- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] Revert "efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs"
by Xinyu Zheng 08 May '26

08 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8677 -------------------------------- This reverts commit b9c7bcaf7b0531bade10dfed2a453e0b40e62d20. This patch follow the latest UEFI/2.10 2.9A data structure specs description. In downstream CI environment, their Bios version just follow UEFI 2.8 verison, which has error type parse conflict. Since now all released BIOS version still following UEFI 2.8, revert this LTS patch to keep consistency. Fixes: b9c7bcaf7b05 ("efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs") Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/acpi/apei/ghes.c | 16 ++++------- drivers/firmware/efi/cper-arm.c | 50 +++++++++++++++++---------------- include/linux/cper.h | 10 +++---- 3 files changed, 37 insertions(+), 39 deletions(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index 4c3dee093745..34ab844bd013 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -22,7 +22,6 @@ #include <linux/moduleparam.h> #include <linux/init.h> #include <linux/acpi.h> -#include <linux/bitfield.h> #include <linux/io.h> #include <linux/interrupt.h> #include <linux/timer.h> @@ -608,7 +607,6 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, { struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); int flags = sync ? MF_ACTION_REQUIRED : 0; - char error_type[120]; bool queued = false; int sec_sev, i; bool critical; @@ -627,8 +625,9 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, critical = ghes_armp_vendor_critical_error(err, sync); for (i = 0; i < err->err_info_num; i++) { struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; - bool is_cache = err_info->type & CPER_ARM_CACHE_ERROR; + bool is_cache = (err_info->type == CPER_ARM_CACHE_ERROR); bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); + const char *error_type = "unknown error"; /* * The field (err_info->error_info & BIT(26)) is fixed to set to @@ -642,15 +641,12 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, continue; } - cper_bits_to_str(error_type, sizeof(error_type), - FIELD_GET(CPER_ARM_ERR_TYPE_MASK, err_info->type), - cper_proc_error_type_strs, - ARRAY_SIZE(cper_proc_error_type_strs)); + if (err_info->type < ARRAY_SIZE(cper_proc_error_type_strs)) + error_type = cper_proc_error_type_strs[err_info->type]; pr_warn_ratelimited(FW_WARN GHES_PFX - "Unhandled processor error type 0x%02x: %s%s\n", - err_info->type, error_type, - (err_info->type & ~CPER_ARM_ERR_TYPE_MASK) ? " with reserved bit(s)" : ""); + "Unhandled processor error type: %s\n", + error_type); p += err_info->length; } diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c index 52d18490b59e..eb7ee6af55f2 100644 --- a/drivers/firmware/efi/cper-arm.c +++ b/drivers/firmware/efi/cper-arm.c @@ -93,11 +93,15 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, bool proc_context_corrupt, corrected, precise_pc, restartable_pc; bool time_out, access_mode; + /* If the type is unknown, bail. */ + if (type > CPER_ARM_MAX_TYPE) + return; + /* * Vendor type errors have error information values that are vendor * specific. */ - if (type & CPER_ARM_VENDOR_ERROR) + if (type == CPER_ARM_VENDOR_ERROR) return; if (error_info & CPER_ARM_ERR_VALID_TRANSACTION_TYPE) { @@ -112,38 +116,43 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, if (error_info & CPER_ARM_ERR_VALID_OPERATION_TYPE) { op_type = ((error_info >> CPER_ARM_ERR_OPERATION_SHIFT) & CPER_ARM_ERR_OPERATION_MASK); - if (type & CPER_ARM_CACHE_ERROR) { + switch (type) { + case CPER_ARM_CACHE_ERROR: if (op_type < ARRAY_SIZE(arm_cache_err_op_strs)) { - printk("%scache error, operation type: %s\n", pfx, + printk("%soperation type: %s\n", pfx, arm_cache_err_op_strs[op_type]); } - } - if (type & CPER_ARM_TLB_ERROR) { + break; + case CPER_ARM_TLB_ERROR: if (op_type < ARRAY_SIZE(arm_tlb_err_op_strs)) { - printk("%sTLB error, operation type: %s\n", pfx, + printk("%soperation type: %s\n", pfx, arm_tlb_err_op_strs[op_type]); } - } - if (type & CPER_ARM_BUS_ERROR) { + break; + case CPER_ARM_BUS_ERROR: if (op_type < ARRAY_SIZE(arm_bus_err_op_strs)) { - printk("%sbus error, operation type: %s\n", pfx, + printk("%soperation type: %s\n", pfx, arm_bus_err_op_strs[op_type]); } + break; } } if (error_info & CPER_ARM_ERR_VALID_LEVEL) { level = ((error_info >> CPER_ARM_ERR_LEVEL_SHIFT) & CPER_ARM_ERR_LEVEL_MASK); - if (type & CPER_ARM_CACHE_ERROR) + switch (type) { + case CPER_ARM_CACHE_ERROR: printk("%scache level: %d\n", pfx, level); - - if (type & CPER_ARM_TLB_ERROR) + break; + case CPER_ARM_TLB_ERROR: printk("%sTLB level: %d\n", pfx, level); - - if (type & CPER_ARM_BUS_ERROR) + break; + case CPER_ARM_BUS_ERROR: printk("%saffinity level at which the bus error occurred: %d\n", pfx, level); + break; + } } if (error_info & CPER_ARM_ERR_VALID_PROC_CONTEXT_CORRUPT) { @@ -232,7 +241,6 @@ void cper_print_proc_arm(const char *pfx, struct cper_arm_err_info *err_info; struct cper_arm_ctx_info *ctx_info; char newpfx[64], infopfx[ARRAY_SIZE(newpfx) + 1]; - char error_type[120]; printk("%sMIDR: 0x%016llx\n", pfx, proc->midr); @@ -281,15 +289,9 @@ void cper_print_proc_arm(const char *pfx, newpfx); } - cper_bits_to_str(error_type, sizeof(error_type), - FIELD_GET(CPER_ARM_ERR_TYPE_MASK, err_info->type), - cper_proc_error_type_strs, - ARRAY_SIZE(cper_proc_error_type_strs)); - - printk("%serror_type: 0x%02x: %s%s\n", newpfx, err_info->type, - error_type, - (err_info->type & ~CPER_ARM_ERR_TYPE_MASK) ? " with reserved bit(s)" : ""); - + printk("%serror_type: %d, %s\n", newpfx, err_info->type, + err_info->type < ARRAY_SIZE(cper_proc_error_type_strs) ? + cper_proc_error_type_strs[err_info->type] : "unknown"); if (err_info->validation_bits & CPER_ARM_INFO_VALID_ERR_INFO) { printk("%serror_info: 0x%016llx\n", newpfx, err_info->error_info); diff --git a/include/linux/cper.h b/include/linux/cper.h index eb5c54814e76..e94724818bc2 100644 --- a/include/linux/cper.h +++ b/include/linux/cper.h @@ -274,11 +274,11 @@ enum { #define CPER_ARM_INFO_FLAGS_PROPAGATED BIT(2) #define CPER_ARM_INFO_FLAGS_OVERFLOW BIT(3) -#define CPER_ARM_ERR_TYPE_MASK GENMASK(4,1) -#define CPER_ARM_CACHE_ERROR BIT(1) -#define CPER_ARM_TLB_ERROR BIT(2) -#define CPER_ARM_BUS_ERROR BIT(3) -#define CPER_ARM_VENDOR_ERROR BIT(4) +#define CPER_ARM_CACHE_ERROR 0 +#define CPER_ARM_TLB_ERROR 1 +#define CPER_ARM_BUS_ERROR 2 +#define CPER_ARM_VENDOR_ERROR 3 +#define CPER_ARM_MAX_TYPE CPER_ARM_VENDOR_ERROR #define CPER_ARM_ERR_VALID_TRANSACTION_TYPE BIT(0) #define CPER_ARM_ERR_VALID_OPERATION_TYPE BIT(1) -- 2.34.1

2 1

[PATCH OLK-6.6] Revert "efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs"
by Xinyu Zheng 08 May '26

08 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8677 -------------------------------- This reverts commit b9c7bcaf7b0531bade10dfed2a453e0b40e62d20. This patch follow the latest UEFI/2.10 2.9A data structure specs description. In downstream CI environment, their Bios version just follow UEFI 2.8 verison, which has error type parse conflict. Since now all released BIOS version still following UEFI 2.8, revert this LTS patch to keep consistency. Fixes: b9c7bcaf7b05 ("[Backport] efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs") Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/acpi/apei/ghes.c | 16 ++++------- drivers/firmware/efi/cper-arm.c | 50 +++++++++++++++++---------------- include/linux/cper.h | 10 +++---- 3 files changed, 37 insertions(+), 39 deletions(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index 4c3dee093745..34ab844bd013 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -22,7 +22,6 @@ #include <linux/moduleparam.h> #include <linux/init.h> #include <linux/acpi.h> -#include <linux/bitfield.h> #include <linux/io.h> #include <linux/interrupt.h> #include <linux/timer.h> @@ -608,7 +607,6 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, { struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); int flags = sync ? MF_ACTION_REQUIRED : 0; - char error_type[120]; bool queued = false; int sec_sev, i; bool critical; @@ -627,8 +625,9 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, critical = ghes_armp_vendor_critical_error(err, sync); for (i = 0; i < err->err_info_num; i++) { struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; - bool is_cache = err_info->type & CPER_ARM_CACHE_ERROR; + bool is_cache = (err_info->type == CPER_ARM_CACHE_ERROR); bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); + const char *error_type = "unknown error"; /* * The field (err_info->error_info & BIT(26)) is fixed to set to @@ -642,15 +641,12 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, continue; } - cper_bits_to_str(error_type, sizeof(error_type), - FIELD_GET(CPER_ARM_ERR_TYPE_MASK, err_info->type), - cper_proc_error_type_strs, - ARRAY_SIZE(cper_proc_error_type_strs)); + if (err_info->type < ARRAY_SIZE(cper_proc_error_type_strs)) + error_type = cper_proc_error_type_strs[err_info->type]; pr_warn_ratelimited(FW_WARN GHES_PFX - "Unhandled processor error type 0x%02x: %s%s\n", - err_info->type, error_type, - (err_info->type & ~CPER_ARM_ERR_TYPE_MASK) ? " with reserved bit(s)" : ""); + "Unhandled processor error type: %s\n", + error_type); p += err_info->length; } diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c index 52d18490b59e..eb7ee6af55f2 100644 --- a/drivers/firmware/efi/cper-arm.c +++ b/drivers/firmware/efi/cper-arm.c @@ -93,11 +93,15 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, bool proc_context_corrupt, corrected, precise_pc, restartable_pc; bool time_out, access_mode; + /* If the type is unknown, bail. */ + if (type > CPER_ARM_MAX_TYPE) + return; + /* * Vendor type errors have error information values that are vendor * specific. */ - if (type & CPER_ARM_VENDOR_ERROR) + if (type == CPER_ARM_VENDOR_ERROR) return; if (error_info & CPER_ARM_ERR_VALID_TRANSACTION_TYPE) { @@ -112,38 +116,43 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, if (error_info & CPER_ARM_ERR_VALID_OPERATION_TYPE) { op_type = ((error_info >> CPER_ARM_ERR_OPERATION_SHIFT) & CPER_ARM_ERR_OPERATION_MASK); - if (type & CPER_ARM_CACHE_ERROR) { + switch (type) { + case CPER_ARM_CACHE_ERROR: if (op_type < ARRAY_SIZE(arm_cache_err_op_strs)) { - printk("%scache error, operation type: %s\n", pfx, + printk("%soperation type: %s\n", pfx, arm_cache_err_op_strs[op_type]); } - } - if (type & CPER_ARM_TLB_ERROR) { + break; + case CPER_ARM_TLB_ERROR: if (op_type < ARRAY_SIZE(arm_tlb_err_op_strs)) { - printk("%sTLB error, operation type: %s\n", pfx, + printk("%soperation type: %s\n", pfx, arm_tlb_err_op_strs[op_type]); } - } - if (type & CPER_ARM_BUS_ERROR) { + break; + case CPER_ARM_BUS_ERROR: if (op_type < ARRAY_SIZE(arm_bus_err_op_strs)) { - printk("%sbus error, operation type: %s\n", pfx, + printk("%soperation type: %s\n", pfx, arm_bus_err_op_strs[op_type]); } + break; } } if (error_info & CPER_ARM_ERR_VALID_LEVEL) { level = ((error_info >> CPER_ARM_ERR_LEVEL_SHIFT) & CPER_ARM_ERR_LEVEL_MASK); - if (type & CPER_ARM_CACHE_ERROR) + switch (type) { + case CPER_ARM_CACHE_ERROR: printk("%scache level: %d\n", pfx, level); - - if (type & CPER_ARM_TLB_ERROR) + break; + case CPER_ARM_TLB_ERROR: printk("%sTLB level: %d\n", pfx, level); - - if (type & CPER_ARM_BUS_ERROR) + break; + case CPER_ARM_BUS_ERROR: printk("%saffinity level at which the bus error occurred: %d\n", pfx, level); + break; + } } if (error_info & CPER_ARM_ERR_VALID_PROC_CONTEXT_CORRUPT) { @@ -232,7 +241,6 @@ void cper_print_proc_arm(const char *pfx, struct cper_arm_err_info *err_info; struct cper_arm_ctx_info *ctx_info; char newpfx[64], infopfx[ARRAY_SIZE(newpfx) + 1]; - char error_type[120]; printk("%sMIDR: 0x%016llx\n", pfx, proc->midr); @@ -281,15 +289,9 @@ void cper_print_proc_arm(const char *pfx, newpfx); } - cper_bits_to_str(error_type, sizeof(error_type), - FIELD_GET(CPER_ARM_ERR_TYPE_MASK, err_info->type), - cper_proc_error_type_strs, - ARRAY_SIZE(cper_proc_error_type_strs)); - - printk("%serror_type: 0x%02x: %s%s\n", newpfx, err_info->type, - error_type, - (err_info->type & ~CPER_ARM_ERR_TYPE_MASK) ? " with reserved bit(s)" : ""); - + printk("%serror_type: %d, %s\n", newpfx, err_info->type, + err_info->type < ARRAY_SIZE(cper_proc_error_type_strs) ? + cper_proc_error_type_strs[err_info->type] : "unknown"); if (err_info->validation_bits & CPER_ARM_INFO_VALID_ERR_INFO) { printk("%serror_info: 0x%016llx\n", newpfx, err_info->error_info); diff --git a/include/linux/cper.h b/include/linux/cper.h index eb5c54814e76..e94724818bc2 100644 --- a/include/linux/cper.h +++ b/include/linux/cper.h @@ -274,11 +274,11 @@ enum { #define CPER_ARM_INFO_FLAGS_PROPAGATED BIT(2) #define CPER_ARM_INFO_FLAGS_OVERFLOW BIT(3) -#define CPER_ARM_ERR_TYPE_MASK GENMASK(4,1) -#define CPER_ARM_CACHE_ERROR BIT(1) -#define CPER_ARM_TLB_ERROR BIT(2) -#define CPER_ARM_BUS_ERROR BIT(3) -#define CPER_ARM_VENDOR_ERROR BIT(4) +#define CPER_ARM_CACHE_ERROR 0 +#define CPER_ARM_TLB_ERROR 1 +#define CPER_ARM_BUS_ERROR 2 +#define CPER_ARM_VENDOR_ERROR 3 +#define CPER_ARM_MAX_TYPE CPER_ARM_VENDOR_ERROR #define CPER_ARM_ERR_VALID_TRANSACTION_TYPE BIT(0) #define CPER_ARM_ERR_VALID_OPERATION_TYPE BIT(1) -- 2.34.1

2 1

[openEuler-1.0-LTS] pstore: ram_core: fix incorrect success return when vmap() fails
by Luo Gengkun 08 May '26

08 May '26

From: Ruipeng Qi <ruipengqi3(a)gmail.com> stable inclusion from stable-v5.10.252 commit d47234840aeb4182ed3ee795c578b1dfa9cbd25b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14671 CVE: CVE-2026-43124 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ] In persistent_ram_vmap(), vmap() may return NULL on failure. If offset is non-zero, adding offset_in_page(start) causes the function to return a non-NULL pointer even though the mapping failed. persistent_ram_buffer_map() therefore incorrectly returns success. Subsequent access to prz->buffer may dereference an invalid address and cause crashes. Add proper NULL checking for vmap() failures. Signed-off-by: Ruipeng Qi <ruipengqi3(a)gmail.com> Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com Signed-off-by: Kees Cook <kees(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- fs/pstore/ram_core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index 588392e6f531..749a9fa36b62 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -433,6 +433,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot); kfree(pages); + /* + * vmap() may fail and return NULL. Do not add the offset in this + * case, otherwise a NULL mapping would appear successful. + */ + if (!vaddr) + return NULL; + /* * Since vmap() uses page granularity, we must add the offset * into the page here, to get the byte granularity address -- 2.34.1

1 0

[PATCH OLK-6.6 0/2] Fix CVE-2026-31729
by Hongbo Li 08 May '26

08 May '26

Fix CVE-2026-31729. Nathan Rebello (2): usb: typec: ucsi: validate connector number in ucsi_notify_common() usb: typec: ucsi: skip connector validation before init drivers/usb/typec/ucsi/ucsi.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6] atm: lec: fix use-after-free in sock_def_readable()
by Yi Yang 08 May '26

08 May '26

From: Deepanshu Kartikey <kartikey406(a)gmail.com> stable inclusion from stable-v6.6.134 commit b256d055da47258e63f8b40965f276c5f23d229a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14582 CVE: CVE-2026-43050 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 922814879542c2e397b0e9641fd36b8202a8e555 ] A race condition exists between lec_atm_close() setting priv->lecd to NULL and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(), and lec_atm_send(). When the socket is freed via RCU while another thread is still using it, a use-after-free occurs in sock_def_readable() when accessing the socket's wait queue. The root cause is that lec_atm_close() clears priv->lecd without any synchronization, while callers dereference priv->lecd without any protection against concurrent teardown. Fix this by converting priv->lecd to an RCU-protected pointer: - Mark priv->lecd as __rcu in lec.h - Use rcu_assign_pointer() in lec_atm_close() and lecd_attach() for safe pointer assignment - Use rcu_access_pointer() for NULL checks that do not dereference the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and lecd_attach() - Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(), lec_handle_bridge() and lec_atm_send() to safely access lecd - Use rcu_assign_pointer() followed by synchronize_rcu() in lec_atm_close() to ensure all readers have completed before proceeding. This is safe since lec_atm_close() is called from vcc_release() which holds lock_sock(), a sleeping lock. - Remove the manual sk_receive_queue drain from lec_atm_close() since vcc_destroy_socket() already drains it after lec_atm_close() returns. v2: Switch from spinlock + sock_hold/put approach to RCU to properly fix the race. The v1 spinlock approach had two issues pointed out by Eric Dumazet: 1. priv->lecd was still accessed directly after releasing the lock instead of using a local copy. 2. The spinlock did not prevent packets being queued after lec_atm_close() drains sk_receive_queue since timer and workqueue paths bypass netif_stop_queue(). Note: Syzbot patch testing was attempted but the test VM terminated unexpectedly with "Connection to localhost closed by remote host", likely due to a QEMU AHCI emulation issue unrelated to this fix. Compile testing with "make W=1 net/atm/lec.o" passes cleanly. Reported-by: syzbot+f50072212ab792c86925(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925 Link: https://lore.kernel.org/all/20260309093614.502094-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey <kartikey406(a)gmail.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260309155908.508768-1-kartikey406@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- net/atm/lec.c | 72 +++++++++++++++++++++++++++++++++------------------ net/atm/lec.h | 2 +- 2 files changed, 48 insertions(+), 26 deletions(-) diff --git a/net/atm/lec.c b/net/atm/lec.c index b7fa48a9b720..e14b7ca8b17e 100644 --- a/net/atm/lec.c +++ b/net/atm/lec.c @@ -154,10 +154,19 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev) /* 0x01 is topology change */ priv = netdev_priv(dev); - atm_force_charge(priv->lecd, skb2->truesize); - sk = sk_atm(priv->lecd); - skb_queue_tail(&sk->sk_receive_queue, skb2); - sk->sk_data_ready(sk); + struct atm_vcc *vcc; + + rcu_read_lock(); + vcc = rcu_dereference(priv->lecd); + if (vcc) { + atm_force_charge(vcc, skb2->truesize); + sk = sk_atm(vcc); + skb_queue_tail(&sk->sk_receive_queue, skb2); + sk->sk_data_ready(sk); + } else { + dev_kfree_skb(skb2); + } + rcu_read_unlock(); } } #endif /* IS_ENABLED(CONFIG_BRIDGE) */ @@ -216,7 +225,7 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb, int is_rdesc; pr_debug("called\n"); - if (!priv->lecd) { + if (!rcu_access_pointer(priv->lecd)) { pr_info("%s:No lecd attached\n", dev->name); dev->stats.tx_errors++; netif_stop_queue(dev); @@ -449,10 +458,19 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb) break; skb2->len = sizeof(struct atmlec_msg); skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg)); - atm_force_charge(priv->lecd, skb2->truesize); - sk = sk_atm(priv->lecd); - skb_queue_tail(&sk->sk_receive_queue, skb2); - sk->sk_data_ready(sk); + struct atm_vcc *vcc; + + rcu_read_lock(); + vcc = rcu_dereference(priv->lecd); + if (vcc) { + atm_force_charge(vcc, skb2->truesize); + sk = sk_atm(vcc); + skb_queue_tail(&sk->sk_receive_queue, skb2); + sk->sk_data_ready(sk); + } else { + dev_kfree_skb(skb2); + } + rcu_read_unlock(); } } #endif /* IS_ENABLED(CONFIG_BRIDGE) */ @@ -468,23 +486,16 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb) static void lec_atm_close(struct atm_vcc *vcc) { - struct sk_buff *skb; struct net_device *dev = (struct net_device *)vcc->proto_data; struct lec_priv *priv = netdev_priv(dev); - priv->lecd = NULL; + rcu_assign_pointer(priv->lecd, NULL); + synchronize_rcu(); /* Do something needful? */ netif_stop_queue(dev); lec_arp_destroy(priv); - if (skb_peek(&sk_atm(vcc)->sk_receive_queue)) - pr_info("%s closing with messages pending\n", dev->name); - while ((skb = skb_dequeue(&sk_atm(vcc)->sk_receive_queue))) { - atm_return(vcc, skb->truesize); - dev_kfree_skb(skb); - } - pr_info("%s: Shut down!\n", dev->name); module_put(THIS_MODULE); } @@ -510,12 +521,14 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type, const unsigned char *mac_addr, const unsigned char *atm_addr, struct sk_buff *data) { + struct atm_vcc *vcc; struct sock *sk; struct sk_buff *skb; struct atmlec_msg *mesg; - if (!priv || !priv->lecd) + if (!priv || !rcu_access_pointer(priv->lecd)) return -1; + skb = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC); if (!skb) return -1; @@ -532,18 +545,27 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type, if (atm_addr) memcpy(&mesg->content.normal.atm_addr, atm_addr, ATM_ESA_LEN); - atm_force_charge(priv->lecd, skb->truesize); - sk = sk_atm(priv->lecd); + rcu_read_lock(); + vcc = rcu_dereference(priv->lecd); + if (!vcc) { + rcu_read_unlock(); + kfree_skb(skb); + return -1; + } + + atm_force_charge(vcc, skb->truesize); + sk = sk_atm(vcc); skb_queue_tail(&sk->sk_receive_queue, skb); sk->sk_data_ready(sk); if (data != NULL) { pr_debug("about to send %d bytes of data\n", data->len); - atm_force_charge(priv->lecd, data->truesize); + atm_force_charge(vcc, data->truesize); skb_queue_tail(&sk->sk_receive_queue, data); sk->sk_data_ready(sk); } + rcu_read_unlock(); return 0; } @@ -618,7 +640,7 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb) atm_return(vcc, skb->truesize); if (*(__be16 *) skb->data == htons(priv->lecid) || - !priv->lecd || !(dev->flags & IFF_UP)) { + !rcu_access_pointer(priv->lecd) || !(dev->flags & IFF_UP)) { /* * Probably looping back, or if lecd is missing, * lecd has gone down @@ -753,12 +775,12 @@ static int lecd_attach(struct atm_vcc *vcc, int arg) priv = netdev_priv(dev_lec[i]); } else { priv = netdev_priv(dev_lec[i]); - if (priv->lecd) + if (rcu_access_pointer(priv->lecd)) return -EADDRINUSE; } lec_arp_init(priv); priv->itfnum = i; /* LANE2 addition */ - priv->lecd = vcc; + rcu_assign_pointer(priv->lecd, vcc); vcc->dev = &lecatm_dev; vcc_insert_socket(sk_atm(vcc)); diff --git a/net/atm/lec.h b/net/atm/lec.h index be0e2667bd8c..ec85709bf818 100644 --- a/net/atm/lec.h +++ b/net/atm/lec.h @@ -91,7 +91,7 @@ struct lec_priv { */ spinlock_t lec_arp_lock; struct atm_vcc *mcast_vcc; /* Default Multicast Send VCC */ - struct atm_vcc *lecd; + struct atm_vcc __rcu *lecd; struct delayed_work lec_arp_work; /* C10 */ unsigned int maximum_unknown_frame_count; /* -- 2.25.1

2 1

[PATCH OLK-6.6 v10 0/5] SMT QOS
by Jinjie Ruan 08 May '26

08 May '26

Cloud Service Provider deploy Best-Effort and Latency Sensitive tasks on the same physical core to maximize the resource utilization. We observe the LS task needs more cycles to complete the same workload due to the Microarchitectural resource contention. This feature control the instruction throughput of BE task into pipeline, so that the other SMT running LS task could occupy more uarch resources to reach better IPC. First split out QOS_LABEL from QOS_SCHED for SMT QoS reuse. The test results on 920G: +-------------------------------------------------------------+ | | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.201 | 0.292 | 0.212 | | CPU utilization | 29.3% | 67.00% | 63.30% | | P99 regression percentage | \ | 45.27% | 5.47% | +-------------------------------------------------------------+ Changes in v10: - Decouple QOS_SCHED_SMT_EXPELLER and QOS_SCHED scheduling logic with SMT_QOS. - Some cleanup. Changes in v9: - Also use SMT sibling CPU utilization NUMA level watermark for offline task cpu select to improve the 920G CPU utilization. Chanegs in v8: - Use SMT sibling CPU utilization NUMA level watermark instead of src cpu offline tasks migrate watermark on every load balance. Changes in v7: - Fix the prefer_cpu and select_cpus save/restore. - Extract can_smt_qos_migrate_task() helper from can_migrate_task(). - Update the names. - Update the arch code and remove the pmu code. - Add some comment. Changes in v6: - Rename QOS_LABEL to QOS_LEVEL. - Rename USER_WFXT to SMT_QOS. - Rename TAG_PULL to SMT_TAG_PULL. - Adjust the select cpu code which depends on QOS_SCHED_DYNAMIC_AFFINITY. - Distribute offline tasks to SMT sibling cores based on the configured proportion move to a separate patch. - Use cpumask_t for even_cpu_mask. - smt_throttle move to the arch patch. - pmu_smt_update_status() -> smt_update_qos_level(). - >> smt_task_imbalance instead of / 1000. - Remove the limit for odd -> even load balance, which solve the one NUMA load very high problem. - Rebased on the newest OLK-6.6 code. - Fix the build issue for QOS_LEVEL selected but CGROUP_SCHED or CFS_BANDWIDTH not selected. Jinjie Ruan (5): sched: Split out QOS_LEVEL from QOS_SCHED for reuse sched: Add qos_sched_enabled() helper for future expansion sched/fair: Add SMT QoS sched core code arm64: Add arch code for SMT QoS config: Enable SMT_QOS arch/arm64/Kconfig.turbo | 17 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 5 + arch/arm64/include/asm/xint.h | 15 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/entry-common.c | 16 ++ arch/arm64/kernel/entry.S | 14 +- arch/arm64/kernel/smp.c | 23 ++ arch/arm64/kernel/smt_qos.c | 84 +++++++ arch/arm64/kernel/xcall/entry.S | 78 +++++++ drivers/irqchip/irq-gic-v3.c | 43 ++++ include/linux/sched.h | 20 ++ init/Kconfig | 5 + kernel/sched/core.c | 20 +- kernel/sched/fair.c | 289 ++++++++++++++++++++++++- kernel/sched/features.h | 4 + kernel/sched/sched.h | 18 +- 17 files changed, 618 insertions(+), 35 deletions(-) create mode 100644 arch/arm64/include/asm/xint.h create mode 100644 arch/arm64/kernel/smt_qos.c -- 2.34.1

2 6

[PATCH OLK-6.6] mm/numa_remote: avoid numa_remote lock when onlining pre-onlined memory
by Jinjiang Tu 08 May '26

08 May '26

hulk inclusion category: performance bugzilla: https://atomgit.com/openeuler/kernel/issues/9122 ---------------------------------------- When onlining pre-onlined memory, numa_remote lock is held to check if the memory range is pre-onlined. However, it may lead to unstable performance when the lock is contended. So, don't check it in add_memory_remote(), only check it in numa_remote_undo_fake_online(). Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/base/numa_remote.c | 56 ++++++++++++++++---------------------- 1 file changed, 23 insertions(+), 33 deletions(-) diff --git a/drivers/base/numa_remote.c b/drivers/base/numa_remote.c index f53d1dcab2ce..fed37dc20391 100644 --- a/drivers/base/numa_remote.c +++ b/drivers/base/numa_remote.c @@ -30,6 +30,7 @@ static nodemask_t numa_nodes_remote; struct undo_fake_online_control { u64 start; u64 size; + int nid; struct llist_node llist; }; @@ -283,17 +284,14 @@ static void numa_remote_online_pages(unsigned long start_pfn, unsigned long end_ * Undo fake-online a remote node. Have to be called in preonline mode then * the memory on the node can be allocated. */ -static int __ref numa_remote_undo_fake_online(u64 start, u64 size) +static int __ref numa_remote_undo_fake_online(u64 start, u64 size, int nid) { unsigned long start_pfn = PFN_DOWN(start); unsigned long end_pfn = PFN_DOWN(start + size); unsigned long nr_pages = end_pfn - start_pfn; - struct zone *zone; - int nid; int ret = 0; mem_hotplug_begin(); - /* Re-check whether all memory block are pre-online. */ if (!check_memory_block_pre_online(start, size, true)) { ret = -EINVAL; goto out; @@ -304,8 +302,6 @@ static int __ref numa_remote_undo_fake_online(u64 start, u64 size) goto out; } - zone = page_zone(phys_to_page(start)); - nid = zone_to_nid(zone); if (!check_memory_block_nid(start, size, nid)) { ret = -EINVAL; goto out; @@ -328,6 +324,8 @@ static int __ref numa_remote_undo_fake_online(u64 start, u64 size) out: atomic_long_add(-nr_pages, &undo_fake_online_pages_node[nid]); mem_hotplug_done(); + if (unlikely(ret)) + pr_warn("online memory [%llx, %llx) failed: %d\n", start, start + size, ret); return ret; } @@ -362,7 +360,7 @@ static void undo_fake_online_work_fn(struct work_struct *work) node = node->next; mutex_lock(&numa_remote_lock); - numa_remote_undo_fake_online(uic->start, uic->size); + numa_remote_undo_fake_online(uic->start, uic->size, uic->nid); mutex_unlock(&numa_remote_lock); kfree(uic); } @@ -454,43 +452,37 @@ int add_memory_remote(int nid, u64 start, u64 size, int flags) if (flags == (MEMORY_KEEP_ISOLATED | MEMORY_DIRECT_ONLINE)) return NUMA_NO_NODE; - if (flags & (MEMORY_KEEP_ISOLATED | MEMORY_DIRECT_ONLINE)) { - numa_remote_wait_undo_fake_online(); - down_write(&numa_remote_state_lock); - } - mutex_lock(&numa_remote_lock); - - if (numa_remote_preonline_mode && !flags) { + /* Online pre-onlined memory. To avoid grabbing numa_rmeote + * lock and leading to unstable performance, don't check if + * [start, start + size) is pre-onelined, check it in the + * async work. + */ + if (!flags) { struct undo_fake_online_control *uic; if (check_hotplug_memory_range(start, size)) - goto out; - /* Check whether all memory block are pre-online. */ - if (!check_memory_block_pre_online(start, size, true)) - goto out; + return NUMA_NO_NODE; - real_nid = (nid == NUMA_NO_NODE) ? - page_to_nid(phys_to_page(start)) : nid; - if (!check_memory_block_nid(start, size, real_nid)) { - real_nid = NUMA_NO_NODE; - goto out; - } + if (nid == NUMA_NO_NODE) + return NUMA_NO_NODE; uic = kzalloc(sizeof(struct undo_fake_online_control), GFP_KERNEL); - if (!uic) { - real_nid = NUMA_NO_NODE; - goto out; - } + if (!uic) + return NUMA_NO_NODE; - atomic_long_add(size / PAGE_SIZE, &undo_fake_online_pages_node[real_nid]); + atomic_long_add(size / PAGE_SIZE, &undo_fake_online_pages_node[nid]); uic->start = start; uic->size = size; + uic->nid = nid; if (llist_add(&uic->llist, &undo_fake_online_list)) schedule_work(&undo_fake_online_work); - goto out; + return nid; } + numa_remote_wait_undo_fake_online(); + down_write(&numa_remote_state_lock); + mutex_lock(&numa_remote_lock); lock_device_hotplug(); real_nid = (nid == NUMA_NO_NODE) ? find_unused_remote_node() : nid; @@ -505,10 +497,8 @@ int add_memory_remote(int nid, u64 start, u64 size, int flags) unlock: unlock_device_hotplug(); -out: mutex_unlock(&numa_remote_lock); - if (flags & (MEMORY_KEEP_ISOLATED | MEMORY_DIRECT_ONLINE)) - up_write(&numa_remote_state_lock); + up_write(&numa_remote_state_lock); return real_nid; } EXPORT_SYMBOL_GPL(add_memory_remote); -- 2.43.0

2 1

[PATCH OLK-5.10 0/1] Revert "[cpufreq]Fix re-boost issue after hotplugging a CPU"
by Lifeng Zheng 08 May '26

08 May '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8995 ---------------------------------------------------------------------- Lifeng Zheng (1): Revert "[cpufreq]Fix re-boost issue after hotplugging a CPU" drivers/cpufreq/cpufreq.c | 4 ---- 1 file changed, 4 deletions(-) -- 2.33.0

2 2

[PATCH OLK-5.10 0/1] cpufreq: conservative: Reset requested_freq on limits change
by Lifeng Zheng 08 May '26

08 May '26

From: Hongye Lin <linhongye(a)h-partners.com> mainline inclusion from mainline-v7.0-rc6 commit 6a28fb8cb28b9eb39a392e531d938a889eacafc5 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8993 CVE: NA Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… ---------------------------------------------------------------------- A recently reported issue highlighted that the cached requested_freq is not guaranteed to stay in sync with policy->cur. If the platform changes the actual CPU frequency after the governor sets one (e.g. due to platform-specific frequency scaling) and a re-sync occurs later, policy->cur may diverge from requested_freq. This can lead to incorrect behavior in the conservative governor. For example, the governor may assume the CPU is already running at the maximum frequency and skip further increases even though there is still headroom. Avoid this by resetting the cached requested_freq to policy->cur on detecting a change in policy limits. Viresh Kumar (1): cpufreq: conservative: Reset requested_freq on limits change drivers/cpufreq/cpufreq_conservative.c | 12 ++++++++++++ drivers/cpufreq/cpufreq_governor.c | 3 +++ drivers/cpufreq/cpufreq_governor.h | 1 + 3 files changed, 16 insertions(+) -- 2.33.0

2 2

[PATCH OLK-6.6 0/1] kvm: arm64: Add HIP13 cpu type definition for detecting virtualization features
by liqiqi 08 May '26

08 May '26

Add HIP13 cpu type for detecting whether IPIv and DVMBM are supported. liqiqi (1): kvm: arm64: Add HIP13 cpu type definition for detecting virtualization features arch/arm64/kvm/hisilicon/hisi_virt.c | 12 +++++++----- arch/arm64/kvm/hisilicon/hisi_virt.h | 1 + 2 files changed, 8 insertions(+), 5 deletions(-) -- 2.43.0

2 2