- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()
by Zhang Changzhong 19 Jan '26

19 Jan '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc1 commit a126061c80d5efb4baef4bcf346094139cd81df6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/135 CVE: CVE-2024-57994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page() to increase test coverage. syzbot found a splat caused by hard irq blocking in ptr_ring_resize_multiple() [1] As current users of ptr_ring_resize_multiple() do not require hard irqs being masked, replace it to only block BH. Rename helpers to better reflect they are safe against BH only. - ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh() - skb_array_resize_multiple() to skb_array_resize_multiple_bh() [1] WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline] WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Modules linked in: CPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline] RIP: 0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Code: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 <0f> 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85 RSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083 RAX: ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000 RDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843 RBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000d R10: dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040 R13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffff FS: 00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tun_ptr_free drivers/net/tun.c:617 [inline] __ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline] ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline] tun_queue_resize drivers/net/tun.c:3694 [inline] tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024 do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923 rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550 Fixes: ff4e538c8c3e ("page_pool: add a lockdep check for recycling in hardirq") Reported-by: syzbot+f56a5c5eac2b28439810(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/671e10df.050a0220.2b8c0f.01cf.GAE@google.com… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Link: https://patch.msgid.link/20241217135121.326370-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: include/linux/ptr_ring.h include/linux/skb_array.h [Did not backport 2c321f3f70bc.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/tap.c | 6 +++--- drivers/net/tun.c | 6 +++--- include/linux/ptr_ring.h | 17 ++++++++--------- include/linux/skb_array.h | 13 +++++++------ net/sched/sch_generic.c | 4 ++-- 5 files changed, 23 insertions(+), 23 deletions(-) diff --git a/drivers/net/tap.c b/drivers/net/tap.c index e7212a64..2c4f9d1 100644 --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@ -1330,9 +1330,9 @@ int tap_queue_resize(struct tap_dev *tap) list_for_each_entry(q, &tap->queue_list, next) rings[i++] = &q->ring; - ret = ptr_ring_resize_multiple(rings, n, - dev->tx_queue_len, GFP_KERNEL, - __skb_array_destroy_skb); + ret = ptr_ring_resize_multiple_bh(rings, n, + dev->tx_queue_len, GFP_KERNEL, + __skb_array_destroy_skb); kfree(rings); return ret; diff --git a/drivers/net/tun.c b/drivers/net/tun.c index c1fdf88..97dbec8d 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -3682,9 +3682,9 @@ static int tun_queue_resize(struct tun_struct *tun) list_for_each_entry(tfile, &tun->disabled, next) rings[i++] = &tfile->tx_ring; - ret = ptr_ring_resize_multiple(rings, n, - dev->tx_queue_len, GFP_KERNEL, - tun_ptr_free); + ret = ptr_ring_resize_multiple_bh(rings, n, + dev->tx_queue_len, GFP_KERNEL, + tun_ptr_free); kfree(rings); return ret; diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h index 808f9d3..65da2155 100644 --- a/include/linux/ptr_ring.h +++ b/include/linux/ptr_ring.h @@ -613,15 +613,14 @@ static inline int ptr_ring_resize(struct ptr_ring *r, int size, gfp_t gfp, /* * Note: producer lock is nested within consumer lock, so if you * resize you must make sure all uses nest correctly. - * In particular if you consume ring in interrupt or BH context, you must - * disable interrupts/BH when doing so. + * In particular if you consume ring in BH context, you must + * disable BH when doing so. */ -static inline int ptr_ring_resize_multiple(struct ptr_ring **rings, - unsigned int nrings, - int size, - gfp_t gfp, void (*destroy)(void *)) +static inline int ptr_ring_resize_multiple_bh(struct ptr_ring **rings, + unsigned int nrings, + int size, gfp_t gfp, + void (*destroy)(void *)) { - unsigned long flags; void ***queues; int i; @@ -636,12 +635,12 @@ static inline int ptr_ring_resize_multiple(struct ptr_ring **rings, } for (i = 0; i < nrings; ++i) { - spin_lock_irqsave(&(rings[i])->consumer_lock, flags); + spin_lock_bh(&(rings[i])->consumer_lock); spin_lock(&(rings[i])->producer_lock); queues[i] = __ptr_ring_swap_queue(rings[i], queues[i], size, gfp, destroy); spin_unlock(&(rings[i])->producer_lock); - spin_unlock_irqrestore(&(rings[i])->consumer_lock, flags); + spin_unlock_bh(&(rings[i])->consumer_lock); } for (i = 0; i < nrings; ++i) diff --git a/include/linux/skb_array.h b/include/linux/skb_array.h index e2d45b7..4ef109a 100644 --- a/include/linux/skb_array.h +++ b/include/linux/skb_array.h @@ -198,14 +198,15 @@ static inline int skb_array_resize(struct skb_array *a, int size, gfp_t gfp) return ptr_ring_resize(&a->ring, size, gfp, __skb_array_destroy_skb); } -static inline int skb_array_resize_multiple(struct skb_array **rings, - int nrings, unsigned int size, - gfp_t gfp) +static inline int skb_array_resize_multiple_bh(struct skb_array **rings, + int nrings, + unsigned int size, + gfp_t gfp) { BUILD_BUG_ON(offsetof(struct skb_array, ring)); - return ptr_ring_resize_multiple((struct ptr_ring **)rings, - nrings, size, gfp, - __skb_array_destroy_skb); + return ptr_ring_resize_multiple_bh((struct ptr_ring **)rings, + nrings, size, gfp, + __skb_array_destroy_skb); } static inline void skb_array_cleanup(struct skb_array *a) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index 9664a63..47cf61e 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -907,8 +907,8 @@ static int pfifo_fast_change_tx_queue_len(struct Qdisc *sch, bands[prio] = q; } - return skb_array_resize_multiple(bands, PFIFO_FAST_BANDS, new_len, - GFP_KERNEL); + return skb_array_resize_multiple_bh(bands, PFIFO_FAST_BANDS, new_len, + GFP_KERNEL); } struct Qdisc_ops pfifo_fast_ops __read_mostly = { -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS 0/2] [Backport] RDMA/rxe: Fix NULL-ptr-deref
by Hongtao Zhang 19 Jan '26

19 Jan '26

*** BLURB HERE *** Zhang Xiaoxu (1): [Backport] RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed Zhu Yanjun (1): [Backport] RDMA/rxe: Fix the error caused by qp->sk drivers/infiniband/sw/rxe/rxe_qp.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
by Wang Zhaolong 19 Jan '26

19 Jan '26

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> stable inclusion from stable-v6.6.120 commit dce10c59211e5cd763a62ea01e79b82a629811e3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13299 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8675c69816e4276b979ff475ee5fac4688f80125 ] When a filesystem is being automounted, it needs to preserve the user-set superblock mount options, such as the "ro" flag. Reported-by: Li Lingfeng <lilingfeng3(a)huawei.com> Link: https://lore.kernel.org/all/20240604112636.236517-3-lilingfeng@huaweicloud.… Fixes: f2aedb713c28 ("NFS: Add fs_context support.") Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/nfs/namespace.c | 6 ++++++ fs/nfs/super.c | 4 ---- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c index e7494cdd957e..40d7163bca87 100644 --- a/fs/nfs/namespace.c +++ b/fs/nfs/namespace.c @@ -147,10 +147,11 @@ struct vfsmount *nfs_d_automount(struct path *path) struct nfs_fs_context *ctx; struct fs_context *fc; struct vfsmount *mnt = ERR_PTR(-ENOMEM); struct nfs_server *server = NFS_SB(path->dentry->d_sb); struct nfs_client *client = server->nfs_client; + unsigned long s_flags = path->dentry->d_sb->s_flags; int timeout = READ_ONCE(nfs_mountpoint_expiry_timeout); int ret; if (IS_ROOT(path->dentry)) return ERR_PTR(-ESTALE); @@ -172,10 +173,15 @@ struct vfsmount *nfs_d_automount(struct path *path) if (fc->net_ns != client->cl_net) { put_net(fc->net_ns); fc->net_ns = get_net(client->cl_net); } + /* Inherit the flags covered by NFS_SB_MASK */ + fc->sb_flags_mask |= NFS_SB_MASK; + fc->sb_flags &= ~NFS_SB_MASK; + fc->sb_flags |= s_flags & NFS_SB_MASK; + /* for submounts we want the same server; referrals will reassign */ memcpy(&ctx->nfs_server._address, &client->cl_addr, client->cl_addrlen); ctx->nfs_server.addrlen = client->cl_addrlen; ctx->nfs_server.port = server->port; diff --git a/fs/nfs/super.c b/fs/nfs/super.c index 1c2969cb907e..9fa3d17981bd 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -1318,14 +1318,10 @@ int nfs_get_tree_common(struct fs_context *fc) /* -o noac implies -o sync */ if (server->flags & NFS_MOUNT_NOAC) fc->sb_flags |= SB_SYNCHRONOUS; - if (ctx->clone_data.sb) - if (ctx->clone_data.sb->s_flags & SB_SYNCHRONOUS) - fc->sb_flags |= SB_SYNCHRONOUS; - /* Get a superblock - note that we may end up sharing one that already exists */ fc->s_fs_info = server; s = sget_fc(fc, compare_super, nfs_set_super); fc->s_fs_info = NULL; if (IS_ERR(s)) { -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] scsi/hiraid: Support New Raid feature
by LinKun 19 Jan '26

19 Jan '26

From: 岳智超 <yuezhichao1(a)h-partners.com> driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8291 CVE: NA -------------------------------- Add thread irq for io queue Add stream detect Signed-off-by: 岳智超 <yuezhichao1(a)h-partners.com> --- drivers/scsi/hisi_raid/hiraid.h | 34 ++ drivers/scsi/hisi_raid/hiraid_main.c | 586 ++++++++++++++++++++++++++- 2 files changed, 603 insertions(+), 17 deletions(-) diff --git a/drivers/scsi/hisi_raid/hiraid.h b/drivers/scsi/hisi_raid/hiraid.h index 1ebc3dd..d107951 100644 --- a/drivers/scsi/hisi_raid/hiraid.h +++ b/drivers/scsi/hisi_raid/hiraid.h @@ -683,6 +683,7 @@ struct hiraid_queue { atomic_t inflight; void *sense_buffer_virt; dma_addr_t sense_buffer_phy; + s32 pci_irq; struct dma_pool *prp_small_pool; }; @@ -756,5 +757,38 @@ struct hiraid_sdev_hostdata { u16 pend_count; }; +enum stream_type { + TYPE_TOTAL, + TYPE_WRITE, + TYPE_READ, + TYPE_CLEAN, + TYPE_BOTTOM +}; + +struct HIRAID_STREAM_S { + /* recog-window */ + u64 stream_lba; + u32 stream_len; + u16 vd_id; + u16 type; + /* aging ctrl */ + int aging_credit; + int aging_grade; + u16 stream_id; + u16 using; +}; + +struct IO_LIST_S { + struct list_head list; + struct hiraid_scsi_io_cmd io_cmd; + struct hiraid_queue *submit_queue; + unsigned int sector_size; +}; + +struct spinlock_list_head_s { + struct list_head list; + spinlock_t lock; +}; + #endif diff --git a/drivers/scsi/hisi_raid/hiraid_main.c b/drivers/scsi/hisi_raid/hiraid_main.c index f84182f..281fe79 100644 --- a/drivers/scsi/hisi_raid/hiraid_main.c +++ b/drivers/scsi/hisi_raid/hiraid_main.c @@ -35,6 +35,10 @@ #include <scsi/scsi_transport.h> #include <scsi/scsi_dbg.h> #include <scsi/sg.h> +#include <linux/kthread.h> +#include <linux/mutex.h> +#include <linux/sched.h> +#include <linux/sched/prio.h> #include "hiraid.h" @@ -107,6 +111,13 @@ static u32 log_debug_switch; module_param(log_debug_switch, uint, 0644); MODULE_PARM_DESC(log_debug_switch, "set log state, default zero for switch off"); +static bool threaded_irq = false; +module_param(threaded_irq, bool, 0444); +MODULE_PARM_DESC(threaded_irq, "use threaded irq for io queue, default off"); + +static u32 poll_delay_min = 9; +static u32 poll_delay_max = 19; + static int extra_pool_num_set(const char *val, const struct kernel_param *kp) { u8 n = 0; @@ -153,7 +164,7 @@ static struct workqueue_struct *work_queue; __func__, ##__VA_ARGS__); \ } while (0) -#define HIRAID_DRV_VERSION "1.1.0.0" +#define HIRAID_DRV_VERSION "1.1.0.1" #define ADMIN_TIMEOUT (admin_tmout * HZ) #define USRCMD_TIMEOUT (180 * HZ) @@ -170,6 +181,15 @@ static struct workqueue_struct *work_queue; #define MAX_CAN_QUEUE (4096 - 1) #define MIN_CAN_QUEUE (1024 - 1) +#define MAX_DECREASE_GRADE (-8) +#define MAX_INCREASE_GRADE 8 +#define INC_GRADE 1 +#define MIN_CREDIT 0 +#define MAX_CREDIT 64 +#define CREDIT_THRES 32 +#define MIN(a, b) (((a) < (b)) ? (a) : (b)) +#define MAX(a, b) (((a) > (b)) ? (a) : (b)) + enum SENSE_STATE_CODE { SENSE_STATE_OK = 0, SENSE_STATE_NEED_CHECK, @@ -765,6 +785,404 @@ static int hiraid_build_sgl(struct hiraid_dev *hdev, return 0; } +#define MAX_PD_NUM (40 + 1) +#define MAX_STREAM_NUM 8 +#define PER_MB (1024 * 1024) +#define MAX_IO_NUM (200 * PER_MB) +#define STREAM_LEN (4 * PER_MB) +#define MAX_IO_NUM_ONCE 128 +#define IO_SUBMIT_TIME_OUT 100 +#define MAX_AGING_NUM 130 + +#define MIN_IO_SEND_TIME 10 +#define MAX_IO_SEND_TIME 50 + +#define MIN_WAIT_IO_SEND_TIME 10 +#define MAX_WAIT_IO_SEND_TIME 20 + +enum io_operation_type { + TYPE_DELETE_SINGLE_IO = 1, + TYPE_DELETE_SINGLE_IO_LIST, + TYPE_DELETE_ALL_IO_LIST +}; + +struct HIRAID_STREAM_S stream_array[MAX_PD_NUM][MAX_STREAM_NUM] = {0}; +struct spinlock_list_head_s io_heads_per_stream[MAX_PD_NUM * MAX_STREAM_NUM]; +spinlock_t stream_array_lock; + +u64 g_io_transport_num[MAX_PD_NUM][MAX_STREAM_NUM] = {0}; +u16 g_io_stream_num[MAX_PD_NUM][TYPE_BOTTOM] = {0}; +u16 g_io_count = 1; + +void hiraid_inc_io_transport_num(u16 disk_id, u16 streamd_id, u16 nlb) +{ + g_io_transport_num[disk_id][streamd_id] += nlb; +} + +void hiraid_refresh_io_transport_num(u16 disk_id, u16 streamd_id) +{ + g_io_transport_num[disk_id][streamd_id] = 0; +} + +void hiraid_inc_stream_num(u16 disk_id) +{ + spin_lock(&stream_array_lock); + g_io_stream_num[disk_id][TYPE_TOTAL]++; + spin_unlock(&stream_array_lock); +} + +void hiraid_dec_stream_num(u16 disk_id) +{ + spin_lock(&stream_array_lock); + if (g_io_stream_num[disk_id][TYPE_TOTAL] > 0) + g_io_stream_num[disk_id][TYPE_TOTAL]--; + spin_unlock(&stream_array_lock); +} + +static bool hiraid_io_recog_check_stream_exceed(u16 disk_id) +{ + bool exceed_flag; + + spin_lock(&stream_array_lock); + exceed_flag = (g_io_stream_num[disk_id][TYPE_TOTAL] >= MAX_STREAM_NUM); + spin_unlock(&stream_array_lock); + return exceed_flag; +} + +static u16 hiraid_get_stream_num(u16 disk_id) +{ + return g_io_stream_num[disk_id][TYPE_TOTAL]; +} + +static inline struct HIRAID_STREAM_S *hiraid_get_stream(u16 disk_id, + u16 stream_id) +{ + return &stream_array[disk_id][stream_id]; +} + +static inline struct spinlock_list_head_s *hiraid_get_io_head(u16 disk_id) +{ + return &(io_heads_per_stream[disk_id]); +} + +static bool hiraid_recognition_acknowledge(const struct HIRAID_STREAM_S *stream) +{ + return (stream->aging_credit >= CREDIT_THRES) ? true : false; +} + +void hiraid_io_recognition_init(void) +{ + u16 i; + + spin_lock_init(&stream_array_lock); + for (i = 0; i < (MAX_PD_NUM * MAX_STREAM_NUM); i++) { + INIT_LIST_HEAD(&hiraid_get_io_head(i)->list); + spin_lock_init(&hiraid_get_io_head(i)->lock); + } +} + +static void hiraid_io_recognition_iterator(struct HIRAID_STREAM_S *stream, + int direction) +{ + stream->aging_grade = stream->aging_grade + direction * INC_GRADE; + stream->aging_grade = MAX(stream->aging_grade, MAX_DECREASE_GRADE); + stream->aging_grade = MIN(stream->aging_grade, MAX_INCREASE_GRADE); + stream->aging_credit = stream->aging_credit + stream->aging_grade; + stream->aging_credit = MAX(stream->aging_credit, MIN_CREDIT); + stream->aging_credit = MIN(stream->aging_credit, MAX_CREDIT); +} + +struct HIRAID_STREAM_S *hiraid_io_pick_stream( + struct hiraid_scsi_rw_cmd *req, u16 type) +{ + struct HIRAID_STREAM_S *first_hit_stream = NULL; + struct HIRAID_STREAM_S *temp_stream = NULL; + u16 pick_flag = 0; + u8 i; + + for (i = 0; i < MAX_STREAM_NUM; i++) { + temp_stream = &stream_array[req->hdid][i]; + temp_stream->stream_id = i; + if (req->slba < temp_stream->stream_lba || + req->slba >= temp_stream->stream_lba + + temp_stream->stream_len || + temp_stream->type != type) { + continue; + } + if (!pick_flag) { + temp_stream->stream_lba = req->slba; + first_hit_stream = temp_stream; + pick_flag = 1; + continue; + } + hiraid_dec_stream_num(req->hdid); + memset(temp_stream, 0, + sizeof(struct HIRAID_STREAM_S)); // 去重影 + } + return first_hit_stream; +} + +static struct HIRAID_STREAM_S *hiraid_init_flow_stream(struct hiraid_scsi_rw_cmd *req, + u16 type) +{ + int i; + struct HIRAID_STREAM_S *stream = NULL; + + for (i = 0; i < MAX_STREAM_NUM; i++) { + stream = hiraid_get_stream(req->hdid, i); + if (!stream->using) { + stream->using = 1; + stream->stream_id = i; + break; + } + } + stream->stream_lba = req->slba; + stream->vd_id = req->hdid; + stream->type = type; + stream->aging_credit = 0; + stream->aging_grade = 0; + stream->stream_len = STREAM_LEN; + return stream; +} + +static struct HIRAID_STREAM_S *hiraid_stream_detect(struct hiraid_dev *hdev, + struct hiraid_scsi_rw_cmd *io_cmd) +{ + u16 type = io_cmd->opcode == HIRAID_CMD_WRITE ? TYPE_WRITE : TYPE_READ; + struct HIRAID_STREAM_S *stream = hiraid_io_pick_stream(io_cmd, type); + + if (stream != NULL) { /* 可以命中一个stream */ + return stream; + } + + if (hiraid_io_recog_check_stream_exceed(io_cmd->hdid)) + return NULL; + stream = hiraid_init_flow_stream(io_cmd, type); + hiraid_inc_stream_num(io_cmd->hdid); + return stream; +} + +u64 g_io_last_pull_time[MAX_PD_NUM] = {0}; + +static u16 hiraid_get_submit_io_stream(u16 did, struct hiraid_dev *hdev) +{ + u64 temp_num, i; + static u16 stream_num[MAX_PD_NUM] = {0}; + + if (g_io_last_pull_time[did] == 0) + g_io_last_pull_time[did] = jiffies_to_msecs(jiffies); + + for (i = 0; i < MAX_STREAM_NUM; i++) { + temp_num = g_io_transport_num[did][i]; + if (temp_num != 0) { + if ((temp_num < MAX_IO_NUM) && + ((jiffies_to_msecs(jiffies) - g_io_last_pull_time[did]) + < IO_SUBMIT_TIME_OUT)) { + stream_num[did] = i; + return i; + } + g_io_last_pull_time[did] = jiffies_to_msecs(jiffies); + hiraid_refresh_io_transport_num(did, i); + stream_num[did] = ((i+1) % MAX_STREAM_NUM); + return ((i+1) % MAX_STREAM_NUM); + } + } + g_io_last_pull_time[did] = jiffies_to_msecs(jiffies); + return ((stream_num[did]++) % MAX_STREAM_NUM); +} + +static void hiraid_submit_io_stream(u16 hdid, struct hiraid_dev *hdev) +{ + struct spinlock_list_head_s *io_slist = NULL; + struct list_head *node = NULL; + struct list_head *next_node = NULL; + struct hiraid_scsi_io_cmd io_cmd = {0}; + struct hiraid_queue *submit_queue = NULL; + unsigned int sector_size = 0; + u16 submit_stream_id = hiraid_get_submit_io_stream(hdid, hdev); + + struct IO_LIST_S *temp_io_stream = NULL; + u16 count = 0; + + io_slist = hiraid_get_io_head(hdid * MAX_STREAM_NUM + submit_stream_id); + spin_lock(&io_slist->lock); + list_for_each_safe(node, next_node, &io_slist->list) { + temp_io_stream = list_entry(node, struct IO_LIST_S, list); + list_del_init(node); + io_cmd = temp_io_stream->io_cmd; + submit_queue = temp_io_stream->submit_queue; + sector_size = temp_io_stream->sector_size; + kfree(temp_io_stream); + temp_io_stream = NULL; + spin_unlock(&io_slist->lock); + hiraid_submit_cmd(submit_queue, &io_cmd); + hiraid_inc_io_transport_num(hdid, + submit_stream_id, io_cmd.rw.nlb * sector_size); + // 单次下发不超过MAX_IO_NUM_ONCE，避免仅发送单盘 + if (++count >= MAX_IO_NUM_ONCE) { + spin_lock(&io_slist->lock); + break; + } + spin_lock(&io_slist->lock); + } + spin_unlock(&io_slist->lock); +} + +static u8 hiraid_detect_if_aging(void) +{ + if (++g_io_count == MAX_AGING_NUM) { + g_io_count = 0; + return 1; + } + return 0; +} + +static void hiraid_aging(struct hiraid_dev *hdev) +{ + struct HIRAID_STREAM_S *temp_stream = NULL; + int i = 0; + int j = 0; + + for (i = 1; i < MAX_PD_NUM; i++) { + for (j = 0; j < MAX_STREAM_NUM; j++) { + temp_stream = hiraid_get_stream(i, j); + if (temp_stream->using) { + hiraid_io_recognition_iterator(temp_stream, -1); + if (temp_stream->aging_credit <= 0) { + hiraid_dec_stream_num(i); + memset(temp_stream, + 0, sizeof(struct HIRAID_STREAM_S)); // 老化 + } + } + } + } +} + +static u8 hiraid_io_list_operation(u32 hdid, u16 cid, u16 hwq, u8 operation) +{ + int i, j; + + struct spinlock_list_head_s *io_slist = NULL; + struct list_head *node = NULL; + struct list_head *next_node = NULL; + struct hiraid_scsi_io_cmd *io_cmd = NULL; + struct hiraid_queue *hiraidq = NULL; + struct IO_LIST_S *temp_io_stream = NULL; + + u8 max_hd_num = operation == TYPE_DELETE_ALL_IO_LIST ? + MAX_PD_NUM : hdid + 1; + for (i = hdid; i < max_hd_num; i++) { + for (j = 0; j < MAX_STREAM_NUM; j++) { + io_slist = hiraid_get_io_head(i * MAX_STREAM_NUM + j); + spin_lock(&io_slist->lock); + list_for_each_safe(node, next_node, &io_slist->list) { + temp_io_stream = list_entry(node, + struct IO_LIST_S, list); + io_cmd = &(temp_io_stream->io_cmd); + hiraidq = temp_io_stream->submit_queue; + if (operation >= TYPE_DELETE_SINGLE_IO_LIST) { + list_del_init(node); + kfree(temp_io_stream); + temp_io_stream = NULL; + } else { + if ((io_cmd->rw.cmd_id == cid) && + (hiraidq->qid == hwq)) { + list_del_init(node); + spin_unlock(&io_slist->lock); + kfree(temp_io_stream); + return 1; + } + } + } + spin_unlock(&io_slist->lock); + } + } + return 0; +} + +static u8 hiraid_check_io_list(u32 hdid, u16 cid, u16 hwq) +{ + return hiraid_io_list_operation(hdid, cid, hwq, TYPE_DELETE_SINGLE_IO); +} + +static u8 hiraid_delete_single_pd_io_list(u32 hdid) +{ + return hiraid_io_list_operation(hdid, 0, 0, TYPE_DELETE_SINGLE_IO_LIST); +} + +static u8 hiraid_delete_all_io_list(void) +{ + return hiraid_io_list_operation(0, 0, 0, TYPE_DELETE_ALL_IO_LIST); +} + +static void hiraid_wait_for_io_submit(struct hiraid_dev *hdev) +{ + struct spinlock_list_head_s *io_slist = NULL; + int i = 0; + int io_flush_finished; + + do { + io_flush_finished = 1; + for (i = 0; i < (MAX_PD_NUM * MAX_STREAM_NUM); i++) { + io_slist = hiraid_get_io_head(i); + if (!list_empty(&io_slist->list)) { + io_flush_finished = 0; + break; + } + } + usleep_range(MIN_WAIT_IO_SEND_TIME, MAX_WAIT_IO_SEND_TIME); + } while (!io_flush_finished); +} + +static u8 hiraid_add_io_to_list(struct hiraid_queue *submit_queue, + struct HIRAID_STREAM_S *tmp_stream, struct hiraid_scsi_io_cmd io_cmd, + unsigned int sector_size) +{ + struct spinlock_list_head_s *io_slist = NULL; + struct IO_LIST_S *new_io_node = NULL; + + new_io_node = kmalloc(sizeof(struct IO_LIST_S), GFP_KERNEL); + if (!new_io_node) + return 0; + new_io_node->io_cmd = io_cmd; + new_io_node->submit_queue = submit_queue; + new_io_node->sector_size = sector_size; + io_slist = hiraid_get_io_head(io_cmd.rw.hdid * + MAX_STREAM_NUM + tmp_stream->stream_id); + spin_lock(&io_slist->lock); + INIT_LIST_HEAD(&(new_io_node->list)); + list_add_tail(&(new_io_node->list), &io_slist->list); + spin_unlock(&io_slist->lock); + return 1; +} + +static void hiraid_submit_io_threading(struct hiraid_dev *hdev) +{ + int i = 1; + + while (!kthread_should_stop()) { + for (i = 1; i < MAX_PD_NUM; i++) + hiraid_submit_io_stream(i, hdev); + usleep_range(MIN_IO_SEND_TIME, MAX_IO_SEND_TIME); + } +} + +static void hiraid_destroy_io_stream_resource(struct hiraid_dev *hdev) +{ + u16 i; + + for (i = 0; i < (MAX_PD_NUM * MAX_STREAM_NUM); i++) + list_del_init(&hiraid_get_io_head(i)->list); +} + +struct task_struct *g_hiraid_submit_task; +static void hiraid_init_io_stream(struct hiraid_dev *hdev) +{ + hiraid_io_recognition_init(); + g_hiraid_submit_task = kthread_run((void *)hiraid_submit_io_threading, + hdev, "hiraid_submit_thread"); +} + #define HIRAID_RW_FUA BIT(14) static int hiraid_setup_rw_cmd(struct hiraid_dev *hdev, @@ -866,6 +1284,30 @@ static int hiraid_setup_nonrw_cmd(struct hiraid_dev *hdev, return 0; } +static bool hiraid_disk_is_hdd(u8 attr) +{ + switch (HIRAID_DEV_DISK_TYPE(attr)) { + case HIRAID_SAS_HDD_VD: + case HIRAID_SATA_HDD_VD: + case HIRAID_SAS_HDD_PD: + case HIRAID_SATA_HDD_PD: + return true; + default: + return false; + } +} + +static bool hiraid_disk_is_hdd_rawdrive(u8 attr) +{ + switch (HIRAID_DEV_DISK_TYPE(attr)) { + case HIRAID_SAS_HDD_PD: + case HIRAID_SATA_HDD_PD: + return true; + default: + return false; + } +} + static int hiraid_setup_io_cmd(struct hiraid_dev *hdev, struct hiraid_scsi_io_cmd *io_cmd, struct scsi_cmnd *scmd) @@ -1023,6 +1465,7 @@ static int hiraid_queue_command(struct Scsi_Host *shost, struct hiraid_sdev_hostdata *hostdata; struct hiraid_scsi_io_cmd io_cmd; struct hiraid_queue *ioq; + struct HIRAID_STREAM_S *tmp_stm = NULL; u16 hwq, cid; int ret; @@ -1085,6 +1528,23 @@ static int hiraid_queue_command(struct Scsi_Host *shost, } WRITE_ONCE(mapbuf->state, CMD_FLIGHT); + + if (hiraid_is_rw_scmd(scmd) && + hiraid_disk_is_hdd_rawdrive(hostdata->attr)) { + if (hiraid_detect_if_aging()) + hiraid_aging(hdev); + tmp_stm = hiraid_stream_detect(hdev, &(io_cmd.rw)); + if (tmp_stm != NULL) { + hiraid_io_recognition_iterator(tmp_stm, 1); + if (hiraid_recognition_acknowledge(tmp_stm) && + (hiraid_get_stream_num(io_cmd.rw.hdid) > 1)) { + if (hiraid_add_io_to_list(ioq, + tmp_stm, io_cmd, sdev->sector_size)) { + return 0; + } + } + } + } hiraid_submit_cmd(ioq, &io_cmd); return 0; @@ -1135,19 +1595,6 @@ static int hiraid_disk_qd(u8 attr) } } -static bool hiraid_disk_is_hdd(u8 attr) -{ - switch (HIRAID_DEV_DISK_TYPE(attr)) { - case HIRAID_SAS_HDD_VD: - case HIRAID_SATA_HDD_VD: - case HIRAID_SAS_HDD_PD: - case HIRAID_SATA_HDD_PD: - return true; - default: - return false; - } -} - static int hiraid_slave_alloc(struct scsi_device *sdev) { struct hiraid_sdev_hostdata *hostdata; @@ -1305,6 +1752,7 @@ static int hiraid_alloc_queue(struct hiraid_dev *hdev, u16 qid, u16 depth) hiraidq->q_depth = depth; hiraidq->qid = qid; hiraidq->cq_vector = -1; + hiraidq->pci_irq = -1; hdev->queue_count++; return 0; @@ -1593,12 +2041,38 @@ static inline bool hiraid_process_cq(struct hiraid_queue *hiraidq, u16 *start, u16 *end, int tag) { bool found = false; + *start = hiraidq->cq_head; + while (!found && hiraid_cqe_pending(hiraidq)) { + if (le16_to_cpu(hiraidq->cqes[hiraidq->cq_head].cmd_id) == tag) + found = true; + hiraid_update_cq_head(hiraidq); + } + *end = hiraidq->cq_head; + + if (*start != *end) + writel(hiraidq->cq_head, + hiraidq->q_db + hiraidq->hdev->db_stride); + + return found; +} +static inline bool hiraid_process_cq_for_thread(struct hiraid_queue *hiraidq, + u16 *start, u16 *end, + u8 *wakeup_thread_flag, int tag) +{ + bool found = false; + u16 max_io_num = hiraidq->q_depth / 4; + u16 io_count = 0; *start = hiraidq->cq_head; while (!found && hiraid_cqe_pending(hiraidq)) { if (le16_to_cpu(hiraidq->cqes[hiraidq->cq_head].cmd_id) == tag) found = true; hiraid_update_cq_head(hiraidq); + + if (++io_count >= max_io_num) { + *wakeup_thread_flag = 1; + break; + } } *end = hiraidq->cq_head; @@ -1646,6 +2120,55 @@ static irqreturn_t hiraid_handle_irq(int irq, void *data) return ret; } +static irqreturn_t hiraid_io_poll(int irq, void *data) +{ + struct hiraid_queue *hiraidq = data; + irqreturn_t ret = IRQ_NONE; + u16 start, end; + + do { + spin_lock(&hiraidq->cq_lock); + hiraid_process_cq(hiraidq, &start, &end, -1); + hiraidq->last_cq_head = hiraidq->cq_head; + spin_unlock(&hiraidq->cq_lock); + + if (start != end) { + hiraid_complete_cqes(hiraidq, start, end); + ret = IRQ_HANDLED; + } + usleep_range(poll_delay_min, poll_delay_max); + } while (start != end); + enable_irq(hiraidq->pci_irq); + return ret; +} + +static irqreturn_t hiraid_io_irq(int irq, void *data) +{ + struct hiraid_queue *hiraidq = data; + irqreturn_t ret = IRQ_NONE; + u16 start, end; + u8 wakeup_thread_flag = 0; + + spin_lock(&hiraidq->cq_lock); + if (hiraidq->cq_head != hiraidq->last_cq_head) + ret = IRQ_HANDLED; + + hiraid_process_cq_for_thread(hiraidq, &start, + &end, &wakeup_thread_flag, -1); + hiraidq->last_cq_head = hiraidq->cq_head; + spin_unlock(&hiraidq->cq_lock); + + if (start != end) { + hiraid_complete_cqes(hiraidq, start, end); + ret = IRQ_HANDLED; + } + if (wakeup_thread_flag) { + disable_irq_nosync(hiraidq->pci_irq); + ret = IRQ_WAKE_THREAD; + } + return ret; +} + static int hiraid_setup_admin_queue(struct hiraid_dev *hdev) { struct hiraid_queue *adminq = &hdev->queues[0]; @@ -1681,9 +2204,11 @@ static int hiraid_setup_admin_queue(struct hiraid_dev *hdev) NULL, adminq, "hiraid%d_q%d", hdev->instance, adminq->qid); if (ret) { adminq->cq_vector = -1; + adminq->pci_irq = -1; return ret; } + adminq->pci_irq = pci_irq_vector(hdev->pdev, adminq->cq_vector); hiraid_init_queue(adminq, 0); dev_info(hdev->dev, "setup admin queue success, queuecount[%d] online[%d] pagesize[%d]\n", @@ -1958,14 +2483,23 @@ static int hiraid_create_queue(struct hiraid_queue *hiraidq, u16 qid) goto delete_cq; hiraidq->cq_vector = cq_vector; - ret = pci_request_irq(hdev->pdev, cq_vector, hiraid_handle_irq, NULL, - hiraidq, "hiraid%d_q%d", hdev->instance, qid); + if (threaded_irq) + ret = pci_request_irq(hdev->pdev, cq_vector, hiraid_io_irq, + hiraid_io_poll, hiraidq, "hiraid%d_q%d", + hdev->instance, qid); + else + ret = pci_request_irq(hdev->pdev, cq_vector, hiraid_handle_irq, + NULL, hiraidq, "hiraid%d_q%d", + hdev->instance, qid); + if (ret) { hiraidq->cq_vector = -1; + hiraidq->pci_irq = -1; dev_err(hdev->dev, "request queue[%d] irq failed\n", qid); goto delete_sq; } + hiraidq->pci_irq = pci_irq_vector(hdev->pdev, hiraidq->cq_vector); hiraid_init_queue(hiraidq, qid); return 0; @@ -2122,10 +2656,11 @@ static int hiraid_setup_io_queues(struct hiraid_dev *hdev) adminq, "hiraid%d_q%d", hdev->instance, adminq->qid); if (ret) { dev_err(hdev->dev, "request admin irq failed\n"); + adminq->pci_irq = -1; adminq->cq_vector = -1; return ret; } - + adminq->pci_irq = pci_irq_vector(hdev->pdev, adminq->cq_vector); hdev->online_queues++; for (i = hdev->queue_count; i <= hdev->max_qid; i++) { @@ -3304,6 +3839,12 @@ static int hiraid_abort(struct scsi_cmnd *scmd) cid = mapbuf->cid; hwq = mapbuf->hiraidq->qid; + if (hiraid_check_io_list(hostdata->hdid, cid, hwq)) { + dev_warn(hdev->dev, "find cid[%d] qid[%d] in host, abort succ\n", + cid, hwq); + return SUCCESS; + } + dev_warn(hdev->dev, "cid[%d] qid[%d] timeout, send abort\n", cid, hwq); ret = hiraid_send_abort_cmd(hdev, hostdata->hdid, hwq, cid); if (ret != -ETIME) { @@ -3339,6 +3880,7 @@ static int hiraid_scsi_reset(struct scsi_cmnd *scmd, enum hiraid_rst_type rst) if ((ret == 0) || (ret == FW_EH_DEV_NONE && rst == HIRAID_RESET_TARGET)) { if (rst == HIRAID_RESET_TARGET) { + hiraid_delete_single_pd_io_list(hostdata->hdid); ret = wait_tgt_reset_io_done(scmd); if (ret) { dev_warn(hdev->dev, "sdev[%d:%d] target has %d peding cmd, target reset failed\n", @@ -3378,6 +3920,7 @@ static int hiraid_host_reset(struct scsi_cmnd *scmd) dev_warn(hdev->dev, "sdev[%d:%d] send host reset\n", scmd->device->channel, scmd->device->id); + hiraid_delete_all_io_list(); if (hiraid_reset_work_sync(hdev) == -EBUSY) flush_work(&hdev->reset_work); @@ -3411,6 +3954,7 @@ static pci_ers_result_t hiraid_pci_error_detected(struct pci_dev *pdev, scsi_block_requests(hdev->shost); hiraid_dev_state_trans(hdev, DEV_RESETTING); + hiraid_delete_all_io_list(); return PCI_ERS_RESULT_NEED_RESET; case pci_channel_io_perm_failure: @@ -4044,6 +4588,7 @@ static int hiraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto unregist_bsg; scsi_scan_host(hdev->shost); + hiraid_init_io_stream(hdev); return 0; @@ -4075,6 +4620,13 @@ static void hiraid_remove(struct pci_dev *pdev) dev_info(hdev->dev, "enter hiraid remove\n"); + if (pci_device_is_present(pdev)) + hiraid_wait_for_io_submit(hdev); + + kthread_stop(g_hiraid_submit_task); + hiraid_delete_all_io_list(); + hiraid_destroy_io_stream_resource(hdev); + hiraid_dev_state_trans(hdev, DEV_DELETING); flush_work(&hdev->reset_work); -- 2.45.1.windows.1

2 1

[PATCH OLK-5.10] [Backport] HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
by Chen Jinghuang 19 Jan '26

19 Jan '26

From: Terry Junge <linuxhid(a)cosmicgizmosystems.com> stable inclusion from stable-v5.10.239 commit 41827a2dbdd7880df9881506dee13bc88d4230bb category: bugfix bugzilla: 9660 CVE: CVE-2025-38103 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fe7f7ac8e0c708446ff017453add769ffc15deed upstream. Update struct hid_descriptor to better reflect the mandatory and optional parts of the HID Descriptor as per USB HID 1.11 specification. Note: the kernel currently does not parse any optional HID class descriptors, only the mandatory report descriptor. Update all references to member element desc[0] to rpt_desc. Add test to verify bLength and bNumDescriptors values are valid. Replace the for loop with direct access to the mandatory HID class descriptor member for the report descriptor. This eliminates the possibility of getting an out-of-bounds fault. Add a warning message if the HID descriptor contains any unsupported optional HID class descriptors. Reported-by: syzbot+c52569baf0c843f35495(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c52569baf0c843f35495 Fixes: f043bfc98c19 ("HID: usbhid: fix out-of-bounds bug") Cc: stable(a)vger.kernel.org Signed-off-by: Terry Junge <linuxhid(a)cosmicgizmosystems.com> Reviewed-by: Michael Kelley <mhklinux(a)outlook.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Terry Junge <linuxhid(a)cosmicgizmosystems.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/hid/hid-hyperv.c | 5 +++-- drivers/hid/usbhid/hid-core.c | 25 ++++++++++++++----------- drivers/usb/gadget/function/f_hid.c | 12 ++++++------ include/linux/hid.h | 3 ++- 4 files changed, 25 insertions(+), 20 deletions(-) diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c index b7704dd6809d..bf77cfb723d5 100644 --- a/drivers/hid/hid-hyperv.c +++ b/drivers/hid/hid-hyperv.c @@ -199,7 +199,8 @@ static void mousevsc_on_receive_device_info(struct mousevsc_dev *input_device, if (!input_device->hid_desc) goto cleanup; - input_device->report_desc_size = desc->desc[0].wDescriptorLength; + input_device->report_desc_size = le16_to_cpu( + desc->rpt_desc.wDescriptorLength); if (input_device->report_desc_size == 0) { input_device->dev_info_status = -EINVAL; goto cleanup; @@ -217,7 +218,7 @@ static void mousevsc_on_receive_device_info(struct mousevsc_dev *input_device, memcpy(input_device->report_desc, ((unsigned char *)desc) + desc->bLength, - desc->desc[0].wDescriptorLength); + le16_to_cpu(desc->rpt_desc.wDescriptorLength)); /* Send the ack */ memset(&ack, 0, sizeof(struct mousevsc_prt_msg)); diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c index 009a0469d54f..c3b104c72e49 100644 --- a/drivers/hid/usbhid/hid-core.c +++ b/drivers/hid/usbhid/hid-core.c @@ -984,12 +984,11 @@ static int usbhid_parse(struct hid_device *hid) struct usb_host_interface *interface = intf->cur_altsetting; struct usb_device *dev = interface_to_usbdev (intf); struct hid_descriptor *hdesc; + struct hid_class_descriptor *hcdesc; u32 quirks = 0; unsigned int rsize = 0; char *rdesc; - int ret, n; - int num_descriptors; - size_t offset = offsetof(struct hid_descriptor, desc); + int ret; quirks = hid_lookup_quirk(hid); @@ -1011,20 +1010,19 @@ static int usbhid_parse(struct hid_device *hid) return -ENODEV; } - if (hdesc->bLength < sizeof(struct hid_descriptor)) { - dbg_hid("hid descriptor is too short\n"); + if (!hdesc->bNumDescriptors || + hdesc->bLength != sizeof(*hdesc) + + (hdesc->bNumDescriptors - 1) * sizeof(*hcdesc)) { + dbg_hid("hid descriptor invalid, bLen=%hhu bNum=%hhu\n", + hdesc->bLength, hdesc->bNumDescriptors); return -EINVAL; } hid->version = le16_to_cpu(hdesc->bcdHID); hid->country = hdesc->bCountryCode; - num_descriptors = min_t(int, hdesc->bNumDescriptors, - (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor)); - - for (n = 0; n < num_descriptors; n++) - if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT) - rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength); + if (hdesc->rpt_desc.bDescriptorType == HID_DT_REPORT) + rsize = le16_to_cpu(hdesc->rpt_desc.wDescriptorLength); if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) { dbg_hid("weird size of report descriptor (%u)\n", rsize); @@ -1052,6 +1050,11 @@ static int usbhid_parse(struct hid_device *hid) goto err; } + if (hdesc->bNumDescriptors > 1) + hid_warn(intf, + "%u unsupported optional hid class descriptors\n", + (int)(hdesc->bNumDescriptors - 1)); + hid->quirks |= quirks; return 0; diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c index ba018aeb21d8..2f30699f0426 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -114,8 +114,8 @@ static struct hid_descriptor hidg_desc = { .bcdHID = cpu_to_le16(0x0101), .bCountryCode = 0x00, .bNumDescriptors = 0x1, - /*.desc[0].bDescriptorType = DYNAMIC */ - /*.desc[0].wDescriptorLenght = DYNAMIC */ + /*.rpt_desc.bDescriptorType = DYNAMIC */ + /*.rpt_desc.wDescriptorLength = DYNAMIC */ }; /* Super-Speed Support */ @@ -724,8 +724,8 @@ static int hidg_setup(struct usb_function *f, struct hid_descriptor hidg_desc_copy = hidg_desc; VDBG(cdev, "USB_REQ_GET_DESCRIPTOR: HID\n"); - hidg_desc_copy.desc[0].bDescriptorType = HID_DT_REPORT; - hidg_desc_copy.desc[0].wDescriptorLength = + hidg_desc_copy.rpt_desc.bDescriptorType = HID_DT_REPORT; + hidg_desc_copy.rpt_desc.wDescriptorLength = cpu_to_le16(hidg->report_desc_length); length = min_t(unsigned short, length, @@ -966,8 +966,8 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) * We can use hidg_desc struct here but we should not relay * that its content won't change after returning from this function. */ - hidg_desc.desc[0].bDescriptorType = HID_DT_REPORT; - hidg_desc.desc[0].wDescriptorLength = + hidg_desc.rpt_desc.bDescriptorType = HID_DT_REPORT; + hidg_desc.rpt_desc.wDescriptorLength = cpu_to_le16(hidg->report_desc_length); hidg_hs_in_ep_desc.bEndpointAddress = diff --git a/include/linux/hid.h b/include/linux/hid.h index 9e306bf9959d..03627c96d814 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -674,8 +674,9 @@ struct hid_descriptor { __le16 bcdHID; __u8 bCountryCode; __u8 bNumDescriptors; + struct hid_class_descriptor rpt_desc; - struct hid_class_descriptor desc[1]; + struct hid_class_descriptor opt_descs[]; } __attribute__ ((packed)); #define HID_DEVICE(b, g, ven, prod) \ -- 2.34.1

2 1

[PATCH OLK-5.10] scsi/hiraid: Support New Raid feature
by LinKun 19 Jan '26

19 Jan '26

From: 岳智超 <yuezhichao1(a)h-partners.com> driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8290 CVE: NA -------------------------------- Add thread irq for io queue Add stream detect Signed-off-by: 岳智超 <yuezhichao1(a)h-partners.com> --- drivers/scsi/hisi_raid/hiraid.h | 34 ++ drivers/scsi/hisi_raid/hiraid_main.c | 586 ++++++++++++++++++++++++++- 2 files changed, 604 insertions(+), 16 deletions(-) diff --git a/drivers/scsi/hisi_raid/hiraid.h b/drivers/scsi/hisi_raid/hiraid.h index 04b2e25..b7e3c71 100644 --- a/drivers/scsi/hisi_raid/hiraid.h +++ b/drivers/scsi/hisi_raid/hiraid.h @@ -686,6 +686,7 @@ struct hiraid_queue { atomic_t inflight; void *sense_buffer_virt; dma_addr_t sense_buffer_phy; + s32 pci_irq; struct dma_pool *prp_small_pool; }; @@ -760,5 +761,38 @@ struct hiraid_sdev_hostdata { u16 pend_count; }; +enum stream_type { + TYPE_TOTAL, + TYPE_WRITE, + TYPE_READ, + TYPE_CLEAN, + TYPE_BOTTOM +}; + +struct HIRAID_STREAM_S { + /* recog-window */ + u64 stream_lba; + u32 stream_len; + u16 vd_id; + u16 type; + /* aging ctrl */ + int aging_credit; + int aging_grade; + u16 stream_id; + u16 using; +}; + +struct IO_LIST_S { + struct list_head list; + struct hiraid_scsi_io_cmd io_cmd; + struct hiraid_queue *submit_queue; + unsigned int sector_size; +}; + +struct spinlock_list_head_s { + struct list_head list; + spinlock_t lock; +}; + #endif diff --git a/drivers/scsi/hisi_raid/hiraid_main.c b/drivers/scsi/hisi_raid/hiraid_main.c index 2f33339..a7dc746 100644 --- a/drivers/scsi/hisi_raid/hiraid_main.c +++ b/drivers/scsi/hisi_raid/hiraid_main.c @@ -35,6 +35,10 @@ #include <scsi/scsi_transport.h> #include <scsi/scsi_dbg.h> #include <scsi/sg.h> +#include <linux/kthread.h> +#include <linux/mutex.h> +#include <linux/sched.h> +#include <linux/sched/prio.h> #include "hiraid.h" @@ -107,6 +111,13 @@ static u32 log_debug_switch; module_param(log_debug_switch, uint, 0644); MODULE_PARM_DESC(log_debug_switch, "set log state, default zero for switch off"); +static bool threaded_irq = false; +module_param(threaded_irq, bool, 0444); +MODULE_PARM_DESC(threaded_irq, "use threaded irq for io queue, default off"); + +static u32 poll_delay_min = 9; +static u32 poll_delay_max = 19; + static int extra_pool_num_set(const char *val, const struct kernel_param *kp) { u8 n = 0; @@ -152,7 +163,7 @@ static struct workqueue_struct *work_queue; __func__, ##__VA_ARGS__); \ } while (0) -#define HIRAID_DRV_VERSION "1.1.0.1" +#define HIRAID_DRV_VERSION "1.1.0.2" #define ADMIN_TIMEOUT (admin_tmout * HZ) #define USRCMD_TIMEOUT (180 * HZ) @@ -169,6 +180,15 @@ static struct workqueue_struct *work_queue; #define MAX_CAN_QUEUE (4096 - 1) #define MIN_CAN_QUEUE (1024 - 1) +#define MAX_DECREASE_GRADE (-8) +#define MAX_INCREASE_GRADE 8 +#define INC_GRADE 1 +#define MIN_CREDIT 0 +#define MAX_CREDIT 64 +#define CREDIT_THRES 32 +#define MIN(a, b) (((a) < (b)) ? (a) : (b)) +#define MAX(a, b) (((a) > (b)) ? (a) : (b)) + enum SENSE_STATE_CODE { SENSE_STATE_OK = 0, SENSE_STATE_NEED_CHECK, @@ -749,6 +769,404 @@ static int hiraid_build_sgl(struct hiraid_dev *hdev, struct hiraid_scsi_io_cmd * return 0; } +#define MAX_PD_NUM (40 + 1) +#define MAX_STREAM_NUM 8 +#define PER_MB (1024 * 1024) +#define MAX_IO_NUM (200 * PER_MB) +#define STREAM_LEN (4 * PER_MB) +#define MAX_IO_NUM_ONCE 128 +#define IO_SUBMIT_TIME_OUT 100 +#define MAX_AGING_NUM 130 + +#define MIN_IO_SEND_TIME 10 +#define MAX_IO_SEND_TIME 50 + +#define MIN_WAIT_IO_SEND_TIME 10 +#define MAX_WAIT_IO_SEND_TIME 20 + +enum io_operation_type { + TYPE_DELETE_SINGLE_IO = 1, + TYPE_DELETE_SINGLE_IO_LIST, + TYPE_DELETE_ALL_IO_LIST +}; + +struct HIRAID_STREAM_S stream_array[MAX_PD_NUM][MAX_STREAM_NUM] = {0}; +struct spinlock_list_head_s io_heads_per_stream[MAX_PD_NUM * MAX_STREAM_NUM]; +spinlock_t stream_array_lock; + +u64 g_io_transport_num[MAX_PD_NUM][MAX_STREAM_NUM] = {0}; +u16 g_io_stream_num[MAX_PD_NUM][TYPE_BOTTOM] = {0}; +u16 g_io_count = 1; + +void hiraid_inc_io_transport_num(u16 disk_id, u16 streamd_id, u16 nlb) +{ + g_io_transport_num[disk_id][streamd_id] += nlb; +} + +void hiraid_refresh_io_transport_num(u16 disk_id, u16 streamd_id) +{ + g_io_transport_num[disk_id][streamd_id] = 0; +} + +void hiraid_inc_stream_num(u16 disk_id) +{ + spin_lock(&stream_array_lock); + g_io_stream_num[disk_id][TYPE_TOTAL]++; + spin_unlock(&stream_array_lock); +} + +void hiraid_dec_stream_num(u16 disk_id) +{ + spin_lock(&stream_array_lock); + if (g_io_stream_num[disk_id][TYPE_TOTAL] > 0) + g_io_stream_num[disk_id][TYPE_TOTAL]--; + spin_unlock(&stream_array_lock); +} + +static bool hiraid_io_recog_check_stream_exceed(u16 disk_id) +{ + bool exceed_flag; + + spin_lock(&stream_array_lock); + exceed_flag = (g_io_stream_num[disk_id][TYPE_TOTAL] >= MAX_STREAM_NUM); + spin_unlock(&stream_array_lock); + return exceed_flag; +} + +static u16 hiraid_get_stream_num(u16 disk_id) +{ + return g_io_stream_num[disk_id][TYPE_TOTAL]; +} + +static inline struct HIRAID_STREAM_S *hiraid_get_stream(u16 disk_id, + u16 stream_id) +{ + return &stream_array[disk_id][stream_id]; +} + +static inline struct spinlock_list_head_s *hiraid_get_io_head(u16 disk_id) +{ + return &(io_heads_per_stream[disk_id]); +} + +static bool hiraid_recognition_acknowledge(const struct HIRAID_STREAM_S *stream) +{ + return (stream->aging_credit >= CREDIT_THRES) ? true : false; +} + +void hiraid_io_recognition_init(void) +{ + u16 i; + + spin_lock_init(&stream_array_lock); + for (i = 0; i < (MAX_PD_NUM * MAX_STREAM_NUM); i++) { + INIT_LIST_HEAD(&hiraid_get_io_head(i)->list); + spin_lock_init(&hiraid_get_io_head(i)->lock); + } +} + +static void hiraid_io_recognition_iterator(struct HIRAID_STREAM_S *stream, + int direction) +{ + stream->aging_grade = stream->aging_grade + direction * INC_GRADE; + stream->aging_grade = MAX(stream->aging_grade, MAX_DECREASE_GRADE); + stream->aging_grade = MIN(stream->aging_grade, MAX_INCREASE_GRADE); + stream->aging_credit = stream->aging_credit + stream->aging_grade; + stream->aging_credit = MAX(stream->aging_credit, MIN_CREDIT); + stream->aging_credit = MIN(stream->aging_credit, MAX_CREDIT); +} + +struct HIRAID_STREAM_S *hiraid_io_pick_stream( + struct hiraid_scsi_rw_cmd *req, u16 type) +{ + struct HIRAID_STREAM_S *first_hit_stream = NULL; + struct HIRAID_STREAM_S *temp_stream = NULL; + u16 pick_flag = 0; + u8 i; + + for (i = 0; i < MAX_STREAM_NUM; i++) { + temp_stream = &stream_array[req->hdid][i]; + temp_stream->stream_id = i; + if (req->slba < temp_stream->stream_lba || + req->slba >= temp_stream->stream_lba + + temp_stream->stream_len || + temp_stream->type != type) { + continue; + } + if (!pick_flag) { + temp_stream->stream_lba = req->slba; + first_hit_stream = temp_stream; + pick_flag = 1; + continue; + } + hiraid_dec_stream_num(req->hdid); + memset(temp_stream, 0, + sizeof(struct HIRAID_STREAM_S)); // 去重影 + } + return first_hit_stream; +} + +static struct HIRAID_STREAM_S *hiraid_init_flow_stream(struct hiraid_scsi_rw_cmd *req, + u16 type) +{ + int i; + struct HIRAID_STREAM_S *stream = NULL; + + for (i = 0; i < MAX_STREAM_NUM; i++) { + stream = hiraid_get_stream(req->hdid, i); + if (!stream->using) { + stream->using = 1; + stream->stream_id = i; + break; + } + } + stream->stream_lba = req->slba; + stream->vd_id = req->hdid; + stream->type = type; + stream->aging_credit = 0; + stream->aging_grade = 0; + stream->stream_len = STREAM_LEN; + return stream; +} + +static struct HIRAID_STREAM_S *hiraid_stream_detect(struct hiraid_dev *hdev, + struct hiraid_scsi_rw_cmd *io_cmd) +{ + u16 type = io_cmd->opcode == HIRAID_CMD_WRITE ? TYPE_WRITE : TYPE_READ; + struct HIRAID_STREAM_S *stream = hiraid_io_pick_stream(io_cmd, type); + + if (stream != NULL) { /* 可以命中一个stream */ + return stream; + } + + if (hiraid_io_recog_check_stream_exceed(io_cmd->hdid)) + return NULL; + stream = hiraid_init_flow_stream(io_cmd, type); + hiraid_inc_stream_num(io_cmd->hdid); + return stream; +} + +u64 g_io_last_pull_time[MAX_PD_NUM] = {0}; + +static u16 hiraid_get_submit_io_stream(u16 did, struct hiraid_dev *hdev) +{ + u64 temp_num, i; + static u16 stream_num[MAX_PD_NUM] = {0}; + + if (g_io_last_pull_time[did] == 0) + g_io_last_pull_time[did] = jiffies_to_msecs(jiffies); + + for (i = 0; i < MAX_STREAM_NUM; i++) { + temp_num = g_io_transport_num[did][i]; + if (temp_num != 0) { + if ((temp_num < MAX_IO_NUM) && + ((jiffies_to_msecs(jiffies) - g_io_last_pull_time[did]) + < IO_SUBMIT_TIME_OUT)) { + stream_num[did] = i; + return i; + } + g_io_last_pull_time[did] = jiffies_to_msecs(jiffies); + hiraid_refresh_io_transport_num(did, i); + stream_num[did] = ((i+1) % MAX_STREAM_NUM); + return ((i+1) % MAX_STREAM_NUM); + } + } + g_io_last_pull_time[did] = jiffies_to_msecs(jiffies); + return ((stream_num[did]++) % MAX_STREAM_NUM); +} + +static void hiraid_submit_io_stream(u16 hdid, struct hiraid_dev *hdev) +{ + struct spinlock_list_head_s *io_slist = NULL; + struct list_head *node = NULL; + struct list_head *next_node = NULL; + struct hiraid_scsi_io_cmd io_cmd = {0}; + struct hiraid_queue *submit_queue = NULL; + unsigned int sector_size = 0; + u16 submit_stream_id = hiraid_get_submit_io_stream(hdid, hdev); + + struct IO_LIST_S *temp_io_stream = NULL; + u16 count = 0; + + io_slist = hiraid_get_io_head(hdid * MAX_STREAM_NUM + submit_stream_id); + spin_lock(&io_slist->lock); + list_for_each_safe(node, next_node, &io_slist->list) { + temp_io_stream = list_entry(node, struct IO_LIST_S, list); + list_del_init(node); + io_cmd = temp_io_stream->io_cmd; + submit_queue = temp_io_stream->submit_queue; + sector_size = temp_io_stream->sector_size; + kfree(temp_io_stream); + temp_io_stream = NULL; + spin_unlock(&io_slist->lock); + hiraid_submit_cmd(submit_queue, &io_cmd); + hiraid_inc_io_transport_num(hdid, + submit_stream_id, io_cmd.rw.nlb * sector_size); + // 单次下发不超过MAX_IO_NUM_ONCE，避免仅发送单盘 + if (++count >= MAX_IO_NUM_ONCE) { + spin_lock(&io_slist->lock); + break; + } + spin_lock(&io_slist->lock); + } + spin_unlock(&io_slist->lock); +} + +static u8 hiraid_detect_if_aging(void) +{ + if (++g_io_count == MAX_AGING_NUM) { + g_io_count = 0; + return 1; + } + return 0; +} + +static void hiraid_aging(struct hiraid_dev *hdev) +{ + struct HIRAID_STREAM_S *temp_stream = NULL; + int i = 0; + int j = 0; + + for (i = 1; i < MAX_PD_NUM; i++) { + for (j = 0; j < MAX_STREAM_NUM; j++) { + temp_stream = hiraid_get_stream(i, j); + if (temp_stream->using) { + hiraid_io_recognition_iterator(temp_stream, -1); + if (temp_stream->aging_credit <= 0) { + hiraid_dec_stream_num(i); + memset(temp_stream, + 0, sizeof(struct HIRAID_STREAM_S)); // 老化 + } + } + } + } +} + +static u8 hiraid_io_list_operation(u32 hdid, u16 cid, u16 hwq, u8 operation) +{ + int i, j; + + struct spinlock_list_head_s *io_slist = NULL; + struct list_head *node = NULL; + struct list_head *next_node = NULL; + struct hiraid_scsi_io_cmd *io_cmd = NULL; + struct hiraid_queue *hiraidq = NULL; + struct IO_LIST_S *temp_io_stream = NULL; + + u8 max_hd_num = operation == TYPE_DELETE_ALL_IO_LIST ? + MAX_PD_NUM : hdid + 1; + for (i = hdid; i < max_hd_num; i++) { + for (j = 0; j < MAX_STREAM_NUM; j++) { + io_slist = hiraid_get_io_head(i * MAX_STREAM_NUM + j); + spin_lock(&io_slist->lock); + list_for_each_safe(node, next_node, &io_slist->list) { + temp_io_stream = list_entry(node, + struct IO_LIST_S, list); + io_cmd = &(temp_io_stream->io_cmd); + hiraidq = temp_io_stream->submit_queue; + if (operation >= TYPE_DELETE_SINGLE_IO_LIST) { + list_del_init(node); + kfree(temp_io_stream); + temp_io_stream = NULL; + } else { + if ((io_cmd->rw.cmd_id == cid) && + (hiraidq->qid == hwq)) { + list_del_init(node); + spin_unlock(&io_slist->lock); + kfree(temp_io_stream); + return 1; + } + } + } + spin_unlock(&io_slist->lock); + } + } + return 0; +} + +static u8 hiraid_check_io_list(u32 hdid, u16 cid, u16 hwq) +{ + return hiraid_io_list_operation(hdid, cid, hwq, TYPE_DELETE_SINGLE_IO); +} + +static u8 hiraid_delete_single_pd_io_list(u32 hdid) +{ + return hiraid_io_list_operation(hdid, 0, 0, TYPE_DELETE_SINGLE_IO_LIST); +} + +static u8 hiraid_delete_all_io_list(void) +{ + return hiraid_io_list_operation(0, 0, 0, TYPE_DELETE_ALL_IO_LIST); +} + +static void hiraid_wait_for_io_submit(struct hiraid_dev *hdev) +{ + struct spinlock_list_head_s *io_slist = NULL; + int i = 0; + int io_flush_finished; + + do { + io_flush_finished = 1; + for (i = 0; i < (MAX_PD_NUM * MAX_STREAM_NUM); i++) { + io_slist = hiraid_get_io_head(i); + if (!list_empty(&io_slist->list)) { + io_flush_finished = 0; + break; + } + } + usleep_range(MIN_WAIT_IO_SEND_TIME, MAX_WAIT_IO_SEND_TIME); + } while (!io_flush_finished); +} + +static u8 hiraid_add_io_to_list(struct hiraid_queue *submit_queue, + struct HIRAID_STREAM_S *tmp_stream, struct hiraid_scsi_io_cmd io_cmd, + unsigned int sector_size) +{ + struct spinlock_list_head_s *io_slist = NULL; + struct IO_LIST_S *new_io_node = NULL; + + new_io_node = kmalloc(sizeof(struct IO_LIST_S), GFP_KERNEL); + if (!new_io_node) + return 0; + new_io_node->io_cmd = io_cmd; + new_io_node->submit_queue = submit_queue; + new_io_node->sector_size = sector_size; + io_slist = hiraid_get_io_head(io_cmd.rw.hdid * + MAX_STREAM_NUM + tmp_stream->stream_id); + spin_lock(&io_slist->lock); + INIT_LIST_HEAD(&(new_io_node->list)); + list_add_tail(&(new_io_node->list), &io_slist->list); + spin_unlock(&io_slist->lock); + return 1; +} + +static void hiraid_submit_io_threading(struct hiraid_dev *hdev) +{ + int i = 1; + + while (!kthread_should_stop()) { + for (i = 1; i < MAX_PD_NUM; i++) + hiraid_submit_io_stream(i, hdev); + usleep_range(MIN_IO_SEND_TIME, MAX_IO_SEND_TIME); + } +} + +static void hiraid_destroy_io_stream_resource(struct hiraid_dev *hdev) +{ + u16 i; + + for (i = 0; i < (MAX_PD_NUM * MAX_STREAM_NUM); i++) + list_del_init(&hiraid_get_io_head(i)->list); +} + +struct task_struct *g_hiraid_submit_task; +static void hiraid_init_io_stream(struct hiraid_dev *hdev) +{ + hiraid_io_recognition_init(); + g_hiraid_submit_task = kthread_run((void *)hiraid_submit_io_threading, + hdev, "hiraid_submit_thread"); +} + #define HIRAID_RW_FUA BIT(14) #define RW_LENGTH_ZERO (67) @@ -871,6 +1289,30 @@ static int hiraid_setup_nonrw_cmd(struct hiraid_dev *hdev, return 0; } +static bool hiraid_disk_is_hdd(u8 attr) +{ + switch (HIRAID_DEV_DISK_TYPE(attr)) { + case HIRAID_SAS_HDD_VD: + case HIRAID_SATA_HDD_VD: + case HIRAID_SAS_HDD_PD: + case HIRAID_SATA_HDD_PD: + return true; + default: + return false; + } +} + +static bool hiraid_disk_is_hdd_rawdrive(u8 attr) +{ + switch (HIRAID_DEV_DISK_TYPE(attr)) { + case HIRAID_SAS_HDD_PD: + case HIRAID_SATA_HDD_PD: + return true; + default: + return false; + } +} + static int hiraid_setup_io_cmd(struct hiraid_dev *hdev, struct hiraid_scsi_io_cmd *io_cmd, struct scsi_cmnd *scmd, struct hiraid_mapmange *mapbuf) @@ -1025,6 +1467,7 @@ static int hiraid_queue_command(struct Scsi_Host *shost, struct scsi_cmnd *scmd) struct hiraid_sdev_hostdata *hostdata; struct hiraid_scsi_io_cmd io_cmd; struct hiraid_queue *ioq; + struct HIRAID_STREAM_S *tmp_stm = NULL; u16 hwq, cid; int ret; @@ -1092,6 +1535,23 @@ static int hiraid_queue_command(struct Scsi_Host *shost, struct scsi_cmnd *scmd) } WRITE_ONCE(mapbuf->state, CMD_FLIGHT); + + if (hiraid_is_rw_scmd(scmd) && + hiraid_disk_is_hdd_rawdrive(hostdata->attr)) { + if (hiraid_detect_if_aging()) + hiraid_aging(hdev); + tmp_stm = hiraid_stream_detect(hdev, &(io_cmd.rw)); + if (tmp_stm != NULL) { + hiraid_io_recognition_iterator(tmp_stm, 1); + if (hiraid_recognition_acknowledge(tmp_stm) && + (hiraid_get_stream_num(io_cmd.rw.hdid) > 1)) { + if (hiraid_add_io_to_list(ioq, + tmp_stm, io_cmd, sdev->sector_size)) { + return 0; + } + } + } + } hiraid_submit_cmd(ioq, &io_cmd); return 0; @@ -1141,19 +1601,6 @@ static int hiraid_disk_qd(u8 attr) } } -static bool hiraid_disk_is_hdd(u8 attr) -{ - switch (HIRAID_DEV_DISK_TYPE(attr)) { - case HIRAID_SAS_HDD_VD: - case HIRAID_SATA_HDD_VD: - case HIRAID_SAS_HDD_PD: - case HIRAID_SATA_HDD_PD: - return true; - default: - return false; - } -} - static int hiraid_slave_alloc(struct scsi_device *sdev) { struct hiraid_sdev_hostdata *hostdata; @@ -1305,6 +1752,7 @@ static int hiraid_alloc_queue(struct hiraid_dev *hdev, u16 qid, u16 depth) hiraidq->q_depth = depth; hiraidq->qid = qid; hiraidq->cq_vector = -1; + hiraidq->pci_irq = -1; hdev->queue_count++; return 0; @@ -1594,6 +2042,33 @@ static inline bool hiraid_process_cq(struct hiraid_queue *hiraidq, u16 *start, u return found; } +static inline bool hiraid_process_cq_for_thread(struct hiraid_queue *hiraidq, + u16 *start, u16 *end, + u8 *wakeup_thread_flag, int tag) +{ + bool found = false; + u16 max_io_num = hiraidq->q_depth / 4; + u16 io_count = 0; + *start = hiraidq->cq_head; + while (!found && hiraid_cqe_pending(hiraidq)) { + if (le16_to_cpu(hiraidq->cqes[hiraidq->cq_head].cmd_id) == tag) + found = true; + hiraid_update_cq_head(hiraidq); + + if (++io_count >= max_io_num) { + *wakeup_thread_flag = 1; + break; + } + } + *end = hiraidq->cq_head; + + if (*start != *end) + writel(hiraidq->cq_head, + hiraidq->q_db + hiraidq->hdev->db_stride); + + return found; +} + static bool hiraid_poll_cq(struct hiraid_queue *hiraidq, int cid) { u16 start, end; @@ -1631,6 +2106,55 @@ static irqreturn_t hiraid_handle_irq(int irq, void *data) return ret; } +static irqreturn_t hiraid_io_poll(int irq, void *data) +{ + struct hiraid_queue *hiraidq = data; + irqreturn_t ret = IRQ_NONE; + u16 start, end; + + do { + spin_lock(&hiraidq->cq_lock); + hiraid_process_cq(hiraidq, &start, &end, -1); + hiraidq->last_cq_head = hiraidq->cq_head; + spin_unlock(&hiraidq->cq_lock); + + if (start != end) { + hiraid_complete_cqes(hiraidq, start, end); + ret = IRQ_HANDLED; + } + usleep_range(poll_delay_min, poll_delay_max); + } while (start != end); + enable_irq(hiraidq->pci_irq); + return ret; +} + +static irqreturn_t hiraid_io_irq(int irq, void *data) +{ + struct hiraid_queue *hiraidq = data; + irqreturn_t ret = IRQ_NONE; + u16 start, end; + u8 wakeup_thread_flag = 0; + + spin_lock(&hiraidq->cq_lock); + if (hiraidq->cq_head != hiraidq->last_cq_head) + ret = IRQ_HANDLED; + + hiraid_process_cq_for_thread(hiraidq, &start, + &end, &wakeup_thread_flag, -1); + hiraidq->last_cq_head = hiraidq->cq_head; + spin_unlock(&hiraidq->cq_lock); + + if (start != end) { + hiraid_complete_cqes(hiraidq, start, end); + ret = IRQ_HANDLED; + } + if (wakeup_thread_flag) { + disable_irq_nosync(hiraidq->pci_irq); + ret = IRQ_WAKE_THREAD; + } + return ret; +} + static int hiraid_setup_admin_queue(struct hiraid_dev *hdev) { struct hiraid_queue *adminq = &hdev->queues[0]; @@ -1666,9 +2190,11 @@ static int hiraid_setup_admin_queue(struct hiraid_dev *hdev) adminq, "hiraid%d_q%d", hdev->instance, adminq->qid); if (ret) { adminq->cq_vector = -1; + adminq->pci_irq = -1; return ret; } + adminq->pci_irq = pci_irq_vector(hdev->pdev, adminq->cq_vector); hiraid_init_queue(adminq, 0); dev_info(hdev->dev, "setup admin queue success, queuecount[%d] online[%d] pagesize[%d]\n", @@ -1937,14 +2463,23 @@ static int hiraid_create_queue(struct hiraid_queue *hiraidq, u16 qid) goto delete_cq; hiraidq->cq_vector = cq_vector; - ret = pci_request_irq(hdev->pdev, cq_vector, hiraid_handle_irq, NULL, - hiraidq, "hiraid%d_q%d", hdev->instance, qid); + + if (threaded_irq) + ret = pci_request_irq(hdev->pdev, cq_vector, hiraid_io_irq, + hiraid_io_poll, hiraidq, "hiraid%d_q%d", + hdev->instance, qid); + else + ret = pci_request_irq(hdev->pdev, cq_vector, hiraid_handle_irq, + NULL, hiraidq, "hiraid%d_q%d", + hdev->instance, qid); if (ret) { hiraidq->cq_vector = -1; + hiraidq->pci_irq = -1; dev_err(hdev->dev, "request queue[%d] irq failed\n", qid); goto delete_sq; } + hiraidq->pci_irq = pci_irq_vector(hdev->pdev, hiraidq->cq_vector); hiraid_init_queue(hiraidq, qid); return 0; @@ -2094,10 +2629,12 @@ static int hiraid_setup_io_queues(struct hiraid_dev *hdev) adminq, "hiraid%d_q%d", hdev->instance, adminq->qid); if (ret) { dev_err(hdev->dev, "request admin irq failed\n"); + adminq->pci_irq = -1; adminq->cq_vector = -1; return ret; } + adminq->pci_irq = pci_irq_vector(hdev->pdev, adminq->cq_vector); hdev->online_queues++; for (i = hdev->queue_count; i <= hdev->max_qid; i++) { @@ -3232,6 +3769,12 @@ static int hiraid_abort(struct scsi_cmnd *scmd) cid = mapbuf->cid; hwq = mapbuf->hiraidq->qid; + if (hiraid_check_io_list(hostdata->hdid, cid, hwq)) { + dev_warn(hdev->dev, "find cid[%d] qid[%d] in host, abort succ\n", + cid, hwq); + return SUCCESS; + } + dev_warn(hdev->dev, "cid[%d] qid[%d] timeout, send abort\n", cid, hwq); ret = hiraid_send_abort_cmd(hdev, hostdata->hdid, hwq, cid); if (ret != -ETIME) { @@ -3263,6 +3806,7 @@ static int hiraid_scsi_reset(struct scsi_cmnd *scmd, enum hiraid_rst_type rst) ret = hiraid_send_reset_cmd(hdev, rst, hostdata->hdid); if ((ret == 0) || (ret == FW_EH_DEV_NONE && rst == HIRAID_RESET_TARGET)) { if (rst == HIRAID_RESET_TARGET) { + hiraid_delete_single_pd_io_list(hostdata->hdid); ret = wait_tgt_reset_io_done(scmd); if (ret) { dev_warn(hdev->dev, "sdev[%d:%d] target has %d peding cmd, target reset failed\n", @@ -3300,6 +3844,7 @@ static int hiraid_host_reset(struct scsi_cmnd *scmd) dev_warn(hdev->dev, "sdev[%d:%d] send host reset\n", scmd->device->channel, scmd->device->id); + hiraid_delete_all_io_list(); if (hiraid_reset_work_sync(hdev) == -EBUSY) flush_work(&hdev->reset_work); @@ -3333,6 +3878,7 @@ static pci_ers_result_t hiraid_pci_error_detected(struct pci_dev *pdev, scsi_block_requests(hdev->shost); hiraid_dev_state_trans(hdev, DEV_RESETTING); + hiraid_delete_all_io_list(); return PCI_ERS_RESULT_NEED_RESET; case pci_channel_io_perm_failure: @@ -3906,6 +4452,7 @@ static int hiraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto unregist_bsg; scsi_scan_host(hdev->shost); + hiraid_init_io_stream(hdev); return 0; @@ -3937,6 +4484,13 @@ static void hiraid_remove(struct pci_dev *pdev) dev_info(hdev->dev, "enter hiraid remove\n"); + if (pci_device_is_present(pdev)) + hiraid_wait_for_io_submit(hdev); + + kthread_stop(g_hiraid_submit_task); + hiraid_delete_all_io_list(); + hiraid_destroy_io_stream_resource(hdev); + hiraid_dev_state_trans(hdev, DEV_DELETING); flush_work(&hdev->reset_work); -- 2.45.1.windows.1

2 1

[PATCH OLK-6.6 00/11] HiSock Enhancement
by Pu Lehui 19 Jan '26

19 Jan '26

Liu Jian (1): cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted Pu Lehui (10): bpf: Only deploy hisock in server bpf: Add multi port parse to hisock_cmd bpf: Add target comm parse to hisock_cmd bpf: Add bpf_xdp_early_demux kfunc bpf: Add bpf_xdp_set_ingress_dev kfunc bpf: Add bpf_skb_set_egress_dev kfunc bpf: Deprecate some unused hisock kfuncs bpf: Some refactor for hisock bpf: Add ipv4-mapped ipv6 addr support for hisock bpf: Add local connect support for hisock include/linux/cgroup.h | 1 + kernel/bpf/cgroup.c | 8 +- kernel/cgroup/cgroup.c | 22 +++ net/Kconfig | 1 + net/core/dev.c | 5 +- net/core/filter.c | 83 +++------ samples/bpf/hisock/bpf.c | 315 ++++++++++++++++++++++++-------- samples/bpf/hisock/hisock_cmd.c | 211 ++++++++++++++++----- 8 files changed, 469 insertions(+), 177 deletions(-) -- 2.34.1

2 12

[PATCH openEuler-1.0-LTS] KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
by Zhang Kunbo 16 Jan '26

16 Jan '26

From: fuqiang wang <fuqiang.wng(a)gmail.com> commit 18ab3fc8e880791aa9f7c000261320fc812b5465 upstream. When advancing the target expiration for the guest's APIC timer in periodic mode, set the expiration to "now" if the target expiration is in the past (similar to what is done in update_target_expiration()). Blindly adding the period to the previous target expiration can result in KVM generating a practically unbounded number of hrtimer IRQs due to programming an expired timer over and over. In extreme scenarios, e.g. if userspace pauses/suspends a VM for an extended duration, this can even cause hard lockups in the host. Currently, the bug only affects Intel CPUs when using the hypervisor timer (HV timer), a.k.a. the VMX preemption timer. Unlike the software timer, a.k.a. hrtimer, which KVM keeps running even on exits to userspace, the HV timer only runs while the guest is active. As a result, if the vCPU does not run for an extended duration, there will be a huge gap between the target expiration and the current time the vCPU resumes running. Because the target expiration is incremented by only one period on each timer expiration, this leads to a series of timer expirations occurring rapidly after the vCPU/VM resumes. More critically, when the vCPU first triggers a periodic HV timer expiration after resuming, advancing the expiration by only one period will result in a target expiration in the past. As a result, the delta may be calculated as a negative value. When the delta is converted into an absolute value (tscdeadline is an unsigned u64), the resulting value can overflow what the HV timer is capable of programming. I.e. the large value will exceed the VMX Preemption Timer's maximum bit width of cpu_preemption_timer_multi + 32, and thus cause KVM to switch from the HV timer to the software timer (hrtimers). After switching to the software timer, periodic timer expiration callbacks may be executed consecutively within a single clock interrupt handler, because hrtimers honors KVM's request for an expiration in the past and immediately re-invokes KVM's callback after reprogramming. And because the interrupt handler runs with IRQs disabled, restarting KVM's hrtimer over and over until the target expiration is advanced to "now" can result in a hard lockup. E.g. the following hard lockup was triggered in the host when running a Windows VM (only relevant because it used the APIC timer in periodic mode) after resuming the VM from a long suspend (in the host). NMI watchdog: Watchdog detected hard LOCKUP on cpu 45 ... RIP: 0010:advance_periodic_target_expiration+0x4d/0x80 [kvm] ... RSP: 0018:ff4f88f5d98d8ef0 EFLAGS: 00000046 RAX: fff0103f91be678e RBX: fff0103f91be678e RCX: 00843a7d9e127bcc RDX: 0000000000000002 RSI: 0052ca4003697505 RDI: ff440d5bfbdbd500 RBP: ff440d5956f99200 R08: ff2ff2a42deb6a84 R09: 000000000002a6c0 R10: 0122d794016332b3 R11: 0000000000000000 R12: ff440db1af39cfc0 R13: ff440db1af39cfc0 R14: ffffffffc0d4a560 R15: ff440db1af39d0f8 FS: 00007f04a6ffd700(0000) GS:ff440db1af380000(0000) knlGS:000000e38a3b8000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000d5651feff8 CR3: 000000684e038002 CR4: 0000000000773ee0 PKRU: 55555554 Call Trace: <IRQ> apic_timer_fn+0x31/0x50 [kvm] __hrtimer_run_queues+0x100/0x280 hrtimer_interrupt+0x100/0x210 ? ttwu_do_wakeup+0x19/0x160 smp_apic_timer_interrupt+0x6a/0x130 apic_timer_interrupt+0xf/0x20 </IRQ> Moreover, if the suspend duration of the virtual machine is not long enough to trigger a hard lockup in this scenario, since commit 98c25ead5eda ("KVM: VMX: Move preemption timer <=> hrtimer dance to common x86"), KVM will continue using the software timer until the guest reprograms the APIC timer in some way. Since the periodic timer does not require frequent APIC timer register programming, the guest may continue to use the software timer in perpetuity. Fixes: d8f2f498d9ed ("x86/kvm: fix LAPIC timer drift when guest uses periodic mode") Cc: stable(a)vger.kernel.org Signed-off-by: fuqiang wang <fuqiang.wng(a)gmail.com> [sean: massage comments and changelog] Link: https://patch.msgid.link/20251113205114.1647493-4-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- arch/x86/kvm/lapic.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index 262e49301cae..6603b7decf4f 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -1600,15 +1600,33 @@ static void advance_periodic_target_expiration(struct kvm_lapic *apic) ktime_t delta; /* - * Synchronize both deadlines to the same time source or - * differences in the periods (caused by differences in the - * underlying clocks or numerical approximation errors) will - * cause the two to drift apart over time as the errors - * accumulate. + * Use kernel time as the time source for both the hrtimer deadline and + * TSC-based deadline so that they stay synchronized. Computing each + * deadline independently will cause the two deadlines to drift apart + * over time as differences in the periods accumulate, e.g. due to + * differences in the underlying clocks or numerical approximation errors. */ apic->lapic_timer.target_expiration = ktime_add_ns(apic->lapic_timer.target_expiration, apic->lapic_timer.period); + + /* + * If the new expiration is in the past, e.g. because userspace stopped + * running the VM for an extended duration, then force the expiration + * to "now" and don't try to play catch-up with the missed events. KVM + * will only deliver a single interrupt regardless of how many events + * are pending, i.e. restarting the timer with an expiration in the + * past will do nothing more than waste host cycles, and can even lead + * to a hard lockup in extreme cases. + */ + if (ktime_before(apic->lapic_timer.target_expiration, now)) + apic->lapic_timer.target_expiration = now; + + /* + * Note, ensuring the expiration isn't in the past also prevents delta + * from going negative, which could cause the TSC deadline to become + * excessively large due to it an unsigned value. + */ delta = ktime_sub(apic->lapic_timer.target_expiration, now); apic->lapic_timer.tscdeadline = kvm_read_l1_tsc(apic->vcpu, tscl) + nsec_to_cycles(apic->vcpu, delta); -- 2.34.1

2 1

[PATCH OLK-6.6] KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
by Zhang Kunbo 16 Jan '26

16 Jan '26

From: fuqiang wang <fuqiang.wng(a)gmail.com> stable inclusion from stable-v6.6.120 commit 7b54ccef865e0aa62e4871d4ada2ba4b9dcb8bed category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13419 CVE: CVE-2025-71104 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 18ab3fc8e880791aa9f7c000261320fc812b5465 upstream. When advancing the target expiration for the guest's APIC timer in periodic mode, set the expiration to "now" if the target expiration is in the past (similar to what is done in update_target_expiration()). Blindly adding the period to the previous target expiration can result in KVM generating a practically unbounded number of hrtimer IRQs due to programming an expired timer over and over. In extreme scenarios, e.g. if userspace pauses/suspends a VM for an extended duration, this can even cause hard lockups in the host. Currently, the bug only affects Intel CPUs when using the hypervisor timer (HV timer), a.k.a. the VMX preemption timer. Unlike the software timer, a.k.a. hrtimer, which KVM keeps running even on exits to userspace, the HV timer only runs while the guest is active. As a result, if the vCPU does not run for an extended duration, there will be a huge gap between the target expiration and the current time the vCPU resumes running. Because the target expiration is incremented by only one period on each timer expiration, this leads to a series of timer expirations occurring rapidly after the vCPU/VM resumes. More critically, when the vCPU first triggers a periodic HV timer expiration after resuming, advancing the expiration by only one period will result in a target expiration in the past. As a result, the delta may be calculated as a negative value. When the delta is converted into an absolute value (tscdeadline is an unsigned u64), the resulting value can overflow what the HV timer is capable of programming. I.e. the large value will exceed the VMX Preemption Timer's maximum bit width of cpu_preemption_timer_multi + 32, and thus cause KVM to switch from the HV timer to the software timer (hrtimers). After switching to the software timer, periodic timer expiration callbacks may be executed consecutively within a single clock interrupt handler, because hrtimers honors KVM's request for an expiration in the past and immediately re-invokes KVM's callback after reprogramming. And because the interrupt handler runs with IRQs disabled, restarting KVM's hrtimer over and over until the target expiration is advanced to "now" can result in a hard lockup. E.g. the following hard lockup was triggered in the host when running a Windows VM (only relevant because it used the APIC timer in periodic mode) after resuming the VM from a long suspend (in the host). NMI watchdog: Watchdog detected hard LOCKUP on cpu 45 ... RIP: 0010:advance_periodic_target_expiration+0x4d/0x80 [kvm] ... RSP: 0018:ff4f88f5d98d8ef0 EFLAGS: 00000046 RAX: fff0103f91be678e RBX: fff0103f91be678e RCX: 00843a7d9e127bcc RDX: 0000000000000002 RSI: 0052ca4003697505 RDI: ff440d5bfbdbd500 RBP: ff440d5956f99200 R08: ff2ff2a42deb6a84 R09: 000000000002a6c0 R10: 0122d794016332b3 R11: 0000000000000000 R12: ff440db1af39cfc0 R13: ff440db1af39cfc0 R14: ffffffffc0d4a560 R15: ff440db1af39d0f8 FS: 00007f04a6ffd700(0000) GS:ff440db1af380000(0000) knlGS:000000e38a3b8000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000d5651feff8 CR3: 000000684e038002 CR4: 0000000000773ee0 PKRU: 55555554 Call Trace: <IRQ> apic_timer_fn+0x31/0x50 [kvm] __hrtimer_run_queues+0x100/0x280 hrtimer_interrupt+0x100/0x210 ? ttwu_do_wakeup+0x19/0x160 smp_apic_timer_interrupt+0x6a/0x130 apic_timer_interrupt+0xf/0x20 </IRQ> Moreover, if the suspend duration of the virtual machine is not long enough to trigger a hard lockup in this scenario, since commit 98c25ead5eda ("KVM: VMX: Move preemption timer <=> hrtimer dance to common x86"), KVM will continue using the software timer until the guest reprograms the APIC timer in some way. Since the periodic timer does not require frequent APIC timer register programming, the guest may continue to use the software timer in perpetuity. Fixes: d8f2f498d9ed ("x86/kvm: fix LAPIC timer drift when guest uses periodic mode") Cc: stable(a)vger.kernel.org Signed-off-by: fuqiang wang <fuqiang.wng(a)gmail.com> [sean: massage comments and changelog] Link: https://patch.msgid.link/20251113205114.1647493-4-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/lapic.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index c67610ae5e0b..9f611dc081b5 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -2047,15 +2047,33 @@ static void advance_periodic_target_expiration(struct kvm_lapic *apic) ktime_t delta; /* - * Synchronize both deadlines to the same time source or - * differences in the periods (caused by differences in the - * underlying clocks or numerical approximation errors) will - * cause the two to drift apart over time as the errors - * accumulate. + * Use kernel time as the time source for both the hrtimer deadline and + * TSC-based deadline so that they stay synchronized. Computing each + * deadline independently will cause the two deadlines to drift apart + * over time as differences in the periods accumulate, e.g. due to + * differences in the underlying clocks or numerical approximation errors. */ apic->lapic_timer.target_expiration = ktime_add_ns(apic->lapic_timer.target_expiration, apic->lapic_timer.period); + + /* + * If the new expiration is in the past, e.g. because userspace stopped + * running the VM for an extended duration, then force the expiration + * to "now" and don't try to play catch-up with the missed events. KVM + * will only deliver a single interrupt regardless of how many events + * are pending, i.e. restarting the timer with an expiration in the + * past will do nothing more than waste host cycles, and can even lead + * to a hard lockup in extreme cases. + */ + if (ktime_before(apic->lapic_timer.target_expiration, now)) + apic->lapic_timer.target_expiration = now; + + /* + * Note, ensuring the expiration isn't in the past also prevents delta + * from going negative, which could cause the TSC deadline to become + * excessively large due to it an unsigned value. + */ delta = ktime_sub(apic->lapic_timer.target_expiration, now); apic->lapic_timer.tscdeadline = kvm_read_l1_tsc(apic->vcpu, tscl) + nsec_to_cycles(apic->vcpu, delta); -- 2.34.1

2 1

[PATCH OLK-5.10] KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
by Zhang Kunbo 16 Jan '26

16 Jan '26

From: fuqiang wang <fuqiang.wng(a)gmail.com> stable inclusion from stable-v6.6.120 commit 7b54ccef865e0aa62e4871d4ada2ba4b9dcb8bed category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13419 CVE: CVE-2025-71104 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 18ab3fc8e880791aa9f7c000261320fc812b5465 upstream. When advancing the target expiration for the guest's APIC timer in periodic mode, set the expiration to "now" if the target expiration is in the past (similar to what is done in update_target_expiration()). Blindly adding the period to the previous target expiration can result in KVM generating a practically unbounded number of hrtimer IRQs due to programming an expired timer over and over. In extreme scenarios, e.g. if userspace pauses/suspends a VM for an extended duration, this can even cause hard lockups in the host. Currently, the bug only affects Intel CPUs when using the hypervisor timer (HV timer), a.k.a. the VMX preemption timer. Unlike the software timer, a.k.a. hrtimer, which KVM keeps running even on exits to userspace, the HV timer only runs while the guest is active. As a result, if the vCPU does not run for an extended duration, there will be a huge gap between the target expiration and the current time the vCPU resumes running. Because the target expiration is incremented by only one period on each timer expiration, this leads to a series of timer expirations occurring rapidly after the vCPU/VM resumes. More critically, when the vCPU first triggers a periodic HV timer expiration after resuming, advancing the expiration by only one period will result in a target expiration in the past. As a result, the delta may be calculated as a negative value. When the delta is converted into an absolute value (tscdeadline is an unsigned u64), the resulting value can overflow what the HV timer is capable of programming. I.e. the large value will exceed the VMX Preemption Timer's maximum bit width of cpu_preemption_timer_multi + 32, and thus cause KVM to switch from the HV timer to the software timer (hrtimers). After switching to the software timer, periodic timer expiration callbacks may be executed consecutively within a single clock interrupt handler, because hrtimers honors KVM's request for an expiration in the past and immediately re-invokes KVM's callback after reprogramming. And because the interrupt handler runs with IRQs disabled, restarting KVM's hrtimer over and over until the target expiration is advanced to "now" can result in a hard lockup. E.g. the following hard lockup was triggered in the host when running a Windows VM (only relevant because it used the APIC timer in periodic mode) after resuming the VM from a long suspend (in the host). NMI watchdog: Watchdog detected hard LOCKUP on cpu 45 ... RIP: 0010:advance_periodic_target_expiration+0x4d/0x80 [kvm] ... RSP: 0018:ff4f88f5d98d8ef0 EFLAGS: 00000046 RAX: fff0103f91be678e RBX: fff0103f91be678e RCX: 00843a7d9e127bcc RDX: 0000000000000002 RSI: 0052ca4003697505 RDI: ff440d5bfbdbd500 RBP: ff440d5956f99200 R08: ff2ff2a42deb6a84 R09: 000000000002a6c0 R10: 0122d794016332b3 R11: 0000000000000000 R12: ff440db1af39cfc0 R13: ff440db1af39cfc0 R14: ffffffffc0d4a560 R15: ff440db1af39d0f8 FS: 00007f04a6ffd700(0000) GS:ff440db1af380000(0000) knlGS:000000e38a3b8000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000d5651feff8 CR3: 000000684e038002 CR4: 0000000000773ee0 PKRU: 55555554 Call Trace: <IRQ> apic_timer_fn+0x31/0x50 [kvm] __hrtimer_run_queues+0x100/0x280 hrtimer_interrupt+0x100/0x210 ? ttwu_do_wakeup+0x19/0x160 smp_apic_timer_interrupt+0x6a/0x130 apic_timer_interrupt+0xf/0x20 </IRQ> Moreover, if the suspend duration of the virtual machine is not long enough to trigger a hard lockup in this scenario, since commit 98c25ead5eda ("KVM: VMX: Move preemption timer <=> hrtimer dance to common x86"), KVM will continue using the software timer until the guest reprograms the APIC timer in some way. Since the periodic timer does not require frequent APIC timer register programming, the guest may continue to use the software timer in perpetuity. Fixes: d8f2f498d9ed ("x86/kvm: fix LAPIC timer drift when guest uses periodic mode") Cc: stable(a)vger.kernel.org Signed-off-by: fuqiang wang <fuqiang.wng(a)gmail.com> [sean: massage comments and changelog] Link: https://patch.msgid.link/20251113205114.1647493-4-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/lapic.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index d6272f97368f..4386fd13c12b 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -1793,15 +1793,33 @@ static void advance_periodic_target_expiration(struct kvm_lapic *apic) ktime_t delta; /* - * Synchronize both deadlines to the same time source or - * differences in the periods (caused by differences in the - * underlying clocks or numerical approximation errors) will - * cause the two to drift apart over time as the errors - * accumulate. + * Use kernel time as the time source for both the hrtimer deadline and + * TSC-based deadline so that they stay synchronized. Computing each + * deadline independently will cause the two deadlines to drift apart + * over time as differences in the periods accumulate, e.g. due to + * differences in the underlying clocks or numerical approximation errors. */ apic->lapic_timer.target_expiration = ktime_add_ns(apic->lapic_timer.target_expiration, apic->lapic_timer.period); + + /* + * If the new expiration is in the past, e.g. because userspace stopped + * running the VM for an extended duration, then force the expiration + * to "now" and don't try to play catch-up with the missed events. KVM + * will only deliver a single interrupt regardless of how many events + * are pending, i.e. restarting the timer with an expiration in the + * past will do nothing more than waste host cycles, and can even lead + * to a hard lockup in extreme cases. + */ + if (ktime_before(apic->lapic_timer.target_expiration, now)) + apic->lapic_timer.target_expiration = now; + + /* + * Note, ensuring the expiration isn't in the past also prevents delta + * from going negative, which could cause the TSC deadline to become + * excessively large due to it an unsigned value. + */ delta = ktime_sub(apic->lapic_timer.target_expiration, now); apic->lapic_timer.tscdeadline = kvm_read_l1_tsc(apic->vcpu, tscl) + nsec_to_cycles(apic->vcpu, delta); -- 2.34.1

2 1