| Age | Commit message (Collapse) | Author |
|---|
|
Scalar evolution widens a register that has delta 4. Then the prog copies
the register. With the stale delta the verifier finds that a read of
uninitialized r9 is dead code, and it loads the prog. See
"bpf: Clear delta of a register that scalar evolution widens".
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-9-alexei.starovoitov@gmail.com
|
|
With BPF_F_ARENA_SCALAR the verifier accepts a load or a store through a
scalar as an access to arena. The next patch removes the flag. Remove its
tests.
Keep one test. Without the flag the verifier must reject such a load, also
in a prog that has an arena. Move this test to verifier_arena.c.
The removed tests were the only tests of a special path in the x86 JIT for
the fetching AND/OR/XOR atomics. Only the flag used that path.
arena_atomics tests the usual path.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-5-alexei.starovoitov@gmail.com
|
|
The .arena.data section and the BPF_F_ARENA_SCALAR flag let a prog in Rust
keep its global data in arena. The subsequent patches remove the two,
because the compiler can do this work. First remove the tests for
.arena.data.
One of the tests is a prog in Rust. It has no replacement, because LLVM
does not put the globals of Rust in arena at this time. No other selftest
is in Rust. Thus also remove the makefile rules that build Rust.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-2-alexei.starovoitov@gmail.com
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing updates from Steven Rostedt:
- Add "within" to filter logic
Add a way to trace events by what function they fall in.
echo 'within == "vfs_read" > events/sched/sched_switch/filter
Will only trigger sched_switch events that happen within the vfs_read
function. It uses a stacktrace at the event and checks if any entry
is within the specified function and if so, it prints the event.
- Remove a duplicate definition of ftrace_set_clr_event() from the
header
- Do not have ftrace_set_clr_event() modify its input buffer
Have the buffer passed into ftrace_set_clr_event() to be const char *
and not allow modifications to it that might cause side effects.
- Add kunit tests for ftrace_parse_event_string()
- Add filter argument to __ftrace_set_clr_event()
Make it possible to set a filter on an event at the same time it is
enabled.
- Add event filtering logic to the kernel command line
To allow filtering events on boot, allow filtering to be specified on
the kernel command line when enabling events.
- Rename "ring_buffer_size()" to "ring_buffer_capacity()"
"size" refers to how much is allocated whereas the actual return
value is the amount of available data in the ring buffer minus its
meta data.
- Rename "trace_array_entries" to "trace_array_capacity"
There's several functions that use "entries" and returns the amount
of data that that is usable. "entries" should be only for the number
of events, not the amount of data.
- Print the histogram "bucket" size as unsigned.
If a bucket size is LONG_MAX, then it shows up as a negative number.
- Show bucket size in output of histograms
The output of what the histogram is shown doesn't show the size of
the buckets when buckets are used. The output should be the same as
the input and since specifying buckets without a size is an invalid
command, the output to display what was entered should also show the
size.
- Fix stacktrace modifier output
Only show the stacktrace modifier when it was specified in creation.
- Unregister filed variable histograms when the command fails
If one histogram references a variable of another histogram it
registers that other histogram. But if the first histogram fails in
setup after it registered the other histogram it doesn't unregister
it. Have the first histogram add the reference to the other histogram
so the failure clean up will unregister the second histogram too.
- Fix 64-bit signed histogram fields on 32-bit kernels
A fix to convert char * to u64 with added casting also incorrectly
added an intermediate cast to convert a long value to u64 which ended
up truncating the upper 32 bits for 32-bit kernels. Remove the
intermediate typecast.
- Print signed histogram keys as signed
Histogram keys were being printed as unsigned and with signed keys it
was giving the wrong output.
- Use copy_from_user() and not __copy_from_user() in syscall tracing
The syscall tracing incorrectly was using __copy_from_user() which
could be an issue if the system trusts perf doing the trace.
- Take trace_types_lock when recording a new module in persistent
buffer
When a new module is loaded, the persistent ring buffer saves it in
its persistent memory. All the trace_arrays are iterated looking for
any persistent buffer to add the module to. But it did not hold the
trace_types_lock meaning a trace_array could be added or removed
while iterating the list.
- Only create tracepoint guest_halt_poll_ns when it is used
The tracepoint guest_halt_poll_ns is defined in the power management
code but it is only used when CONFIG_CPU_IDLE_GOV_HALTPOLL is
enabled. This wastes memory when that config isn't enabled so wrap
the tracepoint around that as well.
- Handle empty fields for events in trace_event_get_offsets()
The user events could have empty fields and this causes
trace_event_get_offsets() to crash as it expects events to always
have fields. Make the function handle events with no fields.
- Reject incomplete event filter expressions
If a filter has an incomplete expression (common_pid == 1111 || ), it
will cause a out-of-bounds bug. Have the predicate_parse() only
process the expression if it is complete.
* tag 'trace-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (27 commits)
tracing: Reject incomplete event filter expressions
tracing: Guard trace_event_get_offsets() against an empty fields list
cpuidle: haltpoll: Only define guest_halt_poll_ns tracepoint when used
tracing/osnoise: Add __printf attribute to osnoise_print()
tracing/histograms: Verify event_call identity when updating synth_event refcount
tracing: Save the event file instead of the compatible histogram
tracing: Hold trace_types_lock when resetting last boot data from readers
tracing: Hold trace_types_lock when updating modules in persistent instances
tracing/syscalls: Use copy_from_user for the faultable syscall buffer
tracing: Print a signed histogram key as signed
tracing: Fix 64-bit and signed histogram fields on 32-bit kernels
tracing: Clamp the printed end of a histogram bucket at U64_MAX
tracing: Unregister field variable histograms when the command fails
tracing: Only report the stacktrace modifier on a real field
tracing: Add the bucket size to expr_field_str()
tracing: Print the bucket size as unsigned
tracing: Rename tracing_entries_fops to tracing_capacity_fops
tracing: Rename trace_array::entries to capacity
ring-buffer: Rename ring_buffer_size() to ring_buffer_capacity()
tracing: Parse filter from boot event string
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull more MM updates from Andrew Morton:
- "mm: make VMA flag semantics explicit, eliminate VM_SPECIAL" (Lorenzo
Stoakes):
Replace VM_SPECIAL with helpers describing mapping ownership and
behavior. Enforce the mmap flag rules and convert affected drivers,
removing ambiguous tests shared by driver mappings and ordinary
memory.
- "support kselftest on nommu platform" (Hajime Tazaki):
Add opt-in mmap and mremap tests for NOMMU systems. Teach the runner
to avoid its fork-dependent timeout command and document the build
and runtime requirements.
- "mm/collapse: separate a collapse from its callers" (Kiryl
Shutsemau):
Separate huge-page collapse from caller policy. Replace khugepaged
identity checks with explicit permissions, and separate scanning from
collapse with the mmap_lock drop in one place.
- "mm: implement and use vma_has_anon_rmap(), silence KCSAN" (Lorenzo
Stoakes):
Provide a common helper for testing whether a VMA has anonymous
reverse mappings. Document the locking rules, annotate intentional
concurrent reads for KCSAN, and convert the core MM callers.
- "mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups"
(David Hildenbrand):
Remove SECTION_MARKED_PRESENT in favor of the early-section flag.
Simplify sparse memory initialization, section metadata handling and
related PFN validity checks.
- "sh: remove NUMA and SPARSEMEM support" (Mike Rapoport):
Remove SuperH NUMA and SPARSEMEM support. The extra memory banks have
been unusable since the NO_BOOTMEM conversion, leaving only the code
and data overhead.
- "mm: Unify device DAX and HugeTLB vmemmap population paths" (Muchun
Song):
Unify the generic device DAX and HugeTLB vmemmap population paths and
shared tail-page handling. Remove the duplicate DAX machinery while
retaining the powerpc radix implementation.
- "kselftest: mm: fix some failure of split_huge_page_test" (Yeoreum
Yun):
Fix huge-page split tests racing with khugepaged recollapse. Use
pagemap and page flags instead of VMA-boundary assumptions which fail
when glibc has already enabled THP.
- "memcg: move memcgid refcount to objcg to unpin dying memcgs"
(Bingfang Guo):
Let dying memcgs be freed while swapped-out shmem still holds their
IDs. Move ID references to reparentable objcgs, with the necessary
swap accounting and RCU lifetime changes.
- "mm/truncate: fix data loss when truncating straddling large folios"
(Zhang Yi):
Preserve out-of-range data when truncating straddling large folios.
Fix a lookup race and split-failure handling, and handle minimum
folio orders for the forthcoming ext4 iomap buffered I/O path.
- "mm/damon: introduce damos quota goal target metric complement flag"
(SJ Park):
Let DAMOS quota goals use a metric's complement, so utilization can
also express free-memory goals without adding separate metrics. Add
the sysfs interface, documentation and tests.
- "arm64/mm: Standardize printing for pgtable entries" (Anshuman
Khandual):
Use the generic formatter for arm64 page-table entries, ready for
future wider entries. Move the safe-PTE-update check out of the
header to avoid an include cycle.
- "mm: kmsan: fix iounmap metadata teardown" (Dima Koziuk):
Fix KMSAN metadata leaks on iounmap and failed ioremap allocations.
Free backing pages before removing their mappings, and share the
teardown with partial-allocation cleanup.
- "mm/damon/core: preserve quota state when constructing schemes" (Karl
Mehltretter):
Preserve running DAMOS quota state while validating parameter
updates. Even rejected updates could reset accounting and exceed the
quota window; add tests for both accepted and rejected updates.
- "mm/vmalloc: fix vmalloc_dump_obj VA lookup" (Ye Liu):
Fix vmalloc_dump_obj() lookups for last-page addresses and
allocations spanning vmap zones. These allocations were being missed
in diagnostic output.
- "mm: various (urgent?) fixes" (David Hildenbrand):
Fix mmap charge leaks and hugetlb use-after-free, wrong-address
unmapping, stuck locks and endless faults. Also preserve reservations
on failed mremap and handle stale userfaultfd bits.
- "maple_tree: fix maple_range_64 crashes in RCU mode" (Dimitris
Charisis):
Fix pointer and metadata confusion during RCU destruction of
maple_range_64 nodes, avoiding double frees and invalid accesses. Add
a regression test; no in-tree user currently uses this combination.
- "mm: fix hugetlb NR_HUGETLB accounting on folio migration" (Hongfu
Li):
Fix hugetlb migration and preallocation accounting so /proc/vmstat
retains the correct count and memory.numa_stat follows the folio to
its new node.
- "mm/damon: fix a minor bug, clean code, and add a test" (SJ Park):
Fix 32-bit DAMON age overflow which made old regions look young.
Share hugetlb folio acquisition code and add a regression test for
the previously fixed last-region skipping bug.
- "mm/damon/core: cleanup code, reduce stack usage, and add kunit" (SJ
Park):
Reduce kdamond stack usage and remove unused enums. Add deterministic
PSI quota-goal tests which do not depend on the machine's current
memory pressure.
- "mm/damon: fix the temporal goal tuner's size quota conversion"
(Donggeun Yoo):
Bound the temporal tuner's quota conversion to prevent overflow and
zero effective quotas, which could stop schemes making progress. Add
boundary tests.
- "Don't use GFP_DMA when calling dma_alloc_coherent" (Baoquan He):
Remove redundant GFP_DMA flags from coherent DMA allocation calls.
The DMA API already selects the zone from device limits and ignores
the caller's flag.
- "kselftest: mm: fix intermittent failure khugepaged test" (Yeoreum
Yun):
Propagate child-process failures in the khugepaged tests and prevent
background collapse from racing their checks. This removes false
passes and intermittent failures.
- "MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM"
(Enze Li):
Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds
the right maintainers. Also label the closing hugetlb_cgroup.h
include guard.
Summary of the 65 singletons in this merge:
The singletons include a few worthwhile performance fixes. Avoiding
unnecessary reverse-map tree updates gave a reported 15.9% improvement
in UnixBench's execl test on a 192-core x86 system. A reclaim retry
fix stops defrag_mode from spinning under memory.low protection; a
reported file-creation stress test ran 5.7 times faster, with far less
memory pressure. Narrower hugetlb invalidations also spare KVM guests
needless refaults: the reported Redis-in-VM P99 QPS penalty while
punching holes fell from 7.09% to 1.45%.
Several fixes prevent lost data or corrupted memory. Lazyfree
huge-page races with mremap()/munmap() could lose data or access freed
memory, and MADV_COLD could lose a concurrent write's dirty bit.
Another fix prevents stale migration entries from outliving large
folios. On filesystems with blocks smaller than a page, extending a
file by 4 GiB or more could expose bytes written past the old EOF
through mmap instead of zeroes. That is fixed, along with
use-after-free races in PAGEMAP_SCAN during process exit and in
memory-cgroup accounting on PREEMPT_RT kernels.
Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios,
which could wedge other memory operations, and stop mremap() leaking
commit charges until allocations fail under strict overcommit. A
further fix keeps userfaultfd tracking intact on neighboring mappings.
NUMA binding no longer prevents long-term pins when the chosen node
has only movable memory, fixing QEMU/VFIO startup and io_uring buffer
registration failures. MGLRU also gets a fix for early-boot crashes
with memory cgroups disabled at boot, notably in small crash kernels.
* tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (213 commits)
mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline
mm/page_counter: use WRITE_ONCE() for emin/elow when parent is the root
mm/memcontrol: publish null pointer before dropping css reference
test_maple_tree: test maple_range_64 node in RCU mode
maple_tree: fix maple_range_64 crashes in RCU mode
mm/vma: avoid broken uffd merge on mremap
tools/testing/shared: catch a failed posix_memalign()
mm/damon/core: remove unreachable damos charge_{target,addr}_from
mm/shrinker: allocate shrinker_info_unit from a dedicated kmem_cache
riscv: mm: exclude invalid THP PMDs from page table check
mm/damon/core: filter out damos address filter-split failed region
fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
mm/mempolicy: apply bind policies against the scoped allocation zone
mm/vmscan: reclaim every zone in per-node proactive reclaim
mm/mremap: correctly uncharge accountable VMAs in error path
mm/mremap: populate calculated fields in vrm state correctly
MAINTAINERS: add an entry for MEMORY MANAGEMENT - MEMORY MAP
mm: bdi: reset min_ratio after the sysfs attributes are gone
mm/page_vma_mapped: continue past nonmatching huge PMDs
selftests/mm: skip hugetlb cgroup v2 tests without the needed controllers
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull non-MM updates from Andrew Morton:
- "ocfs2: exit recovery thread on mount error path" (Joseph Qi):
Stop OCFS2 recovery before freeing failed-mount state and replay
slots, closing use-after-free and double-free races. Defer
suballocator reclaim to break a transaction-lock deadlock with
dismount.
- "ocfs2: validate suballoc slot and bit of metadata blocks" (Joseph
Qi):
Validate OCFS2 metadata suballocator slots, bits and directory index
block locations. Reject corrupt metadata with filesystem errors
instead of BUGs or out-of-bounds accesses.
- "ocfs2: deal with legacy signed name hash values" (Joseph Qi):
Restore OCFS2 lookups for non-ASCII names stored with legacy signed
hashes. Use stored xattr hashes during bucket splits to avoid
duplicate entries and spurious ENOSPC failures.
- "ocfs2: stabilize dentry names in file and setattr traces" (Cen
Zhang):
Snapshot OCFS2 names during file and setattr tracing to prevent
rename races using freed storage or mismatched names and lengths.
Preserve trace formats and the locked release open-count sample.
- "panic: fix panic_force_cpu= redirect races and NMI bypass" (Bradley
Morgan):
Fix panic_force_cpu races and NMI redirection so crash-kernel CPU
selection is honored. Preserve variable arguments on failed redirects
and use a static message buffer.
- "fat: allocate multiple clusters in fallocate" (Matheus Alves de
Almeida):
Allocate FAT clusters in batches for FALLOC_FL_KEEP_SIZE and batch
FAT updates. This removes repeated single-cluster allocation
overhead, particularly on synchronous mounts.
- "scripts/gdb: fix radix tree lookup and stack depot diagnostic"
(Ting-Han Hou):
Fix GDB radix-tree lookup and its handling of XArray sibling, retry
and zero entries. Also repair the stack-depot diagnostic for an
out-of-range pool index.
- "hung_task: Improve warning budget handling and task reporting"
(Aaron Tomlin):
Reset the hung-task warning budget after recovery so later hangs
remain visible. Keep the configured limit intact and emit one summary
per scan when detailed reports exhaust the budget.
- "bootconfig: Reject unexpected data after null character and
cleanups" (Masami Hiramatsu):
Reject bootconfig data after an embedded null while accepting
trailing padding. Validate the full input in the userspace tool, and
retain internal tree sanity checks there rather than in the kernel.
- "kbuild: GCOV cleanups following the prefer-atomic fix" (Konstantin
Khorenko):
Use the actual GCOV build flags in the prefer-atomic compiler probe.
Move flag setup into scripts/Makefile.gcov and skip the probe when
GCOV is disabled.
- "ocfs2: xattr bucket validation fixes" (Joseph Qi):
Accept valid OCFS2 xattr buckets spanning 512-byte blocks, avoiding
false read-only remounts. Reject misaligned buckets and return errors
instead of panicking on corrupt defrag metadata.
- "ocfs2: fix metadata reservation for xattr value trees" (Joseph Qi):
Reserve enough OCFS2 metadata for new and relocated xattr value
trees. Fix shortfalls which could cause ENOSPC, dropped entries and
leaked clusters on fragmented filesystems; remove duplicate
reservations.
- "Introduce arch_do_panic" (Mete Durlu):
Add arch_do_panic() and move s390 and sparc handling out of generic
panic code. The architecture-specific actions now follow the
end-of-panic marker.
- "checkpatch: userspace improvements" (Petr Vorel):
Improve checkpatch's userspace detection and suppress kernel-only
checks. Recognize standard inttypes macros and add explicit
--userspace and --no-userspace overrides.
- "ocfs2: validate dr_fs_generation of dir index root blocks" (Joseph
Qi):
Check OCFS2 directory index generations and leaf block numbers.
Reject stale or misplaced blocks instead of using metadata left by a
previously formatted filesystem.
- "selftests/membarrier: Skip an unregistered memory barrier test on
Musl" (Chris Gellermann):
Skip the unregistered membarrier test when libc has already
registered the command. Musl does this during thread creation,
causing false failures in the multithreaded test.
- "init: fix array boundary bugs in boot parameter parsing"
(Wilson Felipe Pereira):
Fix boot argument boundary cases which leave stale arguments in
init's command line or panic when replacing the final environment
variable. Clear the last slot and check duplicates before the limit.
Summary of the 87 singletons in this merge:
The OCFS2 singletons fix deadlocks between xattr updates and inline
truncation, and during inode reclaim. Corrupt quota and extent
metadata could also crash the kernel or corrupt memory; these paths
now check the layout before using it. Other fixes close use-after-free
and publication races around cluster reconfiguration, node failure,
quota remount errors and shared refcount trees. New files now retain
security labels from all stacked LSMs instead of silently dropping all
but one. Valid xattr insertions also stop tripping FORTIFY on builds
with counted arrays.
Elsewhere, a lost wakeup could leave hardware-monitoring reads stuck
in unkillable sleep and block further I2C traffic. That is fixed, as
are kernel memory leaks in POSIX message-queue notifications and tmpfs
casefold setup which could grow until memory is exhausted. A driver
removal race which could crash the kernel is fixed too. The
hibernation command through reboot() also stops taking the same mutex
twice, avoiding a deadlock before suspension.
On the boot side, bzip2 decoding now accepts valid full blocks emitted
by lbzip2, fixing failures to boot those compressed kernels. Malformed
bzip2 streams can no longer overflow the decode buffer, and LZ4
initrds are checked before the decoder can read past their end. FAT
rejects geometry which overflows the data-area calculation on 32-bit
systems, and rolls back entries when inode setup fails, preventing
failed creations from reappearing after remount. The x86 XOR and RAID6
AVX paths also avoid imposing a slowdown on subsequent SSE code.
* tag 'mm-nonmm-stable-2026-10-25-14-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (134 commits)
scripts/gdb: fix stack depot out-of-bounds diagnostic
scripts/gdb: fix radix tree lookup pointer handling
ocfs2/cluster: remove zero-address nodes from IP tree on teardown
ocfs2: snapshot the dentry name while tracing file release
ocfs2: snapshot dentry names in file and setattr traces
ocfs2/dlm: drain join handlers before releasing module text
MAINTAINERS: update Markus's e-mail address
mailmap: add entries for Andrew Jones
stackdepot: stop preallocating after the final pool
ocfs2: drain quorum work before removing the cluster
watchdog: force console verbose when reporting lockups
profiling: fix sampling step on 64-bit big-endian systems
kernel/reboot: avoid potential deadlocks during suspension
compat: avoid double rounding in times()
ocfs2: pin owning modules for open debugfs files
ocfs2/cluster: initialize heartbeat regions before publishing them
selftests/proc: proc-pid-vm: fix unused variable warning on non-x86
ocfs2: pin refcount trees before dropping the lookup lock
ocfs2: validate the xattr tree root of an indexed xattr block
ocfs2/dlm: hold the lookup reference across convert AST enqueue
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse
Pull fuse updates from Miklos Szeredi:
- Add dax backing and extent map support for famfs (John Groves,
Miklos)
- Support large folios (Joanne)
- Add selftests and documentation of caching behavior (Luis Henriques)
- Add FUSE_SYNCFS request (Jimmy Zuber)
- Convert readdir cache to use folios (Tal Zussman)
- Lots of bug fixes
* tag 'fuse-update-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (53 commits)
fuse: handle extent map files in fuse_passthrough_fadvise()
fuse: resolve extent maps in O(1) when possible
fuse: add support for striped backing
fuse: add extent map I/O support
fuse: add extent map data structure
fuse: add support for opening dax device as backing
fuse: support opening 64 bit backing ID
fuse: support 64 bit, server allocated backing ID
fuse: add helpers for EIO return value with kernel message
dax: use READ_ONCE() in dax_holder()
dax: add fsdev_dax_from_file()
fuse: fix copy_file_range reply handling race
virtiofs: validate fixed-output response length
fuse: don't d_drop() before d_splice_alias()
virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree
fuse: validate folio state before pipe_buf_try_steal() in fuse_try_move_folio()
fuse: rename fuse_direct_io() to fuse_do_direct_io()
fuse: Forward vfs_fadvise to backing_file in passthrough mode
selftests/fuse: add the missing FUSE_HAS_SYNCFS privilege test
fuse: don't launder folios of a bad inode
...
|
|
After the clamping changes, r7 returns to the header with [-72, -16]
instead of the narrower [-64, -16], so the test no longer checks subrange
pruning. Assign an invariant fp-16 pointer to r7 in the loop, giving r7 an
ANY SCEV that is not clamped and restoring strict-subrange coverage.
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026-scev-simpler-clamp-v2-11-f373aec9825f@gmail.com
|
|
When building SCEV expressions for the loop:
w7 = w1; r7 = (zext32 r1)
w1 = w7; r1 = (zext32 (zext32 r1))
w1 += 2; r1 = (zext32 (+ (zext32 (zext32 r1)) 2))
Computed SCEV expression for r1:
(zext32 (linear r1 2))
Substituting this into r7's expression at the latch:
(zext32 (zext32 (linear r1 2)))
Without (zext32 (zext32 X)) -> (zext32 X) simplification rule
the latch would not be recognized as linear and header_count
won't be computed.
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026-scev-simpler-clamp-v2-10-f373aec9825f@gmail.com
|
|
Add three test cases exercising state pruning after loop counter
clamping. All turn a 32-bit stack spill into STACK_MISC during the
first iteration. This prevents a state match at the outer loop header
on the next iteration, while allowing states to match further inside
the loop. All are falsely reported as infinite loop w/o changes in
patch [1].
- clamp_callee_state_pruning(), a callee overwrites the upper half of
the caller's stack slot. States then match at the callee's exit,
where the current frame has no active loop.
Verify that current_loop() finds the caller's active loop.
- clamp_nested_loop_state_pruning(), the overwrite happens inside an
inner loop. Exercise matching states when the inner loop is entered
again on a subsequent outer iteration.
- clamp_nested_unrolled_loop_state_pruning(), same as above, but the
inner loop is not recognized by SCEV and is unrolled with a precise
counter, so its entries are never marked terminating.
[1] bpf: avoid false infinite loop reports after changes in SCEV clamping
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026-scev-simpler-clamp-v2-9-f373aec9825f@gmail.com
|
|
A 64-bit and 32-bit examples leading to an empty register range error
when scev.c:bpf_clamp_scev_regs() intersected current register state
with computed iteration range:
r1 = 0; verification
r3 = 0; path
loop: r3 += 1; | <---------.
if r3 != 5 goto +0; | r3 ∈ {5} |
r1 += 1; | |
if r1 != 5 goto loop; '-----------'
r0 = 0;
exit;
- At header r3 ∈ {0,1,2,3,4}.
- After `if r3 != 5 goto ...` continued with r3 ∈ {5}.
- On a second iteration bpf_clamp_scev_regs() computed:
r3 := {0,1,2,3,4} ∩ {5} = ∅
And reported an error:
verifier bug: scev clamp produced empty range for r3
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026-scev-simpler-clamp-v2-8-f373aec9825f@gmail.com
|
|
Add four tests for pointer operands in 32-bit SCEV analysis.
Check that loop bounds are not inferred for the following program shapes:
32-bit latch | 32-bit recurrence
-------------------------+--------------------------
r6 = ... pointer ... | r6 = ... pointer ...
r7 = ... pointer ... | r7 = ... pointer ...
l: r6 += 1 | l: w6 += 1
... | ...
if w6 < w7 goto l | if r6 < r7 goto l
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026-scev-simpler-clamp-v2-7-f373aec9825f@gmail.com
|
|
- Print large 32-bit bounds without sign extension.
- Omit 32-bit bounds when they coincide with 64-bit bounds.
Before:
loop header at ..., widening r0 to 0x80000000..0xffffffff (s32 0xffffffff80000000..-1) step 1
loop header at ..., widening r0 to 0..3 (s32 0..3) step 1
After:
loop header at ..., widening r0 to 0x80000000..0xffffffff (s32 0x80000000..-1) step 1
loop header at ..., widening r0 to 0..3 step 1
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026-scev-simpler-clamp-v2-6-f373aec9825f@gmail.com
|
|
Clamping now reproduces the widened range at every back edge,
so induction variable ranges no longer vary between iterations.
This can produce identical checkpoint states in terminating programs,
for example:
int main(...) {
for (int i = 0; i < 10; i++) {
foo(...);
for (int j = 0; j < 3; j++)
...;
}
}
void foo(...) {
...;
}
Handle two cases in states.c:bpf_is_state_visited():
- For checkpoints inside foo(), look for active loops in upper frames
as well. Otherwise current_loop() returns NULL and an identical
callee state can trigger an infinite loop report.
- For checkpoints inside the inner loop, skip the infinite loop check
when the current state is inside a terminating loop in any frame.
That loop bounds how many times its body is re-executed, so an
identical state on a later iteration does not imply nontermination.
This covers the inner loop above, re-entered with a fresh entry
state on each outer iteration, and inner loops SCEV cannot analyze.
The nested_terminating_prune test still rejects such an outer loop,
but now reaches the jump complexity limit instead of reporting an
infinite loop. Update its expected message accordingly.
Fixes: 6ccf49f79327 ("bpf: Use SCEV to widen bounded loops")
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026-scev-simpler-clamp-v2-3-f373aec9825f@gmail.com
|
|
scev.c:bpf_clamp_scev_regs() is called each time verifier returns to a
loop header via a backedge. It's purpose is to re-establish computed
variable ranges for registers with linear SCEVs.
It can be defined as:
- For each register R with linear SCEV compute:
- loop_range(R) := entry_range(R) * iterations_count
- range(R) := range(R) ∩ loop_range(R)
Such formulation is necessary to avoid ranges over-approximation in
examples like below:
r1 = 0; SCEVs: r1 = (linear r1 1)
r3 = 0; r3 = (linear r3 1)
loop: r3 += 1;
r1 += 1;
if r1 < 5 goto loop;
r0 = 0;
exit;
- At loop entry r3 is widened to be in a range r3 ∈ {0,1,2,3,4}.
- After increment it becomes r3 ∈ {1,2,3,4,5}.
- On a second iteration the bpf_clamp_scev_regs() forces r3 to become
r3 ∈ {1,2,3,4}. W/o clamping logic r3 range wouldn't shrink
preventing loop from converging in states.c:states_equal().
However, intersection logic might lead to assigning an empty range to
a register, as in example below:
r1 = 0; verification
r3 = 0; path
loop: r3 += 1; | <---------.
if r3 != 5 goto +0; | r3 ∈ {5} |
r1 += 1; | |
if r1 != 5 goto loop; '-----------'
r0 = 0;
exit;
- At header r3 ∈ {0,1,2,3,4}.
- While exploring the branch `if r3 != 5 goto ...` with r3 ∈ {5}.
- On a second iteration:
r3 := {0,1,2,3,4} ∩ {5} = ∅
Which stops verification with the following error:
verifier bug: scev clamp produced empty range for r3
Technically this means that the current verification path is
impossible at runtime and should not be traced further.
This commit mitigates the above by removing the intersection logic,
the function is now defined as:
- For each register R with linear SCEV compute:
- range(R) := entry_range(R) * iterations_count
This is still sound, provided that SCEV expressions loop execution
counts are correct.
Fixes: 6ccf49f79327 ("bpf: Use SCEV to widen bounded loops")
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026-scev-simpler-clamp-v2-2-f373aec9825f@gmail.com
|
|
On a device created with gbp, run the reserved bit probes before and
after an unrelated changelink. Check that what the device accepts has
not changed.
Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Link: https://patch.msgid.link/20261023-b4-vxlan-changelink-gbp-v1-2-f0d13951c09b@proxmox.com
Tested-by: Gabriel Goller <g.goller@proxmox.com>
Reviewed-by: Gabriel Goller <g.goller@proxmox.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
interval to vary by HZ
The mcast_startup_query_interval default value is calculated as
125 * HZ / 4. With CONFIG_HZ=250, this results in 3124 instead of
3125 due to integer truncation. The test currently hardcodes 3125,
which fails on kernels built with CONFIG_HZ=250.
Allow a +/- 1 tolerance for the default value check to account for
this rounding, while still catching genuine regressions in the
default value.
Signed-off-by: Jin Li <jinli@lanxincomputing.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261022103023.834927-1-jinli@lanxincomputing.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Check that a skip_hw filter leaves the flags of an action it reuses
unchanged, even when the filter add fails on a later action. Also check
that a filter without skip_hw still cannot reuse a skip_hw action. The
dummy device has no tc offload, so skip_hw stands in for skip_sw.
Signed-off-by: Alexandre Cassen <acassen@corp.free.fr>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20261021193222.1318333-3-acassen@corp.free.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The power_floor and workload_hint Makefiles build nothing when
CROSS_COMPILE is set, even for an x86 target, and they include lib.mk
only on x86. Other architectures therefore have no install or
emit_tests rules for these suites, and their installation fails with a
missing target.
Select the x86 tests from the target ARCH when it is given and from the
host's SUBARCH otherwise, and include lib.mk unconditionally so that the
suites install and emit an empty runlist on other architectures. Use a
private ARCH_PROCESSED instead of the ARCH override added by
commit 5a1292137e89 ("selftests: fix ARCH normalization to handle
command-line argument"): the override changed the value lib.mk uses to
pick the clang target, whereas leaving ARCH unset lets lib.mk use the
compiler's native triple. A command-line ARCH such as x86_64 is still
normalized for the selection, while an ARCH spelling that lib.mk does
not know, such as i686 with LLVM=1, is rejected as in other selftests.
Fixes: 27801542b2b8 ("selftests/thermel/intel: Add test to read workload hint")
Fixes: d4d27e5a1a88 ("selftests/thermel/intel: Add test to read power floor status")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Link: https://patch.msgid.link/20261014200127.1363472-4-sashal@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
|
|
It is also reported by sashiko that there may be leakages of isolated
CPUs when a root partition parent shrinks its effective_xcpus with
isolated partition children. Leakage here means that isolated_cpus may
contain extra CPUs that are not in any isolated partitions and not boot
time isolated. Those CPUs cannot be used in any isolated partitions
anymore.
There are 2 different cases here. The effective_xcpus becomes empty and
the isolated partition should be invalidated in this case. Alternatively
some of its effective_xcpus are not in parent's effective xcpus but
still have some valid effective_xcpus left. The isolated partition can
remain valid. In both cases, the invalid isolated CPUs will have to be
released from isolated_cpus if appropriate.
Fix that by calling isolated_cpus_release() to release those isolated
CPUs from isolated_cpus.
New test cases are added to test_cpuset_prs.sh to test this.
Fixes: 11e5f407b64a ("cgroup/cpuset: Keep track of CPUs in isolated partitions")
Signed-off-by: Waiman Long <longman@redhat.com>
Reviewed-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Tested-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
compute_partition_effective_cpumask()
It is found by sashiko that when a child isolated partition with parent
root partition is invalidated in compute_partition_effective_cpumask(),
the switching of the isolated exclusive CPUs from child to parent will
not be reflected in isolated_cpus leading to CPU leakage. Fix that by
calling isolated_cpus_update() when that happens.
Also simplify compute_partition_effective_cpumask() by doing
child partition invalidation only for the special case of no more
effective_cpus left in a populated parent. The other case doesn't
actually warrant invalidation at this stage and subsequent iteration
in update_cpumasks_hier() and update_parent_effective_cpumask() for
that child should handle that.
Also drop the make_partition_invalid() helper by inlining it into
compute_partition_effective_cpumask() as it is the only caller.
A new test case is add to test_cpuset_prs.sh to verify this.
Fixes: 11e5f407b64a ("cgroup/cpuset: Keep track of CPUs in isolated partitions")
Signed-off-by: Waiman Long <longman@redhat.com>
Reviewed-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Tested-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
update_cpumasks_hier()
Guopeng reports that changing the cpumask of a remote partition root
may set the effective_cpus of the top_cpuset incorrectly. It is
due to the following call sequence:
update_cpumask()
-> partition_cpus_change()
-> remote_cpus_update()
-> update_sibling_cpumasks()
-> update_cpumasks_hier()
-> remote_cpus_update()
The second remote_cpus_update() call passes in the cs->effective_xcpus
instead of the trialcs->effective_xcpus of the first remote_cpus_update()
call. As a result, the second call can revert what has been done in
the first call leading to incorrect effective_cpus of the top_cpuset
as well as subpartitions_cpus.
Fix that by adding a new remote_partition_updating flag into the cpuset
structure to indicate that a remote partition is being updated and
update_cpumasks_hier() should skip the whole subtree as update_cpumask()
or update_exclusive_cpumask() which calls partition_cpus_change()
will eventually calls update_cpumasks_hier() for that subtree anyway.
This new flag is currently set only in remote_cpus_update() to prevent
recursive call of remote_cpus_update() on the same cpuset.
A test case is added to test_cpuset_prs.sh to verify this change.
Reported-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Link: https://lore.kernel.org/lkml/20261010075947.333549-2-guopeng.zhang@linux.dev
Reviewed-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Tested-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Fixes: f62a5d39368e ("cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
test matrix
Commit 989ca25c10ca ("selftests/cgroup: Add tests for nohz_full
housekeeping check") adds a nohz_full test matrix that will only be run
when a nohz_full boot parameter cover all the CPUs beyond CPUs 0-7. The
code looks for the first and last CPU numbers in the nohz_full sysfs
file to determine if that criterion is met. However if there are holes in
the range (i.e. has ",") the test matrix may be incorrectly run leading
to unexpected test failure. Fix that by skipping "," and anything after
that to make sure the first range will cover all the remaining CPUs.
Reviewed-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Tested-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
With the introduction of cpuset.cpus.exclusive, the computation of
effective_cpus differs depending on if a cpuset is a valid partition
root or not.
In update_cpumasks_hier(), effective_cpus is computed early
to check if the current subtree can be skipped. Later on
update_parent_effective_cpumask() may be called which can change the
partition state from valid to invalid or vice versa. If the partition
state changes, the previously computed effective_cpus may no longer be
valid. Fix that by recomputing effective_cpus again when that happens.
Also add a new test case into test_cpuset_prs.sh to verify this change.
Fixes: e2ffe502ba45 ("cgroup/cpuset: Add cpuset.cpus.exclusive for v2")
Signed-off-by: Waiman Long <longman@redhat.com>
Reviewed-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
update_parent_effective_cpumask()
Since the introduction of cpuset.cpus.exclusive in commit
e2ffe502ba45 ("cgroup/cpuset: Add cpuset.cpus.exclusive for v2"), a
compute_effective_exclusive_cpumask() helper which is later renamed to
compute_excpus() is added to compute the effective xcpus of a partition
root. However update_parent_effective_cpumask() is not updated in all
proper places to use the new helper to check if a given cpuset should
remain a valid partition root. This can cause a cpuset to incorrectly
remain a valid partition root even if no effective xcpus is left.
Fix that problem by using compute_excpus() to compute the effective xcpus
into delmask in all cases except partcmd_disable, partcmd_invalidate
or partcmd_update with newmask set and use it for tasks_nocpu_error()
check as well as checking its emptiness. This enables us to catch invalid
partition root more accurately in update_parent_effective_cpumask().
In the case of partcmd_update with newmask set, the passed in new
effective xcpus value will directly be used in the tasks_nocpu_error()
check without relying on old data in the cpuset.
For the partcmd_update with NULL newmask case, the cpu exclusivity test
there is also relaxed to be performed only if exclusive_cpus is empty.
Some test case are added to test_cpuset_prs.sh for invalidating a
partition root due to its effective xcpus becoming empty as well as
making sure that an invalid partition can only be revived when exclusive
CPUs are available agin.
Fixes: e2ffe502ba45 ("cgroup/cpuset: Add cpuset.cpus.exclusive for v2")
Signed-off-by: Waiman Long <longman@redhat.com>
Reviewed-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Tested-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
Pull CXL updates from Dave Jiang:
"The headline item is the first part of support for Dynamic Capacity
Devices (DCD). It covers flagging DCD support in the mailbox, reading
the dynamic capacity configuration from the device, gathering DSMAS
data for the DCD partitions, and configuring the dynamic capacity
interrupts. It also adds a documentation update and a cleanup that
enforces partition ordering. DCD is not enabled yet with these code
changes. Patches are applied to reduce the whole set in order to
relief the burden of very large patch set review.
Zero sized HDM decoders are now allowed, along with cxl_test support
for them. There is also a set of decoder hardening patches for switch
decoder enumeration. Latency calculations now account for link width
and use consistent units. The GPF timeout programming has been
reworked. The pull also has a number of misc patches.
A large number of bug fixes against pre-existing issues make up the
rest of the pull. Many of these were flagged by review of patches
posted to the mailing list by sashiko.
Also adding Richard Cheng as a reviewer (R) to the CXL sub-system"
* tag 'cxl-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (49 commits)
cxl/events: Test CME counter expiry with equality, not bitwise AND
Documentation/cxl: Document DPA partition layout and ordering rules
cxl/core: Enforce partition order/simplify partition calls
cxl/mem: Configure dynamic capacity interrupts
cxl/pci: Factor out interrupt policy check
cxl/events: Split event msgnum configuration from irq setup
cxl/cdat: Gather DSMAS data for DCD partitions
cxl/mem: Read dynamic capacity configuration from the device
cxl/mbox: Flag support for Dynamic Capacity Devices (DCD)
cxl/acpi: Convert QTG _DSM latencies to picoseconds
cxl: Account for link width in latency calculation
cxl/port: Convert PCIe link latency to nanoseconds
cxl/pci: Update only the Port GPF timeout fields
cxl/pci: Program the Port GPF timeouts before caching the DVSEC
cxl/pci: Use the Device GPF DVSEC for restricted endpoints
cxl/port: Attach endpoints to a dport under the lock that pins it
cxl/core: Hold the dport host lock across dport lookup and use
cxl/port: Clear cached dport pointers when a dport is removed
cxl/region: Warn on user region position mismatch
cxl/acpi: Check ACPI companion before use
...
|
|
Check that a GICv3 ITS and a GICv5 VGIC cannot be paired, regardless
of which device is created first. Skip the check when the host does not
expose a GICv3 ITS.
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261020163923.1407856-3-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
|
|
test_idreg_frozen_after_failed_run() checks that changing a feature ID
register after a failed first KVM_RUN is rejected with -EBUSY, and does
so for every field of every register in test_regs.
On a host without AArch32 support at EL0, KVM treats the AArch32 ID
registers as RAZ/WI: aa32_id_visibility() returns REG_RAZ | REG_USER_WI,
and kvm_sys_reg_set_user() ignores the write and returns 0 before
set_id_reg() checks whether the ID registers are final. The test then
fails on the first such register:
arm64/set_id_regs.c:870: r < 0 && errno == EBUSY
ID_DFR0_EL1_PerfMon write after failed first run: r=0 errno=16
KernelCI hits this on every run on an AArch64 only GB300 host.
Only a field that userspace can change can be frozen, and KVM reports
these registers as not writable in KVM_ARM_GET_REG_WRITABLE_MASKS. Skip
the fields that the writable mask does not cover. test_vm_ftr_id_regs()
already requires the mask to cover every other field in test_regs, so
this only drops the fields KVM never lets userspace change. Whether KVM
accepts writes to fields it reports as not writable is a separate
question from finalization.
Fixes: 00e309933879 ("KVM: arm64: selftests: Check ID regs are immutable after a failed run")
Link: https://d.kernelci.org/test/maestro:6adcad0c55fda50760800a00
Signed-off-by: Sasha Levin <sashal@kernel.org>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261026012128.2270251-1-sashal@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
|
|
Exercise the path where a static seven-argument subprogram has unreliable
BTF and is called through a bridge with only one initialized outgoing stack
argument. The callee expects two stack arguments, but the unreliable-BTF
path skips check_outgoing_stack_args(). Expect the verifier to reject the
second r11 load at offset 16.
Also exercise synchronous and asynchronous callbacks whose BTF prototypes
declare a sixth argument. Initialize the outgoing slot at each helper call
site so the programs reach the callback-specific rejection. Keep a valid
six-argument direct call in each program so bpf_fixup_call_args() records
the stack-argument requirement and cannot become an unrelated rejection
fallback.
The fix also rejects the existing uninitialized-stack-argument test before
the later unreadable-register check. Update that test's expected diagnostic
accordingly.
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026015250.1674676-2-bestswngs@gmail.com
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux
Pull liveupdate updates from Mike Rapoport:
- Several small fixes to KHO and LiveUpdate selftest
- A series that renames "KHO scratch" to "KHO bootmem" because this
memory is way more important in kexec'ed kernels rather than in the
original cold boot kernel and the new name reflects it
* tag 'liveupdate-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:
kho: do not reserve empty per-node bootmem areas
selftests/liveupdate: Prefer KVM and HVF over TCG in vmtest.sh
kho: rename kho_scratch= commandline parameter to kho_bootmem=
kho: rename KHO scratch to KHO bootmem
memblock: rename KHO_SCRATCH to KHO_NOPRSRV
memblock: get rid of CONFIG_MEMBLOCK_KHO_SCRATCH
kho: docs: fix scratch_phys debugfs cross-reference
kho: do not reserve scratch memory in the kdump kernel
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mm/memblock
Pull memblock updates from Mike Rapoport:
"Performance improvement:
- Use binary search in memblock_add_range() and
memblock_isolate_range()
Cleanups:
- Several simplifications in memblock and mm_init that remove
redundant code
- After rework of sparsemem buffer preallocation, memmap_alloc() does
not require exact_nid parameter. Remove that parameter, drop now
unused memblock_alloc_exact_nid_raw() and adjust memblock tests
accordingly
memblock test updates:
- add coverage for lowmem allocations
- fix 32-bit build warnings"
* tag 'memblock-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/memblock:
memblock: use binary search to locate candidate regions
memblock: drop for_each_memblock_type() and open code its users
memblock: Remove unused memblock_alloc_exact_nid_raw()
memblock tests: Move exact nid tests to memblock_alloc_range_nid()
mm: Remove unused exact_nid parameter from memmap_alloc()
memblock: initialize the region merge end index
tools: use __pa() in virt_to_phys()
memblock tests: zero-extend simulated memory addresses
memblock tests: use physical addresses for region removal
memblock: reject non-page-aligned reserve_mem regions
memblock tests: cover allocations below the low address limit
memblock tests: model the low allocation limit within dummy memory
mm/mm_init: remove zone_absent_pages_in_node()
memblock: remove conditional return with no effect
memblock: simplify reset_all_zones_managed_pages()
|
|
Pull nfsd updates from Chuck Lever:
"Jeff Layton extended the netlink listener-set operation so that
a management daemon can register NFSD's programs with rpcbind
itself. This prevents an unresponsive rpcbind from stalling NFSD
administration for a minute at a time.
Bulk delegation recall now adjusts the number of delegations it
wants returned, based on memory pressure. The previous mechanism
was spec-conformant, but it requested all delegations to be
returned at once. Clients are free to return few or none in such
cases, but requesting smaller batches of delegations is more
neighborly.
In preparation for handling TLS KeyUpdate, the server's TCP
receive path has been reworked to handle control records. In the
process, the use of sock_recvmsg was replaced with ->read_sock,
which contends less with other holders of the socket lock.
NFSv2 XDR code is now generated by xdrgen, which mechanically
generates the encoders and decoders from the RPC language
specification for the protocol. Replacing hand-built XDR code
makes prototyping new protocol elements faster, reduces errors,
and improves memory safety. Replacement of XDR code for newer NFS
versions will continue in subsequent releases of NFSD.
The remaining bulk of changes in v7.4 is bug fixes, clean-ups, and
small optimizations. Sincere thanks to all contributors,
reviewers, testers, and bug reporters who participated in the v7.4
NFSD development cycle"
* tag 'nfsd-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (184 commits)
SUNRPC: use assign_bit() where applicable
nfsd: Fix id-to-name cache entry leak in idtoname_parse()
NFSD: Use xdrgen XDR functions for NFSv2 READDIR results
NFSD: Refactor NFSv2 directory cookie encoding
NFSD: Add a streaming directory reader
NFSD: Use xdrgen XDR functions for NFSv2 READDIR arguments
NFSD: Use xdrgen XDR functions for the NFSv2 STATFS procedure
NFSD: Use xdrgen XDR functions for NFSv2 RMDIR procedure
NFSD: Use xdrgen XDR functions for NFSv2 MKDIR procedure
NFSD: Use xdrgen XDR functions for NFSv2 SYMLINK procedure
NFSD: Use xdrgen XDR functions for the NFSv2 LINK procedure
NFSD: Use xdrgen XDR functions for the NFSv2 RENAME procedure
NFSD: Use xdrgen XDR functions for the NFSv2 REMOVE procedure
NFSD: Use xdrgen XDR functions for NFSv2 CREATE procedure
NFSD: Refactor nfsd_proc_create()
NFSD: Use xdrgen XDR functions for NFSv2 WRITE procedure
NFSD: Use xdrgen XDR functions for the NFSv2 WRITECACHE procedure
NFSD: Use xdrgen XDR functions for NFSv2 READ procedure
NFSD: Use xdrgen XDR functions for NFSv2 READLINK procedure
NFSD: Use xdrgen XDR functions for the NFSv2 LOOKUP procedure
...
|
|
timer_gettime() must report a zero it_value for a disarmed timer. For
SIGEV_NONE timers, common_timer_get() reported the remaining time of the
previous arming instead.
Add check_sigev_none_disarm(). It arms a SIGEV_NONE oneshot timer, checks
that a remaining time is reported, disarms the timer and checks that
it_value is zero. Run it for CLOCK_MONOTONIC and CLOCK_PROCESS_CPUTIME_ID,
as CPU timers use a separate implementation.
Without the preceding fix, the CLOCK_MONOTONIC case fails.
Signed-off-by: Hung-Jui Lin <alex.lin.programmer@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20261023151411.28685-2-alex.lin.programmer@gmail.com
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound updates from Takashi Iwai:
"The AI flood continues, which brought us a fairly busy development
cycle again with changes spread across the subsystem, ranging from
(lots of) core hardening to new platforms and codecs.
Here are some highlights.
ALSA core:
- PCM: race fixes around channel-map controls, draining/unlink, drop
sync-stop handling, and DMA buffer delay sync
- Compress-offload: state and geometry validations, buffer leak fix,
and stream/card lifetime management
- Jack: module pinning during debugfs access, control removal race
fix, and early injection exposure
- Timer & sequencer: module pinning for user timers, RCU grace period
wait on port deletion, UMP bounds fixes
- Mark OSS sequencer emulation as deprecated
- RawMIDI: proper disconnect handling and input work drain cleanup
- Control: fixes for vmaster racy setups and control callback
serialization, UAF fix on card disconnect
ASoC core:
- Continued framework refactoring, deployment of
auto_selectable_formats across codecs and platform DAIs
- Generic card cleanup: free jack GPIOs on card remove for
simple-card and audio-graph-card variants
- SDCA improvements: SimpleJack function type support, library
helpers, and non-ACPI build support
- Conversion of deprecated DMA API calls
ASoC SOF:
- Support for compressed audio playback on SOF IPC4 with Intel TGL+
- AMD ACP 7.B / 7.F SoundWire and PDM controller support, ASP
carveout firmware loading
- Function topology support for Intel I2S machines
ASoC platforms & codecs:
- Qualcomm: New QAIF driver for Shikra platform, WCD9378 SDCA codec,
Nord Ride/RRD and Motorola Edge 30 boards, LPASS macro cache
converted to maple tree
- New codec drivers: ESS ES9039Q2M, Nuvoton NAU83G60 amplifier,
Senary SN624x SoundWire SDCA codec
- MediaTek / Airoha: New Airoha AN7581 AFE and WM8960 machine
drivers, extensive clock and error-handling cleanups across
MediaTek SoCs
- NVIDIA Tegra: WM8994 machine driver and CS35L45 MDSYNC support
- Realtek: RT766/RT767, RT721_U, RT718 variants, RT712 GPIO LED
control
- Cirrus Logic: CS35L45 MDSYNC support, CS35L56 regmap default tests
- TI: TAS2573 DSP support in TAS2781, TAS2783 SoundWire fixes
- Everest Semi: ES8326 standby / HPF controls, ES8389 / ES8375 resume
fixes
- Removal of obsolete ST-Ericsson Ux500 MOP500 machine driver
HD-audio:
- ACPI controller runtime PM suspend/resume support
- Controller shutdown and unbind race fixes for unsol events and jack
polling
- HDMI: High Bit Rate (HBR) audio capability enabled, ELD proc and
converter bounds checks
- AW88399 side codec SSID-specific firmware naming and Lenovo Legion
R9000P enablement
- Realtek / Conexant / Cirrus / TI quirks for numerous laptops
(Lenovo, ASUS, HP, Acer, HONOR, Minisforum, MSI, etc.)
- Creative CA0132 Sound BlasterX AE-5 external RGB LED strip support
USB-audio:
- Dedicated mixer driver for Audient EVO4
- Native Instruments Kore controller LCD support and keymap fix
- Pioneer DJ DDJ-SZ and Roland (OCTA-CAPTURE / QUAD-CAPTURE
multirate, TD-11) support
- UAC2/3 mixer unit matrix evaluation and bounds checking
- Hardening for LINE6 and caiaq drivers against malformed packets and
races
- Device-specific quirks for PreSonus, TASCAM, Logitech, Mayflower,
MOONDROP, Yamaha, etc.
Misc:
- Auto-cleanup conversion for snd_card_free() and devres migration
across dozens of legacy PCI, ISA, and Sparc drivers
- ALSA loopback (aloop) timer lifecycle fixes and new aloop selftest
- pcmtest driver fixes and kselftest updates"
* tag 'sound-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (924 commits)
ALSA: hda/realtek: Add mute and mic-mute LEDs for HP ENVY 16 (103c:8be5)
selftests: ALSA: pcmtest: Compare all captured bytes in ni_capture
ALSA: usb-audio: Use strscpy() in append_ctl_name()
ALSA: caiaq: Use strscpy() in snd_usb_caiaq_input_init()
ALSA: hiface: Use scnprintf() in hiface_chip_create()
selftests/alsa: Check the aloop PCM Slave controls for a matching playback
ALSA: aloop: Update the PCM Slave controls for a matching playback
selftests: ALSA: pcmtest: Make room for the longest fill pattern
selftests: ALSA: pcmtest: Check the frame count of each transfer
ALSA: hda/realtek: Fix speakers on COLORFUL L1 Plus
ALSA: hda/realtek: enable AW88399 on Lenovo Legion R9000P AFR10
ALSA: line6: Handle period elapsed calls outside the locks
ALSA: emux: Stop voices before freeing zones in all cases
ALSA: emux: Fix UAF of soundfont zones at note-on
ALSA: mtpav: restore negation dropped in guard() conversion
ALSA: compress: reject restarting an ACTIVE task via origin_seqno
ALSA: compress: add missing OPEN-state gate to SET_METADATA
ALSA: compress: reject buffer geometry change on gapless next_track
ALSA: compress: fix buffer leak on failed SET_PARAMS
ALSA: hda/realtek: Enable jack detection on Minisforum AI X1
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull Char/Misc/IIO/others driver updates from Greg KH:
"Here is the big set of char/misc/android/iio and other small driver
subsystem patches for 7.4-rc1. Loads of stuff in here, larger than
normal. Highlights include:
- removal of the C binder code, the rust version is stable and will
be used going forward in a few billion devices. Great job by those
developers
- loads and loads of IIO driver updates and feature additions
- speakup driver fixes and updates
- mhi driver updates
- mei driver updates
- xillybus driver fixes
- comedi driver fixes
- lots of coresight driver updates
- Interconnect driver updates
- nvmem driver updates and fixes
- slimbus driver updates and fixes
- spmi driver updates and fixes
- lots of tiny misc and char driver fixes based on people scanning
for things
All of these have been in linux-next for a while with no reported
issues, other than a merge conflict with one of the rust tree files,
which should be simple to resolve"
* tag 'char-misc-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (446 commits)
rust_binder: wake epoll on self-work queued to poll thread
rust_binder: avoid overflow in get_node_debug_info()
MAINTAINERS: Add Abel as SPMI co-maintainer
spmi: mtk-pmif: Fix clock reference leak in mtk_spmi_bus_probe()
iio: adc: qcom-spmi-iadc: Remove regmap R/W wrapper functions
iio: adc: qcom-spmi-iadc: Migrate to devm_spmi_subdevice_alloc_and_add()
misc: qcom-coincell: Migrate to devm_spmi_subdevice_alloc_and_add()
phy: qualcomm: eusb2-repeater: Migrate to devm_spmi_subdevice_alloc_and_add()
power: reset: qcom-pon: Migrate to devm_spmi_subdevice_alloc_and_add()
nvmem: qcom-spmi-sdam: Migrate to devm_spmi_subdevice_alloc_and_add()
spmi: Add helper to get a parent SPMI device
spmi: Implement spmi_subdevice_alloc_and_add() and devm variant
spmi: Remove unneeded goto in spmi_device_add() error path
spmi: Print error status with %pe format
spmi: Remove redundant dev_name() print in spmi_device_add()
spmi: Fix potential use-after-free by grabbing of_node reference
spmi: mtk-pmif: Add workaround for FSM lockup/error in read operation
MAINTAINERS: Add Qualcomm SPMI controller entry
spmi: pmic-arb: return 0 in spmi_pmic_arb_register_buses() on success
comedi: addi_apci_3xxx: fix subdevice count underallocation
...
|
|
Exercise borrowed VMA results before and after iterator advancement
and destruction, including NULL next, trusted fields, and a FILE
dynptr that must be discarded before advancing. Keep positive controls
for using the current element and discarding the dynptr first.
Use a test-module iterator returning current to verify the explicit
independent-lifetime exception. Retain controls for RCU-protected
results. Also check the generic trusted-field rule outside iterators:
reading file->f_inode while holding an acquired file reference succeeds,
but using the saved inode pointer after bpf_put_file() is rejected.
The annotated programs check verifier loading and diagnostics; they do
not request runtime execution of the added programs.
Signed-off-by: Xu Yunxiang <xyx2021@mail.ustc.edu.cn>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Link: https://patch.msgid.link/20261024100647.2579244-3-xyx2021@mail.ustc.edu.cn
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block updates from Jens Axboe:
- NVMe updates via Keith:
- Apple M4 (t8132) ANS2 NVMe support
- nvme-multipath sysfs attributes for path_state, iopolicies, and
fail_on_ctrl_loss, plus path state evaluation fixes
- nvme-tcp parallelized I/O queue allocation and startup, and using
the caller's network namespace
- nvmet passthru UAF fix and rework, PR preempt use-after-free
fixes, auth hardening, and traffic based keep alive support
- DH-HMAC-CHAP secret attributes readable by root only
- Various other fixes and cleanups
- swim driver overhaul and fixes, plus floppy fixes, via a pull from
Denis
- Block device buffered and direct I/O rework from Tal: use
iomap_dirty_folio, take i_rwsem for the write fallback and splice
read, honor IOCB_NOWAIT in the buffered read path, and reject atomic
write fallback to buffered I/O
- Large zone revalidation rework: serialize revalidation, handle
capacity changes by dropping and retrying zone write plugs, propagate
read-only and offline conditions, and treat offline and read-only
zones as dead
- ublk robustness work around canceled FETCH rounds and going live over
canceled io commands, dropping the default I/O scheduler, and a batch
of selftest additions
- blk-iocost flush cost support and zone append accounting
- rust block fixes for Send/Sync bounds on GenDisk and TagSet, and
import style cleanups
- Atomic write fixes capping size by the PI buffer constraints and
failing short atomic pins
- Skip the redundant flush for O_DSYNC direct writes, and only use
REQ_FUA when the device supports it
- Store GPT attributes as a raw value
- Remove support for swapping loop fds
- Various other fixes and cleanups all over
* tag 'for-7.4/block-20261021' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (144 commits)
block: restore the iterator when rejecting a misaligned bio
blk-mq: clear stale inactive flag on hctx reuse
block, bfq: initialize active lists for all actuators
zloop: print device that had errors
ublk: pin module while release work is pending
blk-mq: drop the tag_set argument from blk_mq_free_rq_map/tags
blk-mq: share one tags_srcu instance across all tag sets
blk-iocost: fix stale comment in ioc_rqos_throttle()
blk-iocost: account zone append completions in latency stats
blk-iocost: charge zone appends as writes
blk-iocost: add flush cost support with the flushiops model parameter
ublk: use global index for reported zones
selftests: ublk: add test for going live over canceled io commands
selftests: ublk: stop a batch thread when PREP_IO_CMDS fails
selftests: ublk: move the control command helpers into ctrl.c
ublk: refuse to go live after an io command was canceled
ublk: let STOP_DEV cancel the server's commands before its release
ublk: allow a NULL io->cmd in the cancel callback
ublk: reset the FETCH round under ub->mutex
ublk: reset the FETCH round in release also without a disk
...
|
|
Userfaultfd often causes unexpected interactions within mm, and does so at
the intersection of uffd, mremap() and VMA merging.
When an mremap of a VMA occurs, copy_vma_and_data() calls
mremap_userfaultfd_prep() to notify uffd of this.
However, mremap_userfaultfd_prep() simply drops the UFFD context for the
VMA if the user did not register it for remap, i.e. didn't specify the
UFFD_FEATURE_EVENT_REMAP flag.
This is OK for the VMA itself, as upon page table move, move_ptes() clears
UFFD page table flags, using vma_has_uffd_without_event_remap() to
determine whether to do so.
However, this doesn't account for merging with adjacent VMAs, whose page
tables won't have received this treatment, and thus latent UFFD markers
will be left around.
Worse, it'll break UFFD for any VMAs it is merged with. This is very
surprising behaviour for a user, who will then simply not receive UFFD
events for VMAs they ought to.
Resolve the issue by explicitly checking for this case via
vma_has_uffd_without_event_remap() in vma_merge_copied_range(), the merge
function explicitly designated for mremap() operations.
Also update the userland VMA tests accordingly.
Link: https://lore.kernel.org/20261020-uffd-remap-fix-v1-1-0f34fc181f0a@kernel.org
Fixes: 3cfd22be0ad6 ("userfaultfd: clear flag if remap event not enabled")
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: shaos <shawnq1@163.com>
Closes: https://lore.kernel.org/all/20261020110748.959870-1-shawnq1@163.com/
Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Reviewed-by: Xueyuan Chen <xueyuan.chen21@gmail.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: <stable@vger.kernel.org>
|
|
posix_memalign() returns zero or a positive error number and never sets
errno, so the checks for a negative return in kmem_cache_alloc_lru() and
kmem_cache_alloc_bulk() is not possible. A failed aligned allocation
carries on with the pointer unset, into the constructor or the memset().
Test for any non-zero return.
Link: https://lore.kernel.org/20261020033128.1934349-1-liam@infradead.org
Fixes: 8801c35c3672 ("tools: fix -Wunused-result in linux.c")
Signed-off-by: Liam R. Howlett (Google) <liam@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Reviewed-by: Vishal Moola (Fractile) <vishal.moola@gmail.com>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
|
|
With -cgroup-v2, charge_reserved_hugetlb.sh and
hugetlb_reparenting_test.sh mount a cgroup2 hierarchy on a temporary
directory when none is mounted and enable the hugetlb controller
(hugetlb_reparenting_test.sh also enables memory) in its
cgroup.subtree_control.
On a system that still binds these controllers to cgroup v1, they are not
available in the new hierarchy. Writing to cgroup.subtree_control fails
with ENOENT, "set -e" aborts the script, the test is reported as failed,
and the temporary cgroup2 mount is left behind.
Check cgroup.controllers first, and skip the test when a controller is
missing, after unmounting the hierarchy and removing the directory the
script created.
With hugetlb and memory bound to cgroup v1, per script:
before after
result fail skip
cgroup2 mounts left behind 1 0
Link: https://lore.kernel.org/20261016-bug-selftests-mm-hugetlb-cgroup2-skip-v1-1-7c78883a67b4@gmail.com
Fixes: 29750f71a9b4 ("hugetlb_cgroup: add hugetlb_cgroup reservation tests")
Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
|
|
So far the assumption has been that mm->mm_lock_seq overflow is benign,
resulting only in readers spuriously falling back to the mmap lock, however
it turns out that this was an unsafe assumption.
If a VMA can be spuriously considered write locked that means read lock
exclusion does not take place, and thus a VMA can end up write-locked with
concurrent readers.
Since overflow only occurs every 2^31 write lock/unlock cycles, resolve the
issue by resetting every VMA's vma->vm_lock_seq each time such an overflow
occurs.
This is done in vma_end_write_all(), which is called when the mmap write
lock is released, i.e. in mmap_write_unlock() and mmap_write_downgrade().
Care must be taken, as resetting the sequence count at overflow means
changing the seqcount of VMAs which are already attached and observable.
The mm's seqcount is guaranteed to be odd when a write lock is held, and
thus any write locked VMA will have an odd seqcount assigned.
Therefore resetting to an even value prevents spurious write locks, since
these can only occur with the mmap write lock held, at which point the mmap
seqcount will be odd.
However, vma_start_read() also checks vma->vm_lock_seq == mm->mm_lock_seq,
bailing if so (indicating a write lock).
This would cause any even reset value chosen to prevent VMA read locks from
being taken - avoid this by also checking whether the VMA seqcount is odd
before bailing on the read lock.
So far, vma->vm_lock_seq has defaulted to UINT_MAX, but this has been
unnecessary since commit e5e7fb278e59 ("mm: convert mm_lock_seq to a proper
seqcount"), since this is assigned when the VMA is still detached, and
cannot be observed.
Therefore perform both reset and initialisation of vma->vm_lock_seq by
simply setting vma->vm_lock_seq to zero.
The reset, performed in __mm_reset_vma_seqcounts(), only needs to
WRITE_ONCE() the value.
However the read of vma->vm_lock_seq in vma_start_read() needs to have
acquire semantics to pair with the smp_wmb() in do_raw_write_seqcount_end()
so a reader reading a reset value also observes VMA modifications made
under the write lock.
Since all VMA write locks were just released and the mmap write lock is
still held, there are no concurrent VMA writers.
Concurrent VMA readers are unaffected. New VMA readers observe either zero,
never a write lock, or the prior seqcount, behaving as before the reset.
Since this only occurs every 2^31 write lock/unlock cycles, the time taken
to update all VMAs is considered to be acceptable.
Also update comments, documentation and VMA userland tests to reflect the
change.
User facing effects are - dangerous races that could cause memory
corruption or NULL pointer derefences (especially on page table traversal)
are avoided.
Link: https://lore.kernel.org/20261016-fix-vma-lock-overflow-v2-1-9eb778b79b58@kernel.org
Fixes: 5e31275cc997 ("mm: add per-VMA lock and helper functions to control it")
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Daehyeon Ko <4ncienth@gmail.com>
Closes: https://lore.kernel.org/all/20261015143735.1630957-1-4ncienth@gmail.com/
Reviewed-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Tested-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: <stable@vger.kernel.org> # 7.3.x
|
|
The mm Makefile includes local_config.mk, which is generated by a rule
that announces itself with "CHK [config] local_config.mk" on standard
output, which make -s does not suppress. When make has to regenerate the
file while it reads the Makefile for emit_tests, for example on a fresh
tree or when the selftests are installed with make -B, the message
becomes part of the emit_tests output that the selftests install target
appends to kselftest-list.txt, so the runlist gains a line that is not a
test.
Print the message on standard error. With V=1 the message is empty and
only the redirection of an empty command remains.
Link: https://lore.kernel.org/20261014200137.1364121-1-sashal@kernel.org
Fixes: 04cf82a741e0 ("selftests/mm: suppress compiler error in liburing check")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Li Wang <li.wang@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Shuah Khan <shuah@kernel.org>
|
|
remap_region() checks that the destination region is free before mapping
it, but not the preamble region placed right before it, so mapping the
preamble can intermittently fail with EEXIST:
# Failed to map dest preamble region: File exists
not ok 15 5MB mremap - Source 1MB-aligned, Dest 1MB-aligned with 40MB Preamble
This happens when the kernel's heap ASLR (arch_randomize_brk()) lands the
process heap inside that unchecked range. Confirmed by correlating
brk(NULL) at startup with pass/fail across 60 runs: every failure had brk
land inside that range.
Fix it by including the preamble in the free-region check.
Link: https://lore.kernel.org/20261014-selftests-mm-mremap_preamble-v1-1-2e97f501cb56@marliere.net
Signed-off-by: Ricardo B. Marlière (SUSE) <ricardo@marliere.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Sarthak Sharma <sarthak.sharma@arm.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Shuah Khan <shuah@kernel.org>
|
|
uffd_move_pmd_test()/uffd_move_test_common() splits the test area into
chunks of chunk_size and moves them one by one. On arm64 with 64K base
pages the chunk_size (read_pmd_pagesize()) is 512MB, which is larger than
the whole 32MB (UFFD_TEST_MEM_SIZE) test area:
step_count = nr_pages / (chunk_size / page_size) == 0
Because chunk_size > page_size, the test then aligns both areas up to
512MB, which points far outside of the 32MB mappings, and decrements
step_count, which underflows to ULONG_MAX. The verification loop then
runs away and the first dereference of area_src faults with a SIGSEGV.
Skip the test when a single chunk cannot fit into the test area.
Link: https://lore.kernel.org/20261011163527.95988-1-zenghui.yu@linux.dev
Fixes: a2bf6a9ca805 ("selftests/mm: add UFFDIO_MOVE ioctl test")
Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Tested-by: Sarthak Sharma <sarthak.sharma@arm.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Peter Xu <peterx@redhat.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
|
|
MREMAP_DONTUNMAP keeps the source VMA in place, but clears its mlock flags
while setting them on the destination VMA. The "mm/mremap: fix two issues
with MREMAP_DONTUNMAP" series fixed two cases where this leaked
mm->locked_vm:
- an unfaulted mlock-on-fault VMA moved behind itself self-merges, so the
single resulting VMA loses the flags without the accounting being
dropped;
- a partial mremap() moves only part of the range, leaving the pages which
are not moved accounted as locked in a VMA whose flags were cleared.
Add a test which mlock2()s a source mapping, moves all or part of it with
MREMAP_DONTUNMAP, unmaps everything and checks that VmLck is back to its
value from before, and run it for the self-merge case and for a partial
move with and without MLOCK_ONFAULT.
Verified on x86_64: the three cases fail on mm-unstable with the two fixes
reverted and pass with them applied.
Link: https://lore.kernel.org/20261006064120.6796-1-azpijr@gmail.com
Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
|
|
Introduce a kselftest utility to validate memory mapping capabilities
under nommu kernels, aligned with
Documentation/admin-guide/mm/nommu-mmap.rst.
The test implements basic checks into a generic architecture-agnostic
test matrix applicable across nommu targets. It evaluates:
1. MAP_FIXED allocation rejections.
2. Standard MAP_PRIVATE and MAP_ANONYMOUS allocation resilience.
3. Regular file mappings via standard filesystem storage.
4. Block device subsystem mappings (gracefully skipping if node is
missing).
5. Shared vs Private backing discrepancies under nommu conditions.
6. mremap limits, ensuring non-expandable restrictions behave properly.
Link: https://lore.kernel.org/20261006085642.3852152-3-thehajime@gmail.com
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260825015945.141739-1-thehajime@gmail.com
Assisted-by: Gemini:Pro [AI_Reviewer] [Sashiko_Linter]
Assisted-by: cubic.dev:unspecified
Cc: David Hildenbrand <david@kernel.org>
Cc: "Liam R. Howlett" <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Ricardo B . Marlière <rbm@suse.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: Hangbin Liu <liuhangbin@gmail.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Kees Cook <kees@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Daniel Palmer <daniel@thingy.jp>
|
|
Patch series "support kselftest on nommu platform", v5.
This patchset adds an ability to execute kselftest on nommu platforms.
Currently there are several issues if we wish to run kselftests on nommu
targets:
- it cannot compile/build test binaries because the current files mainly
assume to build with glibc,
- some of the tests are not able to run on nommu targets as there are no
fork(2) syscall.
The first issue can be avoided if we can build static PIE binaries (if
targets support it), but in our case (build on ubuntu/glibc and run on
alpine/musl-libc), it fails to invoke due to lack of the GNU ifunc
mechanism. Thus, we need to cross-compile with musl toolchain, which
needs to be solved the first issue.
The second issue is the lack of fork(2) syscall on those platforms.
Especially the test harness helper (kselftest_harness.h) uses the
syscall, which cannot be simply with vfork(2). `timeout` command used
in `runner.sh` never works for nommu platform as it uses fork(2).
nommu component in the mm subsystem has several known issues and having
test cases should help this situation, thus this patchset is very first
step toward enriching test environment which has not been well tested
for a while. The test cases is implemented based on the document
(Documentation/admin-guide/mm/nommu-mmap.rst).
Initial shape for this patches is implemented as an opt-in TARGET, not
built/invoked automatically if users don't specify this nommu target.
This patch (of 2):
Architectures lacking MMU don't support fork(2) syscall and only vfork(2)
is available with limitations. Thus, we cannot run kselftest on nommu
architecture as is.
This commit addresses this issue with the following changes:
- Detect NOMMU at runtime from the MmapCopy field in /proc/meminfo
and avoid timeout, which requires fork(2).
- Document how to build and run the NOMMU tests, including the procfs
prerequisite for runtime detection.
Build and run the tests with:
$ make ARCH=um O=build kselftest-all TARGETS=nommu
$ make ARCH=um O=build kselftest-install TARGETS=nommu
$ ./build/kselftest/kselftest_install/run_kselftest.sh -p -c nommu
Link: https://lore.kernel.org/20261006085642.3852152-1-thehajime@gmail.com
Link: https://lore.kernel.org/20261006085642.3852152-2-thehajime@gmail.com
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Closes: https://sashiko.dev/#/patchset/20260813063401.1786548-1-thehajime%40gmail.com
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Kees Cook <kees@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Will Drewry <wad@chromium.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: Hangbin Liu <liuhangbin@gmail.com>
Cc: "Ricardo B. Marliere" <rbm@suse.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Daniel Palmer <daniel@thingy.jp>
|
|
Every test is expected to reserve the HugeTLB pages it needs.
hugetlb-read-hwpoison was not converted, so on a system without
pre-reserved huge pages the MAP_POPULATE mmap() fails with ENOMEM and
every test case is skipped.
Reserve the pages with hugetlb_setup_default(). Each chunk size runs two
HWPOISON tests and a poisoned huge page can't be reused, so reserve two
pages per chunk size. The pool size is restored on exit. The poisoned
pages remain allocated until reboot.
With the patch, all 12 cases pass on a system with no huge pages
reserved (tested on Fedora, x86_64, CONFIG_MEMORY_FAILURE=y).
Link: https://lore.kernel.org/20261004205458.119608-1-jaeyeon.lee.dev@gmail.com
Signed-off-by: Jaeyeon Lee <jaeyeon.lee.dev@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Sarthak Sharma <sarthak.sharma@arm.com>
Reviewed-by: Sarthak Sharma <sarthak.sharma@arm.com>
Assisted-by: LLM
Cc: David Hildenbrand <david@kernel.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
|
|
mrelease_test doubles the child allocation when process_mrelease() returns
ESRCH.
When size is already MAX_SIZE_MB, the current <= check still allows
another retry, causing the allocation to grow from 1024 MB to 2048 MB.
Use < instead of <= so the largest allocation attempted remains
MAX_SIZE_MB.
LLM used in discovering bug. Changes were made and reviewed manually.
Link: https://lore.kernel.org/CANOyQmFzsssM_BXHUDrV+UuVD5SZMBmSkg3UQnmw9Ns1PV7GCQ@mail.gmail.com
Fixes: 33776141b812 ("selftests: vm: add process_mrelease tests")
Signed-off-by: Aveline Noir <jm5905938@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Reviewed-by: SJ Park <sj@kernel.org>
Assisted-by: LLM
Cc: Shuah Khan <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Muhammad Usama Anjum <usama.anjum@arm.com>
|
|
When updating a VMA, vma_prepare() unconditionally removes it from its
rmap interval trees under the rmap lock, and vma_complete() reinserts it
before releasing the lock.
This is wholly unnecessary if its page offset (file rmap) or anonymous
page offset (anon rmap) is unchanged.
So, track whether they will change in the newly introduced
vp->file_pgoff_unchanged and vp->anon_pgoff_unchanged fields, and use them
to determine whether to remove the VMA or not.
The rmap lock keeps things safe as no rmap walks can concurrently occur
during the operation.
Additionally, some architectures (arm, parisc, nios2, csky) have dcache
flush rmap walkers which take only flush_dcache_mmap_lock(), which is
likewise held across the operation.
If the VMA remains in the tree, it's necessary to keep the augmented
rb_subtree_last field updated to reflect its changed range.
Provide mapping_rmap_tree_[pre, post]_update() and anon_rmap_tree_[pre,
post]_update_vma() (replacing the existing logic in the anonymous case) to
handle both the changed and unchanged cases.
For the anon rmap case, with CONFIG_DEBUG_VM_RB set, avc->cached_vma_last
is also updated when propagating in place.
When performing a VMA shrink or a split where the VMA is the lower one,
the page offset cannot change, so set the flags unconditionally in these
cases.
When merging VMAs the page offset is unchanged only in some cases, so
update init_multi_vma_prep() to set the flags only if the page offsets
remain the same.
Finally, while we're here, also update expand_upwards() similarly.
These changes ultimately result in less rmap lock contention.
Pan Deng reported results using the UnixBench/excel benchmark on a
2-socket 192 core, 384 thread x86-64 system for v7.3-rc4 with/without the
patch applied:
Execl Throughput, index score:
avg %stdev min max
v7.3-rc4 3511.5 0.44% 3494.5 3543.4
+ patch 4069.0 0.48% 4047.4 4109.5 (+15.9%)
Average wait on file rmap lock in ms, 5 runs per kernel:
avg %stdev min max
v7.3-rc4 9.470 2.91% 9.070 9.820
+ patch 8.420 3.34% 8.100 8.770 (-11.1%)
Profiling data obtained during the operation highlighted the file rmap lock
as the primary source of contention.
Link: https://lore.kernel.org/20260930-speed-up-inplace-rmap-v2-1-ac1aa19708aa@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Pan Deng <pan.deng@intel.com>
Reviewed-by: Rik van Riel <riel@surriel.com>
Acked-by: Lance Yang <lance.yang@linux.dev>
Tested-by: Lance Yang <lance.yang@linux.dev>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Cc: David Hildenbrand <david@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Harry Yoo <harry@kernel.org>
Cc: Jann Horn <jannh@google.com>
|
