- }
-
- err = luo_session_insert(sh, session);
- if (err) {
- pr_warn("Failed to insert session [%s] %pe\n",
- session->name, ERR_PTR(err));
- luo_session_free(session);
- goto save_err;
- }
-
- scoped_guard(mutex, &session->mutex) {
- err = luo_file_deserialize(&session->file_set,
- &sh->ser[i].file_set_ser);
- }
- if (err) {
- pr_warn("Failed to deserialize files for session [%s] %pe\n",
- session->name, ERR_PTR(err));
+ err = luo_session_deserialize_one(sh, &sh->ser[i]);
+ if (err)
goto save_err;
- }
}
kho_restore_free(sh->header_ser);
--
2.53.0
^ permalink raw reply related
* [PATCH v6 05/13] liveupdate: Extract luo_file_deserialize_one helper
From: Pasha Tatashin @ 2026-06-03 3:28 UTC (permalink / raw)
To: linux-kselftest, rppt, shuah, akpm, linux-mm, skhan, linux-doc,
linux-kernel, corbet, pasha.tatashin, dmatlack, kexec, pratyush,
skhawaja, graf
In-Reply-To: <20260603032905.344462-1-pasha.tatashin@soleen.com>
Extract the logic for deserializing single entries for files into
separate helper functions. In preparation to a linked-block
serialization for files.
This is a pure code movement, no other changes intended.
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
kernel/liveupdate/luo_file.c | 77 ++++++++++++++++++++----------------
1 file changed, 44 insertions(+), 33 deletions(-)
diff --git a/kernel/liveupdate/luo_file.c b/kernel/liveupdate/luo_file.c
index 208987502f73..9eec07a9e9fc 100644
--- a/kernel/liveupdate/luo_file.c
+++ b/kernel/liveupdate/luo_file.c
@@ -753,6 +753,46 @@ int luo_file_finish(struct luo_file_set *file_set)
return 0;
}
+static int luo_file_deserialize_one(struct luo_file_set *file_set,
+ struct luo_file_ser *ser)
+{
+ struct liveupdate_file_handler *fh;
+ bool handler_found = false;
+ struct luo_file *luo_file;
+
+ down_read(&luo_register_rwlock);
+ list_private_for_each_entry(fh, &luo_file_handler_list, list) {
+ if (!strcmp(fh->compatible, ser->compatible)) {
+ if (try_module_get(fh->ops->owner))
+ handler_found = true;
+ break;
+ }
+ }
+ up_read(&luo_register_rwlock);
+
+ if (!handler_found) {
+ pr_warn("No registered handler for compatible '%.*s'\n",
+ (int)sizeof(ser->compatible),
+ ser->compatible);
+ return -ENOENT;
+ }
+
+ luo_file = kzalloc_obj(*luo_file);
+ if (!luo_file) {
+ module_put(fh->ops->owner);
+ return -ENOMEM;
+ }
+
+ luo_file->fh = fh;
+ luo_file->file = NULL;
+ luo_file->serialized_data = ser->data;
+ luo_file->token = ser->token;
+ mutex_init(&luo_file->mutex);
+ list_add_tail(&luo_file->list, &file_set->files_list);
+
+ return 0;
+}
+
/**
* luo_file_deserialize - Reconstructs the list of preserved files in the new kernel.
* @file_set: The incoming file_set to fill with deserialized data.
@@ -782,6 +822,7 @@ int luo_file_deserialize(struct luo_file_set *file_set,
struct luo_file_set_ser *file_set_ser)
{
struct luo_file_ser *file_ser;
+ int err;
u64 i;
if (!file_set_ser->files) {
@@ -809,39 +850,9 @@ int luo_file_deserialize(struct luo_file_set *file_set,
*/
file_ser = file_set->files;
for (i = 0; i < file_set->count; i++) {
- struct liveupdate_file_handler *fh;
- bool handler_found = false;
- struct luo_file *luo_file;
-
- down_read(&luo_register_rwlock);
- list_private_for_each_entry(fh, &luo_file_handler_list, list) {
- if (!strcmp(fh->compatible, file_ser[i].compatible)) {
- if (try_module_get(fh->ops->owner))
- handler_found = true;
- break;
- }
- }
- up_read(&luo_register_rwlock);
-
- if (!handler_found) {
- pr_warn("No registered handler for compatible '%.*s'\n",
- (int)sizeof(file_ser[i].compatible),
- file_ser[i].compatible);
- return -ENOENT;
- }
-
- luo_file = kzalloc_obj(*luo_file);
- if (!luo_file) {
- module_put(fh->ops->owner);
- return -ENOMEM;
- }
-
- luo_file->fh = fh;
- luo_file->file = NULL;
- luo_file->serialized_data = file_ser[i].data;
- luo_file->token = file_ser[i].token;
- mutex_init(&luo_file->mutex);
- list_add_tail(&luo_file->list, &file_set->files_list);
+ err = luo_file_deserialize_one(file_set, &file_ser[i]);
+ if (err)
+ return err;
}
return 0;
--
2.53.0
^ permalink raw reply related
* [PATCH v6 04/13] liveupdate: register luo_ser as KHO subtree
From: Pasha Tatashin @ 2026-06-03 3:28 UTC (permalink / raw)
To: linux-kselftest, rppt, shuah, akpm, linux-mm, skhan, linux-doc,
linux-kernel, corbet, pasha.tatashin, dmatlack, kexec, pratyush,
skhawaja, graf
In-Reply-To: <20260603032905.344462-1-pasha.tatashin@soleen.com>
Entirely remove the LUO FDT wrapper since the FDT only carries the
compatible string and the pointer to the centralized struct luo_ser.
Instead, register the struct luo_ser via the KHO raw subtree
API, placing the compatibility string inside the structure itself.
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
include/linux/kho/abi/luo.h | 57 +++++++++---------------
kernel/liveupdate/luo_core.c | 85 +++++++++++-------------------------
2 files changed, 46 insertions(+), 96 deletions(-)
diff --git a/include/linux/kho/abi/luo.h b/include/linux/kho/abi/luo.h
index 1b2f865a771a..9a4fe491812b 100644
--- a/include/linux/kho/abi/luo.h
+++ b/include/linux/kho/abi/luo.h
@@ -10,11 +10,11 @@
*
* Live Update Orchestrator uses the stable Application Binary Interface
* defined below to pass state from a pre-update kernel to a post-update
- * kernel. The ABI is built upon the Kexec HandOver framework and uses a
- * Flattened Device Tree to describe the preserved data.
+ * kernel. The ABI is built upon the Kexec HandOver framework and registers
+ * the central `struct luo_ser` via the KHO raw subtree API.
*
- * This interface is a contract. Any modification to the FDT structure, node
- * properties, compatible strings, or the layout of the `__packed` serialization
+ * This interface is a contract. Any modification to the structure fields,
+ * compatible strings, or the layout of the `__packed` serialization
* structures defined here constitutes a breaking change. Such changes require
* incrementing the version number in the relevant `_COMPATIBLE` string to
* prevent a new kernel from misinterpreting data from an old kernel.
@@ -23,31 +23,15 @@
* however, backward/forward compatibility is only guaranteed for kernels
* supporting the same ABI version.
*
- * FDT Structure Overview:
+ * KHO Structure Overview:
* The entire LUO state is encapsulated within a single KHO entry named "LUO".
- * This entry contains an FDT with the following layout:
- *
- * .. code-block:: none
- *
- * / {
- * compatible = "luo-v2";
- * luo-abi-header = <phys_addr_of_luo_ser>;
- * };
- *
- * Main LUO Node (/):
- *
- * - compatible: "luo-v2"
- * Identifies the overall LUO ABI version.
- * - luo-abi-header: u64
- * The physical address of `struct luo_ser`.
+ * This entry contains the `struct luo_ser` structure.
*
* Serialization Structures:
- * The FDT properties point to memory regions containing arrays of simple,
- * `__packed` structures. These structures contain the actual preserved state.
- *
* - struct luo_ser:
* The central ABI structure that contains the overall state of the LUO.
- * It includes the liveupdate-number and pointers to sessions and FLBs.
+ * It includes the compatibility string, the liveupdate-number, and pointers
+ * to sessions and FLBs.
*
* - struct luo_session_header_ser:
* Header for the session array. Contains the total page count of the
@@ -78,26 +62,27 @@
#ifndef _LINUX_KHO_ABI_LUO_H
#define _LINUX_KHO_ABI_LUO_H
+#include <linux/align.h>
#include <uapi/linux/liveupdate.h>
/*
- * The LUO FDT hooks all LUO state for sessions, fds, etc.
+ * The LUO state is registered under this KHO entry name.
*/
-#define LUO_FDT_SIZE PAGE_SIZE
-#define LUO_FDT_KHO_ENTRY_NAME "LUO"
-#define LUO_FDT_COMPATIBLE "luo-v2"
-#define LUO_FDT_ABI_HEADER "luo-abi-header"
+#define LUO_KHO_ENTRY_NAME "LUO"
+#define LUO_ABI_COMPATIBLE "luo-v3"
+#define LUO_ABI_COMPAT_LEN ALIGN(sizeof(LUO_ABI_COMPATIBLE), 8)
/**
* struct luo_ser - Centralized LUO ABI header.
+ * @compatible: Compatibility string identifying the LUO ABI version.
* @liveupdate_num: A counter tracking the number of successful live updates.
* @sessions_pa: Physical address of the first session block header.
* @flbs_pa: Physical address of the FLB header.
*
- * This structure is the root of all preserved LUO state. It is pointed to by
- * the "luo-abi-header" property in the LUO FDT.
+ * This structure is the root of all preserved LUO state.
*/
struct luo_ser {
+ char compatible[LUO_ABI_COMPAT_LEN];
u64 liveupdate_num;
u64 sessions_pa;
u64 flbs_pa;
@@ -111,7 +96,7 @@ struct luo_ser {
* @data: Private data
* @token: User provided token for this file
*
- * If this structure is modified, LUO_SESSION_COMPATIBLE must be updated.
+ * If this structure is modified, `LUO_ABI_COMPATIBLE` must be updated.
*/
struct luo_file_ser {
char compatible[LIVEUPDATE_HNDL_COMPAT_LENGTH];
@@ -142,7 +127,7 @@ struct luo_file_set_ser {
* physical memory preserved across the kexec. It provides the necessary
* metadata to interpret the array of session entries that follow.
*
- * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated.
+ * If this structure is modified, `LUO_ABI_COMPATIBLE` must be updated.
*/
struct luo_session_header_ser {
u64 count;
@@ -159,7 +144,7 @@ struct luo_session_header_ser {
* session) is created and passed to the new kernel, allowing it to reconstruct
* the session context.
*
- * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated.
+ * If this structure is modified, `LUO_ABI_COMPATIBLE` must be updated.
*/
struct luo_session_ser {
char name[LIVEUPDATE_SESSION_NAME_LENGTH];
@@ -180,7 +165,7 @@ struct luo_session_ser {
* This structure is located at the physical address specified by the
* flbs_pa in luo_ser.
*
- * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated.
+ * If this structure is modified, `LUO_ABI_COMPATIBLE` must be updated.
*/
struct luo_flb_header_ser {
u64 pgcnt;
@@ -202,7 +187,7 @@ struct luo_flb_header_ser {
* passed to the new kernel. Each entry allows the LUO core to restore one
* global, shared object.
*
- * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated.
+ * If this structure is modified, `LUO_ABI_COMPATIBLE` must be updated.
*/
struct luo_flb_ser {
char name[LIVEUPDATE_FLB_COMPAT_LENGTH];
diff --git a/kernel/liveupdate/luo_core.c b/kernel/liveupdate/luo_core.c
index 085c0dfc1ef1..69b00e7d0f8f 100644
--- a/kernel/liveupdate/luo_core.c
+++ b/kernel/liveupdate/luo_core.c
@@ -54,7 +54,6 @@
#include <linux/kexec_handover.h>
#include <linux/kho/abi/luo.h>
#include <linux/kobject.h>
-#include <linux/libfdt.h>
#include <linux/liveupdate.h>
#include <linux/miscdevice.h>
#include <linux/mm.h>
@@ -67,8 +66,7 @@
static struct {
bool enabled;
- void *fdt_out;
- void *fdt_in;
+ struct luo_ser *luo_ser_out;
u64 liveupdate_num;
} luo_global;
@@ -85,11 +83,10 @@ early_param("liveupdate", early_liveupdate_param);
static int __init luo_early_startup(void)
{
+ phys_addr_t luo_ser_phys;
struct luo_ser *luo_ser;
- int err, header_size;
- phys_addr_t fdt_phys;
- const void *ptr;
- u64 luo_ser_pa;
+ size_t len;
+ int err;
if (!kho_is_enabled()) {
if (liveupdate_enabled())
@@ -98,40 +95,29 @@ static int __init luo_early_startup(void)
return 0;
}
- /* Retrieve LUO subtree, and verify its format. */
- err = kho_retrieve_subtree(LUO_FDT_KHO_ENTRY_NAME, &fdt_phys, NULL);
+ /* Retrieve LUO state from KHO. */
+ err = kho_retrieve_subtree(LUO_KHO_ENTRY_NAME, &luo_ser_phys, &len);
if (err) {
if (err != -ENOENT) {
- pr_err("failed to retrieve FDT '%s' from KHO: %pe\n",
- LUO_FDT_KHO_ENTRY_NAME, ERR_PTR(err));
+ pr_err("failed to retrieve LUO state '%s' from KHO: %pe\n",
+ LUO_KHO_ENTRY_NAME, ERR_PTR(err));
return err;
}
return 0;
}
- luo_global.fdt_in = phys_to_virt(fdt_phys);
- err = fdt_node_check_compatible(luo_global.fdt_in, 0,
- LUO_FDT_COMPATIBLE);
- if (err) {
- pr_err("FDT '%s' is incompatible with '%s' [%d]\n",
- LUO_FDT_KHO_ENTRY_NAME, LUO_FDT_COMPATIBLE, err);
-
+ if (len < sizeof(*luo_ser)) {
+ pr_err("LUO state is too small (%zu < %zu)\n", len, sizeof(*luo_ser));
return -EINVAL;
}
- header_size = 0;
- ptr = fdt_getprop(luo_global.fdt_in, 0, LUO_FDT_ABI_HEADER, &header_size);
- if (!ptr || header_size != sizeof(u64)) {
- pr_err("Unable to get ABI header '%s' [%d]\n",
- LUO_FDT_ABI_HEADER, header_size);
-
+ luo_ser = phys_to_virt(luo_ser_phys);
+ if (strncmp(luo_ser->compatible, LUO_ABI_COMPATIBLE, LUO_ABI_COMPAT_LEN)) {
+ pr_err("LUO state is incompatible with '%s'\n", LUO_ABI_COMPATIBLE);
return -EINVAL;
}
- luo_ser_pa = get_unaligned((u64 *)ptr);
- luo_ser = phys_to_virt(luo_ser_pa);
-
luo_global.liveupdate_num = luo_ser->liveupdate_num;
pr_info("Retrieved live update data, liveupdate number: %lld\n",
luo_global.liveupdate_num);
@@ -164,37 +150,20 @@ static int __init liveupdate_early_init(void)
}
early_initcall(liveupdate_early_init);
-/* Called during boot to create outgoing LUO fdt tree */
-static int __init luo_fdt_setup(void)
+/* Called during boot to create outgoing LUO state */
+static int __init luo_state_setup(void)
{
struct luo_ser *luo_ser;
- u64 luo_ser_pa;
- void *fdt_out;
int err;
- fdt_out = kho_alloc_preserve(LUO_FDT_SIZE);
- if (IS_ERR(fdt_out)) {
- pr_err("failed to allocate/preserve FDT memory\n");
- return PTR_ERR(fdt_out);
- }
-
luo_ser = kho_alloc_preserve(sizeof(*luo_ser));
if (IS_ERR(luo_ser)) {
- err = PTR_ERR(luo_ser);
- goto exit_free_fdt;
+ pr_err("failed to allocate/preserve LUO state memory\n");
+ return PTR_ERR(luo_ser);
}
- luo_ser_pa = virt_to_phys(luo_ser);
-
- err = fdt_create(fdt_out, LUO_FDT_SIZE);
- err |= fdt_finish_reservemap(fdt_out);
- err |= fdt_begin_node(fdt_out, "");
- err |= fdt_property_string(fdt_out, "compatible", LUO_FDT_COMPATIBLE);
- err |= fdt_property(fdt_out, LUO_FDT_ABI_HEADER, &luo_ser_pa,
- sizeof(luo_ser_pa));
- err |= fdt_end_node(fdt_out);
- err |= fdt_finish(fdt_out);
- if (err)
- goto exit_free_luo_ser;
+
+ strscpy(luo_ser->compatible, LUO_ABI_COMPATIBLE, sizeof(luo_ser->compatible));
+ luo_ser->liveupdate_num = luo_global.liveupdate_num + 1;
err = luo_session_setup_outgoing(&luo_ser->sessions_pa);
if (err)
@@ -204,21 +173,17 @@ static int __init luo_fdt_setup(void)
if (err)
goto exit_free_luo_ser;
- luo_ser->liveupdate_num = luo_global.liveupdate_num + 1;
-
- err = kho_add_subtree(LUO_FDT_KHO_ENTRY_NAME, fdt_out,
- fdt_totalsize(fdt_out));
+ err = kho_add_subtree(LUO_KHO_ENTRY_NAME, luo_ser, sizeof(*luo_ser));
if (err)
goto exit_free_luo_ser;
- luo_global.fdt_out = fdt_out;
+
+ luo_global.luo_ser_out = luo_ser;
return 0;
exit_free_luo_ser:
kho_unpreserve_free(luo_ser);
-exit_free_fdt:
- kho_unpreserve_free(fdt_out);
- pr_err("failed to prepare LUO FDT: %d\n", err);
+ pr_err("failed to prepare LUO state: %d\n", err);
return err;
}
@@ -234,7 +199,7 @@ static int __init luo_late_startup(void)
if (!liveupdate_enabled())
return 0;
- err = luo_fdt_setup();
+ err = luo_state_setup();
if (err)
luo_global.enabled = false;
--
2.53.0
^ permalink raw reply related
* [PATCH v6 03/13] liveupdate: centralize state management into struct luo_ser
From: Pasha Tatashin @ 2026-06-03 3:28 UTC (permalink / raw)
To: linux-kselftest, rppt, shuah, akpm, linux-mm, skhan, linux-doc,
linux-kernel, corbet, pasha.tatashin, dmatlack, kexec, pratyush,
skhawaja, graf
In-Reply-To: <20260603032905.344462-1-pasha.tatashin@soleen.com>
Transition the LUO to ABI v2, which centralizes state management into a
single struct luo_ser header.
Previously, LUO state was spread across multiple FDT properties and
subnodes. ABI v2 simplifies this by placing all core state, including
the liveupdate number and physical addresses for sessions and FLB
headers into a centralized struct luo_ser.
Note that this change introduces a semantic difference: the sessions
and FLB serialization formats are no longer completely independent of
the core LUO. Their metadata (such as physical addresses for sessions
and FLB headers) is now coupled to and managed via the centralized
struct luo_ser.
Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
include/linux/kho/abi/luo.h | 91 +++++++++++---------------------
kernel/liveupdate/luo_core.c | 64 +++++++++++++++-------
kernel/liveupdate/luo_flb.c | 60 +++------------------
kernel/liveupdate/luo_internal.h | 8 +--
kernel/liveupdate/luo_session.c | 64 ++++------------------
5 files changed, 96 insertions(+), 191 deletions(-)
diff --git a/include/linux/kho/abi/luo.h b/include/linux/kho/abi/luo.h
index 46750a0ddf88..1b2f865a771a 100644
--- a/include/linux/kho/abi/luo.h
+++ b/include/linux/kho/abi/luo.h
@@ -30,52 +30,25 @@
* .. code-block:: none
*
* / {
- * compatible = "luo-v1";
- * liveupdate-number = <...>;
- *
- * luo-session {
- * compatible = "luo-session-v1";
- * luo-session-header = <phys_addr_of_session_header_ser>;
- * };
- *
- * luo-flb {
- * compatible = "luo-flb-v1";
- * luo-flb-header = <phys_addr_of_flb_header_ser>;
- * };
+ * compatible = "luo-v2";
+ * luo-abi-header = <phys_addr_of_luo_ser>;
* };
*
* Main LUO Node (/):
*
- * - compatible: "luo-v1"
+ * - compatible: "luo-v2"
* Identifies the overall LUO ABI version.
- * - liveupdate-number: u64
- * A counter tracking the number of successful live updates performed.
- *
- * Session Node (luo-session):
- * This node describes all preserved user-space sessions.
- *
- * - compatible: "luo-session-v1"
- * Identifies the session ABI version.
- * - luo-session-header: u64
- * The physical address of a `struct luo_session_header_ser`. This structure
- * is the header for a contiguous block of memory containing an array of
- * `struct luo_session_ser`, one for each preserved session.
- *
- * File-Lifecycle-Bound Node (luo-flb):
- * This node describes all preserved global objects whose lifecycle is bound
- * to that of the preserved files (e.g., shared IOMMU state).
- *
- * - compatible: "luo-flb-v1"
- * Identifies the FLB ABI version.
- * - luo-flb-header: u64
- * The physical address of a `struct luo_flb_header_ser`. This structure is
- * the header for a contiguous block of memory containing an array of
- * `struct luo_flb_ser`, one for each preserved global object.
+ * - luo-abi-header: u64
+ * The physical address of `struct luo_ser`.
*
* Serialization Structures:
* The FDT properties point to memory regions containing arrays of simple,
* `__packed` structures. These structures contain the actual preserved state.
*
+ * - struct luo_ser:
+ * The central ABI structure that contains the overall state of the LUO.
+ * It includes the liveupdate-number and pointers to sessions and FLBs.
+ *
* - struct luo_session_header_ser:
* Header for the session array. Contains the total page count of the
* preserved memory block and the number of `struct luo_session_ser`
@@ -109,13 +82,26 @@
/*
* The LUO FDT hooks all LUO state for sessions, fds, etc.
- * In the root it also carries "liveupdate-number" 64-bit property that
- * corresponds to the number of live-updates performed on this machine.
*/
#define LUO_FDT_SIZE PAGE_SIZE
#define LUO_FDT_KHO_ENTRY_NAME "LUO"
-#define LUO_FDT_COMPATIBLE "luo-v1"
-#define LUO_FDT_LIVEUPDATE_NUM "liveupdate-number"
+#define LUO_FDT_COMPATIBLE "luo-v2"
+#define LUO_FDT_ABI_HEADER "luo-abi-header"
+
+/**
+ * struct luo_ser - Centralized LUO ABI header.
+ * @liveupdate_num: A counter tracking the number of successful live updates.
+ * @sessions_pa: Physical address of the first session block header.
+ * @flbs_pa: Physical address of the FLB header.
+ *
+ * This structure is the root of all preserved LUO state. It is pointed to by
+ * the "luo-abi-header" property in the LUO FDT.
+ */
+struct luo_ser {
+ u64 liveupdate_num;
+ u64 sessions_pa;
+ u64 flbs_pa;
+} __packed;
#define LIVEUPDATE_HNDL_COMPAT_LENGTH 48
@@ -147,15 +133,6 @@ struct luo_file_set_ser {
u64 count;
} __packed;
-/*
- * LUO FDT session node
- * LUO_FDT_SESSION_HEADER: is a u64 physical address of struct
- * luo_session_header_ser
- */
-#define LUO_FDT_SESSION_NODE_NAME "luo-session"
-#define LUO_FDT_SESSION_COMPATIBLE "luo-session-v2"
-#define LUO_FDT_SESSION_HEADER "luo-session-header"
-
/**
* struct luo_session_header_ser - Header for the serialized session data block.
* @count: The number of `struct luo_session_ser` entries that immediately
@@ -165,7 +142,7 @@ struct luo_file_set_ser {
* physical memory preserved across the kexec. It provides the necessary
* metadata to interpret the array of session entries that follow.
*
- * If this structure is modified, `LUO_FDT_SESSION_COMPATIBLE` must be updated.
+ * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated.
*/
struct luo_session_header_ser {
u64 count;
@@ -182,7 +159,7 @@ struct luo_session_header_ser {
* session) is created and passed to the new kernel, allowing it to reconstruct
* the session context.
*
- * If this structure is modified, `LUO_FDT_SESSION_COMPATIBLE` must be updated.
+ * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated.
*/
struct luo_session_ser {
char name[LIVEUPDATE_SESSION_NAME_LENGTH];
@@ -192,10 +169,6 @@ struct luo_session_ser {
/* The max size is set so it can be reliably used during in serialization */
#define LIVEUPDATE_FLB_COMPAT_LENGTH 48
-#define LUO_FDT_FLB_NODE_NAME "luo-flb"
-#define LUO_FDT_FLB_COMPATIBLE "luo-flb-v1"
-#define LUO_FDT_FLB_HEADER "luo-flb-header"
-
/**
* struct luo_flb_header_ser - Header for the serialized FLB data block.
* @pgcnt: The total number of pages occupied by the entire preserved memory
@@ -205,11 +178,9 @@ struct luo_session_ser {
* in the memory block.
*
* This structure is located at the physical address specified by the
- * `LUO_FDT_FLB_HEADER` FDT property. It provides the new kernel with the
- * necessary information to find and iterate over the array of preserved
- * File-Lifecycle-Bound objects and to manage the underlying memory.
+ * flbs_pa in luo_ser.
*
- * If this structure is modified, LUO_FDT_FLB_COMPATIBLE must be updated.
+ * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated.
*/
struct luo_flb_header_ser {
u64 pgcnt;
@@ -231,7 +202,7 @@ struct luo_flb_header_ser {
* passed to the new kernel. Each entry allows the LUO core to restore one
* global, shared object.
*
- * If this structure is modified, LUO_FDT_FLB_COMPATIBLE must be updated.
+ * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated.
*/
struct luo_flb_ser {
char name[LIVEUPDATE_FLB_COMPAT_LENGTH];
diff --git a/kernel/liveupdate/luo_core.c b/kernel/liveupdate/luo_core.c
index 5d5827ced73c..085c0dfc1ef1 100644
--- a/kernel/liveupdate/luo_core.c
+++ b/kernel/liveupdate/luo_core.c
@@ -61,7 +61,6 @@
#include <linux/rwsem.h>
#include <linux/sizes.h>
#include <linux/string.h>
-#include <linux/unaligned.h>
#include "kexec_handover_internal.h"
#include "luo_internal.h"
@@ -86,9 +85,11 @@ early_param("liveupdate", early_liveupdate_param);
static int __init luo_early_startup(void)
{
+ struct luo_ser *luo_ser;
+ int err, header_size;
phys_addr_t fdt_phys;
- int err, ln_size;
const void *ptr;
+ u64 luo_ser_pa;
if (!kho_is_enabled()) {
if (liveupdate_enabled())
@@ -119,26 +120,32 @@ static int __init luo_early_startup(void)
return -EINVAL;
}
- ln_size = 0;
- ptr = fdt_getprop(luo_global.fdt_in, 0, LUO_FDT_LIVEUPDATE_NUM,
- &ln_size);
- if (!ptr || ln_size != sizeof(luo_global.liveupdate_num)) {
- pr_err("Unable to get live update number '%s' [%d]\n",
- LUO_FDT_LIVEUPDATE_NUM, ln_size);
+ header_size = 0;
+ ptr = fdt_getprop(luo_global.fdt_in, 0, LUO_FDT_ABI_HEADER, &header_size);
+ if (!ptr || header_size != sizeof(u64)) {
+ pr_err("Unable to get ABI header '%s' [%d]\n",
+ LUO_FDT_ABI_HEADER, header_size);
return -EINVAL;
}
- luo_global.liveupdate_num = get_unaligned((u64 *)ptr);
+ luo_ser_pa = get_unaligned((u64 *)ptr);
+ luo_ser = phys_to_virt(luo_ser_pa);
+
+ luo_global.liveupdate_num = luo_ser->liveupdate_num;
pr_info("Retrieved live update data, liveupdate number: %lld\n",
luo_global.liveupdate_num);
- err = luo_session_setup_incoming(luo_global.fdt_in);
+ err = luo_session_setup_incoming(luo_ser->sessions_pa);
if (err)
- return err;
+ goto out_free_ser;
+
+ luo_flb_setup_incoming(luo_ser->flbs_pa);
- err = luo_flb_setup_incoming(luo_global.fdt_in);
+ err = 0;
+out_free_ser:
+ kho_restore_free(luo_ser);
return err;
}
@@ -160,7 +167,8 @@ early_initcall(liveupdate_early_init);
/* Called during boot to create outgoing LUO fdt tree */
static int __init luo_fdt_setup(void)
{
- const u64 ln = luo_global.liveupdate_num + 1;
+ struct luo_ser *luo_ser;
+ u64 luo_ser_pa;
void *fdt_out;
int err;
@@ -170,27 +178,45 @@ static int __init luo_fdt_setup(void)
return PTR_ERR(fdt_out);
}
+ luo_ser = kho_alloc_preserve(sizeof(*luo_ser));
+ if (IS_ERR(luo_ser)) {
+ err = PTR_ERR(luo_ser);
+ goto exit_free_fdt;
+ }
+ luo_ser_pa = virt_to_phys(luo_ser);
+
err = fdt_create(fdt_out, LUO_FDT_SIZE);
err |= fdt_finish_reservemap(fdt_out);
err |= fdt_begin_node(fdt_out, "");
err |= fdt_property_string(fdt_out, "compatible", LUO_FDT_COMPATIBLE);
- err |= fdt_property(fdt_out, LUO_FDT_LIVEUPDATE_NUM, &ln, sizeof(ln));
- err |= luo_session_setup_outgoing(fdt_out);
- err |= luo_flb_setup_outgoing(fdt_out);
+ err |= fdt_property(fdt_out, LUO_FDT_ABI_HEADER, &luo_ser_pa,
+ sizeof(luo_ser_pa));
err |= fdt_end_node(fdt_out);
err |= fdt_finish(fdt_out);
if (err)
- goto exit_free;
+ goto exit_free_luo_ser;
+
+ err = luo_session_setup_outgoing(&luo_ser->sessions_pa);
+ if (err)
+ goto exit_free_luo_ser;
+
+ err = luo_flb_setup_outgoing(&luo_ser->flbs_pa);
+ if (err)
+ goto exit_free_luo_ser;
+
+ luo_ser->liveupdate_num = luo_global.liveupdate_num + 1;
err = kho_add_subtree(LUO_FDT_KHO_ENTRY_NAME, fdt_out,
fdt_totalsize(fdt_out));
if (err)
- goto exit_free;
+ goto exit_free_luo_ser;
luo_global.fdt_out = fdt_out;
return 0;
-exit_free:
+exit_free_luo_ser:
+ kho_unpreserve_free(luo_ser);
+exit_free_fdt:
kho_unpreserve_free(fdt_out);
pr_err("failed to prepare LUO FDT: %d\n", err);
diff --git a/kernel/liveupdate/luo_flb.c b/kernel/liveupdate/luo_flb.c
index 8f5c5dd01cd0..5c27134ce7ba 100644
--- a/kernel/liveupdate/luo_flb.c
+++ b/kernel/liveupdate/luo_flb.c
@@ -44,13 +44,11 @@
#include <linux/io.h>
#include <linux/kexec_handover.h>
#include <linux/kho/abi/luo.h>
-#include <linux/libfdt.h>
#include <linux/list_private.h>
#include <linux/liveupdate.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/slab.h>
-#include <linux/unaligned.h>
#include "luo_internal.h"
#define LUO_FLB_PGCNT 1ul
@@ -551,27 +549,15 @@ int liveupdate_flb_get_outgoing(struct liveupdate_flb *flb, void **objp)
return 0;
}
-int __init luo_flb_setup_outgoing(void *fdt_out)
+int __init luo_flb_setup_outgoing(u64 *flbs_pa)
{
struct luo_flb_header_ser *header_ser;
- u64 header_ser_pa;
- int err;
header_ser = kho_alloc_preserve(LUO_FLB_PGCNT << PAGE_SHIFT);
if (IS_ERR(header_ser))
return PTR_ERR(header_ser);
- header_ser_pa = virt_to_phys(header_ser);
-
- err = fdt_begin_node(fdt_out, LUO_FDT_FLB_NODE_NAME);
- err |= fdt_property_string(fdt_out, "compatible",
- LUO_FDT_FLB_COMPATIBLE);
- err |= fdt_property(fdt_out, LUO_FDT_FLB_HEADER, &header_ser_pa,
- sizeof(header_ser_pa));
- err |= fdt_end_node(fdt_out);
-
- if (err)
- goto err_unpreserve;
+ *flbs_pa = virt_to_phys(header_ser);
header_ser->pgcnt = LUO_FLB_PGCNT;
luo_flb_global.outgoing.header_ser = header_ser;
@@ -579,53 +565,19 @@ int __init luo_flb_setup_outgoing(void *fdt_out)
luo_flb_global.outgoing.active = true;
return 0;
-
-err_unpreserve:
- kho_unpreserve_free(header_ser);
-
- return err;
}
-int __init luo_flb_setup_incoming(void *fdt_in)
+void __init luo_flb_setup_incoming(u64 flbs_pa)
{
struct luo_flb_header_ser *header_ser;
- int err, header_size, offset;
- const void *ptr;
- u64 header_ser_pa;
-
- offset = fdt_subnode_offset(fdt_in, 0, LUO_FDT_FLB_NODE_NAME);
- if (offset < 0) {
- pr_err("Unable to get FLB node [%s]\n", LUO_FDT_FLB_NODE_NAME);
-
- return -ENOENT;
- }
-
- err = fdt_node_check_compatible(fdt_in, offset,
- LUO_FDT_FLB_COMPATIBLE);
- if (err) {
- pr_err("FLB node is incompatible with '%s' [%d]\n",
- LUO_FDT_FLB_COMPATIBLE, err);
-
- return -EINVAL;
- }
-
- header_size = 0;
- ptr = fdt_getprop(fdt_in, offset, LUO_FDT_FLB_HEADER, &header_size);
- if (!ptr || header_size != sizeof(u64)) {
- pr_err("Unable to get FLB header property '%s' [%d]\n",
- LUO_FDT_FLB_HEADER, header_size);
- return -EINVAL;
- }
-
- header_ser_pa = get_unaligned((u64 *)ptr);
- header_ser = phys_to_virt(header_ser_pa);
+ if (!flbs_pa)
+ return;
+ header_ser = phys_to_virt(flbs_pa);
luo_flb_global.incoming.header_ser = header_ser;
luo_flb_global.incoming.ser = (void *)(header_ser + 1);
luo_flb_global.incoming.active = true;
-
- return 0;
}
/**
diff --git a/kernel/liveupdate/luo_internal.h b/kernel/liveupdate/luo_internal.h
index ae58206f14ac..fe22086bfbeb 100644
--- a/kernel/liveupdate/luo_internal.h
+++ b/kernel/liveupdate/luo_internal.h
@@ -79,8 +79,8 @@ extern struct rw_semaphore luo_register_rwlock;
int luo_session_create(const char *name, struct file **filep);
int luo_session_retrieve(const char *name, struct file **filep);
-int __init luo_session_setup_outgoing(void *fdt);
-int __init luo_session_setup_incoming(void *fdt);
+int __init luo_session_setup_outgoing(u64 *sessions_pa);
+int __init luo_session_setup_incoming(u64 sessions_pa);
int luo_session_serialize(void);
int luo_session_deserialize(void);
@@ -102,8 +102,8 @@ int luo_flb_file_preserve(struct liveupdate_file_handler *fh);
void luo_flb_file_unpreserve(struct liveupdate_file_handler *fh);
void luo_flb_file_finish(struct liveupdate_file_handler *fh);
void luo_flb_unregister_all(struct liveupdate_file_handler *fh);
-int __init luo_flb_setup_outgoing(void *fdt);
-int __init luo_flb_setup_incoming(void *fdt);
+int __init luo_flb_setup_outgoing(u64 *flbs_pa);
+void __init luo_flb_setup_incoming(u64 flbs_pa);
void luo_flb_serialize(void);
#ifdef CONFIG_LIVEUPDATE_TEST
diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
index 47566db64598..85782c6f3d6c 100644
--- a/kernel/liveupdate/luo_session.c
+++ b/kernel/liveupdate/luo_session.c
@@ -25,9 +25,8 @@
*
* - Serialization: Session metadata is preserved using the KHO framework. When
* a live update is triggered via kexec, an array of `struct luo_session_ser`
- * is populated and placed in a preserved memory region. An FDT node is also
- * created, containing the count of sessions and the physical address of this
- * array.
+ * is populated and placed in a preserved memory region. The physical address
+ * of this array is stored in the centralized `struct luo_ser` structure.
*
* Session Lifecycle:
*
@@ -91,13 +90,11 @@
#include <linux/io.h>
#include <linux/kexec_handover.h>
#include <linux/kho/abi/luo.h>
-#include <linux/libfdt.h>
#include <linux/list.h>
#include <linux/liveupdate.h>
#include <linux/mutex.h>
#include <linux/rwsem.h>
#include <linux/slab.h>
-#include <linux/unaligned.h>
#include <uapi/linux/liveupdate.h>
#include "luo_internal.h"
@@ -527,75 +524,34 @@ int luo_session_retrieve(const char *name, struct file **filep)
return err;
}
-int __init luo_session_setup_outgoing(void *fdt_out)
+int __init luo_session_setup_outgoing(u64 *sessions_pa)
{
struct luo_session_header_ser *header_ser;
- u64 header_ser_pa;
- int err;
header_ser = kho_alloc_preserve(LUO_SESSION_PGCNT << PAGE_SHIFT);
if (IS_ERR(header_ser))
return PTR_ERR(header_ser);
- header_ser_pa = virt_to_phys(header_ser);
-
- err = fdt_begin_node(fdt_out, LUO_FDT_SESSION_NODE_NAME);
- err |= fdt_property_string(fdt_out, "compatible",
- LUO_FDT_SESSION_COMPATIBLE);
- err |= fdt_property(fdt_out, LUO_FDT_SESSION_HEADER, &header_ser_pa,
- sizeof(header_ser_pa));
- err |= fdt_end_node(fdt_out);
- if (err)
- goto err_unpreserve;
+ *sessions_pa = virt_to_phys(header_ser);
luo_session_global.outgoing.header_ser = header_ser;
luo_session_global.outgoing.ser = (void *)(header_ser + 1);
luo_session_global.outgoing.active = true;
return 0;
-
-err_unpreserve:
- kho_unpreserve_free(header_ser);
- return err;
}
-int __init luo_session_setup_incoming(void *fdt_in)
+int __init luo_session_setup_incoming(u64 sessions_pa)
{
struct luo_session_header_ser *header_ser;
- int err, header_size, offset;
- u64 header_ser_pa;
- const void *ptr;
-
- offset = fdt_subnode_offset(fdt_in, 0, LUO_FDT_SESSION_NODE_NAME);
- if (offset < 0) {
- pr_err("Unable to get session node: [%s]\n",
- LUO_FDT_SESSION_NODE_NAME);
- return -EINVAL;
- }
- err = fdt_node_check_compatible(fdt_in, offset,
- LUO_FDT_SESSION_COMPATIBLE);
- if (err) {
- pr_err("Session node incompatible [%s]\n",
- LUO_FDT_SESSION_COMPATIBLE);
- return -EINVAL;
- }
-
- header_size = 0;
- ptr = fdt_getprop(fdt_in, offset, LUO_FDT_SESSION_HEADER, &header_size);
- if (!ptr || header_size != sizeof(u64)) {
- pr_err("Unable to get session header '%s' [%d]\n",
- LUO_FDT_SESSION_HEADER, header_size);
- return -EINVAL;
+ if (sessions_pa) {
+ header_ser = phys_to_virt(sessions_pa);
+ luo_session_global.incoming.header_ser = header_ser;
+ luo_session_global.incoming.ser = (void *)(header_ser + 1);
+ luo_session_global.incoming.active = true;
}
- header_ser_pa = get_unaligned((u64 *)ptr);
- header_ser = phys_to_virt(header_ser_pa);
-
- luo_session_global.incoming.header_ser = header_ser;
- luo_session_global.incoming.ser = (void *)(header_ser + 1);
- luo_session_global.incoming.active = true;
-
return 0;
}
--
2.53.0
^ permalink raw reply related
* [PATCH v6 02/13] liveupdate: avoid mixing cleanup guards with goto in luo_session_retrieve_fd
From: Pasha Tatashin @ 2026-06-03 3:28 UTC (permalink / raw)
To: linux-kselftest, rppt, shuah, akpm, linux-mm, skhan, linux-doc,
linux-kernel, corbet, pasha.tatashin, dmatlack, kexec, pratyush,
skhawaja, graf
In-Reply-To: <20260603032905.344462-1-pasha.tatashin@soleen.com>
Refactoring luo_session_retrieve_fd() to avoid mixing automated
cleanup-style guards with goto-based resource release, which is not
recommended under the Linux kernel coding style.
Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
kernel/liveupdate/luo_session.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
index 5c6cebc6e326..47566db64598 100644
--- a/kernel/liveupdate/luo_session.c
+++ b/kernel/liveupdate/luo_session.c
@@ -291,10 +291,11 @@ static int luo_session_retrieve_fd(struct luo_session *session,
if (argp->fd < 0)
return argp->fd;
- guard(mutex)(&session->mutex);
+ mutex_lock(&session->mutex);
err = luo_retrieve_file(&session->file_set, argp->token, &file);
+ mutex_unlock(&session->mutex);
if (err < 0)
- goto err_put_fd;
+ goto err_put_fd;
err = luo_ucmd_respond(ucmd, sizeof(*argp));
if (err)
--
2.53.0
^ permalink raw reply related
* [PATCH v6 01/13] liveupdate: change file_set->count type to u64 for type safety
From: Pasha Tatashin @ 2026-06-03 3:28 UTC (permalink / raw)
To: linux-kselftest, rppt, shuah, akpm, linux-mm, skhan, linux-doc,
linux-kernel, corbet, pasha.tatashin, dmatlack, kexec, pratyush,
skhawaja, graf
In-Reply-To: <20260603032905.344462-1-pasha.tatashin@soleen.com>
This improves type safety and aligns the in-memory file_set->count with
the serialized count type. It avoids potential truncation or sign
conversion mismatch issues.
Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
kernel/liveupdate/luo_internal.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/liveupdate/luo_internal.h b/kernel/liveupdate/luo_internal.h
index dd53d4a7277e..ae58206f14ac 100644
--- a/kernel/liveupdate/luo_internal.h
+++ b/kernel/liveupdate/luo_internal.h
@@ -52,7 +52,7 @@ static inline int luo_ucmd_respond(struct luo_ucmd *ucmd,
struct luo_file_set {
struct list_head files_list;
struct luo_file_ser *files;
- long count;
+ u64 count;
};
/**
--
2.53.0
^ permalink raw reply related
* [PATCH v6 00/13] liveupdate: Remove limits on sessions and files
From: Pasha Tatashin @ 2026-06-03 3:28 UTC (permalink / raw)
To: linux-kselftest, rppt, shuah, akpm, linux-mm, skhan, linux-doc,
linux-kernel, corbet, pasha.tatashin, dmatlack, kexec, pratyush,
skhawaja, graf
Hi all,
This series removes the fixed limits on the number of files that can
be preserved within a single session, and the total number of sessions
managed by the Live Update Orchestrator (LUO).
The core of the change is a transition from single contiguous memory
blocks for metadata serialization to a chain of linked blocks. This
allows LUO to scale dynamically.
1. ABI Evolution:
- Introduced linked-block headers for both file and session
serialization.
- Bumped session ABI version to v4.
2. Memory Management & Security:
- Implemented a dynamic block allocation and reuse strategy. Blocks
are allocated only when existing ones are exhausted and are reused
during session/file removal cycles.
- Introduced KHO_MAX_BLOCKS (10000) as a safeguard against stupid
excessive allocations or corrupted cyclic lists during restore.
3. Expanded Selftests:
- Added new kexec-based tests verifying preservation of
2000 sessions and 500 files per session.
- Added self-tests for many sessions and many files management.
Tree: git.kernel.org/pub/scm/linux/kernel/git/tatashin/linux.git
Branch: luo-remove-max-files-sessions-limits/v6
Changes v6:
- Addressed comments from Mike and Pratyush:
- Simplified kho_block_set_destroy() to only free successfully tracked blocks
- Enabled dynamic entry count tracking in kho_block_set_it_reserve_entry()
to automatically update the count field in block headers on every reserve.
- Removed the error kho_block_set_it_finalize().
- Renamed various kho_block_* APIs to kho_block_set_* (e.g. kho_block_set_grow,
kho_block_set_shrink, struct kho_block_set_it, etc.).
Changes v5:
- Addressed comments from Pratyush:
- Renamed kho_block_restore -> kho_block_set_restore, kho_block_destroy -> kho_block_set_destroy.
- Renamed block iterator next/read functions to reserve_entry/read_entry.
- Added public helpers kho_block_set_head_pa() and kho_block_set_is_empty().
- Added validation to treat zero-count blocks as errors during restoration.
- Simplified block iterator reading loop from a while to an if statement.
- Changed standard WARN_ON macros to WARN_ON_ONCE on iterator allocation checks, and added warning details.
- Simplified session serialization by removing a redundant NULL check on sessions_pa.
Please review.
Thanks,
Pasha
Pasha Tatashin (13):
liveupdate: change file_set->count type to u64 for type safety
liveupdate: avoid mixing cleanup guards with goto in
luo_session_retrieve_fd
liveupdate: centralize state management into struct luo_ser
liveupdate: register luo_ser as KHO subtree
liveupdate: Extract luo_file_deserialize_one helper
liveupdate: Extract luo_session_deserialize_one helper
kho: add support for linked-block serialization
liveupdate: defer session block allocation and physical address
setting
liveupdate: Remove limit on the number of sessions
liveupdate: Remove limit on the number of files per session
selftests/liveupdate: Test session and file limit removal
selftests/liveupdate: Add stress-sessions kexec test
selftests/liveupdate: Add stress-files kexec test
Documentation/core-api/kho/abi.rst | 5 +
Documentation/core-api/kho/index.rst | 11 +
MAINTAINERS | 1 +
include/linux/kho/abi/block.h | 56 +++
include/linux/kho/abi/luo.h | 149 ++-----
include/linux/kho_block.h | 106 +++++
kernel/liveupdate/Makefile | 1 +
kernel/liveupdate/kho_block.c | 411 ++++++++++++++++++
kernel/liveupdate/luo_core.c | 99 ++---
kernel/liveupdate/luo_file.c | 205 ++++-----
kernel/liveupdate/luo_flb.c | 60 +--
kernel/liveupdate/luo_internal.h | 16 +-
kernel/liveupdate/luo_session.c | 219 +++++-----
tools/testing/selftests/liveupdate/Makefile | 2 +
.../testing/selftests/liveupdate/liveupdate.c | 75 ++++
.../selftests/liveupdate/luo_stress_files.c | 97 +++++
.../liveupdate/luo_stress_sessions.c | 102 +++++
.../selftests/liveupdate/luo_test_utils.c | 24 +
.../selftests/liveupdate/luo_test_utils.h | 2 +
19 files changed, 1196 insertions(+), 445 deletions(-)
create mode 100644 include/linux/kho/abi/block.h
create mode 100644 include/linux/kho_block.h
create mode 100644 kernel/liveupdate/kho_block.c
create mode 100644 tools/testing/selftests/liveupdate/luo_stress_files.c
create mode 100644 tools/testing/selftests/liveupdate/luo_stress_sessions.c
base-commit: 2935777b418d2bfcbfe96705bb2c0fa6c0d94e18
--
2.53.0
^ permalink raw reply
* Re: [PATCH v4 02/13] liveupdate: avoid mixing cleanup guards with goto in luo_session_retrieve_fd
From: Pasha Tatashin @ 2026-06-03 3:10 UTC (permalink / raw)
To: Mike Rapoport
Cc: Pasha Tatashin, linux-kselftest, shuah, akpm, linux-mm, skhan,
linux-doc, linux-kernel, corbet, dmatlack, kexec, pratyush,
skhawaja, graf
In-Reply-To: <178038801485.119771.9514973100282773342.b4-review@b4>
On 06-02 11:13, Mike Rapoport wrote:
> On Sat, 30 May 2026 22:19:27 +0000, Pasha Tatashin <pasha.tatashin@soleen.com> wrote:
> > diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
> > index 146414933977..8d9201c25412 100644
> > --- a/kernel/liveupdate/luo_session.c
> > +++ b/kernel/liveupdate/luo_session.c
> > @@ -291,25 +291,24 @@ static int luo_session_retrieve_fd(struct luo_session *session,
> > if (argp->fd < 0)
> > return argp->fd;
> >
> > - guard(mutex)(&session->mutex);
> > - err = luo_retrieve_file(&session->file_set, argp->token, &file);
> > - if (err < 0)
> > - goto err_put_fd;
> > + scoped_guard(mutex, &session->mutex) {
> > + err = luo_retrieve_file(&session->file_set, argp->token, &file);
> > + if (err < 0) {
> > + put_unused_fd(argp->fd);
> > + return err;
>
> I don't like piling up error handling inside if (err) statements.
>
> As we only need the lock only for luo_retrieve_file() I think it's better
> drop the guard and use goto:
>
>
> mutex_lock(&session->mutex);
> err = luo_retrieve_file(&session->file_set, argp->token, &file);
> mutex_unlock(&session->mutex);
> if (err)
> ...
ok, done.
>
> --
> Sincerely yours,
> Mike.
>
^ permalink raw reply
* Re: [PATCH v3 1/4] mm/zswap: Make shrink_worker writeback cursor per-memcg
From: Hao Jia @ 2026-06-03 3:02 UTC (permalink / raw)
To: Yosry Ahmed
Cc: akpm, tj, hannes, shakeel.butt, mhocko, mkoutny, nphamcs,
chengming.zhou, muchun.song, roman.gushchin, cgroups, linux-mm,
linux-kernel, linux-doc, Hao Jia
In-Reply-To: <ah9i3uhh3PFiS0Uk@google.com>
On 2026/6/3 07:19, Yosry Ahmed wrote:
>>>>>> Proactive writeback also wants a similar per-memcg cursor that is
>>>>>> scoped to the specified memcg, so that repeated invocations against
>>>>>> the same memcg make forward progress across its descendant memcgs
>>>>>> instead of restarting from the first child memcg each time.
>>>>>
>>>>> Is this a problem in practice?
>>>>>
>>>>> Is the concern the overhead of scanning memcgs repeatedly, or lack of
>>>>> fairness? I wonder if we should just do writeback in batches from all
>>>>> memcgs, similar to how reclaim does it, then evaluate at the end if we
>>>>> need to start over?
>>>>>
>>>>
>>>> Not using a per-cgroup cursor will cause issues for "repeated small-budget
>>>> calls" cases. For example, repeatedly triggering a 2MB writeback might
>>>> result in only writing back pages from the first few child memcgs every
>>>> time. In the worst-case scenario (where the writeback amount is less than
>>>> WB_BATCH), it might only ever write back from the first child memcg.
>>>
>>> Right, so a fairness concern?
>>>
>>> I wonder if we should just reclaim a batch from each memcg, then check
>>> if we reached the goal, otherwise start over. If the batch size is small
>>> enough that should work?
>>
>> Even with a small batch size, for small writeback requests triggered by
>> user-space (e.g., 2MB, which is batch size * N), it might still repeatedly
>> write back from only the first N child memcgs.
>
> Yes, I understand, I am asking if this is a problem in practice. For
> this to be a problem we'd need to trigger small writeback requests and
> have many memcgs.
>
>> This could cause the user-space agent to prematurely give up on zswap
>> writeback.
>
> Why? The kernel should not return before trying to writeback from all
> memcgs. If we scan the first N child memcgs and did not writeback
> enough, we should keep going, right?
>
Yes, this issue is not caused by the kernel, but rather by our
user-space agent itself.
For instance, suppose a parent memcg has two children, memcg1 and
memcg2, each with 200MB of zswap (100MB inactive). Triggering proactive
writeback on the parent memcg will exhaust memcg1's inactive zswap
pages. After that, even though memcg2 still has plenty of inactive zswap
pages, it will continue to write back memcg1's active zswap pages.
Writing back active zswap pages causes the user-space agent to
prematurely abort the writeback because it detects that certain memcg
metrics have exceeded predefined thresholds.
Of course, real-world scenarios are much more complex, and this kind of
case is extremely rare in our environment.
That being said, your suggestion of using the global lock for the
per-memcg cursors makes the writeback fairer and would resolve these
corner cases.
>>> What if we do something like this (for the global cursor):
>>>
>>> do {
>>> memcg = xchg(zswap_next_shrink, NULL);
>>> memcg = mem_cgroup_iter(NULL, memcg, NULL);
>>> /* If the cursor was advanced from under us, try again */
>>> if (!try_cmpxchg(zswap_next_shrink, NULL, memcg))
>>> continue;
>>> } while (..);
>>>
>>>
>>
>> Regarding the code above, IIRC, both the global and per-cgroup cursors
>> suffer from race conditions. This race can cause mem_cgroup_iter(NULL, NULL,
>> NULL) to return the root memcg or its descendants, leading zswap to write
>> back pages from the wrong memcg.
>
> Not the wrong memcg, it will just go back to the first memcg again,
> which should be fine as I mentioned below.
>
>>
>> Additionally, since mem_cgroup_iter() puts the prev memcg ref and gets the
>> next memcg ref, a try_cmpxchg() failure on CPU1 might also lead to a ref
>> leak for memcg1.
>>
>>
>> CPU1 CPU2
>> memcg1 = xchg(pos, NULL)
>> memcg2 = xchg(pos, NULL) memcg2 = NULL;
>>
>> memcg1 = mem_cgroup_iter()
>> mem_cgroup_iter(NULL, **NULL**, NULL) error memcg
>> try_cmpxchg(pos，NULL，memcg2） succeed
>> try_cmpxchg(pos，NULL，memcg1） **fail**
>
> Yes, we can probably just take a ref on the memcg before calling
> mem_cgroup_iter(). That being said, I think we can just keep the lock,
> see below.
>
>>
>> I took a stab at implementing a cmpxchg()-based zswap_mem_cgroup_iter()
>> modeled after mem_cgroup_iter(), and it actually doesn't look that complex
>> after all :)
>
> I don't think we should re-implement mem_cgroup_iter() here.
>
> [..]
>>> There is a window where a racing shrinker will see the cursor as NULL
>>> and start over, but that should be fine. We can generalize this for the
>>> per-memcg cursor.
>>>
>>> That being said..
>>>
>>>>
>>>> Currently, this lock is only used in shrink_memcg(), proactive writeback,
>>>> and mem_cgroup_css_offline(). Note that shrink_memcg() only acquires the
>>>> lock of the root cgroup, and mem_cgroup_css_offline() is unlikely to be a
>>>> hot path.
>>>
>>> ..this made me realize it's probably fine to just use a global lock for
>>> now?
>>>
>>> IIUC the only additional contention to the existing lock will be from
>>> userspace proactive writeback, and that shouldn't be a big deal
>>> especially with the critical section being short?
>>>
>>
>> In the current patch implementation, this lock protects the cgroup's own
>> cursor variable. During each writeback, we only acquire the spin_lock of the
>> target cgroup itself; we do not attempt to **spin on any child cgroup's lock
>> while iterating through the descendants**.
>
> Oh, I did not say anything about the current patch adding contention. I
> am suggesting we just keep using the global lock for the per-memcg
> cursors, if we keep them.
>
> Right now, without this series, the global lock protects against
> concurrent changes to the global cursor from concurrent shrinkers. After
> the series, the only added contenders are userspace proactive writeback
> threads. Unless you have 10s or 100s of those, it should be fine to keep
> a single global lock, right?
>
Ah yes, sorry about that, I misunderstood what you meant. Thanks a lot
for the suggestion and for taking the time to explain it so patiently.
I'll switch to using the global lock in v4 patch.
> Yes, userspace can affect writeback efficiency, but we can split the
> lock when it actually causes a problem.
Agreed.
>
>>
>>
>>>>
>>>> So, should we keep the spin_lock or go with the cmpxchg() approach?
>>>> Yosry and Nhat, what are your thoughts on this?
>>>
>>> I think we should experiment with the global lock first. See if you
>>> observe any regressions with workloads that put a lot of pressure on the
>>> lock (a lot of threads in reclaim doing writeback + a few userspace
>>> threads doing proactive writeback). See if the userspace threads
>>> actually cause a meaningful regression.
>>
>> Sorry, it seems there are some implementation issues with the global lock
>> approach.
>>
>> In practice, our user-space agent mostly operates in the following two
>> scenarios:
>> - Triggering proactive writeback on the same cgroup at different times
>> (sequentially).
>> - Triggering proactive writeback on different cgroups at the same time
>> (concurrently).
>>
>> In both cases, there is no lock contention. So, the current lock works
>> perfectly fine for us.
>
> Would using the existing global lock work for your use case? How many
> different cgroups can you end up reclaiming from concurrently?
It should work fine. We typically only have a dozen or so user-space
agents triggering zswap writeback, and the critical section is very
short anyway. I will implement this next.
Thanks,
Hao
^ permalink raw reply
* Re: [PATCH v4 03/13] liveupdate: centralize state management into struct luo_ser
From: Pasha Tatashin @ 2026-06-03 2:57 UTC (permalink / raw)
To: Mike Rapoport
Cc: Pasha Tatashin, linux-kselftest, shuah, akpm, linux-mm, skhan,
linux-doc, linux-kernel, corbet, dmatlack, kexec, pratyush,
skhawaja, graf
In-Reply-To: <178038801487.119771.6308607614059754603.b4-review@b4>
On 06-02 11:13, Mike Rapoport wrote:
> On Sat, 30 May 2026 22:19:28 +0000, Pasha Tatashin <pasha.tatashin@soleen.com> wrote:
> > diff --git a/kernel/liveupdate/luo_flb.c b/kernel/liveupdate/luo_flb.c
> > index 8f5c5dd01cd0..c8dd30b41238 100644
> > --- a/kernel/liveupdate/luo_flb.c
> > +++ b/kernel/liveupdate/luo_flb.c
> > @@ -579,53 +565,18 @@ int __init luo_flb_setup_outgoing(void *fdt_out)
> > [ ... skip 18 lines ... ]
> > - offset = fdt_subnode_offset(fdt_in, 0, LUO_FDT_FLB_NODE_NAME);
> > - if (offset < 0) {
> > - pr_err("Unable to get FLB node [%s]\n", LUO_FDT_FLB_NODE_NAME);
> > -
> > - return -ENOENT;
> > + if (flbs_pa) {
>
> I like
>
> if (!flbs_pa)
> return;
>
> more
Ok.
>
> >
> > diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
> > index 8d9201c25412..3b760fefa7b9 100644
> > --- a/kernel/liveupdate/luo_session.c
> > +++ b/kernel/liveupdate/luo_session.c
> > @@ -497,75 +494,34 @@ int luo_session_retrieve(const char *name, struct file **filep)
> > [ ... skip 58 lines ... ]
> > + if (sessions_pa) {
> > + header_ser = phys_to_virt(sessions_pa);
> > + luo_session_global.incoming.header_ser = header_ser;
> > + luo_session_global.incoming.ser = (void *)(header_ser + 1);
> > + luo_session_global.incoming.active = true;
> > }
>
> Ditto
This functions get's re-written with early return later in the serires.
>
> --
> Sincerely yours,
> Mike.
>
^ permalink raw reply
* Re: [PATCH v4 08/13] liveupdate: defer session block allocation and PA setting
From: Pasha Tatashin @ 2026-06-03 2:50 UTC (permalink / raw)
To: Mike Rapoport
Cc: Pasha Tatashin, linux-kselftest, shuah, akpm, linux-mm, skhan,
linux-doc, linux-kernel, corbet, dmatlack, kexec, pratyush,
skhawaja, graf
In-Reply-To: <178038801492.119771.3419366349068848854.b4-review@b4>
On 06-02 11:13, Mike Rapoport wrote:
> On Sat, 30 May 2026 22:19:33 +0000, Pasha Tatashin <pasha.tatashin@soleen.com> wrote:
> > Currently, luo_session_setup_outgoing() allocates the session block and
>
> "liveupdate: defer session block allocation and PA setting"
>
> PA as "Public Assistance"? ;-)
>
> Let's spell it out.
Done
>
> --
> Sincerely yours,
> Mike.
>
^ permalink raw reply
* Re: [PATCH v4 07/13] kho: add support for linked-block serialization
From: Pasha Tatashin @ 2026-06-03 2:44 UTC (permalink / raw)
To: Pratyush Yadav
Cc: Pasha Tatashin, linux-kselftest, rppt, shuah, akpm, linux-mm,
skhan, linux-doc, linux-kernel, corbet, dmatlack, kexec, skhawaja,
graf
In-Reply-To: <2vxzcxy8evuo.fsf@kernel.org>
On 06-02 18:43, Pratyush Yadav wrote:
> On Mon, Jun 01 2026, Pasha Tatashin wrote:
>
> > On 06-01 15:38, Pratyush Yadav wrote:
> >> On Sat, May 30 2026, Pasha Tatashin wrote:
> >>
> >> > Introduce a linked-block serialization mechanism for state handover.
> >> >
> >> > Previously, LUO used contiguous memory blocks for serializing sessions
> >> > and files, which imposed limits on the total number of items that could
> >> > be preserved across a live update.
> >> >
> >> > This commit adds the infrastructure for a more flexible, block-based
> >> > approach where serialized data is stored in a chain of linked blocks.
> >> > This is a generic KHO serialization block infrastructure that can be
> >> > used by multiple subsystems.
> >> >
> >> > Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
> [...]
> >> > +/**
> >> > + * DOC: KHO Serialization Blocks ABI
> >> > + *
> >> > + * Subsystems using the KHO Serialization Blocks framework rely on the stable
> >> > + * Application Binary Interface defined below to pass serialized state from a
> >> > + * pre-update kernel to a post-update kernel.
> >> > + *
> >> > + * This interface is a contract. Any modification to the structure fields,
> >> > + * compatible strings, or the layout of the `__packed` serialization
> >> > + * structures defined here constitutes a breaking change. Such changes require
> >> > + * incrementing the version number in the `KHO_BLOCK_ABI_COMPATIBLE` string to
> >> > + * prevent a new kernel from misinterpreting data from an old kernel.
> >> > + *
> >> > + * Changes are allowed provided the compatibility version is incremented;
> >> > + * however, backward/forward compatibility is only guaranteed for kernels
> >> > + * supporting the same ABI version.
> >> > + */
> >> > +
> >> > +#ifndef _LINUX_KHO_ABI_BLOCK_H
> >> > +#define _LINUX_KHO_ABI_BLOCK_H
> >> > +
> >> > +#include <asm/page.h>
> >> > +#include <linux/types.h>
> >> > +
> >> > +#define KHO_BLOCK_ABI_COMPATIBLE "kho-block-v1"
> >>
> >> During KHO radix development, I argued for a separate compatible for the
> >> radix tree, but at that time, we tied the radix tree to core KHO ABI.
> >> The argument being that all core KHO data structures belong to the KHO
> >> ABI set. I imagine this will be used by kho_vmalloc, so it will also be
> >> end up being used by a core KHO API.
> >>
> >> So, do we want separate ABI? I don't much have a preference myself, but
> >> I do think the compatible management will be a bit easier if this relied
> >> on KHO compatible, especially once kho_vmalloc starts using it.
> >
> > I prefer to make them fine-grained, now that we are adding more and more
> > features: kho vmalloc, kho radix, and kho block should all have their
> > own compatibility strings. Furthermore, any components that depend on
> > them should include these compatibility strings in their own
> > compatibility strings, in the same manner I have done in this series.
>
> Sure, sounds good.
>
> >
> >>
> >> > +
> >> > +/**
> >> > + * KHO_BLOCK_SIZE - The size of each serialization block.
> >> > + *
> >> > + * This is defined as PAGE_SIZE. PAGE_SIZE is ABI compliant because live
> >> > + * update between kernels with different page sizes is not supported by KHO.
> >> > + */
> >> > +#define KHO_BLOCK_SIZE PAGE_SIZE
> >> > +
> >> > +/**
> >> > + * struct kho_block_header_ser - Header for the serialized data block.
> >> > + * @next: Physical address of the next struct kho_block_header_ser.
> >> > + * @count: The number of entries that immediately follow this header in the
> >> > + * memory block.
> >> > + *
> >> > + * This structure is located at the beginning of a block of physical memory
> >> > + * preserved across a kexec. It provides the necessary metadata to interpret
> >> > + * the array of entries that follow.
> >> > + */
> >> > +struct kho_block_header_ser {
> >> > + u64 next;
> >> > + u64 count;
> >> > +} __packed;
> >> > +
> >> > +#endif /* _LINUX_KHO_ABI_BLOCK_H */
> >> > diff --git a/include/linux/kho_block.h b/include/linux/kho_block.h
> >> > new file mode 100644
> >> > index 000000000000..5e6b87b1befa
> >> > --- /dev/null
> >> > +++ b/include/linux/kho_block.h
> >> > @@ -0,0 +1,79 @@
> >> > +/* SPDX-License-Identifier: GPL-2.0 */
> >> > +/*
> >> > + * Copyright (c) 2026, Google LLC.
> >> > + * Pasha Tatashin <pasha.tatashin@soleen.com>
> >> > + */
> >> > +
> >> > +#ifndef _LINUX_KHO_BLOCK_H
> >> > +#define _LINUX_KHO_BLOCK_H
> >> > +
> >> > +#include <linux/list.h>
> >> > +#include <linux/types.h>
> >> > +#include <linux/kho/abi/block.h>
> >> > +
> >> > +/**
> >> > + * struct kho_block - Internal representation of a serialization block.
> >> > + * @list: List head for linking blocks in memory.
> >> > + * @ser: Pointer to the serialized header in preserved memory.
> >> > + */
> >> > +struct kho_block {
> >> > + struct list_head list;
> >> > + struct kho_block_header_ser *ser;
> >> > +};
> >> > +
> >> > +/**
> >> > + * struct kho_block_set - A set of blocks that belong to the same object.
> >> > + * @blocks: The list of serialization blocks (struct kho_block).
> >> > + * @nblocks: The number of allocated serialization blocks.
> >> > + * @head_pa: Physical address of the first block header.
> >> > + * @entry_size: The size of each entry in the blocks.
> >> > + * @count_per_block: The maximum number of entries each block can hold.
> >> > + * @incoming: True if this block set was restored from the previous kernel.
> >> > + */
> >> > +struct kho_block_set {
> >> > + struct list_head blocks;
> >> > + long nblocks;
> >> > + u64 head_pa;
> >> > + size_t entry_size;
> >>
> >> I think we should add the entry_size to kho_block_header_ser? I think it
> >> is a part of the ABI of the block set. If this changes, we cannot parse
> >> a block set with a different size. If a subsystem wants to change entry
> >> size, they create a new block set with different entry size, and then
> >> they bump their compatible version.
> >
> > I have considered that, and we can certainly do it; however, I do not
> > see how it would affect the current implementation. If luo_file or
> > luo_session change entry_size, they must change the LUO compatibility
> > version, which would prevent LU from one kernel to the next. However,
> > for flexibility and future extensibility, I believe it would be useful
> > to add entry_size and block_size (which is PAGE_SIZE, but could be
> > larger for some users) to the header. This is more of a feature request
> > than an issue with the current series.
>
> My suggestion was mainly for sanity checking. So if LUO or another user
> inadvertently changes entry size, it gets caught. But thinking about it
> more, there are a million other ways to break compatibility while
> keeping the entry size same so perhaps it doesn't matter as much...
>
> >
> >>
> >> > + u64 count_per_block;
> >> > + bool incoming;
> >> > +};
> >> > +
> >> > +/**
> >> > + * struct kho_block_it - Iterator for serializing entries into blocks.
> >> > + * @bs: The block set being iterated.
> >> > + * @block: The current block.
> >> > + * @i: The current entry index within @block.
> >> > + */
> >> > +struct kho_block_it {
> >> > + struct kho_block_set *bs;
> >> > + struct kho_block *block;
> >> > + u64 i;
> >> > +};
> >> > +
> >> > +/**
> >> > + * KHO_BLOCK_SET_INIT - Initialize a static kho_block_set.
> >> > + * @_name: Name of the kho_block_set variable.
> >> > + * @_entry_size: The size of each entry in the block set.
> >> > + */
> >> > +#define KHO_BLOCK_SET_INIT(_name, _entry_size) { \
> >> > + .blocks = LIST_HEAD_INIT((_name).blocks), \
> >> > + .entry_size = _entry_size, \
> >> > +}
> >> > +
> >> > +void kho_block_set_init(struct kho_block_set *bs, size_t entry_size);
> >> > +
> >> > +int kho_block_grow(struct kho_block_set *bs, u64 count);
> >> > +void kho_block_shrink(struct kho_block_set *bs, u64 count);
> >>
> >> These block management functions seem like internal details of the block
> >
> > This is not so. The confusion here is that they must be allocated and
> > preserved at runtime as resources are registered/unregistered, while
> > these blocks are only used serialization phase,
> >
> > These calls are more like notifiers that more files/sessions are created
> > removed, so we can adjust block count accordingly if necessary (allocate
> > preserver memory), and have them available durign
> > serialization/deserialization
>
> Yeah, I got that when reading the later patches that use these.
>
> Perhaps kho_block_prealloc() and kho_block_unalloc() is more clear,
> although it does not sound as nice. If not, then I suppose at least add
> a comment explaining the intended usage.
Done
>
> >
> >> set API. Do we need to export them? I think users should not have to
> >> worry about block management. They should read, set, or clear entries
> >> using the iterators, and internally the block management should take of
> >> allocation or freeing. So here for example, I th
> >
> > something is missing :-)
>
> I don't remember what I meant to say anymore :-/
>
> [...]
> >> > +/**
> >> > + * kho_block_set_init - Initialize a block set.
> >> > + * @bs: The block set to initialize.
> >> > + * @entry_size: The size of each entry in the blocks.
> >> > + */
> >> > +void kho_block_set_init(struct kho_block_set *bs, size_t entry_size)
> >> > +{
> >> > + *bs = (struct kho_block_set)KHO_BLOCK_SET_INIT(*bs, entry_size);
> >> > +}
> >> > +
> >> > +static inline u64 kho_block_count_per_block(struct kho_block_set *bs)
> >> > +{
> >> > + if (unlikely(!bs->count_per_block)) {
> >> > + bs->count_per_block = (KHO_BLOCK_SIZE -
> >> > + sizeof(struct kho_block_header_ser)) /
> >> > + bs->entry_size;
> >> > + WARN_ON(!bs->count_per_block);
> >> > + }
> >> > + return bs->count_per_block;
> >> > +}
> >>
> >> This looks odd. I don't see a reason to calculate this lazily. Why not
> >> just do it when initializing the block set, in kho_block_set_init() or
> >> kho_block_restore()? And then use bs->count_per_block directly.
> >
> > This allows for blocks to use static initilziation, I like static inits
> > :-)
>
> You can do this:
>
> #define KHO_BLOCK_SET_INIT(_name, _entry_size) { \
> .blocks = LIST_HEAD_INIT((_name).blocks), \
> .entry_size = _entry_size, \
> .count_per_block = (KHO_BLOCK_SIZE - sizeof(struct kho_block_header_ser)) / (_entry_size), \
> }
>
> Compiles for me.
You are correct, done.
>
> [...]
> >> > +void kho_block_destroy(struct kho_block_set *bs)
> >> > +{
> >> > + u64 head_pa = bs->head_pa;
> >> > + struct kho_block *block;
> >> > +
> >> > + while (!list_empty(&bs->blocks)) {
> >> > + block = list_first_entry(&bs->blocks, struct kho_block, list);
> >> > + list_del(&block->list);
> >> > + kfree(block);
> >> > + }
> >>
> >> Nit:
> >>
> >> list_for_each_entry_safe(block, tmp, &bs->blocks, list) {
> >> list_del(&block->list);
> >> kfree(block);
> >> }
> >>
> >> is a bit more idiomatic (and IMO easier to read).
> >
> > Sure
> >
> >>
> >> > + bs->nblocks = 0;
> >> > + bs->head_pa = 0;
> >> > +
> >> > + while (head_pa) {
> >> > + struct kho_block_header_ser *ser = phys_to_virt(head_pa);
> >> > +
> >> > + head_pa = ser->next;
> >> > + kho_block_free_ser(bs, ser);
> >>
> >> Nit: also, can't you put this also in the previous loop? Something like:
> >>
> >> list_for_each_entry_safe(block, tmp, &bs->blocks, list) {
> >> list_del(&block->list);
> >> kho_block_free_ser(block->ser);
> >> kfree(block);
> >> }
> >
> > We actually can't merge these into a single loop because of partial
> > restoration failures handling in kho_block_restore().
> >
> > If kho_block_restore fails halfway through restoring a chain of blocks
> > (for example, if kho_block_add fails on block 3 of 5), we jump to the
> > err_destroy cleanup path which calls kho_block_destroy().
> >
> > At this point:
> > - bs->blocks only contains the tracked blocks we successfully added
> > (blocks 1 and 2).
> > - bs->head_pa still points to the physical head of the entire 5-block
> > incoming chain.
> >
> > But, this is a good place to add a comment.
>
> IMO it would be cleaner for kho_block_destroy() to destroy the currently
> initialized block set, and then the error handling path in restore path
> can clean up the rest.
Sounds good, done.
>
> >
> >> > + }
> >> > +}
> [...]
> >> > +/**
> >> > + * kho_block_it_prev - Return the previous entry slot in the block set.
> >> > + * @it: The block iterator.
> >> > + *
> >> > + * If the current index is at the start of a block, it automatically moves to
> >> > + * the end of the previous block.
> >> > + *
> >> > + * Return: A pointer to the previous entry slot, or NULL if at the very
> >> > + * beginning of the block set.
> >> > + */
> >> > +void *kho_block_it_prev(struct kho_block_it *it)
> >> > +{
> >> > + if (!it->block)
> >> > + return NULL;
> >> > +
> >> > + if (it->i == 0) {
> >> > + if (list_is_first(&it->block->list, &it->bs->blocks))
> >> > + return NULL;
> >> > + it->block = list_prev_entry(it->block, list);
> >> > + it->i = kho_block_count_per_block(it->bs);
> >> > + }
> >> > +
> >> > + return (void *)(it->block->ser + 1) + (--it->i * it->bs->entry_size);
> >> > +}
> >> > +
> >> > +/**
> >> > + * kho_block_it_finalize - Finalize the current block by setting its entry count.
> >> > + * @it: The block iterator.
> >> > + */
> >> > +void kho_block_it_finalize(struct kho_block_it *it)
> >> > +{
> >> > + if (it->block)
> >> > + it->block->ser->count = it->i;
> >> > +}
> >>
> >> Doesn't kho_block_it_next() already do this when you add an entry? So
> >> this seems redundant.
> >
> > It is not redundant because of how the final partially-fille block is handled.
> >
> > kho_block_it_next() only writes the count into the block header when a block is completely full and it is advancing to the next one:
> >
> > if (it->i == kho_block_count_per_block(it->bs)) {
> > it->block->ser->count = it->i;
> > ...
> >
> > But for the very last block in the set, it is usually only partially
> > filled (e.g., we write 10 entries into a block with a capacity of 64).
> > Since it->i never reaches the maximum capacity, kho_block_it_next()
> > never commits its count.
> >
> > Pasha
>
> I think we can make kho_block_it_next() always write it. I think it
> makes sense from an API point of view, since I see this API as "adding
> an entry to the block set", so updating its internal counters makes
> sense.
>
> Requiring the finalize will be error prone, since it is easy to forget.
> Then you silently lose some entries on the next boot.
Good suggetion, cleaned-up.
Thank you!
Pasha
>
> --
> Regards,
> Pratyush Yadav
^ permalink raw reply
* Re: [PATCH v8 2/6] mm/memory-failure: surface unhandlable kernel pages as -ENOTRECOVERABLE
From: Miaohe Lin @ 2026-06-03 2:33 UTC (permalink / raw)
To: David Hildenbrand (Arm), Breno Leitao
Cc: linux-mm, linux-kernel, linux-doc, linux-kselftest,
linux-trace-kernel, kernel-team, Lance Yang, Andrew Morton,
Lorenzo Stoakes, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Shuah Khan, Naoya Horiguchi,
Steven Rostedt, Masami Hiramatsu, Mathieu Desnoyers,
Jonathan Corbet, Shuah Khan, Liam R. Howlett
In-Reply-To: <21732071-14a1-486a-951c-34de97b7c757@kernel.org>
On 2026/6/2 17:41, David Hildenbrand (Arm) wrote:
> On 6/2/26 05:08, Miaohe Lin wrote:
>> On 2026/6/1 21:22, David Hildenbrand (Arm) wrote:
>>> On 6/1/26 14:28, Miaohe Lin wrote:
>>>>
>>>> Thanks for your patch.
>>>>
>>>>
>>>> Once shake_page finds a lightweight range-based way to shrink slab, slab pages could be freed
>>>> into buddy and above PageSlab test should be removed then. Maybe add a TODO or XXX here?
>>>>
>>>>
>>>> I'm not sure but is it safe or a common way to test PageReserved, PageSlab,
>>>> PageTable and PageLargeKmalloc without extra page refcnt?
>>>
>>> Checking typed pages in a racy fashion is fine (PageSlab, PageTable,
>>> PageLargeKmalloc).
>>
>> Got it. Thanks.
>>
>>> Checking PageReserved in a racy fashion is fine as well. TESTPAGEFLAG() will
>>> allow checking it on compound pages.
>>
>> It seems PageReserved is not intended to be set on compound pages. I see there are PF_NO_COMPOUND
>> in its definition: PAGEFLAG(Reserved, reserved, PF_NO_COMPOUND).
>>
>>>
>>> For PageLargeKmalloc, we would want to check the head page, though. The page
>>> type is only stored for the head page.
>>
>> Maybe we should check the head page for PageSlab and PageTable too? alloc_slab_page only
>> set PageSlab on the head page and __pagetable_ctor uses __folio_set_pgtable to set PageTable
>> on folio.
>>
>>>
>>> So maybe we want to lookup the compound head (if any) and perform the type
>>> checks against that?
>>
>> Maybe we should or we might miss some pages that could have been handled. And
>> if compound head is required, should we hold an extra page refcnt to guard against
>> possible folio split race?
>
> Races are fine. We might miss some pages, but that can happen on races either way.
>
>
> I'd just do something like
>
> if (PageReserved(page))
> return true;
>
> head = compound_head(page);
If @head is split just after compound_head. And then @head is freed into buddy and re-allocated as slab
page while @page is still in the buddy. We would panic on this scene as @head is PageSlab. But we were
supposed to successfully handle @page. Or am I miss something?
Thanks.
.
> return PageSlab(head) || ...;
>
>
^ permalink raw reply
* Re: [PATCH v10 1/4] HID: hid-msi: Add MSI Claw configuration driver
From: Derek John Clark @ 2026-06-03 2:32 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Jiri Kosina, Benjamin Tissoires, Pierre-Loup A . Griffais,
Denis Benato, Zhouwang Huang, linux-input, linux-doc,
linux-kernel
In-Reply-To: <ahnYeAbzO5K3feRn@google.com>
On Fri, May 29, 2026 at 11:29 AM Dmitry Torokhov
<dmitry.torokhov@gmail.com> wrote:
>
> On Thu, May 28, 2026 at 11:34:18PM -0700, Derek John Clark wrote:
> > On Wed, May 27, 2026 at 10:32 PM Dmitry Torokhov
> > <dmitry.torokhov@gmail.com> wrote:
> > >
> > > Hi Derek,
> > >
> > > On Wed, May 27, 2026 at 10:21:19PM +0000, Derek J. Clark wrote:
> > > > Adds configuration HID driver for the MSI Claw series of handheld PC's.
> > > > In this initial patch add the initial driver outline and attributes for
> > > > changing the gamepad mode, M-key behavior, and add a WO reset function.
> > > >
> > > > Sending the SWITCH_MODE and RESET commands causes a USB disconnect in
> > > > the device. The completion will therefore never get hit and would trigger
> > > > an -EIO. To avoid showing the user an error for every write to these
> > > > attrs a bypass for the completion handling is introduced when timeout ==
> > > > 0.
> > > >
> > > > The initial version of this patch was written by Denis Benato, which
> > > > contained the initial reverse-engineering and implementation for the
> > > > gamepad mode switching. This work was later expanded by Zhouwang Huang
> > > > to include more gamepad modes. Finally, I refactored the drivers data
> > > > in/out flow and overall format to conform to kernel driver best
> > > > practices and style guides. Claude was used as an initial reviewer of
> > > > this patch.
> > >
> > > I wonder why do you need to roll asynchronous probing and asynchronous
> > > resume by hand? This I think complicates the driver greatly and forces
> > > you to use a ton of works, spinlocks, and checks.
> > >
> > > Thanks.
> > >
> >
> > Hi Dmitry,
> >
> > I suppose being asked this means my cover letter and commit
> > descriptions need some additional context. The MCU in these Claw
> > devices is quite temperamental. There are a few specific issues that
> > cause the need for multiple work queues, a serialization mutex, and
> > subsequently spinlocks to prevent stale data reads.
> >
> > 1.) The MCU will halt function if it receives any output reports
> > before ~500MS after probe or resume. This can either manifest as the
> > device never responding to a command, or it can cause the entire
> > system to become unstable and reboot. This creates the need for
> > cfg_setup to query the MCU and then add the gamepad attrs, led_mc
> > device, and rgb attrs. As a side effect, because a system could
> > technically be suspended during that 500ms delay, there exists the
> > need to re-queue the work if it was never triggered, hence the resume
> > queue.
> > 2.) The MCU will not always respond in order if two or more output
> > reports are sent within a few ms of each other. Since many of the
> > commands use a generic "ACK", or share an "ACK" type but don't provide
> > specific context about what sub-function called them, we could
> > potentially have cross talk where data is saved in the wrong attribute
> > or errors propagate because of a missed message. To get around this
> > serialization issue we hold a mutex through a completion triggered in
> > raw_event and, for most events, save a state machine on what command
> > is expected and what sub-command was the initiator. (I.E. profile
> > events handle the M1, M2, RGB, Left rumble, and right rumble). Since
> > the state machine is accessed on both sides, we need spinlocks
> > guarding the reads. This essentially serializes the data and makes it
> > predictable. Using this pattern I haven't had any issues reading from
> > or writing to the MCU.
> > 3.) Some commands will never return their "ACK" while a completion is
> > held, so we have a workaround to basically ignore them and hope the
> > command worked. This is only needed for SYNC_TO_ROM, from which we
> > don't need to set anything on its "ACK", and switching the gamepad
> > mode, which causes USB disconnect/reconnect and the driver fully
> > reloads, so we'll never be able to read it anyway.
> > 4.) The RGB work queue is used to free the userspace write while the
> > completion is held. I found that use without it could stall userspace
> > quite significantly if it has multiple writes back to back. I
> > experienced this using Steam's customization menu, which sends a
> > single write for every increment of its color and brightness sliders.
> > when traversing the full length of the slider it is possible to have
> > effects changing for nearly a minute after stopping. With the queue,
> > only the most recent write is eventually sent to the MCU. This issue
> > also affects the Go 2 driver as well, though not to the same extent,
> > but for which I'll be adding a similar de-bounce queue soon. Go S is
> > also technically affected by this bug, but that returns quickly enough
> > that it isn't really feasible to trigger the bug with much frequency.
> > I'll still fix that one as well though.
> >
> > TBH I'm not "happy" with the complexity of the driver, but I don't see
> > a reasonable alternative. If you have any specific suggestions that I
> > could try that might simplify it, I'd be more than happy to give it a
> > shot. That being said, I'm not very optimistic about it. Development
> > on this device has been like wrestling a bear.
>
> Thank you for this detailed explanation. I would like to concentrate on
> the #1 first. What happens in the driver is you are essentially rolling
> asynchronous probing and asynchronous suspend/resume in the driver
> itself, and end up fighting with the kernel and the driver core
> specifically.
>
> As far as suspend/resume goes: HID subsystem already enables
> asynchronous resume handling (checkout the call to
> device_enable_async_suspend() in
> drivers/hid/hid-core.c::hid_allocate_device()). Therefore I think you
> just need to stick the necessary delay in your resume method() and call
> it a day.
>
> For the probing I would look into annotating the driver as
> PROBE_PREFER_ASYNCHRONOUS and relying on that. Again, if you stick the
> required delay in probe then sysfs attributes will not be created too
> early, same for the rest of concerns with the device being exposed to
> userspace before it is ready to handle requests.
Hi Dmitry,
I've done a bit of a deep dive into this to try and get it to work
without work queues while using PROBE_PREFER_ASYNCHRONOUS and regular
sleeps. While it does simplify the driver, I can't get it to function
properly. No matter how long I wait the probe fails with an -EBUSY as
raw_event never fires during the probe context, and my completion
handler times out. The most likely explanation I have found is that
the MCU must require all interfaces to be fully bound before it will
respond to interrupt URB completions (vice needing to sleep for 500ms
for the MCU to be ready as I previously thought). During probe the
driver core holds the parent USB device lock for the duration of each
interface's probe. Since the other interfaces cannot start binding as
they are blocked waiting for the parent lock, and the MCU is waiting
for them to bind before responding, no ACK arrives within the timeout
window and the probe fails. The other interfaces only begin probing
after the config interface probe returns and releases the parent lock,
as confirmed by dmesg timestamps. When using the work_queue method all
interfaces have finished probing, so the MCU is responding to
interrupt URB completions and everything works.
> If there are issues with HID subsystem honoring
> PROBE_PREFER_ASYNCHRONOUS I would look into fixing the subsystem rather
> than try to work around it in the driver.
Since a lock is held on the parent while each interface is attached,
and USB devices have multiple interfaces, this happens synchronously
even in "async" context. The HID core calls driver_attach, which
detects the async flag and calls __driver_attach_async_helper, which
then calls driver_probe_device after locking the parent.
From drivers/base/dd.c:
static void __driver_attach_async_helper(void *_dev, async_cookie_t cookie)
{
struct device *dev = _dev;
const struct device_driver *drv;
int ret;
__device_driver_lock(dev, dev->parent);
drv = dev->p->async_driver;
dev->p->async_driver = NULL;
ret = driver_probe_device(drv, dev);
__device_driver_unlock(dev, dev->parent);
dev_dbg(dev, "driver %s async attach completed: %d\n", drv->name, ret);
put_device(dev);
}
...
* driver_probe_device - attempt to bind device & driver together
...
* This function must be called with @dev lock held. When called for a
* USB interface, @dev->parent lock must be held as well.
One possible solution might be to add a way to match on
bInterfaceNumber in hid_device_id and allow the interfaces I don't
care about to stay bound to hid_generic. Another would be to
parallelize the interface probing. I'm not sure about the feasibility
of either approach since they would have significant changes and broad
implications for all USB/USBHID drivers. I also don't know if that
would even solve the problem.
Thanks,
Derek
> Thanks.
>
> --
> Dmitry
^ permalink raw reply
* Re: [PATCH v4 07/13] kho: add support for linked-block serialization
From: Pasha Tatashin @ 2026-06-03 2:21 UTC (permalink / raw)
To: Mike Rapoport
Cc: Pasha Tatashin, linux-kselftest, shuah, akpm, linux-mm, skhan,
linux-doc, linux-kernel, corbet, dmatlack, kexec, pratyush,
skhawaja, graf
In-Reply-To: <178038801491.119771.18384706761138506132.b4-review@b4>
On 06-02 11:13, Mike Rapoport wrote:
> On Sat, 30 May 2026 22:19:32 +0000, Pasha Tatashin <pasha.tatashin@soleen.com> wrote:
> > diff --git a/include/linux/kho_block.h b/include/linux/kho_block.h
> > new file mode 100644
> > index 000000000000..5e6b87b1befa
> > --- /dev/null
> > +++ b/include/linux/kho_block.h
> > @@ -0,0 +1,79 @@
> > [ ... skip 19 lines ... ]
> > + struct list_head list;
> > + struct kho_block_header_ser *ser;
> > +};
> > +
> > +/**
> > + * struct kho_block_set - A set of blocks that belong to the same object.
>
> "same object" sounds off to me. The blocks belong to the same module?
> user?
>
> Thoughts?
user and module are not descriptive, as the same client/user/module can
use multiple kho_block_set for different purposes. I suggest:
"struct kho_block_set - A set of blocks containing serialized entries of
the same type."
>
> > + * @blocks: The list of serialization blocks (struct kho_block).
> > + * @nblocks: The number of allocated serialization blocks.
> > + * @head_pa: Physical address of the first block header.
> > + * @entry_size: The size of each entry in the blocks.
>
> I think it's "... entry in a block"
It is 'in the blocks' (or 'across the blocks') because a single
block_set can contain multiple blocks, and they all share this same
uniform entry size.
>
> > [ ... skip 42 lines ... ]
> > +
> > +void kho_block_it_init(struct kho_block_it *it, struct kho_block_set *bs);
> > +void *kho_block_it_next(struct kho_block_it *it);
> > +void *kho_block_it_read(struct kho_block_it *it);
> > +void *kho_block_it_prev(struct kho_block_it *it);
> > +void kho_block_it_finalize(struct kho_block_it *it);
>
> These operate on block sets, should be reflected in the names.
> Can be kho_blocks_ to avoid too long names.
We have already started using kho_block_set. Although it is longer, I
prefer to avoid kho_blocks/kho_block because the subtle difference makes
them difficult to read and prone to typos during coding. Let's use
kho_block_set for operations on a block_set.
> >
> > diff --git a/kernel/liveupdate/kho_block.c b/kernel/liveupdate/kho_block.c
> > new file mode 100644
> > index 000000000000..a4e650af946f
> > --- /dev/null
> > +++ b/kernel/liveupdate/kho_block.c
> > @@ -0,0 +1,384 @@
> > +// SPDX-License-Identifier: GPL-2.0
> > +
> > +/*
> > + * Copyright (c) 2026, Google LLC.
> > + * Pasha Tatashin <pasha.tatashin@soleen.com>
> > + */
> > +
> > +/**
> > + * DOC: KHO Serialization Blocks
> > + *
> > + * KHO provides a mechanism to preserve stateful data across a kexec handover
> > + * by serializing it into memory blocks. This file provides the common
>
> "This file" does not look good in HTML docs.
Fixed.
>
> > [ ... skip 15 lines ... ]
> > +
> > +/*
> > + * Safeguard limit for the number of serialization blocks. This is used to
> > + * prevent infinite loops and excessive memory allocation in case of memory
> > + * corruption in the preserved state.
> > + */
>
> Can you add how much memory it is and how many entries with, say, 4 u64
> it can accommodate?
Done
>
> > [ ... skip 13 lines ... ]
> > +{
> > + if (unlikely(!bs->count_per_block)) {
> > + bs->count_per_block = (KHO_BLOCK_SIZE -
> > + sizeof(struct kho_block_header_ser)) /
> > + bs->entry_size;
> > + WARN_ON(!bs->count_per_block);
>
> Don't you want to set count_per_block in _init()?
Done.
>
> > [ ... skip 29 lines ... ]
> > + if (!block)
> > + return -ENOMEM;
> > +
> > + block->ser = ser;
> > + last = list_last_entry_or_null(&bs->blocks, struct kho_block, list);
> > + list_add_tail(&block->list, &bs->blocks);
>
> No locks?
Linked blocks are not internally synchronized; that is a responsibility
of the caller, similar to linked lists.
>
> > [ ... skip 12 lines ... ]
> > + * @bs: The block set.
> > + * @count: The current number of entries.
> > + *
> > + * This function handles the dynamic expansion of a block set. It allocates
> > + * and links a new serialization block if the provided entry count matches
> > + * the current total capacity of the set.
>
> This is a weird semantics for a generic API. I'd expect _grow() would
> add count - current_count blocks.
Changed the semantics to use target count, i.e. "The target number of
valid entries to accommodate."
>
> > [ ... skip 25 lines ... ]
> > +}
> > +
> > +/**
> > + * kho_block_shrink - Conditionally destroy the last block in a block set.
> > + * @bs: The block set.
> > + * @count: The current number of entries across all blocks.
>
> Maybe
> ... of valid entries?
OK
>
> > + *
> > + * This function checks if the last block in the set is redundant based on the
> > + * total entry count and the capacity of the preceding blocks. If the entry
> > + * count can be accommodated by the blocks that come before the last one, the
> > + * last block is destroyed and removed from the set.
>
> This should mention that it's the caller responsibility to ensure that
> entries are removed in the right order.
OK
>
> > [ ... skip 49 lines ... ]
> > +
> > + fast = phys_to_virt(fast->next);
> > + slow = phys_to_virt(slow->next);
> > +
> > + if (slow == fast) {
> > + pr_err("Cyclic list detected\n");
>
> Maybe "block set is corrupted"?
OK
>
> > + return false;
> > + }
> > + }
> > +
> > + return true;
> > +}
> > +
> > +/**
> > + * kho_block_restore - Restore a block set from a physical address.
> > + * @bs: The block set to restore.
> > + * @head_pa: Physical address of the first block header.
>
> I'd mention that the block set should be allocated and initialized
Done
>
> > [ ... skip 10 lines ... ]
> > + bs->incoming = true;
> > + if (!head_pa)
> > + return 0;
> > +
> > + bs->head_pa = head_pa;
> > + if (!kho_cyclic_blocks_check(bs)) {
>
> if (kho_block_set_cyclic())
>
> reads nicer IMO
Sure, done.
>
> > [ ... skip 87 lines ... ]
> > +{
> > + if (!it->block)
> > + return NULL;
> > +
> > + if (it->i == kho_block_count_per_block(it->bs)) {
> > + it->block->ser->count = it->i;
>
> Why iterator updates ser->count?
The new name kho_block_set_it_reserve_entry() clarifies that this is a
write/reservation path function (unlike the original read-only next
name). Reserving a slot to write entries naturally implies
writing/finalizing the metadata count in the physical block header when
a block becomes full
> > + if (list_is_last(&it->block->list, &it->bs->blocks))
> > + return NULL;
> > + it->block = list_next_entry(it->block, list);
> > + it->i = 0;
> > + }
> > +
> > + return (void *)(it->block->ser + 1) + (it->i++ * it->bs->entry_size);
>
> In a month we'll need an LLM's help to understand what it does.
Good thing in a month we will have even stronger LLMs to help us :-)
Anyways, clean-up ...
>
> > +}
> > +
> > +/**
> > + * kho_block_it_read - Return the next entry slot for reading.
> > + * @it: The block iterator.
>
> And what is the conceptual difference between this and _it_next()?
This was updated :-)
>
> > [ ... skip 49 lines ... ]
> > + * @it: The block iterator.
> > + */
> > +void kho_block_it_finalize(struct kho_block_it *it)
> > +{
> > + if (it->block)
> > + it->block->ser->count = it->i;
>
> So, it looks like the intention of _it_next is for write, and this ends a
> write iteration.
>
> I think the names should be adjusted to make it clearer.
Done
>
> --
> Sincerely yours,
> Mike.
>
^ permalink raw reply
* Re: [PATCH bpf-next v2] bpf, docs: add LOAD_ACQUIRE and STORE_RELEASE instructions
From: David Vernet @ 2026-06-03 1:58 UTC (permalink / raw)
To: Alexis Lothoré
Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Martin KaFai Lau, Eduard Zingerman, Kumar Kartikeya Dwivedi,
Song Liu, Yonghong Song, Jiri Olsa, Jonathan Corbet, Shuah Khan,
ebpf, Bastien Curutchet, Thomas Petazzoni, bpf, bpf, linux-doc,
linux-kernel
In-Reply-To: <DIP2GAUG3O18.29B8U0FOVEVET@bootlin.com>
[-- Attachment #1: Type: text/plain, Size: 670 bytes --]
On Fri, May 22, 2026 at 10:35:20AM +0200, Alexis Lothoré wrote:
[...]
> I don't know how heavy/long the process is to submit this kind of RFC
> update, but your point makes it sound like it makes more sense to just
> go directly for the proper way, ie adding the conformance group and then
> adding those new ops in there, rather than updating the kernel doc as my
> series is proposing, and then later reverting to a proper conformance
> group.
Hey Alexis,
Apologies for the delay. My email filter was broken so I only just saw
this. Yes, this would be my suggestion. I can send out a patch that gets
this started later this week.
Thanks,
David
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply
* Re: [RFC PATCH 0/5] mm, swap: Virtual Swap Space (Swap Table Edition)
From: Yosry Ahmed @ 2026-06-03 1:29 UTC (permalink / raw)
To: Nhat Pham
Cc: kasong, Liam.Howlett, akpm, apopple, axelrasmussen, baohua,
baolin.wang, bhe, byungchul, cgroups, chengming.zhou, chrisl,
corbet, david, dev.jain, gourry, hannes, hughd, jannh,
joshua.hahnjy, lance.yang, lenb, linux-doc, linux-kernel,
linux-mm, linux-pm, lorenzo.stoakes, matthew.brost, mhocko,
muchun.song, npache, pavel, peterx, peterz, pfalcato, rafael,
rakie.kim, roman.gushchin, rppt, ryan.roberts, shakeel.butt,
shikemeng, surenb, tglx, vbabka, weixugc, ying.huang, yosry.ahmed,
yuanchu, zhengqi.arch, ziy, kernel-team, riel, haowenchao22
In-Reply-To: <20260528212955.1912856-1-nphamcs@gmail.com>
> II. Design
>
> With vswap, pages are assigned virtual swap entries on a ghost device
> with no backing storage. These entries are backed by zswap, zero pages,
> or (lazily) physical swap slots. Physical backing is allocated only
> when needed — on zswap writeback or reclaim writeout, after the rmap
> step.
>
> Compared to the standalone v6 implementation [1], which introduces a
> 24-byte per-entry swap descriptor and its own cluster allocator, this
> edition uses swap_table infrastructure, and share a lot of the allocator
> logic. Per-slot metadata is stored in a tag-encoded virtual_table
> (atomic_long_t, 8 bytes per slot), and physical clusters store
> Pointer-tagged rmap entries in the swap_table for reverse lookup back to
> the virtual cluster.
>
> Here are some data layout diagrams:
>
> Case 1: vswap entry (virtualized)
>
> PTE swap_cluster_info_dynamic
> vswap_entry +-------------------------+
> (swp_entry_t) ------>| swap_cluster_info (ci) |
> | +--------------------+ |
> | | swap_table | |
> | | PFN / Shadow | |
> | | memcg_table | |
> | | count,flags,order | |
> | | lock, list | |
> | +--------------------+ |
> | |
> | virtual_table |
> | +--------------------+ |
> | | NONE | |
> | | PHYS | |
> | | ZERO | |
> | | ZSWAP(entry*) | |
> | | FOLIO(folio*) | |
> | +--------------------+ |
> +-------------------------+
> |
> | PHYS resolves to
> v
> PHYSICAL CLUSTER (swap_cluster_info)
> +--------------------------+
> | swap_table per-slot: |
> | NULL - free |
> | PFN - cached folio |
> | Shadow - swapped out |
> | Pointer- vswap rmap |
> | Bad - unusable |
> | |
> | Vswap-backing slot: |
> | Pointer(C|swp_entry_t) |
> | rmap back to vswap |
> +--------------------------+
>
> Case 2: direct-mapped physical entry (no vswap)
>
> PTE PHYSICAL CLUSTER (swap_cluster_info)
> phys_entry +--------------------------+
> (swp_entry_t) ------>| swap_table per-slot: |
> | NULL - free |
> | PFN - cached folio |
> | Shadow - swapped out |
> | Bad - unusable |
> +--------------------------+
>
> struct swap_cluster_info_dynamic {
> struct swap_cluster_info ci; /* swap_table, lock, etc. */
> unsigned int index; /* position in xarray */
> struct rcu_head rcu; /* kfree_rcu deferred free */
> atomic_long_t *virtual_table; /* backend info, 8 B/slot */
> };
>
> Each vswap cluster (swap_cluster_info_dynamic) extends the classic
> swap_cluster_info struct with a virtual_table array that stores the
> backend information for each virtual swap entry in the cluster. Each
> entry is tag-encoded in the low 3 bits to indicate backend types:
>
> NONE: |----- 0000 ------|000| free / unbacked
> PHYS: |-- (type:5,off:N)|001| on a physical swapfile (shifted)
> ZERO: |----- 0000 ------|010| zero-filled page
> ZSWAP: |--- zswap_entry* |011| compressed in zswap
> FOLIO: |--- folio* ------|100| in-memory folio
>
> We still have room for 3 more future backend types, for e.g. CRAM, i.e
> compressed-CXL-as-swap, which is laid out in [10] and [11]. Worst
> case scenario, we can add more fields to this extended struct.
>
> Other design points:
> - Both vswap entries (Case 1) and directly-mapped physical entries
> (Case 2) coexist as first-class citizens. All the common swap
> code paths — swapout, swapin, swap freeing, swapoff, zswap
> writeback, THP swapin, etc. work for both. When CONFIG_VSWAP=n,
> the vswap branches compile out and behavior should be identical to
> today's swap-table P4 (at least that is my intention).
> - Pointer-tagged swap_table on physical clusters for rmap (physical
> -> virtual) lookup.
> - Virtual swap slots not backed by physical swap are not charged to
> memcg swap counters — only physical backing is charged (I made the
> case for this in [7]).
> - Careful separation of vswap and physical swap allocation paths and
> structures adds a lot of complexity, but is crucial to make sure
> both paths are efficient and do not conflict with each other (for
> correctness and performance). I do re-use a lot of the allocation
> logic wherever possible though.
Thanks for working on this! I mostly looked at the high-level design and
the zswap parts, as the swap code has changed a lot since I was familiar
with it :)
It seems like the direction being taken here is that we have one
(massive) vswap swap device, and we keep normal physical swap devices
around as well.
A vswap entry can point at a physical swap entry, or zswap, or zeromap.
If a vswap entry points at a physical swap entry, then the physical swap
entry points back at the vswap entry (a reverse mapping).
I assume the main reason here is to avoid the extra overhead if
everything uses vswap, which would mainly be the reverse mapping
overhead? I guess there's also some simplicity that comes from reusing
the swap info infra as a whole, including the swap table.
I don't like that the code bifurcates for vswap vs. normal swap entries
though. Not sure if this is an issue that can be fixed with proper
abstractions to hide it, or if the design needs modifications. I was
honestly really hoping we don't end up with this. I was hoping that the
physical swap device no longer uses a full swap table and all, and
everything goes through vswap.
I hoping that if redirection isn't needed (e.g. zswap is disabled),
vswap can directly encode the physical swap slot so that the reverse
mapping isn't needed -- so we avoid the overhead without keeping the
physical swap device using a fully-fledged swap table.
All that being said, perhaps I am too out of touch with the code to
realize it's simply not possible.
Honestly, if the main reason we can't have a single swap table for vswap
is saving 8 bytes on the reverse mapping, it sounds like a weak-ish
argument, even if we can't optimize the reverse mapping away. But maybe
I am also out of touch with RAM prices :)
I at least hope that, the current design is not painting us into a
corner (e.g. through userspace interfaces), and we can still achieve a
vswap-for-all implementation in the future (maybe that's what you have
in mind already?).
Aside from the swap code, the only sticking point for me is the logic
bifurcation in zswap. Why does zswap need to handle vswap vs. not vswap?
I thought the point of the design is to use vswap when zswap is used,
and otherwise use a normal swap table. In a way, one of the goals is to
make zswap a first class swap citizen, but it doesn't seem like we are
achieving that?
^ permalink raw reply
* Re: [PATCH v3 2/2] arm64: kernel: Disable CNP on HiSilicon HIP09
From: Zeng Heng @ 2026-06-03 1:13 UTC (permalink / raw)
To: Will Deacon
Cc: vladimir.murzin, xuwei5, wangyushan12, yangyicong, maz,
yeoreum.yun, miko.lenczewski, james.clark, corbet, skhan,
kuninori.morimoto.gx, lucaswei, catalin.marinas, broonie,
lpieralisi, thuth, kevin.brodsky, tongtiangen, oupton,
ryan.roberts, mark.rutland, Sascha.Bischoff, linux-arm-kernel,
wangkefeng.wang, linux-doc, linux-kernel, zengheng4
In-Reply-To: <ah78iIqAqzfofnIG@willie-the-truck>
Hi Will,
On 2026/6/2 23:53, Will Deacon wrote:
> On Mon, Jun 01, 2026 at 07:20:00PM +0800, Zeng Heng wrote:
>> diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
>> index b0db946568b7..02e0ee5c948c 100644
>> --- a/arch/arm64/kernel/cpu_errata.c
>> +++ b/arch/arm64/kernel/cpu_errata.c
>> @@ -608,6 +608,14 @@ static const struct midr_range erratum_ac04_cpu_23_list[] = {
>> };
>> #endif
>>
>> +#ifdef CONFIG_ARM64_WORKAROUND_DISABLE_CNP
>> +static const struct midr_range cnp_erratum_cpus[] = {
>> + MIDR_ALL_VERSIONS(MIDR_NVIDIA_CARMEL),
>> + MIDR_ALL_VERSIONS(MIDR_HISI_HIP09),
>> + {},
>> +};
>> +#endif
> Sashiko [1] points out that this means that
> CONFIG_HISILICON_ERRATUM_162100125 now affects NVIDIA parts and
> vice-versa for CONFIG_NVIDIA_CARMEL_CNP_ERRATUM.
>
> The easiest fix is probably to guard the entries in the array above with
> their respective config options? Otherwise, this all looks good to me.
>
> Will
>
> [1] https://sashiko.dev/#/patchset/20260601112000.1145391-1-zengheng@huaweicloud.com
Yes, that makes sense to me. Thanks for the reminder.
I'll apply the changes in v4.
Best regards,
Zeng Heng
^ permalink raw reply
* Re: [PATCH v5] PM: QoS: Introduce boot parameter pm_qos_resume_latency_us
From: Aaron Tomlin @ 2026-06-03 1:03 UTC (permalink / raw)
To: Rafael J. Wysocki
Cc: gregkh, dakr, pavel, lenb, zhongqiu.han, akpm, bp, pmladek,
rdunlap, feng.tang, pawan.kumar.gupta, kees, elver, arnd, fvdl,
lirongqing, bhelgaas, neelx, sean, mproche, chjohnst, nick.lange,
linux-kernel, linux-pm, linux-doc
In-Reply-To: <CAJZ5v0g4ksMwxqso8nagPO6s59fFzWt0YSv=SJ1ePF1bfgUCjw@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 2084 bytes --]
On Mon, Jun 01, 2026 at 09:08:33PM +0200, Rafael J. Wysocki wrote:
> IMV it would be better to call the new command line arg something like
> "cpu_idle_exit_latency_us" to make it clear what it is about.
>
> Also, generally speaking, it should be part of cpuidle rather than the
> generic QoS code that also applies to devices other than CPUs.
>
> > or if you simply need me to rebase and resend this against the latest
> > power management tree.
>
> And that too.
Hi Rafael,
Thank you for your review and the constructive feedback.
I certainly appreciate your reasoning concerning the naming convention and
its current CPU-specific scope.
However, before I prepare the next iteration, I thought it prudent to
briefly outline my original architectural reasoning for housing it within
the generic PM QoS code, simply to ascertain whether you remain of the view
that cpuidle is the most appropriate home.
My primary motivation for retaining it within the generic PM QoS framework
was to maintain strict symmetry with the existing sysfs interface.
The parameter is designed to align precisely with
/sys/devices/system/cpu/cpuN/power/pm_qos_resume_latency_us. That sysfs
attribute is exposed and managed by the generic device PM QoS code, quite
independently of cpuidle. Furthermore, the boot constraint itself is
applied via dev_pm_qos_expose_latency_limit(&cpu->dev, ...), which is
fundamentally a core QoS API.
Should we move the boot parameter parsing into cpuidle, the consequence is
that the cpuidle subsystem becomes responsible for parsing a boot string,
only to immediately pass that data back into the generic PM QoS framework
during CPU registration. Keeping the implementation within qos.c ensures
that the parsing logic and the underlying data structures remain cohesively
in the same subsystem. Crucially, it also preserves the flexibility to
extend this syntax to non-CPU devices in the future without necessitating
further refactoring.
I look forward to hearing your preference.
Kind regards,
--
Aaron Tomlin
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply
* Re: [PATCH v3 1/4] mm/zswap: Make shrink_worker writeback cursor per-memcg
From: Yosry Ahmed @ 2026-06-02 23:19 UTC (permalink / raw)
To: Hao Jia
Cc: akpm, tj, hannes, shakeel.butt, mhocko, mkoutny, nphamcs,
chengming.zhou, muchun.song, roman.gushchin, cgroups, linux-mm,
linux-kernel, linux-doc, Hao Jia
In-Reply-To: <ff344c9f-51da-8b3a-e7a9-c4a7f4702ef8@gmail.com>
> > > > > Proactive writeback also wants a similar per-memcg cursor that is
> > > > > scoped to the specified memcg, so that repeated invocations against
> > > > > the same memcg make forward progress across its descendant memcgs
> > > > > instead of restarting from the first child memcg each time.
> > > >
> > > > Is this a problem in practice?
> > > >
> > > > Is the concern the overhead of scanning memcgs repeatedly, or lack of
> > > > fairness? I wonder if we should just do writeback in batches from all
> > > > memcgs, similar to how reclaim does it, then evaluate at the end if we
> > > > need to start over?
> > > >
> > >
> > > Not using a per-cgroup cursor will cause issues for "repeated small-budget
> > > calls" cases. For example, repeatedly triggering a 2MB writeback might
> > > result in only writing back pages from the first few child memcgs every
> > > time. In the worst-case scenario (where the writeback amount is less than
> > > WB_BATCH), it might only ever write back from the first child memcg.
> >
> > Right, so a fairness concern?
> >
> > I wonder if we should just reclaim a batch from each memcg, then check
> > if we reached the goal, otherwise start over. If the batch size is small
> > enough that should work?
>
> Even with a small batch size, for small writeback requests triggered by
> user-space (e.g., 2MB, which is batch size * N), it might still repeatedly
> write back from only the first N child memcgs.
Yes, I understand, I am asking if this is a problem in practice. For
this to be a problem we'd need to trigger small writeback requests and
have many memcgs.
> This could cause the user-space agent to prematurely give up on zswap
> writeback.
Why? The kernel should not return before trying to writeback from all
memcgs. If we scan the first N child memcgs and did not writeback
enough, we should keep going, right?
> > What if we do something like this (for the global cursor):
> >
> > do {
> > memcg = xchg(zswap_next_shrink, NULL);
> > memcg = mem_cgroup_iter(NULL, memcg, NULL);
> > /* If the cursor was advanced from under us, try again */
> > if (!try_cmpxchg(zswap_next_shrink, NULL, memcg))
> > continue;
> > } while (..);
> >
> >
>
> Regarding the code above, IIRC, both the global and per-cgroup cursors
> suffer from race conditions. This race can cause mem_cgroup_iter(NULL, NULL,
> NULL) to return the root memcg or its descendants, leading zswap to write
> back pages from the wrong memcg.
Not the wrong memcg, it will just go back to the first memcg again,
which should be fine as I mentioned below.
>
> Additionally, since mem_cgroup_iter() puts the prev memcg ref and gets the
> next memcg ref, a try_cmpxchg() failure on CPU1 might also lead to a ref
> leak for memcg1.
>
>
> CPU1 CPU2
> memcg1 = xchg(pos, NULL)
> memcg2 = xchg(pos, NULL) memcg2 = NULL;
>
> memcg1 = mem_cgroup_iter()
> mem_cgroup_iter(NULL, **NULL**, NULL) error memcg
> try_cmpxchg(pos，NULL，memcg2） succeed
> try_cmpxchg(pos，NULL，memcg1） **fail**
Yes, we can probably just take a ref on the memcg before calling
mem_cgroup_iter(). That being said, I think we can just keep the lock,
see below.
>
> I took a stab at implementing a cmpxchg()-based zswap_mem_cgroup_iter()
> modeled after mem_cgroup_iter(), and it actually doesn't look that complex
> after all :)
I don't think we should re-implement mem_cgroup_iter() here.
[..]
> > There is a window where a racing shrinker will see the cursor as NULL
> > and start over, but that should be fine. We can generalize this for the
> > per-memcg cursor.
> >
> > That being said..
> >
> > >
> > > Currently, this lock is only used in shrink_memcg(), proactive writeback,
> > > and mem_cgroup_css_offline(). Note that shrink_memcg() only acquires the
> > > lock of the root cgroup, and mem_cgroup_css_offline() is unlikely to be a
> > > hot path.
> >
> > ..this made me realize it's probably fine to just use a global lock for
> > now?
> >
> > IIUC the only additional contention to the existing lock will be from
> > userspace proactive writeback, and that shouldn't be a big deal
> > especially with the critical section being short?
> >
>
> In the current patch implementation, this lock protects the cgroup's own
> cursor variable. During each writeback, we only acquire the spin_lock of the
> target cgroup itself; we do not attempt to **spin on any child cgroup's lock
> while iterating through the descendants**.
Oh, I did not say anything about the current patch adding contention. I
am suggesting we just keep using the global lock for the per-memcg
cursors, if we keep them.
Right now, without this series, the global lock protects against
concurrent changes to the global cursor from concurrent shrinkers. After
the series, the only added contenders are userspace proactive writeback
threads. Unless you have 10s or 100s of those, it should be fine to keep
a single global lock, right?
Yes, userspace can affect writeback efficiency, but we can split the
lock when it actually causes a problem.
>
>
> > >
> > > So, should we keep the spin_lock or go with the cmpxchg() approach?
> > > Yosry and Nhat, what are your thoughts on this?
> >
> > I think we should experiment with the global lock first. See if you
> > observe any regressions with workloads that put a lot of pressure on the
> > lock (a lot of threads in reclaim doing writeback + a few userspace
> > threads doing proactive writeback). See if the userspace threads
> > actually cause a meaningful regression.
>
> Sorry, it seems there are some implementation issues with the global lock
> approach.
>
> In practice, our user-space agent mostly operates in the following two
> scenarios:
> - Triggering proactive writeback on the same cgroup at different times
> (sequentially).
> - Triggering proactive writeback on different cgroups at the same time
> (concurrently).
>
> In both cases, there is no lock contention. So, the current lock works
> perfectly fine for us.
Would using the existing global lock work for your use case? How many
different cgroups can you end up reclaiming from concurrently?
>
> However, if we really hate zswap_wb_iter.lock, I can try replacing it with
> the cmpxchg() approach.
>
> Thanks,
> Hao
^ permalink raw reply
* [PATCH v3 15/15] riscv: hwprobe: Introduce rva23u64 base behavior
From: Guodong Xu @ 2026-06-03 11:12 UTC (permalink / raw)
To: Jonathan Corbet, Shuah Khan, Paul Walmsley, Palmer Dabbelt,
Albert Ou, Alexandre Ghiti, Zong Li, Deepak Gupta, Anup Patel,
Atish Patra, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Yixun Lan, Chen Wang, Inochi Amaoto, Conor Dooley, Shuah Khan,
Christian Brauner
Cc: linux-doc, linux-riscv, linux-kernel, kvm, kvm-riscv,
Paul Walmsley, Palmer Dabbelt, Conor Dooley, devicetree, spacemit,
sophgo, linux-kselftest, Andrew Jones, Charles Jenkins,
Samuel Holland, Guodong Xu
In-Reply-To: <20260603-rva23u64-hwprobe-v2-v3-0-5529a7b28384@gmail.com>
Provide a hwprobe base-behavior bit so userspace can check RVA23U64
support in one call. Without it, a consumer needs five hwprobe
calls and four prctl calls, which is error-prone to require of every
caller. Most software treats RVA23U64 as a new base anyway, so
expose it directly.
Signed-off-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Signed-off-by: Guodong Xu <docular.xu@gmail.com>
---
v3: No change.
v2:
- Detect RVA23U64 by reading from the cached hart_isa[].isa_bases
bitmap populated by riscv_init_isa_bases() at init time, sharing
one source of truth with /proc/cpuinfo.
---
Documentation/arch/riscv/hwprobe.rst | 8 ++++++++
arch/riscv/include/uapi/asm/hwprobe.h | 3 ++-
arch/riscv/kernel/sys_hwprobe.c | 23 +++++++++++++++-------
tools/testing/selftests/riscv/hwprobe/which-cpus.c | 2 +-
4 files changed, 27 insertions(+), 9 deletions(-)
diff --git a/Documentation/arch/riscv/hwprobe.rst b/Documentation/arch/riscv/hwprobe.rst
index 601e81f561421..d6712259946e9 100644
--- a/Documentation/arch/riscv/hwprobe.rst
+++ b/Documentation/arch/riscv/hwprobe.rst
@@ -67,6 +67,14 @@ The following keys are defined:
programs (it may still be executed in userspace via a
kernel-controlled mechanism such as the vDSO).
+ * :c:macro:`RISCV_HWPROBE_BASE_BEHAVIOR_RVA23U64`: Support for all mandatory
+ extensions of RVA23U64, as defined in the RISC-V Profiles specification
+ starting from commit 0273f3c921b6 ("rva23/rvb23 ratified").
+
+ The RVA23U64 base is based upon the IMA base and therefore IMA extension
+ keys (e.g. :c:macro:`RISCV_HWPROBE_KEY_IMA_EXT_0`:) may be used to probe
+ optional extensions.
+
* :c:macro:`RISCV_HWPROBE_KEY_IMA_EXT_0`: A bitmask containing extensions
that are compatible with the :c:macro:`RISCV_HWPROBE_BASE_BEHAVIOR_IMA`:
base system behavior.
diff --git a/arch/riscv/include/uapi/asm/hwprobe.h b/arch/riscv/include/uapi/asm/hwprobe.h
index 36ec8ab470423..50733d3db7633 100644
--- a/arch/riscv/include/uapi/asm/hwprobe.h
+++ b/arch/riscv/include/uapi/asm/hwprobe.h
@@ -21,7 +21,8 @@ struct riscv_hwprobe {
#define RISCV_HWPROBE_KEY_MARCHID 1
#define RISCV_HWPROBE_KEY_MIMPID 2
#define RISCV_HWPROBE_KEY_BASE_BEHAVIOR 3
-#define RISCV_HWPROBE_BASE_BEHAVIOR_IMA (1 << 0)
+#define RISCV_HWPROBE_BASE_BEHAVIOR_IMA (1 << 0)
+#define RISCV_HWPROBE_BASE_BEHAVIOR_RVA23U64 (1 << 1)
#define RISCV_HWPROBE_KEY_IMA_EXT_0 4
#define RISCV_HWPROBE_IMA_FD (1 << 0)
#define RISCV_HWPROBE_IMA_C (1 << 1)
diff --git a/arch/riscv/kernel/sys_hwprobe.c b/arch/riscv/kernel/sys_hwprobe.c
index 3e80e5551ae0d..3f66f2e99d41a 100644
--- a/arch/riscv/kernel/sys_hwprobe.c
+++ b/arch/riscv/kernel/sys_hwprobe.c
@@ -226,6 +226,17 @@ static bool hwprobe_ext0_has(const struct cpumask *cpus, u64 ext)
return (pair.value & ext);
}
+static bool hwprobe_has_isa_base(const struct cpumask *cpus, unsigned int base)
+{
+ int cpu;
+
+ for_each_cpu(cpu, cpus) {
+ if (!test_bit(base, hart_isa[cpu].isa_bases))
+ return false;
+ }
+ return true;
+}
+
#if defined(CONFIG_RISCV_PROBE_UNALIGNED_ACCESS)
static u64 hwprobe_misaligned(const struct cpumask *cpus)
{
@@ -308,14 +319,12 @@ static void hwprobe_one_pair(struct riscv_hwprobe *pair,
case RISCV_HWPROBE_KEY_MIMPID:
hwprobe_arch_id(pair, cpus);
break;
- /*
- * The kernel already assumes that the base single-letter ISA
- * extensions are supported on all harts, and only supports the
- * IMA base, so just cheat a bit here and tell that to
- * userspace.
- */
case RISCV_HWPROBE_KEY_BASE_BEHAVIOR:
- pair->value = RISCV_HWPROBE_BASE_BEHAVIOR_IMA;
+ pair->value = 0;
+ if (hwprobe_has_isa_base(cpus, RISCV_ISA_BASE_IMA))
+ pair->value |= RISCV_HWPROBE_BASE_BEHAVIOR_IMA;
+ if (hwprobe_has_isa_base(cpus, RISCV_ISA_BASE_RVA23U64))
+ pair->value |= RISCV_HWPROBE_BASE_BEHAVIOR_RVA23U64;
break;
case RISCV_HWPROBE_KEY_IMA_EXT_0:
diff --git a/tools/testing/selftests/riscv/hwprobe/which-cpus.c b/tools/testing/selftests/riscv/hwprobe/which-cpus.c
index 587feb198c049..f8c797b1d0fd9 100644
--- a/tools/testing/selftests/riscv/hwprobe/which-cpus.c
+++ b/tools/testing/selftests/riscv/hwprobe/which-cpus.c
@@ -105,7 +105,7 @@ int main(int argc, char **argv)
pairs[0] = (struct riscv_hwprobe){ .key = RISCV_HWPROBE_KEY_BASE_BEHAVIOR, };
rc = riscv_hwprobe(pairs, 1, 0, NULL, 0);
assert(rc == 0 && pairs[0].key == RISCV_HWPROBE_KEY_BASE_BEHAVIOR &&
- pairs[0].value == RISCV_HWPROBE_BASE_BEHAVIOR_IMA);
+ (pairs[0].value & RISCV_HWPROBE_BASE_BEHAVIOR_IMA));
pairs[0] = (struct riscv_hwprobe){ .key = RISCV_HWPROBE_KEY_IMA_EXT_0, };
rc = riscv_hwprobe(pairs, 1, 0, NULL, 0);
--
2.43.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox