- Kernel - mailweb.openeuler.org

[PATCH 00/23] KVM: arm64: rVIC/rVID PV interrupt controller
by Kunkun Jiang 21 May '26

21 May '26

https://lore.kernel.org/all/20200903152610.1078827-1-maz@kernel.org/ Marc Zyngier (5): irqchip/rvic: Add support for untrusted interrupt allocation irqchip: Add Reduced Virtual Interrupt Distributor support irqchip/rvid: Add PCI MSI support KVM: arm64: Tighten msis_require_devid reporting KVM: arm64: Add debugfs files for the rVIC/rVID implementation wanghaibin (18): irqchip: Add Reduced Virtual Interrupt Controller driver KVM: arm64: Move GIC model out of the distributor KVM: arm64: vgic-v3: Move early init to kvm_vgic_create() KVM: arm64: Add irqchip callback structure to kvm_arch KVM: arm64: Move kvm_vgic_destroy to kvm_irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_init() to irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_[un]blocking() to irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_load/put() to irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_pending_irq() to irqchip_flow KVM: arm64: Move vgic resource mapping on first run to irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_{sync, flush}_hwstate() to irqchip_flow KVM: arm64: nVHE: Only save/restore GICv3 state if modeling a GIC KVM: arm64: Move interrupt injection to irqchip_flow KVM: arm64: Move mapping of HW interrupts into irqchip_flow KVM: arm64: Move set_owner into irqchip_flow KVM: arm64: Turn vgic_initialized into irqchip_finalized KVM: arm64: Move irqfd routing to irqchip_flow KVM: arm64: Add a rVIC/rVID in-kernel implementation arch/arm64/include/asm/kvm_host.h | 12 +- arch/arm64/include/asm/kvm_irq.h | 142 +++ arch/arm64/include/uapi/asm/kvm.h | 10 + arch/arm64/kvm/Makefile | 2 +- arch/arm64/kvm/arch_timer.c | 55 +- arch/arm64/kvm/arm.c | 128 ++- arch/arm64/kvm/hyp/nvhe/switch.c | 10 +- arch/arm64/kvm/hypercalls.c | 13 + arch/arm64/kvm/pmu-emul.c | 10 +- arch/arm64/kvm/rvic-cpu.c | 1217 +++++++++++++++++++++++++ arch/arm64/kvm/vgic/vgic-debug.c | 7 +- arch/arm64/kvm/vgic/vgic-init.c | 122 ++- arch/arm64/kvm/vgic/vgic-irqfd.c | 72 +- arch/arm64/kvm/vgic/vgic-its.c | 2 +- arch/arm64/kvm/vgic/vgic-kvm-device.c | 18 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio.c | 14 +- arch/arm64/kvm/vgic/vgic-v3.c | 24 +- arch/arm64/kvm/vgic/vgic.c | 55 +- arch/arm64/kvm/vgic/vgic.h | 41 +- arch/arm64/kvm/virtcca_cvm.c | 2 +- drivers/irqchip/Kconfig | 12 + drivers/irqchip/Makefile | 2 + drivers/irqchip/irq-rvic.c | 595 ++++++++++++ drivers/irqchip/irq-rvid.c | 440 +++++++++ include/kvm/arm_rvic.h | 41 + include/kvm/arm_vgic.h | 32 - include/linux/cpuhotplug.h | 1 + include/linux/irqchip/irq-rvic.h | 100 ++ include/uapi/linux/kvm.h | 3 +- 30 files changed, 2945 insertions(+), 239 deletions(-) create mode 100644 arch/arm64/include/asm/kvm_irq.h create mode 100644 arch/arm64/kvm/rvic-cpu.c create mode 100644 drivers/irqchip/irq-rvic.c create mode 100644 drivers/irqchip/irq-rvid.c create mode 100644 include/kvm/arm_rvic.h create mode 100644 include/linux/irqchip/irq-rvic.h -- 2.33.0

1 23

[PATCH openEuler-1.0-LTS v7 00/11] support apei_page_offline_policy
by Qi Xi 21 May '26

21 May '26

Patches 1-4 are the old page isolation solution (enable_soft_offline + panic prevention), already delivered to customers. Original PR: https://atomgit.com/openeuler/kernel/merge_requests/20004 Patches 5-11 are the new solution, enabling automated configuration in the new version: Patches 5-7 remove the redundant enable_soft_offline bit 1 huge page isolation switch from the old solution, and copy mc only supports THP and regular pages. Patch 8 adds sysctl_apei_page_offline_policy to support regular/huge page isolation policies and driver notification chain. Patch 9-11 fix bugs. Changes in v7: Use blocking notifier for page offline policy chain Changes in v6: Fix panic casued by UCE in kernel context (!current->mm). Changes in v5: Change sysctl_apei_page_offline_policy bit0 to enable/disable driver notification. Backport some patches that have been merged. Since CONFIG_UCE_KERNEL_RECOVERY depends on CONFIG_ARM64, remove the redundant condition in migrate_page(). Changes in v4: Fix typo errors and backport bugfix for mc_copy. Changes in v3: Use bool rather than int as the return type of apei_page_should_offline(). Drop the PF_UCE_KERNEL_RECOVERY flag after soft-offlining the page. Changes in v2: Add a new sysctl_apei_page_offline_policy, instead of changing soft_offline_page. Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Qi Xi (5): Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" Revert "arm64: mm: Add copy mc support for migrate_page" apei/ghes: Add sysctl interface to control soft-offline page isolation uce: Prevent kernel panic for kernel-context UCE with recovery path apei: use blocking notifier for page offline policy chain Wupeng Ma (3): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page arm64: mm: Add copy mc support for migrate_page Yongjian Sun (1): ext4: fix e4b bitmap inconsistency reports arch/arm64/mm/fault.c | 10 +++++- drivers/acpi/apei/ghes.c | 77 ++++++++++++++++++++++++++++++++++++++++ fs/ext4/mballoc.c | 21 +++++------ include/linux/highmem.h | 55 ++++++++++++++++++++++++++++ include/linux/mm.h | 7 ++++ kernel/sysctl.c | 21 +++++++++++ mm/memory-failure.c | 20 +++++++++-- mm/migrate.c | 58 ++++++++++++++++++++++++++++-- 8 files changed, 253 insertions(+), 16 deletions(-) -- 2.33.0

2 12

[PATCH OLK-5.10] apei: use blocking notifier for page offline policy chain
by Qi Xi 21 May '26

21 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9170 ------------------------------------------------------- atomic_notifier_call_chain() holds rcu_read_lock() over callbacks, which prevents sleeping. Notifier callbacks such as ipmi_pso_notifier_call() need to sleep for IPMI completion, triggering a BUG: sleeping function called from invalid context. Switch apei_page_offline_notifier_chain to a blocking notifier to allow callbacks to safely sleep when invoked from sysctl write path. Fixes: 543fadb5575a ("apei/ghes: Add sysctl interface to control soft-offline page isolation") Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/acpi/apei/ghes-policy.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/acpi/apei/ghes-policy.c b/drivers/acpi/apei/ghes-policy.c index 87c611f2cbaa..0bc12b0ba32b 100644 --- a/drivers/acpi/apei/ghes-policy.c +++ b/drivers/acpi/apei/ghes-policy.c @@ -17,18 +17,18 @@ int sysctl_apei_page_offline_policy __read_mostly = APEI_PAGE_OFFLINE_ALLOW_BASE_PAGE; EXPORT_SYMBOL(sysctl_apei_page_offline_policy); -static ATOMIC_NOTIFIER_HEAD(apei_page_offline_notifier_chain); +static BLOCKING_NOTIFIER_HEAD(apei_page_offline_notifier_chain); int register_apei_page_offline_notifier(struct notifier_block *nb) { - return atomic_notifier_chain_register( + return blocking_notifier_chain_register( &apei_page_offline_notifier_chain, nb); } EXPORT_SYMBOL(register_apei_page_offline_notifier); int unregister_apei_page_offline_notifier(struct notifier_block *nb) { - return atomic_notifier_chain_unregister( + return blocking_notifier_chain_unregister( &apei_page_offline_notifier_chain, nb); } EXPORT_SYMBOL(unregister_apei_page_offline_notifier); @@ -48,7 +48,7 @@ static int apei_page_offline_policy_handler(struct ctl_table *table, pr_debug("APEI policy: 0x%x -> 0x%x\n", old_val, new_val); if ((old_val ^ new_val) & APEI_PAGE_OFFLINE_NOTIFY) - atomic_notifier_call_chain( + blocking_notifier_call_chain( &apei_page_offline_notifier_chain, 0, &new_val); } -- 2.33.0

2 1

[PATCH OLK-5.10 0/2] tracepoints: get correct superblock from dentry in event btrfs_sync_file()
by Pan Taixi 21 May '26

21 May '26

[ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ] If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb. The patch above introduced another problem and is fixed in the following patch: The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat. This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following: [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] <TASK> [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter(). Filipe Manana (1): btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Goldwyn Rodrigues (1): btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() include/trace/events/btrfs.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/1] mfs: fix inode resource leak when cache object fd is zero
by Hongbo Li 21 May '26

21 May '26

Fix inode resource leak when cache object fd is zero. Hongbo Li (1): mfs: fix inode resource leak when cache object fd is zero fs/mfs/cache.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 00/10] bpf mainline for olk-6.6
by Pu Lehui 21 May '26

21 May '26

Daniel Borkmann (1): bpf, arm64: Fix off-by-one in check_imm signed range check David Carlier (1): bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path Jiayuan Chen (2): bpf: Fix use-after-free in offloaded map/prog info fill bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks Lang Xu (1): bpf: Fix OOB in pcpu_init_value MingTao Huang (1): bpf: Fix stale offload->prog pointer after constant blinding Mykyta Yatsenko (2): bpf: Fix NULL deref in map_kptr_match_type for scalar regs bpf: Use copy_map_value_locked() in alloc_htab_elem() for BPF_F_LOCK Sechang Lim (1): bpf: Fix RCU stall in bpf_fd_array_map_clear() Weiming Shi (1): bpf: fix end-of-list detection in cgroup_storage_get_next_key() arch/arm64/net/bpf_jit_comp.c | 4 ++-- kernel/bpf/arraymap.c | 4 +++- kernel/bpf/bpf_lsm.c | 2 -- kernel/bpf/core.c | 2 ++ kernel/bpf/devmap.c | 5 ++--- kernel/bpf/hashtab.c | 12 ++++++++---- kernel/bpf/local_storage.c | 2 +- kernel/bpf/offload.c | 10 ++++------ kernel/bpf/verifier.c | 5 ++++- 9 files changed, 26 insertions(+), 20 deletions(-) -- 2.34.1

2 12

[PATCH v2 OLK-6.6 0/5] Fix NULL pointer dereference
by Liu Kai 21 May '26

21 May '26

Fix NULL pointer dereference Liu Kai (5): xSched/cgroup: remove legacy cftypes due to cgroup v1 incompatibility xSched: fix incorrect error returns in vstream allocation xSched: prevent HBM allocation for non-AI tasks xSched/dmem: memory allocation size must larger than 0 xSched: fix NULL pointer dereference in cfs_rq during class switch include/linux/xsched.h | 26 ++++++++++++++++++++------ kernel/xsched/cgroup.c | 2 -- kernel/xsched/vstream.c | 27 +++++++++------------------ 3 files changed, 29 insertions(+), 26 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6] Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
by Liu Kai 21 May '26

21 May '26

From: Pauli Virtanen <pav(a)iki.fi> mainline inclusion from mainline-v7.0-rc7 commit 2969554bcfccb5c609f6b6cd4a014933f3a66dd0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14554 CVE: CVE-2026-43022 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hci_cmd_sync_queue_once() needs to indicate whether a queue item was added, so caller can know if callbacks are called, so it can avoid leaking resources. Change the function to return -EEXIST if queue item already exists. Modify all callsites to handle that. Signed-off-by: Pauli Virtanen <pav(a)iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/hci_sync.c [hci_connect_pa_sync(), hci_connect_big_sync(), hci_past_sync(), hci_le_read_remote_features(), hci_acl_change_pkt_type(), hci_le_set_phy() are not introduced, so some changes are not applied] Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- net/bluetooth/hci_sync.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index f4066b8e95da..0648cebf0865 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -798,7 +798,7 @@ int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, void *data, hci_cmd_sync_work_destroy_t destroy) { if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy)) - return 0; + return -EEXIST; return hci_cmd_sync_queue(hdev, func, data, destroy); } @@ -3266,6 +3266,8 @@ static int update_passive_scan_sync(struct hci_dev *hdev, void *data) int hci_update_passive_scan(struct hci_dev *hdev) { + int err; + /* Only queue if it would have any effect */ if (!test_bit(HCI_UP, &hdev->flags) || test_bit(HCI_INIT, &hdev->flags) || @@ -3275,8 +3277,9 @@ int hci_update_passive_scan(struct hci_dev *hdev) hci_dev_test_flag(hdev, HCI_UNREGISTER)) return 0; - return hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL, - NULL); + err = hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL, + NULL); + return (err == -EEXIST) ? 0 : err; } int hci_write_sc_support_sync(struct hci_dev *hdev, u8 val) @@ -6904,8 +6907,11 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn) { - return hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn, - NULL); + int err; + + err = hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn, + NULL); + return (err == -EEXIST) ? 0 : err; } static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) @@ -6941,8 +6947,11 @@ static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn) { - return hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn, - create_le_conn_complete); + int err; + + err = hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn, + create_le_conn_complete); + return (err == -EEXIST) ? 0 : err; } int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn) -- 2.34.1

2 1

[PATCH openEuler-24.03-LTS_SP3] tracing: test ci
by Tengda Wu 20 May '26

20 May '26

hulk inclusion category: feature bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14259 -------------------------------- This is a test. Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 39bef9ddc5ae..affd03dd969c 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -106,6 +106,8 @@ dummy_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set) return 0; } +/* This is a test */ + /* * To prevent the comm cache from being overwritten when no * tracing is active, only save the comm when a trace event -- 2.34.1

1 0

[PATCH OLK-6.6 0/5] Fix NULL pointer dereference
by Liu Kai 20 May '26

20 May '26

Fix NULL pointer dereference Liu Kai (5): xSched/cgroup: remove legacy cftypes due to cgroup v1 incompatibility xSched: fix incorrect error returns in vstream allocation xSched: prevent HBM allocation for non-AI tasks xSched/dmem: memory allocation size must larger than 0 xSched: fix NULL pointer dereference in cfs_rq during class switch include/linux/xsched.h | 7 ++++++- kernel/xsched/cgroup.c | 2 -- kernel/xsched/vstream.c | 27 +++++++++------------------ 3 files changed, 15 insertions(+), 21 deletions(-) -- 2.34.1

2 6