- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] arm64: perf: Add support for HIP12 hw metric
by Yushan Wang 26 Aug '25

26 Aug '25

From: Yicong Yang <yangyicong(a)hisilicon.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICFKG8 ---------------------------------------------------------------------- HIP12 provides hardware metric sampling with adjacent counters counter_2n and counter_2n+1. Overflow of counter_2n+1 will result in an interrupt while overflow of counter_2n will load initial value, which are stored in dedicated registers reload_counter_2n and reload_counter_2n+1, to both counters. With the ability above, software could only perform sampling during handling interrupt of counter_2n and configure different values of reload_counter_2n and reload_counter_2n+1, which realizes hardware metric sampling. For example, perf record -e '\ {armv8_pmuv3_0/cpu_cycles,period=1000000,hw_metric=1/, \ armv8_pmuv3_0/inst_retired,period=800000,hw_metric=1/}:u' \ -- <workload> Above command will only perform sampling when IPC < 800000 / 1000000, since the interrupt will only appear when cpu_cycles reaches 1000000 and inst_retired is less than 800000. Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Yushan Wang <wangyushan(a)hisilicon.com> Signed-off-by: Qizhi Zhang <zhangqizhi3(a)h-partners.com> --- arch/arm64/configs/openeuler_defconfig | 1 + drivers/perf/Kconfig | 7 + drivers/perf/arm_pmu.c | 9 ++ drivers/perf/arm_pmuv3.c | 207 ++++++++++++++++++++++++- 4 files changed, 222 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index f25dd0bd7790..ee5d7760aaf5 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6912,6 +6912,7 @@ CONFIG_ARM_PMU_ACPI=y CONFIG_ARM_SMMU_V3_PMU=m CONFIG_ARM_PMUV3=y CONFIG_ARM64_BRBE=y +CONFIG_HISILICON_HW_METRIC=y # CONFIG_ARM_DSU_PMU is not set CONFIG_QCOM_L2_PMU=y CONFIG_QCOM_L3_PMU=y diff --git a/drivers/perf/Kconfig b/drivers/perf/Kconfig index 7b7b15f9bb6f..f608c2e66235 100644 --- a/drivers/perf/Kconfig +++ b/drivers/perf/Kconfig @@ -246,4 +246,11 @@ config CXL_PMU If unsure say 'm'. +config HISILICON_HW_METRIC + bool "HiSilicon hardware metric sampling support" + depends on ARM64 + help + Support hardware metric that allows filter of sampling for specific + sampling period ratio. + endmenu diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c index 247b038ff4d9..9a97651b7afb 100644 --- a/drivers/perf/arm_pmu.c +++ b/drivers/perf/arm_pmu.c @@ -422,6 +422,15 @@ validate_group(struct perf_event *event) */ memset(&fake_pmu.used_mask, 0, sizeof(fake_pmu.used_mask)); + +#ifdef CONFIG_HISILICON_HW_METRIC + /* + * Make percpu_pmu null so that PMU might get a chance to know if + * get_event_idx is called for validation. + */ + fake_pmu.percpu_pmu = NULL; +#endif + if (!validate_event(event->pmu, &fake_pmu, leader)) return -EINVAL; diff --git a/drivers/perf/arm_pmuv3.c b/drivers/perf/arm_pmuv3.c index c51206684863..29a659d5a273 100644 --- a/drivers/perf/arm_pmuv3.c +++ b/drivers/perf/arm_pmuv3.c @@ -320,6 +320,12 @@ static const struct attribute_group armv8_pmuv3_events_attr_group = { #define ATTR_CFG_FLD_threshold_LO 5 #define ATTR_CFG_FLD_threshold_HI 16 +#ifdef CONFIG_HISILICON_HW_METRIC +#define ATTR_CFG_FLD_hw_metric_CFG config2 +#define ATTR_CFG_FLD_hw_metric_LO 0 +#define ATTR_CFG_FLD_hw_metric_HI 0 +#endif + GEN_PMU_FORMAT_ATTR(event); GEN_PMU_FORMAT_ATTR(long); GEN_PMU_FORMAT_ATTR(rdpmc); @@ -327,6 +333,10 @@ GEN_PMU_FORMAT_ATTR(threshold_count); GEN_PMU_FORMAT_ATTR(threshold_compare); GEN_PMU_FORMAT_ATTR(threshold); +#ifdef CONFIG_HISILICON_HW_METRIC +GEN_PMU_FORMAT_ATTR(hw_metric); +#endif + static int sysctl_perf_user_access __read_mostly; static bool armv8pmu_event_is_64bit(struct perf_event *event) @@ -358,6 +368,29 @@ static u8 armv8pmu_event_threshold_control(struct perf_event_attr *attr) return (th_compare << 1) | th_count; } +#ifdef CONFIG_HISILICON_HW_METRIC +static inline bool armv8pmu_event_is_hw_metric(struct perf_event *event) +{ + return ATTR_CFG_GET_FLD(&event->attr, hw_metric); +} + +static bool armpmu_support_hisi_hw_metric(void) +{ + static const struct midr_range hip12_cpus[] = { + MIDR_ALL_VERSIONS(MIDR_HISI_HIP12), + { } + }; + + /* + * Feature of hw metric requires access to EL1 registers to accomplish, + * which will cause kernel panic in virtual machine because of lack of + * authority. Thus, this feature is banned for virtual machines. + */ + return is_midr_in_range_list(read_cpuid_id(), hip12_cpus) && + is_kernel_in_hyp_mode(); +} +#endif + static struct attribute *armv8_pmuv3_format_attrs[] = { &format_attr_event.attr, &format_attr_long.attr, @@ -365,11 +398,29 @@ static struct attribute *armv8_pmuv3_format_attrs[] = { &format_attr_threshold.attr, &format_attr_threshold_compare.attr, &format_attr_threshold_count.attr, +#ifdef CONFIG_HISILICON_HW_METRIC + &format_attr_hw_metric.attr, +#endif NULL, }; +#ifdef CONFIG_HISILICON_HW_METRIC +static umode_t +armv8pmu_format_attr_is_visible(struct kobject *kobj, + struct attribute *attr, int unused) +{ + if (attr == &format_attr_hw_metric.attr && !armpmu_support_hisi_hw_metric()) + return 0; + + return attr->mode; +} +#endif + static const struct attribute_group armv8_pmuv3_format_attr_group = { .name = "format", +#ifdef CONFIG_HISILICON_HW_METRIC + .is_visible = armv8pmu_format_attr_is_visible, +#endif .attrs = armv8_pmuv3_format_attrs, }; @@ -603,6 +654,41 @@ static void armv8pmu_write_evcntr(int idx, u64 value) write_pmevcntrn(counter, value); } +#ifdef CONFIG_HISILICON_HW_METRIC +static inline void armv8pmu_write_reload_counter(struct perf_event *event, + u64 value) +{ + /* Need to be event->hw.idx - 1 since counter 0 is PMCCNTR_EL0 */ + int idx = event->hw.idx - 1; + +#define HW_METRIC_RELOAD_CNTR(n) sys_reg(3, 3, 15, 3, (2 + n)) +#define write_hw_metric_reload_cntr(_value, _n) \ + do { \ + switch (_n) { \ + case 0: \ + write_sysreg_s(_value, HW_METRIC_RELOAD_CNTR(0)); break; \ + case 1: \ + write_sysreg_s(_value, HW_METRIC_RELOAD_CNTR(1)); break; \ + case 2: \ + write_sysreg_s(_value, HW_METRIC_RELOAD_CNTR(2)); break; \ + case 3: \ + write_sysreg_s(_value, HW_METRIC_RELOAD_CNTR(3)); break; \ + case 4: \ + write_sysreg_s(_value, HW_METRIC_RELOAD_CNTR(4)); break; \ + case 5: \ + write_sysreg_s(_value, HW_METRIC_RELOAD_CNTR(5)); break; \ + default: \ + WARN(1, "Invalid hw_metric reload counter index\n"); \ + dev_err(event->pmu->dev, "event is 0x%lx index is %x\n",\ + event->hw.config_base, event->hw.idx); \ + } \ + } while (0) + write_hw_metric_reload_cntr(value, idx); +#undef write_hw_metric_reload_cntr +#undef HW_METRIC_RELOAD_CNTR +} +#endif + static void armv8pmu_write_hw_counter(struct perf_event *event, u64 value) { @@ -614,6 +700,11 @@ static void armv8pmu_write_hw_counter(struct perf_event *event, } else { armv8pmu_write_evcntr(idx, value); } + +#ifdef CONFIG_HISILICON_HW_METRIC + if (armv8pmu_event_is_hw_metric(event)) + armv8pmu_write_reload_counter(event, value); +#endif } static void armv8pmu_write_counter(struct perf_event *event, u64 value) @@ -688,6 +779,38 @@ static void armv8pmu_enable_counter(u32 mask) write_pmcntenset(mask); } +#ifdef CONFIG_HISILICON_HW_METRIC +static inline void armv8pmu_enable_hw_metric(struct perf_event *event, bool enable) +{ + int idx = event->hw.idx; + u64 reg; + + /* + * Configure the chicken bit on leader event enabling. + */ + if (event != event->group_leader) + return; + + /* Convert the idx since we only use general counters, counter 0 is + * used for PMCCNTR_EL0. + */ + idx -= 1; + +#define HISI_DTU_CTLR_EL1 sys_reg(3, 0, 15, 8, 4) +#define HISI_DTU_CTLR_EL1_CHK_GROUP0 BIT(15) + + reg = read_sysreg_s(HISI_DTU_CTLR_EL1); + if (enable) + reg |= HISI_DTU_CTLR_EL1_CHK_GROUP0 << (idx >> 1); + else + reg &= ~(HISI_DTU_CTLR_EL1_CHK_GROUP0 << (idx >> 1)); + + write_sysreg_s(reg, HISI_DTU_CTLR_EL1); + + reg = read_sysreg_s(HISI_DTU_CTLR_EL1); +} +#endif + static void armv8pmu_enable_event_counter(struct perf_event *event) { struct perf_event_attr *attr = &event->attr; @@ -696,8 +819,14 @@ static void armv8pmu_enable_event_counter(struct perf_event *event) kvm_set_pmu_events(mask, attr); /* We rely on the hypervisor switch code to enable guest counters */ - if (!kvm_pmu_counter_deferred(attr)) + if (!kvm_pmu_counter_deferred(attr)) { armv8pmu_enable_counter(mask); + +#ifdef CONFIG_HISILICON_HW_METRIC + if (armv8pmu_event_is_hw_metric(event)) + armv8pmu_enable_hw_metric(event, true); +#endif + } } static void armv8pmu_disable_counter(u32 mask) @@ -718,8 +847,14 @@ static void armv8pmu_disable_event_counter(struct perf_event *event) kvm_clr_pmu_events(mask); /* We rely on the hypervisor switch code to disable guest counters */ - if (!kvm_pmu_counter_deferred(attr)) + if (!kvm_pmu_counter_deferred(attr)) { armv8pmu_disable_counter(mask); + +#ifdef CONFIG_HISILICON_HW_METRIC + if (armv8pmu_event_is_hw_metric(event)) + armv8pmu_enable_hw_metric(event, false); +#endif + } } static void armv8pmu_enable_intens(u32 mask) @@ -1005,6 +1140,61 @@ static int armv8pmu_get_chain_idx(struct pmu_hw_events *cpuc, return -EAGAIN; } +#ifdef CONFIG_HISILICON_HW_METRIC +static int armv8pmu_check_hw_metric_event(struct pmu_hw_events *cpuc, + struct perf_event *event) +{ + struct perf_event *sibling, *leader = event->group_leader; + int hw_metric_cnt = 0; + + if (cpuc->percpu_pmu) { + for_each_sibling_event(sibling, leader) { + if (armv8pmu_event_is_hw_metric(sibling)) + hw_metric_cnt++; + } + + if (hw_metric_cnt != 1) + return -EINVAL; + } else { + if (event == leader) + return 0; + + if (!armv8pmu_event_is_hw_metric(leader)) + return -EINVAL; + + for_each_sibling_event(sibling, leader) { + if (armv8pmu_event_is_hw_metric(sibling)) + hw_metric_cnt++; + } + + if (hw_metric_cnt > 0) + return -EINVAL; + } + + return 0; +} + +static int armv8pmu_get_hw_metric_event_idx(struct pmu_hw_events *cpuc, + struct perf_event *event) +{ + struct arm_pmu *cpu_pmu = to_arm_pmu(event->pmu); + struct perf_event *leader = event->group_leader; + int leader_idx; + + if (armv8pmu_check_hw_metric_event(cpuc, event)) + return -EINVAL; + + if (event == leader || leader->hw.idx < 1) + return armv8pmu_get_chain_idx(cpuc, cpu_pmu); + + leader_idx = leader->hw.idx; + if (cpuc->events[leader_idx - 1]) + return -EAGAIN; + + return leader_idx - 1; +} +#endif + static int armv8pmu_get_event_idx(struct pmu_hw_events *cpuc, struct perf_event *event) { @@ -1012,6 +1202,14 @@ static int armv8pmu_get_event_idx(struct pmu_hw_events *cpuc, struct hw_perf_event *hwc = &event->hw; unsigned long evtype = hwc->config_base & ARMV8_PMU_EVTYPE_EVENT; +#ifdef CONFIG_HISILICON_HW_METRIC + if (armv8pmu_event_is_hw_metric(event)) + return armv8pmu_get_hw_metric_event_idx(cpuc, event); + else if (event != event->group_leader && + armv8pmu_event_is_hw_metric(event->group_leader)) + return -EINVAL; +#endif + /* Always prefer to place a cycle counter into the cycle counter. */ if ((evtype == ARMV8_PMUV3_PERFCTR_CPU_CYCLES) && !armv8pmu_event_get_threshold(&event->attr)) { @@ -1235,6 +1433,11 @@ static int __armv8_pmuv3_map_event(struct perf_event *event, if (armv8pmu_event_is_64bit(event)) event->hw.flags |= ARMPMU_EVT_64BIT; +#ifdef CONFIG_HISILICON_HW_METRIC + if (armv8pmu_event_is_hw_metric(event) && !armpmu_support_hisi_hw_metric()) + return -EOPNOTSUPP; +#endif + /* * User events must be allocated into a single counter, and so * must not be chained. -- 2.33.0

2 1

[PATCH OLK-6.6 0/1] kvm: hisi_virt: Fix the socket_id of broadcast bitmap for another socket
by Jinqian Yang 26 Aug '25

26 Aug '25

Zhou Wang (1): kvm: hisi_virt: Fix the socket_id of broadcast bitmap for another socket arch/arm64/kvm/hisilicon/hisi_virt.c | 12 +++++++++--- arch/arm64/kvm/hisilicon/hisi_virt.h | 5 +++++ 2 files changed, 14 insertions(+), 3 deletions(-) -- 2.33.0

2 2

[PATCH OLK-6.6 00/11] HiSock Redirect Framework
by Pu Lehui 26 Aug '25

26 Aug '25

Pu Lehui (10): bpf: Add CONFIG_HISOCK bpf: Add XDP_HISOCK_REDIRECT action bpf: Add BPF_PROG_TYPE_HISOCK prog type bpf: Add HISOCK_EGRESS hook on network egress path bpf: Add bpf_get_ingress_dst helper bpf: Add hisock_xdp_buff wrapper for xdp_buff bpf: Add bpf_set_ingress_dst helper bpf: Add bpf_change_skb_dev helper openeuler_defconfig: Enable CONFIG_HISOCK samples/bpf: Add HiSock Redirect sample Xu Kuohai (1): bpf: Add bpf_ext_memcpy extension helper for arm64 arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/insn.h | 4 + arch/arm64/lib/insn.c | 8 + arch/arm64/net/bpf_jit.h | 15 + arch/arm64/net/bpf_jit_comp.c | 266 ++++++++++++++++ arch/x86/configs/openeuler_defconfig | 1 + include/linux/bpf-cgroup-defs.h | 3 + include/linux/bpf-cgroup.h | 25 ++ include/linux/bpf_types.h | 4 + include/linux/filter.h | 3 + include/net/xdp.h | 5 + include/uapi/linux/bpf.h | 45 +++ kernel/bpf/cgroup.c | 43 +++ kernel/bpf/core.c | 7 + kernel/bpf/helpers.c | 27 ++ kernel/bpf/syscall.c | 19 ++ kernel/bpf/verifier.c | 27 ++ net/Kconfig | 10 + net/core/dev.c | 76 ++++- net/core/filter.c | 182 +++++++++++ net/ipv4/ip_output.c | 68 +++++ samples/bpf/.gitignore | 1 + samples/bpf/Makefile | 3 + samples/bpf/hisock/bpf.c | 247 +++++++++++++++ samples/bpf/hisock/hisock_cmd.c | 405 +++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 45 +++ tools/lib/bpf/libbpf.c | 3 + 27 files changed, 1540 insertions(+), 3 deletions(-) create mode 100644 samples/bpf/hisock/bpf.c create mode 100644 samples/bpf/hisock/hisock_cmd.c -- 2.34.1

2 12

[PATCH OLK-5.10 0/2] CVE-2025-37834
by Jinjiang Tu 26 Aug '25

26 Aug '25

Jinjiang Tu (2): mm/vmscan: don't try to reclaim hwpoison folio mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list mm/vmscan.c | 10 ++++++++++ 1 file changed, 10 insertions(+) -- 2.43.0

2 3

[PATCH OLK-6.6] iBMA: Fix veth soft lockup by adding DMA-pre-readl sync
by linan666＠huaweicloud.com 26 Aug '25

26 Aug '25

From: Huangjunhua <huangjunhua14(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICUK85 CVE: NA ----------------------------------------- Fix soft lockup during large file transfers over veth interfaces in Taishan 500(Model 2280) environments by adding a readl operation prior to DMA initiation. This guarantees proper synchronization of Send Queue buffer descriptors, preventing descriptor corruption that caused system hangs. Fixes: 85502a982830 ("Huawei iBMA: Added support for Hi1712 Chip") Signed-off-by: Huangjunhua <huangjunhua14(a)huawei.com> --- drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c b/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c index 678262f7412c..94e63d3ee9dd 100644 --- a/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c +++ b/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c @@ -406,6 +406,12 @@ static s32 submit_dma_queue_sq(u32 dir, struct bspveth_dmal pdmalbase_v, u32 pf) BMA_LOG(DLOG_DEBUG, "submit dma queue sq, sq_tail change %d,\n", sq_tail); wmb(); /* memory barriers. */ + /* readl last u32 of sq buffer descriptor to confirm the sq buffer descriptor + * write to local sq + */ + (void)readl((void __iomem *)(p_dma_sq + sq_tail + sizeof(struct dma_ch_sq_s) + - sizeof(u32))); + (void)set_dma_queue_sq_tail(sq_tail); return 0; -- 2.33.0

2 1

[PATCH OLK-5.10 0/6] fix some CVEs
by Jinjiang Tu 26 Aug '25

26 Aug '25

Guixin Liu (1): scsi: ufs: bsg: Set bsg_queue to NULL after removal Haoxiang Li (1): rapidio: fix an API misues when rio_add_net() fails Ivan Stepchenko (1): drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table Marco Nelissen (1): filemap: avoid truncating 64-bit offset to 32 bits Sean Christopherson (1): KVM: x86: Reset IRTE to host control if *new* route isn't postable Yongzhi Liu (1): drm/amd/display: Fix memory leak arch/x86/kvm/svm/avic.c | 58 ++++++++------- arch/x86/kvm/vmx/posted_intr.c | 28 +++----- .../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 72 ++++++++++++++----- .../drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 2 + drivers/rapidio/devices/rio_mport_cdev.c | 3 +- drivers/scsi/ufs/ufs_bsg.c | 1 + mm/filemap.c | 2 +- 7 files changed, 101 insertions(+), 65 deletions(-) -- 2.43.0

2 7

[PATCH OLK-5.10] mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
by Jinjiang Tu 26 Aug '25

26 Aug '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.16-rc1 commit 1013af4f585fccc4d3e5c5824d174de2257f7d6d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICIQAF CVE: CVE-2025-38085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed. If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected. Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse. Link: https://lkml.kernel.org/r/20250528-hugetlb-fixes-splitrace-v2-2-1329349bad1… Link: https://lkml.kernel.org/r/20250527-hugetlb-fixes-splitrace-v1-2-f4136f5ec58… Fixes: 39dde65c9940 ("[PATCH] shared page table for hugetlb page") Signed-off-by: Jann Horn <jannh(a)google.com> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/hugetlb.c [Context conflicts.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/hugetlb.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index bed9f05ecaf1..32b7ee895315 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -6001,6 +6001,13 @@ int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, return 0; pud_clear(pud); + /* + * Once our caller drops the rmap lock, some other process might be + * using this page table as a normal, non-hugetlb page table. + * Wait for pending gup_fast() in other threads to finish before letting + * that happen. + */ + tlb_remove_table_sync_one(); put_page(virt_to_page(ptep)); mm_dec_nr_pmds(mm); /* -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] fix bug in hdbss
by Jinqian Yang 26 Aug '25

26 Aug '25

Jinqian Yang (2): KVM: arm64: do not support hdbss in nvhe KVM: arm64: fix memory leak in HDBSS arch/arm64/kvm/arm.c | 45 +++++++++++++++++++++++++++++--------------- 1 file changed, 30 insertions(+), 15 deletions(-) -- 2.33.0

2 3

[PATCH OLK-6.6 0/5]fix some CVE
by Tong Tiangen 26 Aug '25

26 Aug '25

Ma Wupeng (1): mm: memory-failure: update ttu flag inside unmap_poisoned_folio Michał Pecio (1): usb: xhci: Fix invalid pointer dereference in Etron workaround Neeraj Sanjay Kale (1): Bluetooth: btnxpuart: Fix kernel panic during FW release Ritesh Harjani (1): powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap Sergey Senozhatsky (1): thunderbolt: Do not double dequeue a configuration request arch/powerpc/platforms/powernv/memtrace.c | 8 ++++++-- drivers/bluetooth/btnxpuart.c | 6 ++++-- drivers/thunderbolt/ctl.c | 5 +++++ drivers/usb/host/xhci-ring.c | 2 +- mm/memory_hotplug.c | 2 +- 5 files changed, 17 insertions(+), 6 deletions(-) -- 2.25.1

2 6

[PATCH OLK-6.6] iBMA: Fix veth soft lockup by adding DMA-pre-readl sync
by linan666＠huaweicloud.com 26 Aug '25

26 Aug '25

From: Huangjunhua <huangjunhua14(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICUK85 CVE: NA ----------------------------------------- Fix soft lockup during large file transfers over veth interfaces in Taishan 500(Model 2280) environments by adding a readl operation prior to DMA initiation. This guarantees proper synchronization of Send Queue buffer descriptors, preventing descriptor corruption that caused system hangs. Signed-off-by: Huangjunhua <huangjunhua14(a)huawei.com> --- drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c b/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c index 678262f7412c..94e63d3ee9dd 100644 --- a/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c +++ b/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c @@ -406,6 +406,12 @@ static s32 submit_dma_queue_sq(u32 dir, struct bspveth_dmal pdmalbase_v, u32 pf) BMA_LOG(DLOG_DEBUG, "submit dma queue sq, sq_tail change %d,\n", sq_tail); wmb(); /* memory barriers. */ + /* readl last u32 of sq buffer descriptor to confirm the sq buffer descriptor + * write to local sq + */ + (void)readl((void __iomem *)(p_dma_sq + sq_tail + sizeof(struct dma_ch_sq_s) + - sizeof(u32))); + (void)set_dma_queue_sq_tail(sq_tail); return 0; -- 2.33.0

2 1