- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] bpf: Fix invalid prog->stats access when update_effective_progs fails
by Pu Lehui 19 Nov '25

19 Nov '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID7DOT Reference: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id… -------------------------------- Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be described as follows: __cgroup_bpf_detach update_effective_progs compute_effective_progs bpf_prog_array_alloc <-- fault inject purge_effective_progs /* change to dummy_bpf_prog */ array->items[index] = &dummy_bpf_prog.prog ---softirq start--- __do_softirq ... __cgroup_bpf_run_filter_skb __bpf_prog_run_save_cb bpf_prog_run stats = this_cpu_ptr(prog->stats) /* invalid memory access */ flags = u64_stats_update_begin_irqsave(&stats->syncp) ---softirq end--- static_branch_dec(&cgroup_bpf_enabled_key[atype]) The reason is that fault injection caused update_effective_progs to fail and then changed the original prog into dummy_bpf_prog.prog in purge_effective_progs. Then a softirq came, and accessing the members of dummy_bpf_prog.prog in the softirq triggers invalid mem access. To fix it, skip updating stats when stats is NULL. Fixes: 492ecee892c2 ("bpf: enable program stats") Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Link: https://lore.kernel.org/r/20251115102343.2200727-1-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: include/linux/filter.h kernel/bpf/syscall.c [context conflicts and no bpf_prog_inc_misses_counter] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- include/linux/filter.h | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/include/linux/filter.h b/include/linux/filter.h index 3c43603bfb62..75c79546aae7 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -580,11 +580,13 @@ DECLARE_STATIC_KEY_FALSE(bpf_stats_enabled_key); u64 __start = sched_clock(); \ unsigned long flags; \ __ret = dfunc(ctx, (prog)->insnsi, (prog)->bpf_func); \ - __stats = this_cpu_ptr(prog->aux->stats); \ - flags = u64_stats_update_begin_irqsave(&__stats->syncp);\ - __stats->cnt++; \ - __stats->nsecs += sched_clock() - __start; \ - u64_stats_update_end_irqrestore(&__stats->syncp, flags);\ + if (likely(prog->aux && prog->aux->stats)) { \ + __stats = this_cpu_ptr(prog->aux->stats); \ + flags = u64_stats_update_begin_irqsave(&__stats->syncp);\ + __stats->cnt++; \ + __stats->nsecs += sched_clock() - __start; \ + u64_stats_update_end_irqrestore(&__stats->syncp, flags);\ + } \ } else { \ __ret = dfunc(ctx, (prog)->insnsi, (prog)->bpf_func); \ } \ -- 2.34.1

1 0

[PATCH OLK-6.6 0/2] cgrp null
by Pu Lehui 19 Nov '25

19 Nov '25

Jose Fernandez (1): bpf: Improve program stats run-time calculation Pu Lehui (1): bpf: Fix invalid prog->stats access when update_effective_progs fails include/linux/filter.h | 16 ++++++++++------ kernel/bpf/syscall.c | 3 +++ kernel/bpf/trampoline.c | 3 ++- 3 files changed, 15 insertions(+), 7 deletions(-) -- 2.34.1

1 2

[PATCH OLK-6.6 0/8] xsched: XCU Partition
by Zicheng Qu 19 Nov '25

19 Nov '25

Alekseev Dmitry (2): xsched: Add XCU control group implementation and its backend in xsched CFS xsched: Add support for CFS quota for cgroups Konstantin Meskhidze (6): xsched: Add base vstream support xcu: Add base NPU driver support xsched: Introduce vstream management xsched: Add basic scheduler core support xsched: Add xsched RT class xsched: Add xsched CFS class arch/arm/tools/syscall.tbl | 2 +- arch/arm64/configs/openeuler_defconfig | 2 + arch/powerpc/kernel/syscalls/syscall.tbl | 2 +- arch/x86/configs/openeuler_defconfig | 2 + arch/x86/entry/syscalls/syscall_32.tbl | 2 +- arch/x86/entry/syscalls/syscall_64.tbl | 2 +- drivers/Makefile | 1 + drivers/xcu/Makefile | 2 + drivers/xcu/xcu_group.c | 380 +++++++++ include/linux/cgroup_subsys.h | 4 + include/linux/syscalls.h | 2 + include/linux/vstream.h | 91 ++ include/linux/xcu_group.h | 96 +++ include/linux/xsched.h | 514 ++++++++++++ include/uapi/asm-generic/unistd.h | 5 +- include/uapi/linux/xcu_vstream.h | 77 ++ init/Kconfig | 1 + kernel/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/xsched/Kconfig | 83 ++ kernel/xsched/Makefile | 9 + kernel/xsched/cfs.c | 237 ++++++ kernel/xsched/cfs_quota.c | 98 +++ kernel/xsched/cgroup.c | 775 ++++++++++++++++++ kernel/xsched/core.c | 526 ++++++++++++ kernel/xsched/rt.c | 281 +++++++ kernel/xsched/vstream.c | 674 +++++++++++++++ .../arch/powerpc/entry/syscalls/syscall.tbl | 2 +- .../arch/x86/entry/syscalls/syscall_64.tbl | 2 +- 29 files changed, 3866 insertions(+), 9 deletions(-) create mode 100644 drivers/xcu/Makefile create mode 100644 drivers/xcu/xcu_group.c create mode 100644 include/linux/vstream.h create mode 100644 include/linux/xcu_group.h create mode 100644 include/linux/xsched.h create mode 100644 include/uapi/linux/xcu_vstream.h create mode 100644 kernel/xsched/Kconfig create mode 100644 kernel/xsched/Makefile create mode 100644 kernel/xsched/cfs.c create mode 100644 kernel/xsched/cfs_quota.c create mode 100644 kernel/xsched/cgroup.c create mode 100644 kernel/xsched/core.c create mode 100644 kernel/xsched/rt.c create mode 100644 kernel/xsched/vstream.c -- 2.34.1

2 9

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 6c5657aecca1857be6ea39f789159c9acfde2f9e
by kernel test robot 19 Nov '25

19 Nov '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 6c5657aecca1857be6ea39f789159c9acfde2f9e !19025 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() Unverified Error/Warning (likely false positive, kindly check if interested): include/linux/unaligned/access_ok.h:40:24: warning: array subscript -1 is outside array bounds of 'struct retrieve_data_struct_cmd[1]' [-Warray-bounds=] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- arm64-defconfig | |-- include-asm-generic-io.h:warning:this-statement-may-fall-through | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | `-- mm-memcontrol.c:warning:bad-line:otherwise. |-- arm64-randconfig-001-20251118 | |-- crypto-xts.c:warning:mismatch-in-argument-type-of-built-in-function-free-expected-void | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | `-- mm-memcontrol.c:warning:bad-line:otherwise. |-- arm64-randconfig-002-20251118 | |-- crypto-xts.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | `-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done |-- arm64-randconfig-003-20251118 | |-- crypto-lrw.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | |-- crypto-xts.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | |-- include-linux-unaligned-access_ok.h:warning:array-subscript-is-outside-array-bounds-of-struct-retrieve_data_struct_cmd | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- arm64-randconfig-004-20251118 | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- arm64-randconfig-r132-20251119 | |-- block-bio-integrity.c:sparse:sparse:symbol-__bio_integrity_free-was-not-declared.-Should-it-be-static | |-- block-blk-mq-sched.c:sparse:sparse:symbol-__blk_mq_sched_dispatch_requests-was-not-declared.-Should-it-be-static | |-- crypto-algif_aead.c:sparse:sparse:Variable-length-array-is-used. | |-- crypto-algif_hash.c:sparse:sparse:Variable-length-array-is-used. | |-- crypto-xcbc.c:sparse:sparse:Variable-length-array-is-used. | |-- drivers-power-reset-xgene-reboot.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-asn-addr-got-void-csr | |-- drivers-power-reset-xgene-reboot.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-csr-got-void-noderef-asn | |-- fs-proc-etmem_scan.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-noderef-asn-buf-got-void-buf | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- include-linux-ptrace.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-cred-const-ptracer_cred-got-struct-cred-const-noderef-asn-ptracer_cred | |-- include-linux-ptrace.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-task_struct-new_parent-got-struct-task_struct-noderef-asn-parent | |-- include-linux-ptrace.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-task_struct-p1-got-struct-task_struct-noderef-asn-real_parent | |-- include-linux-ptrace.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-task_struct-p2-got-struct-task_struct-noderef-asn-parent | |-- include-trace-events-vmscan.h:sparse:sparse:cast-to-restricted-isolate_mode_t | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | |-- init-do_mounts.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-const-noderef-asn-filename-got-char-name | |-- init-do_mounts.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-const-noderef-asn-pathname-got-char-name | |-- init-do_mounts_initrd.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-const-noderef-asn-filename-got-char | |-- init-do_mounts_initrd.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-const-noderef-asn-pathname-got-char | |-- init-do_mounts_initrd.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-noderef-asn-name-got-char | |-- init-init_task.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-task_struct-noderef-asn-parent-got-struct-task_struct | |-- init-init_task.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-task_struct-noderef-asn-real_parent-got-struct-task_struct | |-- init-initramfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-const-noderef-asn-filename-got-char-filename | |-- init-initramfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-const-noderef-asn-filename-got-char-static-assigned-toplevel-collected | |-- init-initramfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-const-noderef-asn-name-got-char-path | |-- init-initramfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-const-noderef-asn-newname-got-char-static-assigned-toplevel-collected | |-- init-initramfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-const-noderef-asn-oldname-got-char | |-- init-initramfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-const-noderef-asn-oldname-got-char-old | |-- init-initramfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-const-noderef-asn-pathname-got-char-path | |-- init-initramfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-const-noderef-asn-pathname-got-char-static-assigned-toplevel-collected | |-- kernel-sys.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-int-noderef-asn-noderef-asn-got-int-noderef-asn-tid_addr | |-- mm-page_alloc.c:sparse:sparse:symbol-pcpu_drain_mutex-was-not-declared.-Should-it-be-static | |-- mm-page_vma_mapped.c:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | |-- mm-slub.c:sparse:sparse:dereference-of-noderef-expression | |-- mm-slub.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-unsigned-long-noderef-asn-got-unsigned-long | |-- mm-slub.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-noderef-asn-got-void | |-- mm-vmstat.c:sparse:sparse:dereference-of-noderef-expression | `-- mm-vmstat.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-signed-char-noderef-usertype-asn-got-signed-char |-- x86_64-allnoconfig | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allnoconfig-bpf | |-- (.text):undefined-reference-to-_DYNAMIC | |-- (.text):undefined-reference-to-_fini | `-- (.text):undefined-reference-to-_init |-- x86_64-buildonly-randconfig-001-20251118 | |-- block-bfq-cgroup.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_ext.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20251118 | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20251118 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-buildonly-randconfig-005-20251118 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20251118 | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-001-20251119 | |-- fs-ext4-mballoc.o:warning:objtool:ext4_mb_complex_scan_group:unreachable-instruction | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-002-20251119 | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-006-20251119 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-011-20251119 | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-012-20251119 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-013-20251119 | |-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-015-20251119 | |-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-072-20251118 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-076-20251118 | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-102-20251119 | |-- arch-x86-events-zhaoxin-uncore.c:opportunity-for-str_enabled_disabled(uncore_enabled) | |-- crypto-aead.c:opportunity-for-str_yes_no(alg-cra_flags-CRYPTO_ALG_ASYNC) | |-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-104-20251119 | |-- arch-x86-events-zhaoxin-uncore.c:opportunity-for-str_enabled_disabled(uncore_enabled) | |-- crypto-aead.c:opportunity-for-str_yes_no(alg-cra_flags-CRYPTO_ALG_ASYNC) | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-121-20251119 | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used `-- x86_64-randconfig-123-20251119 |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): `-- mm-rmap.c:warning:variable-cstart-set-but-not-used elapsed time: 1573m configs tested: 32 configs skipped: 105 tested configs: arm64 allnoconfig gcc-15.1.0 arm64 defconfig gcc-15.1.0 arm64 randconfig-001-20251118 gcc-9.5.0 arm64 randconfig-002-20251118 gcc-12.5.0 arm64 randconfig-003-20251118 gcc-14.3.0 arm64 randconfig-004-20251118 gcc-12.5.0 x86_64 allnoconfig clang-20 x86_64 buildonly-randconfig-001-20251118 clang-20 x86_64 buildonly-randconfig-002-20251118 gcc-14 x86_64 buildonly-randconfig-003-20251118 clang-20 x86_64 buildonly-randconfig-004-20251118 clang-20 x86_64 buildonly-randconfig-005-20251118 clang-20 x86_64 buildonly-randconfig-006-20251118 clang-20 x86_64 defconfig gcc-14 x86_64 randconfig-001-20251119 clang-20 x86_64 randconfig-002-20251119 clang-20 x86_64 randconfig-003-20251119 gcc-14 x86_64 randconfig-004-20251119 gcc-14 x86_64 randconfig-005-20251119 gcc-14 x86_64 randconfig-006-20251119 clang-20 x86_64 randconfig-011-20251119 clang-20 x86_64 randconfig-012-20251119 clang-20 x86_64 randconfig-013-20251119 clang-20 x86_64 randconfig-014-20251119 gcc-14 x86_64 randconfig-015-20251119 clang-20 x86_64 randconfig-016-20251119 gcc-14 x86_64 randconfig-071-20251118 gcc-13 x86_64 randconfig-072-20251118 clang-20 x86_64 randconfig-073-20251118 gcc-14 x86_64 randconfig-074-20251118 gcc-13 x86_64 randconfig-075-20251118 gcc-14 x86_64 randconfig-076-20251118 clang-20 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/8] xsched: XCU Partition
by Zicheng Qu 19 Nov '25

19 Nov '25

Alekseev Dmitry (2): xsched: Add XCU control group implementation and its backend in xsched CFS xsched: Add support for CFS quota for cgroups Konstantin Meskhidze (6): xsched: Add base vstream support xcu: Add base NPU driver support xsched: Introduce vstream management xsched: Add basic scheduler core support xsched: Add xsched RT class xsched: Add xsched CFS class arch/arm/tools/syscall.tbl | 2 +- arch/arm64/configs/openeuler_defconfig | 1 + arch/powerpc/kernel/syscalls/syscall.tbl | 2 +- arch/x86/configs/openeuler_defconfig | 1 + arch/x86/entry/syscalls/syscall_32.tbl | 2 +- arch/x86/entry/syscalls/syscall_64.tbl | 2 +- drivers/Makefile | 1 + drivers/xcu/Makefile | 2 + drivers/xcu/xcu_group.c | 380 +++++++++ include/linux/cgroup_subsys.h | 4 + include/linux/syscalls.h | 2 + include/linux/vstream.h | 91 ++ include/linux/xcu_group.h | 96 +++ include/linux/xsched.h | 514 ++++++++++++ include/uapi/asm-generic/unistd.h | 5 +- include/uapi/linux/xcu_vstream.h | 77 ++ init/Kconfig | 1 + kernel/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/xsched/Kconfig | 83 ++ kernel/xsched/Makefile | 9 + kernel/xsched/cfs.c | 237 ++++++ kernel/xsched/cfs_quota.c | 98 +++ kernel/xsched/cgroup.c | 775 ++++++++++++++++++ kernel/xsched/core.c | 526 ++++++++++++ kernel/xsched/rt.c | 281 +++++++ kernel/xsched/vstream.c | 674 +++++++++++++++ .../arch/powerpc/entry/syscalls/syscall.tbl | 2 +- .../arch/x86/entry/syscalls/syscall_64.tbl | 2 +- 29 files changed, 3864 insertions(+), 9 deletions(-) create mode 100644 drivers/xcu/Makefile create mode 100644 drivers/xcu/xcu_group.c create mode 100644 include/linux/vstream.h create mode 100644 include/linux/xcu_group.h create mode 100644 include/linux/xsched.h create mode 100644 include/uapi/linux/xcu_vstream.h create mode 100644 kernel/xsched/Kconfig create mode 100644 kernel/xsched/Makefile create mode 100644 kernel/xsched/cfs.c create mode 100644 kernel/xsched/cfs_quota.c create mode 100644 kernel/xsched/cgroup.c create mode 100644 kernel/xsched/core.c create mode 100644 kernel/xsched/rt.c create mode 100644 kernel/xsched/vstream.c -- 2.34.1

2 9

[PATCH OLK-6.6 0/8] xsched: XCU Partition
by Zicheng Qu 19 Nov '25

19 Nov '25

Alekseev Dmitry (2): xsched: Add XCU control group implementation and its backend in xsched CFS xsched: Add support for CFS quota for cgroups Konstantin Meskhidze (6): xsched: Add base vstream support xcu: Add base NPU driver support xsched: Introduce vstream management xsched: Add basic scheduler core support xsched: Add xsched RT class xsched: Add xsched CFS class arch/arm/tools/syscall.tbl | 2 +- arch/arm64/configs/openeuler_defconfig | 1 + arch/powerpc/kernel/syscalls/syscall.tbl | 2 +- arch/x86/configs/openeuler_defconfig | 1 + arch/x86/entry/syscalls/syscall_32.tbl | 2 +- arch/x86/entry/syscalls/syscall_64.tbl | 2 +- drivers/Makefile | 1 + drivers/xcu/Makefile | 2 + drivers/xcu/xcu_group.c | 380 +++++++++ include/linux/cgroup_subsys.h | 4 + include/linux/syscalls.h | 2 + include/linux/vstream.h | 91 ++ include/linux/xcu_group.h | 96 +++ include/linux/xsched.h | 514 ++++++++++++ include/uapi/asm-generic/unistd.h | 5 +- include/uapi/linux/xcu_vstream.h | 77 ++ init/Kconfig | 1 + kernel/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/xsched/Kconfig | 85 ++ kernel/xsched/Makefile | 9 + kernel/xsched/cfs.c | 237 ++++++ kernel/xsched/cfs_quota.c | 98 +++ kernel/xsched/cgroup.c | 775 ++++++++++++++++++ kernel/xsched/core.c | 526 ++++++++++++ kernel/xsched/rt.c | 281 +++++++ kernel/xsched/vstream.c | 674 +++++++++++++++ .../arch/powerpc/entry/syscalls/syscall.tbl | 2 +- .../arch/x86/entry/syscalls/syscall_64.tbl | 2 +- 29 files changed, 3866 insertions(+), 9 deletions(-) create mode 100644 drivers/xcu/Makefile create mode 100644 drivers/xcu/xcu_group.c create mode 100644 include/linux/vstream.h create mode 100644 include/linux/xcu_group.h create mode 100644 include/linux/xsched.h create mode 100644 include/uapi/linux/xcu_vstream.h create mode 100644 kernel/xsched/Kconfig create mode 100644 kernel/xsched/Makefile create mode 100644 kernel/xsched/cfs.c create mode 100644 kernel/xsched/cfs_quota.c create mode 100644 kernel/xsched/cgroup.c create mode 100644 kernel/xsched/core.c create mode 100644 kernel/xsched/rt.c create mode 100644 kernel/xsched/vstream.c -- 2.34.1

2 9

[PATCH OLK-6.6] mm: hugetlb: avoid soft lockup when mprotect to large memory area
by Tong Tiangen 19 Nov '25

19 Nov '25

From: Yang Shi <yang(a)os.amperecomputing.com> stable inclusion from stable-v6.6.112 commit 964598e6f70a1be9fe675280bf16b4f96b0a6809 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B8J CVE: CVE-2025-40153 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f52ce0ea90c83a28904c7cc203a70e6434adfecb upstream. When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed: watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916] CPU: 98 PID: 126916 Comm: t2_new_sysv Kdump: loaded Not tainted 6.17-rc7 Hardware name: GIGACOMPUTING R2A3-T40-AAV1/Jefferson CIO, BIOS 5.4.4.1 07/15/2025 pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mte_clear_page_tags+0x14/0x24 lr : mte_sync_tags+0x1c0/0x240 sp : ffff80003150bb80 x29: ffff80003150bb80 x28: ffff00739e9705a8 x27: 0000ffd2d6a00000 x26: 0000ff8e4bc00000 x25: 00e80046cde00f45 x24: 0000000000022458 x23: 0000000000000000 x22: 0000000000000004 x21: 000000011b380000 x20: ffff000000000000 x19: 000000011b379f40 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc875e0aa5e2c x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffc01ce7a5c00 x4 : 00000000046cde00 x3 : fffffc0000000000 x2 : 0000000000000004 x1 : 0000000000000040 x0 : ffff0046cde7c000 Call trace: mte_clear_page_tags+0x14/0x24 set_huge_pte_at+0x25c/0x280 hugetlb_change_protection+0x220/0x430 change_protection+0x5c/0x8c mprotect_fixup+0x10c/0x294 do_mprotect_pkey.constprop.0+0x2e0/0x3d4 __arm64_sys_mprotect+0x24/0x44 invoke_syscall+0x50/0x160 el0_svc_common+0x48/0x144 do_el0_svc+0x30/0xe0 el0_svc+0x30/0xf0 el0t_64_sync_handler+0xc4/0x148 el0t_64_sync+0x1a4/0x1a8 Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size. Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too. So add cond_resched() for hugetlb to avoid soft lockup. Link: https://lkml.kernel.org/r/20250929202402.1663290-1-yang@os.amperecomputing.… Fixes: 8f860591ffb2 ("[PATCH] Enable mprotect on huge pages") Signed-off-by: Yang Shi <yang(a)os.amperecomputing.com> Tested-by: Carl Worth <carl(a)os.amperecomputing.com> Reviewed-by: Christoph Lameter (Ampere) <cl(a)gentwo.org> Reviewed-by: Catalin Marinas <catalin.marinas(a)arm.com> Acked-by: David Hildenbrand <david(a)redhat.com> Acked-by: Oscar Salvador <osalvador(a)suse.de> Reviewed-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Reviewed-by: Dev Jain <dev.jain(a)arm.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Will Deacon <will(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- mm/hugetlb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index ead99b38472a..5234ee0615bb 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -7144,6 +7144,8 @@ long hugetlb_change_protection(struct vm_area_struct *vma, psize); } spin_unlock(ptl); + + cond_resched(); } /* * Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare -- 2.25.1

2 1

[PATCH OLK-6.6 0/3] Fix some bugs.
by Jinjie Ruan 19 Nov '25

19 Nov '25

Fix some bugs. Jinjie Ruan (3): xcall2.0: Fix module unload issue by fixing refcount xcall2.0: Fix the semantic changes and concurrency issues in xcall_enable xcall2.0: Fix stack-out-of-bounds bug in xcall_write() arch/arm64/kernel/xcall/core.c | 8 ++++++++ fs/proc/proc_xcall.c | 25 ++++++++++++++++++++----- include/linux/xcall.h | 2 ++ kernel/fork.c | 3 ++- 4 files changed, 32 insertions(+), 6 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] arch_numa: make node_reclaim_distance_setup static
by Wupeng Ma 19 Nov '25

19 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID4GC1 -------------------------------- Since node_reclaim_distance_setup is not used by others, make it static. Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202511151421.e3kZPnSA-lkp@intel.com/ Fixes: 5e5d40e65cb5 ("arch_numa: Make node reclaim distance adjustment always available") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/base/arch_numa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/base/arch_numa.c b/drivers/base/arch_numa.c index f1a86af00d25d..a280af59a821c 100644 --- a/drivers/base/arch_numa.c +++ b/drivers/base/arch_numa.c @@ -191,7 +191,7 @@ void __init setup_per_cpu_areas(void) #endif #define DISTANCE_MAX (1 << DISTANCE_BITS) -int __init node_reclaim_distance_setup(char *str) +static int __init node_reclaim_distance_setup(char *str) { int val; -- 2.43.0

2 1

[PATCH OLK-5.10] mm: proc: use per_vma mmap_lock for vma traversal.
by Qi Xi 19 Nov '25

19 Nov '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ID6KMQ -------------------------------- The current method of reading /proc/pid/numa_maps uses a global mmap_lock, which can block high-priority writers and therefore lead to low performance. The mmap_lock is held during vma traversal, acquired in m_start() and released in m_stop(). Now introduces a more fine-grained mmap_lock that next() releases and reacquires the lock between vma iterations. The fine-grained lock avoids priority inversion and improves concurrency. However, the output is non-atomic for the entire address space. Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- fs/proc/task_mmu.c | 113 +++++++++++++++++++++++++++++++++++++-- include/linux/pagewalk.h | 2 + mm/pagewalk.c | 27 ++++++++++ 3 files changed, 138 insertions(+), 4 deletions(-) diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 7b41f7c290ce..4370eb895e76 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -182,6 +182,102 @@ static void *m_next(struct seq_file *m, void *v, loff_t *ppos) return next; } +static void *numa_maps_next(struct seq_file *m, void *v, loff_t *ppos) +{ + struct proc_maps_private *priv = m->private; + struct vm_area_struct *next = NULL; + struct vm_area_struct *vma = v; + struct mm_struct *mm = priv->mm; + unsigned long last_vma_end; + unsigned long last_vma_start; + int ret; + + if (!mm) + goto out; + + if (vma == priv->tail_vma) + goto out; + + if (vma->vm_next) + next = vma->vm_next; + else + next = priv->tail_vma; + + last_vma_end = vma->vm_end; + last_vma_start = vma->vm_start; + if (mmap_lock_is_contended(mm)) { + mmap_read_unlock(mm); + ret = mmap_read_lock_killable(mm); + if (ret) { + mmput(mm); + put_task_struct(priv->task); + priv->task = NULL; + return ERR_PTR(ret); + } + + /* + * After dropping the lock, there are four cases to + * consider. See the following example for explanation. + * + * +------+------+-----------+ + * | VMA1 | VMA2 | VMA3 | + * +------+------+-----------+ + * | | | | + * 4k 8k 16k 400k + * + * Suppose we drop the lock after reading VMA2 due to + * contention, then we get: + * + * last_vma_end = 16k + * + * 1) VMA2 is freed, but VMA3 exists: + * + * find_vma(mm, 16k - 1) will return VMA3. + * In this case, just continue from VMA3. + * + * 2) VMA2 still exists: + * + * find_vma(mm, 16k - 1) will return VMA2. + * Iterate the loop like the original one. + * + * 3) No more VMAs can be found: + * + * find_vma(mm, 16k - 1) will return NULL. + * No more things to do, just break. + * + * 4) (last_vma_end - 1) is the middle of a vma (VMA'): + * + * find_vma(mm, 16k - 1) will return VMA' whose range + * contains last_vma_end. + * Iterate VMA' from last_vma_end. + */ + next = find_vma(mm, last_vma_end - 1); + + /* Case 3 above */ + if (!next) + goto out; + + /* Case 1 above */ + if (next->vm_start >= last_vma_end) + goto out; + + /* Case 4 above */ + if (next->vm_end > last_vma_end) { + *ppos = last_vma_end; + return next; + } + + /* Case 2 above */ + if (next->vm_next) + next = next->vm_next; + else + next = priv->tail_vma; + } +out: + *ppos = next ? next->vm_start : -1UL; + return next; +} + static void m_stop(struct seq_file *m, void *v) { struct proc_maps_private *priv = m->private; @@ -2260,6 +2356,7 @@ static int show_numa_map(struct seq_file *m, void *v) struct mempolicy *pol; char buffer[64]; int nid; + unsigned long start_addr; if (!mm) return 0; @@ -2267,7 +2364,15 @@ static int show_numa_map(struct seq_file *m, void *v) /* Ensure we start with an empty set of numa_maps statistics. */ memset(md, 0, sizeof(*md)); - pol = __get_vma_policy(vma, vma->vm_start); + start_addr = max_t(unsigned long, vma->vm_start, m->index); + if (start_addr >= vma->vm_end) { + VM_WARN_ONCE(1, + "invalid range: start_addr=%p vma=[%p-%p]\n", + (void *)start_addr, (void *)vma->vm_start, (void *)vma->vm_end); + return 0; + } + + pol = __get_vma_policy(vma, start_addr); if (pol) { mpol_to_str(buffer, sizeof(buffer), pol); mpol_cond_put(pol); @@ -2275,7 +2380,7 @@ static int show_numa_map(struct seq_file *m, void *v) mpol_to_str(buffer, sizeof(buffer), proc_priv->task_mempolicy); } - seq_printf(m, "%08lx %s", vma->vm_start, buffer); + seq_printf(m, "%08lx %s", start_addr, buffer); if (file) { seq_puts(m, " file="); @@ -2290,7 +2395,7 @@ static int show_numa_map(struct seq_file *m, void *v) seq_puts(m, " huge"); /* mmap_lock is held by m_start */ - walk_page_vma(vma, &show_numa_ops, md); + walk_page_vma_range(vma, start_addr, &show_numa_ops, md); if (!md->pages) goto out; @@ -2328,7 +2433,7 @@ static int show_numa_map(struct seq_file *m, void *v) static const struct seq_operations proc_pid_numa_maps_op = { .start = m_start, - .next = m_next, + .next = numa_maps_next, .stop = m_stop, .show = show_numa_map, }; diff --git a/include/linux/pagewalk.h b/include/linux/pagewalk.h index b1cb6b753abb..9b8e2586cfc2 100644 --- a/include/linux/pagewalk.h +++ b/include/linux/pagewalk.h @@ -101,6 +101,8 @@ int walk_page_range_novma(struct mm_struct *mm, unsigned long start, void *private); int walk_page_vma(struct vm_area_struct *vma, const struct mm_walk_ops *ops, void *private); +int walk_page_vma_range(struct vm_area_struct *vma, unsigned long start_addr, + const struct mm_walk_ops *ops, void *private); int walk_page_mapping(struct address_space *mapping, pgoff_t first_index, pgoff_t nr, const struct mm_walk_ops *ops, void *private); diff --git a/mm/pagewalk.c b/mm/pagewalk.c index 6a4212cf00ba..12032258d1ec 100644 --- a/mm/pagewalk.c +++ b/mm/pagewalk.c @@ -485,6 +485,33 @@ int walk_page_vma(struct vm_area_struct *vma, const struct mm_walk_ops *ops, return __walk_page_range(vma->vm_start, vma->vm_end, &walk); } +int walk_page_vma_range(struct vm_area_struct *vma, unsigned long start_addr, + const struct mm_walk_ops *ops, void *private) +{ + struct mm_walk walk = { + .ops = ops, + .mm = vma->vm_mm, + .vma = vma, + .private = private, + }; + int err; + + if (!walk.mm) + return -EINVAL; + + if (start_addr < vma->vm_start || start_addr >= vma->vm_end) + return -EINVAL; + + mmap_assert_locked(walk.mm); + + err = walk_page_test(start_addr, vma->vm_end, &walk); + if (err > 0) + return 0; + if (err < 0) + return err; + return __walk_page_range(start_addr, vma->vm_end, &walk); +} + /** * walk_page_mapping - walk all memory areas mapped into a struct address_space. * @mapping: Pointer to the struct address_space -- 2.33.0

2 1