summaryrefslogtreecommitdiff
path: root/tools
AgeCommit message (Collapse)Author
2026-07-19selftests/bpf: Remove redundant config option from selftests fragmentsAlexis Lothoré (eBPF Foundation)
CONFIG_IPV6_SEG6_LWTUNNEL is currently enabled in each arch-specific config fragment for the BPF selftests. Commit 33a971d549d8 ("selftests/bpf: Add LWT encap tests for skb metadata") has enabled this config in the generic config as well, resulting in a small warning when configuring a kernel for selftests: $ cat tools/testing/selftests/bpf/{config,config.vm,config.x86_64}>.config $ make olddefconfig HOSTCC scripts/kconfig/conf.o HOSTCC scripts/kconfig/confdata.o HOSTLD scripts/kconfig/conf config:269:warning: override: reassigning to symbol IPV6_SEG6_LWTUNNEL # # configuration written to .config # Now that IPV6_SEG6_LWTUNNEL is set in the general config fragment, drop it from the arch-specific fragments. Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com> Link: https://lore.kernel.org/bpf/20260709-testing-fragments-v1-1-65244b0650ff@bootlin.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-19selftests/bpf: Add tests for memory usage for arenaJiayuan Chen
Allocate and free arena pages, both from BPF and via user-space fault-in, and check that the map's memlock in fdinfo tracks the number of pages that are actually populated. Like the other arena tests it runs serially. test: ./test_progs -a arena_mem_usage #5 arena_mem_usage:OK Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260717114117.350851-5-jiayuan.chen@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-19selftests/bpf: Run arena tests seriallyJiayuan Chen
Every arena reserves a 4GB kernel vmalloc region at creation, and on a KASAN build that eagerly populates ~512MB of shadow memory per arena. When several arena tests run in parallel their shadow adds up, exhausts the memory of a small CI VM and trips the OOM killer during map creation. Make the dedicated arena tests (arena_* and libarena*) serial so they no longer pile up in the parallel phase. That alone brings the peak number of live arenas back within the CI memory budget. A few other tests such as verifier_arena*, stream and compute_live_registers create an arena too, but they run inside shared RUN_TESTS()/RUN() suites, so turning them serial would drag many unrelated subtests along with them. Leave those as-is. Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260717114117.350851-4-jiayuan.chen@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-17perf build: Fix compiler errors with old capstoneNamhyung Kim
It seems RISCV was added in capstone version 5 (released Jul 2023). Unfortunately they are enum constants so cannot check with #ifdef but anyway we can define the symbols. Let's do it using the version number to avoid build errors. It'll fail at runtime though. util/capstone.c: In function 'e_machine_to_capstone': util/capstone.c:186:25: error: 'CS_ARCH_RISCV' undeclared (first use in this function); did you mean 'CS_ARCH_SYSZ'? 186 | *arch = CS_ARCH_RISCV; | ^~~~~~~~~~~~~ | CS_ARCH_SYSZ util/capstone.c:186:25: note: each undeclared identifier is reported only once for each function it appears in util/capstone.c:187:34: error: 'CS_MODE_RISCV64' undeclared (first use in this function); did you mean 'CS_MODE_MIPS64'? 187 | *mode |= (is64 ? CS_MODE_RISCV64 : CS_MODE_RISCV32) | CS_MODE_RISCVC; | ^~~~~~~~~~~~~~~ | CS_MODE_MIPS64 Also note that capstone renamed CS_MODE_RISCVC to CS_MODE_RISCV_C which would cause a different build failure on latest versions. It's reported in https://github.com/capstone-engine/capstone/issues/2977 so I think they will add compatibility layer to prevent the error. Fixes: 12c4737f55f2 ("perf capstone: Determine architecture from e_machine") Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-17perf ui hists: Fix NULL pointer array gap in add_script_opt()Ian Rogers
In add_script_opt(), the function unconditionally increments the optstr and act pointers for a second optional 'time' popup action before attempting to invoke add_script_opt_2(). If the first add_script_opt_2() call failed (for example, due to an asprintf allocation failure), this leaves a NULL pointer gap in the options array at the prior index. When ui__popup_menu() is later displayed, it dereferences this gap and crashes. Fix it by avoiding unconditional pointer increments. Only advance the optstr and act pointers if the first script addition actually succeeded, and safely attach the time parameter to the correct assigned action. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-17perf disasm: Fix potential NULL pointer dereference and use-after-free in ↵Ian Rogers
arch__find() In arch__find(), if the architecture's arch_new_fn[e_machine]() returns NULL, the error handling path attempts to read result->name, dereferencing a NULL pointer and crashing. At the same time, it invokes free(tmp) BEFORE updating the static global archs pointer to tmp. If the reallocarray() call moved the allocated block, the original archs pointer remained active but was freed. A subsequent call to arch__find() would then pass this dangling pointer into bsearch(), causing a use-after-free. Fix both by printing the numeric e_machine ID instead of result->name, and updating the static global archs pointer to tmp immediately after the successful reallocarray() invocation to safely retain the valid prior architectures. Closes: https://lore.kernel.org/linux-perf-users/20260709035721.9EE901F000E9@smtp.kernel.org/ Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-17perf ui hists: Include limits.h for PATH_MAX definitionIan Rogers
Looking at switch_data_file(), it uses the POSIX constant PATH_MAX. Omitting the explicit inclusion of limits.h can cause build failures on musl libc systems, which do not implicitly include headers in the same way glibc does. Fix this by explicitly including <limits.h> at the top of tools/perf/ui/browsers/hists.c. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-17perf ui hists: Fix uninitialized stack memory free on pstack allocation failureIan Rogers
Fixes heap corruption by initializing the options and actions arrays before the pstack allocation check, preventing an uninitialized stack pointer from being passed to free_popup_options() if the allocation fails. Reported-by: sashiko-bot <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/linux-perf-users/20260709035230.6DBEE1F000E9@smtp.kernel.org/ Fixes: f2b487db45f2 ("perf hists browser: Fix possible memory leak") Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers <irogers@google.com> Link: https://lore.kernel.org/linux-perf-users/20260709035230.6DBEE1F000E9@smtp.kernel.org/ Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-17perf hists browser: Increase MAX_OPTIONS to prevent stack buffer overflowIan Rogers
In evsel__hists_browse(), the 'options' and 'actions' arrays are statically allocated on the stack with a size of MAX_OPTIONS (16). Further down, the function sequentially calls several add_*_opt() functions, which increment nr_options without bounds checking. Depending on the context (e.g., branch mode, scripting, annotations), the sum of added options can theoretically exceed 16 (potentially reaching up to ~19). This could lead to a stack buffer overflow. Increase MAX_OPTIONS to 32 to safely accommodate the maximum possible number of options without risking an overflow. Closes: https://lore.kernel.org/linux-perf-users/20260708235834.3FB771F00A3A@smtp.kernel.org/ Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers <irogers@google.com> Link: https://lore.kernel.org/linux-perf-users/20260708235834.3FB771F00A3A@smtp.kernel.org/ Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-17selftests/cgroup: Fix minor defects in test_cpusetWaiman Long
With commit 98149f542530 ("selftests/cgroup: Add test for cpuset affinity on controller disable"), sashiko [1] reported 3 different issues with the new test_cpuset_affinity_on_controller_disable() test. 1) `cpu_set_equal` iterates over mask bytes instead of bits, ignoring CPUs >= 8. 2) Thread synchronization logic allows the main thread to read uninitialized stack memory, causing test flakiness. 3) Test fails instead of skipping gracefully on uniprocessor systems or when CPU 1 is unavailable. Fix the reported issues by: 1) Iterates over the bit size of the mask. 2) Test the new ready flag for each thread to end the wait on the conditional variable and eliminate the now unneeded AFFINITY_THREAD_A_READY and AFFINITY_THREADS_READY test phases. 3) Return KSFT_SKIP on "cpuset.cpus" setting failure. [1] https://sashiko.dev/#/patchset/20260712235510.373125-1-longman%40redhat.com Fixes: 98149f542530 ("selftests/cgroup: Add test for cpuset affinity on controller disable") Signed-off-by: Waiman Long <longman@redhat.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-07-17Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc4Kumar Kartikeya Dwivedi
Cross-merge BPF and other fixes after downstream PR. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-17Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds
Pull bpf fixes from Kumar Kartikeya Dwivedi: - Fix a UAF in socket clone early bailout paths (Matt Bobrowski) - Reject unhashed UDP sockets on sockmap update to prevent refcount leaks (Michal Luczaj) - Account for receive queue data in FIONREAD on sockmap sockets without a verdict program (Mattia Meleleo) - Reject negative constant offsets for verifier buffer pointers (Sun Jian) - Fix for tracing of kfuncs with implicit arguments (Ihor Solodrai) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Cover tracing implicit kfunc args bpf: Fix tracing of kfuncs with implicit args selftests/bpf: Cover negative buffer pointer offsets bpf: Reject negative const offsets for buffer pointers selftests/bpf: Test FIONREAD on a sockmap socket without a verdict program bpf, sockmap: Account for receive queue in FIONREAD without a verdict program selftests/bpf: Fail unbound UDP on sockmap update selftests/bpf: Adapt sockmap update error handling bpf, sockmap: Reject unhashed UDP sockets on sockmap update selftests/bpf: Ensure UDP sockets are bound bpf: Fix UAF in sock clone early bailouts
2026-07-17Merge tag 'net-7.2-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Wireless, IPsec, Netfilter and Bluetooth. Current release - new code bugs: - netfilter: flowtable: use correct direction to set up tunnel route Previous releases - regressions: - wifi: - mac80211: - free AP_VLAN bc_buf SKBs outside IRQ lock - defer link RX stats percpu free to RCU - fix double free on alloc failure - cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock - ipv4: free fib_alias with kfree_rcu() on insert error path - sched: act_tunnel_key: Defer dst_release to RCU callback - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bluetooth: fix locking in unpair_device/disconnect_sync - can: add locking for raw flags bitfield - openvswitch: reject oversized nested action attrs - eth: - bnxt_en: handle partially initialized auxiliary devices - ppp: defer channel free to an RCU grace period to fix UAF Previous releases - always broken: - netfilter: xt_nat: reject unsupported target families - wifi: - brcmfmac: fix heap overflow on a short auth frame - cfg80211: add missing FTM API validation - xfrm: - reject optional IPTFS templates in outbound policies - policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - bluetooth: revalidate LOAD_CONN_PARAM queued update - can: fix lockless bound/ifindex race and silent RX_SETUP failure - eth: mlx5: free mlx5_st_idx_data on final dealloc" * tag 'net-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (108 commits) mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n llc: fix SAP refcount leak when creating incoming sockets selftests: netconsole: only restore MAC when it changed on resume bnxt_en: Handle partially initialized auxiliary devices sctp: fix auth_hmacs array size in struct sctp_cookie net/sched: act_tunnel_key: Defer dst_release to RCU callback dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() tcp: fix TIME_WAIT socket reference leak on PSP policy failure net/mlx5: free mlx5_st_idx_data on final dealloc can: isotp: serialize TX state transitions under so->rx_lock can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER can: isotp: use unconditional synchronize_rcu() in isotp_release() can: bcm: track a single source interface for ANYDEV timeout/throttle ops can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() can: bcm: fix stale rx/tx ops after device removal can: bcm: add missing device refcount for CAN filter removal can: bcm: validate frame length in bcm_rx_setup() for RTR replies can: bcm: extend bcm_tx_lock usage for data and timer updates can: bcm: add missing rcu list annotations and operations can: bcm: fix CAN frame rx/tx statistics ...
2026-07-17selftests/cgroup: Remove redundant cg_enter_current() call in test_coreJian Guo
The test_cgcore_no_internal_process_constraint_on_threads test has two back-to-back cg_enter_current(root) calls in its cleanup path. A single cg_enter_current() call atomically migrates the entire thread group to the target cgroup even for multi-threaded processes, and this test creates no extra threads or child processes that would require a second migration attempt. The second call is a harmless no-op once the process is already in the root cgroup, but it is redundant and inconsistent with the cleanup logic used in all other cgroup core selftest cases. Remove the duplicate call to clean up the code. No functional change is intended. Signed-off-by: Jian Guo <guojian@kylinos.cn> Acked-by: Michal Koutný <mkoutny@suse.com> Tested-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-07-17vfio: selftests: Avoid VLAsAlex Mastro
Allocate VFIO ioctl requests dynamically instead of using VLAs. GCC 11.5.0 rejects initialized VLAs with: error: variable-sized object may not be initialized The replaced stack u8 arrays also do not guarantee native struct alignment for the aliased pointers. Fixes: 19faf6fd969c ("vfio: selftests: Add a helper library for VFIO selftests") Fixes: 20face8c75ff ("vfio: selftests: Add helper to set/override a vf_token") Assisted-by: Codex:gpt-5.5-high Reviewed-by: Vipin Sharma <vipinsh@google.com> Reviewed-by: David Matlack <dmatlack@google.com> Signed-off-by: Alex Mastro <amastro@fb.com> Link: https://lore.kernel.org/r/20260617-scratch-amastro-vfio-selftests-avoid-vlas-v4-2-b9f52f1e2c5a@fb.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-07-17vfio: selftests: Add allocation assert helpersAlex Mastro
Add {malloc,calloc}_assert() helpers alongside the existing *_assert() helpers. Use them for VFIO selftest allocations that immediately assert a non-NULL result. Assisted-by: Codex:gpt-5.5-high Signed-off-by: Alex Mastro <amastro@fb.com> Reviewed-by: David Matlack <dmatlack@google.com> Link: https://lore.kernel.org/r/20260617-scratch-amastro-vfio-selftests-avoid-vlas-v4-1-b9f52f1e2c5a@fb.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-07-17vfio: selftests: Add NVIDIA Falcon driver for DMA testingRubin Du
Add a new VFIO PCI driver for NVIDIA GPUs that enables DMA testing via the Falcon (Fast Logic Controller) microcontrollers. This driver extracts and adapts the DMA test functionality from NVIDIA's gpu-admin-tools project and integrates it into the existing VFIO selftest framework. Falcons are general-purpose microcontrollers present on NVIDIA GPUs that can perform DMA operations between system memory and device memory. By leveraging Falcon DMA, this driver allows NVIDIA GPUs to be tested alongside Intel IOAT and DSA devices using the same selftest infrastructure. The driver is named 'nv_falcon' to reflect that it specifically controls the Falcon microcontrollers for DMA operations, rather than exposing general GPU functionality. Reference implementation: https://github.com/NVIDIA/gpu-admin-tools Signed-off-by: Alex Williamson <alex.williamson@nvidia.com> Signed-off-by: Rubin Du <rubind@nvidia.com> Acked-by: David Matlack <dmatlack@google.com> Link: https://lore.kernel.org/r/20260609232855.3808971-5-rubind@nvidia.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-07-17vfio: selftests: Allow drivers without send_msi() supportRubin Du
Allow drivers that cannot trigger MSI interrupts to leave the send_msi callback NULL. Add an fcntl_set_msi_nonblock() wrapper that only sets nonblocking mode when send_msi is available, and update ASSERT_NO_MSI() to skip when the driver lacks MSI support. The send_msi test SKIPs and mix_and_match skips the MSI portion per iteration. Reviewed-by: David Matlack <dmatlack@google.com> Signed-off-by: Alex Williamson <alex.williamson@nvidia.com> Signed-off-by: Rubin Du <rubind@nvidia.com> Link: https://lore.kernel.org/r/20260609232855.3808971-4-rubind@nvidia.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-07-17vfio: selftests: Add generic PCI command register helpersRubin Du
Add vfio_pci_cmd_set()/vfio_pci_cmd_clear() read-modify-write macros for PCI_COMMAND in vfio_pci_device.h. Reviewed-by: David Matlack <dmatlack@google.com> Signed-off-by: Alex Williamson <alex.williamson@nvidia.com> Signed-off-by: Rubin Du <rubind@nvidia.com> Link: https://lore.kernel.org/r/20260609232855.3808971-3-rubind@nvidia.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-07-17vfio: selftests: Add memcpy chunking to vfio_pci_driver_memcpy()Rubin Du
Add a chunking loop to vfio_pci_driver_memcpy() so that it breaks up large memcpy requests into max_memcpy_size-sized chunks. This allows callers to request any size without worrying about per-driver limits. The memcpy_start()/memcpy_wait() semantics are unchanged. Update the test to use 4x max_memcpy_size so it exercises the new chunking path (4 iterations) while keeping execution fast for drivers with small DMA transfer sizes. Reviewed-by: David Matlack <dmatlack@google.com> Signed-off-by: Alex Williamson <alex.williamson@nvidia.com> Signed-off-by: Rubin Du <rubind@nvidia.com> Link: https://lore.kernel.org/r/20260609232855.3808971-2-rubind@nvidia.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-07-17selftests: ntsync: correct CONFIG_NTSYNC nameEthan Nelson-Moore
The config fragment for these tests defines CONFIG_WINESYNC, which refers to an earlier name for the ntsync driver before it was merged [1]. Correct it to define CONFIG_NTSYNC instead. [1] https://lore.kernel.org/all/f4cc1a38-1441-62f8-47e4-0c67f5ad1d43@codeweavers.com/ Fixes: 7f853a252cde ("selftests: ntsync: Add some tests for semaphore state.") Cc: stable <stable@kernel.org> Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com> Link: https://patch.msgid.link/20260609175505.19632-1-enelsonmoore@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17selftests: netconsole: only restore MAC when it changed on resumeAndre Carvalho
The "mac" bind mode reactivation downs the interface, restores the saved MAC and renames it to trigger a target resume. This assumes the recreated interface comes back with a different MAC, which is true under MACAddressPolicy=none (as on the Netdev CI) but not when MACs are persistent. In the persistent case netconsole resumes the target on its own, and the down/restore/rename flow instead drops it and fails the test. Guard the block on the MAC having actually changed so the test passes under both policies. Fixes: 6ecc08329bab ("selftests: netconsole: validate target resume") Reported-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Closes: https://lore.kernel.org/netdev/f398373e-2cb4-4649-a491-9763df94d98b@kernel.org/ Signed-off-by: Andre Carvalho <asantostc@gmail.com> Tested-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Reviewed-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netcons-mac-reload-v1-1-3fb1bcc70b4a@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-16selftests/bpf: Add testcases for callback with tailcallPu Lehui
Add 2 testcases for callback with tailcall: 1. failure case: callback->subprog->tailcall. 2. success case: subprog with tailcall do not affect no-tailcall callback. Signed-off-by: Pu Lehui <pulehui@huawei.com> Link: https://patch.msgid.link/20260716120157.835937-4-pulehui@huaweicloud.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-16cpupower: Print kernel and hardware frequency informationJeremy Linton
The kernel asserted frequency from scaling_cur_freq may not always match the hardware reported frequency from cpuinfo_cur_freq. Print both values when they are available, and only print the unavailable message on x86 when the hardware frequency can't be read. Link: https://lore.kernel.org/r/20260709221344.1919794-4-jeremy.linton@arm.com Signed-off-by: Jeremy Linton <jeremy.linton@arm.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-07-16cpupower: Build and call CPPC information on non-AMD processorsJeremy Linton
Now that we have a generic CPPC printout, call it on !AMD processors. If it fails to detect CPPC, or the registers don't look reasonable then it will exit without printing anything. Link: https://lore.kernel.org/r/20260709221344.1919794-3-jeremy.linton@arm.com Signed-off-by: Jeremy Linton <jeremy.linton@arm.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-07-16cpupower: Add generic CPPC performance displayJeremy Linton
Arm64 machines, and possibly others, use the standard ACPI defined CPPC infrastructure. cpupower has CPPC support, but it's largely written around the intricacies of AMD processors, using platform MSRs to avoid shortcomings in the specification. Add a generic CPPC display that depends only on standardized fields. The computed frequency values are best effort and rely on the FW providing optional values that can be used to derive a meaningful frequency at a given unique performance level. Link: https://lore.kernel.org/r/20260709221344.1919794-2-jeremy.linton@arm.com Signed-off-by: Jeremy Linton <jeremy.linton@arm.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-07-16selftests/bpf: Cover tracing implicit kfunc argsKumar Kartikeya Dwivedi
KF_IMPLICIT_ARGS kfuncs have a BPF-call prototype and a real kernel target prototype. Add a tracing selftest that attaches fentry and fexit programs to bpf_kfunc_implicit_arg(), runs a syscall BPF program that calls it, and checks that the tracing context exposes both the explicit argument and the implicit prog aux pointer. Co-developed-by: Ihor Solodrai <ihor.solodrai@linux.dev> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://patch.msgid.link/20260713235223.1639022-3-ihor.solodrai@linux.dev Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-16Merge tag 'landlock-7.2-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock fix from Mickaël Salaün: "This fixes TCP Fast Open support, specific test environments, and doc warnings" * tag 'landlock-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available selftests/landlock: Fix screwed up pointers in the scoped_signal_test landlock: Update formatting landlock: Fix kernel-doc for the nested quiet layer flag selftests/landlock: Add test for TCP fast open landlock: Fix TCP Fast Open connection bypass
2026-07-16selftests/cgroup: Add test for cpuset affinity on controller disableMichal Koutný
Add a new selftest that exposes a bug in cpuset_attach() where thread CPU affinity is not properly updated when the cpuset controller is disabled in a threaded cgroup hierarchy. The test creates a threaded cgroup hierarchy with two child cgroups (A and B) having different cpuset.cpus constraints: - Parent: cpuset.cpus=0-1 - Child A: cpuset.cpus=0-1 - Child B: cpuset.cpus=1 (restricted to CPU 1 only) A multithreaded process is created with threads placed in different cgroups. When the cpuset controller is disabled on the parent, thread affinities should be updated to match the parent's cpuset. Expected behavior: - thread_a affinity: {0-1} before and after (unchanged) - thread_b affinity: {1} before, {0-1} after (expanded) Current buggy behavior: - thread_b affinity remains {1} after controller disable Assisted-by: Claude:claude-sonnet-4-5 Signed-off-by: Michal Koutný <mkoutny@suse.com> Acked-by: Waiman Long <longman@redhat.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-07-16perf jevents metric: Add python type annotationsIan Rogers
Make mypy clean. Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-16perf jevents: Add python type annotationsIan Rogers
Make mypy clean. Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-16perf build: Fix a compiler error in util/libbfd.cNamhyung Kim
The bfd_boolean type was gone and converted to the standard bool type but we have some old code that uses the type. It caused a failure in the build test. util/libbfd.c: In function 'slurp_symtab': util/libbfd.c:94:9: error: unknown type name 'bfd_boolean' 94 | bfd_boolean dynamic = FALSE; | ^~~~~~~~~~~ util/libbfd.c:94:31: error: 'FALSE' undeclared (first use in this function) 94 | bfd_boolean dynamic = FALSE; | ^~~~~ util/libbfd.c:94:31: note: each undeclared identifier is reported only once for each function it appears in util/libbfd.c:102:27: error: 'TRUE' undeclared (first use in this function) 102 | dynamic = TRUE; | ^~~~ Fix it with standard bool type and constants. Reviewed-by: Ian Rogers <irogers@google.com> Link: https://sourceware.org/pipermail/binutils-cvs/2021-March/056231.html Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-16perf trace: Refactor augmented_raw_syscalls using bpf_forViktor Malik
The loop for processing syscall args in augment_raw_syscalls has a history of breaking with Clang updates, see e.g. commit 013eb043f37b ("perf trace: Fix BPF loading failure (-E2BIG)") from Clang 15 to 16. Now, a similar thing happened between Clang 21 and 22. While the issue is mitigated on the main line by a recent verifier update, it remains broken on the 6.12 and 6.18 stable branches: [linux-6.18.y]# sudo perf trace true libbpf: prog 'sys_enter': BPF program load failed: -E2BIG libbpf: prog 'sys_enter': -- BEGIN PROG LOAD LOG -- [...] BPF program is too large. Processed 1000001 insn processed 1000001 insns (limit 1000000) max_states_per_insn 40 total_states 37941 peak_states 232 mark_read 0 -- END PROG LOAD LOG -- libbpf: prog 'sys_enter': failed to load: -E2BIG libbpf: failed to load object 'augmented_raw_syscalls_bpf' libbpf: failed to load BPF skeleton 'augmented_raw_syscalls_bpf': -E2BIG Error: failed to get syscall or beauty map fd [...] The reason is that the loop is quite complex and the BPF verifier often struggles to prove that it terminates. Fix the issue by replacing the standard for loop with the bpf_for macro, which uses a numeric BPF iterator. This should prevent future breakages of this kind since the verifier has a much easier job proving that the loop terminates. Small adjustments were necessary for the loop to make it work. The main problem is that the verifier sometimes has problems with bpf_for loops that use a carry-over state, such as the `payload_offset` and `output` vars here, since the verifier tries to track their values too precisely and cannot prove loop convergence. To resolve the issue, we (1) explicitly recompute `payload_offset` in every iteration and (2) use a trick with adding a global zero to `output` to help the verifier forget its precise state and use a range instead. Finally, to keep backwards compatibility with older kernel versions that don't have bpf_for (i.e. numeric iterators), fall back to standard loop. Signed-off-by: Viktor Malik <vmalik@redhat.com> Cc: stable@vger.kernel.org Suggested-by: Andrii Nakryiko <andrii@kernel.org> Fixes: a68fd6a6cdd3 ("perf trace: Collect augmented data using BPF") Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-16perf trace: Factor out BPF loop bodyViktor Malik
The BPF program in augmented_raw_syscalls uses a for loop to iterate all syscall arguments. The loop body is quite complex and often poses problems for the BPF verifier. As a preparation step for addressing this issue, factor out the loop body into a separate function. Signed-off-by: Viktor Malik <vmalik@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-16perf test: Update test for --for-each-cgroup optionNamhyung Kim
To simply check the number of output lines with and without the option. Before this series, it failed like below: $ perf test -v 125 125: perf stat --bpf-counters --for-each-cgroup test: ---- start ---- test child forked, pid 1941516 Normal output has 22 lines, but it now has 54 ---- end(-1) ---- 125: perf stat --bpf-counters --for-each-cgroup test : FAILED! Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-16perf evsel: Arrange some fields that should be clonedNamhyung Kim
In the evsel, there's an internal struct to put fields need copy when the evsel is cloned. This is purely to make it easier track those fields even if it sometimes failed to do so. :) Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-16perf evsel: Remove unused BPF related fieldsNamhyung Kim
IIUC bpf_fd and bpf_obj fields are not used anymore. It seems like leftover from 3d6dfae889174340 ("perf parse-events: Remove BPF event support"). Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-16perf stat: Fix duplicate output with --for-each-cgroupNamhyung Kim
Currently it produces following output with duplicate events when --for-each-cgroup option is used. It seems perf stat adds them when it handles default events but didn't copy some fields in evsel__clone(). $ sudo perf stat -a --for-each-cgroup / true Performance counter stats for 'system wide': 8,440,165 duration_time / 8,439,895 duration_time / 8,440,015 duration_time / 8,440,024 duration_time / 8,440,075 duration_time / 8,440,095 duration_time / 330 context-switches / # 679.4 cs/sec cs_per_second 485.69 msec cpu-clock / # 57.5 CPUs CPUs_utilized 70 cpu-migrations / # 144.1 migrations/sec migrations_per_second 71 page-faults / # 146.2 faults/sec page_faults_per_second 12,183,711 branch-misses / # 10.9 % branch_miss_rate (5.15%) 111,981,297 branches / (5.15%) 95,844,809 branches / # 197.3 M/sec branch_frequency (35.49%) 65,611,429 cpu-cycles / # 0.1 GHz cycles_frequency (98.32%) 24,170,987 cpu-cycles / (95.12%) 18,552,509 instructions / # 0.8 instructions insn_per_cycle (95.12%) 22,405,293 cpu-cycles / (64.78%) 6,840,383 stalled-cycles-frontend / # 0.31 frontend_cycles_idle (64.78%) <not counted> cpu-cycles / <not supported> stalled-cycles-backend / # nan backend_cycles_idle <not supported> stalled-cycles-backend / # nan stalled_cycles_per_instruction <not supported> instructions / <not supported> stalled-cycles-frontend / 0.006546057 seconds time elapsed Some events weren't counted. Try disabling the NMI watchdog: echo 0 > /proc/sys/kernel/nmi_watchdog perf stat ... echo 1 > /proc/sys/kernel/nmi_watchdog But I'm worrying about opening same events multiple times. Probably due to grouping, but I'm not sure if it's beneficial in the end. Without duplication, it seems it won't cause multiplexing (assuming no other users at the same time). Fixes: a3248b5b5427d ("perf jevents: Add metric DefaultShowEvents") Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-16perf stat: Do not open cgroups for BPF countersNamhyung Kim
The --bpf-counters and --for-each-cgroup options use a set of shared events among the given cgroups rather than adding events for each cgroup respectively. It only uses cgroup-ID to compare and calculate the result. So no need to open and keep FDs for cgroups in BPF mode. Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-16tools/lib/api: Fix potential double-free from fdarray__grow()Namhyung Kim
If the realloc for fda->entries succeeds but the realloc for fda->priv fails, the error path frees the newly allocated entries. However, fda->entries is neither updated to point to the new entries block nor cleared to NULL. If realloc moved the allocation to a new block, the old fda->entries pointer is now freed memory. When fdarray__exit() is later called to clean up, it executes free(fda->entries), which would trigger a double-free on that old pointer. Reported-by: Sashiko Review <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/linux-perf-users/20260710200150.11FE71F00A3A@smtp.kernel.org Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-16Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
Pull kvm fixes from Paolo Bonzini: "arm64: - Fix an accounting buglet when reclaiming pages from a protected guest - Fix a bunch of architectural compliance issues when injecting a synthesised exception, most of which were missing the PSTATE.IL bit indicating a 32bit-wide instruction - Another set of fixes addressing issues with translation of VNCR_EL2, including corner cases where the guest point that register at a RO page... - Don't warn when trapping accesses to ZCR_EL2 from an L2 guest, as that's not unexpected at all - Address a bunch of races with LPI migration vs LPIs being disabled - Fix a total howler of a bug combining FEAT_MOPS and NV, resulting in exception returning in the wrong place... - Move locking for kvm_io_bus_get_dev() into the caller, ensuring race-free checks that the returned object is of the correct type - Fix initialisation of the page-table walk level when relaxing permissions - Correctly update the XN attribute when relaxing permissions - Fix the sign extension of loads from emulated MMIO regions - Assorted collection of fixes for pKVM's FFA proxy, together with a couple of FFA driver adjustments - Coerce Fuad Tabba into a reviewer role, and may his Inbox catch fire! s390: - more gmap KVM memory management fixes - PCI passthru fixes x86: - Fix a bug where KVM will trigger a UAF if updating IOMMU IRTEs fails when registering an IRQ-bypass producer - Ignore pending PV EOI instead of BUG()ing the host if the feature was disabled by the guest - Fix nVMX bugs where KVM would run L1 with an L1-controlled CR3 after a failed "late" consistency check when KVM is NOT using EPT - Disallow intra-host migration/mirroring of SNP VMs as KVM doesn't yet support moving/mirroring SNP state - Fix a TOCTOU bug in KVM's handling of the "trusted" CPUID for TDX guests - Fix a NULL pointer deref in trace_kvm_inj_exception() where a change to the core infrastructure missed KVM's unique (ab)use of __print_symbolic() - Put vmcs12 pages if nested VM-Enter fails due to invalid guest state - Fix TLB conflicts between two VMs if one of them VM is run on a CPU before and after it is hotplugged" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (48 commits) KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state KVM: x86: Fix null pointer deref due to dummy array in trace_kvm_inj_exception() KVM: TDX: Reject concurrent change to CPUID entry count KVM: selftests: Verify SNP VMs are rejected from migration and mirroring KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs KVM: s390: pci: Fix handling of AIF enable without AISB KVM: s390: Improve kvm_s390_vm_stop_migration() KVM: s390: Fix dat_crste_walk_range() early return KVM: s390: vsie: Avoid potential deadlock with real spaces KVM: s390: pci: Fix GISC refcount leak on AIF enable failure KVM: nVMX: Don't use vmcs01.GUEST_CR3 to snapshot L1's CR3 when EPT is disabled KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms() firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() KVM: arm64: Zero out the stack initialized data in the FFA handler KVM: arm64: Ensure FFA ranges are page aligned ...
2026-07-15selftests/seccomp: Fix pointer type mismatch build errorKuan-Ying Lee
We hit the following build error while running the seccomp selftests in our testing. CC seccomp_bpf seccomp_bpf.c: In function ‘UPROBE_setup’: seccomp_bpf.c:5175:74: error: pointer type mismatch in conditional expression [-Wincompatible-pointer-types] 5175 | offset = get_uprobe_offset(variant->uretprobe ? probed_uretprobe : probed_uprobe); | ^ seccomp_bpf.c:5175:57: note: first expression has type ‘int (*)(void)’ 5175 | offset = get_uprobe_offset(variant->uretprobe ? probed_uretprobe : probed_uprobe); | ^~~~~~~~~~~~~~~~ seccomp_bpf.c:5175:76: note: second expression has type ‘int (__attribute__((nocf_check)) *)(void)’ 5175 | offset = get_uprobe_offset(variant->uretprobe ? probed_uretprobe : probed_uprobe); | ^~~~~~~~~~~~~ get_uprobe_offset() takes a 'const void *' argument, so cast both operands to 'void *'. Fixes: 9ffc7a635c35 ("selftests/seccomp: validate uprobe syscall passes through seccomp") Signed-off-by: Kuan-Ying Lee <kuan-ying.lee@canonical.com> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://patch.msgid.link/20260715053559.28535-1-kuan-ying.lee@canonical.com Signed-off-by: Kees Cook <kees@kernel.org>
2026-07-15selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASEHaofeng Li
Commit 57fbad15c2ee ("stackleak: Rename STACKLEAK to KSTACK_ERASE") renamed the LKDTM crash type and selftest configuration but missed the entry in tests.txt. As a result, the selftest generates STACKLEAK_ERASING.sh, which run.sh skips because the LKDTM DIRECT trigger only exposes KSTACK_ERASE. Rename the test entry so the generated runner uses the registered crash type. Fixes: 57fbad15c2ee ("stackleak: Rename STACKLEAK to KSTACK_ERASE") Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn> Link: https://patch.msgid.link/tencent_CD80B5F746B6AABD68AF3F1097AD02C96F05@qq.com Signed-off-by: Kees Cook <kees@kernel.org>
2026-07-15perf jevents: Add more components to the metric sorting orderIan Rogers
Nazar Kazakov reported non-deterministic builds due to the metrics being reordered in the jevents.py output. The metrics were largely only being sorted by name, add in the expressions and descriptions. Reported-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk> Closes: https://lore.kernel.org/linux-perf-users/20260706175624.692736-1-nazar.kazakov@codethink.co.uk/ Fixes: 40769665b63d ("perf jevents: Parse metrics during conversion") Tested-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk> Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf sched: Free subcommand string after perf sched statsNamhyung Kim
The first entry of the sched_usage is dynamically allocated in parse_options_subcommand() so it should be released at the end. Do not return from a subcommand directly. Fixes: 064790a3d4a8 ("perf sched stats: Add support for diff subcommand") Reviewed-and-tested-by: Swapnil Sapkal <swapnil.sapkal@amd.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf sched: Fix memory leaks in perf sched stats reportNamhyung Kim
The second pass data is not saved in the list and only used to calculate delta from the first pass. Let's free the data after use. Fixes: 5a357ae6ad63 ("perf sched stats: Add support for report subcommand") Reviewed-and-tested-by: Swapnil Sapkal <swapnil.sapkal@amd.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf sched: Add missing perf_session__delete()Namhyung Kim
The perf sched stats record missed to release the session and ASAN reported a leak. Fixes: c3030995f23b ("perf sched stats: Add record and rawdump support") Reviewed-and-tested-by: Swapnil Sapkal <swapnil.sapkal@amd.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15Merge tag 'linux_kselftest-fixes-7.2-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: - Fix ftrace reading enabled_func test in add_remove_fprobe_module test - Fix tracing trigger-hist-poll.tc to use sched_process_exit * tag 'linux_kselftest-fixes-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/tracing: Have trigger-hist-poll.tc use sched_process_exit selftests/ftrace: Fix reading enabled_functions in add_remove_fprobe_module test
2026-07-15perf vendor events intel: Update emeraldrapids metricsChun-Tse Shao
The updated events were published in: https://github.com/intel/perfmon/commit/240735b7d8e0b50fe8f4a64e08399df13cb87ae6 Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf vendor events intel: Update sierraforest events from 1.17 to 1.18Chun-Tse Shao
The updated events were published in: https://github.com/intel/perfmon/commit/d1bc6c1e8b32e7a75c70cc939295c11ba9aabc96 Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-21 08:34:12 +0000