- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] nfsd: split nfsd4_copy into transient and durable async copy objects
by Lu Jialin 15 Oct '26

15 Oct '26

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v7.3-rc1 commit f307b4f7ed174a3252d2f292904fd276c78c77de category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18939 CVE: CVE-2026-89676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- struct nfsd4_copy served two roles: as &u->copy it is a transient per-COMPOUND argument in the request buffer; as the heap async_copy it is a durable object (worker kthread, reaper linkage, CB_OFFLOAD callback, IDR stateid) that outlives the COMPOUND, with dup_copy_fields() shuttling state between them. That dual identity was the root of the recent lifetime bugs. Introduce struct nfsd4_async_copy for the durable object. It embeds a struct nfsd4_copy (cp_copy) for the operation parameters/result and adds the durable-only fields: async_copies linkage, task_struct, refcount, reaper TTL, copy stateid, and CB_OFFLOAD callback. The durable object therefore never points into the request buffer. cp_clp stays in nfsd4_copy -- it is a request property read by the sync-copy tracepoints on the transient object. Mechanical split, no intended behavioral change; a step toward folding the copy stateids into the common nfs4_stid infrastructure. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://patch.msgid.link/20260710-nfsd-testing-v3-8-a0ff7db6aa3e@kernel.org Signed-off-by: Chuck Lever <cel(a)kernel.org> Conflicts: fs/nfsd/nfs4proc.c [OLK-6.6 is a v6.6-era baseline that lacks the nfsd async-copy prerequisites present in the mainline base (v7.3-rc1): there is no nfsd4_has_active_async_copies(), nfsd4_async_copy_reaper() or nfsd4_cancel_copy_by_sb() to repoint and no cp_ttl reaper, so those hunks do not apply; nfs4_put_copy()/nfsd4_stop_copy()/ nfsd4_unhash_copy() keep OLK-6.6's earlier forms (no task_struct pinning in nfs4_put_copy(), plain cp_clp store, no CB_ERROR/COMPLETED handling) with only the type and cp_copy field paths adjusted; cleanup_async_copy() additionally keeps OLK-6.6's 'if (cp_copy.cp_clp) list_del' block] fs/nfsd/nfs4state.c [nfs4_init_copy_state()/nfs4_free_copy_state() repointed to struct nfsd4_async_copy; nfs4_init_cp_state() keeps the 3-argument form used by OLK-6.6 (mainline's base added a struct nfs4_stid *p_stid param)] fs/nfsd/state.h [forward declaration added for struct nfsd4_async_copy and the two nfs4_*_copy_state() prototypes repointed to it] fs/nfsd/xdr4.h [OLK-6.6's struct nfsd4_copy has no cp_cb_offload, cp_ttl or attr_update (mainline added them in earlier patches), so only copies/copy_task/refcount/cp_stateid move into the new struct nfsd4_async_copy; OLK-6.6 still heap-allocates the CB_OFFLOAD with kzalloc() and uses nfsd4_send_cb_offload(copy, nfserr), so cp_cb_offload is not embedded and nfsd4_cb_offload_release() needs no change] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/nfsd/nfs4proc.c | 89 ++++++++++++++++++++++++--------------------- fs/nfsd/nfs4state.c | 6 +-- fs/nfsd/state.h | 5 ++- fs/nfsd/xdr4.h | 23 +++++++++--- 4 files changed, 70 insertions(+), 53 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index c74aedc1d2c6..ae3ad8afaffd 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1274,32 +1274,32 @@ nfsd4_clone(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, return status; } -static void nfs4_put_copy(struct nfsd4_copy *copy) +static void nfs4_put_copy(struct nfsd4_async_copy *copy) { if (!refcount_dec_and_test(&copy->refcount)) return; - atomic_dec(&copy->cp_nn->pending_async_copies); - kfree(copy->cp_src); + atomic_dec(&copy->cp_copy.cp_nn->pending_async_copies); + kfree(copy->cp_copy.cp_src); kfree(copy); } -static void nfsd4_stop_copy(struct nfsd4_copy *copy) +static void nfsd4_stop_copy(struct nfsd4_async_copy *copy) { - if (!test_and_set_bit(NFSD4_COPY_F_STOPPED, &copy->cp_flags)) + if (!test_and_set_bit(NFSD4_COPY_F_STOPPED, &copy->cp_copy.cp_flags)) kthread_stop(copy->copy_task); nfs4_put_copy(copy); } -static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp) +static struct nfsd4_async_copy *nfsd4_unhash_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy = NULL; + struct nfsd4_async_copy *copy = NULL; spin_lock(&clp->async_lock); if (!list_empty(&clp->async_copies)) { - copy = list_first_entry(&clp->async_copies, struct nfsd4_copy, - copies); + copy = list_first_entry(&clp->async_copies, + struct nfsd4_async_copy, copies); refcount_inc(&copy->refcount); - copy->cp_clp = NULL; + copy->cp_copy.cp_clp = NULL; if (!list_empty(&copy->copies)) list_del_init(&copy->copies); } @@ -1309,7 +1309,7 @@ static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp) void nfsd4_shutdown_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; while ((copy = nfsd4_unhash_copy(clp)) != NULL) nfsd4_stop_copy(copy); @@ -1702,7 +1702,6 @@ static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) if (!nfsd4_ssc_is_inter(src)) dst->nf_src = nfsd_file_get(src->nf_src); - memcpy(&dst->cp_stateid, &src->cp_stateid, sizeof(src->cp_stateid)); memcpy(dst->cp_src, src->cp_src, sizeof(struct nl4_server)); memcpy(&dst->stateid, &src->stateid, sizeof(src->stateid)); memcpy(&dst->c_fh, &src->c_fh, sizeof(src->c_fh)); @@ -1717,20 +1716,20 @@ static void release_copy_files(struct nfsd4_copy *copy) nfsd_file_put(copy->nf_dst); } -static void cleanup_async_copy(struct nfsd4_copy *copy) +static void cleanup_async_copy(struct nfsd4_async_copy *copy) { nfs4_free_copy_state(copy); - release_copy_files(copy); - if (copy->cp_clp) { - spin_lock(&copy->cp_clp->async_lock); + release_copy_files(&copy->cp_copy); + if (copy->cp_copy.cp_clp) { + spin_lock(&copy->cp_copy.cp_clp->async_lock); if (!list_empty(&copy->copies)) list_del_init(&copy->copies); - spin_unlock(&copy->cp_clp->async_lock); + spin_unlock(&copy->cp_copy.cp_clp->async_lock); } nfs4_put_copy(copy); } -static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) +static void nfsd4_send_cb_offload(struct nfsd4_async_copy *copy, __be32 nfserr) { struct nfsd4_cb_offload *cbo; @@ -1738,14 +1737,14 @@ static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) if (!cbo) return; - memcpy(&cbo->co_res, &copy->cp_res, sizeof(copy->cp_res)); - memcpy(&cbo->co_fh, &copy->fh, sizeof(copy->fh)); + memcpy(&cbo->co_res, &copy->cp_copy.cp_res, sizeof(copy->cp_copy.cp_res)); + memcpy(&cbo->co_fh, &copy->cp_copy.fh, sizeof(copy->cp_copy.fh)); cbo->co_nfserr = nfserr; - nfsd4_init_cb(&cbo->co_cb, copy->cp_clp, &nfsd4_cb_offload_ops, + nfsd4_init_cb(&cbo->co_cb, copy->cp_copy.cp_clp, &nfsd4_cb_offload_ops, NFSPROC4_CLNT_CB_OFFLOAD); - trace_nfsd_cb_offload(copy->cp_clp, &cbo->co_res.cb_stateid, - &cbo->co_fh, copy->cp_count, nfserr); + trace_nfsd_cb_offload(copy->cp_copy.cp_clp, &cbo->co_res.cb_stateid, + &cbo->co_fh, copy->cp_copy.cp_count, nfserr); nfsd4_run_cb(&cbo->co_cb); } @@ -1758,7 +1757,8 @@ static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) */ static int nfsd4_do_async_copy(void *data) { - struct nfsd4_copy *copy = (struct nfsd4_copy *)data; + struct nfsd4_async_copy *async = data; + struct nfsd4_copy *copy = &async->cp_copy; __be32 nfserr; if (nfsd4_ssc_is_inter(copy)) { @@ -1786,8 +1786,8 @@ static int nfsd4_do_async_copy(void *data) } do_callback: - nfsd4_send_cb_offload(copy, nfserr); - cleanup_async_copy(copy); + nfsd4_send_cb_offload(async, nfserr); + cleanup_async_copy(async); return 0; } @@ -1796,7 +1796,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, union nfsd4_op_u *u) { struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); - struct nfsd4_copy *async_copy = NULL; + struct nfsd4_async_copy *async_copy = NULL; struct nfsd4_copy *copy = &u->copy; struct nfsd42_write_res *result; __be32 status; @@ -1822,33 +1822,38 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, memcpy(&copy->fh, &cstate->current_fh.fh_handle, sizeof(struct knfsd_fh)); if (nfsd4_copy_is_async(copy)) { - async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); + async_copy = kzalloc(sizeof(struct nfsd4_async_copy), GFP_KERNEL); if (!async_copy) goto out_err; - async_copy->cp_nn = nn; + async_copy->cp_copy.cp_nn = nn; INIT_LIST_HEAD(&async_copy->copies); refcount_set(&async_copy->refcount, 1); /* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return(&nn->pending_async_copies) > (int)rqstp->rq_pool->sp_nrthreads) goto out_err; - async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL); - if (!async_copy->cp_src) + async_copy->cp_copy.cp_src = + kmalloc(sizeof(*async_copy->cp_copy.cp_src), GFP_KERNEL); + if (!async_copy->cp_copy.cp_src) goto out_err; - dup_copy_fields(copy, async_copy); if (!nfs4_init_copy_state(nn, async_copy)) goto out_err; memcpy(&result->cb_stateid, &async_copy->cp_stateid.cs_stid, sizeof(result->cb_stateid)); + /* + * dup after writing cb_stateid; duplicating first would leave + * the callback stateid zeroed. + */ + dup_copy_fields(copy, &async_copy->cp_copy); async_copy->copy_task = kthread_create(nfsd4_do_async_copy, async_copy, "%s", "copy thread"); if (IS_ERR(async_copy->copy_task)) goto out_err; - spin_lock(&async_copy->cp_clp->async_lock); + spin_lock(&async_copy->cp_copy.cp_clp->async_lock); list_add(&async_copy->copies, - &async_copy->cp_clp->async_copies); - spin_unlock(&async_copy->cp_clp->async_lock); + &async_copy->cp_copy.cp_clp->async_copies); + spin_unlock(&async_copy->cp_copy.cp_clp->async_lock); wake_up_process(async_copy->copy_task); status = nfs_ok; } else { @@ -1873,10 +1878,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, goto out; } -static struct nfsd4_copy * +static struct nfsd4_async_copy * find_async_copy_locked(struct nfs4_client *clp, stateid_t *stateid) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; lockdep_assert_held(&clp->async_lock); @@ -1888,10 +1893,10 @@ find_async_copy_locked(struct nfs4_client *clp, stateid_t *stateid) return NULL; } -static struct nfsd4_copy * +static struct nfsd4_async_copy * find_async_copy(struct nfs4_client *clp, stateid_t *stateid) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; spin_lock(&clp->async_lock); copy = find_async_copy_locked(clp, stateid); @@ -1907,7 +1912,7 @@ nfsd4_offload_cancel(struct svc_rqst *rqstp, union nfsd4_op_u *u) { struct nfsd4_offload_status *os = &u->offload_status; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; copy = find_async_copy(clp, &os->stateid); @@ -1995,13 +2000,13 @@ nfsd4_offload_status(struct svc_rqst *rqstp, { struct nfsd4_offload_status *os = &u->offload_status; __be32 status = nfs_ok; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; spin_lock(&clp->async_lock); copy = find_async_copy_locked(clp, &os->stateid); if (copy) - os->count = copy->cp_res.wr_bytes_written; + os->count = copy->cp_copy.cp_res.wr_bytes_written; else status = nfserr_bad_stateid; spin_unlock(&clp->async_lock); diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 5140197771ad..0d62c65ae4d4 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -1034,7 +1034,7 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid, return 1; } -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy) +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy) { return nfs4_init_cp_state(nn, &copy->cp_stateid, NFS4_COPY_STID); } @@ -1068,13 +1068,13 @@ struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, return NULL; } -void nfs4_free_copy_state(struct nfsd4_copy *copy) +void nfs4_free_copy_state(struct nfsd4_async_copy *copy) { struct nfsd_net *nn; if (copy->cp_stateid.cs_type != NFS4_COPY_STID) return; - nn = net_generic(copy->cp_clp->net, nfsd_net_id); + nn = net_generic(copy->cp_copy.cp_clp->net, nfsd_net_id); spin_lock(&nn->s2s_cp_lock); idr_remove(&nn->s2s_cp_stateids, copy->cp_stateid.cs_stid.si_opaque.so_id); diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index 4dd8ade17446..d62faf4f183a 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -676,6 +676,7 @@ struct nfsd4_blocked_lock { struct nfsd4_compound_state; struct nfsd_net; struct nfsd4_copy; +struct nfsd4_async_copy; extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct svc_fh *fhp, @@ -686,8 +687,8 @@ __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, struct nfs4_stid **s, struct nfsd_net *nn); struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab, void (*sc_free)(struct nfs4_stid *)); -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy); -void nfs4_free_copy_state(struct nfsd4_copy *copy); +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy); +void nfs4_free_copy_state(struct nfsd4_async_copy *copy); struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, struct nfs4_stid *p_stid); void nfs4_unhash_stid(struct nfs4_stid *s); diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h index a83a52b0f518..4ac30b2ec7c5 100644 --- a/fs/nfsd/xdr4.h +++ b/fs/nfsd/xdr4.h @@ -599,18 +599,29 @@ struct nfsd4_copy { struct nfsd_file *nf_src; struct nfsd_file *nf_dst; - copy_stateid_t cp_stateid; - - struct list_head copies; - struct task_struct *copy_task; - refcount_t refcount; - struct nfsd4_ssc_umount_item *ss_nsui; struct nfs_fh c_fh; nfs4_stateid stateid; struct nfsd_net *cp_nn; }; +/* + * Durable state for an async (background) server-side COPY. + * + * struct nfsd4_copy is transient: it lives in the COMPOUND argument buffer + * and is reused once the op returns. An async COPY outlives the COMPOUND + * (worker kthread, reaper linkage), so its params and result are snapshotted + * into the embedded cp_copy and it never points into the request buffer. + */ +struct nfsd4_async_copy { + struct nfsd4_copy cp_copy; /* operation params + result */ + + struct list_head copies; /* nfs4_client.async_copies */ + struct task_struct *copy_task; + refcount_t refcount; + copy_stateid_t cp_stateid; /* s2s_cp_stateids IDR entry */ +}; + static inline void nfsd4_copy_set_sync(struct nfsd4_copy *copy, bool sync) { if (sync) -- 2.34.1

2 1

[PATCH OLK-6.6] kabi: Add a Python3 port of check-kabi
by GONG Ruiqi 15 Oct '26

15 Oct '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/10129 ---------------------------------------- scripts/check-kabi is written in Python 2, which has long been in End-Of-Life[1], and its runtime environment is becoming increasingly difficult to obtain. Port it as scripts/check-kabi-py3 with the behavior kept identical: the same -k/-s options, the same output text and the same exit codes (0 on a clean check, 1 on kABI breakage, moved symbols or usage errors). The two byte-identical loaders of the original are folded into a single load_table() helper and the unused os/re imports are dropped along the way; neither change is observable from outside. Link: https://devguide.python.org/versions/ [1] Assisted-by: ZCode:GLM-5.3 Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- scripts/check-kabi-py3 | 114 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 114 insertions(+) create mode 100755 scripts/check-kabi-py3 diff --git a/scripts/check-kabi-py3 b/scripts/check-kabi-py3 new file mode 100755 index 000000000000..3dac8fdda950 --- /dev/null +++ b/scripts/check-kabi-py3 @@ -0,0 +1,114 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: GPL-2.0 +# +# check-kabi - Red Hat kABI reference checking tool +# +# We use this script to check against reference Module.kabi files. +# +# Author: Jon Masters <jcm(a)redhat.com> +# Copyright (C) 2007-2009 Red Hat, Inc. +# +# Python 2 is no longer maintained, hence the port to Python 3. +# +# Author: GONG Ruiqi <gongruiqi1(a)huawei.com> +# Copyright (C) 2026 Huawei Technologies Co., Ltd. +# +# This software may be freely redistributed under the terms of the GNU +# General Public License (GPL). + +import getopt +import sys + +def load_table(table, filename): + """Load a Module.symvers or Module.kabi file.""" + + with open(filename, "r") as f: + for in_line in f: + if in_line == "\n": + continue + checksum, symbol, directory, type, namespace = in_line.split("\t") + table[symbol] = in_line[0:-1] + +def check_kabi(symvers, kabi): + """Check Module.kabi and Module.symvers files.""" + + fail = False + warn = False + changed_symbols = [] + moved_symbols = [] + + for symbol, line in kabi.items(): + abi_hash, _, abi_dir, _, _ = line.split("\t") + if symbol in symvers: + sym_hash, _, sym_dir, _, _ = symvers[symbol].split("\t") + if abi_hash != sym_hash: + fail = True + changed_symbols.append(symbol) + + if abi_dir != sym_dir: + warn = True + moved_symbols.append(symbol) + else: + fail = True + changed_symbols.append(symbol) + + if fail: + print("*** ERROR - ABI BREAKAGE WAS DETECTED ***") + print("") + print("The following symbols have been changed (this will cause an ABI breakage):") + print("") + for symbol in changed_symbols: + print(symbol) + print("") + + if warn: + print("*** WARNING - ABI SYMBOLS MOVED ***") + print("") + print("The following symbols moved (typically caused by moving a symbol from being") + print("provided by the kernel vmlinux out to a loadable module):") + print("") + for symbol in moved_symbols: + print(symbol) + print("") + + # Halt the build, if we got errors and/or warnings. In either case, + # double-checking is required to avoid introducing / concealing + # KABI inconsistencies. + if fail or warn: + sys.exit(1) + sys.exit(0) + +def usage(): + print(""" +check-kabi-py3: check Module.kabi and Module.symvers files. + + check-kabi-py3 [ -k Module.kabi ] [ -s Module.symvers ] + +""") + +if __name__ == "__main__": + + symvers_file = "" + kabi_file = "" + + opts, args = getopt.getopt(sys.argv[1:], "hk:s:") + + for o, v in opts: + if o == "-s": + symvers_file = v + if o == "-h": + usage() + sys.exit(0) + if o == "-k": + kabi_file = v + + if (symvers_file == "") or (kabi_file == ""): + usage() + sys.exit(1) + + symvers = {} + kabi = {} + + load_table(symvers, symvers_file) + load_table(kabi, kabi_file) + check_kabi(symvers, kabi) -- 2.43.0

2 1

[PATCH OLK-6.6] ALSA: pcm: set timer->private_data before registering the PCM timer
by Pan Taixi 15 Oct '26

15 Oct '26

From: Nguyen Ngoc Thang <ngocthang2710.1999(a)gmail.com> stable inclusion from stable-v6.6.158 commit 686c7a6af1eea8d2a919303e4c6bbec3de79dbdc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20047 CVE: CVE-2026-98314 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- ALSA: pcm: set timer->private_data before registering the PCM timer [ Upstream commit 1e713f9bb2ac583521f06b0eb4e22440b1e3d078 ] snd_pcm_timer_init() calls snd_device_register() to link the new struct snd_timer into the global timer list while it still carries hw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop), and only afterwards sets timer->private_data = substream. Once the timer is on the list under register_mutex, a concurrent reader can already reach it through the same mutex and invoke these callbacks. /proc/asound/timers does this via c_resolution(), and snd_timer_open()+snd_timer_start() reach start()/stop() the same way. All three dereference timer->private_data, which for this brief window is NULL, giving a NULL-pointer dereference: substream = timer->private_data; return substream->runtime ? ... // substream is NULL Move the private_data/private_free assignment before snd_device_register() so the timer is never visible on the list without its private_data set. On the snd_device_register() failure path, private_free() (snd_pcm_timer_free()) can now run, but it only does substream->timer = NULL, which is already NULL at that point since substream->timer is set to the new timer just once, after a successful registration -- so the failure path stays safe. Reported-by: syzbot+19da64013c46df87f971(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=19da64013c46df87f971 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999(a)gmail.com> Link: https://patch.msgid.link/20260913134446.114724-1-ngocthang2710.1999@gmail.c… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- sound/core/pcm_timer.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sound/core/pcm_timer.c b/sound/core/pcm_timer.c index c43484b22b34..725a7272cd07 100644 --- a/sound/core/pcm_timer.c +++ b/sound/core/pcm_timer.c @@ -110,16 +110,19 @@ void snd_pcm_timer_init(struct snd_pcm_substream *substream) sprintf(timer->name, "PCM %s %i-%i-%i", substream->stream == SNDRV_PCM_STREAM_CAPTURE ? "capture" : "playback", tid.card, tid.device, tid.subdevice); timer->hw = snd_pcm_timer; + /* Set before registering: a concurrent reader can invoke our hw + * callbacks as soon as the timer is on the global list. + */ + timer->private_data = substream; + timer->private_free = snd_pcm_timer_free; if (snd_device_register(timer->card, timer) < 0) { snd_device_free(timer->card, timer); return; } - timer->private_data = substream; - timer->private_free = snd_pcm_timer_free; substream->timer = timer; } void snd_pcm_timer_done(struct snd_pcm_substream *substream) { -- 2.34.1

2 1

[PATCH OLK-5.10] ALSA: pcm: set timer->private_data before registering the PCM timer
by Pan Taixi 15 Oct '26

15 Oct '26

From: Nguyen Ngoc Thang <ngocthang2710.1999(a)gmail.com> stable inclusion from stable-v5.10.271 commit 27f167e117eca310661fbcbacb352ea08face067 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20047 CVE: CVE-2026-98314 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- ALSA: pcm: set timer->private_data before registering the PCM timer [ Upstream commit 1e713f9bb2ac583521f06b0eb4e22440b1e3d078 ] snd_pcm_timer_init() calls snd_device_register() to link the new struct snd_timer into the global timer list while it still carries hw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop), and only afterwards sets timer->private_data = substream. Once the timer is on the list under register_mutex, a concurrent reader can already reach it through the same mutex and invoke these callbacks. /proc/asound/timers does this via c_resolution(), and snd_timer_open()+snd_timer_start() reach start()/stop() the same way. All three dereference timer->private_data, which for this brief window is NULL, giving a NULL-pointer dereference: substream = timer->private_data; return substream->runtime ? ... // substream is NULL Move the private_data/private_free assignment before snd_device_register() so the timer is never visible on the list without its private_data set. On the snd_device_register() failure path, private_free() (snd_pcm_timer_free()) can now run, but it only does substream->timer = NULL, which is already NULL at that point since substream->timer is set to the new timer just once, after a successful registration -- so the failure path stays safe. Reported-by: syzbot+19da64013c46df87f971(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=19da64013c46df87f971 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999(a)gmail.com> Link: https://patch.msgid.link/20260913134446.114724-1-ngocthang2710.1999@gmail.c… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- sound/core/pcm_timer.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sound/core/pcm_timer.c b/sound/core/pcm_timer.c index c43484b22b34..725a7272cd07 100644 --- a/sound/core/pcm_timer.c +++ b/sound/core/pcm_timer.c @@ -110,16 +110,19 @@ void snd_pcm_timer_init(struct snd_pcm_substream *substream) sprintf(timer->name, "PCM %s %i-%i-%i", substream->stream == SNDRV_PCM_STREAM_CAPTURE ? "capture" : "playback", tid.card, tid.device, tid.subdevice); timer->hw = snd_pcm_timer; + /* Set before registering: a concurrent reader can invoke our hw + * callbacks as soon as the timer is on the global list. + */ + timer->private_data = substream; + timer->private_free = snd_pcm_timer_free; if (snd_device_register(timer->card, timer) < 0) { snd_device_free(timer->card, timer); return; } - timer->private_data = substream; - timer->private_free = snd_pcm_timer_free; substream->timer = timer; } void snd_pcm_timer_done(struct snd_pcm_substream *substream) { -- 2.34.1

2 1

openEuler Kernel SIG双周例会
by openEuler conference 14 Oct '26

14 Oct '26

您好！ Kernel 邀请您参加 2026-10-16 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题可直接填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/986389680 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-10-16 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题可直接填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/986389680 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6 0/8] Add support for vTLBID
by Jinqian Yang 14 Oct '26

14 Oct '26

This series adds KVM/arm64 support for the ARM TLB invalidation domain (TLBID) extension. With TLBID a guest can scope its TLB invalidation broadcasts to a virtual domain (vDomain). User space discovers the feature through the new KVM_CAP_ARM_TLBIDOMAIN capability. The number of supported vDomains is queried with the new VM ioctl KVM_ARM_GET_VDOMAIN_NUM, and the per-vCPU ioctl KVM_ARM_VCPU_SET_VDOMAIN tells KVM which vDomains each vCPU belongs to, via a vDomain bitmap. KVM maintains a per-VM mapping from vDomains to the physical CPUs that run their member vCPUs, and reprogrammes the VTLBID(n)_EL2 registers on every vCPU load, so that a guest TLBI tagged with a vDomain ID only reaches the physical CPUs currently running that vDomain's vCPUs. Because DVMBM and TLBID are mutually exclusive, DVMBM is force-disabled once TLBID is enabled for a VM. On the guest side, TLBIDIDR_EL1 is emulated with virtual domain counts clamped to the hardware limits, the ID_AA64MMFR4_EL1.TLBID field is exposed only when the feature is active for the VM, and guest accesses to TLBIDIDR_EL1 are trapped and handled by KVM. The feature is gated behind CONFIG_KVM_ARM_VTLBID \and additionally requires hardware TLBID support at run time. Tracepoints are added for the vCPU load path so that the vDomain-to-pCPU mapping can be observed. Jinqian Yang (8): KVM: arm64: Introduce TLBID virtualization infrastructure KVM: arm64: Add VTLBID sysregs and update VTLBID(n) on vCPU load KVM: arm64: Wire up TLBID vDomain configuration ioctls KVM: arm64: Ensure DVMBM is disabled when TLBID is enabled KVM: arm64: Emulate TLBIDIDR_EL1 with virtual domain counts KVM: arm64: Conditionally expose ID_AA64MMFR4_EL1.TLBID to guest KVM: arm64: Enable TLBIDIDR_EL1 access trap in guest KVM: arm64: Add tracepoints for TLBID vDomain load events Documentation/virt/kvm/api.rst | 58 +++ arch/arm64/include/asm/kvm_host.h | 53 +++ arch/arm64/include/uapi/asm/kvm.h | 2 + arch/arm64/kvm/Kconfig | 12 + arch/arm64/kvm/arm.c | 530 ++++++++++++++++++++++++++- arch/arm64/kvm/hisilicon/hisi_virt.c | 9 + arch/arm64/kvm/sys_regs.c | 76 +++- arch/arm64/kvm/sys_regs.h | 6 + arch/arm64/kvm/trace_arm.h | 47 +++ arch/arm64/tools/sysreg | 23 +- include/uapi/linux/kvm.h | 14 + 11 files changed, 826 insertions(+), 4 deletions(-) -- 2.33.0

2 9

[PATCH OLK-6.6] Add NI_RANDOM
by Luo Gengkun 14 Oct '26

14 Oct '26

Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- ...ed-fair-Proportional-newidle-balance.patch | 208 ++++++++++++++++++ ...complex-proportional-newidle-balance.patch | 133 +++++++++++ 2 files changed, 341 insertions(+) create mode 100644 NI/0001-sched-fair-Proportional-newidle-balance.patch create mode 100644 NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch diff --git a/NI/0001-sched-fair-Proportional-newidle-balance.patch b/NI/0001-sched-fair-Proportional-newidle-balance.patch new file mode 100644 index 000000000000..09ab81d809ff --- /dev/null +++ b/NI/0001-sched-fair-Proportional-newidle-balance.patch @@ -0,0 +1,208 @@ +From ccfc9b017997ffc44398363c85721a67c56533df Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <peterz(a)infradead.org> +Date: Fri, 7 Nov 2025 17:01:31 +0100 +Subject: [PATCH OLK-6.6 1/2] sched/fair: Proportional newidle balance + +Add a randomized algorithm that runs newidle balancing proportional to +its success rate. + +This improves schbench significantly: + + 6.18-rc4: 2.22 Mrps/s + 6.18-rc4+revert: 2.04 Mrps/s + 6.18-rc4+revert+random: 2.18 Mrps/S + +Conversely, per Adam Li this affects SpecJBB slightly, reducing it by 1%: + + 6.17: -6% + 6.17+revert: 0% + 6.17+revert+random: -1% + +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> +Tested-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> +Tested-by: Chris Mason <clm(a)meta.com> +Link: https://lkml.kernel.org/r/6825c50d-7fa7-45d8-9b81-c6e7e25738e2@meta.com +Link: https://patch.msgid.link/20251107161739.770122091@infradead.org +Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> +--- + include/linux/sched/topology.h | 3 +++ + kernel/sched/core.c | 3 +++ + kernel/sched/fair.c | 43 ++++++++++++++++++++++++++++++---- + kernel/sched/features.h | 5 ++++ + kernel/sched/sched.h | 7 ++++++ + kernel/sched/topology.c | 6 +++++ + 6 files changed, 63 insertions(+), 4 deletions(-) + +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index f0caa9e1a3c2..ab45a04061fb 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -131,6 +131,9 @@ struct sched_domain { + unsigned int nr_balance_failed; /* initialise to 0 */ + + /* idle_balance() stats */ ++ unsigned int newidle_call; ++ unsigned int newidle_success; ++ unsigned int newidle_ratio; + u64 max_newidle_lb_cost; + unsigned long last_decay_max_lb_cost; + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 981652b0d14c..5b486736bd5d 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -46,6 +46,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_util_est_se_tp); + EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); + + DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); ++DEFINE_PER_CPU(struct rnd_state, sched_rnd_state); + + #ifdef CONFIG_SCHED_DEBUG + /* +@@ -9335,6 +9336,8 @@ void __init sched_init_smp(void) + { + sched_init_numa(); + ++ prandom_init_once(&sched_rnd_state); ++ + /* + * There's no userspace yet to cause hotplug operations; hence all the + * CPU masks are stable and all blatant races in the below code cannot +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index fb01890861eb..31a1f7734332 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -11840,8 +11840,23 @@ void update_max_interval(void) + max_load_balance_interval = HZ*num_online_cpus()/10; + } + +-static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost) ++static inline void update_newidle_stats(struct sched_domain *sd, unsigned int success) + { ++ sd->newidle_call++; ++ sd->newidle_success += success; ++ ++ if (sd->newidle_call >= 1024) { ++ sd->newidle_ratio = sd->newidle_success; ++ sd->newidle_call /= 2; ++ sd->newidle_success /= 2; ++ } ++} ++ ++static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost, unsigned int success) ++{ ++ if (cost) ++ update_newidle_stats(sd, success); ++ + if (cost > sd->max_newidle_lb_cost) { + /* + * Track max cost of a domain to make sure to not delay the +@@ -11889,7 +11904,7 @@ static void rebalance_domains(struct rq *rq, enum cpu_idle_type idle) + * Decay the newidle max times here because this is a regular + * visit to all the domains. + */ +- need_decay = update_newidle_cost(sd, 0); ++ need_decay = update_newidle_cost(sd, 0, 0); + max_cost += sd->max_newidle_lb_cost; + + /* +@@ -12527,6 +12542,22 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + break; + + if (sd->flags & SD_BALANCE_NEWIDLE) { ++ unsigned int weight = 1; ++ ++ if (sched_feat(NI_RANDOM)) { ++ /* ++ * Throw a 1k sided dice; and only run ++ * newidle_balance according to the success ++ * rate. ++ */ ++ u32 d1k = sched_rng() % 1024; ++ weight = 1 + sd->newidle_ratio; ++ if (d1k > weight) { ++ update_newidle_stats(sd, 0); ++ continue; ++ } ++ weight = (1024 + weight/2) / weight; ++ } + + pulled_task = load_balance(this_cpu, this_rq, + sd, CPU_NEWLY_IDLE, +@@ -12534,10 +12565,14 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + + t1 = sched_clock_cpu(this_cpu); + domain_cost = t1 - t0; +- update_newidle_cost(sd, domain_cost); +- + curr_cost += domain_cost; + t0 = t1; ++ ++ /* ++ * Track max cost of a domain to make sure to not delay the ++ * next wakeup on the CPU. ++ */ ++ update_newidle_cost(sd, domain_cost, weight * !!pulled_task); + } + + /* +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 578cd5ed2b93..0198f4e97d24 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -117,3 +117,8 @@ SCHED_FEAT(STEAL, false) + SCHED_FEAT(SIS_NODE, false) + SCHED_FEAT(TEST_STEAL_PLUS, false) + SCHED_FEAT(TEST_STEAL_PLUS_IDLE, false) ++ ++/* ++ * Do newidle balancing proportional to its success rate using randomization. ++ */ ++SCHED_FEAT(NI_RANDOM, true) +\ No newline at end of file +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index 8940656dac3d..1f5ea2538515 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -4,6 +4,7 @@ + */ + #include <linux/sched.h> + ++#include <linux/prandom.h> + #include <linux/sched/autogroup.h> + #include <linux/sched/clock.h> + #include <linux/sched/coredump.h> +@@ -1196,6 +1197,12 @@ static inline bool is_migration_disabled(struct task_struct *p) + } + + DECLARE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); ++DECLARE_PER_CPU(struct rnd_state, sched_rnd_state); ++ ++static inline u32 sched_rng(void) ++{ ++ return prandom_u32_state(this_cpu_ptr(&sched_rnd_state)); ++} + + #define cpu_rq(cpu) (&per_cpu(runqueues, (cpu))) + #define this_rq() this_cpu_ptr(&runqueues) +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index 6576bf380086..cb82bbc4fb41 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -1822,6 +1822,12 @@ sd_init(struct sched_domain_topology_level *tl, + + .last_balance = jiffies, + .balance_interval = sd_weight, ++ ++ /* 50% success rate */ ++ .newidle_call = 512, ++ .newidle_success = 256, ++ .newidle_ratio = 512, ++ + .max_newidle_lb_cost = 0, + .last_decay_max_lb_cost = jiffies, + .child = child, +-- +2.34.1 + diff --git a/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch b/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch new file mode 100644 index 000000000000..4ab477726400 --- /dev/null +++ b/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch @@ -0,0 +1,133 @@ +From 069a09a4f06e2a05e933dc58bbeb8c66fcd75572 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <peterz(a)infradead.org> +Date: Tue, 27 Jan 2026 16:17:48 +0100 +Subject: [PATCH OLK-6.6 2/2] sched/fair: More complex proportional newidle + balance + +It turns out that a few workloads (easyWave, fio) have a fairly low +success rate on newidle balance, but still benefit greatly from having +it anyway. + +Luckliky these workloads have a faily low newidle rate, so the cost if +doing the newidle is relatively low, even if unsuccessfull. + +Add a simple rate based part to the newidle ratio compute, such that +low rate newidle will still have a high newidle ratio. + +This cures the easyWave and fio workloads while not affecting the +schbench numbers either (which have a very high newidle rate). + +Reported-by: Mario Roy <marioeroy(a)gmail.com> +Reported-by: "Mohamed Abuelfotoh, Hazem" <abuehaze(a)amazon.com> +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Tested-by: Mario Roy <marioeroy(a)gmail.com> +Tested-by: "Mohamed Abuelfotoh, Hazem" <abuehaze(a)amazon.com> +Link: https://patch.msgid.link/20260127151748.GA1079264@noisy.programming.kicks-a… +Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> +--- + include/linux/sched/topology.h | 1 + + kernel/sched/fair.c | 27 +++++++++++++++++++++++++-- + kernel/sched/features.h | 3 ++- + kernel/sched/topology.c | 3 +++ + 4 files changed, 31 insertions(+), 3 deletions(-) + +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index ab45a04061fb..d66e6c6c2cdf 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -134,6 +134,7 @@ struct sched_domain { + unsigned int newidle_call; + unsigned int newidle_success; + unsigned int newidle_ratio; ++ u64 newidle_stamp; + u64 max_newidle_lb_cost; + unsigned long last_decay_max_lb_cost; + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 31a1f7734332..ec40e79802bd 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -11846,7 +11846,30 @@ static inline void update_newidle_stats(struct sched_domain *sd, unsigned int su + sd->newidle_success += success; + + if (sd->newidle_call >= 1024) { +- sd->newidle_ratio = sd->newidle_success; ++ u64 now = sched_clock(); ++ s64 delta = now - sd->newidle_stamp; ++ sd->newidle_stamp = now; ++ int ratio = 0; ++ ++ if (delta < 0) ++ delta = 0; ++ ++ if (sched_feat(NI_RATE)) { ++ /* ++ * ratio delta freq ++ * ++ * 1024 - 4 s - 128 Hz ++ * 512 - 2 s - 256 Hz ++ * 256 - 1 s - 512 Hz ++ * 128 - .5 s - 1024 Hz ++ * 64 - .25 s - 2048 Hz ++ */ ++ ratio = delta >> 22; ++ } ++ ++ ratio += sd->newidle_success; ++ ++ sd->newidle_ratio = min(1024, ratio); + sd->newidle_call /= 2; + sd->newidle_success /= 2; + } +@@ -12544,7 +12567,7 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + if (sd->flags & SD_BALANCE_NEWIDLE) { + unsigned int weight = 1; + +- if (sched_feat(NI_RANDOM)) { ++ if (sched_feat(NI_RANDOM) && sd->newidle_ratio < 1024) { + /* + * Throw a 1k sided dice; and only run + * newidle_balance according to the success +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 0198f4e97d24..9a8b6f41f4cb 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -121,4 +121,5 @@ SCHED_FEAT(TEST_STEAL_PLUS_IDLE, false) + /* + * Do newidle balancing proportional to its success rate using randomization. + */ +-SCHED_FEAT(NI_RANDOM, true) +\ No newline at end of file ++SCHED_FEAT(NI_RANDOM, true) ++SCHED_FEAT(NI_RATE, true) +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index cb82bbc4fb41..ac198e940978 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -4,6 +4,7 @@ + */ + #include "sched.h" + #include "sparsemask.h" ++#include <linux/sched/clock.h> + + DEFINE_MUTEX(sched_domains_mutex); + +@@ -1783,6 +1784,7 @@ sd_init(struct sched_domain_topology_level *tl, + struct sched_domain *sd = *per_cpu_ptr(sdd->sd, cpu); + int sd_id, sd_weight, sd_flags = 0; + struct cpumask *sd_span; ++ u64 now = sched_clock(); + + #ifdef CONFIG_NUMA + /* +@@ -1827,6 +1829,7 @@ sd_init(struct sched_domain_topology_level *tl, + .newidle_call = 512, + .newidle_success = 256, + .newidle_ratio = 512, ++ .newidle_stamp = now, + + .max_newidle_lb_cost = 0, + .last_decay_max_lb_cost = jiffies, +-- +2.34.1 + -- 2.34.1

2 1

[PATCH OLK-6.6] Add NI_RANDOM
by Luo Gengkun 14 Oct '26

14 Oct '26

Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- NI/0000-cover-letter.patch | 21 ++ ...ed-fair-Proportional-newidle-balance.patch | 208 ++++++++++++++++++ ...complex-proportional-newidle-balance.patch | 133 +++++++++++ 3 files changed, 362 insertions(+) create mode 100644 NI/0000-cover-letter.patch create mode 100644 NI/0001-sched-fair-Proportional-newidle-balance.patch create mode 100644 NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch diff --git a/NI/0000-cover-letter.patch b/NI/0000-cover-letter.patch new file mode 100644 index 000000000000..b66e2ead869c --- /dev/null +++ b/NI/0000-cover-letter.patch @@ -0,0 +1,21 @@ +From 069a09a4f06e2a05e933dc58bbeb8c66fcd75572 Mon Sep 17 00:00:00 2001 +From: Luo Gengkun <luogengkun2(a)huawei.com> +Date: Wed, 14 Oct 2026 01:35:24 +0000 +Subject: [PATCH OLK-6.6 0/2] Backport NI_RANDOM for 5.15 + + +Peter Zijlstra (2): + sched/fair: Proportional newidle balance + sched/fair: More complex proportional newidle balance + + include/linux/sched/topology.h | 4 +++ + kernel/sched/core.c | 3 ++ + kernel/sched/fair.c | 66 +++++++++++++++++++++++++++++++--- + kernel/sched/features.h | 6 ++++ + kernel/sched/sched.h | 7 ++++ + kernel/sched/topology.c | 9 +++++ + 6 files changed, 91 insertions(+), 4 deletions(-) + +-- +2.34.1 + diff --git a/NI/0001-sched-fair-Proportional-newidle-balance.patch b/NI/0001-sched-fair-Proportional-newidle-balance.patch new file mode 100644 index 000000000000..09ab81d809ff --- /dev/null +++ b/NI/0001-sched-fair-Proportional-newidle-balance.patch @@ -0,0 +1,208 @@ +From ccfc9b017997ffc44398363c85721a67c56533df Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <peterz(a)infradead.org> +Date: Fri, 7 Nov 2025 17:01:31 +0100 +Subject: [PATCH OLK-6.6 1/2] sched/fair: Proportional newidle balance + +Add a randomized algorithm that runs newidle balancing proportional to +its success rate. + +This improves schbench significantly: + + 6.18-rc4: 2.22 Mrps/s + 6.18-rc4+revert: 2.04 Mrps/s + 6.18-rc4+revert+random: 2.18 Mrps/S + +Conversely, per Adam Li this affects SpecJBB slightly, reducing it by 1%: + + 6.17: -6% + 6.17+revert: 0% + 6.17+revert+random: -1% + +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> +Tested-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> +Tested-by: Chris Mason <clm(a)meta.com> +Link: https://lkml.kernel.org/r/6825c50d-7fa7-45d8-9b81-c6e7e25738e2@meta.com +Link: https://patch.msgid.link/20251107161739.770122091@infradead.org +Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> +--- + include/linux/sched/topology.h | 3 +++ + kernel/sched/core.c | 3 +++ + kernel/sched/fair.c | 43 ++++++++++++++++++++++++++++++---- + kernel/sched/features.h | 5 ++++ + kernel/sched/sched.h | 7 ++++++ + kernel/sched/topology.c | 6 +++++ + 6 files changed, 63 insertions(+), 4 deletions(-) + +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index f0caa9e1a3c2..ab45a04061fb 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -131,6 +131,9 @@ struct sched_domain { + unsigned int nr_balance_failed; /* initialise to 0 */ + + /* idle_balance() stats */ ++ unsigned int newidle_call; ++ unsigned int newidle_success; ++ unsigned int newidle_ratio; + u64 max_newidle_lb_cost; + unsigned long last_decay_max_lb_cost; + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 981652b0d14c..5b486736bd5d 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -46,6 +46,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_util_est_se_tp); + EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); + + DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); ++DEFINE_PER_CPU(struct rnd_state, sched_rnd_state); + + #ifdef CONFIG_SCHED_DEBUG + /* +@@ -9335,6 +9336,8 @@ void __init sched_init_smp(void) + { + sched_init_numa(); + ++ prandom_init_once(&sched_rnd_state); ++ + /* + * There's no userspace yet to cause hotplug operations; hence all the + * CPU masks are stable and all blatant races in the below code cannot +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index fb01890861eb..31a1f7734332 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -11840,8 +11840,23 @@ void update_max_interval(void) + max_load_balance_interval = HZ*num_online_cpus()/10; + } + +-static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost) ++static inline void update_newidle_stats(struct sched_domain *sd, unsigned int success) + { ++ sd->newidle_call++; ++ sd->newidle_success += success; ++ ++ if (sd->newidle_call >= 1024) { ++ sd->newidle_ratio = sd->newidle_success; ++ sd->newidle_call /= 2; ++ sd->newidle_success /= 2; ++ } ++} ++ ++static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost, unsigned int success) ++{ ++ if (cost) ++ update_newidle_stats(sd, success); ++ + if (cost > sd->max_newidle_lb_cost) { + /* + * Track max cost of a domain to make sure to not delay the +@@ -11889,7 +11904,7 @@ static void rebalance_domains(struct rq *rq, enum cpu_idle_type idle) + * Decay the newidle max times here because this is a regular + * visit to all the domains. + */ +- need_decay = update_newidle_cost(sd, 0); ++ need_decay = update_newidle_cost(sd, 0, 0); + max_cost += sd->max_newidle_lb_cost; + + /* +@@ -12527,6 +12542,22 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + break; + + if (sd->flags & SD_BALANCE_NEWIDLE) { ++ unsigned int weight = 1; ++ ++ if (sched_feat(NI_RANDOM)) { ++ /* ++ * Throw a 1k sided dice; and only run ++ * newidle_balance according to the success ++ * rate. ++ */ ++ u32 d1k = sched_rng() % 1024; ++ weight = 1 + sd->newidle_ratio; ++ if (d1k > weight) { ++ update_newidle_stats(sd, 0); ++ continue; ++ } ++ weight = (1024 + weight/2) / weight; ++ } + + pulled_task = load_balance(this_cpu, this_rq, + sd, CPU_NEWLY_IDLE, +@@ -12534,10 +12565,14 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + + t1 = sched_clock_cpu(this_cpu); + domain_cost = t1 - t0; +- update_newidle_cost(sd, domain_cost); +- + curr_cost += domain_cost; + t0 = t1; ++ ++ /* ++ * Track max cost of a domain to make sure to not delay the ++ * next wakeup on the CPU. ++ */ ++ update_newidle_cost(sd, domain_cost, weight * !!pulled_task); + } + + /* +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 578cd5ed2b93..0198f4e97d24 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -117,3 +117,8 @@ SCHED_FEAT(STEAL, false) + SCHED_FEAT(SIS_NODE, false) + SCHED_FEAT(TEST_STEAL_PLUS, false) + SCHED_FEAT(TEST_STEAL_PLUS_IDLE, false) ++ ++/* ++ * Do newidle balancing proportional to its success rate using randomization. ++ */ ++SCHED_FEAT(NI_RANDOM, true) +\ No newline at end of file +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index 8940656dac3d..1f5ea2538515 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -4,6 +4,7 @@ + */ + #include <linux/sched.h> + ++#include <linux/prandom.h> + #include <linux/sched/autogroup.h> + #include <linux/sched/clock.h> + #include <linux/sched/coredump.h> +@@ -1196,6 +1197,12 @@ static inline bool is_migration_disabled(struct task_struct *p) + } + + DECLARE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); ++DECLARE_PER_CPU(struct rnd_state, sched_rnd_state); ++ ++static inline u32 sched_rng(void) ++{ ++ return prandom_u32_state(this_cpu_ptr(&sched_rnd_state)); ++} + + #define cpu_rq(cpu) (&per_cpu(runqueues, (cpu))) + #define this_rq() this_cpu_ptr(&runqueues) +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index 6576bf380086..cb82bbc4fb41 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -1822,6 +1822,12 @@ sd_init(struct sched_domain_topology_level *tl, + + .last_balance = jiffies, + .balance_interval = sd_weight, ++ ++ /* 50% success rate */ ++ .newidle_call = 512, ++ .newidle_success = 256, ++ .newidle_ratio = 512, ++ + .max_newidle_lb_cost = 0, + .last_decay_max_lb_cost = jiffies, + .child = child, +-- +2.34.1 + diff --git a/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch b/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch new file mode 100644 index 000000000000..4ab477726400 --- /dev/null +++ b/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch @@ -0,0 +1,133 @@ +From 069a09a4f06e2a05e933dc58bbeb8c66fcd75572 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <peterz(a)infradead.org> +Date: Tue, 27 Jan 2026 16:17:48 +0100 +Subject: [PATCH OLK-6.6 2/2] sched/fair: More complex proportional newidle + balance + +It turns out that a few workloads (easyWave, fio) have a fairly low +success rate on newidle balance, but still benefit greatly from having +it anyway. + +Luckliky these workloads have a faily low newidle rate, so the cost if +doing the newidle is relatively low, even if unsuccessfull. + +Add a simple rate based part to the newidle ratio compute, such that +low rate newidle will still have a high newidle ratio. + +This cures the easyWave and fio workloads while not affecting the +schbench numbers either (which have a very high newidle rate). + +Reported-by: Mario Roy <marioeroy(a)gmail.com> +Reported-by: "Mohamed Abuelfotoh, Hazem" <abuehaze(a)amazon.com> +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Tested-by: Mario Roy <marioeroy(a)gmail.com> +Tested-by: "Mohamed Abuelfotoh, Hazem" <abuehaze(a)amazon.com> +Link: https://patch.msgid.link/20260127151748.GA1079264@noisy.programming.kicks-a… +Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> +--- + include/linux/sched/topology.h | 1 + + kernel/sched/fair.c | 27 +++++++++++++++++++++++++-- + kernel/sched/features.h | 3 ++- + kernel/sched/topology.c | 3 +++ + 4 files changed, 31 insertions(+), 3 deletions(-) + +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index ab45a04061fb..d66e6c6c2cdf 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -134,6 +134,7 @@ struct sched_domain { + unsigned int newidle_call; + unsigned int newidle_success; + unsigned int newidle_ratio; ++ u64 newidle_stamp; + u64 max_newidle_lb_cost; + unsigned long last_decay_max_lb_cost; + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 31a1f7734332..ec40e79802bd 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -11846,7 +11846,30 @@ static inline void update_newidle_stats(struct sched_domain *sd, unsigned int su + sd->newidle_success += success; + + if (sd->newidle_call >= 1024) { +- sd->newidle_ratio = sd->newidle_success; ++ u64 now = sched_clock(); ++ s64 delta = now - sd->newidle_stamp; ++ sd->newidle_stamp = now; ++ int ratio = 0; ++ ++ if (delta < 0) ++ delta = 0; ++ ++ if (sched_feat(NI_RATE)) { ++ /* ++ * ratio delta freq ++ * ++ * 1024 - 4 s - 128 Hz ++ * 512 - 2 s - 256 Hz ++ * 256 - 1 s - 512 Hz ++ * 128 - .5 s - 1024 Hz ++ * 64 - .25 s - 2048 Hz ++ */ ++ ratio = delta >> 22; ++ } ++ ++ ratio += sd->newidle_success; ++ ++ sd->newidle_ratio = min(1024, ratio); + sd->newidle_call /= 2; + sd->newidle_success /= 2; + } +@@ -12544,7 +12567,7 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + if (sd->flags & SD_BALANCE_NEWIDLE) { + unsigned int weight = 1; + +- if (sched_feat(NI_RANDOM)) { ++ if (sched_feat(NI_RANDOM) && sd->newidle_ratio < 1024) { + /* + * Throw a 1k sided dice; and only run + * newidle_balance according to the success +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 0198f4e97d24..9a8b6f41f4cb 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -121,4 +121,5 @@ SCHED_FEAT(TEST_STEAL_PLUS_IDLE, false) + /* + * Do newidle balancing proportional to its success rate using randomization. + */ +-SCHED_FEAT(NI_RANDOM, true) +\ No newline at end of file ++SCHED_FEAT(NI_RANDOM, true) ++SCHED_FEAT(NI_RATE, true) +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index cb82bbc4fb41..ac198e940978 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -4,6 +4,7 @@ + */ + #include "sched.h" + #include "sparsemask.h" ++#include <linux/sched/clock.h> + + DEFINE_MUTEX(sched_domains_mutex); + +@@ -1783,6 +1784,7 @@ sd_init(struct sched_domain_topology_level *tl, + struct sched_domain *sd = *per_cpu_ptr(sdd->sd, cpu); + int sd_id, sd_weight, sd_flags = 0; + struct cpumask *sd_span; ++ u64 now = sched_clock(); + + #ifdef CONFIG_NUMA + /* +@@ -1827,6 +1829,7 @@ sd_init(struct sched_domain_topology_level *tl, + .newidle_call = 512, + .newidle_success = 256, + .newidle_ratio = 512, ++ .newidle_stamp = now, + + .max_newidle_lb_cost = 0, + .last_decay_max_lb_cost = jiffies, +-- +2.34.1 + -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Backport NI_RANDOM for 5.15
by Luo Gengkun 14 Oct '26

14 Oct '26

Peter Zijlstra (2): sched/fair: Proportional newidle balance sched/fair: More complex proportional newidle balance include/linux/sched/topology.h | 4 +++ kernel/sched/core.c | 3 ++ kernel/sched/fair.c | 66 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 6 ++++ kernel/sched/sched.h | 7 ++++ kernel/sched/topology.c | 9 +++++ 6 files changed, 91 insertions(+), 4 deletions(-) -- 2.34.1

1 0

[PATCH OLK-6.6 0/1] KVM: arm64: Fix kernel panic due to uninitialized fpmr pointer
by Qinxin Xia 14 Oct '26

14 Oct '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- When the hardware implements FEAT_FPMR but CONFIG_ENABLE_KVM_FPMR is not set in the kernel config, starting a VM crashes the host with the following panic: | Unable to handle kernel paging request at virtual address d6d0b7173a7d8b80 | Mem abort info: | ESR = 0x0000000096000044 | EC = 0x25: DABT (current EL), IL = 32 bits | FSC = 0x04: level 0 translation fault | CM = 0, WnR = 1, TnD = 0, TagAccess = 0 | [d6d0b7173a7d8b80] address between user and kernel address ranges | pc : fpsimd_save+0xd0/0x160 | lr : fpsimd_save+0x38/0x160 | Call trace: | fpsimd_save+0xd0/0x160 | fpsimd_save_and_flush_cpu_state+0x34/0xa8 | kvm_arch_vcpu_put_fp+0xf0/0x250 | kvm_arch_vcpu_put+0x44/0xf0 | vcpu_put+0x20/0x50 | kvm_arch_vcpu_ioctl_run+0x70/0x630 | Kernel panic - not syncing: Oops: Fatal exception The root cause is an asymmetric gating of the FPMR context switch introduced when backporting upstream FPMR support: - The consumer side (fpsimd_save()) saves FPMR whenever the hardware capability is detected at runtime: if (system_supports_fpmr()) *(last->fpmr) = read_sysreg_s(SYS_FPMR); - The producer side (kvm_arch_vcpu_ctxsync_fp()) only assigns fp_state.fpmr under #ifdef CONFIG_ENABLE_KVM_FPMR, while the struct cpu_fp_state stack variable is left uninitialized. With the config disabled, fpsimd_bind_state_to_cpu() binds stack garbage into the per-CPU fpsimd_last_state.fpmr, and the first guest exit writes FPMR to this garbage pointer, causing the above level 0 translation fault. Qinxin Xia (1): KVM: arm64: Fix kernel panic due to uninitialized fpmr pointer arch/arm64/kernel/fpsimd.c | 2 +- arch/arm64/kvm/fpsimd.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) -- 2.33.0

2 2