summaryrefslogtreecommitdiff
path: root/tools
AgeCommit message (Collapse)AuthorFilesLines
2026-03-09docs: kdoc_output: use a method to emit the .TH headerMauro Carvalho Chehab1-8/+26
All man emit functions need to add a .TH header. Move the code to a common function, as we'll be addressing some issues at the common code. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <2e55fcfe8724fde08a78635a1a3f8b449a6adf82.1772810752.git.mchehab+huawei@kernel.org>
2026-03-09docs: sphinx-build-wrapper: don't allow "/" on file namesMauro Carvalho Chehab1-1/+3
When handling "DOC:" sections, slash characters may be there. Prevent using it at the file names, as this is used for directory separator. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <c1a83a50b0659a5bcf68ef14f9457cc188e91e3a.1772810752.git.mchehab+huawei@kernel.org>
2026-03-09docs: sphinx-build-wrapper: better handle troff .TH markupsMauro Carvalho Chehab1-4/+4
Using a regular expression to match .TH is problematic, as it doesn't handle well quotation marks. Use shlex instead. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <9436806316d33aaf68625c00ce068463d3917660.1772810752.git.mchehab+huawei@kernel.org>
2026-03-09tracing: selftests: Add trace remote testsVincent Donnefort6-0/+498
Exercise the tracefs interface for trace remote with a set of tests to check: * loading/unloading (unloading.tc) * reset (reset.tc) * size changes (buffer_size.tc) * consuming read (trace_pipe.tc) * non-consuming read (trace.tc) Cc: Shuah Khan <skhan@linuxfoundation.org> Cc: linux-kselftest@vger.kernel.org Link: https://patch.msgid.link/20260309162516.2623589-16-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-03-09selftests/bpf: Move sleepable refcounted_kptr tests to syscallsViktor Malik2-3/+3
Now that sleepable programs are always enabled on syscalls, let refcounted_kptr tests use syscalls rather than bpf_testmod_test_read, which is not sleepable with error injection disabled. The tests just check that the verifier can handle usage of RCU locks in sleepable programs and never actually attach. So, the attachment target doesn't matter (as long as it is sleepable) and with syscalls, the tests pass on kernels with disabled error injection. Signed-off-by: Viktor Malik <vmalik@redhat.com> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/8b6626eae384559855f7a0e846a16e83f25f06f6.1773055375.git.vmalik@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-09docs: kdoc_files: document KernelFiles() ABIMauro Carvalho Chehab1-1/+43
The KernelFiles is the main entry point to run kernel-doc, being used by both tools/docs/kernel-doc and Documentation/sphinx/kerneldoc.py. It is also used on QEMU, which also uses the kernel-doc libraries from tools/lib/python/kdoc. Properly describe its ABI contract. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <13eb44c341232564eaf2a9c9de4782369fef57e1.1772810574.git.mchehab+huawei@kernel.org>
2026-03-09docs: kdoc_files: allows the caller to use a different xforms classMauro Carvalho Chehab1-2/+7
While the main goal for kernel-doc is to be used inside the Linux Kernel, other open source projects could benefit for it. That's currently the case of QEMU, which has a fork, mainly due to two reasons: - they need an extra C function transform rule; - they handle the html output a little bit different. Add an extra optional argument to make easier for the code to be shared, as, with that, QEMU can just create a new derivated class that will contain its specific rulesets, and just copy the remaining kernel-doc files as-is. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <6b274ddbdcd9d438c6848e00e410a2f65ef80ec2.1772810574.git.mchehab+huawei@kernel.org>
2026-03-09tools/docs/checktransupdate.py: add support for scanning directoryHaoyang LIU1-1/+13
Origin script can only accept a file as parameter, this commit enables it to scan a directory. Usage example: ./scripts/checktransupdate.py Documentation/translations/zh_CN/dev-tools And it will output something like: """ [1772967203.351603] Documentation/translations/zh_CN/dev-tools/kmemleak.rst [1772967205.074201] commit 7591c127f3b1 ("kmemleak: iommu/iova: fix transient kmemleak false positive") [1772967205.074337] 1 commits needs resolving in total [1772967205.301705] Documentation/translations/zh_CN/dev-tools/index.rst [1772967206.912395] commit a592a36e4937 ("Documentation: use a source-read extension for the index link boilerplate") [1772967206.921424] commit 6eac13c87680 ("Documentation: dev-tools: add container.rst page") [1772967206.930220] commit 8f32441d7a53 ("Documentation: Add documentation for Compiler-Based Context Analysis") [1772967206.939002] commit 1e9ddbb2cd34 ("docs: Pull LKMM documentation into dev-tools book") [1772967206.948636] commit d5af79c05e93 ("Documentation: move dev-tools debugging files to process/debugging/") [1772967206.957562] commit d5dc95836147 ("kbuild: Add Propeller configuration for kernel build") [1772967206.966255] commit 315ad8780a12 ("kbuild: Add AutoFDO support for Clang build") [1772967206.966410] 7 commits needs resolving in total """ Signed-off-by: Haoyang LIU <tttturtleruss@gmail.com> [jc: tweaked coding style] Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260308111314.27333-1-tttturtleruss@gmail.com>
2026-03-09objtool: Fix another stack overflow in validate_branch()Josh Poimboeuf1-5/+5
The insn state is getting saved on the stack twice for each recursive iteration. No need for that, once is enough. Fixes the following reported stack overflow: drivers/scsi/qla2xxx/qla_dbg.o: error: SIGSEGV: objtool stack overflow! Segmentation fault Fixes: 70589843b36f ("objtool: Add option to trace function validation") Reported-by: Arnd Bergmann <arnd@arndb.de> Closes: https://lore.kernel.org/90956545-2066-46e3-b547-10c884582eb0@app.fastmail.com Link: https://patch.msgid.link/8b97f62d083457f3b0a29a424275f7957dd3372f.1772821683.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
2026-03-09objtool: Handle Clang RSP musical chairsJosh Poimboeuf2-39/+37
For no apparent reason (possibly related to CONFIG_KMSAN), Clang can randomly pass the value of RSP to other registers and then back again to RSP. Handle that accordingly. Fixes the following warnings: drivers/input/misc/uinput.o: warning: objtool: uinput_str_to_user+0x165: undefined stack state drivers/input/misc/uinput.o: warning: objtool: uinput_str_to_user+0x165: unknown CFA base reg -1 Reported-by: Arnd Bergmann <arnd@arndb.de> Closes: https://lore.kernel.org/90956545-2066-46e3-b547-10c884582eb0@app.fastmail.com Link: https://patch.msgid.link/240e6a172cc73292499334a3724d02ccb3247fc7.1772818491.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
2026-03-09ktest: Add a --dry-run modeRicardo B. Marlière1-26/+63
When working on a ktest configuration, it is often useful to inspect the final option values after includes, defaults, per-test overrides, and variable expansion have been applied, without actually starting a test run. Add a --dry-run option that reads the configuration, prints the test preamble using resolved option values, and exits before opening LOG_FILE or executing any test logic. This is useful for debugging ktest configurations and for scripts that need to validate the final resolved settings without triggering side effects. Cc: John Hawley <warthog9@eaglescrag.net> Cc: Andrea Righi <arighi@nvidia.com> Cc: Marcos Paulo de Souza <mpdesouza@suse.com> Cc: Matthieu Baerts <matttbe@kernel.org> Cc: Fernando Fernandez Mancera <fmancera@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Link: https://patch.msgid.link/20260307-ktest-fixes-v1-9-565d412f4925@suse.com Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-03-09ktest: Run POST_KTEST hooks on failure and cancellationRicardo B. Marlière1-5/+22
PRE_KTEST can be useful for setting up the environment and POST_KTEST to tear it down, however POST_KTEST only runs on the normal end-of-run path. It is skipped when ktest exits through dodie() or cancel_test(). Final cleanup hooks are skipped. Factor the final hook execution into run_post_ktest(), call it from the normal exit path and from the early exit paths, and guard it so the hook runs at most once. Cc: John Hawley <warthog9@eaglescrag.net> Cc: Andrea Righi <arighi@nvidia.com> Cc: Marcos Paulo de Souza <mpdesouza@suse.com> Cc: Matthieu Baerts <matttbe@kernel.org> Cc: Fernando Fernandez Mancera <fmancera@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Link: https://patch.msgid.link/20260307-ktest-fixes-v1-8-565d412f4925@suse.com Fixes: 921ed4c7208e ("ktest: Add PRE/POST_KTEST and TEST options") Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-03-09ktest: Add PRE_KTEST_DIE for PRE_KTEST failuresRicardo B. Marlière2-1/+13
PRE_KTEST runs before the first test, but its return status is currently ignored. A failing setup hook can leave the rest of the run executing in a partially initialized environment. Add PRE_KTEST_DIE so PRE_KTEST can fail the run in the same way PRE_BUILD_DIE and PRE_TEST_DIE already can. Keep the default behavior unchanged when the new option is not set. Cc: John Hawley <warthog9@eaglescrag.net> Cc: Andrea Righi <arighi@nvidia.com> Cc: Marcos Paulo de Souza <mpdesouza@suse.com> Cc: Matthieu Baerts <matttbe@kernel.org> Cc: Fernando Fernandez Mancera <fmancera@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Link: https://patch.msgid.link/20260307-ktest-fixes-v1-7-565d412f4925@suse.com Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-03-09ktest: Stop dropping console output during power-cycle rebootRicardo B. Marlière1-5/+6
The POWER_CYCLE fallback added to reboot() flushes monitor output at the wrong time. In the untimed reboot path, flushing immediately after start_monitor() can consume the first output from the new boot before monitor() begins reading it. In the timed path, flushing after POWER_CYCLE can eat the "Linux version" banner or REBOOT_SUCCESS_LINE from the new kernel. That makes ktest miss the boot it is waiting for and can trigger an unnecessary second power cycle. Start the monitor before POWER_CYCLE so the reference counting stays balanced, but only flush when reboot() was asked to wait for a timed reboot. Perform that flush before issuing POWER_CYCLE so it drains stale output from the old kernel instead of consuming the next boot. Cc: John Hawley <warthog9@eaglescrag.net> Cc: Andrea Righi <arighi@nvidia.com> Cc: Marcos Paulo de Souza <mpdesouza@suse.com> Cc: Matthieu Baerts <matttbe@kernel.org> Cc: Fernando Fernandez Mancera <fmancera@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Link: https://patch.msgid.link/20260307-ktest-fixes-v1-6-565d412f4925@suse.com Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-03-09ktest: Run commands through list-form shell openRicardo B. Marlière1-1/+4
run_command() currently uses string-form open(): open(CMD, "$command 2>&1 |") That delegates parsing to the shell but also mixes the stderr redirection into the command string. Switch to list-form open() with an explicit sh -c wrapper so shell syntax errors are captured in the same output stream as command output. Otherwise, important errors can not be retrieved from the ktest LOG_FILE. Cc: John Hawley <warthog9@eaglescrag.net> Cc: Andrea Righi <arighi@nvidia.com> Cc: Marcos Paulo de Souza <mpdesouza@suse.com> Cc: Matthieu Baerts <matttbe@kernel.org> Cc: Fernando Fernandez Mancera <fmancera@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Link: https://patch.msgid.link/20260307-ktest-fixes-v1-5-565d412f4925@suse.com Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-03-09ktest: Honor empty per-test option overridesRicardo B. Marlière1-2/+4
A per-test override can clear an inherited default option by assigning an empty value, but __set_test_option() still used option_defined() to decide whether a per-test key existed. That turned an empty per-test assignment back into "fall back to the default", so tests still could not clear inherited settings. For example: DEFAULTS (...) LOG_FILE = /tmp/ktest-empty-override.log CLEAR_LOG = 1 ADD_CONFIG = /tmp/.config TEST_START TEST_TYPE = build BUILD_TYPE = nobuild ADD_CONFIG = This would run the test with ADD_CONFIG[1] = /tmp/.config Fix by checking whether the per-test key exists before falling back. If it does exist but is empty, treat it as unset for that test and stop the fallback chain there. Cc: John Hawley <warthog9@eaglescrag.net> Cc: Andrea Righi <arighi@nvidia.com> Cc: Marcos Paulo de Souza <mpdesouza@suse.com> Cc: Matthieu Baerts <matttbe@kernel.org> Cc: Fernando Fernandez Mancera <fmancera@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Link: https://patch.msgid.link/20260307-ktest-fixes-v1-4-565d412f4925@suse.com Fixes: 22c37a9ac49d ("ktest: Allow tests to undefine default options") Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-03-09ktest: Treat undefined self-reference as emptyRicardo B. Marlière1-0/+8
Config variables are expanded when they are assigned. A first-time append such as: VAR := ${VAR} foo leaves the literal ${VAR} in the stored value because VAR has not been defined yet. Later expansions then carry the self-reference forward instead of behaving like an empty prefix. Drop an unescaped self-reference when the variable has no current value, and trim the outer whitespace left behind. Keep escaped \${VAR} references unchanged so literal text still works. Cc: John Hawley <warthog9@eaglescrag.net> Cc: Andrea Righi <arighi@nvidia.com> Cc: Marcos Paulo de Souza <mpdesouza@suse.com> Cc: Matthieu Baerts <matttbe@kernel.org> Cc: Fernando Fernandez Mancera <fmancera@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Link: https://patch.msgid.link/20260307-ktest-fixes-v1-3-565d412f4925@suse.com Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-03-09ktest: Resolve LOG_FILE in test option contextRicardo B. Marlière1-1/+1
LOG_FILE is expanded immediately after the config file is parsed with eval_option(..., -1). That uses the default context, not the same option resolution path used for tests. If LOG_FILE depends on options that are finalized per test, it can be resolved from stale values before the first test starts. Resolve LOG_FILE through set_test_option("LOG_FILE", 1) instead so it uses the same expansion rules as the rest of the test options. Cc: John Hawley <warthog9@eaglescrag.net> Cc: Andrea Righi <arighi@nvidia.com> Cc: Marcos Paulo de Souza <mpdesouza@suse.com> Cc: Matthieu Baerts <matttbe@kernel.org> Cc: Fernando Fernandez Mancera <fmancera@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Link: https://patch.msgid.link/20260307-ktest-fixes-v1-2-565d412f4925@suse.com Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-03-09ktest: Avoid undef warning when WARNINGS_FILE is unsetRicardo B. Marlière1-1/+1
check_buildlog() probes $warnings_file with -f even when WARNINGS_FILE is not configured. Perl warns about the uninitialized value and adds noise to the test log, which can hide the output we actually care about. Check that WARNINGS_FILE is defined before testing whether the file exists. Cc: John Hawley <warthog9@eaglescrag.net> Cc: Andrea Righi <arighi@nvidia.com> Cc: Marcos Paulo de Souza <mpdesouza@suse.com> Cc: Matthieu Baerts <matttbe@kernel.org> Cc: Fernando Fernandez Mancera <fmancera@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Link: https://patch.msgid.link/20260307-ktest-fixes-v1-1-565d412f4925@suse.com Fixes: 4283b169abfb ("ktest: Add make_warnings_file and process full warnings") Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-03-09tools/rtla: Remove unneeded nr_cpus from for_each_monitored_cpuCosta Shulyupin6-21/+20
nr_cpus does not change at runtime, so passing it through the macro argument is unnecessary. Remove the argument and use the global nr_cpus instead. Signed-off-by: Costa Shulyupin <costa.shul@redhat.com> Link: https://lore.kernel.org/r/20260306194953.2511960-5-costa.shul@redhat.com Signed-off-by: Tomas Glozar <tglozar@redhat.com>
2026-03-09tools/rtla: Remove unneeded nr_cpus membersCosta Shulyupin5-50/+38
nr_cpus does not change at runtime, so keeping it in struct members is unnecessary. Use the global nr_cpus instead of struct members. Signed-off-by: Costa Shulyupin <costa.shul@redhat.com> Link: https://lore.kernel.org/r/20260306194953.2511960-4-costa.shul@redhat.com Signed-off-by: Tomas Glozar <tglozar@redhat.com>
2026-03-09tools/rtla: Remove unneeded nr_cpus argumentsCosta Shulyupin7-51/+34
nr_cpus does not change at runtime, so passing it through function arguments is unnecessary. Use the global nr_cpus instead of propagating it via parameters. Signed-off-by: Costa Shulyupin <costa.shul@redhat.com> Link: https://lore.kernel.org/r/20260306194953.2511960-3-costa.shul@redhat.com Signed-off-by: Tomas Glozar <tglozar@redhat.com>
2026-03-09tools/rtla: Consolidate nr_cpus usage across all toolsCosta Shulyupin12-60/+29
sysconf(_SC_NPROCESSORS_CONF) (via get_nprocs_conf) reflects cpu_possible_mask, which is fixed at boot time, so querying it repeatedly is unnecessary. Replace multiple calls to sysconf(_SC_NPROCESSORS_CONF) with a single global nr_cpus variable initialized once at startup. `#pragma once` in timerlat_u.h is needed for pre-C23 compilers to avoid redefinition errors. Signed-off-by: Costa Shulyupin <costa.shul@redhat.com> Link: https://lore.kernel.org/r/20260306194953.2511960-2-costa.shul@redhat.com Signed-off-by: Tomas Glozar <tglozar@redhat.com>
2026-03-08Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.0-rc3Alexei Starovoitov58-283/+1160
Cross-merge BPF and other fixes after downstream PR. No conflicts. Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-07tools/sched_ext/include: Regenerate enum_defs.autogen.hTejun Heo1-12/+37
Regenerate enum_defs.autogen.h from the current vmlinux.h to pick up new SCX enums added in the for-7.1 cycle. Signed-off-by: Tejun Heo <tj@kernel.org> Acked-by: Andrea Righi <arighi@nvidia.com>
2026-03-07tools/sched_ext/include: Add libbpf version guard for assoc_struct_opsTejun Heo1-6/+29
Extract the inline bpf_program__assoc_struct_ops() call in SCX_OPS_LOAD() into a __scx_ops_assoc_prog() helper and wrap it with a libbpf >= 1.7 version guard. bpf_program__assoc_struct_ops() was added in libbpf 1.7; the guard provides a no-op fallback for older versions. Add the <bpf/libbpf.h> include needed by the helper, and fix "assumming" typo in a nearby comment. Signed-off-by: Tejun Heo <tj@kernel.org> Acked-by: Andrea Righi <arighi@nvidia.com>
2026-03-07tools/sched_ext/include: Add __COMPAT_HAS_scx_bpf_select_cpu_and macroTejun Heo1-0/+8
scx_bpf_select_cpu_and() is now an inline wrapper so bpf_ksym_exists(scx_bpf_select_cpu_and) no longer works. Add __COMPAT_HAS_scx_bpf_select_cpu_and macro that checks for either the struct args type (new) or the compat ksym (old) to test availability. Signed-off-by: Tejun Heo <tj@kernel.org> Acked-by: Andrea Righi <arighi@nvidia.com>
2026-03-07tools/sched_ext/include: Add missing helpers to common.bpf.hTejun Heo1-0/+277
Sync several helpers from the scx repo: - bpf_cgroup_acquire() ksym declaration - __sink() macro for hiding values from verifier precision tracking - ctzll() count-trailing-zeros implementation - get_prandom_u64() helper - scx_clock_task/pelt/virt/irq() clock helpers with get_current_rq() Signed-off-by: Tejun Heo <tj@kernel.org> Acked-by: Andrea Righi <arighi@nvidia.com>
2026-03-07tools/sched_ext/include: Sync bpf_arena_common.bpf.h with scx repoTejun Heo1-2/+6
Sync the following changes from the scx repo: - Guard __arena define with #ifndef to avoid redefinition when the attribute is already defined by another header. - Add bpf_arena_reserve_pages() and bpf_arena_mapping_nr_pages() ksym declarations. - Rename TEST to SCX_BPF_UNITTEST to avoid collision with generic TEST macros in other projects. Signed-off-by: Tejun Heo <tj@kernel.org> Acked-by: Andrea Righi <arighi@nvidia.com>
2026-03-07tools/sched_ext/include: Remove dead sdt_task_defs.h guard from common.hTejun Heo1-4/+0
The __has_include guard for sdt_task_defs.h is vestigial — the only remaining content is the bpf_arena_common.h include which is available unconditionally. Remove the dead guard. Signed-off-by: Tejun Heo <tj@kernel.org> Acked-by: Andrea Righi <arighi@nvidia.com>
2026-03-07Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds8-56/+231
Pull bpf fixes from Alexei Starovoitov: - Fix u32/s32 bounds when ranges cross min/max boundary (Eduard Zingerman) - Fix precision backtracking with linked registers (Eduard Zingerman) - Fix linker flags detection for resolve_btfids (Ihor Solodrai) - Fix race in update_ftrace_direct_add/del (Jiri Olsa) - Fix UAF in bpf_trampoline_link_cgroup_shim (Lang Xu) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: resolve_btfids: Fix linker flags detection selftests/bpf: add reproducer for spurious precision propagation through calls bpf: collect only live registers in linked regs Revert "selftests/bpf: Update reg_bound range refinement logic" selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary bpf: Fix u32/s32 bounds when ranges cross min/max boundary bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim ftrace: Add missing ftrace_lock to update_ftrace_direct_add/del
2026-03-07Merge tag 'rcu-fixes.v7.0-20260307a' of ↵Linus Torvalds17-18/+39
git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux Pull RCU selftest fixes from Boqun Feng: "Fix a regression in RCU torture test pre-defined scenarios caused by commit 7dadeaa6e851 ("sched: Further restrict the preemption modes") which limits PREEMPT_NONE to architectures that do not support preemption at all and PREEMPT_VOLUNTARY to those architectures that do not yet have PREEMPT_LAZY support. Since major architectures (e.g. x86 and arm64) no longer support CONFIG_PREEMPT_NONE and CONFIG_PREEMPT_VOLUNTARY, using them in rcutorture, rcuscale, refscale, and scftorture pre-defined scenarios causes config checking errors. Switch these kconfigs to PREEMPT_LAZY" * tag 'rcu-fixes.v7.0-20260307a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: scftorture: Update due to x86 not supporting none/voluntary preemption refscale: Update due to x86 not supporting none/voluntary preemption rcuscale: Update due to x86 not supporting none/voluntary preemption rcutorture: Update due to x86 not supporting none/voluntary preemption
2026-03-07tools/workqueue/wq_dump.py: add NODE prefix to all node columnsBreno Leitao1-6/+1
Previously only the first node column showed "NODE 0" while subsequent columns showed just the bare node number, making it unclear what the numbers refer to. Add the "NODE" prefix to all node columns and remove the now-unnecessary first/else branching. Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-03-07tools/workqueue/wq_dump.py: fix column alignment in node_nr/max_active sectionBreno Leitao1-7/+7
On larger machines with many CPUs, max_active values such as 2048 exceed the hardcoded minimum field width of 3 characters, causing the header and data columns to misalign. Widen the format specifiers to accommodate 4-digit values and right-align each nr/max as a single string to keep the output compact. Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-03-07tools/workqueue/wq_dump.py: remove backslash separator from ↵Breno Leitao1-1/+1
node_nr/max_active header Remove the backslash separator between the workqueue name and the data columns in the "Unbound workqueue -> node_nr/max_active" header for cleaner output. Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-03-07resolve_btfids: Fix linker flags detectionIhor Solodrai2-2/+8
The "|| echo -lzstd" default makes zstd an unconditional link dependency of resolve_btfids. On systems where libzstd-dev is not installed and pkg-config fails, the linker fails: ld: cannot find -lzstd: No such file or directory libzstd is a transitive dependency of libelf, so the -lzstd flag is strictly necessary only for static builds [1]. Remove ZSTD_LIBS variable, and instead set LIBELF_LIBS depending on whether the build is static or not. Use $(HOSTPKG_CONFIG) as primary source of the flags list. Also add a default value for HOSTPKG_CONFIG in case it's not built via the toplevel Makefile. Pass it from selftests/bpf too. [1] https://lore.kernel.org/bpf/4ff82800-2daa-4b9f-95a9-6f512859ee70@linux.dev/ Reported-by: BPF CI Bot (Claude Opus 4.6) <bot+bpf-ci@kernel.org> Reported-by: Vitaly Chikunov <vt@altlinux.org> Closes: https://lore.kernel.org/bpf/aaWqMcK-2AQw5dx8@altlinux.org/ Fixes: 4021848a903e ("selftests/bpf: Pass through build flags to bpftool and resolve_btfids") Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Reviewed-by: Paul Chaignon <paul.chaignon@gmail.com> Link: https://lore.kernel.org/r/20260305014730.3123382-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-07sched_ext: Implement scx_bpf_dsq_reenq() for user DSQsTejun Heo1-2/+55
scx_bpf_dsq_reenq() currently only supports local DSQs. Extend it to support user-defined DSQs by adding a deferred re-enqueue mechanism similar to the local DSQ handling. Add per-cpu deferred_reenq_user_node/flags to scx_dsq_pcpu and deferred_reenq_users list to scx_rq. When scx_bpf_dsq_reenq() is called on a user DSQ, the DSQ's per-cpu node is added to the current rq's deferred list. process_deferred_reenq_users() then iterates the DSQ using the cursor helpers and re-enqueues each task. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-03-07sched_ext: Introduce scx_bpf_dsq_reenq() for remote local DSQ reenqueueTejun Heo3-4/+33
scx_bpf_reenqueue_local() can only trigger re-enqueue of the current CPU's local DSQ. Introduce scx_bpf_dsq_reenq() which takes a DSQ ID and can target any local DSQ including remote CPUs via SCX_DSQ_LOCAL_ON | cpu. This will be expanded to support user DSQs by future changes. scx_bpf_reenqueue_local() is reimplemented as a simple wrapper around scx_bpf_dsq_reenq(SCX_DSQ_LOCAL, 0) and may be deprecated in the future. Update compat.bpf.h with a compatibility shim and scx_qmap to test the new functionality. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-03-06selftests/bpf: add reproducer for spurious precision propagation through callsEduard Zingerman1-0/+64
Add a test for the scenario described in the previous commit: an iterator loop with two paths where one ties r2/r7 via shared scalar id and skips a call, while the other goes through the call. Precision marks from the linked registers get spuriously propagated to the call path via propagate_precision(), hitting "backtracking call unexpected regs" in backtrack_insn(). Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260306-linked-regs-and-propagate-precision-v1-2-18e859be570d@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-06bpf: collect only live registers in linked regsEduard Zingerman3-35/+63
Fix an inconsistency between func_states_equal() and collect_linked_regs(): - regsafe() uses check_ids() to verify that cached and current states have identical register id mapping. - func_states_equal() calls regsafe() only for registers computed as live by compute_live_registers(). - clean_live_states() is supposed to remove dead registers from cached states, but it can skip states belonging to an iterator-based loop. - collect_linked_regs() collects all registers sharing the same id, ignoring the marks computed by compute_live_registers(). Linked registers are stored in the state's jump history. - backtrack_insn() marks all linked registers for an instruction as precise whenever one of the linked registers is precise. The above might lead to a scenario: - There is an instruction I with register rY known to be dead at I. - Instruction I is reached via two paths: first A, then B. - On path A: - There is an id link between registers rX and rY. - Checkpoint C is created at I. - Linked register set {rX, rY} is saved to the jump history. - rX is marked as precise at I, causing both rX and rY to be marked precise at C. - On path B: - There is no id link between registers rX and rY, otherwise register states are sub-states of those in C. - Because rY is dead at I, check_ids() returns true. - Current state is considered equal to checkpoint C, propagate_precision() propagates spurious precision mark for register rY along the path B. - Depending on a program, this might hit verifier_bug() in the backtrack_insn(), e.g. if rY ∈ [r1..r5] and backtrack_insn() spots a function call. The reproducer program is in the next patch. This was hit by sched_ext scx_lavd scheduler code. Changes in tests: - verifier_scalar_ids.c selftests need modification to preserve some registers as live for __msg() checks. - exceptions_assert.c adjusted to match changes in the verifier log, R0 is dead after conditional instruction and thus does not get range. - precise.c adjusted to match changes in the verifier log, register r9 is dead after comparison and it's range is not important for test. Reported-by: Emil Tsalapatis <emil@etsalapatis.com> Fixes: 0fb3cf6110a5 ("bpf: use register liveness information for func_states_equal") Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260306-linked-regs-and-propagate-precision-v1-1-18e859be570d@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-06Merge tag 'kbuild-fixes-7.0-2' of ↵Linus Torvalds1-3/+5
git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: - Split out .modinfo section from ELF_DETAILS macro, as that macro may be used in other areas that expect to discard .modinfo, breaking certain image layouts - Adjust genksyms parser to handle optional attributes in certain declarations, necessary after commit 07919126ecfc ("netfilter: annotate NAT helper hook pointers with __rcu") - Include resolve_btfids in external module build created by scripts/package/install-extmod-build when it may be run on external modules - Avoid removing objtool binary with 'make clean', as it is required for external module builds * tag 'kbuild-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: Leave objtool binary around with 'make clean' kbuild: install-extmod-build: Package resolve_btfids if necessary genksyms: Fix parsing a declarator with a preceding attribute kbuild: Split .modinfo out from ELF_DETAILS
2026-03-06Merge tag 'arm64-fixes' of ↵Linus Torvalds1-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "The main changes are a fix to the way in which we manage the access flag setting for mappings using the contiguous bit and a fix for a hang on the kexec/hibernation path. Summary: - Fix kexec/hibernation hang due to bogus read-only mappings - Fix sparse warnings in our cmpxchg() implementation - Prevent runtime-const being used in modules, just like x86 - Fix broken elision of access flag modifications for contiguous entries on systems without support for hardware updates - Fix a broken SVE selftest that was testing the wrong instruction" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: selftest/arm64: Fix sve2p1_sigill() to hwcap test arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults arm64: make runtime const not usable by modules arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation arm64: Silence sparse warnings caused by the type casting in (cmp)xchg
2026-03-06selftests: net: make ovs-dpctl.py fail when pyroute2 is unsupportedAleksei Oladko1-1/+1
The pmtu.sh kselftest configures OVS using ovs-dpctl.py and falls back to ovs-vsctl only when ovs-dpctl.py fails. However, ovs-dpctl.py exits with a success status when the installed pyroute2 package version is lower than 0.6, even though the OVS datapath is not configured. As a result, pmtu.sh assumes that the setup was successful and continues running the test, which later fails due to the missing OVS configuration. Fix the exit code handling in ovs-dpctl.py so that pmtu.sh can detect that the setup did not complete successfully and fall back to ovs-vsctl. Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Link: https://patch.msgid.link/20260306000127.519064-3-aleksey.oladko@virtuozzo.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-06Revert "selftests/bpf: Update reg_bound range refinement logic"Eduard Zingerman1-14/+0
This reverts commit da653de268d32a80e135c9eb960a8147c186f1bc. Removed logic is now covered by range_refine_in_halves() which handles both 32-bit and 64-bit refinements. Suggested-by: Paul Chaignon <paul.chaignon@gmail.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260306-bpf-32-bit-range-overflow-v3-3-f7f67e060a6b@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-06selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundaryEduard Zingerman1-1/+38
Two test cases for signed/unsigned 32-bit bounds refinement when s32 range crosses the sign boundary: - s32 range [S32_MIN..1] overlapping with u32 range [3..U32_MAX], s32 range tail before sign boundary overlaps with u32 range. - s32 range [-3..5] overlapping with u32 range [0..S32_MIN+3], s32 range head after the sign boundary overlaps with u32 range. This covers both branches added in the __reg32_deduce_bounds(). Also, crossing_32_bit_signed_boundary_2() no longer triggers invariant violations. Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Reviewed-by: Paul Chaignon <paul.chaignon@gmail.com> Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260306-bpf-32-bit-range-overflow-v3-2-f7f67e060a6b@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-06bpf: Fix u32/s32 bounds when ranges cross min/max boundaryEduard Zingerman1-4/+58
Same as in __reg64_deduce_bounds(), refine s32/u32 ranges in __reg32_deduce_bounds() in the following situations: - s32 range crosses U32_MAX/0 boundary, positive part of the s32 range overlaps with u32 range: 0 U32_MAX | [xxxxxxxxxxxxxx u32 range xxxxxxxxxxxxxx] | |----------------------------|----------------------------| |xxxxx s32 range xxxxxxxxx] [xxxxxxx| 0 S32_MAX S32_MIN -1 - s32 range crosses U32_MAX/0 boundary, negative part of the s32 range overlaps with u32 range: 0 U32_MAX | [xxxxxxxxxxxxxx u32 range xxxxxxxxxxxxxx] | |----------------------------|----------------------------| |xxxxxxxxx] [xxxxxxxxxxxx s32 range | 0 S32_MAX S32_MIN -1 - No refinement if ranges overlap in two intervals. This helps for e.g. consider the following program: call %[bpf_get_prandom_u32]; w0 &= 0xffffffff; if w0 < 0x3 goto 1f; // on fall-through u32 range [3..U32_MAX] if w0 s> 0x1 goto 1f; // on fall-through s32 range [S32_MIN..1] if w0 s< 0x0 goto 1f; // range can be narrowed to [S32_MIN..-1] r10 = 0; 1: ...; The reg_bounds.c selftest is updated to incorporate identical logic, refinement based on non-overflowing range halves: ((x ∩ [0, smax]) ∩ (y ∩ [0, smax])) ∪ ((x ∩ [smin,-1]) ∩ (y ∩ [smin,-1])) Reported-by: Andrea Righi <arighi@nvidia.com> Reported-by: Emil Tsalapatis <emil@etsalapatis.com> Closes: https://lore.kernel.org/bpf/aakqucg4vcujVwif@gpd4/T/ Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260306-bpf-32-bit-range-overflow-v3-1-f7f67e060a6b@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-06selftests: net: forwarding: fix IPv6 address leak in cleanupAleksei Oladko4-4/+4
Several forwarding tests (e.g., gre_multipath.sh) initialize both IPv4 and IPv6 addresses using simple_if_init, but only clean up IPv4 in simple_if_fini. This leaves stale IPv6 addresses on the interfaces, which causes subsequent tests to fail when they encounter unexpected address configuration. The issue can be reproduced by running tests in sequence: # run_kselftest.sh -t net/forwarding:ipip_hier_gre.sh # run_kselftest.sh -t net/forwarding:min_max_mtu.sh TAP version 13 1..1 # timeout set to 0 # selftests: net/forwarding: min_max_mtu.sh # TEST: ping [ OK ] # TEST: ping6 [ OK ] # TEST: Test maximum MTU configuration [ OK ] # TEST: Test traffic, packet size is maximum MTU [FAIL] # Ping6, packet size: 65487 succeeded, but should have failed # TEST: Test minimum MTU configuration [ OK ] # TEST: Test traffic, packet size is minimum MTU [ OK ] not ok 1 selftests: net/forwarding: min_max_mtu.sh # exit=1 Fix this by removing the unused IPv6 argument from simple_if_init in tests that don't use IPv6 (gre_multipath.sh, ipip_lib.sh), and by adding the missing IPv6 argument to simple_if_fini in tests that use IPv6 (gre_multipath_nh.sh, gre_multipath_nh_res.sh). Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260305211000.515301-1-aleksey.oladko@virtuozzo.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-06selftests: drv-net: iou-zcrx: wait for memory cleanup of probe runDragos Tatulea1-0/+1
The large chunks test does a probe run of iou-zcrx before it runs the actual test. After the probe run finishes, the context will still exist until the deferred io_uring teardown. When running iou-zcrx the second time, io_uring_register_ifq() can return -EEXIST due to the existence of the old context. The fix is simple: wait for the context teardown using the new mp_clear_wait() utility before running the second instance of iou-zcrx. Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com> Link: https://patch.msgid.link/20260305080446.897628-2-dtatulea@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-06selftests/net: Add netkit container ping testDavid Wei3-0/+33
Add a basic ping test using NetDrvContEnv that sets up a netkit pair, with one end in a netns. Use LOCAL_PREFIX_V6 and nk_forward BPF program to ping from a remote host to the netkit in netns. Signed-off-by: David Wei <dw@davidwei.uk> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://patch.msgid.link/20260305181803.2912736-5-dw@davidwei.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-06selftests/net: Add env for container based testsDavid Wei4-6/+253
Add an env NetDrvContEnv for container based selftests. This automates the setup of a netns, netkit pair with one inside the netns, and a BPF program that forwards skbs from the NETIF host inside the container. Currently only netkit is used, but other virtual netdevs e.g. veth can be used too. Expect netkit container datapath selftests to have a publicly routable IP prefix to assign to netkit in a container, such that packets will land on eth0. The BPF skb forward program will then forward such packets from the host netns to the container netns. Signed-off-by: David Wei <dw@davidwei.uk> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://patch.msgid.link/20260305181803.2912736-4-dw@davidwei.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>