summaryrefslogtreecommitdiff
path: root/tools
AgeCommit message (Collapse)Author
2026-08-04memblock: always include KHO headersPratyush Yadav (Google)
In a coming commit, memblock will start using kho_scratch_overlap() without a compile guard. The compile guard for the function is in kexec_handover.h and provides a stub when CONFIG_KEXEC_HANDOVER is disabled. Since in memblock the call will exist unconditionally, always include the KHO headers. Including these headers unconditionally breaks memblock test compilation. Add stubs to fix that. Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-20-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04kho: expose kho_scratch_overlap() to kexec_handover.hPratyush Yadav (Google)
Support for discovering memory blocks with no preserved memory will be added in coming patches. These areas will also be marked as scratch to allow allocations from them. Memblock will switch to looking through the scratch array to decide the right migratetype. Expose kho_scratch_overlap() to KHO users. Since it is now used by non-debug code, move it out of kexec_handover_debug.c and into kexec_handover.c. Gate the overlap checks in kho_preserve_folio() and kho_preserve_pages() by IS_ENABLED(CONFIG_KEXEC_HANDOVER_DEBUG) instead. Since kexec_handover_debug.c is now empty, delete it. Add a stub for kho_scratch_overlap() to memblock tests to make sure it compiles. It will be used in memblock by a coming commit. No functional changes. Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-14-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-03selftests: ipc: change operation not supported error numberPaul White
The application doesn't know what ENOTSUPP means, as it is a kernelspace error code and the application doesn't have access to kernelspace error codes.I used EOPNOTSUPP in its place as that is an error number the application will recognize and know an operation is being attempted that it cannot support. Link: https://lore.kernel.org/20260720204001.1663473-1-paul.white.kernel@gmail.com Signed-off-by: Paul White <paul.white.kernel@gmail.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Wei Yang <richard.weiyang@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03tools/accounting: fix macro typos in getdelaysShivank Sharma
Correct the spelling of PRINT_FILED_DELAY and PRINT_FILED_DELAY_WITH_TS to PRINT_FIELD_DELAY and PRINT_FIELD_DELAY_WITH_TS respectively. This resolves typo naming errors across the macro definitions and their matching inside print_delayacct(). Link: https://lore.kernel.org/20260716141545.1292951-1-shivanksharma2376543@gmail.com Signed-off-by: Shivank Sharma <shivanksharma2376543@gmail.com> Cc: Fan Yu <fan.yu9@zte.com.cn> Cc: Wang Yaxin <wang.yaxin@zte.com.cn> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03selftests/acct: share netlink helpersYiyang Chen
Extract the duplicated generic netlink boilerplate (netlink_open, send_request, get_family_id, and NLA walker macros) from cgroupstats.c and taskstats_fill_stats_tgid.c into a shared netlink_helper.{h,c}. Link: https://lore.kernel.org/a2adf27308b5cd90d50b59e8519b87da49486bee.1783876192.git.cyyzero16@gmail.com Signed-off-by: Yiyang Chen <cyyzero16@gmail.com> Suggested-by: Andrew Morton <akpm@linux-foundation.org> Acked-by: Balbir Singh <balbirs@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03selftests/acct: add cgroupstats functional testYiyang Chen
Add a self-contained test for the CGROUPSTATS_CMD_GET genl command that covers three cases: - querying a cgroup v1 hierarchy and verifying the response contains non-zero task counts - rejecting an invalid fd without NLM_F_ACK - rejecting an invalid fd with NLM_F_ACK Link: https://lore.kernel.org/2a56921276f0962f97f00863e8c7d3c3f6893d5a.1783713230.git.cyyzero16@gmail.com Signed-off-by: Yiyang Chen <cyyzero16@gmail.com> Cc: Balbir Singh <balbirs@nvidia.com> Cc: Dr. Thomas Orgis <thomas.orgis@uni-hamburg.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03tools/compiler: match glibc 2.42 definition of __attribute_const__Joy H.J. Lee
glibc 2.42 added __attribute_const__ to sys/cdefs.h: # define __attribute_const__ __attribute__ ((__const__)) GCC 15 warns when a macro is redefined to a different replacement list (-Wbuiltin-macro-redefined). Since host tool Makefiles (resolve_btfids, objtool) pass -Werror, this conflict becomes fatal. The warning is suppressed on standard native builds because GCC treats /usr/include as a system header path (-isystem), and macro-redefinition warnings from system headers are silently suppressed by GCC. It fires when glibc headers are on a regular include path (-I) instead, which is the case in cross-compilation setups such as NixOS, where the sysroot's glibc is passed explicitly via -I rather than -isystem. Per (C11 6.10.3), identical replacement lists are accepted silently. Match the glibc definition exactly, including the space before "((", so the redefinition is accepted without warning regardless of whether glibc headers are treated as system or non-system includes. Link: https://lore.kernel.org/20260701200635.3992767-1-rkr0k0r@gmail.com Signed-off-by: Joy H.J. Lee <rkr0k0r@gmail.com> Cc: Nathan Chancellor <nathan@kernel.org> Cc: David Laight <david.laight.linux@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03tools/accounting/delaytop.c: fix typo in PSI header stringSara Sena
Link: https://lore.kernel.org/20260701011153.93426-1-sarasena.adr@gmail.com Signed-off-by: Sara Sena <sarasena.adr@gmail.com> Cc: Fan Yu <fan.yu9@zte.com.cn> Cc: Wang Yaxin <wang.yaxin@zte.com.cn> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03selftests: ublk: add rotating auto_buf index regression testYang Xiuwei
Batch AUTO_BUF_REG COMMIT must unregister the old auto_buf index before storing the next one. Fixed per-tag indexing (A == B) masks bugs that clear after overwriting io->buf. Add kublk --rotate_auto_buf so each tag alternates between two sparse buffer indices, and test_batch_04.sh to exercise that path. Without the driver fix, the request ref stays stuck and I/O hangs; the test uses a short timeout and kills the ublk daemon to recover. With the fix, a small write completes quickly. Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn> Reviewed-by: Ming Lei <tom.leiming@gmail.com> Link: https://patch.msgid.link/20260730024050.1062354-1-yangxiuwei@kylinos.cn Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-03selftests: ublk: add UBLK_F_IO_DESC_SIZE testCaleb Sander Mateos
Add test loop_08, which creates a ublk device with UBLK_F_IO_DESC_SIZE enabled and io_desc_size set to 64. The test issues verified I/O to the device using fio. Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Link: https://patch.msgid.link/20260803211441.2538144-8-csander@purestorage.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-03selftests: ublk: add support for --io_desc_sizeCaleb Sander Mateos
Add an optional --io_desc_size argument to the kublk add/recover commands to enable UBLK_F_IO_DESC on the ublk device. The mmap() arguments and ublk_get_iod() computation are adjusted accordingly. Display the configured io_desc_size in the kublk list output for ublk devices with UBLK_F_IO_DESC. Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Link: https://patch.msgid.link/20260803211441.2538144-7-csander@purestorage.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-03ublk: add UBLK_F_IO_DESC_SIZECaleb Sander Mateos
ublk passes the parameters of incoming I/O in memory shared between the kernel ublk driver and userspace ublk server in struct ublksrv_io_desc. The size of this struct is currently fixed to 24 bytes, which has been an obstacle to extending it with additional fields [1]. Additionally, with multiple ublk server threads handling I/Os from the same ublk queue (possible with UBLK_F_PER_IO_DAEMON or UBLK_F_BATCH_IO), false sharing results from adjacent io_descs sharing the same cache line. Add a ublk feature UBLK_F_IO_DESC_SIZE to allow a ublk server to override the size of each io_desc. The size must be at least 24 and a multiple of 8 to store a properly-aligned struct ublksrv_io_desc. It's also limited to a maximum of 256, though this bound could be lifted in the future. The struct ublksrv_io_desc is located at the beginning of each io_desc and the remainder is padding. The mmap() performed for each queue must have a length of queue_depth * io_desc_size rounded up to the page size. The mmap() offset must be q_id * UBLK_MAX_QUEUE_DEPTH * io_desc_size, also rounded up to the page size. [1]: https://lore.kernel.org/linux-block/aV8QfvaNO5P6vOs6@fedora/ Suggested-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Link: https://patch.msgid.link/20260803211441.2538144-6-csander@purestorage.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-03selftests: drv-net: Test queue stall upon reconfigMohsin Bashir
Add a reconfig_tx_stall test that detects the possibility of a TX stall after ring reconfiguration. The key observation is that drivers using netif_tx_start_all_queues() are prone to experiencing a stall when reconfiguration completes compared to drivers using netif_tx_wake_all_queues(). start_all_queues only clears DRV_XOFF, while wake_all_queues also calls __netif_schedule() to kick the qdisc. Without the kick, qdisc backlog present at reconfig time can stay stuck until a new trigger is issued. The test caps the TX ring at 64 entries so it fills quickly, then installs FQ on a target TX queue and sends UDP packets with SO_TXTIME scheduled in the future. With napi_defer_hard_irqs slowing completions, the small ring can fill when FQ releases the burst, leaving requeued qdisc backlog with no FQ timer to rescue it. A subsequent ring reconfig must wake the queues to drain the backlog. Simply starting the queues can leave it stuck. Some drivers lack backpressure on the TX path and may not be able to build up the qdisc backlog the test relies on. In that case report an expected failure (xfail) instead of a hard failure. Testing on some of the existing drivers: Driver-A does not have the bug, Driver-B has the bug, Driver-C had the bug but it is fixed now. Driver-A: ./drivers/net/ring_reconfig.py -t reconfig_tx_stall TAP version 13 1..1 Sent 1024 SO_TXTIME packets (+100ms) Backlog before reconfig: 1176378 bytes ok 1 ring_reconfig.reconfig_tx_stall Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 Driver-B: TAP version 13 1..1 Sent 128 SO_TXTIME packets (+100ms) Sent 128 SO_TXTIME packets (+200ms) Backlog before reconfig: 148372 bytes Check| At ./drivers/net/ring_reconfig.py, line 397, in reconfig_tx_stall: Check| ksft_eq(0, backlog, Check failed 0 != 148372 qdisc backlog stuck on queue 1 after ring .... not ok 1 ring_reconfig.reconfig_tx_stall Totals: pass:0 fail:1 xfail:0 xpass:0 skip:0 error:0 Driver-C: TAP version 13 1..1 Sent 128 SO_TXTIME packets (+100ms) Backlog before reconfig: 192278 bytes ok 1 ring_reconfig.reconfig_tx_stall Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Mohsin Bashir <hmohsin@meta.com> Link: https://patch.msgid.link/20260731021543.1058526-1-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03selftests: net: getsockopt_iter: cover rawv6 and tlsBreno Leitao
Add fixtures for the newly converted getsockopt leaves: - rawv6: IPV6_HDRINCL / IPV6_CHECKSUM int paths + a SOL_RAW unknown-optname case that reaches do_rawv6_getsockopt(). - tls: TLS_TX_ZEROCOPY_RO, the TLS_TX crypto_info round-trip at the base and full cipher sizes, the NULL-optval and short buffer EINVAL paths, and an unknown optname. It skips when the kernel lacks TLS or AES-GCM. Each fixture pins the returned-length / errno semantics across exact, oversized and short buffers and an unknown optname. The semantics are unchanged by the sockopt_t conversion, so the tests pass both before and after the leaf conversions. ieee802154 and phonet are not covered: their CONFIG options are absent from the net selftest target config, so the cases would only ever skip. Acked-by: Rémi Denis-Courmont <remi@remlab.net> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Joe Damato <joe@dama.to> Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260729-getsockopt_phase4-v4-7-c44576757c17@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03selftests/exec: test the pre-opened interpreter limitChristian Brauner
- an interpreter opened at registration is charged - an interpreter a 'B' entry binds is charged too - an entry that opens none is not - removing an entry gives the charge back - a nested user namespace cannot buy itself budget by raising its own limit Skips where the sysctl or binfmt_misc is missing. The 'B' case lives in binfmt_misc_bpf.c because binding needs a handler. It binds from a child in a user namespace of its own, through the fd the child inherited, so the charge lands on the child while the interpreter is still opened with the entry file's credentials, and nothing outside the child sees a changed limit. Link: https://patch.msgid.link/20260803-work-binfmt_misc-interplimit-v1-2-4a2435500bd9@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-03sched_ext: scx_qmap - Add rescue supportTejun Heo
A sched holds only the cids its parent granted and nothing guarantees that they cover its tasks' affinities. A task that can run on none of them has nowhere to go and qmap stalls out: it force-inserts the task onto its first allowed cid, but the kernel bounces the insert back and the task parks in SHARED_DSQ, which is drained only on self cids it can't run on. Set SCX_ENQ_RESCUE on these inserts so the kernel diverts such tasks to its rescue path instead of bouncing them. The force-insert covers scheds with and without children and fires on re-enqueues, and the SHARED_DSQ scan on every dispatch rescues tasks stranded there - the enqueue-time check misses a task whose cids were lost while it was already queued. The wrong-cid fault injection carries the flag too and doubles as a deterministic rescue-traffic generator. -B and -q set the root-only rescue bandwidth and quantum ops knobs. -B 0 maps to SCX_RESCUE_DISABLE and turns rescue off kernel-side. Rescue inserts are counted and reported in the hier stats line. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-08-03sched_ext: scx_qmap - Idle-check pinned tasks before direct dispatchTejun Heo
pick_direct_dispatch_cid() sent a pinned task straight to its only cpu without an idle check. An insert onto a time-shared cid is forced IMMED, which may not wait on a busy cpu - the kernel bounces the task back to ops.enqueue(), the shortcut re-inserts it, and the loop runs into the reenqueue repeat limit. Run pinned tasks through the same idle test as everyone else and queue them when the cpu is busy. always_enq_immed forces IMMED on every local insert and already skipped the shortcut for the same reason. The check was the last reader of the always_enq_immed rodata mirror, so drop the variable. The -I option still sets SCX_OPS_ALWAYS_ENQ_IMMED. v2: Drop the now-unread always_enq_immed rodata mirror. (sashiko AI) Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-08-03sched_ext: Sync tools autogen enum headersTejun Heo
Mechanical regeneration for the enumerators added by the slice write rework and the rescue machinery. BPF schedulers reference SCX_ENQ_RESCUE, the rest are enum_defs presence markers. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-08-03sched_ext: Add bandwidth-limited rescue execution for stranded tasksTejun Heo
A local DSQ insert lacking the needed caps is diverted to the reject DSQ and bounced back through ops.enqueue() so the scheduler can re-decide. That recovery assumes the scheduler has somewhere legal to send the task. When it doesn't, e.g. when the task's affinity is restricted to cids delegated away, the task starves until the stall watchdog ejects the scheduler. An exiting task is worse - it skips ops.enqueue() and the rejection becomes a self-requeuing cycle that burns the CPU until the watchdog fires. Add SCX_ENQ_RESCUE, a fallback modifier on local DSQ inserts. When the insert would be rejected for missing caps, the kernel takes over and runs the task on the target CPU without consulting the owning scheduler. The kernel sets the flag itself when enqueueing an exiting task. Rescue is a last-resort forward-progress backstop with a persistent disadvantage, not a way around cap enforcement. A per-CPU token bucket accrues rescue_bandwidth_ppt (default 2%) of CPU time and rescues run one at a time in arrival order. Each is granted a slice of the rescue_quantum_us (default 5ms) quantum divided across the waiters, waits at the tail of the local DSQ claiming no priority, and rejoins its scheduler as a fresh arrival once the slice is served. The schedulers keep their normal control over an admitted rescuee and may preempt or reslice it. Service is measured on CPU time actually received, so neither shortens the rescue. Prolonged denial escalates - the remaining slice turns into protected execution (SCX_TASK_PROTECTED) and the rescuee preempts the current task. Escalation is paced by the same bucket, and delivered service converges on the configured bandwidth no matter how aggressively the schedulers dispatch. Both knobs are root-only and SCX_RESCUE_DISABLE turns rescue off, making SCX_ENQ_RESCUE inserts reject as usual. v2: - Add SCX_OPS_OPEN() fix-ups for the new ops fields so cpu-form schedulers setting them still load on older kernels. (Andrea) Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-08-03selftests: drv-net: enable devmem TCP in the test configBobby Eshleman
The config fragment already sets CONFIG_UDMABUF=y, but kconfig silently drops it. UDMABUF/NET_DEVMEM both depend on DMA_SHARED_BUFFER, which we can't enable directly, so we need to enable a config that selects it. We use SYNC_FILE for that purpose here. Additionally, we flip on CONFIG_NET_DEVMEM as well. Suggested-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Reviewed-by: Mina Almasry <almasrymina@google.com> Link: https://patch.msgid.link/20260731-selftests-devmem-config-v1-1-098014348d9d@meta.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03perf arm-spe: Reject zero nr_cpu in metadata to prevent division by zeroArnaldo Carvalho de Melo
arm_spe__alloc_metadata() reads nr_cpu from the auxtrace_info priv array without validation. When a crafted perf.data provides nr_cpu=0, the per_cpu_sz calculation divides by zero: per_cpu_sz = (metadata_size - (hdr_sz * sizeof(u64))) / (*nr_cpu); Reject nr_cpu <= 0 early, before the division. The caller already treats NULL return with metadata_ver != 1 as a parse failure. Fixes: 7842a4b6ff698 ("perf arm-spe: Support metadata version 2") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Reviewed-by: James Clark <james.clark@linaro.org> Reviewed-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-03perf intel-bts: Fix off-by-one in auxtrace_info minimum size checkArnaldo Carvalho de Melo
Same pattern as the Intel PT fix: min_sz is set to sizeof(u64) * INTEL_BTS_SNAPSHOT_MODE, but the code accesses auxtrace_info->priv[INTEL_BTS_SNAPSHOT_MODE], which requires at least INTEL_BTS_SNAPSHOT_MODE + 1 elements. Use (INTEL_BTS_SNAPSHOT_MODE + 1) to ensure the highest accessed index is within bounds. Fixes: d0170af7004dce9c ("perf tools: Add Intel BTS support") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Reviewed-by: James Clark <james.clark@linaro.org> Reviewed-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-03perf intel-pt: Fix off-by-one in auxtrace_info minimum size checkArnaldo Carvalho de Melo
min_sz is set to sizeof(u64) * INTEL_PT_PER_CPU_MMAPS, but the code accesses auxtrace_info->priv[INTEL_PT_PER_CPU_MMAPS], which requires at least INTEL_PT_PER_CPU_MMAPS + 1 elements. A file with exactly min_sz bytes of priv data passes the size check but the access reads one u64 past the validated region. Use (INTEL_PT_PER_CPU_MMAPS + 1) to ensure the highest accessed index is within bounds. Fixes: 90e457f7be087005 ("perf tools: Add Intel PT support") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Reviewed-by: James Clark <james.clark@linaro.org> Reviewed-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-03perf auxtrace: Fix queue grow overflow and old array leakArnaldo Carvalho de Melo
auxtrace_queues__grow() has two bugs: 1. When idx is UINT_MAX, the caller passes new_nr_queues = idx + 1 = 0. The function skips growing (since any nr_queues >= 0), returns success, and the caller accesses queue_array[UINT_MAX] — an OOB heap write. Fix by rejecting new_nr_queues == 0 up front. 2. The function allocates a new queue_array via calloc and copies elements from the old array, but never frees the old array. Fix by saving the old pointer and freeing it after the copy. Fixes: e502789302a6ece9 ("perf auxtrace: Add helpers for queuing AUX area tracing data") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Reviewed-by: James Clark <james.clark@linaro.org> Reviewed-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-03perf thread-stack: Fix heap buffer overflow on branch stack wrap copyArnaldo Carvalho de Melo
thread_stack__br_sample() copies the wrap-around portion of the branch stack ring buffer with: nr = min(ts->br_stack_pos, sz); memcpy(be, &src->entries[0], bsz * ts->br_stack_pos); 'nr' is correctly bounded to min(br_stack_pos, sz) but the memcpy uses the unbounded ts->br_stack_pos directly. When br_stack_pos exceeds the remaining destination space 'sz', this writes past the destination buffer. Use 'nr' (the bounded value) in the memcpy size, matching the pattern of the first memcpy in the same function. Fixes: 86d67180b920 ("perf thread-stack: Add branch stack support") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Reviewed-by: James Clark <james.clark@linaro.org> Reviewed-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-03docs: xforms_lists: support DEFINE_IDTENTRY_IRQ()Randy Dunlap
Avoid kernel-doc warnings by supported DEFINE_IDTENTRY_IRQ() as a function transform. Warning: arch/x86/kernel/apic/apic.c:2157 function parameter 'spurious_interrupt' not described in 'DEFINE_IDTENTRY_IRQ' Warning: arch/x86/kernel/apic/apic.c:2157 expecting prototype for spurious_interrupt(). Prototype was for DEFINE_IDTENTRY_IRQ() instead Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260723190151.507295-1-rdunlap@infradead.org>
2026-08-03perf pmu-events: Fix typo in idle-cycles-frontend descriptionPu Hu
The brief description of the idle-cycles-frontend legacy hardware event refers to its alias as "stalled-cycles-fronted", but there is no such event. The correct event name is "stalled-cycles-frontend". This typo is visible in the output of "perf list", for example: idle-cycles-frontend [Stalled cycles during issue [This event is an alias of stalled-cycles-fronted]. Unit: armv8_pmuv3] Fix the spelling so that the description points to the valid event name. Signed-off-by: Pu Hu <hupu@transsion.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-03docs: kdoc_parser: drop extraneous blank line in warning messageRandy Dunlap
Drop an extra newline (blank line) on warning messages for (2 places): expecting prototype for typedef. Prototype was for typedef {symbol} instead and expecting prototype for {struct|union}. Prototype was for struct|union {symbol} instead This makes these messages consistent with the similar enum warning, which has no extra blank line. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260729052736.1423688-1-rdunlap@infradead.org>
2026-08-03perf ftrace: Fix leak in parse_filter_eventMichail Tatas
strsep() advances the pointer given to it. After the loop s is either NULL (on success) or points mid buffer (early exit if malloc fails) so the original buffer is never freed properly. Fix by adding a tmp pointer for use by strsep and free the original pointer Signed-off-by: Michail Tatas <michail.tatas@gmail.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-03selftests/exec: test interpreters bound to a 'B' entryChristian Brauner
One handler, one entry registered disabled, an interpreter per guest architecture bound to a file one write at a time. The load program picks one by name per exec: - an aarch64 binary runs the interpreter bound as "first" and a riscv one the interpreter bound as "second", from a single entry and a single handler - unlinking a bound interpreter and putting a different binary in its place changes nothing, which is what the binding exists for - the entry reports what it bound, under the names it bound them as - a name the entry did not bind fails the exec with -ENOENT rather than falling back to anything - activating the entry refuses further binding with -EBUSY, a later disable does not undo that, and an entry registered without 'D' never accepted a '+' write to begin with - a name binds one interpreter, and control characters are refused - the command has to end at the write, bytes past an embedded nul are refused - an entry binds at most 100 interpreters, the next one is refused with -ENOSPC The test interpreter prints its argv[0], which is the path the kernel ran that copy under, so one binary installed at two paths tells the harness which of them the program picked. Link: https://patch.msgid.link/20260730-work-binfmt_misc-preopen-v1-8-4a0b0da71f16@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-03selftests/exec: share the bpf handler preconditionsChristian Brauner
The bpf handler fixture opens with three probes, each with its own SKIP. More fixtures with the same needs are about to be added, so hoist the probes into a helper that reports the first missing precondition. Link: https://patch.msgid.link/20260730-work-binfmt_misc-preopen-v1-5-4a0b0da71f16@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-03selftests/exec: test registering an entry disabledChristian Brauner
A magic entry registered with 'D' and the same entry without it, to pin down what the flag decides and what it leaves alone: - the entry reports itself disabled and nothing dispatches until '1' is written to it - without 'D' it dispatches straight away - 'D' is not read back among the entry's flags - enabling and disabling afterwards works as it does for any entry - 'D' composes with the flags that shape the invocation - '-1' to the status file removes a staged entry like any other - a file handle held across a removal cannot resurrect the entry Put the entry write and read-back helpers into binfmt_misc_common.h. The bpf suite will need them as well. Link: https://patch.msgid.link/20260730-work-binfmt_misc-preopen-v1-3-4a0b0da71f16@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-03selftests/exec: let binfmt_flag_supported() return a boolChristian Brauner
binfmt_flag_supported() returns 0 when the flag is supported and -1 when it is not, so every caller reads backwards: if (binfmt_flag_supported('T')) SKIP(return, "kernel without the 'T' flag"); Make it return a bool and flip the callers. errno from a failed probe is still set for callers that check it. Link: https://patch.msgid.link/20260730-work-binfmt_misc-preopen-v1-2-4a0b0da71f16@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> Reviewed-by: Farid Zakaria <farid.m.zakaria@gmail.com>
2026-08-03scripts/kernel-doc: Fix kdoc for Python 3.9-3.11Ryszard Knop
The syntax used by the excess description suggestion change works on Python 3.12+, while we need to support 3.9+. Signed-off-by: Ryszard Knop <ryszard.knop@intel.com> Tested-by: Akira Yokosawa <akiyks@gmail.com> Fixes: d7758384ccb4 ("scripts/kernel-doc: Suggest possible names for excess descriptions") Reported-by: Akira Yokosawa <akiyks@gmail.com> Closes: https://lore.kernel.org/22a9276d-c103-4306-a617-7f34abcd5c29@gmail.com/ Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260731144508.912049-1-ryszard.knop@intel.com>
2026-08-03selftests/sched_ext: Make allowed_cpus idle validation race-freeAndrea Righi
A remotely selected CPU can be re-advertised as idle by an idle-to-idle re-pick before the BPF program validates the selection. Checking that the selected CPU remains absent from the idle mask is therefore inherently racy. Validate a stable local invariant instead: a CPU executing ops.select_cpu() or ops.enqueue() in a non-idle scheduling context must not be advertised as idle. Read the idle mask without modifying it and also validate selected CPUs against the requested domain and task affinity. Suggested-by: Kuba Piecuch <jpiecuch@google.com> Signed-off-by: Andrea Righi <arighi@nvidia.com> Reviewed-by: Kuba Piecuch <jpiecuch@google.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-03Merge tag 'sched_ext-for-7.2-rc6-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - More lifecycle fixes for the new sub-scheduler support: a failed enable could tear down a never-linked sub-scheduler in a way that races the root scheduler's disable and leads to a use-after-free, tasks that were not on the ext class could still get the enable callback, and a policy-rejection path silently rewrote a running task's scheduling policy instead of aborting the scheduler. - Scheduler enable/disable could deadlock with cgroup removal and a concurrent cgroup weight write through kernfs. Fixed by reordering lock acquisition. - Sync wakeups could leave the waker CPU incorrectly marked idle in the built-in idle-CPU tracking. - A selftest fix for sleeping tasks whose CPU affinity changes before wakeup. * tag 'sched_ext-for-7.2-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: selftests/sched_ext: Handle sleeping task affinity changes in numa test sched_ext: Mark waker CPU busy when selected in WAKE_SYNC case sched_ext: Don't enable non-ext tasks in the sub-sched task loops sched_ext: Skip sub-disable teardown for never-linked sub-schedulers sched_ext: Take cgroup_lock() first in scx_cgroup_lock() sched_ext: Reject setting disallow from init_task outside the enable path
2026-08-03selftests/exec: check that a binfmt_misc instance cannot be pinnedChristian Brauner
An 'F' entry whose interpreter keeps the binfmt_misc superblock alive pins the instance that owns it forever. Cover both ways to build that: - an interpreter on the instance's own files, control file and entry file alike - and an instance used as an overlayfs lower layer. Check that an ordinary 'F' registration still succeeds so the fix stays honest about not changing what 'F' promises. Link: https://patch.msgid.link/20260728-work-binfmt_misc-selfpin-v1-2-74df5daeca5b@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-03selftests/exec: test binfmt_misc loader substitutionChristian Brauner
Exercise the 'L' flag end to end. The payload runs as the main image with a copy of the system loader substituted for its PT_INTERP, and asserts the native identity from inside: - argv exactly as the caller built it - no AT_EXECFD - AT_FLAGS clear - AT_BASE set but outside its own image - AT_PHDR/AT_ENTRY inside it - /proc/self/{exe,comm,stat} and AT_EXECFN all describing the binary - ETXTBSY on the running binary - the substituted loader visible in /proc/self/maps under its real path Magic matching pokes a marker into the ELF header's e_ident padding (EI_PAD, offset 9), which sits inside the match window and is ignored by kernel and loader alike. the same binary is also matched by extension. Two cases cover the paths where the substitution does not happen. A '#!' file that matched an 'L' entry is claimed by binfmt_script rather than by binfmt_elf, so the staged substitute has to be released when the interpreter replaces the file; the test opens the loader for writing afterwards, which fails with ETXTBSY if the write denial was leaked instead. A relative interpreter path is rejected at registration for both 'L' and 'C', neither of which may resolve one against the working directory of whoever runs the binary. The bpf-side BPF_BINPRM_LOADER path shares all machinery past the flag mapping. A harness case for it can join the bpf runtime coverage of the transparent series. Link: https://patch.msgid.link/20260721-work-bpf-binfmt_misc-ptinterp-v2-20-e57866e4ae0f@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-03selftests/exec: test the transparent binfmt_misc modeChristian Brauner
Verify the identity a transparent dispatch constructs, from both activation paths. - binfmt_misc_transparent: registers a magic entry with the static 'T' flag and execs a matched binary with arguments. - binfmt_misc_bpf: a handler whose load program sets BPF_BINPRM_TRANSPARENT. Both dispatch to a shared asserting interpreter that runs in place of the binary and checks the contract from the inside: - AT_FLAGS carries AT_FLAGS_TRANSPARENT_INTERP - AT_EXECFD refers to the very inode of the binary - /proc/self/exe resolves to the binary - argv and /proc/self/cmdline are exactly what the caller passed with nothing spliced in - comm is the binary's basename - the binary is write-denied while it runs The static test also validates the registration. 'T' combined with 'P' must be rejected. A kernel that does not know 'T' turns the test into a skip. The asserting interpreter and the static test build without the bpf toolchain so the core transparent semantics stay covered on systems where the bpf cases are skipped. The flag support probe, the canonical payload argv with the run_payload() helper that execs it, and the identity assertions (exe link, comm, write denial) live in binfmt_misc_common.h; the loader substitution test reuses all of them. Link: https://patch.msgid.link/20260721-work-bpf-binfmt_misc-ptinterp-v2-13-e57866e4ae0f@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-03selftests/exec: convert the binfmt_misc bpf test to the kselftest harnessChristian Brauner
The test reports its own pass and fail lines, returns a bare 4 for KSFT_SKIP and runs both cases in one process, so a failure in the first takes the second with it. It also open-codes the register, unregister, file-copy and mount helpers that the tests for the upcoming transparent and loader dispatch modes need again. Convert it to the kselftest harness: a fixture for the common setup and teardown, one TEST_F per case so each is reported and isolated separately, and SKIP() for the root, BTF and binfmt_misc preconditions. Move the helpers to a shared header on the way, with the register helper preserving the write's errno so a caller can tell a rejected flag combination (EINVAL) from a kernel that does not know the flag at all. The synthetic ELF header gains an e_machine argument and uses the elf.h constants instead of open-coded numbers. The fixture no longer mounts bpffs. The handler is attached with bpf_map__attach_struct_ops() and nothing is ever pinned, the mount was carried along from a bpftool-based draft. The bpf objects are compiled with -DBPF_NO_KFUNC_PROTOTYPES - the guard bpftool emits for exactly this - instead of sed'ing the prototypes out of the generated vmlinux.h. And the config fragment records the options the binfmt_misc tests need so a merge-config kernel can run them. No change in what is tested. Link: https://patch.msgid.link/20260721-work-bpf-binfmt_misc-ptinterp-v2-7-e57866e4ae0f@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-03selftests/exec: add binfmt_misc bpf-backed handler testFarid Zakaria
Exercise the bpf-backed ('B') binfmt_misc handlers end to end. A handler is a struct binfmt_misc_ops struct_ops map; the test loads and attaches it (which publishes it by name), activates it with a 'B' entry, and checks that a matched binary is routed to the interpreter the program selected via bpf_binprm_set_interp(). Two self-contained cases are covered: - bpf_interp: the match program matches a synthetic aarch64 ELF header from the prefetched bprm->buf and the load program routes it to a fixed interpreter of its choosing. - nix_origin: the match program parses the program headers to commit only to a "$ORIGIN/..."-relative PT_INTERP and the load program resolves it to an interpreter co-located with the binary -- the relocatable-loader case the kernel ELF loader cannot express. The relocatable binary is linked with PT_INTERP set to the literal "$ORIGIN/binfmt_bpf_interp" (-Wl,--dynamic-linker), which the kernel cannot resolve on its own. Both route to a small test interpreter that prints a marker, proving the program-selected interpreter actually ran. The bpf objects are compiled against the running kernel's BTF: the Makefile generates vmlinux.h with bpftool and the harness links libbpf. Override CLANG/BPFTOOL/VMLINUX_BTF/LIBBPF_CFLAGS/LIBBPF_LDLIBS as needed. The bpf pieces are only built when clang, bpftool, the vmlinux BTF and libbpf are all present (HAVE_BPF_TOOLCHAIN=y forces them) so the other exec selftests keep building without a bpf toolchain. Christian Brauner (Amutable) <brauner@kernel.org> says: Adapted to the two-op contract: 'B' entries carry the handler name in the interpreter field, both programs are sleepable, the match programs decide. nix_origin reads PT_INTERP from the match program and load returns zero on success. Skip on kernels without binfmt_misc_ops in BTF. Build the bpf pieces only when the toolchain is present and gitignore the generated artifacts. Signed-off-by: Farid Zakaria <farid.m.zakaria@gmail.com> Link: https://patch.msgid.link/20260714-work-bpf-binfmt_misc-v2-9-57b7529c002c@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-03objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0Miguel Ojeda
Starting with Rust 1.99.0 (expected 2026-10-01), `objtool` may report: rust/kernel.o: warning: objtool: _R..._6kernel3str9parse_intaNtNtB2_7private12FromStrRadix14from_str_radix() falls through to next function _R..._6kernel3str9parse_intaNtNtB2_7private12FromStrRadix16from_u64_negated() due to calls to the `noreturn` symbol: core::num::from_ascii_bytes_radix_panic The function was renamed from `from_ascii_radix_panic` [1], which is already in the list. Thus add the new one to the list so that `objtool` knows it is actually `noreturn`. See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions") for more details. Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Cc: Josh Poimboeuf <jpoimboe@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Link: https://github.com/rust-lang/rust/pull/159554 [1] Tested-by: Alice Ryhl <aliceryhl@google.com> Link: https://patch.msgid.link/20260728191448.349241-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-03objtool/klp: Fix symbol resolution for duplicate data symbolsJosh Poimboeuf
find_sympos() calculates a sympos used by livepatch to disambiguate duplicately-named symbols. For function symbols, there's a hack which counts .text.unlikely symbols before other .text symbols, matching the linker script's section ordering. Not only is the hack fragile, data symbols can have the same problem. So for example, adding a reference to pwq_cache in ep_unregister_pollwait() can trigger a corrupt sympos and a relocation to the wrong pwq_cache symbol in the livepatch module, resulting in a crash or undefined behavior. Remove the existing hack in favor of a fully deterministic solution, using the new .klp.symid table to derive the symbol-to-id mapping from the original vmlinux.o and the id-to-address mapping from the corresponding vmlinux, which can then be used to determine the exact sympos associated with the original vmlinux. Modules don't need any special treatment: the .ko has the same section/symbol ordering as the original whole-archive symbol table. Fixes: dd590d4d57eb ("objtool/klp: Introduce klp diff subcommand for diffing object files") Reported-by: Ben Procknow <bprockno@redhat.com> Reported-by: Joe Lawrence <joe.lawrence@redhat.com> Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: live-patching@vger.kernel.org Link: https://lore.kernel.org/20260710153042.3156788-1-joe.lawrence@redhat.com Link: https://lore.kernel.org/20260724221730.3126529-1-joe.lawrence@redhat.com Link: https://patch.msgid.link/919785e3bf2245db02ff6391e735d9cb139170b1.1785727106.git.jpoimboe@kernel.org
2026-08-03objtool/klp: Add .klp.symid for sympos disambiguationJosh Poimboeuf
Livepatch identifies a duplicate-named symbol by its position (sympos) among same-named kallsyms entries, which for vmlinux are counted in ascending address order in the final linked kernel. That order can't be reliably derived from vmlinux.o: the final link reorders sub-sections (.text.unlikely*, .data..*, etc). Bridge the gap with a new .klp.symid section which can be used to correlate symbols between vmlinux.o and vmlinux so that klp-diff can reliably determine the sympos. The table can't survive --gc-sections: keeping it alive would keep every duplicate-named symbol's section alive, so the reference kernel would stop matching the one which ships. klp-build rejects CONFIG_LD_DEAD_CODE_DATA_ELIMINATION instead. Nothing is lost today: x86_64 is the only HAVE_KLP_BUILD arch and doesn't select HAVE_LD_DEAD_CODE_DATA_ELIMINATION, arm64 and s390 have never selected it either, and on powerpc, it's still EXPERIMENTAL and disabled by every distro kernel. This is the build-time half of reliable vmlinux sympos computation; "objtool klp diff" will consume the table in a subsequent commit. Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: live-patching@vger.kernel.org Link: https://patch.msgid.link/64d50f077b569f47883c015cdb7079edb068efe8.1785727106.git.jpoimboe@kernel.org
2026-08-03objtool/klp: Fix false module dependencies caused by dead relocsJosh Poimboeuf
When creating a klp reloc, klp-diff keeps the original relocation but converts the referenced symbol to an UNDEF/WEAK placeholder tombstone symbol, which gets fully disabled later by klp post-link. The tombstone symbol is only needed to avoid confusing objtool when it does the final run on the patch module. However, for references to exported symbols, modpost sees the reference to the tombstone symbol as a real reference to an exported symbol, resulting in a false module dependency getting created. Further, for a reference to a tombstone symbol which is exported into a module namespace, e.g. via EXPORT_SYMBOL_FOR_KVM_INTERNAL(), modpost can't satisfy the dependency, resulting in a warning like the following: module ... uses symbol kvm_flush_remote_tlbs from namespace module:kvm-amd,kvm-intel, but does not import it. Rename the placeholder tombstone symbols to ".klp.tombstone.<name>" so modpost no longer recognizes them. Fixes: dd590d4d57eb ("objtool/klp: Introduce klp diff subcommand for diffing object files") Reported-by: Ben Procknow <bprockno@redhat.com> Reported-by: Joe Lawrence <joe.lawrence@redhat.com> Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: live-patching@vger.kernel.org Link: https://lore.kernel.org/20260720145658.1103243-5-joe.lawrence@redhat.com Link: https://patch.msgid.link/9548393f4d89ec3b498f4f69aa6ef6b9bb7150fe.1785727106.git.jpoimboe@kernel.org
2026-08-03objtool/klp: Normalize Module.symvers paths to module namesJoe Lawrence
Module.symvers contains build-tree object paths as module identifiers (e.g., "arch/x86/kvm/kvm") rather than runtime module names ("kvm"). Objtool's clone_reloc_klp() uses this field directly for exported symbols, while unexported symbols correctly go through __find_modname(). This means that exported symbol relocations may land in a .klp.rela section named with the build path rather than the module name. That is a crash waiting to happen: the kernel's livepatch loader silently skips this relocation because it doesn't match the expected klp_object name. The unresolved relocation sits in the newly activated code, crashing when executed. Normalize export->mod at Module.symvers read time using the same logic as __find_modname() (refactored into a shared normalize_modname() helper). Fixes: dd590d4d57eb ("objtool/klp: Introduce klp diff subcommand for diffing object files") Reported-by: Ben Procknow <bprockno@redhat.com> Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com> Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Miroslav Benes <mbenes@suse.cz> Cc: live-patching@vger.kernel.org Link: https://patch.msgid.link/dbe1b72931bd3c31b751fd0729613d9f2226fff6.1785727106.git.jpoimboe@kernel.org
2026-08-03objtool/klp: Fix module name normalization for paths with dotsJosh Poimboeuf
When .modinfo has no "name=" tag, __find_modname() falls back to converting the object's build-tree path to a runtime module name by stripping directory components, converting '-' to '_' and truncating the file extension. It does all that in a single pass over the entire path, so the first dot anywhere in the path ends the name. For an object built in a directory whose name contains a dot, e.g. "drivers/foo-1.0/bar.o", the result is a bogus module name. Strip the directory components up front so only the basename is scanned for the extension separator. Fixes: dd590d4d57eb ("objtool/klp: Introduce klp diff subcommand for diffing object files") Reported-by: Sashiko <sashiko-bot@kernel.org> Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: live-patching@vger.kernel.org Link: https://patch.msgid.link/9017b4609553bed16674e8f924d34691cbc2b2c1.1785727106.git.jpoimboe@kernel.org
2026-08-03selftests/bpf: Add IP_TRANSPARENT and IPV6_TRANSPARENT to setget_sockoptShivaji Kant
Add test coverage for IP_TRANSPARENT and IPV6_TRANSPARENT socket options in the setget_sockopt BPF selftest to verify bpf_setsockopt() and bpf_getsockopt() helpers. Signed-off-by: Shivaji Kant <shivajikant@google.com> Tested-by: Anubhav Singh <anubhavsinggh@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://lore.kernel.org/bpf/20260801051307.478469-2-shivajikant@google.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-03bpf: Classify scalar kfunc arguments from BTFAmery Hung
Add kfunc scalar argument types, classify them in get_kfunc_arg_type() along side with pointer arguments and move scalar type verification into the main switch in check_kfunc_args(). This keeps BTF-based classification separate from register validation for every argument, paving the way for generating the kfunc argument prototype at add-call time. No functional change intended. KF_ARG_MEM_SIZE and KF_ARG_CONST_MEM_SIZE now are reachable. Therefore, remove the fallthrough from KF_ARG_PTR_TO_MEM case and adjust the register indexing. Signed-off-by: Amery Hung <ameryhung@gmail.com> Reviewed-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260801074633.1595644-18-ameryhung@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-03bpf: Classify kfunc pointer arguments from BTF, resolve type against the ↵Amery Hung
register get_kfunc_ptr_arg_type() decided part of a kfunc pointer argument's type from the caller's register: a PTR_TO_BTF_ID (or reg2btf_ids) register made the argument KF_ARG_PTR_TO_BTF_ID, otherwise it fell through to a memory buffer. Folding register state into argument classification prevents describing a kfunc's arguments from its BTF alone, which is a prerequisite for generating a helper-like prototype and eventually sharing the argument checking (check_func_arg()) between helpers and kfuncs. Classify pointer arguments from BTF only, and resolve them against the register in check_kfunc_args(): - A pointer to a struct that is not paired with a __sz/__szk size argument is classified KF_ARG_PTR_TO_BTF_ID and then checked against the register. A register carrying a BTF ID (PTR_TO_BTF_ID or a reg2btf_ids type) must be referenced or trusted and is matched against the expected type. The only relaxation is when the struct is composed of scalars, the register may be verified as a fixed-size memory buffer sized from the BTF type; anything else is rejected. - A pointer paired with a size argument is always a memory buffer and is never classified as BTF_ID, so the __sz/__szk case no longer detours through BTF_ID. The new design now accepts one previously rejected case: passing PTR_TO_BTF_ID to a pointer to scalar w/o a following __sz/__szk. The argument will be classified as KF_ARG_PTR_TO_MEM | MEM_FIXED_SIZE. The PTR_TO_BTF_ID register will go through check_mem_reg() -> check_helper_mem_access() -> check_ptr_to_btf_access(). For a pointer to scalar arg, a kernel btf id will be rejected unless explicitly granted by btf_struct_access(); a program allocated btf id will be allowed. The referenced-or-trusted check thus moves into the KF_ARG_PTR_TO_BTF_ID resolution, alongside the type match. get_kfunc_ptr_arg_type() no longer needs the register, so drop its regs and reg parameters; it is now a pure function of the kfunc's BTF. When a register cannot satisfy a BTF_ID argument, report the register type passed and, when the expected struct has a reg2btf_ids mapping, the register type that would be accepted, instead of a confusing "socket". Update the affected selftest messages accordingly. Signed-off-by: Amery Hung <ameryhung@gmail.com> Link: https://lore.kernel.org/bpf/20260801074633.1595644-16-ameryhung@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>