selftests/bpf: Reject graph kptr use after RCU unlockgrafted

Add a sleepable verifier test that loads a graph-node local kptr in an
explicit RCU read-side critical section, then passes its node to
bpf_rbtree_remove() after the section ends.

Before the verifier fix, the stale NON_OWN_REF flag makes the node look like
a live borrowed reference and the program is accepted. After the fix, the
pointer is demoted without NON_OWN_REF and the graph kfunc argument is
rejected.

Also exercise a graph kptr loaded while a spin lock provides implicit RCU
protection. The pointer must be invalidated when the lock is released, which
guards the required ordering between non-owning-reference invalidation and
RCU demotion.

Update the existing fault-protected load test state description. The
post-unlock pointer no longer carries NON_OWN_REF, but remains readable
because the load is rewritten to use BPF_PROBE_MEM.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 131 insertions, 0 deletions

diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps
new file mode 100644
index 000000000..0ee42b0cc
--- /dev/null
+++ b/arch/arm64/tools/cpucaps
@@ -0,0 +1,131 @@
+# SPDX-License-Identifier: GPL-2.0
+#
+# Internal CPU capabilities constants
+
+ALWAYS_BOOT
+ALWAYS_SYSTEM
+BTI
+# Unreliable: use system_supports_32bit_el0() instead.
+HAS_32BIT_EL0_DO_NOT_USE
+HAS_32BIT_EL1
+HAS_ADDRESS_AUTH
+HAS_ADDRESS_AUTH_ARCH_QARMA3
+HAS_ADDRESS_AUTH_ARCH_QARMA5
+HAS_ADDRESS_AUTH_IMP_DEF
+HAS_AMU_EXTN
+HAS_ARMv8_4_TTL
+HAS_BBML3
+HAS_CACHE_DIC
+HAS_CACHE_IDC
+HAS_CNP
+HAS_CRC32
+HAS_DCPODP
+HAS_DCPOP
+HAS_DIT
+HAS_E0PD
+HAS_ECV
+HAS_ECV_CNTPOFF
+HAS_EPAN
+HAS_EVT
+HAS_FPMR
+HAS_FGT
+HAS_FGT2
+HAS_FPSIMD
+HAS_GCS
+HAS_GENERIC_AUTH
+HAS_GENERIC_AUTH_ARCH_QARMA3
+HAS_GENERIC_AUTH_ARCH_QARMA5
+HAS_GENERIC_AUTH_IMP_DEF
+HAS_GICV3_CPUIF
+HAS_GICV5_CPUIF
+HAS_GICV5_LEGACY
+HAS_GIC_PRIO_MASKING
+HAS_GIC_PRIO_RELAXED_SYNC
+HAS_ICH_HCR_EL2_TDIR
+HAS_HCR_NV1
+HAS_HCX
+HAS_LDAPR
+HAS_LPA2
+HAS_LSE_ATOMICS
+HAS_LS64
+HAS_LS64_V
+HAS_LSUI
+HAS_MOPS
+HAS_NESTED_VIRT
+HAS_PAN
+HAS_PMUV3
+HAS_S1PIE
+HAS_S1POE
+HAS_SCTLR2
+HAS_RAS_EXTN
+HAS_RASV1P1_EXTN
+HAS_RNG
+HAS_SB
+HAS_STAGE2_FWB
+HAS_TCR2
+HAS_TIDCP1
+HAS_TLB_RANGE
+HAS_VA52
+HAS_VIRT_HOST_EXTN
+HAS_WFXT
+HAS_XNX
+HAFT
+HW_DBM
+KVM_HVHE
+KVM_PROTECTED_MODE
+MISMATCHED_CACHE_TYPE
+MPAM
+MPAM_HCR
+MTE
+MTE_ASYMM
+MTE_FAR
+MTE_STORE_ONLY
+SME
+SME_FA64
+SME2
+SPECTRE_V2
+SPECTRE_V3A
+SPECTRE_V4
+SPECTRE_BHB
+SSBS
+SVE
+UNMAP_KERNEL_AT_EL0
+WORKAROUND_834220
+WORKAROUND_843419
+WORKAROUND_845719
+WORKAROUND_858921
+WORKAROUND_1418040
+WORKAROUND_1463225
+WORKAROUND_1508412
+WORKAROUND_1542419
+WORKAROUND_1742098
+WORKAROUND_1902691
+WORKAROUND_2038923
+WORKAROUND_2064142
+WORKAROUND_2077057
+WORKAROUND_2457168
+WORKAROUND_2645198
+WORKAROUND_2658417
+WORKAROUND_4193714
+WORKAROUND_4311569
+WORKAROUND_AMPERE_AC03_CPU_38
+WORKAROUND_AMPERE_AC04_CPU_23
+WORKAROUND_TRBE_OVERWRITE_FILL_MODE
+WORKAROUND_TSB_FLUSH_FAILURE
+WORKAROUND_TRBE_WRITE_OUT_OF_RANGE
+WORKAROUND_CAVIUM_23154
+WORKAROUND_CAVIUM_27456
+WORKAROUND_CAVIUM_30115
+WORKAROUND_CAVIUM_TX2_219_PRFM
+WORKAROUND_CAVIUM_TX2_219_TVM
+WORKAROUND_CLEAN_CACHE
+WORKAROUND_DEVICE_LOAD_ACQUIRE
+WORKAROUND_DISABLE_CNP
+WORKAROUND_NVIDIA_OLYMPUS_1027
+WORKAROUND_PMUV3_IMPDEF_TRAPS
+WORKAROUND_QCOM_FALKOR_E1003
+WORKAROUND_QCOM_ORYON_CNTVOFF
+WORKAROUND_REPEAT_TLBI_SYNC
+WORKAROUND_SPECULATIVE_AT
+WORKAROUND_SPECULATIVE_SSBS
+WORKAROUND_SPECULATIVE_UNPRIV_LOAD