[PATCH 0/5] liveupdate: Remove limits on the number of files and sessions

[PATCH 0/5] liveupdate: Remove limits on the number of files and sessions

[Pasha Tatashin]

This series removes the fixed limits on the number of files that can
be preserved within a single session, and the total number of sessions
managed by the Live Update Orchestrator.

The core of the change is a transition from single contiguous memory
blocks for metadata serialization to a chain of linked blocks. This
allows LUO to scale dynamically.

1.  ABI Evolution:
    - Introduced linked-block headers for both file and session
      serialization.
    - Bumped session ABI version to v4.

2.  Memory Management & Security:
    - Implemented a dynamic block allocation and reuse strategy. Blocks
      are allocated only when existing ones are exhausted and are reused
      during session/file removal cycles.
    - Introduced LUO_MAX_BLOCKS (10000) as a safeguard against stupid
      excessive allocations or corrupted cyclic lists during restore.

3.  Expanded Selftests:
    - Added new kexec-based tests verifying preservation of
      2000 sessions and 500 files per session.
    - Added self-tests for many sessions and many files management.

Pasha Tatashin (5):
  liveupdate: Remove limit on the number of sessions
  liveupdate: Remove limit on the number of files per session
  selftests/liveupdate: Test session and file limit removal
  selftests/liveupdate: Add stress-sessions kexec test
  selftests/liveupdate: Add stress-files kexec test

 include/linux/kho/abi/luo.h                   |  52 +++-
 kernel/liveupdate/luo_file.c                  | 226 +++++++++++------
 kernel/liveupdate/luo_internal.h              |  29 ++-
 kernel/liveupdate/luo_session.c               | 237 +++++++++++++-----
 tools/testing/selftests/liveupdate/Makefile   |   2 +
 .../testing/selftests/liveupdate/liveupdate.c |  99 ++++++++
 .../selftests/liveupdate/luo_stress_files.c   |  98 ++++++++
 .../liveupdate/luo_stress_sessions.c          |  98 ++++++++
 .../selftests/liveupdate/luo_test_utils.c     |  25 ++
 .../selftests/liveupdate/luo_test_utils.h     |   2 +
 10 files changed, 709 insertions(+), 159 deletions(-)
 create mode 100644 tools/testing/selftests/liveupdate/luo_stress_files.c
 create mode 100644 tools/testing/selftests/liveupdate/luo_stress_sessions.c

-- 
2.43.0

[PATCH 1/5] liveupdate: Remove limit on the number of sessions

[Pasha Tatashin]

Currently, the number of LUO sessions is limited by a fixed number of
pre-allocated pages for serialization (16 pages, allowing for ~819
sessions).

This limitation is problematic if LUO is used to support things such as
systemd file descriptor store, and would be used not just as VM memory
but to save other states on the machine.

Remove this limit by transitioning to a linked-block approach for
session metadata serialization. Instead of a single contiguous block,
session metadata is now stored in a chain of 16-page blocks. Each block
starts with a header containing the physical address of the next block
and the number of session entries in the current block.

- Bump session ABI version to v3.
- Update struct luo_session_header_ser to include a 'next' pointer.
- Implement dynamic block allocation in luo_session_insert().
- Update setup, serialization, and deserialization logic to traverse
  the block chain.
- Remove LUO_SESSION_MAX limit.

Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
 include/linux/kho/abi/luo.h      |  19 +--
 kernel/liveupdate/luo_internal.h |  12 +-
 kernel/liveupdate/luo_session.c  | 237 +++++++++++++++++++++++--------
 3 files changed, 197 insertions(+), 71 deletions(-)

diff --git a/include/linux/kho/abi/luo.h b/include/linux/kho/abi/luo.h
index 46750a0ddf88..f5732958545e 100644
--- a/include/linux/kho/abi/luo.h
+++ b/include/linux/kho/abi/luo.h
@@ -57,9 +57,10 @@
  *   - compatible: "luo-session-v1"
  *     Identifies the session ABI version.
  *   - luo-session-header: u64
- *     The physical address of a `struct luo_session_header_ser`. This structure
- *     is the header for a contiguous block of memory containing an array of
- *     `struct luo_session_ser`, one for each preserved session.
+ *     The physical address of the first `struct luo_session_header_ser`.
+ *     This structure is the header for a block of memory containing an array
+ *     of `struct luo_session_ser` entries. Multiple blocks are linked via
+ *     the `next` field in the header.
  *
  * File-Lifecycle-Bound Node (luo-flb):
  *   This node describes all preserved global objects whose lifecycle is bound
@@ -77,9 +78,9 @@
  *   `__packed` structures. These structures contain the actual preserved state.
  *
  *   - struct luo_session_header_ser:
- *     Header for the session array. Contains the total page count of the
- *     preserved memory block and the number of `struct luo_session_ser`
- *     entries that follow.
+ *     Header for the session data block. Contains the physical address of the
+ *     next session data block and the number of `struct luo_session_ser`
+ *     entries that follow this header in the current block.
  *
  *   - struct luo_session_ser:
  *     Metadata for a single session, including its name and a physical pointer
@@ -153,21 +154,23 @@ struct luo_file_set_ser {
  *                          luo_session_header_ser
  */
 #define LUO_FDT_SESSION_NODE_NAME	"luo-session"
-#define LUO_FDT_SESSION_COMPATIBLE	"luo-session-v2"
+#define LUO_FDT_SESSION_COMPATIBLE	"luo-session-v3"
 #define LUO_FDT_SESSION_HEADER		"luo-session-header"
 
 /**
  * struct luo_session_header_ser - Header for the serialized session data block.
+ * @next:  Physical address of the next struct luo_session_header_ser.
  * @count: The number of `struct luo_session_ser` entries that immediately
  *         follow this header in the memory block.
  *
- * This structure is located at the beginning of a contiguous block of
+ * This structure is located at the beginning of a block of
  * physical memory preserved across the kexec. It provides the necessary
  * metadata to interpret the array of session entries that follow.
  *
  * If this structure is modified, `LUO_FDT_SESSION_COMPATIBLE` must be updated.
  */
 struct luo_session_header_ser {
+	u64 next;
 	u64 count;
 } __packed;
 
diff --git a/kernel/liveupdate/luo_internal.h b/kernel/liveupdate/luo_internal.h
index 875844d7a41d..a73f42069301 100644
--- a/kernel/liveupdate/luo_internal.h
+++ b/kernel/liveupdate/luo_internal.h
@@ -11,6 +11,16 @@
 #include <linux/liveupdate.h>
 #include <linux/uaccess.h>
 
+/*
+ * Safeguard limit for the number of serialization blocks. This is used to
+ * prevent infinite loops and excessive memory allocation in case of memory
+ * corruption in the preserved state.
+ *
+ * This limit allows for ~8.1 million sessions and ~1.2 million files per
+ * session, which is more than enough for all realistic use cases.
+ */
+#define LUO_MAX_BLOCKS 10000
+
 struct luo_ucmd {
 	void __user *ubuffer;
 	u32 user_size;
@@ -59,7 +69,6 @@ struct luo_file_set {
  * struct luo_session - Represents an active or incoming Live Update session.
  * @name:       A unique name for this session, used for identification and
  *              retrieval.
- * @ser:        Pointer to the serialized data for this session.
  * @list:       A list_head member used to link this session into a global list
  *              of either outgoing (to be preserved) or incoming (restored from
  *              previous kernel) sessions.
@@ -70,7 +79,6 @@ struct luo_file_set {
  */
 struct luo_session {
 	char name[LIVEUPDATE_SESSION_NAME_LENGTH];
-	struct luo_session_ser *ser;
 	struct list_head list;
 	bool retrieved;
 	struct luo_file_set file_set;
diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
index 92b1af791889..007ca34eba79 100644
--- a/kernel/liveupdate/luo_session.c
+++ b/kernel/liveupdate/luo_session.c
@@ -69,30 +69,39 @@
 #include <uapi/linux/liveupdate.h>
 #include "luo_internal.h"
 
-/* 16 4K pages, give space for 744 sessions */
+/* 16 4K pages, give space for 819 sessions per block */
 #define LUO_SESSION_PGCNT	16ul
-#define LUO_SESSION_MAX		(((LUO_SESSION_PGCNT << PAGE_SHIFT) -	\
+#define LUO_SESSION_BLOCK_MAX		(((LUO_SESSION_PGCNT << PAGE_SHIFT) -	\
 		sizeof(struct luo_session_header_ser)) /		\
 		sizeof(struct luo_session_ser))
 
+/**
+ * struct luo_session_block - Internal representation of a session serialization block.
+ * @list: List head for linking blocks in memory.
+ * @ser:  Pointer to the serialized header in preserved memory.
+ */
+struct luo_session_block {
+	struct list_head list;
+	struct luo_session_header_ser *ser;
+};
+
 /**
  * struct luo_session_header - Header struct for managing LUO sessions.
  * @count:      The number of sessions currently tracked in the @list.
+ * @nblocks:    The number of allocated serialization blocks.
  * @list:       The head of the linked list of `struct luo_session` instances.
  * @rwsem:      A read-write semaphore providing synchronized access to the
  *              session list and other fields in this structure.
- * @header_ser: The header data of serialization array.
- * @ser:        The serialized session data (an array of
- *              `struct luo_session_ser`).
+ * @blocks:     The list of serialization blocks (struct luo_session_block).
  * @active:     Set to true when first initialized. If previous kernel did not
  *              send session data, active stays false for incoming.
  */
 struct luo_session_header {
 	long count;
+	long nblocks;
 	struct list_head list;
 	struct rw_semaphore rwsem;
-	struct luo_session_header_ser *header_ser;
-	struct luo_session_ser *ser;
+	struct list_head blocks;
 	bool active;
 };
 
@@ -110,10 +119,12 @@ static struct luo_session_global luo_session_global = {
 	.incoming = {
 		.list = LIST_HEAD_INIT(luo_session_global.incoming.list),
 		.rwsem = __RWSEM_INITIALIZER(luo_session_global.incoming.rwsem),
+		.blocks = LIST_HEAD_INIT(luo_session_global.incoming.blocks),
 	},
 	.outgoing = {
 		.list = LIST_HEAD_INIT(luo_session_global.outgoing.list),
 		.rwsem = __RWSEM_INITIALIZER(luo_session_global.outgoing.rwsem),
+		.blocks = LIST_HEAD_INIT(luo_session_global.outgoing.blocks),
 	},
 };
 
@@ -140,6 +151,70 @@ static void luo_session_free(struct luo_session *session)
 	kfree(session);
 }
 
+static int luo_session_add_block(struct luo_session_header *sh,
+				 struct luo_session_header_ser *ser)
+{
+	struct luo_session_block *block;
+
+	if (sh->nblocks >= LUO_MAX_BLOCKS)
+		return -ENOSPC;
+
+	block = kzalloc_obj(*block);
+	if (!block)
+		return -ENOMEM;
+
+	block->ser = ser;
+	list_add_tail(&block->list, &sh->blocks);
+	sh->nblocks++;
+
+	return 0;
+}
+
+static int luo_session_create_ser_block(struct luo_session_header *sh)
+{
+	struct luo_session_block *last = NULL;
+	struct luo_session_header_ser *ser;
+	int err;
+
+	ser = kho_alloc_preserve(LUO_SESSION_PGCNT << PAGE_SHIFT);
+	if (IS_ERR(ser))
+		return PTR_ERR(ser);
+
+	if (!list_empty(&sh->blocks))
+		last = list_last_entry(&sh->blocks, struct luo_session_block, list);
+
+	err = luo_session_add_block(sh, ser);
+	if (err)
+		goto err_unpreserve;
+
+	if (last)
+		last->ser->next = virt_to_phys(ser);
+
+	return 0;
+
+err_unpreserve:
+	kho_unpreserve_free(ser);
+	return err;
+}
+
+static void luo_session_destroy_ser_blocks(struct luo_session_header *sh,
+					   bool unpreserve)
+{
+	struct luo_session_block *block, *tmp;
+
+	list_for_each_entry_safe(block, tmp, &sh->blocks, list) {
+		if (block->ser) {
+			if (unpreserve)
+				kho_unpreserve_free(block->ser);
+			else
+				kho_restore_free(block->ser);
+		}
+		list_del(&block->list);
+		kfree(block);
+		sh->nblocks--;
+	}
+}
+
 static int luo_session_insert(struct luo_session_header *sh,
 			      struct luo_session *session)
 {
@@ -147,15 +222,6 @@ static int luo_session_insert(struct luo_session_header *sh,
 
 	guard(rwsem_write)(&sh->rwsem);
 
-	/*
-	 * For outgoing we should make sure there is room in serialization array
-	 * for new session.
-	 */
-	if (sh == &luo_session_global.outgoing) {
-		if (sh->count == LUO_SESSION_MAX)
-			return -ENOMEM;
-	}
-
 	/*
 	 * For small number of sessions this loop won't hurt performance
 	 * but if we ever start using a lot of sessions, this might
@@ -166,6 +232,20 @@ static int luo_session_insert(struct luo_session_header *sh,
 		if (!strncmp(it->name, session->name, sizeof(it->name)))
 			return -EEXIST;
 	}
+
+	/*
+	 * For outgoing we should make sure there is room in serialization array
+	 * for new session. If not, allocate a new block.
+	 */
+	if (sh == &luo_session_global.outgoing) {
+		if (sh->count == sh->nblocks * LUO_SESSION_BLOCK_MAX) {
+			int err = luo_session_create_ser_block(sh);
+
+			if (err)
+				return err;
+		}
+	}
+
 	list_add_tail(&session->list, &sh->list);
 	sh->count++;
 
@@ -444,9 +524,12 @@ int __init luo_session_setup_outgoing(void *fdt_out)
 	u64 header_ser_pa;
 	int err;
 
-	header_ser = kho_alloc_preserve(LUO_SESSION_PGCNT << PAGE_SHIFT);
-	if (IS_ERR(header_ser))
-		return PTR_ERR(header_ser);
+	err = luo_session_create_ser_block(&luo_session_global.outgoing);
+	if (err)
+		return err;
+
+	header_ser = list_first_entry(&luo_session_global.outgoing.blocks,
+				      struct luo_session_block, list)->ser;
 	header_ser_pa = virt_to_phys(header_ser);
 
 	err = fdt_begin_node(fdt_out, LUO_FDT_SESSION_NODE_NAME);
@@ -459,19 +542,18 @@ int __init luo_session_setup_outgoing(void *fdt_out)
 	if (err)
 		goto err_unpreserve;
 
-	luo_session_global.outgoing.header_ser = header_ser;
-	luo_session_global.outgoing.ser = (void *)(header_ser + 1);
 	luo_session_global.outgoing.active = true;
 
 	return 0;
 
 err_unpreserve:
-	kho_unpreserve_free(header_ser);
+	luo_session_destroy_ser_blocks(&luo_session_global.outgoing, true);
 	return err;
 }
 
 int __init luo_session_setup_incoming(void *fdt_in)
 {
+	struct luo_session_header *sh = &luo_session_global.incoming;
 	struct luo_session_header_ser *header_ser;
 	int err, header_size, offset;
 	u64 header_ser_pa;
@@ -501,11 +583,14 @@ int __init luo_session_setup_incoming(void *fdt_in)
 	}
 
 	header_ser_pa = get_unaligned((u64 *)ptr);
-	header_ser = phys_to_virt(header_ser_pa);
-
-	luo_session_global.incoming.header_ser = header_ser;
-	luo_session_global.incoming.ser = (void *)(header_ser + 1);
-	luo_session_global.incoming.active = true;
+	while (header_ser_pa) {
+		header_ser = phys_to_virt(header_ser_pa);
+		err = luo_session_add_block(sh, header_ser);
+		if (err)
+			return err;
+		header_ser_pa = header_ser->next;
+	}
+	sh->active = true;
 
 	return 0;
 }
@@ -513,6 +598,7 @@ int __init luo_session_setup_incoming(void *fdt_in)
 int luo_session_deserialize(void)
 {
 	struct luo_session_header *sh = &luo_session_global.incoming;
+	struct luo_session_block *block;
 	static bool is_deserialized;
 	static int err;
 
@@ -539,40 +625,49 @@ int luo_session_deserialize(void)
 	 * userspace to detect the failure and trigger a reboot, which will
 	 * reliably reset devices and reclaim memory.
 	 */
-	for (int i = 0; i < sh->header_ser->count; i++) {
-		struct luo_session *session;
-
-		session = luo_session_alloc(sh->ser[i].name);
-		if (IS_ERR(session)) {
-			pr_warn("Failed to allocate session [%.*s] during deserialization %pe\n",
-				(int)sizeof(sh->ser[i].name),
-				sh->ser[i].name, session);
-			err = PTR_ERR(session);
-			return err;
-		}
+	list_for_each_entry(block, &sh->blocks, list) {
+		struct luo_session_ser *ser = (void *)(block->ser + 1);
 
-		err = luo_session_insert(sh, session);
-		if (err) {
-			pr_warn("Failed to insert session [%s] %pe\n",
-				session->name, ERR_PTR(err));
-			luo_session_free(session);
+		if (block->ser->count > LUO_SESSION_BLOCK_MAX) {
+			pr_warn("Session block contains too many entries: %llu\n",
+				block->ser->count);
+			err = -EINVAL;
 			return err;
 		}
 
-		scoped_guard(mutex, &session->mutex) {
-			err = luo_file_deserialize(&session->file_set,
-						   &sh->ser[i].file_set_ser);
-		}
-		if (err) {
-			pr_warn("Failed to deserialize files for session [%s] %pe\n",
-				session->name, ERR_PTR(err));
-			return err;
+		for (int i = 0; i < block->ser->count; i++) {
+			struct luo_session *session;
+
+			session = luo_session_alloc(ser[i].name);
+			if (IS_ERR(session)) {
+				pr_warn("Failed to allocate session [%.*s] during deserialization %pe\n",
+					(int)sizeof(ser[i].name),
+					ser[i].name, session);
+				err = PTR_ERR(session);
+				return err;
+			}
+
+			err = luo_session_insert(sh, session);
+			if (err) {
+				pr_warn("Failed to insert session [%s] %pe\n",
+					session->name, ERR_PTR(err));
+				luo_session_free(session);
+				return err;
+			}
+
+			scoped_guard(mutex, &session->mutex) {
+				err = luo_file_deserialize(&session->file_set,
+							   &ser[i].file_set_ser);
+			}
+			if (err) {
+				pr_warn("Failed to deserialize files for session [%s] %pe\n",
+					session->name, ERR_PTR(err));
+				return err;
+			}
 		}
 	}
 
-	kho_restore_free(sh->header_ser);
-	sh->header_ser = NULL;
-	sh->ser = NULL;
+	luo_session_destroy_ser_blocks(sh, false);
 
 	return 0;
 }
@@ -580,31 +675,51 @@ int luo_session_deserialize(void)
 int luo_session_serialize(void)
 {
 	struct luo_session_header *sh = &luo_session_global.outgoing;
+	struct luo_session_block *block;
 	struct luo_session *session;
+	struct luo_session_ser *ser;
 	int i = 0;
 	int err;
 
 	guard(rwsem_write)(&sh->rwsem);
+
+	if (list_empty(&sh->blocks))
+		return 0;
+
+	block = list_first_entry(&sh->blocks, struct luo_session_block, list);
+	ser = (void *)(block->ser + 1);
+
 	list_for_each_entry(session, &sh->list, list) {
-		err = luo_session_freeze_one(session, &sh->ser[i]);
+		if (i == LUO_SESSION_BLOCK_MAX) {
+			block->ser->count = i;
+			block = list_next_entry(block, list);
+			ser = (void *)(block->ser + 1);
+			i = 0;
+		}
+
+		err = luo_session_freeze_one(session, &ser[i]);
 		if (err)
 			goto err_undo;
 
-		strscpy(sh->ser[i].name, session->name,
-			sizeof(sh->ser[i].name));
+		strscpy(ser[i].name, session->name,
+			sizeof(ser[i].name));
 		i++;
 	}
-	sh->header_ser->count = sh->count;
+	block->ser->count = i;
 
 	return 0;
 
 err_undo:
 	list_for_each_entry_continue_reverse(session, &sh->list, list) {
 		i--;
-		luo_session_unfreeze_one(session, &sh->ser[i]);
-		memset(sh->ser[i].name, 0, sizeof(sh->ser[i].name));
+		if (i < 0) {
+			block = list_prev_entry(block, list);
+			ser = (void *)(block->ser + 1);
+			i = LUO_SESSION_BLOCK_MAX - 1;
+		}
+		luo_session_unfreeze_one(session, &ser[i]);
+		memset(ser[i].name, 0, sizeof(ser[i].name));
 	}
 
 	return err;
 }
-
-- 
2.43.0

[PATCH 2/5] liveupdate: Remove limit on the number of files per session

[Pasha Tatashin]

To remove the fixed limit on the number of preserved files per session,
transition the file metadata serialization from a single contiguous memory
block to a chain of linked blocks.

ABI Changes:
- Define 'struct luo_file_header_ser' to manage linked blocks in preserved
  memory.
- Update 'struct luo_file_set_ser' to point to the head of the block chain.
- Bump the session ABI version to 'luo-session-v4' to reflect these breaking
  changes.

Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
 include/linux/kho/abi/luo.h      |  35 ++++-
 kernel/liveupdate/luo_file.c     | 226 ++++++++++++++++++++-----------
 kernel/liveupdate/luo_internal.h |  17 ++-
 3 files changed, 189 insertions(+), 89 deletions(-)

diff --git a/include/linux/kho/abi/luo.h b/include/linux/kho/abi/luo.h
index f5732958545e..a15f6a0f3d93 100644
--- a/include/linux/kho/abi/luo.h
+++ b/include/linux/kho/abi/luo.h
@@ -84,8 +84,13 @@
  *
  *   - struct luo_session_ser:
  *     Metadata for a single session, including its name and a physical pointer
- *     to another preserved memory block containing an array of
- *     `struct luo_file_ser` for all files in that session.
+ *     to the first `struct luo_file_header_ser` for all files in that session.
+ *     Multiple blocks are linked via the `next` field in the header.
+ *
+ *   - struct luo_file_header_ser:
+ *     Header for the file data block. Contains the physical address of the
+ *     next file data block and the number of `struct luo_file_ser` entries
+ *     that follow this header in the current block.
  *
  *   - struct luo_file_ser:
  *     Metadata for a single preserved file. Contains the `compatible` string to
@@ -134,11 +139,29 @@ struct luo_file_ser {
 	u64 token;
 } __packed;
 
+/**
+ * struct luo_file_header_ser - Header for the serialized file data block.
+ * @next:  Physical address of the next struct luo_file_header_ser.
+ * @count: The number of `struct luo_file_ser` entries that immediately
+ *         follow this header in the memory block.
+ *
+ * This structure is located at the beginning of a block of
+ * physical memory preserved across the kexec. It provides the necessary
+ * metadata to interpret the array of file entries that follow.
+ *
+ * If this structure is modified, `LUO_FDT_SESSION_COMPATIBLE` must be updated.
+ */
+struct luo_file_header_ser {
+	u64 next;
+	u64 count;
+} __packed;
+
 /**
  * struct luo_file_set_ser - Represents the serialized metadata for file set
- * @files:   The physical address of a contiguous memory block that holds
- *           the serialized state of files (array of luo_file_ser) in this file
- *           set.
+ * @files:   The physical address of the first `struct luo_file_header_ser`.
+ *           This structure is the header for a block of memory containing
+ *           an array of `struct luo_file_ser` entries. Multiple blocks are
+ *           linked via the `next` field in the header.
  * @count:   The total number of files that were part of this session during
  *           serialization. Used for iteration and validation during
  *           restoration.
@@ -154,7 +177,7 @@ struct luo_file_set_ser {
  *                          luo_session_header_ser
  */
 #define LUO_FDT_SESSION_NODE_NAME	"luo-session"
-#define LUO_FDT_SESSION_COMPATIBLE	"luo-session-v3"
+#define LUO_FDT_SESSION_COMPATIBLE	"luo-session-v4"
 #define LUO_FDT_SESSION_HEADER		"luo-session-header"
 
 /**
diff --git a/kernel/liveupdate/luo_file.c b/kernel/liveupdate/luo_file.c
index dedbb8d02e6a..20a2d776cff4 100644
--- a/kernel/liveupdate/luo_file.c
+++ b/kernel/liveupdate/luo_file.c
@@ -119,10 +119,12 @@ static LIST_HEAD(luo_file_handler_list);
 /* Keep track of files being preserved by LUO */
 static DEFINE_XARRAY(luo_preserved_files);
 
-/* 2 4K pages, give space for 128 files per file_set */
+/* 2 4K pages, give space for 127 files per block */
 #define LUO_FILE_PGCNT		2ul
-#define LUO_FILE_MAX							\
-	((LUO_FILE_PGCNT << PAGE_SHIFT) / sizeof(struct luo_file_ser))
+#define LUO_FILE_BLOCK_MAX					\
+	(((LUO_FILE_PGCNT << PAGE_SHIFT) -			\
+	  sizeof(struct luo_file_header_ser)) /			\
+	 sizeof(struct luo_file_ser))
 
 /**
  * struct luo_file - Represents a single preserved file instance.
@@ -158,7 +160,7 @@ static DEFINE_XARRAY(luo_preserved_files);
  * and the serialized state handle returned by the handler's .preserve()
  * operation.
  *
- * These instances are tracked in a per-file_set list. The @serialized_data
+ * These structures are tracked in a per-file_set list. The @serialized_data
  * field, which holds a handle to the file's serialized state, may be updated
  * during the .freeze() callback before being serialized for the next kernel.
  * After reboot, these structures are recreated by luo_file_deserialize() and
@@ -175,37 +177,68 @@ struct luo_file {
 	u64 token;
 };
 
-static int luo_alloc_files_mem(struct luo_file_set *file_set)
+static int luo_file_add_block(struct luo_file_set *file_set,
+			      struct luo_file_header_ser *ser)
 {
-	size_t size;
-	void *mem;
+	struct luo_file_block *block;
 
-	if (file_set->files)
-		return 0;
-
-	WARN_ON_ONCE(file_set->count);
+	if (file_set->nblocks >= LUO_MAX_BLOCKS)
+		return -ENOSPC;
 
-	size = LUO_FILE_PGCNT << PAGE_SHIFT;
-	mem = kho_alloc_preserve(size);
-	if (IS_ERR(mem))
-		return PTR_ERR(mem);
+	block = kzalloc_obj(*block);
+	if (!block)
+		return -ENOMEM;
 
-	file_set->files = mem;
+	block->ser = ser;
+	list_add_tail(&block->list, &file_set->blocks);
+	file_set->nblocks++;
 
 	return 0;
 }
 
-static void luo_free_files_mem(struct luo_file_set *file_set)
+static int luo_file_create_ser_block(struct luo_file_set *file_set)
 {
-	/* If file_set has files, no need to free preservation memory */
-	if (file_set->count)
-		return;
+	struct luo_file_block *last = NULL;
+	struct luo_file_header_ser *ser;
+	int err;
 
-	if (!file_set->files)
-		return;
+	ser = kho_alloc_preserve(LUO_FILE_PGCNT << PAGE_SHIFT);
+	if (IS_ERR(ser))
+		return PTR_ERR(ser);
+
+	if (!list_empty(&file_set->blocks))
+		last = list_last_entry(&file_set->blocks, struct luo_file_block, list);
+
+	err = luo_file_add_block(file_set, ser);
+	if (err)
+		goto err_unpreserve;
+
+	if (last)
+		last->ser->next = virt_to_phys(ser);
+
+	return 0;
 
-	kho_unpreserve_free(file_set->files);
-	file_set->files = NULL;
+err_unpreserve:
+	kho_unpreserve_free(ser);
+	return err;
+}
+
+static void luo_file_destroy_ser_blocks(struct luo_file_set *file_set,
+					bool unpreserve)
+{
+	struct luo_file_block *block, *tmp;
+
+	list_for_each_entry_safe(block, tmp, &file_set->blocks, list) {
+		if (block->ser) {
+			if (unpreserve)
+				kho_unpreserve_free(block->ser);
+			else
+				kho_restore_free(block->ser);
+		}
+		list_del(&block->list);
+		kfree(block);
+		file_set->nblocks--;
+	}
 }
 
 static unsigned long luo_get_id(struct liveupdate_file_handler *fh,
@@ -247,7 +280,9 @@ static bool luo_token_is_used(struct luo_file_set *file_set, u64 token)
  * 3. Iterates through registered handlers, calling can_preserve() to find one
  *    compatible with the given @fd.
  * 4. Calls the handler's .preserve() operation, which saves the file's state
- *    and returns an opaque private data handle.
+ *    and returns an opaque u64 handle. This is typically performed while the
+ *    workload is still active to minimize the downtime during the
+ *    actual reboot transition.
  * 5. Adds the new instance to the file_set's internal list.
  *
  * On success, LUO takes a reference to the 'struct file' and considers it
@@ -277,17 +312,16 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
 	if (luo_token_is_used(file_set, token))
 		return -EEXIST;
 
-	if (file_set->count == LUO_FILE_MAX)
-		return -ENOSPC;
+	if (file_set->count == file_set->nblocks * LUO_FILE_BLOCK_MAX) {
+		err = luo_file_create_ser_block(file_set);
+		if (err)
+			return err;
+	}
 
 	file = fget(fd);
 	if (!file)
 		return -EBADF;
 
-	err = luo_alloc_files_mem(file_set);
-	if (err)
-		goto  err_fput;
-
 	err = -ENOENT;
 	down_read(&luo_register_rwlock);
 	list_private_for_each_entry(fh, &luo_file_handler_list, list) {
@@ -301,7 +335,7 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
 
 	/* err is still -ENOENT if no handler was found */
 	if (err)
-		goto err_free_files_mem;
+		goto err_fput;
 
 	/* safe to use fh because its module is pinned */
 	err = xa_insert(&luo_preserved_files, luo_get_id(fh, file),
@@ -345,8 +379,6 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
 	xa_erase(&luo_preserved_files, luo_get_id(fh, file));
 err_module_put:
 	module_put(fh->ops->owner);
-err_free_files_mem:
-	luo_free_files_mem(file_set);
 err_fput:
 	fput(file);
 
@@ -399,7 +431,7 @@ void luo_file_unpreserve_files(struct luo_file_set *file_set)
 		kfree(luo_file);
 	}
 
-	luo_free_files_mem(file_set);
+	luo_file_destroy_ser_blocks(file_set, true);
 }
 
 static int luo_file_freeze_one(struct luo_file_set *file_set,
@@ -446,6 +478,7 @@ static void __luo_file_unfreeze(struct luo_file_set *file_set,
 				struct luo_file *failed_entry)
 {
 	struct list_head *files_list = &file_set->files_list;
+	struct luo_file_block *block;
 	struct luo_file *luo_file;
 
 	list_for_each_entry(luo_file, files_list, list) {
@@ -455,7 +488,11 @@ static void __luo_file_unfreeze(struct luo_file_set *file_set,
 		luo_file_unfreeze_one(file_set, luo_file);
 	}
 
-	memset(file_set->files, 0, LUO_FILE_PGCNT << PAGE_SHIFT);
+	list_for_each_entry(block, &file_set->blocks, list) {
+		block->ser->count = 0;
+		memset(block->ser + 1, 0,
+		       (LUO_FILE_PGCNT << PAGE_SHIFT) - sizeof(*block->ser));
+	}
 }
 
 /**
@@ -494,7 +531,8 @@ static void __luo_file_unfreeze(struct luo_file_set *file_set,
 int luo_file_freeze(struct luo_file_set *file_set,
 		    struct luo_file_set_ser *file_set_ser)
 {
-	struct luo_file_ser *file_ser = file_set->files;
+	struct luo_file_block *block;
+	struct luo_file_ser *file_ser;
 	struct luo_file *luo_file;
 	int err;
 	int i;
@@ -502,11 +540,18 @@ int luo_file_freeze(struct luo_file_set *file_set,
 	if (!file_set->count)
 		return 0;
 
-	if (WARN_ON(!file_ser))
-		return -EINVAL;
+	block = list_first_entry(&file_set->blocks, struct luo_file_block, list);
+	file_ser = (void *)(block->ser + 1);
 
 	i = 0;
 	list_for_each_entry(luo_file, &file_set->files_list, list) {
+		if (i == LUO_FILE_BLOCK_MAX) {
+			block->ser->count = i;
+			block = list_next_entry(block, list);
+			file_ser = (void *)(block->ser + 1);
+			i = 0;
+		}
+
 		err = luo_file_freeze_one(file_set, luo_file);
 		if (err < 0) {
 			pr_warn("Freeze failed for token[%#0llx] handler[%s] err[%pe]\n",
@@ -521,10 +566,13 @@ int luo_file_freeze(struct luo_file_set *file_set,
 		file_ser[i].token = luo_file->token;
 		i++;
 	}
+	block->ser->count = i;
 
 	file_set_ser->count = file_set->count;
-	if (file_set->files)
-		file_set_ser->files = virt_to_phys(file_set->files);
+	if (!list_empty(&file_set->blocks)) {
+		block = list_first_entry(&file_set->blocks, struct luo_file_block, list);
+		file_set_ser->files = virt_to_phys(block->ser);
+	}
 
 	return 0;
 
@@ -746,10 +794,7 @@ int luo_file_finish(struct luo_file_set *file_set)
 		kfree(luo_file);
 	}
 
-	if (file_set->files) {
-		kho_restore_free(file_set->files);
-		file_set->files = NULL;
-	}
+	luo_file_destroy_ser_blocks(file_set, false);
 
 	return 0;
 }
@@ -782,8 +827,10 @@ int luo_file_finish(struct luo_file_set *file_set)
 int luo_file_deserialize(struct luo_file_set *file_set,
 			 struct luo_file_set_ser *file_set_ser)
 {
-	struct luo_file_ser *file_ser;
-	u64 i;
+	struct luo_file_header_ser *header_ser;
+	struct luo_file_block *block;
+	u64 header_ser_pa;
+	int err;
 
 	if (!file_set_ser->files) {
 		WARN_ON(file_set_ser->count);
@@ -791,7 +838,15 @@ int luo_file_deserialize(struct luo_file_set *file_set,
 	}
 
 	file_set->count = file_set_ser->count;
-	file_set->files = phys_to_virt(file_set_ser->files);
+	header_ser_pa = file_set_ser->files;
+
+	while (header_ser_pa) {
+		header_ser = phys_to_virt(header_ser_pa);
+		err = luo_file_add_block(file_set, header_ser);
+		if (err)
+			return err;
+		header_ser_pa = header_ser->next;
+	}
 
 	/*
 	 * Note on error handling:
@@ -808,42 +863,51 @@ int luo_file_deserialize(struct luo_file_set *file_set,
 	 * userspace to detect the failure and trigger a reboot, which will
 	 * reliably reset devices and reclaim memory.
 	 */
-	file_ser = file_set->files;
-	for (i = 0; i < file_set->count; i++) {
-		struct liveupdate_file_handler *fh;
-		bool handler_found = false;
-		struct luo_file *luo_file;
-
-		down_read(&luo_register_rwlock);
-		list_private_for_each_entry(fh, &luo_file_handler_list, list) {
-			if (!strcmp(fh->compatible, file_ser[i].compatible)) {
-				if (try_module_get(fh->ops->owner))
-					handler_found = true;
-				break;
-			}
-		}
-		up_read(&luo_register_rwlock);
+	list_for_each_entry(block, &file_set->blocks, list) {
+		struct luo_file_ser *file_ser = (void *)(block->ser + 1);
 
-		if (!handler_found) {
-			pr_warn("No registered handler for compatible '%.*s'\n",
-				(int)sizeof(file_ser[i].compatible),
-				file_ser[i].compatible);
-			return -ENOENT;
+		if (block->ser->count > LUO_FILE_BLOCK_MAX) {
+			pr_warn("File block contains too many entries: %llu\n",
+				block->ser->count);
+			return -EINVAL;
 		}
 
-		luo_file = kzalloc_obj(*luo_file);
-		if (!luo_file) {
-			module_put(fh->ops->owner);
-			return -ENOMEM;
-		}
+		for (int i = 0; i < block->ser->count; i++) {
+			struct liveupdate_file_handler *fh;
+			bool handler_found = false;
+			struct luo_file *luo_file;
+
+			down_read(&luo_register_rwlock);
+			list_private_for_each_entry(fh, &luo_file_handler_list, list) {
+				if (!strcmp(fh->compatible, file_ser[i].compatible)) {
+					if (try_module_get(fh->ops->owner))
+						handler_found = true;
+					break;
+				}
+			}
+			up_read(&luo_register_rwlock);
 
-		/* safe to use fh because its module is pinned */
-		luo_file->fh = fh;
-		luo_file->file = NULL;
-		luo_file->serialized_data = file_ser[i].data;
-		luo_file->token = file_ser[i].token;
-		mutex_init(&luo_file->mutex);
-		list_add_tail(&luo_file->list, &file_set->files_list);
+			if (!handler_found) {
+				pr_warn("No registered handler for compatible '%.*s'\n",
+					(int)sizeof(file_ser[i].compatible),
+					file_ser[i].compatible);
+				return -ENOENT;
+			}
+
+			luo_file = kzalloc_obj(*luo_file);
+			if (!luo_file) {
+				module_put(fh->ops->owner);
+				return -ENOMEM;
+			}
+
+			/* safe to use fh because its module is pinned */
+			luo_file->fh = fh;
+			luo_file->file = NULL;
+			luo_file->serialized_data = file_ser[i].data;
+			luo_file->token = file_ser[i].token;
+			mutex_init(&luo_file->mutex);
+			list_add_tail(&luo_file->list, &file_set->files_list);
+		}
 	}
 
 	return 0;
@@ -852,12 +916,14 @@ int luo_file_deserialize(struct luo_file_set *file_set,
 void luo_file_set_init(struct luo_file_set *file_set)
 {
 	INIT_LIST_HEAD(&file_set->files_list);
+	INIT_LIST_HEAD(&file_set->blocks);
 }
 
 void luo_file_set_destroy(struct luo_file_set *file_set)
 {
 	WARN_ON(file_set->count);
 	WARN_ON(!list_empty(&file_set->files_list));
+	WARN_ON(!list_empty(&file_set->blocks));
 }
 
 /**
diff --git a/kernel/liveupdate/luo_internal.h b/kernel/liveupdate/luo_internal.h
index a73f42069301..a92aaa9c073d 100644
--- a/kernel/liveupdate/luo_internal.h
+++ b/kernel/liveupdate/luo_internal.h
@@ -50,19 +50,30 @@ static inline int luo_ucmd_respond(struct luo_ucmd *ucmd,
  */
 #define luo_restore_fail(__fmt, ...) panic(__fmt, ##__VA_ARGS__)
 
+/**
+ * struct luo_file_block - Internal representation of a file serialization block.
+ * @list: List head for linking blocks in memory.
+ * @ser:  Pointer to the serialized header in preserved memory.
+ */
+struct luo_file_block {
+	struct list_head list;
+	struct luo_file_header_ser *ser;
+};
+
 /**
  * struct luo_file_set - A set of files that belong to the same sessions.
  * @files_list: An ordered list of files associated with this session, it is
  *              ordered by preservation time.
- * @files:      The physically contiguous memory block that holds the serialized
- *              state of files.
+ * @blocks:     The list of serialization blocks (struct luo_file_block).
  * @count:      A counter tracking the number of files currently stored in the
  *              @files_list for this session.
+ * @nblocks:    The number of allocated serialization blocks.
  */
 struct luo_file_set {
 	struct list_head files_list;
-	struct luo_file_ser *files;
+	struct list_head blocks;
 	long count;
+	long nblocks;
 };
 
 /**
-- 
2.43.0

[PATCH 3/5] selftests/liveupdate: Test session and file limit removal

[Pasha Tatashin]

With the removal of static limits on the number of sessions and files per
session, the orchestrator now uses dynamic allocation.

Add new test cases to verify that the system can handle a large number of
sessions and files. These tests ensure that the dynamic block allocation
and reuse logic for session metadata and outgoing files work correctly
beyond the previous static limits.

Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
 .../testing/selftests/liveupdate/liveupdate.c | 99 +++++++++++++++++++
 1 file changed, 99 insertions(+)

diff --git a/tools/testing/selftests/liveupdate/liveupdate.c b/tools/testing/selftests/liveupdate/liveupdate.c
index 37c808fbe1e9..0eaf97b19267 100644
--- a/tools/testing/selftests/liveupdate/liveupdate.c
+++ b/tools/testing/selftests/liveupdate/liveupdate.c
@@ -22,6 +22,7 @@
 #include <fcntl.h>
 #include <string.h>
 #include <sys/ioctl.h>
+#include <sys/resource.h>
 #include <unistd.h>
 
 #include <linux/liveupdate.h>
@@ -386,4 +387,102 @@ TEST_F(liveupdate_device, prevent_double_preservation)
 	ASSERT_EQ(close(session_fd2), 0);
 }
 
+static void ensure_nofile_limit(struct __test_metadata *_metadata,
+				long min_limit)
+{
+	struct rlimit hl;
+
+	if (getrlimit(RLIMIT_NOFILE, &hl) < 0)
+		ksft_exit_fail_msg("getrlimit failed: %s\n", strerror(errno));
+
+	if (hl.rlim_cur >= min_limit)
+		return;
+
+	hl.rlim_cur = min_limit;
+	if (hl.rlim_cur > hl.rlim_max)
+		hl.rlim_max = hl.rlim_cur;
+
+	if (setrlimit(RLIMIT_NOFILE, &hl) < 0) {
+		if (errno == EPERM) {
+			SKIP(return, "Insufficient privileges to set RLIMIT_NOFILE to %ld",
+			     hl.rlim_cur);
+		}
+		ksft_exit_fail_msg("setrlimit to %ld failed: %s\n",
+				   hl.rlim_cur, strerror(errno));
+	}
+}
+
+/*
+ * Test Case: Manage Many Sessions
+ *
+ * Verifies that a large number of sessions can be created and then
+ * destroyed during normal system operation. This specifically tests the
+ * dynamic block allocation and reuse logic for session metadata management
+ * without preserving any files.
+ */
+TEST_F(liveupdate_device, preserve_many_sessions)
+{
+#define MANY_SESSIONS 2000
+	int session_fds[MANY_SESSIONS];
+	int i;
+
+	self->fd1 = open(LIVEUPDATE_DEV, O_RDWR);
+	if (self->fd1 < 0 && errno == ENOENT)
+		SKIP(return, "%s does not exist", LIVEUPDATE_DEV);
+	ASSERT_GE(self->fd1, 0);
+
+	ensure_nofile_limit(_metadata, MANY_SESSIONS + 10);
+	if (_metadata->exit_code == KSFT_SKIP)
+		return;
+
+	for (i = 0; i < MANY_SESSIONS; i++) {
+		char name[64];
+
+		snprintf(name, sizeof(name), "many-session-%d", i);
+		session_fds[i] = create_session(self->fd1, name);
+		ASSERT_GE(session_fds[i], 0);
+	}
+
+	for (i = 0; i < MANY_SESSIONS; i++)
+		ASSERT_EQ(close(session_fds[i]), 0);
+}
+
+/*
+ * Test Case: Preserve Many Files
+ *
+ * Verifies that a large number of files can be preserved in a single session
+ * and then destroyed during normal system operation. This tests the dynamic
+ * block allocation and management for outgoing files.
+ */
+TEST_F(liveupdate_device, preserve_many_files)
+{
+#define MANY_FILES 500
+	int mem_fds[MANY_FILES];
+	int session_fd;
+	int i;
+
+	self->fd1 = open(LIVEUPDATE_DEV, O_RDWR);
+	if (self->fd1 < 0 && errno == ENOENT)
+		SKIP(return, "%s does not exist", LIVEUPDATE_DEV);
+	ASSERT_GE(self->fd1, 0);
+
+	session_fd = create_session(self->fd1, "many-files-test");
+	ASSERT_GE(session_fd, 0);
+
+	ensure_nofile_limit(_metadata, MANY_FILES + 10);
+	if (_metadata->exit_code == KSFT_SKIP)
+		return;
+
+	for (i = 0; i < MANY_FILES; i++) {
+		mem_fds[i] = memfd_create("test-memfd", 0);
+		ASSERT_GE(mem_fds[i], 0);
+		ASSERT_EQ(preserve_fd(session_fd, mem_fds[i], i), 0);
+	}
+
+	for (i = 0; i < MANY_FILES; i++)
+		ASSERT_EQ(close(mem_fds[i]), 0);
+
+	ASSERT_EQ(close(session_fd), 0);
+}
+
 TEST_HARNESS_MAIN
-- 
2.43.0

[PATCH 4/5] selftests/liveupdate: Add stress-sessions kexec test

[Pasha Tatashin]

Add a new test that creates 2000 LUO sessions before a kexec
reboot and verifies their presence after the reboot. This ensures
that the linked-block serialization mechanism works correctly for
a large number of sessions.

Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
 tools/testing/selftests/liveupdate/Makefile   |  1 +
 .../liveupdate/luo_stress_sessions.c          | 98 +++++++++++++++++++
 .../selftests/liveupdate/luo_test_utils.c     | 25 +++++
 .../selftests/liveupdate/luo_test_utils.h     |  2 +
 4 files changed, 126 insertions(+)
 create mode 100644 tools/testing/selftests/liveupdate/luo_stress_sessions.c

diff --git a/tools/testing/selftests/liveupdate/Makefile b/tools/testing/selftests/liveupdate/Makefile
index 080754787ede..ed7534468386 100644
--- a/tools/testing/selftests/liveupdate/Makefile
+++ b/tools/testing/selftests/liveupdate/Makefile
@@ -6,6 +6,7 @@ TEST_GEN_PROGS += liveupdate
 
 TEST_GEN_PROGS_EXTENDED += luo_kexec_simple
 TEST_GEN_PROGS_EXTENDED += luo_multi_session
+TEST_GEN_PROGS_EXTENDED += luo_stress_sessions
 
 TEST_FILES += do_kexec.sh
 
diff --git a/tools/testing/selftests/liveupdate/luo_stress_sessions.c b/tools/testing/selftests/liveupdate/luo_stress_sessions.c
new file mode 100644
index 000000000000..cd6e9bb0db3c
--- /dev/null
+++ b/tools/testing/selftests/liveupdate/luo_stress_sessions.c
@@ -0,0 +1,98 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+/*
+ * Copyright (c) 2026, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ *
+ * Validate that LUO can handle a large number of sessions across a kexec
+ * reboot.
+ */
+
+#include <stdio.h>
+#include <unistd.h>
+#include "luo_test_utils.h"
+
+#define NUM_SESSIONS 2000
+#define STATE_SESSION_NAME "kexec_many_state"
+#define STATE_MEMFD_TOKEN 999
+
+/* Stage 1: Executed before the kexec reboot. */
+static void run_stage_1(int luo_fd)
+{
+	int i;
+
+	ksft_print_msg("[STAGE 1] Increasing ulimit for open files...\n");
+	luo_ensure_nofile_limit(NUM_SESSIONS + 10);
+
+	ksft_print_msg("[STAGE 1] Creating state file for next stage (2)...\n");
+	create_state_file(luo_fd, STATE_SESSION_NAME, STATE_MEMFD_TOKEN, 2);
+
+	ksft_print_msg("[STAGE 1] Creating %d sessions...\n", NUM_SESSIONS);
+
+	for (i = 0; i < NUM_SESSIONS; i++) {
+		char name[LIVEUPDATE_SESSION_NAME_LENGTH];
+		int s_fd;
+
+		snprintf(name, sizeof(name), "many-test-%d", i);
+		s_fd = luo_create_session(luo_fd, name);
+		if (s_fd < 0) {
+			fail_exit("luo_create_session for '%s' at index %d",
+				  name, i);
+		}
+	}
+
+	ksft_print_msg("[STAGE 1] Successfully created %d sessions.\n",
+		       NUM_SESSIONS);
+
+	close(luo_fd);
+	daemonize_and_wait();
+}
+
+/* Stage 2: Executed after the kexec reboot. */
+static void run_stage_2(int luo_fd, int state_session_fd)
+{
+	int i, stage;
+
+	ksft_print_msg("[STAGE 2] Starting post-kexec verification...\n");
+
+	restore_and_read_stage(state_session_fd, STATE_MEMFD_TOKEN, &stage);
+	if (stage != 2) {
+		fail_exit("Expected stage 2, but state file contains %d",
+			  stage);
+	}
+
+	ksft_print_msg("[STAGE 2] Retrieving and finishing %d sessions...\n",
+		       NUM_SESSIONS);
+
+	for (i = 0; i < NUM_SESSIONS; i++) {
+		char name[LIVEUPDATE_SESSION_NAME_LENGTH];
+		int s_fd;
+
+		snprintf(name, sizeof(name), "many-test-%d", i);
+		s_fd = luo_retrieve_session(luo_fd, name);
+		if (s_fd < 0) {
+			fail_exit("luo_retrieve_session for '%s' at index %d",
+				  name, i);
+		}
+
+		if (luo_session_finish(s_fd) < 0) {
+			fail_exit("luo_session_finish for '%s' at index %d",
+				  name, i);
+		}
+		close(s_fd);
+	}
+
+	ksft_print_msg("[STAGE 2] Finalizing state session...\n");
+	if (luo_session_finish(state_session_fd) < 0)
+		fail_exit("luo_session_finish for state session");
+	close(state_session_fd);
+
+	ksft_print_msg("\n--- MANY-SESSIONS KEXEC TEST PASSED (%d sessions) ---\n",
+		       NUM_SESSIONS);
+}
+
+int main(int argc, char *argv[])
+{
+	return luo_test(argc, argv, STATE_SESSION_NAME,
+			run_stage_1, run_stage_2);
+}
diff --git a/tools/testing/selftests/liveupdate/luo_test_utils.c b/tools/testing/selftests/liveupdate/luo_test_utils.c
index 3c8721c505df..37c330b9bb36 100644
--- a/tools/testing/selftests/liveupdate/luo_test_utils.c
+++ b/tools/testing/selftests/liveupdate/luo_test_utils.c
@@ -20,6 +20,7 @@
 #include <sys/stat.h>
 #include <errno.h>
 #include <stdarg.h>
+#include <sys/resource.h>
 
 #include "luo_test_utils.h"
 
@@ -28,6 +29,30 @@ int luo_open_device(void)
 	return open(LUO_DEVICE, O_RDWR);
 }
 
+void luo_ensure_nofile_limit(long min_limit)
+{
+	struct rlimit hl;
+
+	if (getrlimit(RLIMIT_NOFILE, &hl) < 0)
+		ksft_exit_fail_msg("getrlimit failed: %s\n", strerror(errno));
+
+	if (hl.rlim_cur >= min_limit)
+		return;
+
+	hl.rlim_cur = min_limit;
+	if (hl.rlim_cur > hl.rlim_max)
+		hl.rlim_max = hl.rlim_cur;
+
+	if (setrlimit(RLIMIT_NOFILE, &hl) < 0) {
+		if (errno == EPERM) {
+			ksft_exit_skip("Insufficient privileges to set RLIMIT_NOFILE to %ld\n",
+				       hl.rlim_cur);
+		}
+		ksft_exit_fail_msg("setrlimit to %ld failed: %s\n",
+				   hl.rlim_cur, strerror(errno));
+	}
+}
+
 int luo_create_session(int luo_fd, const char *name)
 {
 	struct liveupdate_ioctl_create_session arg = { .size = sizeof(arg) };
diff --git a/tools/testing/selftests/liveupdate/luo_test_utils.h b/tools/testing/selftests/liveupdate/luo_test_utils.h
index 90099bf49577..9174d6757a7f 100644
--- a/tools/testing/selftests/liveupdate/luo_test_utils.h
+++ b/tools/testing/selftests/liveupdate/luo_test_utils.h
@@ -26,6 +26,8 @@ int luo_create_session(int luo_fd, const char *name);
 int luo_retrieve_session(int luo_fd, const char *name);
 int luo_session_finish(int session_fd);
 
+void luo_ensure_nofile_limit(long min_limit);
+
 int create_and_preserve_memfd(int session_fd, int token, const char *data);
 int restore_and_verify_memfd(int session_fd, int token, const char *expected_data);
 
-- 
2.43.0

[PATCH 5/5] selftests/liveupdate: Add stress-files kexec test

[Pasha Tatashin]

Add a new luo_stress_files kexec test that verifies preserving and
retrieving 500 files across a kexec reboot.

Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
 tools/testing/selftests/liveupdate/Makefile   |  1 +
 .../selftests/liveupdate/luo_stress_files.c   | 98 +++++++++++++++++++
 2 files changed, 99 insertions(+)
 create mode 100644 tools/testing/selftests/liveupdate/luo_stress_files.c

diff --git a/tools/testing/selftests/liveupdate/Makefile b/tools/testing/selftests/liveupdate/Makefile
index ed7534468386..30689d22cb02 100644
--- a/tools/testing/selftests/liveupdate/Makefile
+++ b/tools/testing/selftests/liveupdate/Makefile
@@ -7,6 +7,7 @@ TEST_GEN_PROGS += liveupdate
 TEST_GEN_PROGS_EXTENDED += luo_kexec_simple
 TEST_GEN_PROGS_EXTENDED += luo_multi_session
 TEST_GEN_PROGS_EXTENDED += luo_stress_sessions
+TEST_GEN_PROGS_EXTENDED += luo_stress_files
 
 TEST_FILES += do_kexec.sh
 
diff --git a/tools/testing/selftests/liveupdate/luo_stress_files.c b/tools/testing/selftests/liveupdate/luo_stress_files.c
new file mode 100644
index 000000000000..6217122b92f4
--- /dev/null
+++ b/tools/testing/selftests/liveupdate/luo_stress_files.c
@@ -0,0 +1,98 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+/*
+ * Copyright (c) 2026, Google LLC.
+ * Pasha Tatashin <pasha.tatashin@soleen.com>
+ *
+ * Validate that LUO can handle a large number of files per session across
+ * a kexec reboot.
+ */
+
+#include <stdio.h>
+#include <unistd.h>
+#include "luo_test_utils.h"
+
+#define NUM_FILES 500
+#define STATE_SESSION_NAME "kexec_many_files_state"
+#define STATE_MEMFD_TOKEN 9999
+#define TEST_SESSION_NAME "many_files_session"
+
+/* Stage 1: Executed before the kexec reboot. */
+static void run_stage_1(int luo_fd)
+{
+	int session_fd;
+	int i;
+
+	ksft_print_msg("[STAGE 1] Increasing ulimit for open files...\n");
+	luo_ensure_nofile_limit(NUM_FILES + 10);
+
+	ksft_print_msg("[STAGE 1] Creating state file for next stage (2)...\n");
+	create_state_file(luo_fd, STATE_SESSION_NAME, STATE_MEMFD_TOKEN, 2);
+
+	ksft_print_msg("[STAGE 1] Creating test session '%s'...\n", TEST_SESSION_NAME);
+	session_fd = luo_create_session(luo_fd, TEST_SESSION_NAME);
+	if (session_fd < 0)
+		fail_exit("luo_create_session");
+
+	ksft_print_msg("[STAGE 1] Preserving %d files...\n", NUM_FILES);
+	for (i = 0; i < NUM_FILES; i++) {
+		char data[64];
+
+		snprintf(data, sizeof(data), "file-data-%d", i);
+		if (create_and_preserve_memfd(session_fd, i, data) < 0)
+			fail_exit("create_and_preserve_memfd for index %d", i);
+	}
+
+	ksft_print_msg("[STAGE 1] Successfully preserved %d files.\n", NUM_FILES);
+
+	close(luo_fd);
+	daemonize_and_wait();
+}
+
+/* Stage 2: Executed after the kexec reboot. */
+static void run_stage_2(int luo_fd, int state_session_fd)
+{
+	int session_fd;
+	int i, stage;
+
+	ksft_print_msg("[STAGE 2] Starting post-kexec verification...\n");
+
+	restore_and_read_stage(state_session_fd, STATE_MEMFD_TOKEN, &stage);
+	if (stage != 2) {
+		fail_exit("Expected stage 2, but state file contains %d",
+			  stage);
+	}
+
+	ksft_print_msg("[STAGE 2] Retrieving test session '%s'...\n", TEST_SESSION_NAME);
+	session_fd = luo_retrieve_session(luo_fd, TEST_SESSION_NAME);
+	if (session_fd < 0)
+		fail_exit("luo_retrieve_session");
+
+	ksft_print_msg("[STAGE 2] Verifying %d files...\n", NUM_FILES);
+	for (i = 0; i < NUM_FILES; i++) {
+		char data[64];
+
+		snprintf(data, sizeof(data), "file-data-%d", i);
+		if (restore_and_verify_memfd(session_fd, i, data) < 0)
+			fail_exit("restore_and_verify_memfd for index %d", i);
+	}
+
+	ksft_print_msg("[STAGE 2] Finishing test session...\n");
+	if (luo_session_finish(session_fd) < 0)
+		fail_exit("luo_session_finish for test session");
+	close(session_fd);
+
+	ksft_print_msg("[STAGE 2] Finalizing state session...\n");
+	if (luo_session_finish(state_session_fd) < 0)
+		fail_exit("luo_session_finish for state session");
+	close(state_session_fd);
+
+	ksft_print_msg("\n--- MANY-FILES KEXEC TEST PASSED (%d files) ---\n",
+		       NUM_FILES);
+}
+
+int main(int argc, char *argv[])
+{
+	return luo_test(argc, argv, STATE_SESSION_NAME,
+			run_stage_1, run_stage_2);
+}
-- 
2.43.0