summaryrefslogtreecommitdiff
path: root/tools
AgeCommit message (Collapse)Author
2026-05-12libbpf: Add syscall common attributes support for map_createLeon Hwang
With the previous commit adding common attribute support for BPF_MAP_CREATE, users can now retrieve detailed error messages when map creation fails via the log_buf field. Introduce struct bpf_log_opts with the following fields: log_buf, log_size, log_level, and log_true_size. Extend bpf_map_create_opts with a new field log_opts, allowing users to capture and inspect log messages on map creation failures. Acked-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/r/20260512153157.28382-8-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-12libbpf: Add support for extended BPF syscallLeon Hwang
To support the extended BPF syscall introduced in the previous commit, introduce the following internal APIs: * 'sys_bpf_ext()' * 'sys_bpf_ext_fd()' They wrap the raw 'syscall()' interface to support passing extended attributes. * 'probe_sys_bpf_ext()' Check whether current kernel supports the BPF syscall common attributes. Acked-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/r/20260512153157.28382-3-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-12bpf: Extend BPF syscall with common attributes supportLeon Hwang
Add generic BPF syscall support for passing common attributes. The initial set of common attributes includes: 1. 'log_buf': User-provided buffer for storing logs. 2. 'log_size': Size of the log buffer. 3. 'log_level': Log verbosity level. 4. 'log_true_size': Actual log size reported by kernel. The common-attribute pointer and its size are passed as the 4th and 5th syscall arguments. A new command bit, 'BPF_COMMON_ATTRS' ('1 << 16'), indicates that common attributes are supplied. This commit adds syscall and uapi plumbing. Command-specific handling is added in follow-up patches. Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/r/20260512153157.28382-2-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-12selftests/cgroup: check malloc return value in alloc_anon functionsHongfu Li
The alloc_anon() function calls malloc() without checking for a NULL return. If memory allocation fails, a NULL pointer dereference will occur when accessing the buffer. Add proper error handling to return -1 when malloc() fails in all four alloc_anon variants: - alloc_anon() - alloc_anon_50M_check() - alloc_anon_noexit() - alloc_anon_50M_check_swap() Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Reviewed-by: Vishal Moola <vishal.moola@gmail.com> Reviewed-by: Muchun Song <muchun.song@linux.dev> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-12tools: ynl: add scope qualifier for definitionsJakub Kicinski
Using definitions in kernel policies is awkward right now. On one hand we want defines for max values and such. On the other we don't have a way of adding kernel-only defines. Adding unnecessary defines to uAPI is a bad idea, we won't be able to delete them. And when it comes to policy user space should just query it via the policy dump, not use hard coded defines. Add a "scope" property to definitions, which will let us tell the codegen that a definition is for kernel use only. Support following values: - uapi: render into the uAPI header (default, today's behavior) - kernel: render to kernel header only - user: same as kernel but for the user-side generated header Definitions may have a header property (definition is "external", provided by existing header). Extend the scope to headers, too. If definition has both scope and header properties we will only generate the includes in the right scope. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20260510192904.3987113-8-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-12selftests: drv-net: add shaper test for duplicate leavesJakub Kicinski
Add test exercising duplicate leaves. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20260510192904.3987113-5-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-11x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cachePrathyushi Nangia
Make sure resources are not improperly shared in the op cache and cause instruction corruption this way. Signed-off-by: Prathyushi Nangia <prathyushi.nangia@amd.com> Co-developed-by: Borislav Petkov (AMD) <bp@alien8.de> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-05-11selftests: mptcp: pm: use simpler send/recv formsMatthieu Baerts (NGI0)
Instead of sendto() and recvfrom() which the NL address that was already provided before. Just simpler and easier to read without the to/from variants. While at it, fix a checkpatch warning by removing multiple assignments. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260508-net-next-mptcp-pm-inc-limits-v1-8-c84e3fdf9b6a@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-11selftests: mptcp: pm: validate new limitsMatthieu Baerts (NGI0)
These limits have been recently updated, from 8 to: - 64 for the subflows and accepted add_addr - 255 for the MPTCP endpoints These modifications validate the new limits, but are also compatible with the previous ones, to be able to continue to validate stable kernel using the last version of the selftests. That's why new variables are now used instead of hard-coded values. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260508-net-next-mptcp-pm-inc-limits-v1-7-c84e3fdf9b6a@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-11selftests: mptcp: join: validate 8x8 subflowsMatthieu Baerts (NGI0)
The limits have been recently increased, it is required to validate that having 64 subflows is allowed. Here, both the client and the server have 8 network interfaces. The server has 8 endpoints marked as 'signal' to announce all its v4 addresses. The client also has 8 endpoints, but marked as 'subflow' and 'fullmesh' in order to create 8 subflows to each address announced by the server. This means 63 additional subflows will be created after the initial one. If it is not possible to increase the limits to 64, it means an older kernel version is being used, and the test is skipped. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260508-net-next-mptcp-pm-inc-limits-v1-6-c84e3fdf9b6a@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-11selftests: mptcp: join: allow changing ifaces nr per testMatthieu Baerts (NGI0)
By default, 4 network interfaces are created per subtest in a dedicated net namespace. Each netns has a dedicated pair of v4 and v6 addresses. Future tests will need more. Simply always creating more network interfaces per test will increase the execution time for all other tests, for no other benefits. So now it is possible to change this number only when needed, by setting ifaces_nr when calling 'reset' and 'init_shapers', e.g. ifaces_nr=8 reset "Subtest title" ifaces_nr=8 init_shapers Note that it might also be interesting to decrease the default value to 2 to reduce the setup time, especially when a debug kernel config is being used. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260508-net-next-mptcp-pm-inc-limits-v1-5-c84e3fdf9b6a@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-12tools/bootconfig: render kernel.* subtree as cmdline string with -CBreno Leitao
Add a -C option that finds the "kernel" subtree of a bootconfig file and prints it as a flat, space-separated cmdline string by calling the shared xbc_snprint_cmdline() renderer. An empty or absent kernel.* subtree produces empty output and exits successfully. This lets the kernel build embed a bootconfig file as a plain cmdline string at build time, so embedded bootconfig values can reach parse_early_param() during architecture setup without parsing the bootconfig at runtime. The renderer is intentionally limited to the kernel.* subtree: that is the only thing the kernel build needs to embed; init.* and other subtrees keep going through the runtime parser. Example of this new mode: # cat /tmp/test.bconf kernel { foo = bar baz = "hello world" arr = 1, 2 } init.foo = nope # ./tools/bootconfig/bootconfig -C /tmp/test.bconf foo=bar baz="hello world" arr=1 arr=2 % Link: https://lore.kernel.org/all/20260508-bootconfig_using_tools-v1-2-1132219aa773@debian.org/ Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-05-11selftests/bpf: Use both hrtimer enqueue helpers in vmlinux testIhor Solodrai
The vmlinux selftest triggers nanosleep and checks that both kprobe and fentry programs observe the hrtimer enqueue path. After the hrtimer_start_expires_user() conversion [1], nanosleep reaches hrtimer_start_range_ns_user() instead of hrtimer_start_range_ns(). Hard-coding either symbol makes the test fail either on bpf tree or on linux-next [2]. Update the test to resolve the target symbol at runtime via libbpf_find_vmlinux_btf_id(). This is a nice example of how to modify a BPF program to work on both older and newer kernel revision. [1] https://lore.kernel.org/all/20260408114952.062400833@kernel.org/ [2] https://github.com/kernel-patches/bpf/actions/runs/25485909958/job/74782902203 Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/r/20260509005730.250956-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11Merge branch 'for-7.1-fixes' into for-7.2Tejun Heo
Pull to receive: 9a415cc53711 ("sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path") Conflicts with for-7.2's scx_task_iter_relock() rework. The fix moves put_task_struct(p) past scx_error(); for-7.2 still has it at the old position. Resolved by dropping the old one. Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-11selftests/bpf: Add XDP load-balancer benchmark run scriptPuranjay Mohan
Add a convenience script that runs all 24 XDP load-balancer scenarios and formats the results as a table with median, stddev, and p99 columns. ./benchs/run_bench_xdp_lb.sh Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20260427232313.1582588-8-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/bpf: Add XDP load-balancer benchmark driverPuranjay Mohan
Wire up the userspace side of the XDP load-balancer benchmark. 24 scenarios cover the full code-path matrix: TCP/UDP, IPv4/IPv6, cross-AF encap, LRU hit/miss/diverse/cold, consistent-hash bypass, SYN/RST flag handling, and early exits (unknown VIP, non-IP, ICMP, fragments, IP options). Before benchmarking each scenario validates correctness: the output packet is compared byte-for-byte against a pre-built expected packet and BPF map counters are checked against the expected values. Usage: sudo ./bench -a -w3 -p1 xdp-lb --scenario tcp-v4-lru-hit sudo ./bench xdp-lb --list-scenarios Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20260427232313.1582588-7-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/bpf: Add XDP load-balancer BPF programPuranjay Mohan
Add the BPF datapath for the XDP load-balancer benchmark, a simplified L4 load-balancer inspired by katran. The pipeline: L3/L4 parse -> VIP lookup -> per-CPU LRU connection table or consistent-hash fallback -> real server lookup -> per-VIP and per-real stats -> IPIP/IP6IP6 encapsulation. TCP SYN forces the consistent-hash path (skipping LRU); TCP RST skips LRU insert to avoid polluting the table. process_packet() is marked __noinline so that the BENCH_BPF_LOOP reset block (which strips encapsulation) operates on valid packet pointers after bpf_xdp_adjust_head(). Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20260427232313.1582588-6-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/bpf: Add XDP load-balancer common definitionsPuranjay Mohan
Add the shared header for the XDP load-balancer benchmark. This defines the data structures used by both the BPF program and userspace: flow_key, vip_definition, real_definition, and the stats/control structures. Also provides the encapsulation source-address helpers shared between the BPF datapath (for encap) and userspace (for building expected output packets used in validation). Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20260427232313.1582588-5-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/bpf: Add bpf-nop benchmark for timing overhead baselinePuranjay Mohan
Add a minimal benchmark that measures the overhead of the batch-timing infrastructure itself. The BPF program runs an empty BENCH_BPF_LOOP body (~1.5-2 ns/op), establishing the floor cost that all timing-library benchmarks include. [root@virtme-ng tools/testing/selftests/bpf]# sudo ./bench -a -p8 bpf-nop Setting up benchmark 'bpf-nop'... Benchmark 'bpf-nop' started. bpf-nop: median 1.82 ns/op, stddev 0.01, p99 1.86 (1754 samples) Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20260427232313.1582588-4-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/bpf: Add BPF batch-timing libraryPuranjay Mohan
Add a reusable timing library for BPF benchmarks that need to measure BPF program execution time. The BPF side (progs/bench_bpf_timing.bpf.h) provides per-CPU sample arrays and BENCH_BPF_LOOP(), a macro that brackets batch_iters iterations with bpf_ktime_get_ns() reads and records the elapsed time. One extra untimed iteration runs afterward for output validation. The userspace side (benchs/bench_bpf_timing.c) collects samples from the skeleton BSS, computes percentile statistics, and auto-calibrates batch_iters to target ~10 ms per batch. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20260427232313.1582588-3-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/bpf: Add bench_force_done() for early benchmark completionPuranjay Mohan
The bench framework waits for duration_sec to elapse before collecting results. Benchmarks that know exactly how many samples they need can call bench_force_done() to signal completion early, avoiding wasted wall-clock time. Also refactor collect_measurements() to reuse bench_force_done() instead of open-coding the same mutex/cond_signal sequence. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20260427232313.1582588-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11perf tool: Fix missing schedstat delegates and dont_split_sample_group in ↵Ian Rogers
delegate_tool delegate_tool was missing the delegate overrides for schedstat_cpu and schedstat_domain. As a result, when allocated with zalloc, these callbacks defaulted to NULL, causing a segmentation fault crash if any schedstat events were delivered during event processing. Fix this by adding delegate_schedstat_cpu and delegate_schedstat_domain via the CREATE_DELEGATE_OP2 macro, and ensuring delegate_tool__init correctly registers them. Additionally, delegate_tool__init completely omitted copying the dont_split_sample_group property from the delegate. This would cause wrapper tools to default the flag to false, which corrupts piped event processing (e.g., in perf inject) by triggering duplicate event deliveries on split sample values in deliver_sample_group(). Similarly, perf_tool__init() omitted the initialization of this boolean field. On stack-allocated tools that rely on this initializer (like intel-tpebs or __cmd_evlist), this could result in uninitialized stack garbage evaluating to true—silently dropping non-leader event members in deliver_sample_group(). Fix both issues by properly copying the field in delegate_tool__init and initializing it to false in perf_tool__init. Fixes: 6331b266935916bf ("perf tool: Add a delegate_tool that just delegates actions to another tool") Fixes: 79bcd34e0f3da39f ("perf inject: Fix leader sampling inserting additional samples") Assisted-by: Gemini-CLI:Google Gemini 3 Signed-off-by: Ian Rogers <irogers@google.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Gabriel Marin <gmx@google.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: James Clark <james.clark@linaro.org> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-11perf sched: Add missing mmap2 handler in timehistIan Rogers
perf_sched__timehist() registers event handlers for options using the sched->tool struct. It registers handlers for MMAP, COMM, EXIT, FORK, etc. but completely omits registering a handler for MMAP2 events. Failing to register both MMAP and MMAP2 handlers causes modern systems (which primarily output MMAP2 records) to silently drop VMA map mappings. This results in uninitialized machine/thread mapping structures, making it impossible to resolve shared library instruction pointers (IPs) to dynamic symbols/DSOs during timehist callchain analysis. Fix this by correctly registering perf_event__process_mmap2 in sched->tool inside perf_sched__timehist(). Fixes: 49394a2a24c78ce0 ("perf sched timehist: Introduce timehist command") Assisted-by: Gemini-CLI:Google Gemini 3 Signed-off-by: Ian Rogers <irogers@google.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: David Ahern <dsahern@gmail.com> Cc: Gabriel Marin <gmx@google.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: James Clark <james.clark@linaro.org> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-11perf sched stats: Fix segmentation faults, memory leaks, and stale pointers ↵Ian Rogers
in diff mode The patch addresses multiple segmentation fault vectors, out-of-bounds reads, and memory leaks in perf sched stats by adding bounds checks, NULL checks, proper error propagation, and robust memory cleanup. 1. In get_all_cpu_stats(), added assert(!list_empty(head)) to prevent unsafe list_first_entry() calls on empty lists, added a missing NULL check for summary_head->cpu_data allocation, and implemented a cleanup ladder using a temporary list to prevent memory leaks on error paths. 2. In free_schedstat(), fixed memory leaks by ensuring internal domain_data and cpu_data pointers are freed. 3. In show_schedstat_data(), fixed a stale pointer issue where ds2 retained its value from a previous iteration when dptr2 became NULL, and added proper propagation of errors from get_all_cpu_stats(). 4. Propagated show_schedstat_data() errors up to perf_sched__schedstat_diff() and perf_sched__schedstat_live() to prevent output corruption on failure. 5. In show_schedstat_data(), added NULL checks for cd_map1 and cd_map2 to gracefully handle invalid or empty data files. 6. Added parallel iteration termination checks using list_is_last() in show_schedstat_data() for both domain and CPU lists to safely terminate at the end of each list when files contain a different number of CPUs or domains. 7. Added CPU bounds checks (cs1->cpu >= nr1 and cs2->cpu >= nr2) in show_schedstat_data() to prevent out-of-bounds reads from cd_map1 and cd_map2 when comparing files from machines with different CPU counts. 8. Added NULL checks for cd_info1 and cd_info2 to prevent crashes when a CPU has data samples but no corresponding domain info in the header. 9. Added domain bounds checks (ds1->domain >= cd_info1->nr_domains and ds2->domain >= cd_info2->nr_domains) to prevent out-of-bounds array accesses in the domains array. 10. Added NULL checks for dinfo1 and dinfo2 in show_schedstat_data() to prevent crashes when a domain has no corresponding domain info. 11. Zero-initialized the perf_data array in perf_sched__schedstat_diff() to prevent stack garbage from causing perf_data_file__fd() to attempt to use a NULL fptr when use_stdio happened to be non-zero. Assisted-by: Gemini:gemini-3.1-pro-preview Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Ian Rogers <irogers@google.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Athira Rajeev <atrajeev@linux.ibm.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-11perf test: Fix "trace summary" test for musl-based systemsMartin Kaiser
The trace summary test calls /bin/true and filters for open, read and close events. These events are coming from shared library loads. On a musl system, the loader and libc may point to the same file. true needs only libc, no further shared libraries are loaded at startup. The test fails since no open, read and close events are captured. root@host:~# ldd /bin/true /lib/ld-musl-riscv64.so.1 (0x3fb8882000) libc.so => /lib/ld-musl-riscv64.so.1 (0x3fb8882000) root@host:~# file /lib/ld-musl-riscv64.so.1 /lib/ld-musl-riscv64.so.1: symbolic link to /usr/lib/libc.so root@host:~# strace -f /bin/true execve("/bin/true", ["/bin/true", ...], ... /* 18 vars */) = 1 set_tid_address(0x3fa1f7bf70) = 330 mprotect(0x2ad6b8e000, 12288, PROT_READ) = 0 exit_group(0) = ? +++ exited with 0 +++ Run "cat /dev/null" instead of "true". This creates the required events regardless of the C library and it works for cat from busybox or from coreutils. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Acked-by: Ian Rogers <irogers@google.com> Acked-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-11perf test: Fix sys_enter_openat event test for muslMartin Kaiser
The "syscalls:sys_enter_openat event fields" test calls openat(AT_FDCWD, "/etc/passwd", O_RDONLY | O_DIRECTORY) and verifies that the flags of the captured event are matching. This fails for musl, where the openat syscall wrapper always adds O_LARGEFILE. Update the check to allow for additional flags, the access mode flags must be unchanged. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Acked-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-11perf test: Fix nanosleep check in the ftrace testMartin Kaiser
The perf ftrace test case runs: perf ftrace profile --graph-opts depth=5 sleep 0.1 and checks that the output contains a *clock_nanosleep function with a count of 1. This fails on a risc-v system that uses musl as its C library. musl's nanosleep syscall wrapper uses either the nanosleep or the clock_nanosleep syscall. Filter for sys_*nanosleep to allow both syscalls. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Acked-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-11selftests/bpf: Add test for large offset bpf-to-bpf callYazhou Tang
Add a selftest to verify the verifier and JIT behavior when handling bpf-to-bpf calls with relative jump offsets exceeding the s16 boundary. The test utilizes an inline assembly block with ".rept 32765" to generate a massive dummy subprogram. By placing this padding between the main program and the target subprogram, it forces the verifier to process a bpf-to-bpf call where the imm field exceeds the s16 range. - When JIT is enabled, it asserts that the program is successfully loaded and executes correctly to return the expected value. Since the fix does not change the JIT behavior, the test passes whether the fix is applied or not. - When JIT is disabled, it also asserts that the program is successfully loaded and executes correctly to return the expected value 3. - Before the fix, the verifier rewrites the call instruction with a truncated offset (here 32768 -> -32768) and lets it pass. When the program is executed, the call instruction will go to a wrong target (the landing pad) instead of the intended subprogram, then return -1 and fail. - After the fix, the verifier correctly handles the large offset and allows it to pass. The program then executes correctly to return the expected value 3. Co-developed-by: Tianci Cao <ziye@zju.edu.cn> Signed-off-by: Tianci Cao <ziye@zju.edu.cn> Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com> Acked-by: Xu Kuohai <xukuohai@huawei.com> Link: https://lore.kernel.org/r/20260506094714.419842-4-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/namespaces: Skip efault tests when listns() is not availableRicardo B. Marlière
When listns() is not implemented the iterator child detects ENOSYS and exits cleanly with status PIDFD_SKIP before the parent has a chance to signal it. The parent sends SIGKILL (which is a harmless no-op at that point) and then calls waitpid(), obtaining a normal-exit status. The subsequent ASSERT_TRUE(WIFSIGNALED(status)) therefore fails, causing the three EFAULT-focused tests to report FAIL rather than SKIP on kernels that do not yet carry listns() support. After collecting the iterator's exit status, check whether it exited with PIDFD_SKIP and issue a SKIP verdict in that case, consistent with the behaviour of every other listns test that already handles ENOSYS correctly. Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Link: https://patch.msgid.link/20260407-selftests-namespaces_fixes-v1-3-59109909d88b@suse.com Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-05-11selftests/namespaces: Fix waitpid race in listns_efault_test cleanupRicardo B. Marlière
The efault tests spawn two categories of child processes: namespace children (each in its own mount namespace, for concurrent destruction) and an iterator child that calls listns() in a tight loop. The cleanup loop used waitpid(-1), which reaps any child in any order. If the iterator child exits early (e.g. because listns() returned ENOSYS) before all namespace children have been reaped, waitpid(-1) may consume it instead. The subsequent targeted waitpid(iter_pid) would then block indefinitely. Track the PIDs of the namespace children explicitly and use targeted waitpid() calls in the cleanup loop so the iterator child cannot be inadvertently reaped during namespace cleanup. Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Link: https://patch.msgid.link/20260407-selftests-namespaces_fixes-v1-2-59109909d88b@suse.com Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-05-11selftests/namespaces: Kill grandchild in nsid fixture teardownRicardo B. Marlière
The timens_separate and pidns_separate test cases fork a grandchild that calls pause(). FIXTURE_TEARDOWN only kills the direct child, which is the init process of the grandchild's namespace. Once the child (init) exits, the grandchild is reparented to the host init but remains alive and continues to hold the inherited write end of the test runner's TAP pipe open. tap_prefix never receives EOF and blocks indefinitely, hanging the entire test collection. Record the grandchild PID in the fixture struct so that teardown can send SIGKILL and reap it before dealing with the child. The grandchild must be reaped first because the child acts as its PID namespace init; killing the child first would kill the grandchild without giving us a chance to waitpid() it. Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Link: https://patch.msgid.link/20260407-selftests-namespaces_fixes-v1-1-59109909d88b@suse.com Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-05-11selftests/pid_namespace: compute pid_max test limits dynamicallyBjoern Doebel
The pid_max kselftest hardcodes pid_max values of 400 and 500, but the kernel enforces a minimum of PIDS_PER_CPU_MIN * num_possible_cpus(). On machines with many possible CPUs (e.g. nr_cpu_ids=128 yields a minimum of 1024), writing 400 or 500 to /proc/sys/kernel/pid_max returns EINVAL and all three tests fail. Compute these limits the same way as the kernel does and set outer_limit and inner_limit dynamically based on the result. Original test semantics are preserved (outer < inner, nested namespace capped by parent). Signed-off-by: Bjoern Doebel <doebel@amazon.com> Link: https://patch.msgid.link/20260422201151.3830506-1-doebel@amazon.com Reviewed-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> Assisted-by: Kiro:claude-opus-4.6 Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-05-10Merge branch 'for-7.1-fixes' into for-7.2Tejun Heo
Pull to receive dde2f938d02f ("cgroup/cpuset: move PF_EXITING check before __GFP_HARDWALL in cpuset_current_node_allowed()") as a dependency for an upcoming patch in the same function. Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-10selftests/cgroup: fix misleading debug message in test_cgfreezer_time_childTao Cui
The debug message says "Expect ctime <= ptime" when the test actually expects ctime > ptime (child's freeze time should exceed parent's, which is zero). Fix the message to match the actual expectation. Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-10selftests/cgroup: fix child process escaping to parent cleanup in ↵Tao Cui
test_cpucg_nice In test_cpucg_nice, the forked child process incorrectly jumps to the parent's cleanup label on cg_write failure. This causes the child to attempt cg_destroy on cgroups the parent is still using, and then return to main() to continue executing tests as if it were the parent. Replace goto cleanup with exit(EXIT_FAILURE) in the child process. Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-10selftests/cgroup: Add NULL check after malloc in cgroup_util.cHongfu Li
Add NULL checks after malloc() in three helper functions to prevent NULL pointer dereference on memory allocation failure. - cg_name() - cg_name_indexed() - cg_control() These functions allocate memory with malloc() but previously called snprintf() unconditionally, which would trigger undefined behavior if allocation fails. Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-10selftests/sched_ext: Fix build error in dequeue selftestAndrea Righi
Building the dequeue selftest with newer compilers (e.g., gcc 16) triggers the following error: dequeue.c:28:22: error: variable 'sum' set but not used The 'volatile' qualifier prevents the writes from being optimized away, but does not silence the unused variable 'sum' is indeed only written and never read. Consume 'sum' via an empty asm() with a register input constraint. This forces the compiler to keep the accumulated value (preserving the CPU stress loop) and avoiding the build error. Fixes: 658ad2259b3e ("selftests/sched_ext: Add test to validate ops.dequeue() semantics") Signed-off-by: Andrea Righi <arighi@nvidia.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-10selftests/cgroup: Fix string comparison in write_testHongfu Li
Use string comparison (!=) instead of numeric comparison (-ne) for cpuset values like "0-1". For example: $ [[ "0-1" != "2-3" ]] && echo "true" || echo "false" true $ [[ "0-1" -ne "2-3" ]] && echo "true" || echo "false" false Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-10selftests/cgroup: Fix cg_read_strcmp() empty string comparisonHongfu Li
cg_read_strcmp() allocated a buffer sized to strlen(expected) + 1, then passed it to read_text() which calls read(fd, buf, size-1). When comparing against an empty string (""), strlen("") = 0 gives a 1-byte buffer, and read() is asked to read 0 bytes. The file content is never actually read, so strcmp("", buf) always returns 0 regardless of the real content. This caused cg_test_proc_killed() to always report the cgroup as empty immediately, making OOM tests pass without verifying that processes were killed. Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-10Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.1-rc3Alexei Starovoitov
Cross-merge BPF and other fixes after downstream PR. Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-10selftests: rds: Disarm signal alarm on test completionAllison Henderson
A race in stop_pcaps is possible if the test completes and then times out while waiting for the tcpdump process to exit. The signal handler may fire again and needlessly call stop_pcap a second time. Fix this by disabling the alarm after normal test completion. Also if there are no tcpdump processes to wait on, stop_pcaps can just exit. This avoids misleading prints when there are no procs to collect dumps from. Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260507233213.556182-4-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10selftests: rds: Fix TAP-prefixed prints in check_gcov*Allison Henderson
This patch adds the # prefix to info and warning prints in the check_gcov* routines. Since these routines do not exit, as the other check_* routines do, the output here should be kept TAP compliant. Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260507233213.556182-3-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10selftests: rds: Fix stale log clean upAllison Henderson
Since rds self tests no longer has a default folder, users must specify a log collection folder if they want to collect logs. Currently the log folder is deleted and recreated, but this can be dangerous if the user exports RDS_LOG_DIR=/tmp or /var/log. This patch corrects the clean up to delete only rds log artifacts from the log folder, and further prefixes rds specific logs as rds* Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260507233213.556182-2-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10selftests: net: getsockopt_iter: cleanupBreno Leitao
Apply two cleanups suggested by Stanislav and bobby on the original selftest series: - Reorder local variable declarations into reverse christmas-tree order (longest line first). Because that ordering puts socklen_t optlen before the variable whose size it stores, the "optlen = sizeof(...)" initializer is moved out of the declaration to a plain assignment in the test body, as Stanislav suggested. - Add ASSERT_EQ(optlen, ...) on every error path so the value the kernel writes back to the userspace optlen is pinned down even when the syscall returns -1. With do_sock_getsockopt() now writing opt->optlen back to userspace unconditionally, asserting that the netlink/vsock error paths leave the original input length untouched guards against future regressions. Bobby Eshleman pointed out that SO_VM_SOCKETS_CONNECT_TIMEOUT_NEW/OLD return a sock_timeval-shaped payload (16 bytes on 64-bit), which is wider than the u64 case already covered. Add four tests that exercise this path: - connect_timeout_new_exact exact-size buffer - connect_timeout_new_oversize_clamped oversize buffer, clamped - connect_timeout_new_undersize undersize -> -EINVAL, optlen untouched - connect_timeout_old_exact exact-size buffer for OLD optname Suggested-by: Stanislav Fomichev <sdf@fomichev.me> Suggested-by: Bobby Eshleman <bobbyeshleman@meta.com> Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260507-getsock_two-v2-5-5873111d9c12@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10tools/ynl: add missing uapi header deps in Makefile.depsStanislav Fomichev
ethtool.h includes linux/typelimits.h which is a relatively new header not yet shipped in most distro kernel-header packages. Without the explicit entry, the build silently falls through to -idirafter. dev_energymodel.h is a new YNL family whose uapi header is not in system paths at all and was missing a CFLAGS entry entirely. Signed-off-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://patch.msgid.link/20260508204114.205896-2-sdf@fomichev.me Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-09Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds
Pull bpf fixes from Alexei Starovoitov: - Fix sk_local_storage diag dump via netlink (Amery Hung) - Fix off-by-one in arena direct-value access (Junyoung Jang) - Reject TCP_NODELAY in bpf-tcp congestion control (KaFai Wan) - Fix type confusion in bpf_*_sock() (Kuniyuki Iwashima) - Reject TX-only AF_XDP sockets (Linpu Yu) - Don't run arg-tracking analysis twice on main subprog (Paul Chaignon) - Fix NULL pointer dereference in bpf_sk_storage_clone and fib lookup (Weiming Shi) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Fix off-by-one boundary validation in arena direct-value access xskmap: reject TX-only AF_XDP sockets bpf: Don't run arg-tracking analysis twice on main subprog bpf: Free reuseport cBPF prog after RCU grace period. bpf: tcp: Fix type confusion in sol_tcp_sockopt(). bpf: tcp: Fix type confusion in bpf_skc_to_tcp6_sock(). bpf: tcp: Fix type confusion in bpf_skc_to_tcp_sock(). mptcp: bpf: Fix type confusion in bpf_mptcp_sock_from_subflow() selftest: bpf: Add test for bpf_tcp_sock() and RAW socket. bpf: tcp: Fix type confusion in bpf_tcp_sock(). tools/headers: Regenerate stddef.h to fix BPF selftests bpf: Fix sk_local_storage diag dumping uninitialized special fields bpf: Fix NULL pointer dereference in bpf_skb_fib_lookup() sockmap: Fix sk_psock_drop() race vs sock_map_{unhash,close,destroy}(). bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths selftests/bpf: Verify bpf-tcp-cc rejects TCP_NODELAY selftests/bpf: Test TCP_NODELAY in TCP hdr opt callbacks bpf: Reject TCP_NODELAY in bpf-tcp-cc bpf: Reject TCP_NODELAY in TCP header option callbacks
2026-05-08Merge tag 'sched-urgent-2026-05-09' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: - Fix spurious failures in rseq self-tests (Mark Brown) - Fix rseq rseq::cpu_id_start ABI regression due to TCMalloc's creative use of the supposedly read-only field The fix is to introduce a new ABI variant based on a new (larger) rseq area registration size, to keep the TCMalloc use of rseq backwards compatible on new kernels (Thomas Gleixner) - Fix wakeup_preempt_fair() for not waking up task (Vincent Guittot) - Fix s64 mult overflow in vruntime_eligible() (Zhan Xusheng) * tag 'sched-urgent-2026-05-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Fix wakeup_preempt_fair() for not waking up task sched/fair: Fix overflow in vruntime_eligible() selftests/rseq: Expand for optimized RSEQ ABI v2 rseq: Reenable performance optimizations conditionally rseq: Implement read only ABI enforcement for optimized RSEQ V2 mode selftests/rseq: Validate legacy behavior selftests/rseq: Make registration flexible for legacy and optimized mode selftests/rseq: Skip tests if time slice extensions are not available rseq: Revert to historical performance killing behaviour rseq: Don't advertise time slice extensions if disabled rseq: Protect rseq_reset() against interrupts rseq: Set rseq::cpu_id_start to 0 on unregistration selftests/rseq: Don't run tests with runner scripts outside of the scripts
2026-05-08selftests: net: Add protodown testsIdo Schimmel
Add a selftest for the protodown mechanism. Five test cases are included: 1. Basic protodown toggling: Verify that setting protodown on macvlan results in DOWN operational state and clearing it restores UP. 2. Same as the previous test case, but with vxlan. 3. Protodown reasons: Verify that protodown cannot be cleared while there are active protodown reasons, but can be cleared once all reasons are removed. 4. Protodown with lower device being toggled: Verify that toggling the lower device's carrier while protodown is on does not cause the macvlan to gain carrier. 5. Protodown with lower device down: Verify that toggling protodown while the lower device has no carrier does not cause the macvlan to gain carrier. Note that the last two test cases fail without "net: Do not turn on carrier when protodown is on" and "net: Do not unconditionally turn on carrier when turning off protodown": # ./protodown.sh TEST: Basic protodown on/off with macvlan [ OK ] TEST: Basic protodown on/off with vxlan [ OK ] TEST: Protodown reasons [ OK ] TEST: Protodown with lower device toggled [FAIL] Macvlan operational state is not DOWN despite protodown TEST: Protodown with lower device down [FAIL] Macvlan is not LOWERLAYERDOWN after clearing protodown Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260507105906.891817-5-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-08selftests: net: add tests for filtered dumps of page poolJakub Kicinski
Add tests for page pool dumps of a specific ifindex. Link: https://patch.msgid.link/20260506034821.1710113-2-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-08net: page_pool: support dumping pps of a specific ifindex via NetlinkJakub Kicinski
NIPA tries to make sure that HW tests don't modify system state. It saves the state of page pools, too. Now that I write this commit message I realize that this is impractical since page pool IDs and state will get legitimately changed by the tests. But I already spent a couple of hours implementing the filtering, so.. Link: https://patch.msgid.link/20260506034821.1710113-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-21 23:13:21 +0000