January 2026 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()
by Zhang Changzhong 19 Jan '26

19 Jan '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc1 commit a126061c80d5efb4baef4bcf346094139cd81df6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/135 CVE: CVE-2024-57994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page() to increase test coverage. syzbot found a splat caused by hard irq blocking in ptr_ring_resize_multiple() [1] As current users of ptr_ring_resize_multiple() do not require hard irqs being masked, replace it to only block BH. Rename helpers to better reflect they are safe against BH only. - ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh() - skb_array_resize_multiple() to skb_array_resize_multiple_bh() [1] WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline] WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Modules linked in: CPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline] RIP: 0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Code: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 <0f> 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85 RSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083 RAX: ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000 RDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843 RBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000d R10: dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040 R13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffff FS: 00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tun_ptr_free drivers/net/tun.c:617 [inline] __ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline] ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline] tun_queue_resize drivers/net/tun.c:3694 [inline] tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024 do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923 rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550 Fixes: ff4e538c8c3e ("page_pool: add a lockdep check for recycling in hardirq") Reported-by: syzbot+f56a5c5eac2b28439810(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/671e10df.050a0220.2b8c0f.01cf.GAE@google.com… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Link: https://patch.msgid.link/20241217135121.326370-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: include/linux/ptr_ring.h include/linux/skb_array.h [Did not backport 2c321f3f70bc.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/tap.c | 6 +++--- drivers/net/tun.c | 6 +++--- include/linux/ptr_ring.h | 17 ++++++++--------- include/linux/skb_array.h | 13 +++++++------ net/sched/sch_generic.c | 4 ++-- 5 files changed, 23 insertions(+), 23 deletions(-) diff --git a/drivers/net/tap.c b/drivers/net/tap.c index e7212a64..2c4f9d1 100644 --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@ -1330,9 +1330,9 @@ int tap_queue_resize(struct tap_dev *tap) list_for_each_entry(q, &tap->queue_list, next) rings[i++] = &q->ring; - ret = ptr_ring_resize_multiple(rings, n, - dev->tx_queue_len, GFP_KERNEL, - __skb_array_destroy_skb); + ret = ptr_ring_resize_multiple_bh(rings, n, + dev->tx_queue_len, GFP_KERNEL, + __skb_array_destroy_skb); kfree(rings); return ret; diff --git a/drivers/net/tun.c b/drivers/net/tun.c index c1fdf88..97dbec8d 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -3682,9 +3682,9 @@ static int tun_queue_resize(struct tun_struct *tun) list_for_each_entry(tfile, &tun->disabled, next) rings[i++] = &tfile->tx_ring; - ret = ptr_ring_resize_multiple(rings, n, - dev->tx_queue_len, GFP_KERNEL, - tun_ptr_free); + ret = ptr_ring_resize_multiple_bh(rings, n, + dev->tx_queue_len, GFP_KERNEL, + tun_ptr_free); kfree(rings); return ret; diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h index 808f9d3..65da2155 100644 --- a/include/linux/ptr_ring.h +++ b/include/linux/ptr_ring.h @@ -613,15 +613,14 @@ static inline int ptr_ring_resize(struct ptr_ring *r, int size, gfp_t gfp, /* * Note: producer lock is nested within consumer lock, so if you * resize you must make sure all uses nest correctly. - * In particular if you consume ring in interrupt or BH context, you must - * disable interrupts/BH when doing so. + * In particular if you consume ring in BH context, you must + * disable BH when doing so. */ -static inline int ptr_ring_resize_multiple(struct ptr_ring **rings, - unsigned int nrings, - int size, - gfp_t gfp, void (*destroy)(void *)) +static inline int ptr_ring_resize_multiple_bh(struct ptr_ring **rings, + unsigned int nrings, + int size, gfp_t gfp, + void (*destroy)(void *)) { - unsigned long flags; void ***queues; int i; @@ -636,12 +635,12 @@ static inline int ptr_ring_resize_multiple(struct ptr_ring **rings, } for (i = 0; i < nrings; ++i) { - spin_lock_irqsave(&(rings[i])->consumer_lock, flags); + spin_lock_bh(&(rings[i])->consumer_lock); spin_lock(&(rings[i])->producer_lock); queues[i] = __ptr_ring_swap_queue(rings[i], queues[i], size, gfp, destroy); spin_unlock(&(rings[i])->producer_lock); - spin_unlock_irqrestore(&(rings[i])->consumer_lock, flags); + spin_unlock_bh(&(rings[i])->consumer_lock); } for (i = 0; i < nrings; ++i) diff --git a/include/linux/skb_array.h b/include/linux/skb_array.h index e2d45b7..4ef109a 100644 --- a/include/linux/skb_array.h +++ b/include/linux/skb_array.h @@ -198,14 +198,15 @@ static inline int skb_array_resize(struct skb_array *a, int size, gfp_t gfp) return ptr_ring_resize(&a->ring, size, gfp, __skb_array_destroy_skb); } -static inline int skb_array_resize_multiple(struct skb_array **rings, - int nrings, unsigned int size, - gfp_t gfp) +static inline int skb_array_resize_multiple_bh(struct skb_array **rings, + int nrings, + unsigned int size, + gfp_t gfp) { BUILD_BUG_ON(offsetof(struct skb_array, ring)); - return ptr_ring_resize_multiple((struct ptr_ring **)rings, - nrings, size, gfp, - __skb_array_destroy_skb); + return ptr_ring_resize_multiple_bh((struct ptr_ring **)rings, + nrings, size, gfp, + __skb_array_destroy_skb); } static inline void skb_array_cleanup(struct skb_array *a) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index 9664a63..47cf61e 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -907,8 +907,8 @@ static int pfifo_fast_change_tx_queue_len(struct Qdisc *sch, bands[prio] = q; } - return skb_array_resize_multiple(bands, PFIFO_FAST_BANDS, new_len, - GFP_KERNEL); + return skb_array_resize_multiple_bh(bands, PFIFO_FAST_BANDS, new_len, + GFP_KERNEL); } struct Qdisc_ops pfifo_fast_ops __read_mostly = { -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS 0/2] [Backport] RDMA/rxe: Fix NULL-ptr-deref
by Hongtao Zhang 19 Jan '26

19 Jan '26

*** BLURB HERE *** Zhang Xiaoxu (1): [Backport] RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed Zhu Yanjun (1): [Backport] RDMA/rxe: Fix the error caused by qp->sk drivers/infiniband/sw/rxe/rxe_qp.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
by Wang Zhaolong 19 Jan '26

19 Jan '26

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> stable inclusion from stable-v6.6.120 commit dce10c59211e5cd763a62ea01e79b82a629811e3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13299 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8675c69816e4276b979ff475ee5fac4688f80125 ] When a filesystem is being automounted, it needs to preserve the user-set superblock mount options, such as the "ro" flag. Reported-by: Li Lingfeng <lilingfeng3(a)huawei.com> Link: https://lore.kernel.org/all/20240604112636.236517-3-lilingfeng@huaweicloud.… Fixes: f2aedb713c28 ("NFS: Add fs_context support.") Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/nfs/namespace.c | 6 ++++++ fs/nfs/super.c | 4 ---- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c index e7494cdd957e..40d7163bca87 100644 --- a/fs/nfs/namespace.c +++ b/fs/nfs/namespace.c @@ -147,10 +147,11 @@ struct vfsmount *nfs_d_automount(struct path *path) struct nfs_fs_context *ctx; struct fs_context *fc; struct vfsmount *mnt = ERR_PTR(-ENOMEM); struct nfs_server *server = NFS_SB(path->dentry->d_sb); struct nfs_client *client = server->nfs_client; + unsigned long s_flags = path->dentry->d_sb->s_flags; int timeout = READ_ONCE(nfs_mountpoint_expiry_timeout); int ret; if (IS_ROOT(path->dentry)) return ERR_PTR(-ESTALE); @@ -172,10 +173,15 @@ struct vfsmount *nfs_d_automount(struct path *path) if (fc->net_ns != client->cl_net) { put_net(fc->net_ns); fc->net_ns = get_net(client->cl_net); } + /* Inherit the flags covered by NFS_SB_MASK */ + fc->sb_flags_mask |= NFS_SB_MASK; + fc->sb_flags &= ~NFS_SB_MASK; + fc->sb_flags |= s_flags & NFS_SB_MASK; + /* for submounts we want the same server; referrals will reassign */ memcpy(&ctx->nfs_server._address, &client->cl_addr, client->cl_addrlen); ctx->nfs_server.addrlen = client->cl_addrlen; ctx->nfs_server.port = server->port; diff --git a/fs/nfs/super.c b/fs/nfs/super.c index 1c2969cb907e..9fa3d17981bd 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -1318,14 +1318,10 @@ int nfs_get_tree_common(struct fs_context *fc) /* -o noac implies -o sync */ if (server->flags & NFS_MOUNT_NOAC) fc->sb_flags |= SB_SYNCHRONOUS; - if (ctx->clone_data.sb) - if (ctx->clone_data.sb->s_flags & SB_SYNCHRONOUS) - fc->sb_flags |= SB_SYNCHRONOUS; - /* Get a superblock - note that we may end up sharing one that already exists */ fc->s_fs_info = server; s = sget_fc(fc, compare_super, nfs_set_super); fc->s_fs_info = NULL; if (IS_ERR(s)) { -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] scsi/hiraid: Support New Raid feature
by LinKun 19 Jan '26

19 Jan '26

From: 岳智超 <yuezhichao1(a)h-partners.com> driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8291 CVE: NA -------------------------------- Add thread irq for io queue Add stream detect Signed-off-by: 岳智超 <yuezhichao1(a)h-partners.com> --- drivers/scsi/hisi_raid/hiraid.h | 34 ++ drivers/scsi/hisi_raid/hiraid_main.c | 586 ++++++++++++++++++++++++++- 2 files changed, 603 insertions(+), 17 deletions(-) diff --git a/drivers/scsi/hisi_raid/hiraid.h b/drivers/scsi/hisi_raid/hiraid.h index 1ebc3dd..d107951 100644 --- a/drivers/scsi/hisi_raid/hiraid.h +++ b/drivers/scsi/hisi_raid/hiraid.h @@ -683,6 +683,7 @@ struct hiraid_queue { atomic_t inflight; void *sense_buffer_virt; dma_addr_t sense_buffer_phy; + s32 pci_irq; struct dma_pool *prp_small_pool; }; @@ -756,5 +757,38 @@ struct hiraid_sdev_hostdata { u16 pend_count; }; +enum stream_type { + TYPE_TOTAL, + TYPE_WRITE, + TYPE_READ, + TYPE_CLEAN, + TYPE_BOTTOM +}; + +struct HIRAID_STREAM_S { + /* recog-window */ + u64 stream_lba; + u32 stream_len; + u16 vd_id; + u16 type; + /* aging ctrl */ + int aging_credit; + int aging_grade; + u16 stream_id; + u16 using; +}; + +struct IO_LIST_S { + struct list_head list; + struct hiraid_scsi_io_cmd io_cmd; + struct hiraid_queue *submit_queue; + unsigned int sector_size; +}; + +struct spinlock_list_head_s { + struct list_head list; + spinlock_t lock; +}; + #endif diff --git a/drivers/scsi/hisi_raid/hiraid_main.c b/drivers/scsi/hisi_raid/hiraid_main.c index f84182f..281fe79 100644 --- a/drivers/scsi/hisi_raid/hiraid_main.c +++ b/drivers/scsi/hisi_raid/hiraid_main.c @@ -35,6 +35,10 @@ #include <scsi/scsi_transport.h> #include <scsi/scsi_dbg.h> #include <scsi/sg.h> +#include <linux/kthread.h> +#include <linux/mutex.h> +#include <linux/sched.h> +#include <linux/sched/prio.h> #include "hiraid.h" @@ -107,6 +111,13 @@ static u32 log_debug_switch; module_param(log_debug_switch, uint, 0644); MODULE_PARM_DESC(log_debug_switch, "set log state, default zero for switch off"); +static bool threaded_irq = false; +module_param(threaded_irq, bool, 0444); +MODULE_PARM_DESC(threaded_irq, "use threaded irq for io queue, default off"); + +static u32 poll_delay_min = 9; +static u32 poll_delay_max = 19; + static int extra_pool_num_set(const char *val, const struct kernel_param *kp) { u8 n = 0; @@ -153,7 +164,7 @@ static struct workqueue_struct *work_queue; __func__, ##__VA_ARGS__); \ } while (0) -#define HIRAID_DRV_VERSION "1.1.0.0" +#define HIRAID_DRV_VERSION "1.1.0.1" #define ADMIN_TIMEOUT (admin_tmout * HZ) #define USRCMD_TIMEOUT (180 * HZ) @@ -170,6 +181,15 @@ static struct workqueue_struct *work_queue; #define MAX_CAN_QUEUE (4096 - 1) #define MIN_CAN_QUEUE (1024 - 1) +#define MAX_DECREASE_GRADE (-8) +#define MAX_INCREASE_GRADE 8 +#define INC_GRADE 1 +#define MIN_CREDIT 0 +#define MAX_CREDIT 64 +#define CREDIT_THRES 32 +#define MIN(a, b) (((a) < (b)) ? (a) : (b)) +#define MAX(a, b) (((a) > (b)) ? (a) : (b)) + enum SENSE_STATE_CODE { SENSE_STATE_OK = 0, SENSE_STATE_NEED_CHECK, @@ -765,6 +785,404 @@ static int hiraid_build_sgl(struct hiraid_dev *hdev, return 0; } +#define MAX_PD_NUM (40 + 1) +#define MAX_STREAM_NUM 8 +#define PER_MB (1024 * 1024) +#define MAX_IO_NUM (200 * PER_MB) +#define STREAM_LEN (4 * PER_MB) +#define MAX_IO_NUM_ONCE 128 +#define IO_SUBMIT_TIME_OUT 100 +#define MAX_AGING_NUM 130 + +#define MIN_IO_SEND_TIME 10 +#define MAX_IO_SEND_TIME 50 + +#define MIN_WAIT_IO_SEND_TIME 10 +#define MAX_WAIT_IO_SEND_TIME 20 + +enum io_operation_type { + TYPE_DELETE_SINGLE_IO = 1, + TYPE_DELETE_SINGLE_IO_LIST, + TYPE_DELETE_ALL_IO_LIST +}; + +struct HIRAID_STREAM_S stream_array[MAX_PD_NUM][MAX_STREAM_NUM] = {0}; +struct spinlock_list_head_s io_heads_per_stream[MAX_PD_NUM * MAX_STREAM_NUM]; +spinlock_t stream_array_lock; + +u64 g_io_transport_num[MAX_PD_NUM][MAX_STREAM_NUM] = {0}; +u16 g_io_stream_num[MAX_PD_NUM][TYPE_BOTTOM] = {0}; +u16 g_io_count = 1; + +void hiraid_inc_io_transport_num(u16 disk_id, u16 streamd_id, u16 nlb) +{ + g_io_transport_num[disk_id][streamd_id] += nlb; +} + +void hiraid_refresh_io_transport_num(u16 disk_id, u16 streamd_id) +{ + g_io_transport_num[disk_id][streamd_id] = 0; +} + +void hiraid_inc_stream_num(u16 disk_id) +{ + spin_lock(&stream_array_lock); + g_io_stream_num[disk_id][TYPE_TOTAL]++; + spin_unlock(&stream_array_lock); +} + +void hiraid_dec_stream_num(u16 disk_id) +{ + spin_lock(&stream_array_lock); + if (g_io_stream_num[disk_id][TYPE_TOTAL] > 0) + g_io_stream_num[disk_id][TYPE_TOTAL]--; + spin_unlock(&stream_array_lock); +} + +static bool hiraid_io_recog_check_stream_exceed(u16 disk_id) +{ + bool exceed_flag; + + spin_lock(&stream_array_lock); + exceed_flag = (g_io_stream_num[disk_id][TYPE_TOTAL] >= MAX_STREAM_NUM); + spin_unlock(&stream_array_lock); + return exceed_flag; +} + +static u16 hiraid_get_stream_num(u16 disk_id) +{ + return g_io_stream_num[disk_id][TYPE_TOTAL]; +} + +static inline struct HIRAID_STREAM_S *hiraid_get_stream(u16 disk_id, + u16 stream_id) +{ + return &stream_array[disk_id][stream_id]; +} + +static inline struct spinlock_list_head_s *hiraid_get_io_head(u16 disk_id) +{ + return &(io_heads_per_stream[disk_id]); +} + +static bool hiraid_recognition_acknowledge(const struct HIRAID_STREAM_S *stream) +{ + return (stream->aging_credit >= CREDIT_THRES) ? true : false; +} + +void hiraid_io_recognition_init(void) +{ + u16 i; + + spin_lock_init(&stream_array_lock); + for (i = 0; i < (MAX_PD_NUM * MAX_STREAM_NUM); i++) { + INIT_LIST_HEAD(&hiraid_get_io_head(i)->list); + spin_lock_init(&hiraid_get_io_head(i)->lock); + } +} + +static void hiraid_io_recognition_iterator(struct HIRAID_STREAM_S *stream, + int direction) +{ + stream->aging_grade = stream->aging_grade + direction * INC_GRADE; + stream->aging_grade = MAX(stream->aging_grade, MAX_DECREASE_GRADE); + stream->aging_grade = MIN(stream->aging_grade, MAX_INCREASE_GRADE); + stream->aging_credit = stream->aging_credit + stream->aging_grade; + stream->aging_credit = MAX(stream->aging_credit, MIN_CREDIT); + stream->aging_credit = MIN(stream->aging_credit, MAX_CREDIT); +} + +struct HIRAID_STREAM_S *hiraid_io_pick_stream( + struct hiraid_scsi_rw_cmd *req, u16 type) +{ + struct HIRAID_STREAM_S *first_hit_stream = NULL; + struct HIRAID_STREAM_S *temp_stream = NULL; + u16 pick_flag = 0; + u8 i; + + for (i = 0; i < MAX_STREAM_NUM; i++) { + temp_stream = &stream_array[req->hdid][i]; + temp_stream->stream_id = i; + if (req->slba < temp_stream->stream_lba || + req->slba >= temp_stream->stream_lba + + temp_stream->stream_len || + temp_stream->type != type) { + continue; + } + if (!pick_flag) { + temp_stream->stream_lba = req->slba; + first_hit_stream = temp_stream; + pick_flag = 1; + continue; + } + hiraid_dec_stream_num(req->hdid); + memset(temp_stream, 0, + sizeof(struct HIRAID_STREAM_S)); // 去重影 + } + return first_hit_stream; +} + +static struct HIRAID_STREAM_S *hiraid_init_flow_stream(struct hiraid_scsi_rw_cmd *req, + u16 type) +{ + int i; + struct HIRAID_STREAM_S *stream = NULL; + + for (i = 0; i < MAX_STREAM_NUM; i++) { + stream = hiraid_get_stream(req->hdid, i); + if (!stream->using) { + stream->using = 1; + stream->stream_id = i; + break; + } + } + stream->stream_lba = req->slba; + stream->vd_id = req->hdid; + stream->type = type; + stream->aging_credit = 0; + stream->aging_grade = 0; + stream->stream_len = STREAM_LEN; + return stream; +} + +static struct HIRAID_STREAM_S *hiraid_stream_detect(struct hiraid_dev *hdev, + struct hiraid_scsi_rw_cmd *io_cmd) +{ + u16 type = io_cmd->opcode == HIRAID_CMD_WRITE ? TYPE_WRITE : TYPE_READ; + struct HIRAID_STREAM_S *stream = hiraid_io_pick_stream(io_cmd, type); + + if (stream != NULL) { /* 可以命中一个stream */ + return stream; + } + + if (hiraid_io_recog_check_stream_exceed(io_cmd->hdid)) + return NULL; + stream = hiraid_init_flow_stream(io_cmd, type); + hiraid_inc_stream_num(io_cmd->hdid); + return stream; +} + +u64 g_io_last_pull_time[MAX_PD_NUM] = {0}; + +static u16 hiraid_get_submit_io_stream(u16 did, struct hiraid_dev *hdev) +{ + u64 temp_num, i; + static u16 stream_num[MAX_PD_NUM] = {0}; + + if (g_io_last_pull_time[did] == 0) + g_io_last_pull_time[did] = jiffies_to_msecs(jiffies); + + for (i = 0; i < MAX_STREAM_NUM; i++) { + temp_num = g_io_transport_num[did][i]; + if (temp_num != 0) { + if ((temp_num < MAX_IO_NUM) && + ((jiffies_to_msecs(jiffies) - g_io_last_pull_time[did]) + < IO_SUBMIT_TIME_OUT)) { + stream_num[did] = i; + return i; + } + g_io_last_pull_time[did] = jiffies_to_msecs(jiffies); + hiraid_refresh_io_transport_num(did, i); + stream_num[did] = ((i+1) % MAX_STREAM_NUM); + return ((i+1) % MAX_STREAM_NUM); + } + } + g_io_last_pull_time[did] = jiffies_to_msecs(jiffies); + return ((stream_num[did]++) % MAX_STREAM_NUM); +} + +static void hiraid_submit_io_stream(u16 hdid, struct hiraid_dev *hdev) +{ + struct spinlock_list_head_s *io_slist = NULL; + struct list_head *node = NULL; + struct list_head *next_node = NULL; + struct hiraid_scsi_io_cmd io_cmd = {0}; + struct hiraid_queue *submit_queue = NULL; + unsigned int sector_size = 0; + u16 submit_stream_id = hiraid_get_submit_io_stream(hdid, hdev); + + struct IO_LIST_S *temp_io_stream = NULL; + u16 count = 0; + + io_slist = hiraid_get_io_head(hdid * MAX_STREAM_NUM + submit_stream_id); + spin_lock(&io_slist->lock); + list_for_each_safe(node, next_node, &io_slist->list) { + temp_io_stream = list_entry(node, struct IO_LIST_S, list); + list_del_init(node); + io_cmd = temp_io_stream->io_cmd; + submit_queue = temp_io_stream->submit_queue; + sector_size = temp_io_stream->sector_size; + kfree(temp_io_stream); + temp_io_stream = NULL; + spin_unlock(&io_slist->lock); + hiraid_submit_cmd(submit_queue, &io_cmd); + hiraid_inc_io_transport_num(hdid, + submit_stream_id, io_cmd.rw.nlb * sector_size); + // 单次下发不超过MAX_IO_NUM_ONCE，避免仅发送单盘 + if (++count >= MAX_IO_NUM_ONCE) { + spin_lock(&io_slist->lock); + break; + } + spin_lock(&io_slist->lock); + } + spin_unlock(&io_slist->lock); +} + +static u8 hiraid_detect_if_aging(void) +{ + if (++g_io_count == MAX_AGING_NUM) { + g_io_count = 0; + return 1; + } + return 0; +} + +static void hiraid_aging(struct hiraid_dev *hdev) +{ + struct HIRAID_STREAM_S *temp_stream = NULL; + int i = 0; + int j = 0; + + for (i = 1; i < MAX_PD_NUM; i++) { + for (j = 0; j < MAX_STREAM_NUM; j++) { + temp_stream = hiraid_get_stream(i, j); + if (temp_stream->using) { + hiraid_io_recognition_iterator(temp_stream, -1); + if (temp_stream->aging_credit <= 0) { + hiraid_dec_stream_num(i); + memset(temp_stream, + 0, sizeof(struct HIRAID_STREAM_S)); // 老化 + } + } + } + } +} + +static u8 hiraid_io_list_operation(u32 hdid, u16 cid, u16 hwq, u8 operation) +{ + int i, j; + + struct spinlock_list_head_s *io_slist = NULL; + struct list_head *node = NULL; + struct list_head *next_node = NULL; + struct hiraid_scsi_io_cmd *io_cmd = NULL; + struct hiraid_queue *hiraidq = NULL; + struct IO_LIST_S *temp_io_stream = NULL; + + u8 max_hd_num = operation == TYPE_DELETE_ALL_IO_LIST ? + MAX_PD_NUM : hdid + 1; + for (i = hdid; i < max_hd_num; i++) { + for (j = 0; j < MAX_STREAM_NUM; j++) { + io_slist = hiraid_get_io_head(i * MAX_STREAM_NUM + j); + spin_lock(&io_slist->lock); + list_for_each_safe(node, next_node, &io_slist->list) { + temp_io_stream = list_entry(node, + struct IO_LIST_S, list); + io_cmd = &(temp_io_stream->io_cmd); + hiraidq = temp_io_stream->submit_queue; + if (operation >= TYPE_DELETE_SINGLE_IO_LIST) { + list_del_init(node); + kfree(temp_io_stream); + temp_io_stream = NULL; + } else { + if ((io_cmd->rw.cmd_id == cid) && + (hiraidq->qid == hwq)) { + list_del_init(node); + spin_unlock(&io_slist->lock); + kfree(temp_io_stream); + return 1; + } + } + } + spin_unlock(&io_slist->lock); + } + } + return 0; +} + +static u8 hiraid_check_io_list(u32 hdid, u16 cid, u16 hwq) +{ + return hiraid_io_list_operation(hdid, cid, hwq, TYPE_DELETE_SINGLE_IO); +} + +static u8 hiraid_delete_single_pd_io_list(u32 hdid) +{ + return hiraid_io_list_operation(hdid, 0, 0, TYPE_DELETE_SINGLE_IO_LIST); +} + +static u8 hiraid_delete_all_io_list(void) +{ + return hiraid_io_list_operation(0, 0, 0, TYPE_DELETE_ALL_IO_LIST); +} + +static void hiraid_wait_for_io_submit(struct hiraid_dev *hdev) +{ + struct spinlock_list_head_s *io_slist = NULL; + int i = 0; + int io_flush_finished; + + do { + io_flush_finished = 1; + for (i = 0; i < (MAX_PD_NUM * MAX_STREAM_NUM); i++) { + io_slist = hiraid_get_io_head(i); + if (!list_empty(&io_slist->list)) { + io_flush_finished = 0; + break; + } + } + usleep_range(MIN_WAIT_IO_SEND_TIME, MAX_WAIT_IO_SEND_TIME); + } while (!io_flush_finished); +} + +static u8 hiraid_add_io_to_list(struct hiraid_queue *submit_queue, + struct HIRAID_STREAM_S *tmp_stream, struct hiraid_scsi_io_cmd io_cmd, + unsigned int sector_size) +{ + struct spinlock_list_head_s *io_slist = NULL; + struct IO_LIST_S *new_io_node = NULL; + + new_io_node = kmalloc(sizeof(struct IO_LIST_S), GFP_KERNEL); + if (!new_io_node) + return 0; + new_io_node->io_cmd = io_cmd; + new_io_node->submit_queue = submit_queue; + new_io_node->sector_size = sector_size; + io_slist = hiraid_get_io_head(io_cmd.rw.hdid * + MAX_STREAM_NUM + tmp_stream->stream_id); + spin_lock(&io_slist->lock); + INIT_LIST_HEAD(&(new_io_node->list)); + list_add_tail(&(new_io_node->list), &io_slist->list); + spin_unlock(&io_slist->lock); + return 1; +} + +static void hiraid_submit_io_threading(struct hiraid_dev *hdev) +{ + int i = 1; + + while (!kthread_should_stop()) { + for (i = 1; i < MAX_PD_NUM; i++) + hiraid_submit_io_stream(i, hdev); + usleep_range(MIN_IO_SEND_TIME, MAX_IO_SEND_TIME); + } +} + +static void hiraid_destroy_io_stream_resource(struct hiraid_dev *hdev) +{ + u16 i; + + for (i = 0; i < (MAX_PD_NUM * MAX_STREAM_NUM); i++) + list_del_init(&hiraid_get_io_head(i)->list); +} + +struct task_struct *g_hiraid_submit_task; +static void hiraid_init_io_stream(struct hiraid_dev *hdev) +{ + hiraid_io_recognition_init(); + g_hiraid_submit_task = kthread_run((void *)hiraid_submit_io_threading, + hdev, "hiraid_submit_thread"); +} + #define HIRAID_RW_FUA BIT(14) static int hiraid_setup_rw_cmd(struct hiraid_dev *hdev, @@ -866,6 +1284,30 @@ static int hiraid_setup_nonrw_cmd(struct hiraid_dev *hdev, return 0; } +static bool hiraid_disk_is_hdd(u8 attr) +{ + switch (HIRAID_DEV_DISK_TYPE(attr)) { + case HIRAID_SAS_HDD_VD: + case HIRAID_SATA_HDD_VD: + case HIRAID_SAS_HDD_PD: + case HIRAID_SATA_HDD_PD: + return true; + default: + return false; + } +} + +static bool hiraid_disk_is_hdd_rawdrive(u8 attr) +{ + switch (HIRAID_DEV_DISK_TYPE(attr)) { + case HIRAID_SAS_HDD_PD: + case HIRAID_SATA_HDD_PD: + return true; + default: + return false; + } +} + static int hiraid_setup_io_cmd(struct hiraid_dev *hdev, struct hiraid_scsi_io_cmd *io_cmd, struct scsi_cmnd *scmd) @@ -1023,6 +1465,7 @@ static int hiraid_queue_command(struct Scsi_Host *shost, struct hiraid_sdev_hostdata *hostdata; struct hiraid_scsi_io_cmd io_cmd; struct hiraid_queue *ioq; + struct HIRAID_STREAM_S *tmp_stm = NULL; u16 hwq, cid; int ret; @@ -1085,6 +1528,23 @@ static int hiraid_queue_command(struct Scsi_Host *shost, } WRITE_ONCE(mapbuf->state, CMD_FLIGHT); + + if (hiraid_is_rw_scmd(scmd) && + hiraid_disk_is_hdd_rawdrive(hostdata->attr)) { + if (hiraid_detect_if_aging()) + hiraid_aging(hdev); + tmp_stm = hiraid_stream_detect(hdev, &(io_cmd.rw)); + if (tmp_stm != NULL) { + hiraid_io_recognition_iterator(tmp_stm, 1); + if (hiraid_recognition_acknowledge(tmp_stm) && + (hiraid_get_stream_num(io_cmd.rw.hdid) > 1)) { + if (hiraid_add_io_to_list(ioq, + tmp_stm, io_cmd, sdev->sector_size)) { + return 0; + } + } + } + } hiraid_submit_cmd(ioq, &io_cmd); return 0; @@ -1135,19 +1595,6 @@ static int hiraid_disk_qd(u8 attr) } } -static bool hiraid_disk_is_hdd(u8 attr) -{ - switch (HIRAID_DEV_DISK_TYPE(attr)) { - case HIRAID_SAS_HDD_VD: - case HIRAID_SATA_HDD_VD: - case HIRAID_SAS_HDD_PD: - case HIRAID_SATA_HDD_PD: - return true; - default: - return false; - } -} - static int hiraid_slave_alloc(struct scsi_device *sdev) { struct hiraid_sdev_hostdata *hostdata; @@ -1305,6 +1752,7 @@ static int hiraid_alloc_queue(struct hiraid_dev *hdev, u16 qid, u16 depth) hiraidq->q_depth = depth; hiraidq->qid = qid; hiraidq->cq_vector = -1; + hiraidq->pci_irq = -1; hdev->queue_count++; return 0; @@ -1593,12 +2041,38 @@ static inline bool hiraid_process_cq(struct hiraid_queue *hiraidq, u16 *start, u16 *end, int tag) { bool found = false; + *start = hiraidq->cq_head; + while (!found && hiraid_cqe_pending(hiraidq)) { + if (le16_to_cpu(hiraidq->cqes[hiraidq->cq_head].cmd_id) == tag) + found = true; + hiraid_update_cq_head(hiraidq); + } + *end = hiraidq->cq_head; + + if (*start != *end) + writel(hiraidq->cq_head, + hiraidq->q_db + hiraidq->hdev->db_stride); + + return found; +} +static inline bool hiraid_process_cq_for_thread(struct hiraid_queue *hiraidq, + u16 *start, u16 *end, + u8 *wakeup_thread_flag, int tag) +{ + bool found = false; + u16 max_io_num = hiraidq->q_depth / 4; + u16 io_count = 0; *start = hiraidq->cq_head; while (!found && hiraid_cqe_pending(hiraidq)) { if (le16_to_cpu(hiraidq->cqes[hiraidq->cq_head].cmd_id) == tag) found = true; hiraid_update_cq_head(hiraidq); + + if (++io_count >= max_io_num) { + *wakeup_thread_flag = 1; + break; + } } *end = hiraidq->cq_head; @@ -1646,6 +2120,55 @@ static irqreturn_t hiraid_handle_irq(int irq, void *data) return ret; } +static irqreturn_t hiraid_io_poll(int irq, void *data) +{ + struct hiraid_queue *hiraidq = data; + irqreturn_t ret = IRQ_NONE; + u16 start, end; + + do { + spin_lock(&hiraidq->cq_lock); + hiraid_process_cq(hiraidq, &start, &end, -1); + hiraidq->last_cq_head = hiraidq->cq_head; + spin_unlock(&hiraidq->cq_lock); + + if (start != end) { + hiraid_complete_cqes(hiraidq, start, end); + ret = IRQ_HANDLED; + } + usleep_range(poll_delay_min, poll_delay_max); + } while (start != end); + enable_irq(hiraidq->pci_irq); + return ret; +} + +static irqreturn_t hiraid_io_irq(int irq, void *data) +{ + struct hiraid_queue *hiraidq = data; + irqreturn_t ret = IRQ_NONE; + u16 start, end; + u8 wakeup_thread_flag = 0; + + spin_lock(&hiraidq->cq_lock); + if (hiraidq->cq_head != hiraidq->last_cq_head) + ret = IRQ_HANDLED; + + hiraid_process_cq_for_thread(hiraidq, &start, + &end, &wakeup_thread_flag, -1); + hiraidq->last_cq_head = hiraidq->cq_head; + spin_unlock(&hiraidq->cq_lock); + + if (start != end) { + hiraid_complete_cqes(hiraidq, start, end); + ret = IRQ_HANDLED; + } + if (wakeup_thread_flag) { + disable_irq_nosync(hiraidq->pci_irq); + ret = IRQ_WAKE_THREAD; + } + return ret; +} + static int hiraid_setup_admin_queue(struct hiraid_dev *hdev) { struct hiraid_queue *adminq = &hdev->queues[0]; @@ -1681,9 +2204,11 @@ static int hiraid_setup_admin_queue(struct hiraid_dev *hdev) NULL, adminq, "hiraid%d_q%d", hdev->instance, adminq->qid); if (ret) { adminq->cq_vector = -1; + adminq->pci_irq = -1; return ret; } + adminq->pci_irq = pci_irq_vector(hdev->pdev, adminq->cq_vector); hiraid_init_queue(adminq, 0); dev_info(hdev->dev, "setup admin queue success, queuecount[%d] online[%d] pagesize[%d]\n", @@ -1958,14 +2483,23 @@ static int hiraid_create_queue(struct hiraid_queue *hiraidq, u16 qid) goto delete_cq; hiraidq->cq_vector = cq_vector; - ret = pci_request_irq(hdev->pdev, cq_vector, hiraid_handle_irq, NULL, - hiraidq, "hiraid%d_q%d", hdev->instance, qid); + if (threaded_irq) + ret = pci_request_irq(hdev->pdev, cq_vector, hiraid_io_irq, + hiraid_io_poll, hiraidq, "hiraid%d_q%d", + hdev->instance, qid); + else + ret = pci_request_irq(hdev->pdev, cq_vector, hiraid_handle_irq, + NULL, hiraidq, "hiraid%d_q%d", + hdev->instance, qid); + if (ret) { hiraidq->cq_vector = -1; + hiraidq->pci_irq = -1; dev_err(hdev->dev, "request queue[%d] irq failed\n", qid); goto delete_sq; } + hiraidq->pci_irq = pci_irq_vector(hdev->pdev, hiraidq->cq_vector); hiraid_init_queue(hiraidq, qid); return 0; @@ -2122,10 +2656,11 @@ static int hiraid_setup_io_queues(struct hiraid_dev *hdev) adminq, "hiraid%d_q%d", hdev->instance, adminq->qid); if (ret) { dev_err(hdev->dev, "request admin irq failed\n"); + adminq->pci_irq = -1; adminq->cq_vector = -1; return ret; } - + adminq->pci_irq = pci_irq_vector(hdev->pdev, adminq->cq_vector); hdev->online_queues++; for (i = hdev->queue_count; i <= hdev->max_qid; i++) { @@ -3304,6 +3839,12 @@ static int hiraid_abort(struct scsi_cmnd *scmd) cid = mapbuf->cid; hwq = mapbuf->hiraidq->qid; + if (hiraid_check_io_list(hostdata->hdid, cid, hwq)) { + dev_warn(hdev->dev, "find cid[%d] qid[%d] in host, abort succ\n", + cid, hwq); + return SUCCESS; + } + dev_warn(hdev->dev, "cid[%d] qid[%d] timeout, send abort\n", cid, hwq); ret = hiraid_send_abort_cmd(hdev, hostdata->hdid, hwq, cid); if (ret != -ETIME) { @@ -3339,6 +3880,7 @@ static int hiraid_scsi_reset(struct scsi_cmnd *scmd, enum hiraid_rst_type rst) if ((ret == 0) || (ret == FW_EH_DEV_NONE && rst == HIRAID_RESET_TARGET)) { if (rst == HIRAID_RESET_TARGET) { + hiraid_delete_single_pd_io_list(hostdata->hdid); ret = wait_tgt_reset_io_done(scmd); if (ret) { dev_warn(hdev->dev, "sdev[%d:%d] target has %d peding cmd, target reset failed\n", @@ -3378,6 +3920,7 @@ static int hiraid_host_reset(struct scsi_cmnd *scmd) dev_warn(hdev->dev, "sdev[%d:%d] send host reset\n", scmd->device->channel, scmd->device->id); + hiraid_delete_all_io_list(); if (hiraid_reset_work_sync(hdev) == -EBUSY) flush_work(&hdev->reset_work); @@ -3411,6 +3954,7 @@ static pci_ers_result_t hiraid_pci_error_detected(struct pci_dev *pdev, scsi_block_requests(hdev->shost); hiraid_dev_state_trans(hdev, DEV_RESETTING); + hiraid_delete_all_io_list(); return PCI_ERS_RESULT_NEED_RESET; case pci_channel_io_perm_failure: @@ -4044,6 +4588,7 @@ static int hiraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto unregist_bsg; scsi_scan_host(hdev->shost); + hiraid_init_io_stream(hdev); return 0; @@ -4075,6 +4620,13 @@ static void hiraid_remove(struct pci_dev *pdev) dev_info(hdev->dev, "enter hiraid remove\n"); + if (pci_device_is_present(pdev)) + hiraid_wait_for_io_submit(hdev); + + kthread_stop(g_hiraid_submit_task); + hiraid_delete_all_io_list(); + hiraid_destroy_io_stream_resource(hdev); + hiraid_dev_state_trans(hdev, DEV_DELETING); flush_work(&hdev->reset_work); -- 2.45.1.windows.1

2 1

[PATCH OLK-5.10] [Backport] HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
by Chen Jinghuang 19 Jan '26

19 Jan '26

From: Terry Junge <linuxhid(a)cosmicgizmosystems.com> stable inclusion from stable-v5.10.239 commit 41827a2dbdd7880df9881506dee13bc88d4230bb category: bugfix bugzilla: 9660 CVE: CVE-2025-38103 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fe7f7ac8e0c708446ff017453add769ffc15deed upstream. Update struct hid_descriptor to better reflect the mandatory and optional parts of the HID Descriptor as per USB HID 1.11 specification. Note: the kernel currently does not parse any optional HID class descriptors, only the mandatory report descriptor. Update all references to member element desc[0] to rpt_desc. Add test to verify bLength and bNumDescriptors values are valid. Replace the for loop with direct access to the mandatory HID class descriptor member for the report descriptor. This eliminates the possibility of getting an out-of-bounds fault. Add a warning message if the HID descriptor contains any unsupported optional HID class descriptors. Reported-by: syzbot+c52569baf0c843f35495(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c52569baf0c843f35495 Fixes: f043bfc98c19 ("HID: usbhid: fix out-of-bounds bug") Cc: stable(a)vger.kernel.org Signed-off-by: Terry Junge <linuxhid(a)cosmicgizmosystems.com> Reviewed-by: Michael Kelley <mhklinux(a)outlook.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Terry Junge <linuxhid(a)cosmicgizmosystems.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/hid/hid-hyperv.c | 5 +++-- drivers/hid/usbhid/hid-core.c | 25 ++++++++++++++----------- drivers/usb/gadget/function/f_hid.c | 12 ++++++------ include/linux/hid.h | 3 ++- 4 files changed, 25 insertions(+), 20 deletions(-) diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c index b7704dd6809d..bf77cfb723d5 100644 --- a/drivers/hid/hid-hyperv.c +++ b/drivers/hid/hid-hyperv.c @@ -199,7 +199,8 @@ static void mousevsc_on_receive_device_info(struct mousevsc_dev *input_device, if (!input_device->hid_desc) goto cleanup; - input_device->report_desc_size = desc->desc[0].wDescriptorLength; + input_device->report_desc_size = le16_to_cpu( + desc->rpt_desc.wDescriptorLength); if (input_device->report_desc_size == 0) { input_device->dev_info_status = -EINVAL; goto cleanup; @@ -217,7 +218,7 @@ static void mousevsc_on_receive_device_info(struct mousevsc_dev *input_device, memcpy(input_device->report_desc, ((unsigned char *)desc) + desc->bLength, - desc->desc[0].wDescriptorLength); + le16_to_cpu(desc->rpt_desc.wDescriptorLength)); /* Send the ack */ memset(&ack, 0, sizeof(struct mousevsc_prt_msg)); diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c index 009a0469d54f..c3b104c72e49 100644 --- a/drivers/hid/usbhid/hid-core.c +++ b/drivers/hid/usbhid/hid-core.c @@ -984,12 +984,11 @@ static int usbhid_parse(struct hid_device *hid) struct usb_host_interface *interface = intf->cur_altsetting; struct usb_device *dev = interface_to_usbdev (intf); struct hid_descriptor *hdesc; + struct hid_class_descriptor *hcdesc; u32 quirks = 0; unsigned int rsize = 0; char *rdesc; - int ret, n; - int num_descriptors; - size_t offset = offsetof(struct hid_descriptor, desc); + int ret; quirks = hid_lookup_quirk(hid); @@ -1011,20 +1010,19 @@ static int usbhid_parse(struct hid_device *hid) return -ENODEV; } - if (hdesc->bLength < sizeof(struct hid_descriptor)) { - dbg_hid("hid descriptor is too short\n"); + if (!hdesc->bNumDescriptors || + hdesc->bLength != sizeof(*hdesc) + + (hdesc->bNumDescriptors - 1) * sizeof(*hcdesc)) { + dbg_hid("hid descriptor invalid, bLen=%hhu bNum=%hhu\n", + hdesc->bLength, hdesc->bNumDescriptors); return -EINVAL; } hid->version = le16_to_cpu(hdesc->bcdHID); hid->country = hdesc->bCountryCode; - num_descriptors = min_t(int, hdesc->bNumDescriptors, - (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor)); - - for (n = 0; n < num_descriptors; n++) - if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT) - rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength); + if (hdesc->rpt_desc.bDescriptorType == HID_DT_REPORT) + rsize = le16_to_cpu(hdesc->rpt_desc.wDescriptorLength); if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) { dbg_hid("weird size of report descriptor (%u)\n", rsize); @@ -1052,6 +1050,11 @@ static int usbhid_parse(struct hid_device *hid) goto err; } + if (hdesc->bNumDescriptors > 1) + hid_warn(intf, + "%u unsupported optional hid class descriptors\n", + (int)(hdesc->bNumDescriptors - 1)); + hid->quirks |= quirks; return 0; diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c index ba018aeb21d8..2f30699f0426 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -114,8 +114,8 @@ static struct hid_descriptor hidg_desc = { .bcdHID = cpu_to_le16(0x0101), .bCountryCode = 0x00, .bNumDescriptors = 0x1, - /*.desc[0].bDescriptorType = DYNAMIC */ - /*.desc[0].wDescriptorLenght = DYNAMIC */ + /*.rpt_desc.bDescriptorType = DYNAMIC */ + /*.rpt_desc.wDescriptorLength = DYNAMIC */ }; /* Super-Speed Support */ @@ -724,8 +724,8 @@ static int hidg_setup(struct usb_function *f, struct hid_descriptor hidg_desc_copy = hidg_desc; VDBG(cdev, "USB_REQ_GET_DESCRIPTOR: HID\n"); - hidg_desc_copy.desc[0].bDescriptorType = HID_DT_REPORT; - hidg_desc_copy.desc[0].wDescriptorLength = + hidg_desc_copy.rpt_desc.bDescriptorType = HID_DT_REPORT; + hidg_desc_copy.rpt_desc.wDescriptorLength = cpu_to_le16(hidg->report_desc_length); length = min_t(unsigned short, length, @@ -966,8 +966,8 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) * We can use hidg_desc struct here but we should not relay * that its content won't change after returning from this function. */ - hidg_desc.desc[0].bDescriptorType = HID_DT_REPORT; - hidg_desc.desc[0].wDescriptorLength = + hidg_desc.rpt_desc.bDescriptorType = HID_DT_REPORT; + hidg_desc.rpt_desc.wDescriptorLength = cpu_to_le16(hidg->report_desc_length); hidg_hs_in_ep_desc.bEndpointAddress = diff --git a/include/linux/hid.h b/include/linux/hid.h index 9e306bf9959d..03627c96d814 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -674,8 +674,9 @@ struct hid_descriptor { __le16 bcdHID; __u8 bCountryCode; __u8 bNumDescriptors; + struct hid_class_descriptor rpt_desc; - struct hid_class_descriptor desc[1]; + struct hid_class_descriptor opt_descs[]; } __attribute__ ((packed)); #define HID_DEVICE(b, g, ven, prod) \ -- 2.34.1

2 1

[PATCH OLK-5.10] scsi/hiraid: Support New Raid feature
by LinKun 19 Jan '26

19 Jan '26

From: 岳智超 <yuezhichao1(a)h-partners.com> driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8290 CVE: NA -------------------------------- Add thread irq for io queue Add stream detect Signed-off-by: 岳智超 <yuezhichao1(a)h-partners.com> --- drivers/scsi/hisi_raid/hiraid.h | 34 ++ drivers/scsi/hisi_raid/hiraid_main.c | 586 ++++++++++++++++++++++++++- 2 files changed, 604 insertions(+), 16 deletions(-) diff --git a/drivers/scsi/hisi_raid/hiraid.h b/drivers/scsi/hisi_raid/hiraid.h index 04b2e25..b7e3c71 100644 --- a/drivers/scsi/hisi_raid/hiraid.h +++ b/drivers/scsi/hisi_raid/hiraid.h @@ -686,6 +686,7 @@ struct hiraid_queue { atomic_t inflight; void *sense_buffer_virt; dma_addr_t sense_buffer_phy; + s32 pci_irq; struct dma_pool *prp_small_pool; }; @@ -760,5 +761,38 @@ struct hiraid_sdev_hostdata { u16 pend_count; }; +enum stream_type { + TYPE_TOTAL, + TYPE_WRITE, + TYPE_READ, + TYPE_CLEAN, + TYPE_BOTTOM +}; + +struct HIRAID_STREAM_S { + /* recog-window */ + u64 stream_lba; + u32 stream_len; + u16 vd_id; + u16 type; + /* aging ctrl */ + int aging_credit; + int aging_grade; + u16 stream_id; + u16 using; +}; + +struct IO_LIST_S { + struct list_head list; + struct hiraid_scsi_io_cmd io_cmd; + struct hiraid_queue *submit_queue; + unsigned int sector_size; +}; + +struct spinlock_list_head_s { + struct list_head list; + spinlock_t lock; +}; + #endif diff --git a/drivers/scsi/hisi_raid/hiraid_main.c b/drivers/scsi/hisi_raid/hiraid_main.c index 2f33339..a7dc746 100644 --- a/drivers/scsi/hisi_raid/hiraid_main.c +++ b/drivers/scsi/hisi_raid/hiraid_main.c @@ -35,6 +35,10 @@ #include <scsi/scsi_transport.h> #include <scsi/scsi_dbg.h> #include <scsi/sg.h> +#include <linux/kthread.h> +#include <linux/mutex.h> +#include <linux/sched.h> +#include <linux/sched/prio.h> #include "hiraid.h" @@ -107,6 +111,13 @@ static u32 log_debug_switch; module_param(log_debug_switch, uint, 0644); MODULE_PARM_DESC(log_debug_switch, "set log state, default zero for switch off"); +static bool threaded_irq = false; +module_param(threaded_irq, bool, 0444); +MODULE_PARM_DESC(threaded_irq, "use threaded irq for io queue, default off"); + +static u32 poll_delay_min = 9; +static u32 poll_delay_max = 19; + static int extra_pool_num_set(const char *val, const struct kernel_param *kp) { u8 n = 0; @@ -152,7 +163,7 @@ static struct workqueue_struct *work_queue; __func__, ##__VA_ARGS__); \ } while (0) -#define HIRAID_DRV_VERSION "1.1.0.1" +#define HIRAID_DRV_VERSION "1.1.0.2" #define ADMIN_TIMEOUT (admin_tmout * HZ) #define USRCMD_TIMEOUT (180 * HZ) @@ -169,6 +180,15 @@ static struct workqueue_struct *work_queue; #define MAX_CAN_QUEUE (4096 - 1) #define MIN_CAN_QUEUE (1024 - 1) +#define MAX_DECREASE_GRADE (-8) +#define MAX_INCREASE_GRADE 8 +#define INC_GRADE 1 +#define MIN_CREDIT 0 +#define MAX_CREDIT 64 +#define CREDIT_THRES 32 +#define MIN(a, b) (((a) < (b)) ? (a) : (b)) +#define MAX(a, b) (((a) > (b)) ? (a) : (b)) + enum SENSE_STATE_CODE { SENSE_STATE_OK = 0, SENSE_STATE_NEED_CHECK, @@ -749,6 +769,404 @@ static int hiraid_build_sgl(struct hiraid_dev *hdev, struct hiraid_scsi_io_cmd * return 0; } +#define MAX_PD_NUM (40 + 1) +#define MAX_STREAM_NUM 8 +#define PER_MB (1024 * 1024) +#define MAX_IO_NUM (200 * PER_MB) +#define STREAM_LEN (4 * PER_MB) +#define MAX_IO_NUM_ONCE 128 +#define IO_SUBMIT_TIME_OUT 100 +#define MAX_AGING_NUM 130 + +#define MIN_IO_SEND_TIME 10 +#define MAX_IO_SEND_TIME 50 + +#define MIN_WAIT_IO_SEND_TIME 10 +#define MAX_WAIT_IO_SEND_TIME 20 + +enum io_operation_type { + TYPE_DELETE_SINGLE_IO = 1, + TYPE_DELETE_SINGLE_IO_LIST, + TYPE_DELETE_ALL_IO_LIST +}; + +struct HIRAID_STREAM_S stream_array[MAX_PD_NUM][MAX_STREAM_NUM] = {0}; +struct spinlock_list_head_s io_heads_per_stream[MAX_PD_NUM * MAX_STREAM_NUM]; +spinlock_t stream_array_lock; + +u64 g_io_transport_num[MAX_PD_NUM][MAX_STREAM_NUM] = {0}; +u16 g_io_stream_num[MAX_PD_NUM][TYPE_BOTTOM] = {0}; +u16 g_io_count = 1; + +void hiraid_inc_io_transport_num(u16 disk_id, u16 streamd_id, u16 nlb) +{ + g_io_transport_num[disk_id][streamd_id] += nlb; +} + +void hiraid_refresh_io_transport_num(u16 disk_id, u16 streamd_id) +{ + g_io_transport_num[disk_id][streamd_id] = 0; +} + +void hiraid_inc_stream_num(u16 disk_id) +{ + spin_lock(&stream_array_lock); + g_io_stream_num[disk_id][TYPE_TOTAL]++; + spin_unlock(&stream_array_lock); +} + +void hiraid_dec_stream_num(u16 disk_id) +{ + spin_lock(&stream_array_lock); + if (g_io_stream_num[disk_id][TYPE_TOTAL] > 0) + g_io_stream_num[disk_id][TYPE_TOTAL]--; + spin_unlock(&stream_array_lock); +} + +static bool hiraid_io_recog_check_stream_exceed(u16 disk_id) +{ + bool exceed_flag; + + spin_lock(&stream_array_lock); + exceed_flag = (g_io_stream_num[disk_id][TYPE_TOTAL] >= MAX_STREAM_NUM); + spin_unlock(&stream_array_lock); + return exceed_flag; +} + +static u16 hiraid_get_stream_num(u16 disk_id) +{ + return g_io_stream_num[disk_id][TYPE_TOTAL]; +} + +static inline struct HIRAID_STREAM_S *hiraid_get_stream(u16 disk_id, + u16 stream_id) +{ + return &stream_array[disk_id][stream_id]; +} + +static inline struct spinlock_list_head_s *hiraid_get_io_head(u16 disk_id) +{ + return &(io_heads_per_stream[disk_id]); +} + +static bool hiraid_recognition_acknowledge(const struct HIRAID_STREAM_S *stream) +{ + return (stream->aging_credit >= CREDIT_THRES) ? true : false; +} + +void hiraid_io_recognition_init(void) +{ + u16 i; + + spin_lock_init(&stream_array_lock); + for (i = 0; i < (MAX_PD_NUM * MAX_STREAM_NUM); i++) { + INIT_LIST_HEAD(&hiraid_get_io_head(i)->list); + spin_lock_init(&hiraid_get_io_head(i)->lock); + } +} + +static void hiraid_io_recognition_iterator(struct HIRAID_STREAM_S *stream, + int direction) +{ + stream->aging_grade = stream->aging_grade + direction * INC_GRADE; + stream->aging_grade = MAX(stream->aging_grade, MAX_DECREASE_GRADE); + stream->aging_grade = MIN(stream->aging_grade, MAX_INCREASE_GRADE); + stream->aging_credit = stream->aging_credit + stream->aging_grade; + stream->aging_credit = MAX(stream->aging_credit, MIN_CREDIT); + stream->aging_credit = MIN(stream->aging_credit, MAX_CREDIT); +} + +struct HIRAID_STREAM_S *hiraid_io_pick_stream( + struct hiraid_scsi_rw_cmd *req, u16 type) +{ + struct HIRAID_STREAM_S *first_hit_stream = NULL; + struct HIRAID_STREAM_S *temp_stream = NULL; + u16 pick_flag = 0; + u8 i; + + for (i = 0; i < MAX_STREAM_NUM; i++) { + temp_stream = &stream_array[req->hdid][i]; + temp_stream->stream_id = i; + if (req->slba < temp_stream->stream_lba || + req->slba >= temp_stream->stream_lba + + temp_stream->stream_len || + temp_stream->type != type) { + continue; + } + if (!pick_flag) { + temp_stream->stream_lba = req->slba; + first_hit_stream = temp_stream; + pick_flag = 1; + continue; + } + hiraid_dec_stream_num(req->hdid); + memset(temp_stream, 0, + sizeof(struct HIRAID_STREAM_S)); // 去重影 + } + return first_hit_stream; +} + +static struct HIRAID_STREAM_S *hiraid_init_flow_stream(struct hiraid_scsi_rw_cmd *req, + u16 type) +{ + int i; + struct HIRAID_STREAM_S *stream = NULL; + + for (i = 0; i < MAX_STREAM_NUM; i++) { + stream = hiraid_get_stream(req->hdid, i); + if (!stream->using) { + stream->using = 1; + stream->stream_id = i; + break; + } + } + stream->stream_lba = req->slba; + stream->vd_id = req->hdid; + stream->type = type; + stream->aging_credit = 0; + stream->aging_grade = 0; + stream->stream_len = STREAM_LEN; + return stream; +} + +static struct HIRAID_STREAM_S *hiraid_stream_detect(struct hiraid_dev *hdev, + struct hiraid_scsi_rw_cmd *io_cmd) +{ + u16 type = io_cmd->opcode == HIRAID_CMD_WRITE ? TYPE_WRITE : TYPE_READ; + struct HIRAID_STREAM_S *stream = hiraid_io_pick_stream(io_cmd, type); + + if (stream != NULL) { /* 可以命中一个stream */ + return stream; + } + + if (hiraid_io_recog_check_stream_exceed(io_cmd->hdid)) + return NULL; + stream = hiraid_init_flow_stream(io_cmd, type); + hiraid_inc_stream_num(io_cmd->hdid); + return stream; +} + +u64 g_io_last_pull_time[MAX_PD_NUM] = {0}; + +static u16 hiraid_get_submit_io_stream(u16 did, struct hiraid_dev *hdev) +{ + u64 temp_num, i; + static u16 stream_num[MAX_PD_NUM] = {0}; + + if (g_io_last_pull_time[did] == 0) + g_io_last_pull_time[did] = jiffies_to_msecs(jiffies); + + for (i = 0; i < MAX_STREAM_NUM; i++) { + temp_num = g_io_transport_num[did][i]; + if (temp_num != 0) { + if ((temp_num < MAX_IO_NUM) && + ((jiffies_to_msecs(jiffies) - g_io_last_pull_time[did]) + < IO_SUBMIT_TIME_OUT)) { + stream_num[did] = i; + return i; + } + g_io_last_pull_time[did] = jiffies_to_msecs(jiffies); + hiraid_refresh_io_transport_num(did, i); + stream_num[did] = ((i+1) % MAX_STREAM_NUM); + return ((i+1) % MAX_STREAM_NUM); + } + } + g_io_last_pull_time[did] = jiffies_to_msecs(jiffies); + return ((stream_num[did]++) % MAX_STREAM_NUM); +} + +static void hiraid_submit_io_stream(u16 hdid, struct hiraid_dev *hdev) +{ + struct spinlock_list_head_s *io_slist = NULL; + struct list_head *node = NULL; + struct list_head *next_node = NULL; + struct hiraid_scsi_io_cmd io_cmd = {0}; + struct hiraid_queue *submit_queue = NULL; + unsigned int sector_size = 0; + u16 submit_stream_id = hiraid_get_submit_io_stream(hdid, hdev); + + struct IO_LIST_S *temp_io_stream = NULL; + u16 count = 0; + + io_slist = hiraid_get_io_head(hdid * MAX_STREAM_NUM + submit_stream_id); + spin_lock(&io_slist->lock); + list_for_each_safe(node, next_node, &io_slist->list) { + temp_io_stream = list_entry(node, struct IO_LIST_S, list); + list_del_init(node); + io_cmd = temp_io_stream->io_cmd; + submit_queue = temp_io_stream->submit_queue; + sector_size = temp_io_stream->sector_size; + kfree(temp_io_stream); + temp_io_stream = NULL; + spin_unlock(&io_slist->lock); + hiraid_submit_cmd(submit_queue, &io_cmd); + hiraid_inc_io_transport_num(hdid, + submit_stream_id, io_cmd.rw.nlb * sector_size); + // 单次下发不超过MAX_IO_NUM_ONCE，避免仅发送单盘 + if (++count >= MAX_IO_NUM_ONCE) { + spin_lock(&io_slist->lock); + break; + } + spin_lock(&io_slist->lock); + } + spin_unlock(&io_slist->lock); +} + +static u8 hiraid_detect_if_aging(void) +{ + if (++g_io_count == MAX_AGING_NUM) { + g_io_count = 0; + return 1; + } + return 0; +} + +static void hiraid_aging(struct hiraid_dev *hdev) +{ + struct HIRAID_STREAM_S *temp_stream = NULL; + int i = 0; + int j = 0; + + for (i = 1; i < MAX_PD_NUM; i++) { + for (j = 0; j < MAX_STREAM_NUM; j++) { + temp_stream = hiraid_get_stream(i, j); + if (temp_stream->using) { + hiraid_io_recognition_iterator(temp_stream, -1); + if (temp_stream->aging_credit <= 0) { + hiraid_dec_stream_num(i); + memset(temp_stream, + 0, sizeof(struct HIRAID_STREAM_S)); // 老化 + } + } + } + } +} + +static u8 hiraid_io_list_operation(u32 hdid, u16 cid, u16 hwq, u8 operation) +{ + int i, j; + + struct spinlock_list_head_s *io_slist = NULL; + struct list_head *node = NULL; + struct list_head *next_node = NULL; + struct hiraid_scsi_io_cmd *io_cmd = NULL; + struct hiraid_queue *hiraidq = NULL; + struct IO_LIST_S *temp_io_stream = NULL; + + u8 max_hd_num = operation == TYPE_DELETE_ALL_IO_LIST ? + MAX_PD_NUM : hdid + 1; + for (i = hdid; i < max_hd_num; i++) { + for (j = 0; j < MAX_STREAM_NUM; j++) { + io_slist = hiraid_get_io_head(i * MAX_STREAM_NUM + j); + spin_lock(&io_slist->lock); + list_for_each_safe(node, next_node, &io_slist->list) { + temp_io_stream = list_entry(node, + struct IO_LIST_S, list); + io_cmd = &(temp_io_stream->io_cmd); + hiraidq = temp_io_stream->submit_queue; + if (operation >= TYPE_DELETE_SINGLE_IO_LIST) { + list_del_init(node); + kfree(temp_io_stream); + temp_io_stream = NULL; + } else { + if ((io_cmd->rw.cmd_id == cid) && + (hiraidq->qid == hwq)) { + list_del_init(node); + spin_unlock(&io_slist->lock); + kfree(temp_io_stream); + return 1; + } + } + } + spin_unlock(&io_slist->lock); + } + } + return 0; +} + +static u8 hiraid_check_io_list(u32 hdid, u16 cid, u16 hwq) +{ + return hiraid_io_list_operation(hdid, cid, hwq, TYPE_DELETE_SINGLE_IO); +} + +static u8 hiraid_delete_single_pd_io_list(u32 hdid) +{ + return hiraid_io_list_operation(hdid, 0, 0, TYPE_DELETE_SINGLE_IO_LIST); +} + +static u8 hiraid_delete_all_io_list(void) +{ + return hiraid_io_list_operation(0, 0, 0, TYPE_DELETE_ALL_IO_LIST); +} + +static void hiraid_wait_for_io_submit(struct hiraid_dev *hdev) +{ + struct spinlock_list_head_s *io_slist = NULL; + int i = 0; + int io_flush_finished; + + do { + io_flush_finished = 1; + for (i = 0; i < (MAX_PD_NUM * MAX_STREAM_NUM); i++) { + io_slist = hiraid_get_io_head(i); + if (!list_empty(&io_slist->list)) { + io_flush_finished = 0; + break; + } + } + usleep_range(MIN_WAIT_IO_SEND_TIME, MAX_WAIT_IO_SEND_TIME); + } while (!io_flush_finished); +} + +static u8 hiraid_add_io_to_list(struct hiraid_queue *submit_queue, + struct HIRAID_STREAM_S *tmp_stream, struct hiraid_scsi_io_cmd io_cmd, + unsigned int sector_size) +{ + struct spinlock_list_head_s *io_slist = NULL; + struct IO_LIST_S *new_io_node = NULL; + + new_io_node = kmalloc(sizeof(struct IO_LIST_S), GFP_KERNEL); + if (!new_io_node) + return 0; + new_io_node->io_cmd = io_cmd; + new_io_node->submit_queue = submit_queue; + new_io_node->sector_size = sector_size; + io_slist = hiraid_get_io_head(io_cmd.rw.hdid * + MAX_STREAM_NUM + tmp_stream->stream_id); + spin_lock(&io_slist->lock); + INIT_LIST_HEAD(&(new_io_node->list)); + list_add_tail(&(new_io_node->list), &io_slist->list); + spin_unlock(&io_slist->lock); + return 1; +} + +static void hiraid_submit_io_threading(struct hiraid_dev *hdev) +{ + int i = 1; + + while (!kthread_should_stop()) { + for (i = 1; i < MAX_PD_NUM; i++) + hiraid_submit_io_stream(i, hdev); + usleep_range(MIN_IO_SEND_TIME, MAX_IO_SEND_TIME); + } +} + +static void hiraid_destroy_io_stream_resource(struct hiraid_dev *hdev) +{ + u16 i; + + for (i = 0; i < (MAX_PD_NUM * MAX_STREAM_NUM); i++) + list_del_init(&hiraid_get_io_head(i)->list); +} + +struct task_struct *g_hiraid_submit_task; +static void hiraid_init_io_stream(struct hiraid_dev *hdev) +{ + hiraid_io_recognition_init(); + g_hiraid_submit_task = kthread_run((void *)hiraid_submit_io_threading, + hdev, "hiraid_submit_thread"); +} + #define HIRAID_RW_FUA BIT(14) #define RW_LENGTH_ZERO (67) @@ -871,6 +1289,30 @@ static int hiraid_setup_nonrw_cmd(struct hiraid_dev *hdev, return 0; } +static bool hiraid_disk_is_hdd(u8 attr) +{ + switch (HIRAID_DEV_DISK_TYPE(attr)) { + case HIRAID_SAS_HDD_VD: + case HIRAID_SATA_HDD_VD: + case HIRAID_SAS_HDD_PD: + case HIRAID_SATA_HDD_PD: + return true; + default: + return false; + } +} + +static bool hiraid_disk_is_hdd_rawdrive(u8 attr) +{ + switch (HIRAID_DEV_DISK_TYPE(attr)) { + case HIRAID_SAS_HDD_PD: + case HIRAID_SATA_HDD_PD: + return true; + default: + return false; + } +} + static int hiraid_setup_io_cmd(struct hiraid_dev *hdev, struct hiraid_scsi_io_cmd *io_cmd, struct scsi_cmnd *scmd, struct hiraid_mapmange *mapbuf) @@ -1025,6 +1467,7 @@ static int hiraid_queue_command(struct Scsi_Host *shost, struct scsi_cmnd *scmd) struct hiraid_sdev_hostdata *hostdata; struct hiraid_scsi_io_cmd io_cmd; struct hiraid_queue *ioq; + struct HIRAID_STREAM_S *tmp_stm = NULL; u16 hwq, cid; int ret; @@ -1092,6 +1535,23 @@ static int hiraid_queue_command(struct Scsi_Host *shost, struct scsi_cmnd *scmd) } WRITE_ONCE(mapbuf->state, CMD_FLIGHT); + + if (hiraid_is_rw_scmd(scmd) && + hiraid_disk_is_hdd_rawdrive(hostdata->attr)) { + if (hiraid_detect_if_aging()) + hiraid_aging(hdev); + tmp_stm = hiraid_stream_detect(hdev, &(io_cmd.rw)); + if (tmp_stm != NULL) { + hiraid_io_recognition_iterator(tmp_stm, 1); + if (hiraid_recognition_acknowledge(tmp_stm) && + (hiraid_get_stream_num(io_cmd.rw.hdid) > 1)) { + if (hiraid_add_io_to_list(ioq, + tmp_stm, io_cmd, sdev->sector_size)) { + return 0; + } + } + } + } hiraid_submit_cmd(ioq, &io_cmd); return 0; @@ -1141,19 +1601,6 @@ static int hiraid_disk_qd(u8 attr) } } -static bool hiraid_disk_is_hdd(u8 attr) -{ - switch (HIRAID_DEV_DISK_TYPE(attr)) { - case HIRAID_SAS_HDD_VD: - case HIRAID_SATA_HDD_VD: - case HIRAID_SAS_HDD_PD: - case HIRAID_SATA_HDD_PD: - return true; - default: - return false; - } -} - static int hiraid_slave_alloc(struct scsi_device *sdev) { struct hiraid_sdev_hostdata *hostdata; @@ -1305,6 +1752,7 @@ static int hiraid_alloc_queue(struct hiraid_dev *hdev, u16 qid, u16 depth) hiraidq->q_depth = depth; hiraidq->qid = qid; hiraidq->cq_vector = -1; + hiraidq->pci_irq = -1; hdev->queue_count++; return 0; @@ -1594,6 +2042,33 @@ static inline bool hiraid_process_cq(struct hiraid_queue *hiraidq, u16 *start, u return found; } +static inline bool hiraid_process_cq_for_thread(struct hiraid_queue *hiraidq, + u16 *start, u16 *end, + u8 *wakeup_thread_flag, int tag) +{ + bool found = false; + u16 max_io_num = hiraidq->q_depth / 4; + u16 io_count = 0; + *start = hiraidq->cq_head; + while (!found && hiraid_cqe_pending(hiraidq)) { + if (le16_to_cpu(hiraidq->cqes[hiraidq->cq_head].cmd_id) == tag) + found = true; + hiraid_update_cq_head(hiraidq); + + if (++io_count >= max_io_num) { + *wakeup_thread_flag = 1; + break; + } + } + *end = hiraidq->cq_head; + + if (*start != *end) + writel(hiraidq->cq_head, + hiraidq->q_db + hiraidq->hdev->db_stride); + + return found; +} + static bool hiraid_poll_cq(struct hiraid_queue *hiraidq, int cid) { u16 start, end; @@ -1631,6 +2106,55 @@ static irqreturn_t hiraid_handle_irq(int irq, void *data) return ret; } +static irqreturn_t hiraid_io_poll(int irq, void *data) +{ + struct hiraid_queue *hiraidq = data; + irqreturn_t ret = IRQ_NONE; + u16 start, end; + + do { + spin_lock(&hiraidq->cq_lock); + hiraid_process_cq(hiraidq, &start, &end, -1); + hiraidq->last_cq_head = hiraidq->cq_head; + spin_unlock(&hiraidq->cq_lock); + + if (start != end) { + hiraid_complete_cqes(hiraidq, start, end); + ret = IRQ_HANDLED; + } + usleep_range(poll_delay_min, poll_delay_max); + } while (start != end); + enable_irq(hiraidq->pci_irq); + return ret; +} + +static irqreturn_t hiraid_io_irq(int irq, void *data) +{ + struct hiraid_queue *hiraidq = data; + irqreturn_t ret = IRQ_NONE; + u16 start, end; + u8 wakeup_thread_flag = 0; + + spin_lock(&hiraidq->cq_lock); + if (hiraidq->cq_head != hiraidq->last_cq_head) + ret = IRQ_HANDLED; + + hiraid_process_cq_for_thread(hiraidq, &start, + &end, &wakeup_thread_flag, -1); + hiraidq->last_cq_head = hiraidq->cq_head; + spin_unlock(&hiraidq->cq_lock); + + if (start != end) { + hiraid_complete_cqes(hiraidq, start, end); + ret = IRQ_HANDLED; + } + if (wakeup_thread_flag) { + disable_irq_nosync(hiraidq->pci_irq); + ret = IRQ_WAKE_THREAD; + } + return ret; +} + static int hiraid_setup_admin_queue(struct hiraid_dev *hdev) { struct hiraid_queue *adminq = &hdev->queues[0]; @@ -1666,9 +2190,11 @@ static int hiraid_setup_admin_queue(struct hiraid_dev *hdev) adminq, "hiraid%d_q%d", hdev->instance, adminq->qid); if (ret) { adminq->cq_vector = -1; + adminq->pci_irq = -1; return ret; } + adminq->pci_irq = pci_irq_vector(hdev->pdev, adminq->cq_vector); hiraid_init_queue(adminq, 0); dev_info(hdev->dev, "setup admin queue success, queuecount[%d] online[%d] pagesize[%d]\n", @@ -1937,14 +2463,23 @@ static int hiraid_create_queue(struct hiraid_queue *hiraidq, u16 qid) goto delete_cq; hiraidq->cq_vector = cq_vector; - ret = pci_request_irq(hdev->pdev, cq_vector, hiraid_handle_irq, NULL, - hiraidq, "hiraid%d_q%d", hdev->instance, qid); + + if (threaded_irq) + ret = pci_request_irq(hdev->pdev, cq_vector, hiraid_io_irq, + hiraid_io_poll, hiraidq, "hiraid%d_q%d", + hdev->instance, qid); + else + ret = pci_request_irq(hdev->pdev, cq_vector, hiraid_handle_irq, + NULL, hiraidq, "hiraid%d_q%d", + hdev->instance, qid); if (ret) { hiraidq->cq_vector = -1; + hiraidq->pci_irq = -1; dev_err(hdev->dev, "request queue[%d] irq failed\n", qid); goto delete_sq; } + hiraidq->pci_irq = pci_irq_vector(hdev->pdev, hiraidq->cq_vector); hiraid_init_queue(hiraidq, qid); return 0; @@ -2094,10 +2629,12 @@ static int hiraid_setup_io_queues(struct hiraid_dev *hdev) adminq, "hiraid%d_q%d", hdev->instance, adminq->qid); if (ret) { dev_err(hdev->dev, "request admin irq failed\n"); + adminq->pci_irq = -1; adminq->cq_vector = -1; return ret; } + adminq->pci_irq = pci_irq_vector(hdev->pdev, adminq->cq_vector); hdev->online_queues++; for (i = hdev->queue_count; i <= hdev->max_qid; i++) { @@ -3232,6 +3769,12 @@ static int hiraid_abort(struct scsi_cmnd *scmd) cid = mapbuf->cid; hwq = mapbuf->hiraidq->qid; + if (hiraid_check_io_list(hostdata->hdid, cid, hwq)) { + dev_warn(hdev->dev, "find cid[%d] qid[%d] in host, abort succ\n", + cid, hwq); + return SUCCESS; + } + dev_warn(hdev->dev, "cid[%d] qid[%d] timeout, send abort\n", cid, hwq); ret = hiraid_send_abort_cmd(hdev, hostdata->hdid, hwq, cid); if (ret != -ETIME) { @@ -3263,6 +3806,7 @@ static int hiraid_scsi_reset(struct scsi_cmnd *scmd, enum hiraid_rst_type rst) ret = hiraid_send_reset_cmd(hdev, rst, hostdata->hdid); if ((ret == 0) || (ret == FW_EH_DEV_NONE && rst == HIRAID_RESET_TARGET)) { if (rst == HIRAID_RESET_TARGET) { + hiraid_delete_single_pd_io_list(hostdata->hdid); ret = wait_tgt_reset_io_done(scmd); if (ret) { dev_warn(hdev->dev, "sdev[%d:%d] target has %d peding cmd, target reset failed\n", @@ -3300,6 +3844,7 @@ static int hiraid_host_reset(struct scsi_cmnd *scmd) dev_warn(hdev->dev, "sdev[%d:%d] send host reset\n", scmd->device->channel, scmd->device->id); + hiraid_delete_all_io_list(); if (hiraid_reset_work_sync(hdev) == -EBUSY) flush_work(&hdev->reset_work); @@ -3333,6 +3878,7 @@ static pci_ers_result_t hiraid_pci_error_detected(struct pci_dev *pdev, scsi_block_requests(hdev->shost); hiraid_dev_state_trans(hdev, DEV_RESETTING); + hiraid_delete_all_io_list(); return PCI_ERS_RESULT_NEED_RESET; case pci_channel_io_perm_failure: @@ -3906,6 +4452,7 @@ static int hiraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto unregist_bsg; scsi_scan_host(hdev->shost); + hiraid_init_io_stream(hdev); return 0; @@ -3937,6 +4484,13 @@ static void hiraid_remove(struct pci_dev *pdev) dev_info(hdev->dev, "enter hiraid remove\n"); + if (pci_device_is_present(pdev)) + hiraid_wait_for_io_submit(hdev); + + kthread_stop(g_hiraid_submit_task); + hiraid_delete_all_io_list(); + hiraid_destroy_io_stream_resource(hdev); + hiraid_dev_state_trans(hdev, DEV_DELETING); flush_work(&hdev->reset_work); -- 2.45.1.windows.1

2 1

[PATCH OLK-6.6 00/11] HiSock Enhancement
by Pu Lehui 19 Jan '26

19 Jan '26

Liu Jian (1): cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted Pu Lehui (10): bpf: Only deploy hisock in server bpf: Add multi port parse to hisock_cmd bpf: Add target comm parse to hisock_cmd bpf: Add bpf_xdp_early_demux kfunc bpf: Add bpf_xdp_set_ingress_dev kfunc bpf: Add bpf_skb_set_egress_dev kfunc bpf: Deprecate some unused hisock kfuncs bpf: Some refactor for hisock bpf: Add ipv4-mapped ipv6 addr support for hisock bpf: Add local connect support for hisock include/linux/cgroup.h | 1 + kernel/bpf/cgroup.c | 8 +- kernel/cgroup/cgroup.c | 22 +++ net/Kconfig | 1 + net/core/dev.c | 5 +- net/core/filter.c | 83 +++------ samples/bpf/hisock/bpf.c | 315 ++++++++++++++++++++++++-------- samples/bpf/hisock/hisock_cmd.c | 211 ++++++++++++++++----- 8 files changed, 469 insertions(+), 177 deletions(-) -- 2.34.1

2 12

[PATCH openEuler-1.0-LTS] KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
by Zhang Kunbo 16 Jan '26

16 Jan '26

From: fuqiang wang <fuqiang.wng(a)gmail.com> commit 18ab3fc8e880791aa9f7c000261320fc812b5465 upstream. When advancing the target expiration for the guest's APIC timer in periodic mode, set the expiration to "now" if the target expiration is in the past (similar to what is done in update_target_expiration()). Blindly adding the period to the previous target expiration can result in KVM generating a practically unbounded number of hrtimer IRQs due to programming an expired timer over and over. In extreme scenarios, e.g. if userspace pauses/suspends a VM for an extended duration, this can even cause hard lockups in the host. Currently, the bug only affects Intel CPUs when using the hypervisor timer (HV timer), a.k.a. the VMX preemption timer. Unlike the software timer, a.k.a. hrtimer, which KVM keeps running even on exits to userspace, the HV timer only runs while the guest is active. As a result, if the vCPU does not run for an extended duration, there will be a huge gap between the target expiration and the current time the vCPU resumes running. Because the target expiration is incremented by only one period on each timer expiration, this leads to a series of timer expirations occurring rapidly after the vCPU/VM resumes. More critically, when the vCPU first triggers a periodic HV timer expiration after resuming, advancing the expiration by only one period will result in a target expiration in the past. As a result, the delta may be calculated as a negative value. When the delta is converted into an absolute value (tscdeadline is an unsigned u64), the resulting value can overflow what the HV timer is capable of programming. I.e. the large value will exceed the VMX Preemption Timer's maximum bit width of cpu_preemption_timer_multi + 32, and thus cause KVM to switch from the HV timer to the software timer (hrtimers). After switching to the software timer, periodic timer expiration callbacks may be executed consecutively within a single clock interrupt handler, because hrtimers honors KVM's request for an expiration in the past and immediately re-invokes KVM's callback after reprogramming. And because the interrupt handler runs with IRQs disabled, restarting KVM's hrtimer over and over until the target expiration is advanced to "now" can result in a hard lockup. E.g. the following hard lockup was triggered in the host when running a Windows VM (only relevant because it used the APIC timer in periodic mode) after resuming the VM from a long suspend (in the host). NMI watchdog: Watchdog detected hard LOCKUP on cpu 45 ... RIP: 0010:advance_periodic_target_expiration+0x4d/0x80 [kvm] ... RSP: 0018:ff4f88f5d98d8ef0 EFLAGS: 00000046 RAX: fff0103f91be678e RBX: fff0103f91be678e RCX: 00843a7d9e127bcc RDX: 0000000000000002 RSI: 0052ca4003697505 RDI: ff440d5bfbdbd500 RBP: ff440d5956f99200 R08: ff2ff2a42deb6a84 R09: 000000000002a6c0 R10: 0122d794016332b3 R11: 0000000000000000 R12: ff440db1af39cfc0 R13: ff440db1af39cfc0 R14: ffffffffc0d4a560 R15: ff440db1af39d0f8 FS: 00007f04a6ffd700(0000) GS:ff440db1af380000(0000) knlGS:000000e38a3b8000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000d5651feff8 CR3: 000000684e038002 CR4: 0000000000773ee0 PKRU: 55555554 Call Trace: <IRQ> apic_timer_fn+0x31/0x50 [kvm] __hrtimer_run_queues+0x100/0x280 hrtimer_interrupt+0x100/0x210 ? ttwu_do_wakeup+0x19/0x160 smp_apic_timer_interrupt+0x6a/0x130 apic_timer_interrupt+0xf/0x20 </IRQ> Moreover, if the suspend duration of the virtual machine is not long enough to trigger a hard lockup in this scenario, since commit 98c25ead5eda ("KVM: VMX: Move preemption timer <=> hrtimer dance to common x86"), KVM will continue using the software timer until the guest reprograms the APIC timer in some way. Since the periodic timer does not require frequent APIC timer register programming, the guest may continue to use the software timer in perpetuity. Fixes: d8f2f498d9ed ("x86/kvm: fix LAPIC timer drift when guest uses periodic mode") Cc: stable(a)vger.kernel.org Signed-off-by: fuqiang wang <fuqiang.wng(a)gmail.com> [sean: massage comments and changelog] Link: https://patch.msgid.link/20251113205114.1647493-4-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- arch/x86/kvm/lapic.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index 262e49301cae..6603b7decf4f 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -1600,15 +1600,33 @@ static void advance_periodic_target_expiration(struct kvm_lapic *apic) ktime_t delta; /* - * Synchronize both deadlines to the same time source or - * differences in the periods (caused by differences in the - * underlying clocks or numerical approximation errors) will - * cause the two to drift apart over time as the errors - * accumulate. + * Use kernel time as the time source for both the hrtimer deadline and + * TSC-based deadline so that they stay synchronized. Computing each + * deadline independently will cause the two deadlines to drift apart + * over time as differences in the periods accumulate, e.g. due to + * differences in the underlying clocks or numerical approximation errors. */ apic->lapic_timer.target_expiration = ktime_add_ns(apic->lapic_timer.target_expiration, apic->lapic_timer.period); + + /* + * If the new expiration is in the past, e.g. because userspace stopped + * running the VM for an extended duration, then force the expiration + * to "now" and don't try to play catch-up with the missed events. KVM + * will only deliver a single interrupt regardless of how many events + * are pending, i.e. restarting the timer with an expiration in the + * past will do nothing more than waste host cycles, and can even lead + * to a hard lockup in extreme cases. + */ + if (ktime_before(apic->lapic_timer.target_expiration, now)) + apic->lapic_timer.target_expiration = now; + + /* + * Note, ensuring the expiration isn't in the past also prevents delta + * from going negative, which could cause the TSC deadline to become + * excessively large due to it an unsigned value. + */ delta = ktime_sub(apic->lapic_timer.target_expiration, now); apic->lapic_timer.tscdeadline = kvm_read_l1_tsc(apic->vcpu, tscl) + nsec_to_cycles(apic->vcpu, delta); -- 2.34.1

2 1

[PATCH OLK-6.6] KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
by Zhang Kunbo 16 Jan '26

16 Jan '26

From: fuqiang wang <fuqiang.wng(a)gmail.com> stable inclusion from stable-v6.6.120 commit 7b54ccef865e0aa62e4871d4ada2ba4b9dcb8bed category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13419 CVE: CVE-2025-71104 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 18ab3fc8e880791aa9f7c000261320fc812b5465 upstream. When advancing the target expiration for the guest's APIC timer in periodic mode, set the expiration to "now" if the target expiration is in the past (similar to what is done in update_target_expiration()). Blindly adding the period to the previous target expiration can result in KVM generating a practically unbounded number of hrtimer IRQs due to programming an expired timer over and over. In extreme scenarios, e.g. if userspace pauses/suspends a VM for an extended duration, this can even cause hard lockups in the host. Currently, the bug only affects Intel CPUs when using the hypervisor timer (HV timer), a.k.a. the VMX preemption timer. Unlike the software timer, a.k.a. hrtimer, which KVM keeps running even on exits to userspace, the HV timer only runs while the guest is active. As a result, if the vCPU does not run for an extended duration, there will be a huge gap between the target expiration and the current time the vCPU resumes running. Because the target expiration is incremented by only one period on each timer expiration, this leads to a series of timer expirations occurring rapidly after the vCPU/VM resumes. More critically, when the vCPU first triggers a periodic HV timer expiration after resuming, advancing the expiration by only one period will result in a target expiration in the past. As a result, the delta may be calculated as a negative value. When the delta is converted into an absolute value (tscdeadline is an unsigned u64), the resulting value can overflow what the HV timer is capable of programming. I.e. the large value will exceed the VMX Preemption Timer's maximum bit width of cpu_preemption_timer_multi + 32, and thus cause KVM to switch from the HV timer to the software timer (hrtimers). After switching to the software timer, periodic timer expiration callbacks may be executed consecutively within a single clock interrupt handler, because hrtimers honors KVM's request for an expiration in the past and immediately re-invokes KVM's callback after reprogramming. And because the interrupt handler runs with IRQs disabled, restarting KVM's hrtimer over and over until the target expiration is advanced to "now" can result in a hard lockup. E.g. the following hard lockup was triggered in the host when running a Windows VM (only relevant because it used the APIC timer in periodic mode) after resuming the VM from a long suspend (in the host). NMI watchdog: Watchdog detected hard LOCKUP on cpu 45 ... RIP: 0010:advance_periodic_target_expiration+0x4d/0x80 [kvm] ... RSP: 0018:ff4f88f5d98d8ef0 EFLAGS: 00000046 RAX: fff0103f91be678e RBX: fff0103f91be678e RCX: 00843a7d9e127bcc RDX: 0000000000000002 RSI: 0052ca4003697505 RDI: ff440d5bfbdbd500 RBP: ff440d5956f99200 R08: ff2ff2a42deb6a84 R09: 000000000002a6c0 R10: 0122d794016332b3 R11: 0000000000000000 R12: ff440db1af39cfc0 R13: ff440db1af39cfc0 R14: ffffffffc0d4a560 R15: ff440db1af39d0f8 FS: 00007f04a6ffd700(0000) GS:ff440db1af380000(0000) knlGS:000000e38a3b8000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000d5651feff8 CR3: 000000684e038002 CR4: 0000000000773ee0 PKRU: 55555554 Call Trace: <IRQ> apic_timer_fn+0x31/0x50 [kvm] __hrtimer_run_queues+0x100/0x280 hrtimer_interrupt+0x100/0x210 ? ttwu_do_wakeup+0x19/0x160 smp_apic_timer_interrupt+0x6a/0x130 apic_timer_interrupt+0xf/0x20 </IRQ> Moreover, if the suspend duration of the virtual machine is not long enough to trigger a hard lockup in this scenario, since commit 98c25ead5eda ("KVM: VMX: Move preemption timer <=> hrtimer dance to common x86"), KVM will continue using the software timer until the guest reprograms the APIC timer in some way. Since the periodic timer does not require frequent APIC timer register programming, the guest may continue to use the software timer in perpetuity. Fixes: d8f2f498d9ed ("x86/kvm: fix LAPIC timer drift when guest uses periodic mode") Cc: stable(a)vger.kernel.org Signed-off-by: fuqiang wang <fuqiang.wng(a)gmail.com> [sean: massage comments and changelog] Link: https://patch.msgid.link/20251113205114.1647493-4-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/lapic.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index c67610ae5e0b..9f611dc081b5 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -2047,15 +2047,33 @@ static void advance_periodic_target_expiration(struct kvm_lapic *apic) ktime_t delta; /* - * Synchronize both deadlines to the same time source or - * differences in the periods (caused by differences in the - * underlying clocks or numerical approximation errors) will - * cause the two to drift apart over time as the errors - * accumulate. + * Use kernel time as the time source for both the hrtimer deadline and + * TSC-based deadline so that they stay synchronized. Computing each + * deadline independently will cause the two deadlines to drift apart + * over time as differences in the periods accumulate, e.g. due to + * differences in the underlying clocks or numerical approximation errors. */ apic->lapic_timer.target_expiration = ktime_add_ns(apic->lapic_timer.target_expiration, apic->lapic_timer.period); + + /* + * If the new expiration is in the past, e.g. because userspace stopped + * running the VM for an extended duration, then force the expiration + * to "now" and don't try to play catch-up with the missed events. KVM + * will only deliver a single interrupt regardless of how many events + * are pending, i.e. restarting the timer with an expiration in the + * past will do nothing more than waste host cycles, and can even lead + * to a hard lockup in extreme cases. + */ + if (ktime_before(apic->lapic_timer.target_expiration, now)) + apic->lapic_timer.target_expiration = now; + + /* + * Note, ensuring the expiration isn't in the past also prevents delta + * from going negative, which could cause the TSC deadline to become + * excessively large due to it an unsigned value. + */ delta = ktime_sub(apic->lapic_timer.target_expiration, now); apic->lapic_timer.tscdeadline = kvm_read_l1_tsc(apic->vcpu, tscl) + nsec_to_cycles(apic->vcpu, delta); -- 2.34.1

2 1

[PATCH OLK-5.10] KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
by Zhang Kunbo 16 Jan '26

16 Jan '26

From: fuqiang wang <fuqiang.wng(a)gmail.com> stable inclusion from stable-v6.6.120 commit 7b54ccef865e0aa62e4871d4ada2ba4b9dcb8bed category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13419 CVE: CVE-2025-71104 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 18ab3fc8e880791aa9f7c000261320fc812b5465 upstream. When advancing the target expiration for the guest's APIC timer in periodic mode, set the expiration to "now" if the target expiration is in the past (similar to what is done in update_target_expiration()). Blindly adding the period to the previous target expiration can result in KVM generating a practically unbounded number of hrtimer IRQs due to programming an expired timer over and over. In extreme scenarios, e.g. if userspace pauses/suspends a VM for an extended duration, this can even cause hard lockups in the host. Currently, the bug only affects Intel CPUs when using the hypervisor timer (HV timer), a.k.a. the VMX preemption timer. Unlike the software timer, a.k.a. hrtimer, which KVM keeps running even on exits to userspace, the HV timer only runs while the guest is active. As a result, if the vCPU does not run for an extended duration, there will be a huge gap between the target expiration and the current time the vCPU resumes running. Because the target expiration is incremented by only one period on each timer expiration, this leads to a series of timer expirations occurring rapidly after the vCPU/VM resumes. More critically, when the vCPU first triggers a periodic HV timer expiration after resuming, advancing the expiration by only one period will result in a target expiration in the past. As a result, the delta may be calculated as a negative value. When the delta is converted into an absolute value (tscdeadline is an unsigned u64), the resulting value can overflow what the HV timer is capable of programming. I.e. the large value will exceed the VMX Preemption Timer's maximum bit width of cpu_preemption_timer_multi + 32, and thus cause KVM to switch from the HV timer to the software timer (hrtimers). After switching to the software timer, periodic timer expiration callbacks may be executed consecutively within a single clock interrupt handler, because hrtimers honors KVM's request for an expiration in the past and immediately re-invokes KVM's callback after reprogramming. And because the interrupt handler runs with IRQs disabled, restarting KVM's hrtimer over and over until the target expiration is advanced to "now" can result in a hard lockup. E.g. the following hard lockup was triggered in the host when running a Windows VM (only relevant because it used the APIC timer in periodic mode) after resuming the VM from a long suspend (in the host). NMI watchdog: Watchdog detected hard LOCKUP on cpu 45 ... RIP: 0010:advance_periodic_target_expiration+0x4d/0x80 [kvm] ... RSP: 0018:ff4f88f5d98d8ef0 EFLAGS: 00000046 RAX: fff0103f91be678e RBX: fff0103f91be678e RCX: 00843a7d9e127bcc RDX: 0000000000000002 RSI: 0052ca4003697505 RDI: ff440d5bfbdbd500 RBP: ff440d5956f99200 R08: ff2ff2a42deb6a84 R09: 000000000002a6c0 R10: 0122d794016332b3 R11: 0000000000000000 R12: ff440db1af39cfc0 R13: ff440db1af39cfc0 R14: ffffffffc0d4a560 R15: ff440db1af39d0f8 FS: 00007f04a6ffd700(0000) GS:ff440db1af380000(0000) knlGS:000000e38a3b8000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000d5651feff8 CR3: 000000684e038002 CR4: 0000000000773ee0 PKRU: 55555554 Call Trace: <IRQ> apic_timer_fn+0x31/0x50 [kvm] __hrtimer_run_queues+0x100/0x280 hrtimer_interrupt+0x100/0x210 ? ttwu_do_wakeup+0x19/0x160 smp_apic_timer_interrupt+0x6a/0x130 apic_timer_interrupt+0xf/0x20 </IRQ> Moreover, if the suspend duration of the virtual machine is not long enough to trigger a hard lockup in this scenario, since commit 98c25ead5eda ("KVM: VMX: Move preemption timer <=> hrtimer dance to common x86"), KVM will continue using the software timer until the guest reprograms the APIC timer in some way. Since the periodic timer does not require frequent APIC timer register programming, the guest may continue to use the software timer in perpetuity. Fixes: d8f2f498d9ed ("x86/kvm: fix LAPIC timer drift when guest uses periodic mode") Cc: stable(a)vger.kernel.org Signed-off-by: fuqiang wang <fuqiang.wng(a)gmail.com> [sean: massage comments and changelog] Link: https://patch.msgid.link/20251113205114.1647493-4-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/lapic.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index d6272f97368f..4386fd13c12b 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -1793,15 +1793,33 @@ static void advance_periodic_target_expiration(struct kvm_lapic *apic) ktime_t delta; /* - * Synchronize both deadlines to the same time source or - * differences in the periods (caused by differences in the - * underlying clocks or numerical approximation errors) will - * cause the two to drift apart over time as the errors - * accumulate. + * Use kernel time as the time source for both the hrtimer deadline and + * TSC-based deadline so that they stay synchronized. Computing each + * deadline independently will cause the two deadlines to drift apart + * over time as differences in the periods accumulate, e.g. due to + * differences in the underlying clocks or numerical approximation errors. */ apic->lapic_timer.target_expiration = ktime_add_ns(apic->lapic_timer.target_expiration, apic->lapic_timer.period); + + /* + * If the new expiration is in the past, e.g. because userspace stopped + * running the VM for an extended duration, then force the expiration + * to "now" and don't try to play catch-up with the missed events. KVM + * will only deliver a single interrupt regardless of how many events + * are pending, i.e. restarting the timer with an expiration in the + * past will do nothing more than waste host cycles, and can even lead + * to a hard lockup in extreme cases. + */ + if (ktime_before(apic->lapic_timer.target_expiration, now)) + apic->lapic_timer.target_expiration = now; + + /* + * Note, ensuring the expiration isn't in the past also prevents delta + * from going negative, which could cause the TSC deadline to become + * excessively large due to it an unsigned value. + */ delta = ktime_sub(apic->lapic_timer.target_expiration, now); apic->lapic_timer.tscdeadline = kvm_read_l1_tsc(apic->vcpu, tscl) + nsec_to_cycles(apic->vcpu, delta); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
by Wupeng Ma 16 Jan '26

16 Jan '26

From: Duoming Zhou <duoming(a)zju.edu.cn> stable inclusion from stable-v5.10.150 commit a9e5176ead6de64f572ad5c87a72825d9d3c82ae category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8336 CVE: CVE-2022-50422 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 46ba53c30666717cb06c2b3c5d896301cd00d0c0 ] When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to delete "slow_task->timer". However, if the timer handler sas_task_internal_timedout() is running, the del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below: (thread 1) | (thread 2) smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ... sas_free_task(task) | kfree(task->slow_task) //FREE| | task->slow_task->... //USE Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the "task->slow_task" is deallocated. Link: https://lore.kernel.org/r/20220920144213.10536-1-duoming@zju.edu.cn Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver") Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/libsas/sas_expander.c [Wupeng Ma: context conflicts] Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/scsi/libsas/sas_expander.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c index 911d0e1e8e3fc..7b46f3b2b7710 100644 --- a/drivers/scsi/libsas/sas_expander.c +++ b/drivers/scsi/libsas/sas_expander.c @@ -98,7 +98,7 @@ static int smp_execute_task_sg(struct domain_device *dev, res = i->dft->lldd_execute_task(task, GFP_KERNEL); if (res) { - del_timer(&task->slow_task->timer); + del_timer_sync(&task->slow_task->timer); SAS_DPRINTK("executing SMP task failed:%d\n", res); break; } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2023-54179
by Yi Yang 16 Jan '26

16 Jan '26

scsi: qla2xxx: Array index may go out of bound Stable-dep-of: d721b591b95c ("scsi: qla2xxx: Array index may go out of bound") Nilesh Javali (1): scsi: qla2xxx: Array index may go out of bound Ye Bin (1): scsi: qla2xxx: Fix inconsistent format argument type in qla_os.c drivers/scsi/qla2xxx/qla_os.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
by Yi Yang 16 Jan '26

16 Jan '26

From: Long Li <leo.lilong(a)huawei.com> stable inclusion from stable-v6.6.120 commit 61abf8c3162d155b4fd0fb251f08557093363a0a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/12749 CVE: CVE-2025-68367 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1e4b207ffe54cf33a4b7a2912c4110f89c73bf3f ] The following warning appears when running syzkaller, and this issue also exists in the mainline code. ------------[ cut here ]------------ list_add double add: new=ffffffffa57eee28, prev=ffffffffa57eee28, next=ffffffffa5e63100. WARNING: CPU: 0 PID: 1491 at lib/list_debug.c:35 __list_add_valid_or_report+0xf7/0x130 Modules linked in: CPU: 0 PID: 1491 Comm: syz.1.28 Not tainted 6.6.0+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__list_add_valid_or_report+0xf7/0x130 RSP: 0018:ff1100010dfb7b78 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffffa57eee18 RCX: ffffffff97fc9817 RDX: 0000000000040000 RSI: ffa0000002383000 RDI: 0000000000000001 RBP: ffffffffa57eee28 R08: 0000000000000001 R09: ffe21c0021bf6f2c R10: 0000000000000001 R11: 6464615f7473696c R12: ffffffffa5e63100 R13: ffffffffa57eee28 R14: ffffffffa57eee28 R15: ff1100010dfb7d48 FS: 00007fb14398b640(0000) GS:ff11000119600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010d096005 CR4: 0000000000773ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 80000000 Call Trace: <TASK> input_register_handler+0xb3/0x210 mac_hid_start_emulation+0x1c5/0x290 mac_hid_toggle_emumouse+0x20a/0x240 proc_sys_call_handler+0x4c2/0x6e0 new_sync_write+0x1b1/0x2d0 vfs_write+0x709/0x950 ksys_write+0x12a/0x250 do_syscall_64+0x5a/0x110 entry_SYSCALL_64_after_hwframe+0x78/0xe2 The WARNING occurs when two processes concurrently write to the mac-hid emulation sysctl, causing a race condition in mac_hid_toggle_emumouse(). Both processes read old_val=0, then both try to register the input handler, leading to a double list_add of the same handler. CPU0 CPU1 ------------------------- ------------------------- vfs_write() //write 1 vfs_write() //write 1 proc_sys_write() proc_sys_write() mac_hid_toggle_emumouse() mac_hid_toggle_emumouse() old_val = *valp // old_val=0 old_val = *valp // old_val=0 mutex_lock_killable() proc_dointvec() // *valp=1 mac_hid_start_emulation() input_register_handler() mutex_unlock() mutex_lock_killable() proc_dointvec() mac_hid_start_emulation() input_register_handler() //Trigger Warning mutex_unlock() Fix this by moving the old_val read inside the mutex lock region. Fixes: 99b089c3c38a ("Input: Mac button emulation - implement as an input filter") Signed-off-by: Long Li <leo.lilong(a)huawei.com> Signed-off-by: Madhavan Srinivasan <maddy(a)linux.ibm.com> Link: https://patch.msgid.link/20250819091035.2263329-1-leo.lilong@huaweicloud.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/macintosh/mac_hid.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/macintosh/mac_hid.c b/drivers/macintosh/mac_hid.c index d8c4d5664145..44e332ee99d3 100644 --- a/drivers/macintosh/mac_hid.c +++ b/drivers/macintosh/mac_hid.c @@ -186,13 +186,14 @@ static int mac_hid_toggle_emumouse(struct ctl_table *table, int write, void *buffer, size_t *lenp, loff_t *ppos) { int *valp = table->data; - int old_val = *valp; + int old_val; int rc; rc = mutex_lock_killable(&mac_hid_emumouse_mutex); if (rc) return rc; + old_val = *valp; rc = proc_dointvec(table, write, buffer, lenp, ppos); if (rc == 0 && write && *valp != old_val) { -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] mmc: via-sdmmc: fix return value check of mmc_add_host()
by Yi Yang 16 Jan '26

16 Jan '26

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v4.19.270 commit 95025a8dd0ec015872f6c16473fe04d6264e68ca category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13164 CVE: CVE-2022-50846 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e4e46fb61e3bb4628170810d3f2b996b709b90d9 ] mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). Fix this by checking the return value and goto error path which will call mmc_free_host(). Fixes: f0bf7f61b840 ("mmc: Add new via-sdmmc host controller driver") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221108130949.1067699-1-yangyingliang@huawei.com Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mmc/host/via-sdmmc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/mmc/host/via-sdmmc.c b/drivers/mmc/host/via-sdmmc.c index 32c4211506fc..a86e4b3b4060 100644 --- a/drivers/mmc/host/via-sdmmc.c +++ b/drivers/mmc/host/via-sdmmc.c @@ -1158,7 +1158,9 @@ static int via_sd_probe(struct pci_dev *pcidev, pcidev->subsystem_device == 0x3891) sdhost->quirks = VIA_CRDR_QUIRK_300MS_PWRDELAY; - mmc_add_host(mmc); + ret = mmc_add_host(mmc); + if (ret) + goto unmap; return 0; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] fbcon: Fix the issue of uninitialized charcount in the remaining consoles
by Luo Gengkun 15 Jan '26

15 Jan '26

HULK inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/12587 CVE: NA ---------------------------------------------------------------------- After commit 054a54161b88 ("fbdev: bitblit: bound-check glyph index in bit_putcs*") was merged, using alt+ctrl+f1 to switch the tty from tty0 to tty1 results in garbled display. The reason is the vc->vc_font.charcount is 0, it is clearly an uninitialized value. The mainline is fine because commit a1ac250a82a5 ("fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount") assigns the fvc->vc_font.charcount to vc->vc_font.charcount. Fixes: f9a6134c4b54 ("fbdev: bitblit: bound-check glyph index in bit_putcs*") Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 83a4949e2497..4043b0b19140 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -1032,6 +1032,7 @@ static void fbcon_init(struct vc_data *vc, int init) fvc->vc_font.data); vc->vc_font.width = fvc->vc_font.width; vc->vc_font.height = fvc->vc_font.height; + vc->vc_font.charcount = fvc->vc_font.charcount; p->userfont = t->userfont; if (p->userfont) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] fbcon: Fix the issue of uninitialized charcount in the remaining consoles
by Luo Gengkun 15 Jan '26

15 Jan '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/12587 ---------------------------------------------------------------------- After commit 054a54161b88 ("fbdev: bitblit: bound-check glyph index in bit_putcs*") was merged, using alt+ctrl+f1 to switch the tty from tty0 to tty1 results in garbled display. The reason is the vc->vc_font.charcount is 0, it is clearly an uninitialized value. The mainline is fine because commit a1ac250a82a5 ("fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount") assigns the fvc->vc_font.charcount to vc->vc_font.charcount. Fixes: f9a6134c4b54 ("fbdev: bitblit: bound-check glyph index in bit_putcs*") Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 83a4949e2497..4043b0b19140 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -1032,6 +1032,7 @@ static void fbcon_init(struct vc_data *vc, int init) fvc->vc_font.data); vc->vc_font.width = fvc->vc_font.width; vc->vc_font.height = fvc->vc_font.height; + vc->vc_font.charcount = fvc->vc_font.charcount; p->userfont = t->userfont; if (p->userfont) -- 2.34.1

2 1

[PATCH] mfs: fix the compile error of use demo tool mdsd_prefetch
by Kuang Kai 15 Jan '26

15 Jan '26

From: kuangkai <kuangkai(a)kylinos.cn> kylin inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8354 CVE: NA -------------------------- Commit daa2c7d2bbd0 ("mfs: Add prefetch demo") use the pthread_create but not declared and linked, this cause compile mfs/tool with make fail: # cd tools/mfs && make mfsd_prefetch.cpp:118:23: error: 'pthread_create' was not declared in this scope Signed-off-by: kuangkai <kuangkai(a)kylinos.cn> --- tools/mfs/Makefile | 2 +- tools/mfs/mfsd_prefetch.cpp | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/mfs/Makefile b/tools/mfs/Makefile index f99c9cde828f..3fc331c7ebde 100644 --- a/tools/mfs/Makefile +++ b/tools/mfs/Makefile @@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 # Makefile for mfs demo -CFLAGS = -Wall -Wextra +CFLAGS = -Wall -Wextra -lpthread PROGS := mfsd mfsd_prefetch diff --git a/tools/mfs/mfsd_prefetch.cpp b/tools/mfs/mfsd_prefetch.cpp index d35aeb31941a..a26b271b3a00 100644 --- a/tools/mfs/mfsd_prefetch.cpp +++ b/tools/mfs/mfsd_prefetch.cpp @@ -23,6 +23,7 @@ #include <sys/statfs.h> #include <sys/stat.h> #include <sys/mman.h> +#include <pthread.h> #include <map> #include <string> -- 2.39.2 (Apple Git-143)

1 0

[PATCH OLK-6.6 0/1] cpufreq/sched: Explicitly synchronize limits_changed flag handling
by Lifeng Zheng 15 Jan '26

15 Jan '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8343 ---------------------------------------------------------------------- Rafael J. Wysocki (1): cpufreq/sched: Explicitly synchronize limits_changed flag handling kernel/sched/cpufreq_schedutil.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-) -- 2.33.0

2 2

[PATCH OLK-5.10 0/2] kmemleak: Fix kmemleak false warnings
by Qi Xi 15 Jan '26

15 Jan '26

This series fixes kmemleak false warnings when reserving crash kernel memory. Patch 1 moves kmemleak_ignore_phys() to reserve_crashkernel_high() where memory is actually tracked by kmemleak. Patch 2 ensures kmemleak_ignore_phys() is only called when new memory is allocated, not when crash_base is pre-set via cmdline. ZhangPeng (2): arm64: kdump: fix kmemleak unknown object warning arm64: kdump: fix kmemleak unknown object warning when crash base is set kernel/crash_core.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) -- 2.33.0

2 3

[PATCH OLK-6.6] armv8_pmuv3: Keep event consistency of hw_metric events
by Yushan Wang 15 Jan '26

15 Jan '26

driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8310 CVE: NA ----------------------------------------------- hw_metric events should have same pmus. Check the event types and event pmus for event consistency. Signed-off-by: Yushan Wang <wangyushan12(a)huawei.com> Signed-off-by: Ying Jiang <jiangying44(a)h-partners.com> Signed-off-by: jiangying <jiangying44(a)h-partners.com> --- drivers/perf/arm_pmuv3.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/perf/arm_pmuv3.c b/drivers/perf/arm_pmuv3.c index 5d750678a70e..4f27c75cfdfa 100644 --- a/drivers/perf/arm_pmuv3.c +++ b/drivers/perf/arm_pmuv3.c @@ -1159,7 +1159,8 @@ static int armv8pmu_check_hw_metric_event(struct pmu_hw_events *cpuc, if (event == leader) return 0; - if (!armv8pmu_event_is_hw_metric(leader)) + if (leader->pmu != event->pmu || + !armv8pmu_event_is_hw_metric(leader)) return -EINVAL; for_each_sibling_event(sibling, leader) { -- 2.33.0

2 1

[PATCH OLK-5.10 0/4] fix kmemleak false warning
by Qi Xi 15 Jan '26

15 Jan '26

Patch #1 introduces the OBJECT_PHYS flag and create_object_phys() for physical address-allocated kmemleak objects. Patch #2 adds object_phys_tree_root to store physical address objects and uses raw physical addresses instead of virtual addresses. Patch #3 fixes false positives in KFENCE by using kmemleak_ignore_phys() for early memblock-allocated pools. Patch #4 fixes similar false positives in percpu by replacing kmemleak_free() with kmemleak_ignore_phys(). Patrick Wang (3): mm: kmemleak: add OBJECT_PHYS flag for objects allocated with physical address mm: kmemleak: add rbtree and store physical address for objects allocated with PA mm: percpu: use kmemleak_ignore_phys() instead of kmemleak_free() Yee Lee (1): mm: kfence: apply kmemleak_ignore_phys on early allocated pool mm/kfence/core.c | 18 ++--- mm/kmemleak.c | 166 +++++++++++++++++++++++++++++++++-------------- mm/percpu.c | 6 +- 3 files changed, 131 insertions(+), 59 deletions(-) -- 2.33.0

2 5

[PATCH v2 OLK-6.6] xsched: Add XSched manual
by Liu Kai 14 Jan '26

14 Jan '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8232 -------------------------------- Add user manual for XSched. Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- Documentation/scheduler/xsched.md | 355 ++++++++++++++++++++++++++++++ 1 file changed, 355 insertions(+) create mode 100644 Documentation/scheduler/xsched.md diff --git a/Documentation/scheduler/xsched.md b/Documentation/scheduler/xsched.md new file mode 100644 index 000000000000..89ef01d42fc0 --- /dev/null +++ b/Documentation/scheduler/xsched.md @@ -0,0 +1,355 @@ +# XSched 用户指南 + +## 1 环境部署 + +### 1.1 安装 NPU 原生软件栈 + +本特性依赖 NPU 原生软件栈，需要安装 NPU driver、firmware、CANN + +### 1.2 安装XSched内核 + +#### 1.2.1 获取内核源码 + +```bash +# 下载源码 +git clone https://atomgit.com/openeuler/kernel.git -b OLK-6.6 OLK-6.6 + +# 进入内核目录 +cd OLK-6.6 +``` + +#### 1.2.2 安装内核 + +##### 1.2.2.1 修改内核配置 + +```shell +# 生成默认配置 +make openeuler_defconfig + +# 修改并保存配置 +vim .config + +CONFIG_XCU_SCHEDULER=y +CONFIG_XCU_VSTREAM=y +CONFIG_XSCHED_NR_CUS=8 # 根据 NPU 卡的数量配置 +CONFIG_XCU_SCHED_RT=y +CONFIG_XCU_SCHED_CFS=y +CONFIG_CGROUP_XCU=y +``` + +##### 1.2.2.2 编译安装 + +以下方式**二选一**： + +* 源码编译安装 + + ```bash + make clean && make -j$(nproc) + make modules_install -j$(nproc) INSTALL_MOD_STRIP=1 && INSTALL_MOD_STRIP=1 make install + grub2-set-default 0 + ``` + +* RPM 包编译安装 + + ```bash + INSTALL_MOD_STRIP=1 make rpm-pkg -j `nproc` + # kernel 和 devel 包都要安装，否则会导致驱动无法重编 + rpm -ivh <path_to_rpm> --force + grub2-set-default 0 + ``` + +##### 1.2.2.3 修改 cmdline + +```shell +# 修改内核引导文件，根据实际情况编辑 +vim /etc/grub2-efi.cfg + +# 在XSched内核新增 cmdline 配置，关闭驱动签名校验、开启cgroup-v2 +module.sig_enforce=0 systemd.unified_cgroup_hierarchy=1 cgroup_no_v1=all +``` + +保存引导文件后，重启切换内核 + +### 1.3 重编驱动 + +**！！需先安装好原生驱动！！**，`npu-smi info` 检查驱动是否安装成功 + +#### 1.3.1 修改驱动 + +获取驱动源码 + +```shell +mkdir <new_driver_dir> + +./Ascend-hdk-910b-npu-driver_xx.x.x_linux-aarch64.run --tar -xvf -C <new_driver_dir> +``` + +下载驱动补丁 [XSched driver patch](https://gitee.com/openeuler/kernel/commit/8d50448f11b697a177b63d3ccb… 适配 NPU 驱动 + +```shell +cp 0001-Adapt-910b-npu-driver-for-xsched.patch <new_driver_dir>/driver/kernel/ +cd <new_driver_dir>/driver/kernel/ + +# 初始化 git 仓库并应用补丁 +git init +git add . +git commit -m "npu init" +# 如果有冲突则根据 .rej 文件适配冲突代码 +git am 0001-Adapt-910b-npu-driver-for-xsched.patch --reject +``` + +#### 1.3.2 替换驱动 + +```shell +# 返回驱动根目录 +cd ../../ + +# 备份原生驱动 ko +cp -r <new_driver_dir>/driver/host <new_driver_dir>/driver/host-bak +rm -f <new_driver_dir>/driver/host/* + +cd <new_driver_dir>/driver/script +# 如果强制重编则增加 --force 参数，驱动 ko 会生成到 <new_driver_dir>/driver/host/ +sh run_driver_ko_rebuild.sh [--force] + +# 替换驱动 +for line in `ls /lib/modules/$(uname -r)/updates`; do \cp ../host/$line /lib/modules/$(uname -r)/updates; done +``` + +#### 1.3.3 检查驱动 + +重启后检查驱动是否替换成功 + +```shell +reboot +npu-smi info +``` + +### 1.4 libXSched + +XSched 用户态拦截层，拦截 CANN API 并转发到 XSched 内核 + +#### 1.4.1 编译 + +获取源码 + +```bash +git clone https://atomgit.com/openeuler/libXSched.git +``` + +编译源码 + +```bash +# 准备头文件 +cp OLK-6.6/include/uapi/linux/xsched/xcu_vstream.h /usr/include/linux + +# 编译生成 libucc_engine.so +make clean && make +``` + +#### 1.4.2 使用 + +使用 `LD_PRELOAD` 加载 `libucc_engine.so` + +```bash +LD_PRELOAD=<path_to_libucc> <run_model_script> +``` + +### 1.5 验证 + +```shell +# 开启 XSched 日志 +echo "file kernel/xsched/* +p" > /sys/kernel/debug/dynamic_debug/control + +# pytorch 框架 +LD_PRELOAD=<path_to_libucc> python3 -c "import torch;import torch_npu; a = torch.randn(3, 4).npu(); print(a + a);" + +# mindspore 框架 +LD_PRELOAD=<path_to_libucc> python3 -c "import mindspore;mindspore.set_device('Ascend');mindspore.run_check()" +``` + +`dmesg` 查看内核日志，检查是否有 XSCHED 日志，有日志则说明 XSched 环境部署成功，验证完后关闭 XSched 日志 `echo "file kernel/xsched/* -p" > /sys/kernel/debug/dynamic_debug/control` + +## 2 使用指南 + +### 2.1 Cgroup 接口 + +#### 2.1.1 配置 XSched 策略 + +使能 XSched 控制器 + +```bash +echo "+xcu" > /sys/fs/cgroup/cgroup.subtree_control +``` + +##### 2.1.1.1 可配置接口 + +* `xcu.sched_class`：配置调度类，cfs 或 rt + +* `xcu.period_ms`：配置获取算力资源时间片周期，默认 100ms（需先设置为 cfs 调度类） + +* `xcu.quota_ms`：配置周期内可分配的时间片，比如配置 50ms，则每 100ms 内可分配 50ms，-1 则是不管控算力资源（需先设置为 cfs 调度类） + +* `xcu.shares`：配置 cfs 任务的权重，权重越大，相比于其他任务的优先级越高，默认为 1024（需先设置为 cfs 调度类） + +* `xcu.stat`：查看统计信息，仅支持 cfs 调度类 + +##### 2.1.1.2 Host 使用方法 + +在主机侧使用 XSched 管控 ai 任务，需手动创建 cgroup 组 + +```bash +mkdir -p /sys/fs/cgroup/xsched_group + +# 按需配置 XSched 策略，例如 echo cfs > /sys/fs/cgroup/xsched_group/xcu.sched_class +echo <config_value> > /sys/fs/cgroup/xsched_group/xcu.<config_item> +``` + +将 ai 任务加入到 cgroup 中管控算力资源 + +```bash +# 运行 ai 任务 +LD_PRELOAD=<path_to_libucc> <run_model_script> + +# 加入 ai 任务到 cgroup +echo <pid> > /sys/fs/cgroup/xsched_group/cgroup.procs +``` + +##### 2.1.1.3 Docker 使用方法 + +启动 docker 容器时会自动挂载到 cgroup 目录（`/sys/fs/cgroup/user.slice`）下，docker 内的任务的 pid 也会自动添加到 cgroup.procs 下，无需手动创建 cgroup 组和添加任务 + +1. 修改 docker 配置，修改挂载的 cgroup 目录和 docker 的 cgroup 版本为 v2（**docker 需升级到支持 cgroup-v2 的版本**） + + ```bash + vim /etc/docker/daemon.json + + # 添加以下配置 + # 挂载的 cgroup 目录，目录名任意，以 docker.slice 为例 + "cgroup-parent": "docker.slice" + # 使用 cgroup-v2 管理 docker + "exec-opts": ["native.cgroupdriver=systemd"] + + # 修改保存后重启 docker 服务 + systemctl restart docker + ``` + + 因为 docker 默认的挂载目录是 `/sys/fs/cgroup/user.slice` ，`user.slice` 下还会有其他的用户任务在运行，可能会无法修改 `user.slice` 的 XSched 配置，所以需要修改 docker 的挂载目录为 `/sys/fs/cgroup/docker.slice` 方便配置和管理 + +2. 配置 docker 的 xsched 调度策略 + + ```bash + # 修改调度类为 cfs + echo cfs > /sys/fs/cgroup/docker.slice/xcu.sched_class + + # 启动容器 + docker start <container_name> + + # 配置对应容器的 xsched 策略 + echo <config_value> > /sys/fs/cgroup/docker.slice/docker-<docker_id>/xcu.<config_item> + + # 进入容器 + docker exec -it <container_name> bash + + # 运行 ai 任务（容器内也有 libucc_engine.so），pid 会自动添加到 /sys/fs/cgroup/docker.slice/docker-<docker_id>/cgroup.procs + LD_PRELOAD=<path_to_libucc> <run_model_script> + ``` + +### 2.2 Syscall 接口 + +提供两个 syscall 接口用于设置/获取 rt 调度类的任务优先级（`xsched_setattr/xsched_getattr`） + +* `pid`：ai 任务 pid，pid=0 表示当前进程 + +* `struct xsched_attr`：XSched 可配置属性 + + ```c + struct xsched_attr { + __u32 xsched_class; // 调度类，当前仅支持 RT（xsched_class=0） + __u32 xsched_priority; // rt 优先级，可配置范围 [1,5]，数字越大，优先级越高 + }; + ``` + +调用 syscall 接口示例程序： + +```c +#include <stdio.h> +#include <stdlib.h> +#include <unistd.h> +#include <string.h> +#include <errno.h> +#include <sys/syscall.h> +#include <stdint.h> +#include <sys/types.h> + +// Define xsched_attr structure +struct xsched_attr { + uint32_t xsched_class; // Scheduling class: XSCHED_TYPE_RT, XSCHED_TYPE_CFS + uint32_t xsched_priority; // Priority level: 1~5 +}; + +// Scheduling class constants (should match kernel header definitions) +#define XSCHED_TYPE_RT 0 // Real-time scheduling class +#define XSCHED_TYPE_CFS 1 // Completely Fair Scheduler class + +// System call numbers (update these with actual numbers) +#define __NR_xsched_setattr 467 +#define __NR_xsched_getattr 468 + +// Wrapper functions for system calls +static inline long xsched_setattr(pid_t pid, const struct xsched_attr *attr) +{ + return syscall(__NR_xsched_setattr, pid, attr); +} + +static inline long xsched_getattr(pid_t pid, struct xsched_attr *attr) +{ + return syscall(__NR_xsched_getattr, pid, attr); +} + +void main(void) +{ + pid_t pid = getpid(); + struct xsched_attr attr; + long ret; + + // Get current configuration + ret = xsched_getattr(pid, &attr); + if (ret < 0) { + printf("Failed to get configuration!\n"); + } + + attr.xsched_class = XSCHED_TYPE_RT; + attr.xsched_priority = 3; + + ret = xsched_setattr(pid, &attr); + if (ret < 0) { + printf("Failed to set configuration\n"); + } + + // Verify the configuration + memset(&attr, 0, sizeof(attr)); + ret = xsched_getattr(pid, &attr); + if (ret < 0) { + printf("Failed to verify configuration!\n"); + } +} +``` + +### 2.3 调试日志 + +开启/关闭 XSched 调试日志 + +```shell +echo "file kernel/xsched/* +p" > /sys/kernel/debug/dynamic_debug/control +echo "file kernel/xsched/* -p" > /sys/kernel/debug/dynamic_debug/control +``` + +开启/关闭 NPU 驱动调试日志 + +```shell +echo "module ascend_trs_core +p" > /sys/kernel/debug/dynamic_debug/control +echo "module ascend_trs_pm_adapt +p" > /sys/kernel/debug/dynamic_debug/control +echo "module ascend_trs_core -p" > /sys/kernel/debug/dynamic_debug/control +echo "module ascend_trs_pm_adapt -p" > /sys/kernel/debug/dynamic_debug/control +``` -- 2.34.1

2 1

[PATCH 001/415] bpf: Add ability to pin bpf timer to calling CPU
by Luo Gengkun 14 Jan '26

14 Jan '26

From: David Vernet <void(a)manifault.com> mainline inclusion from mainline-v6.7-rc1 commit d6247ecb6c1e17d7a33317090627f5bfe563cbb2 category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8335 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- BPF supports creating high resolution timers using bpf_timer_* helper functions. Currently, only the BPF_F_TIMER_ABS flag is supported, which specifies that the timeout should be interpreted as absolute time. It would also be useful to be able to pin that timer to a core. For example, if you wanted to make a subset of cores run without timer interrupts, and only have the timer be invoked on a single core. This patch adds support for this with a new BPF_F_TIMER_CPU_PIN flag. When specified, the HRTIMER_MODE_PINNED flag is passed to hrtimer_start(). A subsequent patch will update selftests to validate. Signed-off-by: David Vernet <void(a)manifault.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Song Liu <song(a)kernel.org> Acked-by: Hou Tao <houtao1(a)huawei.com> Link: https://lore.kernel.org/bpf/20231004162339.200702-2-void@manifault.com Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- include/uapi/linux/bpf.h | 4 ++++ kernel/bpf/helpers.c | 5 ++++- tools/include/uapi/linux/bpf.h | 4 ++++ 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 782d56c4ebca..3fa3f9b1a052 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -5122,6 +5122,8 @@ union bpf_attr { * **BPF_F_TIMER_ABS** * Start the timer in absolute expire value instead of the * default relative one. + * **BPF_F_TIMER_CPU_PIN** + * Timer will be pinned to the CPU of the caller. * * Return * 0 on success. @@ -7346,9 +7348,11 @@ struct bpf_core_relo { * Flags to control bpf_timer_start() behaviour. * - BPF_F_TIMER_ABS: Timeout passed is absolute time, by default it is * relative to current time. + * - BPF_F_TIMER_CPU_PIN: Timer will be pinned to the CPU of the caller. */ enum { BPF_F_TIMER_ABS = (1ULL << 0), + BPF_F_TIMER_CPU_PIN = (1ULL << 1), }; /* BPF numbers iterator state */ diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index f40085f4de31..c889a9dee6c6 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -1363,7 +1363,7 @@ BPF_CALL_3(bpf_timer_start, struct bpf_async_kern *, timer, u64, nsecs, u64, fla if (in_nmi()) return -EOPNOTSUPP; - if (flags > BPF_F_TIMER_ABS) + if (flags & ~(BPF_F_TIMER_ABS | BPF_F_TIMER_CPU_PIN)) return -EINVAL; __bpf_spin_lock_irqsave(&timer->lock); t = timer->timer; @@ -1377,6 +1377,9 @@ BPF_CALL_3(bpf_timer_start, struct bpf_async_kern *, timer, u64, nsecs, u64, fla else mode = HRTIMER_MODE_REL_SOFT; + if (flags & BPF_F_TIMER_CPU_PIN) + mode |= HRTIMER_MODE_PINNED; + hrtimer_start(&t->timer, ns_to_ktime(nsecs), mode); out: __bpf_spin_unlock_irqrestore(&timer->lock); diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index a457d4f82da2..fc0ed3b6abf1 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -5122,6 +5122,8 @@ union bpf_attr { * **BPF_F_TIMER_ABS** * Start the timer in absolute expire value instead of the * default relative one. + * **BPF_F_TIMER_CPU_PIN** + * Timer will be pinned to the CPU of the caller. * * Return * 0 on success. @@ -7349,9 +7351,11 @@ struct bpf_core_relo { * Flags to control bpf_timer_start() behaviour. * - BPF_F_TIMER_ABS: Timeout passed is absolute time, by default it is * relative to current time. + * - BPF_F_TIMER_CPU_PIN: Timer will be pinned to the CPU of the caller. */ enum { BPF_F_TIMER_ABS = (1ULL << 0), + BPF_F_TIMER_CPU_PIN = (1ULL << 1), }; /* BPF numbers iterator state */ -- 2.34.1

1 414

[PATCH OLK-6.6 0/2] CVE-2025-40099
by Wang Zhaolong 14 Jan '26

14 Jan '26

Eugene Korenevsky (1): cifs: parse_dfs_referrals: prevent oob on malformed input Paulo Alcantara (1): smb: client: fix return value of parse_dfs_referrals() fs/smb/client/misc.c | 21 +++++++++++++++++++-- fs/smb/client/smb2ops.c | 6 +++--- 2 files changed, 22 insertions(+), 5 deletions(-) -- 2.34.3

2 3

[PATCH OLK-6.6] cifs: client: fix memory leak in smb3_fs_context_parse_param
by Wang Zhaolong 14 Jan '26

14 Jan '26

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v6.6.117 commit 868fc62811d3fabcf5685e14f36377a855d5412d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/12582 CVE: CVE-2025-40268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e8c73eb7db0a498cd4b22d2819e6ab1a6f506bd6 upstream. The user calls fsconfig twice, but when the program exits, free() only frees ctx->source for the second fsconfig, not the first. Regarding fc->source, there is no code in the fs context related to its memory reclamation. To fix this memory leak, release the source memory corresponding to ctx or fc before each parsing. syzbot reported: BUG: memory leak unreferenced object 0xffff888128afa360 (size 96): backtrace (crc 79c9c7ba): kstrdup+0x3c/0x80 mm/util.c:84 smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444 BUG: memory leak unreferenced object 0xffff888112c7d900 (size 96): backtrace (crc 79c9c7ba): smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629 smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438 Reported-by: syzbot+72afd4c236e6bc3f4bac(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=72afd4c236e6bc3f4bac Cc: stable(a)vger.kernel.org Reviewed-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.org> Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/smb/client/fs_context.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c index 137d03781d52..cf233cb9c194 100644 --- a/fs/smb/client/fs_context.c +++ b/fs/smb/client/fs_context.c @@ -1359,16 +1359,18 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, goto cifs_parse_mount_err; default: cifs_errorf(fc, "Unknown error parsing devname\n"); goto cifs_parse_mount_err; } + kfree(ctx->source); ctx->source = smb3_fs_context_fullpath(ctx, '/'); if (IS_ERR(ctx->source)) { ctx->source = NULL; cifs_errorf(fc, "OOM when copying UNC string\n"); goto cifs_parse_mount_err; } + kfree(fc->source); fc->source = kstrdup(ctx->source, GFP_KERNEL); if (fc->source == NULL) { cifs_errorf(fc, "OOM when copying UNC string\n"); goto cifs_parse_mount_err; } -- 2.34.3

2 1