debugfs access modes were added in Linux 5.10 (Dec 2020) [1], but the
no-mount mode has behaved effectively the same as the off mode since
Linux 5.12 (Apr 2021) [2]. The only difference is the specific error
code returned by the debugfs_create_* functions, which is -ENOENT in
no-mount mode and -EPERM in off mode.
Given that no-mount hasn't worked for several years with no complaints,
just remove it.
[1] a24c6f7bc923 ("debugfs: Add access restriction option")
[2] bc6de804d36b ("debugfs: be more robust at handling improper input in debugfs_lookup()")
56348560d495 ("debugfs: do not attempt to create a new file before the filesystem is initalized")
Signed-off-by: Aaron Thompson <dev@aaront.org>
---
.../admin-guide/kernel-parameters.txt | 6 +-----
fs/debugfs/inode.c | 18 +++++++++++-------
fs/debugfs/internal.h | 13 -------------
lib/Kconfig.debug | 9 +--------
4 files changed, 13 insertions(+), 33 deletions(-)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 6c42061ca20e..847a17efe289 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -1113,12 +1113,8 @@
debugfs= [KNL,EARLY] This parameter enables what is exposed to
userspace and debugfs internal clients.
- Format: { on, no-mount, off }
+ Format: { on, off }
on: All functions are enabled.
- no-mount:
- Filesystem is not registered but kernel clients can
- access APIs and a crashkernel can be used to read
- its content. There is nothing to mount.
off: Filesystem is not registered and clients
get a -EPERM as result when trying to register files
or directories within debugfs.
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index b6e401c46b6b..0284b0256195 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -35,7 +35,7 @@
static struct vfsmount *debugfs_mount;
static int debugfs_mount_count;
static bool debugfs_registered;
-static unsigned int debugfs_allow __ro_after_init = DEFAULT_DEBUGFS_ALLOW_BITS;
+static bool debugfs_enabled __ro_after_init = IS_ENABLED(DEBUG_FS_ALLOW_ALL);
/*
* Don't allow access attributes to be changed whilst the kernel is locked down
@@ -365,7 +365,7 @@ static struct dentry *debugfs_start_creating(const char *name,
struct dentry *dentry;
int error;
- if (!(debugfs_allow & DEBUGFS_ALLOW_API))
+ if (!debugfs_enabled)
return ERR_PTR(-EPERM);
if (!debugfs_initialized())
@@ -885,21 +885,25 @@ static int __init debugfs_kernel(char *str)
{
if (str) {
if (!strcmp(str, "on"))
- debugfs_allow = DEBUGFS_ALLOW_API | DEBUGFS_ALLOW_MOUNT;
- else if (!strcmp(str, "no-mount"))
- debugfs_allow = DEBUGFS_ALLOW_API;
+ debugfs_enabled = true;
else if (!strcmp(str, "off"))
- debugfs_allow = 0;
+ debugfs_enabled = false;
+ else if (!strcmp(str, "no-mount")) {
+ pr_notice("debugfs=no-mount is a deprecated alias "
+ "for debugfs=off\n");
+ debugfs_enabled = false;
+ }
}
return 0;
}
early_param("debugfs", debugfs_kernel);
+
static int __init debugfs_init(void)
{
int retval;
- if (!(debugfs_allow & DEBUGFS_ALLOW_MOUNT))
+ if (!debugfs_enabled)
return -EPERM;
retval = sysfs_create_mount_point(kernel_kobj, "debug");
diff --git a/fs/debugfs/internal.h b/fs/debugfs/internal.h
index 427987f81571..c95699b27a56 100644
--- a/fs/debugfs/internal.h
+++ b/fs/debugfs/internal.h
@@ -55,17 +55,4 @@ enum {
HAS_IOCTL = 16
};
-#define DEBUGFS_ALLOW_API BIT(0)
-#define DEBUGFS_ALLOW_MOUNT BIT(1)
-
-#ifdef CONFIG_DEBUG_FS_ALLOW_ALL
-#define DEFAULT_DEBUGFS_ALLOW_BITS (DEBUGFS_ALLOW_MOUNT | DEBUGFS_ALLOW_API)
-#endif
-#ifdef CONFIG_DEBUG_FS_DISALLOW_MOUNT
-#define DEFAULT_DEBUGFS_ALLOW_BITS (DEBUGFS_ALLOW_API)
-#endif
-#ifdef CONFIG_DEBUG_FS_ALLOW_NONE
-#define DEFAULT_DEBUGFS_ALLOW_BITS (0)
-#endif
-
#endif /* _DEBUGFS_INTERNAL_H_ */
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 3034e294d50d..d9ab42916143 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -679,7 +679,7 @@ choice
help
This selects the default access restrictions for debugfs.
It can be overridden with kernel command line option
- debugfs=[on,no-mount,off]. The restrictions apply for API access
+ debugfs=[on,off]. The restrictions apply for API access
and filesystem registration.
config DEBUG_FS_ALLOW_ALL
@@ -688,13 +688,6 @@ config DEBUG_FS_ALLOW_ALL
No restrictions apply. Both API and filesystem registration
is on. This is the normal default operation.
-config DEBUG_FS_DISALLOW_MOUNT
- bool "Do not register debugfs as filesystem"
- help
- The API is open but filesystem is not loaded. Clients can still do
- their work and read with debug tools that do not need
- debugfs filesystem.
-
config DEBUG_FS_ALLOW_NONE
bool "No access"
help
--
2.47.3On Thu, Nov 20, 2025 at 10:26:33AM +0000, Aaron Thompson wrote: > debugfs access modes were added in Linux 5.10 (Dec 2020) [1], but the > no-mount mode has behaved effectively the same as the off mode since > Linux 5.12 (Apr 2021) [2]. The only difference is the specific error > code returned by the debugfs_create_* functions, which is -ENOENT in > no-mount mode and -EPERM in off mode. I'm seeing regressions in -next in a lot of testing stuff which bisect to this patch. I've got a test that looks at the deferred probe list to see if it's empty, and the mm split_huge_page_test which uses a debugfs file called split_huge_pages. Neither of these mount debugfs for themselves, they just assume it'll be there - it looks like that's not happening any more but I didn't investigate properly. I don't immediately see what's getting confused, DEBUG_FS_ALLOW_ALL is the default and not overridden by anything in any defconfig so debugfs_enabled still ought to be being set, but I didn't actually try to debug this yet. Sample bisect: git bisect start # status: waiting for both good and bad commits # bad: [95cb2fd6ce0ad61af54191fe5ef271d7177f9c3a] Add linux-next specific files for 20251201 git bisect bad 95cb2fd6ce0ad61af54191fe5ef271d7177f9c3a # status: waiting for good commit(s), bad commit known # good: [4ffc97b7687d1b355f08f464e212fb1085ec5c34] Merge branch 'tip/urgent' of https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git git bisect good 4ffc97b7687d1b355f08f464e212fb1085ec5c34 # good: [87d5c4addc7e535618586e7205191a7f402288ba] Merge branch 'master' of https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git git bisect good 87d5c4addc7e535618586e7205191a7f402288ba # good: [a4ad48eac682ccdc21e2f16b8f27abbf615d8d3d] Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator.git git bisect good a4ad48eac682ccdc21e2f16b8f27abbf615d8d3d # bad: [b99f4ac0a6c7ccf37be14f5ef61b160b1c8a74b0] Merge branch 'driver-core-next' of https://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core.git git bisect bad b99f4ac0a6c7ccf37be14f5ef61b160b1c8a74b0 # good: [24cefd05bbf969c95fff3733da174e8a352c1cb2] Merge branch 'master' of https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git git bisect good 24cefd05bbf969c95fff3733da174e8a352c1cb2 # good: [a5d0f36158717334aa85753fab8dedfa0dfeeaca] Merge branch 'riscv_kvm_next' of https://github.com/kvm-riscv/linux.git git bisect good a5d0f36158717334aa85753fab8dedfa0dfeeaca # good: [f16919001053bba074af696571831d4d3e7f86bc] Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/tj/wq.git git bisect good f16919001053bba074af696571831d4d3e7f86bc # good: [4f7961a0cc56637fb5df8d118e72ab12160e6c11] Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86.git git bisect good 4f7961a0cc56637fb5df8d118e72ab12160e6c11 # good: [0a75f3d90e7ab9cd182327fca4b4e3bce379afe5] devres: Move devm_alloc_percpu() and related to devres.h git bisect good 0a75f3d90e7ab9cd182327fca4b4e3bce379afe5 # good: [2a522e38f813c7fab9e49ebdfbfaba4c05b06579] Merge branch 'for-leds-next' of https://git.kernel.org/pub/scm/linux/kernel/git/lee/leds.git git bisect good 2a522e38f813c7fab9e49ebdfbfaba4c05b06579 # good: [f10c23fa159c5481dfe0025e619dc5ef844f6ce1] tick/nohz: avoid showing '(null)' if nohz_full= not set git bisect good f10c23fa159c5481dfe0025e619dc5ef844f6ce1 # good: [f940e425c6fbcf5282e8daddb9351239e2343598] Merge branch 'for-next' of https://github.com/cminyard/linux-ipmi.git git bisect good f940e425c6fbcf5282e8daddb9351239e2343598 # good: [ac1ab906d7a98e34be95ef63b81ff828cc432346] driver core: WQ_PERCPU added to alloc_workqueue users git bisect good ac1ab906d7a98e34be95ef63b81ff828cc432346 # good: [3ae94a55d047d133fad1e6c811befe4347b75791] debugfs: Remove redundant access mode checks git bisect good 3ae94a55d047d133fad1e6c811befe4347b75791 # bad: [f278809475f6835b56de78b28dc2cc0c7e2c20a4] debugfs: Remove broken no-mount mode git bisect bad f278809475f6835b56de78b28dc2cc0c7e2c20a4 # first bad commit: [f278809475f6835b56de78b28dc2cc0c7e2c20a4] debugfs: Remove broken no-mount mode
On 12/1/25 09:15, Mark Brown wrote: > On Thu, Nov 20, 2025 at 10:26:33AM +0000, Aaron Thompson wrote: > >> debugfs access modes were added in Linux 5.10 (Dec 2020) [1], but the >> no-mount mode has behaved effectively the same as the off mode since >> Linux 5.12 (Apr 2021) [2]. The only difference is the specific error >> code returned by the debugfs_create_* functions, which is -ENOENT in >> no-mount mode and -EPERM in off mode. > > I'm seeing regressions in -next in a lot of testing stuff which bisect > to this patch. I've got a test that looks at the deferred probe list to > see if it's empty, and the mm split_huge_page_test which uses a debugfs > file called split_huge_pages. Neither of these mount debugfs for > themselves, they just assume it'll be there - it looks like that's not > happening any more but I didn't investigate properly. > > I don't immediately see what's getting confused, DEBUG_FS_ALLOW_ALL is > the default and not overridden by anything in any defconfig so > debugfs_enabled still ought to be being set, but I didn't actually try > to debug this yet. > > Sample bisect: > > git bisect start > # status: waiting for both good and bad commits > ... > # bad: [f278809475f6835b56de78b28dc2cc0c7e2c20a4] debugfs: Remove broken no-mount mode > git bisect bad f278809475f6835b56de78b28dc2cc0c7e2c20a4 > # first bad commit: [f278809475f6835b56de78b28dc2cc0c7e2c20a4] debugfs: Remove broken no-mount mode I am terribly sorry, this was a sloppy mistake on my part. The IS_ENABLED() check is missing the CONFIG_ prefix. The fix patch is attached. Greg, should I send a v2 of the patch series, or a separate patch with just the fix? Or something else? Again, sorry for the trouble. -- Aaron
© 2016 - 2025 Red Hat, Inc.