This series adds support for LIVEUPDATE_SESSION_RETRIEVE_INTO_FD, a new
UAPI to enable preserved files to be restored into a userspace-provided
file instead of a kernel-allocated file, and uses this to support
preserving tmpfs files in-place without any changes to the LUO ABI.
The Live Update Orchestrator (LUO) API currently explicitly returns a
new struct file for every preserved file during retrieve() (e.g. via
memfd_alloc_file()). This then forces userspace to use anonymous memfds
for all in-memory files it wants to preserve. This works reasonably well
for VM guest memory but does not work well for other types of files that
userspace may want to preserve (e.g. in-memory logs, binaries,
configuration files, etc.).
Preserving entire tmpfs mounts in-place would require a large amount of
kernel support and would effectively make tmpfs an ABI, which is a
non-starter (or so I hear). Instead, we can delegate the reconstruction
of the tmpfs mounts (directory structure, permissions, etc.) post-kexec
to userspace. The kernel just needs to preserve the contents of tmpfs
files and provide userspace a mechanism to restore those contents back
into a specific file on the filesystem after the kexec. Hence,
LIVEUPDATE_SESSION_RETRIEVE_INTO_FD.
An alternative approach to restoring data to a named file would be
supporting a zero-copy sendfile() that can be used to convert named
tmpfs files to/from memfds across the kexec. But this poses significant
challenges on the *preserve* side since the preserved file might still
be actively in use. The benefit of the retrieve-into approach introduced
in this series is that it does not require dealing with two different
files. There is only ever one file that owns the preserved memory.
By leaving file and metadata allocation purely in the purview of
userspace, programs can create the target files where they want, with
the names and security permissions they desire, before directing the
kernel to restore the preserved folios into them.
Currently, only tmpfs shmem files are allowed as valid target receptors.
Attempting to target populated files, or anything other than an empty
shmem file, will trigger -EINVAL. HugeTLBfs files could be supported in
the future.
The coding work for this series was done with assistance from Gemini. I
am not sure what is the latest recommendation is with respect to adding
Assisted-by tags, but I can add them when I send out the real patches if
this RFC looks acceptable.
David Matlack (5):
liveupdate: Extract luo_file token lookup logic into helper function
liveupdate: Introduce SESSION_RETRIEVE_INTO_FD API and core support
mm/memfd_luo: Implement retrieve_into callback for shmem folios
mm/memfd_luo: Expand support beyond memfd to all generic shmem inodes
selftests: liveupdate: Add multi-session test coverage for
session_retrieve_into
include/linux/liveupdate.h | 1 +
include/uapi/linux/liveupdate.h | 21 ++++++
kernel/liveupdate/luo_file.c | 66 ++++++++++++++----
kernel/liveupdate/luo_internal.h | 2 +
kernel/liveupdate/luo_session.c | 30 ++++++++
mm/memfd_luo.c | 68 ++++++++++++++++---
.../liveupdate/lib/include/libliveupdate.h | 1 +
.../selftests/liveupdate/lib/lu_utils.c | 33 +++++++++
.../selftests/liveupdate/luo_multi_session.c | 56 +++++++++++++--
9 files changed, 249 insertions(+), 29 deletions(-)
base-commit: 4e1b74c6004371b046338325011a47cd7ab9dcc1
--
2.55.0.966.g6673acef38-goog
