- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 000/452] sched_ext v1
by Zicheng Qu 03 Apr '26

03 Apr '26

Aboorva Devarajan (2): sched_ext: Documentation: Remove mentions of scx_bpf_switch_all sched: Pass correct scheduling policy to __setscheduler_class Alan Maguire (16): kbuild,bpf: Switch to using --btf_features for pahole v1.26 and later kbuild, bpf: Use test-ge check for v1.25-only pahole libbpf: Add btf__distill_base() creating split BTF with distilled base BTF selftests/bpf: Test distilled base, split BTF generation libbpf: Split BTF relocation selftests/bpf: Extend distilled BTF tests to cover BTF relocation resolve_btfids: Handle presence of .BTF.base section libbpf: BTF relocation followup fixing naming, loop logic module, bpf: Store BTF base pointer in struct module libbpf: Split field iter code into its own file kernel libbpf,bpf: Share BTF relocate-related code with kernel kbuild,bpf: Add module-specific pahole flags for distilled base BTF selftests/bpf: Add kfunc_call test for simple dtor in bpf_testmod bpf: fix build when CONFIG_DEBUG_INFO_BTF[_MODULES] is undefined libbpf: Fix error handling in btf__distill_base() libbpf: Fix license for btf_relocate.c Alexander Lobakin (1): bitops: make BYTES_TO_BITS() treewide-available Alexei Starovoitov (2): s390/bpf: Fix indirect trampoline generation bpf: Introduce "volatile compare" macros Andrea Righi (33): sched_ext: fix typo in set_weight() description sched_ext: add CONFIG_DEBUG_INFO_BTF dependency sched_ext: Provide a sysfs enable_seq counter sched_ext: improve WAKE_SYNC behavior for default idle CPU selection sched_ext: Clarify ops.select_cpu() for single-CPU tasks sched_ext: Introduce LLC awareness to the default idle selection policy sched_ext: Introduce NUMA awareness to the default idle selection policy sched_ext: Do not enable LLC/NUMA optimizations when domains overlap sched_ext: Fix incorrect use of bitwise AND MAINTAINERS: add self as reviewer for sched_ext sched_ext: idle: Refresh idle masks during idle-to-idle transitions sched_ext: Use the NUMA scheduling domain for NUMA optimizations sched_ext: idle: use assign_cpu() to update the idle cpumask sched_ext: idle: clarify comments sched_ext: idle: introduce check_builtin_idle_enabled() helper sched_ext: idle: small CPU iteration refactoring sched_ext: update scx_bpf_dsq_insert() doc for SCX_DSQ_LOCAL_ON sched_ext: Include remaining task time slice in error state dump sched_ext: Include task weight in the error state dump selftests/sched_ext: Fix enum resolution tools/sched_ext: Add helper to check task migration state sched_ext: selftests/dsp_local_on: Fix selftest on UP systems sched_ext: Fix lock imbalance in dispatch_to_local_dsq() selftests/sched_ext: Fix exit selftest hang on UP sched_ext: Move built-in idle CPU selection policy to a separate file sched_ext: Track currently locked rq sched_ext: Make scx_locked_rq() inline sched_ext: Fix missing rq lock in scx_bpf_cpuperf_set() sched/ext: Fix invalid task state transitions on class switch sched_ext: Make scx_kf_allowed_if_unlocked() available outside ext.c sched_ext: Remove duplicate BTF_ID_FLAGS definitions sched_ext: Fix rq lock state in hotplug ops sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl() Andrii Nakryiko (14): bpf: Emit global subprog name in verifier logs bpf: Validate global subprogs lazily selftests/bpf: Add lazy global subprog validation tests libbpf: Add btf__new_split() API that was declared but not implemented bpf: move sleepable flag from bpf_prog_aux to bpf_prog libbpf: Add BTF field iterator libbpf: Make use of BTF field iterator in BPF linker code libbpf: Make use of BTF field iterator in BTF handling code bpftool: Use BTF field iterator in btfgen libbpf: Remove callback-based type/string BTF field visitor helpers bpf: extract iterator argument type and name validation logic bpf: allow passing struct bpf_iter_<type> as kfunc arguments selftests/bpf: test passing iterator to a kfunc selftests/bpf: validate eliminated global subprog is not freplaceable Arnaldo Carvalho de Melo (1): tools include UAPI: Sync linux/sched.h copy with the kernel sources Atul Kumar Pant (1): sched_ext: Fixes typos in comments Benjamin Tissoires (1): bpf: introduce in_sleepable() helper Bitao Hu (4): genirq: Convert kstat_irqs to a struct genirq: Provide a snapshot mechanism for interrupt statistics watchdog/softlockup: Low-overhead detection of interrupt storm watchdog/softlockup: Report the most frequent interrupts Björn Töpel (1): selftests: sched_ext: Add sched_ext as proper selftest target Breno Leitao (3): rhashtable: Fix potential deadlock by moving schedule_work outside lock sched_ext: Use kvzalloc for large exit_dump allocation sched/ext: Prevent update_locked_rq() calls with NULL rq Changwoo Min (12): sched_ext: Clarify sched_ext_ops table for userland scheduler sched_ext: add a missing rcu_read_lock/unlock pair at scx_select_cpu_dfl() MAINTAINERS: add me as reviewer for sched_ext sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass() sched_ext: Relocate scx_enabled() related code sched_ext: Implement scx_bpf_now() sched_ext: Add scx_bpf_now() for BPF scheduler sched_ext: Add time helpers for BPF schedulers sched_ext: Replace bpf_ktime_get_ns() to scx_bpf_now() sched_ext: Use time helpers in BPF schedulers sched_ext: Fix incorrect time delta calculation in time_delta() sched_ext: Add scx_bpf_events() and scx_read_event() for BPF schedulers Cheng-Yang Chou (1): sched_ext: Always use SMP versions in kernel/sched/ext.c Christian Brauner (1): file: add take_fd() cleanup helper Christian Loehle (1): sched/fair: Remove stale FREQUENCY_UTIL comment Christophe Leroy (2): bpf: Remove arch_unprotect_bpf_trampoline() bpf: Check return from set_memory_rox() Chuyi Zhou (15): cgroup: Prepare for using css_task_iter_*() in BPF bpf: Introduce css_task open-coded iterator kfuncs bpf: Introduce task open coded iterator kfuncs bpf: Introduce css open-coded iterator kfuncs bpf: teach the verifier to enforce css_iter and task_iter in RCU CS bpf: Let bpf_iter_task_new accept null task ptr selftests/bpf: rename bpf_iter_task.c to bpf_iter_tasks.c selftests/bpf: Add tests for open-coded task and css iter bpf: Relax allowlist for css_task iter selftests/bpf: Add tests for css_task iter combining with cgroup iter selftests/bpf: Add test for using css_task iter in sleepable progs bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h. sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx Colin Ian King (1): sched_ext: Fix spelling mistake: "intead" -> "instead" Daniel Xu (3): bpf: btf: Support flags for BTF_SET8 sets bpf: btf: Add BTF_KFUNCS_START/END macro pair bpf: treewide: Annotate BPF kfuncs in BTF Dave Marchevsky (6): bpf: Don't explicitly emit BTF for struct btf_iter_num selftests/bpf: Rename bpf_iter_task_vma.c to bpf_iter_task_vmas.c bpf: Introduce task_vma open-coded iterator kfuncs selftests/bpf: Add tests for open-coded task_vma iter bpf: Add __bpf_kfunc_{start,end}_defs macros bpf: Add __bpf_hook_{start,end} macros David Vernet (15): bpf: Add ability to pin bpf timer to calling CPU selftests/bpf: Test pinning bpf timer to a core sched_ext: Implement runnable task stall watchdog sched_ext: Print sched_ext info when dumping stack sched_ext: Implement SCX_KICK_WAIT sched_ext: Implement sched_ext_ops.cpu_acquire/release() sched_ext: Add selftests bpf: Load vmlinux btf for any struct_ops map sched_ext: Make scx_bpf_cpuperf_set() @cpu arg signed scx: Allow calling sleepable kfuncs from BPF_PROG_TYPE_SYSCALL scx/selftests: Verify we can call create_dsq from prog_run sched_ext: Remove unnecessary cpu_relax() scx: Fix exit selftest to use custom DSQ scx: Fix raciness in scx_ops_bypass() scx: Fix maximal BPF selftest prog Dawei Li (1): genirq: Deduplicate interrupt descriptor initialization Devaansh Kumar (1): sched_ext: selftests: Fix grammar in tests description Devaansh-Kumar (1): sched_ext: Documentation: Update instructions for running example schedulers Eduard Zingerman (2): libbpf: Make btf_parse_elf process .BTF.base transparently selftests/bpf: Check if distilled base inherits source endianness Geliang Tang (1): bpf, btf: Check btf for register_bpf_struct_ops Henry Huang (2): sched_ext: initialize kit->cursor.flags sched_ext: keep running prev when prev->scx.slice != 0 Herbert Xu (1): rhashtable: Fix rhashtable_try_insert test Honglei Wang (3): sched_ext: use correct function name in pick_task_scx() warning message sched_ext: Add __weak to fix the build errors sched_ext: switch class when preempted by higher priority scheduler Hongyan Xia (1): sched/ext: Add BPF function to fetch rq Hou Tao (7): bpf: Free dynamically allocated bits in bpf_iter_bits_destroy() bpf: Add bpf_mem_alloc_check_size() helper bpf: Check the validity of nr_words in bpf_iter_bits_new() bpf: Use __u64 to save the bits in bits iterator selftests/bpf: Add three test cases for bits_iter selftests/bpf: Use -4095 as the bad address for bits iterator selftests/bpf: Export map_update_retriable() Ihor Solodrai (2): selftests/sched_ext: add order-only dependency of runner.o on BPFOBJ selftests/sched_ext: fix build after renames in sched_ext API Ilpo Järvinen (1): <linux/cleanup.h>: Allow the passing of both iomem and non-iomem pointers to no_free_ptr() Ingo Molnar (3): sched/syscalls: Split out kernel/sched/syscalls.c from kernel/sched/core.c sched/fair: Rename check_preempt_wakeup() to check_preempt_wakeup_fair() sched/fair: Rename check_preempt_curr() to wakeup_preempt() Jake Hillion (2): sched_ext: create_dsq: Return -EEXIST on duplicate request sched_ext: Drop kfuncs marked for removal in 6.15 Jiapeng Chong (1): sched_ext: Fixes incorrect type in bpf_scx_init() Jiayuan Chen (1): selftests/bpf: Fixes for test_maps test Kui-Feng Lee (29): bpf: refactory struct_ops type initialization to a function. bpf: get type information with BTF_ID_LIST bpf, net: introduce bpf_struct_ops_desc. bpf: add struct_ops_tab to btf. bpf: make struct_ops_map support btfs other than btf_vmlinux. bpf: pass btf object id in bpf_map_info. bpf: lookup struct_ops types from a given module BTF. bpf: pass attached BTF to the bpf_struct_ops subsystem bpf: hold module refcnt in bpf_struct_ops map creation and prog verification. bpf: validate value_type bpf, net: switch to dynamic registration libbpf: Find correct module BTFs for struct_ops maps and progs. bpf: export btf_ctx_access to modules. selftests/bpf: test case for register_bpf_struct_ops(). bpf: Fix error checks against bpf_get_btf_vmlinux(). bpf: Remove an unnecessary check. selftests/bpf: Suppress warning message of an unused variable. bpf: add btf pointer to struct bpf_ctx_arg_aux. bpf: Move __kfunc_param_match_suffix() to btf.c. bpf: Create argument information for nullable arguments. selftests/bpf: Test PTR_MAYBE_NULL arguments of struct_ops operators. libbpf: Set btf_value_type_id of struct bpf_map for struct_ops. libbpf: Convert st_ops->data to shadow type. bpftool: Generated shadow variables for struct_ops maps. bpftool: Add an example for struct_ops map and shadow type. selftests/bpf: Test if shadow types work correctly. bpf, net: validate struct_ops when updating value. bpf: struct_ops supports more than one page for trampolines. selftests/bpf: Test struct_ops maps with a large number of struct_ops program. Kumar Kartikeya Dwivedi (4): bpf: Allow calling static subprogs while holding a bpf_spin_lock selftests/bpf: Add test for static subprog call in lock cs bpf: Transfer RCU lock state between subprog calls selftests/bpf: Add tests for RCU lock transfer between subprogs Liang Jie (1): sched_ext: Use sizeof_field for key_len in dsq_hash_params Luo Gengkun (7): bpf: Fix kabi-breakage for bpf_func_info_aux bpf: Fix kabi-breakage for bpf_tramp_image bpf: Fix kabi for bpf_attr bpf_verifier: Fix kabi for bpf_verifier_env bpf: Fix kabi for bpf_ctx_arg_aux bpf: Fix kabi for bpf_prog_aux and bpf_prog selftests/bpf: modify test_loader that didn't support running bpf_prog_type_syscall programs Manu Bretelle (1): sched_ext: define missing cfi stubs for sched_ext Martin KaFai Lau (5): libbpf: Ensure undefined bpf_attr field stays 0 bpf: Remove unnecessary err < 0 check in bpf_struct_ops_map_update_elem bpf: Fix a crash when btf_parse_base() returns an error pointer bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing bpf: Use kallsyms to find the function name of a struct_ops's stub function Masahiro Yamada (1): kbuild: avoid too many execution of scripts/pahole-flags.sh Matthieu Baerts (1): bpf: fix compilation error without CGROUPS Peter Zijlstra (26): cfi: Flip headers x86/cfi,bpf: Fix BPF JIT call x86/cfi,bpf: Fix bpf_callback_t CFI x86/cfi,bpf: Fix bpf_struct_ops CFI cfi: Add CFI_NOSEAL() bpf: Fix dtor CFI cleanup: Make no_free_ptr() __must_check sched: Simplify set_user_nice() sched: Simplify syscalls sched: Simplify sched_{set,get}affinity() sched: Simplify yield_to() sched: Simplify sched_rr_get_interval() sched: Simplify sched_move_task() sched: Misc cleanups sched/deadline: Move bandwidth accounting into {en,de}queue_dl_entity sched: Allow sched_class::dequeue_task() to fail sched: Unify runtime accounting across classes sched: Use set_next_task(.first) where required sched/fair: Cleanup pick_task_fair() vs throttle sched/fair: Cleanup pick_task_fair()'s curr sched/fair: Unify pick_{,next_}_task_fair() sched: Fixup set_next_task() implementations sched: Split up put_prev_task_balance() sched: Rework pick_next_task() sched: Combine the last put_prev_task() and the first set_next_task() sched: Add put_prev_task(.next) Pu Lehui (8): riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops bpf: Fix kabi breakage in struct module riscv, bpf: Fix out-of-bounds issue when preparing trampoline image selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill test libbpf: Fix return zero when elf_begin failed libbpf: Fix incorrect traversal end type ID when marking BTF_IS_EMBEDDED selftests/bpf: Add distilled BTF test about marking BTF_IS_EMBEDDED selftests/bpf: Add file_read_pattern to gitignore Randy Dunlap (1): sched_ext: fix kernel-doc warnings Shizhao Chen (1): sched_ext: Add option -l in selftest runner to list all available tests Song Liu (8): bpf: Charge modmem for struct_ops trampoline bpf: Let bpf_prog_pack_free handle any pointer bpf: Adjust argument names of arch_prepare_bpf_trampoline() bpf: Add helpers for trampoline image management bpf, x86: Adjust arch_prepare_bpf_trampoline return value bpf: Add arch_bpf_trampoline_size() bpf: Use arch_bpf_trampoline_size x86, bpf: Use bpf_prog_pack for bpf trampoline T.J. Mercier (1): bpf, docs: Fix broken link to renamed bpf_iter_task_vmas.c Tejun Heo (152): sched: Restructure sched_class order sanity checks in sched_init() sched: Allow sched_cgroup_fork() to fail and introduce sched_cancel_fork() sched: Add sched_class->reweight_task() sched: Add sched_class->switching_to() and expose check_class_changing/changed() sched: Factor out cgroup weight conversion functions sched: Factor out update_other_load_avgs() from __update_blocked_others() sched: Add normal_policy() sched_ext: Add boilerplate for extensible scheduler class sched_ext: Implement BPF extensible scheduler class sched_ext: Add scx_simple and scx_example_qmap example schedulers sched_ext: Add sysrq-S which disables the BPF scheduler sched_ext: Allow BPF schedulers to disallow specific tasks from joining SCHED_EXT sched_ext: Print debug dump after an error exit tools/sched_ext: Add scx_show_state.py sched_ext: Implement scx_bpf_kick_cpu() and task preemption support sched_ext: Add a central scheduler which makes all scheduling decisions on one CPU sched_ext: Make watchdog handle ops.dispatch() looping stall sched_ext: Add task state tracking operations sched_ext: Implement tickless support sched_ext: Track tasks that are subjects of the in-flight SCX operation sched_ext: Implement sched_ext_ops.cpu_online/offline() sched_ext: Bypass BPF scheduler while PM events are in progress sched_ext: Implement core-sched support sched_ext: Add vtime-ordered priority queue to dispatch_q's sched_ext: Documentation: scheduler: Document extensible scheduler class sched, sched_ext: Replace scx_next_task_picked() with sched_class->switch_class() cpufreq_schedutil: Refactor sugov_cpu_is_busy() sched_ext: Add cpuperf support sched_ext: Drop tools_clean target from the top-level Makefile sched_ext: Swap argument positions in kcalloc() call to avoid compiler warning sched, sched_ext: Simplify dl_prio() case handling in sched_fork() sched_ext: Account for idle policy when setting p->scx.weight in scx_ops_enable_task() sched_ext: Disallow loading BPF scheduler if isolcpus= domain isolation is in effect sched_ext: Minor cleanups in kernel/sched/ext.h sched, sched_ext: Open code for_balance_class_range() sched, sched_ext: Move some declarations from kernel/sched/ext.h to sched.h sched_ext: Take out ->priq and ->flags from scx_dsq_node sched_ext: Implement DSQ iterator sched_ext/scx_qmap: Add an example usage of DSQ iterator sched_ext: Reimplement scx_bpf_reenqueue_local() sched_ext: Make scx_bpf_reenqueue_local() skip tasks that are being migrated sched: Move struct balance_callback definition upward sched_ext: Unpin and repin rq lock from balance_scx() sched_ext: s/SCX_RQ_BALANCING/SCX_RQ_IN_BALANCE/ and add SCX_RQ_IN_WAKEUP sched_ext: Allow SCX_DSQ_LOCAL_ON for direct dispatches sched_ext/scx_qmap: Pick idle CPU for direct dispatch on !wakeup enqueues sched_ext: Build fix on !CONFIG_STACKTRACE[_SUPPORT] sched_ext: Allow p->scx.disallow only while loading sched_ext: Simplify scx_can_stop_tick() invocation in sched_can_stop_tick() sched_ext: Add scx_enabled() test to @start_class promotion in put_prev_task_balance() sched_ext: Use update_curr_common() in update_curr_scx() sched_ext: Simplify UP support by enabling sched_class->balance() in UP sched_ext: Improve comment on idle_sched_class exception in scx_task_iter_next_locked() sched_ext: Make task_can_run_on_remote_rq() use common task_allowed_on_cpu() sched_ext: Fix unsafe list iteration in process_ddsp_deferred_locals() sched_ext: Make scx_rq_online() also test cpu_active() in addition to SCX_RQ_ONLINE sched_ext: Improve logging around enable/disable sched_ext: Don't use double locking to migrate tasks across CPUs scx_central: Fix smatch checker warning sched_ext: Add missing cfi stub for ops.tick sched_ext: Use task_can_run_on_remote_rq() test in dispatch_to_local_dsq() sched_ext: Use sched_clock_cpu() instead of rq_clock_task() in touch_core_sched() sched_ext: Don't call put_prev_task_scx() before picking the next task sched_ext: Replace SCX_TASK_BAL_KEEP with SCX_RQ_BAL_KEEP sched_ext: Unify regular and core-sched pick task paths sched_ext: Relocate functions in kernel/sched/ext.c sched_ext: Remove switch_class_scx() sched_ext: Remove sched_class->switch_class() sched_ext: TASK_DEAD tasks must be switched out of SCX on ops_disable sched_ext: TASK_DEAD tasks must be switched into SCX on ops_enable sched: Expose css_tg() sched: Make cpu_shares_read_u64() use tg_weight() sched: Introduce CONFIG_GROUP_SCHED_WEIGHT sched_ext: Add cgroup support sched_ext: Add a cgroup scheduler which uses flattened hierarchy sched_ext: Temporarily work around pick_task_scx() being called without balance_scx() sched_ext: Add missing static to scx_has_op[] sched_ext: Add missing static to scx_dump_data sched_ext: Rename scx_kfunc_set_sleepable to unlocked and relocate sched_ext: Refactor consume_remote_task() sched_ext: Make find_dsq_for_dispatch() handle SCX_DSQ_LOCAL_ON sched_ext: Fix processs_ddsp_deferred_locals() by unifying DTL_INVALID handling sched_ext: Restructure dispatch_to_local_dsq() sched_ext: Reorder args for consume_local/remote_task() sched_ext: Move sanity check and dsq_mod_nr() into task_unlink_from_dsq() sched_ext: Move consume_local_task() upward sched_ext: Replace consume_local_task() with move_local_task_to_local_dsq() sched_ext: Compact struct bpf_iter_scx_dsq_kern sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq() scx_qmap: Implement highpri boosting sched_ext: Synchronize bypass state changes with rq lock sched_ext: Don't trigger ops.quiescent/runnable() on migrations sched_ext: Fix build when !CONFIG_STACKTRACE sched_ext: Build fix for !CONFIG_SMP sched_ext: Add __COMPAT helpers for features added during v6.12 devel cycle tools/sched_ext: Receive misc updates from SCX repo scx_flatcg: Use a user DSQ for fallback instead of SCX_DSQ_GLOBAL sched_ext: Allow only user DSQs for scx_bpf_consume(), scx_bpf_dsq_nr_queued() and bpf_iter_scx_dsq_new() sched_ext: Relocate find_user_dsq() sched_ext: Split the global DSQ per NUMA node sched_ext: Use shorter slice while bypassing sched_ext: Relocate check_hotplug_seq() call in scx_ops_enable() sched_ext: Remove SCX_OPS_PREPPING sched_ext: Initialize in bypass mode sched_ext: Fix SCX_TASK_INIT -> SCX_TASK_READY transitions in scx_ops_enable() sched_ext: Enable scx_ops_init_task() separately sched_ext: Add scx_cgroup_enabled to gate cgroup operations and fix scx_tg_online() sched_ext: Decouple locks in scx_ops_disable_workfn() sched_ext: Decouple locks in scx_ops_enable() sched_ext: Improve error reporting during loading sched_ext: scx_cgroup_exit() may be called without successful scx_cgroup_init() sched/core: Make select_task_rq() take the pointer to wake_flags instead of value sched/core: Add ENQUEUE_RQ_SELECTED to indicate whether ->select_task_rq() was called sched_ext, scx_qmap: Add and use SCX_ENQ_CPU_SELECTED Revert "sched_ext: Use shorter slice while bypassing" sched_ext: Start schedulers with consistent p->scx.slice values sched_ext: Move scx_buildin_idle_enabled check to scx_bpf_select_cpu_dfl() sched_ext: bypass mode shouldn't depend on ops.select_cpu() sched_ext: Move scx_tasks_lock handling into scx_task_iter helpers sched_ext: Don't hold scx_tasks_lock for too long sched_ext: Make cast_mask() inline sched_ext: Fix enq_last_no_enq_fails selftest sched_ext: Add a missing newline at the end of an error message sched_ext: Update scx_show_state.py to match scx_ops_bypass_depth's new type sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx() sched_ext: ops.cpu_acquire() should be called with SCX_KF_REST sched_ext: Factor out move_task_between_dsqs() from scx_dispatch_from_dsq() sched_ext: Rename CFI stubs to names that are recognized by BPF sched_ext: Replace set_arg_maybe_null() with __nullable CFI stub tags sched_ext: Avoid live-locking bypass mode switching sched_ext: Enable the ops breather and eject BPF scheduler on softlockup sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked context sched_ext: Rename scx_bpf_dispatch[_vtime]() to scx_bpf_dsq_insert[_vtime]() sched_ext: Rename scx_bpf_consume() to scx_bpf_dsq_move_to_local() sched_ext: Rename scx_bpf_dispatch[_vtime]_from_dsq*() -> scx_bpf_dsq_move[_vtime]*() sched_ext: Fix invalid irq restore in scx_ops_bypass() sched_ext: Fix dsq_local_on selftest tools/sched_ext: Receive updates from SCX repo sched_ext: selftests/dsp_local_on: Fix sporadic failures sched_ext: Fix incorrect autogroup migration detection sched_ext: Implement auto local dispatching of migration disabled tasks sched_ext: Fix migration disabled handling in targeted dispatches sched_ext: Fix incorrect assumption about migration disabled tasks in task_can_run_on_remote_rq() sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance() sched_ext: Implement SCX_OPS_ALLOW_QUEUED_WAKEUP sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator sched_ext: Make scx_group_set_weight() always update tg->scx.weight sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU sched_ext: Don't kick CPUs running higher classes sched_ext: Use SCX_TASK_READY test instead of tryget_task_struct() during class switch tools/sched_ext: Sync with scx repo Thomas Gleixner (1): sched/ext: Remove sched_fork() hack Thorsten Blum (1): sched_ext: Use str_enabled_disabled() helper in update_selcpu_topology() Tianchen Ding (1): sched_ext: Use btf_ids to resolve task_struct Tony Ambardar (1): libbpf: Ensure new BTF objects inherit input endianness Vincent Guittot (2): sched/cpufreq: Rework schedutil governor performance estimation sched/fair: Fix sched_can_stop_tick() for fair tasks Vishal Chourasia (2): sched_ext: Add __weak markers to BPF helper function decalarations sched_ext: Fix function pointer type mismatches in BPF selftests Wenyu Huang (1): sched/doc: Update documentation after renames and synchronize Chinese version Yafang Shao (2): bpf: Add bits iterator selftests/bpf: Add selftest for bits iter Yipeng Zou (1): sched_ext: Allow dequeue_task_scx to fail Yiwei Lin (1): sched/fair: Remove unused 'curr' argument from pick_next_entity() Yu Liao (2): sched: Put task_group::idle under CONFIG_GROUP_SCHED_WEIGHT sched: Add dummy version of sched_group_set_idle() Yury Norov (1): cpumask: introduce assign_cpu() macro Zhang Qiao (3): sched_ext: Remove redundant p->nr_cpus_allowed checker sched/ext: Fix unmatch trailing comment of CONFIG_EXT_GROUP_SCHED sched/ext: Use tg_cgroup() to elieminate duplicate code Zhao Mengmeng (1): sched_ext: Replace scx_next_task_picked() with switch_class() in comment Zicheng Qu (18): sched: Fix kabi for reweight_task in struct sched_class Revert "sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting" sched/syscalls: Fix kabi for EXPORT_SYMBOL moved from core.c to syscalls.c sched: Fix kabi for switching_to in struct sched_class sched/fair: Fix kabi for check_preempt_curr and wakeup_preempt in struct sched_class sched: Fix kabi for dequeue_task in struct sched_class sched_ext: Fix kabi for scx in struct task_struct sched_ext: Fix kabi for switch_class in struct sched_class sched: Fix kabi for exec_max in struct sched_statistics sched_ext: Fix kabi for balance in struct sched_class sched_ext: Fix kabi for header in kernel/sched/sched.h sched: Fix kabi pick_task in struct sched_class sched: Fix kabi for put_prev_task in struct sched_class sched_ext: Fix kabi for scx_flags and scx_weight in struct task_group sched: Fix kabi for int idle in struct task_group sched: Add __setscheduler_class() for sched_ext genirq: Fix kabi for kstat_irqs in struct irq_desc sched_ext: Enable and disable sched_ext configs Zqiang (1): sched_ext: Fix unsafe locking in the scx_dump_state() guanjing (1): sched_ext: fix application of sizeof to pointer Documentation/bpf/bpf_iterators.rst | 2 +- Documentation/bpf/kfuncs.rst | 14 +- Documentation/scheduler/index.rst | 1 + Documentation/scheduler/sched-design-CFS.rst | 8 +- Documentation/scheduler/sched-ext.rst | 325 + .../zh_CN/scheduler/sched-design-CFS.rst | 8 +- MAINTAINERS | 16 +- Makefile | 4 +- arch/arm64/configs/openeuler_defconfig | 3 + arch/arm64/kernel/bpf-rvi.c | 4 +- arch/arm64/net/bpf_jit_comp.c | 55 +- arch/mips/dec/setup.c | 2 +- arch/parisc/kernel/smp.c | 2 +- arch/powerpc/kvm/book3s_hv_rm_xics.c | 2 +- arch/riscv/include/asm/cfi.h | 3 +- arch/riscv/kernel/cfi.c | 2 +- arch/riscv/net/bpf_jit_comp64.c | 48 +- arch/s390/net/bpf_jit_comp.c | 59 +- arch/x86/configs/openeuler_defconfig | 2 + arch/x86/include/asm/cfi.h | 126 +- arch/x86/kernel/alternative.c | 87 +- arch/x86/kernel/cfi.c | 4 +- arch/x86/net/bpf_jit_comp.c | 261 +- block/blk-cgroup.c | 4 +- drivers/hid/bpf/hid_bpf_dispatch.c | 12 +- drivers/tty/sysrq.c | 1 + fs/proc/stat.c | 4 +- include/asm-generic/Kbuild | 1 + include/asm-generic/cfi.h | 5 + include/asm-generic/vmlinux.lds.h | 1 + include/linux/bitops.h | 2 + include/linux/bpf.h | 130 +- include/linux/bpf_mem_alloc.h | 3 + include/linux/bpf_verifier.h | 21 +- include/linux/btf.h | 105 + include/linux/btf_ids.h | 21 +- include/linux/cfi.h | 12 + include/linux/cgroup.h | 14 +- include/linux/cleanup.h | 42 +- include/linux/cpumask.h | 41 +- include/linux/energy_model.h | 1 - include/linux/file.h | 20 + include/linux/filter.h | 2 +- include/linux/irqdesc.h | 17 +- include/linux/kernel_stat.h | 8 + include/linux/module.h | 8 +- include/linux/sched.h | 8 +- include/linux/sched/ext.h | 216 + include/linux/sched/task.h | 8 +- include/trace/events/sched_ext.h | 32 + include/uapi/linux/bpf.h | 16 +- include/uapi/linux/sched.h | 1 + init/Kconfig | 10 + init/init_task.c | 12 + kernel/Kconfig.preempt | 27 +- kernel/bpf-rvi/common_kfuncs.c | 4 +- kernel/bpf/Makefile | 8 +- kernel/bpf/bpf_iter.c | 12 +- kernel/bpf/bpf_struct_ops.c | 745 +- kernel/bpf/bpf_struct_ops_types.h | 12 - kernel/bpf/btf.c | 431 +- kernel/bpf/cgroup_iter.c | 65 +- kernel/bpf/core.c | 76 +- kernel/bpf/cpumask.c | 18 +- kernel/bpf/dispatcher.c | 7 +- kernel/bpf/helpers.c | 202 +- kernel/bpf/map_iter.c | 10 +- kernel/bpf/memalloc.c | 14 +- kernel/bpf/syscall.c | 12 +- kernel/bpf/task_iter.c | 242 +- kernel/bpf/trampoline.c | 99 +- kernel/bpf/verifier.c | 317 +- kernel/cgroup/cgroup.c | 18 +- kernel/cgroup/cpuset.c | 4 +- kernel/cgroup/rstat.c | 13 +- kernel/events/core.c | 2 +- kernel/fork.c | 17 +- kernel/irq/Kconfig | 4 + kernel/irq/internals.h | 2 +- kernel/irq/irqdesc.c | 144 +- kernel/irq/proc.c | 5 +- kernel/module/main.c | 5 +- kernel/sched/autogroup.c | 4 +- kernel/sched/bpf_sched.c | 8 +- kernel/sched/build_policy.c | 13 + kernel/sched/core.c | 2522 +----- kernel/sched/cpuacct.c | 4 +- kernel/sched/cpufreq_schedutil.c | 83 +- kernel/sched/deadline.c | 175 +- kernel/sched/debug.c | 3 + kernel/sched/ext.c | 7155 +++++++++++++++++ kernel/sched/ext.h | 119 + kernel/sched/ext_idle.c | 755 ++ kernel/sched/ext_idle.h | 39 + kernel/sched/fair.c | 306 +- kernel/sched/idle.c | 31 +- kernel/sched/rt.c | 40 +- kernel/sched/sched.h | 473 +- kernel/sched/stop_task.c | 35 +- kernel/sched/syscalls.c | 1713 ++++ kernel/trace/bpf_trace.c | 12 +- kernel/trace/trace_probe.c | 2 - kernel/watchdog.c | 223 +- lib/Kconfig.debug | 14 + lib/dump_stack.c | 1 + lib/rhashtable.c | 12 +- net/bpf/bpf_dummy_struct_ops.c | 72 +- net/bpf/test_run.c | 30 +- net/core/filter.c | 33 +- net/core/xdp.c | 10 +- net/ipv4/bpf_tcp_ca.c | 93 +- net/ipv4/fou_bpf.c | 10 +- net/ipv4/tcp_bbr.c | 4 +- net/ipv4/tcp_cong.c | 6 +- net/ipv4/tcp_cubic.c | 4 +- net/ipv4/tcp_dctcp.c | 4 +- net/netfilter/nf_conntrack_bpf.c | 10 +- net/netfilter/nf_nat_bpf.c | 10 +- net/socket.c | 8 +- net/xfrm/xfrm_interface_bpf.c | 10 +- scripts/Makefile.btf | 33 + scripts/Makefile.modfinal | 2 +- scripts/gdb/linux/interrupts.py | 6 +- scripts/pahole-flags.sh | 30 - tools/Makefile | 10 +- .../bpf/bpftool/Documentation/bpftool-gen.rst | 58 +- tools/bpf/bpftool/gen.c | 253 +- tools/bpf/resolve_btfids/main.c | 8 + tools/include/linux/bitops.h | 2 + tools/include/uapi/linux/bpf.h | 14 +- tools/include/uapi/linux/sched.h | 1 + tools/lib/bpf/Build | 2 +- tools/lib/bpf/bpf.c | 4 +- tools/lib/bpf/bpf.h | 4 +- tools/lib/bpf/btf.c | 704 +- tools/lib/bpf/btf.h | 36 + tools/lib/bpf/btf_iter.c | 177 + tools/lib/bpf/btf_relocate.c | 519 ++ tools/lib/bpf/libbpf.c | 97 +- tools/lib/bpf/libbpf.map | 4 +- tools/lib/bpf/libbpf_internal.h | 29 +- tools/lib/bpf/libbpf_probes.c | 1 + tools/lib/bpf/linker.c | 58 +- tools/perf/util/probe-finder.c | 4 +- tools/sched_ext/.gitignore | 2 + tools/sched_ext/Makefile | 246 + tools/sched_ext/README.md | 270 + .../sched_ext/include/bpf-compat/gnu/stubs.h | 11 + tools/sched_ext/include/scx/common.bpf.h | 647 ++ tools/sched_ext/include/scx/common.h | 81 + tools/sched_ext/include/scx/compat.bpf.h | 143 + tools/sched_ext/include/scx/compat.h | 187 + .../sched_ext/include/scx/enums.autogen.bpf.h | 105 + tools/sched_ext/include/scx/enums.autogen.h | 41 + tools/sched_ext/include/scx/enums.bpf.h | 12 + tools/sched_ext/include/scx/enums.h | 27 + tools/sched_ext/include/scx/user_exit_info.h | 118 + tools/sched_ext/scx_central.bpf.c | 356 + tools/sched_ext/scx_central.c | 145 + tools/sched_ext/scx_flatcg.bpf.c | 954 +++ tools/sched_ext/scx_flatcg.c | 234 + tools/sched_ext/scx_flatcg.h | 51 + tools/sched_ext/scx_qmap.bpf.c | 827 ++ tools/sched_ext/scx_qmap.c | 155 + tools/sched_ext/scx_show_state.py | 42 + tools/sched_ext/scx_simple.bpf.c | 151 + tools/sched_ext/scx_simple.c | 107 + tools/testing/selftests/Makefile | 9 +- tools/testing/selftests/bpf/.gitignore | 1 + .../testing/selftests/bpf/bpf_experimental.h | 96 + .../selftests/bpf/bpf_testmod/bpf_testmod.c | 160 +- .../selftests/bpf/bpf_testmod/bpf_testmod.h | 61 + .../bpf/bpf_testmod/bpf_testmod_kfunc.h | 9 + .../selftests/bpf/prog_tests/bpf_iter.c | 44 +- .../selftests/bpf/prog_tests/btf_distill.c | 692 ++ .../selftests/bpf/prog_tests/cgroup_iter.c | 33 + .../bpf/prog_tests/global_func_dead_code.c | 60 + .../testing/selftests/bpf/prog_tests/iters.c | 209 + .../selftests/bpf/prog_tests/kfunc_call.c | 1 + .../selftests/bpf/prog_tests/rcu_read_lock.c | 6 + .../selftests/bpf/prog_tests/spin_lock.c | 2 + .../prog_tests/test_struct_ops_maybe_null.c | 46 + .../bpf/prog_tests/test_struct_ops_module.c | 86 + .../prog_tests/test_struct_ops_multi_pages.c | 30 + .../testing/selftests/bpf/prog_tests/timer.c | 4 + .../selftests/bpf/prog_tests/verifier.c | 4 + ...f_iter_task_vma.c => bpf_iter_task_vmas.c} | 0 .../{bpf_iter_task.c => bpf_iter_tasks.c} | 0 .../bpf/progs/freplace_dead_global_func.c | 11 + tools/testing/selftests/bpf/progs/iters_css.c | 72 + .../selftests/bpf/progs/iters_css_task.c | 102 + .../testing/selftests/bpf/progs/iters_task.c | 41 + .../selftests/bpf/progs/iters_task_failure.c | 105 + .../selftests/bpf/progs/iters_task_vma.c | 43 + .../selftests/bpf/progs/iters_testmod_seq.c | 50 + .../selftests/bpf/progs/kfunc_call_test.c | 37 + .../selftests/bpf/progs/rcu_read_lock.c | 120 + .../bpf/progs/struct_ops_maybe_null.c | 29 + .../bpf/progs/struct_ops_maybe_null_fail.c | 24 + .../selftests/bpf/progs/struct_ops_module.c | 37 + .../bpf/progs/struct_ops_multi_pages.c | 102 + .../selftests/bpf/progs/test_global_func12.c | 4 +- .../selftests/bpf/progs/test_spin_lock.c | 65 + .../selftests/bpf/progs/test_spin_lock_fail.c | 44 + tools/testing/selftests/bpf/progs/timer.c | 63 +- .../selftests/bpf/progs/verifier_bits_iter.c | 232 + .../bpf/progs/verifier_global_subprogs.c | 101 + .../selftests/bpf/progs/verifier_spin_lock.c | 2 +- .../bpf/progs/verifier_subprog_precision.c | 4 +- tools/testing/selftests/bpf/test_loader.c | 10 +- tools/testing/selftests/bpf/test_maps.c | 18 +- tools/testing/selftests/bpf/test_maps.h | 5 + tools/testing/selftests/sched_ext/.gitignore | 6 + tools/testing/selftests/sched_ext/Makefile | 211 + tools/testing/selftests/sched_ext/config | 9 + .../selftests/sched_ext/create_dsq.bpf.c | 58 + .../testing/selftests/sched_ext/create_dsq.c | 57 + .../sched_ext/ddsp_bogus_dsq_fail.bpf.c | 42 + .../selftests/sched_ext/ddsp_bogus_dsq_fail.c | 60 + .../sched_ext/ddsp_vtimelocal_fail.bpf.c | 39 + .../sched_ext/ddsp_vtimelocal_fail.c | 59 + .../selftests/sched_ext/dsp_local_on.bpf.c | 68 + .../selftests/sched_ext/dsp_local_on.c | 60 + .../sched_ext/enq_last_no_enq_fails.bpf.c | 29 + .../sched_ext/enq_last_no_enq_fails.c | 64 + .../sched_ext/enq_select_cpu_fails.bpf.c | 43 + .../sched_ext/enq_select_cpu_fails.c | 61 + tools/testing/selftests/sched_ext/exit.bpf.c | 86 + tools/testing/selftests/sched_ext/exit.c | 64 + tools/testing/selftests/sched_ext/exit_test.h | 20 + .../testing/selftests/sched_ext/hotplug.bpf.c | 61 + tools/testing/selftests/sched_ext/hotplug.c | 170 + .../selftests/sched_ext/hotplug_test.h | 15 + .../sched_ext/init_enable_count.bpf.c | 53 + .../selftests/sched_ext/init_enable_count.c | 157 + .../testing/selftests/sched_ext/maximal.bpf.c | 166 + tools/testing/selftests/sched_ext/maximal.c | 54 + .../selftests/sched_ext/maybe_null.bpf.c | 36 + .../testing/selftests/sched_ext/maybe_null.c | 49 + .../sched_ext/maybe_null_fail_dsp.bpf.c | 25 + .../sched_ext/maybe_null_fail_yld.bpf.c | 28 + .../testing/selftests/sched_ext/minimal.bpf.c | 21 + tools/testing/selftests/sched_ext/minimal.c | 58 + .../selftests/sched_ext/prog_run.bpf.c | 33 + tools/testing/selftests/sched_ext/prog_run.c | 78 + .../testing/selftests/sched_ext/reload_loop.c | 74 + tools/testing/selftests/sched_ext/runner.c | 212 + tools/testing/selftests/sched_ext/scx_test.h | 131 + .../selftests/sched_ext/select_cpu_dfl.bpf.c | 40 + .../selftests/sched_ext/select_cpu_dfl.c | 75 + .../sched_ext/select_cpu_dfl_nodispatch.bpf.c | 89 + .../sched_ext/select_cpu_dfl_nodispatch.c | 75 + .../sched_ext/select_cpu_dispatch.bpf.c | 41 + .../selftests/sched_ext/select_cpu_dispatch.c | 73 + .../select_cpu_dispatch_bad_dsq.bpf.c | 37 + .../sched_ext/select_cpu_dispatch_bad_dsq.c | 59 + .../select_cpu_dispatch_dbl_dsp.bpf.c | 38 + .../sched_ext/select_cpu_dispatch_dbl_dsp.c | 59 + .../sched_ext/select_cpu_vtime.bpf.c | 92 + .../selftests/sched_ext/select_cpu_vtime.c | 62 + .../selftests/sched_ext/test_example.c | 49 + tools/testing/selftests/sched_ext/util.c | 71 + tools/testing/selftests/sched_ext/util.h | 13 + 263 files changed, 27732 insertions(+), 3817 deletions(-) create mode 100644 Documentation/scheduler/sched-ext.rst create mode 100644 include/asm-generic/cfi.h create mode 100644 include/linux/sched/ext.h create mode 100644 include/trace/events/sched_ext.h delete mode 100644 kernel/bpf/bpf_struct_ops_types.h create mode 100644 kernel/sched/ext.c create mode 100644 kernel/sched/ext.h create mode 100644 kernel/sched/ext_idle.c create mode 100644 kernel/sched/ext_idle.h create mode 100644 kernel/sched/syscalls.c create mode 100644 scripts/Makefile.btf delete mode 100755 scripts/pahole-flags.sh create mode 100644 tools/lib/bpf/btf_iter.c create mode 100644 tools/lib/bpf/btf_relocate.c create mode 100644 tools/sched_ext/.gitignore create mode 100644 tools/sched_ext/Makefile create mode 100644 tools/sched_ext/README.md create mode 100644 tools/sched_ext/include/bpf-compat/gnu/stubs.h create mode 100644 tools/sched_ext/include/scx/common.bpf.h create mode 100644 tools/sched_ext/include/scx/common.h create mode 100644 tools/sched_ext/include/scx/compat.bpf.h create mode 100644 tools/sched_ext/include/scx/compat.h create mode 100644 tools/sched_ext/include/scx/enums.autogen.bpf.h create mode 100644 tools/sched_ext/include/scx/enums.autogen.h create mode 100644 tools/sched_ext/include/scx/enums.bpf.h create mode 100644 tools/sched_ext/include/scx/enums.h create mode 100644 tools/sched_ext/include/scx/user_exit_info.h create mode 100644 tools/sched_ext/scx_central.bpf.c create mode 100644 tools/sched_ext/scx_central.c create mode 100644 tools/sched_ext/scx_flatcg.bpf.c create mode 100644 tools/sched_ext/scx_flatcg.c create mode 100644 tools/sched_ext/scx_flatcg.h create mode 100644 tools/sched_ext/scx_qmap.bpf.c create mode 100644 tools/sched_ext/scx_qmap.c create mode 100644 tools/sched_ext/scx_show_state.py create mode 100644 tools/sched_ext/scx_simple.bpf.c create mode 100644 tools/sched_ext/scx_simple.c create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_distill.c create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_maybe_null.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_module.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_pages.c rename tools/testing/selftests/bpf/progs/{bpf_iter_task_vma.c => bpf_iter_task_vmas.c} (100%) rename tools/testing/selftests/bpf/progs/{bpf_iter_task.c => bpf_iter_tasks.c} (100%) create mode 100644 tools/testing/selftests/bpf/progs/freplace_dead_global_func.c create mode 100644 tools/testing/selftests/bpf/progs/iters_css.c create mode 100644 tools/testing/selftests/bpf/progs/iters_css_task.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task_failure.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task_vma.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null_fail.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_module.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_multi_pages.c create mode 100644 tools/testing/selftests/bpf/progs/verifier_bits_iter.c create mode 100644 tools/testing/selftests/bpf/progs/verifier_global_subprogs.c create mode 100644 tools/testing/selftests/sched_ext/.gitignore create mode 100644 tools/testing/selftests/sched_ext/Makefile create mode 100644 tools/testing/selftests/sched_ext/config create mode 100644 tools/testing/selftests/sched_ext/create_dsq.bpf.c create mode 100644 tools/testing/selftests/sched_ext/create_dsq.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.bpf.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.bpf.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.c create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.bpf.c create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.c create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.bpf.c create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.c create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.bpf.c create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.c create mode 100644 tools/testing/selftests/sched_ext/exit.bpf.c create mode 100644 tools/testing/selftests/sched_ext/exit.c create mode 100644 tools/testing/selftests/sched_ext/exit_test.h create mode 100644 tools/testing/selftests/sched_ext/hotplug.bpf.c create mode 100644 tools/testing/selftests/sched_ext/hotplug.c create mode 100644 tools/testing/selftests/sched_ext/hotplug_test.h create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.bpf.c create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.c create mode 100644 tools/testing/selftests/sched_ext/maximal.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maximal.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_dsp.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_yld.bpf.c create mode 100644 tools/testing/selftests/sched_ext/minimal.bpf.c create mode 100644 tools/testing/selftests/sched_ext/minimal.c create mode 100644 tools/testing/selftests/sched_ext/prog_run.bpf.c create mode 100644 tools/testing/selftests/sched_ext/prog_run.c create mode 100644 tools/testing/selftests/sched_ext/reload_loop.c create mode 100644 tools/testing/selftests/sched_ext/runner.c create mode 100644 tools/testing/selftests/sched_ext/scx_test.h create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.c create mode 100644 tools/testing/selftests/sched_ext/test_example.c create mode 100644 tools/testing/selftests/sched_ext/util.c create mode 100644 tools/testing/selftests/sched_ext/util.h -- 2.34.1

2 453

[PATCH OLK-6.6 0/2] CVE-2026-23296
by Li Lingfeng 03 Apr '26

03 Apr '26

Junxiao Bi (2): scsi: core: Fix refcount leak for tagset_refcnt scsi: core: Fix error handling for scsi_alloc_sdev() drivers/scsi/scsi_scan.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) -- 2.52.0

2 6

[PATCH OLK-6.6 000/451] sched_ext v1
by Zicheng Qu 03 Apr '26

03 Apr '26

Aboorva Devarajan (2): sched_ext: Documentation: Remove mentions of scx_bpf_switch_all sched: Pass correct scheduling policy to __setscheduler_class Alan Maguire (16): kbuild,bpf: Switch to using --btf_features for pahole v1.26 and later kbuild, bpf: Use test-ge check for v1.25-only pahole libbpf: Add btf__distill_base() creating split BTF with distilled base BTF selftests/bpf: Test distilled base, split BTF generation libbpf: Split BTF relocation selftests/bpf: Extend distilled BTF tests to cover BTF relocation resolve_btfids: Handle presence of .BTF.base section libbpf: BTF relocation followup fixing naming, loop logic module, bpf: Store BTF base pointer in struct module libbpf: Split field iter code into its own file kernel libbpf,bpf: Share BTF relocate-related code with kernel kbuild,bpf: Add module-specific pahole flags for distilled base BTF selftests/bpf: Add kfunc_call test for simple dtor in bpf_testmod bpf: fix build when CONFIG_DEBUG_INFO_BTF[_MODULES] is undefined libbpf: Fix error handling in btf__distill_base() libbpf: Fix license for btf_relocate.c Alexander Lobakin (1): bitops: make BYTES_TO_BITS() treewide-available Alexei Starovoitov (2): s390/bpf: Fix indirect trampoline generation bpf: Introduce "volatile compare" macros Andrea Righi (33): sched_ext: fix typo in set_weight() description sched_ext: add CONFIG_DEBUG_INFO_BTF dependency sched_ext: Provide a sysfs enable_seq counter sched_ext: improve WAKE_SYNC behavior for default idle CPU selection sched_ext: Clarify ops.select_cpu() for single-CPU tasks sched_ext: Introduce LLC awareness to the default idle selection policy sched_ext: Introduce NUMA awareness to the default idle selection policy sched_ext: Do not enable LLC/NUMA optimizations when domains overlap sched_ext: Fix incorrect use of bitwise AND MAINTAINERS: add self as reviewer for sched_ext sched_ext: idle: Refresh idle masks during idle-to-idle transitions sched_ext: Use the NUMA scheduling domain for NUMA optimizations sched_ext: idle: use assign_cpu() to update the idle cpumask sched_ext: idle: clarify comments sched_ext: idle: introduce check_builtin_idle_enabled() helper sched_ext: idle: small CPU iteration refactoring sched_ext: update scx_bpf_dsq_insert() doc for SCX_DSQ_LOCAL_ON sched_ext: Include remaining task time slice in error state dump sched_ext: Include task weight in the error state dump selftests/sched_ext: Fix enum resolution tools/sched_ext: Add helper to check task migration state sched_ext: selftests/dsp_local_on: Fix selftest on UP systems sched_ext: Fix lock imbalance in dispatch_to_local_dsq() selftests/sched_ext: Fix exit selftest hang on UP sched_ext: Move built-in idle CPU selection policy to a separate file sched_ext: Track currently locked rq sched_ext: Make scx_locked_rq() inline sched_ext: Fix missing rq lock in scx_bpf_cpuperf_set() sched/ext: Fix invalid task state transitions on class switch sched_ext: Make scx_kf_allowed_if_unlocked() available outside ext.c sched_ext: Remove duplicate BTF_ID_FLAGS definitions sched_ext: Fix rq lock state in hotplug ops sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl() Andrii Nakryiko (14): bpf: Emit global subprog name in verifier logs bpf: Validate global subprogs lazily selftests/bpf: Add lazy global subprog validation tests libbpf: Add btf__new_split() API that was declared but not implemented bpf: move sleepable flag from bpf_prog_aux to bpf_prog libbpf: Add BTF field iterator libbpf: Make use of BTF field iterator in BPF linker code libbpf: Make use of BTF field iterator in BTF handling code bpftool: Use BTF field iterator in btfgen libbpf: Remove callback-based type/string BTF field visitor helpers bpf: extract iterator argument type and name validation logic bpf: allow passing struct bpf_iter_<type> as kfunc arguments selftests/bpf: test passing iterator to a kfunc selftests/bpf: validate eliminated global subprog is not freplaceable Arnaldo Carvalho de Melo (1): tools include UAPI: Sync linux/sched.h copy with the kernel sources Atul Kumar Pant (1): sched_ext: Fixes typos in comments Benjamin Tissoires (1): bpf: introduce in_sleepable() helper Bitao Hu (4): genirq: Convert kstat_irqs to a struct genirq: Provide a snapshot mechanism for interrupt statistics watchdog/softlockup: Low-overhead detection of interrupt storm watchdog/softlockup: Report the most frequent interrupts Björn Töpel (1): selftests: sched_ext: Add sched_ext as proper selftest target Breno Leitao (3): rhashtable: Fix potential deadlock by moving schedule_work outside lock sched_ext: Use kvzalloc for large exit_dump allocation sched/ext: Prevent update_locked_rq() calls with NULL rq Changwoo Min (12): sched_ext: Clarify sched_ext_ops table for userland scheduler sched_ext: add a missing rcu_read_lock/unlock pair at scx_select_cpu_dfl() MAINTAINERS: add me as reviewer for sched_ext sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass() sched_ext: Relocate scx_enabled() related code sched_ext: Implement scx_bpf_now() sched_ext: Add scx_bpf_now() for BPF scheduler sched_ext: Add time helpers for BPF schedulers sched_ext: Replace bpf_ktime_get_ns() to scx_bpf_now() sched_ext: Use time helpers in BPF schedulers sched_ext: Fix incorrect time delta calculation in time_delta() sched_ext: Add scx_bpf_events() and scx_read_event() for BPF schedulers Cheng-Yang Chou (1): sched_ext: Always use SMP versions in kernel/sched/ext.c Christian Brauner (1): file: add take_fd() cleanup helper Christian Loehle (1): sched/fair: Remove stale FREQUENCY_UTIL comment Christophe Leroy (2): bpf: Remove arch_unprotect_bpf_trampoline() bpf: Check return from set_memory_rox() Chuyi Zhou (15): cgroup: Prepare for using css_task_iter_*() in BPF bpf: Introduce css_task open-coded iterator kfuncs bpf: Introduce task open coded iterator kfuncs bpf: Introduce css open-coded iterator kfuncs bpf: teach the verifier to enforce css_iter and task_iter in RCU CS bpf: Let bpf_iter_task_new accept null task ptr selftests/bpf: rename bpf_iter_task.c to bpf_iter_tasks.c selftests/bpf: Add tests for open-coded task and css iter bpf: Relax allowlist for css_task iter selftests/bpf: Add tests for css_task iter combining with cgroup iter selftests/bpf: Add test for using css_task iter in sleepable progs bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h. sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx Colin Ian King (1): sched_ext: Fix spelling mistake: "intead" -> "instead" Daniel Xu (3): bpf: btf: Support flags for BTF_SET8 sets bpf: btf: Add BTF_KFUNCS_START/END macro pair bpf: treewide: Annotate BPF kfuncs in BTF Dave Marchevsky (6): bpf: Don't explicitly emit BTF for struct btf_iter_num selftests/bpf: Rename bpf_iter_task_vma.c to bpf_iter_task_vmas.c bpf: Introduce task_vma open-coded iterator kfuncs selftests/bpf: Add tests for open-coded task_vma iter bpf: Add __bpf_kfunc_{start,end}_defs macros bpf: Add __bpf_hook_{start,end} macros David Vernet (15): bpf: Add ability to pin bpf timer to calling CPU selftests/bpf: Test pinning bpf timer to a core sched_ext: Implement runnable task stall watchdog sched_ext: Print sched_ext info when dumping stack sched_ext: Implement SCX_KICK_WAIT sched_ext: Implement sched_ext_ops.cpu_acquire/release() sched_ext: Add selftests bpf: Load vmlinux btf for any struct_ops map sched_ext: Make scx_bpf_cpuperf_set() @cpu arg signed scx: Allow calling sleepable kfuncs from BPF_PROG_TYPE_SYSCALL scx/selftests: Verify we can call create_dsq from prog_run sched_ext: Remove unnecessary cpu_relax() scx: Fix exit selftest to use custom DSQ scx: Fix raciness in scx_ops_bypass() scx: Fix maximal BPF selftest prog Dawei Li (1): genirq: Deduplicate interrupt descriptor initialization Devaansh Kumar (1): sched_ext: selftests: Fix grammar in tests description Devaansh-Kumar (1): sched_ext: Documentation: Update instructions for running example schedulers Eduard Zingerman (2): libbpf: Make btf_parse_elf process .BTF.base transparently selftests/bpf: Check if distilled base inherits source endianness Geliang Tang (1): bpf, btf: Check btf for register_bpf_struct_ops Henry Huang (2): sched_ext: initialize kit->cursor.flags sched_ext: keep running prev when prev->scx.slice != 0 Herbert Xu (1): rhashtable: Fix rhashtable_try_insert test Honglei Wang (3): sched_ext: use correct function name in pick_task_scx() warning message sched_ext: Add __weak to fix the build errors sched_ext: switch class when preempted by higher priority scheduler Hongyan Xia (1): sched/ext: Add BPF function to fetch rq Hou Tao (7): bpf: Free dynamically allocated bits in bpf_iter_bits_destroy() bpf: Add bpf_mem_alloc_check_size() helper bpf: Check the validity of nr_words in bpf_iter_bits_new() bpf: Use __u64 to save the bits in bits iterator selftests/bpf: Add three test cases for bits_iter selftests/bpf: Use -4095 as the bad address for bits iterator selftests/bpf: Export map_update_retriable() Ihor Solodrai (2): selftests/sched_ext: add order-only dependency of runner.o on BPFOBJ selftests/sched_ext: fix build after renames in sched_ext API Ilpo Järvinen (1): <linux/cleanup.h>: Allow the passing of both iomem and non-iomem pointers to no_free_ptr() Ingo Molnar (3): sched/syscalls: Split out kernel/sched/syscalls.c from kernel/sched/core.c sched/fair: Rename check_preempt_wakeup() to check_preempt_wakeup_fair() sched/fair: Rename check_preempt_curr() to wakeup_preempt() Jake Hillion (2): sched_ext: create_dsq: Return -EEXIST on duplicate request sched_ext: Drop kfuncs marked for removal in 6.15 Jiapeng Chong (1): sched_ext: Fixes incorrect type in bpf_scx_init() Jiayuan Chen (1): selftests/bpf: Fixes for test_maps test Kui-Feng Lee (29): bpf: refactory struct_ops type initialization to a function. bpf: get type information with BTF_ID_LIST bpf, net: introduce bpf_struct_ops_desc. bpf: add struct_ops_tab to btf. bpf: make struct_ops_map support btfs other than btf_vmlinux. bpf: pass btf object id in bpf_map_info. bpf: lookup struct_ops types from a given module BTF. bpf: pass attached BTF to the bpf_struct_ops subsystem bpf: hold module refcnt in bpf_struct_ops map creation and prog verification. bpf: validate value_type bpf, net: switch to dynamic registration libbpf: Find correct module BTFs for struct_ops maps and progs. bpf: export btf_ctx_access to modules. selftests/bpf: test case for register_bpf_struct_ops(). bpf: Fix error checks against bpf_get_btf_vmlinux(). bpf: Remove an unnecessary check. selftests/bpf: Suppress warning message of an unused variable. bpf: add btf pointer to struct bpf_ctx_arg_aux. bpf: Move __kfunc_param_match_suffix() to btf.c. bpf: Create argument information for nullable arguments. selftests/bpf: Test PTR_MAYBE_NULL arguments of struct_ops operators. libbpf: Set btf_value_type_id of struct bpf_map for struct_ops. libbpf: Convert st_ops->data to shadow type. bpftool: Generated shadow variables for struct_ops maps. bpftool: Add an example for struct_ops map and shadow type. selftests/bpf: Test if shadow types work correctly. bpf, net: validate struct_ops when updating value. bpf: struct_ops supports more than one page for trampolines. selftests/bpf: Test struct_ops maps with a large number of struct_ops program. Kumar Kartikeya Dwivedi (4): bpf: Allow calling static subprogs while holding a bpf_spin_lock selftests/bpf: Add test for static subprog call in lock cs bpf: Transfer RCU lock state between subprog calls selftests/bpf: Add tests for RCU lock transfer between subprogs Liang Jie (1): sched_ext: Use sizeof_field for key_len in dsq_hash_params Luo Gengkun (7): bpf: Fix kabi-breakage for bpf_func_info_aux bpf: Fix kabi-breakage for bpf_tramp_image bpf: Fix kabi for bpf_attr bpf_verifier: Fix kabi for bpf_verifier_env bpf: Fix kabi for bpf_ctx_arg_aux bpf: Fix kabi for bpf_prog_aux and bpf_prog selftests/bpf: modify test_loader that didn't support running bpf_prog_type_syscall programs Manu Bretelle (1): sched_ext: define missing cfi stubs for sched_ext Martin KaFai Lau (5): libbpf: Ensure undefined bpf_attr field stays 0 bpf: Remove unnecessary err < 0 check in bpf_struct_ops_map_update_elem bpf: Fix a crash when btf_parse_base() returns an error pointer bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing bpf: Use kallsyms to find the function name of a struct_ops's stub function Masahiro Yamada (1): kbuild: avoid too many execution of scripts/pahole-flags.sh Matthieu Baerts (1): bpf: fix compilation error without CGROUPS Peter Zijlstra (26): cfi: Flip headers x86/cfi,bpf: Fix BPF JIT call x86/cfi,bpf: Fix bpf_callback_t CFI x86/cfi,bpf: Fix bpf_struct_ops CFI cfi: Add CFI_NOSEAL() bpf: Fix dtor CFI cleanup: Make no_free_ptr() __must_check sched: Simplify set_user_nice() sched: Simplify syscalls sched: Simplify sched_{set,get}affinity() sched: Simplify yield_to() sched: Simplify sched_rr_get_interval() sched: Simplify sched_move_task() sched: Misc cleanups sched/deadline: Move bandwidth accounting into {en,de}queue_dl_entity sched: Allow sched_class::dequeue_task() to fail sched: Unify runtime accounting across classes sched: Use set_next_task(.first) where required sched/fair: Cleanup pick_task_fair() vs throttle sched/fair: Cleanup pick_task_fair()'s curr sched/fair: Unify pick_{,next_}_task_fair() sched: Fixup set_next_task() implementations sched: Split up put_prev_task_balance() sched: Rework pick_next_task() sched: Combine the last put_prev_task() and the first set_next_task() sched: Add put_prev_task(.next) Pu Lehui (8): riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops bpf: Fix kabi breakage in struct module riscv, bpf: Fix out-of-bounds issue when preparing trampoline image selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill test libbpf: Fix return zero when elf_begin failed libbpf: Fix incorrect traversal end type ID when marking BTF_IS_EMBEDDED selftests/bpf: Add distilled BTF test about marking BTF_IS_EMBEDDED selftests/bpf: Add file_read_pattern to gitignore Randy Dunlap (1): sched_ext: fix kernel-doc warnings Shizhao Chen (1): sched_ext: Add option -l in selftest runner to list all available tests Song Liu (8): bpf: Charge modmem for struct_ops trampoline bpf: Let bpf_prog_pack_free handle any pointer bpf: Adjust argument names of arch_prepare_bpf_trampoline() bpf: Add helpers for trampoline image management bpf, x86: Adjust arch_prepare_bpf_trampoline return value bpf: Add arch_bpf_trampoline_size() bpf: Use arch_bpf_trampoline_size x86, bpf: Use bpf_prog_pack for bpf trampoline T.J. Mercier (1): bpf, docs: Fix broken link to renamed bpf_iter_task_vmas.c Tejun Heo (152): sched: Restructure sched_class order sanity checks in sched_init() sched: Allow sched_cgroup_fork() to fail and introduce sched_cancel_fork() sched: Add sched_class->reweight_task() sched: Add sched_class->switching_to() and expose check_class_changing/changed() sched: Factor out cgroup weight conversion functions sched: Factor out update_other_load_avgs() from __update_blocked_others() sched: Add normal_policy() sched_ext: Add boilerplate for extensible scheduler class sched_ext: Implement BPF extensible scheduler class sched_ext: Add scx_simple and scx_example_qmap example schedulers sched_ext: Add sysrq-S which disables the BPF scheduler sched_ext: Allow BPF schedulers to disallow specific tasks from joining SCHED_EXT sched_ext: Print debug dump after an error exit tools/sched_ext: Add scx_show_state.py sched_ext: Implement scx_bpf_kick_cpu() and task preemption support sched_ext: Add a central scheduler which makes all scheduling decisions on one CPU sched_ext: Make watchdog handle ops.dispatch() looping stall sched_ext: Add task state tracking operations sched_ext: Implement tickless support sched_ext: Track tasks that are subjects of the in-flight SCX operation sched_ext: Implement sched_ext_ops.cpu_online/offline() sched_ext: Bypass BPF scheduler while PM events are in progress sched_ext: Implement core-sched support sched_ext: Add vtime-ordered priority queue to dispatch_q's sched_ext: Documentation: scheduler: Document extensible scheduler class sched, sched_ext: Replace scx_next_task_picked() with sched_class->switch_class() cpufreq_schedutil: Refactor sugov_cpu_is_busy() sched_ext: Add cpuperf support sched_ext: Drop tools_clean target from the top-level Makefile sched_ext: Swap argument positions in kcalloc() call to avoid compiler warning sched, sched_ext: Simplify dl_prio() case handling in sched_fork() sched_ext: Account for idle policy when setting p->scx.weight in scx_ops_enable_task() sched_ext: Disallow loading BPF scheduler if isolcpus= domain isolation is in effect sched_ext: Minor cleanups in kernel/sched/ext.h sched, sched_ext: Open code for_balance_class_range() sched, sched_ext: Move some declarations from kernel/sched/ext.h to sched.h sched_ext: Take out ->priq and ->flags from scx_dsq_node sched_ext: Implement DSQ iterator sched_ext/scx_qmap: Add an example usage of DSQ iterator sched_ext: Reimplement scx_bpf_reenqueue_local() sched_ext: Make scx_bpf_reenqueue_local() skip tasks that are being migrated sched: Move struct balance_callback definition upward sched_ext: Unpin and repin rq lock from balance_scx() sched_ext: s/SCX_RQ_BALANCING/SCX_RQ_IN_BALANCE/ and add SCX_RQ_IN_WAKEUP sched_ext: Allow SCX_DSQ_LOCAL_ON for direct dispatches sched_ext/scx_qmap: Pick idle CPU for direct dispatch on !wakeup enqueues sched_ext: Build fix on !CONFIG_STACKTRACE[_SUPPORT] sched_ext: Allow p->scx.disallow only while loading sched_ext: Simplify scx_can_stop_tick() invocation in sched_can_stop_tick() sched_ext: Add scx_enabled() test to @start_class promotion in put_prev_task_balance() sched_ext: Use update_curr_common() in update_curr_scx() sched_ext: Simplify UP support by enabling sched_class->balance() in UP sched_ext: Improve comment on idle_sched_class exception in scx_task_iter_next_locked() sched_ext: Make task_can_run_on_remote_rq() use common task_allowed_on_cpu() sched_ext: Fix unsafe list iteration in process_ddsp_deferred_locals() sched_ext: Make scx_rq_online() also test cpu_active() in addition to SCX_RQ_ONLINE sched_ext: Improve logging around enable/disable sched_ext: Don't use double locking to migrate tasks across CPUs scx_central: Fix smatch checker warning sched_ext: Add missing cfi stub for ops.tick sched_ext: Use task_can_run_on_remote_rq() test in dispatch_to_local_dsq() sched_ext: Use sched_clock_cpu() instead of rq_clock_task() in touch_core_sched() sched_ext: Don't call put_prev_task_scx() before picking the next task sched_ext: Replace SCX_TASK_BAL_KEEP with SCX_RQ_BAL_KEEP sched_ext: Unify regular and core-sched pick task paths sched_ext: Relocate functions in kernel/sched/ext.c sched_ext: Remove switch_class_scx() sched_ext: Remove sched_class->switch_class() sched_ext: TASK_DEAD tasks must be switched out of SCX on ops_disable sched_ext: TASK_DEAD tasks must be switched into SCX on ops_enable sched: Expose css_tg() sched: Make cpu_shares_read_u64() use tg_weight() sched: Introduce CONFIG_GROUP_SCHED_WEIGHT sched_ext: Add cgroup support sched_ext: Add a cgroup scheduler which uses flattened hierarchy sched_ext: Temporarily work around pick_task_scx() being called without balance_scx() sched_ext: Add missing static to scx_has_op[] sched_ext: Add missing static to scx_dump_data sched_ext: Rename scx_kfunc_set_sleepable to unlocked and relocate sched_ext: Refactor consume_remote_task() sched_ext: Make find_dsq_for_dispatch() handle SCX_DSQ_LOCAL_ON sched_ext: Fix processs_ddsp_deferred_locals() by unifying DTL_INVALID handling sched_ext: Restructure dispatch_to_local_dsq() sched_ext: Reorder args for consume_local/remote_task() sched_ext: Move sanity check and dsq_mod_nr() into task_unlink_from_dsq() sched_ext: Move consume_local_task() upward sched_ext: Replace consume_local_task() with move_local_task_to_local_dsq() sched_ext: Compact struct bpf_iter_scx_dsq_kern sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq() scx_qmap: Implement highpri boosting sched_ext: Synchronize bypass state changes with rq lock sched_ext: Don't trigger ops.quiescent/runnable() on migrations sched_ext: Fix build when !CONFIG_STACKTRACE sched_ext: Build fix for !CONFIG_SMP sched_ext: Add __COMPAT helpers for features added during v6.12 devel cycle tools/sched_ext: Receive misc updates from SCX repo scx_flatcg: Use a user DSQ for fallback instead of SCX_DSQ_GLOBAL sched_ext: Allow only user DSQs for scx_bpf_consume(), scx_bpf_dsq_nr_queued() and bpf_iter_scx_dsq_new() sched_ext: Relocate find_user_dsq() sched_ext: Split the global DSQ per NUMA node sched_ext: Use shorter slice while bypassing sched_ext: Relocate check_hotplug_seq() call in scx_ops_enable() sched_ext: Remove SCX_OPS_PREPPING sched_ext: Initialize in bypass mode sched_ext: Fix SCX_TASK_INIT -> SCX_TASK_READY transitions in scx_ops_enable() sched_ext: Enable scx_ops_init_task() separately sched_ext: Add scx_cgroup_enabled to gate cgroup operations and fix scx_tg_online() sched_ext: Decouple locks in scx_ops_disable_workfn() sched_ext: Decouple locks in scx_ops_enable() sched_ext: Improve error reporting during loading sched_ext: scx_cgroup_exit() may be called without successful scx_cgroup_init() sched/core: Make select_task_rq() take the pointer to wake_flags instead of value sched/core: Add ENQUEUE_RQ_SELECTED to indicate whether ->select_task_rq() was called sched_ext, scx_qmap: Add and use SCX_ENQ_CPU_SELECTED Revert "sched_ext: Use shorter slice while bypassing" sched_ext: Start schedulers with consistent p->scx.slice values sched_ext: Move scx_buildin_idle_enabled check to scx_bpf_select_cpu_dfl() sched_ext: bypass mode shouldn't depend on ops.select_cpu() sched_ext: Move scx_tasks_lock handling into scx_task_iter helpers sched_ext: Don't hold scx_tasks_lock for too long sched_ext: Make cast_mask() inline sched_ext: Fix enq_last_no_enq_fails selftest sched_ext: Add a missing newline at the end of an error message sched_ext: Update scx_show_state.py to match scx_ops_bypass_depth's new type sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx() sched_ext: ops.cpu_acquire() should be called with SCX_KF_REST sched_ext: Factor out move_task_between_dsqs() from scx_dispatch_from_dsq() sched_ext: Rename CFI stubs to names that are recognized by BPF sched_ext: Replace set_arg_maybe_null() with __nullable CFI stub tags sched_ext: Avoid live-locking bypass mode switching sched_ext: Enable the ops breather and eject BPF scheduler on softlockup sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked context sched_ext: Rename scx_bpf_dispatch[_vtime]() to scx_bpf_dsq_insert[_vtime]() sched_ext: Rename scx_bpf_consume() to scx_bpf_dsq_move_to_local() sched_ext: Rename scx_bpf_dispatch[_vtime]_from_dsq*() -> scx_bpf_dsq_move[_vtime]*() sched_ext: Fix invalid irq restore in scx_ops_bypass() sched_ext: Fix dsq_local_on selftest tools/sched_ext: Receive updates from SCX repo sched_ext: selftests/dsp_local_on: Fix sporadic failures sched_ext: Fix incorrect autogroup migration detection sched_ext: Implement auto local dispatching of migration disabled tasks sched_ext: Fix migration disabled handling in targeted dispatches sched_ext: Fix incorrect assumption about migration disabled tasks in task_can_run_on_remote_rq() sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance() sched_ext: Implement SCX_OPS_ALLOW_QUEUED_WAKEUP sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator sched_ext: Make scx_group_set_weight() always update tg->scx.weight sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU sched_ext: Don't kick CPUs running higher classes sched_ext: Use SCX_TASK_READY test instead of tryget_task_struct() during class switch tools/sched_ext: Sync with scx repo Thomas Gleixner (1): sched/ext: Remove sched_fork() hack Thorsten Blum (1): sched_ext: Use str_enabled_disabled() helper in update_selcpu_topology() Tianchen Ding (1): sched_ext: Use btf_ids to resolve task_struct Tony Ambardar (1): libbpf: Ensure new BTF objects inherit input endianness Vincent Guittot (2): sched/cpufreq: Rework schedutil governor performance estimation sched/fair: Fix sched_can_stop_tick() for fair tasks Vishal Chourasia (2): sched_ext: Add __weak markers to BPF helper function decalarations sched_ext: Fix function pointer type mismatches in BPF selftests Wenyu Huang (1): sched/doc: Update documentation after renames and synchronize Chinese version Yafang Shao (2): bpf: Add bits iterator selftests/bpf: Add selftest for bits iter Yipeng Zou (1): sched_ext: Allow dequeue_task_scx to fail Yiwei Lin (1): sched/fair: Remove unused 'curr' argument from pick_next_entity() Yu Liao (2): sched: Put task_group::idle under CONFIG_GROUP_SCHED_WEIGHT sched: Add dummy version of sched_group_set_idle() Yury Norov (1): cpumask: introduce assign_cpu() macro Zhang Qiao (3): sched_ext: Remove redundant p->nr_cpus_allowed checker sched/ext: Fix unmatch trailing comment of CONFIG_EXT_GROUP_SCHED sched/ext: Use tg_cgroup() to elieminate duplicate code Zhao Mengmeng (1): sched_ext: Replace scx_next_task_picked() with switch_class() in comment Zicheng Qu (17): sched: Fix kabi for reweight_task in struct sched_class sched/syscalls: Fix kabi for EXPORT_SYMBOL moved from core.c to syscalls.c sched: Fix kabi for switching_to in struct sched_class sched/fair: Fix kabi for check_preempt_curr and wakeup_preempt in struct sched_class sched: Fix kabi for dequeue_task in struct sched_class sched_ext: Fix kabi for scx in struct task_struct sched_ext: Fix kabi for switch_class in struct sched_class sched: Fix kabi for exec_max in struct sched_statistics sched_ext: Fix kabi for balance in struct sched_class sched_ext: Fix kabi for header in kernel/sched/sched.h sched: Fix kabi pick_task in struct sched_class sched: Fix kabi for put_prev_task in struct sched_class sched_ext: Fix kabi for scx_flags and scx_weight in struct task_group sched: Fix kabi for int idle in struct task_group sched: Add __setscheduler_class() for sched_ext genirq: Fix kabi for kstat_irqs in struct irq_desc sched_ext: Enable and disable sched_ext configs Zqiang (1): sched_ext: Fix unsafe locking in the scx_dump_state() guanjing (1): sched_ext: fix application of sizeof to pointer Documentation/bpf/bpf_iterators.rst | 2 +- Documentation/bpf/kfuncs.rst | 14 +- Documentation/scheduler/index.rst | 1 + Documentation/scheduler/sched-design-CFS.rst | 8 +- Documentation/scheduler/sched-ext.rst | 325 + .../zh_CN/scheduler/sched-design-CFS.rst | 8 +- MAINTAINERS | 16 +- Makefile | 4 +- arch/arm64/configs/openeuler_defconfig | 3 + arch/arm64/kernel/bpf-rvi.c | 4 +- arch/arm64/net/bpf_jit_comp.c | 55 +- arch/mips/dec/setup.c | 2 +- arch/parisc/kernel/smp.c | 2 +- arch/powerpc/kvm/book3s_hv_rm_xics.c | 2 +- arch/riscv/include/asm/cfi.h | 3 +- arch/riscv/kernel/cfi.c | 2 +- arch/riscv/net/bpf_jit_comp64.c | 48 +- arch/s390/net/bpf_jit_comp.c | 59 +- arch/x86/configs/openeuler_defconfig | 2 + arch/x86/include/asm/cfi.h | 126 +- arch/x86/kernel/alternative.c | 87 +- arch/x86/kernel/cfi.c | 4 +- arch/x86/net/bpf_jit_comp.c | 261 +- block/blk-cgroup.c | 4 +- drivers/hid/bpf/hid_bpf_dispatch.c | 12 +- drivers/tty/sysrq.c | 1 + fs/proc/stat.c | 4 +- include/asm-generic/Kbuild | 1 + include/asm-generic/cfi.h | 5 + include/asm-generic/vmlinux.lds.h | 1 + include/linux/bitops.h | 2 + include/linux/bpf.h | 130 +- include/linux/bpf_mem_alloc.h | 3 + include/linux/bpf_verifier.h | 21 +- include/linux/btf.h | 105 + include/linux/btf_ids.h | 21 +- include/linux/cfi.h | 12 + include/linux/cgroup.h | 14 +- include/linux/cleanup.h | 42 +- include/linux/cpumask.h | 41 +- include/linux/energy_model.h | 1 - include/linux/file.h | 20 + include/linux/filter.h | 2 +- include/linux/irqdesc.h | 17 +- include/linux/kernel_stat.h | 8 + include/linux/module.h | 8 +- include/linux/sched.h | 8 +- include/linux/sched/ext.h | 216 + include/linux/sched/task.h | 8 +- include/trace/events/sched_ext.h | 32 + include/uapi/linux/bpf.h | 16 +- include/uapi/linux/sched.h | 1 + init/Kconfig | 10 + init/init_task.c | 12 + kernel/Kconfig.preempt | 27 +- kernel/bpf-rvi/common_kfuncs.c | 4 +- kernel/bpf/Makefile | 8 +- kernel/bpf/bpf_iter.c | 12 +- kernel/bpf/bpf_struct_ops.c | 745 +- kernel/bpf/bpf_struct_ops_types.h | 12 - kernel/bpf/btf.c | 431 +- kernel/bpf/cgroup_iter.c | 65 +- kernel/bpf/core.c | 76 +- kernel/bpf/cpumask.c | 18 +- kernel/bpf/dispatcher.c | 7 +- kernel/bpf/helpers.c | 202 +- kernel/bpf/map_iter.c | 10 +- kernel/bpf/memalloc.c | 14 +- kernel/bpf/syscall.c | 12 +- kernel/bpf/task_iter.c | 242 +- kernel/bpf/trampoline.c | 99 +- kernel/bpf/verifier.c | 317 +- kernel/cgroup/cgroup.c | 18 +- kernel/cgroup/cpuset.c | 4 +- kernel/cgroup/rstat.c | 13 +- kernel/events/core.c | 2 +- kernel/fork.c | 17 +- kernel/irq/Kconfig | 4 + kernel/irq/internals.h | 2 +- kernel/irq/irqdesc.c | 144 +- kernel/irq/proc.c | 5 +- kernel/module/main.c | 5 +- kernel/sched/autogroup.c | 4 +- kernel/sched/bpf_sched.c | 8 +- kernel/sched/build_policy.c | 13 + kernel/sched/core.c | 2492 +----- kernel/sched/cpuacct.c | 4 +- kernel/sched/cpufreq_schedutil.c | 83 +- kernel/sched/deadline.c | 175 +- kernel/sched/debug.c | 3 + kernel/sched/ext.c | 7155 +++++++++++++++++ kernel/sched/ext.h | 119 + kernel/sched/ext_idle.c | 755 ++ kernel/sched/ext_idle.h | 39 + kernel/sched/fair.c | 306 +- kernel/sched/idle.c | 31 +- kernel/sched/rt.c | 40 +- kernel/sched/sched.h | 473 +- kernel/sched/stop_task.c | 35 +- kernel/sched/syscalls.c | 1713 ++++ kernel/trace/bpf_trace.c | 12 +- kernel/trace/trace_probe.c | 2 - kernel/watchdog.c | 223 +- lib/Kconfig.debug | 14 + lib/dump_stack.c | 1 + lib/rhashtable.c | 12 +- net/bpf/bpf_dummy_struct_ops.c | 72 +- net/bpf/test_run.c | 30 +- net/core/filter.c | 33 +- net/core/xdp.c | 10 +- net/ipv4/bpf_tcp_ca.c | 93 +- net/ipv4/fou_bpf.c | 10 +- net/ipv4/tcp_bbr.c | 4 +- net/ipv4/tcp_cong.c | 6 +- net/ipv4/tcp_cubic.c | 4 +- net/ipv4/tcp_dctcp.c | 4 +- net/netfilter/nf_conntrack_bpf.c | 10 +- net/netfilter/nf_nat_bpf.c | 10 +- net/socket.c | 8 +- net/xfrm/xfrm_interface_bpf.c | 10 +- scripts/Makefile.btf | 33 + scripts/Makefile.modfinal | 2 +- scripts/gdb/linux/interrupts.py | 6 +- scripts/pahole-flags.sh | 30 - tools/Makefile | 10 +- .../bpf/bpftool/Documentation/bpftool-gen.rst | 58 +- tools/bpf/bpftool/gen.c | 253 +- tools/bpf/resolve_btfids/main.c | 8 + tools/include/linux/bitops.h | 2 + tools/include/uapi/linux/bpf.h | 14 +- tools/include/uapi/linux/sched.h | 1 + tools/lib/bpf/Build | 2 +- tools/lib/bpf/bpf.c | 4 +- tools/lib/bpf/bpf.h | 4 +- tools/lib/bpf/btf.c | 704 +- tools/lib/bpf/btf.h | 36 + tools/lib/bpf/btf_iter.c | 177 + tools/lib/bpf/btf_relocate.c | 519 ++ tools/lib/bpf/libbpf.c | 97 +- tools/lib/bpf/libbpf.map | 4 +- tools/lib/bpf/libbpf_internal.h | 29 +- tools/lib/bpf/libbpf_probes.c | 1 + tools/lib/bpf/linker.c | 58 +- tools/perf/util/probe-finder.c | 4 +- tools/sched_ext/.gitignore | 2 + tools/sched_ext/Makefile | 246 + tools/sched_ext/README.md | 270 + .../sched_ext/include/bpf-compat/gnu/stubs.h | 11 + tools/sched_ext/include/scx/common.bpf.h | 647 ++ tools/sched_ext/include/scx/common.h | 81 + tools/sched_ext/include/scx/compat.bpf.h | 143 + tools/sched_ext/include/scx/compat.h | 187 + .../sched_ext/include/scx/enums.autogen.bpf.h | 105 + tools/sched_ext/include/scx/enums.autogen.h | 41 + tools/sched_ext/include/scx/enums.bpf.h | 12 + tools/sched_ext/include/scx/enums.h | 27 + tools/sched_ext/include/scx/user_exit_info.h | 118 + tools/sched_ext/scx_central.bpf.c | 356 + tools/sched_ext/scx_central.c | 145 + tools/sched_ext/scx_flatcg.bpf.c | 954 +++ tools/sched_ext/scx_flatcg.c | 234 + tools/sched_ext/scx_flatcg.h | 51 + tools/sched_ext/scx_qmap.bpf.c | 827 ++ tools/sched_ext/scx_qmap.c | 155 + tools/sched_ext/scx_show_state.py | 42 + tools/sched_ext/scx_simple.bpf.c | 151 + tools/sched_ext/scx_simple.c | 107 + tools/testing/selftests/Makefile | 9 +- tools/testing/selftests/bpf/.gitignore | 1 + .../testing/selftests/bpf/bpf_experimental.h | 96 + .../selftests/bpf/bpf_testmod/bpf_testmod.c | 160 +- .../selftests/bpf/bpf_testmod/bpf_testmod.h | 61 + .../bpf/bpf_testmod/bpf_testmod_kfunc.h | 9 + .../selftests/bpf/prog_tests/bpf_iter.c | 44 +- .../selftests/bpf/prog_tests/btf_distill.c | 692 ++ .../selftests/bpf/prog_tests/cgroup_iter.c | 33 + .../bpf/prog_tests/global_func_dead_code.c | 60 + .../testing/selftests/bpf/prog_tests/iters.c | 209 + .../selftests/bpf/prog_tests/kfunc_call.c | 1 + .../selftests/bpf/prog_tests/rcu_read_lock.c | 6 + .../selftests/bpf/prog_tests/spin_lock.c | 2 + .../prog_tests/test_struct_ops_maybe_null.c | 46 + .../bpf/prog_tests/test_struct_ops_module.c | 86 + .../prog_tests/test_struct_ops_multi_pages.c | 30 + .../testing/selftests/bpf/prog_tests/timer.c | 4 + .../selftests/bpf/prog_tests/verifier.c | 4 + ...f_iter_task_vma.c => bpf_iter_task_vmas.c} | 0 .../{bpf_iter_task.c => bpf_iter_tasks.c} | 0 .../bpf/progs/freplace_dead_global_func.c | 11 + tools/testing/selftests/bpf/progs/iters_css.c | 72 + .../selftests/bpf/progs/iters_css_task.c | 102 + .../testing/selftests/bpf/progs/iters_task.c | 41 + .../selftests/bpf/progs/iters_task_failure.c | 105 + .../selftests/bpf/progs/iters_task_vma.c | 43 + .../selftests/bpf/progs/iters_testmod_seq.c | 50 + .../selftests/bpf/progs/kfunc_call_test.c | 37 + .../selftests/bpf/progs/rcu_read_lock.c | 120 + .../bpf/progs/struct_ops_maybe_null.c | 29 + .../bpf/progs/struct_ops_maybe_null_fail.c | 24 + .../selftests/bpf/progs/struct_ops_module.c | 37 + .../bpf/progs/struct_ops_multi_pages.c | 102 + .../selftests/bpf/progs/test_global_func12.c | 4 +- .../selftests/bpf/progs/test_spin_lock.c | 65 + .../selftests/bpf/progs/test_spin_lock_fail.c | 44 + tools/testing/selftests/bpf/progs/timer.c | 63 +- .../selftests/bpf/progs/verifier_bits_iter.c | 232 + .../bpf/progs/verifier_global_subprogs.c | 101 + .../selftests/bpf/progs/verifier_spin_lock.c | 2 +- .../bpf/progs/verifier_subprog_precision.c | 4 +- tools/testing/selftests/bpf/test_loader.c | 10 +- tools/testing/selftests/bpf/test_maps.c | 18 +- tools/testing/selftests/bpf/test_maps.h | 5 + tools/testing/selftests/sched_ext/.gitignore | 6 + tools/testing/selftests/sched_ext/Makefile | 211 + tools/testing/selftests/sched_ext/config | 9 + .../selftests/sched_ext/create_dsq.bpf.c | 58 + .../testing/selftests/sched_ext/create_dsq.c | 57 + .../sched_ext/ddsp_bogus_dsq_fail.bpf.c | 42 + .../selftests/sched_ext/ddsp_bogus_dsq_fail.c | 60 + .../sched_ext/ddsp_vtimelocal_fail.bpf.c | 39 + .../sched_ext/ddsp_vtimelocal_fail.c | 59 + .../selftests/sched_ext/dsp_local_on.bpf.c | 68 + .../selftests/sched_ext/dsp_local_on.c | 60 + .../sched_ext/enq_last_no_enq_fails.bpf.c | 29 + .../sched_ext/enq_last_no_enq_fails.c | 64 + .../sched_ext/enq_select_cpu_fails.bpf.c | 43 + .../sched_ext/enq_select_cpu_fails.c | 61 + tools/testing/selftests/sched_ext/exit.bpf.c | 86 + tools/testing/selftests/sched_ext/exit.c | 64 + tools/testing/selftests/sched_ext/exit_test.h | 20 + .../testing/selftests/sched_ext/hotplug.bpf.c | 61 + tools/testing/selftests/sched_ext/hotplug.c | 170 + .../selftests/sched_ext/hotplug_test.h | 15 + .../sched_ext/init_enable_count.bpf.c | 53 + .../selftests/sched_ext/init_enable_count.c | 157 + .../testing/selftests/sched_ext/maximal.bpf.c | 166 + tools/testing/selftests/sched_ext/maximal.c | 54 + .../selftests/sched_ext/maybe_null.bpf.c | 36 + .../testing/selftests/sched_ext/maybe_null.c | 49 + .../sched_ext/maybe_null_fail_dsp.bpf.c | 25 + .../sched_ext/maybe_null_fail_yld.bpf.c | 28 + .../testing/selftests/sched_ext/minimal.bpf.c | 21 + tools/testing/selftests/sched_ext/minimal.c | 58 + .../selftests/sched_ext/prog_run.bpf.c | 33 + tools/testing/selftests/sched_ext/prog_run.c | 78 + .../testing/selftests/sched_ext/reload_loop.c | 74 + tools/testing/selftests/sched_ext/runner.c | 212 + tools/testing/selftests/sched_ext/scx_test.h | 131 + .../selftests/sched_ext/select_cpu_dfl.bpf.c | 40 + .../selftests/sched_ext/select_cpu_dfl.c | 75 + .../sched_ext/select_cpu_dfl_nodispatch.bpf.c | 89 + .../sched_ext/select_cpu_dfl_nodispatch.c | 75 + .../sched_ext/select_cpu_dispatch.bpf.c | 41 + .../selftests/sched_ext/select_cpu_dispatch.c | 73 + .../select_cpu_dispatch_bad_dsq.bpf.c | 37 + .../sched_ext/select_cpu_dispatch_bad_dsq.c | 59 + .../select_cpu_dispatch_dbl_dsp.bpf.c | 38 + .../sched_ext/select_cpu_dispatch_dbl_dsp.c | 59 + .../sched_ext/select_cpu_vtime.bpf.c | 92 + .../selftests/sched_ext/select_cpu_vtime.c | 62 + .../selftests/sched_ext/test_example.c | 49 + tools/testing/selftests/sched_ext/util.c | 71 + tools/testing/selftests/sched_ext/util.h | 13 + 263 files changed, 27732 insertions(+), 3787 deletions(-) create mode 100644 Documentation/scheduler/sched-ext.rst create mode 100644 include/asm-generic/cfi.h create mode 100644 include/linux/sched/ext.h create mode 100644 include/trace/events/sched_ext.h delete mode 100644 kernel/bpf/bpf_struct_ops_types.h create mode 100644 kernel/sched/ext.c create mode 100644 kernel/sched/ext.h create mode 100644 kernel/sched/ext_idle.c create mode 100644 kernel/sched/ext_idle.h create mode 100644 kernel/sched/syscalls.c create mode 100644 scripts/Makefile.btf delete mode 100755 scripts/pahole-flags.sh create mode 100644 tools/lib/bpf/btf_iter.c create mode 100644 tools/lib/bpf/btf_relocate.c create mode 100644 tools/sched_ext/.gitignore create mode 100644 tools/sched_ext/Makefile create mode 100644 tools/sched_ext/README.md create mode 100644 tools/sched_ext/include/bpf-compat/gnu/stubs.h create mode 100644 tools/sched_ext/include/scx/common.bpf.h create mode 100644 tools/sched_ext/include/scx/common.h create mode 100644 tools/sched_ext/include/scx/compat.bpf.h create mode 100644 tools/sched_ext/include/scx/compat.h create mode 100644 tools/sched_ext/include/scx/enums.autogen.bpf.h create mode 100644 tools/sched_ext/include/scx/enums.autogen.h create mode 100644 tools/sched_ext/include/scx/enums.bpf.h create mode 100644 tools/sched_ext/include/scx/enums.h create mode 100644 tools/sched_ext/include/scx/user_exit_info.h create mode 100644 tools/sched_ext/scx_central.bpf.c create mode 100644 tools/sched_ext/scx_central.c create mode 100644 tools/sched_ext/scx_flatcg.bpf.c create mode 100644 tools/sched_ext/scx_flatcg.c create mode 100644 tools/sched_ext/scx_flatcg.h create mode 100644 tools/sched_ext/scx_qmap.bpf.c create mode 100644 tools/sched_ext/scx_qmap.c create mode 100644 tools/sched_ext/scx_show_state.py create mode 100644 tools/sched_ext/scx_simple.bpf.c create mode 100644 tools/sched_ext/scx_simple.c create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_distill.c create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_maybe_null.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_module.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_pages.c rename tools/testing/selftests/bpf/progs/{bpf_iter_task_vma.c => bpf_iter_task_vmas.c} (100%) rename tools/testing/selftests/bpf/progs/{bpf_iter_task.c => bpf_iter_tasks.c} (100%) create mode 100644 tools/testing/selftests/bpf/progs/freplace_dead_global_func.c create mode 100644 tools/testing/selftests/bpf/progs/iters_css.c create mode 100644 tools/testing/selftests/bpf/progs/iters_css_task.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task_failure.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task_vma.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null_fail.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_module.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_multi_pages.c create mode 100644 tools/testing/selftests/bpf/progs/verifier_bits_iter.c create mode 100644 tools/testing/selftests/bpf/progs/verifier_global_subprogs.c create mode 100644 tools/testing/selftests/sched_ext/.gitignore create mode 100644 tools/testing/selftests/sched_ext/Makefile create mode 100644 tools/testing/selftests/sched_ext/config create mode 100644 tools/testing/selftests/sched_ext/create_dsq.bpf.c create mode 100644 tools/testing/selftests/sched_ext/create_dsq.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.bpf.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.bpf.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.c create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.bpf.c create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.c create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.bpf.c create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.c create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.bpf.c create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.c create mode 100644 tools/testing/selftests/sched_ext/exit.bpf.c create mode 100644 tools/testing/selftests/sched_ext/exit.c create mode 100644 tools/testing/selftests/sched_ext/exit_test.h create mode 100644 tools/testing/selftests/sched_ext/hotplug.bpf.c create mode 100644 tools/testing/selftests/sched_ext/hotplug.c create mode 100644 tools/testing/selftests/sched_ext/hotplug_test.h create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.bpf.c create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.c create mode 100644 tools/testing/selftests/sched_ext/maximal.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maximal.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_dsp.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_yld.bpf.c create mode 100644 tools/testing/selftests/sched_ext/minimal.bpf.c create mode 100644 tools/testing/selftests/sched_ext/minimal.c create mode 100644 tools/testing/selftests/sched_ext/prog_run.bpf.c create mode 100644 tools/testing/selftests/sched_ext/prog_run.c create mode 100644 tools/testing/selftests/sched_ext/reload_loop.c create mode 100644 tools/testing/selftests/sched_ext/runner.c create mode 100644 tools/testing/selftests/sched_ext/scx_test.h create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.c create mode 100644 tools/testing/selftests/sched_ext/test_example.c create mode 100644 tools/testing/selftests/sched_ext/util.c create mode 100644 tools/testing/selftests/sched_ext/util.h -- 2.34.1

2 452

[PATCH OLK-6.6] wifi: libertas: fix use-after-free in lbs_free_adapter()
by Wupeng Ma 03 Apr '26

03 Apr '26

From: Daniel Hodges <git(a)danielhodges.dev> stable inclusion from stable-v6.6.130 commit 3c5c818c78b03a1725f3dcd566865c77b48dd3a6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13984 CVE: CVE-2026-23281 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0 ] The lbs_free_adapter() function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before the structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete. If a timer callback is executing when lbs_free_adapter() is called, the callback will access freed memory since lbs_cfg_free() frees the containing structure immediately after lbs_free_adapter() returns. Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler) access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields, which would all be use-after-free violations. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning. This bug was introduced in commit 8f641d93c38a ("libertas: detect TX lockups and reset hardware") where del_timer() was used instead of del_timer_sync() in the cleanup path. The command_timer has had the same issue since the driver was first written. Fixes: 8f641d93c38a ("libertas: detect TX lockups and reset hardware") Fixes: 954ee164f4f4 ("[PATCH] libertas: reorganize and simplify init sequence") Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Hodges <git(a)danielhodges.dev> Link: https://patch.msgid.link/20260206195356.15647-1-git@danielhodges.dev Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> [ del_timer() => timer_delete_sync() ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/wireless/marvell/libertas/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c index 78e8b5aecec0e..91b9501c6d8cb 100644 --- a/drivers/net/wireless/marvell/libertas/main.c +++ b/drivers/net/wireless/marvell/libertas/main.c @@ -881,8 +881,8 @@ static void lbs_free_adapter(struct lbs_private *priv) { lbs_free_cmd_buffer(priv); kfifo_free(&priv->event_fifo); - del_timer(&priv->command_timer); - del_timer(&priv->tx_lockup_timer); + timer_delete_sync(&priv->command_timer); + timer_delete_sync(&priv->tx_lockup_timer); del_timer(&priv->auto_deepsleep_timer); } -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression
by Li Xiasong 03 Apr '26

03 Apr '26

This patchset contains a backport of the upstream change that introduced the issue, followed by the fix. Patch 1 is a backport of upstream commit f478b8239d65 ("net: tunnel: make skb_vlan_inet_prepare() return drop reasons") which changed the return value semantics of skb_vlan_inet_prepare(). Patch 2 adapts the return value handling in __ip6_tnl_rcv() to match the new semantics, fixing the regression. Including the upstream change as patch 1 ensures that applying both patches together does not introduce the issue that would occur if only patch 1 were merged. Li Xiasong (1): ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change Menglong Dong (1): net: tunnel: make skb_vlan_inet_prepare() return drop reasons drivers/net/bareudp.c | 4 ++-- drivers/net/geneve.c | 4 ++-- include/net/ip_tunnels.h | 13 ++++++++----- net/ipv6/ip6_tunnel.c | 2 +- 4 files changed, 13 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
by Wupeng Ma 03 Apr '26

03 Apr '26

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> stable inclusion from stable-v6.6.130 commit f6e90c113c92e83fc0963d5e60e16b0e8a268981 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13957 CVE: CVE-2026-23324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5eaad4f768266f1f17e01232ffe2ef009f8129b7 upstream. When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logic is correctly done elsewhere in the driver, except in the read bulk callback so do that here also. Cc: Vincent Mailhol <mailhol(a)kernel.org> Cc: Marc Kleine-Budde <mkl(a)pengutronix.de> Cc: stable(a)kernel.org Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Reviewed-by: Vincent Mailhol <mailhol(a)kernel.org> Tested-by: Vincent Mailhol <mailhol(a)kernel.org> Link: https://patch.msgid.link/2026022320-poser-stiffly-9d84@gregkh Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces") Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/can/usb/etas_es58x/es58x_core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c index bb49a2c0a9a5c..3edf06106f9d3 100644 --- a/drivers/net/can/usb/etas_es58x/es58x_core.c +++ b/drivers/net/can/usb/etas_es58x/es58x_core.c @@ -1461,12 +1461,18 @@ static void es58x_read_bulk_callback(struct urb *urb) } resubmit_urb: + usb_anchor_urb(urb, &es58x_dev->rx_urbs); ret = usb_submit_urb(urb, GFP_ATOMIC); + if (!ret) + return; + + usb_unanchor_urb(urb); + if (ret == -ENODEV) { for (i = 0; i < es58x_dev->num_can_ch; i++) if (es58x_dev->netdev[i]) netif_device_detach(es58x_dev->netdev[i]); - } else if (ret) + } else dev_err_ratelimited(dev, "Failed resubmitting read bulk urb: %pe\n", ERR_PTR(ret)); -- 2.43.0

2 1

[PATCH OLK-6.6 000/451] sched_ext v1
by Zicheng Qu 03 Apr '26

03 Apr '26

Aboorva Devarajan (2): sched_ext: Documentation: Remove mentions of scx_bpf_switch_all sched: Pass correct scheduling policy to __setscheduler_class Alan Maguire (16): kbuild,bpf: Switch to using --btf_features for pahole v1.26 and later kbuild, bpf: Use test-ge check for v1.25-only pahole libbpf: Add btf__distill_base() creating split BTF with distilled base BTF selftests/bpf: Test distilled base, split BTF generation libbpf: Split BTF relocation selftests/bpf: Extend distilled BTF tests to cover BTF relocation resolve_btfids: Handle presence of .BTF.base section libbpf: BTF relocation followup fixing naming, loop logic module, bpf: Store BTF base pointer in struct module libbpf: Split field iter code into its own file kernel libbpf,bpf: Share BTF relocate-related code with kernel kbuild,bpf: Add module-specific pahole flags for distilled base BTF selftests/bpf: Add kfunc_call test for simple dtor in bpf_testmod bpf: fix build when CONFIG_DEBUG_INFO_BTF[_MODULES] is undefined libbpf: Fix error handling in btf__distill_base() libbpf: Fix license for btf_relocate.c Alexander Lobakin (1): bitops: make BYTES_TO_BITS() treewide-available Alexei Starovoitov (2): s390/bpf: Fix indirect trampoline generation bpf: Introduce "volatile compare" macros Andrea Righi (33): sched_ext: fix typo in set_weight() description sched_ext: add CONFIG_DEBUG_INFO_BTF dependency sched_ext: Provide a sysfs enable_seq counter sched_ext: improve WAKE_SYNC behavior for default idle CPU selection sched_ext: Clarify ops.select_cpu() for single-CPU tasks sched_ext: Introduce LLC awareness to the default idle selection policy sched_ext: Introduce NUMA awareness to the default idle selection policy sched_ext: Do not enable LLC/NUMA optimizations when domains overlap sched_ext: Fix incorrect use of bitwise AND MAINTAINERS: add self as reviewer for sched_ext sched_ext: idle: Refresh idle masks during idle-to-idle transitions sched_ext: Use the NUMA scheduling domain for NUMA optimizations sched_ext: idle: use assign_cpu() to update the idle cpumask sched_ext: idle: clarify comments sched_ext: idle: introduce check_builtin_idle_enabled() helper sched_ext: idle: small CPU iteration refactoring sched_ext: update scx_bpf_dsq_insert() doc for SCX_DSQ_LOCAL_ON sched_ext: Include remaining task time slice in error state dump sched_ext: Include task weight in the error state dump selftests/sched_ext: Fix enum resolution tools/sched_ext: Add helper to check task migration state sched_ext: selftests/dsp_local_on: Fix selftest on UP systems sched_ext: Fix lock imbalance in dispatch_to_local_dsq() selftests/sched_ext: Fix exit selftest hang on UP sched_ext: Move built-in idle CPU selection policy to a separate file sched_ext: Track currently locked rq sched_ext: Make scx_locked_rq() inline sched_ext: Fix missing rq lock in scx_bpf_cpuperf_set() sched/ext: Fix invalid task state transitions on class switch sched_ext: Make scx_kf_allowed_if_unlocked() available outside ext.c sched_ext: Remove duplicate BTF_ID_FLAGS definitions sched_ext: Fix rq lock state in hotplug ops sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl() Andrii Nakryiko (14): bpf: Emit global subprog name in verifier logs bpf: Validate global subprogs lazily selftests/bpf: Add lazy global subprog validation tests libbpf: Add btf__new_split() API that was declared but not implemented bpf: move sleepable flag from bpf_prog_aux to bpf_prog libbpf: Add BTF field iterator libbpf: Make use of BTF field iterator in BPF linker code libbpf: Make use of BTF field iterator in BTF handling code bpftool: Use BTF field iterator in btfgen libbpf: Remove callback-based type/string BTF field visitor helpers bpf: extract iterator argument type and name validation logic bpf: allow passing struct bpf_iter_<type> as kfunc arguments selftests/bpf: test passing iterator to a kfunc selftests/bpf: validate eliminated global subprog is not freplaceable Arnaldo Carvalho de Melo (1): tools include UAPI: Sync linux/sched.h copy with the kernel sources Atul Kumar Pant (1): sched_ext: Fixes typos in comments Benjamin Tissoires (1): bpf: introduce in_sleepable() helper Bitao Hu (4): genirq: Convert kstat_irqs to a struct genirq: Provide a snapshot mechanism for interrupt statistics watchdog/softlockup: Low-overhead detection of interrupt storm watchdog/softlockup: Report the most frequent interrupts Björn Töpel (1): selftests: sched_ext: Add sched_ext as proper selftest target Breno Leitao (3): rhashtable: Fix potential deadlock by moving schedule_work outside lock sched_ext: Use kvzalloc for large exit_dump allocation sched/ext: Prevent update_locked_rq() calls with NULL rq Changwoo Min (12): sched_ext: Clarify sched_ext_ops table for userland scheduler sched_ext: add a missing rcu_read_lock/unlock pair at scx_select_cpu_dfl() MAINTAINERS: add me as reviewer for sched_ext sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass() sched_ext: Relocate scx_enabled() related code sched_ext: Implement scx_bpf_now() sched_ext: Add scx_bpf_now() for BPF scheduler sched_ext: Add time helpers for BPF schedulers sched_ext: Replace bpf_ktime_get_ns() to scx_bpf_now() sched_ext: Use time helpers in BPF schedulers sched_ext: Fix incorrect time delta calculation in time_delta() sched_ext: Add scx_bpf_events() and scx_read_event() for BPF schedulers Cheng-Yang Chou (1): sched_ext: Always use SMP versions in kernel/sched/ext.c Christian Brauner (1): file: add take_fd() cleanup helper Christian Loehle (1): sched/fair: Remove stale FREQUENCY_UTIL comment Christophe Leroy (2): bpf: Remove arch_unprotect_bpf_trampoline() bpf: Check return from set_memory_rox() Chuyi Zhou (15): cgroup: Prepare for using css_task_iter_*() in BPF bpf: Introduce css_task open-coded iterator kfuncs bpf: Introduce task open coded iterator kfuncs bpf: Introduce css open-coded iterator kfuncs bpf: teach the verifier to enforce css_iter and task_iter in RCU CS bpf: Let bpf_iter_task_new accept null task ptr selftests/bpf: rename bpf_iter_task.c to bpf_iter_tasks.c selftests/bpf: Add tests for open-coded task and css iter bpf: Relax allowlist for css_task iter selftests/bpf: Add tests for css_task iter combining with cgroup iter selftests/bpf: Add test for using css_task iter in sleepable progs bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h. sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx Colin Ian King (1): sched_ext: Fix spelling mistake: "intead" -> "instead" Daniel Xu (3): bpf: btf: Support flags for BTF_SET8 sets bpf: btf: Add BTF_KFUNCS_START/END macro pair bpf: treewide: Annotate BPF kfuncs in BTF Dave Marchevsky (6): bpf: Don't explicitly emit BTF for struct btf_iter_num selftests/bpf: Rename bpf_iter_task_vma.c to bpf_iter_task_vmas.c bpf: Introduce task_vma open-coded iterator kfuncs selftests/bpf: Add tests for open-coded task_vma iter bpf: Add __bpf_kfunc_{start,end}_defs macros bpf: Add __bpf_hook_{start,end} macros David Vernet (15): bpf: Add ability to pin bpf timer to calling CPU selftests/bpf: Test pinning bpf timer to a core sched_ext: Implement runnable task stall watchdog sched_ext: Print sched_ext info when dumping stack sched_ext: Implement SCX_KICK_WAIT sched_ext: Implement sched_ext_ops.cpu_acquire/release() sched_ext: Add selftests bpf: Load vmlinux btf for any struct_ops map sched_ext: Make scx_bpf_cpuperf_set() @cpu arg signed scx: Allow calling sleepable kfuncs from BPF_PROG_TYPE_SYSCALL scx/selftests: Verify we can call create_dsq from prog_run sched_ext: Remove unnecessary cpu_relax() scx: Fix exit selftest to use custom DSQ scx: Fix raciness in scx_ops_bypass() scx: Fix maximal BPF selftest prog Dawei Li (1): genirq: Deduplicate interrupt descriptor initialization Devaansh Kumar (1): sched_ext: selftests: Fix grammar in tests description Devaansh-Kumar (1): sched_ext: Documentation: Update instructions for running example schedulers Eduard Zingerman (2): libbpf: Make btf_parse_elf process .BTF.base transparently selftests/bpf: Check if distilled base inherits source endianness Geliang Tang (1): bpf, btf: Check btf for register_bpf_struct_ops Henry Huang (2): sched_ext: initialize kit->cursor.flags sched_ext: keep running prev when prev->scx.slice != 0 Herbert Xu (1): rhashtable: Fix rhashtable_try_insert test Honglei Wang (3): sched_ext: use correct function name in pick_task_scx() warning message sched_ext: Add __weak to fix the build errors sched_ext: switch class when preempted by higher priority scheduler Hongyan Xia (1): sched/ext: Add BPF function to fetch rq Hou Tao (7): bpf: Free dynamically allocated bits in bpf_iter_bits_destroy() bpf: Add bpf_mem_alloc_check_size() helper bpf: Check the validity of nr_words in bpf_iter_bits_new() bpf: Use __u64 to save the bits in bits iterator selftests/bpf: Add three test cases for bits_iter selftests/bpf: Use -4095 as the bad address for bits iterator selftests/bpf: Export map_update_retriable() Ihor Solodrai (2): selftests/sched_ext: add order-only dependency of runner.o on BPFOBJ selftests/sched_ext: fix build after renames in sched_ext API Ilpo Järvinen (1): <linux/cleanup.h>: Allow the passing of both iomem and non-iomem pointers to no_free_ptr() Ingo Molnar (3): sched/syscalls: Split out kernel/sched/syscalls.c from kernel/sched/core.c sched/fair: Rename check_preempt_wakeup() to check_preempt_wakeup_fair() sched/fair: Rename check_preempt_curr() to wakeup_preempt() Jake Hillion (2): sched_ext: create_dsq: Return -EEXIST on duplicate request sched_ext: Drop kfuncs marked for removal in 6.15 Jiapeng Chong (1): sched_ext: Fixes incorrect type in bpf_scx_init() Jiayuan Chen (1): selftests/bpf: Fixes for test_maps test Kui-Feng Lee (29): bpf: refactory struct_ops type initialization to a function. bpf: get type information with BTF_ID_LIST bpf, net: introduce bpf_struct_ops_desc. bpf: add struct_ops_tab to btf. bpf: make struct_ops_map support btfs other than btf_vmlinux. bpf: pass btf object id in bpf_map_info. bpf: lookup struct_ops types from a given module BTF. bpf: pass attached BTF to the bpf_struct_ops subsystem bpf: hold module refcnt in bpf_struct_ops map creation and prog verification. bpf: validate value_type bpf, net: switch to dynamic registration libbpf: Find correct module BTFs for struct_ops maps and progs. bpf: export btf_ctx_access to modules. selftests/bpf: test case for register_bpf_struct_ops(). bpf: Fix error checks against bpf_get_btf_vmlinux(). bpf: Remove an unnecessary check. selftests/bpf: Suppress warning message of an unused variable. bpf: add btf pointer to struct bpf_ctx_arg_aux. bpf: Move __kfunc_param_match_suffix() to btf.c. bpf: Create argument information for nullable arguments. selftests/bpf: Test PTR_MAYBE_NULL arguments of struct_ops operators. libbpf: Set btf_value_type_id of struct bpf_map for struct_ops. libbpf: Convert st_ops->data to shadow type. bpftool: Generated shadow variables for struct_ops maps. bpftool: Add an example for struct_ops map and shadow type. selftests/bpf: Test if shadow types work correctly. bpf, net: validate struct_ops when updating value. bpf: struct_ops supports more than one page for trampolines. selftests/bpf: Test struct_ops maps with a large number of struct_ops program. Kumar Kartikeya Dwivedi (4): bpf: Allow calling static subprogs while holding a bpf_spin_lock selftests/bpf: Add test for static subprog call in lock cs bpf: Transfer RCU lock state between subprog calls selftests/bpf: Add tests for RCU lock transfer between subprogs Liang Jie (1): sched_ext: Use sizeof_field for key_len in dsq_hash_params Luo Gengkun (7): bpf: Fix kabi-breakage for bpf_func_info_aux bpf: Fix kabi-breakage for bpf_tramp_image bpf: Fix kabi for bpf_attr bpf_verifier: Fix kabi for bpf_verifier_env bpf: Fix kabi for bpf_ctx_arg_aux bpf: Fix kabi for bpf_prog_aux and bpf_prog selftests/bpf: modify test_loader that didn't support running bpf_prog_type_syscall programs Manu Bretelle (1): sched_ext: define missing cfi stubs for sched_ext Martin KaFai Lau (5): libbpf: Ensure undefined bpf_attr field stays 0 bpf: Remove unnecessary err < 0 check in bpf_struct_ops_map_update_elem bpf: Fix a crash when btf_parse_base() returns an error pointer bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing bpf: Use kallsyms to find the function name of a struct_ops's stub function Masahiro Yamada (1): kbuild: avoid too many execution of scripts/pahole-flags.sh Matthieu Baerts (1): bpf: fix compilation error without CGROUPS Peter Zijlstra (26): cfi: Flip headers x86/cfi,bpf: Fix BPF JIT call x86/cfi,bpf: Fix bpf_callback_t CFI x86/cfi,bpf: Fix bpf_struct_ops CFI cfi: Add CFI_NOSEAL() bpf: Fix dtor CFI cleanup: Make no_free_ptr() __must_check sched: Simplify set_user_nice() sched: Simplify syscalls sched: Simplify sched_{set,get}affinity() sched: Simplify yield_to() sched: Simplify sched_rr_get_interval() sched: Simplify sched_move_task() sched: Misc cleanups sched/deadline: Move bandwidth accounting into {en,de}queue_dl_entity sched: Allow sched_class::dequeue_task() to fail sched: Unify runtime accounting across classes sched: Use set_next_task(.first) where required sched/fair: Cleanup pick_task_fair() vs throttle sched/fair: Cleanup pick_task_fair()'s curr sched/fair: Unify pick_{,next_}_task_fair() sched: Fixup set_next_task() implementations sched: Split up put_prev_task_balance() sched: Rework pick_next_task() sched: Combine the last put_prev_task() and the first set_next_task() sched: Add put_prev_task(.next) Pu Lehui (8): riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops bpf: Fix kabi breakage in struct module riscv, bpf: Fix out-of-bounds issue when preparing trampoline image selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill test libbpf: Fix return zero when elf_begin failed libbpf: Fix incorrect traversal end type ID when marking BTF_IS_EMBEDDED selftests/bpf: Add distilled BTF test about marking BTF_IS_EMBEDDED selftests/bpf: Add file_read_pattern to gitignore Randy Dunlap (1): sched_ext: fix kernel-doc warnings Shizhao Chen (1): sched_ext: Add option -l in selftest runner to list all available tests Song Liu (8): bpf: Charge modmem for struct_ops trampoline bpf: Let bpf_prog_pack_free handle any pointer bpf: Adjust argument names of arch_prepare_bpf_trampoline() bpf: Add helpers for trampoline image management bpf, x86: Adjust arch_prepare_bpf_trampoline return value bpf: Add arch_bpf_trampoline_size() bpf: Use arch_bpf_trampoline_size x86, bpf: Use bpf_prog_pack for bpf trampoline T.J. Mercier (1): bpf, docs: Fix broken link to renamed bpf_iter_task_vmas.c Tejun Heo (152): sched: Restructure sched_class order sanity checks in sched_init() sched: Allow sched_cgroup_fork() to fail and introduce sched_cancel_fork() sched: Add sched_class->reweight_task() sched: Add sched_class->switching_to() and expose check_class_changing/changed() sched: Factor out cgroup weight conversion functions sched: Factor out update_other_load_avgs() from __update_blocked_others() sched: Add normal_policy() sched_ext: Add boilerplate for extensible scheduler class sched_ext: Implement BPF extensible scheduler class sched_ext: Add scx_simple and scx_example_qmap example schedulers sched_ext: Add sysrq-S which disables the BPF scheduler sched_ext: Allow BPF schedulers to disallow specific tasks from joining SCHED_EXT sched_ext: Print debug dump after an error exit tools/sched_ext: Add scx_show_state.py sched_ext: Implement scx_bpf_kick_cpu() and task preemption support sched_ext: Add a central scheduler which makes all scheduling decisions on one CPU sched_ext: Make watchdog handle ops.dispatch() looping stall sched_ext: Add task state tracking operations sched_ext: Implement tickless support sched_ext: Track tasks that are subjects of the in-flight SCX operation sched_ext: Implement sched_ext_ops.cpu_online/offline() sched_ext: Bypass BPF scheduler while PM events are in progress sched_ext: Implement core-sched support sched_ext: Add vtime-ordered priority queue to dispatch_q's sched_ext: Documentation: scheduler: Document extensible scheduler class sched, sched_ext: Replace scx_next_task_picked() with sched_class->switch_class() cpufreq_schedutil: Refactor sugov_cpu_is_busy() sched_ext: Add cpuperf support sched_ext: Drop tools_clean target from the top-level Makefile sched_ext: Swap argument positions in kcalloc() call to avoid compiler warning sched, sched_ext: Simplify dl_prio() case handling in sched_fork() sched_ext: Account for idle policy when setting p->scx.weight in scx_ops_enable_task() sched_ext: Disallow loading BPF scheduler if isolcpus= domain isolation is in effect sched_ext: Minor cleanups in kernel/sched/ext.h sched, sched_ext: Open code for_balance_class_range() sched, sched_ext: Move some declarations from kernel/sched/ext.h to sched.h sched_ext: Take out ->priq and ->flags from scx_dsq_node sched_ext: Implement DSQ iterator sched_ext/scx_qmap: Add an example usage of DSQ iterator sched_ext: Reimplement scx_bpf_reenqueue_local() sched_ext: Make scx_bpf_reenqueue_local() skip tasks that are being migrated sched: Move struct balance_callback definition upward sched_ext: Unpin and repin rq lock from balance_scx() sched_ext: s/SCX_RQ_BALANCING/SCX_RQ_IN_BALANCE/ and add SCX_RQ_IN_WAKEUP sched_ext: Allow SCX_DSQ_LOCAL_ON for direct dispatches sched_ext/scx_qmap: Pick idle CPU for direct dispatch on !wakeup enqueues sched_ext: Build fix on !CONFIG_STACKTRACE[_SUPPORT] sched_ext: Allow p->scx.disallow only while loading sched_ext: Simplify scx_can_stop_tick() invocation in sched_can_stop_tick() sched_ext: Add scx_enabled() test to @start_class promotion in put_prev_task_balance() sched_ext: Use update_curr_common() in update_curr_scx() sched_ext: Simplify UP support by enabling sched_class->balance() in UP sched_ext: Improve comment on idle_sched_class exception in scx_task_iter_next_locked() sched_ext: Make task_can_run_on_remote_rq() use common task_allowed_on_cpu() sched_ext: Fix unsafe list iteration in process_ddsp_deferred_locals() sched_ext: Make scx_rq_online() also test cpu_active() in addition to SCX_RQ_ONLINE sched_ext: Improve logging around enable/disable sched_ext: Don't use double locking to migrate tasks across CPUs scx_central: Fix smatch checker warning sched_ext: Add missing cfi stub for ops.tick sched_ext: Use task_can_run_on_remote_rq() test in dispatch_to_local_dsq() sched_ext: Use sched_clock_cpu() instead of rq_clock_task() in touch_core_sched() sched_ext: Don't call put_prev_task_scx() before picking the next task sched_ext: Replace SCX_TASK_BAL_KEEP with SCX_RQ_BAL_KEEP sched_ext: Unify regular and core-sched pick task paths sched_ext: Relocate functions in kernel/sched/ext.c sched_ext: Remove switch_class_scx() sched_ext: Remove sched_class->switch_class() sched_ext: TASK_DEAD tasks must be switched out of SCX on ops_disable sched_ext: TASK_DEAD tasks must be switched into SCX on ops_enable sched: Expose css_tg() sched: Make cpu_shares_read_u64() use tg_weight() sched: Introduce CONFIG_GROUP_SCHED_WEIGHT sched_ext: Add cgroup support sched_ext: Add a cgroup scheduler which uses flattened hierarchy sched_ext: Temporarily work around pick_task_scx() being called without balance_scx() sched_ext: Add missing static to scx_has_op[] sched_ext: Add missing static to scx_dump_data sched_ext: Rename scx_kfunc_set_sleepable to unlocked and relocate sched_ext: Refactor consume_remote_task() sched_ext: Make find_dsq_for_dispatch() handle SCX_DSQ_LOCAL_ON sched_ext: Fix processs_ddsp_deferred_locals() by unifying DTL_INVALID handling sched_ext: Restructure dispatch_to_local_dsq() sched_ext: Reorder args for consume_local/remote_task() sched_ext: Move sanity check and dsq_mod_nr() into task_unlink_from_dsq() sched_ext: Move consume_local_task() upward sched_ext: Replace consume_local_task() with move_local_task_to_local_dsq() sched_ext: Compact struct bpf_iter_scx_dsq_kern sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq() scx_qmap: Implement highpri boosting sched_ext: Synchronize bypass state changes with rq lock sched_ext: Don't trigger ops.quiescent/runnable() on migrations sched_ext: Fix build when !CONFIG_STACKTRACE sched_ext: Build fix for !CONFIG_SMP sched_ext: Add __COMPAT helpers for features added during v6.12 devel cycle tools/sched_ext: Receive misc updates from SCX repo scx_flatcg: Use a user DSQ for fallback instead of SCX_DSQ_GLOBAL sched_ext: Allow only user DSQs for scx_bpf_consume(), scx_bpf_dsq_nr_queued() and bpf_iter_scx_dsq_new() sched_ext: Relocate find_user_dsq() sched_ext: Split the global DSQ per NUMA node sched_ext: Use shorter slice while bypassing sched_ext: Relocate check_hotplug_seq() call in scx_ops_enable() sched_ext: Remove SCX_OPS_PREPPING sched_ext: Initialize in bypass mode sched_ext: Fix SCX_TASK_INIT -> SCX_TASK_READY transitions in scx_ops_enable() sched_ext: Enable scx_ops_init_task() separately sched_ext: Add scx_cgroup_enabled to gate cgroup operations and fix scx_tg_online() sched_ext: Decouple locks in scx_ops_disable_workfn() sched_ext: Decouple locks in scx_ops_enable() sched_ext: Improve error reporting during loading sched_ext: scx_cgroup_exit() may be called without successful scx_cgroup_init() sched/core: Make select_task_rq() take the pointer to wake_flags instead of value sched/core: Add ENQUEUE_RQ_SELECTED to indicate whether ->select_task_rq() was called sched_ext, scx_qmap: Add and use SCX_ENQ_CPU_SELECTED Revert "sched_ext: Use shorter slice while bypassing" sched_ext: Start schedulers with consistent p->scx.slice values sched_ext: Move scx_buildin_idle_enabled check to scx_bpf_select_cpu_dfl() sched_ext: bypass mode shouldn't depend on ops.select_cpu() sched_ext: Move scx_tasks_lock handling into scx_task_iter helpers sched_ext: Don't hold scx_tasks_lock for too long sched_ext: Make cast_mask() inline sched_ext: Fix enq_last_no_enq_fails selftest sched_ext: Add a missing newline at the end of an error message sched_ext: Update scx_show_state.py to match scx_ops_bypass_depth's new type sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx() sched_ext: ops.cpu_acquire() should be called with SCX_KF_REST sched_ext: Factor out move_task_between_dsqs() from scx_dispatch_from_dsq() sched_ext: Rename CFI stubs to names that are recognized by BPF sched_ext: Replace set_arg_maybe_null() with __nullable CFI stub tags sched_ext: Avoid live-locking bypass mode switching sched_ext: Enable the ops breather and eject BPF scheduler on softlockup sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked context sched_ext: Rename scx_bpf_dispatch[_vtime]() to scx_bpf_dsq_insert[_vtime]() sched_ext: Rename scx_bpf_consume() to scx_bpf_dsq_move_to_local() sched_ext: Rename scx_bpf_dispatch[_vtime]_from_dsq*() -> scx_bpf_dsq_move[_vtime]*() sched_ext: Fix invalid irq restore in scx_ops_bypass() sched_ext: Fix dsq_local_on selftest tools/sched_ext: Receive updates from SCX repo sched_ext: selftests/dsp_local_on: Fix sporadic failures sched_ext: Fix incorrect autogroup migration detection sched_ext: Implement auto local dispatching of migration disabled tasks sched_ext: Fix migration disabled handling in targeted dispatches sched_ext: Fix incorrect assumption about migration disabled tasks in task_can_run_on_remote_rq() sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance() sched_ext: Implement SCX_OPS_ALLOW_QUEUED_WAKEUP sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator sched_ext: Make scx_group_set_weight() always update tg->scx.weight sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU sched_ext: Don't kick CPUs running higher classes sched_ext: Use SCX_TASK_READY test instead of tryget_task_struct() during class switch tools/sched_ext: Sync with scx repo Thomas Gleixner (1): sched/ext: Remove sched_fork() hack Thorsten Blum (1): sched_ext: Use str_enabled_disabled() helper in update_selcpu_topology() Tianchen Ding (1): sched_ext: Use btf_ids to resolve task_struct Tony Ambardar (1): libbpf: Ensure new BTF objects inherit input endianness Vincent Guittot (2): sched/cpufreq: Rework schedutil governor performance estimation sched/fair: Fix sched_can_stop_tick() for fair tasks Vishal Chourasia (2): sched_ext: Add __weak markers to BPF helper function decalarations sched_ext: Fix function pointer type mismatches in BPF selftests Wenyu Huang (1): sched/doc: Update documentation after renames and synchronize Chinese version Yafang Shao (2): bpf: Add bits iterator selftests/bpf: Add selftest for bits iter Yipeng Zou (1): sched_ext: Allow dequeue_task_scx to fail Yiwei Lin (1): sched/fair: Remove unused 'curr' argument from pick_next_entity() Yu Liao (2): sched: Put task_group::idle under CONFIG_GROUP_SCHED_WEIGHT sched: Add dummy version of sched_group_set_idle() Yury Norov (1): cpumask: introduce assign_cpu() macro Zhang Qiao (3): sched_ext: Remove redundant p->nr_cpus_allowed checker sched/ext: Fix unmatch trailing comment of CONFIG_EXT_GROUP_SCHED sched/ext: Use tg_cgroup() to elieminate duplicate code Zhao Mengmeng (1): sched_ext: Replace scx_next_task_picked() with switch_class() in comment Zicheng Qu (17): sched: Fix kabi for reweight_task in struct sched_class sched/syscalls: Fix kabi for EXPORT_SYMBOL moved from core.c to syscalls.c sched: Fix kabi for switching_to in struct sched_class sched/fair: Fix kabi for check_preempt_curr and wakeup_preempt in struct sched_class sched: Fix kabi for dequeue_task in struct sched_class sched_ext: Fix kabi for scx in struct task_struct sched_ext: Fix kabi for switch_class in struct sched_class sched: Fix kabi for exec_max in struct sched_statistics sched_ext: Fix kabi for balance in struct sched_class sched_ext: Fix kabi for header in kernel/sched/sched.h sched: Fix kabi pick_task in struct sched_class sched: Fix kabi for put_prev_task in struct sched_class sched_ext: Fix kabi for scx_flags and scx_weight in struct task_group sched: Fix kabi for int idle in struct task_group sched: Add __setscheduler_class() for sched_ext genirq: Fix kabi for kstat_irqs in struct irq_desc sched_ext: Enable and disable sched_ext configs Zqiang (1): sched_ext: Fix unsafe locking in the scx_dump_state() guanjing (1): sched_ext: fix application of sizeof to pointer Documentation/bpf/bpf_iterators.rst | 2 +- Documentation/bpf/kfuncs.rst | 14 +- Documentation/scheduler/index.rst | 1 + Documentation/scheduler/sched-design-CFS.rst | 8 +- Documentation/scheduler/sched-ext.rst | 325 + .../zh_CN/scheduler/sched-design-CFS.rst | 8 +- MAINTAINERS | 16 +- Makefile | 4 +- arch/arm64/configs/openeuler_defconfig | 3 + arch/arm64/kernel/bpf-rvi.c | 4 +- arch/arm64/net/bpf_jit_comp.c | 55 +- arch/mips/dec/setup.c | 2 +- arch/parisc/kernel/smp.c | 2 +- arch/powerpc/kvm/book3s_hv_rm_xics.c | 2 +- arch/riscv/include/asm/cfi.h | 3 +- arch/riscv/kernel/cfi.c | 2 +- arch/riscv/net/bpf_jit_comp64.c | 48 +- arch/s390/net/bpf_jit_comp.c | 59 +- arch/x86/configs/openeuler_defconfig | 2 + arch/x86/include/asm/cfi.h | 126 +- arch/x86/kernel/alternative.c | 87 +- arch/x86/kernel/cfi.c | 4 +- arch/x86/net/bpf_jit_comp.c | 261 +- block/blk-cgroup.c | 4 +- drivers/hid/bpf/hid_bpf_dispatch.c | 12 +- drivers/tty/sysrq.c | 1 + fs/proc/stat.c | 4 +- include/asm-generic/Kbuild | 1 + include/asm-generic/cfi.h | 5 + include/asm-generic/vmlinux.lds.h | 1 + include/linux/bitops.h | 2 + include/linux/bpf.h | 130 +- include/linux/bpf_mem_alloc.h | 3 + include/linux/bpf_verifier.h | 21 +- include/linux/btf.h | 105 + include/linux/btf_ids.h | 21 +- include/linux/cfi.h | 12 + include/linux/cgroup.h | 14 +- include/linux/cleanup.h | 42 +- include/linux/cpumask.h | 41 +- include/linux/energy_model.h | 1 - include/linux/file.h | 20 + include/linux/filter.h | 2 +- include/linux/irqdesc.h | 17 +- include/linux/kernel_stat.h | 8 + include/linux/module.h | 8 +- include/linux/sched.h | 8 +- include/linux/sched/ext.h | 216 + include/linux/sched/task.h | 8 +- include/trace/events/sched_ext.h | 32 + include/uapi/linux/bpf.h | 16 +- include/uapi/linux/sched.h | 1 + init/Kconfig | 10 + init/init_task.c | 12 + kernel/Kconfig.preempt | 27 +- kernel/bpf-rvi/common_kfuncs.c | 4 +- kernel/bpf/Makefile | 8 +- kernel/bpf/bpf_iter.c | 12 +- kernel/bpf/bpf_struct_ops.c | 745 +- kernel/bpf/bpf_struct_ops_types.h | 12 - kernel/bpf/btf.c | 431 +- kernel/bpf/cgroup_iter.c | 65 +- kernel/bpf/core.c | 76 +- kernel/bpf/cpumask.c | 18 +- kernel/bpf/dispatcher.c | 7 +- kernel/bpf/helpers.c | 202 +- kernel/bpf/map_iter.c | 10 +- kernel/bpf/memalloc.c | 14 +- kernel/bpf/syscall.c | 12 +- kernel/bpf/task_iter.c | 242 +- kernel/bpf/trampoline.c | 99 +- kernel/bpf/verifier.c | 317 +- kernel/cgroup/cgroup.c | 18 +- kernel/cgroup/cpuset.c | 4 +- kernel/cgroup/rstat.c | 13 +- kernel/events/core.c | 2 +- kernel/fork.c | 17 +- kernel/irq/Kconfig | 4 + kernel/irq/internals.h | 2 +- kernel/irq/irqdesc.c | 144 +- kernel/irq/proc.c | 5 +- kernel/module/main.c | 5 +- kernel/sched/autogroup.c | 4 +- kernel/sched/bpf_sched.c | 8 +- kernel/sched/build_policy.c | 13 + kernel/sched/core.c | 2492 +----- kernel/sched/cpuacct.c | 4 +- kernel/sched/cpufreq_schedutil.c | 83 +- kernel/sched/deadline.c | 175 +- kernel/sched/debug.c | 3 + kernel/sched/ext.c | 7155 +++++++++++++++++ kernel/sched/ext.h | 119 + kernel/sched/ext_idle.c | 755 ++ kernel/sched/ext_idle.h | 39 + kernel/sched/fair.c | 306 +- kernel/sched/idle.c | 31 +- kernel/sched/rt.c | 40 +- kernel/sched/sched.h | 473 +- kernel/sched/stop_task.c | 35 +- kernel/sched/syscalls.c | 1713 ++++ kernel/trace/bpf_trace.c | 12 +- kernel/trace/trace_probe.c | 2 - kernel/watchdog.c | 223 +- lib/Kconfig.debug | 14 + lib/dump_stack.c | 1 + lib/rhashtable.c | 12 +- net/bpf/bpf_dummy_struct_ops.c | 72 +- net/bpf/test_run.c | 30 +- net/core/filter.c | 33 +- net/core/xdp.c | 10 +- net/ipv4/bpf_tcp_ca.c | 93 +- net/ipv4/fou_bpf.c | 10 +- net/ipv4/tcp_bbr.c | 4 +- net/ipv4/tcp_cong.c | 6 +- net/ipv4/tcp_cubic.c | 4 +- net/ipv4/tcp_dctcp.c | 4 +- net/netfilter/nf_conntrack_bpf.c | 10 +- net/netfilter/nf_nat_bpf.c | 10 +- net/socket.c | 8 +- net/xfrm/xfrm_interface_bpf.c | 10 +- scripts/Makefile.btf | 33 + scripts/Makefile.modfinal | 2 +- scripts/gdb/linux/interrupts.py | 6 +- scripts/pahole-flags.sh | 30 - tools/Makefile | 10 +- .../bpf/bpftool/Documentation/bpftool-gen.rst | 58 +- tools/bpf/bpftool/gen.c | 253 +- tools/bpf/resolve_btfids/main.c | 8 + tools/include/linux/bitops.h | 2 + tools/include/uapi/linux/bpf.h | 14 +- tools/include/uapi/linux/sched.h | 1 + tools/lib/bpf/Build | 2 +- tools/lib/bpf/bpf.c | 4 +- tools/lib/bpf/bpf.h | 4 +- tools/lib/bpf/btf.c | 704 +- tools/lib/bpf/btf.h | 36 + tools/lib/bpf/btf_iter.c | 177 + tools/lib/bpf/btf_relocate.c | 519 ++ tools/lib/bpf/libbpf.c | 97 +- tools/lib/bpf/libbpf.map | 4 +- tools/lib/bpf/libbpf_internal.h | 29 +- tools/lib/bpf/libbpf_probes.c | 1 + tools/lib/bpf/linker.c | 58 +- tools/perf/util/probe-finder.c | 4 +- tools/sched_ext/.gitignore | 2 + tools/sched_ext/Makefile | 246 + tools/sched_ext/README.md | 270 + .../sched_ext/include/bpf-compat/gnu/stubs.h | 11 + tools/sched_ext/include/scx/common.bpf.h | 647 ++ tools/sched_ext/include/scx/common.h | 81 + tools/sched_ext/include/scx/compat.bpf.h | 143 + tools/sched_ext/include/scx/compat.h | 187 + .../sched_ext/include/scx/enums.autogen.bpf.h | 105 + tools/sched_ext/include/scx/enums.autogen.h | 41 + tools/sched_ext/include/scx/enums.bpf.h | 12 + tools/sched_ext/include/scx/enums.h | 27 + tools/sched_ext/include/scx/user_exit_info.h | 118 + tools/sched_ext/scx_central.bpf.c | 356 + tools/sched_ext/scx_central.c | 145 + tools/sched_ext/scx_flatcg.bpf.c | 954 +++ tools/sched_ext/scx_flatcg.c | 234 + tools/sched_ext/scx_flatcg.h | 51 + tools/sched_ext/scx_qmap.bpf.c | 827 ++ tools/sched_ext/scx_qmap.c | 155 + tools/sched_ext/scx_show_state.py | 42 + tools/sched_ext/scx_simple.bpf.c | 151 + tools/sched_ext/scx_simple.c | 107 + tools/testing/selftests/Makefile | 9 +- tools/testing/selftests/bpf/.gitignore | 1 + .../testing/selftests/bpf/bpf_experimental.h | 96 + .../selftests/bpf/bpf_testmod/bpf_testmod.c | 160 +- .../selftests/bpf/bpf_testmod/bpf_testmod.h | 61 + .../bpf/bpf_testmod/bpf_testmod_kfunc.h | 9 + .../selftests/bpf/prog_tests/bpf_iter.c | 44 +- .../selftests/bpf/prog_tests/btf_distill.c | 692 ++ .../selftests/bpf/prog_tests/cgroup_iter.c | 33 + .../bpf/prog_tests/global_func_dead_code.c | 60 + .../testing/selftests/bpf/prog_tests/iters.c | 209 + .../selftests/bpf/prog_tests/kfunc_call.c | 1 + .../selftests/bpf/prog_tests/rcu_read_lock.c | 6 + .../selftests/bpf/prog_tests/spin_lock.c | 2 + .../prog_tests/test_struct_ops_maybe_null.c | 46 + .../bpf/prog_tests/test_struct_ops_module.c | 86 + .../prog_tests/test_struct_ops_multi_pages.c | 30 + .../testing/selftests/bpf/prog_tests/timer.c | 4 + .../selftests/bpf/prog_tests/verifier.c | 4 + ...f_iter_task_vma.c => bpf_iter_task_vmas.c} | 0 .../{bpf_iter_task.c => bpf_iter_tasks.c} | 0 .../bpf/progs/freplace_dead_global_func.c | 11 + tools/testing/selftests/bpf/progs/iters_css.c | 72 + .../selftests/bpf/progs/iters_css_task.c | 102 + .../testing/selftests/bpf/progs/iters_task.c | 41 + .../selftests/bpf/progs/iters_task_failure.c | 105 + .../selftests/bpf/progs/iters_task_vma.c | 43 + .../selftests/bpf/progs/iters_testmod_seq.c | 50 + .../selftests/bpf/progs/kfunc_call_test.c | 37 + .../selftests/bpf/progs/rcu_read_lock.c | 120 + .../bpf/progs/struct_ops_maybe_null.c | 29 + .../bpf/progs/struct_ops_maybe_null_fail.c | 24 + .../selftests/bpf/progs/struct_ops_module.c | 37 + .../bpf/progs/struct_ops_multi_pages.c | 102 + .../selftests/bpf/progs/test_global_func12.c | 4 +- .../selftests/bpf/progs/test_spin_lock.c | 65 + .../selftests/bpf/progs/test_spin_lock_fail.c | 44 + tools/testing/selftests/bpf/progs/timer.c | 63 +- .../selftests/bpf/progs/verifier_bits_iter.c | 232 + .../bpf/progs/verifier_global_subprogs.c | 101 + .../selftests/bpf/progs/verifier_spin_lock.c | 2 +- .../bpf/progs/verifier_subprog_precision.c | 4 +- tools/testing/selftests/bpf/test_loader.c | 10 +- tools/testing/selftests/bpf/test_maps.c | 18 +- tools/testing/selftests/bpf/test_maps.h | 5 + tools/testing/selftests/sched_ext/.gitignore | 6 + tools/testing/selftests/sched_ext/Makefile | 211 + tools/testing/selftests/sched_ext/config | 9 + .../selftests/sched_ext/create_dsq.bpf.c | 58 + .../testing/selftests/sched_ext/create_dsq.c | 57 + .../sched_ext/ddsp_bogus_dsq_fail.bpf.c | 42 + .../selftests/sched_ext/ddsp_bogus_dsq_fail.c | 60 + .../sched_ext/ddsp_vtimelocal_fail.bpf.c | 39 + .../sched_ext/ddsp_vtimelocal_fail.c | 59 + .../selftests/sched_ext/dsp_local_on.bpf.c | 68 + .../selftests/sched_ext/dsp_local_on.c | 60 + .../sched_ext/enq_last_no_enq_fails.bpf.c | 29 + .../sched_ext/enq_last_no_enq_fails.c | 64 + .../sched_ext/enq_select_cpu_fails.bpf.c | 43 + .../sched_ext/enq_select_cpu_fails.c | 61 + tools/testing/selftests/sched_ext/exit.bpf.c | 86 + tools/testing/selftests/sched_ext/exit.c | 64 + tools/testing/selftests/sched_ext/exit_test.h | 20 + .../testing/selftests/sched_ext/hotplug.bpf.c | 61 + tools/testing/selftests/sched_ext/hotplug.c | 170 + .../selftests/sched_ext/hotplug_test.h | 15 + .../sched_ext/init_enable_count.bpf.c | 53 + .../selftests/sched_ext/init_enable_count.c | 157 + .../testing/selftests/sched_ext/maximal.bpf.c | 166 + tools/testing/selftests/sched_ext/maximal.c | 54 + .../selftests/sched_ext/maybe_null.bpf.c | 36 + .../testing/selftests/sched_ext/maybe_null.c | 49 + .../sched_ext/maybe_null_fail_dsp.bpf.c | 25 + .../sched_ext/maybe_null_fail_yld.bpf.c | 28 + .../testing/selftests/sched_ext/minimal.bpf.c | 21 + tools/testing/selftests/sched_ext/minimal.c | 58 + .../selftests/sched_ext/prog_run.bpf.c | 33 + tools/testing/selftests/sched_ext/prog_run.c | 78 + .../testing/selftests/sched_ext/reload_loop.c | 74 + tools/testing/selftests/sched_ext/runner.c | 212 + tools/testing/selftests/sched_ext/scx_test.h | 131 + .../selftests/sched_ext/select_cpu_dfl.bpf.c | 40 + .../selftests/sched_ext/select_cpu_dfl.c | 75 + .../sched_ext/select_cpu_dfl_nodispatch.bpf.c | 89 + .../sched_ext/select_cpu_dfl_nodispatch.c | 75 + .../sched_ext/select_cpu_dispatch.bpf.c | 41 + .../selftests/sched_ext/select_cpu_dispatch.c | 73 + .../select_cpu_dispatch_bad_dsq.bpf.c | 37 + .../sched_ext/select_cpu_dispatch_bad_dsq.c | 59 + .../select_cpu_dispatch_dbl_dsp.bpf.c | 38 + .../sched_ext/select_cpu_dispatch_dbl_dsp.c | 59 + .../sched_ext/select_cpu_vtime.bpf.c | 92 + .../selftests/sched_ext/select_cpu_vtime.c | 62 + .../selftests/sched_ext/test_example.c | 49 + tools/testing/selftests/sched_ext/util.c | 71 + tools/testing/selftests/sched_ext/util.h | 13 + 263 files changed, 27732 insertions(+), 3787 deletions(-) create mode 100644 Documentation/scheduler/sched-ext.rst create mode 100644 include/asm-generic/cfi.h create mode 100644 include/linux/sched/ext.h create mode 100644 include/trace/events/sched_ext.h delete mode 100644 kernel/bpf/bpf_struct_ops_types.h create mode 100644 kernel/sched/ext.c create mode 100644 kernel/sched/ext.h create mode 100644 kernel/sched/ext_idle.c create mode 100644 kernel/sched/ext_idle.h create mode 100644 kernel/sched/syscalls.c create mode 100644 scripts/Makefile.btf delete mode 100755 scripts/pahole-flags.sh create mode 100644 tools/lib/bpf/btf_iter.c create mode 100644 tools/lib/bpf/btf_relocate.c create mode 100644 tools/sched_ext/.gitignore create mode 100644 tools/sched_ext/Makefile create mode 100644 tools/sched_ext/README.md create mode 100644 tools/sched_ext/include/bpf-compat/gnu/stubs.h create mode 100644 tools/sched_ext/include/scx/common.bpf.h create mode 100644 tools/sched_ext/include/scx/common.h create mode 100644 tools/sched_ext/include/scx/compat.bpf.h create mode 100644 tools/sched_ext/include/scx/compat.h create mode 100644 tools/sched_ext/include/scx/enums.autogen.bpf.h create mode 100644 tools/sched_ext/include/scx/enums.autogen.h create mode 100644 tools/sched_ext/include/scx/enums.bpf.h create mode 100644 tools/sched_ext/include/scx/enums.h create mode 100644 tools/sched_ext/include/scx/user_exit_info.h create mode 100644 tools/sched_ext/scx_central.bpf.c create mode 100644 tools/sched_ext/scx_central.c create mode 100644 tools/sched_ext/scx_flatcg.bpf.c create mode 100644 tools/sched_ext/scx_flatcg.c create mode 100644 tools/sched_ext/scx_flatcg.h create mode 100644 tools/sched_ext/scx_qmap.bpf.c create mode 100644 tools/sched_ext/scx_qmap.c create mode 100644 tools/sched_ext/scx_show_state.py create mode 100644 tools/sched_ext/scx_simple.bpf.c create mode 100644 tools/sched_ext/scx_simple.c create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_distill.c create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_maybe_null.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_module.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_pages.c rename tools/testing/selftests/bpf/progs/{bpf_iter_task_vma.c => bpf_iter_task_vmas.c} (100%) rename tools/testing/selftests/bpf/progs/{bpf_iter_task.c => bpf_iter_tasks.c} (100%) create mode 100644 tools/testing/selftests/bpf/progs/freplace_dead_global_func.c create mode 100644 tools/testing/selftests/bpf/progs/iters_css.c create mode 100644 tools/testing/selftests/bpf/progs/iters_css_task.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task_failure.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task_vma.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null_fail.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_module.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_multi_pages.c create mode 100644 tools/testing/selftests/bpf/progs/verifier_bits_iter.c create mode 100644 tools/testing/selftests/bpf/progs/verifier_global_subprogs.c create mode 100644 tools/testing/selftests/sched_ext/.gitignore create mode 100644 tools/testing/selftests/sched_ext/Makefile create mode 100644 tools/testing/selftests/sched_ext/config create mode 100644 tools/testing/selftests/sched_ext/create_dsq.bpf.c create mode 100644 tools/testing/selftests/sched_ext/create_dsq.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.bpf.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.bpf.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.c create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.bpf.c create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.c create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.bpf.c create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.c create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.bpf.c create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.c create mode 100644 tools/testing/selftests/sched_ext/exit.bpf.c create mode 100644 tools/testing/selftests/sched_ext/exit.c create mode 100644 tools/testing/selftests/sched_ext/exit_test.h create mode 100644 tools/testing/selftests/sched_ext/hotplug.bpf.c create mode 100644 tools/testing/selftests/sched_ext/hotplug.c create mode 100644 tools/testing/selftests/sched_ext/hotplug_test.h create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.bpf.c create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.c create mode 100644 tools/testing/selftests/sched_ext/maximal.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maximal.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_dsp.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_yld.bpf.c create mode 100644 tools/testing/selftests/sched_ext/minimal.bpf.c create mode 100644 tools/testing/selftests/sched_ext/minimal.c create mode 100644 tools/testing/selftests/sched_ext/prog_run.bpf.c create mode 100644 tools/testing/selftests/sched_ext/prog_run.c create mode 100644 tools/testing/selftests/sched_ext/reload_loop.c create mode 100644 tools/testing/selftests/sched_ext/runner.c create mode 100644 tools/testing/selftests/sched_ext/scx_test.h create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.c create mode 100644 tools/testing/selftests/sched_ext/test_example.c create mode 100644 tools/testing/selftests/sched_ext/util.c create mode 100644 tools/testing/selftests/sched_ext/util.h -- 2.34.1

1 294

[PATCH OLK-6.6] nvme-fc: release admin tagset if init fails
by Zheng Qixing 03 Apr '26

03 Apr '26

From: Chaitanya Kulkarni <ckulkarnilinux(a)gmail.com> stable inclusion from stable-v6.6.124 commit 7c54d3f5ebbc5982daaa004260242dc07ac943ea category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13892 CVE: CVE-2026-23261 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d1877cc7270302081a315a81a0ee8331f19f95c8 ] nvme_fabrics creates an NVMe/FC controller in following path: nvmf_dev_write() -> nvmf_create_ctrl() -> nvme_fc_create_ctrl() -> nvme_fc_init_ctrl() nvme_fc_init_ctrl() allocates the admin blk-mq resources right after nvme_add_ctrl() succeeds. If any of the subsequent steps fail (changing the controller state, scheduling connect work, etc.), we jump to the fail_ctrl path, which tears down the controller references but never frees the admin queue/tag set. The leaked blk-mq allocations match the kmemleak report seen during blktests nvme/fc. Check ctrl->ctrl.admin_tagset in the fail_ctrl path and call nvme_remove_admin_tag_set() when it is set so that all admin queue allocations are reclaimed whenever controller setup aborts. Reported-by: Yi Zhang <yi.zhang(a)redhat.com> Reviewed-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: Chaitanya Kulkarni <ckulkarnilinux(a)gmail.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/nvme/host/fc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c index db339f72ce62..745b3babb849 100644 --- a/drivers/nvme/host/fc.c +++ b/drivers/nvme/host/fc.c @@ -3546,6 +3546,8 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, ctrl->ctrl.opts = NULL; + if (ctrl->ctrl.admin_tagset) + nvme_remove_admin_tag_set(&ctrl->ctrl); /* initiate nvme ctrl ref counting teardown */ nvme_uninit_ctrl(&ctrl->ctrl); -- 2.39.2

2 1

[PATCH OLK-6.6] wifi: libertas: fix use-after-free in lbs_free_adapter()
by Wupeng Ma 03 Apr '26

03 Apr '26

From: Daniel Hodges <git(a)danielhodges.dev> stable inclusion from stable-v6.6.130 commit 3c5c818c78b03a1725f3dcd566865c77b48dd3a6 category: bugfix bugzilla: 13984 CVE: CVE-2026-23281 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0 ] The lbs_free_adapter() function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before the structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete. If a timer callback is executing when lbs_free_adapter() is called, the callback will access freed memory since lbs_cfg_free() frees the containing structure immediately after lbs_free_adapter() returns. Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler) access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields, which would all be use-after-free violations. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning. This bug was introduced in commit 8f641d93c38a ("libertas: detect TX lockups and reset hardware") where del_timer() was used instead of del_timer_sync() in the cleanup path. The command_timer has had the same issue since the driver was first written. Fixes: 8f641d93c38a ("libertas: detect TX lockups and reset hardware") Fixes: 954ee164f4f4 ("[PATCH] libertas: reorganize and simplify init sequence") Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Hodges <git(a)danielhodges.dev> Link: https://patch.msgid.link/20260206195356.15647-1-git@danielhodges.dev Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> [ del_timer() => timer_delete_sync() ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/wireless/marvell/libertas/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c index 78e8b5aecec0e..91b9501c6d8cb 100644 --- a/drivers/net/wireless/marvell/libertas/main.c +++ b/drivers/net/wireless/marvell/libertas/main.c @@ -881,8 +881,8 @@ static void lbs_free_adapter(struct lbs_private *priv) { lbs_free_cmd_buffer(priv); kfifo_free(&priv->event_fifo); - del_timer(&priv->command_timer); - del_timer(&priv->tx_lockup_timer); + timer_delete_sync(&priv->command_timer); + timer_delete_sync(&priv->tx_lockup_timer); del_timer(&priv->auto_deepsleep_timer); } -- 2.43.0

2 1

[PATCH OLK-6.6] can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
by Wupeng Ma 03 Apr '26

03 Apr '26

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> stable inclusion from stable-v6.6.130 commit f6e90c113c92e83fc0963d5e60e16b0e8a268981 category: bugfix bugzilla: 13957 CVE: CVE-2026-23324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5eaad4f768266f1f17e01232ffe2ef009f8129b7 upstream. When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logic is correctly done elsewhere in the driver, except in the read bulk callback so do that here also. Cc: Vincent Mailhol <mailhol(a)kernel.org> Cc: Marc Kleine-Budde <mkl(a)pengutronix.de> Cc: stable(a)kernel.org Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Reviewed-by: Vincent Mailhol <mailhol(a)kernel.org> Tested-by: Vincent Mailhol <mailhol(a)kernel.org> Link: https://patch.msgid.link/2026022320-poser-stiffly-9d84@gregkh Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces") Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/can/usb/etas_es58x/es58x_core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c index bb49a2c0a9a5c..3edf06106f9d3 100644 --- a/drivers/net/can/usb/etas_es58x/es58x_core.c +++ b/drivers/net/can/usb/etas_es58x/es58x_core.c @@ -1461,12 +1461,18 @@ static void es58x_read_bulk_callback(struct urb *urb) } resubmit_urb: + usb_anchor_urb(urb, &es58x_dev->rx_urbs); ret = usb_submit_urb(urb, GFP_ATOMIC); + if (!ret) + return; + + usb_unanchor_urb(urb); + if (ret == -ENODEV) { for (i = 0; i < es58x_dev->num_can_ch; i++) if (es58x_dev->netdev[i]) netif_device_detach(es58x_dev->netdev[i]); - } else if (ret) + } else dev_err_ratelimited(dev, "Failed resubmitting read bulk urb: %pe\n", ERR_PTR(ret)); -- 2.43.0

2 1

openEuler Kernel SIG双周例会
by openEuler conference 03 Apr '26

03 Apr '26

您好！ Kernel 邀请您参加 2026-04-03 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题可直接填写至会议看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/981797149 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-04-03 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题可直接填写至会议看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/981797149 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6 0/2] ACPI/IORT: Add PMCG platform information for 162001900
by Zeng Heng 03 Apr '26

03 Apr '26

Qinxin Xia (2): arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata ACPI/IORT: Add PMCG platform information for 162001900 drivers/acpi/arm64/iort.c | 4 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 6 ++++++ 2 files changed, 10 insertions(+) -- 2.25.1

2 3

[PATCH v3 OLK-6.6 0/5] Reuse SUBSYS for xcu and freezer to preserve KABI
by Liu Kai 02 Apr '26

02 Apr '26

Reuse SUBSYS for xcu and freezer to preserve KABI Liu Kai (5): xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI xSched/cgroup: make xcu.stat invisible at root cgroup cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig xSched: update xSched manual for xcu cmdline enable option Documentation/scheduler/xsched.md | 6 +- arch/arm64/configs/openeuler_defconfig | 3 +- arch/x86/configs/openeuler_defconfig | 3 +- include/linux/cgroup_subsys.h | 8 +- include/linux/freezer.h | 24 ++++ kernel/cgroup/cgroup.c | 2 +- kernel/cgroup/legacy_freezer.c | 25 +++- kernel/xsched/cgroup.c | 174 +++++++++++++++++++++++-- 8 files changed, 217 insertions(+), 28 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6 0/2] CVE-2026-23276
by Li Xiasong 02 Apr '26

02 Apr '26

Eric Dumazet (1): net: prevent NULL deref in ip[6]tunnel_xmit() Weiming Shi (1): net: add xmit recursion limit to tunnel xmit functions include/net/ip6_tunnel.h | 14 ++++++++++++++ include/net/ip_tunnels.h | 7 +++++++ net/ipv4/ip_tunnel_core.c | 15 +++++++++++++++ 3 files changed, 36 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6] tcp: secure_seq: add back ports to TS offset
by Li Xiasong 02 Apr '26

02 Apr '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.0-rc3 commit 165573e41f2f66ef98940cf65f838b2cb575d9d1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13867 CVE: CVE-2026-23247 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets") tcp_tw_recycle went away in 2017. Zhouyan Deng reported off-path TCP source port leakage via SYN cookie side-channel that can be fixed in multiple ways. One of them is to bring back TCP ports in TS offset randomization. As a bonus, we perform a single siphash() computation to provide both an ISN and a TS offset. Fixes: 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets") Reported-by: Zhouyan Deng <dengzhouyan_nwpu(a)163.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)google.com> Acked-by: Florian Westphal <fw(a)strlen.de> Link: https://patch.msgid.link/20260302205527.1982836-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: include/net/secure_seq.h include/net/tcp.h net/core/secure_seq.c net/ipv4/syncookies.c net/ipv4/tcp_input.c net/ipv4/tcp_ipv4.c net/ipv6/syncookies.c net/ipv6/tcp_ipv6.c [conflicts due to merged bf8317ce3910 ("net: use __GENKSYMS__ to revert the kabi change") and not merge 2a63dd0edf38 ("net: Retire DCCP socket.") and 6dc4c2526f6d ("tcp: use EXPORT_IPV6_MOD[_GPL]()") and 8e7bab6b9652 ("tcp: Factorise cookie-independent fields initialisation in cookie_v[46]_check()") and cdbab6236605 ("tcp: fix fastopen code vs usec TS") and 449f68f8fffa ("net: Convert proto callbacks from sockaddr to sockaddr_unsized").] Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- include/net/secure_seq.h | 45 ++++++++++++++++++---- include/net/tcp.h | 6 ++- net/core/secure_seq.c | 80 +++++++++++++++------------------------- net/ipv4/syncookies.c | 11 ++++-- net/ipv4/tcp_input.c | 10 +++-- net/ipv4/tcp_ipv4.c | 37 +++++++++---------- net/ipv6/syncookies.c | 11 ++++-- net/ipv6/tcp_ipv6.c | 37 +++++++++---------- 8 files changed, 128 insertions(+), 109 deletions(-) diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h index 21e7fa2a1813..e4ad681a2a12 100644 --- a/include/net/secure_seq.h +++ b/include/net/secure_seq.h @@ -5,20 +5,51 @@ #include <linux/types.h> struct net; +extern struct net init_net; + +union tcp_seq_and_ts_off { + struct { + u32 seq; + u32 ts_off; + }; + u64 hash64; +}; u64 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport); u64 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr, __be16 dport); -u32 secure_tcp_seq(__be32 saddr, __be32 daddr, - __be16 sport, __be16 dport); -u32 secure_tcp_ts_off(const struct net *net, __be32 saddr, __be32 daddr); -u32 secure_tcpv6_seq(const __be32 *saddr, const __be32 *daddr, - __be16 sport, __be16 dport); -u32 secure_tcpv6_ts_off(const struct net *net, - const __be32 *saddr, const __be32 *daddr); u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport); u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr, __be16 sport, __be16 dport); +union tcp_seq_and_ts_off +secure_tcp_seq_and_ts_off(const struct net *net, __be32 saddr, __be32 daddr, + __be16 sport, __be16 dport); + +static inline u32 secure_tcp_seq(__be32 saddr, __be32 daddr, + __be16 sport, __be16 dport) +{ + union tcp_seq_and_ts_off ts; + + ts = secure_tcp_seq_and_ts_off(&init_net, saddr, daddr, + sport, dport); + + return ts.seq; +} + +union tcp_seq_and_ts_off +secure_tcpv6_seq_and_ts_off(const struct net *net, const __be32 *saddr, + const __be32 *daddr, + __be16 sport, __be16 dport); + +static inline u32 secure_tcpv6_seq(const __be32 *saddr, const __be32 *daddr, + __be16 sport, __be16 dport) +{ + union tcp_seq_and_ts_off ts; + + ts = secure_tcpv6_seq_and_ts_off(&init_net, saddr, daddr, + sport, dport); + return ts.seq; +} #endif /* _NET_SECURE_SEQ */ diff --git a/include/net/tcp.h b/include/net/tcp.h index e8f81924defc..f0a6468a1c34 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -44,6 +44,7 @@ #ifndef __GENKSYMS__ #include <net/xfrm.h> #endif +#include <net/secure_seq.h> #include <linux/seq_file.h> #include <linux/memcontrol.h> @@ -2180,8 +2181,9 @@ struct tcp_request_sock_ops { struct sk_buff *skb, struct flowi *fl, struct request_sock *req); - u32 (*init_seq)(const struct sk_buff *skb); - u32 (*init_ts_off)(const struct net *net, const struct sk_buff *skb); + union tcp_seq_and_ts_off (*init_seq_and_ts_off)( + const struct net *net, + const struct sk_buff *skb); int (*send_synack)(const struct sock *sk, struct dst_entry *dst, struct flowi *fl, struct request_sock *req, struct tcp_fastopen_cookie *foc, diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c index b0ff6153be62..740642aeaf76 100644 --- a/net/core/secure_seq.c +++ b/net/core/secure_seq.c @@ -20,7 +20,6 @@ #include <net/tcp.h> static siphash_aligned_key_t net_secret; -static siphash_aligned_key_t ts_secret; #define EPHEMERAL_PORT_SHUFFLE_PERIOD (10 * HZ) @@ -28,11 +27,6 @@ static __always_inline void net_secret_init(void) { net_get_random_once(&net_secret, sizeof(net_secret)); } - -static __always_inline void ts_secret_init(void) -{ - net_get_random_once(&ts_secret, sizeof(ts_secret)); -} #endif #ifdef CONFIG_INET @@ -53,28 +47,9 @@ static u32 seq_scale(u32 seq) #endif #if IS_ENABLED(CONFIG_IPV6) -u32 secure_tcpv6_ts_off(const struct net *net, - const __be32 *saddr, const __be32 *daddr) -{ - const struct { - struct in6_addr saddr; - struct in6_addr daddr; - } __aligned(SIPHASH_ALIGNMENT) combined = { - .saddr = *(struct in6_addr *)saddr, - .daddr = *(struct in6_addr *)daddr, - }; - - if (READ_ONCE(net->ipv4.sysctl_tcp_timestamps) != 1) - return 0; - - ts_secret_init(); - return siphash(&combined, offsetofend(typeof(combined), daddr), - &ts_secret); -} -EXPORT_SYMBOL(secure_tcpv6_ts_off); - -u32 secure_tcpv6_seq(const __be32 *saddr, const __be32 *daddr, - __be16 sport, __be16 dport) +union tcp_seq_and_ts_off +secure_tcpv6_seq_and_ts_off(const struct net *net, const __be32 *saddr, + const __be32 *daddr, __be16 sport, __be16 dport) { const struct { struct in6_addr saddr; @@ -87,14 +62,20 @@ u32 secure_tcpv6_seq(const __be32 *saddr, const __be32 *daddr, .sport = sport, .dport = dport }; - u32 hash; + union tcp_seq_and_ts_off st; net_secret_init(); - hash = siphash(&combined, offsetofend(typeof(combined), dport), - &net_secret); - return seq_scale(hash); + + st.hash64 = siphash(&combined, offsetofend(typeof(combined), dport), + &net_secret); + + if (READ_ONCE(net->ipv4.sysctl_tcp_timestamps) != 1) + st.ts_off = 0; + + st.seq = seq_scale(st.seq); + return st; } -EXPORT_SYMBOL(secure_tcpv6_seq); +EXPORT_SYMBOL(secure_tcpv6_seq_and_ts_off); u64 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr, __be16 dport) @@ -118,33 +99,30 @@ EXPORT_SYMBOL(secure_ipv6_port_ephemeral); #endif #ifdef CONFIG_INET -u32 secure_tcp_ts_off(const struct net *net, __be32 saddr, __be32 daddr) -{ - if (READ_ONCE(net->ipv4.sysctl_tcp_timestamps) != 1) - return 0; - - ts_secret_init(); - return siphash_2u32((__force u32)saddr, (__force u32)daddr, - &ts_secret); -} - /* secure_tcp_seq_and_tsoff(a, b, 0, d) == secure_ipv4_port_ephemeral(a, b, d), * but fortunately, `sport' cannot be 0 in any circumstances. If this changes, * it would be easy enough to have the former function use siphash_4u32, passing * the arguments as separate u32. */ -u32 secure_tcp_seq(__be32 saddr, __be32 daddr, - __be16 sport, __be16 dport) +union tcp_seq_and_ts_off +secure_tcp_seq_and_ts_off(const struct net *net, __be32 saddr, __be32 daddr, + __be16 sport, __be16 dport) { - u32 hash; + u32 ports = (__force u32)sport << 16 | (__force u32)dport; + union tcp_seq_and_ts_off st; net_secret_init(); - hash = siphash_3u32((__force u32)saddr, (__force u32)daddr, - (__force u32)sport << 16 | (__force u32)dport, - &net_secret); - return seq_scale(hash); + + st.hash64 = siphash_3u32((__force u32)saddr, (__force u32)daddr, + ports, &net_secret); + + if (READ_ONCE(net->ipv4.sysctl_tcp_timestamps) != 1) + st.ts_off = 0; + + st.seq = seq_scale(st.seq); + return st; } -EXPORT_SYMBOL_GPL(secure_tcp_seq); +EXPORT_SYMBOL_GPL(secure_tcp_seq_and_ts_off); u64 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport) { diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c index 64f098d127ac..b8f7e2b0b4f3 100644 --- a/net/ipv4/syncookies.c +++ b/net/ipv4/syncookies.c @@ -353,9 +353,14 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb) tcp_parse_options(sock_net(sk), skb, &tcp_opt, 0, NULL); if (tcp_opt.saw_tstamp && tcp_opt.rcv_tsecr) { - tsoff = secure_tcp_ts_off(sock_net(sk), - ip_hdr(skb)->daddr, - ip_hdr(skb)->saddr); + union tcp_seq_and_ts_off st; + + st = secure_tcp_seq_and_ts_off(sock_net(sk), + ip_hdr(skb)->daddr, + ip_hdr(skb)->saddr, + tcp_hdr(skb)->dest, + tcp_hdr(skb)->source); + tsoff = st.ts_off; tcp_opt.rcv_tsecr -= tsoff; } diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 8d6757ec06aa..9ca0a78d5a4b 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -7165,6 +7165,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, struct tcp_sock *tp = tcp_sk(sk); struct net *net = sock_net(sk); struct sock *fastopen_sk = NULL; + union tcp_seq_and_ts_off st; struct request_sock *req; bool want_cookie = false; struct dst_entry *dst; @@ -7227,9 +7228,12 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, if (!dst) goto drop_and_free; - if (tmp_opt.tstamp_ok) - tcp_rsk(req)->ts_off = af_ops->init_ts_off(net, skb); + if (tmp_opt.tstamp_ok || (!want_cookie && !isn)) + st = af_ops->init_seq_and_ts_off(net, skb); + if (tmp_opt.tstamp_ok) { + tcp_rsk(req)->ts_off = st.ts_off; + } if (!want_cookie && !isn) { int max_syn_backlog = READ_ONCE(net->ipv4.sysctl_max_syn_backlog); @@ -7250,7 +7254,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, goto drop_and_release; } - isn = af_ops->init_seq(skb); + isn = st.seq; } tcp_ecn_create_request(req, skb, sk, dst); diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 56d00db07d12..ceb34b30218b 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -96,17 +96,14 @@ static DEFINE_PER_CPU(struct sock *, ipv4_tcp_sk); static DEFINE_MUTEX(tcp_exit_batch_mutex); -static u32 tcp_v4_init_seq(const struct sk_buff *skb) +static union tcp_seq_and_ts_off +tcp_v4_init_seq_and_ts_off(const struct net *net, const struct sk_buff *skb) { - return secure_tcp_seq(ip_hdr(skb)->daddr, - ip_hdr(skb)->saddr, - tcp_hdr(skb)->dest, - tcp_hdr(skb)->source); -} - -static u32 tcp_v4_init_ts_off(const struct net *net, const struct sk_buff *skb) -{ - return secure_tcp_ts_off(net, ip_hdr(skb)->daddr, ip_hdr(skb)->saddr); + return secure_tcp_seq_and_ts_off(net, + ip_hdr(skb)->daddr, + ip_hdr(skb)->saddr, + tcp_hdr(skb)->dest, + tcp_hdr(skb)->source); } int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp) @@ -313,15 +310,16 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) rt = NULL; if (likely(!tp->repair)) { + union tcp_seq_and_ts_off st; + + st = secure_tcp_seq_and_ts_off(net, + inet->inet_saddr, + inet->inet_daddr, + inet->inet_sport, + usin->sin_port); if (!tp->write_seq) - WRITE_ONCE(tp->write_seq, - secure_tcp_seq(inet->inet_saddr, - inet->inet_daddr, - inet->inet_sport, - usin->sin_port)); - WRITE_ONCE(tp->tsoffset, - secure_tcp_ts_off(net, inet->inet_saddr, - inet->inet_daddr)); + WRITE_ONCE(tp->write_seq, st.seq); + WRITE_ONCE(tp->tsoffset, st.ts_off); } atomic_set(&inet->inet_id, get_random_u16()); @@ -1535,8 +1533,7 @@ const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = { .cookie_init_seq = cookie_v4_init_sequence, #endif .route_req = tcp_v4_route_req, - .init_seq = tcp_v4_init_seq, - .init_ts_off = tcp_v4_init_ts_off, + .init_seq_and_ts_off = tcp_v4_init_seq_and_ts_off, .send_synack = tcp_v4_send_synack, }; diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c index a6cefee15005..bdbd3fd20448 100644 --- a/net/ipv6/syncookies.c +++ b/net/ipv6/syncookies.c @@ -161,9 +161,14 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) tcp_parse_options(sock_net(sk), skb, &tcp_opt, 0, NULL); if (tcp_opt.saw_tstamp && tcp_opt.rcv_tsecr) { - tsoff = secure_tcpv6_ts_off(sock_net(sk), - ipv6_hdr(skb)->daddr.s6_addr32, - ipv6_hdr(skb)->saddr.s6_addr32); + union tcp_seq_and_ts_off st; + + st = secure_tcpv6_seq_and_ts_off(sock_net(sk), + ipv6_hdr(skb)->daddr.s6_addr32, + ipv6_hdr(skb)->saddr.s6_addr32, + tcp_hdr(skb)->dest, + tcp_hdr(skb)->source); + tsoff = st.ts_off; tcp_opt.rcv_tsecr -= tsoff; } diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index f285e52b8b85..793e644fa750 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -107,18 +107,14 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb) } } -static u32 tcp_v6_init_seq(const struct sk_buff *skb) +static union tcp_seq_and_ts_off +tcp_v6_init_seq_and_ts_off(const struct net *net, const struct sk_buff *skb) { - return secure_tcpv6_seq(ipv6_hdr(skb)->daddr.s6_addr32, - ipv6_hdr(skb)->saddr.s6_addr32, - tcp_hdr(skb)->dest, - tcp_hdr(skb)->source); -} - -static u32 tcp_v6_init_ts_off(const struct net *net, const struct sk_buff *skb) -{ - return secure_tcpv6_ts_off(net, ipv6_hdr(skb)->daddr.s6_addr32, - ipv6_hdr(skb)->saddr.s6_addr32); + return secure_tcpv6_seq_and_ts_off(net, + ipv6_hdr(skb)->daddr.s6_addr32, + ipv6_hdr(skb)->saddr.s6_addr32, + tcp_hdr(skb)->dest, + tcp_hdr(skb)->source); } static int tcp_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr, @@ -318,14 +314,16 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, sk_set_txhash(sk); if (likely(!tp->repair)) { + union tcp_seq_and_ts_off st; + + st = secure_tcpv6_seq_and_ts_off(net, + np->saddr.s6_addr32, + sk->sk_v6_daddr.s6_addr32, + inet->inet_sport, + inet->inet_dport); if (!tp->write_seq) - WRITE_ONCE(tp->write_seq, - secure_tcpv6_seq(np->saddr.s6_addr32, - sk->sk_v6_daddr.s6_addr32, - inet->inet_sport, - inet->inet_dport)); - tp->tsoffset = secure_tcpv6_ts_off(net, np->saddr.s6_addr32, - sk->sk_v6_daddr.s6_addr32); + WRITE_ONCE(tp->write_seq, st.seq); + tp->tsoffset = st.ts_off; } if (tcp_fastopen_defer_connect(sk, &err)) @@ -831,8 +829,7 @@ const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = { .cookie_init_seq = cookie_v6_init_sequence, #endif .route_req = tcp_v6_route_req, - .init_seq = tcp_v6_init_seq, - .init_ts_off = tcp_v6_init_ts_off, + .init_seq_and_ts_off = tcp_v6_init_seq_and_ts_off, .send_synack = tcp_v6_send_synack, }; -- 2.34.1

2 1

[PATCH OLK-6.6] net: gro: fix outer network offset
by Li Xiasong 02 Apr '26

02 Apr '26

From: Paolo Abeni <pabeni(a)redhat.com> stable inclusion from stable-v6.6.124 commit 9d40a85138568696387ef04cd004c64612a70874 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13895 CVE: CVE-2026-23254 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5c2c3c38be396257a6a2e55bd601a12bb9781507 ] The udp GRO complete stage assumes that all the packets inserted the RX have the `encapsulation` flag zeroed. Such assumption is not true, as a few H/W NICs can set such flag when H/W offloading the checksum for an UDP encapsulated traffic, the tun driver can inject GSO packets with UDP encapsulation and the problematic layout can also be created via a veth based setup. Due to the above, in the problematic scenarios, udp4_gro_complete() uses the wrong network offset (inner instead of outer) to compute the outer UDP header pseudo checksum, leading to csum validation errors later on in packet processing. Address the issue always clearing the encapsulation flag at GRO completion time. Such flag will be set again as needed for encapsulated packets by udp_gro_complete(). Fixes: 5ef31ea5d053 ("net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb") Reviewed-by: Willem de Bruijn <willemb(a)google.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/562638dbebb3b15424220e26a180274b387e2a88.177003208… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/core/gro.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/core/gro.c b/net/core/gro.c index 2f72cce0b219..98f47ff5837b 100644 --- a/net/core/gro.c +++ b/net/core/gro.c @@ -242,6 +242,8 @@ static void napi_gro_complete(struct napi_struct *napi, struct sk_buff *skb) goto out; } + /* NICs can feed encapsulated packets into GRO */ + skb->encapsulation = 0; rcu_read_lock(); list_for_each_entry_rcu(ptype, head, list) { if (ptype->type != type || !ptype->callbacks.gro_complete) -- 2.34.1

2 1

[PATCH OLK-6.6] net: annotate data-races around sk->sk_{data_ready,write_space}
by Li Xiasong 02 Apr '26

02 Apr '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.0-rc3 commit 2ef2b20cf4e04ac8a6ba68493f8780776ff84300 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13979 CVE: CVE-2026-23302 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- skmsg (and probably other layers) are changing these pointers while other cpus might read them concurrently. Add corresponding READ_ONCE()/WRITE_ONCE() annotations for UDP, TCP and AF_UNIX. Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Reported-by: syzbot+87f770387a9e5dc6b79b(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/699ee9fc.050a0220.1cd54b.0009.GAE@google.com/ Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Daniel Borkmann <daniel(a)iogearbox.net> Cc: John Fastabend <john.fastabend(a)gmail.com> Cc: Jakub Sitnicki <jakub(a)cloudflare.com> Cc: Willem de Bruijn <willemdebruijn.kernel(a)gmail.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)google.com> Link: https://patch.msgid.link/20260225131547.1085509-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/udp.c net/ipv4/tcp.c net/ipv4/tcp_input.c net/ipv4/tcp_minisocks.c net/unix/af_unix.c [conflicts due to not merge bd61848900bf ("net: devmem: Implement TX path") and 95b9a87c6a6b ("tcp: record last received ipv6 flowlabel") and f0db2bca0cf9 ("tcp: rework {__,}tcp_ecn_check_ce() -> tcp_data_ecn_check()") and 2bd99aef1b19 ("tcp: accept bare FIN packets under memory pressure") and b98256959305 ("tcp: make the dropreason really work when calling tcp_rcv_state_process()") and 85cb0757d7e1 ("net: Convert proto_ops connect() callbacks to use sockaddr_unsized") and f4e1fb04c123 ("af_unix: Use cached value for SOCK_STREAM in unix_inq_len().") and b650bf0977d3 ("udp: remove busylock and add per NUMA queues").] Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/core/skmsg.c | 14 +++++++------- net/ipv4/tcp.c | 4 ++-- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_input.c | 14 ++++++++------ net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/udp.c | 3 ++- net/ipv4/udp_bpf.c | 2 +- net/unix/af_unix.c | 8 ++++---- 8 files changed, 26 insertions(+), 23 deletions(-) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index 3429c6e2ce21..e3696d510eec 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -1174,8 +1174,8 @@ void sk_psock_start_strp(struct sock *sk, struct sk_psock *psock) return; psock->saved_data_ready = sk->sk_data_ready; - sk->sk_data_ready = sk_psock_strp_data_ready; - sk->sk_write_space = sk_psock_write_space; + WRITE_ONCE(sk->sk_data_ready, sk_psock_strp_data_ready); + WRITE_ONCE(sk->sk_write_space, sk_psock_write_space); } void sk_psock_stop_strp(struct sock *sk, struct sk_psock *psock) @@ -1185,8 +1185,8 @@ void sk_psock_stop_strp(struct sock *sk, struct sk_psock *psock) if (!psock->saved_data_ready) return; - sk->sk_data_ready = psock->saved_data_ready; - psock->saved_data_ready = NULL; + WRITE_ONCE(sk->sk_data_ready, psock->saved_data_ready); + WRITE_ONCE(psock->saved_data_ready, NULL); strp_stop(&psock->strp); } @@ -1265,8 +1265,8 @@ void sk_psock_start_verdict(struct sock *sk, struct sk_psock *psock) return; psock->saved_data_ready = sk->sk_data_ready; - sk->sk_data_ready = sk_psock_verdict_data_ready; - sk->sk_write_space = sk_psock_write_space; + WRITE_ONCE(sk->sk_data_ready, sk_psock_verdict_data_ready); + WRITE_ONCE(sk->sk_write_space, sk_psock_write_space); } void sk_psock_stop_verdict(struct sock *sk, struct sk_psock *psock) @@ -1277,6 +1277,6 @@ void sk_psock_stop_verdict(struct sock *sk, struct sk_psock *psock) if (!psock->saved_data_ready) return; - sk->sk_data_ready = psock->saved_data_ready; + WRITE_ONCE(sk->sk_data_ready, psock->saved_data_ready); psock->saved_data_ready = NULL; } diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index bf23aa827031..1fe89e742f75 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1342,7 +1342,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size) err = sk_stream_error(sk, flags, err); /* make sure we wake any epoll edge trigger waiter */ if (unlikely(tcp_rtx_and_write_queues_empty(sk) && err == -EAGAIN)) { - sk->sk_write_space(sk); + READ_ONCE(sk->sk_write_space)(sk); tcp_chrono_stop(sk, TCP_CHRONO_SNDBUF_LIMITED); } return err; @@ -3705,7 +3705,7 @@ int do_tcp_setsockopt(struct sock *sk, int level, int optname, break; case TCP_NOTSENT_LOWAT: WRITE_ONCE(tp->notsent_lowat, val); - sk->sk_write_space(sk); + READ_ONCE(sk->sk_write_space)(sk); break; case TCP_INQ: if (val > 1 || val < 0) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 0e56f3baf98a..9ceb6e0c8b00 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -668,7 +668,7 @@ int tcp_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore) WRITE_ONCE(sk->sk_prot->unhash, psock->saved_unhash); tcp_update_ulp(sk, psock->sk_proto, psock->saved_write_space); } else { - sk->sk_write_space = psock->saved_write_space; + WRITE_ONCE(sk->sk_write_space, psock->saved_write_space); /* Pairs with lockless read in sk_clone_lock() */ sock_replace_proto(sk, psock->sk_proto); } diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 8d6757ec06aa..a10e7da1a612 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -4985,7 +4985,7 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) if (unlikely(tcp_try_rmem_schedule(sk, skb, skb->truesize))) { NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPOFODROP); - sk->sk_data_ready(sk); + READ_ONCE(sk->sk_data_ready)(sk); tcp_drop_reason(sk, skb, SKB_DROP_REASON_PROTO_MEM); return; } @@ -5192,7 +5192,7 @@ int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size) void tcp_data_ready(struct sock *sk) { if (tcp_epollin_ready(sk, sk->sk_rcvlowat) || sock_flag(sk, SOCK_DONE)) - sk->sk_data_ready(sk); + READ_ONCE(sk->sk_data_ready)(sk); } static void tcp_data_queue(struct sock *sk, struct sk_buff *skb) @@ -5238,7 +5238,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb) inet_csk(sk)->icsk_ack.pending |= (ICSK_ACK_NOMEM | ICSK_ACK_NOW); inet_csk_schedule_ack(sk); - sk->sk_data_ready(sk); + READ_ONCE(sk->sk_data_ready)(sk); if (skb_queue_len(&sk->sk_receive_queue)) { reason = SKB_DROP_REASON_PROTO_MEM; @@ -5675,7 +5675,9 @@ static void tcp_new_space(struct sock *sk) tp->snd_cwnd_stamp = tcp_jiffies32; } - INDIRECT_CALL_1(sk->sk_write_space, sk_stream_write_space, sk); + INDIRECT_CALL_1(READ_ONCE(sk->sk_write_space), + sk_stream_write_space, + sk); } /* Caller made space either from: @@ -5873,7 +5875,7 @@ static void tcp_urg(struct sock *sk, struct sk_buff *skb, const struct tcphdr *t BUG(); WRITE_ONCE(tp->urg_data, TCP_URG_VALID | tmp); if (!sock_flag(sk, SOCK_DEAD)) - sk->sk_data_ready(sk); + READ_ONCE(sk->sk_data_ready)(sk); } } } @@ -7279,7 +7281,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, sock_put(fastopen_sk); goto drop_and_free; } - sk->sk_data_ready(sk); + READ_ONCE(sk->sk_data_ready)(sk); bh_unlock_sock(fastopen_sk); sock_put(fastopen_sk); } else { diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index 770b1ffb2e22..8d72532143bf 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -900,7 +900,7 @@ int tcp_child_process(struct sock *parent, struct sock *child, ret = tcp_rcv_state_process(child, skb); /* Wakeup parent, send SIGIO */ if (state == TCP_SYN_RECV && child->sk_state != state) - parent->sk_data_ready(parent); + READ_ONCE(parent->sk_data_ready)(parent); } else { /* Alas, it is possible again, because we do lookup * in main socket hash table and lock on listening diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 4c1f82f6777f..40100fed5c67 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1618,7 +1618,8 @@ int __udp_enqueue_schedule_skb(struct sock *sk, struct sk_buff *skb) spin_unlock(&list->lock); if (!sock_flag(sk, SOCK_DEAD)) - INDIRECT_CALL_1(sk->sk_data_ready, sock_def_readable, sk); + INDIRECT_CALL_1(READ_ONCE(sk->sk_data_ready), + sock_def_readable, sk); busylock_release(busy); return 0; diff --git a/net/ipv4/udp_bpf.c b/net/ipv4/udp_bpf.c index 0735d820e413..44271ba1adec 100644 --- a/net/ipv4/udp_bpf.c +++ b/net/ipv4/udp_bpf.c @@ -143,7 +143,7 @@ int udp_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore) int family = sk->sk_family == AF_INET ? UDP_BPF_IPV4 : UDP_BPF_IPV6; if (restore) { - sk->sk_write_space = psock->saved_write_space; + WRITE_ONCE(sk->sk_write_space, psock->saved_write_space); sock_replace_proto(sk, psock->sk_proto); return 0; } diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index abf9fe35e620..51f444ecebf6 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -1678,7 +1678,7 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr, __skb_queue_tail(&other->sk_receive_queue, skb); spin_unlock(&other->sk_receive_queue.lock); unix_state_unlock(other); - other->sk_data_ready(other); + READ_ONCE(other->sk_data_ready)(other); sock_put(other); return 0; @@ -2138,7 +2138,7 @@ static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg, scm_stat_add(other, skb); skb_queue_tail(&other->sk_receive_queue, skb); unix_state_unlock(other); - other->sk_data_ready(other); + READ_ONCE(other->sk_data_ready)(other); sock_put(other); scm_destroy(&scm); return len; @@ -2206,7 +2206,7 @@ static int queue_oob(struct socket *sock, struct msghdr *msg, struct sock *other sk_send_sigurg(other); unix_state_unlock(other); - other->sk_data_ready(other); + READ_ONCE(other->sk_data_ready)(other); return err; } @@ -2317,7 +2317,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, scm_stat_add(other, skb); skb_queue_tail(&other->sk_receive_queue, skb); unix_state_unlock(other); - other->sk_data_ready(other); + READ_ONCE(other->sk_data_ready)(other); sent += size; } -- 2.34.1

2 1

[PATCH OLK-6.6] net: add proper RCU protection to /proc/net/ptype
by Li Xiasong 02 Apr '26

02 Apr '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.19 commit f613e8b4afea0cd17c7168e8b00e25bc8d33175d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13893 CVE: CVE-2026-23255 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Yin Fengwei reported an RCU stall in ptype_seq_show() and provided a patch. Real issue is that ptype_seq_next() and ptype_seq_show() violate RCU rules. ptype_seq_show() runs under rcu_read_lock(), and reads pt->dev to get device name without any barrier. At the same time, concurrent writers can remove a packet_type structure (which is correctly freed after an RCU grace period) and clear pt->dev without an RCU grace period. Define ptype_iter_state to carry a dev pointer along seq_net_private: struct ptype_iter_state { struct seq_net_private p; struct net_device *dev; // added in this patch }; We need to record the device pointer in ptype_get_idx() and ptype_seq_next() so that ptype_seq_show() is safe against concurrent pt->dev changes. We also need to add full RCU protection in ptype_seq_next(). (Missing READ_ONCE() when reading list.next values) Many thanks to Dong Chenchen for providing a repro. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 1d10f8a1f40b ("net-procfs: show net devices bound packet types") Fixes: c353e8983e0d ("net: introduce per netns packet chains") Reported-by: Yin Fengwei <fengwei_yin(a)linux.alibaba.com> Reported-by: Dong Chenchen <dongchenchen2(a)huawei.com> Closes: https://lore.kernel.org/netdev/CANn89iKRRKPnWjJmb-_3a=sq+9h6DvTQM4DBZHT5ZRG… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Tested-by: Yin Fengwei <fengwei_yin(a)linux.alibaba.com> Link: https://patch.msgid.link/20260202205217.2881198-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/core/net-procfs.c [conflicts due to not merge c353e8983e0d ("net: introduce per netns packet chains").] Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/core/net-procfs.c | 48 +++++++++++++++++++++++++++++-------------- 1 file changed, 33 insertions(+), 15 deletions(-) diff --git a/net/core/net-procfs.c b/net/core/net-procfs.c index 09f7ed1a04e8..caad20464a4d 100644 --- a/net/core/net-procfs.c +++ b/net/core/net-procfs.c @@ -200,8 +200,14 @@ static const struct seq_operations softnet_seq_ops = { .show = softnet_seq_show, }; +struct ptype_iter_state { + struct seq_net_private p; + struct net_device *dev; +}; + static void *ptype_get_idx(struct seq_file *seq, loff_t pos) { + struct ptype_iter_state *iter = seq->private; struct list_head *ptype_list = NULL; struct packet_type *pt = NULL; struct net_device *dev; @@ -211,12 +217,16 @@ static void *ptype_get_idx(struct seq_file *seq, loff_t pos) for_each_netdev_rcu(seq_file_net(seq), dev) { ptype_list = &dev->ptype_all; list_for_each_entry_rcu(pt, ptype_list, list) { - if (i == pos) + if (i == pos) { + iter->dev = dev; return pt; + } ++i; } } + iter->dev = NULL; + list_for_each_entry_rcu(pt, &ptype_all, list) { if (i == pos) return pt; @@ -242,6 +252,7 @@ static void *ptype_seq_start(struct seq_file *seq, loff_t *pos) static void *ptype_seq_next(struct seq_file *seq, void *v, loff_t *pos) { + struct ptype_iter_state *iter = seq->private; struct net_device *dev; struct packet_type *pt; struct list_head *nxt; @@ -252,20 +263,22 @@ static void *ptype_seq_next(struct seq_file *seq, void *v, loff_t *pos) return ptype_get_idx(seq, 0); pt = v; - nxt = pt->list.next; - if (pt->dev) { - if (nxt != &pt->dev->ptype_all) + nxt = READ_ONCE(pt->list.next); + dev = iter->dev; + if (dev) { + if (nxt != &dev->ptype_all) goto found; - dev = pt->dev; for_each_netdev_continue_rcu(seq_file_net(seq), dev) { - if (!list_empty(&dev->ptype_all)) { - nxt = dev->ptype_all.next; + nxt = READ_ONCE(dev->ptype_all.next); + if (nxt != &dev->ptype_all) { + iter->dev = dev; goto found; } } - nxt = ptype_all.next; + iter->dev = NULL; + nxt = READ_ONCE(ptype_all.next); goto ptype_all; } @@ -274,14 +287,14 @@ static void *ptype_seq_next(struct seq_file *seq, void *v, loff_t *pos) if (nxt != &ptype_all) goto found; hash = 0; - nxt = ptype_base[0].next; + nxt = READ_ONCE(ptype_base[0].next); } else hash = ntohs(pt->type) & PTYPE_HASH_MASK; while (nxt == &ptype_base[hash]) { if (++hash >= PTYPE_HASH_SIZE) return NULL; - nxt = ptype_base[hash].next; + nxt = READ_ONCE(ptype_base[hash].next); } found: return list_entry(nxt, struct packet_type, list); @@ -295,19 +308,24 @@ static void ptype_seq_stop(struct seq_file *seq, void *v) static int ptype_seq_show(struct seq_file *seq, void *v) { + struct ptype_iter_state *iter = seq->private; struct packet_type *pt = v; + struct net_device *dev; - if (v == SEQ_START_TOKEN) + if (v == SEQ_START_TOKEN) { seq_puts(seq, "Type Device Function\n"); - else if ((!pt->af_packet_net || net_eq(pt->af_packet_net, seq_file_net(seq))) && - (!pt->dev || net_eq(dev_net(pt->dev), seq_file_net(seq)))) { + return 0; + } + dev = iter->dev; + if ((!pt->af_packet_net || net_eq(pt->af_packet_net, seq_file_net(seq))) && + (!dev || net_eq(dev_net(dev), seq_file_net(seq)))) { if (pt->type == htons(ETH_P_ALL)) seq_puts(seq, "ALL "); else seq_printf(seq, "%04x", ntohs(pt->type)); seq_printf(seq, " %-8s %ps\n", - pt->dev ? pt->dev->name : "", pt->func); + dev ? dev->name : "", pt->func); } return 0; @@ -331,7 +349,7 @@ static int __net_init dev_proc_net_init(struct net *net) &softnet_seq_ops)) goto out_dev; if (!proc_create_net("ptype", 0444, net->proc_net, &ptype_seq_ops, - sizeof(struct seq_net_private))) + sizeof(struct ptype_iter_state))) goto out_softnet; if (wext_proc_init(net)) -- 2.34.1

2 1

[PATCH OLK-6.6] af_unix: Give up GC if MSG_PEEK intervened.
by Li Xiasong 02 Apr '26

02 Apr '26

From: Kuniyuki Iwashima <kuniyu(a)google.com> mainline inclusion from mainline-v7.0-rc5 commit e5b31d988a41549037b8d8721a3c3cae893d8670 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14025 CVE: CVE-2026-23394 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Igor Ushakov reported that GC purged the receive queue of an alive socket due to a race with MSG_PEEK with a nice repro. This is the exact same issue previously fixed by commit cbcf01128d0a ("af_unix: fix garbage collect vs MSG_PEEK"). After GC was replaced with the current algorithm, the cited commit removed the locking dance in unix_peek_fds() and reintroduced the same issue. The problem is that MSG_PEEK bumps a file refcount without interacting with GC. Consider an SCC containing sk-A and sk-B, where sk-A is close()d but can be recv()ed via sk-B. The bad thing happens if sk-A is recv()ed with MSG_PEEK from sk-B and sk-B is close()d while GC is checking unix_vertex_dead() for sk-A and sk-B. GC thread User thread --------- ----------- unix_vertex_dead(sk-A) -> true <------. \ `------ recv(sk-B, MSG_PEEK) invalidate !! -> sk-A's file refcount : 1 -> 2 close(sk-B) -> sk-B's file refcount : 2 -> 1 unix_vertex_dead(sk-B) -> true Initially, sk-A's file refcount is 1 by the inflight fd in sk-B recvq. GC thinks sk-A is dead because the file refcount is the same as the number of its inflight fds. However, sk-A's file refcount is bumped silently by MSG_PEEK, which invalidates the previous evaluation. At this moment, sk-B's file refcount is 2; one by the open fd, and one by the inflight fd in sk-A. The subsequent close() releases one refcount by the former. Finally, GC incorrectly concludes that both sk-A and sk-B are dead. One option is to restore the locking dance in unix_peek_fds(), but we can resolve this more elegantly thanks to the new algorithm. The point is that the issue does not occur without the subsequent close() and we actually do not need to synchronise MSG_PEEK with the dead SCC detection. When the issue occurs, close() and GC touch the same file refcount. If GC sees the refcount being decremented by close(), it can just give up garbage-collecting the SCC. Therefore, we only need to signal the race during MSG_PEEK with a proper memory barrier to make it visible to the GC. Let's use seqcount_t to notify GC when MSG_PEEK occurs and let it defer the SCC to the next run. This way no locking is needed on the MSG_PEEK side, and we can avoid imposing a penalty on every MSG_PEEK unnecessarily. Note that we can retry within unix_scc_dead() if MSG_PEEK is detected, but we do not do so to avoid hung task splat from abusive MSG_PEEK calls. Fixes: 118f457da9ed ("af_unix: Remove lock dance in unix_peek_fds().") Reported-by: Igor Ushakov <sysroot314(a)gmail.com> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Link: https://patch.msgid.link/20260311054043.1231316-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/unix/af_unix.h include/net/af_unix.h net/unix/garbage.c [conflicts due to not merge 58b47c713711 ("af_unix: Count cyclic SCC.") and da8fc7a39be8 ("af_unix: Don't trigger GC from close() if unnecessary.") and 84960bf24031 ("af_unix: Move internal definitions to net/unix/.").] Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- include/net/af_unix.h | 1 + net/unix/af_unix.c | 2 ++ net/unix/garbage.c | 79 ++++++++++++++++++++++++++++--------------- 3 files changed, 54 insertions(+), 28 deletions(-) diff --git a/include/net/af_unix.h b/include/net/af_unix.h index b6eedf7650da..d2fa6d9f1e97 100644 --- a/include/net/af_unix.h +++ b/include/net/af_unix.h @@ -23,6 +23,7 @@ void unix_del_edges(struct scm_fp_list *fpl); void unix_update_edges(struct unix_sock *receiver); int unix_prepare_fpl(struct scm_fp_list *fpl); void unix_destroy_fpl(struct scm_fp_list *fpl); +void unix_peek_fpl(struct scm_fp_list *fpl); void unix_gc(void); void wait_for_unix_gc(struct scm_fp_list *fpl); diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index abf9fe35e620..4407d4fedb02 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -1848,6 +1848,8 @@ static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb) static void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb) { scm->fp = scm_fp_dup(UNIXCB(skb).fp); + + unix_peek_fpl(scm->fp); } static void unix_destruct_scm(struct sk_buff *skb) diff --git a/net/unix/garbage.c b/net/unix/garbage.c index 66fd606c43f4..1cdb54c61619 100644 --- a/net/unix/garbage.c +++ b/net/unix/garbage.c @@ -306,6 +306,25 @@ void unix_destroy_fpl(struct scm_fp_list *fpl) unix_free_vertices(fpl); } +static bool gc_in_progress; +static seqcount_t unix_peek_seq = SEQCNT_ZERO(unix_peek_seq); + +void unix_peek_fpl(struct scm_fp_list *fpl) +{ + static DEFINE_SPINLOCK(unix_peek_lock); + + if (!fpl || !fpl->count_unix) + return; + + if (!READ_ONCE(gc_in_progress)) + return; + + /* Invalidate the final refcnt check in unix_vertex_dead(). */ + spin_lock(&unix_peek_lock); + raw_write_seqcount_barrier(&unix_peek_seq); + spin_unlock(&unix_peek_lock); +} + static bool unix_vertex_dead(struct unix_vertex *vertex) { struct unix_edge *edge; @@ -339,6 +358,36 @@ static bool unix_vertex_dead(struct unix_vertex *vertex) return true; } +static LIST_HEAD(unix_visited_vertices); +static unsigned long unix_vertex_grouped_index = UNIX_VERTEX_INDEX_MARK2; + +static bool unix_scc_dead(struct list_head *scc, bool fast) +{ + struct unix_vertex *vertex; + bool scc_dead = true; + unsigned int seq; + + seq = read_seqcount_begin(&unix_peek_seq); + + list_for_each_entry_reverse(vertex, scc, scc_entry) { + /* Don't restart DFS from this vertex. */ + list_move_tail(&vertex->entry, &unix_visited_vertices); + + /* Mark vertex as off-stack for __unix_walk_scc(). */ + if (!fast) + vertex->index = unix_vertex_grouped_index; + + if (scc_dead) + scc_dead = unix_vertex_dead(vertex); + } + + /* If MSG_PEEK intervened, defer this SCC to the next round. */ + if (read_seqcount_retry(&unix_peek_seq, seq)) + return false; + + return scc_dead; +} + static void unix_collect_skb(struct list_head *scc, struct sk_buff_head *hitlist) { struct unix_vertex *vertex; @@ -392,9 +441,6 @@ static bool unix_scc_cyclic(struct list_head *scc) return false; } -static LIST_HEAD(unix_visited_vertices); -static unsigned long unix_vertex_grouped_index = UNIX_VERTEX_INDEX_MARK2; - static void __unix_walk_scc(struct unix_vertex *vertex, unsigned long *last_index, struct sk_buff_head *hitlist) { @@ -460,9 +506,7 @@ static void __unix_walk_scc(struct unix_vertex *vertex, unsigned long *last_inde } if (vertex->index == vertex->scc_index) { - struct unix_vertex *v; struct list_head scc; - bool scc_dead = true; /* SCC finalised. * @@ -471,18 +515,7 @@ static void __unix_walk_scc(struct unix_vertex *vertex, unsigned long *last_inde */ __list_cut_position(&scc, &vertex_stack, &vertex->scc_entry); - list_for_each_entry_reverse(v, &scc, scc_entry) { - /* Don't restart DFS from this vertex in unix_walk_scc(). */ - list_move_tail(&v->entry, &unix_visited_vertices); - - /* Mark vertex as off-stack. */ - v->index = unix_vertex_grouped_index; - - if (scc_dead) - scc_dead = unix_vertex_dead(v); - } - - if (scc_dead) { + if (unix_scc_dead(&scc, false)) { unix_collect_skb(&scc, hitlist); } else { if (unix_vertex_max_scc_index < vertex->scc_index) @@ -530,19 +563,11 @@ static void unix_walk_scc_fast(struct sk_buff_head *hitlist) while (!list_empty(&unix_unvisited_vertices)) { struct unix_vertex *vertex; struct list_head scc; - bool scc_dead = true; vertex = list_first_entry(&unix_unvisited_vertices, typeof(*vertex), entry); list_add(&scc, &vertex->scc_entry); - list_for_each_entry_reverse(vertex, &scc, scc_entry) { - list_move_tail(&vertex->entry, &unix_visited_vertices); - - if (scc_dead) - scc_dead = unix_vertex_dead(vertex); - } - - if (scc_dead) + if (unix_scc_dead(&scc, true)) unix_collect_skb(&scc, hitlist); else if (!unix_graph_maybe_cyclic) unix_graph_maybe_cyclic = unix_scc_cyclic(&scc); @@ -553,8 +578,6 @@ static void unix_walk_scc_fast(struct sk_buff_head *hitlist) list_replace_init(&unix_visited_vertices, &unix_unvisited_vertices); } -static bool gc_in_progress; - static void __unix_gc(struct work_struct *work) { struct sk_buff_head hitlist; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression
by Li Xiasong 02 Apr '26

02 Apr '26

This patchset contains a backport of the upstream change that introduced the issue, followed by the fix. Patch 1 is a backport of upstream commit f478b8239d65 ("net: tunnel: make skb_vlan_inet_prepare() return drop reasons") which changed the return value semantics of skb_vlan_inet_prepare(). Patch 2 adapts the return value handling in __ip6_tnl_rcv() to match the new semantics, fixing the regression. Including the upstream change as patch 1 ensures that applying both patches together does not introduce the issue that would occur if only patch 1 were merged. Li Xiasong (1): ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change Menglong Dong (1): net: tunnel: make skb_vlan_inet_prepare() return drop reasons drivers/net/bareudp.c | 4 ++-- drivers/net/geneve.c | 4 ++-- include/net/ip_tunnels.h | 13 ++++++++----- net/ipv6/ip6_tunnel.c | 2 +- 4 files changed, 13 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
by Zhang Kunbo 02 Apr '26

02 Apr '26

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v7.0-rc6 commit aad885e774966e97b675dfe928da164214a71605 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14045 CVE: CVE-2026-23401 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]--- Reported-by: Alexander Bulekov <bkov(a)amazon.com> Debugged-by: Alexander Bulekov <bkov(a)amazon.com> Suggested-by: Fred Griffoul <fgriffo(a)amazon.co.uk> Fixes: a54aa15c6bda3 ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()") Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Conflicts: arch/x86/kvm/mmu/mmu.c [1075d41-not-merged,-and-context-conflicts] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/mmu/mmu.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index 0fee502a5f29..6ee54414295b 100755 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -2820,11 +2820,6 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, pgprintk("%s: spte %llx write_fault %d gfn %llx\n", __func__, *sptep, write_fault, gfn); - if (unlikely(is_noslot_pfn(pfn))) { - mark_mmio_spte(vcpu, sptep, gfn, pte_access); - return RET_PF_EMULATE; - } - if (is_shadow_present_pte(*sptep)) { /* * If we overwrite a PTE page pointer with a 2MB PMD, unlink @@ -2846,6 +2841,13 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, was_rmapped = 1; } + if (unlikely(is_noslot_pfn(pfn))) { + mark_mmio_spte(vcpu, sptep, gfn, pte_access); + if (flush) + kvm_flush_remote_tlbs_gfn(vcpu->kvm, gfn, level); + return RET_PF_EMULATE; + } + wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch, true, host_writable, &spte); -- 2.34.1

2 1

[PATCH OLK-6.6] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
by Zhang Kunbo 02 Apr '26

02 Apr '26

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v7.0-rc6 commit aad885e774966e97b675dfe928da164214a71605 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14045 CVE: CVE-2026-23401 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]--- Reported-by: Alexander Bulekov <bkov(a)amazon.com> Debugged-by: Alexander Bulekov <bkov(a)amazon.com> Suggested-by: Fred Griffoul <fgriffo(a)amazon.co.uk> Fixes: a54aa15c6bda ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()") Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Conflicts: arch/x86/kvm/mmu/mmu.c [Context conflicts.] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/mmu/mmu.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index c54c8385b16d..2837f83b807d 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -2914,12 +2914,6 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, bool prefetch = !fault || fault->prefetch; bool write_fault = fault && fault->write; - if (unlikely(is_noslot_pfn(pfn))) { - vcpu->stat.pf_mmio_spte_created++; - mark_mmio_spte(vcpu, sptep, gfn, pte_access); - return RET_PF_EMULATE; - } - if (is_shadow_present_pte(*sptep)) { /* * If we overwrite a PTE page pointer with a 2MB PMD, unlink @@ -2939,6 +2933,14 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, was_rmapped = 1; } + if (unlikely(is_noslot_pfn(pfn))) { + vcpu->stat.pf_mmio_spte_created++; + mark_mmio_spte(vcpu, sptep, gfn, pte_access); + if (flush) + kvm_flush_remote_tlbs_gfn(vcpu->kvm, gfn, level); + return RET_PF_EMULATE; + } + wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch, true, host_writable, &spte); -- 2.34.1

2 1

[PATCH OLK-6.6] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
by Zhang Kunbo 02 Apr '26

02 Apr '26

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v7.0-rc6 commit aad885e774966e97b675dfe928da164214a71605 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14045 CVE: CVE-2026-23401 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]--- Reported-by: Alexander Bulekov <bkov(a)amazon.com> Debugged-by: Alexander Bulekov <bkov(a)amazon.com> Suggested-by: Fred Griffoul <fgriffo(a)amazon.co.uk> Fixes: a54aa15c6bda ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()") Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Conflicts: arch/x86/kvm/mmu/mmu.c [Context conflicts.] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/mmu/mmu.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index c54c8385b16d..2837f83b807d 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -2914,12 +2914,6 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, bool prefetch = !fault || fault->prefetch; bool write_fault = fault && fault->write; - if (unlikely(is_noslot_pfn(pfn))) { - vcpu->stat.pf_mmio_spte_created++; - mark_mmio_spte(vcpu, sptep, gfn, pte_access); - return RET_PF_EMULATE; - } - if (is_shadow_present_pte(*sptep)) { /* * If we overwrite a PTE page pointer with a 2MB PMD, unlink @@ -2939,6 +2933,14 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, was_rmapped = 1; } + if (unlikely(is_noslot_pfn(pfn))) { + vcpu->stat.pf_mmio_spte_created++; + mark_mmio_spte(vcpu, sptep, gfn, pte_access); + if (flush) + kvm_flush_remote_tlbs_gfn(vcpu->kvm, gfn, level); + return RET_PF_EMULATE; + } + wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch, true, host_writable, &spte); -- 2.34.1

2 1

[PATCH OLK-6.6] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
by Zhang Kunbo 02 Apr '26

02 Apr '26

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v7.0-rc6 commit aad885e774966e97b675dfe928da164214a71605 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14045 CVE: CVE-2026-23401 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]--- Reported-by: Alexander Bulekov <bkov(a)amazon.com> Debugged-by: Alexander Bulekov <bkov(a)amazon.com> Suggested-by: Fred Griffoul <fgriffo(a)amazon.co.uk> Fixes: a54aa15c6bda3 ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()") Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Conflicts: arch/x86/kvm/mmu/mmu.c [Context conflicts.] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/mmu/mmu.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index c54c8385b16d..2837f83b807d 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -2914,12 +2914,6 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, bool prefetch = !fault || fault->prefetch; bool write_fault = fault && fault->write; - if (unlikely(is_noslot_pfn(pfn))) { - vcpu->stat.pf_mmio_spte_created++; - mark_mmio_spte(vcpu, sptep, gfn, pte_access); - return RET_PF_EMULATE; - } - if (is_shadow_present_pte(*sptep)) { /* * If we overwrite a PTE page pointer with a 2MB PMD, unlink @@ -2939,6 +2933,14 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, was_rmapped = 1; } + if (unlikely(is_noslot_pfn(pfn))) { + vcpu->stat.pf_mmio_spte_created++; + mark_mmio_spte(vcpu, sptep, gfn, pte_access); + if (flush) + kvm_flush_remote_tlbs_gfn(vcpu->kvm, gfn, level); + return RET_PF_EMULATE; + } + wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch, true, host_writable, &spte); -- 2.34.1

2 1

[PATCH OLK-5.10] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
by Zhang Kunbo 02 Apr '26

02 Apr '26

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.6.130 commit 3990f352bb0adc8688d0949a9c13e3110570eb61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13978 CVE: CVE-2026-23303 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]--- Reported-by: Alexander Bulekov <bkov(a)amazon.com> Debugged-by: Alexander Bulekov <bkov(a)amazon.com> Suggested-by: Fred Griffoul <fgriffo(a)amazon.co.uk> Fixes: a54aa15c6bda3 ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()") Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Conflicts: arch/x86/kvm/mmu/mmu.c [1075d41 not merged, and context conflicts] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/mmu/mmu.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index 0fee502a5f29..8d6f331d3a8f 100755 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -2820,11 +2820,6 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, pgprintk("%s: spte %llx write_fault %d gfn %llx\n", __func__, *sptep, write_fault, gfn); - if (unlikely(is_noslot_pfn(pfn))) { - mark_mmio_spte(vcpu, sptep, gfn, pte_access); - return RET_PF_EMULATE; - } - if (is_shadow_present_pte(*sptep)) { /* * If we overwrite a PTE page pointer with a 2MB PMD, unlink @@ -2846,6 +2841,14 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, was_rmapped = 1; } + if (unlikely(is_noslot_pfn(pfn))) { + vcpu->stat.pf_mmio_spte_created++; + mark_mmio_spte(vcpu, sptep, gfn, pte_access); + if (flush) + kvm_flush_remote_tlbs_gfn(vcpu->kvm, gfn, level); + return RET_PF_EMULATE; + } + wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch, true, host_writable, &spte); -- 2.34.1

2 1

[PATCH OLK-5.10] ice: Fix memory leak in ice_set_ringparam()
by Pan Taixi 02 Apr '26

02 Apr '26

From: Zilin Guan <zilin(a)seu.edu.cn> mainline inclusion from mainline-v7.0-rc3 commit fe868b499d16f55bbeea89992edb98043c9de416 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14020/ CVE: CVE-2026-23389 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In ice_set_ringparam, tx_rings and xdp_rings are allocated before rx_rings. If the allocation of rx_rings fails, the code jumps to the done label leaking both tx_rings and xdp_rings. Furthermore, if the setup of an individual Rx ring fails during the loop, the code jumps to the free_tx label which releases tx_rings but leaks xdp_rings. Fix this by introducing a free_xdp label and updating the error paths to ensure both xdp_rings and tx_rings are properly freed if rx_rings allocation or setup fails. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: fcea6f3da546 ("ice: Add stats and ethtool support") Fixes: efc2214b6047 ("ice: Add support for XDP") Signed-off-by: Zilin Guan <zilin(a)seu.edu.cn> Reviewed-by: Paul Menzel <pmenzel(a)molgen.mpg.de> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Conflicts: drivers/net/ethernet/intel/ice/ice_ethtool.c [ Context conflicts due to different memory allocation function used. Also, ice_for_each_xdp_txq is introduced in unmmerged commit 2faf63b650bb ("ice: make use of ice_for_each_* macros"), use normal for loops here instead. ] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_ethtool.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c index 9659668279dc..0d6965b5deb4 100644 --- a/drivers/net/ethernet/intel/ice/ice_ethtool.c +++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c @@ -2865,7 +2865,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, rx_rings = kcalloc(vsi->num_rxq, sizeof(*rx_rings), GFP_KERNEL); if (!rx_rings) { err = -ENOMEM; - goto done; + goto free_xdp; } ice_for_each_rxq(vsi, i) { @@ -2894,7 +2894,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, } kfree(rx_rings); err = -ENOMEM; - goto free_tx; + goto free_xdp; } } @@ -2945,6 +2945,14 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, } goto done; +free_xdp: + if (xdp_rings) { + for (i = 0; i < vsi->num_xdp_txq; i++) { + ice_free_tx_ring(vsi->xdp_rings[i]); + } + kfree(xdp_rings); + } + free_tx: /* error cleanup if the Rx allocations failed after getting Tx */ if (tx_rings) { -- 2.34.1

2 1

[PATCH OLK-6.6] net: usb: kalmia: validate USB endpoints
by Qi Xi 02 Apr '26

02 Apr '26

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> mainline inclusion from mainline-v7.0-rc2 commit c58b6c29a4c9b8125e8ad3bca0637e00b71e2693 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13916 CVE: CVE-2026-23365 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kalmia driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints. Cc: stable <stable(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Fixes: d40261236e8e ("net/usb: Add Samsung Kalmia driver for Samsung GT-B3730") Link: https://patch.msgid.link/2026022326-shack-headstone-ef6f@gregkh Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/net/usb/kalmia.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/usb/kalmia.c b/drivers/net/usb/kalmia.c index 613fc6910f14..ee9c48f7f68f 100644 --- a/drivers/net/usb/kalmia.c +++ b/drivers/net/usb/kalmia.c @@ -132,11 +132,18 @@ kalmia_bind(struct usbnet *dev, struct usb_interface *intf) { int status; u8 ethernet_addr[ETH_ALEN]; + static const u8 ep_addr[] = { + 1 | USB_DIR_IN, + 2 | USB_DIR_OUT, + 0}; /* Don't bind to AT command interface */ if (intf->cur_altsetting->desc.bInterfaceClass != USB_CLASS_VENDOR_SPEC) return -EINVAL; + if (!usb_check_bulk_endpoints(intf, ep_addr)) + return -ENODEV; + dev->in = usb_rcvbulkpipe(dev->udev, 0x81 & USB_ENDPOINT_NUMBER_MASK); dev->out = usb_sndbulkpipe(dev->udev, 0x02 & USB_ENDPOINT_NUMBER_MASK); dev->status = NULL; -- 2.33.0

2 1

[PATCH OLK-5.10 0/2] CVE-2025-39955
by Zhang Changzhong 02 Apr '26

02 Apr '26

Kuniyuki Iwashima (2): tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). net/ipv4/tcp.c | 5 +++++ net/ipv4/tcp_input.c | 1 - 2 files changed, 5 insertions(+), 1 deletion(-) -- 2.9.5

2 3

[PATCH OLK-5.10 v2] net: usb: pegasus: validate USB endpoints
by Ze Zuo 02 Apr '26

02 Apr '26

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> mainline inclusion from mainline-v7.0-rc2 commit 11de1d3ae5565ed22ef1f89d73d8f2d00322c699 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13993 CVE: CVE-2026-23290 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The pegasus driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints. Cc: Petko Manolov <petkan(a)nucleusys.com> Cc: stable <stable(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Link: https://patch.msgid.link/2026022347-legibly-attest-cc5c@gregkh Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/usb/pegasus.c [conflicts due not to merge commit 23a64c514631("net: usb: pegasus: use new tasklet API").] Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- change since v1: -- add some commit. drivers/net/usb/pegasus.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c index 138279bbb544..99a8702c1df7 100644 --- a/drivers/net/usb/pegasus.c +++ b/drivers/net/usb/pegasus.c @@ -828,8 +828,19 @@ static void unlink_all_urbs(pegasus_t *pegasus) static int alloc_urbs(pegasus_t *pegasus) { + static const u8 bulk_ep_addr[] = { + 1 | USB_DIR_IN, + 2 | USB_DIR_OUT, + 0}; + static const u8 int_ep_addr[] = { + 3 | USB_DIR_IN, + 0}; int res = -ENOMEM; + if (!usb_check_bulk_endpoints(pegasus->intf, bulk_ep_addr) || + !usb_check_int_endpoints(pegasus->intf, int_ep_addr)) + return -ENODEV; + pegasus->rx_urb = usb_alloc_urb(0, GFP_KERNEL); if (!pegasus->rx_urb) { return res; @@ -1170,6 +1181,7 @@ static int pegasus_probe(struct usb_interface *intf, pegasus = netdev_priv(net); pegasus->dev_index = dev_index; + pegasus->intf = intf; res = alloc_urbs(pegasus); if (res < 0) { @@ -1181,7 +1193,6 @@ static int pegasus_probe(struct usb_interface *intf, INIT_DELAYED_WORK(&pegasus->carrier_check, check_carrier); - pegasus->intf = intf; pegasus->usb = dev; pegasus->net = net; -- 2.25.1

2 1

[PATCH OLK-6.6] regmap: maple: free entry on mas_store_gfp() failure
by Lin Ruifeng 02 Apr '26

02 Apr '26

From: Kaushlendra Kumar <kaushlendra.kumar(a)intel.com> stable inclusion from stable-v6.6.124 commit d61171cf097156030142643942c217759a9cc806 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8792 CVE: CVE-2026-23260 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f3f380ce6b3d5c9805c7e0b3d5bc28d9ec41e2e8 ] regcache_maple_write() allocates a new block ('entry') to merge adjacent ranges and then stores it with mas_store_gfp(). When mas_store_gfp() fails, the new 'entry' remains allocated and is never freed, leaking memory. Free 'entry' on the failure path; on success continue freeing the replaced neighbor blocks ('lower', 'upper'). Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar(a)intel.com> Link: https://patch.msgid.link/20260105031820.260119-1-kaushlendra.kumar@intel.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> --- drivers/base/regmap/regcache-maple.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/base/regmap/regcache-maple.c b/drivers/base/regmap/regcache-maple.c index fb5761a5ef6e..86de71ce2c19 100644 --- a/drivers/base/regmap/regcache-maple.c +++ b/drivers/base/regmap/regcache-maple.c @@ -96,12 +96,13 @@ static int regcache_maple_write(struct regmap *map, unsigned int reg, mas_unlock(&mas); - if (ret == 0) { - kfree(lower); - kfree(upper); + if (ret) { + kfree(entry); + return ret; } - - return ret; + kfree(lower); + kfree(upper); + return 0; } static int regcache_maple_drop(struct regmap *map, unsigned int min, -- 2.43.0

2 1

[PATCH OLK-5.10] ALSA: usb-audio: Use correct version for UAC3 header validation
by Lin Ruifeng 02 Apr '26

02 Apr '26

From: Jun Seo <jun.seo.93(a)proton.me> stable inclusion from stable-v6.1.167 commit 0dcd1ed96c03459cf14706885c9dd3c1fd8bd29f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13963 CVE: CVE-2026-23318 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 54f9d645a5453d0bfece0c465d34aaf072ea99fa upstream. The entry of the validators table for UAC3 AC header descriptor is defined with the wrong protocol version UAC_VERSION_2, while it should have been UAC_VERSION_3. This results in the validator never matching for actual UAC3 devices (protocol == UAC_VERSION_3), causing their header descriptors to bypass validation entirely. A malicious USB device presenting a truncated UAC3 header could exploit this to cause out-of-bounds reads when the driver later accesses unvalidated descriptor fields. The bug was introduced in the same commit as the recently fixed UAC3 feature unit sub-type typo, and appears to be from the same copy-paste error when the UAC3 section was created from the UAC2 section. Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units") Cc: <stable(a)vger.kernel.org> Signed-off-by: Jun Seo <jun.seo.93(a)proton.me> Link: https://patch.msgid.link/20260226010820.36529-1-jun.seo.93@proton.me Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/usb/validate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/usb/validate.c b/sound/usb/validate.c index 4f4e8e87a14c..61eb3f39e092 100644 --- a/sound/usb/validate.c +++ b/sound/usb/validate.c @@ -277,7 +277,7 @@ static const struct usb_desc_validator audio_validators[] = { /* UAC_VERSION_2, UAC2_SAMPLE_RATE_CONVERTER: not implemented yet */ /* UAC3 */ - FIXED(UAC_VERSION_2, UAC_HEADER, struct uac3_ac_header_descriptor), + FIXED(UAC_VERSION_3, UAC_HEADER, struct uac3_ac_header_descriptor), FIXED(UAC_VERSION_3, UAC_INPUT_TERMINAL, struct uac3_input_terminal_descriptor), FIXED(UAC_VERSION_3, UAC_OUTPUT_TERMINAL, -- 2.43.0

2 1

[PATCH OLK-5.10] bus: fsl-mc: fix use-after-free in driver_override_show()
by Lin Ruifeng 02 Apr '26

02 Apr '26

From: Gui-Dong Han <hanguidong02(a)gmail.com> stable inclusion from stable-v6.18.11 commit 1d6bd6183e723a7b256ff34bbb5b498b5f4f2ec0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13796 CVE: CVE-2026-23221 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 148891e95014b5dc5878acefa57f1940c281c431 upstream. The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and frees the string while holding the device_lock. This can result in a concurrent use-after-free if the string is freed by the store function while being read by the show function. Fix this by holding the device_lock around the read operation. Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus") Cc: stable(a)vger.kernel.org Signed-off-by: Gui-Dong Han <hanguidong02(a)gmail.com> Reviewed-by: Ioana Ciornei <ioana.ciornei(a)nxp.com> Link: https://lore.kernel.org/r/20251202174438.12658-1-hanguidong02@gmail.com Signed-off-by: Christophe Leroy (CS GROUP) <chleroy(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/bus/fsl-mc/fsl-mc-bus.c [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/bus/fsl-mc/fsl-mc-bus.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index 0481b8a321b6..59389ad93595 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -178,12 +178,14 @@ static ssize_t driver_override_store(struct device *dev, if (cp) *cp = '\0'; + device_lock(dev); if (strlen(driver_override)) { mc_dev->driver_override = driver_override; } else { kfree(driver_override); mc_dev->driver_override = NULL; } + device_unlock(dev); kfree(old); @@ -194,8 +196,12 @@ static ssize_t driver_override_show(struct device *dev, struct device_attribute *attr, char *buf) { struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); + ssize_t len; - return snprintf(buf, PAGE_SIZE, "%s\n", mc_dev->driver_override); + device_lock(dev); + len = snprintf(buf, PAGE_SIZE, "%s\n", mc_dev->driver_override); + device_unlock(dev); + return len; } static DEVICE_ATTR_RW(driver_override); -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] *** fix CVE-2026-23208 ***
by Lin Ruifeng 02 Apr '26

02 Apr '26

*** fix CVE-2026-23208 *** Edward Adam Davis (1): ALSA: usb-audio: Prevent excessive number of frames Takashi Iwai (1): ALSA: usb-audio: Use the right limit for PCM OOB check sound/usb/pcm.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.43.0

2 3

[PATCH v2 OLK-6.6 0/5] Reuse SUBSYS for xcu and freezer to preserve KABI
by Liu Kai 02 Apr '26

02 Apr '26

Reuse SUBSYS for xcu and freezer to preserve KABI Liu Kai (5): xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI xSched/cgroup: make xcu.stat invisible at root cgroup cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig xSched: update xSched manual for xcu cmdline enable option Documentation/scheduler/xsched.md | 6 +- arch/arm64/configs/openeuler_defconfig | 3 +- arch/x86/configs/openeuler_defconfig | 3 +- include/linux/cgroup_subsys.h | 8 +- include/linux/freezer.h | 24 ++++ kernel/cgroup/cgroup.c | 2 +- kernel/cgroup/legacy_freezer.c | 25 ++-- kernel/xsched/cgroup.c | 166 +++++++++++++++++++++++-- 8 files changed, 209 insertions(+), 28 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6] mm: thp: deny THP for files on anonymous inodes
by Ze Zuo 02 Apr '26

02 Apr '26

From: Deepanshu Kartikey <kartikey406(a)gmail.com> stable inclusion from stable-v6.12.78 commit 08de46a75f91a6661bc1ce0a93614f4bc313c581 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14006 CVE: CVE-2026-23375 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dd085fe9a8ebfc5d10314c60452db38d2b75e609 upstream. file_thp_enabled() incorrectly allows THP for files on anonymous inodes (e.g. guest_memfd and secretmem). These files are created via alloc_file_pseudo(), which does not call get_write_access() and leaves inode->i_writecount at 0. Combined with S_ISREG(inode->i_mode) being true, they appear as read-only regular files when CONFIG_READ_ONLY_THP_FOR_FS is enabled, making them eligible for THP collapse. Anonymous inodes can never pass the inode_is_open_for_write() check since their i_writecount is never incremented through the normal VFS open path. The right thing to do is to exclude them from THP eligibility altogether, since CONFIG_READ_ONLY_THP_FOR_FS was designed for real filesystem files (e.g. shared libraries), not for pseudo-filesystem inodes. For guest_memfd, this allows khugepaged and MADV_COLLAPSE to create large folios in the page cache via the collapse path, but the guest_memfd fault handler does not support large folios. This triggers WARN_ON_ONCE(folio_test_large(folio)) in kvm_gmem_fault_user_mapping(). For secretmem, collapse_file() tries to copy page contents through the direct map, but secretmem pages are removed from the direct map. This can result in a kernel crash: BUG: unable to handle page fault for address: ffff88810284d000 RIP: 0010:memcpy_orig+0x16/0x130 Call Trace: collapse_file hpage_collapse_scan_file madvise_collapse Secretmem is not affected by the crash on upstream as the memory failure recovery handles the failed copy gracefully, but it still triggers confusing false memory failure reports: Memory failure: 0x106d96f: recovery action for clean unevictable LRU page: Recovered Check IS_ANON_FILE(inode) in file_thp_enabled() to deny THP for all anonymous inode files. Link: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44 Link: https://lore.kernel.org/linux-mm/CAEvNRgHegcz3ro35ixkDw39ES8=U6rs6S7iP0gkR9… Link: https://lkml.kernel.org/r/20260214001535.435626-1-kartikey406@gmail.com Fixes: 7fbb5e188248 ("mm: remove VM_EXEC requirement for THP eligibility") Signed-off-by: Deepanshu Kartikey <Kartikey406(a)gmail.com> Reported-by: syzbot+33a04338019ac7e43a44(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44 Tested-by: syzbot+33a04338019ac7e43a44(a)syzkaller.appspotmail.com Tested-by: Lance Yang <lance.yang(a)linux.dev> Acked-by: David Hildenbrand (Arm) <david(a)kernel.org> Reviewed-by: Barry Song <baohua(a)kernel.org> Reviewed-by: Ackerley Tng <ackerleytng(a)google.com> Tested-by: Ackerley Tng <ackerleytng(a)google.com> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: Dev Jain <dev.jain(a)arm.com> Cc: Fangrui Song <i(a)maskray.me> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Nico Pache <npache(a)redhat.com> Cc: Ryan Roberts <ryan.roberts(a)arm.com> Cc: Yang Shi <shy828301(a)gmail.com> Cc: Zi Yan <ziy(a)nvidia.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> [ Ackerley: we don't have IS_ANON_FILE() yet. As guest_memfd does not apply yet, simply check for secretmem explicitly. ] Signed-off-by: Ackerley Tng <ackerleytng(a)google.com> Reviewed-by: David Hildenbrand (Arm) <david(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- include/linux/huge_mm.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index 328b1fbb134c..86565da790e0 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -7,6 +7,7 @@ #include <linux/fs.h> /* only for vma_is_dax() */ #include <linux/kobject.h> +#include <linux/secretmem.h> vm_fault_t do_huge_pmd_anonymous_page(struct vm_fault *vmf); int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm, @@ -270,6 +271,9 @@ static inline bool file_thp_enabled(struct vm_area_struct *vma) inode = vma->vm_file->f_inode; + if (secretmem_mapping(inode->i_mapping)) + return false; + return (IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS)) && !inode_is_open_for_write(inode) && S_ISREG(inode->i_mode); } -- 2.25.1

2 1

[PATCH OLK-6.6] net: usb: pegasus: validate USB endpoints
by Ze Zuo 02 Apr '26

02 Apr '26

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> stable inclusion from stable-v6.6.130 commit 7f8505c7ce3f186ef9d2495f3c0bd6ad6fce999f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13993 CVE: CVE-2026-23290 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 11de1d3ae5565ed22ef1f89d73d8f2d00322c699 upstream. The pegasus driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints. Cc: Petko Manolov <petkan(a)nucleusys.com> Cc: stable <stable(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Link: https://patch.msgid.link/2026022347-legibly-attest-cc5c@gregkh Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/net/usb/pegasus.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c index c514483134f0..7cc949460edc 100644 --- a/drivers/net/usb/pegasus.c +++ b/drivers/net/usb/pegasus.c @@ -804,8 +804,19 @@ static void unlink_all_urbs(pegasus_t *pegasus) static int alloc_urbs(pegasus_t *pegasus) { + static const u8 bulk_ep_addr[] = { + 1 | USB_DIR_IN, + 2 | USB_DIR_OUT, + 0}; + static const u8 int_ep_addr[] = { + 3 | USB_DIR_IN, + 0}; int res = -ENOMEM; + if (!usb_check_bulk_endpoints(pegasus->intf, bulk_ep_addr) || + !usb_check_int_endpoints(pegasus->intf, int_ep_addr)) + return -ENODEV; + pegasus->rx_urb = usb_alloc_urb(0, GFP_KERNEL); if (!pegasus->rx_urb) { return res; @@ -1146,6 +1157,7 @@ static int pegasus_probe(struct usb_interface *intf, pegasus = netdev_priv(net); pegasus->dev_index = dev_index; + pegasus->intf = intf; res = alloc_urbs(pegasus); if (res < 0) { @@ -1157,7 +1169,6 @@ static int pegasus_probe(struct usb_interface *intf, INIT_DELAYED_WORK(&pegasus->carrier_check, check_carrier); - pegasus->intf = intf; pegasus->usb = dev; pegasus->net = net; -- 2.25.1

2 1

[PATCH OLK-5.10] net: usb: pegasus: validate USB endpoints
by Ze Zuo 02 Apr '26

02 Apr '26

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> mainline inclusion from mainline-v7.0-rc2 commit 11de1d3ae5565ed22ef1f89d73d8f2d00322c699 category: bugfix bugzilla: CVE-2026-23290 CVE: CVE-2026-23290 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The pegasus driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints. Cc: Petko Manolov <petkan(a)nucleusys.com> Cc: stable <stable(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Link: https://patch.msgid.link/2026022347-legibly-attest-cc5c@gregkh Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/net/usb/pegasus.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c index 138279bbb544..99a8702c1df7 100644 --- a/drivers/net/usb/pegasus.c +++ b/drivers/net/usb/pegasus.c @@ -828,8 +828,19 @@ static void unlink_all_urbs(pegasus_t *pegasus) static int alloc_urbs(pegasus_t *pegasus) { + static const u8 bulk_ep_addr[] = { + 1 | USB_DIR_IN, + 2 | USB_DIR_OUT, + 0}; + static const u8 int_ep_addr[] = { + 3 | USB_DIR_IN, + 0}; int res = -ENOMEM; + if (!usb_check_bulk_endpoints(pegasus->intf, bulk_ep_addr) || + !usb_check_int_endpoints(pegasus->intf, int_ep_addr)) + return -ENODEV; + pegasus->rx_urb = usb_alloc_urb(0, GFP_KERNEL); if (!pegasus->rx_urb) { return res; @@ -1170,6 +1181,7 @@ static int pegasus_probe(struct usb_interface *intf, pegasus = netdev_priv(net); pegasus->dev_index = dev_index; + pegasus->intf = intf; res = alloc_urbs(pegasus); if (res < 0) { @@ -1181,7 +1193,6 @@ static int pegasus_probe(struct usb_interface *intf, INIT_DELAYED_WORK(&pegasus->carrier_check, check_carrier); - pegasus->intf = intf; pegasus->usb = dev; pegasus->net = net; -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_sample()
by Lifeng Zheng 02 Apr '26

02 Apr '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8860 ---------------------------------------------------------------------- Lifeng Zheng (1): cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_sample() drivers/cpufreq/cppc_cpufreq.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.33.0

2 2

[PATCH OLK-6.6 0/1] cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair()
by Lifeng Zheng 01 Apr '26

01 Apr '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8860 ---------------------------------------------------------------------- Lifeng Zheng (1): cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() drivers/cpufreq/cppc_cpufreq.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.33.0

2 2

[PATCH OLK-6.6] xSched/cgroup: utilize xcu cmdline to dynamically switch between xcu and freezer subsys
by Liu Kai 01 Apr '26

01 Apr '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8424 ---------------------------------------- To support both cgroup v1 and v2 while adhering to the CGROUP_SUBSYS_COUNT limit (16), this patch introduces a mechanism to share the same SUBSYS(xcu) slot between the 'xcu' and 'freezer' subsystems. Since 'xcu' is a cgroup v2-only controller and 'freezer' is a cgroup v1-only controller, they are mutually exclusive at runtime. We introduce a new kernel command line parameter, "xcu", to control this behavior dynamically. This approach allows us to enable both CONFIG_CGROUP_XCU and CONFIG_CGROUP_FREEZER simultaneously without exceeding the subsystem limit. The behavior based on the "xcu" cmdline parameter is as follows: 1. xcu=disable, cgroup v1: - The legacy 'frezzer' subsystem is active and functional. - The 'xcu' subsystem remains dormant. 2. xcu=enable, cgroup v1: - The 'freezer' subsystem is effectively disabled/blocked. - (Note: 'xcu' is not usable in v1 mode as it is v2-only). 3. xcu=disable, cgroup v2: - The 'xcu' subsystem is not enabled in the hierarchy. 4. xcu=enable, cgroup v2: - The 'xcu' subsystem is active and usable. - The 'freezer' logic is bypassed. This ensures backward compatibility for v1 users while enabling the new functionality for v2, all within the constraints of the kernel subsystem limit. Fixes: 43bbefc53356 ("xsched: Add XCU control group implementation and its backend in xsched CFS") Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- Documentation/scheduler/xsched.md | 6 +- arch/arm64/configs/openeuler_defconfig | 3 +- arch/x86/configs/openeuler_defconfig | 3 +- include/linux/cgroup_subsys.h | 8 +- include/linux/freezer.h | 24 ++++ kernel/cgroup/cgroup.c | 2 +- kernel/cgroup/legacy_freezer.c | 25 ++-- kernel/xsched/cgroup.c | 166 +++++++++++++++++++++++-- 8 files changed, 209 insertions(+), 28 deletions(-) diff --git a/Documentation/scheduler/xsched.md b/Documentation/scheduler/xsched.md index 11dc0c964e0a..c5e643ab35f0 100644 --- a/Documentation/scheduler/xsched.md +++ b/Documentation/scheduler/xsched.md @@ -64,11 +64,11 @@ CONFIG_CGROUP_XCU=y # 修改内核引导文件，根据实际情况编辑 vim /etc/grub2-efi.cfg -# 在XSched内核新增 cmdline 配置，关闭驱动签名校验、开启cgroup-v2 -module.sig_enforce=0 systemd.unified_cgroup_hierarchy=1 cgroup_no_v1=all +# 在XSched内核新增 cmdline 配置，关闭驱动签名校验、开启cgroup-v2，使能 xcu cgroup 子系统 +module.sig_enforce=0 systemd.unified_cgroup_hierarchy=1 cgroup_no_v1=all xcu=enable ``` -保存引导文件后，重启切换内核 +保存引导文件后，重启切换内核，**注意！！！，xcu 子系统仅支持 cgroup-v2** ### 1.3 重编驱动 diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index fc581adb563b..622d44e6d9ff 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -101,7 +101,8 @@ CONFIG_XCU_SCHEDULER=y CONFIG_XCU_VSTREAM=y CONFIG_XSCHED_NR_CUS=128 CONFIG_XCU_SCHED_RT=y -# CONFIG_XCU_SCHED_CFS is not set +CONFIG_XCU_SCHED_CFS=y +CONFIG_CGROUP_XCU=y # # CPU/Task time and stats accounting diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index d493dbf6b8a1..e66724b15bb4 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -121,7 +121,8 @@ CONFIG_XCU_SCHEDULER=y CONFIG_XCU_VSTREAM=y CONFIG_XSCHED_NR_CUS=128 CONFIG_XCU_SCHED_RT=y -# CONFIG_XCU_SCHED_CFS is not set +CONFIG_XCU_SCHED_CFS=y +CONFIG_CGROUP_XCU=y # # CPU/Task time and stats accounting diff --git a/include/linux/cgroup_subsys.h b/include/linux/cgroup_subsys.h index e65ae90946c2..9ee14c9cab33 100644 --- a/include/linux/cgroup_subsys.h +++ b/include/linux/cgroup_subsys.h @@ -33,7 +33,9 @@ SUBSYS(memory) SUBSYS(devices) #endif -#if IS_ENABLED(CONFIG_CGROUP_FREEZER) +#if IS_ENABLED(CONFIG_CGROUP_XCU) +SUBSYS(xcu) +#elif IS_ENABLED(CONFIG_CGROUP_FREEZER) SUBSYS(freezer) #endif @@ -61,10 +63,6 @@ SUBSYS(pids) SUBSYS(rdma) #endif -#if IS_ENABLED(CONFIG_CGROUP_XCU) -SUBSYS(xcu) -#endif - #if IS_ENABLED(CONFIG_CGROUP_MISC) SUBSYS(misc) #endif diff --git a/include/linux/freezer.h b/include/linux/freezer.h index b303472255be..0c7a6da03d43 100644 --- a/include/linux/freezer.h +++ b/include/linux/freezer.h @@ -10,6 +10,10 @@ #include <linux/atomic.h> #include <linux/jump_label.h> +#ifdef CONFIG_CGROUP_XCU +#include <linux/cgroup-defs.h> +#endif + #ifdef CONFIG_FREEZER DECLARE_STATIC_KEY_FALSE(freezer_active); @@ -87,4 +91,24 @@ static inline void set_freezable(void) {} #endif /* !CONFIG_FREEZER */ +/* + * When CONFIG_CGROUP_XCU is enabled, freezer_cgrp_subsys and xcu_cgrp_subsys + * share the same set of cgroup_subsys hook functions. Consequently, the hooks for + * freezer_cgrp_subsys must be exposed externally to allow linkage with the XCU + * cgroup_subsys. + * + */ +#ifdef CONFIG_CGROUP_XCU +#define freezer_cgrp_id xcu_cgrp_id + +extern struct cftype files[]; +struct cgroup_subsys_state * +freezer_css_alloc(struct cgroup_subsys_state *parent_css); +int freezer_css_online(struct cgroup_subsys_state *css); +void freezer_css_offline(struct cgroup_subsys_state *css); +void freezer_css_free(struct cgroup_subsys_state *css); +void freezer_attach(struct cgroup_taskset *tset); +void freezer_fork(struct task_struct *task); +#endif /* CONFIG_CGROUP_XCU */ + #endif /* FREEZER_H_INCLUDED */ diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 17521bc192ee..04301432e84a 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -6256,7 +6256,7 @@ int __init cgroup_init(void) struct cgroup_subsys *ss; int ssid; - BUILD_BUG_ON(CGROUP_SUBSYS_COUNT > 17); + BUILD_BUG_ON(CGROUP_SUBSYS_COUNT > 16); BUG_ON(cgroup_init_cftypes(NULL, cgroup_base_files)); BUG_ON(cgroup_init_cftypes(NULL, cgroup_psi_files)); BUG_ON(cgroup_init_cftypes(NULL, cgroup1_base_files)); diff --git a/kernel/cgroup/legacy_freezer.c b/kernel/cgroup/legacy_freezer.c index bee2f9ea5e4a..9ef242b73947 100644 --- a/kernel/cgroup/legacy_freezer.c +++ b/kernel/cgroup/legacy_freezer.c @@ -24,6 +24,17 @@ #include <linux/mutex.h> #include <linux/cpu.h> +/* + * The STATIC macro is used to handle this conditional visibility: + * - Enabled: interfaces are defined as non-static (exported). + * - Disabled: interfaces remain static (file-local). + */ +#ifdef CONFIG_CGROUP_XCU +#define STATIC +#else +#define STATIC static +#endif + /* * A cgroup is freezing if any FREEZING flags are set. FREEZING_SELF is * set if "FROZEN" is written to freezer.state cgroupfs file, and cleared @@ -83,7 +94,7 @@ static const char *freezer_state_strs(unsigned int state) return "THAWED"; }; -static struct cgroup_subsys_state * +STATIC struct cgroup_subsys_state * freezer_css_alloc(struct cgroup_subsys_state *parent_css) { struct freezer *freezer; @@ -103,7 +114,7 @@ freezer_css_alloc(struct cgroup_subsys_state *parent_css) * parent's freezing state while holding both parent's and our * freezer->lock. */ -static int freezer_css_online(struct cgroup_subsys_state *css) +STATIC int freezer_css_online(struct cgroup_subsys_state *css) { struct freezer *freezer = css_freezer(css); struct freezer *parent = parent_freezer(freezer); @@ -130,7 +141,7 @@ static int freezer_css_online(struct cgroup_subsys_state *css) * @css is going away. Mark it dead and decrement system_freezing_count if * it was holding one. */ -static void freezer_css_offline(struct cgroup_subsys_state *css) +STATIC void freezer_css_offline(struct cgroup_subsys_state *css) { struct freezer *freezer = css_freezer(css); @@ -146,7 +157,7 @@ static void freezer_css_offline(struct cgroup_subsys_state *css) cpus_read_unlock(); } -static void freezer_css_free(struct cgroup_subsys_state *css) +STATIC void freezer_css_free(struct cgroup_subsys_state *css) { kfree(css_freezer(css)); } @@ -160,7 +171,7 @@ static void freezer_css_free(struct cgroup_subsys_state *css) * @freezer->lock. freezer_attach() makes the new tasks conform to the * current state and all following state changes can see the new tasks. */ -static void freezer_attach(struct cgroup_taskset *tset) +STATIC void freezer_attach(struct cgroup_taskset *tset) { struct task_struct *task; struct cgroup_subsys_state *new_css; @@ -205,7 +216,7 @@ static void freezer_attach(struct cgroup_taskset *tset) * to do anything as freezer_attach() will put @task into the appropriate * state. */ -static void freezer_fork(struct task_struct *task) +STATIC void freezer_fork(struct task_struct *task) { struct freezer *freezer; @@ -449,7 +460,7 @@ static u64 freezer_parent_freezing_read(struct cgroup_subsys_state *css, return (bool)(freezer->state & CGROUP_FREEZING_PARENT); } -static struct cftype files[] = { +STATIC struct cftype files[] = { { .name = "state", .flags = CFTYPE_NOT_ON_ROOT, diff --git a/kernel/xsched/cgroup.c b/kernel/xsched/cgroup.c index 73f044475939..8a85faaa8dc4 100644 --- a/kernel/xsched/cgroup.c +++ b/kernel/xsched/cgroup.c @@ -21,6 +21,10 @@ #include <linux/xsched.h> #include <linux/delay.h> +#ifdef CONFIG_CGROUP_FREEZER +#include <linux/freezer.h> +#endif + static struct xsched_group root_xsched_group; struct xsched_group *root_xcg = &root_xsched_group; @@ -39,6 +43,61 @@ static const char xcu_sched_name[XSCHED_TYPE_NUM][SCHED_CLASS_MAX_LENGTH] = { [XSCHED_TYPE_CFS] = "cfs" }; +/* + * xcu_mode: + * 0 = disable (freezer cgroup) + * 1 = enable (xcu cgroup) + */ +static int xcu_mode; + +/** + * Parse the "xcu=" kernel command line parameter. + * + * Usage: + * xcu=enable → enable xcu_cgrp_subsys + * Otherwise → enable freezer_cgrp_subsys + * + * Returns: + * 1 (handled), 0 (not handled) + */ +static int __init xcu_setup(char *str) +{ + if (!str) + return 0; + + if (strcmp(str, "enable") == 0) + xcu_mode = 1; + + return 1; +} +__setup("xcu=", xcu_setup); + +static bool xcu_cgroup_enabled(void) +{ + return xcu_mode; +} + +/** + * xcu_cgroup_check_compat - Verify XCU mode matches the cgroup hierarchy version. + * + * Checks if the current xcu_mode aligns with the cgroup subsystem's default + * hierarchy status. + * + * IMPORTANT: cgroup_subsys_on_dfl() only returns a valid version indicator + * after the cgroup filesystem has been mounted at the root node. Calling + * this function prior to mount may yield incorrect results. + * + * Return: true if compatible, false otherwise (with a warning logged). + */ +static bool xcu_cgroup_check_compat(void) +{ + if (xcu_mode != cgroup_subsys_on_dfl(xcu_cgrp_subsys)) { + XSCHED_WARN("XCU cgrp is incompatible with the cgroup version\n"); + return false; + } + return true; +} + static int xcu_cg_set_file_show(struct xsched_group *xg, int sched_class) { if (!xg) { @@ -742,6 +801,7 @@ static struct cftype xcu_cg_files[] = { }, { .name = "stat", + .flags = CFTYPE_NOT_ON_ROOT, .seq_show = xcu_stat, }, { @@ -753,17 +813,103 @@ static struct cftype xcu_cg_files[] = { {} /* terminate */ }; +static struct cgroup_subsys_state * +xcu_freezer_compat_css_alloc(struct cgroup_subsys_state *parent_css) +{ + /* Skip allocation if XCU cmdline mismatches the cgroup version. */ + if (parent_css && !xcu_cgroup_check_compat()) + return ERR_PTR(-EPERM); + + if (xcu_cgroup_enabled()) + return xcu_css_alloc(parent_css); + +#ifdef CONFIG_CGROUP_FREEZER + return freezer_css_alloc(parent_css); +#else /* CONFIG_CGROUP_FREEZER=n xcu=disable cgroup=v1 */ + if (!parent_css) + return &root_xsched_group.css; + else + return ERR_PTR(-EPERM); +#endif +} + +static int xcu_freezer_compat_css_online(struct cgroup_subsys_state *css) +{ + if (xcu_cgroup_enabled()) + return xcu_css_online(css); + +#ifdef CONFIG_CGROUP_FREEZER + return freezer_css_online(css); +#else + return 0; +#endif +} + +static void xcu_freezer_compat_css_offline(struct cgroup_subsys_state *css) +{ + if (xcu_cgroup_enabled()) + return xcu_css_offline(css); + +#ifdef CONFIG_CGROUP_FREEZER + return freezer_css_offline(css); +#endif +} + +static void xcu_freezer_compat_css_released(struct cgroup_subsys_state *css) +{ + if (xcu_cgroup_enabled()) + return xcu_css_released(css); +} + +static void xcu_freezer_compat_css_free(struct cgroup_subsys_state *css) +{ + if (xcu_cgroup_enabled()) + return xcu_css_free(css); + +#ifdef CONFIG_CGROUP_FREEZER + return freezer_css_free(css); +#endif +} + +static int xcu_freezer_compat_can_attach(struct cgroup_taskset *tset) +{ + if (xcu_cgroup_enabled()) + return xcu_can_attach(tset); + + return 0; +} + +static void xcu_freezer_compat_cancel_attach(struct cgroup_taskset *tset) +{ + if (xcu_cgroup_enabled()) + return xcu_cancel_attach(tset); +} + +static void xcu_freezer_compat_attach(struct cgroup_taskset *tset) +{ + if (xcu_cgroup_enabled()) + return xcu_attach(tset); + +#ifdef CONFIG_CGROUP_FREEZER + return freezer_attach(tset); +#endif +} + struct cgroup_subsys xcu_cgrp_subsys = { - .css_alloc = xcu_css_alloc, - .css_online = xcu_css_online, - .css_offline = xcu_css_offline, - .css_released = xcu_css_released, - .css_free = xcu_css_free, - .can_attach = xcu_can_attach, - .cancel_attach = xcu_cancel_attach, - .attach = xcu_attach, + .css_alloc = xcu_freezer_compat_css_alloc, + .css_online = xcu_freezer_compat_css_online, + .css_offline = xcu_freezer_compat_css_offline, + .css_released = xcu_freezer_compat_css_released, + .css_free = xcu_freezer_compat_css_free, + .can_attach = xcu_freezer_compat_can_attach, + .cancel_attach = xcu_freezer_compat_cancel_attach, + .attach = xcu_freezer_compat_attach, .dfl_cftypes = xcu_cg_files, +#ifdef CONFIG_CGROUP_FREEZER + .fork = freezer_fork, + .legacy_cftypes = files, + .legacy_name = "freezer", +#else .legacy_cftypes = xcu_cg_files, - .early_init = false, - .threaded = true +#endif }; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
by Jinjiang Tu 01 Apr '26

01 Apr '26

mainline inclusion from mainline-v7.0-rc6 commit 4c5e7f0fcd592801c9cc18f29f80fbee84eb8669 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8836 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP splitting and zap_nonpresent_ptes() races, and the root cause is lack of memory barrier in softleaf_to_folio(). The race is as follows: CPU0 CPU1 deferred_split_scan() zap_nonpresent_ptes() lock folio split_folio() unmap_folio() change ptes to migration entries __split_folio_to_order() softleaf_to_folio() set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry)) smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio)) prep_compound_page() for tail pages In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages are visible before the tail page becomes non-compound. smp_wmb() should be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a result, if zap_nonpresent_ptes() accesses migration entry that stores tail pfn, softleaf_to_folio() may see the updated compound_head of tail page before page->flags. This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio() because of the race between folio split and zap_nonpresent_ptes() leading to a folio incorrectly undergoing modification without a folio lock being held. This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further swapops predicates"), which in merged in v6.19-rc1. To fix it, add missing smp_rmb() if the softleaf entry is migration entry in softleaf_to_folio() and softleaf_to_page(). [tujinjiang(a)huawei.com: update function name and comments] Link: https://lkml.kernel.org/r/20260321075214.3305564-1-tujinjiang@huawei.com Link: https://lkml.kernel.org/r/20260319012541.4158561-1-tujinjiang@huawei.com Fixes: e9b61f19858a ("thp: reintroduce split_huge_page()") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> Acked-by: David Hildenbrand (Arm) <david(a)kernel.org> Reviewed-by: Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> Cc: Barry Song <baohua(a)kernel.org> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: Ryan Roberts <ryan.roberts(a)arm.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Vlastimil Babka <vbabka(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: include/linux/leafops.h include/linux/swapops.h [miragtion entry hasn't been renamed to softleaf entry.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/linux/swapops.h | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/include/linux/swapops.h b/include/linux/swapops.h index 22af9d8a84ae..c742e778e024 100644 --- a/include/linux/swapops.h +++ b/include/linux/swapops.h @@ -205,14 +205,28 @@ static inline unsigned long migration_entry_to_pfn(swp_entry_t entry) return swp_offset(entry); } -static inline struct page *migration_entry_to_page(swp_entry_t entry) +static inline void migration_entry_sync_page(struct page *head) { - struct page *p = pfn_to_page(swp_offset(entry)); + /* + * Ensure we do not race with split, which might alter tail pages into new + * head pages and thus result in observing an unlocked page. + * This matches the write barrier in __split_huge_page_tail(). + */ + smp_rmb(); + /* * Any use of migration entries may only occur while the * corresponding page is locked */ - BUG_ON(!PageLocked(compound_head(p))); + BUG_ON(!PageLocked(head)); +} + +static inline struct page *migration_entry_to_page(swp_entry_t entry) +{ + struct page *p = pfn_to_page(swp_offset(entry)); + + migration_entry_sync_page(compound_head(p)); + return p; } -- 2.43.0

2 1

[PATCH OLK-5.10] mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
by Jinjiang Tu 01 Apr '26

01 Apr '26

mainline inclusion from mainline-v7.0-rc6 commit 4c5e7f0fcd592801c9cc18f29f80fbee84eb8669 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8836 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP splitting and zap_nonpresent_ptes() races, and the root cause is lack of memory barrier in softleaf_to_folio(). The race is as follows: CPU0 CPU1 deferred_split_scan() zap_nonpresent_ptes() lock folio split_folio() unmap_folio() change ptes to migration entries __split_folio_to_order() softleaf_to_folio() set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry)) smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio)) prep_compound_page() for tail pages In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages are visible before the tail page becomes non-compound. smp_wmb() should be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a result, if zap_nonpresent_ptes() accesses migration entry that stores tail pfn, softleaf_to_folio() may see the updated compound_head of tail page before page->flags. To fix it, add missing smp_rmb() if the softleaf entry is migration entry in softleaf_to_folio() and softleaf_to_page(). [tujinjiang(a)huawei.com: update function name and comments] Link: https://lkml.kernel.org/r/20260321075214.3305564-1-tujinjiang@huawei.com Link: https://lkml.kernel.org/r/20260319012541.4158561-1-tujinjiang@huawei.com Fixes: e9b61f19858a ("thp: reintroduce split_huge_page()") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> Acked-by: David Hildenbrand (Arm) <david(a)kernel.org> Reviewed-by: Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> Cc: Barry Song <baohua(a)kernel.org> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: Ryan Roberts <ryan.roberts(a)arm.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Vlastimil Babka <vbabka(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: include/linux/leafops.h include/linux/swapops.h mm/filemap.c [miragtion entry hasn't been renamed to softleaf entry. Add new helper migration_entry_to_compound_page().] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/linux/swapops.h | 31 ++++++++++++++++++++++++++++--- mm/filemap.c | 2 +- 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/include/linux/swapops.h b/include/linux/swapops.h index e749c4c86b26..ed33367fb6a6 100644 --- a/include/linux/swapops.h +++ b/include/linux/swapops.h @@ -194,17 +194,42 @@ static inline unsigned long migration_entry_to_pfn(swp_entry_t entry) return swp_offset(entry); } -static inline struct page *migration_entry_to_page(swp_entry_t entry) +static inline void migration_entry_sync_page(struct page *head) { - struct page *p = pfn_to_page(swp_offset(entry)); + /* + * Ensure we do not race with split, which might alter tail pages into new + * head pages and thus result in observing an unlocked page. + * This matches the write barrier in __split_huge_page_tail(). + */ + smp_rmb(); + /* * Any use of migration entries may only occur while the * corresponding page is locked */ - BUG_ON(!PageLocked(compound_head(p))); + BUG_ON(!PageLocked(head)); +} + +static inline struct page *migration_entry_to_page(swp_entry_t entry) +{ + struct page *p = pfn_to_page(swp_offset(entry)); + + migration_entry_sync_page(compound_head(p)); + return p; } +static inline struct page *migration_entry_to_compound_page(swp_entry_t entry) +{ + struct page *p = pfn_to_page(swp_offset(entry)); + struct page *head; + + head = compound_head(p); + migration_entry_sync_page(head); + + return head; +} + static inline void make_migration_entry_read(swp_entry_t *entry) { *entry = swp_entry(SWP_MIGRATION_READ, swp_offset(*entry)); diff --git a/mm/filemap.c b/mm/filemap.c index 18e304ce6229..c2932db70212 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -1334,7 +1334,7 @@ void migration_entry_wait_on_locked(swp_entry_t entry, pte_t *ptep, bool delayacct = false; unsigned long pflags = 0; wait_queue_head_t *q; - struct page *page = compound_head(migration_entry_to_page(entry)); + struct page *page = migration_entry_to_compound_page(entry); q = page_waitqueue(page); if (!PageUptodate(page) && PageWorkingset(page)) { -- 2.43.0

2 1

[PATCH OLK-6.6] mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
by Jinjiang Tu 01 Apr '26

01 Apr '26

mainline inclusion from mainline-v7.0-rc6 commit 4c5e7f0fcd592801c9cc18f29f80fbee84eb8669 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8836 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP splitting and zap_nonpresent_ptes() races, and the root cause is lack of memory barrier in softleaf_to_folio(). The race is as follows: CPU0 CPU1 deferred_split_scan() zap_nonpresent_ptes() lock folio split_folio() unmap_folio() change ptes to migration entries __split_folio_to_order() softleaf_to_folio() set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry)) smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio)) prep_compound_page() for tail pages In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages are visible before the tail page becomes non-compound. smp_wmb() should be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a result, if zap_nonpresent_ptes() accesses migration entry that stores tail pfn, softleaf_to_folio() may see the updated compound_head of tail page before page->flags. This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio() because of the race between folio split and zap_nonpresent_ptes() leading to a folio incorrectly undergoing modification without a folio lock being held. This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further swapops predicates"), which in merged in v6.19-rc1. To fix it, add missing smp_rmb() if the softleaf entry is migration entry in softleaf_to_folio() and softleaf_to_page(). [tujinjiang(a)huawei.com: update function name and comments] Link: https://lkml.kernel.org/r/20260321075214.3305564-1-tujinjiang@huawei.com Link: https://lkml.kernel.org/r/20260319012541.4158561-1-tujinjiang@huawei.com Fixes: e9b61f19858a ("thp: reintroduce split_huge_page()") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> Acked-by: David Hildenbrand (Arm) <david(a)kernel.org> Reviewed-by: Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> Cc: Barry Song <baohua(a)kernel.org> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: Ryan Roberts <ryan.roberts(a)arm.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Vlastimil Babka <vbabka(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: include/linux/leafops.h include/linux/swapops.h [miragtion entry hasn't been renamed to softleaf entry.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/linux/swapops.h | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/include/linux/swapops.h b/include/linux/swapops.h index b32d696242b6..7bb5937a3f3c 100644 --- a/include/linux/swapops.h +++ b/include/linux/swapops.h @@ -500,15 +500,28 @@ static inline int is_userswap_entry(swp_entry_t entry) } #endif -static inline struct page *pfn_swap_entry_to_page(swp_entry_t entry) +static inline void migration_entry_sync(struct folio *folio) { - struct page *p = pfn_to_page(swp_offset_pfn(entry)); + /* + * Ensure we do not race with split, which might alter tail pages into new + * folios and thus result in observing an unlocked folio. + * This matches the write barrier in __split_folio_to_order(). + */ + smp_rmb(); /* * Any use of migration entries may only occur while the * corresponding page is locked */ - BUG_ON(is_migration_entry(entry) && !PageLocked(p)); + BUG_ON(!folio_test_locked(folio)); +} + +static inline struct page *pfn_swap_entry_to_page(swp_entry_t entry) +{ + struct page *p = pfn_to_page(swp_offset_pfn(entry)); + + if (is_migration_entry(entry)) + migration_entry_sync(page_folio(p)); return p; } @@ -517,11 +530,8 @@ static inline struct folio *pfn_swap_entry_folio(swp_entry_t entry) { struct folio *folio = pfn_folio(swp_offset_pfn(entry)); - /* - * Any use of migration entries may only occur while the - * corresponding folio is locked - */ - BUG_ON(is_migration_entry(entry) && !folio_test_locked(folio)); + if (is_migration_entry(entry)) + migration_entry_sync(folio); return folio; } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
by Jinjiang Tu 31 Mar '26

31 Mar '26

mainline inclusion from mainline-v7.0-rc6 commit 4c5e7f0fcd592801c9cc18f29f80fbee84eb8669 category: bugfix bugzilla: https://gitcode.com/openeuler/kernel/issues/8836 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP splitting and zap_nonpresent_ptes() races, and the root cause is lack of memory barrier in softleaf_to_folio(). The race is as follows: CPU0 CPU1 deferred_split_scan() zap_nonpresent_ptes() lock folio split_folio() unmap_folio() change ptes to migration entries __split_folio_to_order() softleaf_to_folio() set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry)) smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio)) prep_compound_page() for tail pages In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages are visible before the tail page becomes non-compound. smp_wmb() should be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a result, if zap_nonpresent_ptes() accesses migration entry that stores tail pfn, softleaf_to_folio() may see the updated compound_head of tail page before page->flags. This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio() because of the race between folio split and zap_nonpresent_ptes() leading to a folio incorrectly undergoing modification without a folio lock being held. This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further swapops predicates"), which in merged in v6.19-rc1. To fix it, add missing smp_rmb() if the softleaf entry is migration entry in softleaf_to_folio() and softleaf_to_page(). [tujinjiang(a)huawei.com: update function name and comments] Link: https://lkml.kernel.org/r/20260321075214.3305564-1-tujinjiang@huawei.com Link: https://lkml.kernel.org/r/20260319012541.4158561-1-tujinjiang@huawei.com Fixes: e9b61f19858a ("thp: reintroduce split_huge_page()") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> Acked-by: David Hildenbrand (Arm) <david(a)kernel.org> Reviewed-by: Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> Cc: Barry Song <baohua(a)kernel.org> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: Ryan Roberts <ryan.roberts(a)arm.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Vlastimil Babka <vbabka(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: include/linux/leafops.h include/linux/swapops.h [miragtion entry hasn't been renamed to softleaf entry.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/linux/swapops.h | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/include/linux/swapops.h b/include/linux/swapops.h index 22af9d8a84ae..c742e778e024 100644 --- a/include/linux/swapops.h +++ b/include/linux/swapops.h @@ -205,14 +205,28 @@ static inline unsigned long migration_entry_to_pfn(swp_entry_t entry) return swp_offset(entry); } -static inline struct page *migration_entry_to_page(swp_entry_t entry) +static inline void migration_entry_sync_page(struct page *head) { - struct page *p = pfn_to_page(swp_offset(entry)); + /* + * Ensure we do not race with split, which might alter tail pages into new + * head pages and thus result in observing an unlocked page. + * This matches the write barrier in __split_huge_page_tail(). + */ + smp_rmb(); + /* * Any use of migration entries may only occur while the * corresponding page is locked */ - BUG_ON(!PageLocked(compound_head(p))); + BUG_ON(!PageLocked(head)); +} + +static inline struct page *migration_entry_to_page(swp_entry_t entry) +{ + struct page *p = pfn_to_page(swp_offset(entry)); + + migration_entry_sync_page(compound_head(p)); + return p; } -- 2.43.0

2 1

[PATCH OLK-5.10] mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
by Jinjiang Tu 31 Mar '26

31 Mar '26

mainline inclusion from mainline-v7.0-rc6 commit 4c5e7f0fcd592801c9cc18f29f80fbee84eb8669 category: bugfix bugzilla: https://gitcode.com/openeuler/kernel/issues/8836 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP splitting and zap_nonpresent_ptes() races, and the root cause is lack of memory barrier in softleaf_to_folio(). The race is as follows: CPU0 CPU1 deferred_split_scan() zap_nonpresent_ptes() lock folio split_folio() unmap_folio() change ptes to migration entries __split_folio_to_order() softleaf_to_folio() set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry)) smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio)) prep_compound_page() for tail pages In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages are visible before the tail page becomes non-compound. smp_wmb() should be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a result, if zap_nonpresent_ptes() accesses migration entry that stores tail pfn, softleaf_to_folio() may see the updated compound_head of tail page before page->flags. To fix it, add missing smp_rmb() if the softleaf entry is migration entry in softleaf_to_folio() and softleaf_to_page(). [tujinjiang(a)huawei.com: update function name and comments] Link: https://lkml.kernel.org/r/20260321075214.3305564-1-tujinjiang@huawei.com Link: https://lkml.kernel.org/r/20260319012541.4158561-1-tujinjiang@huawei.com Fixes: e9b61f19858a ("thp: reintroduce split_huge_page()") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> Acked-by: David Hildenbrand (Arm) <david(a)kernel.org> Reviewed-by: Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> Cc: Barry Song <baohua(a)kernel.org> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: Ryan Roberts <ryan.roberts(a)arm.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Vlastimil Babka <vbabka(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: include/linux/leafops.h include/linux/swapops.h mm/filemap.c [miragtion entry hasn't been renamed to softleaf entry. Add new helper migration_entry_to_compound_page().] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/linux/swapops.h | 31 ++++++++++++++++++++++++++++--- mm/filemap.c | 2 +- 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/include/linux/swapops.h b/include/linux/swapops.h index e749c4c86b26..ed33367fb6a6 100644 --- a/include/linux/swapops.h +++ b/include/linux/swapops.h @@ -194,17 +194,42 @@ static inline unsigned long migration_entry_to_pfn(swp_entry_t entry) return swp_offset(entry); } -static inline struct page *migration_entry_to_page(swp_entry_t entry) +static inline void migration_entry_sync_page(struct page *head) { - struct page *p = pfn_to_page(swp_offset(entry)); + /* + * Ensure we do not race with split, which might alter tail pages into new + * head pages and thus result in observing an unlocked page. + * This matches the write barrier in __split_huge_page_tail(). + */ + smp_rmb(); + /* * Any use of migration entries may only occur while the * corresponding page is locked */ - BUG_ON(!PageLocked(compound_head(p))); + BUG_ON(!PageLocked(head)); +} + +static inline struct page *migration_entry_to_page(swp_entry_t entry) +{ + struct page *p = pfn_to_page(swp_offset(entry)); + + migration_entry_sync_page(compound_head(p)); + return p; } +static inline struct page *migration_entry_to_compound_page(swp_entry_t entry) +{ + struct page *p = pfn_to_page(swp_offset(entry)); + struct page *head; + + head = compound_head(p); + migration_entry_sync_page(head); + + return head; +} + static inline void make_migration_entry_read(swp_entry_t *entry) { *entry = swp_entry(SWP_MIGRATION_READ, swp_offset(*entry)); diff --git a/mm/filemap.c b/mm/filemap.c index 18e304ce6229..c2932db70212 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -1334,7 +1334,7 @@ void migration_entry_wait_on_locked(swp_entry_t entry, pte_t *ptep, bool delayacct = false; unsigned long pflags = 0; wait_queue_head_t *q; - struct page *page = compound_head(migration_entry_to_page(entry)); + struct page *page = migration_entry_to_compound_page(entry); q = page_waitqueue(page); if (!PageUptodate(page) && PageWorkingset(page)) { -- 2.43.0

2 1

[PATCH OLK-6.6] mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
by Jinjiang Tu 31 Mar '26

31 Mar '26

mainline inclusion from mainline-v7.0-rc6 commit 4c5e7f0fcd592801c9cc18f29f80fbee84eb8669 category: bugfix bugzilla: https://gitcode.com/openeuler/kernel/issues/8836 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP splitting and zap_nonpresent_ptes() races, and the root cause is lack of memory barrier in softleaf_to_folio(). The race is as follows: CPU0 CPU1 deferred_split_scan() zap_nonpresent_ptes() lock folio split_folio() unmap_folio() change ptes to migration entries __split_folio_to_order() softleaf_to_folio() set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry)) smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio)) prep_compound_page() for tail pages In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages are visible before the tail page becomes non-compound. smp_wmb() should be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a result, if zap_nonpresent_ptes() accesses migration entry that stores tail pfn, softleaf_to_folio() may see the updated compound_head of tail page before page->flags. This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio() because of the race between folio split and zap_nonpresent_ptes() leading to a folio incorrectly undergoing modification without a folio lock being held. This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further swapops predicates"), which in merged in v6.19-rc1. To fix it, add missing smp_rmb() if the softleaf entry is migration entry in softleaf_to_folio() and softleaf_to_page(). [tujinjiang(a)huawei.com: update function name and comments] Link: https://lkml.kernel.org/r/20260321075214.3305564-1-tujinjiang@huawei.com Link: https://lkml.kernel.org/r/20260319012541.4158561-1-tujinjiang@huawei.com Fixes: e9b61f19858a ("thp: reintroduce split_huge_page()") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> Acked-by: David Hildenbrand (Arm) <david(a)kernel.org> Reviewed-by: Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> Cc: Barry Song <baohua(a)kernel.org> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: Ryan Roberts <ryan.roberts(a)arm.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Vlastimil Babka <vbabka(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: include/linux/leafops.h include/linux/swapops.h [miragtion entry hasn't been renamed to softleaf entry.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/linux/swapops.h | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/include/linux/swapops.h b/include/linux/swapops.h index b32d696242b6..7bb5937a3f3c 100644 --- a/include/linux/swapops.h +++ b/include/linux/swapops.h @@ -500,15 +500,28 @@ static inline int is_userswap_entry(swp_entry_t entry) } #endif -static inline struct page *pfn_swap_entry_to_page(swp_entry_t entry) +static inline void migration_entry_sync(struct folio *folio) { - struct page *p = pfn_to_page(swp_offset_pfn(entry)); + /* + * Ensure we do not race with split, which might alter tail pages into new + * folios and thus result in observing an unlocked folio. + * This matches the write barrier in __split_folio_to_order(). + */ + smp_rmb(); /* * Any use of migration entries may only occur while the * corresponding page is locked */ - BUG_ON(is_migration_entry(entry) && !PageLocked(p)); + BUG_ON(!folio_test_locked(folio)); +} + +static inline struct page *pfn_swap_entry_to_page(swp_entry_t entry) +{ + struct page *p = pfn_to_page(swp_offset_pfn(entry)); + + if (is_migration_entry(entry)) + migration_entry_sync(page_folio(p)); return p; } @@ -517,11 +530,8 @@ static inline struct folio *pfn_swap_entry_folio(swp_entry_t entry) { struct folio *folio = pfn_folio(swp_offset_pfn(entry)); - /* - * Any use of migration entries may only occur while the - * corresponding folio is locked - */ - BUG_ON(is_migration_entry(entry) && !folio_test_locked(folio)); + if (is_migration_entry(entry)) + migration_entry_sync(folio); return folio; } -- 2.43.0

2 1

[PATCH OLK-6.6 v4 0/2] kvm: arm64: Transition from CPU Type to MIDR Register for Virtualization Feature Detection
by liqiqi 31 Mar '26

31 Mar '26

Currently, there are two methods for determining whether a chip supports specific virtualization features: 1. Reading the chip's CPU type from BIOS 2. Reading the value of the MIDR register The issue with the first method is that each time a new chip is introduced, the new CPU type must be defined, which leads to poor code portability and maintainability. Therefore, the second method has been adopted to replace the first. This approach eliminates the dependency on CPU type by using the MIDR register. liqiqi (2): kvm: arm64: Add MIDR definitions and use MIDR to determine whether features are supported kvm: arm64: Remove cpu_type definition and it's related interfaces arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cputype.h | 8 +- arch/arm64/kernel/cpu_errata.c | 4 +- arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/kernel/proton-pack.c | 4 +- arch/arm64/kvm/arm.c | 1 - arch/arm64/kvm/hisilicon/hisi_virt.c | 111 +++-------------------- arch/arm64/kvm/hisilicon/hisi_virt.h | 12 --- drivers/perf/hisilicon/hisi_uncore_pmu.c | 2 +- tools/arch/arm64/include/asm/cputype.h | 4 +- 10 files changed, 26 insertions(+), 124 deletions(-) -- 2.43.0

2 7

[PATCH OLK-5.10] xfs: fix internal error from AGFL exhaustion
by Long Li 31 Mar '26

31 Mar '26

From: Omar Sandoval <osandov(a)fb.com> mainline inclusion from mainline-v6.7-rc1 commit f63a5b3769ad7659da4c0420751d78958ab97675 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14036 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We've been seeing XFS errors like the following: XFS: Internal error i != 1 at line 3526 of file fs/xfs/libxfs/xfs_btree.c. Caller xfs_btree_insert+0x1ec/0x280 ... Call Trace: xfs_corruption_error+0x94/0xa0 xfs_btree_insert+0x221/0x280 xfs_alloc_fixup_trees+0x104/0x3e0 xfs_alloc_ag_vextent_size+0x667/0x820 xfs_alloc_fix_freelist+0x5d9/0x750 xfs_free_extent_fix_freelist+0x65/0xa0 __xfs_free_extent+0x57/0x180 ... This is the XFS_IS_CORRUPT() check in xfs_btree_insert() when xfs_btree_insrec() fails. After converting this into a panic and dissecting the core dump, I found that xfs_btree_insrec() is failing because it's trying to split a leaf node in the cntbt when the AG free list is empty. In particular, it's failing to get a block from the AGFL _while trying to refill the AGFL_. If a single operation splits every level of the bnobt and the cntbt (and the rmapbt if it is enabled) at once, the free list will be empty. Then, when the next operation tries to refill the free list, it allocates space. If the allocation does not use a full extent, it will need to insert records for the remaining space in the bnobt and cntbt. And if those new records go in full leaves, the leaves (and potentially more nodes up to the old root) need to be split. Fix it by accounting for the additional splits that may be required to refill the free list in the calculation for the minimum free list size. P.S. As far as I can tell, this bug has existed for a long time -- maybe back to xfs-history commit afdf80ae7405 ("Add XFS_AG_MAXLEVELS macros ...") in April 1994! It requires a very unlucky sequence of events, and in fact we didn't hit it until a particular sparse mmap workload updated from 5.12 to 5.19. But this bug existed in 5.12, so it must've been exposed by some other change in allocation or writeback patterns. It's also much less likely to be hit with the rmapbt enabled, since that increases the minimum free list size and is unlikely to split at the same time as the bnobt and cntbt. Reviewed-by: "Darrick J. Wong" <djwong(a)kernel.org> Reviewed-by: Dave Chinner <dchinner(a)redhat.com> Signed-off-by: Omar Sandoval <osandov(a)fb.com> Signed-off-by: Chandan Babu R <chandanbabu(a)kernel.org> Conflicts: fs/xfs/libxfs/xfs_alloc.c [Context conflicts] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/libxfs/xfs_alloc.c | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c index 23c0e666d2f4..15dce9276d45 100644 --- a/fs/xfs/libxfs/xfs_alloc.c +++ b/fs/xfs/libxfs/xfs_alloc.c @@ -2328,16 +2328,37 @@ xfs_alloc_min_freelist( ASSERT(mp->m_ag_maxlevels > 0); + /* + * For a btree shorter than the maximum height, the worst case is that + * every level gets split and a new level is added, then while inserting + * another entry to refill the AGFL, every level under the old root gets + * split again. This is: + * + * (full height split reservation) + (AGFL refill split height) + * = (current height + 1) + (current height - 1) + * = (new height) + (new height - 2) + * = 2 * new height - 2 + * + * For a btree of maximum height, the worst case is that every level + * under the root gets split, then while inserting another entry to + * refill the AGFL, every level under the root gets split again. This is + * also: + * + * 2 * (current height - 1) + * = 2 * (new height - 1) + * = 2 * new height - 2 + */ + /* space needed by-bno freespace btree */ min_free = min_t(unsigned int, levels[XFS_BTNUM_BNOi] + 1, - mp->m_ag_maxlevels); + mp->m_ag_maxlevels) * 2 - 2; /* space needed by-size freespace btree */ min_free += min_t(unsigned int, levels[XFS_BTNUM_CNTi] + 1, - mp->m_ag_maxlevels); + mp->m_ag_maxlevels) * 2 - 2; /* space needed reverse mapping used space btree */ if (xfs_has_rmapbt(mp)) min_free += min_t(unsigned int, levels[XFS_BTNUM_RMAPi] + 1, - mp->m_rmap_maxlevels); + mp->m_rmap_maxlevels) * 2 - 2; return min_free; } -- 2.39.2

2 1

[PATCH OLK-6.6 v3 0/3] kvm: arm64: Transition from CPU Type to MIDR Register for Virtualization Feature Detection
by liqiqi 31 Mar '26

31 Mar '26

Currently, there are two methods for determining whether a chip supports specific virtualization features: 1. Reading the chip's CPU type from BIOS 2. Reading the value of the MIDR register The issue with the first method is that each time a new chip is introduced, the new CPU type must be defined, which leads to poor code portability and maintainability. Therefore, the second method has been adopted to replace the first. This approach eliminates the dependency on CPU type by using the MIDR register. liqiqi (3): kvm: arm64: Add HIP08, HIP10, HIP10C MIDR definitions kvm: arm64: use MIDR to determine whether features are supported kvm: arm64: Remove cpu_type definition and it's related interfaces arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cputype.h | 8 +- arch/arm64/kernel/cpu_errata.c | 4 +- arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/kernel/proton-pack.c | 4 +- arch/arm64/kvm/arm.c | 1 - arch/arm64/kvm/hisilicon/hisi_virt.c | 111 +++-------------------- arch/arm64/kvm/hisilicon/hisi_virt.h | 12 --- drivers/perf/hisilicon/hisi_uncore_pmu.c | 2 +- tools/arch/arm64/include/asm/cputype.h | 4 +- 10 files changed, 26 insertions(+), 124 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6] time/jiffies: Mark jiffies_64_to_clock_t() notrace
by Liu Kai 31 Mar '26

31 Mar '26

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v7.0-rc4 commit 755a648e78f12574482d4698d877375793867fa1 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8837 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The trace_clock_jiffies() function that handles the "uptime" clock for tracing calls jiffies_64_to_clock_t(). This causes the function tracer to constantly recurse when the tracing clock is set to "uptime". Mark it notrace to prevent unnecessary recursion when using the "uptime" clock. Fixes: 58d4e21e50ff3 ("tracing: Fix wraparound problems in "uptime" trace clock") Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Thomas Gleixner <tglx(a)kernel.org> Link: https://patch.msgid.link/20260306212403.72270bb2@robin Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- kernel/time/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/time/time.c b/kernel/time/time.c index 1ad88e97b4eb..da7e8a02a096 100644 --- a/kernel/time/time.c +++ b/kernel/time/time.c @@ -702,7 +702,7 @@ EXPORT_SYMBOL(clock_t_to_jiffies); * * Return: jiffies_64 value converted to 64-bit "clock_t" (CLOCKS_PER_SEC) */ -u64 jiffies_64_to_clock_t(u64 x) +notrace u64 jiffies_64_to_clock_t(u64 x) { #if (TICK_NSEC % (NSEC_PER_SEC / USER_HZ)) == 0 # if HZ < USER_HZ -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata
by Zeng Heng 31 Mar '26

31 Mar '26

Qinxin Xia (2): arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata ACPI/IORT: Add PMCG platform information for 162001900 drivers/acpi/arm64/iort.c | 4 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 6 ++++++ 2 files changed, 10 insertions(+) -- 2.25.1

1 1

[PATCH OLK-5.10] time/jiffies: Mark jiffies_64_to_clock_t() notrace
by Liu Kai 31 Mar '26

31 Mar '26

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v7.0-rc4 commit 755a648e78f12574482d4698d877375793867fa1 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8837 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The trace_clock_jiffies() function that handles the "uptime" clock for tracing calls jiffies_64_to_clock_t(). This causes the function tracer to constantly recurse when the tracing clock is set to "uptime". Mark it notrace to prevent unnecessary recursion when using the "uptime" clock. Fixes: 58d4e21e50ff3 ("tracing: Fix wraparound problems in "uptime" trace clock") Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Thomas Gleixner <tglx(a)kernel.org> Link: https://patch.msgid.link/20260306212403.72270bb2@robin Conflicts: kernel/time/time.c [Context conflict] Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- kernel/time/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/time/time.c b/kernel/time/time.c index 3985b2b32d08..22551ee392e4 100644 --- a/kernel/time/time.c +++ b/kernel/time/time.c @@ -649,7 +649,7 @@ unsigned long clock_t_to_jiffies(unsigned long x) } EXPORT_SYMBOL(clock_t_to_jiffies); -u64 jiffies_64_to_clock_t(u64 x) +notrace u64 jiffies_64_to_clock_t(u64 x) { #if (TICK_NSEC % (NSEC_PER_SEC / USER_HZ)) == 0 # if HZ < USER_HZ -- 2.34.1

2 1

[PATCH OLK-6.6 v2 0/3] kvm: arm64: Transition from CPU Type to MIDR Register for Virtualization Feature Detection
by liqiqi 31 Mar '26

31 Mar '26

Currently, there are two methods for determining whether a chip supports specific virtualization features: 1. Reading the chip's CPU type from BIOS 2. Reading the value of the MIDR register The issue with the first method is that each time a new chip is introduced, the new CPU type must be defined, which leads to poor code portability and maintainability. Therefore, the second method has been adopted to replace the first. This approach eliminates the dependency on CPU type by using the MIDR register and removes the need for defining CPU types and their related interfaces. liqiqi (3): kvm: arm64: Add HIP08, HIP10, HIP10C MIDR definitions kvm: arm64: use MIDR to determine whether features are supported kvm: arm64: Remove cpu_type definition and it's related interfaces arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cputype.h | 8 +- arch/arm64/kernel/cpu_errata.c | 4 +- arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/kernel/proton-pack.c | 4 +- arch/arm64/kvm/arm.c | 1 - arch/arm64/kvm/hisilicon/hisi_virt.c | 111 +++---------------------- arch/arm64/kvm/hisilicon/hisi_virt.h | 12 --- tools/arch/arm64/include/asm/cputype.h | 4 +- 9 files changed, 25 insertions(+), 123 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 0/2] arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata
by Zeng Heng 31 Mar '26

31 Mar '26

Qinxin Xia (2): arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata ACPI/IORT: Add PMCG platform information for 162001900 drivers/acpi/arm64/iort.c | 4 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 6 ++++++ 2 files changed, 10 insertions(+) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
by Jinjiang Tu 31 Mar '26

31 Mar '26

mainline inclusion from mainline-v7.0-rc6 commit 4c5e7f0fcd592801c9cc18f29f80fbee84eb8669 category: bugfix bugzilla: https://hulk.rnd.huawei.com/issue/info/45383 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP splitting and zap_nonpresent_ptes() races, and the root cause is lack of memory barrier in softleaf_to_folio(). The race is as follows: CPU0 CPU1 deferred_split_scan() zap_nonpresent_ptes() lock folio split_folio() unmap_folio() change ptes to migration entries __split_folio_to_order() softleaf_to_folio() set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry)) smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio)) prep_compound_page() for tail pages In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages are visible before the tail page becomes non-compound. smp_wmb() should be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a result, if zap_nonpresent_ptes() accesses migration entry that stores tail pfn, softleaf_to_folio() may see the updated compound_head of tail page before page->flags. This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio() because of the race between folio split and zap_nonpresent_ptes() leading to a folio incorrectly undergoing modification without a folio lock being held. This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further swapops predicates"), which in merged in v6.19-rc1. To fix it, add missing smp_rmb() if the softleaf entry is migration entry in softleaf_to_folio() and softleaf_to_page(). [tujinjiang(a)huawei.com: update function name and comments] Link: https://lkml.kernel.org/r/20260321075214.3305564-1-tujinjiang@huawei.com Link: https://lkml.kernel.org/r/20260319012541.4158561-1-tujinjiang@huawei.com Fixes: e9b61f19858a ("thp: reintroduce split_huge_page()") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> Acked-by: David Hildenbrand (Arm) <david(a)kernel.org> Reviewed-by: Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> Cc: Barry Song <baohua(a)kernel.org> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: Ryan Roberts <ryan.roberts(a)arm.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Vlastimil Babka <vbabka(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: include/linux/leafops.h include/linux/swapops.h [miragtion entry hasn't been renamed to softleaf entry.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/linux/swapops.h | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/include/linux/swapops.h b/include/linux/swapops.h index 22af9d8a84ae..c742e778e024 100644 --- a/include/linux/swapops.h +++ b/include/linux/swapops.h @@ -205,14 +205,28 @@ static inline unsigned long migration_entry_to_pfn(swp_entry_t entry) return swp_offset(entry); } -static inline struct page *migration_entry_to_page(swp_entry_t entry) +static inline void migration_entry_sync_page(struct page *head) { - struct page *p = pfn_to_page(swp_offset(entry)); + /* + * Ensure we do not race with split, which might alter tail pages into new + * head pages and thus result in observing an unlocked page. + * This matches the write barrier in __split_huge_page_tail(). + */ + smp_rmb(); + /* * Any use of migration entries may only occur while the * corresponding page is locked */ - BUG_ON(!PageLocked(compound_head(p))); + BUG_ON(!PageLocked(head)); +} + +static inline struct page *migration_entry_to_page(swp_entry_t entry) +{ + struct page *p = pfn_to_page(swp_offset(entry)); + + migration_entry_sync_page(compound_head(p)); + return p; } -- 2.43.0

2 1

[PATCH OLK-6.6] i40e: Fix preempt count leak in napi poll tracepoint
by Luo Gengkun 31 Mar '26

31 Mar '26

From: Thomas Gleixner <tglx(a)kernel.org> mainline inclusion from mainline-v7.0-rc3 commit 4b3d54a85bd37ebf2d9836f0d0de775c0ff21af9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13968 CVE: CVE-2026-23313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- Using get_cpu() in the tracepoint assignment causes an obvious preempt count leak because nothing invokes put_cpu() to undo it: softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100, exited with 00000101? This clearly has seen a lot of testing in the last 3+ years... Use smp_processor_id() instead. Fixes: 6d4d584a7ea8 ("i40e: Add i40e_napi_poll tracepoint") Signed-off-by: Thomas Gleixner <tglx(a)kernel.org> Cc: Tony Nguyen <anthony.l.nguyen(a)intel.com> Cc: Przemek Kitszel <przemyslaw.kitszel(a)intel.com> Cc: intel-wired-lan(a)lists.osuosl.org Cc: netdev(a)vger.kernel.org Reviewed-by: Joe Damato <joe(a)dama.to> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Conflicts: drivers/net/ethernet/intel/i40e/i40e_trace.h [Fix conflicts because of context diff.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/ethernet/intel/i40e/i40e_trace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_trace.h b/drivers/net/ethernet/intel/i40e/i40e_trace.h index 33b4e30f5e00..9b735a9e2114 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_trace.h +++ b/drivers/net/ethernet/intel/i40e/i40e_trace.h @@ -88,7 +88,7 @@ TRACE_EVENT(i40e_napi_poll, __entry->rx_clean_complete = rx_clean_complete; __entry->tx_clean_complete = tx_clean_complete; __entry->irq_num = q->irq_num; - __entry->curr_cpu = get_cpu(); + __entry->curr_cpu = smp_processor_id(); __assign_str(qname, q->name); __assign_str(dev_name, napi->dev ? napi->dev->name : NO_DEV); __assign_bitmask(irq_affinity, cpumask_bits(&q->affinity_mask), -- 2.34.1

2 1

[PATCH OLK-6.6 00/14] ext4: fix generic/363 failure in iomap buffered I/O mode
by Yongjian Sun 30 Mar '26

30 Mar '26

Brian Foster (2): iomap: fix handling of dirty folios over unwritten extents iomap: make zero range flush conditional on unwritten mappings Zhang Yi (12): ext4: rename and extend ext4_block_truncate_page() ext4: factor out journalled block zeroing range ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() ext4: move ordered data handling out of ext4_block_do_zero_range() ext4: remove handle parameters from zero partial block functions ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() ext4: move zero partial block range functions out of active handle ext4: ensure zeroed partial blocks are persisted in SYNC mode ext4: unify SYNC mode checks in fallocate paths ext4: remove ctime/mtime update from ext4_alloc_file_blocks() ext4: move pagecache_isize_extended() out of active handle ext4: zero post EOF partial block before iomap appending write fs/ext4/ext4.h | 5 +- fs/ext4/extents.c | 137 ++++++++++++----------- fs/ext4/file.c | 17 +++ fs/ext4/inode.c | 244 +++++++++++++++++++++++------------------ fs/iomap/buffered-io.c | 63 ++++++++++- fs/xfs/xfs_iops.c | 10 -- 6 files changed, 291 insertions(+), 185 deletions(-) -- 2.39.2

2 15

[PATCH OLK-6.6 v2 0/2] CVE-2026-23319
by Pu Lehui 30 Mar '26

30 Mar '26

Kui-Feng Lee (1): bpf: export bpf_link_inc_not_zero. Lang Xu (1): bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim include/linux/bpf.h | 6 ++++++ kernel/bpf/syscall.c | 3 ++- kernel/bpf/trampoline.c | 4 +--- 3 files changed, 9 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] bpf: Fix stack-out-of-bounds write in devmap
by Pu Lehui 30 Mar '26

30 Mar '26

From: Kohei Enju <kohei(a)enjuk.jp> stable inclusion from stable-v6.6.130 commit 8a95fb9df1105b1618872c2846a6c01e3ba20b45 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13922 CVE: CVE-2026-23359 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b7bf516c3ecd9a2aae2dc2635178ab87b734fef1 ] get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds. Also the callers assume that the max number of upper devices is MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack, but that assumption is not correct and the number of upper devices could be larger than MAX_NEST_DEV (e.g., many macvlans), causing a stack-out-of-bounds write. Add a max parameter to get_upper_ifindexes() to avoid the issue. When there are too many upper devices, return -EOVERFLOW and abort the redirect. To reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS. Then send a packet to the device to trigger the XDP redirect path. Reported-by: syzbot+10cc7f13760b31bd2e61(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/698c4ce3.050a0220.340abe.000b.GAE@google.com/T/ Fixes: aeea1b86f936 ("bpf, devmap: Exclude XDP broadcast to master device") Reviewed-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Signed-off-by: Kohei Enju <kohei(a)enjuk.jp> Link: https://lore.kernel.org/r/20260225053506.4738-1-kohei@enjuk.jp Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/devmap.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c index 5f2356b47b2d..3bdec239be61 100644 --- a/kernel/bpf/devmap.c +++ b/kernel/bpf/devmap.c @@ -577,18 +577,22 @@ static inline bool is_ifindex_excluded(int *excluded, int num_excluded, int ifin } /* Get ifindex of each upper device. 'indexes' must be able to hold at - * least MAX_NEST_DEV elements. - * Returns the number of ifindexes added. + * least 'max' elements. + * Returns the number of ifindexes added, or -EOVERFLOW if there are too + * many upper devices. */ -static int get_upper_ifindexes(struct net_device *dev, int *indexes) +static int get_upper_ifindexes(struct net_device *dev, int *indexes, int max) { struct net_device *upper; struct list_head *iter; int n = 0; netdev_for_each_upper_dev_rcu(dev, upper, iter) { + if (n >= max) + return -EOVERFLOW; indexes[n++] = upper->ifindex; } + return n; } @@ -604,7 +608,11 @@ int dev_map_enqueue_multi(struct xdp_frame *xdpf, struct net_device *dev_rx, int err; if (exclude_ingress) { - num_excluded = get_upper_ifindexes(dev_rx, excluded_devices); + num_excluded = get_upper_ifindexes(dev_rx, excluded_devices, + ARRAY_SIZE(excluded_devices) - 1); + if (num_excluded < 0) + return num_excluded; + excluded_devices[num_excluded++] = dev_rx->ifindex; } @@ -722,7 +730,11 @@ int dev_map_redirect_multi(struct net_device *dev, struct sk_buff *skb, int err; if (exclude_ingress) { - num_excluded = get_upper_ifindexes(dev, excluded_devices); + num_excluded = get_upper_ifindexes(dev, excluded_devices, + ARRAY_SIZE(excluded_devices) - 1); + if (num_excluded < 0) + return num_excluded; + excluded_devices[num_excluded++] = dev->ifindex; } -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
by Pu Lehui 30 Mar '26

30 Mar '26

From: Lang Xu <xulang(a)uniontech.com> stable inclusion from stable-v6.6.130 commit 9b02c5c4147f8af8ed783c8deb5df927a55c3951 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13962 CVE: CVE-2026-23319 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 56145d237385ca0e7ca9ff7b226aaf2eb8ef368b ] The root cause of this bug is that when 'bpf_link_put' reduces the refcount of 'shim_link->link.link' to zero, the resource is considered released but may still be referenced via 'tr->progs_hlist' in 'cgroup_shim_find'. The actual cleanup of 'tr->progs_hlist' in 'bpf_shim_tramp_link_release' is deferred. During this window, another process can cause a use-after-free via 'bpf_trampoline_link_cgroup_shim'. Based on Martin KaFai Lau's suggestions, I have created a simple patch. To fix this: Add an atomic non-zero check in 'bpf_trampoline_link_cgroup_shim'. Only increment the refcount if it is not already zero. Testing: I verified the fix by adding a delay in 'bpf_shim_tramp_link_release' to make the bug easier to trigger: static void bpf_shim_tramp_link_release(struct bpf_link *link) { /* ... */ if (!shim_link->trampoline) return; + msleep(100); WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link, shim_link->trampoline, NULL)); bpf_trampoline_put(shim_link->trampoline); } Before the patch, running a PoC easily reproduced the crash(almost 100%) with a call trace similar to KaiyanM's report. After the patch, the bug no longer occurs even after millions of iterations. Fixes: 69fd337a975c ("bpf: per-cgroup lsm flavor") Reported-by: Kaiyan Mei <M202472210(a)hust.edu.cn> Closes: https://lore.kernel.org/bpf/3c4ebb0b.46ff8.19abab8abe2.Coremail.kaiyanm@hus… Signed-off-by: Lang Xu <xulang(a)uniontech.com> Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://patch.msgid.link/279EEE1BA1DDB49D+20260303095217.34436-1-xulang@uni… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/trampoline.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c index 08325a65835b..bb842decab0d 100644 --- a/kernel/bpf/trampoline.c +++ b/kernel/bpf/trampoline.c @@ -733,10 +733,8 @@ int bpf_trampoline_link_cgroup_shim(struct bpf_prog *prog, mutex_lock(&tr->mutex); shim_link = cgroup_shim_find(tr, bpf_func); - if (shim_link) { + if (shim_link && !IS_ERR(bpf_link_inc_not_zero(&shim_link->link.link))) { /* Reusing existing shim attached by the other program. */ - bpf_link_inc(&shim_link->link.link); - mutex_unlock(&tr->mutex); bpf_trampoline_put(tr); /* bpf_trampoline_get above */ return 0; -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Release module BTF IDR before module unload
by Pu Lehui 30 Mar '26

30 Mar '26

From: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> mainline inclusion from mainline-v7.0-rc5 commit 146bd2a87a65aa407bb17fac70d8d583d19aba06 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8835 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Gregory reported in [0] that the global_map_resize test when run in repeatedly ends up failing during program load. This stems from the fact that BTF reference has not dropped to zero after the previous run's module is unloaded, and the older module's BTF is still discoverable and visible. Later, in libbpf, load_module_btfs() will find the ID for this stale BTF, open its fd, and then it will be used during program load where later steps taking module reference using btf_try_get_module() fail since the underlying module for the BTF is gone. Logically, once a module is unloaded, it's associated BTF artifacts should become hidden. The BTF object inside the kernel may still remain alive as long its reference counts are alive, but it should no longer be discoverable. To fix this, let us call btf_free_id() from the MODULE_STATE_GOING case for the module unload to free the BTF associated IDR entry, and disable its discovery once module unload returns to user space. If a race happens during unload, the outcome is non-deterministic anyway. However, user space should be able to rely on the guarantee that once it has synchronously established a successful module unload, no more stale artifacts associated with this module can be obtained subsequently. Note that we must be careful to not invoke btf_free_id() in btf_put() when btf_is_module() is true now. There could be a window where the module unload drops a non-terminal reference, frees the IDR, but the same ID gets reused and the second unconditional btf_free_id() ends up releasing an unrelated entry. To avoid a special case for btf_is_module() case, set btf->id to zero to make btf_free_id() idempotent, such that we can unconditionally invoke it from btf_put(), and also from the MODULE_STATE_GOING case. Since zero is an invalid IDR, the idr_remove() should be a noop. Note that we can be sure that by the time we reach final btf_put() for btf_is_module() case, the btf_free_id() is already done, since the module itself holds the BTF reference, and it will call this function for the BTF before dropping its own reference. [0]: https://lore.kernel.org/bpf/cover.1773170190.git.grbell@redhat.com Fixes: 36e68442d1af ("bpf: Load and verify kernel module BTFs") Acked-by: Martin KaFai Lau <martin.lau(a)kernel.org> Suggested-by: Martin KaFai Lau <martin.lau(a)kernel.org> Reported-by: Gregory Bell <grbell(a)redhat.com> Reviewed-by: Emil Tsalapatis <emil(a)etsalapatis.com> Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Link: https://lore.kernel.org/r/20260312205307.1346991-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/btf.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 7c888ee0ccc7..5d1413e95185 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -1640,7 +1640,16 @@ static void btf_free_id(struct btf *btf) * of the _bh() version. */ spin_lock_irqsave(&btf_idr_lock, flags); - idr_remove(&btf_idr, btf->id); + if (btf->id) { + idr_remove(&btf_idr, btf->id); + /* + * Clear the id here to make this function idempotent, since it will get + * called a couple of times for module BTFs: on module unload, and then + * the final btf_put(). btf_alloc_id() starts IDs with 1, so we can use + * 0 as sentinel value. + */ + WRITE_ONCE(btf->id, 0); + } spin_unlock_irqrestore(&btf_idr_lock, flags); } @@ -7408,7 +7417,7 @@ static void bpf_btf_show_fdinfo(struct seq_file *m, struct file *filp) { const struct btf *btf = filp->private_data; - seq_printf(m, "btf_id:\t%u\n", btf->id); + seq_printf(m, "btf_id:\t%u\n", READ_ONCE(btf->id)); } #endif @@ -7500,7 +7509,7 @@ int btf_get_info_by_fd(const struct btf *btf, if (copy_from_user(&info, uinfo, info_copy)) return -EFAULT; - info.id = btf->id; + info.id = READ_ONCE(btf->id); ubtf = u64_to_user_ptr(info.btf); btf_copy = min_t(u32, btf->data_size, info.btf_size); if (copy_to_user(ubtf, btf->data, btf_copy)) @@ -7563,7 +7572,7 @@ int btf_get_fd_by_id(u32 id) u32 btf_obj_id(const struct btf *btf) { - return btf->id; + return READ_ONCE(btf->id); } bool btf_is_kernel(const struct btf *btf) @@ -7695,6 +7704,13 @@ static int btf_module_notify(struct notifier_block *nb, unsigned long op, if (btf_mod->module != module) continue; + /* + * For modules, we do the freeing of BTF IDR as soon as + * module goes away to disable BTF discovery, since the + * btf_try_get_module() on such BTFs will fail. This may + * be called again on btf_put(), but it's ok to do so. + */ + btf_free_id(btf_mod->btf); list_del(&btf_mod->list); if (btf_mod->sysfs_attr) sysfs_remove_bin_file(btf_kobj, btf_mod->sysfs_attr); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] wifi: prevent A-MSDU attacks in mesh networks
by Zhang Yuwei 28 Mar '26

28 Mar '26

From: Mathy Vanhoef <Mathy.Vanhoef(a)kuleuven.be> stable inclusion from stable-v6.6.99 commit ec6392061de6681148b63ee6c8744da833498cdd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/7758 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 737bb912ebbe4571195c56eba557c4d7315b26fb upstream. This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, in response to the FragAttacks, missed this case (CVE-2025-27558). It can be considered a variant of CVE-2020-24588 but for mesh networks. This patch tries to detect if a standard MSDU was turned into an A-MSDU by an adversary. This is done by parsing a received A-MSDU as a standard MSDU, calculating the length of the Mesh Control header, and seeing if the 6 bytes after this header equal the start of an rfc1042 header. If equal, this is a strong indication of an ongoing attack attempt. This defense was tested with mac80211_hwsim against a mesh network that uses an empty Mesh Address Extension field, i.e., when four addresses are used, and when using a 12-byte Mesh Address Extension field, i.e., when six addresses are used. Functionality of normal MSDUs and A-MSDUs was also tested, and confirmed working, when using both an empty and 12-byte Mesh Address Extension field. It was also tested with mac80211_hwsim that A-MSDU attacks in non-mesh networks keep being detected and prevented. Note that the vulnerability being patched, and the defense being implemented, was also discussed in the following paper and in the following IEEE 802.11 presentation: https://papers.mathyvanhoef.com/wisec2025.pdf https://mentor.ieee.org/802.11/dcn/25/11-25-0949-00-000m-a-msdu-mesh-spoof-… Cc: stable(a)vger.kernel.org Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)kuleuven.be> Link: https://patch.msgid.link/20250616004635.224344-1-Mathy.Vanhoef@kuleuven.be Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/wireless/util.c | 51 +++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 49 insertions(+), 2 deletions(-) diff --git a/net/wireless/util.c b/net/wireless/util.c index 4e81210e5b24..4af280c1a6d4 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -623,6 +623,51 @@ __ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen, return frame; } +/* + * Detects if an MSDU frame was maliciously converted into an A-MSDU + * frame by an adversary. This is done by parsing the received frame + * as if it were a regular MSDU, even though the A-MSDU flag is set. + * + * For non-mesh interfaces, detection involves checking whether the + * payload, when interpreted as an MSDU, begins with a valid RFC1042 + * header. This is done by comparing the A-MSDU subheader's destination + * address to the start of the RFC1042 header. + * + * For mesh interfaces, the MSDU includes a 6-byte Mesh Control field + * and an optional variable-length Mesh Address Extension field before + * the RFC1042 header. The position of the RFC1042 header must therefore + * be calculated based on the mesh header length. + * + * Since this function intentionally parses an A-MSDU frame as an MSDU, + * it only assumes that the A-MSDU subframe header is present, and + * beyond this it performs its own bounds checks under the assumption + * that the frame is instead parsed as a non-aggregated MSDU. + */ +static bool +is_amsdu_aggregation_attack(struct ethhdr *eth, struct sk_buff *skb, + enum nl80211_iftype iftype) +{ + int offset; + + /* Non-mesh case can be directly compared */ + if (iftype != NL80211_IFTYPE_MESH_POINT) + return ether_addr_equal(eth->h_dest, rfc1042_header); + + offset = __ieee80211_get_mesh_hdrlen(eth->h_dest[0]); + if (offset == 6) { + /* Mesh case with empty address extension field */ + return ether_addr_equal(eth->h_source, rfc1042_header); + } else if (offset + ETH_ALEN <= skb->len) { + /* Mesh case with non-empty address extension field */ + u8 temp[ETH_ALEN]; + + skb_copy_bits(skb, offset, temp, ETH_ALEN); + return ether_addr_equal(temp, rfc1042_header); + } + + return false; +} + void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, const u8 *addr, enum nl80211_iftype iftype, const unsigned int extra_headroom, @@ -655,8 +700,10 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, /* the last MSDU has no padding */ if (subframe_len > remaining) goto purge; - /* mitigate A-MSDU aggregation injection attacks */ - if (ether_addr_equal(eth.h_dest, rfc1042_header)) + /* mitigate A-MSDU aggregation injection attacks, to be + * checked when processing first subframe (offset == 0). + */ + if (offset == 0 && is_amsdu_aggregation_attack(&eth, skb, iftype)) goto purge; offset += sizeof(struct ethhdr); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] wifi: prevent A-MSDU attacks in mesh networks
by Zhang Yuwei 28 Mar '26

28 Mar '26

From: Mathy Vanhoef <Mathy.Vanhoef(a)kuleuven.be> stable inclusion from stable-v6.6.99 commit ec6392061de6681148b63ee6c8744da833498cdd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/7758 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 737bb912ebbe4571195c56eba557c4d7315b26fb upstream. This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, in response to the FragAttacks, missed this case (CVE-2025-27558). It can be considered a variant of CVE-2020-24588 but for mesh networks. This patch tries to detect if a standard MSDU was turned into an A-MSDU by an adversary. This is done by parsing a received A-MSDU as a standard MSDU, calculating the length of the Mesh Control header, and seeing if the 6 bytes after this header equal the start of an rfc1042 header. If equal, this is a strong indication of an ongoing attack attempt. This defense was tested with mac80211_hwsim against a mesh network that uses an empty Mesh Address Extension field, i.e., when four addresses are used, and when using a 12-byte Mesh Address Extension field, i.e., when six addresses are used. Functionality of normal MSDUs and A-MSDUs was also tested, and confirmed working, when using both an empty and 12-byte Mesh Address Extension field. It was also tested with mac80211_hwsim that A-MSDU attacks in non-mesh networks keep being detected and prevented. Note that the vulnerability being patched, and the defense being implemented, was also discussed in the following paper and in the following IEEE 802.11 presentation: https://papers.mathyvanhoef.com/wisec2025.pdf https://mentor.ieee.org/802.11/dcn/25/11-25-0949-00-000m-a-msdu-mesh-spoof-… Cc: stable(a)vger.kernel.org Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)kuleuven.be> Link: https://patch.msgid.link/20250616004635.224344-1-Mathy.Vanhoef@kuleuven.be Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/wireless/util.c | 51 +++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 49 insertions(+), 2 deletions(-) diff --git a/net/wireless/util.c b/net/wireless/util.c index 4e81210e5b24..dcca1b882455 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -623,6 +623,51 @@ __ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen, return frame; } +/* + * Detects if an MSDU frame was maliciously converted into an A-MSDU + * frame by an adversary. This is done by parsing the received frame + * as if it were a regular MSDU, even though the A-MSDU flag is set. + * + * For non-mesh interfaces, detection involves checking whether the + * payload, when interpreted as an MSDU, begins with a valid RFC1042 + * header. This is done by comparing the A-MSDU subheader's destination + * address to the start of the RFC1042 header. + * + * For mesh interfaces, the MSDU includes a 6-byte Mesh Control field + * and an optional variable-length Mesh Address Extension field before + * the RFC1042 header. The position of the RFC1042 header must therefore + * be calculated based on the mesh header length. + * + * Since this function intentionally parses an A-MSDU frame as an MSDU, + * it only assumes that the A-MSDU subframe header is present, and + * beyond this it performs its own bounds checks under the assumption + * that the frame is instead parsed as a non-aggregated MSDU. + */ +static bool +is_amsdu_aggregation_attack(struct ethhdr *eth, struct sk_buff *skb, + enum nl80211_iftype iftype) +{ + int offset; + + /* Non-mesh case can be directly compared */ + if (iftype != NL80211_IFTYPE_MESH_POINT) + return ether_addr_equal(eth->h_dest, rfc1042_header); + + offset = __ieee80211_get_mesh_hdrlen(eth->h_dest[0]); + if (offset == 6) { + /* Mesh case with empty address extension field */ + return ether_addr_equal(eth->h_source, rfc1042_header); + } else if (offset + ETH_ALEN <= skb->len) { + /* Mesh case with non-empty address extension field */ + u8 temp[ETH_ALEN]; + + skb_copy_bits(skb, offset, temp, ETH_ALEN); + return ether_addr_equal(temp, rfc1042_header); + } + + return false; +} + void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, const u8 *addr, enum nl80211_iftype iftype, const unsigned int extra_headroom, @@ -655,8 +700,10 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, /* the last MSDU has no padding */ if (subframe_len > remaining) goto purge; - /* mitigate A-MSDU aggregation injection attacks */ - if (ether_addr_equal(eth.h_dest, rfc1042_header)) + /* mitigate A-MSDU aggregation injection attacks, to be + * checked when processing first subframe (offset == 0). + */ + if (offset == 0 && is_amsdu_aggregation_attack(&hdr.eth, skb, iftype)) goto purge; offset += sizeof(struct ethhdr); -- 2.22.0

2 1

[PATCH OLK-5.10] RDMA/umad: Reject negative data_len in ib_umad_write
by Liu Kai 28 Mar '26

28 Mar '26

From: YunJe Shin <yjshin0438(a)gmail.com> stable inclusion from stable-v5.10.252 commit 1371ef6b1ecf3676b8942f5dfb3634fb0648128e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13865 CVE: CVE-2026-23243 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5551b02fdbfd85a325bb857f3a8f9c9f33397ed2 upstream. ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80 Fixes: 2be8e3ee8efd ("IB/umad: Add P_Key index support") Signed-off-by: YunJe Shin <ioerts(a)kookmin.ac.kr> Link: https://patch.msgid.link/20260203100628.1215408-1-ioerts@kookmin.ac.kr Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/infiniband/core/user_mad.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c index 063707dd4fe3..c8ad6ef39fa5 100644 --- a/drivers/infiniband/core/user_mad.c +++ b/drivers/infiniband/core/user_mad.c @@ -514,7 +514,8 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf, struct rdma_ah_attr ah_attr; struct ib_ah *ah; __be64 *tid; - int ret, data_len, hdr_len, copy_offset, rmpp_active; + int ret, hdr_len, copy_offset, rmpp_active; + size_t data_len; u8 base_version; if (count < hdr_size(file) + IB_MGMT_RMPP_HDR) @@ -588,7 +589,10 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf, } base_version = ((struct ib_mad_hdr *)&packet->mad.data)->base_version; - data_len = count - hdr_size(file) - hdr_len; + if (check_sub_overflow(count, hdr_size(file) + hdr_len, &data_len)) { + ret = -EINVAL; + goto err_ah; + } packet->msg = ib_create_send_mad(agent, be32_to_cpu(packet->mad.hdr.qpn), packet->mad.hdr.pkey_index, rmpp_active, -- 2.34.1

2 1

[PATCH OLK-6.6] RDMA/umad: Reject negative data_len in ib_umad_write
by Liu Kai 28 Mar '26

28 Mar '26

From: YunJe Shin <yjshin0438(a)gmail.com> stable inclusion from stable-v6.6.128 commit a6a3e4af10993cb9e4b8f0548680aba0ab5f3b0d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13865 CVE: CVE-2026-23243 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5551b02fdbfd85a325bb857f3a8f9c9f33397ed2 upstream. ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80 Fixes: 2be8e3ee8efd ("IB/umad: Add P_Key index support") Signed-off-by: YunJe Shin <ioerts(a)kookmin.ac.kr> Link: https://patch.msgid.link/20260203100628.1215408-1-ioerts@kookmin.ac.kr Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/infiniband/core/user_mad.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c index 2ed749f50a29..285f251fc014 100644 --- a/drivers/infiniband/core/user_mad.c +++ b/drivers/infiniband/core/user_mad.c @@ -514,7 +514,8 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf, struct rdma_ah_attr ah_attr; struct ib_ah *ah; __be64 *tid; - int ret, data_len, hdr_len, copy_offset, rmpp_active; + int ret, hdr_len, copy_offset, rmpp_active; + size_t data_len; u8 base_version; if (count < hdr_size(file) + IB_MGMT_RMPP_HDR) @@ -588,7 +589,10 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf, } base_version = ((struct ib_mad_hdr *)&packet->mad.data)->base_version; - data_len = count - hdr_size(file) - hdr_len; + if (check_sub_overflow(count, hdr_size(file) + hdr_len, &data_len)) { + ret = -EINVAL; + goto err_ah; + } packet->msg = ib_create_send_mad(agent, be32_to_cpu(packet->mad.hdr.qpn), packet->mad.hdr.pkey_index, rmpp_active, -- 2.34.1

2 1

[PATCH OLK-6.6] nvme: fix admin queue leak on controller reset
by Zizhi Wo 28 Mar '26

28 Mar '26

From: Ming Lei <ming.lei(a)redhat.com> stable inclusion from stable-v6.12.77 commit 64f87b96de0e645a4c066c7cffd753f334446db6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13921 CVE: CVE-2026-23360 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d ] When nvme_alloc_admin_tag_set() is called during a controller reset, a previous admin queue may still exist. Release it properly before allocating a new one to avoid orphaning the old queue. This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime"). Cc: Keith Busch <kbusch(a)kernel.org> Fixes: 03b3bcd319b3 ("nvme: fix admin request_queue lifetime"). Reported-and-tested-by: Yi Zhang <yi.zhang(a)redhat.com> Closes: https://lore.kernel.org/linux-block/CAHj4cs9wv3SdPo+N01Fw2SHBYDs9tj2M_e1-Gd… Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/nvme/host/core.c [Commit 9ac4dd8c47d5 ("block: pass a queue_limits argument to blk_mq_init_queue") replace blk_mq_init_queue by blk_mq_alloc_queue to get admin_q.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/nvme/host/core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 2997d0561c39..50de9e76d07d 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -4301,10 +4301,17 @@ int nvme_alloc_admin_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set, set->timeout = NVME_ADMIN_TIMEOUT; ret = blk_mq_alloc_tag_set(set); if (ret) return ret; + /* + * If a previous admin queue exists (e.g., from before a reset), + * put it now before allocating a new one to avoid orphaning it. + */ + if (ctrl->admin_q) + blk_put_queue(ctrl->admin_q); + ctrl->admin_q = blk_mq_init_queue(set); if (IS_ERR(ctrl->admin_q)) { ret = PTR_ERR(ctrl->admin_q); goto out_free_tagset; } -- 2.39.2

2 1

[PATCH OLK-6.6] scsi: target: Fix recursive locking in __configfs_open_file()
by Zizhi Wo 28 Mar '26

28 Mar '26

From: Prithvi Tambewagh <activprithvi(a)gmail.com> stable inclusion from stable-v6.6.130 commit e8ef82cb6443d5f3260b1b830e17f03dda4229ea category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13995 CVE: CVE-2026-23292 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 14d4ac19d1895397532eec407433c5d74d9da53b upstream. In flush_write_buffer, &p->frag_sem is acquired and then the loaded store function is called, which, here, is target_core_item_dbroot_store(). This function called filp_open(), following which these functions were called (in reverse order), according to the call trace: down_read __configfs_open_file do_dentry_open vfs_open do_open path_openat do_filp_open file_open_name filp_open target_core_item_dbroot_store flush_write_buffer configfs_write_iter target_core_item_dbroot_store() tries to validate the new file path by trying to open the file path provided to it; however, in this case, the bug report shows: db_root: not a directory: /sys/kernel/config/target/dbroot indicating that the same configfs file was tried to be opened, on which it is currently working on. Thus, it is trying to acquire frag_sem semaphore of the same file of which it already holds the semaphore obtained in flush_write_buffer(), leading to acquiring the semaphore in a nested manner and a possibility of recursive locking. Fix this by modifying target_core_item_dbroot_store() to use kern_path() instead of filp_open() to avoid opening the file using filesystem-specific function __configfs_open_file(), and further modifying it to make this fix compatible. Reported-by: syzbot+f6e8174215573a84b797(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f6e8174215573a84b797 Tested-by: syzbot+f6e8174215573a84b797(a)syzkaller.appspotmail.com Cc: stable(a)vger.kernel.org Signed-off-by: Prithvi Tambewagh <activprithvi(a)gmail.com> Reviewed-by: Dmitry Bogdanov <d.bogdanov(a)yadro.com> Link: https://patch.msgid.link/20260216062002.61937-1-activprithvi@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/target/target_core_configfs.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c index eddcfd09c05b..f1a0022e5295 100644 --- a/drivers/target/target_core_configfs.c +++ b/drivers/target/target_core_configfs.c @@ -106,12 +106,12 @@ static ssize_t target_core_item_dbroot_show(struct config_item *item, static ssize_t target_core_item_dbroot_store(struct config_item *item, const char *page, size_t count) { ssize_t read_bytes; - struct file *fp; ssize_t r = -EINVAL; + struct path path = {}; mutex_lock(&target_devices_lock); if (target_devices) { pr_err("db_root: cannot be changed because it's in use\n"); goto unlock; @@ -129,21 +129,18 @@ static ssize_t target_core_item_dbroot_store(struct config_item *item, if (db_root_stage[read_bytes - 1] == '\n') db_root_stage[read_bytes - 1] = '\0'; /* validate new db root before accepting it */ - fp = filp_open(db_root_stage, O_RDONLY, 0); - if (IS_ERR(fp)) { + r = kern_path(db_root_stage, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &path); + if (r) { pr_err("db_root: cannot open: %s\n", db_root_stage); + if (r == -ENOTDIR) + pr_err("db_root: not a directory: %s\n", db_root_stage); goto unlock; } - if (!S_ISDIR(file_inode(fp)->i_mode)) { - filp_close(fp, NULL); - pr_err("db_root: not a directory: %s\n", db_root_stage); - goto unlock; - } - filp_close(fp, NULL); + path_put(&path); strncpy(db_root, db_root_stage, read_bytes); pr_debug("Target_Core_ConfigFS: db_root set to %s\n", db_root); r = read_bytes; -- 2.39.2

2 1

[PATCH OLK-6.6 v3 0/2] CVE-2026-23352
by Jinjie Ruan 28 Mar '26

28 Mar '26

CVE-2026-23352 Mike Rapoport (Microsoft) (2): x86/efi: defer freeing of boot services memory x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size arch/x86/include/asm/efi.h | 2 +- arch/x86/platform/efi/efi.c | 2 +- arch/x86/platform/efi/quirks.c | 55 +++++++++++++++++++++++++++-- drivers/firmware/efi/mokvar-table.c | 2 +- 4 files changed, 55 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 v3 0/2] CVE-2026-23352
by Jinjie Ruan 28 Mar '26

28 Mar '26

CVE-2026-23352 Mike Rapoport (Microsoft) (2): x86/efi: defer freeing of boot services memory x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size arch/x86/include/asm/efi.h | 2 +- arch/x86/platform/efi/efi.c | 2 +- arch/x86/platform/efi/quirks.c | 55 +++++++++++++++++++++++++++-- drivers/firmware/efi/mokvar-table.c | 2 +- 4 files changed, 55 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 v2 0/2] *** SUBJECT HERE ***
by Jinjie Ruan 28 Mar '26

28 Mar '26

*** BLURB HERE *** Mike Rapoport (Microsoft) (2): x86/efi: defer freeing of boot services memory x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size arch/x86/include/asm/efi.h | 2 +- arch/x86/platform/efi/efi.c | 2 +- arch/x86/platform/efi/quirks.c | 55 +++++++++++++++++++++++++++-- drivers/firmware/efi/mokvar-table.c | 2 +- 4 files changed, 55 insertions(+), 6 deletions(-) -- 2.34.1

3 5

[PATCH OLK-6.6 v2 0/2] *** SUBJECT HERE ***
by Jinjie Ruan 28 Mar '26

28 Mar '26

*** BLURB HERE *** Mike Rapoport (Microsoft) (2): x86/efi: defer freeing of boot services memory x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size arch/x86/include/asm/efi.h | 2 +- arch/x86/platform/efi/efi.c | 2 +- arch/x86/platform/efi/quirks.c | 55 +++++++++++++++++++++++++++-- drivers/firmware/efi/mokvar-table.c | 2 +- 4 files changed, 55 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] x86/efi: defer freeing of boot services memory
by Jinjie Ruan 28 Mar '26

28 Mar '26

From: "Mike Rapoport (Microsoft)" <rppt(a)kernel.org> stable inclusion from stable-v6.6.130 commit 6a25e25279282c5c8ade554c04c6ab9dc7902c64 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13929 CVE: CVE-2026-23352 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a4b0bf6a40f3c107c67a24fbc614510ef5719980 upstream. efi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE and EFI_BOOT_SERVICES_DATA using memblock_free_late(). There are two issue with that: memblock_free_late() should be used for memory allocated with memblock_alloc() while the memory reserved with memblock_reserve() should be freed with free_reserved_area(). More acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y efi_free_boot_services() is called before deferred initialization of the memory map is complete. Benjamin Herrenschmidt reports that this causes a leak of ~140MB of RAM on EC2 t3a.nano instances which only have 512MB or RAM. If the freed memory resides in the areas that memory map for them is still uninitialized, they won't be actually freed because memblock_free_late() calls memblock_free_pages() and the latter skips uninitialized pages. Using free_reserved_area() at this point is also problematic because __free_page() accesses the buddy of the freed page and that again might end up in uninitialized part of the memory map. Delaying the entire efi_free_boot_services() could be problematic because in addition to freeing boot services memory it updates efi.memmap without any synchronization and that's undesirable late in boot when there is concurrency. More robust approach is to only defer freeing of the EFI boot services memory. Split efi_free_boot_services() in two. First efi_unmap_boot_services() collects ranges that should be freed into an array then efi_free_boot_services() later frees them after deferred init is complete. Link: https://lore.kernel.org/all/ec2aaef14783869b3be6e3c253b2dcbf67dbc12a.camel@… Fixes: 916f676f8dc0 ("x86, efi: Retain boot service code until after switching to virtual mode") Cc: <stable(a)vger.kernel.org> Signed-off-by: Mike Rapoport (Microsoft) <rppt(a)kernel.org> Reviewed-by: Benjamin Herrenschmidt <benh(a)kernel.crashing.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/include/asm/efi.h arch/x86/platform/efi/quirks.c [ context conflict. ] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/x86/include/asm/efi.h | 2 +- arch/x86/platform/efi/efi.c | 2 +- arch/x86/platform/efi/quirks.c | 55 +++++++++++++++++++++++++++-- drivers/firmware/efi/mokvar-table.c | 2 +- 4 files changed, 55 insertions(+), 6 deletions(-) diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h index 2de20f6a765b..fb1c8fded78b 100644 --- a/arch/x86/include/asm/efi.h +++ b/arch/x86/include/asm/efi.h @@ -149,7 +149,7 @@ extern int __init efi_reuse_config(u64 tables, int nr_tables); extern void efi_delete_dummy_variable(void); extern void efi_switch_mm(struct mm_struct *mm); extern void efi_recover_from_page_fault(unsigned long phys_addr); -extern void efi_free_boot_services(void); +extern void efi_unmap_boot_services(void); /* kexec external ABI */ struct efi_setup_data { diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c index 91f8edd50dd7..9f18c5d2a812 100644 --- a/arch/x86/platform/efi/efi.c +++ b/arch/x86/platform/efi/efi.c @@ -793,7 +793,7 @@ static void __init __efi_enter_virtual_mode(void) } efi_check_for_embedded_firmwares(); - efi_free_boot_services(); + efi_unmap_boot_services(); if (!efi_is_mixed()) efi_native_runtime_setup(); diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c index c1eec019dcee..a152d5762400 100644 --- a/arch/x86/platform/efi/quirks.c +++ b/arch/x86/platform/efi/quirks.c @@ -333,7 +333,7 @@ void __init efi_reserve_boot_services(void) /* * Because the following memblock_reserve() is paired - * with memblock_free_late() for this region in + * with free_reserved_area() for this region in * efi_free_boot_services(), we must be extremely * careful not to reserve, and subsequently free, * critical regions of memory (like the kernel image) or @@ -396,17 +396,33 @@ static void __init efi_unmap_pages(efi_memory_desc_t *md) pr_err("Failed to unmap VA mapping for 0x%llx\n", va); } -void __init efi_free_boot_services(void) +struct efi_freeable_range { + u64 start; + u64 end; +}; + +static struct efi_freeable_range *ranges_to_free; + +void __init efi_unmap_boot_services(void) { struct efi_memory_map_data data = { 0 }; efi_memory_desc_t *md; int num_entries = 0; + int idx = 0; + size_t sz; void *new, *new_md; /* Keep all regions for /sys/kernel/debug/efi */ if (efi_enabled(EFI_DBG)) return; + sz = sizeof(*ranges_to_free) * efi.memmap.nr_map + 1; + ranges_to_free = kzalloc(sz, GFP_KERNEL); + if (!ranges_to_free) { + pr_err("Failed to allocate storage for freeable EFI regions\n"); + return; + } + for_each_efi_memory_desc(md) { unsigned long long start = md->phys_addr; unsigned long long size = md->num_pages << EFI_PAGE_SHIFT; @@ -451,7 +467,15 @@ void __init efi_free_boot_services(void) size -= rm_size; } - memblock_free_late(start, size); + /* + * With CONFIG_DEFERRED_STRUCT_PAGE_INIT parts of the memory + * map are still not initialized and we can't reliably free + * memory here. + * Queue the ranges to free at a later point. + */ + ranges_to_free[idx].start = start; + ranges_to_free[idx].end = start + size; + idx++; } if (!num_entries) @@ -492,6 +516,31 @@ void __init efi_free_boot_services(void) } } +static int __init efi_free_boot_services(void) +{ + struct efi_freeable_range *range = ranges_to_free; + unsigned long freed = 0; + + if (!ranges_to_free) + return 0; + + while (range->start) { + void *start = phys_to_virt(range->start); + void *end = phys_to_virt(range->end); + + free_reserved_area(start, end, -1, NULL); + freed += (end - start); + range++; + } + kfree(ranges_to_free); + + if (freed) + pr_info("Freeing EFI boot services memory: %ldK\n", freed / SZ_1K); + + return 0; +} +arch_initcall(efi_free_boot_services); + /* * A number of config table entries get remapped to virtual addresses * after entering EFI virtual mode. However, the kexec kernel requires diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c index 38722d2009e2..4a5c2f823788 100644 --- a/drivers/firmware/efi/mokvar-table.c +++ b/drivers/firmware/efi/mokvar-table.c @@ -85,7 +85,7 @@ static struct kobject *mokvar_kobj; * as an alternative to ordinary EFI variables, due to platform-dependent * limitations. The memory occupied by this table is marked as reserved. * - * This routine must be called before efi_free_boot_services() in order + * This routine must be called before efi_unmap_boot_services() in order * to guarantee that it can mark the table as reserved. * * Implicit inputs: -- 2.34.1

2 1

[PATCH OLK-6.6] x86/efi: defer freeing of boot services memory
by Jinjie Ruan 28 Mar '26

28 Mar '26

From: "Mike Rapoport (Microsoft)" <rppt(a)kernel.org> stable inclusion from stable-v6.6.130 commit 6a25e25279282c5c8ade554c04c6ab9dc7902c64 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13929 CVE: CVE-2026-23352 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a4b0bf6a40f3c107c67a24fbc614510ef5719980 upstream. efi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE and EFI_BOOT_SERVICES_DATA using memblock_free_late(). There are two issue with that: memblock_free_late() should be used for memory allocated with memblock_alloc() while the memory reserved with memblock_reserve() should be freed with free_reserved_area(). More acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y efi_free_boot_services() is called before deferred initialization of the memory map is complete. Benjamin Herrenschmidt reports that this causes a leak of ~140MB of RAM on EC2 t3a.nano instances which only have 512MB or RAM. If the freed memory resides in the areas that memory map for them is still uninitialized, they won't be actually freed because memblock_free_late() calls memblock_free_pages() and the latter skips uninitialized pages. Using free_reserved_area() at this point is also problematic because __free_page() accesses the buddy of the freed page and that again might end up in uninitialized part of the memory map. Delaying the entire efi_free_boot_services() could be problematic because in addition to freeing boot services memory it updates efi.memmap without any synchronization and that's undesirable late in boot when there is concurrency. More robust approach is to only defer freeing of the EFI boot services memory. Split efi_free_boot_services() in two. First efi_unmap_boot_services() collects ranges that should be freed into an array then efi_free_boot_services() later frees them after deferred init is complete. Link: https://lore.kernel.org/all/ec2aaef14783869b3be6e3c253b2dcbf67dbc12a.camel@… Fixes: 916f676f8dc0 ("x86, efi: Retain boot service code until after switching to virtual mode") Cc: <stable(a)vger.kernel.org> Signed-off-by: Mike Rapoport (Microsoft) <rppt(a)kernel.org> Reviewed-by: Benjamin Herrenschmidt <benh(a)kernel.crashing.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/x86/include/asm/efi.h | 2 +- arch/x86/platform/efi/efi.c | 2 +- arch/x86/platform/efi/quirks.c | 55 +++++++++++++++++++++++++++-- drivers/firmware/efi/mokvar-table.c | 2 +- 4 files changed, 55 insertions(+), 6 deletions(-) diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h index a050d329e34b..aaf1e71b067a 100644 --- a/arch/x86/include/asm/efi.h +++ b/arch/x86/include/asm/efi.h @@ -138,7 +138,7 @@ extern void __init efi_apply_memmap_quirks(void); extern int __init efi_reuse_config(u64 tables, int nr_tables); extern void efi_delete_dummy_variable(void); extern void efi_crash_gracefully_on_page_fault(unsigned long phys_addr); -extern void efi_free_boot_services(void); +extern void efi_unmap_boot_services(void); void arch_efi_call_virt_setup(void); void arch_efi_call_virt_teardown(void); diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c index e9f99c56f3ce..55a61aaa3303 100644 --- a/arch/x86/platform/efi/efi.c +++ b/arch/x86/platform/efi/efi.c @@ -860,7 +860,7 @@ static void __init __efi_enter_virtual_mode(void) } efi_check_for_embedded_firmwares(); - efi_free_boot_services(); + efi_unmap_boot_services(); if (!efi_is_mixed()) efi_native_runtime_setup(); diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c index f0cc00032751..df3b45ef1420 100644 --- a/arch/x86/platform/efi/quirks.c +++ b/arch/x86/platform/efi/quirks.c @@ -341,7 +341,7 @@ void __init efi_reserve_boot_services(void) /* * Because the following memblock_reserve() is paired - * with memblock_free_late() for this region in + * with free_reserved_area() for this region in * efi_free_boot_services(), we must be extremely * careful not to reserve, and subsequently free, * critical regions of memory (like the kernel image) or @@ -404,17 +404,33 @@ static void __init efi_unmap_pages(efi_memory_desc_t *md) pr_err("Failed to unmap VA mapping for 0x%llx\n", va); } -void __init efi_free_boot_services(void) +struct efi_freeable_range { + u64 start; + u64 end; +}; + +static struct efi_freeable_range *ranges_to_free; + +void __init efi_unmap_boot_services(void) { struct efi_memory_map_data data = { 0 }; efi_memory_desc_t *md; int num_entries = 0; + int idx = 0; + size_t sz; void *new, *new_md; /* Keep all regions for /sys/kernel/debug/efi */ if (efi_enabled(EFI_DBG)) return; + sz = sizeof(*ranges_to_free) * efi.memmap.nr_map + 1; + ranges_to_free = kzalloc(sz, GFP_KERNEL); + if (!ranges_to_free) { + pr_err("Failed to allocate storage for freeable EFI regions\n"); + return; + } + for_each_efi_memory_desc(md) { unsigned long long start = md->phys_addr; unsigned long long size = md->num_pages << EFI_PAGE_SHIFT; @@ -471,7 +487,15 @@ void __init efi_free_boot_services(void) start = SZ_1M; } - memblock_free_late(start, size); + /* + * With CONFIG_DEFERRED_STRUCT_PAGE_INIT parts of the memory + * map are still not initialized and we can't reliably free + * memory here. + * Queue the ranges to free at a later point. + */ + ranges_to_free[idx].start = start; + ranges_to_free[idx].end = start + size; + idx++; } if (!num_entries) @@ -512,6 +536,31 @@ void __init efi_free_boot_services(void) } } +static int __init efi_free_boot_services(void) +{ + struct efi_freeable_range *range = ranges_to_free; + unsigned long freed = 0; + + if (!ranges_to_free) + return 0; + + while (range->start) { + void *start = phys_to_virt(range->start); + void *end = phys_to_virt(range->end); + + free_reserved_area(start, end, -1, NULL); + freed += (end - start); + range++; + } + kfree(ranges_to_free); + + if (freed) + pr_info("Freeing EFI boot services memory: %ldK\n", freed / SZ_1K); + + return 0; +} +arch_initcall(efi_free_boot_services); + /* * A number of config table entries get remapped to virtual addresses * after entering EFI virtual mode. However, the kexec kernel requires diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c index 4eb0dff4dfaf..bd84a22805b5 100644 --- a/drivers/firmware/efi/mokvar-table.c +++ b/drivers/firmware/efi/mokvar-table.c @@ -85,7 +85,7 @@ static struct kobject *mokvar_kobj; * as an alternative to ordinary EFI variables, due to platform-dependent * limitations. The memory occupied by this table is marked as reserved. * - * This routine must be called before efi_free_boot_services() in order + * This routine must be called before efi_unmap_boot_services() in order * to guarantee that it can mark the table as reserved. * * Implicit inputs: -- 2.34.1

2 1

[PATCH OLK-6.6] regmap: maple: free entry on mas_store_gfp() failure
by Lin Ruifeng 28 Mar '26

28 Mar '26

From: Kaushlendra Kumar <kaushlendra.kumar(a)intel.com> stable inclusion from stable-v6.6.124 commit d61171cf097156030142643942c217759a9cc806 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13884 CVE: CVE-2026-23260 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f3f380ce6b3d5c9805c7e0b3d5bc28d9ec41e2e8 ] regcache_maple_write() allocates a new block ('entry') to merge adjacent ranges and then stores it with mas_store_gfp(). When mas_store_gfp() fails, the new 'entry' remains allocated and is never freed, leaking memory. Free 'entry' on the failure path; on success continue freeing the replaced neighbor blocks ('lower', 'upper'). Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar(a)intel.com> Link: https://patch.msgid.link/20260105031820.260119-1-kaushlendra.kumar@intel.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/base/regmap/regcache-maple.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/base/regmap/regcache-maple.c b/drivers/base/regmap/regcache-maple.c index fb5761a5ef6e..86de71ce2c19 100644 --- a/drivers/base/regmap/regcache-maple.c +++ b/drivers/base/regmap/regcache-maple.c @@ -96,12 +96,13 @@ static int regcache_maple_write(struct regmap *map, unsigned int reg, mas_unlock(&mas); - if (ret == 0) { - kfree(lower); - kfree(upper); + if (ret) { + kfree(entry); + return ret; } - - return ret; + kfree(lower); + kfree(upper); + return 0; } static int regcache_maple_drop(struct regmap *map, unsigned int min, -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] bpf: Fix NULL event->prog pointer access in bpf_overflow_handler
by Pu Lehui 27 Mar '26

27 Mar '26

From: Yonghong Song <yhs(a)fb.com> mainline inclusion from mainline-v5.15-rc1 commit 594286b7574c6e8217b1c233cc0d0650f2268a77 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Andrii reported that libbpf CI hit the following oops when running selftest send_signal: [ 1243.160719] BUG: kernel NULL pointer dereference, address: 0000000000000030 [ 1243.161066] #PF: supervisor read access in kernel mode [ 1243.161066] #PF: error_code(0x0000) - not-present page [ 1243.161066] PGD 0 P4D 0 [ 1243.161066] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 1243.161066] CPU: 1 PID: 882 Comm: new_name Tainted: G O 5.14.0-rc5 #1 [ 1243.161066] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 1243.161066] RIP: 0010:bpf_overflow_handler+0x9a/0x1e0 [ 1243.161066] Code: 5a 84 c0 0f 84 06 01 00 00 be 66 02 00 00 48 c7 c7 6d 96 07 82 48 8b ab 18 05 00 00 e8 df 55 eb ff 66 90 48 8d 75 48 48 89 e7 <ff> 55 30 41 89 c4 e8 fb c1 f0 ff 84 c0 0f 84 94 00 00 00 e8 6e 0f [ 1243.161066] RSP: 0018:ffffc900000c0d80 EFLAGS: 00000046 [ 1243.161066] RAX: 0000000000000002 RBX: ffff8881002e0dd0 RCX: 00000000b4b47cf8 [ 1243.161066] RDX: ffffffff811dcb06 RSI: 0000000000000048 RDI: ffffc900000c0d80 [ 1243.161066] RBP: 0000000000000000 R08: 0000000000000000 R09: 1a9d56bb00000000 [ 1243.161066] R10: 0000000000000001 R11: 0000000000080000 R12: 0000000000000000 [ 1243.161066] R13: ffffc900000c0e00 R14: ffffc900001c3c68 R15: 0000000000000082 [ 1243.161066] FS: 00007fc0be2d3380(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 [ 1243.161066] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1243.161066] CR2: 0000000000000030 CR3: 0000000104f8e000 CR4: 00000000000006e0 [ 1243.161066] Call Trace: [ 1243.161066] <IRQ> [ 1243.161066] __perf_event_overflow+0x4f/0xf0 [ 1243.161066] perf_swevent_hrtimer+0x116/0x130 [ 1243.161066] ? __lock_acquire+0x378/0x2730 [ 1243.161066] ? __lock_acquire+0x372/0x2730 [ 1243.161066] ? lock_is_held_type+0xd5/0x130 [ 1243.161066] ? find_held_lock+0x2b/0x80 [ 1243.161066] ? lock_is_held_type+0xd5/0x130 [ 1243.161066] ? perf_event_groups_first+0x80/0x80 [ 1243.161066] ? perf_event_groups_first+0x80/0x80 [ 1243.161066] __hrtimer_run_queues+0x1a3/0x460 [ 1243.161066] hrtimer_interrupt+0x110/0x220 [ 1243.161066] __sysvec_apic_timer_interrupt+0x8a/0x260 [ 1243.161066] sysvec_apic_timer_interrupt+0x89/0xc0 [ 1243.161066] </IRQ> [ 1243.161066] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1243.161066] RIP: 0010:finish_task_switch+0xaf/0x250 [ 1243.161066] Code: 31 f6 68 90 2a 09 81 49 8d 7c 24 18 e8 aa d6 03 00 4c 89 e7 e8 12 ff ff ff 4c 89 e7 e8 ca 9c 80 00 e8 35 af 0d 00 fb 4d 85 f6 <58> 74 1d 65 48 8b 04 25 c0 6d 01 00 4c 3b b0 a0 04 00 00 74 37 f0 [ 1243.161066] RSP: 0018:ffffc900001c3d18 EFLAGS: 00000282 [ 1243.161066] RAX: 000000000000031f RBX: ffff888104cf4980 RCX: 0000000000000000 [ 1243.161066] RDX: 0000000000000000 RSI: ffffffff82095460 RDI: ffffffff820adc4e [ 1243.161066] RBP: ffffc900001c3d58 R08: 0000000000000001 R09: 0000000000000001 [ 1243.161066] R10: 0000000000000001 R11: 0000000000080000 R12: ffff88813bd2bc80 [ 1243.161066] R13: ffff8881002e8000 R14: ffff88810022ad80 R15: 0000000000000000 [ 1243.161066] ? finish_task_switch+0xab/0x250 [ 1243.161066] ? finish_task_switch+0x70/0x250 [ 1243.161066] __schedule+0x36b/0xbb0 [ 1243.161066] ? _raw_spin_unlock_irqrestore+0x2d/0x50 [ 1243.161066] ? lockdep_hardirqs_on+0x79/0x100 [ 1243.161066] schedule+0x43/0xe0 [ 1243.161066] pipe_read+0x30b/0x450 [ 1243.161066] ? wait_woken+0x80/0x80 [ 1243.161066] new_sync_read+0x164/0x170 [ 1243.161066] vfs_read+0x122/0x1b0 [ 1243.161066] ksys_read+0x93/0xd0 [ 1243.161066] do_syscall_64+0x35/0x80 [ 1243.161066] entry_SYSCALL_64_after_hwframe+0x44/0xae The oops can also be reproduced with the following steps: ./vmtest.sh -s # at qemu shell cd /root/bpf && while true; do ./test_progs -t send_signal Further analysis showed that the failure is introduced with commit b89fbfbb854c ("bpf: Implement minimal BPF perf link"). With the above commit, the following scenario becomes possible: cpu1 cpu2 hrtimer_interrupt -> bpf_overflow_handler (due to closing link_fd) bpf_perf_link_release -> perf_event_free_bpf_prog -> perf_event_free_bpf_handler -> WRITE_ONCE(event->overflow_handler, event->orig_overflow_handler) event->prog = NULL bpf_prog_run(event->prog, &ctx) In the above case, the event->prog is NULL for bpf_prog_run, hence causing oops. To fix the issue, check whether event->prog is NULL or not. If it is, do not call bpf_prog_run. This seems working as the above reproducible step runs more than one hour and I didn't see any failures. Fixes: b89fbfbb854c ("bpf: Implement minimal BPF perf link") Signed-off-by: Yonghong Song <yhs(a)fb.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20210819155209.1927994-1-yhs@fb.com Conflicts: kernel/events/core.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/events/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index ff875ddf4aeb..372450750559 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -8747,6 +8747,7 @@ static void bpf_overflow_handler(struct perf_event *event, .data = data, .event = event, }; + struct bpf_prog *prog; int ret = 0; ctx.regs = perf_arch_bpf_user_pt_regs(regs); @@ -8754,7 +8755,9 @@ static void bpf_overflow_handler(struct perf_event *event, if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) goto out; rcu_read_lock(); - ret = BPF_PROG_RUN(event->prog, &ctx); + prog = READ_ONCE(event->prog); + if (prog) + ret = BPF_PROG_RUN(prog, &ctx); rcu_read_unlock(); out: __this_cpu_dec(bpf_prog_active); -- 2.34.1

2 1

[PATCH OLK-5.10] bpf: Fix NULL event->prog pointer access in bpf_overflow_handler
by Pu Lehui 27 Mar '26

27 Mar '26

From: Yonghong Song <yhs(a)fb.com> mainline inclusion from mainline-v5.15-rc1 commit 594286b7574c6e8217b1c233cc0d0650f2268a77 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Andrii reported that libbpf CI hit the following oops when running selftest send_signal: [ 1243.160719] BUG: kernel NULL pointer dereference, address: 0000000000000030 [ 1243.161066] #PF: supervisor read access in kernel mode [ 1243.161066] #PF: error_code(0x0000) - not-present page [ 1243.161066] PGD 0 P4D 0 [ 1243.161066] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 1243.161066] CPU: 1 PID: 882 Comm: new_name Tainted: G O 5.14.0-rc5 #1 [ 1243.161066] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 1243.161066] RIP: 0010:bpf_overflow_handler+0x9a/0x1e0 [ 1243.161066] Code: 5a 84 c0 0f 84 06 01 00 00 be 66 02 00 00 48 c7 c7 6d 96 07 82 48 8b ab 18 05 00 00 e8 df 55 eb ff 66 90 48 8d 75 48 48 89 e7 <ff> 55 30 41 89 c4 e8 fb c1 f0 ff 84 c0 0f 84 94 00 00 00 e8 6e 0f [ 1243.161066] RSP: 0018:ffffc900000c0d80 EFLAGS: 00000046 [ 1243.161066] RAX: 0000000000000002 RBX: ffff8881002e0dd0 RCX: 00000000b4b47cf8 [ 1243.161066] RDX: ffffffff811dcb06 RSI: 0000000000000048 RDI: ffffc900000c0d80 [ 1243.161066] RBP: 0000000000000000 R08: 0000000000000000 R09: 1a9d56bb00000000 [ 1243.161066] R10: 0000000000000001 R11: 0000000000080000 R12: 0000000000000000 [ 1243.161066] R13: ffffc900000c0e00 R14: ffffc900001c3c68 R15: 0000000000000082 [ 1243.161066] FS: 00007fc0be2d3380(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 [ 1243.161066] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1243.161066] CR2: 0000000000000030 CR3: 0000000104f8e000 CR4: 00000000000006e0 [ 1243.161066] Call Trace: [ 1243.161066] <IRQ> [ 1243.161066] __perf_event_overflow+0x4f/0xf0 [ 1243.161066] perf_swevent_hrtimer+0x116/0x130 [ 1243.161066] ? __lock_acquire+0x378/0x2730 [ 1243.161066] ? __lock_acquire+0x372/0x2730 [ 1243.161066] ? lock_is_held_type+0xd5/0x130 [ 1243.161066] ? find_held_lock+0x2b/0x80 [ 1243.161066] ? lock_is_held_type+0xd5/0x130 [ 1243.161066] ? perf_event_groups_first+0x80/0x80 [ 1243.161066] ? perf_event_groups_first+0x80/0x80 [ 1243.161066] __hrtimer_run_queues+0x1a3/0x460 [ 1243.161066] hrtimer_interrupt+0x110/0x220 [ 1243.161066] __sysvec_apic_timer_interrupt+0x8a/0x260 [ 1243.161066] sysvec_apic_timer_interrupt+0x89/0xc0 [ 1243.161066] </IRQ> [ 1243.161066] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1243.161066] RIP: 0010:finish_task_switch+0xaf/0x250 [ 1243.161066] Code: 31 f6 68 90 2a 09 81 49 8d 7c 24 18 e8 aa d6 03 00 4c 89 e7 e8 12 ff ff ff 4c 89 e7 e8 ca 9c 80 00 e8 35 af 0d 00 fb 4d 85 f6 <58> 74 1d 65 48 8b 04 25 c0 6d 01 00 4c 3b b0 a0 04 00 00 74 37 f0 [ 1243.161066] RSP: 0018:ffffc900001c3d18 EFLAGS: 00000282 [ 1243.161066] RAX: 000000000000031f RBX: ffff888104cf4980 RCX: 0000000000000000 [ 1243.161066] RDX: 0000000000000000 RSI: ffffffff82095460 RDI: ffffffff820adc4e [ 1243.161066] RBP: ffffc900001c3d58 R08: 0000000000000001 R09: 0000000000000001 [ 1243.161066] R10: 0000000000000001 R11: 0000000000080000 R12: ffff88813bd2bc80 [ 1243.161066] R13: ffff8881002e8000 R14: ffff88810022ad80 R15: 0000000000000000 [ 1243.161066] ? finish_task_switch+0xab/0x250 [ 1243.161066] ? finish_task_switch+0x70/0x250 [ 1243.161066] __schedule+0x36b/0xbb0 [ 1243.161066] ? _raw_spin_unlock_irqrestore+0x2d/0x50 [ 1243.161066] ? lockdep_hardirqs_on+0x79/0x100 [ 1243.161066] schedule+0x43/0xe0 [ 1243.161066] pipe_read+0x30b/0x450 [ 1243.161066] ? wait_woken+0x80/0x80 [ 1243.161066] new_sync_read+0x164/0x170 [ 1243.161066] vfs_read+0x122/0x1b0 [ 1243.161066] ksys_read+0x93/0xd0 [ 1243.161066] do_syscall_64+0x35/0x80 [ 1243.161066] entry_SYSCALL_64_after_hwframe+0x44/0xae The oops can also be reproduced with the following steps: ./vmtest.sh -s # at qemu shell cd /root/bpf && while true; do ./test_progs -t send_signal Further analysis showed that the failure is introduced with commit b89fbfbb854c ("bpf: Implement minimal BPF perf link"). With the above commit, the following scenario becomes possible: cpu1 cpu2 hrtimer_interrupt -> bpf_overflow_handler (due to closing link_fd) bpf_perf_link_release -> perf_event_free_bpf_prog -> perf_event_free_bpf_handler -> WRITE_ONCE(event->overflow_handler, event->orig_overflow_handler) event->prog = NULL bpf_prog_run(event->prog, &ctx) In the above case, the event->prog is NULL for bpf_prog_run, hence causing oops. To fix the issue, check whether event->prog is NULL or not. If it is, do not call bpf_prog_run. This seems working as the above reproducible step runs more than one hour and I didn't see any failures. Fixes: b89fbfbb854c ("bpf: Implement minimal BPF perf link") Signed-off-by: Yonghong Song <yhs(a)fb.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20210819155209.1927994-1-yhs@fb.com Conflicts: kernel/events/core.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/events/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index d1ffd5fb9c6f..a46f2cefc031 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -9728,13 +9728,16 @@ static void bpf_overflow_handler(struct perf_event *event, .data = data, .event = event, }; + struct bpf_prog *prog; int ret = 0; ctx.regs = perf_arch_bpf_user_pt_regs(regs); if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) goto out; rcu_read_lock(); - ret = BPF_PROG_RUN(event->prog, &ctx); + prog = READ_ONCE(event->prog); + if (prog) + ret = BPF_PROG_RUN(prog, &ctx); rcu_read_unlock(); out: __this_cpu_dec(bpf_prog_active); -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] CVE-2026-23320
by Jinjie Ruan 27 Mar '26

27 Mar '26

CVE-2026-23320 Christian Brauner (1): file: add take_fd() cleanup helper Kuen-Han Tsai (1): usb: gadget: f_ncm: Fix net_device lifecycle with device_move Peter Zijlstra (1): cleanup: Make no_free_ptr() __must_check Thomas Gleixner (1): cleanup: Provide retain_and_null_ptr() drivers/usb/gadget/function/f_ncm.c | 35 ++++++++++----- drivers/usb/gadget/function/u_ether.c | 22 ++++++++++ drivers/usb/gadget/function/u_ether.h | 26 ++++++++++++ drivers/usb/gadget/function/u_ncm.h | 2 +- include/linux/cleanup.h | 61 +++++++++++++++++++++++++-- include/linux/file.h | 20 +++++++++ 6 files changed, 151 insertions(+), 15 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/2] fix queue start/stop imbalance under race
by Zheng Qixing 27 Mar '26

27 Mar '26

Zheng Qixing (2): dm: fix queue start/stop imbalance under suspend/load/resume races dm: fix queue start/stop imbalance under remove/resume races drivers/md/dm-core.h | 1 + drivers/md/dm.c | 11 ++++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 0/2] fix queue start/stop imbalance under race
by Zheng Qixing 27 Mar '26

27 Mar '26

Zheng Qixing (2): dm: fix queue start/stop imbalance under suspend/load/resume races dm: fix queue start/stop imbalance under remove/resume races drivers/md/dm-core.h | 1 + drivers/md/dm.c | 11 ++++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 0/2] CVE-2026-23296
by Li Lingfeng 27 Mar '26

27 Mar '26

Junxiao Bi (2): scsi: core: Fix refcount leak for tagset_refcnt scsi: core: Fix error handling for scsi_alloc_sdev() drivers/scsi/scsi_scan.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 0/2] fix queue start/stop imbalance under race
by Zheng Qixing 27 Mar '26

27 Mar '26

Zheng Qixing (2): dm: fix queue start/stop imbalance under suspend/load/resume races dm: fix queue start/stop imbalance under remove/resume races drivers/md/dm-core.h | 1 + drivers/md/dm.c | 11 ++++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 0/2] fix queue start/stop imbalance under race
by Zheng Qixing 27 Mar '26

27 Mar '26

Zheng Qixing (2): dm: fix queue start/stop imbalance under suspend/load/resume races dm: fix queue start/stop imbalance under remove/resume races drivers/md/dm-core.h | 1 + drivers/md/dm.c | 11 ++++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] wifi: prevent A-MSDU attacks in mesh networks
by Zhang Yuwei 27 Mar '26

27 Mar '26

From: Mathy Vanhoef <Mathy.Vanhoef(a)kuleuven.be> stable inclusion from stable-v6.6.99 commit ec6392061de6681148b63ee6c8744da833498cdd category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICTWCN Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 737bb912ebbe4571195c56eba557c4d7315b26fb upstream. This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, in response to the FragAttacks, missed this case (CVE-2025-27558). It can be considered a variant of CVE-2020-24588 but for mesh networks. This patch tries to detect if a standard MSDU was turned into an A-MSDU by an adversary. This is done by parsing a received A-MSDU as a standard MSDU, calculating the length of the Mesh Control header, and seeing if the 6 bytes after this header equal the start of an rfc1042 header. If equal, this is a strong indication of an ongoing attack attempt. This defense was tested with mac80211_hwsim against a mesh network that uses an empty Mesh Address Extension field, i.e., when four addresses are used, and when using a 12-byte Mesh Address Extension field, i.e., when six addresses are used. Functionality of normal MSDUs and A-MSDUs was also tested, and confirmed working, when using both an empty and 12-byte Mesh Address Extension field. It was also tested with mac80211_hwsim that A-MSDU attacks in non-mesh networks keep being detected and prevented. Note that the vulnerability being patched, and the defense being implemented, was also discussed in the following paper and in the following IEEE 802.11 presentation: https://papers.mathyvanhoef.com/wisec2025.pdf https://mentor.ieee.org/802.11/dcn/25/11-25-0949-00-000m-a-msdu-mesh-spoof-… Cc: stable(a)vger.kernel.org Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef(a)kuleuven.be> Link: https://patch.msgid.link/20250616004635.224344-1-Mathy.Vanhoef@kuleuven.be Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/wireless/util.c | 51 +++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 49 insertions(+), 2 deletions(-) diff --git a/net/wireless/util.c b/net/wireless/util.c index 4e81210e5b24..dcca1b882455 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -623,6 +623,51 @@ __ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen, return frame; } +/* + * Detects if an MSDU frame was maliciously converted into an A-MSDU + * frame by an adversary. This is done by parsing the received frame + * as if it were a regular MSDU, even though the A-MSDU flag is set. + * + * For non-mesh interfaces, detection involves checking whether the + * payload, when interpreted as an MSDU, begins with a valid RFC1042 + * header. This is done by comparing the A-MSDU subheader's destination + * address to the start of the RFC1042 header. + * + * For mesh interfaces, the MSDU includes a 6-byte Mesh Control field + * and an optional variable-length Mesh Address Extension field before + * the RFC1042 header. The position of the RFC1042 header must therefore + * be calculated based on the mesh header length. + * + * Since this function intentionally parses an A-MSDU frame as an MSDU, + * it only assumes that the A-MSDU subframe header is present, and + * beyond this it performs its own bounds checks under the assumption + * that the frame is instead parsed as a non-aggregated MSDU. + */ +static bool +is_amsdu_aggregation_attack(struct ethhdr *eth, struct sk_buff *skb, + enum nl80211_iftype iftype) +{ + int offset; + + /* Non-mesh case can be directly compared */ + if (iftype != NL80211_IFTYPE_MESH_POINT) + return ether_addr_equal(eth->h_dest, rfc1042_header); + + offset = __ieee80211_get_mesh_hdrlen(eth->h_dest[0]); + if (offset == 6) { + /* Mesh case with empty address extension field */ + return ether_addr_equal(eth->h_source, rfc1042_header); + } else if (offset + ETH_ALEN <= skb->len) { + /* Mesh case with non-empty address extension field */ + u8 temp[ETH_ALEN]; + + skb_copy_bits(skb, offset, temp, ETH_ALEN); + return ether_addr_equal(temp, rfc1042_header); + } + + return false; +} + void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, const u8 *addr, enum nl80211_iftype iftype, const unsigned int extra_headroom, @@ -655,8 +700,10 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, /* the last MSDU has no padding */ if (subframe_len > remaining) goto purge; - /* mitigate A-MSDU aggregation injection attacks */ - if (ether_addr_equal(eth.h_dest, rfc1042_header)) + /* mitigate A-MSDU aggregation injection attacks, to be + * checked when processing first subframe (offset == 0). + */ + if (offset == 0 && is_amsdu_aggregation_attack(&hdr.eth, skb, iftype)) goto purge; offset += sizeof(struct ethhdr); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] RDMA/umad: Reject negative data_len in ib_umad_write
by Liu Kai 27 Mar '26

27 Mar '26

From: YunJe Shin <yjshin0438(a)gmail.com> mainline inclusion from mainline-v7.0-rc1 commit 5551b02fdbfd85a325bb857f3a8f9c9f33397ed2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13865 CVE: CVE-2026-23243 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80 Fixes: 2be8e3ee8efd ("IB/umad: Add P_Key index support") Signed-off-by: YunJe Shin <ioerts(a)kookmin.ac.kr> Link: https://patch.msgid.link/20260203100628.1215408-1-ioerts@kookmin.ac.kr Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/core/user_mad.c [add type casting in check_sub_overflow()] Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/infiniband/core/user_mad.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c index b37aada92a62a..5d51794b69d46 100644 --- a/drivers/infiniband/core/user_mad.c +++ b/drivers/infiniband/core/user_mad.c @@ -486,7 +486,8 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf, struct ib_ah *ah; struct ib_rmpp_mad *rmpp_mad; __be64 *tid; - int ret, data_len, hdr_len, copy_offset, rmpp_active; + int ret, hdr_len, copy_offset, rmpp_active; + size_t data_len; u8 base_version; if (count < hdr_size(file) + IB_MGMT_RMPP_HDR) @@ -557,7 +558,11 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf, } base_version = ((struct ib_mad_hdr *)&packet->mad.data)->base_version; - data_len = count - hdr_size(file) - hdr_len; + if (check_sub_overflow(count, (size_t) (hdr_size(file) + hdr_len), + &data_len)) { + ret = -EINVAL; + goto err_ah; + } packet->msg = ib_create_send_mad(agent, be32_to_cpu(packet->mad.hdr.qpn), packet->mad.hdr.pkey_index, rmpp_active, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/umad: Reject negative data_len in ib_umad_write
by Liu Kai 26 Mar '26

26 Mar '26

From: YunJe Shin <yjshin0438(a)gmail.com> stable inclusion from mainline-v7.0-rc1 commit 5551b02fdbfd85a325bb857f3a8f9c9f33397ed2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13865 CVE: CVE-2026-23243 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80 Fixes: 2be8e3ee8efd ("IB/umad: Add P_Key index support") Signed-off-by: YunJe Shin <ioerts(a)kookmin.ac.kr> Link: https://patch.msgid.link/20260203100628.1215408-1-ioerts@kookmin.ac.kr Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/core/user_mad.c [add type casting in check_sub_overflow()] Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/infiniband/core/user_mad.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c index b37aada92a62a..5d51794b69d46 100644 --- a/drivers/infiniband/core/user_mad.c +++ b/drivers/infiniband/core/user_mad.c @@ -486,7 +486,8 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf, struct ib_ah *ah; struct ib_rmpp_mad *rmpp_mad; __be64 *tid; - int ret, data_len, hdr_len, copy_offset, rmpp_active; + int ret, hdr_len, copy_offset, rmpp_active; + size_t data_len; u8 base_version; if (count < hdr_size(file) + IB_MGMT_RMPP_HDR) @@ -557,7 +558,11 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf, } base_version = ((struct ib_mad_hdr *)&packet->mad.data)->base_version; - data_len = count - hdr_size(file) - hdr_len; + if (check_sub_overflow(count, (size_t) (hdr_size(file) + hdr_len), + &data_len)) { + ret = -EINVAL; + goto err_ah; + } packet->msg = ib_create_send_mad(agent, be32_to_cpu(packet->mad.hdr.qpn), packet->mad.hdr.pkey_index, rmpp_active, -- 2.34.1

2 2

[PATCH OLK-5.10] ext4: fix memory leak in ext4_ext_shift_extents()
by Yongjian Sun 26 Mar '26

26 Mar '26

From: Zilin Guan <zilin(a)seu.edu.cn> mainline inclusion from mainline-v7.0-rc1 commit ca81109d4a8f192dc1cbad4a1ee25246363c2833 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In ext4_ext_shift_extents(), if the extent is NULL in the while loop, the function returns immediately without releasing the path obtained via ext4_find_extent(), leading to a memory leak. Fix this by jumping to the out label to ensure the path is properly released. Fixes: a18ed359bdddc ("ext4: always check ext4_ext_find_extent result") Signed-off-by: Zilin Guan <zilin(a)seu.edu.cn> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Link: https://patch.msgid.link/20251225084800.905701-1-zilin@seu.edu.cn Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Cc: stable(a)kernel.org Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/extents.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index ceca82a0fd5c..786701524736 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -5278,7 +5278,8 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, if (!extent) { EXT4_ERROR_INODE(inode, "unexpected hole at %lu", (unsigned long) *iterator); - return -EFSCORRUPTED; + ret = -EFSCORRUPTED; + goto out; } if (SHIFT == SHIFT_LEFT && *iterator > le32_to_cpu(extent->ee_block)) { -- 2.39.2

2 1

[PATCH OLK-6.6] quota: fix livelock between quotactl and freeze_super
by Yongjian Sun 26 Mar '26

26 Mar '26

From: Abhishek Bapat <abhishekbapat(a)google.com> mainline inclusion from mainline-v7.0-rc1 commit 77449e453dfc006ad738dec55374c4cbc056fd39 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a filesystem is frozen, quotactl_block() enters a retry loop waiting for the filesystem to thaw. It acquires s_umount, checks the freeze state, drops s_umount and uses sb_start_write() - sb_end_write() pair to wait for the unfreeze. However, this retry loop can trigger a livelock issue, specifically on kernels with preemption disabled. The mechanism is as follows: 1. freeze_super() sets SB_FREEZE_WRITE and calls sb_wait_write(). 2. sb_wait_write() calls percpu_down_write(), which initiates synchronize_rcu(). 3. Simultaneously, quotactl_block() spins in its retry loop, immediately executing the sb_start_write() - sb_end_write() pair. 4. Because the kernel is non-preemptible and the loop contains no scheduling points, quotactl_block() never yields the CPU. This prevents that CPU from reaching an RCU quiescent state. 5. synchronize_rcu() in the freezer thread waits indefinitely for the quotactl_block() CPU to report a quiescent state. 6. quotactl_block() spins indefinitely waiting for the freezer to advance, which it cannot do as it is blocked on the RCU sync. This results in a hang of the freezer process and 100% CPU usage by the quota process. While this can occur intermittently on multi-core systems, it is reliably reproducing on a node with the following script, running both the freezer and the quota toggle on the same CPU: # mkfs.ext4 -O quota /dev/sda 2g && mkdir a_mount # mount /dev/sda -o quota,usrquota,grpquota a_mount # taskset -c 3 bash -c "while true; do xfs_freeze -f a_mount; \ xfs_freeze -u a_mount; done" & # taskset -c 3 bash -c "while true; do quotaon a_mount; \ quotaoff a_mount; done" & Adding cond_resched() to the retry loop fixes the issue. It acts as an RCU quiescent state, allowing synchronize_rcu() in percpu_down_write() to complete. Fixes: 576215cffdef ("fs: Drop wait_unfrozen wait queue") Signed-off-by: Abhishek Bapat <abhishekbapat(a)google.com> Link: https://patch.msgid.link/20260115213103.1089129-1-abhishekbapat@google.com Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/quota/quota.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/quota/quota.c b/fs/quota/quota.c index 0e41fb84060f..5be53cae2c95 100644 --- a/fs/quota/quota.c +++ b/fs/quota/quota.c @@ -899,6 +899,7 @@ static struct super_block *quotactl_block(const char __user *special, int cmd) sb_start_write(sb); sb_end_write(sb); put_super(sb); + cond_resched(); goto retry; } return sb; -- 2.39.2

2 1

[PATCH OLK-6.6] ext4: fix dirtyclusters double decrement on fs shutdown
by Yongjian Sun 26 Mar '26

26 Mar '26

From: Brian Foster <bfoster(a)redhat.com> mainline inclusion from mainline-v7.0-rc1 commit 94a8cea54cd935c54fa2fba70354757c0fc245e3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- fstests test generic/388 occasionally reproduces a warning in ext4_put_super() associated with the dirty clusters count: WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4] Tracing the failure shows that the warning fires due to an s_dirtyclusters_counter value of -1. IOW, this appears to be a spurious decrement as opposed to some sort of leak. Further tracing of the dirty cluster count deltas and an LLM scan of the resulting output identified the cause as a double decrement in the error path between ext4_mb_mark_diskspace_used() and the caller ext4_mb_new_blocks(). First, note that generic/388 is a shutdown vs. fsstress test and so produces a random set of operations and shutdown injections. In the problematic case, the shutdown triggers an error return from the ext4_handle_dirty_metadata() call(s) made from ext4_mb_mark_context(). The changed value is non-zero at this point, so ext4_mb_mark_diskspace_used() does not exit after the error bubbles up from ext4_mb_mark_context(). Instead, the former decrements both cluster counters and returns the error up to ext4_mb_new_blocks(). The latter falls into the !ar->len out path which decrements the dirty clusters counter a second time, creating the inconsistency. To avoid this problem and simplify ownership of the cluster reservation in this codepath, lift the counter reduction to a single place in the caller. This makes it more clear that ext4_mb_new_blocks() is responsible for acquiring cluster reservation (via ext4_claim_free_clusters()) in the !delalloc case as well as releasing it, regardless of whether it ends up consumed or returned due to failure. Fixes: 0087d9fb3f29 ("ext4: Fix s_dirty_blocks_counter if block allocation failed with nodelalloc") Signed-off-by: Brian Foster <bfoster(a)redhat.com> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Link: https://patch.msgid.link/20260113171905.118284-1-bfoster@redhat.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Cc: stable(a)kernel.org Conflicts: fs/ext4/mballoc-test.c fs/ext4/mballoc.c [mainline 2f94711b098b & 7c9fa399a369 not applied] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/mballoc.c | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index ba5a8f2c7bff..81c3ba818aca 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -4071,8 +4071,7 @@ void ext4_exit_mballoc(void) * Returns 0 if success or error code */ static noinline_for_stack int -ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac, - handle_t *handle, unsigned int reserv_clstrs) +ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac, handle_t *handle) { struct buffer_head *bitmap_bh = NULL; struct ext4_group_desc *gdp; @@ -4158,13 +4157,6 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac, ext4_unlock_group(sb, ac->ac_b_ex.fe_group); percpu_counter_sub(&sbi->s_freeclusters_counter, ac->ac_b_ex.fe_len); - /* - * Now reduce the dirty block count also. Should not go negative - */ - if (!(ac->ac_flags & EXT4_MB_DELALLOC_RESERVED)) - /* release all the reserved blocks if non delalloc */ - percpu_counter_sub(&sbi->s_dirtyclusters_counter, - reserv_clstrs); if (sbi->s_log_groups_per_flex) { ext4_group_t flex_group = ext4_flex_group(sbi, @@ -6402,7 +6394,7 @@ ext4_fsblk_t ext4_mb_new_blocks(handle_t *handle, ext4_mb_pa_put_free(ac); } if (likely(ac->ac_status == AC_STATUS_FOUND)) { - *errp = ext4_mb_mark_diskspace_used(ac, handle, reserv_clstrs); + *errp = ext4_mb_mark_diskspace_used(ac, handle); if (*errp) { ext4_discard_allocated_blocks(ac); goto errout; @@ -6433,12 +6425,9 @@ ext4_fsblk_t ext4_mb_new_blocks(handle_t *handle, out: if (inquota && ar->len < inquota) dquot_free_block(ar->inode, EXT4_C2B(sbi, inquota - ar->len)); - if (!ar->len) { - if ((ar->flags & EXT4_MB_DELALLOC_RESERVED) == 0) - /* release all the reserved blocks if non delalloc */ - percpu_counter_sub(&sbi->s_dirtyclusters_counter, - reserv_clstrs); - } + /* release any reserved blocks */ + if (reserv_clstrs) + percpu_counter_sub(&sbi->s_dirtyclusters_counter, reserv_clstrs); trace_ext4_allocate_blocks(ar, (unsigned long long)block); -- 2.39.2

2 1

[PATCH OLK-6.6] fat: avoid parent link count underflow in rmdir
by Yongjian Sun 26 Mar '26

26 Mar '26

From: Zhiyu Zhang <zhiyuzhang999(a)gmail.com> mainline inclusion from mainline-v7.0-rc1 commit 8cafcb881364af5ef3a8b9fed4db254054033d8a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Corrupted FAT images can leave a directory inode with an incorrect i_nlink (e.g. 2 even though subdirectories exist). rmdir then unconditionally calls drop_nlink(dir) and can drive i_nlink to 0, triggering the WARN_ON in drop_nlink(). Add a sanity check in vfat_rmdir() and msdos_rmdir(): only drop the parent link count when it is at least 3, otherwise report a filesystem error. Link: https://lkml.kernel.org/r/20260101111148.1437-1-zhiyuzhang999@gmail.com Fixes: 9a53c3a783c2 ("[PATCH] r/o bind mounts: unlink: monitor i_nlink") Signed-off-by: Zhiyu Zhang <zhiyuzhang999(a)gmail.com> Reported-by: Zhiyu Zhang <zhiyuzhang999(a)gmail.com> Closes: https://lore.kernel.org/linux-fsdevel/aVN06OKsKxZe6-Kv@casper.infradead.org… Tested-by: Zhiyu Zhang <zhiyuzhang999(a)gmail.com> Acked-by: OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Christian Brauner <brauner(a)kernel.org> Cc: Jan Kara <jack(a)suse.cz> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/fat/namei_msdos.c | 7 ++++++- fs/fat/namei_vfat.c | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/fs/fat/namei_msdos.c b/fs/fat/namei_msdos.c index 2116c486843b..e189fbf95fca 100644 --- a/fs/fat/namei_msdos.c +++ b/fs/fat/namei_msdos.c @@ -325,7 +325,12 @@ static int msdos_rmdir(struct inode *dir, struct dentry *dentry) err = fat_remove_entries(dir, &sinfo); /* and releases bh */ if (err) goto out; - drop_nlink(dir); + if (dir->i_nlink >= 3) + drop_nlink(dir); + else { + fat_fs_error(sb, "parent dir link count too low (%u)", + dir->i_nlink); + } clear_nlink(inode); fat_truncate_time(inode, NULL, S_CTIME); diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c index 3cf22a6727f1..7d7ac30c6eff 100644 --- a/fs/fat/namei_vfat.c +++ b/fs/fat/namei_vfat.c @@ -806,7 +806,12 @@ static int vfat_rmdir(struct inode *dir, struct dentry *dentry) err = fat_remove_entries(dir, &sinfo); /* and releases bh */ if (err) goto out; - drop_nlink(dir); + if (dir->i_nlink >= 3) + drop_nlink(dir); + else { + fat_fs_error(sb, "parent dir link count too low (%u)", + dir->i_nlink); + } clear_nlink(inode); fat_truncate_time(inode, NULL, S_ATIME|S_MTIME); -- 2.39.2

2 1

[PATCH OLK-6.6] ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
by Yongjian Sun 26 Mar '26

26 Mar '26

From: Zhang Yi <yi.zhang(a)huawei.com> mainline inclusion from mainline-v7.0-rc1 commit feaf2a80e78f89ee8a3464126077ba8683b62791 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When allocating blocks during within-EOF DIO and writeback with dioread_nolock enabled, EXT4_GET_BLOCKS_PRE_IO was set to split an existing large unwritten extent. However, EXT4_GET_BLOCKS_CONVERT was set when calling ext4_split_convert_extents(), which may potentially result in stale data issues. Assume we have an unwritten extent, and then DIO writes the second half. [UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent [UUUUUUUUUUUUUUUU] extent status tree |<- ->| ----> dio write this range First, ext4_iomap_alloc() call ext4_map_blocks() with EXT4_GET_BLOCKS_PRE_IO, EXT4_GET_BLOCKS_UNWRIT_EXT and EXT4_GET_BLOCKS_CREATE flags set. ext4_map_blocks() find this extent and call ext4_split_convert_extents() with EXT4_GET_BLOCKS_CONVERT and the above flags set. Then, ext4_split_convert_extents() calls ext4_split_extent() with EXT4_EXT_MAY_ZEROOUT, EXT4_EXT_MARK_UNWRIT2 and EXT4_EXT_DATA_VALID2 flags set, and it calls ext4_split_extent_at() to split the second half with EXT4_EXT_DATA_VALID2, EXT4_EXT_MARK_UNWRIT1, EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_MARK_UNWRIT2 flags set. However, ext4_split_extent_at() failed to insert extent since a temporary lack -ENOSPC. It zeroes out the first half but convert the entire on-disk extent to written since the EXT4_EXT_DATA_VALID2 flag set, but left the second half as unwritten in the extent status tree. [0000000000SSSSSS] data S: stale data, 0: zeroed [WWWWWWWWWWWWWWWW] on-disk extent W: written extent [WWWWWWWWWWUUUUUU] extent status tree Finally, if the DIO failed to write data to the disk, the stale data in the second half will be exposed once the cached extent entry is gone. Fix this issue by not passing EXT4_GET_BLOCKS_CONVERT when splitting an unwritten extent before submitting I/O, and make ext4_split_convert_extents() to zero out the entire extent range to zero for this case, and also mark the extent in the extent status tree for consistency. Fixes: b8a8684502a0 ("ext4: Introduce FALLOC_FL_ZERO_RANGE flag for fallocate") Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Cc: stable(a)kernel.org Message-ID: <20251129103247.686136-4-yi.zhang(a)huaweicloud.com> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/extents.c [mainline commit dac092195b6a not applied] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/extents.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 19eae32fc128..83b2e5d1e00a 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -3713,11 +3713,15 @@ static int ext4_split_convert_extents(handle_t *handle, /* Convert to unwritten */ if (flags & EXT4_GET_BLOCKS_CONVERT_UNWRITTEN) { split_flag |= EXT4_EXT_DATA_VALID1; - /* Convert to initialized */ - } else if (flags & EXT4_GET_BLOCKS_CONVERT) { + /* Split the existing unwritten extent */ + } else if (flags & (EXT4_GET_BLOCKS_UNWRIT_EXT | + EXT4_GET_BLOCKS_CONVERT)) { split_flag |= ee_block + ee_len <= eof_block ? EXT4_EXT_MAY_ZEROOUT : 0; - split_flag |= (EXT4_EXT_MARK_UNWRIT2 | EXT4_EXT_DATA_VALID2); + split_flag |= EXT4_EXT_MARK_UNWRIT2; + /* Convert to initialized */ + if (flags & EXT4_GET_BLOCKS_CONVERT) + split_flag |= EXT4_EXT_DATA_VALID2; } flags |= EXT4_GET_BLOCKS_PRE_IO; return ext4_split_extent(handle, inode, ppath, map, split_flag, flags); @@ -3888,7 +3892,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, /* get_block() before submitting IO, split the extent */ if (flags & EXT4_GET_BLOCKS_PRE_IO) { ret = ext4_split_convert_extents(handle, inode, map, ppath, - flags | EXT4_GET_BLOCKS_CONVERT); + flags); if (ret < 0) { err = ret; goto out2; -- 2.39.2

2 1

[PATCH OLK-6.6] ext4: fix memory leak in ext4_ext_shift_extents()
by Yongjian Sun 26 Mar '26

26 Mar '26

From: Zilin Guan <zilin(a)seu.edu.cn> mainline inclusion from mainline-v7.0-rc1 commit ca81109d4a8f192dc1cbad4a1ee25246363c2833 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In ext4_ext_shift_extents(), if the extent is NULL in the while loop, the function returns immediately without releasing the path obtained via ext4_find_extent(), leading to a memory leak. Fix this by jumping to the out label to ensure the path is properly released. Fixes: a18ed359bdddc ("ext4: always check ext4_ext_find_extent result") Signed-off-by: Zilin Guan <zilin(a)seu.edu.cn> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Link: https://patch.msgid.link/20251225084800.905701-1-zilin@seu.edu.cn Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Cc: stable(a)kernel.org Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/extents.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 6126f98bac63..19eae32fc128 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -5281,7 +5281,8 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, if (!extent) { EXT4_ERROR_INODE(inode, "unexpected hole at %lu", (unsigned long) *iterator); - return -EFSCORRUPTED; + ret = -EFSCORRUPTED; + goto out; } if (SHIFT == SHIFT_LEFT && *iterator > le32_to_cpu(extent->ee_block)) { -- 2.39.2

2 1

[PATCH OLK-6.6] blktrace: fix __this_cpu_read/write in preemptible context
by Yongjian Sun 26 Mar '26

26 Mar '26

From: Chaitanya Kulkarni <kch(a)nvidia.com> mainline inclusion from mainline-v7.0-rc3 commit da46b5dfef48658d03347cda21532bcdbb521e67 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14005 CVE: CVE-2026-23374 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- tracing_record_cmdline() internally uses __this_cpu_read() and __this_cpu_write() on the per-CPU variable trace_cmdline_save, and trace_save_cmdline() explicitly asserts preemption is disabled via lockdep_assert_preemption_disabled(). These operations are only safe when preemption is off, as they were designed to be called from the scheduler context (probe_wakeup_sched_switch() / probe_wakeup()). __blk_add_trace() was calling tracing_record_cmdline(current) early in the blk_tracer path, before ring buffer reservation, from process context where preemption is fully enabled. This triggers the following using blktests/blktrace/002: blktrace/002 (blktrace ftrace corruption with sysfs trace) [failed] runtime 0.367s ... 0.437s something found in dmesg: [ 81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33 [ 81.239580] null_blk: disk nullb1 created [ 81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516 [ 81.362842] caller is tracing_record_cmdline+0x10/0x40 [ 81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G N 7.0.0-rc1lblk+ #84 PREEMPT(full) [ 81.362877] Tainted: [N]=TEST [ 81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 81.362881] Call Trace: [ 81.362884] <TASK> [ 81.362886] dump_stack_lvl+0x8d/0xb0 ... (See '/mnt/sda/blktests/results/nodev/blktrace/002.dmesg' for the entire message) [ 81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33 [ 81.239580] null_blk: disk nullb1 created [ 81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516 [ 81.362842] caller is tracing_record_cmdline+0x10/0x40 [ 81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G N 7.0.0-rc1lblk+ #84 PREEMPT(full) [ 81.362877] Tainted: [N]=TEST [ 81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 81.362881] Call Trace: [ 81.362884] <TASK> [ 81.362886] dump_stack_lvl+0x8d/0xb0 [ 81.362895] check_preemption_disabled+0xce/0xe0 [ 81.362902] tracing_record_cmdline+0x10/0x40 [ 81.362923] __blk_add_trace+0x307/0x5d0 [ 81.362934] ? lock_acquire+0xe0/0x300 [ 81.362940] ? iov_iter_extract_pages+0x101/0xa30 [ 81.362959] blk_add_trace_bio+0x106/0x1e0 [ 81.362968] submit_bio_noacct_nocheck+0x24b/0x3a0 [ 81.362979] ? lockdep_init_map_type+0x58/0x260 [ 81.362988] submit_bio_wait+0x56/0x90 [ 81.363009] __blkdev_direct_IO_simple+0x16c/0x250 [ 81.363026] ? __pfx_submit_bio_wait_endio+0x10/0x10 [ 81.363038] ? rcu_read_lock_any_held+0x73/0xa0 [ 81.363051] blkdev_read_iter+0xc1/0x140 [ 81.363059] vfs_read+0x20b/0x330 [ 81.363083] ksys_read+0x67/0xe0 [ 81.363090] do_syscall_64+0xbf/0xf00 [ 81.363102] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 81.363106] RIP: 0033:0x7f281906029d [ 81.363111] Code: 31 c0 e9 c6 fe ff ff 50 48 8d 3d 66 63 0a 00 e8 59 ff 01 00 66 0f 1f 84 00 00 00 00 00 80 3d 41 33 0e 00 00 74 17 31 c0 0f 0c [ 81.363113] RSP: 002b:00007ffca127dd48 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 81.363120] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f281906029d [ 81.363122] RDX: 0000000000001000 RSI: 0000559f8bfae000 RDI: 0000000000000000 [ 81.363123] RBP: 0000000000001000 R08: 0000002863a10a81 R09: 00007f281915f000 [ 81.363124] R10: 00007f2818f77b60 R11: 0000000000000246 R12: 0000559f8bfae000 [ 81.363126] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000000a [ 81.363142] </TASK> The same BUG fires from blk_add_trace_plug(), blk_add_trace_unplug(), and blk_add_trace_rq() paths as well. The purpose of tracing_record_cmdline() is to cache the task->comm for a given PID so that the trace can later resolve it. It is only meaningful when a trace event is actually being recorded. Ring buffer reservation via ring_buffer_lock_reserve() disables preemption, and preemption remains disabled until the event is committed :- __blk_add_trace() __trace_buffer_lock_reserve() __trace_buffer_lock_reserve() ring_buffer_lock_reserve() preempt_disable_notrace(); <--- With this fix blktests for blktrace pass: blktests (master) # ./check blktrace blktrace/001 (blktrace zone management command tracing) [passed] runtime 3.650s ... 3.647s blktrace/002 (blktrace ftrace corruption with sysfs trace) [passed] runtime 0.411s ... 0.384s Fixes: 7ffbd48d5cab ("tracing: Cache comms only after an event occurred") Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Suggested-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Chaitanya Kulkarni <kch(a)nvidia.com> Reviewed-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: kernel/trace/blktrace.c [mainline e472eca538358 & 48886b9d668 not applied] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- kernel/trace/blktrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c index d5d94510afd3..ce797d8dd451 100644 --- a/kernel/trace/blktrace.c +++ b/kernel/trace/blktrace.c @@ -251,8 +251,6 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes, cpu = raw_smp_processor_id(); if (blk_tracer) { - tracing_record_cmdline(current); - buffer = blk_tr->array_buffer.buffer; trace_ctx = tracing_gen_ctx_flags(0); event = trace_buffer_lock_reserve(buffer, TRACE_BLK, @@ -260,6 +258,8 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes, trace_ctx); if (!event) return; + + tracing_record_cmdline(current); t = ring_buffer_event_data(event); goto record_it; } -- 2.39.2

2 1

[PATCH OLK-5.10] ext4: fix dirtyclusters double decrement on fs shutdown
by Yongjian Sun 26 Mar '26

26 Mar '26

From: Brian Foster <bfoster(a)redhat.com> mainline inclusion from mainline-v7.0-rc1 commit 94a8cea54cd935c54fa2fba70354757c0fc245e3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- fstests test generic/388 occasionally reproduces a warning in ext4_put_super() associated with the dirty clusters count: WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4] Tracing the failure shows that the warning fires due to an s_dirtyclusters_counter value of -1. IOW, this appears to be a spurious decrement as opposed to some sort of leak. Further tracing of the dirty cluster count deltas and an LLM scan of the resulting output identified the cause as a double decrement in the error path between ext4_mb_mark_diskspace_used() and the caller ext4_mb_new_blocks(). First, note that generic/388 is a shutdown vs. fsstress test and so produces a random set of operations and shutdown injections. In the problematic case, the shutdown triggers an error return from the ext4_handle_dirty_metadata() call(s) made from ext4_mb_mark_context(). The changed value is non-zero at this point, so ext4_mb_mark_diskspace_used() does not exit after the error bubbles up from ext4_mb_mark_context(). Instead, the former decrements both cluster counters and returns the error up to ext4_mb_new_blocks(). The latter falls into the !ar->len out path which decrements the dirty clusters counter a second time, creating the inconsistency. To avoid this problem and simplify ownership of the cluster reservation in this codepath, lift the counter reduction to a single place in the caller. This makes it more clear that ext4_mb_new_blocks() is responsible for acquiring cluster reservation (via ext4_claim_free_clusters()) in the !delalloc case as well as releasing it, regardless of whether it ends up consumed or returned due to failure. Fixes: 0087d9fb3f29 ("ext4: Fix s_dirty_blocks_counter if block allocation failed with nodelalloc") Signed-off-by: Brian Foster <bfoster(a)redhat.com> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Link: https://patch.msgid.link/20260113171905.118284-1-bfoster@redhat.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Cc: stable(a)kernel.org Conflicts: fs/ext4/mballoc-test.c fs/ext4/mballoc.c [mainline 2f94711b098b & 7c9fa399a369 not applied] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/mballoc.c | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 9d4e8e3c74e2..683f1e220645 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -3300,8 +3300,7 @@ void ext4_exit_mballoc(void) * Returns 0 if success or error code */ static noinline_for_stack int -ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac, - handle_t *handle, unsigned int reserv_clstrs) +ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac, handle_t *handle) { struct buffer_head *bitmap_bh = NULL; struct ext4_group_desc *gdp; @@ -3388,13 +3387,6 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac, ext4_unlock_group(sb, ac->ac_b_ex.fe_group); percpu_counter_sub(&sbi->s_freeclusters_counter, ac->ac_b_ex.fe_len); - /* - * Now reduce the dirty block count also. Should not go negative - */ - if (!(ac->ac_flags & EXT4_MB_DELALLOC_RESERVED)) - /* release all the reserved blocks if non delalloc */ - percpu_counter_sub(&sbi->s_dirtyclusters_counter, - reserv_clstrs); if (sbi->s_log_groups_per_flex) { ext4_group_t flex_group = ext4_flex_group(sbi, @@ -5272,7 +5264,7 @@ ext4_fsblk_t ext4_mb_new_blocks(handle_t *handle, ext4_mb_pa_free(ac); } if (likely(ac->ac_status == AC_STATUS_FOUND)) { - *errp = ext4_mb_mark_diskspace_used(ac, handle, reserv_clstrs); + *errp = ext4_mb_mark_diskspace_used(ac, handle); if (*errp) { ext4_discard_allocated_blocks(ac); goto errout; @@ -5304,12 +5296,9 @@ ext4_fsblk_t ext4_mb_new_blocks(handle_t *handle, kmem_cache_free(ext4_ac_cachep, ac); if (inquota && ar->len < inquota) dquot_free_block(ar->inode, EXT4_C2B(sbi, inquota - ar->len)); - if (!ar->len) { - if ((ar->flags & EXT4_MB_DELALLOC_RESERVED) == 0) - /* release all the reserved blocks if non delalloc */ - percpu_counter_sub(&sbi->s_dirtyclusters_counter, - reserv_clstrs); - } + /* release any reserved blocks */ + if (reserv_clstrs) + percpu_counter_sub(&sbi->s_dirtyclusters_counter, reserv_clstrs); trace_ext4_allocate_blocks(ar, (unsigned long long)block); -- 2.39.2

2 1

[PATCH OLK-5.10] ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
by Yongjian Sun 26 Mar '26

26 Mar '26

From: Zhang Yi <yi.zhang(a)huawei.com> mainline inclusion from mainline-v7.0-rc1 commit feaf2a80e78f89ee8a3464126077ba8683b62791 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When allocating blocks during within-EOF DIO and writeback with dioread_nolock enabled, EXT4_GET_BLOCKS_PRE_IO was set to split an existing large unwritten extent. However, EXT4_GET_BLOCKS_CONVERT was set when calling ext4_split_convert_extents(), which may potentially result in stale data issues. Assume we have an unwritten extent, and then DIO writes the second half. [UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent [UUUUUUUUUUUUUUUU] extent status tree |<- ->| ----> dio write this range First, ext4_iomap_alloc() call ext4_map_blocks() with EXT4_GET_BLOCKS_PRE_IO, EXT4_GET_BLOCKS_UNWRIT_EXT and EXT4_GET_BLOCKS_CREATE flags set. ext4_map_blocks() find this extent and call ext4_split_convert_extents() with EXT4_GET_BLOCKS_CONVERT and the above flags set. Then, ext4_split_convert_extents() calls ext4_split_extent() with EXT4_EXT_MAY_ZEROOUT, EXT4_EXT_MARK_UNWRIT2 and EXT4_EXT_DATA_VALID2 flags set, and it calls ext4_split_extent_at() to split the second half with EXT4_EXT_DATA_VALID2, EXT4_EXT_MARK_UNWRIT1, EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_MARK_UNWRIT2 flags set. However, ext4_split_extent_at() failed to insert extent since a temporary lack -ENOSPC. It zeroes out the first half but convert the entire on-disk extent to written since the EXT4_EXT_DATA_VALID2 flag set, but left the second half as unwritten in the extent status tree. [0000000000SSSSSS] data S: stale data, 0: zeroed [WWWWWWWWWWWWWWWW] on-disk extent W: written extent [WWWWWWWWWWUUUUUU] extent status tree Finally, if the DIO failed to write data to the disk, the stale data in the second half will be exposed once the cached extent entry is gone. Fix this issue by not passing EXT4_GET_BLOCKS_CONVERT when splitting an unwritten extent before submitting I/O, and make ext4_split_convert_extents() to zero out the entire extent range to zero for this case, and also mark the extent in the extent status tree for consistency. Fixes: b8a8684502a0 ("ext4: Introduce FALLOC_FL_ZERO_RANGE flag for fallocate") Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Cc: stable(a)kernel.org Message-ID: <20251129103247.686136-4-yi.zhang(a)huaweicloud.com> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/extents.c [mainline commit dac092195b6a not applied] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/extents.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 786701524736..4c77284be84d 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -3714,11 +3714,15 @@ static int ext4_split_convert_extents(handle_t *handle, /* Convert to unwritten */ if (flags & EXT4_GET_BLOCKS_CONVERT_UNWRITTEN) { split_flag |= EXT4_EXT_DATA_VALID1; - /* Convert to initialized */ - } else if (flags & EXT4_GET_BLOCKS_CONVERT) { + /* Split the existing unwritten extent */ + } else if (flags & (EXT4_GET_BLOCKS_UNWRIT_EXT | + EXT4_GET_BLOCKS_CONVERT)) { split_flag |= ee_block + ee_len <= eof_block ? EXT4_EXT_MAY_ZEROOUT : 0; - split_flag |= (EXT4_EXT_MARK_UNWRIT2 | EXT4_EXT_DATA_VALID2); + split_flag |= EXT4_EXT_MARK_UNWRIT2; + /* Convert to initialized */ + if (flags & EXT4_GET_BLOCKS_CONVERT) + split_flag |= EXT4_EXT_DATA_VALID2; } flags |= EXT4_GET_BLOCKS_PRE_IO; return ext4_split_extent(handle, inode, ppath, map, split_flag, flags); @@ -3883,7 +3887,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, /* get_block() before submitting IO, split the extent */ if (flags & EXT4_GET_BLOCKS_PRE_IO) { ret = ext4_split_convert_extents(handle, inode, map, ppath, - flags | EXT4_GET_BLOCKS_CONVERT); + flags); if (ret < 0) { err = ret; goto out2; -- 2.39.2

2 1

[PATCH OLK-5.10] fat: avoid parent link count underflow in rmdir
by Yongjian Sun 26 Mar '26

26 Mar '26

From: Zhiyu Zhang <zhiyuzhang999(a)gmail.com> mainline inclusion from mainline-v7.0-rc1 commit 8cafcb881364af5ef3a8b9fed4db254054033d8a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Corrupted FAT images can leave a directory inode with an incorrect i_nlink (e.g. 2 even though subdirectories exist). rmdir then unconditionally calls drop_nlink(dir) and can drive i_nlink to 0, triggering the WARN_ON in drop_nlink(). Add a sanity check in vfat_rmdir() and msdos_rmdir(): only drop the parent link count when it is at least 3, otherwise report a filesystem error. Link: https://lkml.kernel.org/r/20260101111148.1437-1-zhiyuzhang999@gmail.com Fixes: 9a53c3a783c2 ("[PATCH] r/o bind mounts: unlink: monitor i_nlink") Signed-off-by: Zhiyu Zhang <zhiyuzhang999(a)gmail.com> Reported-by: Zhiyu Zhang <zhiyuzhang999(a)gmail.com> Closes: https://lore.kernel.org/linux-fsdevel/aVN06OKsKxZe6-Kv@casper.infradead.org… Tested-by: Zhiyu Zhang <zhiyuzhang999(a)gmail.com> Acked-by: OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Christian Brauner <brauner(a)kernel.org> Cc: Jan Kara <jack(a)suse.cz> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/fat/namei_msdos.c | 7 ++++++- fs/fat/namei_vfat.c | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/fs/fat/namei_msdos.c b/fs/fat/namei_msdos.c index 9d062886fbc1..63a323be9179 100644 --- a/fs/fat/namei_msdos.c +++ b/fs/fat/namei_msdos.c @@ -325,7 +325,12 @@ static int msdos_rmdir(struct inode *dir, struct dentry *dentry) err = fat_remove_entries(dir, &sinfo); /* and releases bh */ if (err) goto out; - drop_nlink(dir); + if (dir->i_nlink >= 3) + drop_nlink(dir); + else { + fat_fs_error(sb, "parent dir link count too low (%u)", + dir->i_nlink); + } clear_nlink(inode); fat_truncate_time(inode, NULL, S_CTIME); diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c index 0cdd0fb9f742..db9a88fb6e2d 100644 --- a/fs/fat/namei_vfat.c +++ b/fs/fat/namei_vfat.c @@ -808,7 +808,12 @@ static int vfat_rmdir(struct inode *dir, struct dentry *dentry) err = fat_remove_entries(dir, &sinfo); /* and releases bh */ if (err) goto out; - drop_nlink(dir); + if (dir->i_nlink >= 3) + drop_nlink(dir); + else { + fat_fs_error(sb, "parent dir link count too low (%u)", + dir->i_nlink); + } clear_nlink(inode); fat_truncate_time(inode, NULL, S_ATIME|S_MTIME); -- 2.39.2

2 1

[PATCH OLK-6.6] scsi: core: Fix refcount leak for tagset_refcnt
by Li Lingfeng 26 Mar '26

26 Mar '26

From: Junxiao Bi <junxiao.bi(a)oracle.com> stable inclusion from stable-v6.6.130 commit 7c01b680beaf4d3143866b062b8e770e8b237fb8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13999 CVE: CVE-2026-23296 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1ac22c8eae81366101597d48360718dff9b9d980 upstream. This leak will cause a hang when tearing down the SCSI host. For example, iscsid hangs with the following call trace: [130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured PID: 2528 TASK: ffff9d0408974e00 CPU: 3 COMMAND: "iscsid" #0 [ffffb5b9c134b9e0] __schedule at ffffffff860657d4 #1 [ffffb5b9c134ba28] schedule at ffffffff86065c6f #2 [ffffb5b9c134ba40] schedule_timeout at ffffffff86069fb0 #3 [ffffb5b9c134bab0] __wait_for_common at ffffffff8606674f #4 [ffffb5b9c134bb10] scsi_remove_host at ffffffff85bfe84b #5 [ffffb5b9c134bb30] iscsi_sw_tcp_session_destroy at ffffffffc03031c4 [iscsi_tcp] #6 [ffffb5b9c134bb48] iscsi_if_recv_msg at ffffffffc0292692 [scsi_transport_iscsi] #7 [ffffb5b9c134bb98] iscsi_if_rx at ffffffffc02929c2 [scsi_transport_iscsi] #8 [ffffb5b9c134bbf0] netlink_unicast at ffffffff85e551d6 #9 [ffffb5b9c134bc38] netlink_sendmsg at ffffffff85e554ef Fixes: 8fe4ce5836e9 ("scsi: core: Fix a use-after-free") Cc: stable(a)vger.kernel.org Signed-off-by: Junxiao Bi <junxiao.bi(a)oracle.com> Reviewed-by: Mike Christie <michael.christie(a)oracle.com> Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://patch.msgid.link/20260223232728.93350-1-junxiao.bi@oracle.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/scsi_scan.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c index 8ee74dddef16..e5b62e36761f 100644 --- a/drivers/scsi/scsi_scan.c +++ b/drivers/scsi/scsi_scan.c @@ -354,6 +354,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, * since we use this queue depth most of times. */ if (scsi_realloc_sdev_budget_map(sdev, depth)) { + kref_put(&sdev->host->tagset_refcnt, scsi_mq_free_tags); put_device(&starget->dev); kfree(sdev); goto out; -- 2.52.0

2 1

[PATCH OLK-5.10] bonding: fix use-after-free due to enslave fail after slave array update
by Dong Chenchen 26 Mar '26

26 Mar '26

From: Nikolay Aleksandrov <razor(a)blackwall.org> mainline inclusion from mainline-v6.19-rc8 commit e9acda52fd2ee0cdca332f996da7a95c5fd25294 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13721 CVE: CVE-2026-23171 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems. It is very easy to reproduce the problem with a simple xdp_pass prog: ip l add bond1 type bond mode balance-xor ip l set bond1 up ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass ip l add dumdum type dummy Then run in parallel: while :; do ip l set dumdum master bond1 1>/dev/null 2>&1; done; mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn" The crash happens almost immediately: [ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf] [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary) [ 605.602979] Tainted: [B]=BAD_PAGE [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210 [ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89 [ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213 [ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000 [ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be [ 605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c [ 605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000 [ 605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84 [ 605.603286] FS: 00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000 [ 605.603319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0 [ 605.603373] Call Trace: [ 605.603392] <TASK> [ 605.603410] __dev_queue_xmit+0x448/0x32a0 [ 605.603434] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603461] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603484] ? __pfx___dev_queue_xmit+0x10/0x10 [ 605.603507] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603546] ? _printk+0xcb/0x100 [ 605.603566] ? __pfx__printk+0x10/0x10 [ 605.603589] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603627] ? add_taint+0x5e/0x70 [ 605.603648] ? add_taint+0x2a/0x70 [ 605.603670] ? end_report.cold+0x51/0x75 [ 605.603693] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603731] bond_start_xmit+0x623/0xc20 [bonding] Fixes: 9e2ee5c7e7c3 ("net, bonding: Add XDP support to the bonding driver") Signed-off-by: Nikolay Aleksandrov <razor(a)blackwall.org> Reported-by: Chen Zhen <chenzhen126(a)huawei.com> Closes: https://lore.kernel.org/netdev/fae17c21-4940-5605-85b2-1d5e17342358@huawei.… CC: Jussi Maki <joamaki(a)gmail.com> CC: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://patch.msgid.link/20260123120659.571187-1-razor@blackwall.org Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: drivers/net/bonding/bond_main.c [commit e0caeb24f538 and cb9e6e584d584 are not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/bonding/bond_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index cd64d7cc65aa..9deea4439b79 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -2139,9 +2139,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev, unblock_netpoll_tx(); } - if (bond_mode_can_use_xmit_hash(bond)) - bond_update_slave_arr(bond, NULL); - if (!slave_dev->netdev_ops->ndo_bpf || !slave_dev->netdev_ops->ndo_xdp_xmit) { @@ -2178,6 +2175,9 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev, bpf_prog_inc(bond->xdp_prog); } + if (bond_mode_can_use_xmit_hash(bond)) + bond_update_slave_arr(bond, NULL); + slave_info(bond_dev, slave_dev, "Enslaving as %s interface with %s link\n", bond_is_active_slave(new_slave) ? "an active" : "a backup", new_slave->link != BOND_LINK_DOWN ? "an up" : "a down"); -- 2.25.1

2 1

[PATCH OLK-6.6] perf: HiSilicon: Support uncore ITS PMU
by Yushan Wang 26 Mar '26

26 Mar '26

driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8741 ----------------------------------------------- Support uncore ITS PMU, which provides the capability of counting interrupts routed to ITS by interrupt catagories, and its latency. It also supports ITS internal structure latency and DDR access events. The driver adapts to HiSilicon uncore PMU framework. ITS PMU driver does not support overflow interruption, which is the same as NoC PMU, so a few dummy functions or handling interrupts are left empty. Signed-off-by: Yushan Wang <wangyushan12(a)huawei.com> Signed-off-by: Ying Jiang <jiangying44(a)h-partners.com> --- drivers/perf/hisilicon/hisi_uncore_its_pmu.c | 364 +++++++++++++++++++ 1 file changed, 364 insertions(+) create mode 100644 drivers/perf/hisilicon/hisi_uncore_its_pmu.c diff --git a/drivers/perf/hisilicon/hisi_uncore_its_pmu.c b/drivers/perf/hisilicon/hisi_uncore_its_pmu.c new file mode 100644 index 000000000000..9d9035207e78 --- /dev/null +++ b/drivers/perf/hisilicon/hisi_uncore_its_pmu.c @@ -0,0 +1,364 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Driver for HiSilicon Uncore ITS PMU device + * + * Copyright (c) 2025 HiSilicon Technologies Co., Ltd. + * Author: Yushan Wang <wangyushan12(a)huawei.com> + */ +#include <linux/bitops.h> +#include <linux/cpuhotplug.h> +#include <linux/device.h> +#include <linux/io.h> +#include <linux/mod_devicetable.h> +#include <linux/module.h> +#include <linux/platform_device.h> +#include <linux/property.h> +#include <linux/sysfs.h> + +#include "hisi_uncore_pmu.h" + +#define ITS_PMU_VERSION 0x21000 +#define ITS_PMU_GLOBAL_CTRL 0x21004 +#define ITS_PMU_GLOBAL_CTRL_PMU_EN BIT(0) +#define ITS_PMU_COUNTER_CTRL 0x21008 +#define ITS_PMU_EVENT_CTRL 0x2100c +#define ITS_PMU_COUNTER0 0x21010 + +#define ITS_PMU_INT_ID_MASK 0x20008 +#define ITS_PMU_INT_ID_CTRL 0x20084 + +#define ITS_PMU_NR_COUNTERS 4 + +#define ITS_PMU_EVENT_CNTRn(cntr0, n) ((cntr0) + 8 * (n)) +#define ITS_PMU_CNTR_CTRL_MASK(n) GENMASK(8 * ((n) + 1) - 1, 8 * (n)) +#define ITS_PMU_CNTR_EVENT_CFG(n, e) ((e) << ((n) * 8)) +#define ITS_PMU_EVENT_CTRL_TYPE GENMASK(12, 0) + +HISI_PMU_EVENT_ATTR_EXTRACTOR(int_id, config1, 31, 0); + +/* Dynamic CPU hotplug state used by this PMU driver */ +static enum cpuhp_state hisi_its_pmu_cpuhp_state; + +struct hisi_its_pmu_regs { + u32 version; + u32 pmu_ctrl; + u32 event_ctrl0; + u32 event_cntr0; + u32 cntr_ctrl; +}; + +static void hisi_its_pmu_write_evtype(struct hisi_pmu *its_pmu, int idx, u32 type) +{ + struct hisi_its_pmu_regs *reg_info = its_pmu->dev_info->private; + u32 reg; + + reg = readl(its_pmu->base + reg_info->event_ctrl0); + reg &= ~ITS_PMU_CNTR_CTRL_MASK(idx); + reg |= ITS_PMU_CNTR_EVENT_CFG(idx, type); + writel(reg, its_pmu->base + reg_info->event_ctrl0); +} + +static u64 hisi_its_pmu_read_counter(struct hisi_pmu *its_pmu, + struct hw_perf_event *hwc) +{ + struct hisi_its_pmu_regs *reg_info = its_pmu->dev_info->private; + + return readq(its_pmu->base + ITS_PMU_EVENT_CNTRn(reg_info->event_cntr0, hwc->idx)); +} + +static void hisi_its_pmu_write_counter(struct hisi_pmu *its_pmu, + struct hw_perf_event *hwc, u64 val) +{ + struct hisi_its_pmu_regs *reg_info = its_pmu->dev_info->private; + + writeq(val, its_pmu->base + ITS_PMU_EVENT_CNTRn(reg_info->event_cntr0, hwc->idx)); +} + +static void hisi_its_pmu_enable_counter(struct hisi_pmu *its_pmu, + struct hw_perf_event *hwc) +{ + struct hisi_its_pmu_regs *reg_info = its_pmu->dev_info->private; + u32 reg; + + reg = readl(its_pmu->base + reg_info->cntr_ctrl); + reg |= BIT(hwc->idx); + writel(reg, its_pmu->base + reg_info->cntr_ctrl); +} + +static void hisi_its_pmu_disable_counter(struct hisi_pmu *its_pmu, + struct hw_perf_event *hwc) +{ + struct hisi_its_pmu_regs *reg_info = its_pmu->dev_info->private; + u32 reg; + + reg = readl(its_pmu->base + reg_info->cntr_ctrl); + reg &= ~BIT(hwc->idx); + writel(reg, its_pmu->base + reg_info->cntr_ctrl); +} + +static void hisi_its_pmu_enable_counter_int(struct hisi_pmu *its_pmu, + struct hw_perf_event *hwc) +{ + /* We don't support interrupt, so a stub here. */ +} + +static void hisi_its_pmu_disable_counter_int(struct hisi_pmu *its_pmu, + struct hw_perf_event *hwc) +{ +} + +static void hisi_its_pmu_start_counters(struct hisi_pmu *its_pmu) +{ + struct hisi_its_pmu_regs *reg_info = its_pmu->dev_info->private; + u32 reg; + + reg = readl(its_pmu->base + reg_info->pmu_ctrl); + reg |= ITS_PMU_GLOBAL_CTRL_PMU_EN; + writel(reg, its_pmu->base + reg_info->pmu_ctrl); +} + +static void hisi_its_pmu_stop_counters(struct hisi_pmu *its_pmu) +{ + struct hisi_its_pmu_regs *reg_info = its_pmu->dev_info->private; + u32 reg; + + reg = readl(its_pmu->base + reg_info->pmu_ctrl); + reg &= ~ITS_PMU_GLOBAL_CTRL_PMU_EN; + writel(reg, its_pmu->base + reg_info->pmu_ctrl); +} + +static void hisi_its_pmu_enable_filter(struct perf_event *event) +{ + struct hisi_pmu *its_pmu = to_hisi_pmu(event->pmu); + u32 int_id = hisi_get_int_id(event); + u32 reg = int_id ? 0 : -1U; + + if (int_id) + writel(int_id, its_pmu->base + ITS_PMU_INT_ID_CTRL); + + writel(reg, its_pmu->base + ITS_PMU_INT_ID_MASK); +} + +static void hisi_its_pmu_disable_filter(struct perf_event *event) +{ + struct hisi_pmu *its_pmu = to_hisi_pmu(event->pmu); + u32 int_id = hisi_get_int_id(event); + + if (bitmap_weight(its_pmu->pmu_events.used_mask, its_pmu->num_counters) > 1) + return; + + if (int_id) { + writel(0, its_pmu->base + ITS_PMU_INT_ID_CTRL); + writel(-1U, its_pmu->base + ITS_PMU_INT_ID_MASK); + } +} + +static const struct hisi_uncore_ops hisi_uncore_its_ops = { + .write_evtype = hisi_its_pmu_write_evtype, + .get_event_idx = hisi_uncore_pmu_get_event_idx, + .read_counter = hisi_its_pmu_read_counter, + .write_counter = hisi_its_pmu_write_counter, + .enable_counter = hisi_its_pmu_enable_counter, + .disable_counter = hisi_its_pmu_disable_counter, + .enable_counter_int = hisi_its_pmu_enable_counter_int, + .disable_counter_int = hisi_its_pmu_disable_counter_int, + .start_counters = hisi_its_pmu_start_counters, + .stop_counters = hisi_its_pmu_stop_counters, + .enable_filter = hisi_its_pmu_enable_filter, + .disable_filter = hisi_its_pmu_disable_filter, +}; + +static struct attribute *hisi_its_pmu_format_attrs[] = { + HISI_PMU_FORMAT_ATTR(event, "config:0-16"), + HISI_PMU_FORMAT_ATTR(int_id, "config1:0-31"), + NULL +}; + +static const struct attribute_group hisi_its_pmu_format_group = { + .name = "format", + .attrs = hisi_its_pmu_format_attrs, +}; + +static struct attribute *hisi_its_pmu_events_attrs[] = { + HISI_PMU_EVENT_ATTR(lpi_num, 0xc0), + HISI_PMU_EVENT_ATTR(lpi_time, 0x80), + HISI_PMU_EVENT_ATTR(sgi_num, 0xc1), + HISI_PMU_EVENT_ATTR(sgi_time, 0x81), + HISI_PMU_EVENT_ATTR(ppi_num, 0xc2), + HISI_PMU_EVENT_ATTR(ppi_time, 0x82), + HISI_PMU_EVENT_ATTR(sl3_lpi_num, 0xc3), + HISI_PMU_EVENT_ATTR(sl3_sgi_num, 0xc4), + HISI_PMU_EVENT_ATTR(sl3_ppi_num, 0xc5), + HISI_PMU_EVENT_ATTR(sl0_ddr_read, 0xc9), + HISI_PMU_EVENT_ATTR(sl0_ddr_time, 0x89), + HISI_PMU_EVENT_ATTR(sl1_ddr_read, 0xca), + HISI_PMU_EVENT_ATTR(sl1_ddr_time, 0x8a), + HISI_PMU_EVENT_ATTR(sl2_ddr_read, 0xcb), + HISI_PMU_EVENT_ATTR(sl2_ddr_time, 0x8b), + HISI_PMU_EVENT_ATTR(cycles, 0xcc), + NULL +}; + +static const struct attribute_group hisi_its_pmu_events_group = { + .name = "events", + .attrs = hisi_its_pmu_events_attrs, +}; + +static const struct attribute_group *hisi_its_pmu_attr_groups[] = { + &hisi_its_pmu_format_group, + &hisi_its_pmu_events_group, + &hisi_pmu_cpumask_attr_group, + &hisi_pmu_identifier_group, + NULL +}; + +static int hisi_its_pmu_dev_init(struct platform_device *pdev, struct hisi_pmu *its_pmu) +{ + struct hisi_its_pmu_regs *reg_info; + + hisi_uncore_pmu_init_topology(its_pmu, &pdev->dev); + + if (its_pmu->topo.scl_id < 0) + return dev_err_probe(&pdev->dev, -EINVAL, "failed to get scl-id\n"); + + if (its_pmu->topo.index_id < 0) + return dev_err_probe(&pdev->dev, -EINVAL, "failed to get idx-id\n"); + + its_pmu->base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(its_pmu->base)) + return dev_err_probe(&pdev->dev, PTR_ERR(its_pmu->base), + "fail to remap io memory\n"); + + its_pmu->dev_info = device_get_match_data(&pdev->dev); + if (!its_pmu->dev_info) + return -ENODEV; + + its_pmu->pmu_events.attr_groups = its_pmu->dev_info->attr_groups; + its_pmu->counter_bits = its_pmu->dev_info->counter_bits; + its_pmu->check_event = its_pmu->dev_info->check_event; + its_pmu->num_counters = ITS_PMU_NR_COUNTERS; + its_pmu->ops = &hisi_uncore_its_ops; + its_pmu->dev = &pdev->dev; + its_pmu->on_cpu = -1; + + reg_info = its_pmu->dev_info->private; + its_pmu->identifier = readl(its_pmu->base + reg_info->version); + + return 0; +} + +static void hisi_its_pmu_remove_cpuhp_instance(void *hotplug_node) +{ + cpuhp_state_remove_instance_nocalls(hisi_its_pmu_cpuhp_state, hotplug_node); +} + +static void hisi_its_pmu_unregister_pmu(void *pmu) +{ + perf_pmu_unregister(pmu); +} + +static int hisi_its_pmu_probe(struct platform_device *pdev) +{ + struct device *dev = &pdev->dev; + struct hisi_pmu *its_pmu; + char *name; + int ret; + + its_pmu = devm_kzalloc(dev, sizeof(*its_pmu), GFP_KERNEL); + if (!its_pmu) + return -ENOMEM; + + /* + * HiSilicon Uncore PMU framework needs to get common hisi_pmu device + * from device's drvdata. + */ + platform_set_drvdata(pdev, its_pmu); + + ret = hisi_its_pmu_dev_init(pdev, its_pmu); + if (ret) + return ret; + + ret = cpuhp_state_add_instance(hisi_its_pmu_cpuhp_state, &its_pmu->node); + if (ret) + return dev_err_probe(dev, ret, "Fail to register cpuhp instance\n"); + + ret = devm_add_action_or_reset(dev, hisi_its_pmu_remove_cpuhp_instance, + &its_pmu->node); + if (ret) + return ret; + + hisi_pmu_init(its_pmu, THIS_MODULE); + + name = devm_kasprintf(dev, GFP_KERNEL, "hisi_scl%d_its%d", + its_pmu->topo.scl_id, its_pmu->topo.index_id); + if (!name) + return -ENOMEM; + + ret = perf_pmu_register(&its_pmu->pmu, name, -1); + if (ret) + return dev_err_probe(dev, ret, "Fail to register PMU\n"); + + return devm_add_action_or_reset(dev, hisi_its_pmu_unregister_pmu, + &its_pmu->pmu); +} + +static struct hisi_its_pmu_regs hisi_its_v1_pmu_regs = { + .version = ITS_PMU_VERSION, + .pmu_ctrl = ITS_PMU_GLOBAL_CTRL, + .event_ctrl0 = ITS_PMU_EVENT_CTRL, + .event_cntr0 = ITS_PMU_COUNTER0, + .cntr_ctrl = ITS_PMU_COUNTER_CTRL, +}; + +static const struct hisi_pmu_dev_info hisi_its_v1 = { + .attr_groups = hisi_its_pmu_attr_groups, + .counter_bits = 48, + .check_event = ITS_PMU_EVENT_CTRL_TYPE, + .private = &hisi_its_v1_pmu_regs, +}; + +static const struct acpi_device_id hisi_its_pmu_ids[] = { + { "HISI0591", (kernel_ulong_t) &hisi_its_v1 }, + { } +}; +MODULE_DEVICE_TABLE(acpi, hisi_its_pmu_ids); + +static struct platform_driver hisi_its_pmu_driver = { + .driver = { + .name = "hisi_its_pmu", + .acpi_match_table = hisi_its_pmu_ids, + .suppress_bind_attrs = true, + }, + .probe = hisi_its_pmu_probe, +}; + +static int __init hisi_its_pmu_module_init(void) +{ + int ret = cpuhp_setup_state_multi(CPUHP_AP_ONLINE_DYN, + "perf/hisi/its:online", + hisi_uncore_pmu_online_cpu, + hisi_uncore_pmu_offline_cpu); + if (ret < 0) { + pr_err("hisi_its_pmu: Fail to setup cpuhp callbacks, ret = %d\n", ret); + return ret; + } + hisi_its_pmu_cpuhp_state = ret; + + ret = platform_driver_register(&hisi_its_pmu_driver); + if (ret) + cpuhp_remove_multi_state(hisi_its_pmu_cpuhp_state); + + return ret; +} +module_init(hisi_its_pmu_module_init); + +static void __exit hisi_its_pmu_module_exit(void) +{ + platform_driver_unregister(&hisi_its_pmu_driver); + cpuhp_remove_multi_state(hisi_its_pmu_cpuhp_state); +} +module_exit(hisi_its_pmu_module_exit); + +MODULE_IMPORT_NS(HISI_PMU); +MODULE_DESCRIPTION("HiSilicon SoC Uncore ITS PMU driver"); +MODULE_LICENSE("GPL"); -- 2.33.0

2 1

[PATCH OLK-6.6] drivers/perf: hisi: Add new function for HiSilicon MN PMU driver
by Yifan Wu 26 Mar '26

26 Mar '26

driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8741 ----------------------------------------------- MN (Miscellaneous Node) is a hybrid node in ARM CHI. The MN PMU driver using the HiSilicon uncore PMU framework. On HiSilicon Hip13 platform, cycle event is supported on MN PMU. The cycle event is exposed directly in driver and some variables shall be added suffix to distinguish the version. Signed-off-by: Yifan Wu <wuyifan50(a)huawei.com> Signed-off-by: Ying Jiang <jiangying44(a)h-partners.com> --- drivers/perf/hisilicon/hisi_uncore_mn_pmu.c | 61 +++++++++++++++++++-- 1 file changed, 55 insertions(+), 6 deletions(-) diff --git a/drivers/perf/hisilicon/hisi_uncore_mn_pmu.c b/drivers/perf/hisilicon/hisi_uncore_mn_pmu.c index 38a72c95fb6d..5baebb63af2a 100644 --- a/drivers/perf/hisilicon/hisi_uncore_mn_pmu.c +++ b/drivers/perf/hisilicon/hisi_uncore_mn_pmu.c @@ -192,7 +192,7 @@ static const struct attribute_group hisi_mn_pmu_format_group = { .attrs = hisi_mn_pmu_format_attr, }; -static struct attribute *hisi_mn_pmu_events_attr[] = { +static struct attribute *hisi_mn_pmu_events_attr_v1[] = { HISI_PMU_EVENT_ATTR(req_eobarrier_num, 0x00), HISI_PMU_EVENT_ATTR(req_ecbarrier_num, 0x01), HISI_PMU_EVENT_ATTR(req_dvmop_num, 0x02), @@ -219,14 +219,55 @@ static struct attribute *hisi_mn_pmu_events_attr[] = { NULL }; -static const struct attribute_group hisi_mn_pmu_events_group = { +static const struct attribute_group hisi_mn_pmu_events_group_v1 = { .name = "events", - .attrs = hisi_mn_pmu_events_attr, + .attrs = hisi_mn_pmu_events_attr_v1, }; -static const struct attribute_group *hisi_mn_pmu_attr_groups[] = { +static const struct attribute_group *hisi_mn_pmu_attr_groups_v1[] = { &hisi_mn_pmu_format_group, - &hisi_mn_pmu_events_group, + &hisi_mn_pmu_events_group_v1, + &hisi_pmu_cpumask_attr_group, + &hisi_pmu_identifier_group, + NULL +}; + +static struct attribute *hisi_mn_pmu_events_attr_v2[] = { + HISI_PMU_EVENT_ATTR(req_eobarrier_num, 0x00), + HISI_PMU_EVENT_ATTR(req_ecbarrier_num, 0x01), + HISI_PMU_EVENT_ATTR(req_dvmop_num, 0x02), + HISI_PMU_EVENT_ATTR(req_dvmsync_num, 0x03), + HISI_PMU_EVENT_ATTR(req_retry_num, 0x04), + HISI_PMU_EVENT_ATTR(req_writenosnp_num, 0x05), + HISI_PMU_EVENT_ATTR(req_readnosnp_num, 0x06), + HISI_PMU_EVENT_ATTR(snp_dvm_num, 0x07), + HISI_PMU_EVENT_ATTR(snp_dvmsync_num, 0x08), + HISI_PMU_EVENT_ATTR(l3t_req_dvm_num, 0x09), + HISI_PMU_EVENT_ATTR(l3t_req_dvmsync_num, 0x0A), + HISI_PMU_EVENT_ATTR(mn_req_dvm_num, 0x0B), + HISI_PMU_EVENT_ATTR(mn_req_dvmsync_num, 0x0C), + HISI_PMU_EVENT_ATTR(pa_req_dvm_num, 0x0D), + HISI_PMU_EVENT_ATTR(pa_req_dvmsync_num, 0x0E), + HISI_PMU_EVENT_ATTR(cycles, 0x0F), + HISI_PMU_EVENT_ATTR(snp_dvm_latency, 0x80), + HISI_PMU_EVENT_ATTR(snp_dvmsync_latency, 0x81), + HISI_PMU_EVENT_ATTR(l3t_req_dvm_latency, 0x82), + HISI_PMU_EVENT_ATTR(l3t_req_dvmsync_latency, 0x83), + HISI_PMU_EVENT_ATTR(mn_req_dvm_latency, 0x84), + HISI_PMU_EVENT_ATTR(mn_req_dvmsync_latency, 0x85), + HISI_PMU_EVENT_ATTR(pa_req_dvm_latency, 0x86), + HISI_PMU_EVENT_ATTR(pa_req_dvmsync_latency, 0x87), + NULL +}; + +static const struct attribute_group hisi_mn_pmu_events_group_v2 = { + .name = "events", + .attrs = hisi_mn_pmu_events_attr_v2, +}; + +static const struct attribute_group *hisi_mn_pmu_attr_groups_v2[] = { + &hisi_mn_pmu_format_group, + &hisi_mn_pmu_events_group_v2, &hisi_pmu_cpumask_attr_group, &hisi_pmu_identifier_group, NULL @@ -351,7 +392,14 @@ static struct hisi_mn_pmu_regs hisi_mn_v1_pmu_regs = { }; static const struct hisi_pmu_dev_info hisi_mn_v1 = { - .attr_groups = hisi_mn_pmu_attr_groups, + .attr_groups = hisi_mn_pmu_attr_groups_v1, + .counter_bits = 48, + .check_event = HISI_MN_EVTYPE_MASK, + .private = &hisi_mn_v1_pmu_regs, +}; + +static const struct hisi_pmu_dev_info hisi_mn_v2 = { + .attr_groups = hisi_mn_pmu_attr_groups_v2, .counter_bits = 48, .check_event = HISI_MN_EVTYPE_MASK, .private = &hisi_mn_v1_pmu_regs, @@ -359,6 +407,7 @@ static const struct hisi_pmu_dev_info hisi_mn_v1 = { static const struct acpi_device_id hisi_mn_pmu_acpi_match[] = { { "HISI0222", (kernel_ulong_t) &hisi_mn_v1 }, + { "HISI0224", (kernel_ulong_t) &hisi_mn_v2 }, { } }; MODULE_DEVICE_TABLE(acpi, hisi_mn_pmu_acpi_match); -- 2.33.0

2 1

[PATCH OLK-6.6 1/1] perf: HiSilicon: Support uncore ITS PMU
by Yushan Wang 26 Mar '26

26 Mar '26

driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8741 ----------------------------------------------- Support uncore ITS PMU, which provides the capability of counting interrupts routed to ITS by interrupt catagories, and its latency. It also supports ITS internal structure latency and DDR access events. The driver adapts to HiSilicon uncore PMU framework. ITS PMU driver does not support overflow interruption, which is the same as NoC PMU, so a few dummy functions or handling interrupts are left empty. Signed-off-by: Yushan Wang <wangyushan12(a)huawei.com> Signed-off-by: Ying Jiang <jiangying44(a)h-partners.com> --- drivers/perf/hisilicon/hisi_uncore_its_pmu.c | 364 +++++++++++++++++++ 1 file changed, 364 insertions(+) create mode 100644 drivers/perf/hisilicon/hisi_uncore_its_pmu.c diff --git a/drivers/perf/hisilicon/hisi_uncore_its_pmu.c b/drivers/perf/hisilicon/hisi_uncore_its_pmu.c new file mode 100644 index 000000000000..9d9035207e78 --- /dev/null +++ b/drivers/perf/hisilicon/hisi_uncore_its_pmu.c @@ -0,0 +1,364 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Driver for HiSilicon Uncore ITS PMU device + * + * Copyright (c) 2025 HiSilicon Technologies Co., Ltd. + * Author: Yushan Wang <wangyushan12(a)huawei.com> + */ +#include <linux/bitops.h> +#include <linux/cpuhotplug.h> +#include <linux/device.h> +#include <linux/io.h> +#include <linux/mod_devicetable.h> +#include <linux/module.h> +#include <linux/platform_device.h> +#include <linux/property.h> +#include <linux/sysfs.h> + +#include "hisi_uncore_pmu.h" + +#define ITS_PMU_VERSION 0x21000 +#define ITS_PMU_GLOBAL_CTRL 0x21004 +#define ITS_PMU_GLOBAL_CTRL_PMU_EN BIT(0) +#define ITS_PMU_COUNTER_CTRL 0x21008 +#define ITS_PMU_EVENT_CTRL 0x2100c +#define ITS_PMU_COUNTER0 0x21010 + +#define ITS_PMU_INT_ID_MASK 0x20008 +#define ITS_PMU_INT_ID_CTRL 0x20084 + +#define ITS_PMU_NR_COUNTERS 4 + +#define ITS_PMU_EVENT_CNTRn(cntr0, n) ((cntr0) + 8 * (n)) +#define ITS_PMU_CNTR_CTRL_MASK(n) GENMASK(8 * ((n) + 1) - 1, 8 * (n)) +#define ITS_PMU_CNTR_EVENT_CFG(n, e) ((e) << ((n) * 8)) +#define ITS_PMU_EVENT_CTRL_TYPE GENMASK(12, 0) + +HISI_PMU_EVENT_ATTR_EXTRACTOR(int_id, config1, 31, 0); + +/* Dynamic CPU hotplug state used by this PMU driver */ +static enum cpuhp_state hisi_its_pmu_cpuhp_state; + +struct hisi_its_pmu_regs { + u32 version; + u32 pmu_ctrl; + u32 event_ctrl0; + u32 event_cntr0; + u32 cntr_ctrl; +}; + +static void hisi_its_pmu_write_evtype(struct hisi_pmu *its_pmu, int idx, u32 type) +{ + struct hisi_its_pmu_regs *reg_info = its_pmu->dev_info->private; + u32 reg; + + reg = readl(its_pmu->base + reg_info->event_ctrl0); + reg &= ~ITS_PMU_CNTR_CTRL_MASK(idx); + reg |= ITS_PMU_CNTR_EVENT_CFG(idx, type); + writel(reg, its_pmu->base + reg_info->event_ctrl0); +} + +static u64 hisi_its_pmu_read_counter(struct hisi_pmu *its_pmu, + struct hw_perf_event *hwc) +{ + struct hisi_its_pmu_regs *reg_info = its_pmu->dev_info->private; + + return readq(its_pmu->base + ITS_PMU_EVENT_CNTRn(reg_info->event_cntr0, hwc->idx)); +} + +static void hisi_its_pmu_write_counter(struct hisi_pmu *its_pmu, + struct hw_perf_event *hwc, u64 val) +{ + struct hisi_its_pmu_regs *reg_info = its_pmu->dev_info->private; + + writeq(val, its_pmu->base + ITS_PMU_EVENT_CNTRn(reg_info->event_cntr0, hwc->idx)); +} + +static void hisi_its_pmu_enable_counter(struct hisi_pmu *its_pmu, + struct hw_perf_event *hwc) +{ + struct hisi_its_pmu_regs *reg_info = its_pmu->dev_info->private; + u32 reg; + + reg = readl(its_pmu->base + reg_info->cntr_ctrl); + reg |= BIT(hwc->idx); + writel(reg, its_pmu->base + reg_info->cntr_ctrl); +} + +static void hisi_its_pmu_disable_counter(struct hisi_pmu *its_pmu, + struct hw_perf_event *hwc) +{ + struct hisi_its_pmu_regs *reg_info = its_pmu->dev_info->private; + u32 reg; + + reg = readl(its_pmu->base + reg_info->cntr_ctrl); + reg &= ~BIT(hwc->idx); + writel(reg, its_pmu->base + reg_info->cntr_ctrl); +} + +static void hisi_its_pmu_enable_counter_int(struct hisi_pmu *its_pmu, + struct hw_perf_event *hwc) +{ + /* We don't support interrupt, so a stub here. */ +} + +static void hisi_its_pmu_disable_counter_int(struct hisi_pmu *its_pmu, + struct hw_perf_event *hwc) +{ +} + +static void hisi_its_pmu_start_counters(struct hisi_pmu *its_pmu) +{ + struct hisi_its_pmu_regs *reg_info = its_pmu->dev_info->private; + u32 reg; + + reg = readl(its_pmu->base + reg_info->pmu_ctrl); + reg |= ITS_PMU_GLOBAL_CTRL_PMU_EN; + writel(reg, its_pmu->base + reg_info->pmu_ctrl); +} + +static void hisi_its_pmu_stop_counters(struct hisi_pmu *its_pmu) +{ + struct hisi_its_pmu_regs *reg_info = its_pmu->dev_info->private; + u32 reg; + + reg = readl(its_pmu->base + reg_info->pmu_ctrl); + reg &= ~ITS_PMU_GLOBAL_CTRL_PMU_EN; + writel(reg, its_pmu->base + reg_info->pmu_ctrl); +} + +static void hisi_its_pmu_enable_filter(struct perf_event *event) +{ + struct hisi_pmu *its_pmu = to_hisi_pmu(event->pmu); + u32 int_id = hisi_get_int_id(event); + u32 reg = int_id ? 0 : -1U; + + if (int_id) + writel(int_id, its_pmu->base + ITS_PMU_INT_ID_CTRL); + + writel(reg, its_pmu->base + ITS_PMU_INT_ID_MASK); +} + +static void hisi_its_pmu_disable_filter(struct perf_event *event) +{ + struct hisi_pmu *its_pmu = to_hisi_pmu(event->pmu); + u32 int_id = hisi_get_int_id(event); + + if (bitmap_weight(its_pmu->pmu_events.used_mask, its_pmu->num_counters) > 1) + return; + + if (int_id) { + writel(0, its_pmu->base + ITS_PMU_INT_ID_CTRL); + writel(-1U, its_pmu->base + ITS_PMU_INT_ID_MASK); + } +} + +static const struct hisi_uncore_ops hisi_uncore_its_ops = { + .write_evtype = hisi_its_pmu_write_evtype, + .get_event_idx = hisi_uncore_pmu_get_event_idx, + .read_counter = hisi_its_pmu_read_counter, + .write_counter = hisi_its_pmu_write_counter, + .enable_counter = hisi_its_pmu_enable_counter, + .disable_counter = hisi_its_pmu_disable_counter, + .enable_counter_int = hisi_its_pmu_enable_counter_int, + .disable_counter_int = hisi_its_pmu_disable_counter_int, + .start_counters = hisi_its_pmu_start_counters, + .stop_counters = hisi_its_pmu_stop_counters, + .enable_filter = hisi_its_pmu_enable_filter, + .disable_filter = hisi_its_pmu_disable_filter, +}; + +static struct attribute *hisi_its_pmu_format_attrs[] = { + HISI_PMU_FORMAT_ATTR(event, "config:0-16"), + HISI_PMU_FORMAT_ATTR(int_id, "config1:0-31"), + NULL +}; + +static const struct attribute_group hisi_its_pmu_format_group = { + .name = "format", + .attrs = hisi_its_pmu_format_attrs, +}; + +static struct attribute *hisi_its_pmu_events_attrs[] = { + HISI_PMU_EVENT_ATTR(lpi_num, 0xc0), + HISI_PMU_EVENT_ATTR(lpi_time, 0x80), + HISI_PMU_EVENT_ATTR(sgi_num, 0xc1), + HISI_PMU_EVENT_ATTR(sgi_time, 0x81), + HISI_PMU_EVENT_ATTR(ppi_num, 0xc2), + HISI_PMU_EVENT_ATTR(ppi_time, 0x82), + HISI_PMU_EVENT_ATTR(sl3_lpi_num, 0xc3), + HISI_PMU_EVENT_ATTR(sl3_sgi_num, 0xc4), + HISI_PMU_EVENT_ATTR(sl3_ppi_num, 0xc5), + HISI_PMU_EVENT_ATTR(sl0_ddr_read, 0xc9), + HISI_PMU_EVENT_ATTR(sl0_ddr_time, 0x89), + HISI_PMU_EVENT_ATTR(sl1_ddr_read, 0xca), + HISI_PMU_EVENT_ATTR(sl1_ddr_time, 0x8a), + HISI_PMU_EVENT_ATTR(sl2_ddr_read, 0xcb), + HISI_PMU_EVENT_ATTR(sl2_ddr_time, 0x8b), + HISI_PMU_EVENT_ATTR(cycles, 0xcc), + NULL +}; + +static const struct attribute_group hisi_its_pmu_events_group = { + .name = "events", + .attrs = hisi_its_pmu_events_attrs, +}; + +static const struct attribute_group *hisi_its_pmu_attr_groups[] = { + &hisi_its_pmu_format_group, + &hisi_its_pmu_events_group, + &hisi_pmu_cpumask_attr_group, + &hisi_pmu_identifier_group, + NULL +}; + +static int hisi_its_pmu_dev_init(struct platform_device *pdev, struct hisi_pmu *its_pmu) +{ + struct hisi_its_pmu_regs *reg_info; + + hisi_uncore_pmu_init_topology(its_pmu, &pdev->dev); + + if (its_pmu->topo.scl_id < 0) + return dev_err_probe(&pdev->dev, -EINVAL, "failed to get scl-id\n"); + + if (its_pmu->topo.index_id < 0) + return dev_err_probe(&pdev->dev, -EINVAL, "failed to get idx-id\n"); + + its_pmu->base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(its_pmu->base)) + return dev_err_probe(&pdev->dev, PTR_ERR(its_pmu->base), + "fail to remap io memory\n"); + + its_pmu->dev_info = device_get_match_data(&pdev->dev); + if (!its_pmu->dev_info) + return -ENODEV; + + its_pmu->pmu_events.attr_groups = its_pmu->dev_info->attr_groups; + its_pmu->counter_bits = its_pmu->dev_info->counter_bits; + its_pmu->check_event = its_pmu->dev_info->check_event; + its_pmu->num_counters = ITS_PMU_NR_COUNTERS; + its_pmu->ops = &hisi_uncore_its_ops; + its_pmu->dev = &pdev->dev; + its_pmu->on_cpu = -1; + + reg_info = its_pmu->dev_info->private; + its_pmu->identifier = readl(its_pmu->base + reg_info->version); + + return 0; +} + +static void hisi_its_pmu_remove_cpuhp_instance(void *hotplug_node) +{ + cpuhp_state_remove_instance_nocalls(hisi_its_pmu_cpuhp_state, hotplug_node); +} + +static void hisi_its_pmu_unregister_pmu(void *pmu) +{ + perf_pmu_unregister(pmu); +} + +static int hisi_its_pmu_probe(struct platform_device *pdev) +{ + struct device *dev = &pdev->dev; + struct hisi_pmu *its_pmu; + char *name; + int ret; + + its_pmu = devm_kzalloc(dev, sizeof(*its_pmu), GFP_KERNEL); + if (!its_pmu) + return -ENOMEM; + + /* + * HiSilicon Uncore PMU framework needs to get common hisi_pmu device + * from device's drvdata. + */ + platform_set_drvdata(pdev, its_pmu); + + ret = hisi_its_pmu_dev_init(pdev, its_pmu); + if (ret) + return ret; + + ret = cpuhp_state_add_instance(hisi_its_pmu_cpuhp_state, &its_pmu->node); + if (ret) + return dev_err_probe(dev, ret, "Fail to register cpuhp instance\n"); + + ret = devm_add_action_or_reset(dev, hisi_its_pmu_remove_cpuhp_instance, + &its_pmu->node); + if (ret) + return ret; + + hisi_pmu_init(its_pmu, THIS_MODULE); + + name = devm_kasprintf(dev, GFP_KERNEL, "hisi_scl%d_its%d", + its_pmu->topo.scl_id, its_pmu->topo.index_id); + if (!name) + return -ENOMEM; + + ret = perf_pmu_register(&its_pmu->pmu, name, -1); + if (ret) + return dev_err_probe(dev, ret, "Fail to register PMU\n"); + + return devm_add_action_or_reset(dev, hisi_its_pmu_unregister_pmu, + &its_pmu->pmu); +} + +static struct hisi_its_pmu_regs hisi_its_v1_pmu_regs = { + .version = ITS_PMU_VERSION, + .pmu_ctrl = ITS_PMU_GLOBAL_CTRL, + .event_ctrl0 = ITS_PMU_EVENT_CTRL, + .event_cntr0 = ITS_PMU_COUNTER0, + .cntr_ctrl = ITS_PMU_COUNTER_CTRL, +}; + +static const struct hisi_pmu_dev_info hisi_its_v1 = { + .attr_groups = hisi_its_pmu_attr_groups, + .counter_bits = 48, + .check_event = ITS_PMU_EVENT_CTRL_TYPE, + .private = &hisi_its_v1_pmu_regs, +}; + +static const struct acpi_device_id hisi_its_pmu_ids[] = { + { "HISI0591", (kernel_ulong_t) &hisi_its_v1 }, + { } +}; +MODULE_DEVICE_TABLE(acpi, hisi_its_pmu_ids); + +static struct platform_driver hisi_its_pmu_driver = { + .driver = { + .name = "hisi_its_pmu", + .acpi_match_table = hisi_its_pmu_ids, + .suppress_bind_attrs = true, + }, + .probe = hisi_its_pmu_probe, +}; + +static int __init hisi_its_pmu_module_init(void) +{ + int ret = cpuhp_setup_state_multi(CPUHP_AP_ONLINE_DYN, + "perf/hisi/its:online", + hisi_uncore_pmu_online_cpu, + hisi_uncore_pmu_offline_cpu); + if (ret < 0) { + pr_err("hisi_its_pmu: Fail to setup cpuhp callbacks, ret = %d\n", ret); + return ret; + } + hisi_its_pmu_cpuhp_state = ret; + + ret = platform_driver_register(&hisi_its_pmu_driver); + if (ret) + cpuhp_remove_multi_state(hisi_its_pmu_cpuhp_state); + + return ret; +} +module_init(hisi_its_pmu_module_init); + +static void __exit hisi_its_pmu_module_exit(void) +{ + platform_driver_unregister(&hisi_its_pmu_driver); + cpuhp_remove_multi_state(hisi_its_pmu_cpuhp_state); +} +module_exit(hisi_its_pmu_module_exit); + +MODULE_IMPORT_NS(HISI_PMU); +MODULE_DESCRIPTION("HiSilicon SoC Uncore ITS PMU driver"); +MODULE_LICENSE("GPL"); -- 2.33.0

2 1

[PATCH OLK-6.6] xsched: xcu cgrp kabi
by Liu Kai 26 Mar '26

26 Mar '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8424 ---------------------------------------- to do Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 3 +- arch/x86/configs/openeuler_defconfig | 3 +- include/linux/cgroup_subsys.h | 8 +- include/linux/device_cgroup.h | 28 +++++ include/linux/xsched.h | 2 + kernel/xsched/cgroup.c | 138 +++++++++++++++++++++++-- security/device_cgroup.c | 48 +++++++-- 7 files changed, 208 insertions(+), 22 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index fc581adb563b..622d44e6d9ff 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -101,7 +101,8 @@ CONFIG_XCU_SCHEDULER=y CONFIG_XCU_VSTREAM=y CONFIG_XSCHED_NR_CUS=128 CONFIG_XCU_SCHED_RT=y -# CONFIG_XCU_SCHED_CFS is not set +CONFIG_XCU_SCHED_CFS=y +CONFIG_CGROUP_XCU=y # # CPU/Task time and stats accounting diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index d493dbf6b8a1..e66724b15bb4 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -121,7 +121,8 @@ CONFIG_XCU_SCHEDULER=y CONFIG_XCU_VSTREAM=y CONFIG_XSCHED_NR_CUS=128 CONFIG_XCU_SCHED_RT=y -# CONFIG_XCU_SCHED_CFS is not set +CONFIG_XCU_SCHED_CFS=y +CONFIG_CGROUP_XCU=y # # CPU/Task time and stats accounting diff --git a/include/linux/cgroup_subsys.h b/include/linux/cgroup_subsys.h index e65ae90946c2..4130c924f47c 100644 --- a/include/linux/cgroup_subsys.h +++ b/include/linux/cgroup_subsys.h @@ -29,7 +29,9 @@ SUBSYS(io) SUBSYS(memory) #endif -#if IS_ENABLED(CONFIG_CGROUP_DEVICE) +#if IS_ENABLED(CONFIG_CGROUP_XCU) +SUBSYS(xcu) +#elif IS_ENABLED(CONFIG_CGROUP_DEVICE) SUBSYS(devices) #endif @@ -61,10 +63,6 @@ SUBSYS(pids) SUBSYS(rdma) #endif -#if IS_ENABLED(CONFIG_CGROUP_XCU) -SUBSYS(xcu) -#endif - #if IS_ENABLED(CONFIG_CGROUP_MISC) SUBSYS(misc) #endif diff --git a/include/linux/device_cgroup.h b/include/linux/device_cgroup.h index d02f32b7514e..ee84ce61546c 100644 --- a/include/linux/device_cgroup.h +++ b/include/linux/device_cgroup.h @@ -1,6 +1,10 @@ /* SPDX-License-Identifier: GPL-2.0 */ #include <linux/fs.h> +#ifdef CONFIG_CGROUP_XCU +#include <linux/cgroup-defs.h> +#endif + #define DEVCG_ACC_MKNOD 1 #define DEVCG_ACC_READ 2 #define DEVCG_ACC_WRITE 4 @@ -65,3 +69,27 @@ static inline int devcgroup_inode_permission(struct inode *inode, int mask) static inline int devcgroup_inode_mknod(int mode, dev_t dev) { return 0; } #endif + +#ifdef CONFIG_CGROUP_XCU +/* + * When CONFIG_CGROUP_XCU is enabled, devices_cgrp_subsys and xcu_cgrp_subsys + * share the same set of cgroup_subsys hook functions. Consequently, the hooks for + * devices_cgrp_subsys must be exposed externally to allow linkage with the XCU + * cgroup_subsys. + * + * The STATIC macro is used to handle this conditional visibility: + * - Enabled: interfaces are defined as non-static (exported). + * - Disabled: interfaces remain static (file-local). + */ +#define STATIC +#define devices_cgrp_id xcu_cgrp_id + +extern struct cftype dev_cgroup_files[]; +int devcgroup_online(struct cgroup_subsys_state *css); +void devcgroup_offline(struct cgroup_subsys_state *css); +struct cgroup_subsys_state * +devcgroup_css_alloc(struct cgroup_subsys_state *parent_css); +void devcgroup_css_free(struct cgroup_subsys_state *css); +#else +#define STATIC static +#endif diff --git a/include/linux/xsched.h b/include/linux/xsched.h index ff314f88169f..e9c580149d55 100644 --- a/include/linux/xsched.h +++ b/include/linux/xsched.h @@ -485,6 +485,8 @@ void xsched_quota_account(struct xsched_group *xg, s64 exec_time); void xsched_quota_check(struct xsched_group *xg, struct xsched_cu *xcu); void xsched_quota_refill(struct work_struct *work); +bool xcu_cgroup_enabled(void); + #define XCU_PERIOD_MIN_MS 1 #define XCU_QUOTA_RUNTIME_INF -1 #define XCU_SHARES_MIN 1 diff --git a/kernel/xsched/cgroup.c b/kernel/xsched/cgroup.c index 73f044475939..53f958f7b844 100644 --- a/kernel/xsched/cgroup.c +++ b/kernel/xsched/cgroup.c @@ -20,6 +20,7 @@ #include <linux/slab.h> #include <linux/xsched.h> #include <linux/delay.h> +#include <linux/device_cgroup.h> static struct xsched_group root_xsched_group; struct xsched_group *root_xcg = &root_xsched_group; @@ -39,6 +40,61 @@ static const char xcu_sched_name[XSCHED_TYPE_NUM][SCHED_CLASS_MAX_LENGTH] = { [XSCHED_TYPE_CFS] = "cfs" }; +/* + * xcu_mode: + * 0 = disable (devices cgroup) + * 1 = enable (xcu cgroup) + */ +static int xcu_mode; + +/** + * Parse the "xcu=" kernel command line parameter. + * + * Usage: + * xcu=enable → enable xcu_cgrp_subsys + * Otherwise → enable devices_cgrp_subsys + * + * Returns: + * 1 (handled), 0 (not handled) + */ +static int __init xcu_setup(char *str) +{ + if (!str) + return 0; + + if (strcmp(str, "enable") == 0) + xcu_mode = 1; + + return 1; +} +__setup("xcu=", xcu_setup); + +bool xcu_cgroup_enabled(void) +{ + return xcu_mode; +} + +/** + * xcu_cgroup_check_compat - Verify XCU mode matches the cgroup hierarchy version. + * + * Checks if the current xcu_mode aligns with the cgroup subsystem's default + * hierarchy status. + * + * IMPORTANT: cgroup_subsys_on_dfl() only returns a valid version indicator + * after the cgroup filesystem has been mounted at the root node. Calling + * this function prior to mount may yield incorrect results. + * + * Return: true if compatible, false otherwise (with a warning logged). + */ +bool xcu_cgroup_check_compat(void) +{ + if (xcu_mode != cgroup_subsys_on_dfl(xcu_cgrp_subsys)) { + XSCHED_WARN("XCU cgrp is incompatible with the cgroup version\n"); + return false; + } + return true; +} + static int xcu_cg_set_file_show(struct xsched_group *xg, int sched_class) { if (!xg) { @@ -742,6 +798,7 @@ static struct cftype xcu_cg_files[] = { }, { .name = "stat", + .flags = CFTYPE_NOT_ON_ROOT, .seq_show = xcu_stat, }, { @@ -753,17 +810,80 @@ static struct cftype xcu_cg_files[] = { {} /* terminate */ }; +static struct cgroup_subsys_state * +xcu_devices_compat_css_alloc(struct cgroup_subsys_state *parent_css) +{ + if (parent_css && xcu_cgroup_check_compat()) + return ERR_PTR(-EPERM); + + if (xcu_cgroup_enabled()) + return xcu_css_alloc(parent_css); + + return devcgroup_css_alloc(parent_css); +} + +static int xcu_devices_compat_css_online(struct cgroup_subsys_state *css) +{ + if (xcu_cgroup_enabled()) + return xcu_css_online(css); + + return devcgroup_online(css); +} + +static void xcu_devices_compat_css_offline(struct cgroup_subsys_state *css) +{ + if (xcu_cgroup_enabled()) + return xcu_css_offline(css); + + return devcgroup_offline(css); +} + +static void xcu_devices_compat_css_released(struct cgroup_subsys_state *css) +{ + if (xcu_cgroup_enabled()) + return xcu_css_released(css); +} + +static void xcu_devices_compat_css_free(struct cgroup_subsys_state *css) +{ + if (xcu_cgroup_enabled()) + return xcu_css_free(css); + + return devcgroup_css_free(css); +} + +static int xcu_devices_compat_can_attach(struct cgroup_taskset *tset) +{ + if (xcu_cgroup_enabled()) + return xcu_can_attach(tset); + + return 0; +} + +static void xcu_devices_compat_cancel_attach(struct cgroup_taskset *tset) +{ + if (xcu_cgroup_enabled()) + return xcu_cancel_attach(tset); +} + +static void xcu_devices_compat_attach(struct cgroup_taskset *tset) +{ + if (xcu_cgroup_enabled()) + return xcu_attach(tset); +} + struct cgroup_subsys xcu_cgrp_subsys = { - .css_alloc = xcu_css_alloc, - .css_online = xcu_css_online, - .css_offline = xcu_css_offline, - .css_released = xcu_css_released, - .css_free = xcu_css_free, - .can_attach = xcu_can_attach, - .cancel_attach = xcu_cancel_attach, - .attach = xcu_attach, + .css_alloc = xcu_devices_compat_css_alloc, + .css_online = xcu_devices_compat_css_online, + .css_offline = xcu_devices_compat_css_offline, + .css_released = xcu_devices_compat_css_released, + .css_free = xcu_devices_compat_css_free, + .can_attach = xcu_devices_compat_can_attach, + .cancel_attach = xcu_devices_compat_cancel_attach, + .attach = xcu_devices_compat_attach, .dfl_cftypes = xcu_cg_files, - .legacy_cftypes = xcu_cg_files, + .legacy_cftypes = dev_cgroup_files, + .legacy_name = "devices", .early_init = false, .threaded = true }; diff --git a/security/device_cgroup.c b/security/device_cgroup.c index dc4df7475081..72b471e0e0fd 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c @@ -16,6 +16,10 @@ #include <linux/rcupdate.h> #include <linux/mutex.h> +#ifdef CONFIG_CGROUP_XCU +#include <linux/xsched.h> +#endif + #ifdef CONFIG_CGROUP_DEVICE static DEFINE_MUTEX(devcgroup_mutex); @@ -185,7 +189,7 @@ static inline bool is_devcg_online(const struct dev_cgroup *devcg) * @css: css getting online * returns 0 in case of success, error code otherwise */ -static int devcgroup_online(struct cgroup_subsys_state *css) +STATIC int devcgroup_online(struct cgroup_subsys_state *css) { struct dev_cgroup *dev_cgroup = css_to_devcgroup(css); struct dev_cgroup *parent_dev_cgroup = css_to_devcgroup(css->parent); @@ -206,7 +210,7 @@ static int devcgroup_online(struct cgroup_subsys_state *css) return ret; } -static void devcgroup_offline(struct cgroup_subsys_state *css) +STATIC void devcgroup_offline(struct cgroup_subsys_state *css) { struct dev_cgroup *dev_cgroup = css_to_devcgroup(css); @@ -218,7 +222,7 @@ static void devcgroup_offline(struct cgroup_subsys_state *css) /* * called from kernel/cgroup/cgroup.c with cgroup_lock() held. */ -static struct cgroup_subsys_state * +STATIC struct cgroup_subsys_state * devcgroup_css_alloc(struct cgroup_subsys_state *parent_css) { struct dev_cgroup *dev_cgroup; @@ -232,7 +236,7 @@ devcgroup_css_alloc(struct cgroup_subsys_state *parent_css) return &dev_cgroup->css; } -static void devcgroup_css_free(struct cgroup_subsys_state *css) +STATIC void devcgroup_css_free(struct cgroup_subsys_state *css) { struct dev_cgroup *dev_cgroup = css_to_devcgroup(css); @@ -280,10 +284,20 @@ static void set_majmin(char *str, unsigned m) static int devcgroup_seq_show(struct seq_file *m, void *v) { - struct dev_cgroup *devcgroup = css_to_devcgroup(seq_css(m)); + struct dev_cgroup *devcgroup; struct dev_exception_item *ex; char maj[MAJMINLEN], min[MAJMINLEN], acc[ACCLEN]; +#ifdef CONFIG_CGROUP_XCU + /* + * When the XCU subsystem is enabled but cgroup v1 is mounted, + * operations on the devices subsystem interfaces are not permitted. + */ + if (xcu_cgroup_enabled()) + return -EPERM; +#endif /* CONFIG_CGROUP_XCU */ + + devcgroup = css_to_devcgroup(seq_css(m)); rcu_read_lock(); /* * To preserve the compatibility: @@ -786,6 +800,15 @@ static ssize_t devcgroup_access_write(struct kernfs_open_file *of, { int retval; +#ifdef CONFIG_CGROUP_XCU + /* + * When the XCU subsystem is enabled but cgroup v1 is mounted, + * operations on the devices subsystem interfaces are not permitted. + */ + if (xcu_cgroup_enabled()) + return -EPERM; +#endif /* CONFIG_CGROUP_XCU */ + mutex_lock(&devcgroup_mutex); retval = devcgroup_update_access(css_to_devcgroup(of_css(of)), of_cft(of)->private, strstrip(buf)); @@ -793,7 +816,7 @@ static ssize_t devcgroup_access_write(struct kernfs_open_file *of, return retval ?: nbytes; } -static struct cftype dev_cgroup_files[] = { +STATIC struct cftype dev_cgroup_files[] = { { .name = "allow", .write = devcgroup_access_write, @@ -835,6 +858,19 @@ static int devcgroup_legacy_check_permission(short type, u32 major, u32 minor, struct dev_cgroup *dev_cgroup; bool rc; +#ifdef CONFIG_CGROUP_XCU + /* + * When CONFIG_CGROUP_XCU is enabled and "xcu=enable" is set on the command line, + * xcu_cgrp_subsys is used instead of the standard devices_cgrp_subsys. + * In this case, task_devcgroup() returns an invalid dev_cgroup, which would + * trigger an exception if processed further. + * This scenario is effectively equivalent to having CONFIG_CGROUP_DEVICE disabled. + * Therefore, we can safely return 0 here without proceeding further. + */ + if (xcu_cgroup_enabled()) + return 0; +#endif /* CONFIG_CGROUP_XCU */ + rcu_read_lock(); dev_cgroup = task_devcgroup(current); if (dev_cgroup->behavior == DEVCG_DEFAULT_ALLOW) -- 2.34.1

2 1

[PATCH OLK-6.6] nvme: fix memory allocation in nvme_pr_read_keys()
by Long Li 26 Mar '26

26 Mar '26

From: Sungwoo Kim <iam(a)sung-woo.kim> mainline inclusion from mainline-v6.17-rc7 commit c3320153769f05fd7fe9d840cb555dd3080ae424 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13870 CVE: CVE-2026-23244 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nvme_pr_read_keys() takes num_keys from userspace and uses it to calculate the allocation size for rse via struct_size(). The upper limit is PR_KEYS_MAX (64K). A malicious or buggy userspace can pass a large num_keys value that results in a 4MB allocation attempt at most, causing a warning in the page allocator when the order exceeds MAX_PAGE_ORDER. To fix this, use kvzalloc() instead of kzalloc(). This bug has the same reasoning and fix with the patch below: https://lore.kernel.org/linux-block/20251212013510.3576091-1-kartikey406@gm… Warning log: WARNING: mm/page_alloc.c:5216 at __alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216, CPU#1: syz-executor117/272 Modules linked in: CPU: 1 UID: 0 PID: 272 Comm: syz-executor117 Not tainted 6.19.0 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:__alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216 Code: ff 83 bd a8 fe ff ff 0a 0f 86 69 fb ff ff 0f b6 1d f9 f9 c4 04 80 fb 01 0f 87 3b 76 30 ff 83 e3 01 75 09 c6 05 e4 f9 c4 04 01 <0f> 0b 48 c7 85 70 fe ff ff 00 00 00 00 e9 8f fd ff ff 31 c0 e9 0d RSP: 0018:ffffc90000fcf450 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffff920001f9ea0 RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000040dc0 RBP: ffffc90000fcf648 R08: ffff88800b6c3380 R09: 0000000000000001 R10: ffffc90000fcf840 R11: ffff88807ffad280 R12: 0000000000000000 R13: 0000000000040dc0 R14: 0000000000000001 R15: ffffc90000fcf620 FS: 0000555565db33c0(0000) GS:ffff8880be26c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000000c CR3: 0000000003b72000 CR4: 00000000000006f0 Call Trace: <TASK> alloc_pages_mpol+0x236/0x4d0 mm/mempolicy.c:2486 alloc_frozen_pages_noprof+0x149/0x180 mm/mempolicy.c:2557 ___kmalloc_large_node+0x10c/0x140 mm/slub.c:5598 __kmalloc_large_node_noprof+0x25/0xc0 mm/slub.c:5629 __do_kmalloc_node mm/slub.c:5645 [inline] __kmalloc_noprof+0x483/0x6f0 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] nvme_pr_read_keys+0x8f/0x4c0 drivers/nvme/host/pr.c:245 blkdev_pr_read_keys block/ioctl.c:456 [inline] blkdev_common_ioctl+0x1b71/0x29b0 block/ioctl.c:730 blkdev_ioctl+0x299/0x700 block/ioctl.c:786 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x1bf/0x220 fs/ioctl.c:583 x64_sys_call+0x1280/0x21b0 mnt/fuzznvme_1/fuzznvme/linux-build/v6.19/./arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x71/0x330 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fb893d3108d Code: 28 c3 e8 46 1e 00 00 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffff61f2f38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffff61f3138 RCX: 00007fb893d3108d RDX: 0000000020000040 RSI: 00000000c01070ce RDI: 0000000000000003 RBP: 0000000000000001 R08: 0000000000000000 R09: 00007ffff61f3138 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffff61f3128 R14: 00007fb893dae530 R15: 0000000000000001 </TASK> Fixes: 5fd96a4e15de (nvme: Add pr_ops read_keys support) Acked-by: Chao Shi <cshi008(a)fiu.edu> Acked-by: Weidong Zhu <weizhu(a)fiu.edu> Acked-by: Dave Tian <daveti(a)purdue.edu> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Hannes Reinecke <hare(a)suse.de> Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/pr.c [Context conflicts] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- drivers/nvme/host/pr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/host/pr.c b/drivers/nvme/host/pr.c index 803efc97fd1e..08b8965bd945 100644 --- a/drivers/nvme/host/pr.c +++ b/drivers/nvme/host/pr.c @@ -213,7 +213,7 @@ static int nvme_pr_read_keys(struct block_device *bdev, * enough to get enough keys to fill the return keys buffer. */ rse_len = struct_size(rse, regctl_eds, num_keys); - rse = kzalloc(rse_len, GFP_KERNEL); + rse = kvzalloc(rse_len, GFP_KERNEL); if (!rse) return -ENOMEM; @@ -238,7 +238,7 @@ static int nvme_pr_read_keys(struct block_device *bdev, } free_rse: - kfree(rse); + kvfree(rse); return ret; } -- 2.39.2

2 1

[PATCH OLK-6.6 0/5] Transition from CPU Type to MIDR Register for Virtualization Feature Detection
by liqiqi 25 Mar '26

25 Mar '26

Currently, there are two methods for determining whether a chip supports specific virtualization features: 1. Reading the chip's CPU type from BIOS 2. Reading the value of the MIDR register The issue with the first method is that each time a new chip is introduced, the new CPU type must be defined, which leads to poor code portability and maintainability. Therefore, the second method has been adopted to replace the first. This approach eliminates the dependency on CPU type by using the MIDR register and removes the need for defining CPU types and their related interfaces. liqiqi (5): kvm: arm64: use MIDR_HISI_TSV110 to determine whether NCSNP is supported kvm: arm64: Add HIP10, HIP10C MIDR definitions kvm: arm64: Use MIDR to determine whether DVMBM is supported kvm: arm64: Use MIDR to determine whether IPIv is supported kvm: arm64: Remove cpu_type definition and it's related interfaces arch/arm64/include/asm/cputype.h | 4 + arch/arm64/kvm/arm.c | 1 - arch/arm64/kvm/hisilicon/hisi_virt.c | 111 +++------------------------ arch/arm64/kvm/hisilicon/hisi_virt.h | 12 --- 4 files changed, 15 insertions(+), 113 deletions(-) -- 2.43.0

2 6

[PATCH OLK-6.6] perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
by Luo Gengkun 25 Mar '26

25 Mar '26

From: Peter Zijlstra <peterz(a)infradead.org> mainline inclusion from mainline-v7.0-rc2 commit c9bc1753b3cc41d0e01fbca7f035258b5f4db0ae category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13907 CVE: CVE-2026-23271 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- Make sure that __perf_event_overflow() runs with IRQs disabled for all possible callchains. Specifically the software events can end up running it with only preemption disabled. This opens up a race vs perf_event_exit_event() and friends that will go and free various things the overflow path expects to be present, like the BPF program. Fixes: 592903cdcbf6 ("perf_counter: add an event_list") Reported-by: Simond Hu <cmdhh1767(a)gmail.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Tested-by: Simond Hu <cmdhh1767(a)gmail.com> Link: https://patch.msgid.link/20260224122909.GV1395416@noisy.programming.kicks-a… Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 42 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index e5c2105625a2..1d3f8eed6d0d 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -9708,6 +9708,13 @@ int perf_event_overflow(struct perf_event *event, struct perf_sample_data *data, struct pt_regs *regs) { + /* + * Entry point from hardware PMI, interrupts should be disabled here. + * This serializes us against perf_event_remove_from_context() in + * things like perf_event_release_kernel(). + */ + lockdep_assert_irqs_disabled(); + return __perf_event_overflow(event, 1, data, regs); } @@ -9788,6 +9795,19 @@ static void perf_swevent_event(struct perf_event *event, u64 nr, { struct hw_perf_event *hwc = &event->hw; + /* + * This is: + * - software preempt + * - tracepoint preempt + * - tp_target_task irq (ctx->lock) + * - uprobes preempt/irq + * - kprobes preempt/irq + * - hw_breakpoint irq + * + * Any of these are sufficient to hold off RCU and thus ensure @event + * exists. + */ + lockdep_assert_preemption_disabled(); local64_add(nr, &event->count); if (!regs) @@ -9796,6 +9816,16 @@ static void perf_swevent_event(struct perf_event *event, u64 nr, if (!is_sampling_event(event)) return; + /* + * Serialize against event_function_call() IPIs like normal overflow + * event handling. Specifically, must not allow + * perf_event_release_kernel() -> perf_remove_from_context() to make + * progress and 'release' the event from under us. + */ + guard(irqsave)(); + if (event->state != PERF_EVENT_STATE_ACTIVE) + return; + if ((event->attr.sample_type & PERF_SAMPLE_PERIOD) && !event->attr.freq) { data->period = nr; return perf_swevent_overflow(event, 1, data, regs); @@ -10299,6 +10329,11 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size, struct perf_sample_data data; struct perf_event *event; + /* + * Per being a tracepoint, this runs with preemption disabled. + */ + lockdep_assert_preemption_disabled(); + struct perf_raw_record raw = { .frag = { .size = entry_size, @@ -10712,6 +10747,11 @@ void perf_bp_event(struct perf_event *bp, void *data) struct perf_sample_data sample; struct pt_regs *regs = data; + /* + * Exception context, will have interrupts disabled. + */ + lockdep_assert_irqs_disabled(); + perf_sample_data_init(&sample, bp->attr.bp_addr, 0); if (!bp->hw.state && !perf_exclude_event(bp, regs)) @@ -11164,7 +11204,7 @@ static enum hrtimer_restart perf_swevent_hrtimer(struct hrtimer *hrtimer) if (regs && !perf_exclude_event(event, regs)) { if (!(event->attr.exclude_idle && is_idle_task(current))) - if (__perf_event_overflow(event, 1, &data, regs)) + if (perf_event_overflow(event, &data, regs)) ret = HRTIMER_NORESTART; } -- 2.34.1

2 1

[PATCH 0/5] Transition from CPU Type to MIDR Register for Virtualization Feature Detection
by liqiqi 25 Mar '26

25 Mar '26

Currently, there are two methods for determining whether a chip supports specific virtualization features: 1. Reading the chip's CPU type from BIOS 2. Reading the value of the MIDR register The issue with the first method is that each time a new chip is introduced, the new CPU type must be defined, which leads to poor code portability and maintainability. Therefore, the second method has been adopted to replace the first. This approach eliminates the dependency on CPU type by using the MIDR register and removes the need for defining CPU types and their related interfaces. liqiqi (5): kvm: arm64: use MIDR_HISI_TSV110 to determine whether NCSNP is supported kvm: arm64: Add HIP10, HIP10C MIDR definitions kvm: arm64: Use MIDR to determine whether DVMBM is supported kvm: arm64: Use MIDR to determine whether IPIv is supported kvm: arm64: Remove cpu_type definition and it's related interfaces arch/arm64/include/asm/cputype.h | 4 + arch/arm64/kvm/arm.c | 1 - arch/arm64/kvm/hisilicon/hisi_virt.c | 111 +++------------------------ arch/arm64/kvm/hisilicon/hisi_virt.h | 12 --- 4 files changed, 15 insertions(+), 113 deletions(-) -- 2.43.0

1 5

[PATCH OLK-6.6] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
by Chen Jinghuang 25 Mar '26

25 Mar '26

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v7.0-rc2 commit bfbc0b5b32a8f28ce284add619bf226716a59bc0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13873 CVE: CVE-2026-23253 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which reinitializes the waitqueue list head to empty. Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the same DVR device share it), this orphans any existing waitqueue entries from io_uring poll or epoll, leaving them with stale prev/next pointers while the list head is reset to {self, self}. The waitqueue and spinlock in dvr_buffer are already properly initialized once in dvb_dmxdev_init(). The open path only needs to reset the buffer data pointer, size, and read/write positions. Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct assignment of data/size and a call to dvb_ringbuffer_reset(), which properly resets pread, pwrite, and error with correct memory ordering without touching the waitqueue or spinlock. Cc: stable(a)vger.kernel.org Fixes: 34731df288a5 ("V4L/DVB (3501): Dmxdev: use dvb_ringbuffer") Reported-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ab12f0c08dd7ab8d057c Tested-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/all/698a26d3.050a0220.3b3015.007d.GAE@google.com/ Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflicts: drivers/media/dvb-core/dmxdev.c [context conflict] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/media/dvb-core/dmxdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c index 9ce5f010de3f..4ce3ae3954c5 100644 --- a/drivers/media/dvb-core/dmxdev.c +++ b/drivers/media/dvb-core/dmxdev.c @@ -168,7 +168,9 @@ static int dvb_dvr_open(struct inode *inode, struct file *file) mutex_unlock(&dmxdev->mutex); return -ENOMEM; } - dvb_ringbuffer_init(&dmxdev->dvr_buffer, mem, DVR_BUFFER_SIZE); + dmxdev->dvr_buffer.data = mem; + dmxdev->dvr_buffer.size = DVR_BUFFER_SIZE; + dvb_ringbuffer_reset(&dmxdev->dvr_buffer); if (dmxdev->may_do_mmap) dvb_vb2_init(&dmxdev->dvr_vb2_ctx, "dvr", file->f_flags & O_NONBLOCK); -- 2.34.1

2 1

[PATCH 0/5] Transition from CPU Type to MIDR Register for Virtualization Feature Detection
by liqiqi 25 Mar '26

25 Mar '26

Currently, there are two methods for determining whether a chip supports specific virtualization features: 1. Reading the chip's CPU type from BIOS 2. Reading the value of the MIDR register The issue with the first method is that each time a new chip is introduced, the new CPU type must be defined, which leads to poor code portability and maintainability. Therefore, the second method has been adopted to replace the first. This approach eliminates the dependency on CPU type by using the MIDR register and removes the need for defining CPU types and their related interfaces. liqiqi (5): kvm: arm64: use MIDR_HISI_TSV110 to determine whether NCSNP is supported kvm: arm64: Add HIP10, HIP10C MIDR definitions kvm: arm64: Use MIDR to determine whether DVMBM is supported kvm: arm64: Use MIDR to determine whether IPIv is supported kvm: arm64: Remove cpu_type definition and it's related interfaces arch/arm64/include/asm/cputype.h | 4 + arch/arm64/kvm/arm.c | 1 - arch/arm64/kvm/hisilicon/hisi_virt.c | 111 +++------------------------ arch/arm64/kvm/hisilicon/hisi_virt.h | 12 --- 4 files changed, 15 insertions(+), 113 deletions(-) -- 2.43.0

1 5

[PATCH OLK-6.6] arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled
by Wupeng Ma 24 Mar '26

24 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8386 ------------------------------------------ If CONFIG_ARCH_HAS_COPY_MC is not enabled, kernel can not be compiled with the following error: aarch64-linux-gnu-ld: arch/arm64/mm/flush.o: in function `copy_mc_to_user_page': arch/arm64/mm/flush.c:56:(.text+0x3a4): undefined reference to `memcpy_mc' aarch64-linux-gnu-ld: mm/memory.o: in function `__access_remote_vm': mm/memory.c:6674:(.text+0xe138): undefined reference to `memcpy_mc' aarch64-linux-gnu-ld: mm/kasan/shadow.o: in function `memcpy_mc': mm/kasan/shadow.c:90:(.text+0xa94): undefined reference to `__memcpy_mc' Fix this by add stub function of memcpy_mc which just call memcpy. Fixes: d51d1b114c86 ("arm64: mm: support recovery from copy_{from/to}_user_page()") Fixes: b991780c836c ("arm64: introduce copy_mc_to_kernel() implementation") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/include/asm/string.h | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/arch/arm64/include/asm/string.h b/arch/arm64/include/asm/string.h index 23eca4fb24fa6..97844a8e3ed3a 100644 --- a/arch/arm64/include/asm/string.h +++ b/arch/arm64/include/asm/string.h @@ -36,8 +36,13 @@ extern void *memcpy(void *, const void *, __kernel_size_t); extern void *__memcpy(void *, const void *, __kernel_size_t); #define __HAVE_ARCH_MEMCPY_MC +#ifdef CONFIG_ARCH_HAS_COPY_MC extern int memcpy_mc(void *, const void *, __kernel_size_t); extern int __memcpy_mc(void *, const void *, __kernel_size_t); +#else +#define memcpy_mc(dst, src, len) __memcpy(dst, src, len) +#define __memcpy_mc(dst, src, len) __memcpy(dst, src, len) +#endif #define __HAVE_ARCH_MEMMOVE extern void *memmove(void *, const void *, __kernel_size_t); @@ -61,7 +66,9 @@ void memcpy_flushcache(void *dst, const void *src, size_t cnt); */ #define memcpy(dst, src, len) __memcpy(dst, src, len) +#ifndef memcpy_mc #define memcpy_mc(dst, src, len) __memcpy_mc(dst, src, len) +#endif #define memmove(dst, src, len) __memmove(dst, src, len) #define memset(s, c, n) __memset(s, c, n) -- 2.43.0

2 1

[PATCH OLK-6.6] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
by Chen Jinghuang 24 Mar '26

24 Mar '26

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v7.0-rc2 commit bfbc0b5b32a8f28ce284add619bf226716a59bc0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13873 CVE: CVE-2026-23253 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which reinitializes the waitqueue list head to empty. Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the same DVR device share it), this orphans any existing waitqueue entries from io_uring poll or epoll, leaving them with stale prev/next pointers while the list head is reset to {self, self}. The waitqueue and spinlock in dvr_buffer are already properly initialized once in dvb_dmxdev_init(). The open path only needs to reset the buffer data pointer, size, and read/write positions. Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct assignment of data/size and a call to dvb_ringbuffer_reset(), which properly resets pread, pwrite, and error with correct memory ordering without touching the waitqueue or spinlock. Cc: stable(a)vger.kernel.org Fixes: 34731df288a5f ("V4L/DVB (3501): Dmxdev: use dvb_ringbuffer") Reported-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com Tested-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/all/698a26d3.050a0220.3b3015.007d.GAE@google.com/ Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflicts: drivers/media/dvb-core/dmxdev.c [context conflict] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/media/dvb-core/dmxdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c index 9ce5f010de3f..4ce3ae3954c5 100644 --- a/drivers/media/dvb-core/dmxdev.c +++ b/drivers/media/dvb-core/dmxdev.c @@ -168,7 +168,9 @@ static int dvb_dvr_open(struct inode *inode, struct file *file) mutex_unlock(&dmxdev->mutex); return -ENOMEM; } - dvb_ringbuffer_init(&dmxdev->dvr_buffer, mem, DVR_BUFFER_SIZE); + dmxdev->dvr_buffer.data = mem; + dmxdev->dvr_buffer.size = DVR_BUFFER_SIZE; + dvb_ringbuffer_reset(&dmxdev->dvr_buffer); if (dmxdev->may_do_mmap) dvb_vb2_init(&dmxdev->dvr_vb2_ctx, "dvr", file->f_flags & O_NONBLOCK); -- 2.34.1

2 1

[PATCH OLK-6.6] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
by Chen Jinghuang 24 Mar '26

24 Mar '26

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v7.0-rc2 commit bfbc0b5b32a8f28ce284add619bf226716a59bc0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13873 CVE: CVE-2026-23253 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which reinitializes the waitqueue list head to empty. Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the same DVR device share it), this orphans any existing waitqueue entries from io_uring poll or epoll, leaving them with stale prev/next pointers while the list head is reset to {self, self}. The waitqueue and spinlock in dvr_buffer are already properly initialized once in dvb_dmxdev_init(). The open path only needs to reset the buffer data pointer, size, and read/write positions. Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct assignment of data/size and a call to dvb_ringbuffer_reset(), which properly resets pread, pwrite, and error with correct memory ordering without touching the waitqueue or spinlock. Cc: stable(a)vger.kernel.org Fixes: 34731df288a5f ("V4L/DVB (3501): Dmxdev: use dvb_ringbuffer") Reported-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com Tested-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/all/698a26d3.050a0220.3b3015.007d.GAE@google.com/ Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflicts: drivers/media/dvb-core/dmxdev.c [context conflict] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/media/dvb-core/dmxdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c index 9ce5f010de3f..4ce3ae3954c5 100644 --- a/drivers/media/dvb-core/dmxdev.c +++ b/drivers/media/dvb-core/dmxdev.c @@ -168,7 +168,9 @@ static int dvb_dvr_open(struct inode *inode, struct file *file) mutex_unlock(&dmxdev->mutex); return -ENOMEM; } - dvb_ringbuffer_init(&dmxdev->dvr_buffer, mem, DVR_BUFFER_SIZE); + dmxdev->dvr_buffer.data = mem; + dmxdev->dvr_buffer.size = DVR_BUFFER_SIZE; + dvb_ringbuffer_reset(&dmxdev->dvr_buffer); if (dmxdev->may_do_mmap) dvb_vb2_init(&dmxdev->dvr_vb2_ctx, "dvr", file->f_flags & O_NONBLOCK); -- 2.34.1

2 1

[PATCH 0/5] Transition from CPU Type to MIDR Register for
by liqiqi 24 Mar '26

24 Mar '26

Currently, there are two methods for determining whether a chip supports specific virtualization features: 1. Reading the chip's CPU type from BIOS 2. Reading the value of the MIDR register The issue with the first method is that each time a new chip is introduced, the new CPU type must be defined, which leads to poor code portability and maintainability. Therefore, the second method has been adopted to replace the first. This approach eliminates the dependency on CPU type by using the MIDR register and removes the need for defining CPU types and their related interfaces. liqiqi (5): kvm: arm64: use MIDR_HISI_TSV110 to determine whether NCSNP is supported kvm: arm64: Add HIP10, HIP10C MIDR definitions kvm: arm64: Use MIDR to determine whether DVMBM is supported kvm: arm64: Use MIDR to determine whether IPIv is supported kvm: arm64: Remove cpu_type definition and it's related interfaces arch/arm64/include/asm/cputype.h | 4 + arch/arm64/kvm/arm.c | 1 - arch/arm64/kvm/hisilicon/hisi_virt.c | 111 +++------------------------ arch/arm64/kvm/hisilicon/hisi_virt.h | 12 --- 4 files changed, 15 insertions(+), 113 deletions(-) -- 2.43.0

1 5

[openEuler-25.03, 0/1] mm: arm64: Add user replication feature with control policies.
by Gadeev Dmitry 24 Mar '26

24 Mar '26

This patchset implements support of userspace translation tables and private read-only data replication for AArch64 and is going to improve latency and memory bandwidth by reducing cross-NUMA memory accesses. openEuler 25.03 is used as a baseline. Current implementation supports next functionality: 1. Per-NUMA node replication of userspace translation tables and private read-only data. We replicate only __private read-only__ data to avoid dealing with replicas coherence and consistency support. Translation tables, in turn, are able to replicate for any kind of underlying data. 2. Ability to enable userspace replication for a certain process via procfs or for a group of processes via memory cgroup. 3. 4K and 64K pages are supported. 4. Several table replication policies supported: 0 - table replication disabled; 1 - table replication enabled only for data might be replicated, e.g. private read-only data; 2 - table replication enabled for any data; Tables are getting replicated during page faults. Several data replication policies supported as well: 0 - data replication disabled; 1 - appropriate data getting replicated on NUMA faults via NUMA balancer; 2 - appropriate data that has been already faulted in are getting replicated immediately, further data will be replicated on NUMA faults. That is no difference between 1 and 2 policies if it is enabled at the start of a process. 3 - appropriate data (with related page tables) are getting replicated immediately after populating either on page faults or somehow else. Data replication might be enabled (!= 0) only with table replication enabled (!= 0). 5. Replicated data pages can't be a ksm, migration or swap/reclaim candidates by design. But for other pages these work as well with replicated translation tables support. Known problems: 1. Current implementation doesn't support huge pages, so you have to build the kernel with huge pages disabled for user replication to work. Huge pages support will be added in the nearest future. 2. mremap syscall doesn't work with replicated memory yet. 3. page_idle, uprobes and userfaultfd support replicated translation tables, but not replicated data. Be responsible using these features with userspace replication enabled. 4. When replicating translation tables during page faults, there should be enough space on __each__ NUMA node for table allocations. Otherwise it will cause OOM-killer. Despite the problems above, they are mostly not related to workloads assumed to benefit from user replication feature, and such workloads will work properly with the feature enabled. Gadeev Dmitry (1): mm: Support NUMA-aware replication of read-only data and translation tables of user space applications with different policies arch/arm64/include/asm/numa_replication.h | 3 + arch/arm64/mm/init.c | 2 +- arch/arm64/mm/pgd.c | 13 +- fs/exec.c | 7 + fs/proc/base.c | 149 ++ fs/proc/task_mmu.c | 112 +- include/asm-generic/pgalloc.h | 19 +- include/asm-generic/tlb.h | 22 + include/linux/cgroup.h | 1 + include/linux/gfp_types.h | 12 +- include/linux/memcontrol.h | 4 + include/linux/mm.h | 77 +- include/linux/mm_inline.h | 5 + include/linux/mm_types.h | 70 +- include/linux/numa_kernel_replication.h | 237 ++- include/linux/numa_user_replication.h | 827 ++++++++ include/linux/page-flags.h | 18 +- include/trace/events/mmflags.h | 10 +- include/uapi/asm-generic/mman-common.h | 3 + kernel/cgroup/cgroup.c | 2 +- kernel/events/uprobes.c | 5 +- kernel/fork.c | 18 + kernel/sched/fair.c | 8 +- mm/Kconfig | 13 + mm/Makefile | 1 + mm/gup.c | 15 +- mm/ksm.c | 15 +- mm/madvise.c | 19 +- mm/memcontrol.c | 181 +- mm/memory.c | 566 +++++- mm/mempolicy.c | 5 + mm/migrate.c | 11 +- mm/migrate_device.c | 17 +- mm/mlock.c | 22 + mm/mmap.c | 26 + mm/mmu_gather.c | 55 +- mm/mprotect.c | 424 ++-- mm/mremap.c | 97 +- mm/numa_kernel_replication.c | 5 +- mm/numa_user_replication.c | 2242 +++++++++++++++++++++ mm/page_alloc.c | 8 +- mm/page_idle.c | 3 +- mm/page_vma_mapped.c | 3 +- mm/rmap.c | 41 +- mm/swap.c | 7 +- mm/swapfile.c | 3 +- mm/userfaultfd.c | 7 +- mm/userswap.c | 11 +- 48 files changed, 4979 insertions(+), 442 deletions(-) create mode 100644 include/linux/numa_user_replication.h create mode 100644 mm/numa_user_replication.c -- 2.53.0

2 3

[PATCH OLK-5.10] arm64/mpam: Add nrdy latency to mbw_rdmon.
by Quanmin Yan 24 Mar '26

24 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8421 Reference: https://atomgit.com/openeuler/kernel/pull/15200 -------------------------------- On some platforms, when configuring a new partid, the NRDY bit remains 0, we need to re-read the statistics result to ensure accurate data. However, due to the statistical mechanism, this re-reading needs to have a certain nrdy delay; otherwise, statistical errors may occur. Fix it by adding nrdy latency to mbw_rdmon. Fixes: da1960a8d3b4 ("arm64/mpam: Add quirk for MPAM MSMON_MBWU monitor NRDY bit") Signed-off-by: Quanmin Yan <yanquanmin1(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_resctrl.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_resctrl.c b/arch/arm64/kernel/mpam/mpam_resctrl.c index 4cc18c90a601..51b4edb1b1bb 100644 --- a/arch/arm64/kernel/mpam/mpam_resctrl.c +++ b/arch/arm64/kernel/mpam/mpam_resctrl.c @@ -490,7 +490,7 @@ static u64 cache_rdmon(struct rdt_domain *d, void *md_priv) static u64 mbw_rdmon(struct rdt_domain *d, void *md_priv) { int err; - u64 result; + u64 result, wait_jiffies; union mon_data_bits md; struct sync_args args; struct mpam_resctrl_dom *dom; @@ -520,7 +520,19 @@ static u64 mbw_rdmon(struct rdt_domain *d, void *md_priv) err = mpam_component_mon(dom->comp, &args, &result); /* Currently just report it */ WARN_ON(err && (err != -EBUSY)); - } while (err == -EBUSY); + + if (err != -EBUSY) + break; + + /* + * The "nrdy_usec" needs to be waited. Since there is + * currently no way to obtain "arm,not-ready-us", + * only a hardcoded value is written. + */ + wait_jiffies = usecs_to_jiffies(1000); + while (wait_jiffies) + wait_jiffies = schedule_timeout_uninterruptible(wait_jiffies); + } while (1); return result; } -- 2.43.0

2 1

[PATCH OLK-6.6 0/9] prevent SEA storms on critical RAS
by Wupeng Ma 23 Mar '26

23 Mar '26

After a critical RAS event is triggered, user data for this task becomes inaccessible. To prevents wider system impact, following step will be done: - sending SIGBUS to threads belong to this task - skip memory access during __access_remote_vm - skip memory access during exit_ruobus_list - skip memory access during rseq_get_rseq_cs - skip memory access during do_coredump Jiacheng Yu (1): futex: avoid memory access during exit_robust_list if task facing critical RAS Wupeng Ma (5): mm: memory_failure: fix UAF in memory_failure_cb ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct coredump: skip coredump during critical error if task facing critical RAS mm: avoid memory access during __access_remote_vm if task facing critical RAS arm64: openeuler_defconfig: enable ras critical related configs by default Xiaofei Tan (1): ACPI: APEI: Add vendor specific error info handling for ARM Processor Zhang Qiao (2): exit: terminate process on critical RAS events to prevent further damage rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS arch/arm64/configs/openeuler_defconfig | 2 + drivers/acpi/apei/Kconfig | 14 ++++ drivers/acpi/apei/Makefile | 1 + drivers/acpi/apei/apei-internal.h | 11 ++++ drivers/acpi/apei/ghes-vendor-info.c | 90 ++++++++++++++++++++++++++ drivers/acpi/apei/ghes.c | 60 +++++++++++++++-- fs/coredump.c | 15 +++++ include/linux/mm.h | 12 ++++ include/linux/sched/coredump.h | 6 ++ kernel/futex/core.c | 3 + kernel/rseq.c | 3 + mm/memory.c | 5 ++ 12 files changed, 217 insertions(+), 5 deletions(-) create mode 100644 drivers/acpi/apei/ghes-vendor-info.c -- 2.43.0

2 10

[PATCH v4 OLK-6.6] hugetlb: drain pcp for movable zone before alloc
by Wupeng Ma 23 Mar '26

23 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8761 -------------------------------- Memory retained in Per-CPU Pages (PCP) caches can prevent hugepage allocations from succeeding despite sufficient free system memory. This occurs because hugepage allocations don't actively trigger PCP draining. Reproduction: - Alloc page and free the page via put_page to release to pcp - Observe hugepage reservation failure Solution: Actively drain PCP during hugetlb memory allocation for movable node. Verification: This issue can be reproduce easily in zone movable with the following step: w/o this patch # numactl -m 2 dd if=/dev/urandom of=/dev/shm/testfile bs=4k count=64 # rm -f /dev/shm/testfile # sync # echo 3 > /proc/sys/vm/drop_caches # echo 2048 > /sys/devices/system/node/node2/hugepages/hugepages-2048kB/nr_hugepages # cat /sys/devices/system/node/node2/hugepages/hugepages-2048kB/nr_hugepages 2029 w/ this patch # numactl -m 2 dd if=/dev/urandom of=/dev/shm/testfile bs=4k count=64 # rm -f /dev/shm/testfile # sync # echo 3 > /proc/sys/vm/drop_caches # echo 2048 > /sys/devices/system/node/node2/hugepages/hugepages-2048kB/nr_hugepages # cat /sys/devices/system/node/node2/hugepages/hugepages-2048kB/nr_hugepages 2044 Commit 3a1587ef612c ("mm/numa_remote: introduce hugetlb_nowatermark mode for remote node") already bring the basic mechanism and this patch extends it to movable_node_is_enabled(). Since param h is not used, remove it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/hugetlb.c | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index d8fe41a77cd2..c61232d4d582 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3835,22 +3835,26 @@ static int adjust_pool_surplus(struct hstate *h, nodemask_t *nodes_allowed, return 1; } -#ifdef CONFIG_ZONE_EXTMEM -static void hugetlb_drain_remote_pcp(struct hstate *h, int nid) +static void hugetlb_drain_zone(struct zone *zone) { - pg_data_t *pgdat = NODE_DATA(nid); - struct zone *zone; - - zone = &pgdat->node_zones[ZONE_EXTMEM]; + if (!zone_managed_pages(zone)) + return; - if (zone_managed_pages(zone)) - drain_all_pages(zone); + drain_all_pages(zone); } -#else -static inline void hugetlb_drain_remote_pcp(struct hstate *h, int nid) + +static void hugetlb_drain_pcp(int nid) { -} + pg_data_t *pgdat = NODE_DATA(nid); + + if (movable_node_is_enabled()) + hugetlb_drain_zone(&pgdat->node_zones[ZONE_MOVABLE]); + +#ifdef CONFIG_ZONE_EXTMEM + if (numa_remote_hugetlb_nowatermark(nid)) + hugetlb_drain_zone(&pgdat->node_zones[ZONE_EXTMEM]); #endif +} #define persistent_huge_pages(h) (h->nr_huge_pages - h->surplus_huge_pages) static int set_max_huge_pages(struct hstate *h, unsigned long count, int nid, @@ -3947,8 +3951,8 @@ static int set_max_huge_pages(struct hstate *h, unsigned long count, int nid, /* yield cpu to avoid soft lockup */ cond_resched(); - if ((nid != NUMA_NO_NODE) && numa_remote_hugetlb_nowatermark(nid) && !drained) { - hugetlb_drain_remote_pcp(h, nid); + if ((nid != NUMA_NO_NODE) && !drained) { + hugetlb_drain_pcp(nid); drained = true; } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] sched/cputime: Fix time overflow in cputime_adjust()
by Xia Fukun 23 Mar '26

23 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8331 CVE: NA ------------------ When a process has hundreds of threads and runs for an extended period, the aggregated stime or utime of its thread group can become extremely large. Accessing /proc/xx/stat then triggers a divide error like the following: divide error: 0000 [#1] SMP NOPTI CPU: 273 PID: 4619 Comm: ... Tainted: 5.10.0 x86_64 RIP: 0010:cputime_adjust+0x55/0xb0 RSP: 0018:ffffae408e07bbc8 EFLAGS: 00010807 ... Call Trace: thread_group_cputime_adjusted+0x4b/0x70 do_task_stat+0x2d8/0xdc0 This issue is caused by an overflow in stime + utime. In older kernel versions, this overflow could lead to a division-by-zero error in scale_stime(). Although the scale_stime() function itself might exhibit issues under certain specially crafted inputs, the actual arguments passed to it are constrained by the context at its call sites within the kernel. Given that this interface is no longer used in newer kernel versions, only this minimal fix is applied. Add overflow detection logic and, upon overflow, right-shift the values before computation. This fixes the issue while preserving the original calculation semantics. Fixes: 9d7fb0427648 ("sched/cputime: Guarantee stime + utime == rtime") Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/sched/cputime.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c index 4055f2008cc6..e2077ee4c710 100644 --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -692,6 +692,7 @@ void cputime_adjust(struct task_cputime *curr, struct prev_cputime *prev, u64 *ut, u64 *st) { u64 rtime, stime, utime; + u64 s, u, sum; unsigned long flags; /* Serialize concurrent callers such that we can honour our guarantees */ @@ -727,7 +728,23 @@ void cputime_adjust(struct task_cputime *curr, struct prev_cputime *prev, goto update; } - stime = scale_stime(stime, rtime, stime + utime); + s = stime; + u = utime; + sum = s + u; + + /* + * Detect unsigned overflow: if sum < either operand, + * overflow occurred. A single right shift is sufficient + * to guarantee that the new sum won't overflow. + */ + if (unlikely(sum < s)) { + s >>= 1; + u >>= 1; + sum = s + u; + stime = scale_stime(s, rtime, sum); + } else { + stime = scale_stime(stime, rtime, stime + utime); + } /* * Because mul_u64_u64_div_u64() can approximate on some * achitectures; enforce the constraint that: a*b/(b+c) <= a. -- 2.34.1

2 2

[PATCH openEuler-26.09 v2] tools: Add maio-utils tool
by Hongbo Li 23 Mar '26

23 Mar '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8613 -------------------------------- This is a userspace tool for MFS to provide: programmable strategy framework. Some basic strategies have added in test, and more flexible strategies can be written based on this framework. Signed-off-by: Hongbo Li <lihongbo22(a)huawei.com> --- tools/mfs/maio-utils/CMakeLists.txt | 101 ++++ tools/mfs/maio-utils/README.md | 17 + tools/mfs/maio-utils/build/build.sh | 91 +++ .../mfs/maio-utils/include/client/fs_client.h | 17 + tools/mfs/maio-utils/include/inner/inner.h | 37 ++ tools/mfs/maio-utils/include/loader/loader.h | 10 + tools/mfs/maio-utils/include/maio.h | 53 ++ .../maio-utils/include/parser/req_parser.h | 13 + tools/mfs/maio-utils/include/policy/policy.h | 17 + tools/mfs/maio-utils/include/uapi/mfs.h | 62 ++ tools/mfs/maio-utils/src/CMakeLists.txt | 42 ++ .../mfs/maio-utils/src/client/CMakeLists.txt | 17 + tools/mfs/maio-utils/src/client/fs_client.c | 359 ++++++++++++ .../mfs/maio-utils/src/loader/CMakeLists.txt | 18 + tools/mfs/maio-utils/src/loader/loader.c | 144 +++++ tools/mfs/maio-utils/src/main.c | 156 +++++ .../mfs/maio-utils/src/parser/CMakeLists.txt | 16 + tools/mfs/maio-utils/src/parser/req_parser.c | 313 ++++++++++ .../mfs/maio-utils/src/policy/CMakeLists.txt | 16 + tools/mfs/maio-utils/src/policy/policy.c | 114 ++++ tools/mfs/maio-utils/test/Makefile | 26 + tools/mfs/maio-utils/test/README.md | 61 ++ tools/mfs/maio-utils/test/strategy_demo.c | 45 ++ .../mfs/maio-utils/test/strategy_generate.cpp | 296 ++++++++++ .../mfs/maio-utils/test/strategy_prefetch.cpp | 150 +++++ tools/mfs/maio-utils/test/strategy_prefetch.h | 21 + tools/mfs/maio-utils/test/strategy_replay.cpp | 540 ++++++++++++++++++ tools/mfs/maio-utils/test/strategy_template.h | 21 + tools/mfs/maio-utils/test/strategy_toend.c | 46 ++ tools/mfs/maio-utils/test/trace_analyse.py | 87 +++ tools/mfs/maio-utils/test/trace_gen.py | 116 ++++ 31 files changed, 3022 insertions(+) create mode 100644 tools/mfs/maio-utils/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/README.md create mode 100644 tools/mfs/maio-utils/build/build.sh create mode 100644 tools/mfs/maio-utils/include/client/fs_client.h create mode 100644 tools/mfs/maio-utils/include/inner/inner.h create mode 100644 tools/mfs/maio-utils/include/loader/loader.h create mode 100644 tools/mfs/maio-utils/include/maio.h create mode 100644 tools/mfs/maio-utils/include/parser/req_parser.h create mode 100644 tools/mfs/maio-utils/include/policy/policy.h create mode 100644 tools/mfs/maio-utils/include/uapi/mfs.h create mode 100644 tools/mfs/maio-utils/src/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/client/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/client/fs_client.c create mode 100644 tools/mfs/maio-utils/src/loader/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/loader/loader.c create mode 100644 tools/mfs/maio-utils/src/main.c create mode 100644 tools/mfs/maio-utils/src/parser/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/parser/req_parser.c create mode 100644 tools/mfs/maio-utils/src/policy/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/policy/policy.c create mode 100644 tools/mfs/maio-utils/test/Makefile create mode 100644 tools/mfs/maio-utils/test/README.md create mode 100644 tools/mfs/maio-utils/test/strategy_demo.c create mode 100644 tools/mfs/maio-utils/test/strategy_generate.cpp create mode 100644 tools/mfs/maio-utils/test/strategy_prefetch.cpp create mode 100644 tools/mfs/maio-utils/test/strategy_prefetch.h create mode 100644 tools/mfs/maio-utils/test/strategy_replay.cpp create mode 100644 tools/mfs/maio-utils/test/strategy_template.h create mode 100644 tools/mfs/maio-utils/test/strategy_toend.c create mode 100644 tools/mfs/maio-utils/test/trace_analyse.py create mode 100644 tools/mfs/maio-utils/test/trace_gen.py diff --git a/tools/mfs/maio-utils/CMakeLists.txt b/tools/mfs/maio-utils/CMakeLists.txt new file mode 100644 index 000000000000..a13fe2bf1d7f --- /dev/null +++ b/tools/mfs/maio-utils/CMakeLists.txt @@ -0,0 +1,101 @@ +#******************************************************************************* +#******************************************************************************* + +cmake_minimum_required(VERSION 3.0) +cmake_policy(SET CMP0057 NEW) + +project(maio) + +#******************************************************************************* +#******************************************************************************* + +add_definitions(-D__LINUX_USR__) +add_definitions(-D__USE_GNU) +add_definitions(-D__POSIX_SOURCE) +add_definitions(-D_GNU_SOURCE) +add_definitions(-D_FILE_OFFSET_BITS=64) + +#******************************************************************************* +#******************************************************************************* + +include(TestBigEndian) + +TEST_BIG_ENDIAN(BIGENDIAN) + if (${BIGENDIAN}) + message(">>> Big Endian") + add_definitions(-D_CMAKE_BIGENDIAN) + else() + message(">>> Little Endian") + endif(${BIGENDIAN}) + +#******************************************************************************* +#******************************************************************************* + +EXECUTE_PROCESS(COMMAND uname -m COMMAND tr -d '\n' OUTPUT_VARIABLE ARCH) +if(${ARCH} STREQUAL "x86_64" OR ${ARCH} STREQUAL "aarch64") + message(STATUS "Architecture: ${ARCH}") +else() + message(STATUS "Invalid Architecture: ${ARCH}") + return() +endif() + +#******************************************************************************* +#******************************************************************************* + +set(BASE_FLAGS "-g -Wall -Werror -fno-strict-overflow -rdynamic") +set(SP_C_FLAGS "-std=gnu99") +set(SP_C++_FLAGS "-std=c++11") +set(SP_RELEASE_FLAGS "-O2") +set(SP_DEBUG_FLAGS "-O0") +set(SEC_REQ_FLAGS "-fstack-protector-all -fPIE -pie -fPIC -Wl,-z,relro,-z,now,-z,noexecstack") +set(SEC_SUG_BASE_FLAGS "-Wformat=2") +set(SEC_SUG_SP_C_FLAGS "-Wshadow") + +set(C_FLAGS "${BASE_FLAGS} ${SP_C_FLAGS}") +set(C++_FLAGS "${BASE_FLAGS} ${SP_C++_FLAGS}") +set(SEC_C_FLAGS "${SEC_REQ_FLAGS} ${SEC_SUG_BASE_FLAGS} ${SEC_SUG_SP_C_FLAGS}") +set(SEC_C++_FLAGS "${SEC_REQ_FLAGS} ${SEC_SUG_BASE_FLAGS}") +set(DEPC_FLAGS "-Wno-error=deprecated-declarations -Wno-deprecated-declarations") + +if(CMAKE_BUILD_TYPE MATCHES "Release") + message(">>> Release Mode") + set(CMAKE_C_FLAGS "${C_FLAGS} ${SP_RELEASE_FLAGS} ${SEC_C_FLAGS}") + set(CMAKE_CXX_FLAGS "${C++_FLAGS} ${SP_RELEASE_FLAGS} ${SEC_C++_FLAGS} ${DEPC_FLAGS}") +else() + message(">>> Debug Mode") + add_definitions(-D_DEBUG) + set(CMAKE_C_FLAGS "${C_FLAGS} ${SP_DEBUG_FLAGS} ${SEC_C_FLAGS}") + set(CMAKE_CXX_FLAGS "${C++_FLAGS} ${SP_DEBUG_FLAGS} ${SEC_C++_FLAGS} ${DEPC_FLAGS}") + set(COVERAGE_FLAGS "-coverage") + set(COVERAGE_LINK "gcov") +endif() + +message(STATUS ">>> Source Dir: " ${PROJECT_SOURCE_DIR}) +message(STATUS ">>> Binary Dir: " ${PROJECT_BINARY_DIR}) +message(STATUS ">>> C_FLAGS : " ${CMAKE_C_FLAGS}) +message(STATUS ">>> CXX_FLAGS : " ${CMAKE_CXX_FLAGS}) + +#******************************************************************************* +#******************************************************************************* + +set(EXECUTABLE_OUTPUT_PATH ${PROJECT_BINARY_DIR}/bin) + +#******************************************************************************* +#******************************************************************************* + +if(DEFINED THIRD_PARTY) + message(">>> third_party: ${THIRD_PARTY}") +else() + set(THIRD_PARTY ${PROJECT_SOURCE_DIR}/lib) +endif() + +set(INFRA_DIR ${PROJECT_SOURCE_DIR}/infrastructure) +set(SECUREC_DIR ${THIRD_PARTY}/securec) +set(ZLOG_DIR ${THIRD_PARTY}/zlog) +set(LIBNUMA_DIR ${THIRD_PARTY}/libnuma) + +#******************************************************************************* +#******************************************************************************* + +add_subdirectory(infrastructure) +add_subdirectory(src) diff --git a/tools/mfs/maio-utils/README.md b/tools/mfs/maio-utils/README.md new file mode 100644 index 000000000000..40477bebf130 --- /dev/null +++ b/tools/mfs/maio-utils/README.md @@ -0,0 +1,17 @@ +# maio-utils + +#### How to build + +1. prepare thirdparty by using: +``` +git clone -b threadpool_bind https://github.com/hb-lee/infrastructure.git infrastructure +git clone -b 1.2.18 https://github.com/HardySimpson/zlog.git thirdparty/zlog +git clone https://github.com/chriszt/securec.git thirdparty/securec +git clone -b v2.0.19 https://github.com/numactl/numactl.git thirdparty/libnuma +``` +2. cd build +3. bash build.sh prepare # only once. +4. bash build.sh build # [debug|release] + +#### How to run +Run with `./maio -m ${MNTPOINT}`, here ${MNTPOINT} means the mfs mount point. If you want to use some strategies, you can run with `./maio -m ${MNTPOINT} -s ${STRATEGYLIB}` where ${STRATEGYLIB} is your strategy library. Some examples are provided in `test` directory. diff --git a/tools/mfs/maio-utils/build/build.sh b/tools/mfs/maio-utils/build/build.sh new file mode 100644 index 000000000000..a095df880b68 --- /dev/null +++ b/tools/mfs/maio-utils/build/build.sh @@ -0,0 +1,91 @@ +#!/bin/bash + +LOCAL_PATH="$(readlink -e "$(dirname "$0")")" +PRJ_PATH="$(readlink -e "${LOCAL_PATH}/..")" +THIRD_SUB="${PRJ_PATH}/thirdparty" +Lib_PATH="${PRJ_PATH}/lib" + +ARCH=$(uname -m) + +function build_zlog() { + local zlog_dir=${THIRD_SUB}/zlog + local build_path=${zlog_dir}/build + mkdir ${build_path} + mkdir -p ${Lib_PATH}/zlog + cd ${zlog_dir} + make PREFIX=`pwd`/build/zlog + make PREFIX=`pwd`/build/zlog install + cp -rdp ${build_path}/zlog/include ${Lib_PATH}/zlog + cp -rdp ${build_path}/zlog/lib ${Lib_PATH}/zlog + cd - +} + +function build_securec() { + local securec_dir=${THIRD_SUB}/securec + local securec_lib=${securec_dir}/build/securec/lib + mkdir -p ${securec_lib} + mkdir -p ${Lib_PATH}/securec + cd ${securec_dir} + if [ "${ARCH}" = "aarch64" ]; then + make -f aarch64-so.mk + else + make -f x86-so.mk + fi + cp -rdp include build/securec + cp libsecurec.so build/securec/lib + cp -rdp build/securec/include ${Lib_PATH}/securec + cp -rdp build/securec/lib ${Lib_PATH}/securec + cd - +} + +function build_libnuma() { + local libnuma_dir=${THIRD_SUB}/libnuma + local build_path=${libnuma_dir}/build + mkdir ${build_path} + mkdir -p ${Lib_PATH}/libnuma + cd ${libnuma_dir} + ./autogen.sh + ./configure --prefix=`pwd`/build + make -j4 + make install + cp -rdp build/include ${Lib_PATH}/libnuma + cp -rdp build/lib ${Lib_PATH}/libnuma + cd - +} + +function prepare_thirdparty() { + build_jsoncpp + build_zlog + build_securec + build_libnuma +} + +function build_program() { + local BUILD_TYPE=$1 + + set -x + if [ "${BUILD_TYPE}" == "release" ]; then + cmake .. -DCMAKE_BUILD_TYPE=Release + else + cmake .. -DCMAKE_BUILD_TYPE=Debug + fi + set +x + + make clean + make VERBOSE=1 -j +} + +function main() { + local ACTION="$1" + local PARAMETER="$2" + + if [ "${ACTION}" == "prepare" ]; then + prepare_thirdparty + fi + if [ "$ACTION" == "build" ]; then + build_program $PARAMETER + fi +} + +main $@ +exit $? diff --git a/tools/mfs/maio-utils/include/client/fs_client.h b/tools/mfs/maio-utils/include/client/fs_client.h new file mode 100644 index 000000000000..df3a086e317a --- /dev/null +++ b/tools/mfs/maio-utils/include/client/fs_client.h @@ -0,0 +1,17 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _FS_CLIENT_H_ +#define _FS_CLIENT_H_ + +#include <stdint.h> + +int fs_evict_by_path(const char *path, uint64_t off, uint64_t len); +int fs_load_by_path(const char *path, uint64_t off, uint64_t len); +int fs_load_by_fd(int fd, uint64_t off, uint64_t len); +int fs_sync_by_path(const char *path, void *buf, uint64_t off, uint64_t len); + +int fs_client_init(const char *source); +void fs_client_exit(void); + +#endif diff --git a/tools/mfs/maio-utils/include/inner/inner.h b/tools/mfs/maio-utils/include/inner/inner.h new file mode 100644 index 000000000000..fbb87e13b1bb --- /dev/null +++ b/tools/mfs/maio-utils/include/inner/inner.h @@ -0,0 +1,37 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _INNER_H_ +#define _INNER_H_ + +#include <time.h> +#include <stdint.h> + +static inline uint64_t _get_ts(void) +{ + struct timespec now = {0}; + (void)clock_gettime(CLOCK_MONOTONIC_COARSE, &now); + return (uint64_t)now.tv_sec; +} + +/* io context for loader and writeback */ +struct io_context { + uint32_t id; /* msg id */ + uint64_t off; /* io offset in fd */ + uint64_t len; /* io length */ + uint16_t numaid; /* numa node of this io, -1 means non-bind */ + int fd; /* io file handle */ + char *path; /* fullpath of this io */ + void *buf; /* flighting buffer for writeback */ + + uint64_t seq; + + void *private; + void (*end_io)(int ret, void *private); +}; + +void loader_update_curseq(uint64_t seq); +int loader_evict_submit(struct io_context *ioctx); +int loader_io_submit(struct io_context *ioctx); + +#endif diff --git a/tools/mfs/maio-utils/include/loader/loader.h b/tools/mfs/maio-utils/include/loader/loader.h new file mode 100644 index 000000000000..7bf0f163b292 --- /dev/null +++ b/tools/mfs/maio-utils/include/loader/loader.h @@ -0,0 +1,10 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _LOADER_H_ +#define _LOADER_H_ + +int loader_init(void); +void loader_exit(void); + +#endif diff --git a/tools/mfs/maio-utils/include/maio.h b/tools/mfs/maio-utils/include/maio.h new file mode 100644 index 000000000000..a508d5b1fa27 --- /dev/null +++ b/tools/mfs/maio-utils/include/maio.h @@ -0,0 +1,53 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _MAIO_H_ +#define _MAIO_H_ + +#ifdef __cplusplus +extern "C" { +#endif + +#include <stdint.h> + +struct maio_entry { + char *fpath; + uint64_t toff; + uint64_t tlen; + uint8_t tnuma; + uint64_t seq; +}; + +struct maio { + /* IN */ + int fd; + uint64_t off; + uint64_t len; + int pid; + uint8_t op; + uint64_t ts; + uint32_t cksz; + + /* OUT */ + uint16_t flags; +#define MAIO_WITH_SEQ 0x0001 + uint64_t curseq; + struct maio_entry entries[]; +}; + +struct maio_operation { + int max_io; + int (*init) (void); + void (*exit) (void); + int (*load) (struct maio **io); + int (*evict) (struct maio **io); +}; + +char *_get_fullpath(char *fpath, int fd); +void maio_preload(struct maio *maio, int nio); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/tools/mfs/maio-utils/include/parser/req_parser.h b/tools/mfs/maio-utils/include/parser/req_parser.h new file mode 100644 index 000000000000..bcb23474b58b --- /dev/null +++ b/tools/mfs/maio-utils/include/parser/req_parser.h @@ -0,0 +1,13 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef __REQ_PARSER_H__ +#define __REQ_PARSER_H__ + +#include <stdint.h> + +int parser_init(uint32_t fs_mode, const char *mntpoint); +void parser_destory(void); +int maio_parse_req(void *buf, int size); + +#endif diff --git a/tools/mfs/maio-utils/include/policy/policy.h b/tools/mfs/maio-utils/include/policy/policy.h new file mode 100644 index 000000000000..954d25edc894 --- /dev/null +++ b/tools/mfs/maio-utils/include/policy/policy.h @@ -0,0 +1,17 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _POLICY_H_ +#define _POLICY_H_ + +#include "maio.h" + +int policy_max_io(void); +int policy_load(struct maio **io); +int policy_evict(struct maio **io); +int policy_register(const char *path); +void policy_unregister(void); +int policy_init(void); +void policy_exit(void); + +#endif diff --git a/tools/mfs/maio-utils/include/uapi/mfs.h b/tools/mfs/maio-utils/include/uapi/mfs.h new file mode 100644 index 000000000000..a7d5882b5e50 --- /dev/null +++ b/tools/mfs/maio-utils/include/uapi/mfs.h @@ -0,0 +1,62 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ + +#ifndef _UAPI_LINUX_MFS_H +#define _UAPI_LINUX_MFS_H + +#include <linux/types.h> +#include <linux/ioctl.h> + +enum mfs_opcode { + MFS_OP_READ = 0, + MFS_OP_FAULT, + MFS_OP_FAROUND, +}; + +enum { + MFS_MODE_NONE = 0, + MFS_MODE_LOCAL, + MFS_MODE_REMOTE, +}; + +struct mfs_ioc_ra { + __u64 off; + __u64 len; +}; + +struct mfs_ioc_done { + __u32 id; + __u32 ret; +}; + +struct mfs_ioc_rpath { + __u16 max; + __u16 len; + __u8 d[]; +}; + +#define MFS_IOC_RA _IOW(0xbc, 1, struct mfs_ioc_ra) +#define MFS_IOC_DONE _IOW(0xbc, 2, struct mfs_ioc_done) +#define MFS_IOC_RPATH _IOWR(0xbc, 3, struct mfs_ioc_rpath) + +struct mfs_ioc_fsinfo { + __u8 mode; /* 0: none, 1: local, 2: remote */ +}; + +#define MFS_IOC_FSINFO _IOR(0xbd, 1, struct mfs_ioc_fsinfo) + +struct mfs_msg { + __u8 version; + __u8 opcode; + __u16 len; + __u32 fd; + __u32 id; + __u8 data[]; +}; + +struct mfs_read { + __u64 off; + __u64 len; + __s32 pid; +}; + +#endif /* _UAPI_LINUX_MFS_H */ diff --git a/tools/mfs/maio-utils/src/CMakeLists.txt b/tools/mfs/maio-utils/src/CMakeLists.txt new file mode 100644 index 000000000000..fd053a8bd081 --- /dev/null +++ b/tools/mfs/maio-utils/src/CMakeLists.txt @@ -0,0 +1,42 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${PROJECT_SOURCE_DIR}/include) +include_directories(${PROJECT_SOURCE_DIR}/include/inner) +include_directories(${PROJECT_SOURCE_DIR}/include/uapi) +include_directories(${PROJECT_SOURCE_DIR}/include/client) +include_directories(${PROJECT_SOURCE_DIR}/include/loader) +include_directories(${PROJECT_SOURCE_DIR}/include/policy) +include_directories(${PROJECT_SOURCE_DIR}/include/monitor) +include_directories(${PROJECT_SOURCE_DIR}/include/parser) + +include_directories(${INFRA_DIR}/include) +include_directories(${SECUREC_DIR}/include) +include_directories(${ZLOG_DIR}/include) +include_directories(${LIBNUMA_DIR}/include) + +#******************************************************************************* +#******************************************************************************* + +link_directories(${PROJECT_BINARY_DIR}/lib) +link_directories(${SECUREC_DIR}/lib) +link_directories(${ZLOG_DIR}/lib) +link_directories(${LIBNUMA_DIR}/lib) + +#******************************************************************************* +#******************************************************************************* + +add_subdirectory(client) +add_subdirectory(loader) +add_subdirectory(policy) +add_subdirectory(parser) + +add_executable(maio-utils main.c) +target_link_libraries(maio-utils "-Wl,--whole-archive" + client + loader + policy + parser + "-Wl,--no-whole-archive" + infra + dl) diff --git a/tools/mfs/maio-utils/src/client/CMakeLists.txt b/tools/mfs/maio-utils/src/client/CMakeLists.txt new file mode 100644 index 000000000000..ca1c91fd3057 --- /dev/null +++ b/tools/mfs/maio-utils/src/client/CMakeLists.txt @@ -0,0 +1,17 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +#aux_source_directory(. CLIENT_SRC) +set(CLIENT_SRC fs_client.c) + +#******************************************************************************* +#******************************************************************************* + +add_library(client ${CLIENT_SRC}) +target_link_libraries(client infra + securec) diff --git a/tools/mfs/maio-utils/src/client/fs_client.c b/tools/mfs/maio-utils/src/client/fs_client.c new file mode 100644 index 000000000000..94ef1b70be97 --- /dev/null +++ b/tools/mfs/maio-utils/src/client/fs_client.c @@ -0,0 +1,359 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "fs_client.h" +#include "mfs.h" +#include "inner.h" +#include "hashmap.h" +#include "hashfunc.h" +#include "stimer.h" +#include "atomic.h" +#include "log.h" +#include "list.h" +#include "spinlock.h" +#include "sysdef.h" +#include "securec.h" + +#include <fcntl.h> +#include <errno.h> +#include <string.h> +#include <unistd.h> +#include <sys/ioctl.h> + +#define TIMER_CYCLE 10000 /* 10s */ +#define FD_TMOUT 3600 /* 60s */ + +struct fs_client { + int rootfd; + hashmap_t *map; + stimer_t *timer; + list_head_t head; + spinlock_t lock; + uint64_t tmout; +}; + +struct fs_client g_client = {0}; + +typedef struct { + uint32_t plen; + char *path; +} fdkey_t; + +typedef struct { + fdkey_t key; + int fd; + int ref; + uint64_t ts; + list_head_t link; + hashlink_t hash; +} fd_t; + +static inline int fd_cmp(void *first, void *second) +{ + fdkey_t *key1 = (fdkey_t *)first; + fdkey_t *key2 = (fdkey_t *)second; + + if (key1->plen != key2->plen) + return -1; + + return strcmp(key1->path, key2->path); +} + +static inline uint32_t fd_hash(void *args) +{ + fdkey_t *key = (fdkey_t *)args; + uint64_t hash = hashstr(key->path, key->plen); + + return (uint32_t)hash; +} + +static inline void fd_inc(void *args, hashlink_t *link) +{ + fd_t *f = container_of(link, fd_t, hash); + int ref = atomic_s32_inc(&f->ref); + if (ref <= 0) { + log_error("fd(%d) for path(%s) with invalid ref(%d)", + f->fd, f->key.path, ref); + sys_assert(0); + } +} + +static inline int fd_dec(void *args, hashlink_t *link) +{ + fd_t *f = container_of(link, fd_t, hash); + int ref = atomic_s32_dec(&f->ref); + + if (ref < 0) { + log_error("fd(%d) for path(%s) with invalid ref(%d)", + f->fd, f->key.path, ref); + sys_assert(0); + } + /* update access timestamp for the last one */ + if (ref == 0) + f->ts = _get_ts(); + return -1; +} + +static inline int fd_expire(void *args, hashlink_t *link) +{ + fd_t *f = container_of(link, fd_t, hash); + int ref = atomic_s32_fetch(&f->ref); + uint64_t cur; + + if (ref > 0) + return -1; + if (ref < 0) { + log_error("fd(%d) for path(%s) with invalid ref(%d)", + f->fd, f->key.path, ref); + sys_assert(0); + } + cur = _get_ts(); + return ((cur - f->ts) >= g_client.tmout) ? 0 : -1; +} + +static fd_t *fd_alloc(const char *path) +{ + fd_t *f = (fd_t *)malloc(sizeof(fd_t)); + if (!f) { + log_error("alloc fd_t fail"); + return NULL; + } + + f->key.path = strdup(path); + if (!f->key.path) { + log_error("strdup(%s) fail", path); + free(f); + return NULL; + } + + f->key.plen = strlen(path) + 1; + f->fd = -1; + f->ref = 1; + f->hash.key = &f->key; + list_init(&f->link); + return f; +} + +static void fd_free(fd_t *f) +{ + if (f->fd > 0) { + int ret = close(f->fd); + if (ret != 0) { + log_error("close(%d) fail, err(%s)", f->fd, strerror(errno)); + } + f->fd = -1; + } + + if (f->key.path) { + free(f->key.path); + f->key.path = NULL; + } + list_del(&f->link); + free(f); +} + +static int fd_fetch(const char *path, fd_t **f_res, int dirfd) +{ + fdkey_t key; + key.plen = strlen(path) + 1; + key.path = (char *)path; + + /* fd in cache */ + hashlink_t *data = NULL; + if (EEXIST == hashmap_search(g_client.map, &key, &data, NULL, fd_inc)) { + *f_res = container_of(data, fd_t, hash); + (*f_res)->ts = _get_ts(); + return 0; + } + + /* new fd */ + fd_t *f = fd_alloc(path); + if (!f) + return -ENOMEM; + + /* open file */ + if (dirfd > 0) + f->fd = openat(dirfd, path, O_RDONLY, S_IRUSR | S_IRGRP); + else + f->fd = open(path, O_RDONLY, S_IRUSR | S_IRGRP); + if (f->fd < 0) { + if (errno != ENOENT) + log_error("open(%d,%s) fail, err(%s)", dirfd, path, strerror(errno)); + fd_free(f); + return errno; + } + + /* add to fd cache */ + hashlink_t *old = NULL; + if (EEXIST == hashmap_insert(g_client.map, &f->hash, &old, NULL, fd_inc)) { + fd_free(f); + f = container_of(old, fd_t, hash); + } + + spinlock_lock(&g_client.lock); + list_add_tail(&f->link, &g_client.head); + spinlock_unlock(&g_client.lock); + f->ts = _get_ts(); + *f_res = f; + return 0; +} + +static inline void fd_restore(fd_t *f) +{ + (void)hashmap_protect(g_client.map, &f->key, NULL, fd_dec); +} + +static void _fd_gc(void *args) +{ + list_head_t head, *curr, *next; + hashlink_t *data = NULL; + + list_init(&head); + spinlock_lock(&g_client.lock); + list_splice(&g_client.head, &head); + spinlock_unlock(&g_client.lock); + + list_foreach_safe(curr, next, &head) + { + fd_t *f = container_of(curr, fd_t, link); + if (atomic_s32_fetch(&f->ref) != 0) + continue; + /* try to destroy */ + if (0 != hashmap_delete(g_client.map, &f->key, &data, NULL, fd_expire)) + continue; + list_del(&f->link); + log_info("path:%s with fd:%d is expire.", f->key.path, f->fd); + fd_free(f); + } + + spinlock_lock(&g_client.lock); + list_splice(&head, &g_client.head); + spinlock_unlock(&g_client.lock); +} + +int fs_evict_by_path(const char *path, uint64_t off, uint64_t len) +{ + int ret; + fd_t *f; + uint64_t step = 4096 * 4; + + ret = fd_fetch(path, &f, 0); + if (ret) + return ret; + + while (len) { + if (step > len) + step = len; + ret = posix_fadvise(f->fd, off, len, POSIX_FADV_DONTNEED); + if (ret < 0) + break; + len -= step; + off += step; + } + + fd_restore(f); + return ret; +} + +int fs_load_by_path(const char *path, uint64_t off, uint64_t len) +{ + int ret; + fd_t *f; + uint64_t step = 16 * 4096; + char *buf = NULL; + + ret = fd_fetch(path, &f, 0); + if (ret) + return ret; + + buf = (char *)malloc(step); + + while (len) { + if (step > len) + step = len; + ret = pread(f->fd, buf, step, off); + if (ret <= 0) + break; + len -= step; + off += step; + } + free(buf); + fd_restore(f); + return ret; +} + +int fs_load_by_fd(int fd, uint64_t off, uint64_t len) +{ + struct mfs_ioc_ra ra; + + ra.off = off; + ra.len = len; + return ioctl(fd, MFS_IOC_RA, &ra); +} + +int fs_sync_by_path(const char *path, void *buf, uint64_t off, uint64_t len) +{ + ssize_t rsize = 0, ret; + uint64_t pos = 0; + fd_t *f; + + ret = fd_fetch(path + 1, &f, g_client.rootfd); + if (ret) + return ret; + + do { + ret = pread(f->fd, buf + pos, len - pos, off + pos); + if (ret == 0) + break; + if (ret < 0) { + log_error("failed to read:%s", strerror(errno)); + fd_restore(f); + return -1; + } + pos += ret; + rsize += ret; + } while (rsize < len); + fd_restore(f); + return 0; +} + +int fs_client_init(const char *source) +{ + int ret; + + g_client.rootfd = -1; + if (source) { + g_client.rootfd = open(source, O_RDONLY | O_DIRECTORY); + if (g_client.rootfd <= 0) { + log_error("open %s failed", source); + return -1; + } + } + ret = hashmap_create(1024, fd_cmp, fd_hash, &g_client.map); + if (ret) { + log_error("client fd map alloc failed"); + close(g_client.rootfd); + return ret; + } + + g_client.timer = stimer_create("LfsGc", TIMER_CYCLE, NULL, _fd_gc); + if (!g_client.timer) { + log_error("timer create failed"); + hashmap_destroy(g_client.map, NULL, NULL); + close(g_client.rootfd); + return -1; + } + list_init(&g_client.head); + spinlock_init(&g_client.lock); + g_client.tmout = FD_TMOUT; + return 0; +} + +void fs_client_exit(void) +{ + spinlock_destroy(&g_client.lock); + stimer_destroy(g_client.timer); + hashmap_destroy(g_client.map, NULL, NULL); + close(g_client.rootfd); +} + diff --git a/tools/mfs/maio-utils/src/loader/CMakeLists.txt b/tools/mfs/maio-utils/src/loader/CMakeLists.txt new file mode 100644 index 000000000000..08e1b637be26 --- /dev/null +++ b/tools/mfs/maio-utils/src/loader/CMakeLists.txt @@ -0,0 +1,18 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +aux_source_directory(. LOADER_SRC) + +#******************************************************************************* +#******************************************************************************* + +add_library(loader ${LOADER_SRC}) +target_link_libraries(loader infra + numa + securec) + diff --git a/tools/mfs/maio-utils/src/loader/loader.c b/tools/mfs/maio-utils/src/loader/loader.c new file mode 100644 index 000000000000..f3460735c94e --- /dev/null +++ b/tools/mfs/maio-utils/src/loader/loader.c @@ -0,0 +1,144 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "loader.h" + +#include "fs_client.h" +#include "threadpool.h" +#include "log.h" +#include "atomic.h" +#include "inner.h" +#include "sysdef.h" + +#include "securec.h" +#include "numa.h" +#include <errno.h> + +struct loader_mgr { + int numa_num; + threadpool_t **numa_thp; + uint64_t curseq; +}; + +struct loader_mgr g_local_mgr; + +static threadpool_t *choose_worker_pool(struct io_context *ioctx) +{ + static uint64_t cid; + int nid; + + if (ioctx->numaid == (uint16_t)-1) + nid = cid++ % g_local_mgr.numa_num; + else + nid = ioctx->numaid % g_local_mgr.numa_num; + return g_local_mgr.numa_thp[nid]; +} + +static void handle_io(void *args) +{ + struct io_context *ioctx = (struct io_context *)args; + int ret; + + if (g_local_mgr.curseq > ioctx->seq) { + if (ioctx->end_io) + ioctx->end_io(0, ioctx->private); + return; + } + ret = ioctx->path ? fs_load_by_path(ioctx->path, ioctx->off, ioctx->len) + : fs_load_by_fd(ioctx->fd, ioctx->off, ioctx->len); + if (ioctx->end_io) + ioctx->end_io(ret, ioctx->private); +} + +int loader_io_submit(struct io_context *ioctx) +{ + threadpool_t *worker_pools = choose_worker_pool(ioctx); + + threadpool_submit(worker_pools, ioctx, handle_io); + return 0; +} + +void loader_update_curseq(uint64_t seq) +{ + uint64_t curseq = atomic_u64_fetch(&g_local_mgr.curseq); + uint64_t old; + + while (seq > curseq) { + if (atomic_u64_cas(&g_local_mgr.curseq, curseq, seq, &old)) + break; + curseq = old; + } +} + +static void handle_evict(void *args) +{ + struct io_context *ioctx = (struct io_context *)args; + int ret; + + ret = ioctx->path ? fs_evict_by_path(ioctx->path, ioctx->off, ioctx->len) : 0; + if (ioctx->end_io) + ioctx->end_io(ret, ioctx->private); +} + +int loader_evict_submit(struct io_context *ioctx) +{ + threadpool_t *worker_pools = choose_worker_pool(ioctx); + + threadpool_submit(worker_pools, ioctx, handle_evict); + return 0; +} + +static void _free_loader(void) +{ + int i; + + if (!g_local_mgr.numa_thp) + return; + + for (i = 0; i < g_local_mgr.numa_num; i++) + threadpool_destroy(g_local_mgr.numa_thp[i]); + free(g_local_mgr.numa_thp); + g_local_mgr.numa_thp = NULL; +} + +int loader_init(void) +{ + int i, ret, wnum = 8; + char name[THD_NAME + 1] = {0}; + + if (numa_available() < 0) { + log_error("Current system does not support NUAM api"); + return -1; + } + + g_local_mgr.numa_num = numa_max_node() + 1; + g_local_mgr.curseq = 0; + ret = 0; + do { + g_local_mgr.numa_thp = + calloc(g_local_mgr.numa_num, sizeof(threadpool_t *)); + if (!g_local_mgr.numa_thp) { + log_error("alloc for numa threadpool failed"); + ret = -1; + break; + } + for (i = 0; i < g_local_mgr.numa_num; i++) { + sprintf_s(name, sizeof(name), "Loader-%d", i); + g_local_mgr.numa_thp[i] = threadpool_create(name, wnum, i); + if (!g_local_mgr.numa_thp[i]) { + log_error("alloc Loader-%d failed", i); + ret = -1; + break; + } + } + } while (0); + + if (ret != 0) + _free_loader(); + return ret; +} + +void loader_exit(void) +{ + _free_loader(); +} diff --git a/tools/mfs/maio-utils/src/main.c b/tools/mfs/maio-utils/src/main.c new file mode 100644 index 000000000000..ac5473d00011 --- /dev/null +++ b/tools/mfs/maio-utils/src/main.c @@ -0,0 +1,156 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include <stdlib.h> +#include <unistd.h> +#include <string.h> +#include <getopt.h> +#include <errno.h> +#include <fcntl.h> +#include <poll.h> + +#include "loader.h" +#include "log.h" +#include "maio.h" +#include "policy.h" +#include "req_parser.h" +#include "fs_client.h" +#include "mfs.h" +#include "securec.h" + +#include <sys/ioctl.h> +#include <sys/statfs.h> + +#define MAX_BUF_SIZE 1024 +#define MFS_SUPER_MAGIC 0x85428370 + +static int read_req(int fd) +{ + char *buf; + int ret; + + buf = calloc(MAX_BUF_SIZE, sizeof(char)); + if (!buf) { + log_error("failed to alloc buf\n"); + return -1; + } + ret = read(fd, buf, MAX_BUF_SIZE); + if (ret <= 0) { + if (ret < 0) + log_error("failed to read, ret:%d\n", ret); + return -1; + } + return maio_parse_req(buf, ret); +} + +static void dev_monitor(int dfd) +{ + struct pollfd pfd; + int ret; + + pfd.fd = dfd; + pfd.events = POLLIN; + while (1) { + ret = poll(&pfd, 1, -1); + if (ret < 0) { + log_error("poll failed\n"); + return; + } + if (ret == 0 || !(pfd.revents & POLLIN)) { + log_error("poll events error, ret:%d, revents:%x\n", ret, pfd.revents); + continue; + } + while (!read_req(pfd.fd)) {} + } +} + +int main(int argc, char *argv[]) +{ + const char *mntpoint = NULL, *strategylib = NULL; + struct mfs_ioc_fsinfo fsinfo = {0}; + int dfd, ret, opt; + struct statfs buf; + char devname[10]; + + while ((opt = getopt(argc, argv, "m:s:")) != -1) { + switch (opt) { + case 'm': + mntpoint = optarg; + break; + case 's': + strategylib = optarg; + break; + default: + fprintf(stderr, "Usage: %s -m ${mnt} [-s ${strategylib}]\n", argv[0]); + return -EINVAL; + } + } + if (!mntpoint) { + fprintf(stderr, "mount point should specify\n"); + fprintf(stderr, "Usage: %s -m ${mnt} [-s ${strategylib}]\n", argv[0]); + return -1; + } + + ret = statfs(mntpoint, &buf); + if (ret) { + log_error("statfs %s failed, errstr:%s\n", mntpoint, strerror(errno)); + return -1; + } + if (buf.f_type != MFS_SUPER_MAGIC) { + log_error("fstype(%x) is invalid, please check the mountpoint", buf.f_type); + return -1; + } + + sprintf_s(devname, sizeof(devname), "/dev/mfs%ld", buf.f_spare[0]); + /* Open with O_CLOEXEC to avoid potential fd leaks */ + dfd = open(devname, O_RDWR | O_CLOEXEC); + if (dfd < 0) { + log_error("open %s failed errstr:%s\n", devname, strerror(errno)); + return -1; + } + + ret = ioctl(dfd, MFS_IOC_FSINFO, (unsigned long)&fsinfo); + if (ret < 0) { + log_error("ioctl get fsinfo failed, ret:%d\n", ret); + goto close_fd; + } + if (fsinfo.mode != 1) { + log_error("fs runing mode(%d) is not supported", fsinfo.mode); + goto close_fd; + } + ret = loader_init(); + if (ret) { + log_error("loader init failed"); + goto close_fd; + } + ret = fs_client_init(NULL); + if (ret) { + log_error("clients init failed"); + goto free_loader; + } + ret = parser_init(fsinfo.mode, mntpoint); + if (ret) { + log_error("parser init failed"); + goto free_client; + } + ret = policy_init(); + if (ret) { + log_error("policy init failed"); + goto free_parser; + } + ret = policy_register(strategylib); + if (ret) { + log_info("register new policy failed, use default policy"); + } + + dev_monitor(dfd); +free_parser: + parser_destory(); +free_client: + fs_client_exit(); +free_loader: + loader_exit(); +close_fd: + close(dfd); + return ret; +} diff --git a/tools/mfs/maio-utils/src/parser/CMakeLists.txt b/tools/mfs/maio-utils/src/parser/CMakeLists.txt new file mode 100644 index 000000000000..72e5849da8e4 --- /dev/null +++ b/tools/mfs/maio-utils/src/parser/CMakeLists.txt @@ -0,0 +1,16 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +aux_source_directory(. PARSER_SRC) + +#******************************************************************************* +#******************************************************************************* + +add_library(parser ${PARSER_SRC}) +target_link_libraries(parser infra + securec) diff --git a/tools/mfs/maio-utils/src/parser/req_parser.c b/tools/mfs/maio-utils/src/parser/req_parser.c new file mode 100644 index 000000000000..137eb8d8cb3f --- /dev/null +++ b/tools/mfs/maio-utils/src/parser/req_parser.c @@ -0,0 +1,313 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ + +#include "inner.h" +#include "log.h" +#include "mfs.h" +#include "policy.h" +#include "securec.h" +#include "threadpool.h" + +#include <stdbool.h> +#include <errno.h> +#include <sys/ioctl.h> +#include <sys/stat.h> + +struct parser_mgr { + uint32_t fs_mode; + uint32_t chunk_size; + const char *mntpoint; + threadpool_t *parser; +}; + +struct parser_mgr g_parser_mgr; + +#define PARSER_NUM 8 +#define MAX_PATH_SIZE 1024 + +#define __round_mask(x, y) ((__typeof__(x))((y)-1)) +#define round_up(x, y) ((((x)-1) | __round_mask(x, y))+1) +#define round_down(x, y) ((x) & ~__round_mask(x, y)) + +#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) +#define MIN(x, y) ((x) < (y) ? (x) : (y)) + +bool is_power_of_2(unsigned long n) +{ + return (n != 0 && ((n & (n - 1)) == 0)); +} + +void ctx_cb(int ret, void *args) +{ + struct io_context *ctx = (struct io_context *)args; + + if (ctx->path) + free(ctx->path); + if (ctx->buf) + free(ctx->buf); + free(ctx); +} + +void _submit_local_io(int fd, struct maio_entry *entry) +{ + struct io_context *ioctx; + + ioctx = calloc(1, sizeof(struct io_context)); + if (!ioctx) { + log_error("ioctx alloc failed"); + return; + } + ioctx->off = entry->toff; + ioctx->len = entry->tlen; + ioctx->numaid = entry->tnuma; + ioctx->fd = fd; + ioctx->path = entry->fpath; + ioctx->seq = entry->seq; + ioctx->private = ioctx; + ioctx->end_io = ctx_cb; + loader_io_submit(ioctx); +} + +char *get_file_path(int fd) +{ + struct mfs_ioc_rpath *rp; + char *path; + int ret; + + rp = malloc(sizeof(struct mfs_ioc_rpath) + MAX_PATH_SIZE); + if (!rp) { + log_error("rpath alloc failed"); + return NULL; + } + rp->max = MAX_PATH_SIZE; + ret = ioctl(fd, MFS_IOC_RPATH, (unsigned long)rp); + if (ret) { + log_error("realpath failed for fd:%d, ret:%d", fd, ret); + free(rp); + return NULL; + } + rp->d[rp->len] = '\0'; + + path = malloc(strlen(g_parser_mgr.mntpoint) + rp->len); + if (!path) { + log_error("malloc path %s %s failed", g_parser_mgr.mntpoint, (const char *)rp->d); + return NULL; + } + sprintf(path, "%s%s", g_parser_mgr.mntpoint, (const char *)rp->d); + free(rp); + return path; +} + +char *_get_fullpath(char *fpath, int fd) +{ + struct mfs_ioc_rpath *rp; + char *path; + int ret; + + if (fpath) + return fpath; + rp = malloc(sizeof(struct mfs_ioc_rpath) + MAX_PATH_SIZE); + if (!rp) { + log_error("rpath alloc failed"); + return NULL; + } + rp->max = MAX_PATH_SIZE; + ret = ioctl(fd, MFS_IOC_RPATH, (unsigned long)rp); + if (ret) { + log_error("realpath failed for fd:%d, ret:%d", fd, ret); + free(rp); + return NULL; + } + rp->d[rp->len] = '\0'; + path = strdup((const char *)rp->d); + if (!path) + log_error("strdup path(%s) failed", (const char *)rp->d); + free(rp); + return path; +} + +void maio_preload(struct maio *maio, int nio) +{ + struct maio_entry *entry; + + for (int i = 0; i < nio; ++i) { + entry = &maio->entries[i]; + _submit_local_io(0, entry); + } +} + +uint8_t pid_to_numaid(int pid) +{ + return (uint8_t)-1; +} + +void _process_read_io(uint32_t id, struct maio *maio, int nio) +{ + struct maio_entry *entry; + int i; + + /* process the successor io */ + for (i = 0; i < nio; i++) { + entry = &maio->entries[i]; + _submit_local_io(maio->fd, entry); + } +} + +void _submit_evict(struct maio_entry *entry) +{ + struct io_context *ioctx; + + ioctx = calloc(1, sizeof(struct io_context)); + if (!ioctx) { + log_error("ioctx alloc failed"); + return; + } + ioctx->off = entry->toff; + ioctx->len = entry->tlen; + ioctx->numaid = -1; + ioctx->path = entry->fpath; + ioctx->private = ioctx; + ioctx->end_io = ctx_cb; + loader_evict_submit(ioctx); +} + +void _process_evict(struct mfs_msg *msg) +{ + struct maio_entry *entry; + struct mfs_read *read; + uint64_t soff, eoff; + struct maio *maio; + int ret; + + if (g_parser_mgr.fs_mode != MFS_MODE_LOCAL) + return; + + maio = calloc(1, sizeof(struct maio)); + if (!maio) { + log_error("failed to alloc maio"); + return; + } + + read = (void *)msg->data; + maio->cksz = g_parser_mgr.chunk_size; + soff = round_down(read->off, maio->cksz); + eoff = round_up(read->off + read->len, maio->cksz); + maio->fd = msg->fd; + maio->off = read->off; + maio->len = eoff - soff; + maio->pid = read->pid; + maio->op = msg->opcode; + + ret = policy_evict(&maio); + if (ret <= 0) + goto out; + + for (int i = 0; i < ret; ++i) { + entry = &maio->entries[i]; + _submit_evict(entry); + } +out: + free(maio); +} + +void _parse_read_req(struct mfs_msg *msg) +{ + struct mfs_read *read; + struct maio *maio; + uint64_t soff, eoff, ts; + int ret, io_num = policy_max_io(); + + _process_evict(msg); + + /* alloc maio slots */ + maio = calloc(1, sizeof(struct maio) + io_num * sizeof(struct maio_entry)); + if (!maio) { + log_error("failed to alloc maio, num:%d", io_num); + return; + } + read = (void *)msg->data; + maio->cksz = g_parser_mgr.chunk_size; + soff = round_down(read->off, maio->cksz); + eoff = round_up(read->off + read->len, maio->cksz); + ts = _get_ts(); + maio->fd = msg->fd; + maio->off = soff; + maio->len = eoff - soff; + maio->pid = read->pid; + maio->op = msg->opcode; + maio->ts = ts; + + /* fill slots from policy */ + ret = policy_load(&maio); + if (ret < 0) { + char *path = _get_fullpath(NULL, maio->fd); + if (path) { + log_warn("io on path:%s%s offset:%lu length:%lu dropped", + g_parser_mgr.mntpoint, path, read->off, read->len); + free(path); + } + free(maio); + return; + } + + if (maio->flags & MAIO_WITH_SEQ) + loader_update_curseq(maio->curseq); + + /* keep the input parameter */ + maio->fd = msg->fd; + maio->off = soff; + maio->len = eoff - soff; + maio->cksz = g_parser_mgr.chunk_size; + maio->pid = read->pid; + maio->op = msg->opcode; + maio->ts = ts; + + /* process each maio in slots */ + _process_read_io(msg->id, maio, ret); + free(maio); +} + +void _parse_one_req(void *buf) +{ + struct mfs_msg *msg = (struct mfs_msg *)buf; + + if (msg->opcode == MFS_OP_READ || msg->opcode == MFS_OP_FAULT) + _parse_read_req(msg); + + free(buf); +} + +int maio_parse_req(void *buf, int size) +{ + struct mfs_msg *msg = (struct mfs_msg *)buf; + + if (msg->len != size) + return -1; + + threadpool_submit(g_parser_mgr.parser, buf, _parse_one_req); + return 0; +} + +int parser_init(uint32_t fs_mode, const char *mntpoint) +{ + g_parser_mgr.fs_mode = fs_mode; + g_parser_mgr.mntpoint = strdup(mntpoint); + g_parser_mgr.chunk_size = 4096; + if (!is_power_of_2(g_parser_mgr.chunk_size)) { + log_error("chunk size must be power of 2"); + return -1; + } + g_parser_mgr.parser = threadpool_create("ReqParser", PARSER_NUM, -1); + if (!g_parser_mgr.parser) { + log_error("failed to alloc parser threadpool"); + return -1; + } + + return 0; +} + +void parser_destory(void) +{ + threadpool_destroy(g_parser_mgr.parser); +} diff --git a/tools/mfs/maio-utils/src/policy/CMakeLists.txt b/tools/mfs/maio-utils/src/policy/CMakeLists.txt new file mode 100644 index 000000000000..714023475e07 --- /dev/null +++ b/tools/mfs/maio-utils/src/policy/CMakeLists.txt @@ -0,0 +1,16 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +aux_source_directory(. POLICY_SRC) + +#******************************************************************************* +#******************************************************************************* + +add_library(policy ${POLICY_SRC}) +target_link_libraries(policy infra + securec) diff --git a/tools/mfs/maio-utils/src/policy/policy.c b/tools/mfs/maio-utils/src/policy/policy.c new file mode 100644 index 000000000000..c77ab31752be --- /dev/null +++ b/tools/mfs/maio-utils/src/policy/policy.c @@ -0,0 +1,114 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "policy.h" + +#include "maio.h" +#include "log.h" +#include "securec.h" +#include <dlfcn.h> + +typedef struct maio_operation* (*strategy_init)(); + +struct policy_mgr { + void *handle; + struct maio_operation *strategy; +}; + +struct policy_mgr g_policy; + +static int default_init(void) +{ + return 0; +} + +static void default_exit(void) +{ +} + +static int default_load(struct maio **io) +{ + return 0; +} + +static int default_evict(struct maio **io) +{ + return 0; +} + +struct maio_operation default_ops = { + .max_io = 1, + .init = default_init, + .exit = default_exit, + .load = default_load, + .evict = default_evict, +}; + +static void set_default_strategy(void) +{ + g_policy.strategy = &default_ops; +} + +int policy_max_io(void) +{ + return g_policy.strategy->max_io; +} + +/* return the filled num of io */ +int policy_load(struct maio **io) +{ + return g_policy.strategy->load(io); +} + +int policy_evict(struct maio **io) +{ + return g_policy.strategy->evict(io); +} + +int policy_register(const char *path) +{ + strategy_init sinit; + + if (!path || strlen(path) == 0) + return -1; + + g_policy.handle = dlopen(path, RTLD_LAZY); + if (!g_policy.handle) { + log_error("dlopen failed:%s", dlerror()); + return -1; + } + + sinit = dlsym(g_policy.handle, "register_strategy"); + if (!sinit) { + log_error("dlsym failed:%s", dlerror()); + dlclose(g_policy.handle); + g_policy.handle = NULL; + return -1; + } + g_policy.strategy = sinit(); + if (g_policy.strategy->init()) + return -1; + log_info("register strategy:%s done.", path); + return 0; +} + +void policy_unregister(void) +{ + if (g_policy.handle) { + g_policy.strategy->exit(); + dlclose(g_policy.handle); + g_policy.handle = NULL; + } + set_default_strategy(); +} + +int policy_init(void) +{ + g_policy.handle = NULL; + set_default_strategy(); + return 0; +} + +void policy_exit(void) +{ +} diff --git a/tools/mfs/maio-utils/test/Makefile b/tools/mfs/maio-utils/test/Makefile new file mode 100644 index 000000000000..404d9cf3d9a4 --- /dev/null +++ b/tools/mfs/maio-utils/test/Makefile @@ -0,0 +1,26 @@ +# SPDX-License-Identifier: GPL-2.0 + +CC := gcc +CFLAGS := -fPIC -Wall -Werror -O2 +CPPFLAGS := -fPIC -Wall -Wno-ignored-attributes -Werror -O2 -std=c++11 -g +LDFLAGS := -shared + +CFLAGS += $(addprefix -I,../include) +CPPFLAGS += $(addprefix -I,../include) + +C_SRCS := $(wildcard *.c) +CPP_SRCS := $(wildcard *.cpp) +TARGETS := $(C_SRCS:.c=.so) $(CPP_SRCS:.cpp=.so) + +all: $(TARGETS) + +%.so: %.c + $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $< + +%.so: %.cpp + $(CC) $(CPPFLAGS) $(LDFLAGS) -o $@ $< + +clean: + rm -f $(TARGETS) + +.PHONY: all clean diff --git a/tools/mfs/maio-utils/test/README.md b/tools/mfs/maio-utils/test/README.md new file mode 100644 index 000000000000..cf37df6d85d3 --- /dev/null +++ b/tools/mfs/maio-utils/test/README.md @@ -0,0 +1,61 @@ +Here, we provide some strategies library for some cases. + +- strategy_demo +A simple strategy library shows how to write a demo. + +- strategy_prefetch +A prefetch strategy library to prefetch data. + +- strategy_toend +A readahead strategy until the end. + +- strategy_generate +A tools using maio-util to generate the io trace. + +- strategy_replay +A strategy to replay the io trace. + +### How to build + +Using `make -j` to build the libraries. + +### How to use + +Set the library path as the `-s` parameter's value to run with maio-utils. Here we show usage of the advanced replay strategy: + +- generate the io trace + +> assume you have mounted the mfs at /mnt/mfs, and you are in build directory. + +This is the tracing period. + +``` +export MAIO_TRACE_FILE=trace.txt +export MAIO_MNTPOINT=/mnt/mfs # /mnt/mfs is the MFS mountpoint +./bin/maio-utils -m /mnt/mfs -s ../test/strategy_generate.so +``` +Then, you can trigger the io. After finishing, you would get the trace file with the content likes: + +``` +xxx/model-00001-of-000008.safetensors 0 32768 0 +xxx/model-00001-of-000008.safetensors 32768 32768 0 +xxx/model-00001-of-000008.safetensors 65536 32768 0 +xxx/model-00001-of-000008.safetensors 98304 32768 0 +xxx/model-00001-of-000008.safetensors 131072 32768 0 +... + +``` + +The format is "<path> <offset> <length> <numaid>". + +- replay the io trace + +> assume you have mounted the mfs at /mnt/mfs and begin to launch the model. + +This is the running period. + +``` +export MAIO_TRACE_FILE=trace.txt +export MAIO_MNTPOINT=/mnt/mfs # /mnt/mfs is the MFS mountpoint +./bin/maio-utils -m /mnt/mfs -s ../test/strategy_replay.so +``` diff --git a/tools/mfs/maio-utils/test/strategy_demo.c b/tools/mfs/maio-utils/test/strategy_demo.c new file mode 100644 index 000000000000..82a5cd178b03 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_demo.c @@ -0,0 +1,45 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include <stddef.h> + +int demo_init(void) +{ + return 0; +} + +void demo_exit(void) +{ +} + +int demo_load(struct maio **io) +{ + struct maio_entry *entry; + + entry = (*io)->entries; + entry[0].toff = (*io)->off + (*io)->len; + entry[0].tlen = (*io)->cksz; + entry[0].fpath = NULL; + entry[0].tnuma = -1; + return 1; +} + +int demo_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation demo_strategy = { + .max_io = 1, + .init = demo_init, + .exit = demo_exit, + .load = demo_load, + .evict = demo_evict, +}; + +struct maio_operation *register_strategy(void) +{ + return (struct maio_operation *)&demo_strategy; +} diff --git a/tools/mfs/maio-utils/test/strategy_generate.cpp b/tools/mfs/maio-utils/test/strategy_generate.cpp new file mode 100644 index 000000000000..929be30e6a42 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_generate.cpp @@ -0,0 +1,296 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include "strategy_template.h" + +#include <array> +#include <atomic> +#include <cstring> +#include <condition_variable> +#include <fstream> +#include <sstream> +#include <iostream> +#include <mutex> +#include <queue> +#include <thread> +#include <unordered_map> +#include <vector> +#include <unistd.h> + +using namespace std; + +#define MAIO_MNTPOINT "MAIO_MNTPOINT" +#define MAIO_TRACE_FILE "MAIO_TRACE_FILE" +#define CACHEDIR "cachedir" + +#define MAXLINE 1024 + +/* Data struct definition */ +template<typename T> +class SafeQueue { +private: + queue<T> data_queue; + mutex mtx; + condition_variable cv; + +public: + // 添加数据到队列 + void push(T item) { + lock_guard<mutex> lock(mtx); + data_queue.push(move(item)); + cv.notify_one(); + } + + // 从队列取出数据（阻塞直到有数据） + T pop() { + unique_lock<mutex> lock(mtx); + cv.wait(lock, [this]{ return !data_queue.empty(); }); + T item = move(data_queue.front()); + data_queue.pop(); + return item; + } + + // 检查队列是否为空 + bool empty() { + lock_guard<mutex> lock(mtx); + return data_queue.empty(); + } +}; + +struct io { + string name; + uint64_t off; + uint64_t len; + uint8_t npu; + + io(const string& _name, uint64_t _off, uint64_t _len, uint8_t _npu) + : name(_name), off(_off), len(_len), npu(_npu) {} +}; + +/* Global variable definition */ +unordered_map<int, char*> fd_map; /* map fd to path */ +mutex fd_mutex; +string cachedir; + +vector<io> iovec; /* io traces */ +mutex iovec_mutex; +SafeQueue<vector<io>> iovec_queue; + +ofstream tfile; /* trace file */ + +thread writer; + +unordered_map<int, int> process_npu_map; +mutex pnpu_mutex; + +atomic<int> npu_smi_enable(-1); + +/* fd_map helper function */ +char* fd_path_find(int iofd) { + lock_guard<mutex> lock(fd_mutex); + auto it = fd_map.find(iofd); + if (it != fd_map.end()) { + return it->second; + } else { + char *path = _get_fullpath(NULL, iofd); + fd_map.insert({iofd, path}); + return path; + } +} + +/* iovec helper function */ +void io_insert_data(string name, uint64_t off, uint64_t len, uint8_t npu) +{ + lock_guard<mutex> lock(iovec_mutex); + iovec.emplace_back(name, off, len, npu); + + vector<io> copy_iovec = move(iovec); + iovec.clear(); + + iovec_queue.push(move(copy_iovec)); +} + +void get_mount_option(const char* mntpoint, const char* option) +{ + ifstream mounts("/proc/mounts"); + string line, target_mp; + + if (!mounts.is_open()) { + cerr << "Error: could not open /proc/mounts" << endl; + return; + } + + while (getline(mounts, line)) { + istringstream iss(line); + string device, mp, fs_type, options; + + if (!(iss >> device >> mp >> fs_type >> options)) + continue; + + if (mp.back() != '/') + mp += '/'; + target_mp = mntpoint; + if (target_mp.back() != '/') + target_mp += '/'; + + if (target_mp == mp) { + istringstream opt_stream(options); + string opt; + + while (getline(opt_stream, opt, ',')) { + if (opt.find(option) == 0) { + if (opt[strlen(option)] == '=') { + cachedir = opt.substr(strlen(option) + 1); + } + } + } + break; + } + } +} + +void writer_thread() { + while (true) { + vector<io> iovec_to_write = iovec_queue.pop(); + + for (const auto &item : iovec_to_write) + tfile << cachedir << item.name << " " << item.off << " " << item.len << " " << (unsigned int)item.npu << endl; + tfile.flush(); + } +} + +string exec_cmd(const char* cmd) { + array<char, 128> buffer; + string result; + unique_ptr<FILE, decltype(&pclose)> pipe(popen(cmd, "r"), pclose); + + if (!pipe) { + throw std::runtime_error("popen() failed!"); + } + while (fgets(buffer.data(), buffer.size(), pipe.get()) != nullptr) { + result += buffer.data(); + } + return result; +} + +bool isNumber(const std::string& str) { + return !str.empty() && str.find_first_not_of("0123456789") == std::string::npos; +} + +void get_npu_info(string &npuinfo) +{ + istringstream iss(npuinfo); + string line; + + while (getline(iss, line)) { + istringstream lineStream(line); + string token; + vector<string> tokens; + while (getline(lineStream, token, ' ')) { + if (!token.empty()) { + tokens.push_back(token); + } + } + if (tokens.size() >= 3) { + if (!isNumber(tokens[1]) || !isNumber(tokens[4])) + continue; + int npuId = stoi(tokens[1]); + int processId = stoi(tokens[4]); + process_npu_map[processId] = npuId; + } + } +} + +int process_npu_find(int processid) { + lock_guard<mutex> lock(pnpu_mutex); + auto it = process_npu_map.find(processid); + + if (npu_smi_enable.load() == -1) { + if (exec_cmd("command -v npu-smi").empty()) + npu_smi_enable.store(0); + else + npu_smi_enable.store(1); + } + + if (npu_smi_enable.load() == 0) + return 0; + + if (it != process_npu_map.end()) { + return it->second; + } else { + string result = exec_cmd("npu-smi info"); + get_npu_info(result); + auto it = process_npu_map.find(processid); + if (it != process_npu_map.end()) + return it->second; + else + return 0; + } +} + +int strategy_init(void) +{ + char *tfilename = getenv(MAIO_TRACE_FILE); + char *mntpoint = getenv(MAIO_MNTPOINT); + + if(!tfilename || !mntpoint) { + printf("no MAIO_TRACE_FILE or MAIO_MNTPOINT env variable\n"); + return -1; + } + get_mount_option(mntpoint, CACHEDIR); + string stfilename = tfilename; + tfile.open(stfilename, ios::trunc); + writer = thread(writer_thread); + if (!tfile.is_open()) { + cerr << "Error: could not open" << stfilename << endl; + return -1; + } + return 0; +} + +void strategy_exit(void) +{ + lock_guard<mutex> lock(iovec_mutex); + vector<io> copy_iovec = move(iovec); + iovec.clear(); + iovec_queue.push(move(copy_iovec)); + + tfile.close(); + writer.join(); +} + +int strategy_load(struct maio **io) +{ + char *path; + string pathStr; + int ret = 0; + + if (!tfile.is_open()) + return -1; + + path = fd_path_find((*io)->fd); + pathStr.assign(path); + io_insert_data(pathStr, (*io)->off, (*io)->len, process_npu_find((*io)->pid)); + + return ret; +} + +int strategy_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation maio_strategy = { + .max_io = 1, + .init = strategy_init, + .exit = strategy_exit, + .load = strategy_load, + .evict = strategy_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&maio_strategy; +} diff --git a/tools/mfs/maio-utils/test/strategy_prefetch.cpp b/tools/mfs/maio-utils/test/strategy_prefetch.cpp new file mode 100644 index 000000000000..9ba205931cdc --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_prefetch.cpp @@ -0,0 +1,150 @@ +#include "strategy_prefetch.h" +#include "maio.h" +#include <iostream> +#include <map> +#include <cstring> +#include <string> +#include <stdint.h> +#include <sys/stat.h> +#include <sys/mman.h> +#include <dirent.h> +#include <fcntl.h> +#include <unistd.h> + +using namespace std; + +struct prefetch_mgr { + map<string, uint64_t> files; +}; + +struct prefetch_mgr g_prefetch; + +int get_files(const char *parent) +{ + DIR *dir; + struct dirent *entry; + string filepath; + struct stat buf; + + if ((dir = opendir(parent)) == NULL) { + cout<<"opening directory failed"<<endl; + return -1; + } + + while ((entry = readdir(dir)) != NULL) { + if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) + continue; + + filepath = string(parent) + "/" + string(entry->d_name); + if (stat(filepath.c_str(), &buf) == -1) { + cout<<"stat path:"<<filepath<<" failed"<<endl; + continue; + } + if (S_ISDIR(buf.st_mode)) + continue; + cout<<"Find file:"<<filepath<<" size:"<<buf.st_size<<endl; + g_prefetch.files.insert(pair<string, uint64_t>(filepath, buf.st_size)); + } + + map<string, uint64_t>::iterator it; + for (it = g_prefetch.files.begin(); it != g_prefetch.files.end(); ++it) { + cout<<"path:"<<it->first<<" size:"<<it->second<<endl; + } + return 0; +} + +int prefetch_init(void) +{ + char *parent = getenv("MODEL_WEIGHT_DIR"); + if (!parent) { + cout<<"please set the env MODEL_WEIGHT_DIR"<<endl; + return -1; + } + + if (get_files(parent) != 0) { + cout<<"get all files failed"<<endl; + return -1; + } + return 0; +} + +void prefetch_exit(void) +{ +} + +struct thread_ctx { + char *path; + uint64_t off; + uint64_t len; +}; + +void *fault(void *arg) +{ + struct thread_ctx *ctx = (struct thread_ctx *)arg; + int fd = open(ctx->path, O_RDONLY); + if (fd < 0) { + cout<<"open file:%s"<<ctx->path<<" failed"<<endl; + free(ctx); + return NULL; + } + + cout<<"FAULT path:"<<ctx->path<<" fd:"<<fd<<" off:"<<ctx->off<<" len:"<<ctx->len<<endl; + void *addr = mmap(NULL, ctx->len, PROT_READ, MAP_SHARED, fd, 0); + uint64_t idx; + char tmp, total, *buffer = (char *)addr; + total = 'B'; + for (idx = 0; idx < ctx->len; idx += 4096) { + tmp = buffer[idx]; + total += tmp; + } + cout<<"Fault calculate total:"<<total<<endl; + munmap(addr, ctx->len); + close(fd); + free(ctx); + return NULL; +} + +int prefetch_load(struct maio **io) +{ + map<string, uint64_t>::iterator it; + struct thread_ctx *ctx; + pthread_t t0; + int ret; + + for (it = g_prefetch.files.begin(); it != g_prefetch.files.end(); ++it) { + ctx = (struct thread_ctx *)malloc(sizeof(struct thread_ctx)); + if (!ctx) { + cout<<"malloc ctx failed"<<endl; + continue; + } + ctx->path = strdup(it->first.c_str()); + ctx->off = 0; + ctx->len = it->second; + ret = pthread_create(&t0, NULL, fault, ctx); + if (ret == 0) + pthread_detach(t0); + } + g_prefetch.files.clear(); + + return 0; +} + +int prefetch_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation prefetch_strategy = { + .max_io = 1, + .init = prefetch_init, + .exit = prefetch_exit, + .load = prefetch_load, + .evict = prefetch_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&prefetch_strategy; +} + diff --git a/tools/mfs/maio-utils/test/strategy_prefetch.h b/tools/mfs/maio-utils/test/strategy_prefetch.h new file mode 100644 index 000000000000..e487e38b3d8b --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_prefetch.h @@ -0,0 +1,21 @@ +#ifndef STRATEGY_PREFETCH_H +#define STRATEGY_PREFETCH_H + +#ifdef __cplusplus +extern "C" { +#endif + +int prefetch_init(void); +void prefetch_exit(void); +int prefetch_load(struct maio *io); +int prefetch_evict(struct maio **io); + +extern const struct maio_operation prefetch_strategy; + +struct maio_operation *register_strategy(void); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/tools/mfs/maio-utils/test/strategy_replay.cpp b/tools/mfs/maio-utils/test/strategy_replay.cpp new file mode 100644 index 000000000000..85c1c7defedd --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_replay.cpp @@ -0,0 +1,540 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include "strategy_template.h" + +#include <atomic> +#include <array> +#include <cstring> +#include <fstream> +#include <iostream> +#include <map> +#include <mutex> +#include <sstream> +#include <string> +#include <thread> +#include <unordered_map> +#include <vector> +#include <pthread.h> +#include <fcntl.h> +#include <unistd.h> + +using namespace std; + +#define MAIO_MNTPOINT "MAIO_MNTPOINT" +#define MAIO_TRACE_FILE "MAIO_TRACE_FILE" +#define CACHEDIR "cachedir" +#define MAXLINE 1024 + +/* Data structure definition */ +enum { + IO_NONE = 0, + IO_LOADED, + IO_EVICTED, +}; + +struct io { + string name; + uint64_t off; + uint64_t len; + uint8_t npu; + int flag; + + explicit io(const string& _name, uint64_t _off, uint64_t _len, uint8_t _npu) + : name(_name), off(_off), len(_len), npu(_npu), flag(IO_NONE) {} +}; + + +struct ioKey { + string name; + uint64_t off; + uint64_t len; + uint8_t npu; + + ioKey(const string& _name, uint64_t _off, uint64_t _len, uint8_t _npu) + : name(_name), off(_off), len(_len), npu(_npu) {} + + bool operator<(const ioKey &other) const { + return name < other.name || (name == other.name && off < other.off) || + (name == other.name && off == other.off && len < other.len); + } +}; + +vector<io> iovec; /* io traces */ +map<ioKey, int> io_to_index; +unordered_map<int, char*> fd_map; +mutex fd_mutex; +string cachedir; + +unordered_map<int, int> npu_numa_map; + +unordered_map<int, int> process_npu_map; +mutex pnpu_mutex; + +/* for evict */ +#define EVICT_DIST 10000 +#define EVICT_IO_MAX 5000 +thread_local size_t evict_idx = 0; + +atomic<int> npu_smi_enable(-1); +atomic<uint64_t> memory_usage(0); + +uint64_t memory_limit; +uint64_t memory_limit_bound; +string usage_in_bytes_path = "memory.usage_in_bytes"; +string limit_in_bytes_path = "memory.limit_in_bytes"; +string cgroup_mem=""; + +string get_cgroup_path() +{ + fstream cgroup_file("/proc/self/cgroup"); + if (!cgroup_file.is_open()) { + cerr << "Failed to open /proc/self/cgroup" << endl; + return ""; + } + + string line; + string cgroup_path; + while (getline(cgroup_file, line)) { + istringstream iss(line); + string hierarchy, controller, path; + if (!getline(iss, hierarchy, ':')) + continue; + if (!getline(iss, controller, ':')) + continue; + if (!getline(iss, path, ':')) + continue; + if (controller == "memory") { + cgroup_path = path; + break; + } + } + cgroup_file.close(); + return cgroup_path; +} + +/* read from /sys/fs/cgroup/memory/memory.[usage_in_bytes|limit_in_bytes] */ +uint64_t read_cgroup_memory(const string &file_path) +{ + if (cgroup_mem == "") + return -1; + string whole_path = "/sys/fs/cgroup/memory"+cgroup_mem+"/"+file_path; + ifstream cgroup_file(whole_path); + + if(!cgroup_file.is_open()) { + cerr << "Failed to open " << file_path << endl; + return -1; + } + + string line; + while(getline(cgroup_file, line)) { + try { + return stoll(line); + } catch (...) { + cerr << "Failed to parse line" << line << endl; + } + } + + cgroup_file.close(); + return -1; +} + +/* mount helper */ +void get_mount_option(const char* mntpoint, const char* option) +{ + ifstream mounts("/proc/mounts"); + string line, target_mp; + + if (!mounts.is_open()) { + cerr << "Error: could not open /proc/mounts" << endl; + return; + } + + while (getline(mounts, line)) { + istringstream iss(line); + string device, mp, fs_type, options; + + if (!(iss >> device >> mp >> fs_type >> options)) + continue; + + if (mp.back() != '/') + mp += '/'; + target_mp = mntpoint; + if (target_mp.back() != '/') + target_mp += '/'; + + if (target_mp == mp) { + istringstream opt_stream(options); + string opt; + + while (getline(opt_stream, opt, ',')) { + if (opt.find(option) == 0) { + if (opt[strlen(option)] == '=') { + cachedir = opt.substr(strlen(option) + 1); + } + } + } + break; + } + } +} + +/* fd_map helper function */ +char* fd_path_find(int iofd) { + lock_guard<mutex> lock(fd_mutex); + auto it = fd_map.find(iofd); + if (it != fd_map.end()) { + return it->second; + } else { + char *path = _get_fullpath(NULL, iofd); + size_t len = strlen(path) + cachedir.length() + 1; + char *realpath = (char*)malloc(len); + snprintf(realpath, len, "%s%s", cachedir.c_str(), path); + fd_map.insert({iofd, realpath}); + return realpath; + } +} + +string exec_cmd(const char* cmd) { + array<char, 128> buffer; + string result = ""; + unique_ptr<FILE, decltype(&pclose)> pipe(popen(cmd, "r"), pclose); + + if (!pipe) { + throw std::runtime_error("popen() failed!"); + } + while (fgets(buffer.data(), buffer.size(), pipe.get()) != nullptr) { + result += buffer.data(); + } + return result; +} + +bool isNumber(const std::string& str) { + return !str.empty() && str.find_first_not_of("0123456789") == std::string::npos; +} + +/* cpu_numa_map builder from lscpu */ +unordered_map<string, int> build_cpu_numa_map() { + unordered_map<string, int> cpuNumaMap; + string result = exec_cmd("lscpu"); + istringstream iss(result); + string line; + + while (getline(iss, line)) { + if (line.find("NUMA node") != string::npos) { + istringstream lineStream(line); + string key, value; + int numaNode; + getline(lineStream, value, ':'); + getline(lineStream, key); + /* what if numa is more than 10 */ + value = value.substr(value.find("NUMA node") + 9, 1); + if (!isNumber(value)) + continue; + numaNode = stoi(value); + key.erase(0, key.find_first_not_of(" \t")); + key.erase(key.find_last_not_of(" \t") + 1); + cpuNumaMap[key]=numaNode; + } + } + return cpuNumaMap; +} + +/* npu_numa_map builder, from npu-smi info -t topo */ +void build_npu_map_map() +{ + if (npu_smi_enable.load() == -1) { + if (exec_cmd("command -v npu-smi").empty()) + npu_smi_enable.store(0); + else + npu_smi_enable.store(1); + } + + if (npu_smi_enable.load() == 0) + return; + + unordered_map<string, int> cpuNumaMap = build_cpu_numa_map(); + string result = exec_cmd("npu-smi info -t topo"); + istringstream iss(result); + string line; + size_t target_token_size = 0; + + cout << "NPU\tCPU_AFFINITY\tNUMA_NODE" << endl; + while (getline(iss, line)) { + istringstream lineStream(line); + string npuStr, numaStr, token; + vector<string> tokens; + + while (lineStream >> token) { + tokens.push_back(token); + } + + if (tokens.size() >= 2 && tokens.back() == "Affinity") { + target_token_size = tokens.size() - 1 + 1; + continue; + } + + if (tokens.size() != target_token_size) + continue; + + int npuId = stoi(tokens[0].substr(3)); + + numaStr = tokens.back(); + cout << npuId << "\t" << numaStr << "\t\t" << cpuNumaMap[numaStr] << endl; + npu_numa_map[npuId] = cpuNumaMap[numaStr]; + } +} + +/* process_npu_map builder, from npu-smi info */ +void get_npu_info(string &npuinfo) +{ + istringstream iss(npuinfo); + string line; + + while (getline(iss, line)) { + istringstream lineStream(line); + string token; + vector<string> tokens; + while (getline(lineStream, token, ' ')) { + if (!token.empty()) { + tokens.push_back(token); + } + } + if (tokens.size() >= 3) { + if (!isNumber(tokens[1]) || !isNumber(tokens[4])) + continue; + int npuId = stoi(tokens[1]); + int processId = stoi(tokens[4]); + process_npu_map[processId] = npuId; + } + } +} + +/* process_npu_map helper */ +int process_npu_find(int processid) { + lock_guard<mutex> lock(pnpu_mutex); + auto it = process_npu_map.find(processid); + + if (npu_smi_enable.load() == 0) + return 0; + + if (it != process_npu_map.end()) { + return it->second; + } else { + string result = exec_cmd("npu-smi info"); + get_npu_info(result); + auto it = process_npu_map.find(processid); + if (it != process_npu_map.end()) + return it->second; + else + return 0; + } +} + +int strategy_init(void) +{ + const char *mntpoint = getenv(MAIO_MNTPOINT); + char *tfilename = getenv(MAIO_TRACE_FILE); + if(!tfilename || !mntpoint) { + fprintf(stderr, "no MAIO_TRACE_FILE or MAIO_MNTPOINT env variable\n"); + return -1; + } + ifstream tfile(tfilename); + string line; + + cgroup_mem=get_cgroup_path(); + memory_limit = read_cgroup_memory(limit_in_bytes_path); + memory_limit_bound = memory_limit * 4 / 5; + cout << "memory_limit: " << memory_limit << " memory_limit_bound: " << memory_limit_bound << endl; + get_mount_option(mntpoint, CACHEDIR); + build_npu_map_map(); + + if(!tfile.is_open()) { + cerr << "Failed to open file:" << tfilename << endl; + return -1; + } + + while(getline(tfile, line)) { + istringstream iss(line); + + string name; + uint64_t off; + uint64_t len; + unsigned int npu; + if (iss >> name >> off >> len >> npu) { + iovec.emplace_back(name, off, len, npu); + io_to_index[ioKey(name, off, len, npu)] = iovec.size() - 1; + } else { + cerr << "Failed to parse line:" << line << endl; + } + } + + tfile.close(); + return 0; +} + +void strategy_exit(void) +{ +} + +int strategy_load(struct maio **io) +{ + int npuid = process_npu_find((*io)->pid); + struct maio_entry *entry; + string pathStr; + char *path; + uint64_t idx = iovec.size(); + int ret = 0; + struct maio *new_io; + + path = fd_path_find((*io)->fd); + pathStr.assign(path); + + ioKey key(pathStr, (*io)->off, (*io)->len, npuid); + auto io_it = io_to_index.lower_bound(key); + if (io_it == io_to_index.end()) { + entry = (*io)->entries; + entry[0].toff = (*io)->off + (*io)->len; + entry[0].tlen = 0; + entry[0].fpath = NULL; + entry[0].tnuma = npu_numa_map[npuid]; + return 1; + } + if (key < io_it->first) { + if (io_it != io_to_index.begin()) { + --io_it; + if (io_it->first.name != pathStr) { + ++io_it; + } + } + } + + idx = io_it->second; + (*io)->flags |= MAIO_WITH_SEQ; + (*io)->curseq = idx; + entry = (*io)->entries; + int ios = 0; + uint64_t memory_usage = read_cgroup_memory(usage_in_bytes_path); + vector<int> io_extra; + + /* fill ios below max_io */ + while (idx < iovec.size()) { + if (iovec[idx].flag == IO_LOADED) { + idx++; + continue; + } + memory_usage += iovec[idx].len / 2; + if (memory_usage > memory_limit_bound) + break; + if (ios >= maio_strategy.max_io) { + io_extra.push_back(idx); + goto next_io; + } + entry[ios].seq = idx; + if (pathStr == iovec[idx].name) { + entry[ios].toff = iovec[idx].off; + entry[ios].tlen = iovec[idx].len; + entry[ios].tnuma = npu_numa_map[npuid]; + } else { + entry[ios].fpath = strdup(iovec[idx].name.c_str()); + entry[ios].toff = iovec[idx].off; + entry[ios].tlen = iovec[idx].len; + entry[ios].tnuma = npu_numa_map[iovec[idx].npu]; + } +next_io: + iovec[idx].flag = IO_LOADED; + idx++; + ios++; + } + + /* fill ios above max_io */ + if (ios > maio_strategy.max_io) { + new_io = (struct maio *)realloc(*io, sizeof(struct maio) + ios * sizeof(struct maio_entry)); + if (!new_io) { + printf("failed to alloc ios:%d maio\n", ios); + return -1; + } + *io = new_io; + entry = (*io)->entries; + for (int i = maio_strategy.max_io; i < ios; ++i) { + int io_idx = io_extra[i - maio_strategy.max_io]; + entry[i].seq = io_idx; + if (pathStr == iovec[io_idx].name) { + entry[i].toff = iovec[io_idx].off; + entry[i].tlen = iovec[io_idx].len; + entry[i].tnuma = npu_numa_map[npuid]; + } else { + entry[i].fpath = strdup(iovec[io_idx].name.c_str()); + entry[i].toff = iovec[io_idx].off; + entry[i].tlen = iovec[io_idx].len; + entry[i].tnuma = npu_numa_map[iovec[io_idx].npu]; + } + } + } + + // printf("file:%s off:%lu len:%lu generate_ios:%d from %d",path, (*io)->off, (*io)->len, ios, io_it->second); + ret = ios; + return ret; +} + +int strategy_evict(struct maio **io) +{ + string pathStr; + char *path; + path = fd_path_find((*io)->fd); + pathStr.assign(path); + ioKey key(pathStr, (*io)->off, (*io)->len, (*io)->pid); + auto io_it = io_to_index.lower_bound(key); + int dist = 0; + size_t i = 0, io_idx = io_it->second; + struct maio_entry *entry; + struct maio *new_io; + uint64_t evict_memory = 0; + uint64_t memory_usage = read_cgroup_memory(usage_in_bytes_path); + + if (memory_usage < (memory_limit_bound * 3 / 4)) + return 0; + dist = io_idx - evict_idx; + if (dist < 0) + return 0; + if (static_cast<size_t>(dist) < iovec.size() / 8 && io_it != io_to_index.end()) + return 0; + size_t evict_win = 0; + if (io_it != io_to_index.end()) { + evict_win = min(iovec.size() / 10, io_idx - 1); + } else { + evict_win = dist; + } + + new_io = (struct maio*)realloc(*io, sizeof(struct maio) + evict_win * sizeof(struct maio_entry)); + if (!new_io) + return -1; + *io = new_io; + entry = new_io->entries; + + for (i = 0; i < evict_win && evict_idx < iovec.size(); ++i) { + evict_memory += iovec[evict_idx].len; + if (evict_memory > memory_limit_bound / 8) + break; + entry[i].fpath = strdup(iovec[evict_idx].name.c_str()); + entry[i].toff = iovec[evict_idx].off; + entry[i].tlen = iovec[evict_idx].len; + evict_idx++; + iovec[evict_idx].flag = IO_EVICTED; + } + return i; +} + +const struct maio_operation maio_strategy = { + .max_io = 500, + .init = strategy_init, + .exit = strategy_exit, + .load = strategy_load, + .evict = strategy_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&maio_strategy; +} diff --git a/tools/mfs/maio-utils/test/strategy_template.h b/tools/mfs/maio-utils/test/strategy_template.h new file mode 100644 index 000000000000..c574d72e4a03 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_template.h @@ -0,0 +1,21 @@ +#ifndef STRATEGY_TEMPLATE_H +#define STRATEGY_TEMPLATE_H + +#ifdef __cplusplus +extern "C" { +#endif + +int strategy_init(void); +void strategy_exit(void); +int strategy_load(struct maio **io); +int strategy_evict(struct maio *io); + +extern const struct maio_operation maio_strategy; + +struct maio_operation *register_strategy(void); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/tools/mfs/maio-utils/test/strategy_toend.c b/tools/mfs/maio-utils/test/strategy_toend.c new file mode 100644 index 000000000000..56a068d450e5 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_toend.c @@ -0,0 +1,46 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include <stddef.h> + +int demo_init(void) +{ + return 0; +} + +void demo_exit(void) +{ +} + +int demo_load(struct maio **io) +{ + struct maio_entry *entry; + + entry = (*io)->entries; + entry[0].toff = (*io)->off + (*io)->len; + /* Read Ahead until the end */ + entry[0].tlen = 0; + entry[0].fpath = NULL; + entry[0].tnuma = -1; + return 1; +} + +int demo_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation demo_strategy = { + .max_io = 1, + .init = demo_init, + .exit = demo_exit, + .load = demo_load, + .evict = demo_evict, +}; + +struct maio_operation *register_strategy(void) +{ + return (struct maio_operation *)&demo_strategy; +} diff --git a/tools/mfs/maio-utils/test/trace_analyse.py b/tools/mfs/maio-utils/test/trace_analyse.py new file mode 100644 index 000000000000..c25d1ce364df --- /dev/null +++ b/tools/mfs/maio-utils/test/trace_analyse.py @@ -0,0 +1,87 @@ +def merge_intervals(intervals): + """ + 合并区间 + :param intervals: 区间列表，每个区间是一个元组 (start, end) + :return: 合并后的区间列表 + """ + if not intervals: + return [] + + # 按起始位置排序 + intervals.sort(key=lambda x: x[0]) + + merged = [intervals[0]] + for current in intervals[1:]: + last_merged = merged[-1] + if current[0] <= last_merged[1]: # 有重叠 + merged[-1] = (last_merged[0], max(last_merged[1], current[1])) + else: + merged.append(current) + + return merged + +def process_file(input_file): + """ + 处理输入文件 + :param input_file: 输入文件路径 + :return: 每个文件的合并区间和总大小 + """ + from collections import defaultdict + + # 使用字典按文件名分组 + file_intervals = defaultdict(list) + + with open(input_file, 'r') as f: + for line in f: + parts = line.strip().split() + if len(parts) < 3: + print(f"跳过无效行: {line.strip()}") + continue + + # 解析文件名、起始位置、大小 + filename, start, size = parts[:3] + start = int(start) + size = int(size) + + # 计算区间 + end = start + size + file_intervals[filename].append((start, end)) + + # 合并每个文件的区间 + merged_results = {} + for filename, intervals in file_intervals.items(): + merged_intervals = merge_intervals(intervals) + # 计算合并后的区间总大小 + total_size = sum(end - start for start, end in merged_intervals) + merged_results[filename] = { + "merged_intervals": merged_intervals, + "total_size": total_size + } + + return merged_results + +def main(): + import sys + + if len(sys.argv) != 2: + print("用法: python script.py <输入文件>") + sys.exit(1) + + input_file = sys.argv[1] + + merged_results = process_file(input_file) + + whole_result=0 + + for filename, result in merged_results.items(): + print(f"文件: {filename}") + # print("合并后的区间:") + # for interval in result["merged_intervals"]: + # print(f"起始位置: {interval[0]}, 结束位置: {interval[1]}") + print(f"所有区间内数据的总大小: {result['total_size']} 字节") + print("-" * 40) + whole_result+=result['total_size'] + print(f"所有文件内数据的总大小: {whole_result} 字节") + +if __name__ == "__main__": + main() diff --git a/tools/mfs/maio-utils/test/trace_gen.py b/tools/mfs/maio-utils/test/trace_gen.py new file mode 100644 index 000000000000..d050fa48801c --- /dev/null +++ b/tools/mfs/maio-utils/test/trace_gen.py @@ -0,0 +1,116 @@ +import argparse +import os +import sys + +FILENAME_IDX = 0 +OFF_IDX = 1 +LEN_IDX = 2 +NUMA_IDX = 3 +OFF_BOUND = 1024 * 1024 * 4096 + +class ReplayHintGenerator(object): + def __init__(self, trace_file, output_file): + self.output_file = output_file + self.trace_file = trace_file + self.data_list = [] + + def generate_hint(self): + with open(self.output_file, 'w') as f: + for data in self.data_list: + data_off = data[OFF_IDX] + data_len = data[LEN_IDX] + print(data_off) + step = (512 * 1024 * 1024) + while data_len: + if data_len < step: + step = data_len + print(f"{data[FILENAME_IDX]} {data_off} {step} {data[NUMA_IDX]}", file=f) + data_len-=step + data_off+=step + + def parse_trace(self): + file_map_index={} + with open(self.trace_file, 'r') as f: + for line in f: + parts = line.strip().split(' ') + + filename, off, length, numaid = parts + off = int(off) + length = int(length) + numaid = int(numaid) + if self.data_list: + tail_data = self.data_list[-1] + ''' + 首先尝试跟末尾的数据合并: + 如若跟末尾的数据是同一个文件跟numaid, + 两者之间的距离小于设定值, + 就进行合并 + ''' + if (tail_data[FILENAME_IDX] == filename and tail_data[NUMA_IDX] == numaid): + tail_off = tail_data[OFF_IDX] + tail_end = tail_data[OFF_IDX] + tail_data[LEN_IDX] + end = off + length + abs_off = max(abs(off - tail_end), abs(tail_off - end)) + if abs_off < OFF_BOUND: + tail_data[OFF_IDX] = min(tail_off, off) + tail_data[LEN_IDX] = max(tail_end, end) - tail_data[OFF_IDX] + continue + else: + ''' + 否则跟之前同一文件和numaid的数据进行合并 + 如若两者之间距离小于设定值， + 就进行合并 + ''' + key = (filename, numaid) + if key in file_map_index: + index = file_map_index[key] + data = self.data_list[index] + data_off = data[OFF_IDX] + data_end = data[OFF_IDX] + data[LEN_IDX] + end = off + length + abs_off = max(abs(off - data_end), abs(data_off - end)) + if abs_off < OFF_BOUND: + data[OFF_IDX] = min(data_off, off) + data[LEN_IDX] = max(data_end, end) - data[OFF_IDX] + continue + self.data_list.append([filename, off, length, numaid]) + file_map_index[(filename, numaid)] = len(self.data_list) - 1 + + +def main(agrv): + """ + Parse the argument + """ + parser = argparse.ArgumentParser('model trace parser') + parser.add_argument('--trace_file', + required=True, + type=str, + help='trace source') + parser.add_argument('--output_file', + required=True, + type=str, + help='output of hint file') + try: + args = parser.parse_args() + trace_file = args.trace_file + output_file = args.output_file + if not os.path.exists(trace_file): + print("{trace_file} not exist") + return -1 + + hint_generator=ReplayHintGenerator(trace_file, output_file) + hint_generator.parse_trace() + hint_generator.generate_hint() + return 0 + except Exception as e: + print(f"Parse model trace exception:{str(e)}") + return -1 + +if __name__ == '__main__': + try: + ret = main(sys.argv[1:]) + except Exception as main_e: + print(str(main_e)) + ret = -1 + sys.exit(ret) + -- 2.34.1

2 1

[PATCH OLK-6.6] mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb
by Jinjiang Tu 23 Mar '26

23 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8775 ---------------------------------------- When a file hugetlb folio triggers UCE, me_huge_page() will keep the hugetlb folio in pagcahe with refcount increased and PG_hwpoison set. Even after the hugetlb file is deleted, the hugetlb folio is still leaked. If we want to offline the memory block that the hwpoisoned hugetlb folio belongs to, it fails in dissolve_free_hugetlb_folios() due to the hwpoisoned hugetlb folio isn't free. I can reproduce this issue with the following steps in qemu: 1) echo offline >/sys/devices/system/memory/auto_online_blocks 2) in qemu monitor: object_add memory-backend-ram,id=mem10,size=1G device_add pc-dimm,id=dimm1,memdev=mem10,node=2 3) echo online_movable > /sys/devices/system/node/node2/memory136/state 4) echo 5 > /sys/devices/system/node/node2/hugepages/hugepages-2048kB/nr_hugepages 5) run ./hugetlb_file. This process will receive SIGBUS. 6) remove the hugetlbfs file. 7) echo offline > /sys/devices/system/node/node2/memory136/state hugetlb_file.c: fd = open("/dev/hugepages/my_hugepage_file", O_CREAT | O_RDWR, 0755); fallocate(fd, 0, 0, HUGEPAGE_SIZE * 2); addr = mmap(NULL, HUGEPAGE_SIZE * 2, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_HUGETLB, fd, 0); memset(addr, 0xaa, HUGEPAGE_SIZE * 2); madvise(addr, HUGEPAGE_SIZE, MADV_HWPOISON); To fix it, force to put ref of hwpoisoned hugetlb in memory offline, the hwpoisoned hugetlb will be freed and succeeds to be dissolved. We couldn't avoid races here, just like commit b023f46813cd ("memory-hotplug: skip HWPoisoned page when offlining pages"), which force to skip hwpoisoned page regardless of refcount. Fixes: 8625147cafaa ("hugetlbfs: don't delete error page from pagecache") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/hugetlb.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index d8fe41a77cd2..33dd9dcb186b 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -2480,6 +2480,7 @@ int dissolve_free_huge_page(struct page *page) */ int dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn) { + struct folio *folio; unsigned long pfn; struct page *page; int rc = 0; @@ -2495,6 +2496,16 @@ int dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn) for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << order) { page = pfn_to_page(pfn); + folio = page_folio(page); + + /* + * For hwpoisoned hugetlb, put the refcount increaed by + * memory-failure, make it succeed to dissolve. + */ + if (unlikely(folio_test_hwpoison(folio) && folio_test_hugetlb(folio) + && !READ_ONCE(folio->mapping) && (folio_ref_count(folio) == 1))) + folio_put(folio); + rc = dissolve_free_huge_page(page); if (rc) break; -- 2.43.0

2 1

[PATCH OLK-6.6] nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
by Zizhi Wo 21 Mar '26

21 Mar '26

From: Roberto Bergantinos Corpas <rbergant(a)redhat.com> stable inclusion from stable-v6.18.19 commit 203c792cb4315360d49973ae2e57feeb6d3dcf7e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8774 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 410666a298c34ebd57256fde6b24c96bd23059a2 ] If we found an alias through nfs3_do_create/nfs_add_or_obtain /d_splice_alias which happens to be a dir dentry, we don't return any error, and simply forget about this alias, but the original dentry we were adding and passed as parameter remains negative. This later causes an oops on nfs_atomic_open_v23/finish_open since we supply a negative dentry to do_dentry_open. This has been observed running lustre-racer, where dirs and files are created/removed concurrently with the same name and O_EXCL is not used to open files (frequent file redirection). While d_splice_alias typically returns a directory alias or NULL, we explicitly check d_is_dir() to ensure that we don't attempt to perform file operations (like finish_open) on a directory inode, which triggers the observed oops. Fixes: 7c6c5249f061 ("NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly.") Reviewed-by: Olga Kornievskaia <okorniev(a)redhat.com> Reviewed-by: Scott Mayhew <smayhew(a)redhat.com> Signed-off-by: Roberto Bergantinos Corpas <rbergant(a)redhat.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nfs/nfs3proc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c index d84016e5346e..09eed676cb66 100644 --- a/fs/nfs/nfs3proc.c +++ b/fs/nfs/nfs3proc.c @@ -393,8 +393,13 @@ nfs3_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr, if (status != 0) goto out_release_acls; - if (d_alias) + if (d_alias) { + if (d_is_dir(d_alias)) { + status = -EISDIR; + goto out_dput; + } dentry = d_alias; + } /* When we created the file with exclusive semantics, make * sure we set the attributes afterwards. */ -- 2.39.2

2 1

[PATCH OLK-5.10] nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
by Zizhi Wo 21 Mar '26

21 Mar '26

From: Roberto Bergantinos Corpas <rbergant(a)redhat.com> stable inclusion from stable-v6.18.19 commit 203c792cb4315360d49973ae2e57feeb6d3dcf7e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8774 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 410666a298c34ebd57256fde6b24c96bd23059a2 ] If we found an alias through nfs3_do_create/nfs_add_or_obtain /d_splice_alias which happens to be a dir dentry, we don't return any error, and simply forget about this alias, but the original dentry we were adding and passed as parameter remains negative. This later causes an oops on nfs_atomic_open_v23/finish_open since we supply a negative dentry to do_dentry_open. This has been observed running lustre-racer, where dirs and files are created/removed concurrently with the same name and O_EXCL is not used to open files (frequent file redirection). While d_splice_alias typically returns a directory alias or NULL, we explicitly check d_is_dir() to ensure that we don't attempt to perform file operations (like finish_open) on a directory inode, which triggers the observed oops. Fixes: 7c6c5249f061 ("NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly.") Reviewed-by: Olga Kornievskaia <okorniev(a)redhat.com> Reviewed-by: Scott Mayhew <smayhew(a)redhat.com> Signed-off-by: Roberto Bergantinos Corpas <rbergant(a)redhat.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nfs/nfs3proc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c index e1491def7124..2551e361a82f 100644 --- a/fs/nfs/nfs3proc.c +++ b/fs/nfs/nfs3proc.c @@ -369,8 +369,13 @@ nfs3_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr, if (status != 0) goto out_release_acls; - if (d_alias) + if (d_alias) { + if (d_is_dir(d_alias)) { + status = -EISDIR; + goto out_dput; + } dentry = d_alias; + } /* When we created the file with exclusive semantics, make * sure we set the attributes afterwards. */ -- 2.39.2

2 1

[PATCH] [Backport] nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
by Zizhi Wo 21 Mar '26

21 Mar '26

From: Roberto Bergantinos Corpas <rbergant(a)redhat.com> stable inclusion from stable-v6.18.19 commit 203c792cb4315360d49973ae2e57feeb6d3dcf7e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8774 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 410666a298c34ebd57256fde6b24c96bd23059a2 ] If we found an alias through nfs3_do_create/nfs_add_or_obtain /d_splice_alias which happens to be a dir dentry, we don't return any error, and simply forget about this alias, but the original dentry we were adding and passed as parameter remains negative. This later causes an oops on nfs_atomic_open_v23/finish_open since we supply a negative dentry to do_dentry_open. This has been observed running lustre-racer, where dirs and files are created/removed concurrently with the same name and O_EXCL is not used to open files (frequent file redirection). While d_splice_alias typically returns a directory alias or NULL, we explicitly check d_is_dir() to ensure that we don't attempt to perform file operations (like finish_open) on a directory inode, which triggers the observed oops. Fixes: 7c6c5249f061 ("NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly.") Reviewed-by: Olga Kornievskaia <okorniev(a)redhat.com> Reviewed-by: Scott Mayhew <smayhew(a)redhat.com> Signed-off-by: Roberto Bergantinos Corpas <rbergant(a)redhat.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nfs/nfs3proc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c index d84016e5346e..09eed676cb66 100644 --- a/fs/nfs/nfs3proc.c +++ b/fs/nfs/nfs3proc.c @@ -393,8 +393,13 @@ nfs3_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr, if (status != 0) goto out_release_acls; - if (d_alias) + if (d_alias) { + if (d_is_dir(d_alias)) { + status = -EISDIR; + goto out_dput; + } dentry = d_alias; + } /* When we created the file with exclusive semantics, make * sure we set the attributes afterwards. */ -- 2.39.2

1 0

[PATCH] [Backport] nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
by Zizhi Wo 21 Mar '26

21 Mar '26

From: Roberto Bergantinos Corpas <rbergant(a)redhat.com> stable inclusion from stable-v6.18.19 commit 203c792cb4315360d49973ae2e57feeb6d3dcf7e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8774 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 410666a298c34ebd57256fde6b24c96bd23059a2 ] If we found an alias through nfs3_do_create/nfs_add_or_obtain /d_splice_alias which happens to be a dir dentry, we don't return any error, and simply forget about this alias, but the original dentry we were adding and passed as parameter remains negative. This later causes an oops on nfs_atomic_open_v23/finish_open since we supply a negative dentry to do_dentry_open. This has been observed running lustre-racer, where dirs and files are created/removed concurrently with the same name and O_EXCL is not used to open files (frequent file redirection). While d_splice_alias typically returns a directory alias or NULL, we explicitly check d_is_dir() to ensure that we don't attempt to perform file operations (like finish_open) on a directory inode, which triggers the observed oops. Fixes: 7c6c5249f061 ("NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly.") Reviewed-by: Olga Kornievskaia <okorniev(a)redhat.com> Reviewed-by: Scott Mayhew <smayhew(a)redhat.com> Signed-off-by: Roberto Bergantinos Corpas <rbergant(a)redhat.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nfs/nfs3proc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c index d84016e5346e..09eed676cb66 100644 --- a/fs/nfs/nfs3proc.c +++ b/fs/nfs/nfs3proc.c @@ -393,8 +393,13 @@ nfs3_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr, if (status != 0) goto out_release_acls; - if (d_alias) + if (d_alias) { + if (d_is_dir(d_alias)) { + status = -EISDIR; + goto out_dput; + } dentry = d_alias; + } /* When we created the file with exclusive semantics, make * sure we set the attributes afterwards. */ -- 2.39.2

1 0

[PATCH openEuler-26.09 v2] tools: Add maio-utils tool
by Hongbo Li 20 Mar '26

20 Mar '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8613 -------------------------------- This is a userspace tool for MFS to provide: programmable strategy framework. Some basic strategies have added in test, and more flexible strategies can be written based on this framework. Signed-off-by: Hongbo Li <lihongbo22(a)huawei.com> --- tools/mfs/maio-utils/CMakeLists.txt | 101 ++++ tools/mfs/maio-utils/README.md | 17 + tools/mfs/maio-utils/build/build.sh | 91 +++ .../mfs/maio-utils/include/client/fs_client.h | 17 + tools/mfs/maio-utils/include/inner/inner.h | 37 ++ tools/mfs/maio-utils/include/loader/loader.h | 10 + tools/mfs/maio-utils/include/maio.h | 53 ++ .../maio-utils/include/parser/req_parser.h | 13 + tools/mfs/maio-utils/include/policy/policy.h | 17 + tools/mfs/maio-utils/include/uapi/mfs.h | 62 ++ tools/mfs/maio-utils/src/CMakeLists.txt | 42 ++ .../mfs/maio-utils/src/client/CMakeLists.txt | 17 + tools/mfs/maio-utils/src/client/fs_client.c | 359 ++++++++++++ .../mfs/maio-utils/src/loader/CMakeLists.txt | 18 + tools/mfs/maio-utils/src/loader/loader.c | 144 +++++ tools/mfs/maio-utils/src/main.c | 156 +++++ .../mfs/maio-utils/src/parser/CMakeLists.txt | 16 + tools/mfs/maio-utils/src/parser/req_parser.c | 313 ++++++++++ .../mfs/maio-utils/src/policy/CMakeLists.txt | 16 + tools/mfs/maio-utils/src/policy/policy.c | 114 ++++ tools/mfs/maio-utils/test/Makefile | 26 + tools/mfs/maio-utils/test/README.md | 61 ++ tools/mfs/maio-utils/test/strategy_demo.c | 45 ++ .../mfs/maio-utils/test/strategy_generate.cpp | 296 ++++++++++ .../mfs/maio-utils/test/strategy_prefetch.cpp | 151 +++++ tools/mfs/maio-utils/test/strategy_prefetch.h | 21 + tools/mfs/maio-utils/test/strategy_replay.cpp | 540 ++++++++++++++++++ tools/mfs/maio-utils/test/strategy_template.h | 21 + tools/mfs/maio-utils/test/strategy_toend.c | 46 ++ tools/mfs/maio-utils/test/trace_analyse.py | 87 +++ tools/mfs/maio-utils/test/trace_gen.py | 116 ++++ 31 files changed, 3023 insertions(+) create mode 100644 tools/mfs/maio-utils/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/README.md create mode 100644 tools/mfs/maio-utils/build/build.sh create mode 100644 tools/mfs/maio-utils/include/client/fs_client.h create mode 100644 tools/mfs/maio-utils/include/inner/inner.h create mode 100644 tools/mfs/maio-utils/include/loader/loader.h create mode 100644 tools/mfs/maio-utils/include/maio.h create mode 100644 tools/mfs/maio-utils/include/parser/req_parser.h create mode 100644 tools/mfs/maio-utils/include/policy/policy.h create mode 100644 tools/mfs/maio-utils/include/uapi/mfs.h create mode 100644 tools/mfs/maio-utils/src/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/client/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/client/fs_client.c create mode 100644 tools/mfs/maio-utils/src/loader/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/loader/loader.c create mode 100644 tools/mfs/maio-utils/src/main.c create mode 100644 tools/mfs/maio-utils/src/parser/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/parser/req_parser.c create mode 100644 tools/mfs/maio-utils/src/policy/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/policy/policy.c create mode 100644 tools/mfs/maio-utils/test/Makefile create mode 100644 tools/mfs/maio-utils/test/README.md create mode 100644 tools/mfs/maio-utils/test/strategy_demo.c create mode 100644 tools/mfs/maio-utils/test/strategy_generate.cpp create mode 100644 tools/mfs/maio-utils/test/strategy_prefetch.cpp create mode 100644 tools/mfs/maio-utils/test/strategy_prefetch.h create mode 100644 tools/mfs/maio-utils/test/strategy_replay.cpp create mode 100644 tools/mfs/maio-utils/test/strategy_template.h create mode 100644 tools/mfs/maio-utils/test/strategy_toend.c create mode 100644 tools/mfs/maio-utils/test/trace_analyse.py create mode 100644 tools/mfs/maio-utils/test/trace_gen.py diff --git a/tools/mfs/maio-utils/CMakeLists.txt b/tools/mfs/maio-utils/CMakeLists.txt new file mode 100644 index 000000000000..f710e6c15f79 --- /dev/null +++ b/tools/mfs/maio-utils/CMakeLists.txt @@ -0,0 +1,101 @@ +#******************************************************************************* +#******************************************************************************* + +cmake_minimum_required(VERSION 3.0) +cmake_policy(SET CMP0057 NEW) + +project(maio) + +#******************************************************************************* +#******************************************************************************* + +add_definitions(-D__LINUX_USR__) +add_definitions(-D__USE_GNU) +add_definitions(-D__POSIX_SOURCE) +add_definitions(-D_GNU_SOURCE) +add_definitions(-D_FILE_OFFSET_BITS=64) + +#******************************************************************************* +#******************************************************************************* + +include(TestBigEndian) + +TEST_BIG_ENDIAN(BIGENDIAN) + if (${BIGENDIAN}) + message(">>> Big Endian") + add_definitions(-D_CMAKE_BIGENDIAN) + else() + message(">>> Little Endian") + endif(${BIGENDIAN}) + +#******************************************************************************* +#******************************************************************************* + +EXECUTE_PROCESS(COMMAND uname -m COMMAND tr -d '\n' OUTPUT_VARIABLE ARCH) +if(${ARCH} STREQUAL "x86_64" OR ${ARCH} STREQUAL "aarch64") + message(STATUS "Architecture: ${ARCH}") +else() + message(STATUS "Invaild Architecture: ${ARCH}") + return() +endif() + +#******************************************************************************* +#******************************************************************************* + +set(BASE_FLAGS "-g -Wall -Werror -fno-strict-overflow -rdynamic") +set(SP_C_FLAGS "-std=gnu99") +set(SP_C++_FLAGS "-std=c++11") +set(SP_RELEASE_FLAGS "-O2") +set(SP_DEBUG_FLAGS "-O0") +set(SEC_REQ_FLAGS "-fstack-protector-all -fPIE -pie -fPIC -Wl,-z,relro,-z,now,-z,noexecstack") +set(SEC_SUG_BASE_FLAGS "-Wformat=2") +set(SEC_SUG_SP_C_FLAGS "-Wshadow") + +set(C_FLAGS "${BASE_FLAGS} ${SP_C_FLAGS}") +set(C++_FLAGS "${BASE_FLAGS} ${SP_C++_FLAGS}") +set(SEC_C_FLAGS "${SEC_REQ_FLAGS} ${SEC_SUG_BASE_FLAGS} ${SEC_SUG_SP_C_FLAGS}") +set(SEC_C++_FLAGS "${SEC_REQ_FLAGS} ${SEC_SUG_BASE_FLAGS}") +set(DEPC_FLAGS "-Wno-error=deprecated-declarations -Wno-deprecated-declarations") + +if(CMAKE_BUILD_TYPE MATCHES "Release") + message(">>> Release Mode") + set(CMAKE_C_FLAGS "${C_FLAGS} ${SP_RELEASE_FLAGS} ${SEC_C_FLAGS}") + set(CMAKE_CXX_FLAGS "${C++_FLAGS} ${SP_RELEASE_FLAGS} ${SEC_C++_FLAGS} ${DEPC_FLAGS}") +else() + message(">>> Debug Mode") + add_definitions(-D_DEBUG) + set(CMAKE_C_FLAGS "${C_FLAGS} ${SP_DEBUG_FLAGS} ${SEC_C_FLAGS}") + set(CMAKE_CXX_FLAGS "${C++_FLAGS} ${SP_DEBUG_FLAGS} ${SEC_C++_FLAGS} ${DEPC_FLAGS}") + set(COVERAGE_FLAGS "-coverage") + set(COVERAGE_LINK "gcov") +endif() + +message(STATUS ">>> Source Dir: " ${PROJECT_SOURCE_DIR}) +message(STATUS ">>> Binary Dir: " ${PROJECT_BINARY_DIR}) +message(STATUS ">>> C_FLAGS : " ${CMAKE_C_FLAGS}) +message(STATUS ">>> CXX_FLAGS : " ${CMAKE_CXX_FLAGS}) + +#******************************************************************************* +#******************************************************************************* + +set(EXECUTABLE_OUTPUT_PATH ${PROJECT_BINARY_DIR}/bin) + +#******************************************************************************* +#******************************************************************************* + +if(DEFINED THIRD_PARTY) + message(">>> third_party: ${THIRD_PARTY}") +else() + set(THIRD_PARTY ${PROJECT_SOURCE_DIR}/lib) +endif() + +set(INFRA_DIR ${PROJECT_SOURCE_DIR}/infrastructure) +set(SECUREC_DIR ${THIRD_PARTY}/securec) +set(ZLOG_DIR ${THIRD_PARTY}/zlog) +set(LIBNUMA_DIR ${THIRD_PARTY}/libnuma) + +#******************************************************************************* +#******************************************************************************* + +add_subdirectory(infrastructure) +add_subdirectory(src) diff --git a/tools/mfs/maio-utils/README.md b/tools/mfs/maio-utils/README.md new file mode 100644 index 000000000000..4c5a66a83c60 --- /dev/null +++ b/tools/mfs/maio-utils/README.md @@ -0,0 +1,17 @@ +# maio-utils + +#### How to build + +1. prepare thirdparty by using: +``` +git clone -b threadpool_bind https://github.com/hb-lee/infrastructure.git infrastructure +git clone -b 1.2.18 https://github.com/HardySimpson/zlog.git thirdparty/zlog +git clone https://github.com/chriszt/securec.git thirdparty/securec +git clone -b v2.0.19 https://github.com/numactl/numactl.git thirdparty/libnuma +``` +2. cd build +3. bash build.sh prepare # only once. +4. bash build.sh build + +#### How to run +Run with `./maio -m ${MNTPOINT}`, here ${MNTPOINT} means the mfs mount point. If you want to use some strategies, you can run with `./maio -m ${MNTPOINT} -s ${STRATEGYLIB}` where ${STRATEGYLIB} is your strategy library. Some examples are provided in `test` directory. diff --git a/tools/mfs/maio-utils/build/build.sh b/tools/mfs/maio-utils/build/build.sh new file mode 100644 index 000000000000..91b49d3d6bf8 --- /dev/null +++ b/tools/mfs/maio-utils/build/build.sh @@ -0,0 +1,91 @@ +#!/bin/bash + +LOCAL_PATH="$(readlink -e "$(dirname "$0")")" +PRJ_PATH="$(readlink -e "${LOCAL_PATH}/..")" +THIRD_SUB="${PRJ_PATH}/thirdparty" +Lib_PATH="${PRJ_PATH}/lib" + +ARCH=$(uname -m) + +function build_zlog() { + local zlog_dir=${THIRD_SUB}/zlog + local build_path=${zlog_dir}/build + mkdir ${build_path} + mkdir -p ${Lib_PATH}/zlog + cd ${zlog_dir} + make PREFIX=`pwd`/build/zlog + make PREFIX=`pwd`/build/zlog install + cp -rdp ${build_path}/zlog/include ${Lib_PATH}/zlog + cp -rdp ${build_path}/zlog/lib ${Lib_PATH}/zlog + cd - +} + +function build_securec() { + local securec_dir=${THIRD_SUB}/securec + local securec_lib=${securec_dir}/build/securec/lib + mkdir -p ${securec_lib} + mkdir -p ${Lib_PATH}/securec + cd ${securec_dir} + if [ "${ARCH}" = "aarch64" ]; then + make -f aarch64-so.mk + else + make -f x86-so.mk + fi + cp -rdp include build/securec + cp libsecurec.so build/securec/lib + cp -rdp build/securec/include ${Lib_PATH}/securec + cp -rdp build/securec/lib ${Lib_PATH}/securec + cd - +} + +function build_libnuma() { + local libnuma_dir=${THIRD_SUB}/libnuma + local build_path=${libnuma_dir}/build + mkdir ${build_path} + mkdir -p ${Lib_PATH}/libnuma + cd ${libnuma_dir} + ./autogen.sh + ./configure --prefix=`pwd`/build + make -j4 + make install + cp -rdp build/include ${Lib_PATH}/libnuma + cp -rdp build/lib ${Lib_PATH}/libnuma + cd - +} + +function prepare_thirdparty() { + build_jsoncpp + build_zlog + build_securec + build_libnuma +} + +function build_program() { + local BUILD_TYPE=$1 + + set -x + if [ "${BUILD_TYPE}" == "release" ]; then + cmake .. -DCMAKE_BUILD_TYPE=Release + else + cmake .. -DCMAKE_BUILD_TYPE=Debug + fi + set +x + + make clean + make VERBOSE=1 -j +} + +function main() { + local ACTION="$1" + local PARAMETER="$2" + + if [ "${ACTION}" == "prepare" ]; then + prepare_thirdparty + fi + if [ "$ACTION" == "build" ]; then + build_program $PARAMETER + fi +} + +main $@ +exit $? diff --git a/tools/mfs/maio-utils/include/client/fs_client.h b/tools/mfs/maio-utils/include/client/fs_client.h new file mode 100644 index 000000000000..803179ade14c --- /dev/null +++ b/tools/mfs/maio-utils/include/client/fs_client.h @@ -0,0 +1,17 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _FS_CLIENT_H_ +#define _FS_CLIENT_H_ + +#include <stdint.h> + +int fs_evict_by_path(const char*path, uint64_t off, uint64_t len); +int fs_load_by_path(const char *path, uint64_t off, uint64_t len); +int fs_load_by_fd(int fd, uint64_t off, uint64_t len); +int fs_sync_by_path(const char *path, void *buf, uint64_t off, uint64_t len); + +int fs_client_init(const char *source); +void fs_client_exit(); + +#endif diff --git a/tools/mfs/maio-utils/include/inner/inner.h b/tools/mfs/maio-utils/include/inner/inner.h new file mode 100644 index 000000000000..c10f40a3712c --- /dev/null +++ b/tools/mfs/maio-utils/include/inner/inner.h @@ -0,0 +1,37 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _INNER_H_ +#define _INNER_H_ + +#include <time.h> +#include <stdint.h> + +static inline uint64_t _get_ts() +{ + struct timespec now = {0}; + (void)clock_gettime(CLOCK_MONOTONIC_COARSE, &now); + return (uint64_t)now.tv_sec; +} + +/* io context for loader and writeback */ +struct io_context { + uint32_t id; /* msg id */ + uint64_t off; /* io offset in fd */ + uint64_t len; /* io length */ + uint16_t numaid; /* numa node of this io, -1 means non-bind */ + int fd; /* io file handle */ + char *path; /* fullpath of this io */ + void *buf; /* flighting buffer for writeback */ + + uint64_t seq; + + void *private; + void (*end_io)(int ret, void *private); +}; + +void loader_update_curseq(uint64_t seq); +int loader_evict_submit(struct io_context *ioctx); +int loader_io_submit(struct io_context *ioctx); + +#endif diff --git a/tools/mfs/maio-utils/include/loader/loader.h b/tools/mfs/maio-utils/include/loader/loader.h new file mode 100644 index 000000000000..ff280989f9f9 --- /dev/null +++ b/tools/mfs/maio-utils/include/loader/loader.h @@ -0,0 +1,10 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _LOADER_H_ +#define _LOADER_H_ + +int loader_init(); +void loader_exit(); + +#endif diff --git a/tools/mfs/maio-utils/include/maio.h b/tools/mfs/maio-utils/include/maio.h new file mode 100644 index 000000000000..a508d5b1fa27 --- /dev/null +++ b/tools/mfs/maio-utils/include/maio.h @@ -0,0 +1,53 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _MAIO_H_ +#define _MAIO_H_ + +#ifdef __cplusplus +extern "C" { +#endif + +#include <stdint.h> + +struct maio_entry { + char *fpath; + uint64_t toff; + uint64_t tlen; + uint8_t tnuma; + uint64_t seq; +}; + +struct maio { + /* IN */ + int fd; + uint64_t off; + uint64_t len; + int pid; + uint8_t op; + uint64_t ts; + uint32_t cksz; + + /* OUT */ + uint16_t flags; +#define MAIO_WITH_SEQ 0x0001 + uint64_t curseq; + struct maio_entry entries[]; +}; + +struct maio_operation { + int max_io; + int (*init) (void); + void (*exit) (void); + int (*load) (struct maio **io); + int (*evict) (struct maio **io); +}; + +char *_get_fullpath(char *fpath, int fd); +void maio_preload(struct maio *maio, int nio); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/tools/mfs/maio-utils/include/parser/req_parser.h b/tools/mfs/maio-utils/include/parser/req_parser.h new file mode 100644 index 000000000000..908e7297558a --- /dev/null +++ b/tools/mfs/maio-utils/include/parser/req_parser.h @@ -0,0 +1,13 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef __REQ_PARSER_H__ +#define __REQ_PARSER_H__ + +#include <stdint.h> + +int parser_init(uint32_t fs_mode, const char *mntpoint); +void parser_destory(); +int maio_parse_req(void *buf, int size); + +#endif diff --git a/tools/mfs/maio-utils/include/policy/policy.h b/tools/mfs/maio-utils/include/policy/policy.h new file mode 100644 index 000000000000..aef05c956b3b --- /dev/null +++ b/tools/mfs/maio-utils/include/policy/policy.h @@ -0,0 +1,17 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _POLICY_H_ +#define _POLICY_H_ + +#include "maio.h" + +int policy_max_io(); +int policy_load(struct maio **io); +int policy_evict(struct maio **io); +int policy_register(const char *path); +void policy_unregister(); +int policy_init(); +void policy_exit(); + +#endif diff --git a/tools/mfs/maio-utils/include/uapi/mfs.h b/tools/mfs/maio-utils/include/uapi/mfs.h new file mode 100644 index 000000000000..a7d5882b5e50 --- /dev/null +++ b/tools/mfs/maio-utils/include/uapi/mfs.h @@ -0,0 +1,62 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ + +#ifndef _UAPI_LINUX_MFS_H +#define _UAPI_LINUX_MFS_H + +#include <linux/types.h> +#include <linux/ioctl.h> + +enum mfs_opcode { + MFS_OP_READ = 0, + MFS_OP_FAULT, + MFS_OP_FAROUND, +}; + +enum { + MFS_MODE_NONE = 0, + MFS_MODE_LOCAL, + MFS_MODE_REMOTE, +}; + +struct mfs_ioc_ra { + __u64 off; + __u64 len; +}; + +struct mfs_ioc_done { + __u32 id; + __u32 ret; +}; + +struct mfs_ioc_rpath { + __u16 max; + __u16 len; + __u8 d[]; +}; + +#define MFS_IOC_RA _IOW(0xbc, 1, struct mfs_ioc_ra) +#define MFS_IOC_DONE _IOW(0xbc, 2, struct mfs_ioc_done) +#define MFS_IOC_RPATH _IOWR(0xbc, 3, struct mfs_ioc_rpath) + +struct mfs_ioc_fsinfo { + __u8 mode; /* 0: none, 1: local, 2: remote */ +}; + +#define MFS_IOC_FSINFO _IOR(0xbd, 1, struct mfs_ioc_fsinfo) + +struct mfs_msg { + __u8 version; + __u8 opcode; + __u16 len; + __u32 fd; + __u32 id; + __u8 data[]; +}; + +struct mfs_read { + __u64 off; + __u64 len; + __s32 pid; +}; + +#endif /* _UAPI_LINUX_MFS_H */ diff --git a/tools/mfs/maio-utils/src/CMakeLists.txt b/tools/mfs/maio-utils/src/CMakeLists.txt new file mode 100644 index 000000000000..fd053a8bd081 --- /dev/null +++ b/tools/mfs/maio-utils/src/CMakeLists.txt @@ -0,0 +1,42 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${PROJECT_SOURCE_DIR}/include) +include_directories(${PROJECT_SOURCE_DIR}/include/inner) +include_directories(${PROJECT_SOURCE_DIR}/include/uapi) +include_directories(${PROJECT_SOURCE_DIR}/include/client) +include_directories(${PROJECT_SOURCE_DIR}/include/loader) +include_directories(${PROJECT_SOURCE_DIR}/include/policy) +include_directories(${PROJECT_SOURCE_DIR}/include/monitor) +include_directories(${PROJECT_SOURCE_DIR}/include/parser) + +include_directories(${INFRA_DIR}/include) +include_directories(${SECUREC_DIR}/include) +include_directories(${ZLOG_DIR}/include) +include_directories(${LIBNUMA_DIR}/include) + +#******************************************************************************* +#******************************************************************************* + +link_directories(${PROJECT_BINARY_DIR}/lib) +link_directories(${SECUREC_DIR}/lib) +link_directories(${ZLOG_DIR}/lib) +link_directories(${LIBNUMA_DIR}/lib) + +#******************************************************************************* +#******************************************************************************* + +add_subdirectory(client) +add_subdirectory(loader) +add_subdirectory(policy) +add_subdirectory(parser) + +add_executable(maio-utils main.c) +target_link_libraries(maio-utils "-Wl,--whole-archive" + client + loader + policy + parser + "-Wl,--no-whole-archive" + infra + dl) diff --git a/tools/mfs/maio-utils/src/client/CMakeLists.txt b/tools/mfs/maio-utils/src/client/CMakeLists.txt new file mode 100644 index 000000000000..0fb67d64eb03 --- /dev/null +++ b/tools/mfs/maio-utils/src/client/CMakeLists.txt @@ -0,0 +1,17 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +#aux_source_directory(. CLIENT_SRC) +set(CLIENT_SRC fs_client.c) + +#******************************************************************************* +#******************************************************************************* + +add_library(client ${CLIENT_SRC}) +target_link_libraries(client infra + securec) diff --git a/tools/mfs/maio-utils/src/client/fs_client.c b/tools/mfs/maio-utils/src/client/fs_client.c new file mode 100644 index 000000000000..5d359b8f22e1 --- /dev/null +++ b/tools/mfs/maio-utils/src/client/fs_client.c @@ -0,0 +1,359 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "fs_client.h" +#include "mfs.h" +#include "inner.h" +#include "hashmap.h" +#include "hashfunc.h" +#include "stimer.h" +#include "atomic.h" +#include "log.h" +#include "list.h" +#include "spinlock.h" +#include "sysdef.h" +#include "securec.h" + +#include <fcntl.h> +#include <errno.h> +#include <string.h> +#include <unistd.h> +#include <sys/ioctl.h> + +#define TIMER_CYCLE 10000 /* 10s */ +#define FD_TMOUT 3600 /* 60s */ + +struct fs_client { + int rootfd; + hashmap_t *map; + stimer_t *timer; + list_head_t head; + spinlock_t lock; + uint64_t tmout; +}; + +struct fs_client g_client = {0}; + +typedef struct { + uint32_t plen; + char *path; +} fdkey_t; + +typedef struct { + fdkey_t key; + int fd; + int ref; + uint64_t ts; + list_head_t link; + hashlink_t hash; +} fd_t; + +static inline int fd_cmp(void *first, void *second) +{ + fdkey_t *key1 = (fdkey_t *)first; + fdkey_t *key2 = (fdkey_t *)second; + + if (key1->plen != key2->plen) + return -1; + + return strcmp(key1->path, key2->path); +} + +static inline uint32_t fd_hash(void *args) +{ + fdkey_t *key = (fdkey_t *)args; + uint64_t hash = hashstr(key->path, key->plen); + + return (uint32_t)hash; +} + +static inline void fd_inc(void *args, hashlink_t *link) +{ + fd_t *f = container_of(link, fd_t, hash); + int ref = atomic_s32_inc(&f->ref); + if (ref <= 0) { + log_error("fd(%d) for path(%s) with invalid ref(%d)", + f->fd, f->key.path, ref); + sys_assert(0); + } +} + +static inline int fd_dec(void *args, hashlink_t *link) +{ + fd_t *f = container_of(link, fd_t, hash); + int ref = atomic_s32_dec(&f->ref); + + if (ref < 0) { + log_error("fd(%d) for path(%s) with invalid ref(%d)", + f->fd, f->key.path, ref); + sys_assert(0); + } + /* update access timestamp for the last one */ + if (ref == 0) + f->ts = _get_ts(); + return -1; +} + +static inline int fd_expire(void *args, hashlink_t *link) +{ + fd_t *f = container_of(link, fd_t, hash); + int ref = atomic_s32_fetch(&f->ref); + uint64_t cur; + + if (ref > 0) + return -1; + if (ref < 0) { + log_error("fd(%d) for path(%s) with invalid ref(%d)", + f->fd, f->key.path, ref); + sys_assert(0); + } + cur = _get_ts(); + return ((cur - f->ts) >= g_client.tmout) ? 0: -1; +} + +static fd_t *fd_alloc(const char *path) +{ + fd_t *f = (fd_t *)malloc(sizeof(fd_t)); + if (!f) { + log_error("alloc fd_t fail"); + return NULL; + } + + f->key.path = strdup(path); + if (!f->key.path) { + log_error("strdup(%s) fail", path); + free(f); + return NULL; + } + + f->key.plen = strlen(path) + 1; + f->fd = -1; + f->ref = 1; + f->hash.key = &f->key; + list_init(&f->link); + return f; +} + +static void fd_free(fd_t *f) +{ + if (f->fd > 0) { + int ret = close(f->fd); + if (ret != 0) { + log_error("close(%d) fail, err(%s)", f->fd, strerror(errno)); + } + f->fd = -1; + } + + if (f->key.path) { + free(f->key.path); + f->key.path = NULL; + } + list_del(&f->link); + free(f); +} + +static int fd_fetch(const char *path, fd_t **f_res, int dirfd) +{ + fdkey_t key; + key.plen = strlen(path) + 1; + key.path = (char *)path; + + /* fd in cache */ + hashlink_t *data = NULL; + if (EEXIST == hashmap_search(g_client.map, &key, &data, NULL, fd_inc)) { + *f_res = container_of(data, fd_t, hash); + (*f_res)->ts = _get_ts(); + return 0; + } + + /* new fd */ + fd_t *f = fd_alloc(path); + if (!f) + return -ENOMEM; + + /* open file */ + if (dirfd > 0) + f->fd = openat(dirfd, path, O_RDONLY, S_IRUSR | S_IRGRP); + else + f->fd = open(path, O_RDONLY, S_IRUSR | S_IRGRP); + if (f->fd < 0) { + if (errno != ENOENT) + log_error("open(%d,%s) fail, err(%s)", dirfd, path, strerror(errno)); + fd_free(f); + return errno; + } + + /* add to fd cache */ + hashlink_t *old = NULL; + if (EEXIST == hashmap_insert(g_client.map, &f->hash, &old, NULL, fd_inc)) { + fd_free(f); + f = container_of(old, fd_t, hash); + } + + spinlock_lock(&g_client.lock); + list_add_tail(&f->link, &g_client.head); + spinlock_unlock(&g_client.lock); + f->ts = _get_ts(); + *f_res = f; + return 0; +} + +static inline void fd_restore(fd_t *f) +{ + (void)hashmap_protect(g_client.map, &f->key, NULL, fd_dec); +} + +static void _fd_gc(void *args) +{ + list_head_t head, *curr, *next; + hashlink_t *data = NULL; + + list_init(&head); + spinlock_lock(&g_client.lock); + list_splice(&g_client.head, &head); + spinlock_unlock(&g_client.lock); + + list_foreach_safe(curr, next, &head) + { + fd_t *f = container_of(curr, fd_t, link); + if (atomic_s32_fetch(&f->ref) != 0) + continue; + /* try to destroy */ + if (0 != hashmap_delete(g_client.map, &f->key, &data, NULL, fd_expire)) + continue; + list_del(&f->link); + log_info("path:%s with fd:%d is expire.", f->key.path, f->fd); + fd_free(f); + } + + spinlock_lock(&g_client.lock); + list_splice(&head, &g_client.head); + spinlock_unlock(&g_client.lock); +} + +int fs_evict_by_path(const char*path, uint64_t off, uint64_t len) +{ + int ret; + fd_t *f; + uint64_t step = 4096 * 4; + + ret = fd_fetch(path, &f, 0); + if (ret) + return ret; + + while (len) { + if (step > len) + step = len; + ret = posix_fadvise(f->fd, off, len, POSIX_FADV_DONTNEED); + if (ret < 0) + break; + len -= step; + off += step; + } + + fd_restore(f); + return ret; +} + +int fs_load_by_path(const char *path, uint64_t off, uint64_t len) +{ + int ret; + fd_t *f; + uint64_t step = 16 * 4096; + char *buf = NULL; + + ret = fd_fetch(path, &f, 0); + if (ret) + return ret; + + buf = (char *)malloc(step); + + while (len) { + if (step > len) + step = len; + ret = pread(f->fd, buf, step, off); + if (ret <= 0) + break; + len -= step; + off += step; + } + free(buf); + fd_restore(f); + return ret; +} + +int fs_load_by_fd(int fd, uint64_t off, uint64_t len) +{ + struct mfs_ioc_ra ra; + + ra.off = off; + ra.len = len; + return ioctl(fd, MFS_IOC_RA, &ra); +} + +int fs_sync_by_path(const char *path, void *buf, uint64_t off, uint64_t len) +{ + ssize_t rsize = 0, ret; + uint64_t pos = 0; + fd_t *f; + + ret = fd_fetch(path + 1, &f, g_client.rootfd); + if (ret) + return ret; + + do { + ret = pread(f->fd, buf + pos, len - pos, off + pos); + if (ret == 0) + break; + if (ret < 0) { + log_error("failed to read:%s", strerror(errno)); + fd_restore(f); + return -1; + } + pos += ret; + rsize += ret; + } while (rsize < len); + fd_restore(f); + return 0; +} + +int fs_client_init(const char *source) +{ + int ret; + + g_client.rootfd = -1; + if (source) { + g_client.rootfd = open(source, O_RDONLY | O_DIRECTORY); + if (g_client.rootfd <= 0) { + log_error("open %s failed", source); + return -1; + } + } + ret = hashmap_create(1024, fd_cmp, fd_hash, &g_client.map); + if (ret) { + log_error("client fd map alloc failed"); + close(g_client.rootfd); + return ret; + } + + g_client.timer = stimer_create("LfsGc", TIMER_CYCLE, NULL, _fd_gc); + if (!g_client.timer) { + log_error("timer create failed"); + hashmap_destroy(g_client.map, NULL, NULL); + close(g_client.rootfd); + return -1; + } + list_init(&g_client.head); + spinlock_init(&g_client.lock); + g_client.tmout = FD_TMOUT; + return 0; +} + +void fs_client_exit() +{ + spinlock_destroy(&g_client.lock); + stimer_destroy(g_client.timer); + hashmap_destroy(g_client.map, NULL, NULL); + close(g_client.rootfd); +} + diff --git a/tools/mfs/maio-utils/src/loader/CMakeLists.txt b/tools/mfs/maio-utils/src/loader/CMakeLists.txt new file mode 100644 index 000000000000..08e1b637be26 --- /dev/null +++ b/tools/mfs/maio-utils/src/loader/CMakeLists.txt @@ -0,0 +1,18 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +aux_source_directory(. LOADER_SRC) + +#******************************************************************************* +#******************************************************************************* + +add_library(loader ${LOADER_SRC}) +target_link_libraries(loader infra + numa + securec) + diff --git a/tools/mfs/maio-utils/src/loader/loader.c b/tools/mfs/maio-utils/src/loader/loader.c new file mode 100644 index 000000000000..61c5302204fc --- /dev/null +++ b/tools/mfs/maio-utils/src/loader/loader.c @@ -0,0 +1,144 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "loader.h" + +#include "fs_client.h" +#include "threadpool.h" +#include "log.h" +#include "atomic.h" +#include "inner.h" +#include "sysdef.h" + +#include "securec.h" +#include "numa.h" +#include <errno.h> + +struct loader_mgr { + int numa_num; + threadpool_t **numa_thp; + uint64_t curseq; +}; + +struct loader_mgr g_local_mgr; + +static threadpool_t *choose_worker_pool(struct io_context *ioctx) +{ + static uint64_t cid = 0; + int nid; + + if (ioctx->numaid == (uint16_t)-1) + nid = cid++ % g_local_mgr.numa_num; + else + nid = ioctx->numaid % g_local_mgr.numa_num; + return g_local_mgr.numa_thp[nid]; +} + +static void handle_io(void *args) +{ + struct io_context *ioctx = (struct io_context *)args; + int ret; + + if (g_local_mgr.curseq > ioctx->seq) { + if (ioctx->end_io) + ioctx->end_io(0, ioctx->private); + return; + } + ret = ioctx->path ? fs_load_by_path(ioctx->path, ioctx->off, ioctx->len) + : fs_load_by_fd(ioctx->fd, ioctx->off, ioctx->len); + if (ioctx->end_io) + ioctx->end_io(ret, ioctx->private); +} + +int loader_io_submit(struct io_context *ioctx) +{ + threadpool_t *worker_pools = choose_worker_pool(ioctx); + + threadpool_submit(worker_pools, ioctx, handle_io); + return 0; +} + +void loader_update_curseq(uint64_t seq) +{ + uint64_t curseq = atomic_u64_fetch(&g_local_mgr.curseq); + uint64_t old; + + while (seq > curseq) { + if (atomic_u64_cas(&g_local_mgr.curseq, curseq, seq, &old)) + break; + curseq = old; + } +} + +static void handle_evict(void *args) +{ + struct io_context *ioctx = (struct io_context *)args; + int ret; + + ret = ioctx->path ? fs_evict_by_path(ioctx->path, ioctx->off, ioctx->len) : 0; + if (ioctx->end_io) + ioctx->end_io(ret, ioctx->private); +} + +int loader_evict_submit(struct io_context *ioctx) +{ + threadpool_t *worker_pools = choose_worker_pool(ioctx); + + threadpool_submit(worker_pools, ioctx, handle_evict); + return 0; +} + +static void _free_loader() +{ + int i; + + if (!g_local_mgr.numa_thp) + return; + + for (i = 0; i < g_local_mgr.numa_num; i++) + threadpool_destroy(g_local_mgr.numa_thp[i]); + free(g_local_mgr.numa_thp); + g_local_mgr.numa_thp = NULL; +} + +int loader_init() +{ + int i, ret, wnum = 8; + char name[THD_NAME + 1] = {0}; + + if (numa_available() < 0) { + log_error("Current system does not support NUAM api"); + return -1; + } + + g_local_mgr.numa_num = numa_max_node() + 1; + g_local_mgr.curseq = 0; + ret = 0; + do { + g_local_mgr.numa_thp = + calloc(g_local_mgr.numa_num, sizeof(threadpool_t *)); + if (!g_local_mgr.numa_thp) { + log_error("alloc for numa threadpool failed"); + ret = -1; + break; + } + for (i = 0; i < g_local_mgr.numa_num; i++) { + sprintf_s(name, sizeof(name), "Loader-%d", i); + g_local_mgr.numa_thp[i] = threadpool_create(name, wnum, i); + if (!g_local_mgr.numa_thp[i]) { + log_error("alloc Loader-%d failed", i); + ret = -1; + break; + } + } + } while (0); + + if (ret != 0) + _free_loader(); + return ret; +} + +void loader_exit() +{ + _free_loader(); +} diff --git a/tools/mfs/maio-utils/src/main.c b/tools/mfs/maio-utils/src/main.c new file mode 100644 index 000000000000..854c5b298521 --- /dev/null +++ b/tools/mfs/maio-utils/src/main.c @@ -0,0 +1,156 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include <stdlib.h> +#include <unistd.h> +#include <string.h> +#include <getopt.h> +#include <errno.h> +#include <fcntl.h> +#include <poll.h> + +#include "loader.h" +#include "log.h" +#include "maio.h" +#include "policy.h" +#include "req_parser.h" +#include "fs_client.h" +#include "mfs.h" +#include "securec.h" + +#include <sys/ioctl.h> +#include <sys/statfs.h> + +#define MAX_BUF_SIZE 1024 +#define MFS_SUPER_MAGIC 0x85428370 + +static int read_req(int fd) +{ + char *buf; + int ret; + + buf = calloc(MAX_BUF_SIZE, sizeof(char)); + if (!buf) { + log_error("failed to alloc buf\n"); + return -1; + } + ret = read(fd, buf, MAX_BUF_SIZE); + if (ret <= 0) { + if (ret < 0) + log_error("failed to read, ret:%d\n", ret); + return -1; + } + return maio_parse_req(buf, ret); +} + +static void dev_monitor(int dfd) +{ + struct pollfd pfd; + int ret; + + pfd.fd = dfd; + pfd.events = POLLIN; + while (1) { + ret = poll(&pfd, 1, -1); + if (ret < 0) { + log_error("poll failed\n"); + return; + } + if (ret == 0 || !(pfd.revents & POLLIN)) { + log_error("poll events error, ret:%d, revents:%x\n", ret, pfd.revents); + continue; + } + while(!read_req(pfd.fd)) {} + } +} + +int main(int argc, char *argv[]) +{ + const char *mntpoint = NULL, *strategylib = NULL; + struct mfs_ioc_fsinfo fsinfo = {0}; + int dfd, ret, opt; + struct statfs buf; + char devname[10]; + + while ((opt = getopt(argc, argv, "m:s:")) != -1) { + switch (opt) { + case 'm': + mntpoint = optarg; + break; + case 's': + strategylib = optarg; + break; + default: + fprintf(stderr, "Usage: %s -m ${mnt} [-s ${strategylib}]\n", argv[0]); + return -EINVAL; + } + } + if (!mntpoint) { + fprintf(stderr, "mount point should specify\n"); + fprintf(stderr, "Usage: %s -m ${mnt} [-s ${strategylib}]\n", argv[0]); + return -1; + } + + ret = statfs(mntpoint, &buf); + if (ret) { + log_error("statfs %s failed, errstr:%s\n", mntpoint, strerror(errno)); + return -1; + } + if (buf.f_type != MFS_SUPER_MAGIC) { + log_error("fstype(%x) is invalid, please check the mountpoint", buf.f_type); + return -1; + } + + sprintf_s(devname, sizeof(devname), "/dev/mfs%ld", buf.f_spare[0]); + /* Open with O_CLOEXEC to avoid potential fd leaks */ + dfd = open(devname, O_RDWR | O_CLOEXEC); + if (dfd < 0) { + log_error("open %s failed errstr:%s\n", devname, strerror(errno)); + return -1; + } + + ret = ioctl(dfd, MFS_IOC_FSINFO, (unsigned long)&fsinfo); + if (ret < 0) { + log_error("ioctl get fsinfo failed, ret:%d\n", ret); + goto close_fd; + } + if (fsinfo.mode != 1) { + log_error("fs runing mode(%d) is not supported", fsinfo.mode); + goto close_fd; + } + ret = loader_init(); + if (ret) { + log_error("loader init failed"); + goto close_fd; + } + ret = fs_client_init(NULL); + if (ret) { + log_error("clients init failed"); + goto free_loader; + } + ret = parser_init(fsinfo.mode, mntpoint); + if (ret) { + log_error("parser init failed"); + goto free_client; + } + ret = policy_init(); + if (ret) { + log_error("policy init failed"); + goto free_parser; + } + ret = policy_register(strategylib); + if (ret) { + log_info("register new policy failed, use default policy"); + } + + dev_monitor(dfd); +free_parser: + parser_destory(); +free_client: + fs_client_exit(); +free_loader: + loader_exit(); +close_fd: + close(dfd); + return ret; +} diff --git a/tools/mfs/maio-utils/src/parser/CMakeLists.txt b/tools/mfs/maio-utils/src/parser/CMakeLists.txt new file mode 100644 index 000000000000..72e5849da8e4 --- /dev/null +++ b/tools/mfs/maio-utils/src/parser/CMakeLists.txt @@ -0,0 +1,16 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +aux_source_directory(. PARSER_SRC) + +#******************************************************************************* +#******************************************************************************* + +add_library(parser ${PARSER_SRC}) +target_link_libraries(parser infra + securec) diff --git a/tools/mfs/maio-utils/src/parser/req_parser.c b/tools/mfs/maio-utils/src/parser/req_parser.c new file mode 100644 index 000000000000..83a975276bc2 --- /dev/null +++ b/tools/mfs/maio-utils/src/parser/req_parser.c @@ -0,0 +1,313 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ + +#include "inner.h" +#include "log.h" +#include "mfs.h" +#include "policy.h" +#include "securec.h" +#include "threadpool.h" + +#include <stdbool.h> +#include <errno.h> +#include <sys/ioctl.h> +#include <sys/stat.h> + +struct parser_mgr { + uint32_t fs_mode; + uint32_t chunk_size; + const char *mntpoint; + threadpool_t *parser; +}; + +struct parser_mgr g_parser_mgr; + +#define PARSER_NUM 8 +#define MAX_PATH_SIZE 1024 + +#define __round_mask(x, y) ((__typeof__(x))((y)-1)) +#define round_up(x, y) ((((x)-1) | __round_mask(x, y))+1) +#define round_down(x, y) ((x) & ~__round_mask(x, y)) + +#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) +#define MIN(x, y) ((x) < (y) ? (x) : (y)) + +bool is_power_of_2(unsigned long n) +{ + return (n != 0 && ((n & (n - 1)) == 0)); +} + +void ctx_cb(int ret, void *args) +{ + struct io_context *ctx = (struct io_context *)args; + + if (ctx->path) + free(ctx->path); + if (ctx->buf) + free(ctx->buf); + free(ctx); +} + +void _submit_local_io(int fd, struct maio_entry *entry) +{ + struct io_context *ioctx; + + ioctx = calloc(1, sizeof(struct io_context)); + if (!ioctx) { + log_error("ioctx alloc failed"); + return; + } + ioctx->off = entry->toff; + ioctx->len = entry->tlen; + ioctx->numaid = entry->tnuma; + ioctx->fd = fd; + ioctx->path = entry->fpath; + ioctx->seq = entry->seq; + ioctx->private = ioctx; + ioctx->end_io = ctx_cb; + loader_io_submit(ioctx); +} + +char *get_file_path(int fd) +{ + struct mfs_ioc_rpath *rp; + char *path; + int ret; + + rp = malloc(sizeof(struct mfs_ioc_rpath) + MAX_PATH_SIZE); + if (!rp) { + log_error("rpath alloc failed"); + return NULL; + } + rp->max = MAX_PATH_SIZE; + ret = ioctl(fd, MFS_IOC_RPATH, (unsigned long)rp); + if (ret) { + log_error("realpath failed for fd:%d, ret:%d", fd, ret); + free(rp); + return NULL; + } + rp->d[rp->len] = '\0'; + + path = malloc(strlen(g_parser_mgr.mntpoint) + rp->len); + if (!path) { + log_error("malloc path %s %s failed", g_parser_mgr.mntpoint, (const char *)rp->d); + return NULL; + } + sprintf(path, "%s%s", g_parser_mgr.mntpoint, (const char *)rp->d); + free(rp); + return path; +} + +char *_get_fullpath(char *fpath, int fd) +{ + struct mfs_ioc_rpath *rp; + char *path; + int ret; + + if (fpath) + return fpath; + rp = malloc(sizeof(struct mfs_ioc_rpath) + MAX_PATH_SIZE); + if (!rp) { + log_error("rpath alloc failed"); + return NULL; + } + rp->max = MAX_PATH_SIZE; + ret = ioctl(fd, MFS_IOC_RPATH, (unsigned long)rp); + if (ret) { + log_error("realpath failed for fd:%d, ret:%d", fd, ret); + free(rp); + return NULL; + } + rp->d[rp->len] = '\0'; + path = strdup((const char *)rp->d); + if (!path) + log_error("strdup path(%s) failed", (const char *)rp->d); + free(rp); + return path; +} + +void maio_preload(struct maio *maio, int nio) +{ + struct maio_entry *entry; + + for (int i = 0; i < nio; ++i) { + entry = &maio->entries[i]; + _submit_local_io(0, entry); + } +} + +uint8_t pid_to_numaid(int pid) +{ + return (uint8_t)-1; +} + +void _process_read_io(uint32_t id, struct maio *maio, int nio) +{ + struct maio_entry *entry; + int i; + + /* process the successor io */ + for (i = 0; i < nio; i++) { + entry = &maio->entries[i]; + _submit_local_io(maio->fd, entry); + } +} + +void _submit_evict(struct maio_entry *entry) +{ + struct io_context *ioctx; + + ioctx = calloc(1, sizeof(struct io_context)); + if (!ioctx) { + log_error("ioctx alloc failed"); + return; + } + ioctx->off = entry->toff; + ioctx->len = entry->tlen; + ioctx->numaid = -1; + ioctx->path = entry->fpath; + ioctx->private = ioctx; + ioctx->end_io = ctx_cb; + loader_evict_submit(ioctx); +} + +void _process_evict(struct mfs_msg *msg) +{ + struct maio_entry *entry; + struct mfs_read *read; + uint64_t soff, eoff; + struct maio *maio; + int ret; + + if (g_parser_mgr.fs_mode != MFS_MODE_LOCAL) + return; + + maio = calloc(1, sizeof(struct maio)); + if (!maio) { + log_error("failed to alloc maio"); + return; + } + + read = (void*)msg->data; + maio->cksz = g_parser_mgr.chunk_size; + soff = round_down(read->off, maio->cksz); + eoff = round_up(read->off + read->len, maio->cksz); + maio->fd = msg->fd; + maio->off = read->off; + maio->len = eoff - soff; + maio->pid = read->pid; + maio->op = msg->opcode; + + ret = policy_evict(&maio); + if (ret <= 0) + goto out; + + for (int i = 0; i < ret; ++i) { + entry = &maio->entries[i]; + _submit_evict(entry); + } +out: + free(maio); +} + +void _parse_read_req(struct mfs_msg *msg) +{ + struct mfs_read *read; + struct maio *maio; + uint64_t soff, eoff, ts; + int ret, io_num = policy_max_io(); + + _process_evict(msg); + + /* alloc maio slots */ + maio = calloc(1, sizeof(struct maio) + io_num * sizeof(struct maio_entry)); + if (!maio) { + log_error("failed to alloc maio, num:%d", io_num); + return; + } + read = (void *)msg->data; + maio->cksz = g_parser_mgr.chunk_size; + soff = round_down(read->off, maio->cksz); + eoff = round_up(read->off + read->len, maio->cksz); + ts = _get_ts(); + maio->fd = msg->fd; + maio->off = soff; + maio->len = eoff - soff; + maio->pid = read->pid; + maio->op = msg->opcode; + maio->ts = ts; + + /* fill slots from policy */ + ret = policy_load(&maio); + if (ret < 0) { + char *path = _get_fullpath(NULL, maio->fd); + if (path) { + log_warn("io on path:%s%s offset:%lu length:%lu dropped", + g_parser_mgr.mntpoint, path, read->off, read->len); + free(path); + } + free(maio); + return; + } + + if (maio->flags & MAIO_WITH_SEQ) + loader_update_curseq(maio->curseq); + + /* keep the input parameter */ + maio->fd = msg->fd; + maio->off = soff; + maio->len = eoff - soff; + maio->cksz = g_parser_mgr.chunk_size; + maio->pid = read->pid; + maio->op = msg->opcode; + maio->ts = ts; + + /* process each maio in slots */ + _process_read_io(msg->id, maio, ret); + free(maio); +} + +void _parse_one_req(void *buf) +{ + struct mfs_msg *msg = (struct mfs_msg *)buf; + + if (msg->opcode == MFS_OP_READ || msg->opcode == MFS_OP_FAULT) + _parse_read_req(msg); + + free(buf); +} + +int maio_parse_req(void *buf, int size) +{ + struct mfs_msg *msg = (struct mfs_msg *)buf; + + if (msg->len != size) + return -1; + + threadpool_submit(g_parser_mgr.parser, buf, _parse_one_req); + return 0; +} + +int parser_init(uint32_t fs_mode, const char *mntpoint) +{ + g_parser_mgr.fs_mode = fs_mode; + g_parser_mgr.mntpoint = strdup(mntpoint); + g_parser_mgr.chunk_size = 4096; + if (!is_power_of_2(g_parser_mgr.chunk_size)) { + log_error("chunk size must be power of 2"); + return -1; + } + g_parser_mgr.parser = threadpool_create("ReqParser", PARSER_NUM, -1); + if (!g_parser_mgr.parser) { + log_error("failed to alloc parser threadpool"); + return -1; + } + + return 0; +} + +void parser_destory() +{ + threadpool_destroy(g_parser_mgr.parser); +} diff --git a/tools/mfs/maio-utils/src/policy/CMakeLists.txt b/tools/mfs/maio-utils/src/policy/CMakeLists.txt new file mode 100644 index 000000000000..714023475e07 --- /dev/null +++ b/tools/mfs/maio-utils/src/policy/CMakeLists.txt @@ -0,0 +1,16 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +aux_source_directory(. POLICY_SRC) + +#******************************************************************************* +#******************************************************************************* + +add_library(policy ${POLICY_SRC}) +target_link_libraries(policy infra + securec) diff --git a/tools/mfs/maio-utils/src/policy/policy.c b/tools/mfs/maio-utils/src/policy/policy.c new file mode 100644 index 000000000000..404358ff9b46 --- /dev/null +++ b/tools/mfs/maio-utils/src/policy/policy.c @@ -0,0 +1,114 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "policy.h" + +#include "maio.h" +#include "log.h" +#include "securec.h" +#include <dlfcn.h> + +typedef struct maio_operation* (*strategy_init)(); + +struct policy_mgr { + void *handle; + struct maio_operation *strategy; +}; + +struct policy_mgr g_policy; + +static int default_init(void) +{ + return 0; +} + +static void default_exit(void) +{ +} + +static int default_load(struct maio **io) +{ + return 0; +} + +static int default_evict(struct maio **io) +{ + return 0; +} + +struct maio_operation default_ops = { + .max_io = 1, + .init = default_init, + .exit = default_exit, + .load = default_load, + .evict = default_evict, +}; + +static void set_default_strategy() +{ + g_policy.strategy = &default_ops; +} + +int policy_max_io(void) +{ + return g_policy.strategy->max_io; +} + +/* return the filled num of io */ +int policy_load(struct maio **io) +{ + return g_policy.strategy->load(io); +} + +int policy_evict(struct maio **io) +{ + return g_policy.strategy->evict(io); +} + +int policy_register(const char *path) +{ + strategy_init sinit; + + if (!path || strlen(path) == 0) + return -1; + + g_policy.handle = dlopen(path, RTLD_LAZY); + if (!g_policy.handle) { + log_error("dlopen failed:%s", dlerror()); + return -1; + } + + sinit = dlsym(g_policy.handle, "register_strategy"); + if (!sinit) { + log_error("dlsym failed:%s", dlerror()); + dlclose(g_policy.handle); + g_policy.handle = NULL; + return -1; + } + g_policy.strategy = sinit(); + if (g_policy.strategy->init()) + return -1; + log_info("register strategy:%s done.", path); + return 0; +} + +void policy_unregister() +{ + if (g_policy.handle) { + g_policy.strategy->exit(); + dlclose(g_policy.handle); + g_policy.handle = NULL; + } + set_default_strategy(); +} + +int policy_init() +{ + g_policy.handle = NULL; + set_default_strategy(); + return 0; +} + +void policy_exit() +{ +} diff --git a/tools/mfs/maio-utils/test/Makefile b/tools/mfs/maio-utils/test/Makefile new file mode 100644 index 000000000000..404d9cf3d9a4 --- /dev/null +++ b/tools/mfs/maio-utils/test/Makefile @@ -0,0 +1,26 @@ +# SPDX-License-Identifier: GPL-2.0 + +CC := gcc +CFLAGS := -fPIC -Wall -Werror -O2 +CPPFLAGS := -fPIC -Wall -Wno-ignored-attributes -Werror -O2 -std=c++11 -g +LDFLAGS := -shared + +CFLAGS += $(addprefix -I,../include) +CPPFLAGS += $(addprefix -I,../include) + +C_SRCS := $(wildcard *.c) +CPP_SRCS := $(wildcard *.cpp) +TARGETS := $(C_SRCS:.c=.so) $(CPP_SRCS:.cpp=.so) + +all: $(TARGETS) + +%.so: %.c + $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $< + +%.so: %.cpp + $(CC) $(CPPFLAGS) $(LDFLAGS) -o $@ $< + +clean: + rm -f $(TARGETS) + +.PHONY: all clean diff --git a/tools/mfs/maio-utils/test/README.md b/tools/mfs/maio-utils/test/README.md new file mode 100644 index 000000000000..245fc622c075 --- /dev/null +++ b/tools/mfs/maio-utils/test/README.md @@ -0,0 +1,61 @@ +Here, we provide some strategies library for some cases. + +- strategy_demo +A simple strategy library shows how to write a demo. + +- strategy_prefetch +A prefetch strategy library to prefetch data. + +- strategy_toend +A readahead strategy until the end. + +- strategy_generate +A tools using maio-util to generate the io trace. + +- strategy_replay +A strategy to replay the io trace. + +### How to build + +Using `make -j` to build the libraries. + +### How to use + +Set the library path as the `-s` parameter's value to run with maio-utils. Here we show usage of the advanced replay strategy: + +- generate the io trace + +> assume you have mounted the mfs at /mnt/mfs, and you are in build directory. + +This is the tracing period. + +``` +export MAIO_TRACE_FILE=trace.txt +export MAIO_MNTPOINT=/mnt/mfs # /mnt/mfs is the MFS mountpoint +./bin/maio-utils -m /mnt/mfs -s ../test/strategy_generate.so +``` +Then, you can trigger the io. After finishing, you would get the trace file with the content likes: + +``` +xxx/model-00001-of-000008.safetensors 0 32768 0 +xxx/model-00001-of-000008.safetensors 32768 32768 0 +xxx/model-00001-of-000008.safetensors 65536 32768 0 +xxx/model-00001-of-000008.safetensors 98304 32768 0 +xxx/model-00001-of-000008.safetensors 131072 32768 0 +... + +``` + +The format is "<path> <offset> <length> <numaid>". + +- replay the io trace + +> assume you have mounted the mfs at /mnt/mfs and begin to launch the model. + +This is the running period. + +``` +export MAIO_TRACE_FILE=trace.txt +export MAIO_MNTPOINT=/mnt/mfs # /mnt/mfs is the MFS mountpoint +./bin/maio-utils -m /mnt/mfs -s ../test/strategy_replay.so +``` diff --git a/tools/mfs/maio-utils/test/strategy_demo.c b/tools/mfs/maio-utils/test/strategy_demo.c new file mode 100644 index 000000000000..54554b609f85 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_demo.c @@ -0,0 +1,45 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include <stddef.h> + +int demo_init(void) +{ + return 0; +} + +void demo_exit(void) +{ +} + +int demo_load(struct maio **io) +{ + struct maio_entry *entry; + + entry = (*io)->entries; + entry[0].toff = (*io)->off + (*io)->len; + entry[0].tlen = (*io)->cksz; + entry[0].fpath = NULL; + entry[0].tnuma = -1; + return 1; +} + +int demo_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation demo_strategy = { + .max_io = 1, + .init = demo_init, + .exit = demo_exit, + .load = demo_load, + .evict = demo_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&demo_strategy; +} diff --git a/tools/mfs/maio-utils/test/strategy_generate.cpp b/tools/mfs/maio-utils/test/strategy_generate.cpp new file mode 100644 index 000000000000..929be30e6a42 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_generate.cpp @@ -0,0 +1,296 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include "strategy_template.h" + +#include <array> +#include <atomic> +#include <cstring> +#include <condition_variable> +#include <fstream> +#include <sstream> +#include <iostream> +#include <mutex> +#include <queue> +#include <thread> +#include <unordered_map> +#include <vector> +#include <unistd.h> + +using namespace std; + +#define MAIO_MNTPOINT "MAIO_MNTPOINT" +#define MAIO_TRACE_FILE "MAIO_TRACE_FILE" +#define CACHEDIR "cachedir" + +#define MAXLINE 1024 + +/* Data struct definition */ +template<typename T> +class SafeQueue { +private: + queue<T> data_queue; + mutex mtx; + condition_variable cv; + +public: + // 添加数据到队列 + void push(T item) { + lock_guard<mutex> lock(mtx); + data_queue.push(move(item)); + cv.notify_one(); + } + + // 从队列取出数据（阻塞直到有数据） + T pop() { + unique_lock<mutex> lock(mtx); + cv.wait(lock, [this]{ return !data_queue.empty(); }); + T item = move(data_queue.front()); + data_queue.pop(); + return item; + } + + // 检查队列是否为空 + bool empty() { + lock_guard<mutex> lock(mtx); + return data_queue.empty(); + } +}; + +struct io { + string name; + uint64_t off; + uint64_t len; + uint8_t npu; + + io(const string& _name, uint64_t _off, uint64_t _len, uint8_t _npu) + : name(_name), off(_off), len(_len), npu(_npu) {} +}; + +/* Global variable definition */ +unordered_map<int, char*> fd_map; /* map fd to path */ +mutex fd_mutex; +string cachedir; + +vector<io> iovec; /* io traces */ +mutex iovec_mutex; +SafeQueue<vector<io>> iovec_queue; + +ofstream tfile; /* trace file */ + +thread writer; + +unordered_map<int, int> process_npu_map; +mutex pnpu_mutex; + +atomic<int> npu_smi_enable(-1); + +/* fd_map helper function */ +char* fd_path_find(int iofd) { + lock_guard<mutex> lock(fd_mutex); + auto it = fd_map.find(iofd); + if (it != fd_map.end()) { + return it->second; + } else { + char *path = _get_fullpath(NULL, iofd); + fd_map.insert({iofd, path}); + return path; + } +} + +/* iovec helper function */ +void io_insert_data(string name, uint64_t off, uint64_t len, uint8_t npu) +{ + lock_guard<mutex> lock(iovec_mutex); + iovec.emplace_back(name, off, len, npu); + + vector<io> copy_iovec = move(iovec); + iovec.clear(); + + iovec_queue.push(move(copy_iovec)); +} + +void get_mount_option(const char* mntpoint, const char* option) +{ + ifstream mounts("/proc/mounts"); + string line, target_mp; + + if (!mounts.is_open()) { + cerr << "Error: could not open /proc/mounts" << endl; + return; + } + + while (getline(mounts, line)) { + istringstream iss(line); + string device, mp, fs_type, options; + + if (!(iss >> device >> mp >> fs_type >> options)) + continue; + + if (mp.back() != '/') + mp += '/'; + target_mp = mntpoint; + if (target_mp.back() != '/') + target_mp += '/'; + + if (target_mp == mp) { + istringstream opt_stream(options); + string opt; + + while (getline(opt_stream, opt, ',')) { + if (opt.find(option) == 0) { + if (opt[strlen(option)] == '=') { + cachedir = opt.substr(strlen(option) + 1); + } + } + } + break; + } + } +} + +void writer_thread() { + while (true) { + vector<io> iovec_to_write = iovec_queue.pop(); + + for (const auto &item : iovec_to_write) + tfile << cachedir << item.name << " " << item.off << " " << item.len << " " << (unsigned int)item.npu << endl; + tfile.flush(); + } +} + +string exec_cmd(const char* cmd) { + array<char, 128> buffer; + string result; + unique_ptr<FILE, decltype(&pclose)> pipe(popen(cmd, "r"), pclose); + + if (!pipe) { + throw std::runtime_error("popen() failed!"); + } + while (fgets(buffer.data(), buffer.size(), pipe.get()) != nullptr) { + result += buffer.data(); + } + return result; +} + +bool isNumber(const std::string& str) { + return !str.empty() && str.find_first_not_of("0123456789") == std::string::npos; +} + +void get_npu_info(string &npuinfo) +{ + istringstream iss(npuinfo); + string line; + + while (getline(iss, line)) { + istringstream lineStream(line); + string token; + vector<string> tokens; + while (getline(lineStream, token, ' ')) { + if (!token.empty()) { + tokens.push_back(token); + } + } + if (tokens.size() >= 3) { + if (!isNumber(tokens[1]) || !isNumber(tokens[4])) + continue; + int npuId = stoi(tokens[1]); + int processId = stoi(tokens[4]); + process_npu_map[processId] = npuId; + } + } +} + +int process_npu_find(int processid) { + lock_guard<mutex> lock(pnpu_mutex); + auto it = process_npu_map.find(processid); + + if (npu_smi_enable.load() == -1) { + if (exec_cmd("command -v npu-smi").empty()) + npu_smi_enable.store(0); + else + npu_smi_enable.store(1); + } + + if (npu_smi_enable.load() == 0) + return 0; + + if (it != process_npu_map.end()) { + return it->second; + } else { + string result = exec_cmd("npu-smi info"); + get_npu_info(result); + auto it = process_npu_map.find(processid); + if (it != process_npu_map.end()) + return it->second; + else + return 0; + } +} + +int strategy_init(void) +{ + char *tfilename = getenv(MAIO_TRACE_FILE); + char *mntpoint = getenv(MAIO_MNTPOINT); + + if(!tfilename || !mntpoint) { + printf("no MAIO_TRACE_FILE or MAIO_MNTPOINT env variable\n"); + return -1; + } + get_mount_option(mntpoint, CACHEDIR); + string stfilename = tfilename; + tfile.open(stfilename, ios::trunc); + writer = thread(writer_thread); + if (!tfile.is_open()) { + cerr << "Error: could not open" << stfilename << endl; + return -1; + } + return 0; +} + +void strategy_exit(void) +{ + lock_guard<mutex> lock(iovec_mutex); + vector<io> copy_iovec = move(iovec); + iovec.clear(); + iovec_queue.push(move(copy_iovec)); + + tfile.close(); + writer.join(); +} + +int strategy_load(struct maio **io) +{ + char *path; + string pathStr; + int ret = 0; + + if (!tfile.is_open()) + return -1; + + path = fd_path_find((*io)->fd); + pathStr.assign(path); + io_insert_data(pathStr, (*io)->off, (*io)->len, process_npu_find((*io)->pid)); + + return ret; +} + +int strategy_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation maio_strategy = { + .max_io = 1, + .init = strategy_init, + .exit = strategy_exit, + .load = strategy_load, + .evict = strategy_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&maio_strategy; +} diff --git a/tools/mfs/maio-utils/test/strategy_prefetch.cpp b/tools/mfs/maio-utils/test/strategy_prefetch.cpp new file mode 100644 index 000000000000..c8a990925e3e --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_prefetch.cpp @@ -0,0 +1,151 @@ +#include "strategy_prefetch.h" +#include "maio.h" +#include <iostream> +#include <map> +#include <pthread.h> +#include <cstring> +#include <string> +#include <stdint.h> +#include <sys/stat.h> +#include <sys/mman.h> +#include <dirent.h> +#include <fcntl.h> +#include <unistd.h> + +using namespace std; + +struct prefetch_mgr { + map<string, uint64_t> files; +}; + +struct prefetch_mgr g_prefetch; + +int get_files(const char *parent) +{ + DIR *dir; + struct dirent *entry; + string filepath; + struct stat buf; + + if ((dir = opendir(parent)) == NULL) { + cout<<"opening directory failed"<<endl; + return -1; + } + + while ((entry = readdir(dir)) != NULL) { + if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) + continue; + + filepath = string(parent) + "/" + string(entry->d_name); + if (stat(filepath.c_str(), &buf) == -1) { + cout<<"stat path:"<<filepath<<" failed"<<endl; + continue; + } + if (S_ISDIR(buf.st_mode)) + continue; + cout<<"Find file:"<<filepath<<" size:"<<buf.st_size<<endl; + g_prefetch.files.insert(pair<string, uint64_t>(filepath, buf.st_size)); + } + + map<string, uint64_t>::iterator it; + for (it = g_prefetch.files.begin(); it != g_prefetch.files.end(); ++it) { + cout<<"path:"<<it->first<<" size:"<<it->second<<endl; + } + return 0; +} + +int prefetch_init(void) +{ + char *parent = getenv("MODEL_WEIGHT_DIR"); + if (!parent) { + cout<<"please set the env MODEL_WEIGHT_DIR"<<endl; + return -1; + } + + if (get_files(parent) != 0) { + cout<<"get all files failed"<<endl; + return -1; + } + return 0; +} + +void prefetch_exit(void) +{ +} + +struct thread_ctx { + char *path; + uint64_t off; + uint64_t len; +}; + +void *fault(void *arg) +{ + struct thread_ctx *ctx = (struct thread_ctx *)arg; + int fd = open(ctx->path, O_RDONLY); + if (fd < 0) { + cout<<"open file:%s"<<ctx->path<<" failed"<<endl; + free(ctx); + return NULL; + } + + cout<<"FAULT path:"<<ctx->path<<" fd:"<<fd<<" off:"<<ctx->off<<" len:"<<ctx->len<<endl; + void *addr = mmap(NULL, ctx->len, PROT_READ, MAP_SHARED, fd, 0); + uint64_t idx; + char tmp, total, *buffer = (char *)addr; + total = 'B'; + for (idx = 0; idx < ctx->len; idx += 4096) { + tmp = buffer[idx]; + total += tmp; + } + cout<<"Fault calculate total:"<<total<<endl; + munmap(addr, ctx->len); + close(fd); + free(ctx); + return NULL; +} + +int prefetch_load(struct maio **io) +{ + map<string, uint64_t>::iterator it; + struct thread_ctx *ctx; + pthread_t t0; + int ret; + + for (it = g_prefetch.files.begin(); it != g_prefetch.files.end(); ++it) { + ctx = (struct thread_ctx *)malloc(sizeof(struct thread_ctx)); + if (!ctx) { + cout<<"malloc ctx failed"<<endl; + continue; + } + ctx->path = strdup(it->first.c_str()); + ctx->off = 0; + ctx->len = it->second; + ret = pthread_create(&t0, NULL, fault, ctx); + if (ret == 0) + pthread_detach(t0); + } + g_prefetch.files.clear(); + + return 0; +} + +int prefetch_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation prefetch_strategy = { + .max_io = 1, + .init = prefetch_init, + .exit = prefetch_exit, + .load = prefetch_load, + .evict = prefetch_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&prefetch_strategy; +} + diff --git a/tools/mfs/maio-utils/test/strategy_prefetch.h b/tools/mfs/maio-utils/test/strategy_prefetch.h new file mode 100644 index 000000000000..2c2475dc91f0 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_prefetch.h @@ -0,0 +1,21 @@ +#ifndef STRATEGY_PREFETCH_H +#define STRATEGY_PREFETCH_H + +#ifdef __cplusplus +extern "C" { +#endif + +int prefetch_init(void); +void prefetch_exit(void); +int prefetch_load(struct maio *io); +int prefetch_evict(struct maio **io); + +extern const struct maio_operation prefetch_strategy; + +struct maio_operation *register_strategy(); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/tools/mfs/maio-utils/test/strategy_replay.cpp b/tools/mfs/maio-utils/test/strategy_replay.cpp new file mode 100644 index 000000000000..85c1c7defedd --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_replay.cpp @@ -0,0 +1,540 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include "strategy_template.h" + +#include <atomic> +#include <array> +#include <cstring> +#include <fstream> +#include <iostream> +#include <map> +#include <mutex> +#include <sstream> +#include <string> +#include <thread> +#include <unordered_map> +#include <vector> +#include <pthread.h> +#include <fcntl.h> +#include <unistd.h> + +using namespace std; + +#define MAIO_MNTPOINT "MAIO_MNTPOINT" +#define MAIO_TRACE_FILE "MAIO_TRACE_FILE" +#define CACHEDIR "cachedir" +#define MAXLINE 1024 + +/* Data structure definition */ +enum { + IO_NONE = 0, + IO_LOADED, + IO_EVICTED, +}; + +struct io { + string name; + uint64_t off; + uint64_t len; + uint8_t npu; + int flag; + + explicit io(const string& _name, uint64_t _off, uint64_t _len, uint8_t _npu) + : name(_name), off(_off), len(_len), npu(_npu), flag(IO_NONE) {} +}; + + +struct ioKey { + string name; + uint64_t off; + uint64_t len; + uint8_t npu; + + ioKey(const string& _name, uint64_t _off, uint64_t _len, uint8_t _npu) + : name(_name), off(_off), len(_len), npu(_npu) {} + + bool operator<(const ioKey &other) const { + return name < other.name || (name == other.name && off < other.off) || + (name == other.name && off == other.off && len < other.len); + } +}; + +vector<io> iovec; /* io traces */ +map<ioKey, int> io_to_index; +unordered_map<int, char*> fd_map; +mutex fd_mutex; +string cachedir; + +unordered_map<int, int> npu_numa_map; + +unordered_map<int, int> process_npu_map; +mutex pnpu_mutex; + +/* for evict */ +#define EVICT_DIST 10000 +#define EVICT_IO_MAX 5000 +thread_local size_t evict_idx = 0; + +atomic<int> npu_smi_enable(-1); +atomic<uint64_t> memory_usage(0); + +uint64_t memory_limit; +uint64_t memory_limit_bound; +string usage_in_bytes_path = "memory.usage_in_bytes"; +string limit_in_bytes_path = "memory.limit_in_bytes"; +string cgroup_mem=""; + +string get_cgroup_path() +{ + fstream cgroup_file("/proc/self/cgroup"); + if (!cgroup_file.is_open()) { + cerr << "Failed to open /proc/self/cgroup" << endl; + return ""; + } + + string line; + string cgroup_path; + while (getline(cgroup_file, line)) { + istringstream iss(line); + string hierarchy, controller, path; + if (!getline(iss, hierarchy, ':')) + continue; + if (!getline(iss, controller, ':')) + continue; + if (!getline(iss, path, ':')) + continue; + if (controller == "memory") { + cgroup_path = path; + break; + } + } + cgroup_file.close(); + return cgroup_path; +} + +/* read from /sys/fs/cgroup/memory/memory.[usage_in_bytes|limit_in_bytes] */ +uint64_t read_cgroup_memory(const string &file_path) +{ + if (cgroup_mem == "") + return -1; + string whole_path = "/sys/fs/cgroup/memory"+cgroup_mem+"/"+file_path; + ifstream cgroup_file(whole_path); + + if(!cgroup_file.is_open()) { + cerr << "Failed to open " << file_path << endl; + return -1; + } + + string line; + while(getline(cgroup_file, line)) { + try { + return stoll(line); + } catch (...) { + cerr << "Failed to parse line" << line << endl; + } + } + + cgroup_file.close(); + return -1; +} + +/* mount helper */ +void get_mount_option(const char* mntpoint, const char* option) +{ + ifstream mounts("/proc/mounts"); + string line, target_mp; + + if (!mounts.is_open()) { + cerr << "Error: could not open /proc/mounts" << endl; + return; + } + + while (getline(mounts, line)) { + istringstream iss(line); + string device, mp, fs_type, options; + + if (!(iss >> device >> mp >> fs_type >> options)) + continue; + + if (mp.back() != '/') + mp += '/'; + target_mp = mntpoint; + if (target_mp.back() != '/') + target_mp += '/'; + + if (target_mp == mp) { + istringstream opt_stream(options); + string opt; + + while (getline(opt_stream, opt, ',')) { + if (opt.find(option) == 0) { + if (opt[strlen(option)] == '=') { + cachedir = opt.substr(strlen(option) + 1); + } + } + } + break; + } + } +} + +/* fd_map helper function */ +char* fd_path_find(int iofd) { + lock_guard<mutex> lock(fd_mutex); + auto it = fd_map.find(iofd); + if (it != fd_map.end()) { + return it->second; + } else { + char *path = _get_fullpath(NULL, iofd); + size_t len = strlen(path) + cachedir.length() + 1; + char *realpath = (char*)malloc(len); + snprintf(realpath, len, "%s%s", cachedir.c_str(), path); + fd_map.insert({iofd, realpath}); + return realpath; + } +} + +string exec_cmd(const char* cmd) { + array<char, 128> buffer; + string result = ""; + unique_ptr<FILE, decltype(&pclose)> pipe(popen(cmd, "r"), pclose); + + if (!pipe) { + throw std::runtime_error("popen() failed!"); + } + while (fgets(buffer.data(), buffer.size(), pipe.get()) != nullptr) { + result += buffer.data(); + } + return result; +} + +bool isNumber(const std::string& str) { + return !str.empty() && str.find_first_not_of("0123456789") == std::string::npos; +} + +/* cpu_numa_map builder from lscpu */ +unordered_map<string, int> build_cpu_numa_map() { + unordered_map<string, int> cpuNumaMap; + string result = exec_cmd("lscpu"); + istringstream iss(result); + string line; + + while (getline(iss, line)) { + if (line.find("NUMA node") != string::npos) { + istringstream lineStream(line); + string key, value; + int numaNode; + getline(lineStream, value, ':'); + getline(lineStream, key); + /* what if numa is more than 10 */ + value = value.substr(value.find("NUMA node") + 9, 1); + if (!isNumber(value)) + continue; + numaNode = stoi(value); + key.erase(0, key.find_first_not_of(" \t")); + key.erase(key.find_last_not_of(" \t") + 1); + cpuNumaMap[key]=numaNode; + } + } + return cpuNumaMap; +} + +/* npu_numa_map builder, from npu-smi info -t topo */ +void build_npu_map_map() +{ + if (npu_smi_enable.load() == -1) { + if (exec_cmd("command -v npu-smi").empty()) + npu_smi_enable.store(0); + else + npu_smi_enable.store(1); + } + + if (npu_smi_enable.load() == 0) + return; + + unordered_map<string, int> cpuNumaMap = build_cpu_numa_map(); + string result = exec_cmd("npu-smi info -t topo"); + istringstream iss(result); + string line; + size_t target_token_size = 0; + + cout << "NPU\tCPU_AFFINITY\tNUMA_NODE" << endl; + while (getline(iss, line)) { + istringstream lineStream(line); + string npuStr, numaStr, token; + vector<string> tokens; + + while (lineStream >> token) { + tokens.push_back(token); + } + + if (tokens.size() >= 2 && tokens.back() == "Affinity") { + target_token_size = tokens.size() - 1 + 1; + continue; + } + + if (tokens.size() != target_token_size) + continue; + + int npuId = stoi(tokens[0].substr(3)); + + numaStr = tokens.back(); + cout << npuId << "\t" << numaStr << "\t\t" << cpuNumaMap[numaStr] << endl; + npu_numa_map[npuId] = cpuNumaMap[numaStr]; + } +} + +/* process_npu_map builder, from npu-smi info */ +void get_npu_info(string &npuinfo) +{ + istringstream iss(npuinfo); + string line; + + while (getline(iss, line)) { + istringstream lineStream(line); + string token; + vector<string> tokens; + while (getline(lineStream, token, ' ')) { + if (!token.empty()) { + tokens.push_back(token); + } + } + if (tokens.size() >= 3) { + if (!isNumber(tokens[1]) || !isNumber(tokens[4])) + continue; + int npuId = stoi(tokens[1]); + int processId = stoi(tokens[4]); + process_npu_map[processId] = npuId; + } + } +} + +/* process_npu_map helper */ +int process_npu_find(int processid) { + lock_guard<mutex> lock(pnpu_mutex); + auto it = process_npu_map.find(processid); + + if (npu_smi_enable.load() == 0) + return 0; + + if (it != process_npu_map.end()) { + return it->second; + } else { + string result = exec_cmd("npu-smi info"); + get_npu_info(result); + auto it = process_npu_map.find(processid); + if (it != process_npu_map.end()) + return it->second; + else + return 0; + } +} + +int strategy_init(void) +{ + const char *mntpoint = getenv(MAIO_MNTPOINT); + char *tfilename = getenv(MAIO_TRACE_FILE); + if(!tfilename || !mntpoint) { + fprintf(stderr, "no MAIO_TRACE_FILE or MAIO_MNTPOINT env variable\n"); + return -1; + } + ifstream tfile(tfilename); + string line; + + cgroup_mem=get_cgroup_path(); + memory_limit = read_cgroup_memory(limit_in_bytes_path); + memory_limit_bound = memory_limit * 4 / 5; + cout << "memory_limit: " << memory_limit << " memory_limit_bound: " << memory_limit_bound << endl; + get_mount_option(mntpoint, CACHEDIR); + build_npu_map_map(); + + if(!tfile.is_open()) { + cerr << "Failed to open file:" << tfilename << endl; + return -1; + } + + while(getline(tfile, line)) { + istringstream iss(line); + + string name; + uint64_t off; + uint64_t len; + unsigned int npu; + if (iss >> name >> off >> len >> npu) { + iovec.emplace_back(name, off, len, npu); + io_to_index[ioKey(name, off, len, npu)] = iovec.size() - 1; + } else { + cerr << "Failed to parse line:" << line << endl; + } + } + + tfile.close(); + return 0; +} + +void strategy_exit(void) +{ +} + +int strategy_load(struct maio **io) +{ + int npuid = process_npu_find((*io)->pid); + struct maio_entry *entry; + string pathStr; + char *path; + uint64_t idx = iovec.size(); + int ret = 0; + struct maio *new_io; + + path = fd_path_find((*io)->fd); + pathStr.assign(path); + + ioKey key(pathStr, (*io)->off, (*io)->len, npuid); + auto io_it = io_to_index.lower_bound(key); + if (io_it == io_to_index.end()) { + entry = (*io)->entries; + entry[0].toff = (*io)->off + (*io)->len; + entry[0].tlen = 0; + entry[0].fpath = NULL; + entry[0].tnuma = npu_numa_map[npuid]; + return 1; + } + if (key < io_it->first) { + if (io_it != io_to_index.begin()) { + --io_it; + if (io_it->first.name != pathStr) { + ++io_it; + } + } + } + + idx = io_it->second; + (*io)->flags |= MAIO_WITH_SEQ; + (*io)->curseq = idx; + entry = (*io)->entries; + int ios = 0; + uint64_t memory_usage = read_cgroup_memory(usage_in_bytes_path); + vector<int> io_extra; + + /* fill ios below max_io */ + while (idx < iovec.size()) { + if (iovec[idx].flag == IO_LOADED) { + idx++; + continue; + } + memory_usage += iovec[idx].len / 2; + if (memory_usage > memory_limit_bound) + break; + if (ios >= maio_strategy.max_io) { + io_extra.push_back(idx); + goto next_io; + } + entry[ios].seq = idx; + if (pathStr == iovec[idx].name) { + entry[ios].toff = iovec[idx].off; + entry[ios].tlen = iovec[idx].len; + entry[ios].tnuma = npu_numa_map[npuid]; + } else { + entry[ios].fpath = strdup(iovec[idx].name.c_str()); + entry[ios].toff = iovec[idx].off; + entry[ios].tlen = iovec[idx].len; + entry[ios].tnuma = npu_numa_map[iovec[idx].npu]; + } +next_io: + iovec[idx].flag = IO_LOADED; + idx++; + ios++; + } + + /* fill ios above max_io */ + if (ios > maio_strategy.max_io) { + new_io = (struct maio *)realloc(*io, sizeof(struct maio) + ios * sizeof(struct maio_entry)); + if (!new_io) { + printf("failed to alloc ios:%d maio\n", ios); + return -1; + } + *io = new_io; + entry = (*io)->entries; + for (int i = maio_strategy.max_io; i < ios; ++i) { + int io_idx = io_extra[i - maio_strategy.max_io]; + entry[i].seq = io_idx; + if (pathStr == iovec[io_idx].name) { + entry[i].toff = iovec[io_idx].off; + entry[i].tlen = iovec[io_idx].len; + entry[i].tnuma = npu_numa_map[npuid]; + } else { + entry[i].fpath = strdup(iovec[io_idx].name.c_str()); + entry[i].toff = iovec[io_idx].off; + entry[i].tlen = iovec[io_idx].len; + entry[i].tnuma = npu_numa_map[iovec[io_idx].npu]; + } + } + } + + // printf("file:%s off:%lu len:%lu generate_ios:%d from %d",path, (*io)->off, (*io)->len, ios, io_it->second); + ret = ios; + return ret; +} + +int strategy_evict(struct maio **io) +{ + string pathStr; + char *path; + path = fd_path_find((*io)->fd); + pathStr.assign(path); + ioKey key(pathStr, (*io)->off, (*io)->len, (*io)->pid); + auto io_it = io_to_index.lower_bound(key); + int dist = 0; + size_t i = 0, io_idx = io_it->second; + struct maio_entry *entry; + struct maio *new_io; + uint64_t evict_memory = 0; + uint64_t memory_usage = read_cgroup_memory(usage_in_bytes_path); + + if (memory_usage < (memory_limit_bound * 3 / 4)) + return 0; + dist = io_idx - evict_idx; + if (dist < 0) + return 0; + if (static_cast<size_t>(dist) < iovec.size() / 8 && io_it != io_to_index.end()) + return 0; + size_t evict_win = 0; + if (io_it != io_to_index.end()) { + evict_win = min(iovec.size() / 10, io_idx - 1); + } else { + evict_win = dist; + } + + new_io = (struct maio*)realloc(*io, sizeof(struct maio) + evict_win * sizeof(struct maio_entry)); + if (!new_io) + return -1; + *io = new_io; + entry = new_io->entries; + + for (i = 0; i < evict_win && evict_idx < iovec.size(); ++i) { + evict_memory += iovec[evict_idx].len; + if (evict_memory > memory_limit_bound / 8) + break; + entry[i].fpath = strdup(iovec[evict_idx].name.c_str()); + entry[i].toff = iovec[evict_idx].off; + entry[i].tlen = iovec[evict_idx].len; + evict_idx++; + iovec[evict_idx].flag = IO_EVICTED; + } + return i; +} + +const struct maio_operation maio_strategy = { + .max_io = 500, + .init = strategy_init, + .exit = strategy_exit, + .load = strategy_load, + .evict = strategy_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&maio_strategy; +} diff --git a/tools/mfs/maio-utils/test/strategy_template.h b/tools/mfs/maio-utils/test/strategy_template.h new file mode 100644 index 000000000000..6599b68754c9 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_template.h @@ -0,0 +1,21 @@ +#ifndef STRATEGY_TEMPLATE_H +#define STRATEGY_TEMPLATE_H + +#ifdef __cplusplus +extern "C" { +#endif + +int strategy_init(void); +void strategy_exit(void); +int strategy_load(struct maio **io); +int strategy_evict(struct maio *io); + +extern const struct maio_operation maio_strategy; + +struct maio_operation *register_strategy(); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/tools/mfs/maio-utils/test/strategy_toend.c b/tools/mfs/maio-utils/test/strategy_toend.c new file mode 100644 index 000000000000..f2208281f8ee --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_toend.c @@ -0,0 +1,46 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include <stddef.h> + +int demo_init(void) +{ + return 0; +} + +void demo_exit(void) +{ +} + +int demo_load(struct maio **io) +{ + struct maio_entry *entry; + + entry = (*io)->entries; + entry[0].toff = (*io)->off + (*io)->len; + /* Read Ahead until the end */ + entry[0].tlen = 0; + entry[0].fpath = NULL; + entry[0].tnuma = -1; + return 1; +} + +int demo_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation demo_strategy = { + .max_io = 1, + .init = demo_init, + .exit = demo_exit, + .load = demo_load, + .evict = demo_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&demo_strategy; +} diff --git a/tools/mfs/maio-utils/test/trace_analyse.py b/tools/mfs/maio-utils/test/trace_analyse.py new file mode 100644 index 000000000000..c25d1ce364df --- /dev/null +++ b/tools/mfs/maio-utils/test/trace_analyse.py @@ -0,0 +1,87 @@ +def merge_intervals(intervals): + """ + 合并区间 + :param intervals: 区间列表，每个区间是一个元组 (start, end) + :return: 合并后的区间列表 + """ + if not intervals: + return [] + + # 按起始位置排序 + intervals.sort(key=lambda x: x[0]) + + merged = [intervals[0]] + for current in intervals[1:]: + last_merged = merged[-1] + if current[0] <= last_merged[1]: # 有重叠 + merged[-1] = (last_merged[0], max(last_merged[1], current[1])) + else: + merged.append(current) + + return merged + +def process_file(input_file): + """ + 处理输入文件 + :param input_file: 输入文件路径 + :return: 每个文件的合并区间和总大小 + """ + from collections import defaultdict + + # 使用字典按文件名分组 + file_intervals = defaultdict(list) + + with open(input_file, 'r') as f: + for line in f: + parts = line.strip().split() + if len(parts) < 3: + print(f"跳过无效行: {line.strip()}") + continue + + # 解析文件名、起始位置、大小 + filename, start, size = parts[:3] + start = int(start) + size = int(size) + + # 计算区间 + end = start + size + file_intervals[filename].append((start, end)) + + # 合并每个文件的区间 + merged_results = {} + for filename, intervals in file_intervals.items(): + merged_intervals = merge_intervals(intervals) + # 计算合并后的区间总大小 + total_size = sum(end - start for start, end in merged_intervals) + merged_results[filename] = { + "merged_intervals": merged_intervals, + "total_size": total_size + } + + return merged_results + +def main(): + import sys + + if len(sys.argv) != 2: + print("用法: python script.py <输入文件>") + sys.exit(1) + + input_file = sys.argv[1] + + merged_results = process_file(input_file) + + whole_result=0 + + for filename, result in merged_results.items(): + print(f"文件: {filename}") + # print("合并后的区间:") + # for interval in result["merged_intervals"]: + # print(f"起始位置: {interval[0]}, 结束位置: {interval[1]}") + print(f"所有区间内数据的总大小: {result['total_size']} 字节") + print("-" * 40) + whole_result+=result['total_size'] + print(f"所有文件内数据的总大小: {whole_result} 字节") + +if __name__ == "__main__": + main() diff --git a/tools/mfs/maio-utils/test/trace_gen.py b/tools/mfs/maio-utils/test/trace_gen.py new file mode 100644 index 000000000000..d050fa48801c --- /dev/null +++ b/tools/mfs/maio-utils/test/trace_gen.py @@ -0,0 +1,116 @@ +import argparse +import os +import sys + +FILENAME_IDX = 0 +OFF_IDX = 1 +LEN_IDX = 2 +NUMA_IDX = 3 +OFF_BOUND = 1024 * 1024 * 4096 + +class ReplayHintGenerator(object): + def __init__(self, trace_file, output_file): + self.output_file = output_file + self.trace_file = trace_file + self.data_list = [] + + def generate_hint(self): + with open(self.output_file, 'w') as f: + for data in self.data_list: + data_off = data[OFF_IDX] + data_len = data[LEN_IDX] + print(data_off) + step = (512 * 1024 * 1024) + while data_len: + if data_len < step: + step = data_len + print(f"{data[FILENAME_IDX]} {data_off} {step} {data[NUMA_IDX]}", file=f) + data_len-=step + data_off+=step + + def parse_trace(self): + file_map_index={} + with open(self.trace_file, 'r') as f: + for line in f: + parts = line.strip().split(' ') + + filename, off, length, numaid = parts + off = int(off) + length = int(length) + numaid = int(numaid) + if self.data_list: + tail_data = self.data_list[-1] + ''' + 首先尝试跟末尾的数据合并: + 如若跟末尾的数据是同一个文件跟numaid, + 两者之间的距离小于设定值, + 就进行合并 + ''' + if (tail_data[FILENAME_IDX] == filename and tail_data[NUMA_IDX] == numaid): + tail_off = tail_data[OFF_IDX] + tail_end = tail_data[OFF_IDX] + tail_data[LEN_IDX] + end = off + length + abs_off = max(abs(off - tail_end), abs(tail_off - end)) + if abs_off < OFF_BOUND: + tail_data[OFF_IDX] = min(tail_off, off) + tail_data[LEN_IDX] = max(tail_end, end) - tail_data[OFF_IDX] + continue + else: + ''' + 否则跟之前同一文件和numaid的数据进行合并 + 如若两者之间距离小于设定值， + 就进行合并 + ''' + key = (filename, numaid) + if key in file_map_index: + index = file_map_index[key] + data = self.data_list[index] + data_off = data[OFF_IDX] + data_end = data[OFF_IDX] + data[LEN_IDX] + end = off + length + abs_off = max(abs(off - data_end), abs(data_off - end)) + if abs_off < OFF_BOUND: + data[OFF_IDX] = min(data_off, off) + data[LEN_IDX] = max(data_end, end) - data[OFF_IDX] + continue + self.data_list.append([filename, off, length, numaid]) + file_map_index[(filename, numaid)] = len(self.data_list) - 1 + + +def main(agrv): + """ + Parse the argument + """ + parser = argparse.ArgumentParser('model trace parser') + parser.add_argument('--trace_file', + required=True, + type=str, + help='trace source') + parser.add_argument('--output_file', + required=True, + type=str, + help='output of hint file') + try: + args = parser.parse_args() + trace_file = args.trace_file + output_file = args.output_file + if not os.path.exists(trace_file): + print("{trace_file} not exist") + return -1 + + hint_generator=ReplayHintGenerator(trace_file, output_file) + hint_generator.parse_trace() + hint_generator.generate_hint() + return 0 + except Exception as e: + print(f"Parse model trace exception:{str(e)}") + return -1 + +if __name__ == '__main__': + try: + ret = main(sys.argv[1:]) + except Exception as main_e: + print(str(main_e)) + ret = -1 + sys.exit(ret) + -- 2.34.1

2 1

[PATCH OLK-6.6] bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
by Pu Lehui 19 Mar '26

19 Mar '26

From: Fuad Tabba <tabba(a)google.com> mainline inclusion from mainline-v7.0-rc2 commit ef06fd16d48704eac868441d98d4ef083d8f3d07 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8762 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- struct bpf_plt contains a u64 target field. Currently, the BPF JIT allocator requests an alignment of 4 bytes (sizeof(u32)) for the JIT buffer. Because the base address of the JIT buffer can be 4-byte aligned (e.g., ending in 0x4 or 0xc), the relative padding logic in build_plt() fails to ensure that target lands on an 8-byte boundary. This leads to two issues: 1. UBSAN reports misaligned-access warnings when dereferencing the structure. 2. More critically, target is updated concurrently via WRITE_ONCE() in bpf_arch_text_poke() while the JIT'd code executes ldr. On arm64, 64-bit loads/stores are only guaranteed to be single-copy atomic if they are 64-bit aligned. A misaligned target risks a torn read, causing the JIT to jump to a corrupted address. Fix this by increasing the allocation alignment requirement to 8 bytes (sizeof(u64)) in bpf_jit_binary_pack_alloc(). This anchors the base of the JIT buffer to an 8-byte boundary, allowing the relative padding math in build_plt() to correctly align the target field. Fixes: b2ad54e1533e ("bpf, arm64: Implement bpf_arch_text_poke() for arm64") Signed-off-by: Fuad Tabba <tabba(a)google.com> Acked-by: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20260226075525.233321-1-tabba@google.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: arch/arm64/net/bpf_jit_comp.c [The conflicts were due to not merge commit 1dad391daef1] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/arm64/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index f98ae8bf4e19..2494a5c96489 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -1648,7 +1648,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) extable_offset = round_up(prog_size + PLT_TARGET_SIZE, extable_align); image_size = extable_offset + extable_size; header = bpf_jit_binary_alloc(image_size, &image_ptr, - sizeof(u32), jit_fill_hole); + sizeof(u64), jit_fill_hole); if (header == NULL) { prog = orig_prog; goto out_off; -- 2.34.1

2 1

[PATCH OLK-6.6] mm/shrinker: Implementation of register_shrinker() and unregister_shrinker()
by Zhang Qilong 19 Mar '26

19 Mar '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8743 -------------------------------- The commit 6a317cb001d1 ("mm: shrinker: remove old APIs") removed old shrinker API. In order to maintain the compatibility of the KABI interface, it is necessary to adapt the old interface to connect to the new shrinking function. Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- include/linux/shrinker.h | 5 +++-- mm/vmscan.c | 44 +++++++++++++++++++++++++++++++++++----- 2 files changed, 42 insertions(+), 7 deletions(-) diff --git a/include/linux/shrinker.h b/include/linux/shrinker.h index 7091c5d21a9f..3467b18a8dbb 100644 --- a/include/linux/shrinker.h +++ b/include/linux/shrinker.h @@ -72,10 +72,11 @@ struct shrink_control { }; #define SHRINK_STOP (~0UL) #define SHRINK_EMPTY (~0UL - 1) +struct shrinker; /* * A callback you can register to apply pressure to ageable caches. * * @count_objects should return the number of freeable items in the cache. If * there are no objects to free, it should return SHRINK_EMPTY, while 0 is @@ -118,11 +119,11 @@ struct shrinker_v2 { struct dentry *debugfs_entry; #endif /* objs pending delete, per node */ atomic_long_t *nr_deferred; - KABI_RESERVE(1) + KABI_USE(1, struct shrinker *v1) KABI_RESERVE(2) /* * The reference count of this shrinker. Registered shrinker have an * initial refcount of 1, then the lookup operations are now allowed @@ -161,11 +162,11 @@ struct shrinker { const char *name; struct dentry *debugfs_entry; #endif atomic_long_t *nr_deferred; - KABI_RESERVE(1) + KABI_USE(1, struct shrinker_v2 *v2) KABI_RESERVE(2) }; #define DEFAULT_SEEKS 2 /* A good number if you don't know better. */ diff --git a/mm/vmscan.c b/mm/vmscan.c index 9e4aedbfd85e..cf6b9e6dc8cd 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -7608,22 +7608,56 @@ void check_move_unevictable_folios(struct folio_batch *fbatch) count_vm_events(UNEVICTABLE_PGSCANNED, pgscanned); } } EXPORT_SYMBOL_GPL(check_move_unevictable_folios); +static unsigned long shrinker_v2_to_v1_count_objects(struct shrinker_v2 *shk_v2, + struct shrink_control *sc) +{ + if (shk_v2->v1) + return shk_v2->v1->count_objects(shk_v2->v1, sc); + + return 0; +} + +static unsigned long shrinker_v2_to_v1_scan_objects(struct shrinker_v2 *shk_v2, + struct shrink_control *sc) +{ + if (shk_v2->v1) + return shk_v2->v1->count_objects(shk_v2->v1, sc); + + return SHRINK_EMPTY; +} + int register_shrinker(struct shrinker *shrinker, const char *fmt, ...) { - pr_warn_once("%s interface is deprecated. Please use instead shrinker_register()\n", - __func__); - return -ENOSYS; + struct shrinker_v2 *shk_v2; + + shk_v2 = shrinker_alloc(shrinker->flags, fmt); + if (!shk_v2) + return -ENOMEM; + + shk_v2->count_objects = shrinker_v2_to_v1_count_objects; + shk_v2->scan_objects = shrinker_v2_to_v1_scan_objects; + shk_v2->batch = shrinker->batch; + shk_v2->seeks = shrinker->seeks; + shk_v2->flags |= shrinker->flags; + shk_v2->v1 = shrinker; + + shrinker_register(shk_v2); + shrinker->v2 = shk_v2; + + return 0; } EXPORT_SYMBOL(register_shrinker); void unregister_shrinker(struct shrinker *shrinker) { - pr_warn_once("%s interface is deprecated. Please use instead shrinker_free()\n", - __func__); + if (shrinker->v2) { + shrinker_free(shrinker->v2); + shrinker->v2 = NULL; + } } EXPORT_SYMBOL(unregister_shrinker); void synchronize_shrinkers(void) { -- 2.43.0

2 1

[PATCH OLK-5.10] mm/shrinker: Implementation of register_shrinker() and unregister_shrinker()
by Zhang Qilong 19 Mar '26

19 Mar '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8743 -------------------------------- The commit 6a317cb001d1 ("mm: shrinker: remove old APIs") removed old shrinker API. In order to maintain the compatibility of the KABI interface, it is necessary to adapt the old interface to connect to the new shrinking function. Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- include/linux/shrinker.h | 5 +++-- mm/vmscan.c | 44 +++++++++++++++++++++++++++++++++++----- 2 files changed, 42 insertions(+), 7 deletions(-) diff --git a/include/linux/shrinker.h b/include/linux/shrinker.h index 7091c5d21a9f..3467b18a8dbb 100644 --- a/include/linux/shrinker.h +++ b/include/linux/shrinker.h @@ -72,10 +72,11 @@ struct shrink_control { }; #define SHRINK_STOP (~0UL) #define SHRINK_EMPTY (~0UL - 1) +struct shrinker; /* * A callback you can register to apply pressure to ageable caches. * * @count_objects should return the number of freeable items in the cache. If * there are no objects to free, it should return SHRINK_EMPTY, while 0 is @@ -118,11 +119,11 @@ struct shrinker_v2 { struct dentry *debugfs_entry; #endif /* objs pending delete, per node */ atomic_long_t *nr_deferred; - KABI_RESERVE(1) + KABI_USE(1, struct shrinker *v1) KABI_RESERVE(2) /* * The reference count of this shrinker. Registered shrinker have an * initial refcount of 1, then the lookup operations are now allowed @@ -161,11 +162,11 @@ struct shrinker { const char *name; struct dentry *debugfs_entry; #endif atomic_long_t *nr_deferred; - KABI_RESERVE(1) + KABI_USE(1, struct shrinker_v2 *v2) KABI_RESERVE(2) }; #define DEFAULT_SEEKS 2 /* A good number if you don't know better. */ diff --git a/mm/vmscan.c b/mm/vmscan.c index 9e4aedbfd85e..cf6b9e6dc8cd 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -7608,22 +7608,56 @@ void check_move_unevictable_folios(struct folio_batch *fbatch) count_vm_events(UNEVICTABLE_PGSCANNED, pgscanned); } } EXPORT_SYMBOL_GPL(check_move_unevictable_folios); +static unsigned long shrinker_v2_to_v1_count_objects(struct shrinker_v2 *shk_v2, + struct shrink_control *sc) +{ + if (shk_v2->v1) + return shk_v2->v1->count_objects(shk_v2->v1, sc); + + return 0; +} + +static unsigned long shrinker_v2_to_v1_scan_objects(struct shrinker_v2 *shk_v2, + struct shrink_control *sc) +{ + if (shk_v2->v1) + return shk_v2->v1->count_objects(shk_v2->v1, sc); + + return SHRINK_EMPTY; +} + int register_shrinker(struct shrinker *shrinker, const char *fmt, ...) { - pr_warn_once("%s interface is deprecated. Please use instead shrinker_register()\n", - __func__); - return -ENOSYS; + struct shrinker_v2 *shk_v2; + + shk_v2 = shrinker_alloc(shrinker->flags, fmt); + if (!shk_v2) + return -ENOMEM; + + shk_v2->count_objects = shrinker_v2_to_v1_count_objects; + shk_v2->scan_objects = shrinker_v2_to_v1_scan_objects; + shk_v2->batch = shrinker->batch; + shk_v2->seeks = shrinker->seeks; + shk_v2->flags |= shrinker->flags; + shk_v2->v1 = shrinker; + + shrinker_register(shk_v2); + shrinker->v2 = shk_v2; + + return 0; } EXPORT_SYMBOL(register_shrinker); void unregister_shrinker(struct shrinker *shrinker) { - pr_warn_once("%s interface is deprecated. Please use instead shrinker_free()\n", - __func__); + if (shrinker->v2) { + shrinker_free(shrinker->v2); + shrinker->v2 = NULL; + } } EXPORT_SYMBOL(unregister_shrinker); void synchronize_shrinkers(void) { -- 2.43.0

2 1

openEuler Kernel SIG双周例会
by openEuler conference 18 Mar '26

18 Mar '26

您好！ Kernel 邀请您参加 2026-03-20 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题可直接填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/986250028 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-03-20 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题可直接填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/986250028 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-5.10] mm: make sure freeram is smaller than totalram
by Liu Shixin 17 Mar '26

17 Mar '26

From: Yang Yingliang <yangyingliang(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8748 CVE: NA -------------------------------------------------- The memory stat is not done in real time, it have some gap with real value. In CPU-less NUMA node, the values of MemTotal and MemFree can be nearly equal, the gap make cause MemFree is bigger than MemTotal, it leads MemUsed is negative which print as a large positive number. cat /sys/devices/system/node/node17/meminfo Node 17 MemTotal: 4194304 kB Node 17 MemFree: 4195552 kB Node 17 MemUsed: 18446744073709550368 kB Node 17 Active: 52 kB Node 17 Inactive: 320 kB Node 17 Active(anon): 0 kB Node 17 Inactive(anon): 0 kB Node 17 Active(file): 52 kB Node 17 Inactive(file): 320 kB Node 17 Unevictable: 0 kB Node 17 Mlocked: 0 kB Node 17 Dirty: 0 kB Node 17 Writeback: 0 kB Node 17 FilePages: 372 kB Node 17 Mapped: 320 kB Node 17 AnonPages: 0 kB Node 17 Shmem: 0 kB Node 17 KernelStack: 0 kB Node 17 PageTables: 0 kB Node 17 NFS_Unstable: 0 kB Node 17 Bounce: 0 kB Node 17 WritebackTmp: 0 kB Node 17 KReclaimable: 0 kB Node 17 Slab: 0 kB Node 17 SReclaimable: 0 kB Node 17 SUnreclaim: 0 kB Node 17 AnonHugePages: 79872 kB Node 17 ShmemHugePages: 0 kB Node 17 ShmemPmdMapped: 0 kB Node 17 FileHugePages: 0 kB Node 17 FilePmdMapped: 0 kB Node 17 HugePages_Total: 0 Node 17 HugePages_Free: 0 Node 17 HugePages_Surp: 0 To avoid this exception, make MemFree equals MemTotal, when MemFree is bigger than MemTotal Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/page_alloc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 72d5303f8000..02db21de93aa 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -5837,6 +5837,7 @@ void si_meminfo_node(struct sysinfo *val, int nid) val->totalram = managed_pages; val->sharedram = node_page_state(pgdat, NR_SHMEM); val->freeram = sum_zone_node_page_state(nid, NR_FREE_PAGES); + val->freeram = min(val->freeram, val->totalram); #ifdef CONFIG_HIGHMEM for (zone_type = 0; zone_type < MAX_NR_ZONES; zone_type++) { struct zone *zone = &pgdat->node_zones[zone_type]; -- 2.33.0

2 1

[PATCH OLK-5.10] mm: make sure freeram is smaller than totalram
by Liu Shixin 17 Mar '26

17 Mar '26

From: Yang Yingliang <yangyingliang(a)huawei.com> The memory stat is not done in real time, it have some gap with real value. In CPU-less NUMA node, the values of MemTotal and MemFree can be nearly equal, the gap make cause MemFree is bigger than MemTotal, it leads MemUsed is negative which print as a large positive number. cat /sys/devices/system/node/node17/meminfo Node 17 MemTotal: 4194304 kB Node 17 MemFree: 4195552 kB Node 17 MemUsed: 18446744073709550368 kB Node 17 Active: 52 kB Node 17 Inactive: 320 kB Node 17 Active(anon): 0 kB Node 17 Inactive(anon): 0 kB Node 17 Active(file): 52 kB Node 17 Inactive(file): 320 kB Node 17 Unevictable: 0 kB Node 17 Mlocked: 0 kB Node 17 Dirty: 0 kB Node 17 Writeback: 0 kB Node 17 FilePages: 372 kB Node 17 Mapped: 320 kB Node 17 AnonPages: 0 kB Node 17 Shmem: 0 kB Node 17 KernelStack: 0 kB Node 17 PageTables: 0 kB Node 17 NFS_Unstable: 0 kB Node 17 Bounce: 0 kB Node 17 WritebackTmp: 0 kB Node 17 KReclaimable: 0 kB Node 17 Slab: 0 kB Node 17 SReclaimable: 0 kB Node 17 SUnreclaim: 0 kB Node 17 AnonHugePages: 79872 kB Node 17 ShmemHugePages: 0 kB Node 17 ShmemPmdMapped: 0 kB Node 17 FileHugePages: 0 kB Node 17 FilePmdMapped: 0 kB Node 17 HugePages_Total: 0 Node 17 HugePages_Free: 0 Node 17 HugePages_Surp: 0 To avoid this exception, make MemFree equals MemTotal, when MemFree is bigger than MemTotal Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/page_alloc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 72d5303f8000..02db21de93aa 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -5837,6 +5837,7 @@ void si_meminfo_node(struct sysinfo *val, int nid) val->totalram = managed_pages; val->sharedram = node_page_state(pgdat, NR_SHMEM); val->freeram = sum_zone_node_page_state(nid, NR_FREE_PAGES); + val->freeram = min(val->freeram, val->totalram); #ifdef CONFIG_HIGHMEM for (zone_type = 0; zone_type < MAX_NR_ZONES; zone_type++) { struct zone *zone = &pgdat->node_zones[zone_type]; -- 2.33.0

2 1

[PATCH OLK-5.10] l2tp: fix double dst_release() on sk_dst_cache race
by Li Xiasong 17 Mar '26

17 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8696 Reference: https://lore.kernel.org/netdev/20251215145537.5085-1-m.lobanov@rosa.ru/ ---------------------------------------- A reproducible rcuref - imbalanced put() warning is observed under IPv6 L2TP (pppol2tp) traffic with blackhole routes, indicating an imbalance in dst reference counting for routes cached in sk->sk_dst_cache and pointing to a subtle lifetime/synchronization issue between the helpers that validate and drop cached dst entries. rcuref - imbalanced put() WARNING: CPU: 0 PID: 899 at lib/rcuref.c:266 rcuref_put_slowpath+0x1ce/0x240 lib/rcuref.c:266 Modules linked in: CPSocket connected tcp:127.0.0.1:48148,server=on <-> 127.0.0.1:33750 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:rcuref_put_slowpath+0x1ce/0x240 lib/rcuref.c:266 Call Trace: <TASK> __rcuref_put include/linux/rcuref.h:97 [inline] rcuref_put include/linux/rcuref.h:153 [inline] dst_release+0x291/0x310 net/core/dst.c:167 __sk_dst_check+0x2d4/0x350 net/core/sock.c:604 __inet6_csk_dst_check net/ipv6/inet6_connection_sock.c:76 [inline] inet6_csk_route_socket+0x6ed/0x10c0 net/ipv6/inet6_connection_sock.c:104 inet6_csk_xmit+0x12f/0x740 net/ipv6/inet6_connection_sock.c:121 l2tp_xmit_queue net/l2tp/l2tp_core.c:1214 [inline] l2tp_xmit_core net/l2tp/l2tp_core.c:1309 [inline] l2tp_xmit_skb+0x1404/0x1910 net/l2tp/l2tp_core.c:1325 pppol2tp_sendmsg+0x3ca/0x550 net/l2tp/l2tp_ppp.c:302 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg net/socket.c:744 [inline] ____sys_sendmsg+0xab2/0xc70 net/socket.c:2609 ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2663 __sys_sendmmsg+0x188/0x450 net/socket.c:2749 __do_sys_sendmmsg net/socket.c:2778 [inline] __se_sys_sendmmsg net/socket.c:2775 [inline] __x64_sys_sendmmsg+0x98/0x100 net/socket.c:2775 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x64/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe6960ec719 </TASK> The race occurs between the lockless UDPv6 transmit path (udpv6_sendmsg() -> sk_dst_check()) and the locked L2TP/pppol2tp transmit path (pppol2tp_sendmsg() -> l2tp_xmit_skb() -> ... -> inet6_csk_xmit() → __sk_dst_check()), when both handle the same obsolete dst from sk->sk_dst_cache: the UDPv6 side takes an extra reference and atomically steals and releases the cached dst, while the L2TP side, using a stale cached pointer, still calls dst_release() on it, and together these updates produce an extra final dst_release() on that dst, triggering rcuref - imbalanced put(). The Race Condition: Initial: sk->sk_dst_cache = dst ref(dst) = 1 Thread 1: sk_dst_check() Thread 2: __sk_dst_check() ------------------------ ---------------------------- sk_dst_get(sk): rcu_read_lock() dst = rcu_dereference(sk->sk_dst_cache) rcuref_get(dst) succeeds rcu_read_unlock() // ref = 2 dst = __sk_dst_get(sk) // reads same dst from sk_dst_cache // ref still = 2 (no extra get) [both see dst obsolete & check() == NULL] sk_dst_reset(sk): old = xchg(&sk->sk_dst_cache, NULL) // old = dst dst_release(old) // drop cached ref // ref: 2 -> 1 RCU_INIT_POINTER(sk->sk_dst_cache, NULL) // cache already NULL after xchg dst_release(dst) // ref: 1 -> 0 dst_release(dst) // tries to drop its own ref after final put // rcuref_put_slowpath() -> "rcuref - imbalanced put()" Make L2TP's IPv6 transmit path stop using inet6_csk_xmit() (and thus __sk_dst_check()) and instead open-code the same routing and transmit sequence using the existing sk_dst_check() with dst reference counting and ip6_dst_lookup_flow(). The new code builds a flowi6 from the socket fields in the same way as inet6_csk_route_socket(), then performs dst lookup using sk_dst_check() with proper reference counting, attaches the resulting dst to the skb via skb_dst_set(), and finally invokes ip6_xmit() for transmission. This makes both the UDPv6 and L2TP IPv6 paths use the same dst-cache handling logic for a given socket and removes the possibility that the lockless sk_dst_check() and the locked __sk_dst_check() concurrently drop the same cached dst and trigger the rcuref - imbalanced put() warning under concurrent traffic. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: b0270e91014d ("ipv4: add a sock pointer to ip_queue_xmit()") Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/l2tp/l2tp_core.c | 60 +++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 57 insertions(+), 3 deletions(-) diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c index 97350350478d..80a20c079a9a 100644 --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -995,19 +995,73 @@ static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf) return bufp - optr; } +#if IS_ENABLED(CONFIG_IPV6) +static int l2tp_xmit_ipv6(struct sock *sk, struct sk_buff *skb) +{ + struct ipv6_pinfo *np = inet6_sk(sk); + struct inet_sock *inet = inet_sk(sk); + struct in6_addr *final_p, final; + struct dst_entry *dst; + struct flowi6 fl6; + int err; + + memset(&fl6, 0, sizeof(fl6)); + fl6.flowi6_proto = sk->sk_protocol; + fl6.daddr = sk->sk_v6_daddr; + fl6.saddr = np->saddr; + fl6.flowlabel = np->flow_label; + IP6_ECN_flow_xmit(sk, fl6.flowlabel); + + fl6.flowi6_oif = sk->sk_bound_dev_if; + fl6.flowi6_mark = sk->sk_mark; + fl6.fl6_sport = inet->inet_sport; + fl6.fl6_dport = inet->inet_dport; + fl6.flowi6_uid = sk->sk_uid; + + security_sk_classify_flow(sk, flowi6_to_flowi_common(&fl6)); + + rcu_read_lock(); + final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final); + rcu_read_unlock(); + + dst = sk_dst_check(sk, np->dst_cookie); + if (!dst) { + dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p); + if (IS_ERR(dst)) { + sk->sk_err_soft = -PTR_ERR(dst); + sk->sk_route_caps = 0; + kfree_skb(skb); + return PTR_ERR(dst); + } + + ip6_dst_store(sk, dst_clone(dst), NULL, NULL); + } + + skb_dst_set(skb, dst); + fl6.daddr = sk->sk_v6_daddr; + + rcu_read_lock(); + err = ip6_xmit(sk, skb, &fl6, sk->sk_mark, rcu_dereference(np->opt), + np->tclass, sk->sk_priority); + rcu_read_unlock(); + return err; +} +#endif + /* Queue the packet to IP for output: tunnel socket lock must be held */ static int l2tp_xmit_queue(struct l2tp_tunnel *tunnel, struct sk_buff *skb, struct flowi *fl) { int err; + struct sock *sk = tunnel->sock; skb->ignore_df = 1; skb_dst_drop(skb); #if IS_ENABLED(CONFIG_IPV6) - if (l2tp_sk_is_v6(tunnel->sock)) - err = inet6_csk_xmit(tunnel->sock, skb, NULL); + if (l2tp_sk_is_v6(sk)) + err = l2tp_xmit_ipv6(sk, skb); else #endif - err = ip_queue_xmit(tunnel->sock, skb, fl); + err = ip_queue_xmit(sk, skb, fl); return err >= 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP; } -- 2.34.1

2 1

[PATCH OLK-6.6] l2tp: fix double dst_release() on sk_dst_cache race
by Li Xiasong 17 Mar '26

17 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8696 Reference: https://lore.kernel.org/netdev/20251215145537.5085-1-m.lobanov@rosa.ru/ ---------------------------------------- A reproducible rcuref - imbalanced put() warning is observed under IPv6 L2TP (pppol2tp) traffic with blackhole routes, indicating an imbalance in dst reference counting for routes cached in sk->sk_dst_cache and pointing to a subtle lifetime/synchronization issue between the helpers that validate and drop cached dst entries. rcuref - imbalanced put() WARNING: CPU: 0 PID: 899 at lib/rcuref.c:266 rcuref_put_slowpath+0x1ce/0x240 lib/rcuref.c:266 Modules linked in: CPSocket connected tcp:127.0.0.1:48148,server=on <-> 127.0.0.1:33750 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:rcuref_put_slowpath+0x1ce/0x240 lib/rcuref.c:266 Call Trace: <TASK> __rcuref_put include/linux/rcuref.h:97 [inline] rcuref_put include/linux/rcuref.h:153 [inline] dst_release+0x291/0x310 net/core/dst.c:167 __sk_dst_check+0x2d4/0x350 net/core/sock.c:604 __inet6_csk_dst_check net/ipv6/inet6_connection_sock.c:76 [inline] inet6_csk_route_socket+0x6ed/0x10c0 net/ipv6/inet6_connection_sock.c:104 inet6_csk_xmit+0x12f/0x740 net/ipv6/inet6_connection_sock.c:121 l2tp_xmit_queue net/l2tp/l2tp_core.c:1214 [inline] l2tp_xmit_core net/l2tp/l2tp_core.c:1309 [inline] l2tp_xmit_skb+0x1404/0x1910 net/l2tp/l2tp_core.c:1325 pppol2tp_sendmsg+0x3ca/0x550 net/l2tp/l2tp_ppp.c:302 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg net/socket.c:744 [inline] ____sys_sendmsg+0xab2/0xc70 net/socket.c:2609 ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2663 __sys_sendmmsg+0x188/0x450 net/socket.c:2749 __do_sys_sendmmsg net/socket.c:2778 [inline] __se_sys_sendmmsg net/socket.c:2775 [inline] __x64_sys_sendmmsg+0x98/0x100 net/socket.c:2775 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x64/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe6960ec719 </TASK> The race occurs between the lockless UDPv6 transmit path (udpv6_sendmsg() -> sk_dst_check()) and the locked L2TP/pppol2tp transmit path (pppol2tp_sendmsg() -> l2tp_xmit_skb() -> ... -> inet6_csk_xmit() → __sk_dst_check()), when both handle the same obsolete dst from sk->sk_dst_cache: the UDPv6 side takes an extra reference and atomically steals and releases the cached dst, while the L2TP side, using a stale cached pointer, still calls dst_release() on it, and together these updates produce an extra final dst_release() on that dst, triggering rcuref - imbalanced put(). The Race Condition: Initial: sk->sk_dst_cache = dst ref(dst) = 1 Thread 1: sk_dst_check() Thread 2: __sk_dst_check() ------------------------ ---------------------------- sk_dst_get(sk): rcu_read_lock() dst = rcu_dereference(sk->sk_dst_cache) rcuref_get(dst) succeeds rcu_read_unlock() // ref = 2 dst = __sk_dst_get(sk) // reads same dst from sk_dst_cache // ref still = 2 (no extra get) [both see dst obsolete & check() == NULL] sk_dst_reset(sk): old = xchg(&sk->sk_dst_cache, NULL) // old = dst dst_release(old) // drop cached ref // ref: 2 -> 1 RCU_INIT_POINTER(sk->sk_dst_cache, NULL) // cache already NULL after xchg dst_release(dst) // ref: 1 -> 0 dst_release(dst) // tries to drop its own ref after final put // rcuref_put_slowpath() -> "rcuref - imbalanced put()" Make L2TP's IPv6 transmit path stop using inet6_csk_xmit() (and thus __sk_dst_check()) and instead open-code the same routing and transmit sequence using the existing sk_dst_check() with dst reference counting and ip6_dst_lookup_flow(). The new code builds a flowi6 from the socket fields in the same way as inet6_csk_route_socket(), then performs dst lookup using sk_dst_check() with proper reference counting, attaches the resulting dst to the skb via skb_dst_set(), and finally invokes ip6_xmit() for transmission. This makes both the UDPv6 and L2TP IPv6 paths use the same dst-cache handling logic for a given socket and removes the possibility that the lockless sk_dst_check() and the locked __sk_dst_check() concurrently drop the same cached dst and trigger the rcuref - imbalanced put() warning under concurrent traffic. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: b0270e91014d ("ipv4: add a sock pointer to ip_queue_xmit()") Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/l2tp/l2tp_core.c | 60 +++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 57 insertions(+), 3 deletions(-) diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c index f85b383811d5..79a5f635b049 100644 --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -1000,19 +1000,73 @@ static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf) return bufp - optr; } +#if IS_ENABLED(CONFIG_IPV6) +static int l2tp_xmit_ipv6(struct sock *sk, struct sk_buff *skb) +{ + struct ipv6_pinfo *np = inet6_sk(sk); + struct inet_sock *inet = inet_sk(sk); + struct in6_addr *final_p, final; + struct dst_entry *dst; + struct flowi6 fl6; + int err; + + memset(&fl6, 0, sizeof(fl6)); + fl6.flowi6_proto = sk->sk_protocol; + fl6.daddr = sk->sk_v6_daddr; + fl6.saddr = np->saddr; + fl6.flowlabel = np->flow_label; + IP6_ECN_flow_xmit(sk, fl6.flowlabel); + + fl6.flowi6_oif = sk->sk_bound_dev_if; + fl6.flowi6_mark = sk->sk_mark; + fl6.fl6_sport = inet->inet_sport; + fl6.fl6_dport = inet->inet_dport; + fl6.flowi6_uid = sk->sk_uid; + + security_sk_classify_flow(sk, flowi6_to_flowi_common(&fl6)); + + rcu_read_lock(); + final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final); + rcu_read_unlock(); + + dst = sk_dst_check(sk, np->dst_cookie); + if (!dst) { + dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p); + if (IS_ERR(dst)) { + WRITE_ONCE(sk->sk_err_soft, -PTR_ERR(dst)); + sk->sk_route_caps = 0; + kfree_skb(skb); + return PTR_ERR(dst); + } + + ip6_dst_store(sk, dst_clone(dst), NULL, NULL); + } + + skb_dst_set(skb, dst); + fl6.daddr = sk->sk_v6_daddr; + + rcu_read_lock(); + err = ip6_xmit(sk, skb, &fl6, sk->sk_mark, rcu_dereference(np->opt), + np->tclass, sk->sk_priority); + rcu_read_unlock(); + return err; +} +#endif + /* Queue the packet to IP for output: tunnel socket lock must be held */ static int l2tp_xmit_queue(struct l2tp_tunnel *tunnel, struct sk_buff *skb, struct flowi *fl) { int err; + struct sock *sk = tunnel->sock; skb->ignore_df = 1; skb_dst_drop(skb); #if IS_ENABLED(CONFIG_IPV6) - if (l2tp_sk_is_v6(tunnel->sock)) - err = inet6_csk_xmit(tunnel->sock, skb, NULL); + if (l2tp_sk_is_v6(sk)) + err = l2tp_xmit_ipv6(sk, skb); else #endif - err = ip_queue_xmit(tunnel->sock, skb, fl); + err = ip_queue_xmit(sk, skb, fl); return err >= 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] mptcp: fix soft lockup in mptcp_recvmsg()
by Li Xiasong 17 Mar '26

17 Mar '26

Li Xiasong (1): mptcp: fix soft lockup in mptcp_recvmsg() Paolo Abeni (1): mptcp: fix MSG_PEEK stream corruption net/mptcp/protocol.c | 44 +++++++++++++++++++++++++++++++++----------- 1 file changed, 33 insertions(+), 11 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] l2tp: fix double dst_release() on sk_dst_cache race
by Li Xiasong 17 Mar '26

17 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8696 Reference: https://lore.kernel.org/netdev/20251215145537.5085-1-m.lobanov@rosa.ru/ ---------------------------------------- A reproducible rcuref - imbalanced put() warning is observed under IPv6 L2TP (pppol2tp) traffic with blackhole routes, indicating an imbalance in dst reference counting for routes cached in sk->sk_dst_cache and pointing to a subtle lifetime/synchronization issue between the helpers that validate and drop cached dst entries. rcuref - imbalanced put() WARNING: CPU: 0 PID: 899 at lib/rcuref.c:266 rcuref_put_slowpath+0x1ce/0x240 lib/rcuref.c:266 Modules linked in: CPSocket connected tcp:127.0.0.1:48148,server=on <-> 127.0.0.1:33750 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:rcuref_put_slowpath+0x1ce/0x240 lib/rcuref.c:266 Call Trace: <TASK> __rcuref_put include/linux/rcuref.h:97 [inline] rcuref_put include/linux/rcuref.h:153 [inline] dst_release+0x291/0x310 net/core/dst.c:167 __sk_dst_check+0x2d4/0x350 net/core/sock.c:604 __inet6_csk_dst_check net/ipv6/inet6_connection_sock.c:76 [inline] inet6_csk_route_socket+0x6ed/0x10c0 net/ipv6/inet6_connection_sock.c:104 inet6_csk_xmit+0x12f/0x740 net/ipv6/inet6_connection_sock.c:121 l2tp_xmit_queue net/l2tp/l2tp_core.c:1214 [inline] l2tp_xmit_core net/l2tp/l2tp_core.c:1309 [inline] l2tp_xmit_skb+0x1404/0x1910 net/l2tp/l2tp_core.c:1325 pppol2tp_sendmsg+0x3ca/0x550 net/l2tp/l2tp_ppp.c:302 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg net/socket.c:744 [inline] ____sys_sendmsg+0xab2/0xc70 net/socket.c:2609 ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2663 __sys_sendmmsg+0x188/0x450 net/socket.c:2749 __do_sys_sendmmsg net/socket.c:2778 [inline] __se_sys_sendmmsg net/socket.c:2775 [inline] __x64_sys_sendmmsg+0x98/0x100 net/socket.c:2775 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x64/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe6960ec719 </TASK> The race occurs between the lockless UDPv6 transmit path (udpv6_sendmsg() -> sk_dst_check()) and the locked L2TP/pppol2tp transmit path (pppol2tp_sendmsg() -> l2tp_xmit_skb() -> ... -> inet6_csk_xmit() → __sk_dst_check()), when both handle the same obsolete dst from sk->sk_dst_cache: the UDPv6 side takes an extra reference and atomically steals and releases the cached dst, while the L2TP side, using a stale cached pointer, still calls dst_release() on it, and together these updates produce an extra final dst_release() on that dst, triggering rcuref - imbalanced put(). The Race Condition: Initial: sk->sk_dst_cache = dst ref(dst) = 1 Thread 1: sk_dst_check() Thread 2: __sk_dst_check() ------------------------ ---------------------------- sk_dst_get(sk): rcu_read_lock() dst = rcu_dereference(sk->sk_dst_cache) rcuref_get(dst) succeeds rcu_read_unlock() // ref = 2 dst = __sk_dst_get(sk) // reads same dst from sk_dst_cache // ref still = 2 (no extra get) [both see dst obsolete & check() == NULL] sk_dst_reset(sk): old = xchg(&sk->sk_dst_cache, NULL) // old = dst dst_release(old) // drop cached ref // ref: 2 -> 1 RCU_INIT_POINTER(sk->sk_dst_cache, NULL) // cache already NULL after xchg dst_release(dst) // ref: 1 -> 0 dst_release(dst) // tries to drop its own ref after final put // rcuref_put_slowpath() -> "rcuref - imbalanced put()" Make L2TP's IPv6 transmit path stop using inet6_csk_xmit() (and thus __sk_dst_check()) and instead open-code the same routing and transmit sequence using the existing sk_dst_check() with dst reference counting and ip6_dst_lookup_flow(). The new code builds a flowi6 from the socket fields in the same way as inet6_csk_route_socket(), then performs dst lookup using sk_dst_check() with proper reference counting, attaches the resulting dst to the skb via skb_dst_set(), and finally invokes ip6_xmit() for transmission. This makes both the UDPv6 and L2TP IPv6 paths use the same dst-cache handling logic for a given socket and removes the possibility that the lockless sk_dst_check() and the locked __sk_dst_check() concurrently drop the same cached dst and trigger the rcuref - imbalanced put() warning under concurrent traffic. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: b0270e91014d ("ipv4: add a sock pointer to ip_queue_xmit()") Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/l2tp/l2tp_core.c | 60 +++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 57 insertions(+), 3 deletions(-) diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c index f85b383811d5..79a5f635b049 100644 --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -1000,19 +1000,73 @@ static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf) return bufp - optr; } +#if IS_ENABLED(CONFIG_IPV6) +static int l2tp_xmit_ipv6(struct sock *sk, struct sk_buff *skb) +{ + struct ipv6_pinfo *np = inet6_sk(sk); + struct inet_sock *inet = inet_sk(sk); + struct in6_addr *final_p, final; + struct dst_entry *dst; + struct flowi6 fl6; + int err; + + memset(&fl6, 0, sizeof(fl6)); + fl6.flowi6_proto = sk->sk_protocol; + fl6.daddr = sk->sk_v6_daddr; + fl6.saddr = np->saddr; + fl6.flowlabel = np->flow_label; + IP6_ECN_flow_xmit(sk, fl6.flowlabel); + + fl6.flowi6_oif = sk->sk_bound_dev_if; + fl6.flowi6_mark = sk->sk_mark; + fl6.fl6_sport = inet->inet_sport; + fl6.fl6_dport = inet->inet_dport; + fl6.flowi6_uid = sk->sk_uid; + + security_sk_classify_flow(sk, flowi6_to_flowi_common(&fl6)); + + rcu_read_lock(); + final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final); + rcu_read_unlock(); + + dst = sk_dst_check(sk, np->dst_cookie); + if (!dst) { + dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p); + if (IS_ERR(dst)) { + WRITE_ONCE(sk->sk_err_soft, -PTR_ERR(dst)); + sk->sk_route_caps = 0; + kfree_skb(skb); + return PTR_ERR(dst); + } + + ip6_dst_store(sk, dst_clone(dst), NULL, NULL); + } + + skb_dst_set(skb, dst); + fl6.daddr = sk->sk_v6_daddr; + + rcu_read_lock(); + err = ip6_xmit(sk, skb, &fl6, sk->sk_mark, rcu_dereference(np->opt), + np->tclass, sk->sk_priority); + rcu_read_unlock(); + return err; +} +#endif + /* Queue the packet to IP for output: tunnel socket lock must be held */ static int l2tp_xmit_queue(struct l2tp_tunnel *tunnel, struct sk_buff *skb, struct flowi *fl) { int err; + struct sock *sk = tunnel->sock; skb->ignore_df = 1; skb_dst_drop(skb); #if IS_ENABLED(CONFIG_IPV6) - if (l2tp_sk_is_v6(tunnel->sock)) - err = inet6_csk_xmit(tunnel->sock, skb, NULL); + if (l2tp_sk_is_v6(sk)) + err = l2tp_xmit_ipv6(sk, skb); else #endif - err = ip_queue_xmit(tunnel->sock, skb, fl); + err = ip_queue_xmit(sk, skb, fl); return err >= 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP; } -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] arm64/mpam: Extending MPAM features and bugfix
by Quanmin Yan 17 Mar '26

17 Mar '26

Extending the MPAM features and bugfix in OLK-5.10. Quanmin Yan (3): arm64/mpam: Add quirk to shrink MATA PMG range arm64/mpam: Add quirk for MPAM MSMON_MBWU monitor NRDY bit arm64/mpam: Allow MBMIN to be set to 0 arch/arm64/kernel/mpam/mpam_device.c | 33 +++++++++++++++++++++++---- arch/arm64/kernel/mpam/mpam_resctrl.c | 8 ++++--- 2 files changed, 34 insertions(+), 7 deletions(-) -- 2.43.0

2 4

[PATCH OLK-5.10 0/3] arm64/mpam: Extending MPAM features and bugfix
by Quanmin Yan 17 Mar '26

17 Mar '26

Extending the MPAM features and bugfix in OLK-5.10. Quanmin Yan (3): arm64/mpam: Add quirk to shrink MATA PMG range arm64/mpam: Add quirk for MPAM MSMON_MBWU monitor NRDY bit arm64/mpam: Allow MBMIN to be set to 0 arch/arm64/kernel/mpam/mpam_device.c | 33 +++++++++++++++++++++++---- arch/arm64/kernel/mpam/mpam_resctrl.c | 8 ++++--- 2 files changed, 34 insertions(+), 7 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6] bfq: Lock when clearing the q->elevator entry
by Zizhi Wo 16 Mar '26

16 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8717 -------------------------------- In the error path out_free of bfq_init_queue(), the last reference count of eq->kobj is released, causing eq to be freed. Before the caller blk_mq_init_sched() executes "q->elevator = NULL", another process modifies the blkcgroup interface, such as disabling iocost, which triggers wbt_enable_default() to access the already freed elevator, leading to a UAF issue. Lock when clearing the q->elevator entry to solve this issue. And do cleanup on some repeated nulling processes. Fixes: 671fae5e5129 ("blk-wbt: don't enable throttling if default elevator is bfq") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- block/bfq-iosched.c | 3 +++ block/blk-mq-sched.c | 4 ++-- block/blk-wbt.c | 2 ++ block/elevator.c | 1 - 4 files changed, 7 insertions(+), 3 deletions(-) diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index a8ebf3962f11..a12f0196dc51 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -7417,6 +7417,9 @@ static int bfq_init_queue(struct request_queue *q, struct elevator_type *e) return 0; out_free: + spin_lock_irq(&q->queue_lock); + q->elevator = NULL; + spin_unlock_irq(&q->queue_lock); kfree(bfqd); kobject_put(&eq->kobj); return -ENOMEM; diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c index 7b48630b63a7..bb166403d311 100644 --- a/block/blk-mq-sched.c +++ b/block/blk-mq-sched.c @@ -499,8 +499,6 @@ int blk_mq_init_sched(struct request_queue *q, struct elevator_type *e) err_free_map_and_rqs: blk_mq_sched_free_rqs(q); blk_mq_sched_tags_teardown(q, flags); - - q->elevator = NULL; return ret; } @@ -550,5 +548,7 @@ void blk_mq_exit_sched(struct request_queue *q, struct elevator_queue *e) if (e->type->ops.exit_sched) e->type->ops.exit_sched(e); blk_mq_sched_tags_teardown(q, flags); + spin_lock_irq(&q->queue_lock); q->elevator = NULL; + spin_unlock_irq(&q->queue_lock); } diff --git a/block/blk-wbt.c b/block/blk-wbt.c index 6b81f2c47279..71ca08deb485 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -732,9 +732,11 @@ void wbt_enable_default(struct gendisk *disk) struct rq_qos *rqos; bool enable = IS_ENABLED(CONFIG_BLK_WBT_MQ); + spin_lock_irq(&q->queue_lock); if (q->elevator && test_bit(ELEVATOR_FLAG_DISABLE_WBT, &q->elevator->flags)) enable = false; + spin_unlock_irq(&q->queue_lock); /* Throttling already enabled? */ rqos = wbt_rq_qos(q); diff --git a/block/elevator.c b/block/elevator.c index ba072d8f660e..e80381765b3c 100644 --- a/block/elevator.c +++ b/block/elevator.c @@ -704,7 +704,6 @@ void elevator_disable(struct request_queue *q) elv_unregister_queue(q); elevator_exit(q); blk_queue_flag_clear(QUEUE_FLAG_SQ_SCHED, q); - q->elevator = NULL; q->nr_requests = q->tag_set->queue_depth; blk_add_trace_msg(q, "elv switch: none"); -- 2.39.2

2 1

[PATCH OLK-6.6] bfq: Lock when clearing the q->elevator entry
by Zizhi Wo 16 Mar '26

16 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8717 -------------------------------- In the error path out_free of bfq_init_queue(), the last reference count of eq->kobj is released, causing eq to be freed. Before the caller blk_mq_init_sched() executes "q->elevator = NULL", another process modifies the blkcgroup interface, such as disabling iocost, which triggers wbt_enable_default() to access the already freed elevator, leading to a UAF issue. Lock when clearing the q->elevator entry to solve this issue. And do cleanup on some repeated nulling processes. Fixes: 671fae5e5129 ("blk-wbt: don't enable throttling if default elevator is bfq") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> Signed-off-by: Zizhi Wo <wozizhi(a)huaweicloud.com> --- block/bfq-iosched.c | 3 +++ block/blk-mq-sched.c | 4 ++-- block/blk-wbt.c | 2 ++ block/elevator.c | 1 - 4 files changed, 7 insertions(+), 3 deletions(-) diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index a8ebf3962f11..a12f0196dc51 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -7417,6 +7417,9 @@ static int bfq_init_queue(struct request_queue *q, struct elevator_type *e) return 0; out_free: + spin_lock_irq(&q->queue_lock); + q->elevator = NULL; + spin_unlock_irq(&q->queue_lock); kfree(bfqd); kobject_put(&eq->kobj); return -ENOMEM; diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c index 7b48630b63a7..bb166403d311 100644 --- a/block/blk-mq-sched.c +++ b/block/blk-mq-sched.c @@ -499,8 +499,6 @@ int blk_mq_init_sched(struct request_queue *q, struct elevator_type *e) err_free_map_and_rqs: blk_mq_sched_free_rqs(q); blk_mq_sched_tags_teardown(q, flags); - - q->elevator = NULL; return ret; } @@ -550,5 +548,7 @@ void blk_mq_exit_sched(struct request_queue *q, struct elevator_queue *e) if (e->type->ops.exit_sched) e->type->ops.exit_sched(e); blk_mq_sched_tags_teardown(q, flags); + spin_lock_irq(&q->queue_lock); q->elevator = NULL; + spin_unlock_irq(&q->queue_lock); } diff --git a/block/blk-wbt.c b/block/blk-wbt.c index 6b81f2c47279..71ca08deb485 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -732,9 +732,11 @@ void wbt_enable_default(struct gendisk *disk) struct rq_qos *rqos; bool enable = IS_ENABLED(CONFIG_BLK_WBT_MQ); + spin_lock_irq(&q->queue_lock); if (q->elevator && test_bit(ELEVATOR_FLAG_DISABLE_WBT, &q->elevator->flags)) enable = false; + spin_unlock_irq(&q->queue_lock); /* Throttling already enabled? */ rqos = wbt_rq_qos(q); diff --git a/block/elevator.c b/block/elevator.c index ba072d8f660e..e80381765b3c 100644 --- a/block/elevator.c +++ b/block/elevator.c @@ -704,7 +704,6 @@ void elevator_disable(struct request_queue *q) elv_unregister_queue(q); elevator_exit(q); blk_queue_flag_clear(QUEUE_FLAG_SQ_SCHED, q); - q->elevator = NULL; q->nr_requests = q->tag_set->queue_depth; blk_add_trace_msg(q, "elv switch: none"); -- 2.39.2

2 1

[PATCH OLK-6.6] xattr: switch to CLASS(fd)
by Yongjian Sun 16 Mar '26

16 Mar '26

From: Al Viro <viro(a)zeniv.linux.org.uk> mainline inclusion from mainline-v6.13-rc1 commit a71874379ec8c6e788a61d71b3ad014a8d9a5c08 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13855 CVE: CVE-2024-14027 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reviewed-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Conflicts: fs/xattr.c [mainline 88a2f6468d01 not applied] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/xattr.c | 25 +++++++++---------------- 1 file changed, 9 insertions(+), 16 deletions(-) diff --git a/fs/xattr.c b/fs/xattr.c index 7574d24b982e..44dffb1f90c5 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -810,16 +810,13 @@ SYSCALL_DEFINE4(lgetxattr, const char __user *, pathname, SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name, void __user *, value, size_t, size) { - struct fd f = fdget(fd); - ssize_t error = -EBADF; + CLASS(fd, f)(fd); if (!f.file) - return error; + return -EBADF; audit_file(f.file); - error = getxattr(file_mnt_idmap(f.file), f.file->f_path.dentry, + return getxattr(file_mnt_idmap(f.file), f.file->f_path.dentry, name, value, size); - fdput(f); - return error; } /* @@ -886,15 +883,12 @@ SYSCALL_DEFINE3(llistxattr, const char __user *, pathname, char __user *, list, SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size) { - struct fd f = fdget(fd); - ssize_t error = -EBADF; + CLASS(fd, f)(fd); if (!f.file) - return error; + return -EBADF; audit_file(f.file); - error = listxattr(f.file->f_path.dentry, list, size); - fdput(f); - return error; + return listxattr(f.file->f_path.dentry, list, size); } /* @@ -951,12 +945,12 @@ SYSCALL_DEFINE2(lremovexattr, const char __user *, pathname, SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name) { - struct fd f = fdget(fd); + CLASS(fd, f)(fd); char kname[XATTR_NAME_MAX + 1]; - int error = -EBADF; + int error; if (!f.file) - return error; + return -EBADF; audit_file(f.file); error = strncpy_from_user(kname, name, sizeof(kname)); @@ -971,7 +965,6 @@ SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name) f.file->f_path.dentry, kname); mnt_drop_write_file(f.file); } - fdput(f); return error; } -- 2.39.2

2 1

[PATCH OLK-6.6] arm64: Set __nocfi on swsusp_arch_resume()
by Lin Yujun 16 Mar '26

16 Mar '26

From: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> stable inclusion from stable-v6.6.122 commit 8557bdd9af8dd04911fba56ff92b17842b0b5c7f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13677 CVE: CVE-2026-23128 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e2f8216ca2d8e61a23cb6ec355616339667e0ba6 upstream. A DABT is reported[1] on an android based system when resume from hiberate. This happens because swsusp_arch_suspend_exit() is marked with SYM_CODE_*() and does not have a CFI hash, but swsusp_arch_resume() will attempt to verify the CFI hash when calling a copy of swsusp_arch_suspend_exit(). Given that there's an existing requirement that the entrypoint to swsusp_arch_suspend_exit() is the first byte of the .hibernate_exit.text section, we cannot fix this by marking swsusp_arch_suspend_exit() with SYM_FUNC_*(). The simplest fix for now is to disable the CFI check in swsusp_arch_resume(). Mark swsusp_arch_resume() as __nocfi to disable the CFI check. [1] [ 22.991934][ T1] Unable to handle kernel paging request at virtual address 0000000109170ffc [ 22.991934][ T1] Mem abort info: [ 22.991934][ T1] ESR = 0x0000000096000007 [ 22.991934][ T1] EC = 0x25: DABT (current EL), IL = 32 bits [ 22.991934][ T1] SET = 0, FnV = 0 [ 22.991934][ T1] EA = 0, S1PTW = 0 [ 22.991934][ T1] FSC = 0x07: level 3 translation fault [ 22.991934][ T1] Data abort info: [ 22.991934][ T1] ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 [ 22.991934][ T1] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 22.991934][ T1] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 22.991934][ T1] [0000000109170ffc] user address but active_mm is swapper [ 22.991934][ T1] Internal error: Oops: 0000000096000007 [#1] PREEMPT SMP [ 22.991934][ T1] Dumping ftrace buffer: [ 22.991934][ T1] (ftrace buffer empty) [ 22.991934][ T1] Modules linked in: [ 22.991934][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.6.98-android15-8-g0b1d2aee7fc3-dirty-4k #1 688c7060a825a3ac418fe53881730b355915a419 [ 22.991934][ T1] Hardware name: Unisoc UMS9360-base Board (DT) [ 22.991934][ T1] pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 22.991934][ T1] pc : swsusp_arch_resume+0x2ac/0x344 [ 22.991934][ T1] lr : swsusp_arch_resume+0x294/0x344 [ 22.991934][ T1] sp : ffffffc08006b960 [ 22.991934][ T1] x29: ffffffc08006b9c0 x28: 0000000000000000 x27: 0000000000000000 [ 22.991934][ T1] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000820 [ 22.991934][ T1] x23: ffffffd0817e3000 x22: ffffffd0817e3000 x21: 0000000000000000 [ 22.991934][ T1] x20: ffffff8089171000 x19: ffffffd08252c8c8 x18: ffffffc080061058 [ 22.991934][ T1] x17: 00000000529c6ef0 x16: 00000000529c6ef0 x15: 0000000000000004 [ 22.991934][ T1] x14: ffffff8178c88000 x13: 0000000000000006 x12: 0000000000000000 [ 22.991934][ T1] x11: 0000000000000015 x10: 0000000000000001 x9 : ffffffd082533000 [ 22.991934][ T1] x8 : 0000000109171000 x7 : 205b5d3433393139 x6 : 392e32322020205b [ 22.991934][ T1] x5 : 000000010916f000 x4 : 000000008164b000 x3 : ffffff808a4e0530 [ 22.991934][ T1] x2 : ffffffd08058e784 x1 : 0000000082326000 x0 : 000000010a283000 [ 22.991934][ T1] Call trace: [ 22.991934][ T1] swsusp_arch_resume+0x2ac/0x344 [ 22.991934][ T1] hibernation_restore+0x158/0x18c [ 22.991934][ T1] load_image_and_restore+0xb0/0xec [ 22.991934][ T1] software_resume+0xf4/0x19c [ 22.991934][ T1] software_resume_initcall+0x34/0x78 [ 22.991934][ T1] do_one_initcall+0xe8/0x370 [ 22.991934][ T1] do_initcall_level+0xc8/0x19c [ 22.991934][ T1] do_initcalls+0x70/0xc0 [ 22.991934][ T1] do_basic_setup+0x1c/0x28 [ 22.991934][ T1] kernel_init_freeable+0xe0/0x148 [ 22.991934][ T1] kernel_init+0x20/0x1a8 [ 22.991934][ T1] ret_from_fork+0x10/0x20 [ 22.991934][ T1] Code: a9400a61 f94013e0 f9438923 f9400a64 (b85fc110) Co-developed-by: Jeson Gao <jeson.gao(a)unisoc.com> Signed-off-by: Jeson Gao <jeson.gao(a)unisoc.com> Signed-off-by: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Acked-by: Will Deacon <will(a)kernel.org> Acked-by: Mark Rutland <mark.rutland(a)arm.com> Cc: <stable(a)vger.kernel.org> [catalin.marinas(a)arm.com: commit log updated by Mark Rutland] Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- arch/arm64/kernel/hibernate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c index 02870beb271e..17c436387f1b 100644 --- a/arch/arm64/kernel/hibernate.c +++ b/arch/arm64/kernel/hibernate.c @@ -394,11 +394,11 @@ int swsusp_arch_suspend(void) * Setup then Resume from the hibernate image using swsusp_arch_suspend_exit(). * * Memory allocated by get_safe_page() will be dealt with by the hibernate code, * we don't need to free it here. */ -int swsusp_arch_resume(void) +int __nocfi swsusp_arch_resume(void) { int rc; void *zero_page; size_t exit_size; pgd_t *tmp_pg_dir; -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] arm64/mpam: Extending MPAM features and bugfix
by Quanmin Yan 16 Mar '26

16 Mar '26

Extending the MPAM features and bugfix in OLK-5.10. Quanmin Yan (3): arm64/mpam: Add quirk to shrink MATA PMG range arm64/mpam: Add quirk for MPAM MSMON_MBWU monitor NRDY bit arm64/mpam: Allow MBMIN to be set to 0 arch/arm64/kernel/mpam/mpam_device.c | 33 +++++++++++++++++++++++---- arch/arm64/kernel/mpam/mpam_resctrl.c | 7 +++--- 2 files changed, 33 insertions(+), 7 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6] arm64/xcall: add research papers reference in file headers
by Yipeng Zou 16 Mar '26

16 Mar '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8729 -------------------------------------------------------------------- Add research paper references to xcall feature source files to document the academic foundation of the design. Reference papers: 1. XPC (ISCA 2019) - XPC: Architectural Support for Secure and Efficient Cross Process Call Authors: Dong Du, Zhichao Hua, Yubin Xia, Binyu Zang, Haibo Chen 2. Boosting IPC (TOCS 2022) - Boosting Inter-Process Communication with Architectural Support Authors: Yubin Xia, Dong Du, Zhichao Hua, Binyu Zang, Haibo Chen, Haibing Guan Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- arch/arm64/include/asm/xcall.h | 9 +++++++++ arch/arm64/kernel/xcall/core.c | 7 +++++++ arch/arm64/kernel/xcall/entry.S | 7 ++++++- arch/arm64/kernel/xcall/proc.c | 7 +++++++ arch/arm64/kernel/xcall/xcall.c | 7 ++++++- include/linux/xcall.h | 7 +++++++ 6 files changed, 42 insertions(+), 2 deletions(-) diff --git a/arch/arm64/include/asm/xcall.h b/arch/arm64/include/asm/xcall.h index 0d0c4c794010..6ea03cc6cb20 100644 --- a/arch/arm64/include/asm/xcall.h +++ b/arch/arm64/include/asm/xcall.h @@ -1,4 +1,13 @@ /* SPDX-License-Identifier: GPL-2.0 */ +/* + * ARM64-specific xcall definitions and inline functions. + * + * Inspired by: + * 1. XPC (ISCA 2019) - Dong Du, Zhichao Hua, Yubin Xia, Binyu Zang, Haibo Chen; + * 2. Boosting IPC (TOCS 2022) - Yubin Xia, Dong Du, Zhichao Hua, Binyu Zang, + * Haibo Chen, Haibing Guan. + */ + #ifndef __ASM_XCALL_H #define __ASM_XCALL_H diff --git a/arch/arm64/kernel/xcall/core.c b/arch/arm64/kernel/xcall/core.c index 5dc6e4aebf11..5dc8e3b505b4 100644 --- a/arch/arm64/kernel/xcall/core.c +++ b/arch/arm64/kernel/xcall/core.c @@ -1,6 +1,13 @@ // SPDX-License-Identifier: GPL-2.0-only /* + * xcall core implementation: syscall interception and xcall_area management. + * * Copyright (C) 2025 Huawei Limited. + * + * Inspired by: + * 1. XPC (ISCA 2019) - Dong Du, Zhichao Hua, Yubin Xia, Binyu Zang, Haibo Chen; + * 2. Boosting IPC (TOCS 2022) - Yubin Xia, Dong Du, Zhichao Hua, Binyu Zang, + * Haibo Chen, Haibing Guan. */ #define pr_fmt(fmt) "xcall: " fmt diff --git a/arch/arm64/kernel/xcall/entry.S b/arch/arm64/kernel/xcall/entry.S index f531f1e17f48..d5ed68db1547 100644 --- a/arch/arm64/kernel/xcall/entry.S +++ b/arch/arm64/kernel/xcall/entry.S @@ -1,10 +1,15 @@ /* SPDX-License-Identifier: GPL-2.0-only */ /* - * Low-level exception handling code + * xcall low-level exception handling and register saving. * * Copyright (C) 2012 ARM Ltd. * Authors: Catalin Marinas <catalin.marinas(a)arm.com> * Will Deacon <will.deacon(a)arm.com> + * + * Inspired by: + * 1. XPC (ISCA 2019) - Dong Du, Zhichao Hua, Yubin Xia, Binyu Zang, Haibo Chen; + * 2. Boosting IPC (TOCS 2022) - Yubin Xia, Dong Du, Zhichao Hua, Binyu Zang, + * Haibo Chen, Haibing Guan. */ .macro hw_xcall_save_base_regs diff --git a/arch/arm64/kernel/xcall/proc.c b/arch/arm64/kernel/xcall/proc.c index 9dea182340ef..f2fcc9c8eaa2 100644 --- a/arch/arm64/kernel/xcall/proc.c +++ b/arch/arm64/kernel/xcall/proc.c @@ -1,6 +1,13 @@ // SPDX-License-Identifier: GPL-2.0-only /* + * xcall proc interface for attach/detach operations. + * * Copyright (C) 2025 Huawei Limited. + * + * Inspired by: + * 1. XPC (ISCA 2019) - Dong Du, Zhichao Hua, Yubin Xia, Binyu Zang, Haibo Chen; + * 2. Boosting IPC (TOCS 2022) - Yubin Xia, Dong Du, Zhichao Hua, Binyu Zang, + * Haibo Chen, Haibing Guan. */ #include <linux/namei.h> diff --git a/arch/arm64/kernel/xcall/xcall.c b/arch/arm64/kernel/xcall/xcall.c index f3fc89ef8e2f..a239f8b1b88a 100644 --- a/arch/arm64/kernel/xcall/xcall.c +++ b/arch/arm64/kernel/xcall/xcall.c @@ -1,8 +1,13 @@ // SPDX-License-Identifier: GPL-2.0-only /* - * xcall related code + * xcall task lifecycle management and context switch implementation. * * Copyright (C) 2025 Huawei Ltd. + * + * Inspired by: + * 1. XPC (ISCA 2019) - Dong Du, Zhichao Hua, Yubin Xia, Binyu Zang, Haibo Chen; + * 2. Boosting IPC (TOCS 2022) - Yubin Xia, Dong Du, Zhichao Hua, Binyu Zang, + * Haibo Chen, Haibing Guan. */ #include <linux/bitmap.h> diff --git a/include/linux/xcall.h b/include/linux/xcall.h index 26c60cd3dd38..222bd2cfb843 100644 --- a/include/linux/xcall.h +++ b/include/linux/xcall.h @@ -1,6 +1,13 @@ /* SPDX-License-Identifier: GPL-2.0-only */ /* + * xcall data structures and function declarations. + * * Copyright (C) 2025 Huawei. + * + * Inspired by: + * 1. XPC (ISCA 2019) - Dong Du, Zhichao Hua, Yubin Xia, Binyu Zang, Haibo Chen; + * 2. Boosting IPC (TOCS 2022) - Yubin Xia, Dong Du, Zhichao Hua, Binyu Zang, + * Haibo Chen, Haibing Guan. */ #ifndef _LINUX_XCALL_H -- 2.34.1

2 1

[PATCH openEuler-26.09] tools: Add maio-utils tool
by Hongbo Li 16 Mar '26

16 Mar '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8613 -------------------------------- This is a userspace tool for MFS to provide: programmable strategy framework. Some basic strategies have added in test, and more flexible strategies can be written based on this framework. Signed-off-by: Hongbo Li <lihongbo22(a)huawei.com> --- tools/mfs/maio-utils/CMakeLists.txt | 101 ++++ tools/mfs/maio-utils/README.md | 17 + tools/mfs/maio-utils/build/build.sh | 91 +++ .../mfs/maio-utils/include/client/fs_client.h | 17 + tools/mfs/maio-utils/include/inner/inner.h | 37 ++ tools/mfs/maio-utils/include/loader/loader.h | 10 + tools/mfs/maio-utils/include/maio.h | 53 ++ .../maio-utils/include/parser/req_parser.h | 13 + tools/mfs/maio-utils/include/policy/policy.h | 17 + tools/mfs/maio-utils/include/uapi/mfs.h | 62 ++ tools/mfs/maio-utils/src/CMakeLists.txt | 42 ++ .../mfs/maio-utils/src/client/CMakeLists.txt | 17 + tools/mfs/maio-utils/src/client/fs_client.c | 359 ++++++++++++ .../mfs/maio-utils/src/loader/CMakeLists.txt | 18 + tools/mfs/maio-utils/src/loader/loader.c | 144 +++++ tools/mfs/maio-utils/src/main.c | 156 +++++ .../mfs/maio-utils/src/parser/CMakeLists.txt | 16 + tools/mfs/maio-utils/src/parser/req_parser.c | 313 ++++++++++ .../mfs/maio-utils/src/policy/CMakeLists.txt | 16 + tools/mfs/maio-utils/src/policy/policy.c | 114 ++++ tools/mfs/maio-utils/test/Makefile | 26 + tools/mfs/maio-utils/test/README.md | 61 ++ tools/mfs/maio-utils/test/strategy_demo.c | 45 ++ .../mfs/maio-utils/test/strategy_generate.cpp | 296 ++++++++++ .../mfs/maio-utils/test/strategy_prefetch.cpp | 150 +++++ tools/mfs/maio-utils/test/strategy_prefetch.h | 21 + tools/mfs/maio-utils/test/strategy_replay.cpp | 540 ++++++++++++++++++ tools/mfs/maio-utils/test/strategy_template.h | 21 + tools/mfs/maio-utils/test/strategy_toend.c | 46 ++ tools/mfs/maio-utils/test/trace_analyse.py | 87 +++ tools/mfs/maio-utils/test/trace_gen.py | 116 ++++ 31 files changed, 3022 insertions(+) create mode 100644 tools/mfs/maio-utils/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/README.md create mode 100644 tools/mfs/maio-utils/build/build.sh create mode 100644 tools/mfs/maio-utils/include/client/fs_client.h create mode 100644 tools/mfs/maio-utils/include/inner/inner.h create mode 100644 tools/mfs/maio-utils/include/loader/loader.h create mode 100644 tools/mfs/maio-utils/include/maio.h create mode 100644 tools/mfs/maio-utils/include/parser/req_parser.h create mode 100644 tools/mfs/maio-utils/include/policy/policy.h create mode 100644 tools/mfs/maio-utils/include/uapi/mfs.h create mode 100644 tools/mfs/maio-utils/src/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/client/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/client/fs_client.c create mode 100644 tools/mfs/maio-utils/src/loader/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/loader/loader.c create mode 100644 tools/mfs/maio-utils/src/main.c create mode 100644 tools/mfs/maio-utils/src/parser/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/parser/req_parser.c create mode 100644 tools/mfs/maio-utils/src/policy/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/policy/policy.c create mode 100644 tools/mfs/maio-utils/test/Makefile create mode 100644 tools/mfs/maio-utils/test/README.md create mode 100644 tools/mfs/maio-utils/test/strategy_demo.c create mode 100644 tools/mfs/maio-utils/test/strategy_generate.cpp create mode 100644 tools/mfs/maio-utils/test/strategy_prefetch.cpp create mode 100644 tools/mfs/maio-utils/test/strategy_prefetch.h create mode 100644 tools/mfs/maio-utils/test/strategy_replay.cpp create mode 100644 tools/mfs/maio-utils/test/strategy_template.h create mode 100644 tools/mfs/maio-utils/test/strategy_toend.c create mode 100644 tools/mfs/maio-utils/test/trace_analyse.py create mode 100644 tools/mfs/maio-utils/test/trace_gen.py diff --git a/tools/mfs/maio-utils/CMakeLists.txt b/tools/mfs/maio-utils/CMakeLists.txt new file mode 100644 index 000000000000..a13fe2bf1d7f --- /dev/null +++ b/tools/mfs/maio-utils/CMakeLists.txt @@ -0,0 +1,101 @@ +#******************************************************************************* +#******************************************************************************* + +cmake_minimum_required(VERSION 3.0) +cmake_policy(SET CMP0057 NEW) + +project(maio) + +#******************************************************************************* +#******************************************************************************* + +add_definitions(-D__LINUX_USR__) +add_definitions(-D__USE_GNU) +add_definitions(-D__POSIX_SOURCE) +add_definitions(-D_GNU_SOURCE) +add_definitions(-D_FILE_OFFSET_BITS=64) + +#******************************************************************************* +#******************************************************************************* + +include(TestBigEndian) + +TEST_BIG_ENDIAN(BIGENDIAN) + if (${BIGENDIAN}) + message(">>> Big Endian") + add_definitions(-D_CMAKE_BIGENDIAN) + else() + message(">>> Little Endian") + endif(${BIGENDIAN}) + +#******************************************************************************* +#******************************************************************************* + +EXECUTE_PROCESS(COMMAND uname -m COMMAND tr -d '\n' OUTPUT_VARIABLE ARCH) +if(${ARCH} STREQUAL "x86_64" OR ${ARCH} STREQUAL "aarch64") + message(STATUS "Architecture: ${ARCH}") +else() + message(STATUS "Invalid Architecture: ${ARCH}") + return() +endif() + +#******************************************************************************* +#******************************************************************************* + +set(BASE_FLAGS "-g -Wall -Werror -fno-strict-overflow -rdynamic") +set(SP_C_FLAGS "-std=gnu99") +set(SP_C++_FLAGS "-std=c++11") +set(SP_RELEASE_FLAGS "-O2") +set(SP_DEBUG_FLAGS "-O0") +set(SEC_REQ_FLAGS "-fstack-protector-all -fPIE -pie -fPIC -Wl,-z,relro,-z,now,-z,noexecstack") +set(SEC_SUG_BASE_FLAGS "-Wformat=2") +set(SEC_SUG_SP_C_FLAGS "-Wshadow") + +set(C_FLAGS "${BASE_FLAGS} ${SP_C_FLAGS}") +set(C++_FLAGS "${BASE_FLAGS} ${SP_C++_FLAGS}") +set(SEC_C_FLAGS "${SEC_REQ_FLAGS} ${SEC_SUG_BASE_FLAGS} ${SEC_SUG_SP_C_FLAGS}") +set(SEC_C++_FLAGS "${SEC_REQ_FLAGS} ${SEC_SUG_BASE_FLAGS}") +set(DEPC_FLAGS "-Wno-error=deprecated-declarations -Wno-deprecated-declarations") + +if(CMAKE_BUILD_TYPE MATCHES "Release") + message(">>> Release Mode") + set(CMAKE_C_FLAGS "${C_FLAGS} ${SP_RELEASE_FLAGS} ${SEC_C_FLAGS}") + set(CMAKE_CXX_FLAGS "${C++_FLAGS} ${SP_RELEASE_FLAGS} ${SEC_C++_FLAGS} ${DEPC_FLAGS}") +else() + message(">>> Debug Mode") + add_definitions(-D_DEBUG) + set(CMAKE_C_FLAGS "${C_FLAGS} ${SP_DEBUG_FLAGS} ${SEC_C_FLAGS}") + set(CMAKE_CXX_FLAGS "${C++_FLAGS} ${SP_DEBUG_FLAGS} ${SEC_C++_FLAGS} ${DEPC_FLAGS}") + set(COVERAGE_FLAGS "-coverage") + set(COVERAGE_LINK "gcov") +endif() + +message(STATUS ">>> Source Dir: " ${PROJECT_SOURCE_DIR}) +message(STATUS ">>> Binary Dir: " ${PROJECT_BINARY_DIR}) +message(STATUS ">>> C_FLAGS : " ${CMAKE_C_FLAGS}) +message(STATUS ">>> CXX_FLAGS : " ${CMAKE_CXX_FLAGS}) + +#******************************************************************************* +#******************************************************************************* + +set(EXECUTABLE_OUTPUT_PATH ${PROJECT_BINARY_DIR}/bin) + +#******************************************************************************* +#******************************************************************************* + +if(DEFINED THIRD_PARTY) + message(">>> third_party: ${THIRD_PARTY}") +else() + set(THIRD_PARTY ${PROJECT_SOURCE_DIR}/lib) +endif() + +set(INFRA_DIR ${PROJECT_SOURCE_DIR}/infrastructure) +set(SECUREC_DIR ${THIRD_PARTY}/securec) +set(ZLOG_DIR ${THIRD_PARTY}/zlog) +set(LIBNUMA_DIR ${THIRD_PARTY}/libnuma) + +#******************************************************************************* +#******************************************************************************* + +add_subdirectory(infrastructure) +add_subdirectory(src) diff --git a/tools/mfs/maio-utils/README.md b/tools/mfs/maio-utils/README.md new file mode 100644 index 000000000000..40477bebf130 --- /dev/null +++ b/tools/mfs/maio-utils/README.md @@ -0,0 +1,17 @@ +# maio-utils + +#### How to build + +1. prepare thirdparty by using: +``` +git clone -b threadpool_bind https://github.com/hb-lee/infrastructure.git infrastructure +git clone -b 1.2.18 https://github.com/HardySimpson/zlog.git thirdparty/zlog +git clone https://github.com/chriszt/securec.git thirdparty/securec +git clone -b v2.0.19 https://github.com/numactl/numactl.git thirdparty/libnuma +``` +2. cd build +3. bash build.sh prepare # only once. +4. bash build.sh build # [debug|release] + +#### How to run +Run with `./maio -m ${MNTPOINT}`, here ${MNTPOINT} means the mfs mount point. If you want to use some strategies, you can run with `./maio -m ${MNTPOINT} -s ${STRATEGYLIB}` where ${STRATEGYLIB} is your strategy library. Some examples are provided in `test` directory. diff --git a/tools/mfs/maio-utils/build/build.sh b/tools/mfs/maio-utils/build/build.sh new file mode 100644 index 000000000000..91b49d3d6bf8 --- /dev/null +++ b/tools/mfs/maio-utils/build/build.sh @@ -0,0 +1,91 @@ +#!/bin/bash + +LOCAL_PATH="$(readlink -e "$(dirname "$0")")" +PRJ_PATH="$(readlink -e "${LOCAL_PATH}/..")" +THIRD_SUB="${PRJ_PATH}/thirdparty" +Lib_PATH="${PRJ_PATH}/lib" + +ARCH=$(uname -m) + +function build_zlog() { + local zlog_dir=${THIRD_SUB}/zlog + local build_path=${zlog_dir}/build + mkdir ${build_path} + mkdir -p ${Lib_PATH}/zlog + cd ${zlog_dir} + make PREFIX=`pwd`/build/zlog + make PREFIX=`pwd`/build/zlog install + cp -rdp ${build_path}/zlog/include ${Lib_PATH}/zlog + cp -rdp ${build_path}/zlog/lib ${Lib_PATH}/zlog + cd - +} + +function build_securec() { + local securec_dir=${THIRD_SUB}/securec + local securec_lib=${securec_dir}/build/securec/lib + mkdir -p ${securec_lib} + mkdir -p ${Lib_PATH}/securec + cd ${securec_dir} + if [ "${ARCH}" = "aarch64" ]; then + make -f aarch64-so.mk + else + make -f x86-so.mk + fi + cp -rdp include build/securec + cp libsecurec.so build/securec/lib + cp -rdp build/securec/include ${Lib_PATH}/securec + cp -rdp build/securec/lib ${Lib_PATH}/securec + cd - +} + +function build_libnuma() { + local libnuma_dir=${THIRD_SUB}/libnuma + local build_path=${libnuma_dir}/build + mkdir ${build_path} + mkdir -p ${Lib_PATH}/libnuma + cd ${libnuma_dir} + ./autogen.sh + ./configure --prefix=`pwd`/build + make -j4 + make install + cp -rdp build/include ${Lib_PATH}/libnuma + cp -rdp build/lib ${Lib_PATH}/libnuma + cd - +} + +function prepare_thirdparty() { + build_jsoncpp + build_zlog + build_securec + build_libnuma +} + +function build_program() { + local BUILD_TYPE=$1 + + set -x + if [ "${BUILD_TYPE}" == "release" ]; then + cmake .. -DCMAKE_BUILD_TYPE=Release + else + cmake .. -DCMAKE_BUILD_TYPE=Debug + fi + set +x + + make clean + make VERBOSE=1 -j +} + +function main() { + local ACTION="$1" + local PARAMETER="$2" + + if [ "${ACTION}" == "prepare" ]; then + prepare_thirdparty + fi + if [ "$ACTION" == "build" ]; then + build_program $PARAMETER + fi +} + +main $@ +exit $? diff --git a/tools/mfs/maio-utils/include/client/fs_client.h b/tools/mfs/maio-utils/include/client/fs_client.h new file mode 100644 index 000000000000..df3a086e317a --- /dev/null +++ b/tools/mfs/maio-utils/include/client/fs_client.h @@ -0,0 +1,17 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _FS_CLIENT_H_ +#define _FS_CLIENT_H_ + +#include <stdint.h> + +int fs_evict_by_path(const char *path, uint64_t off, uint64_t len); +int fs_load_by_path(const char *path, uint64_t off, uint64_t len); +int fs_load_by_fd(int fd, uint64_t off, uint64_t len); +int fs_sync_by_path(const char *path, void *buf, uint64_t off, uint64_t len); + +int fs_client_init(const char *source); +void fs_client_exit(void); + +#endif diff --git a/tools/mfs/maio-utils/include/inner/inner.h b/tools/mfs/maio-utils/include/inner/inner.h new file mode 100644 index 000000000000..fbb87e13b1bb --- /dev/null +++ b/tools/mfs/maio-utils/include/inner/inner.h @@ -0,0 +1,37 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _INNER_H_ +#define _INNER_H_ + +#include <time.h> +#include <stdint.h> + +static inline uint64_t _get_ts(void) +{ + struct timespec now = {0}; + (void)clock_gettime(CLOCK_MONOTONIC_COARSE, &now); + return (uint64_t)now.tv_sec; +} + +/* io context for loader and writeback */ +struct io_context { + uint32_t id; /* msg id */ + uint64_t off; /* io offset in fd */ + uint64_t len; /* io length */ + uint16_t numaid; /* numa node of this io, -1 means non-bind */ + int fd; /* io file handle */ + char *path; /* fullpath of this io */ + void *buf; /* flighting buffer for writeback */ + + uint64_t seq; + + void *private; + void (*end_io)(int ret, void *private); +}; + +void loader_update_curseq(uint64_t seq); +int loader_evict_submit(struct io_context *ioctx); +int loader_io_submit(struct io_context *ioctx); + +#endif diff --git a/tools/mfs/maio-utils/include/loader/loader.h b/tools/mfs/maio-utils/include/loader/loader.h new file mode 100644 index 000000000000..7bf0f163b292 --- /dev/null +++ b/tools/mfs/maio-utils/include/loader/loader.h @@ -0,0 +1,10 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _LOADER_H_ +#define _LOADER_H_ + +int loader_init(void); +void loader_exit(void); + +#endif diff --git a/tools/mfs/maio-utils/include/maio.h b/tools/mfs/maio-utils/include/maio.h new file mode 100644 index 000000000000..a508d5b1fa27 --- /dev/null +++ b/tools/mfs/maio-utils/include/maio.h @@ -0,0 +1,53 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _MAIO_H_ +#define _MAIO_H_ + +#ifdef __cplusplus +extern "C" { +#endif + +#include <stdint.h> + +struct maio_entry { + char *fpath; + uint64_t toff; + uint64_t tlen; + uint8_t tnuma; + uint64_t seq; +}; + +struct maio { + /* IN */ + int fd; + uint64_t off; + uint64_t len; + int pid; + uint8_t op; + uint64_t ts; + uint32_t cksz; + + /* OUT */ + uint16_t flags; +#define MAIO_WITH_SEQ 0x0001 + uint64_t curseq; + struct maio_entry entries[]; +}; + +struct maio_operation { + int max_io; + int (*init) (void); + void (*exit) (void); + int (*load) (struct maio **io); + int (*evict) (struct maio **io); +}; + +char *_get_fullpath(char *fpath, int fd); +void maio_preload(struct maio *maio, int nio); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/tools/mfs/maio-utils/include/parser/req_parser.h b/tools/mfs/maio-utils/include/parser/req_parser.h new file mode 100644 index 000000000000..bcb23474b58b --- /dev/null +++ b/tools/mfs/maio-utils/include/parser/req_parser.h @@ -0,0 +1,13 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef __REQ_PARSER_H__ +#define __REQ_PARSER_H__ + +#include <stdint.h> + +int parser_init(uint32_t fs_mode, const char *mntpoint); +void parser_destory(void); +int maio_parse_req(void *buf, int size); + +#endif diff --git a/tools/mfs/maio-utils/include/policy/policy.h b/tools/mfs/maio-utils/include/policy/policy.h new file mode 100644 index 000000000000..954d25edc894 --- /dev/null +++ b/tools/mfs/maio-utils/include/policy/policy.h @@ -0,0 +1,17 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _POLICY_H_ +#define _POLICY_H_ + +#include "maio.h" + +int policy_max_io(void); +int policy_load(struct maio **io); +int policy_evict(struct maio **io); +int policy_register(const char *path); +void policy_unregister(void); +int policy_init(void); +void policy_exit(void); + +#endif diff --git a/tools/mfs/maio-utils/include/uapi/mfs.h b/tools/mfs/maio-utils/include/uapi/mfs.h new file mode 100644 index 000000000000..a7d5882b5e50 --- /dev/null +++ b/tools/mfs/maio-utils/include/uapi/mfs.h @@ -0,0 +1,62 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ + +#ifndef _UAPI_LINUX_MFS_H +#define _UAPI_LINUX_MFS_H + +#include <linux/types.h> +#include <linux/ioctl.h> + +enum mfs_opcode { + MFS_OP_READ = 0, + MFS_OP_FAULT, + MFS_OP_FAROUND, +}; + +enum { + MFS_MODE_NONE = 0, + MFS_MODE_LOCAL, + MFS_MODE_REMOTE, +}; + +struct mfs_ioc_ra { + __u64 off; + __u64 len; +}; + +struct mfs_ioc_done { + __u32 id; + __u32 ret; +}; + +struct mfs_ioc_rpath { + __u16 max; + __u16 len; + __u8 d[]; +}; + +#define MFS_IOC_RA _IOW(0xbc, 1, struct mfs_ioc_ra) +#define MFS_IOC_DONE _IOW(0xbc, 2, struct mfs_ioc_done) +#define MFS_IOC_RPATH _IOWR(0xbc, 3, struct mfs_ioc_rpath) + +struct mfs_ioc_fsinfo { + __u8 mode; /* 0: none, 1: local, 2: remote */ +}; + +#define MFS_IOC_FSINFO _IOR(0xbd, 1, struct mfs_ioc_fsinfo) + +struct mfs_msg { + __u8 version; + __u8 opcode; + __u16 len; + __u32 fd; + __u32 id; + __u8 data[]; +}; + +struct mfs_read { + __u64 off; + __u64 len; + __s32 pid; +}; + +#endif /* _UAPI_LINUX_MFS_H */ diff --git a/tools/mfs/maio-utils/src/CMakeLists.txt b/tools/mfs/maio-utils/src/CMakeLists.txt new file mode 100644 index 000000000000..fd053a8bd081 --- /dev/null +++ b/tools/mfs/maio-utils/src/CMakeLists.txt @@ -0,0 +1,42 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${PROJECT_SOURCE_DIR}/include) +include_directories(${PROJECT_SOURCE_DIR}/include/inner) +include_directories(${PROJECT_SOURCE_DIR}/include/uapi) +include_directories(${PROJECT_SOURCE_DIR}/include/client) +include_directories(${PROJECT_SOURCE_DIR}/include/loader) +include_directories(${PROJECT_SOURCE_DIR}/include/policy) +include_directories(${PROJECT_SOURCE_DIR}/include/monitor) +include_directories(${PROJECT_SOURCE_DIR}/include/parser) + +include_directories(${INFRA_DIR}/include) +include_directories(${SECUREC_DIR}/include) +include_directories(${ZLOG_DIR}/include) +include_directories(${LIBNUMA_DIR}/include) + +#******************************************************************************* +#******************************************************************************* + +link_directories(${PROJECT_BINARY_DIR}/lib) +link_directories(${SECUREC_DIR}/lib) +link_directories(${ZLOG_DIR}/lib) +link_directories(${LIBNUMA_DIR}/lib) + +#******************************************************************************* +#******************************************************************************* + +add_subdirectory(client) +add_subdirectory(loader) +add_subdirectory(policy) +add_subdirectory(parser) + +add_executable(maio-utils main.c) +target_link_libraries(maio-utils "-Wl,--whole-archive" + client + loader + policy + parser + "-Wl,--no-whole-archive" + infra + dl) diff --git a/tools/mfs/maio-utils/src/client/CMakeLists.txt b/tools/mfs/maio-utils/src/client/CMakeLists.txt new file mode 100644 index 000000000000..ca1c91fd3057 --- /dev/null +++ b/tools/mfs/maio-utils/src/client/CMakeLists.txt @@ -0,0 +1,17 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +#aux_source_directory(. CLIENT_SRC) +set(CLIENT_SRC fs_client.c) + +#******************************************************************************* +#******************************************************************************* + +add_library(client ${CLIENT_SRC}) +target_link_libraries(client infra + securec) diff --git a/tools/mfs/maio-utils/src/client/fs_client.c b/tools/mfs/maio-utils/src/client/fs_client.c new file mode 100644 index 000000000000..94ef1b70be97 --- /dev/null +++ b/tools/mfs/maio-utils/src/client/fs_client.c @@ -0,0 +1,359 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "fs_client.h" +#include "mfs.h" +#include "inner.h" +#include "hashmap.h" +#include "hashfunc.h" +#include "stimer.h" +#include "atomic.h" +#include "log.h" +#include "list.h" +#include "spinlock.h" +#include "sysdef.h" +#include "securec.h" + +#include <fcntl.h> +#include <errno.h> +#include <string.h> +#include <unistd.h> +#include <sys/ioctl.h> + +#define TIMER_CYCLE 10000 /* 10s */ +#define FD_TMOUT 3600 /* 60s */ + +struct fs_client { + int rootfd; + hashmap_t *map; + stimer_t *timer; + list_head_t head; + spinlock_t lock; + uint64_t tmout; +}; + +struct fs_client g_client = {0}; + +typedef struct { + uint32_t plen; + char *path; +} fdkey_t; + +typedef struct { + fdkey_t key; + int fd; + int ref; + uint64_t ts; + list_head_t link; + hashlink_t hash; +} fd_t; + +static inline int fd_cmp(void *first, void *second) +{ + fdkey_t *key1 = (fdkey_t *)first; + fdkey_t *key2 = (fdkey_t *)second; + + if (key1->plen != key2->plen) + return -1; + + return strcmp(key1->path, key2->path); +} + +static inline uint32_t fd_hash(void *args) +{ + fdkey_t *key = (fdkey_t *)args; + uint64_t hash = hashstr(key->path, key->plen); + + return (uint32_t)hash; +} + +static inline void fd_inc(void *args, hashlink_t *link) +{ + fd_t *f = container_of(link, fd_t, hash); + int ref = atomic_s32_inc(&f->ref); + if (ref <= 0) { + log_error("fd(%d) for path(%s) with invalid ref(%d)", + f->fd, f->key.path, ref); + sys_assert(0); + } +} + +static inline int fd_dec(void *args, hashlink_t *link) +{ + fd_t *f = container_of(link, fd_t, hash); + int ref = atomic_s32_dec(&f->ref); + + if (ref < 0) { + log_error("fd(%d) for path(%s) with invalid ref(%d)", + f->fd, f->key.path, ref); + sys_assert(0); + } + /* update access timestamp for the last one */ + if (ref == 0) + f->ts = _get_ts(); + return -1; +} + +static inline int fd_expire(void *args, hashlink_t *link) +{ + fd_t *f = container_of(link, fd_t, hash); + int ref = atomic_s32_fetch(&f->ref); + uint64_t cur; + + if (ref > 0) + return -1; + if (ref < 0) { + log_error("fd(%d) for path(%s) with invalid ref(%d)", + f->fd, f->key.path, ref); + sys_assert(0); + } + cur = _get_ts(); + return ((cur - f->ts) >= g_client.tmout) ? 0 : -1; +} + +static fd_t *fd_alloc(const char *path) +{ + fd_t *f = (fd_t *)malloc(sizeof(fd_t)); + if (!f) { + log_error("alloc fd_t fail"); + return NULL; + } + + f->key.path = strdup(path); + if (!f->key.path) { + log_error("strdup(%s) fail", path); + free(f); + return NULL; + } + + f->key.plen = strlen(path) + 1; + f->fd = -1; + f->ref = 1; + f->hash.key = &f->key; + list_init(&f->link); + return f; +} + +static void fd_free(fd_t *f) +{ + if (f->fd > 0) { + int ret = close(f->fd); + if (ret != 0) { + log_error("close(%d) fail, err(%s)", f->fd, strerror(errno)); + } + f->fd = -1; + } + + if (f->key.path) { + free(f->key.path); + f->key.path = NULL; + } + list_del(&f->link); + free(f); +} + +static int fd_fetch(const char *path, fd_t **f_res, int dirfd) +{ + fdkey_t key; + key.plen = strlen(path) + 1; + key.path = (char *)path; + + /* fd in cache */ + hashlink_t *data = NULL; + if (EEXIST == hashmap_search(g_client.map, &key, &data, NULL, fd_inc)) { + *f_res = container_of(data, fd_t, hash); + (*f_res)->ts = _get_ts(); + return 0; + } + + /* new fd */ + fd_t *f = fd_alloc(path); + if (!f) + return -ENOMEM; + + /* open file */ + if (dirfd > 0) + f->fd = openat(dirfd, path, O_RDONLY, S_IRUSR | S_IRGRP); + else + f->fd = open(path, O_RDONLY, S_IRUSR | S_IRGRP); + if (f->fd < 0) { + if (errno != ENOENT) + log_error("open(%d,%s) fail, err(%s)", dirfd, path, strerror(errno)); + fd_free(f); + return errno; + } + + /* add to fd cache */ + hashlink_t *old = NULL; + if (EEXIST == hashmap_insert(g_client.map, &f->hash, &old, NULL, fd_inc)) { + fd_free(f); + f = container_of(old, fd_t, hash); + } + + spinlock_lock(&g_client.lock); + list_add_tail(&f->link, &g_client.head); + spinlock_unlock(&g_client.lock); + f->ts = _get_ts(); + *f_res = f; + return 0; +} + +static inline void fd_restore(fd_t *f) +{ + (void)hashmap_protect(g_client.map, &f->key, NULL, fd_dec); +} + +static void _fd_gc(void *args) +{ + list_head_t head, *curr, *next; + hashlink_t *data = NULL; + + list_init(&head); + spinlock_lock(&g_client.lock); + list_splice(&g_client.head, &head); + spinlock_unlock(&g_client.lock); + + list_foreach_safe(curr, next, &head) + { + fd_t *f = container_of(curr, fd_t, link); + if (atomic_s32_fetch(&f->ref) != 0) + continue; + /* try to destroy */ + if (0 != hashmap_delete(g_client.map, &f->key, &data, NULL, fd_expire)) + continue; + list_del(&f->link); + log_info("path:%s with fd:%d is expire.", f->key.path, f->fd); + fd_free(f); + } + + spinlock_lock(&g_client.lock); + list_splice(&head, &g_client.head); + spinlock_unlock(&g_client.lock); +} + +int fs_evict_by_path(const char *path, uint64_t off, uint64_t len) +{ + int ret; + fd_t *f; + uint64_t step = 4096 * 4; + + ret = fd_fetch(path, &f, 0); + if (ret) + return ret; + + while (len) { + if (step > len) + step = len; + ret = posix_fadvise(f->fd, off, len, POSIX_FADV_DONTNEED); + if (ret < 0) + break; + len -= step; + off += step; + } + + fd_restore(f); + return ret; +} + +int fs_load_by_path(const char *path, uint64_t off, uint64_t len) +{ + int ret; + fd_t *f; + uint64_t step = 16 * 4096; + char *buf = NULL; + + ret = fd_fetch(path, &f, 0); + if (ret) + return ret; + + buf = (char *)malloc(step); + + while (len) { + if (step > len) + step = len; + ret = pread(f->fd, buf, step, off); + if (ret <= 0) + break; + len -= step; + off += step; + } + free(buf); + fd_restore(f); + return ret; +} + +int fs_load_by_fd(int fd, uint64_t off, uint64_t len) +{ + struct mfs_ioc_ra ra; + + ra.off = off; + ra.len = len; + return ioctl(fd, MFS_IOC_RA, &ra); +} + +int fs_sync_by_path(const char *path, void *buf, uint64_t off, uint64_t len) +{ + ssize_t rsize = 0, ret; + uint64_t pos = 0; + fd_t *f; + + ret = fd_fetch(path + 1, &f, g_client.rootfd); + if (ret) + return ret; + + do { + ret = pread(f->fd, buf + pos, len - pos, off + pos); + if (ret == 0) + break; + if (ret < 0) { + log_error("failed to read:%s", strerror(errno)); + fd_restore(f); + return -1; + } + pos += ret; + rsize += ret; + } while (rsize < len); + fd_restore(f); + return 0; +} + +int fs_client_init(const char *source) +{ + int ret; + + g_client.rootfd = -1; + if (source) { + g_client.rootfd = open(source, O_RDONLY | O_DIRECTORY); + if (g_client.rootfd <= 0) { + log_error("open %s failed", source); + return -1; + } + } + ret = hashmap_create(1024, fd_cmp, fd_hash, &g_client.map); + if (ret) { + log_error("client fd map alloc failed"); + close(g_client.rootfd); + return ret; + } + + g_client.timer = stimer_create("LfsGc", TIMER_CYCLE, NULL, _fd_gc); + if (!g_client.timer) { + log_error("timer create failed"); + hashmap_destroy(g_client.map, NULL, NULL); + close(g_client.rootfd); + return -1; + } + list_init(&g_client.head); + spinlock_init(&g_client.lock); + g_client.tmout = FD_TMOUT; + return 0; +} + +void fs_client_exit(void) +{ + spinlock_destroy(&g_client.lock); + stimer_destroy(g_client.timer); + hashmap_destroy(g_client.map, NULL, NULL); + close(g_client.rootfd); +} + diff --git a/tools/mfs/maio-utils/src/loader/CMakeLists.txt b/tools/mfs/maio-utils/src/loader/CMakeLists.txt new file mode 100644 index 000000000000..08e1b637be26 --- /dev/null +++ b/tools/mfs/maio-utils/src/loader/CMakeLists.txt @@ -0,0 +1,18 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +aux_source_directory(. LOADER_SRC) + +#******************************************************************************* +#******************************************************************************* + +add_library(loader ${LOADER_SRC}) +target_link_libraries(loader infra + numa + securec) + diff --git a/tools/mfs/maio-utils/src/loader/loader.c b/tools/mfs/maio-utils/src/loader/loader.c new file mode 100644 index 000000000000..f3460735c94e --- /dev/null +++ b/tools/mfs/maio-utils/src/loader/loader.c @@ -0,0 +1,144 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "loader.h" + +#include "fs_client.h" +#include "threadpool.h" +#include "log.h" +#include "atomic.h" +#include "inner.h" +#include "sysdef.h" + +#include "securec.h" +#include "numa.h" +#include <errno.h> + +struct loader_mgr { + int numa_num; + threadpool_t **numa_thp; + uint64_t curseq; +}; + +struct loader_mgr g_local_mgr; + +static threadpool_t *choose_worker_pool(struct io_context *ioctx) +{ + static uint64_t cid; + int nid; + + if (ioctx->numaid == (uint16_t)-1) + nid = cid++ % g_local_mgr.numa_num; + else + nid = ioctx->numaid % g_local_mgr.numa_num; + return g_local_mgr.numa_thp[nid]; +} + +static void handle_io(void *args) +{ + struct io_context *ioctx = (struct io_context *)args; + int ret; + + if (g_local_mgr.curseq > ioctx->seq) { + if (ioctx->end_io) + ioctx->end_io(0, ioctx->private); + return; + } + ret = ioctx->path ? fs_load_by_path(ioctx->path, ioctx->off, ioctx->len) + : fs_load_by_fd(ioctx->fd, ioctx->off, ioctx->len); + if (ioctx->end_io) + ioctx->end_io(ret, ioctx->private); +} + +int loader_io_submit(struct io_context *ioctx) +{ + threadpool_t *worker_pools = choose_worker_pool(ioctx); + + threadpool_submit(worker_pools, ioctx, handle_io); + return 0; +} + +void loader_update_curseq(uint64_t seq) +{ + uint64_t curseq = atomic_u64_fetch(&g_local_mgr.curseq); + uint64_t old; + + while (seq > curseq) { + if (atomic_u64_cas(&g_local_mgr.curseq, curseq, seq, &old)) + break; + curseq = old; + } +} + +static void handle_evict(void *args) +{ + struct io_context *ioctx = (struct io_context *)args; + int ret; + + ret = ioctx->path ? fs_evict_by_path(ioctx->path, ioctx->off, ioctx->len) : 0; + if (ioctx->end_io) + ioctx->end_io(ret, ioctx->private); +} + +int loader_evict_submit(struct io_context *ioctx) +{ + threadpool_t *worker_pools = choose_worker_pool(ioctx); + + threadpool_submit(worker_pools, ioctx, handle_evict); + return 0; +} + +static void _free_loader(void) +{ + int i; + + if (!g_local_mgr.numa_thp) + return; + + for (i = 0; i < g_local_mgr.numa_num; i++) + threadpool_destroy(g_local_mgr.numa_thp[i]); + free(g_local_mgr.numa_thp); + g_local_mgr.numa_thp = NULL; +} + +int loader_init(void) +{ + int i, ret, wnum = 8; + char name[THD_NAME + 1] = {0}; + + if (numa_available() < 0) { + log_error("Current system does not support NUAM api"); + return -1; + } + + g_local_mgr.numa_num = numa_max_node() + 1; + g_local_mgr.curseq = 0; + ret = 0; + do { + g_local_mgr.numa_thp = + calloc(g_local_mgr.numa_num, sizeof(threadpool_t *)); + if (!g_local_mgr.numa_thp) { + log_error("alloc for numa threadpool failed"); + ret = -1; + break; + } + for (i = 0; i < g_local_mgr.numa_num; i++) { + sprintf_s(name, sizeof(name), "Loader-%d", i); + g_local_mgr.numa_thp[i] = threadpool_create(name, wnum, i); + if (!g_local_mgr.numa_thp[i]) { + log_error("alloc Loader-%d failed", i); + ret = -1; + break; + } + } + } while (0); + + if (ret != 0) + _free_loader(); + return ret; +} + +void loader_exit(void) +{ + _free_loader(); +} diff --git a/tools/mfs/maio-utils/src/main.c b/tools/mfs/maio-utils/src/main.c new file mode 100644 index 000000000000..ac5473d00011 --- /dev/null +++ b/tools/mfs/maio-utils/src/main.c @@ -0,0 +1,156 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include <stdlib.h> +#include <unistd.h> +#include <string.h> +#include <getopt.h> +#include <errno.h> +#include <fcntl.h> +#include <poll.h> + +#include "loader.h" +#include "log.h" +#include "maio.h" +#include "policy.h" +#include "req_parser.h" +#include "fs_client.h" +#include "mfs.h" +#include "securec.h" + +#include <sys/ioctl.h> +#include <sys/statfs.h> + +#define MAX_BUF_SIZE 1024 +#define MFS_SUPER_MAGIC 0x85428370 + +static int read_req(int fd) +{ + char *buf; + int ret; + + buf = calloc(MAX_BUF_SIZE, sizeof(char)); + if (!buf) { + log_error("failed to alloc buf\n"); + return -1; + } + ret = read(fd, buf, MAX_BUF_SIZE); + if (ret <= 0) { + if (ret < 0) + log_error("failed to read, ret:%d\n", ret); + return -1; + } + return maio_parse_req(buf, ret); +} + +static void dev_monitor(int dfd) +{ + struct pollfd pfd; + int ret; + + pfd.fd = dfd; + pfd.events = POLLIN; + while (1) { + ret = poll(&pfd, 1, -1); + if (ret < 0) { + log_error("poll failed\n"); + return; + } + if (ret == 0 || !(pfd.revents & POLLIN)) { + log_error("poll events error, ret:%d, revents:%x\n", ret, pfd.revents); + continue; + } + while (!read_req(pfd.fd)) {} + } +} + +int main(int argc, char *argv[]) +{ + const char *mntpoint = NULL, *strategylib = NULL; + struct mfs_ioc_fsinfo fsinfo = {0}; + int dfd, ret, opt; + struct statfs buf; + char devname[10]; + + while ((opt = getopt(argc, argv, "m:s:")) != -1) { + switch (opt) { + case 'm': + mntpoint = optarg; + break; + case 's': + strategylib = optarg; + break; + default: + fprintf(stderr, "Usage: %s -m ${mnt} [-s ${strategylib}]\n", argv[0]); + return -EINVAL; + } + } + if (!mntpoint) { + fprintf(stderr, "mount point should specify\n"); + fprintf(stderr, "Usage: %s -m ${mnt} [-s ${strategylib}]\n", argv[0]); + return -1; + } + + ret = statfs(mntpoint, &buf); + if (ret) { + log_error("statfs %s failed, errstr:%s\n", mntpoint, strerror(errno)); + return -1; + } + if (buf.f_type != MFS_SUPER_MAGIC) { + log_error("fstype(%x) is invalid, please check the mountpoint", buf.f_type); + return -1; + } + + sprintf_s(devname, sizeof(devname), "/dev/mfs%ld", buf.f_spare[0]); + /* Open with O_CLOEXEC to avoid potential fd leaks */ + dfd = open(devname, O_RDWR | O_CLOEXEC); + if (dfd < 0) { + log_error("open %s failed errstr:%s\n", devname, strerror(errno)); + return -1; + } + + ret = ioctl(dfd, MFS_IOC_FSINFO, (unsigned long)&fsinfo); + if (ret < 0) { + log_error("ioctl get fsinfo failed, ret:%d\n", ret); + goto close_fd; + } + if (fsinfo.mode != 1) { + log_error("fs runing mode(%d) is not supported", fsinfo.mode); + goto close_fd; + } + ret = loader_init(); + if (ret) { + log_error("loader init failed"); + goto close_fd; + } + ret = fs_client_init(NULL); + if (ret) { + log_error("clients init failed"); + goto free_loader; + } + ret = parser_init(fsinfo.mode, mntpoint); + if (ret) { + log_error("parser init failed"); + goto free_client; + } + ret = policy_init(); + if (ret) { + log_error("policy init failed"); + goto free_parser; + } + ret = policy_register(strategylib); + if (ret) { + log_info("register new policy failed, use default policy"); + } + + dev_monitor(dfd); +free_parser: + parser_destory(); +free_client: + fs_client_exit(); +free_loader: + loader_exit(); +close_fd: + close(dfd); + return ret; +} diff --git a/tools/mfs/maio-utils/src/parser/CMakeLists.txt b/tools/mfs/maio-utils/src/parser/CMakeLists.txt new file mode 100644 index 000000000000..72e5849da8e4 --- /dev/null +++ b/tools/mfs/maio-utils/src/parser/CMakeLists.txt @@ -0,0 +1,16 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +aux_source_directory(. PARSER_SRC) + +#******************************************************************************* +#******************************************************************************* + +add_library(parser ${PARSER_SRC}) +target_link_libraries(parser infra + securec) diff --git a/tools/mfs/maio-utils/src/parser/req_parser.c b/tools/mfs/maio-utils/src/parser/req_parser.c new file mode 100644 index 000000000000..137eb8d8cb3f --- /dev/null +++ b/tools/mfs/maio-utils/src/parser/req_parser.c @@ -0,0 +1,313 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ + +#include "inner.h" +#include "log.h" +#include "mfs.h" +#include "policy.h" +#include "securec.h" +#include "threadpool.h" + +#include <stdbool.h> +#include <errno.h> +#include <sys/ioctl.h> +#include <sys/stat.h> + +struct parser_mgr { + uint32_t fs_mode; + uint32_t chunk_size; + const char *mntpoint; + threadpool_t *parser; +}; + +struct parser_mgr g_parser_mgr; + +#define PARSER_NUM 8 +#define MAX_PATH_SIZE 1024 + +#define __round_mask(x, y) ((__typeof__(x))((y)-1)) +#define round_up(x, y) ((((x)-1) | __round_mask(x, y))+1) +#define round_down(x, y) ((x) & ~__round_mask(x, y)) + +#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) +#define MIN(x, y) ((x) < (y) ? (x) : (y)) + +bool is_power_of_2(unsigned long n) +{ + return (n != 0 && ((n & (n - 1)) == 0)); +} + +void ctx_cb(int ret, void *args) +{ + struct io_context *ctx = (struct io_context *)args; + + if (ctx->path) + free(ctx->path); + if (ctx->buf) + free(ctx->buf); + free(ctx); +} + +void _submit_local_io(int fd, struct maio_entry *entry) +{ + struct io_context *ioctx; + + ioctx = calloc(1, sizeof(struct io_context)); + if (!ioctx) { + log_error("ioctx alloc failed"); + return; + } + ioctx->off = entry->toff; + ioctx->len = entry->tlen; + ioctx->numaid = entry->tnuma; + ioctx->fd = fd; + ioctx->path = entry->fpath; + ioctx->seq = entry->seq; + ioctx->private = ioctx; + ioctx->end_io = ctx_cb; + loader_io_submit(ioctx); +} + +char *get_file_path(int fd) +{ + struct mfs_ioc_rpath *rp; + char *path; + int ret; + + rp = malloc(sizeof(struct mfs_ioc_rpath) + MAX_PATH_SIZE); + if (!rp) { + log_error("rpath alloc failed"); + return NULL; + } + rp->max = MAX_PATH_SIZE; + ret = ioctl(fd, MFS_IOC_RPATH, (unsigned long)rp); + if (ret) { + log_error("realpath failed for fd:%d, ret:%d", fd, ret); + free(rp); + return NULL; + } + rp->d[rp->len] = '\0'; + + path = malloc(strlen(g_parser_mgr.mntpoint) + rp->len); + if (!path) { + log_error("malloc path %s %s failed", g_parser_mgr.mntpoint, (const char *)rp->d); + return NULL; + } + sprintf(path, "%s%s", g_parser_mgr.mntpoint, (const char *)rp->d); + free(rp); + return path; +} + +char *_get_fullpath(char *fpath, int fd) +{ + struct mfs_ioc_rpath *rp; + char *path; + int ret; + + if (fpath) + return fpath; + rp = malloc(sizeof(struct mfs_ioc_rpath) + MAX_PATH_SIZE); + if (!rp) { + log_error("rpath alloc failed"); + return NULL; + } + rp->max = MAX_PATH_SIZE; + ret = ioctl(fd, MFS_IOC_RPATH, (unsigned long)rp); + if (ret) { + log_error("realpath failed for fd:%d, ret:%d", fd, ret); + free(rp); + return NULL; + } + rp->d[rp->len] = '\0'; + path = strdup((const char *)rp->d); + if (!path) + log_error("strdup path(%s) failed", (const char *)rp->d); + free(rp); + return path; +} + +void maio_preload(struct maio *maio, int nio) +{ + struct maio_entry *entry; + + for (int i = 0; i < nio; ++i) { + entry = &maio->entries[i]; + _submit_local_io(0, entry); + } +} + +uint8_t pid_to_numaid(int pid) +{ + return (uint8_t)-1; +} + +void _process_read_io(uint32_t id, struct maio *maio, int nio) +{ + struct maio_entry *entry; + int i; + + /* process the successor io */ + for (i = 0; i < nio; i++) { + entry = &maio->entries[i]; + _submit_local_io(maio->fd, entry); + } +} + +void _submit_evict(struct maio_entry *entry) +{ + struct io_context *ioctx; + + ioctx = calloc(1, sizeof(struct io_context)); + if (!ioctx) { + log_error("ioctx alloc failed"); + return; + } + ioctx->off = entry->toff; + ioctx->len = entry->tlen; + ioctx->numaid = -1; + ioctx->path = entry->fpath; + ioctx->private = ioctx; + ioctx->end_io = ctx_cb; + loader_evict_submit(ioctx); +} + +void _process_evict(struct mfs_msg *msg) +{ + struct maio_entry *entry; + struct mfs_read *read; + uint64_t soff, eoff; + struct maio *maio; + int ret; + + if (g_parser_mgr.fs_mode != MFS_MODE_LOCAL) + return; + + maio = calloc(1, sizeof(struct maio)); + if (!maio) { + log_error("failed to alloc maio"); + return; + } + + read = (void *)msg->data; + maio->cksz = g_parser_mgr.chunk_size; + soff = round_down(read->off, maio->cksz); + eoff = round_up(read->off + read->len, maio->cksz); + maio->fd = msg->fd; + maio->off = read->off; + maio->len = eoff - soff; + maio->pid = read->pid; + maio->op = msg->opcode; + + ret = policy_evict(&maio); + if (ret <= 0) + goto out; + + for (int i = 0; i < ret; ++i) { + entry = &maio->entries[i]; + _submit_evict(entry); + } +out: + free(maio); +} + +void _parse_read_req(struct mfs_msg *msg) +{ + struct mfs_read *read; + struct maio *maio; + uint64_t soff, eoff, ts; + int ret, io_num = policy_max_io(); + + _process_evict(msg); + + /* alloc maio slots */ + maio = calloc(1, sizeof(struct maio) + io_num * sizeof(struct maio_entry)); + if (!maio) { + log_error("failed to alloc maio, num:%d", io_num); + return; + } + read = (void *)msg->data; + maio->cksz = g_parser_mgr.chunk_size; + soff = round_down(read->off, maio->cksz); + eoff = round_up(read->off + read->len, maio->cksz); + ts = _get_ts(); + maio->fd = msg->fd; + maio->off = soff; + maio->len = eoff - soff; + maio->pid = read->pid; + maio->op = msg->opcode; + maio->ts = ts; + + /* fill slots from policy */ + ret = policy_load(&maio); + if (ret < 0) { + char *path = _get_fullpath(NULL, maio->fd); + if (path) { + log_warn("io on path:%s%s offset:%lu length:%lu dropped", + g_parser_mgr.mntpoint, path, read->off, read->len); + free(path); + } + free(maio); + return; + } + + if (maio->flags & MAIO_WITH_SEQ) + loader_update_curseq(maio->curseq); + + /* keep the input parameter */ + maio->fd = msg->fd; + maio->off = soff; + maio->len = eoff - soff; + maio->cksz = g_parser_mgr.chunk_size; + maio->pid = read->pid; + maio->op = msg->opcode; + maio->ts = ts; + + /* process each maio in slots */ + _process_read_io(msg->id, maio, ret); + free(maio); +} + +void _parse_one_req(void *buf) +{ + struct mfs_msg *msg = (struct mfs_msg *)buf; + + if (msg->opcode == MFS_OP_READ || msg->opcode == MFS_OP_FAULT) + _parse_read_req(msg); + + free(buf); +} + +int maio_parse_req(void *buf, int size) +{ + struct mfs_msg *msg = (struct mfs_msg *)buf; + + if (msg->len != size) + return -1; + + threadpool_submit(g_parser_mgr.parser, buf, _parse_one_req); + return 0; +} + +int parser_init(uint32_t fs_mode, const char *mntpoint) +{ + g_parser_mgr.fs_mode = fs_mode; + g_parser_mgr.mntpoint = strdup(mntpoint); + g_parser_mgr.chunk_size = 4096; + if (!is_power_of_2(g_parser_mgr.chunk_size)) { + log_error("chunk size must be power of 2"); + return -1; + } + g_parser_mgr.parser = threadpool_create("ReqParser", PARSER_NUM, -1); + if (!g_parser_mgr.parser) { + log_error("failed to alloc parser threadpool"); + return -1; + } + + return 0; +} + +void parser_destory(void) +{ + threadpool_destroy(g_parser_mgr.parser); +} diff --git a/tools/mfs/maio-utils/src/policy/CMakeLists.txt b/tools/mfs/maio-utils/src/policy/CMakeLists.txt new file mode 100644 index 000000000000..714023475e07 --- /dev/null +++ b/tools/mfs/maio-utils/src/policy/CMakeLists.txt @@ -0,0 +1,16 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +aux_source_directory(. POLICY_SRC) + +#******************************************************************************* +#******************************************************************************* + +add_library(policy ${POLICY_SRC}) +target_link_libraries(policy infra + securec) diff --git a/tools/mfs/maio-utils/src/policy/policy.c b/tools/mfs/maio-utils/src/policy/policy.c new file mode 100644 index 000000000000..c77ab31752be --- /dev/null +++ b/tools/mfs/maio-utils/src/policy/policy.c @@ -0,0 +1,114 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "policy.h" + +#include "maio.h" +#include "log.h" +#include "securec.h" +#include <dlfcn.h> + +typedef struct maio_operation* (*strategy_init)(); + +struct policy_mgr { + void *handle; + struct maio_operation *strategy; +}; + +struct policy_mgr g_policy; + +static int default_init(void) +{ + return 0; +} + +static void default_exit(void) +{ +} + +static int default_load(struct maio **io) +{ + return 0; +} + +static int default_evict(struct maio **io) +{ + return 0; +} + +struct maio_operation default_ops = { + .max_io = 1, + .init = default_init, + .exit = default_exit, + .load = default_load, + .evict = default_evict, +}; + +static void set_default_strategy(void) +{ + g_policy.strategy = &default_ops; +} + +int policy_max_io(void) +{ + return g_policy.strategy->max_io; +} + +/* return the filled num of io */ +int policy_load(struct maio **io) +{ + return g_policy.strategy->load(io); +} + +int policy_evict(struct maio **io) +{ + return g_policy.strategy->evict(io); +} + +int policy_register(const char *path) +{ + strategy_init sinit; + + if (!path || strlen(path) == 0) + return -1; + + g_policy.handle = dlopen(path, RTLD_LAZY); + if (!g_policy.handle) { + log_error("dlopen failed:%s", dlerror()); + return -1; + } + + sinit = dlsym(g_policy.handle, "register_strategy"); + if (!sinit) { + log_error("dlsym failed:%s", dlerror()); + dlclose(g_policy.handle); + g_policy.handle = NULL; + return -1; + } + g_policy.strategy = sinit(); + if (g_policy.strategy->init()) + return -1; + log_info("register strategy:%s done.", path); + return 0; +} + +void policy_unregister(void) +{ + if (g_policy.handle) { + g_policy.strategy->exit(); + dlclose(g_policy.handle); + g_policy.handle = NULL; + } + set_default_strategy(); +} + +int policy_init(void) +{ + g_policy.handle = NULL; + set_default_strategy(); + return 0; +} + +void policy_exit(void) +{ +} diff --git a/tools/mfs/maio-utils/test/Makefile b/tools/mfs/maio-utils/test/Makefile new file mode 100644 index 000000000000..6c87247aafa0 --- /dev/null +++ b/tools/mfs/maio-utils/test/Makefile @@ -0,0 +1,26 @@ +# SPDX-License-Identifier: GPL-2.0 + +CC := gcc +CFLAGS := -fPIC -Wall -Werror -O2 +CPPFLAGS := -fPIC -Wall -Werror -O2 -std=c++11 -g +LDFLAGS := -shared + +CFLAGS += $(addprefix -I,../include) +CPPFLAGS += $(addprefix -I,../include) + +C_SRCS := $(wildcard *.c) +CPP_SRCS := $(wildcard *.cpp) +TARGETS := $(C_SRCS:.c=.so) $(CPP_SRCS:.cpp=.so) + +all: $(TARGETS) + +%.so: %.c + $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $< + +%.so: %.cpp + $(CC) $(CPPFLAGS) $(LDFLAGS) -o $@ $< + +clean: + rm -f $(TARGETS) + +.PHONY: all clean diff --git a/tools/mfs/maio-utils/test/README.md b/tools/mfs/maio-utils/test/README.md new file mode 100644 index 000000000000..a7b7980de933 --- /dev/null +++ b/tools/mfs/maio-utils/test/README.md @@ -0,0 +1,61 @@ +Here, we provide some strategies library for some cases. + +- strategy_demo +A simple strategy library shows how to write a demo. + +- strategy_prefetch +A prefetch strategy library to prefetch data. + +- strategy_toend +A readahead strategy until the end. + +- strategy_generate +A tools using maio-util to generate the io trace. + +- strategy_replay +A strategy to replay the io trace. + +### How to build + +Using `make -j` to build the libraries. + +### How to use + +Set the library path as the `-s` parameter's value to run with maio-utils. Here we show usage of the advanced replay strategy: + +- generate the io trace + +> assume you have mounted the mfs at /mnt/mfs + +This is the tracing period. + +``` +export MAIO_TRACE_FILE=trace.txt +export MAIO_MNTPOINT=/mnt/mfs # /mnt/mfs is the MFS mountpoint +./bin/maio-utils -m /mnt/mfs -s /home/lihb/workspace/hulk-6.6/maio-utils/test/strategy_generate.so +``` +Then, you can trigger the io. After finishing, you would get the trace file with the content likes: + +``` +xxx/model-00001-of-000008.safetensors 0 32768 0 +xxx/model-00001-of-000008.safetensors 32768 32768 0 +xxx/model-00001-of-000008.safetensors 65536 32768 0 +xxx/model-00001-of-000008.safetensors 98304 32768 0 +xxx/model-00001-of-000008.safetensors 131072 32768 0 +... + +``` + +The format is "<path> <offset> <length> <numaid>". + +- replay the io trace + +> assume you have mounted the mfs at /mnt/mfs and begin to launch the model. + +This is the running period. + +``` +export MAIO_TRACE_FILE=trace.txt +export MAIO_MNTPOINT=/mnt/mfs # /mnt/mfs is the MFS mountpoint +./bin/maio-utils -m /mnt/mfs -s /home/lihb/workspace/hulk-6.6/maio-utils/test/replay.so +``` diff --git a/tools/mfs/maio-utils/test/strategy_demo.c b/tools/mfs/maio-utils/test/strategy_demo.c new file mode 100644 index 000000000000..82a5cd178b03 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_demo.c @@ -0,0 +1,45 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include <stddef.h> + +int demo_init(void) +{ + return 0; +} + +void demo_exit(void) +{ +} + +int demo_load(struct maio **io) +{ + struct maio_entry *entry; + + entry = (*io)->entries; + entry[0].toff = (*io)->off + (*io)->len; + entry[0].tlen = (*io)->cksz; + entry[0].fpath = NULL; + entry[0].tnuma = -1; + return 1; +} + +int demo_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation demo_strategy = { + .max_io = 1, + .init = demo_init, + .exit = demo_exit, + .load = demo_load, + .evict = demo_evict, +}; + +struct maio_operation *register_strategy(void) +{ + return (struct maio_operation *)&demo_strategy; +} diff --git a/tools/mfs/maio-utils/test/strategy_generate.cpp b/tools/mfs/maio-utils/test/strategy_generate.cpp new file mode 100644 index 000000000000..929be30e6a42 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_generate.cpp @@ -0,0 +1,296 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include "strategy_template.h" + +#include <array> +#include <atomic> +#include <cstring> +#include <condition_variable> +#include <fstream> +#include <sstream> +#include <iostream> +#include <mutex> +#include <queue> +#include <thread> +#include <unordered_map> +#include <vector> +#include <unistd.h> + +using namespace std; + +#define MAIO_MNTPOINT "MAIO_MNTPOINT" +#define MAIO_TRACE_FILE "MAIO_TRACE_FILE" +#define CACHEDIR "cachedir" + +#define MAXLINE 1024 + +/* Data struct definition */ +template<typename T> +class SafeQueue { +private: + queue<T> data_queue; + mutex mtx; + condition_variable cv; + +public: + // 添加数据到队列 + void push(T item) { + lock_guard<mutex> lock(mtx); + data_queue.push(move(item)); + cv.notify_one(); + } + + // 从队列取出数据（阻塞直到有数据） + T pop() { + unique_lock<mutex> lock(mtx); + cv.wait(lock, [this]{ return !data_queue.empty(); }); + T item = move(data_queue.front()); + data_queue.pop(); + return item; + } + + // 检查队列是否为空 + bool empty() { + lock_guard<mutex> lock(mtx); + return data_queue.empty(); + } +}; + +struct io { + string name; + uint64_t off; + uint64_t len; + uint8_t npu; + + io(const string& _name, uint64_t _off, uint64_t _len, uint8_t _npu) + : name(_name), off(_off), len(_len), npu(_npu) {} +}; + +/* Global variable definition */ +unordered_map<int, char*> fd_map; /* map fd to path */ +mutex fd_mutex; +string cachedir; + +vector<io> iovec; /* io traces */ +mutex iovec_mutex; +SafeQueue<vector<io>> iovec_queue; + +ofstream tfile; /* trace file */ + +thread writer; + +unordered_map<int, int> process_npu_map; +mutex pnpu_mutex; + +atomic<int> npu_smi_enable(-1); + +/* fd_map helper function */ +char* fd_path_find(int iofd) { + lock_guard<mutex> lock(fd_mutex); + auto it = fd_map.find(iofd); + if (it != fd_map.end()) { + return it->second; + } else { + char *path = _get_fullpath(NULL, iofd); + fd_map.insert({iofd, path}); + return path; + } +} + +/* iovec helper function */ +void io_insert_data(string name, uint64_t off, uint64_t len, uint8_t npu) +{ + lock_guard<mutex> lock(iovec_mutex); + iovec.emplace_back(name, off, len, npu); + + vector<io> copy_iovec = move(iovec); + iovec.clear(); + + iovec_queue.push(move(copy_iovec)); +} + +void get_mount_option(const char* mntpoint, const char* option) +{ + ifstream mounts("/proc/mounts"); + string line, target_mp; + + if (!mounts.is_open()) { + cerr << "Error: could not open /proc/mounts" << endl; + return; + } + + while (getline(mounts, line)) { + istringstream iss(line); + string device, mp, fs_type, options; + + if (!(iss >> device >> mp >> fs_type >> options)) + continue; + + if (mp.back() != '/') + mp += '/'; + target_mp = mntpoint; + if (target_mp.back() != '/') + target_mp += '/'; + + if (target_mp == mp) { + istringstream opt_stream(options); + string opt; + + while (getline(opt_stream, opt, ',')) { + if (opt.find(option) == 0) { + if (opt[strlen(option)] == '=') { + cachedir = opt.substr(strlen(option) + 1); + } + } + } + break; + } + } +} + +void writer_thread() { + while (true) { + vector<io> iovec_to_write = iovec_queue.pop(); + + for (const auto &item : iovec_to_write) + tfile << cachedir << item.name << " " << item.off << " " << item.len << " " << (unsigned int)item.npu << endl; + tfile.flush(); + } +} + +string exec_cmd(const char* cmd) { + array<char, 128> buffer; + string result; + unique_ptr<FILE, decltype(&pclose)> pipe(popen(cmd, "r"), pclose); + + if (!pipe) { + throw std::runtime_error("popen() failed!"); + } + while (fgets(buffer.data(), buffer.size(), pipe.get()) != nullptr) { + result += buffer.data(); + } + return result; +} + +bool isNumber(const std::string& str) { + return !str.empty() && str.find_first_not_of("0123456789") == std::string::npos; +} + +void get_npu_info(string &npuinfo) +{ + istringstream iss(npuinfo); + string line; + + while (getline(iss, line)) { + istringstream lineStream(line); + string token; + vector<string> tokens; + while (getline(lineStream, token, ' ')) { + if (!token.empty()) { + tokens.push_back(token); + } + } + if (tokens.size() >= 3) { + if (!isNumber(tokens[1]) || !isNumber(tokens[4])) + continue; + int npuId = stoi(tokens[1]); + int processId = stoi(tokens[4]); + process_npu_map[processId] = npuId; + } + } +} + +int process_npu_find(int processid) { + lock_guard<mutex> lock(pnpu_mutex); + auto it = process_npu_map.find(processid); + + if (npu_smi_enable.load() == -1) { + if (exec_cmd("command -v npu-smi").empty()) + npu_smi_enable.store(0); + else + npu_smi_enable.store(1); + } + + if (npu_smi_enable.load() == 0) + return 0; + + if (it != process_npu_map.end()) { + return it->second; + } else { + string result = exec_cmd("npu-smi info"); + get_npu_info(result); + auto it = process_npu_map.find(processid); + if (it != process_npu_map.end()) + return it->second; + else + return 0; + } +} + +int strategy_init(void) +{ + char *tfilename = getenv(MAIO_TRACE_FILE); + char *mntpoint = getenv(MAIO_MNTPOINT); + + if(!tfilename || !mntpoint) { + printf("no MAIO_TRACE_FILE or MAIO_MNTPOINT env variable\n"); + return -1; + } + get_mount_option(mntpoint, CACHEDIR); + string stfilename = tfilename; + tfile.open(stfilename, ios::trunc); + writer = thread(writer_thread); + if (!tfile.is_open()) { + cerr << "Error: could not open" << stfilename << endl; + return -1; + } + return 0; +} + +void strategy_exit(void) +{ + lock_guard<mutex> lock(iovec_mutex); + vector<io> copy_iovec = move(iovec); + iovec.clear(); + iovec_queue.push(move(copy_iovec)); + + tfile.close(); + writer.join(); +} + +int strategy_load(struct maio **io) +{ + char *path; + string pathStr; + int ret = 0; + + if (!tfile.is_open()) + return -1; + + path = fd_path_find((*io)->fd); + pathStr.assign(path); + io_insert_data(pathStr, (*io)->off, (*io)->len, process_npu_find((*io)->pid)); + + return ret; +} + +int strategy_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation maio_strategy = { + .max_io = 1, + .init = strategy_init, + .exit = strategy_exit, + .load = strategy_load, + .evict = strategy_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&maio_strategy; +} diff --git a/tools/mfs/maio-utils/test/strategy_prefetch.cpp b/tools/mfs/maio-utils/test/strategy_prefetch.cpp new file mode 100644 index 000000000000..9ba205931cdc --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_prefetch.cpp @@ -0,0 +1,150 @@ +#include "strategy_prefetch.h" +#include "maio.h" +#include <iostream> +#include <map> +#include <cstring> +#include <string> +#include <stdint.h> +#include <sys/stat.h> +#include <sys/mman.h> +#include <dirent.h> +#include <fcntl.h> +#include <unistd.h> + +using namespace std; + +struct prefetch_mgr { + map<string, uint64_t> files; +}; + +struct prefetch_mgr g_prefetch; + +int get_files(const char *parent) +{ + DIR *dir; + struct dirent *entry; + string filepath; + struct stat buf; + + if ((dir = opendir(parent)) == NULL) { + cout<<"opening directory failed"<<endl; + return -1; + } + + while ((entry = readdir(dir)) != NULL) { + if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) + continue; + + filepath = string(parent) + "/" + string(entry->d_name); + if (stat(filepath.c_str(), &buf) == -1) { + cout<<"stat path:"<<filepath<<" failed"<<endl; + continue; + } + if (S_ISDIR(buf.st_mode)) + continue; + cout<<"Find file:"<<filepath<<" size:"<<buf.st_size<<endl; + g_prefetch.files.insert(pair<string, uint64_t>(filepath, buf.st_size)); + } + + map<string, uint64_t>::iterator it; + for (it = g_prefetch.files.begin(); it != g_prefetch.files.end(); ++it) { + cout<<"path:"<<it->first<<" size:"<<it->second<<endl; + } + return 0; +} + +int prefetch_init(void) +{ + char *parent = getenv("MODEL_WEIGHT_DIR"); + if (!parent) { + cout<<"please set the env MODEL_WEIGHT_DIR"<<endl; + return -1; + } + + if (get_files(parent) != 0) { + cout<<"get all files failed"<<endl; + return -1; + } + return 0; +} + +void prefetch_exit(void) +{ +} + +struct thread_ctx { + char *path; + uint64_t off; + uint64_t len; +}; + +void *fault(void *arg) +{ + struct thread_ctx *ctx = (struct thread_ctx *)arg; + int fd = open(ctx->path, O_RDONLY); + if (fd < 0) { + cout<<"open file:%s"<<ctx->path<<" failed"<<endl; + free(ctx); + return NULL; + } + + cout<<"FAULT path:"<<ctx->path<<" fd:"<<fd<<" off:"<<ctx->off<<" len:"<<ctx->len<<endl; + void *addr = mmap(NULL, ctx->len, PROT_READ, MAP_SHARED, fd, 0); + uint64_t idx; + char tmp, total, *buffer = (char *)addr; + total = 'B'; + for (idx = 0; idx < ctx->len; idx += 4096) { + tmp = buffer[idx]; + total += tmp; + } + cout<<"Fault calculate total:"<<total<<endl; + munmap(addr, ctx->len); + close(fd); + free(ctx); + return NULL; +} + +int prefetch_load(struct maio **io) +{ + map<string, uint64_t>::iterator it; + struct thread_ctx *ctx; + pthread_t t0; + int ret; + + for (it = g_prefetch.files.begin(); it != g_prefetch.files.end(); ++it) { + ctx = (struct thread_ctx *)malloc(sizeof(struct thread_ctx)); + if (!ctx) { + cout<<"malloc ctx failed"<<endl; + continue; + } + ctx->path = strdup(it->first.c_str()); + ctx->off = 0; + ctx->len = it->second; + ret = pthread_create(&t0, NULL, fault, ctx); + if (ret == 0) + pthread_detach(t0); + } + g_prefetch.files.clear(); + + return 0; +} + +int prefetch_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation prefetch_strategy = { + .max_io = 1, + .init = prefetch_init, + .exit = prefetch_exit, + .load = prefetch_load, + .evict = prefetch_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&prefetch_strategy; +} + diff --git a/tools/mfs/maio-utils/test/strategy_prefetch.h b/tools/mfs/maio-utils/test/strategy_prefetch.h new file mode 100644 index 000000000000..e487e38b3d8b --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_prefetch.h @@ -0,0 +1,21 @@ +#ifndef STRATEGY_PREFETCH_H +#define STRATEGY_PREFETCH_H + +#ifdef __cplusplus +extern "C" { +#endif + +int prefetch_init(void); +void prefetch_exit(void); +int prefetch_load(struct maio *io); +int prefetch_evict(struct maio **io); + +extern const struct maio_operation prefetch_strategy; + +struct maio_operation *register_strategy(void); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/tools/mfs/maio-utils/test/strategy_replay.cpp b/tools/mfs/maio-utils/test/strategy_replay.cpp new file mode 100644 index 000000000000..85c1c7defedd --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_replay.cpp @@ -0,0 +1,540 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include "strategy_template.h" + +#include <atomic> +#include <array> +#include <cstring> +#include <fstream> +#include <iostream> +#include <map> +#include <mutex> +#include <sstream> +#include <string> +#include <thread> +#include <unordered_map> +#include <vector> +#include <pthread.h> +#include <fcntl.h> +#include <unistd.h> + +using namespace std; + +#define MAIO_MNTPOINT "MAIO_MNTPOINT" +#define MAIO_TRACE_FILE "MAIO_TRACE_FILE" +#define CACHEDIR "cachedir" +#define MAXLINE 1024 + +/* Data structure definition */ +enum { + IO_NONE = 0, + IO_LOADED, + IO_EVICTED, +}; + +struct io { + string name; + uint64_t off; + uint64_t len; + uint8_t npu; + int flag; + + explicit io(const string& _name, uint64_t _off, uint64_t _len, uint8_t _npu) + : name(_name), off(_off), len(_len), npu(_npu), flag(IO_NONE) {} +}; + + +struct ioKey { + string name; + uint64_t off; + uint64_t len; + uint8_t npu; + + ioKey(const string& _name, uint64_t _off, uint64_t _len, uint8_t _npu) + : name(_name), off(_off), len(_len), npu(_npu) {} + + bool operator<(const ioKey &other) const { + return name < other.name || (name == other.name && off < other.off) || + (name == other.name && off == other.off && len < other.len); + } +}; + +vector<io> iovec; /* io traces */ +map<ioKey, int> io_to_index; +unordered_map<int, char*> fd_map; +mutex fd_mutex; +string cachedir; + +unordered_map<int, int> npu_numa_map; + +unordered_map<int, int> process_npu_map; +mutex pnpu_mutex; + +/* for evict */ +#define EVICT_DIST 10000 +#define EVICT_IO_MAX 5000 +thread_local size_t evict_idx = 0; + +atomic<int> npu_smi_enable(-1); +atomic<uint64_t> memory_usage(0); + +uint64_t memory_limit; +uint64_t memory_limit_bound; +string usage_in_bytes_path = "memory.usage_in_bytes"; +string limit_in_bytes_path = "memory.limit_in_bytes"; +string cgroup_mem=""; + +string get_cgroup_path() +{ + fstream cgroup_file("/proc/self/cgroup"); + if (!cgroup_file.is_open()) { + cerr << "Failed to open /proc/self/cgroup" << endl; + return ""; + } + + string line; + string cgroup_path; + while (getline(cgroup_file, line)) { + istringstream iss(line); + string hierarchy, controller, path; + if (!getline(iss, hierarchy, ':')) + continue; + if (!getline(iss, controller, ':')) + continue; + if (!getline(iss, path, ':')) + continue; + if (controller == "memory") { + cgroup_path = path; + break; + } + } + cgroup_file.close(); + return cgroup_path; +} + +/* read from /sys/fs/cgroup/memory/memory.[usage_in_bytes|limit_in_bytes] */ +uint64_t read_cgroup_memory(const string &file_path) +{ + if (cgroup_mem == "") + return -1; + string whole_path = "/sys/fs/cgroup/memory"+cgroup_mem+"/"+file_path; + ifstream cgroup_file(whole_path); + + if(!cgroup_file.is_open()) { + cerr << "Failed to open " << file_path << endl; + return -1; + } + + string line; + while(getline(cgroup_file, line)) { + try { + return stoll(line); + } catch (...) { + cerr << "Failed to parse line" << line << endl; + } + } + + cgroup_file.close(); + return -1; +} + +/* mount helper */ +void get_mount_option(const char* mntpoint, const char* option) +{ + ifstream mounts("/proc/mounts"); + string line, target_mp; + + if (!mounts.is_open()) { + cerr << "Error: could not open /proc/mounts" << endl; + return; + } + + while (getline(mounts, line)) { + istringstream iss(line); + string device, mp, fs_type, options; + + if (!(iss >> device >> mp >> fs_type >> options)) + continue; + + if (mp.back() != '/') + mp += '/'; + target_mp = mntpoint; + if (target_mp.back() != '/') + target_mp += '/'; + + if (target_mp == mp) { + istringstream opt_stream(options); + string opt; + + while (getline(opt_stream, opt, ',')) { + if (opt.find(option) == 0) { + if (opt[strlen(option)] == '=') { + cachedir = opt.substr(strlen(option) + 1); + } + } + } + break; + } + } +} + +/* fd_map helper function */ +char* fd_path_find(int iofd) { + lock_guard<mutex> lock(fd_mutex); + auto it = fd_map.find(iofd); + if (it != fd_map.end()) { + return it->second; + } else { + char *path = _get_fullpath(NULL, iofd); + size_t len = strlen(path) + cachedir.length() + 1; + char *realpath = (char*)malloc(len); + snprintf(realpath, len, "%s%s", cachedir.c_str(), path); + fd_map.insert({iofd, realpath}); + return realpath; + } +} + +string exec_cmd(const char* cmd) { + array<char, 128> buffer; + string result = ""; + unique_ptr<FILE, decltype(&pclose)> pipe(popen(cmd, "r"), pclose); + + if (!pipe) { + throw std::runtime_error("popen() failed!"); + } + while (fgets(buffer.data(), buffer.size(), pipe.get()) != nullptr) { + result += buffer.data(); + } + return result; +} + +bool isNumber(const std::string& str) { + return !str.empty() && str.find_first_not_of("0123456789") == std::string::npos; +} + +/* cpu_numa_map builder from lscpu */ +unordered_map<string, int> build_cpu_numa_map() { + unordered_map<string, int> cpuNumaMap; + string result = exec_cmd("lscpu"); + istringstream iss(result); + string line; + + while (getline(iss, line)) { + if (line.find("NUMA node") != string::npos) { + istringstream lineStream(line); + string key, value; + int numaNode; + getline(lineStream, value, ':'); + getline(lineStream, key); + /* what if numa is more than 10 */ + value = value.substr(value.find("NUMA node") + 9, 1); + if (!isNumber(value)) + continue; + numaNode = stoi(value); + key.erase(0, key.find_first_not_of(" \t")); + key.erase(key.find_last_not_of(" \t") + 1); + cpuNumaMap[key]=numaNode; + } + } + return cpuNumaMap; +} + +/* npu_numa_map builder, from npu-smi info -t topo */ +void build_npu_map_map() +{ + if (npu_smi_enable.load() == -1) { + if (exec_cmd("command -v npu-smi").empty()) + npu_smi_enable.store(0); + else + npu_smi_enable.store(1); + } + + if (npu_smi_enable.load() == 0) + return; + + unordered_map<string, int> cpuNumaMap = build_cpu_numa_map(); + string result = exec_cmd("npu-smi info -t topo"); + istringstream iss(result); + string line; + size_t target_token_size = 0; + + cout << "NPU\tCPU_AFFINITY\tNUMA_NODE" << endl; + while (getline(iss, line)) { + istringstream lineStream(line); + string npuStr, numaStr, token; + vector<string> tokens; + + while (lineStream >> token) { + tokens.push_back(token); + } + + if (tokens.size() >= 2 && tokens.back() == "Affinity") { + target_token_size = tokens.size() - 1 + 1; + continue; + } + + if (tokens.size() != target_token_size) + continue; + + int npuId = stoi(tokens[0].substr(3)); + + numaStr = tokens.back(); + cout << npuId << "\t" << numaStr << "\t\t" << cpuNumaMap[numaStr] << endl; + npu_numa_map[npuId] = cpuNumaMap[numaStr]; + } +} + +/* process_npu_map builder, from npu-smi info */ +void get_npu_info(string &npuinfo) +{ + istringstream iss(npuinfo); + string line; + + while (getline(iss, line)) { + istringstream lineStream(line); + string token; + vector<string> tokens; + while (getline(lineStream, token, ' ')) { + if (!token.empty()) { + tokens.push_back(token); + } + } + if (tokens.size() >= 3) { + if (!isNumber(tokens[1]) || !isNumber(tokens[4])) + continue; + int npuId = stoi(tokens[1]); + int processId = stoi(tokens[4]); + process_npu_map[processId] = npuId; + } + } +} + +/* process_npu_map helper */ +int process_npu_find(int processid) { + lock_guard<mutex> lock(pnpu_mutex); + auto it = process_npu_map.find(processid); + + if (npu_smi_enable.load() == 0) + return 0; + + if (it != process_npu_map.end()) { + return it->second; + } else { + string result = exec_cmd("npu-smi info"); + get_npu_info(result); + auto it = process_npu_map.find(processid); + if (it != process_npu_map.end()) + return it->second; + else + return 0; + } +} + +int strategy_init(void) +{ + const char *mntpoint = getenv(MAIO_MNTPOINT); + char *tfilename = getenv(MAIO_TRACE_FILE); + if(!tfilename || !mntpoint) { + fprintf(stderr, "no MAIO_TRACE_FILE or MAIO_MNTPOINT env variable\n"); + return -1; + } + ifstream tfile(tfilename); + string line; + + cgroup_mem=get_cgroup_path(); + memory_limit = read_cgroup_memory(limit_in_bytes_path); + memory_limit_bound = memory_limit * 4 / 5; + cout << "memory_limit: " << memory_limit << " memory_limit_bound: " << memory_limit_bound << endl; + get_mount_option(mntpoint, CACHEDIR); + build_npu_map_map(); + + if(!tfile.is_open()) { + cerr << "Failed to open file:" << tfilename << endl; + return -1; + } + + while(getline(tfile, line)) { + istringstream iss(line); + + string name; + uint64_t off; + uint64_t len; + unsigned int npu; + if (iss >> name >> off >> len >> npu) { + iovec.emplace_back(name, off, len, npu); + io_to_index[ioKey(name, off, len, npu)] = iovec.size() - 1; + } else { + cerr << "Failed to parse line:" << line << endl; + } + } + + tfile.close(); + return 0; +} + +void strategy_exit(void) +{ +} + +int strategy_load(struct maio **io) +{ + int npuid = process_npu_find((*io)->pid); + struct maio_entry *entry; + string pathStr; + char *path; + uint64_t idx = iovec.size(); + int ret = 0; + struct maio *new_io; + + path = fd_path_find((*io)->fd); + pathStr.assign(path); + + ioKey key(pathStr, (*io)->off, (*io)->len, npuid); + auto io_it = io_to_index.lower_bound(key); + if (io_it == io_to_index.end()) { + entry = (*io)->entries; + entry[0].toff = (*io)->off + (*io)->len; + entry[0].tlen = 0; + entry[0].fpath = NULL; + entry[0].tnuma = npu_numa_map[npuid]; + return 1; + } + if (key < io_it->first) { + if (io_it != io_to_index.begin()) { + --io_it; + if (io_it->first.name != pathStr) { + ++io_it; + } + } + } + + idx = io_it->second; + (*io)->flags |= MAIO_WITH_SEQ; + (*io)->curseq = idx; + entry = (*io)->entries; + int ios = 0; + uint64_t memory_usage = read_cgroup_memory(usage_in_bytes_path); + vector<int> io_extra; + + /* fill ios below max_io */ + while (idx < iovec.size()) { + if (iovec[idx].flag == IO_LOADED) { + idx++; + continue; + } + memory_usage += iovec[idx].len / 2; + if (memory_usage > memory_limit_bound) + break; + if (ios >= maio_strategy.max_io) { + io_extra.push_back(idx); + goto next_io; + } + entry[ios].seq = idx; + if (pathStr == iovec[idx].name) { + entry[ios].toff = iovec[idx].off; + entry[ios].tlen = iovec[idx].len; + entry[ios].tnuma = npu_numa_map[npuid]; + } else { + entry[ios].fpath = strdup(iovec[idx].name.c_str()); + entry[ios].toff = iovec[idx].off; + entry[ios].tlen = iovec[idx].len; + entry[ios].tnuma = npu_numa_map[iovec[idx].npu]; + } +next_io: + iovec[idx].flag = IO_LOADED; + idx++; + ios++; + } + + /* fill ios above max_io */ + if (ios > maio_strategy.max_io) { + new_io = (struct maio *)realloc(*io, sizeof(struct maio) + ios * sizeof(struct maio_entry)); + if (!new_io) { + printf("failed to alloc ios:%d maio\n", ios); + return -1; + } + *io = new_io; + entry = (*io)->entries; + for (int i = maio_strategy.max_io; i < ios; ++i) { + int io_idx = io_extra[i - maio_strategy.max_io]; + entry[i].seq = io_idx; + if (pathStr == iovec[io_idx].name) { + entry[i].toff = iovec[io_idx].off; + entry[i].tlen = iovec[io_idx].len; + entry[i].tnuma = npu_numa_map[npuid]; + } else { + entry[i].fpath = strdup(iovec[io_idx].name.c_str()); + entry[i].toff = iovec[io_idx].off; + entry[i].tlen = iovec[io_idx].len; + entry[i].tnuma = npu_numa_map[iovec[io_idx].npu]; + } + } + } + + // printf("file:%s off:%lu len:%lu generate_ios:%d from %d",path, (*io)->off, (*io)->len, ios, io_it->second); + ret = ios; + return ret; +} + +int strategy_evict(struct maio **io) +{ + string pathStr; + char *path; + path = fd_path_find((*io)->fd); + pathStr.assign(path); + ioKey key(pathStr, (*io)->off, (*io)->len, (*io)->pid); + auto io_it = io_to_index.lower_bound(key); + int dist = 0; + size_t i = 0, io_idx = io_it->second; + struct maio_entry *entry; + struct maio *new_io; + uint64_t evict_memory = 0; + uint64_t memory_usage = read_cgroup_memory(usage_in_bytes_path); + + if (memory_usage < (memory_limit_bound * 3 / 4)) + return 0; + dist = io_idx - evict_idx; + if (dist < 0) + return 0; + if (static_cast<size_t>(dist) < iovec.size() / 8 && io_it != io_to_index.end()) + return 0; + size_t evict_win = 0; + if (io_it != io_to_index.end()) { + evict_win = min(iovec.size() / 10, io_idx - 1); + } else { + evict_win = dist; + } + + new_io = (struct maio*)realloc(*io, sizeof(struct maio) + evict_win * sizeof(struct maio_entry)); + if (!new_io) + return -1; + *io = new_io; + entry = new_io->entries; + + for (i = 0; i < evict_win && evict_idx < iovec.size(); ++i) { + evict_memory += iovec[evict_idx].len; + if (evict_memory > memory_limit_bound / 8) + break; + entry[i].fpath = strdup(iovec[evict_idx].name.c_str()); + entry[i].toff = iovec[evict_idx].off; + entry[i].tlen = iovec[evict_idx].len; + evict_idx++; + iovec[evict_idx].flag = IO_EVICTED; + } + return i; +} + +const struct maio_operation maio_strategy = { + .max_io = 500, + .init = strategy_init, + .exit = strategy_exit, + .load = strategy_load, + .evict = strategy_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&maio_strategy; +} diff --git a/tools/mfs/maio-utils/test/strategy_template.h b/tools/mfs/maio-utils/test/strategy_template.h new file mode 100644 index 000000000000..c574d72e4a03 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_template.h @@ -0,0 +1,21 @@ +#ifndef STRATEGY_TEMPLATE_H +#define STRATEGY_TEMPLATE_H + +#ifdef __cplusplus +extern "C" { +#endif + +int strategy_init(void); +void strategy_exit(void); +int strategy_load(struct maio **io); +int strategy_evict(struct maio *io); + +extern const struct maio_operation maio_strategy; + +struct maio_operation *register_strategy(void); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/tools/mfs/maio-utils/test/strategy_toend.c b/tools/mfs/maio-utils/test/strategy_toend.c new file mode 100644 index 000000000000..56a068d450e5 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_toend.c @@ -0,0 +1,46 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include <stddef.h> + +int demo_init(void) +{ + return 0; +} + +void demo_exit(void) +{ +} + +int demo_load(struct maio **io) +{ + struct maio_entry *entry; + + entry = (*io)->entries; + entry[0].toff = (*io)->off + (*io)->len; + /* Read Ahead until the end */ + entry[0].tlen = 0; + entry[0].fpath = NULL; + entry[0].tnuma = -1; + return 1; +} + +int demo_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation demo_strategy = { + .max_io = 1, + .init = demo_init, + .exit = demo_exit, + .load = demo_load, + .evict = demo_evict, +}; + +struct maio_operation *register_strategy(void) +{ + return (struct maio_operation *)&demo_strategy; +} diff --git a/tools/mfs/maio-utils/test/trace_analyse.py b/tools/mfs/maio-utils/test/trace_analyse.py new file mode 100644 index 000000000000..c25d1ce364df --- /dev/null +++ b/tools/mfs/maio-utils/test/trace_analyse.py @@ -0,0 +1,87 @@ +def merge_intervals(intervals): + """ + 合并区间 + :param intervals: 区间列表，每个区间是一个元组 (start, end) + :return: 合并后的区间列表 + """ + if not intervals: + return [] + + # 按起始位置排序 + intervals.sort(key=lambda x: x[0]) + + merged = [intervals[0]] + for current in intervals[1:]: + last_merged = merged[-1] + if current[0] <= last_merged[1]: # 有重叠 + merged[-1] = (last_merged[0], max(last_merged[1], current[1])) + else: + merged.append(current) + + return merged + +def process_file(input_file): + """ + 处理输入文件 + :param input_file: 输入文件路径 + :return: 每个文件的合并区间和总大小 + """ + from collections import defaultdict + + # 使用字典按文件名分组 + file_intervals = defaultdict(list) + + with open(input_file, 'r') as f: + for line in f: + parts = line.strip().split() + if len(parts) < 3: + print(f"跳过无效行: {line.strip()}") + continue + + # 解析文件名、起始位置、大小 + filename, start, size = parts[:3] + start = int(start) + size = int(size) + + # 计算区间 + end = start + size + file_intervals[filename].append((start, end)) + + # 合并每个文件的区间 + merged_results = {} + for filename, intervals in file_intervals.items(): + merged_intervals = merge_intervals(intervals) + # 计算合并后的区间总大小 + total_size = sum(end - start for start, end in merged_intervals) + merged_results[filename] = { + "merged_intervals": merged_intervals, + "total_size": total_size + } + + return merged_results + +def main(): + import sys + + if len(sys.argv) != 2: + print("用法: python script.py <输入文件>") + sys.exit(1) + + input_file = sys.argv[1] + + merged_results = process_file(input_file) + + whole_result=0 + + for filename, result in merged_results.items(): + print(f"文件: {filename}") + # print("合并后的区间:") + # for interval in result["merged_intervals"]: + # print(f"起始位置: {interval[0]}, 结束位置: {interval[1]}") + print(f"所有区间内数据的总大小: {result['total_size']} 字节") + print("-" * 40) + whole_result+=result['total_size'] + print(f"所有文件内数据的总大小: {whole_result} 字节") + +if __name__ == "__main__": + main() diff --git a/tools/mfs/maio-utils/test/trace_gen.py b/tools/mfs/maio-utils/test/trace_gen.py new file mode 100644 index 000000000000..d050fa48801c --- /dev/null +++ b/tools/mfs/maio-utils/test/trace_gen.py @@ -0,0 +1,116 @@ +import argparse +import os +import sys + +FILENAME_IDX = 0 +OFF_IDX = 1 +LEN_IDX = 2 +NUMA_IDX = 3 +OFF_BOUND = 1024 * 1024 * 4096 + +class ReplayHintGenerator(object): + def __init__(self, trace_file, output_file): + self.output_file = output_file + self.trace_file = trace_file + self.data_list = [] + + def generate_hint(self): + with open(self.output_file, 'w') as f: + for data in self.data_list: + data_off = data[OFF_IDX] + data_len = data[LEN_IDX] + print(data_off) + step = (512 * 1024 * 1024) + while data_len: + if data_len < step: + step = data_len + print(f"{data[FILENAME_IDX]} {data_off} {step} {data[NUMA_IDX]}", file=f) + data_len-=step + data_off+=step + + def parse_trace(self): + file_map_index={} + with open(self.trace_file, 'r') as f: + for line in f: + parts = line.strip().split(' ') + + filename, off, length, numaid = parts + off = int(off) + length = int(length) + numaid = int(numaid) + if self.data_list: + tail_data = self.data_list[-1] + ''' + 首先尝试跟末尾的数据合并: + 如若跟末尾的数据是同一个文件跟numaid, + 两者之间的距离小于设定值, + 就进行合并 + ''' + if (tail_data[FILENAME_IDX] == filename and tail_data[NUMA_IDX] == numaid): + tail_off = tail_data[OFF_IDX] + tail_end = tail_data[OFF_IDX] + tail_data[LEN_IDX] + end = off + length + abs_off = max(abs(off - tail_end), abs(tail_off - end)) + if abs_off < OFF_BOUND: + tail_data[OFF_IDX] = min(tail_off, off) + tail_data[LEN_IDX] = max(tail_end, end) - tail_data[OFF_IDX] + continue + else: + ''' + 否则跟之前同一文件和numaid的数据进行合并 + 如若两者之间距离小于设定值， + 就进行合并 + ''' + key = (filename, numaid) + if key in file_map_index: + index = file_map_index[key] + data = self.data_list[index] + data_off = data[OFF_IDX] + data_end = data[OFF_IDX] + data[LEN_IDX] + end = off + length + abs_off = max(abs(off - data_end), abs(data_off - end)) + if abs_off < OFF_BOUND: + data[OFF_IDX] = min(data_off, off) + data[LEN_IDX] = max(data_end, end) - data[OFF_IDX] + continue + self.data_list.append([filename, off, length, numaid]) + file_map_index[(filename, numaid)] = len(self.data_list) - 1 + + +def main(agrv): + """ + Parse the argument + """ + parser = argparse.ArgumentParser('model trace parser') + parser.add_argument('--trace_file', + required=True, + type=str, + help='trace source') + parser.add_argument('--output_file', + required=True, + type=str, + help='output of hint file') + try: + args = parser.parse_args() + trace_file = args.trace_file + output_file = args.output_file + if not os.path.exists(trace_file): + print("{trace_file} not exist") + return -1 + + hint_generator=ReplayHintGenerator(trace_file, output_file) + hint_generator.parse_trace() + hint_generator.generate_hint() + return 0 + except Exception as e: + print(f"Parse model trace exception:{str(e)}") + return -1 + +if __name__ == '__main__': + try: + ret = main(sys.argv[1:]) + except Exception as main_e: + print(str(main_e)) + ret = -1 + sys.exit(ret) + -- 2.34.1

2 1

[PATCH OLK-5.10] fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
by Long Li 16 Mar '26

16 Mar '26

From: Albin Babu Varghese <albinbabuvarghese20(a)gmail.com> stable inclusion from stable-v5.10.246 commit f0982400648a3e00580253e0c48e991f34d2684c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/12588 CVE: CVE-2025-40304 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ] Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes. Reported-by: syzbot+48b0652a95834717f190(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 Suggested-by: Helge Deller <deller(a)gmx.de> Tested-by: syzbot+48b0652a95834717f190(a)syzkaller.appspotmail.com Signed-off-by: Albin Babu Varghese <albinbabuvarghese20(a)gmail.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c index f22a68603a61..786af65bbf7b 100644 --- a/drivers/video/fbdev/core/bitblit.c +++ b/drivers/video/fbdev/core/bitblit.c @@ -169,6 +169,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, image.height = vc->vc_font.height; image.depth = 1; + if (image.dy >= info->var.yres) + return; + + image.height = min(image.height, info->var.yres - image.dy); + if (attribute) { buf = kmalloc(cellsize, GFP_ATOMIC); if (!buf) @@ -182,6 +187,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, cnt = count; image.width = vc->vc_font.width * cnt; + + if (image.dx >= info->var.xres) + break; + + if (image.dx + image.width > info->var.xres) { + image.width = info->var.xres - image.dx; + cnt = image.width / vc->vc_font.width; + if (cnt == 0) + break; + image.width = cnt * vc->vc_font.width; + } + pitch = DIV_ROUND_UP(image.width, 8) + scan_align; pitch &= ~scan_align; size = pitch * image.height + buf_align; -- 2.39.2

2 1

[PATCH openEuler-26.09] tools: Add maio-utils tool
by Hongbo Li 16 Mar '26

16 Mar '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8613 -------------------------------- This is a userspace tool for MFS to provide: programmable strategy framework. Some basic strategies have added in test, and more flexible strategies can be written based on this framework. Signed-off-by: Hongbo Li <lihongbo22(a)huawei.com> --- tools/mfs/maio-utils/CMakeLists.txt | 101 ++++ tools/mfs/maio-utils/README.md | 17 + tools/mfs/maio-utils/build/build.sh | 91 +++ .../mfs/maio-utils/include/client/fs_client.h | 17 + tools/mfs/maio-utils/include/inner/inner.h | 37 ++ tools/mfs/maio-utils/include/loader/loader.h | 10 + tools/mfs/maio-utils/include/maio.h | 53 ++ .../maio-utils/include/parser/req_parser.h | 13 + tools/mfs/maio-utils/include/policy/policy.h | 17 + tools/mfs/maio-utils/include/uapi/mfs.h | 62 ++ tools/mfs/maio-utils/src/CMakeLists.txt | 42 ++ .../mfs/maio-utils/src/client/CMakeLists.txt | 17 + tools/mfs/maio-utils/src/client/fs_client.c | 359 ++++++++++++ .../mfs/maio-utils/src/loader/CMakeLists.txt | 18 + tools/mfs/maio-utils/src/loader/loader.c | 144 +++++ tools/mfs/maio-utils/src/main.c | 156 +++++ .../mfs/maio-utils/src/parser/CMakeLists.txt | 16 + tools/mfs/maio-utils/src/parser/req_parser.c | 313 ++++++++++ .../mfs/maio-utils/src/policy/CMakeLists.txt | 16 + tools/mfs/maio-utils/src/policy/policy.c | 114 ++++ tools/mfs/maio-utils/test/Makefile | 26 + tools/mfs/maio-utils/test/README.md | 61 ++ tools/mfs/maio-utils/test/strategy_demo.c | 45 ++ .../mfs/maio-utils/test/strategy_generate.cpp | 296 ++++++++++ .../mfs/maio-utils/test/strategy_prefetch.cpp | 150 +++++ tools/mfs/maio-utils/test/strategy_prefetch.h | 21 + tools/mfs/maio-utils/test/strategy_replay.cpp | 540 ++++++++++++++++++ tools/mfs/maio-utils/test/strategy_template.h | 21 + tools/mfs/maio-utils/test/strategy_toend.c | 46 ++ tools/mfs/maio-utils/test/trace_analyse.py | 87 +++ tools/mfs/maio-utils/test/trace_gen.py | 116 ++++ 31 files changed, 3022 insertions(+) create mode 100644 tools/mfs/maio-utils/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/README.md create mode 100644 tools/mfs/maio-utils/build/build.sh create mode 100644 tools/mfs/maio-utils/include/client/fs_client.h create mode 100644 tools/mfs/maio-utils/include/inner/inner.h create mode 100644 tools/mfs/maio-utils/include/loader/loader.h create mode 100644 tools/mfs/maio-utils/include/maio.h create mode 100644 tools/mfs/maio-utils/include/parser/req_parser.h create mode 100644 tools/mfs/maio-utils/include/policy/policy.h create mode 100644 tools/mfs/maio-utils/include/uapi/mfs.h create mode 100644 tools/mfs/maio-utils/src/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/client/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/client/fs_client.c create mode 100644 tools/mfs/maio-utils/src/loader/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/loader/loader.c create mode 100644 tools/mfs/maio-utils/src/main.c create mode 100644 tools/mfs/maio-utils/src/parser/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/parser/req_parser.c create mode 100644 tools/mfs/maio-utils/src/policy/CMakeLists.txt create mode 100644 tools/mfs/maio-utils/src/policy/policy.c create mode 100644 tools/mfs/maio-utils/test/Makefile create mode 100644 tools/mfs/maio-utils/test/README.md create mode 100644 tools/mfs/maio-utils/test/strategy_demo.c create mode 100644 tools/mfs/maio-utils/test/strategy_generate.cpp create mode 100644 tools/mfs/maio-utils/test/strategy_prefetch.cpp create mode 100644 tools/mfs/maio-utils/test/strategy_prefetch.h create mode 100644 tools/mfs/maio-utils/test/strategy_replay.cpp create mode 100644 tools/mfs/maio-utils/test/strategy_template.h create mode 100644 tools/mfs/maio-utils/test/strategy_toend.c create mode 100644 tools/mfs/maio-utils/test/trace_analyse.py create mode 100644 tools/mfs/maio-utils/test/trace_gen.py diff --git a/tools/mfs/maio-utils/CMakeLists.txt b/tools/mfs/maio-utils/CMakeLists.txt new file mode 100644 index 000000000000..f710e6c15f79 --- /dev/null +++ b/tools/mfs/maio-utils/CMakeLists.txt @@ -0,0 +1,101 @@ +#******************************************************************************* +#******************************************************************************* + +cmake_minimum_required(VERSION 3.0) +cmake_policy(SET CMP0057 NEW) + +project(maio) + +#******************************************************************************* +#******************************************************************************* + +add_definitions(-D__LINUX_USR__) +add_definitions(-D__USE_GNU) +add_definitions(-D__POSIX_SOURCE) +add_definitions(-D_GNU_SOURCE) +add_definitions(-D_FILE_OFFSET_BITS=64) + +#******************************************************************************* +#******************************************************************************* + +include(TestBigEndian) + +TEST_BIG_ENDIAN(BIGENDIAN) + if (${BIGENDIAN}) + message(">>> Big Endian") + add_definitions(-D_CMAKE_BIGENDIAN) + else() + message(">>> Little Endian") + endif(${BIGENDIAN}) + +#******************************************************************************* +#******************************************************************************* + +EXECUTE_PROCESS(COMMAND uname -m COMMAND tr -d '\n' OUTPUT_VARIABLE ARCH) +if(${ARCH} STREQUAL "x86_64" OR ${ARCH} STREQUAL "aarch64") + message(STATUS "Architecture: ${ARCH}") +else() + message(STATUS "Invaild Architecture: ${ARCH}") + return() +endif() + +#******************************************************************************* +#******************************************************************************* + +set(BASE_FLAGS "-g -Wall -Werror -fno-strict-overflow -rdynamic") +set(SP_C_FLAGS "-std=gnu99") +set(SP_C++_FLAGS "-std=c++11") +set(SP_RELEASE_FLAGS "-O2") +set(SP_DEBUG_FLAGS "-O0") +set(SEC_REQ_FLAGS "-fstack-protector-all -fPIE -pie -fPIC -Wl,-z,relro,-z,now,-z,noexecstack") +set(SEC_SUG_BASE_FLAGS "-Wformat=2") +set(SEC_SUG_SP_C_FLAGS "-Wshadow") + +set(C_FLAGS "${BASE_FLAGS} ${SP_C_FLAGS}") +set(C++_FLAGS "${BASE_FLAGS} ${SP_C++_FLAGS}") +set(SEC_C_FLAGS "${SEC_REQ_FLAGS} ${SEC_SUG_BASE_FLAGS} ${SEC_SUG_SP_C_FLAGS}") +set(SEC_C++_FLAGS "${SEC_REQ_FLAGS} ${SEC_SUG_BASE_FLAGS}") +set(DEPC_FLAGS "-Wno-error=deprecated-declarations -Wno-deprecated-declarations") + +if(CMAKE_BUILD_TYPE MATCHES "Release") + message(">>> Release Mode") + set(CMAKE_C_FLAGS "${C_FLAGS} ${SP_RELEASE_FLAGS} ${SEC_C_FLAGS}") + set(CMAKE_CXX_FLAGS "${C++_FLAGS} ${SP_RELEASE_FLAGS} ${SEC_C++_FLAGS} ${DEPC_FLAGS}") +else() + message(">>> Debug Mode") + add_definitions(-D_DEBUG) + set(CMAKE_C_FLAGS "${C_FLAGS} ${SP_DEBUG_FLAGS} ${SEC_C_FLAGS}") + set(CMAKE_CXX_FLAGS "${C++_FLAGS} ${SP_DEBUG_FLAGS} ${SEC_C++_FLAGS} ${DEPC_FLAGS}") + set(COVERAGE_FLAGS "-coverage") + set(COVERAGE_LINK "gcov") +endif() + +message(STATUS ">>> Source Dir: " ${PROJECT_SOURCE_DIR}) +message(STATUS ">>> Binary Dir: " ${PROJECT_BINARY_DIR}) +message(STATUS ">>> C_FLAGS : " ${CMAKE_C_FLAGS}) +message(STATUS ">>> CXX_FLAGS : " ${CMAKE_CXX_FLAGS}) + +#******************************************************************************* +#******************************************************************************* + +set(EXECUTABLE_OUTPUT_PATH ${PROJECT_BINARY_DIR}/bin) + +#******************************************************************************* +#******************************************************************************* + +if(DEFINED THIRD_PARTY) + message(">>> third_party: ${THIRD_PARTY}") +else() + set(THIRD_PARTY ${PROJECT_SOURCE_DIR}/lib) +endif() + +set(INFRA_DIR ${PROJECT_SOURCE_DIR}/infrastructure) +set(SECUREC_DIR ${THIRD_PARTY}/securec) +set(ZLOG_DIR ${THIRD_PARTY}/zlog) +set(LIBNUMA_DIR ${THIRD_PARTY}/libnuma) + +#******************************************************************************* +#******************************************************************************* + +add_subdirectory(infrastructure) +add_subdirectory(src) diff --git a/tools/mfs/maio-utils/README.md b/tools/mfs/maio-utils/README.md new file mode 100644 index 000000000000..4c5a66a83c60 --- /dev/null +++ b/tools/mfs/maio-utils/README.md @@ -0,0 +1,17 @@ +# maio-utils + +#### How to build + +1. prepare thirdparty by using: +``` +git clone -b threadpool_bind https://github.com/hb-lee/infrastructure.git infrastructure +git clone -b 1.2.18 https://github.com/HardySimpson/zlog.git thirdparty/zlog +git clone https://github.com/chriszt/securec.git thirdparty/securec +git clone -b v2.0.19 https://github.com/numactl/numactl.git thirdparty/libnuma +``` +2. cd build +3. bash build.sh prepare # only once. +4. bash build.sh build + +#### How to run +Run with `./maio -m ${MNTPOINT}`, here ${MNTPOINT} means the mfs mount point. If you want to use some strategies, you can run with `./maio -m ${MNTPOINT} -s ${STRATEGYLIB}` where ${STRATEGYLIB} is your strategy library. Some examples are provided in `test` directory. diff --git a/tools/mfs/maio-utils/build/build.sh b/tools/mfs/maio-utils/build/build.sh new file mode 100644 index 000000000000..91b49d3d6bf8 --- /dev/null +++ b/tools/mfs/maio-utils/build/build.sh @@ -0,0 +1,91 @@ +#!/bin/bash + +LOCAL_PATH="$(readlink -e "$(dirname "$0")")" +PRJ_PATH="$(readlink -e "${LOCAL_PATH}/..")" +THIRD_SUB="${PRJ_PATH}/thirdparty" +Lib_PATH="${PRJ_PATH}/lib" + +ARCH=$(uname -m) + +function build_zlog() { + local zlog_dir=${THIRD_SUB}/zlog + local build_path=${zlog_dir}/build + mkdir ${build_path} + mkdir -p ${Lib_PATH}/zlog + cd ${zlog_dir} + make PREFIX=`pwd`/build/zlog + make PREFIX=`pwd`/build/zlog install + cp -rdp ${build_path}/zlog/include ${Lib_PATH}/zlog + cp -rdp ${build_path}/zlog/lib ${Lib_PATH}/zlog + cd - +} + +function build_securec() { + local securec_dir=${THIRD_SUB}/securec + local securec_lib=${securec_dir}/build/securec/lib + mkdir -p ${securec_lib} + mkdir -p ${Lib_PATH}/securec + cd ${securec_dir} + if [ "${ARCH}" = "aarch64" ]; then + make -f aarch64-so.mk + else + make -f x86-so.mk + fi + cp -rdp include build/securec + cp libsecurec.so build/securec/lib + cp -rdp build/securec/include ${Lib_PATH}/securec + cp -rdp build/securec/lib ${Lib_PATH}/securec + cd - +} + +function build_libnuma() { + local libnuma_dir=${THIRD_SUB}/libnuma + local build_path=${libnuma_dir}/build + mkdir ${build_path} + mkdir -p ${Lib_PATH}/libnuma + cd ${libnuma_dir} + ./autogen.sh + ./configure --prefix=`pwd`/build + make -j4 + make install + cp -rdp build/include ${Lib_PATH}/libnuma + cp -rdp build/lib ${Lib_PATH}/libnuma + cd - +} + +function prepare_thirdparty() { + build_jsoncpp + build_zlog + build_securec + build_libnuma +} + +function build_program() { + local BUILD_TYPE=$1 + + set -x + if [ "${BUILD_TYPE}" == "release" ]; then + cmake .. -DCMAKE_BUILD_TYPE=Release + else + cmake .. -DCMAKE_BUILD_TYPE=Debug + fi + set +x + + make clean + make VERBOSE=1 -j +} + +function main() { + local ACTION="$1" + local PARAMETER="$2" + + if [ "${ACTION}" == "prepare" ]; then + prepare_thirdparty + fi + if [ "$ACTION" == "build" ]; then + build_program $PARAMETER + fi +} + +main $@ +exit $? diff --git a/tools/mfs/maio-utils/include/client/fs_client.h b/tools/mfs/maio-utils/include/client/fs_client.h new file mode 100644 index 000000000000..803179ade14c --- /dev/null +++ b/tools/mfs/maio-utils/include/client/fs_client.h @@ -0,0 +1,17 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _FS_CLIENT_H_ +#define _FS_CLIENT_H_ + +#include <stdint.h> + +int fs_evict_by_path(const char*path, uint64_t off, uint64_t len); +int fs_load_by_path(const char *path, uint64_t off, uint64_t len); +int fs_load_by_fd(int fd, uint64_t off, uint64_t len); +int fs_sync_by_path(const char *path, void *buf, uint64_t off, uint64_t len); + +int fs_client_init(const char *source); +void fs_client_exit(); + +#endif diff --git a/tools/mfs/maio-utils/include/inner/inner.h b/tools/mfs/maio-utils/include/inner/inner.h new file mode 100644 index 000000000000..c10f40a3712c --- /dev/null +++ b/tools/mfs/maio-utils/include/inner/inner.h @@ -0,0 +1,37 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _INNER_H_ +#define _INNER_H_ + +#include <time.h> +#include <stdint.h> + +static inline uint64_t _get_ts() +{ + struct timespec now = {0}; + (void)clock_gettime(CLOCK_MONOTONIC_COARSE, &now); + return (uint64_t)now.tv_sec; +} + +/* io context for loader and writeback */ +struct io_context { + uint32_t id; /* msg id */ + uint64_t off; /* io offset in fd */ + uint64_t len; /* io length */ + uint16_t numaid; /* numa node of this io, -1 means non-bind */ + int fd; /* io file handle */ + char *path; /* fullpath of this io */ + void *buf; /* flighting buffer for writeback */ + + uint64_t seq; + + void *private; + void (*end_io)(int ret, void *private); +}; + +void loader_update_curseq(uint64_t seq); +int loader_evict_submit(struct io_context *ioctx); +int loader_io_submit(struct io_context *ioctx); + +#endif diff --git a/tools/mfs/maio-utils/include/loader/loader.h b/tools/mfs/maio-utils/include/loader/loader.h new file mode 100644 index 000000000000..ff280989f9f9 --- /dev/null +++ b/tools/mfs/maio-utils/include/loader/loader.h @@ -0,0 +1,10 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _LOADER_H_ +#define _LOADER_H_ + +int loader_init(); +void loader_exit(); + +#endif diff --git a/tools/mfs/maio-utils/include/maio.h b/tools/mfs/maio-utils/include/maio.h new file mode 100644 index 000000000000..a508d5b1fa27 --- /dev/null +++ b/tools/mfs/maio-utils/include/maio.h @@ -0,0 +1,53 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _MAIO_H_ +#define _MAIO_H_ + +#ifdef __cplusplus +extern "C" { +#endif + +#include <stdint.h> + +struct maio_entry { + char *fpath; + uint64_t toff; + uint64_t tlen; + uint8_t tnuma; + uint64_t seq; +}; + +struct maio { + /* IN */ + int fd; + uint64_t off; + uint64_t len; + int pid; + uint8_t op; + uint64_t ts; + uint32_t cksz; + + /* OUT */ + uint16_t flags; +#define MAIO_WITH_SEQ 0x0001 + uint64_t curseq; + struct maio_entry entries[]; +}; + +struct maio_operation { + int max_io; + int (*init) (void); + void (*exit) (void); + int (*load) (struct maio **io); + int (*evict) (struct maio **io); +}; + +char *_get_fullpath(char *fpath, int fd); +void maio_preload(struct maio *maio, int nio); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/tools/mfs/maio-utils/include/parser/req_parser.h b/tools/mfs/maio-utils/include/parser/req_parser.h new file mode 100644 index 000000000000..908e7297558a --- /dev/null +++ b/tools/mfs/maio-utils/include/parser/req_parser.h @@ -0,0 +1,13 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef __REQ_PARSER_H__ +#define __REQ_PARSER_H__ + +#include <stdint.h> + +int parser_init(uint32_t fs_mode, const char *mntpoint); +void parser_destory(); +int maio_parse_req(void *buf, int size); + +#endif diff --git a/tools/mfs/maio-utils/include/policy/policy.h b/tools/mfs/maio-utils/include/policy/policy.h new file mode 100644 index 000000000000..aef05c956b3b --- /dev/null +++ b/tools/mfs/maio-utils/include/policy/policy.h @@ -0,0 +1,17 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#ifndef _POLICY_H_ +#define _POLICY_H_ + +#include "maio.h" + +int policy_max_io(); +int policy_load(struct maio **io); +int policy_evict(struct maio **io); +int policy_register(const char *path); +void policy_unregister(); +int policy_init(); +void policy_exit(); + +#endif diff --git a/tools/mfs/maio-utils/include/uapi/mfs.h b/tools/mfs/maio-utils/include/uapi/mfs.h new file mode 100644 index 000000000000..a7d5882b5e50 --- /dev/null +++ b/tools/mfs/maio-utils/include/uapi/mfs.h @@ -0,0 +1,62 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ + +#ifndef _UAPI_LINUX_MFS_H +#define _UAPI_LINUX_MFS_H + +#include <linux/types.h> +#include <linux/ioctl.h> + +enum mfs_opcode { + MFS_OP_READ = 0, + MFS_OP_FAULT, + MFS_OP_FAROUND, +}; + +enum { + MFS_MODE_NONE = 0, + MFS_MODE_LOCAL, + MFS_MODE_REMOTE, +}; + +struct mfs_ioc_ra { + __u64 off; + __u64 len; +}; + +struct mfs_ioc_done { + __u32 id; + __u32 ret; +}; + +struct mfs_ioc_rpath { + __u16 max; + __u16 len; + __u8 d[]; +}; + +#define MFS_IOC_RA _IOW(0xbc, 1, struct mfs_ioc_ra) +#define MFS_IOC_DONE _IOW(0xbc, 2, struct mfs_ioc_done) +#define MFS_IOC_RPATH _IOWR(0xbc, 3, struct mfs_ioc_rpath) + +struct mfs_ioc_fsinfo { + __u8 mode; /* 0: none, 1: local, 2: remote */ +}; + +#define MFS_IOC_FSINFO _IOR(0xbd, 1, struct mfs_ioc_fsinfo) + +struct mfs_msg { + __u8 version; + __u8 opcode; + __u16 len; + __u32 fd; + __u32 id; + __u8 data[]; +}; + +struct mfs_read { + __u64 off; + __u64 len; + __s32 pid; +}; + +#endif /* _UAPI_LINUX_MFS_H */ diff --git a/tools/mfs/maio-utils/src/CMakeLists.txt b/tools/mfs/maio-utils/src/CMakeLists.txt new file mode 100644 index 000000000000..fd053a8bd081 --- /dev/null +++ b/tools/mfs/maio-utils/src/CMakeLists.txt @@ -0,0 +1,42 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${PROJECT_SOURCE_DIR}/include) +include_directories(${PROJECT_SOURCE_DIR}/include/inner) +include_directories(${PROJECT_SOURCE_DIR}/include/uapi) +include_directories(${PROJECT_SOURCE_DIR}/include/client) +include_directories(${PROJECT_SOURCE_DIR}/include/loader) +include_directories(${PROJECT_SOURCE_DIR}/include/policy) +include_directories(${PROJECT_SOURCE_DIR}/include/monitor) +include_directories(${PROJECT_SOURCE_DIR}/include/parser) + +include_directories(${INFRA_DIR}/include) +include_directories(${SECUREC_DIR}/include) +include_directories(${ZLOG_DIR}/include) +include_directories(${LIBNUMA_DIR}/include) + +#******************************************************************************* +#******************************************************************************* + +link_directories(${PROJECT_BINARY_DIR}/lib) +link_directories(${SECUREC_DIR}/lib) +link_directories(${ZLOG_DIR}/lib) +link_directories(${LIBNUMA_DIR}/lib) + +#******************************************************************************* +#******************************************************************************* + +add_subdirectory(client) +add_subdirectory(loader) +add_subdirectory(policy) +add_subdirectory(parser) + +add_executable(maio-utils main.c) +target_link_libraries(maio-utils "-Wl,--whole-archive" + client + loader + policy + parser + "-Wl,--no-whole-archive" + infra + dl) diff --git a/tools/mfs/maio-utils/src/client/CMakeLists.txt b/tools/mfs/maio-utils/src/client/CMakeLists.txt new file mode 100644 index 000000000000..0fb67d64eb03 --- /dev/null +++ b/tools/mfs/maio-utils/src/client/CMakeLists.txt @@ -0,0 +1,17 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +#aux_source_directory(. CLIENT_SRC) +set(CLIENT_SRC fs_client.c) + +#******************************************************************************* +#******************************************************************************* + +add_library(client ${CLIENT_SRC}) +target_link_libraries(client infra + securec) diff --git a/tools/mfs/maio-utils/src/client/fs_client.c b/tools/mfs/maio-utils/src/client/fs_client.c new file mode 100644 index 000000000000..5d359b8f22e1 --- /dev/null +++ b/tools/mfs/maio-utils/src/client/fs_client.c @@ -0,0 +1,359 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "fs_client.h" +#include "mfs.h" +#include "inner.h" +#include "hashmap.h" +#include "hashfunc.h" +#include "stimer.h" +#include "atomic.h" +#include "log.h" +#include "list.h" +#include "spinlock.h" +#include "sysdef.h" +#include "securec.h" + +#include <fcntl.h> +#include <errno.h> +#include <string.h> +#include <unistd.h> +#include <sys/ioctl.h> + +#define TIMER_CYCLE 10000 /* 10s */ +#define FD_TMOUT 3600 /* 60s */ + +struct fs_client { + int rootfd; + hashmap_t *map; + stimer_t *timer; + list_head_t head; + spinlock_t lock; + uint64_t tmout; +}; + +struct fs_client g_client = {0}; + +typedef struct { + uint32_t plen; + char *path; +} fdkey_t; + +typedef struct { + fdkey_t key; + int fd; + int ref; + uint64_t ts; + list_head_t link; + hashlink_t hash; +} fd_t; + +static inline int fd_cmp(void *first, void *second) +{ + fdkey_t *key1 = (fdkey_t *)first; + fdkey_t *key2 = (fdkey_t *)second; + + if (key1->plen != key2->plen) + return -1; + + return strcmp(key1->path, key2->path); +} + +static inline uint32_t fd_hash(void *args) +{ + fdkey_t *key = (fdkey_t *)args; + uint64_t hash = hashstr(key->path, key->plen); + + return (uint32_t)hash; +} + +static inline void fd_inc(void *args, hashlink_t *link) +{ + fd_t *f = container_of(link, fd_t, hash); + int ref = atomic_s32_inc(&f->ref); + if (ref <= 0) { + log_error("fd(%d) for path(%s) with invalid ref(%d)", + f->fd, f->key.path, ref); + sys_assert(0); + } +} + +static inline int fd_dec(void *args, hashlink_t *link) +{ + fd_t *f = container_of(link, fd_t, hash); + int ref = atomic_s32_dec(&f->ref); + + if (ref < 0) { + log_error("fd(%d) for path(%s) with invalid ref(%d)", + f->fd, f->key.path, ref); + sys_assert(0); + } + /* update access timestamp for the last one */ + if (ref == 0) + f->ts = _get_ts(); + return -1; +} + +static inline int fd_expire(void *args, hashlink_t *link) +{ + fd_t *f = container_of(link, fd_t, hash); + int ref = atomic_s32_fetch(&f->ref); + uint64_t cur; + + if (ref > 0) + return -1; + if (ref < 0) { + log_error("fd(%d) for path(%s) with invalid ref(%d)", + f->fd, f->key.path, ref); + sys_assert(0); + } + cur = _get_ts(); + return ((cur - f->ts) >= g_client.tmout) ? 0: -1; +} + +static fd_t *fd_alloc(const char *path) +{ + fd_t *f = (fd_t *)malloc(sizeof(fd_t)); + if (!f) { + log_error("alloc fd_t fail"); + return NULL; + } + + f->key.path = strdup(path); + if (!f->key.path) { + log_error("strdup(%s) fail", path); + free(f); + return NULL; + } + + f->key.plen = strlen(path) + 1; + f->fd = -1; + f->ref = 1; + f->hash.key = &f->key; + list_init(&f->link); + return f; +} + +static void fd_free(fd_t *f) +{ + if (f->fd > 0) { + int ret = close(f->fd); + if (ret != 0) { + log_error("close(%d) fail, err(%s)", f->fd, strerror(errno)); + } + f->fd = -1; + } + + if (f->key.path) { + free(f->key.path); + f->key.path = NULL; + } + list_del(&f->link); + free(f); +} + +static int fd_fetch(const char *path, fd_t **f_res, int dirfd) +{ + fdkey_t key; + key.plen = strlen(path) + 1; + key.path = (char *)path; + + /* fd in cache */ + hashlink_t *data = NULL; + if (EEXIST == hashmap_search(g_client.map, &key, &data, NULL, fd_inc)) { + *f_res = container_of(data, fd_t, hash); + (*f_res)->ts = _get_ts(); + return 0; + } + + /* new fd */ + fd_t *f = fd_alloc(path); + if (!f) + return -ENOMEM; + + /* open file */ + if (dirfd > 0) + f->fd = openat(dirfd, path, O_RDONLY, S_IRUSR | S_IRGRP); + else + f->fd = open(path, O_RDONLY, S_IRUSR | S_IRGRP); + if (f->fd < 0) { + if (errno != ENOENT) + log_error("open(%d,%s) fail, err(%s)", dirfd, path, strerror(errno)); + fd_free(f); + return errno; + } + + /* add to fd cache */ + hashlink_t *old = NULL; + if (EEXIST == hashmap_insert(g_client.map, &f->hash, &old, NULL, fd_inc)) { + fd_free(f); + f = container_of(old, fd_t, hash); + } + + spinlock_lock(&g_client.lock); + list_add_tail(&f->link, &g_client.head); + spinlock_unlock(&g_client.lock); + f->ts = _get_ts(); + *f_res = f; + return 0; +} + +static inline void fd_restore(fd_t *f) +{ + (void)hashmap_protect(g_client.map, &f->key, NULL, fd_dec); +} + +static void _fd_gc(void *args) +{ + list_head_t head, *curr, *next; + hashlink_t *data = NULL; + + list_init(&head); + spinlock_lock(&g_client.lock); + list_splice(&g_client.head, &head); + spinlock_unlock(&g_client.lock); + + list_foreach_safe(curr, next, &head) + { + fd_t *f = container_of(curr, fd_t, link); + if (atomic_s32_fetch(&f->ref) != 0) + continue; + /* try to destroy */ + if (0 != hashmap_delete(g_client.map, &f->key, &data, NULL, fd_expire)) + continue; + list_del(&f->link); + log_info("path:%s with fd:%d is expire.", f->key.path, f->fd); + fd_free(f); + } + + spinlock_lock(&g_client.lock); + list_splice(&head, &g_client.head); + spinlock_unlock(&g_client.lock); +} + +int fs_evict_by_path(const char*path, uint64_t off, uint64_t len) +{ + int ret; + fd_t *f; + uint64_t step = 4096 * 4; + + ret = fd_fetch(path, &f, 0); + if (ret) + return ret; + + while (len) { + if (step > len) + step = len; + ret = posix_fadvise(f->fd, off, len, POSIX_FADV_DONTNEED); + if (ret < 0) + break; + len -= step; + off += step; + } + + fd_restore(f); + return ret; +} + +int fs_load_by_path(const char *path, uint64_t off, uint64_t len) +{ + int ret; + fd_t *f; + uint64_t step = 16 * 4096; + char *buf = NULL; + + ret = fd_fetch(path, &f, 0); + if (ret) + return ret; + + buf = (char *)malloc(step); + + while (len) { + if (step > len) + step = len; + ret = pread(f->fd, buf, step, off); + if (ret <= 0) + break; + len -= step; + off += step; + } + free(buf); + fd_restore(f); + return ret; +} + +int fs_load_by_fd(int fd, uint64_t off, uint64_t len) +{ + struct mfs_ioc_ra ra; + + ra.off = off; + ra.len = len; + return ioctl(fd, MFS_IOC_RA, &ra); +} + +int fs_sync_by_path(const char *path, void *buf, uint64_t off, uint64_t len) +{ + ssize_t rsize = 0, ret; + uint64_t pos = 0; + fd_t *f; + + ret = fd_fetch(path + 1, &f, g_client.rootfd); + if (ret) + return ret; + + do { + ret = pread(f->fd, buf + pos, len - pos, off + pos); + if (ret == 0) + break; + if (ret < 0) { + log_error("failed to read:%s", strerror(errno)); + fd_restore(f); + return -1; + } + pos += ret; + rsize += ret; + } while (rsize < len); + fd_restore(f); + return 0; +} + +int fs_client_init(const char *source) +{ + int ret; + + g_client.rootfd = -1; + if (source) { + g_client.rootfd = open(source, O_RDONLY | O_DIRECTORY); + if (g_client.rootfd <= 0) { + log_error("open %s failed", source); + return -1; + } + } + ret = hashmap_create(1024, fd_cmp, fd_hash, &g_client.map); + if (ret) { + log_error("client fd map alloc failed"); + close(g_client.rootfd); + return ret; + } + + g_client.timer = stimer_create("LfsGc", TIMER_CYCLE, NULL, _fd_gc); + if (!g_client.timer) { + log_error("timer create failed"); + hashmap_destroy(g_client.map, NULL, NULL); + close(g_client.rootfd); + return -1; + } + list_init(&g_client.head); + spinlock_init(&g_client.lock); + g_client.tmout = FD_TMOUT; + return 0; +} + +void fs_client_exit() +{ + spinlock_destroy(&g_client.lock); + stimer_destroy(g_client.timer); + hashmap_destroy(g_client.map, NULL, NULL); + close(g_client.rootfd); +} + diff --git a/tools/mfs/maio-utils/src/loader/CMakeLists.txt b/tools/mfs/maio-utils/src/loader/CMakeLists.txt new file mode 100644 index 000000000000..08e1b637be26 --- /dev/null +++ b/tools/mfs/maio-utils/src/loader/CMakeLists.txt @@ -0,0 +1,18 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +aux_source_directory(. LOADER_SRC) + +#******************************************************************************* +#******************************************************************************* + +add_library(loader ${LOADER_SRC}) +target_link_libraries(loader infra + numa + securec) + diff --git a/tools/mfs/maio-utils/src/loader/loader.c b/tools/mfs/maio-utils/src/loader/loader.c new file mode 100644 index 000000000000..61c5302204fc --- /dev/null +++ b/tools/mfs/maio-utils/src/loader/loader.c @@ -0,0 +1,144 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "loader.h" + +#include "fs_client.h" +#include "threadpool.h" +#include "log.h" +#include "atomic.h" +#include "inner.h" +#include "sysdef.h" + +#include "securec.h" +#include "numa.h" +#include <errno.h> + +struct loader_mgr { + int numa_num; + threadpool_t **numa_thp; + uint64_t curseq; +}; + +struct loader_mgr g_local_mgr; + +static threadpool_t *choose_worker_pool(struct io_context *ioctx) +{ + static uint64_t cid = 0; + int nid; + + if (ioctx->numaid == (uint16_t)-1) + nid = cid++ % g_local_mgr.numa_num; + else + nid = ioctx->numaid % g_local_mgr.numa_num; + return g_local_mgr.numa_thp[nid]; +} + +static void handle_io(void *args) +{ + struct io_context *ioctx = (struct io_context *)args; + int ret; + + if (g_local_mgr.curseq > ioctx->seq) { + if (ioctx->end_io) + ioctx->end_io(0, ioctx->private); + return; + } + ret = ioctx->path ? fs_load_by_path(ioctx->path, ioctx->off, ioctx->len) + : fs_load_by_fd(ioctx->fd, ioctx->off, ioctx->len); + if (ioctx->end_io) + ioctx->end_io(ret, ioctx->private); +} + +int loader_io_submit(struct io_context *ioctx) +{ + threadpool_t *worker_pools = choose_worker_pool(ioctx); + + threadpool_submit(worker_pools, ioctx, handle_io); + return 0; +} + +void loader_update_curseq(uint64_t seq) +{ + uint64_t curseq = atomic_u64_fetch(&g_local_mgr.curseq); + uint64_t old; + + while (seq > curseq) { + if (atomic_u64_cas(&g_local_mgr.curseq, curseq, seq, &old)) + break; + curseq = old; + } +} + +static void handle_evict(void *args) +{ + struct io_context *ioctx = (struct io_context *)args; + int ret; + + ret = ioctx->path ? fs_evict_by_path(ioctx->path, ioctx->off, ioctx->len) : 0; + if (ioctx->end_io) + ioctx->end_io(ret, ioctx->private); +} + +int loader_evict_submit(struct io_context *ioctx) +{ + threadpool_t *worker_pools = choose_worker_pool(ioctx); + + threadpool_submit(worker_pools, ioctx, handle_evict); + return 0; +} + +static void _free_loader() +{ + int i; + + if (!g_local_mgr.numa_thp) + return; + + for (i = 0; i < g_local_mgr.numa_num; i++) + threadpool_destroy(g_local_mgr.numa_thp[i]); + free(g_local_mgr.numa_thp); + g_local_mgr.numa_thp = NULL; +} + +int loader_init() +{ + int i, ret, wnum = 8; + char name[THD_NAME + 1] = {0}; + + if (numa_available() < 0) { + log_error("Current system does not support NUAM api"); + return -1; + } + + g_local_mgr.numa_num = numa_max_node() + 1; + g_local_mgr.curseq = 0; + ret = 0; + do { + g_local_mgr.numa_thp = + calloc(g_local_mgr.numa_num, sizeof(threadpool_t *)); + if (!g_local_mgr.numa_thp) { + log_error("alloc for numa threadpool failed"); + ret = -1; + break; + } + for (i = 0; i < g_local_mgr.numa_num; i++) { + sprintf_s(name, sizeof(name), "Loader-%d", i); + g_local_mgr.numa_thp[i] = threadpool_create(name, wnum, i); + if (!g_local_mgr.numa_thp[i]) { + log_error("alloc Loader-%d failed", i); + ret = -1; + break; + } + } + } while (0); + + if (ret != 0) + _free_loader(); + return ret; +} + +void loader_exit() +{ + _free_loader(); +} diff --git a/tools/mfs/maio-utils/src/main.c b/tools/mfs/maio-utils/src/main.c new file mode 100644 index 000000000000..854c5b298521 --- /dev/null +++ b/tools/mfs/maio-utils/src/main.c @@ -0,0 +1,156 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include <stdlib.h> +#include <unistd.h> +#include <string.h> +#include <getopt.h> +#include <errno.h> +#include <fcntl.h> +#include <poll.h> + +#include "loader.h" +#include "log.h" +#include "maio.h" +#include "policy.h" +#include "req_parser.h" +#include "fs_client.h" +#include "mfs.h" +#include "securec.h" + +#include <sys/ioctl.h> +#include <sys/statfs.h> + +#define MAX_BUF_SIZE 1024 +#define MFS_SUPER_MAGIC 0x85428370 + +static int read_req(int fd) +{ + char *buf; + int ret; + + buf = calloc(MAX_BUF_SIZE, sizeof(char)); + if (!buf) { + log_error("failed to alloc buf\n"); + return -1; + } + ret = read(fd, buf, MAX_BUF_SIZE); + if (ret <= 0) { + if (ret < 0) + log_error("failed to read, ret:%d\n", ret); + return -1; + } + return maio_parse_req(buf, ret); +} + +static void dev_monitor(int dfd) +{ + struct pollfd pfd; + int ret; + + pfd.fd = dfd; + pfd.events = POLLIN; + while (1) { + ret = poll(&pfd, 1, -1); + if (ret < 0) { + log_error("poll failed\n"); + return; + } + if (ret == 0 || !(pfd.revents & POLLIN)) { + log_error("poll events error, ret:%d, revents:%x\n", ret, pfd.revents); + continue; + } + while(!read_req(pfd.fd)) {} + } +} + +int main(int argc, char *argv[]) +{ + const char *mntpoint = NULL, *strategylib = NULL; + struct mfs_ioc_fsinfo fsinfo = {0}; + int dfd, ret, opt; + struct statfs buf; + char devname[10]; + + while ((opt = getopt(argc, argv, "m:s:")) != -1) { + switch (opt) { + case 'm': + mntpoint = optarg; + break; + case 's': + strategylib = optarg; + break; + default: + fprintf(stderr, "Usage: %s -m ${mnt} [-s ${strategylib}]\n", argv[0]); + return -EINVAL; + } + } + if (!mntpoint) { + fprintf(stderr, "mount point should specify\n"); + fprintf(stderr, "Usage: %s -m ${mnt} [-s ${strategylib}]\n", argv[0]); + return -1; + } + + ret = statfs(mntpoint, &buf); + if (ret) { + log_error("statfs %s failed, errstr:%s\n", mntpoint, strerror(errno)); + return -1; + } + if (buf.f_type != MFS_SUPER_MAGIC) { + log_error("fstype(%x) is invalid, please check the mountpoint", buf.f_type); + return -1; + } + + sprintf_s(devname, sizeof(devname), "/dev/mfs%ld", buf.f_spare[0]); + /* Open with O_CLOEXEC to avoid potential fd leaks */ + dfd = open(devname, O_RDWR | O_CLOEXEC); + if (dfd < 0) { + log_error("open %s failed errstr:%s\n", devname, strerror(errno)); + return -1; + } + + ret = ioctl(dfd, MFS_IOC_FSINFO, (unsigned long)&fsinfo); + if (ret < 0) { + log_error("ioctl get fsinfo failed, ret:%d\n", ret); + goto close_fd; + } + if (fsinfo.mode != 1) { + log_error("fs runing mode(%d) is not supported", fsinfo.mode); + goto close_fd; + } + ret = loader_init(); + if (ret) { + log_error("loader init failed"); + goto close_fd; + } + ret = fs_client_init(NULL); + if (ret) { + log_error("clients init failed"); + goto free_loader; + } + ret = parser_init(fsinfo.mode, mntpoint); + if (ret) { + log_error("parser init failed"); + goto free_client; + } + ret = policy_init(); + if (ret) { + log_error("policy init failed"); + goto free_parser; + } + ret = policy_register(strategylib); + if (ret) { + log_info("register new policy failed, use default policy"); + } + + dev_monitor(dfd); +free_parser: + parser_destory(); +free_client: + fs_client_exit(); +free_loader: + loader_exit(); +close_fd: + close(dfd); + return ret; +} diff --git a/tools/mfs/maio-utils/src/parser/CMakeLists.txt b/tools/mfs/maio-utils/src/parser/CMakeLists.txt new file mode 100644 index 000000000000..72e5849da8e4 --- /dev/null +++ b/tools/mfs/maio-utils/src/parser/CMakeLists.txt @@ -0,0 +1,16 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +aux_source_directory(. PARSER_SRC) + +#******************************************************************************* +#******************************************************************************* + +add_library(parser ${PARSER_SRC}) +target_link_libraries(parser infra + securec) diff --git a/tools/mfs/maio-utils/src/parser/req_parser.c b/tools/mfs/maio-utils/src/parser/req_parser.c new file mode 100644 index 000000000000..83a975276bc2 --- /dev/null +++ b/tools/mfs/maio-utils/src/parser/req_parser.c @@ -0,0 +1,313 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ + +#include "inner.h" +#include "log.h" +#include "mfs.h" +#include "policy.h" +#include "securec.h" +#include "threadpool.h" + +#include <stdbool.h> +#include <errno.h> +#include <sys/ioctl.h> +#include <sys/stat.h> + +struct parser_mgr { + uint32_t fs_mode; + uint32_t chunk_size; + const char *mntpoint; + threadpool_t *parser; +}; + +struct parser_mgr g_parser_mgr; + +#define PARSER_NUM 8 +#define MAX_PATH_SIZE 1024 + +#define __round_mask(x, y) ((__typeof__(x))((y)-1)) +#define round_up(x, y) ((((x)-1) | __round_mask(x, y))+1) +#define round_down(x, y) ((x) & ~__round_mask(x, y)) + +#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) +#define MIN(x, y) ((x) < (y) ? (x) : (y)) + +bool is_power_of_2(unsigned long n) +{ + return (n != 0 && ((n & (n - 1)) == 0)); +} + +void ctx_cb(int ret, void *args) +{ + struct io_context *ctx = (struct io_context *)args; + + if (ctx->path) + free(ctx->path); + if (ctx->buf) + free(ctx->buf); + free(ctx); +} + +void _submit_local_io(int fd, struct maio_entry *entry) +{ + struct io_context *ioctx; + + ioctx = calloc(1, sizeof(struct io_context)); + if (!ioctx) { + log_error("ioctx alloc failed"); + return; + } + ioctx->off = entry->toff; + ioctx->len = entry->tlen; + ioctx->numaid = entry->tnuma; + ioctx->fd = fd; + ioctx->path = entry->fpath; + ioctx->seq = entry->seq; + ioctx->private = ioctx; + ioctx->end_io = ctx_cb; + loader_io_submit(ioctx); +} + +char *get_file_path(int fd) +{ + struct mfs_ioc_rpath *rp; + char *path; + int ret; + + rp = malloc(sizeof(struct mfs_ioc_rpath) + MAX_PATH_SIZE); + if (!rp) { + log_error("rpath alloc failed"); + return NULL; + } + rp->max = MAX_PATH_SIZE; + ret = ioctl(fd, MFS_IOC_RPATH, (unsigned long)rp); + if (ret) { + log_error("realpath failed for fd:%d, ret:%d", fd, ret); + free(rp); + return NULL; + } + rp->d[rp->len] = '\0'; + + path = malloc(strlen(g_parser_mgr.mntpoint) + rp->len); + if (!path) { + log_error("malloc path %s %s failed", g_parser_mgr.mntpoint, (const char *)rp->d); + return NULL; + } + sprintf(path, "%s%s", g_parser_mgr.mntpoint, (const char *)rp->d); + free(rp); + return path; +} + +char *_get_fullpath(char *fpath, int fd) +{ + struct mfs_ioc_rpath *rp; + char *path; + int ret; + + if (fpath) + return fpath; + rp = malloc(sizeof(struct mfs_ioc_rpath) + MAX_PATH_SIZE); + if (!rp) { + log_error("rpath alloc failed"); + return NULL; + } + rp->max = MAX_PATH_SIZE; + ret = ioctl(fd, MFS_IOC_RPATH, (unsigned long)rp); + if (ret) { + log_error("realpath failed for fd:%d, ret:%d", fd, ret); + free(rp); + return NULL; + } + rp->d[rp->len] = '\0'; + path = strdup((const char *)rp->d); + if (!path) + log_error("strdup path(%s) failed", (const char *)rp->d); + free(rp); + return path; +} + +void maio_preload(struct maio *maio, int nio) +{ + struct maio_entry *entry; + + for (int i = 0; i < nio; ++i) { + entry = &maio->entries[i]; + _submit_local_io(0, entry); + } +} + +uint8_t pid_to_numaid(int pid) +{ + return (uint8_t)-1; +} + +void _process_read_io(uint32_t id, struct maio *maio, int nio) +{ + struct maio_entry *entry; + int i; + + /* process the successor io */ + for (i = 0; i < nio; i++) { + entry = &maio->entries[i]; + _submit_local_io(maio->fd, entry); + } +} + +void _submit_evict(struct maio_entry *entry) +{ + struct io_context *ioctx; + + ioctx = calloc(1, sizeof(struct io_context)); + if (!ioctx) { + log_error("ioctx alloc failed"); + return; + } + ioctx->off = entry->toff; + ioctx->len = entry->tlen; + ioctx->numaid = -1; + ioctx->path = entry->fpath; + ioctx->private = ioctx; + ioctx->end_io = ctx_cb; + loader_evict_submit(ioctx); +} + +void _process_evict(struct mfs_msg *msg) +{ + struct maio_entry *entry; + struct mfs_read *read; + uint64_t soff, eoff; + struct maio *maio; + int ret; + + if (g_parser_mgr.fs_mode != MFS_MODE_LOCAL) + return; + + maio = calloc(1, sizeof(struct maio)); + if (!maio) { + log_error("failed to alloc maio"); + return; + } + + read = (void*)msg->data; + maio->cksz = g_parser_mgr.chunk_size; + soff = round_down(read->off, maio->cksz); + eoff = round_up(read->off + read->len, maio->cksz); + maio->fd = msg->fd; + maio->off = read->off; + maio->len = eoff - soff; + maio->pid = read->pid; + maio->op = msg->opcode; + + ret = policy_evict(&maio); + if (ret <= 0) + goto out; + + for (int i = 0; i < ret; ++i) { + entry = &maio->entries[i]; + _submit_evict(entry); + } +out: + free(maio); +} + +void _parse_read_req(struct mfs_msg *msg) +{ + struct mfs_read *read; + struct maio *maio; + uint64_t soff, eoff, ts; + int ret, io_num = policy_max_io(); + + _process_evict(msg); + + /* alloc maio slots */ + maio = calloc(1, sizeof(struct maio) + io_num * sizeof(struct maio_entry)); + if (!maio) { + log_error("failed to alloc maio, num:%d", io_num); + return; + } + read = (void *)msg->data; + maio->cksz = g_parser_mgr.chunk_size; + soff = round_down(read->off, maio->cksz); + eoff = round_up(read->off + read->len, maio->cksz); + ts = _get_ts(); + maio->fd = msg->fd; + maio->off = soff; + maio->len = eoff - soff; + maio->pid = read->pid; + maio->op = msg->opcode; + maio->ts = ts; + + /* fill slots from policy */ + ret = policy_load(&maio); + if (ret < 0) { + char *path = _get_fullpath(NULL, maio->fd); + if (path) { + log_warn("io on path:%s%s offset:%lu length:%lu dropped", + g_parser_mgr.mntpoint, path, read->off, read->len); + free(path); + } + free(maio); + return; + } + + if (maio->flags & MAIO_WITH_SEQ) + loader_update_curseq(maio->curseq); + + /* keep the input parameter */ + maio->fd = msg->fd; + maio->off = soff; + maio->len = eoff - soff; + maio->cksz = g_parser_mgr.chunk_size; + maio->pid = read->pid; + maio->op = msg->opcode; + maio->ts = ts; + + /* process each maio in slots */ + _process_read_io(msg->id, maio, ret); + free(maio); +} + +void _parse_one_req(void *buf) +{ + struct mfs_msg *msg = (struct mfs_msg *)buf; + + if (msg->opcode == MFS_OP_READ || msg->opcode == MFS_OP_FAULT) + _parse_read_req(msg); + + free(buf); +} + +int maio_parse_req(void *buf, int size) +{ + struct mfs_msg *msg = (struct mfs_msg *)buf; + + if (msg->len != size) + return -1; + + threadpool_submit(g_parser_mgr.parser, buf, _parse_one_req); + return 0; +} + +int parser_init(uint32_t fs_mode, const char *mntpoint) +{ + g_parser_mgr.fs_mode = fs_mode; + g_parser_mgr.mntpoint = strdup(mntpoint); + g_parser_mgr.chunk_size = 4096; + if (!is_power_of_2(g_parser_mgr.chunk_size)) { + log_error("chunk size must be power of 2"); + return -1; + } + g_parser_mgr.parser = threadpool_create("ReqParser", PARSER_NUM, -1); + if (!g_parser_mgr.parser) { + log_error("failed to alloc parser threadpool"); + return -1; + } + + return 0; +} + +void parser_destory() +{ + threadpool_destroy(g_parser_mgr.parser); +} diff --git a/tools/mfs/maio-utils/src/policy/CMakeLists.txt b/tools/mfs/maio-utils/src/policy/CMakeLists.txt new file mode 100644 index 000000000000..714023475e07 --- /dev/null +++ b/tools/mfs/maio-utils/src/policy/CMakeLists.txt @@ -0,0 +1,16 @@ +#******************************************************************************* +#******************************************************************************* + +include_directories(${CMAKE_CURRENT_SOURCE_DIR}) + +#******************************************************************************* +#******************************************************************************* + +aux_source_directory(. POLICY_SRC) + +#******************************************************************************* +#******************************************************************************* + +add_library(policy ${POLICY_SRC}) +target_link_libraries(policy infra + securec) diff --git a/tools/mfs/maio-utils/src/policy/policy.c b/tools/mfs/maio-utils/src/policy/policy.c new file mode 100644 index 000000000000..404358ff9b46 --- /dev/null +++ b/tools/mfs/maio-utils/src/policy/policy.c @@ -0,0 +1,114 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "policy.h" + +#include "maio.h" +#include "log.h" +#include "securec.h" +#include <dlfcn.h> + +typedef struct maio_operation* (*strategy_init)(); + +struct policy_mgr { + void *handle; + struct maio_operation *strategy; +}; + +struct policy_mgr g_policy; + +static int default_init(void) +{ + return 0; +} + +static void default_exit(void) +{ +} + +static int default_load(struct maio **io) +{ + return 0; +} + +static int default_evict(struct maio **io) +{ + return 0; +} + +struct maio_operation default_ops = { + .max_io = 1, + .init = default_init, + .exit = default_exit, + .load = default_load, + .evict = default_evict, +}; + +static void set_default_strategy() +{ + g_policy.strategy = &default_ops; +} + +int policy_max_io(void) +{ + return g_policy.strategy->max_io; +} + +/* return the filled num of io */ +int policy_load(struct maio **io) +{ + return g_policy.strategy->load(io); +} + +int policy_evict(struct maio **io) +{ + return g_policy.strategy->evict(io); +} + +int policy_register(const char *path) +{ + strategy_init sinit; + + if (!path || strlen(path) == 0) + return -1; + + g_policy.handle = dlopen(path, RTLD_LAZY); + if (!g_policy.handle) { + log_error("dlopen failed:%s", dlerror()); + return -1; + } + + sinit = dlsym(g_policy.handle, "register_strategy"); + if (!sinit) { + log_error("dlsym failed:%s", dlerror()); + dlclose(g_policy.handle); + g_policy.handle = NULL; + return -1; + } + g_policy.strategy = sinit(); + if (g_policy.strategy->init()) + return -1; + log_info("register strategy:%s done.", path); + return 0; +} + +void policy_unregister() +{ + if (g_policy.handle) { + g_policy.strategy->exit(); + dlclose(g_policy.handle); + g_policy.handle = NULL; + } + set_default_strategy(); +} + +int policy_init() +{ + g_policy.handle = NULL; + set_default_strategy(); + return 0; +} + +void policy_exit() +{ +} diff --git a/tools/mfs/maio-utils/test/Makefile b/tools/mfs/maio-utils/test/Makefile new file mode 100644 index 000000000000..6c87247aafa0 --- /dev/null +++ b/tools/mfs/maio-utils/test/Makefile @@ -0,0 +1,26 @@ +# SPDX-License-Identifier: GPL-2.0 + +CC := gcc +CFLAGS := -fPIC -Wall -Werror -O2 +CPPFLAGS := -fPIC -Wall -Werror -O2 -std=c++11 -g +LDFLAGS := -shared + +CFLAGS += $(addprefix -I,../include) +CPPFLAGS += $(addprefix -I,../include) + +C_SRCS := $(wildcard *.c) +CPP_SRCS := $(wildcard *.cpp) +TARGETS := $(C_SRCS:.c=.so) $(CPP_SRCS:.cpp=.so) + +all: $(TARGETS) + +%.so: %.c + $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $< + +%.so: %.cpp + $(CC) $(CPPFLAGS) $(LDFLAGS) -o $@ $< + +clean: + rm -f $(TARGETS) + +.PHONY: all clean diff --git a/tools/mfs/maio-utils/test/README.md b/tools/mfs/maio-utils/test/README.md new file mode 100644 index 000000000000..a7b7980de933 --- /dev/null +++ b/tools/mfs/maio-utils/test/README.md @@ -0,0 +1,61 @@ +Here, we provide some strategies library for some cases. + +- strategy_demo +A simple strategy library shows how to write a demo. + +- strategy_prefetch +A prefetch strategy library to prefetch data. + +- strategy_toend +A readahead strategy until the end. + +- strategy_generate +A tools using maio-util to generate the io trace. + +- strategy_replay +A strategy to replay the io trace. + +### How to build + +Using `make -j` to build the libraries. + +### How to use + +Set the library path as the `-s` parameter's value to run with maio-utils. Here we show usage of the advanced replay strategy: + +- generate the io trace + +> assume you have mounted the mfs at /mnt/mfs + +This is the tracing period. + +``` +export MAIO_TRACE_FILE=trace.txt +export MAIO_MNTPOINT=/mnt/mfs # /mnt/mfs is the MFS mountpoint +./bin/maio-utils -m /mnt/mfs -s /home/lihb/workspace/hulk-6.6/maio-utils/test/strategy_generate.so +``` +Then, you can trigger the io. After finishing, you would get the trace file with the content likes: + +``` +xxx/model-00001-of-000008.safetensors 0 32768 0 +xxx/model-00001-of-000008.safetensors 32768 32768 0 +xxx/model-00001-of-000008.safetensors 65536 32768 0 +xxx/model-00001-of-000008.safetensors 98304 32768 0 +xxx/model-00001-of-000008.safetensors 131072 32768 0 +... + +``` + +The format is "<path> <offset> <length> <numaid>". + +- replay the io trace + +> assume you have mounted the mfs at /mnt/mfs and begin to launch the model. + +This is the running period. + +``` +export MAIO_TRACE_FILE=trace.txt +export MAIO_MNTPOINT=/mnt/mfs # /mnt/mfs is the MFS mountpoint +./bin/maio-utils -m /mnt/mfs -s /home/lihb/workspace/hulk-6.6/maio-utils/test/replay.so +``` diff --git a/tools/mfs/maio-utils/test/strategy_demo.c b/tools/mfs/maio-utils/test/strategy_demo.c new file mode 100644 index 000000000000..54554b609f85 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_demo.c @@ -0,0 +1,45 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include <stddef.h> + +int demo_init(void) +{ + return 0; +} + +void demo_exit(void) +{ +} + +int demo_load(struct maio **io) +{ + struct maio_entry *entry; + + entry = (*io)->entries; + entry[0].toff = (*io)->off + (*io)->len; + entry[0].tlen = (*io)->cksz; + entry[0].fpath = NULL; + entry[0].tnuma = -1; + return 1; +} + +int demo_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation demo_strategy = { + .max_io = 1, + .init = demo_init, + .exit = demo_exit, + .load = demo_load, + .evict = demo_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&demo_strategy; +} diff --git a/tools/mfs/maio-utils/test/strategy_generate.cpp b/tools/mfs/maio-utils/test/strategy_generate.cpp new file mode 100644 index 000000000000..929be30e6a42 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_generate.cpp @@ -0,0 +1,296 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include "strategy_template.h" + +#include <array> +#include <atomic> +#include <cstring> +#include <condition_variable> +#include <fstream> +#include <sstream> +#include <iostream> +#include <mutex> +#include <queue> +#include <thread> +#include <unordered_map> +#include <vector> +#include <unistd.h> + +using namespace std; + +#define MAIO_MNTPOINT "MAIO_MNTPOINT" +#define MAIO_TRACE_FILE "MAIO_TRACE_FILE" +#define CACHEDIR "cachedir" + +#define MAXLINE 1024 + +/* Data struct definition */ +template<typename T> +class SafeQueue { +private: + queue<T> data_queue; + mutex mtx; + condition_variable cv; + +public: + // 添加数据到队列 + void push(T item) { + lock_guard<mutex> lock(mtx); + data_queue.push(move(item)); + cv.notify_one(); + } + + // 从队列取出数据（阻塞直到有数据） + T pop() { + unique_lock<mutex> lock(mtx); + cv.wait(lock, [this]{ return !data_queue.empty(); }); + T item = move(data_queue.front()); + data_queue.pop(); + return item; + } + + // 检查队列是否为空 + bool empty() { + lock_guard<mutex> lock(mtx); + return data_queue.empty(); + } +}; + +struct io { + string name; + uint64_t off; + uint64_t len; + uint8_t npu; + + io(const string& _name, uint64_t _off, uint64_t _len, uint8_t _npu) + : name(_name), off(_off), len(_len), npu(_npu) {} +}; + +/* Global variable definition */ +unordered_map<int, char*> fd_map; /* map fd to path */ +mutex fd_mutex; +string cachedir; + +vector<io> iovec; /* io traces */ +mutex iovec_mutex; +SafeQueue<vector<io>> iovec_queue; + +ofstream tfile; /* trace file */ + +thread writer; + +unordered_map<int, int> process_npu_map; +mutex pnpu_mutex; + +atomic<int> npu_smi_enable(-1); + +/* fd_map helper function */ +char* fd_path_find(int iofd) { + lock_guard<mutex> lock(fd_mutex); + auto it = fd_map.find(iofd); + if (it != fd_map.end()) { + return it->second; + } else { + char *path = _get_fullpath(NULL, iofd); + fd_map.insert({iofd, path}); + return path; + } +} + +/* iovec helper function */ +void io_insert_data(string name, uint64_t off, uint64_t len, uint8_t npu) +{ + lock_guard<mutex> lock(iovec_mutex); + iovec.emplace_back(name, off, len, npu); + + vector<io> copy_iovec = move(iovec); + iovec.clear(); + + iovec_queue.push(move(copy_iovec)); +} + +void get_mount_option(const char* mntpoint, const char* option) +{ + ifstream mounts("/proc/mounts"); + string line, target_mp; + + if (!mounts.is_open()) { + cerr << "Error: could not open /proc/mounts" << endl; + return; + } + + while (getline(mounts, line)) { + istringstream iss(line); + string device, mp, fs_type, options; + + if (!(iss >> device >> mp >> fs_type >> options)) + continue; + + if (mp.back() != '/') + mp += '/'; + target_mp = mntpoint; + if (target_mp.back() != '/') + target_mp += '/'; + + if (target_mp == mp) { + istringstream opt_stream(options); + string opt; + + while (getline(opt_stream, opt, ',')) { + if (opt.find(option) == 0) { + if (opt[strlen(option)] == '=') { + cachedir = opt.substr(strlen(option) + 1); + } + } + } + break; + } + } +} + +void writer_thread() { + while (true) { + vector<io> iovec_to_write = iovec_queue.pop(); + + for (const auto &item : iovec_to_write) + tfile << cachedir << item.name << " " << item.off << " " << item.len << " " << (unsigned int)item.npu << endl; + tfile.flush(); + } +} + +string exec_cmd(const char* cmd) { + array<char, 128> buffer; + string result; + unique_ptr<FILE, decltype(&pclose)> pipe(popen(cmd, "r"), pclose); + + if (!pipe) { + throw std::runtime_error("popen() failed!"); + } + while (fgets(buffer.data(), buffer.size(), pipe.get()) != nullptr) { + result += buffer.data(); + } + return result; +} + +bool isNumber(const std::string& str) { + return !str.empty() && str.find_first_not_of("0123456789") == std::string::npos; +} + +void get_npu_info(string &npuinfo) +{ + istringstream iss(npuinfo); + string line; + + while (getline(iss, line)) { + istringstream lineStream(line); + string token; + vector<string> tokens; + while (getline(lineStream, token, ' ')) { + if (!token.empty()) { + tokens.push_back(token); + } + } + if (tokens.size() >= 3) { + if (!isNumber(tokens[1]) || !isNumber(tokens[4])) + continue; + int npuId = stoi(tokens[1]); + int processId = stoi(tokens[4]); + process_npu_map[processId] = npuId; + } + } +} + +int process_npu_find(int processid) { + lock_guard<mutex> lock(pnpu_mutex); + auto it = process_npu_map.find(processid); + + if (npu_smi_enable.load() == -1) { + if (exec_cmd("command -v npu-smi").empty()) + npu_smi_enable.store(0); + else + npu_smi_enable.store(1); + } + + if (npu_smi_enable.load() == 0) + return 0; + + if (it != process_npu_map.end()) { + return it->second; + } else { + string result = exec_cmd("npu-smi info"); + get_npu_info(result); + auto it = process_npu_map.find(processid); + if (it != process_npu_map.end()) + return it->second; + else + return 0; + } +} + +int strategy_init(void) +{ + char *tfilename = getenv(MAIO_TRACE_FILE); + char *mntpoint = getenv(MAIO_MNTPOINT); + + if(!tfilename || !mntpoint) { + printf("no MAIO_TRACE_FILE or MAIO_MNTPOINT env variable\n"); + return -1; + } + get_mount_option(mntpoint, CACHEDIR); + string stfilename = tfilename; + tfile.open(stfilename, ios::trunc); + writer = thread(writer_thread); + if (!tfile.is_open()) { + cerr << "Error: could not open" << stfilename << endl; + return -1; + } + return 0; +} + +void strategy_exit(void) +{ + lock_guard<mutex> lock(iovec_mutex); + vector<io> copy_iovec = move(iovec); + iovec.clear(); + iovec_queue.push(move(copy_iovec)); + + tfile.close(); + writer.join(); +} + +int strategy_load(struct maio **io) +{ + char *path; + string pathStr; + int ret = 0; + + if (!tfile.is_open()) + return -1; + + path = fd_path_find((*io)->fd); + pathStr.assign(path); + io_insert_data(pathStr, (*io)->off, (*io)->len, process_npu_find((*io)->pid)); + + return ret; +} + +int strategy_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation maio_strategy = { + .max_io = 1, + .init = strategy_init, + .exit = strategy_exit, + .load = strategy_load, + .evict = strategy_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&maio_strategy; +} diff --git a/tools/mfs/maio-utils/test/strategy_prefetch.cpp b/tools/mfs/maio-utils/test/strategy_prefetch.cpp new file mode 100644 index 000000000000..9ba205931cdc --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_prefetch.cpp @@ -0,0 +1,150 @@ +#include "strategy_prefetch.h" +#include "maio.h" +#include <iostream> +#include <map> +#include <cstring> +#include <string> +#include <stdint.h> +#include <sys/stat.h> +#include <sys/mman.h> +#include <dirent.h> +#include <fcntl.h> +#include <unistd.h> + +using namespace std; + +struct prefetch_mgr { + map<string, uint64_t> files; +}; + +struct prefetch_mgr g_prefetch; + +int get_files(const char *parent) +{ + DIR *dir; + struct dirent *entry; + string filepath; + struct stat buf; + + if ((dir = opendir(parent)) == NULL) { + cout<<"opening directory failed"<<endl; + return -1; + } + + while ((entry = readdir(dir)) != NULL) { + if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) + continue; + + filepath = string(parent) + "/" + string(entry->d_name); + if (stat(filepath.c_str(), &buf) == -1) { + cout<<"stat path:"<<filepath<<" failed"<<endl; + continue; + } + if (S_ISDIR(buf.st_mode)) + continue; + cout<<"Find file:"<<filepath<<" size:"<<buf.st_size<<endl; + g_prefetch.files.insert(pair<string, uint64_t>(filepath, buf.st_size)); + } + + map<string, uint64_t>::iterator it; + for (it = g_prefetch.files.begin(); it != g_prefetch.files.end(); ++it) { + cout<<"path:"<<it->first<<" size:"<<it->second<<endl; + } + return 0; +} + +int prefetch_init(void) +{ + char *parent = getenv("MODEL_WEIGHT_DIR"); + if (!parent) { + cout<<"please set the env MODEL_WEIGHT_DIR"<<endl; + return -1; + } + + if (get_files(parent) != 0) { + cout<<"get all files failed"<<endl; + return -1; + } + return 0; +} + +void prefetch_exit(void) +{ +} + +struct thread_ctx { + char *path; + uint64_t off; + uint64_t len; +}; + +void *fault(void *arg) +{ + struct thread_ctx *ctx = (struct thread_ctx *)arg; + int fd = open(ctx->path, O_RDONLY); + if (fd < 0) { + cout<<"open file:%s"<<ctx->path<<" failed"<<endl; + free(ctx); + return NULL; + } + + cout<<"FAULT path:"<<ctx->path<<" fd:"<<fd<<" off:"<<ctx->off<<" len:"<<ctx->len<<endl; + void *addr = mmap(NULL, ctx->len, PROT_READ, MAP_SHARED, fd, 0); + uint64_t idx; + char tmp, total, *buffer = (char *)addr; + total = 'B'; + for (idx = 0; idx < ctx->len; idx += 4096) { + tmp = buffer[idx]; + total += tmp; + } + cout<<"Fault calculate total:"<<total<<endl; + munmap(addr, ctx->len); + close(fd); + free(ctx); + return NULL; +} + +int prefetch_load(struct maio **io) +{ + map<string, uint64_t>::iterator it; + struct thread_ctx *ctx; + pthread_t t0; + int ret; + + for (it = g_prefetch.files.begin(); it != g_prefetch.files.end(); ++it) { + ctx = (struct thread_ctx *)malloc(sizeof(struct thread_ctx)); + if (!ctx) { + cout<<"malloc ctx failed"<<endl; + continue; + } + ctx->path = strdup(it->first.c_str()); + ctx->off = 0; + ctx->len = it->second; + ret = pthread_create(&t0, NULL, fault, ctx); + if (ret == 0) + pthread_detach(t0); + } + g_prefetch.files.clear(); + + return 0; +} + +int prefetch_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation prefetch_strategy = { + .max_io = 1, + .init = prefetch_init, + .exit = prefetch_exit, + .load = prefetch_load, + .evict = prefetch_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&prefetch_strategy; +} + diff --git a/tools/mfs/maio-utils/test/strategy_prefetch.h b/tools/mfs/maio-utils/test/strategy_prefetch.h new file mode 100644 index 000000000000..2c2475dc91f0 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_prefetch.h @@ -0,0 +1,21 @@ +#ifndef STRATEGY_PREFETCH_H +#define STRATEGY_PREFETCH_H + +#ifdef __cplusplus +extern "C" { +#endif + +int prefetch_init(void); +void prefetch_exit(void); +int prefetch_load(struct maio *io); +int prefetch_evict(struct maio **io); + +extern const struct maio_operation prefetch_strategy; + +struct maio_operation *register_strategy(); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/tools/mfs/maio-utils/test/strategy_replay.cpp b/tools/mfs/maio-utils/test/strategy_replay.cpp new file mode 100644 index 000000000000..85c1c7defedd --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_replay.cpp @@ -0,0 +1,540 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include "strategy_template.h" + +#include <atomic> +#include <array> +#include <cstring> +#include <fstream> +#include <iostream> +#include <map> +#include <mutex> +#include <sstream> +#include <string> +#include <thread> +#include <unordered_map> +#include <vector> +#include <pthread.h> +#include <fcntl.h> +#include <unistd.h> + +using namespace std; + +#define MAIO_MNTPOINT "MAIO_MNTPOINT" +#define MAIO_TRACE_FILE "MAIO_TRACE_FILE" +#define CACHEDIR "cachedir" +#define MAXLINE 1024 + +/* Data structure definition */ +enum { + IO_NONE = 0, + IO_LOADED, + IO_EVICTED, +}; + +struct io { + string name; + uint64_t off; + uint64_t len; + uint8_t npu; + int flag; + + explicit io(const string& _name, uint64_t _off, uint64_t _len, uint8_t _npu) + : name(_name), off(_off), len(_len), npu(_npu), flag(IO_NONE) {} +}; + + +struct ioKey { + string name; + uint64_t off; + uint64_t len; + uint8_t npu; + + ioKey(const string& _name, uint64_t _off, uint64_t _len, uint8_t _npu) + : name(_name), off(_off), len(_len), npu(_npu) {} + + bool operator<(const ioKey &other) const { + return name < other.name || (name == other.name && off < other.off) || + (name == other.name && off == other.off && len < other.len); + } +}; + +vector<io> iovec; /* io traces */ +map<ioKey, int> io_to_index; +unordered_map<int, char*> fd_map; +mutex fd_mutex; +string cachedir; + +unordered_map<int, int> npu_numa_map; + +unordered_map<int, int> process_npu_map; +mutex pnpu_mutex; + +/* for evict */ +#define EVICT_DIST 10000 +#define EVICT_IO_MAX 5000 +thread_local size_t evict_idx = 0; + +atomic<int> npu_smi_enable(-1); +atomic<uint64_t> memory_usage(0); + +uint64_t memory_limit; +uint64_t memory_limit_bound; +string usage_in_bytes_path = "memory.usage_in_bytes"; +string limit_in_bytes_path = "memory.limit_in_bytes"; +string cgroup_mem=""; + +string get_cgroup_path() +{ + fstream cgroup_file("/proc/self/cgroup"); + if (!cgroup_file.is_open()) { + cerr << "Failed to open /proc/self/cgroup" << endl; + return ""; + } + + string line; + string cgroup_path; + while (getline(cgroup_file, line)) { + istringstream iss(line); + string hierarchy, controller, path; + if (!getline(iss, hierarchy, ':')) + continue; + if (!getline(iss, controller, ':')) + continue; + if (!getline(iss, path, ':')) + continue; + if (controller == "memory") { + cgroup_path = path; + break; + } + } + cgroup_file.close(); + return cgroup_path; +} + +/* read from /sys/fs/cgroup/memory/memory.[usage_in_bytes|limit_in_bytes] */ +uint64_t read_cgroup_memory(const string &file_path) +{ + if (cgroup_mem == "") + return -1; + string whole_path = "/sys/fs/cgroup/memory"+cgroup_mem+"/"+file_path; + ifstream cgroup_file(whole_path); + + if(!cgroup_file.is_open()) { + cerr << "Failed to open " << file_path << endl; + return -1; + } + + string line; + while(getline(cgroup_file, line)) { + try { + return stoll(line); + } catch (...) { + cerr << "Failed to parse line" << line << endl; + } + } + + cgroup_file.close(); + return -1; +} + +/* mount helper */ +void get_mount_option(const char* mntpoint, const char* option) +{ + ifstream mounts("/proc/mounts"); + string line, target_mp; + + if (!mounts.is_open()) { + cerr << "Error: could not open /proc/mounts" << endl; + return; + } + + while (getline(mounts, line)) { + istringstream iss(line); + string device, mp, fs_type, options; + + if (!(iss >> device >> mp >> fs_type >> options)) + continue; + + if (mp.back() != '/') + mp += '/'; + target_mp = mntpoint; + if (target_mp.back() != '/') + target_mp += '/'; + + if (target_mp == mp) { + istringstream opt_stream(options); + string opt; + + while (getline(opt_stream, opt, ',')) { + if (opt.find(option) == 0) { + if (opt[strlen(option)] == '=') { + cachedir = opt.substr(strlen(option) + 1); + } + } + } + break; + } + } +} + +/* fd_map helper function */ +char* fd_path_find(int iofd) { + lock_guard<mutex> lock(fd_mutex); + auto it = fd_map.find(iofd); + if (it != fd_map.end()) { + return it->second; + } else { + char *path = _get_fullpath(NULL, iofd); + size_t len = strlen(path) + cachedir.length() + 1; + char *realpath = (char*)malloc(len); + snprintf(realpath, len, "%s%s", cachedir.c_str(), path); + fd_map.insert({iofd, realpath}); + return realpath; + } +} + +string exec_cmd(const char* cmd) { + array<char, 128> buffer; + string result = ""; + unique_ptr<FILE, decltype(&pclose)> pipe(popen(cmd, "r"), pclose); + + if (!pipe) { + throw std::runtime_error("popen() failed!"); + } + while (fgets(buffer.data(), buffer.size(), pipe.get()) != nullptr) { + result += buffer.data(); + } + return result; +} + +bool isNumber(const std::string& str) { + return !str.empty() && str.find_first_not_of("0123456789") == std::string::npos; +} + +/* cpu_numa_map builder from lscpu */ +unordered_map<string, int> build_cpu_numa_map() { + unordered_map<string, int> cpuNumaMap; + string result = exec_cmd("lscpu"); + istringstream iss(result); + string line; + + while (getline(iss, line)) { + if (line.find("NUMA node") != string::npos) { + istringstream lineStream(line); + string key, value; + int numaNode; + getline(lineStream, value, ':'); + getline(lineStream, key); + /* what if numa is more than 10 */ + value = value.substr(value.find("NUMA node") + 9, 1); + if (!isNumber(value)) + continue; + numaNode = stoi(value); + key.erase(0, key.find_first_not_of(" \t")); + key.erase(key.find_last_not_of(" \t") + 1); + cpuNumaMap[key]=numaNode; + } + } + return cpuNumaMap; +} + +/* npu_numa_map builder, from npu-smi info -t topo */ +void build_npu_map_map() +{ + if (npu_smi_enable.load() == -1) { + if (exec_cmd("command -v npu-smi").empty()) + npu_smi_enable.store(0); + else + npu_smi_enable.store(1); + } + + if (npu_smi_enable.load() == 0) + return; + + unordered_map<string, int> cpuNumaMap = build_cpu_numa_map(); + string result = exec_cmd("npu-smi info -t topo"); + istringstream iss(result); + string line; + size_t target_token_size = 0; + + cout << "NPU\tCPU_AFFINITY\tNUMA_NODE" << endl; + while (getline(iss, line)) { + istringstream lineStream(line); + string npuStr, numaStr, token; + vector<string> tokens; + + while (lineStream >> token) { + tokens.push_back(token); + } + + if (tokens.size() >= 2 && tokens.back() == "Affinity") { + target_token_size = tokens.size() - 1 + 1; + continue; + } + + if (tokens.size() != target_token_size) + continue; + + int npuId = stoi(tokens[0].substr(3)); + + numaStr = tokens.back(); + cout << npuId << "\t" << numaStr << "\t\t" << cpuNumaMap[numaStr] << endl; + npu_numa_map[npuId] = cpuNumaMap[numaStr]; + } +} + +/* process_npu_map builder, from npu-smi info */ +void get_npu_info(string &npuinfo) +{ + istringstream iss(npuinfo); + string line; + + while (getline(iss, line)) { + istringstream lineStream(line); + string token; + vector<string> tokens; + while (getline(lineStream, token, ' ')) { + if (!token.empty()) { + tokens.push_back(token); + } + } + if (tokens.size() >= 3) { + if (!isNumber(tokens[1]) || !isNumber(tokens[4])) + continue; + int npuId = stoi(tokens[1]); + int processId = stoi(tokens[4]); + process_npu_map[processId] = npuId; + } + } +} + +/* process_npu_map helper */ +int process_npu_find(int processid) { + lock_guard<mutex> lock(pnpu_mutex); + auto it = process_npu_map.find(processid); + + if (npu_smi_enable.load() == 0) + return 0; + + if (it != process_npu_map.end()) { + return it->second; + } else { + string result = exec_cmd("npu-smi info"); + get_npu_info(result); + auto it = process_npu_map.find(processid); + if (it != process_npu_map.end()) + return it->second; + else + return 0; + } +} + +int strategy_init(void) +{ + const char *mntpoint = getenv(MAIO_MNTPOINT); + char *tfilename = getenv(MAIO_TRACE_FILE); + if(!tfilename || !mntpoint) { + fprintf(stderr, "no MAIO_TRACE_FILE or MAIO_MNTPOINT env variable\n"); + return -1; + } + ifstream tfile(tfilename); + string line; + + cgroup_mem=get_cgroup_path(); + memory_limit = read_cgroup_memory(limit_in_bytes_path); + memory_limit_bound = memory_limit * 4 / 5; + cout << "memory_limit: " << memory_limit << " memory_limit_bound: " << memory_limit_bound << endl; + get_mount_option(mntpoint, CACHEDIR); + build_npu_map_map(); + + if(!tfile.is_open()) { + cerr << "Failed to open file:" << tfilename << endl; + return -1; + } + + while(getline(tfile, line)) { + istringstream iss(line); + + string name; + uint64_t off; + uint64_t len; + unsigned int npu; + if (iss >> name >> off >> len >> npu) { + iovec.emplace_back(name, off, len, npu); + io_to_index[ioKey(name, off, len, npu)] = iovec.size() - 1; + } else { + cerr << "Failed to parse line:" << line << endl; + } + } + + tfile.close(); + return 0; +} + +void strategy_exit(void) +{ +} + +int strategy_load(struct maio **io) +{ + int npuid = process_npu_find((*io)->pid); + struct maio_entry *entry; + string pathStr; + char *path; + uint64_t idx = iovec.size(); + int ret = 0; + struct maio *new_io; + + path = fd_path_find((*io)->fd); + pathStr.assign(path); + + ioKey key(pathStr, (*io)->off, (*io)->len, npuid); + auto io_it = io_to_index.lower_bound(key); + if (io_it == io_to_index.end()) { + entry = (*io)->entries; + entry[0].toff = (*io)->off + (*io)->len; + entry[0].tlen = 0; + entry[0].fpath = NULL; + entry[0].tnuma = npu_numa_map[npuid]; + return 1; + } + if (key < io_it->first) { + if (io_it != io_to_index.begin()) { + --io_it; + if (io_it->first.name != pathStr) { + ++io_it; + } + } + } + + idx = io_it->second; + (*io)->flags |= MAIO_WITH_SEQ; + (*io)->curseq = idx; + entry = (*io)->entries; + int ios = 0; + uint64_t memory_usage = read_cgroup_memory(usage_in_bytes_path); + vector<int> io_extra; + + /* fill ios below max_io */ + while (idx < iovec.size()) { + if (iovec[idx].flag == IO_LOADED) { + idx++; + continue; + } + memory_usage += iovec[idx].len / 2; + if (memory_usage > memory_limit_bound) + break; + if (ios >= maio_strategy.max_io) { + io_extra.push_back(idx); + goto next_io; + } + entry[ios].seq = idx; + if (pathStr == iovec[idx].name) { + entry[ios].toff = iovec[idx].off; + entry[ios].tlen = iovec[idx].len; + entry[ios].tnuma = npu_numa_map[npuid]; + } else { + entry[ios].fpath = strdup(iovec[idx].name.c_str()); + entry[ios].toff = iovec[idx].off; + entry[ios].tlen = iovec[idx].len; + entry[ios].tnuma = npu_numa_map[iovec[idx].npu]; + } +next_io: + iovec[idx].flag = IO_LOADED; + idx++; + ios++; + } + + /* fill ios above max_io */ + if (ios > maio_strategy.max_io) { + new_io = (struct maio *)realloc(*io, sizeof(struct maio) + ios * sizeof(struct maio_entry)); + if (!new_io) { + printf("failed to alloc ios:%d maio\n", ios); + return -1; + } + *io = new_io; + entry = (*io)->entries; + for (int i = maio_strategy.max_io; i < ios; ++i) { + int io_idx = io_extra[i - maio_strategy.max_io]; + entry[i].seq = io_idx; + if (pathStr == iovec[io_idx].name) { + entry[i].toff = iovec[io_idx].off; + entry[i].tlen = iovec[io_idx].len; + entry[i].tnuma = npu_numa_map[npuid]; + } else { + entry[i].fpath = strdup(iovec[io_idx].name.c_str()); + entry[i].toff = iovec[io_idx].off; + entry[i].tlen = iovec[io_idx].len; + entry[i].tnuma = npu_numa_map[iovec[io_idx].npu]; + } + } + } + + // printf("file:%s off:%lu len:%lu generate_ios:%d from %d",path, (*io)->off, (*io)->len, ios, io_it->second); + ret = ios; + return ret; +} + +int strategy_evict(struct maio **io) +{ + string pathStr; + char *path; + path = fd_path_find((*io)->fd); + pathStr.assign(path); + ioKey key(pathStr, (*io)->off, (*io)->len, (*io)->pid); + auto io_it = io_to_index.lower_bound(key); + int dist = 0; + size_t i = 0, io_idx = io_it->second; + struct maio_entry *entry; + struct maio *new_io; + uint64_t evict_memory = 0; + uint64_t memory_usage = read_cgroup_memory(usage_in_bytes_path); + + if (memory_usage < (memory_limit_bound * 3 / 4)) + return 0; + dist = io_idx - evict_idx; + if (dist < 0) + return 0; + if (static_cast<size_t>(dist) < iovec.size() / 8 && io_it != io_to_index.end()) + return 0; + size_t evict_win = 0; + if (io_it != io_to_index.end()) { + evict_win = min(iovec.size() / 10, io_idx - 1); + } else { + evict_win = dist; + } + + new_io = (struct maio*)realloc(*io, sizeof(struct maio) + evict_win * sizeof(struct maio_entry)); + if (!new_io) + return -1; + *io = new_io; + entry = new_io->entries; + + for (i = 0; i < evict_win && evict_idx < iovec.size(); ++i) { + evict_memory += iovec[evict_idx].len; + if (evict_memory > memory_limit_bound / 8) + break; + entry[i].fpath = strdup(iovec[evict_idx].name.c_str()); + entry[i].toff = iovec[evict_idx].off; + entry[i].tlen = iovec[evict_idx].len; + evict_idx++; + iovec[evict_idx].flag = IO_EVICTED; + } + return i; +} + +const struct maio_operation maio_strategy = { + .max_io = 500, + .init = strategy_init, + .exit = strategy_exit, + .load = strategy_load, + .evict = strategy_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&maio_strategy; +} diff --git a/tools/mfs/maio-utils/test/strategy_template.h b/tools/mfs/maio-utils/test/strategy_template.h new file mode 100644 index 000000000000..6599b68754c9 --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_template.h @@ -0,0 +1,21 @@ +#ifndef STRATEGY_TEMPLATE_H +#define STRATEGY_TEMPLATE_H + +#ifdef __cplusplus +extern "C" { +#endif + +int strategy_init(void); +void strategy_exit(void); +int strategy_load(struct maio **io); +int strategy_evict(struct maio *io); + +extern const struct maio_operation maio_strategy; + +struct maio_operation *register_strategy(); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/tools/mfs/maio-utils/test/strategy_toend.c b/tools/mfs/maio-utils/test/strategy_toend.c new file mode 100644 index 000000000000..f2208281f8ee --- /dev/null +++ b/tools/mfs/maio-utils/test/strategy_toend.c @@ -0,0 +1,46 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2025 Huawei Technologies Co., Ltd + */ +#include "maio.h" +#include <stddef.h> + +int demo_init(void) +{ + return 0; +} + +void demo_exit(void) +{ +} + +int demo_load(struct maio **io) +{ + struct maio_entry *entry; + + entry = (*io)->entries; + entry[0].toff = (*io)->off + (*io)->len; + /* Read Ahead until the end */ + entry[0].tlen = 0; + entry[0].fpath = NULL; + entry[0].tnuma = -1; + return 1; +} + +int demo_evict(struct maio **io) +{ + ((void)io); + return 0; +} + +const struct maio_operation demo_strategy = { + .max_io = 1, + .init = demo_init, + .exit = demo_exit, + .load = demo_load, + .evict = demo_evict, +}; + +struct maio_operation *register_strategy() +{ + return (struct maio_operation *)&demo_strategy; +} diff --git a/tools/mfs/maio-utils/test/trace_analyse.py b/tools/mfs/maio-utils/test/trace_analyse.py new file mode 100644 index 000000000000..c25d1ce364df --- /dev/null +++ b/tools/mfs/maio-utils/test/trace_analyse.py @@ -0,0 +1,87 @@ +def merge_intervals(intervals): + """ + 合并区间 + :param intervals: 区间列表，每个区间是一个元组 (start, end) + :return: 合并后的区间列表 + """ + if not intervals: + return [] + + # 按起始位置排序 + intervals.sort(key=lambda x: x[0]) + + merged = [intervals[0]] + for current in intervals[1:]: + last_merged = merged[-1] + if current[0] <= last_merged[1]: # 有重叠 + merged[-1] = (last_merged[0], max(last_merged[1], current[1])) + else: + merged.append(current) + + return merged + +def process_file(input_file): + """ + 处理输入文件 + :param input_file: 输入文件路径 + :return: 每个文件的合并区间和总大小 + """ + from collections import defaultdict + + # 使用字典按文件名分组 + file_intervals = defaultdict(list) + + with open(input_file, 'r') as f: + for line in f: + parts = line.strip().split() + if len(parts) < 3: + print(f"跳过无效行: {line.strip()}") + continue + + # 解析文件名、起始位置、大小 + filename, start, size = parts[:3] + start = int(start) + size = int(size) + + # 计算区间 + end = start + size + file_intervals[filename].append((start, end)) + + # 合并每个文件的区间 + merged_results = {} + for filename, intervals in file_intervals.items(): + merged_intervals = merge_intervals(intervals) + # 计算合并后的区间总大小 + total_size = sum(end - start for start, end in merged_intervals) + merged_results[filename] = { + "merged_intervals": merged_intervals, + "total_size": total_size + } + + return merged_results + +def main(): + import sys + + if len(sys.argv) != 2: + print("用法: python script.py <输入文件>") + sys.exit(1) + + input_file = sys.argv[1] + + merged_results = process_file(input_file) + + whole_result=0 + + for filename, result in merged_results.items(): + print(f"文件: {filename}") + # print("合并后的区间:") + # for interval in result["merged_intervals"]: + # print(f"起始位置: {interval[0]}, 结束位置: {interval[1]}") + print(f"所有区间内数据的总大小: {result['total_size']} 字节") + print("-" * 40) + whole_result+=result['total_size'] + print(f"所有文件内数据的总大小: {whole_result} 字节") + +if __name__ == "__main__": + main() diff --git a/tools/mfs/maio-utils/test/trace_gen.py b/tools/mfs/maio-utils/test/trace_gen.py new file mode 100644 index 000000000000..d050fa48801c --- /dev/null +++ b/tools/mfs/maio-utils/test/trace_gen.py @@ -0,0 +1,116 @@ +import argparse +import os +import sys + +FILENAME_IDX = 0 +OFF_IDX = 1 +LEN_IDX = 2 +NUMA_IDX = 3 +OFF_BOUND = 1024 * 1024 * 4096 + +class ReplayHintGenerator(object): + def __init__(self, trace_file, output_file): + self.output_file = output_file + self.trace_file = trace_file + self.data_list = [] + + def generate_hint(self): + with open(self.output_file, 'w') as f: + for data in self.data_list: + data_off = data[OFF_IDX] + data_len = data[LEN_IDX] + print(data_off) + step = (512 * 1024 * 1024) + while data_len: + if data_len < step: + step = data_len + print(f"{data[FILENAME_IDX]} {data_off} {step} {data[NUMA_IDX]}", file=f) + data_len-=step + data_off+=step + + def parse_trace(self): + file_map_index={} + with open(self.trace_file, 'r') as f: + for line in f: + parts = line.strip().split(' ') + + filename, off, length, numaid = parts + off = int(off) + length = int(length) + numaid = int(numaid) + if self.data_list: + tail_data = self.data_list[-1] + ''' + 首先尝试跟末尾的数据合并: + 如若跟末尾的数据是同一个文件跟numaid, + 两者之间的距离小于设定值, + 就进行合并 + ''' + if (tail_data[FILENAME_IDX] == filename and tail_data[NUMA_IDX] == numaid): + tail_off = tail_data[OFF_IDX] + tail_end = tail_data[OFF_IDX] + tail_data[LEN_IDX] + end = off + length + abs_off = max(abs(off - tail_end), abs(tail_off - end)) + if abs_off < OFF_BOUND: + tail_data[OFF_IDX] = min(tail_off, off) + tail_data[LEN_IDX] = max(tail_end, end) - tail_data[OFF_IDX] + continue + else: + ''' + 否则跟之前同一文件和numaid的数据进行合并 + 如若两者之间距离小于设定值， + 就进行合并 + ''' + key = (filename, numaid) + if key in file_map_index: + index = file_map_index[key] + data = self.data_list[index] + data_off = data[OFF_IDX] + data_end = data[OFF_IDX] + data[LEN_IDX] + end = off + length + abs_off = max(abs(off - data_end), abs(data_off - end)) + if abs_off < OFF_BOUND: + data[OFF_IDX] = min(data_off, off) + data[LEN_IDX] = max(data_end, end) - data[OFF_IDX] + continue + self.data_list.append([filename, off, length, numaid]) + file_map_index[(filename, numaid)] = len(self.data_list) - 1 + + +def main(agrv): + """ + Parse the argument + """ + parser = argparse.ArgumentParser('model trace parser') + parser.add_argument('--trace_file', + required=True, + type=str, + help='trace source') + parser.add_argument('--output_file', + required=True, + type=str, + help='output of hint file') + try: + args = parser.parse_args() + trace_file = args.trace_file + output_file = args.output_file + if not os.path.exists(trace_file): + print("{trace_file} not exist") + return -1 + + hint_generator=ReplayHintGenerator(trace_file, output_file) + hint_generator.parse_trace() + hint_generator.generate_hint() + return 0 + except Exception as e: + print(f"Parse model trace exception:{str(e)}") + return -1 + +if __name__ == '__main__': + try: + ret = main(sys.argv[1:]) + except Exception as main_e: + print(str(main_e)) + ret = -1 + sys.exit(ret) + -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] Fix TLBI broadcast optimization loss and incorrect dvmbm handling
by Tian Zheng 13 Mar '26

13 Mar '26

Fix 1 In the TLBI broadcast-optimization feature, the SYS_LSUDVM_CTRL_EL2 register controls whether the feature is enabled. When LPI low-power mode is enabled, this register is cleared as the pCPU powers down into LPI mode, causing the TLBI broadcast optimization to stop working. The fix saves and restores this control register in the callbacks for entering and exiting LPI mode. Fix 2 The current TLBI broadcast-optimization logic only supports normal VMs. If the feature is enabled globally, VMs that are not yet adapted for it, such as CCA will use an incorrect TLBI broadcast bitmap, which can cause a panic in CCA VMs. The fix moves the actual enable/disable of the dvmbm functionality into the vcpu load and vcpu put functions. Tian Zheng (1): KVM: arm64: Fix CCA guest panic when dvmbm is enabled arch/arm64/kvm/hisilicon/hisi_virt.c | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) -- 2.33.0

1 1

[PATCH v13 00/12] arm64: entry: Convert to Generic Entry
by Jinjie Ruan 13 Mar '26

13 Mar '26

Currently, x86, Riscv, Loongarch use the Generic Entry which makes maintainers' work easier and codes more elegant. arm64 has already successfully switched to the Generic IRQ Entry in commit b3cf07851b6c ("arm64: entry: Switch to generic IRQ entry"), it is time to completely convert arm64 to Generic Entry. The goal is to bring arm64 in line with other architectures that already use the generic entry infrastructure, reducing duplicated code and making it easier to share future changes in entry/exit paths, such as "Syscall User Dispatch". This patch set is rebased on v7.0-rc1. And the performance was measured on Kunpeng 920 using "perf bench basic syscall" with "arm64.nopauth selinux=0 audit=1". On the basis of optimizing el0_svc_common(), the performance are below: | Metric | W/O Generic Entry | With Generic Entry opt| Change | | ---------- | ----------------- | ------------------ | ------ | | Total time | 2.487 [sec] | 2.264 [sec] | ↓9.0% | | usecs/op | 0.248780 | 0.226481 | ↓9.0% | | ops/sec | 4,019,620 | 4,415,383 | ↑9.8% | Therefore, after the optimization, ARM64 System Call performance improved by approximately 9%. It was tested ok with following test cases on kunpeng920 and QEMU virt platform: - Stress-ng CPU stress test. - Hackbench stress test. - "sud" selftest testcase. - get_set_sud, get_syscall_info, set_syscall_info, peeksiginfo in tools/testing/selftests/ptrace. - breakpoint_test_arm64 in selftests/breakpoints. - syscall-abi and ptrace in tools/testing/selftests/arm64/abi - fp-ptrace, sve-ptrace, za-ptrace in selftests/arm64/fp. - vdso_test_getrandom in tools/testing/selftests/vDSO - Strace tests. The test QEMU configuration is as follows: qemu-system-aarch64 \ -M virt,gic-version=3,virtualization=on,mte=on \ -cpu max,pauth-impdef=on \ -kernel Image \ -smp 8,sockets=1,cores=4,threads=2 \ -m 512m \ -nographic \ -no-reboot \ -device virtio-rng-pci \ -append "root=/dev/vda rw console=ttyAMA0 kgdboc=ttyAMA0,115200 \ earlycon preempt=voluntary irqchip.gicv3_pseudo_nmi=1" \ -drive if=none,file=images/rootfs.ext4,format=raw,id=hd0 \ -device virtio-blk-device,drive=hd0 \ Changes in v13: - Rebased on v7.0-rc3, so drop the firt applied arm64 patch. - Use generic TIF bits to enables RSEQ optimization. - Update most of the commit message to make it more clear. - Link to v12: https://lore.kernel.org/all/20260203133728.848283-5-ruanjinjie@huawei.com/ Changes in v12: - Rebased on "sched/core", so remove the four generic entry patches. - Move "Expand secure_computing() in place" and "Use syscall_get_arguments() helper" patch forward, which will group all non-functional cleanups at the front. - Adjust the explanation for moving rseq_syscall() before audit_syscall_exit(). - Link to v11: https://lore.kernel.org/all/20260128031934.3906955-1-ruanjinjie@huawei.com/ Changes in v11: - Remove unused syscall in syscall_trace_enter(). - Update and provide a detailed explanation of the differences after moving rseq_syscall() before audit_syscall_exit(). - Rebased on arm64 (for-next/entry), and remove the first applied 3 patchs. - syscall_exit_to_user_mode_work() for arch reuse instead of adding new syscall_exit_to_user_mode_work_prepare() helper. - Link to v10: https://lore.kernel.org/all/20251222114737.1334364-1-ruanjinjie@huawei.com/ Changes in v10: - Rebased on v6.19-rc1, rename syscall_exit_to_user_mode_prepare() to syscall_exit_to_user_mode_work_prepare() to avoid conflict. - Also inline syscall_trace_enter(). - Support aarch64 for sud_benchmark. - Update and correct the commit message. - Add Reviewed-by. - Link to v9: https://lore.kernel.org/all/20251204082123.2792067-1-ruanjinjie@huawei.com/ Changes in v9: - Move "Return early for ptrace_report_syscall_entry() error" patch ahead to make it not introduce a regression. - Not check _TIF_SECCOMP/SYSCALL_EMU for syscall_exit_work() in a separate patch. - Do not report_syscall_exit() for PTRACE_SYSEMU_SINGLESTEP in a separate patch. - Add two performance patch to improve the arm64 performance. - Add Reviewed-by. - Link to v8: https://lore.kernel.org/all/20251126071446.3234218-1-ruanjinjie@huawei.com/ Changes in v8: - Rename "report_syscall_enter()" to "report_syscall_entry()". - Add ptrace_save_reg() to avoid duplication. - Remove unused _TIF_WORK_MASK in a standalone patch. - Align syscall_trace_enter() return value with the generic version. - Use "scno" instead of regs->syscallno in el0_svc_common(). - Move rseq_syscall() ahead in a standalone patch to clarify it clearly. - Rename "syscall_trace_exit()" to "syscall_exit_work()". - Keep the goto in el0_svc_common(). - No argument was passed to __secure_computing() and check -1 not -1L. - Remove "Add has_syscall_work() helper" patch. - Move "Add syscall_exit_to_user_mode_prepare() helper" patch later. - Add miss header for asm/entry-common.h. - Update the implementation of arch_syscall_is_vdso_sigreturn(). - Add "ARCH_SYSCALL_WORK_EXIT" to be defined as "SECCOMP | SYSCALL_EMU" to keep the behaviour unchanged. - Add more testcases test. - Add Reviewed-by. - Update the commit message. - Link to v7: https://lore.kernel.org/all/20251117133048.53182-1-ruanjinjie@huawei.com/ Jinjie Ruan (11): arm64/ptrace: Refactor syscall_trace_enter/exit() to accept flags parameter arm64/ptrace: Expand secure_computing() in place arm64/ptrace: Use syscall_get_arguments() helper for audit arm64: ptrace: Move rseq_syscall() before audit_syscall_exit() arm64: syscall: Introduce syscall_exit_to_user_mode_work() arm64/ptrace: Define and use _TIF_SYSCALL_EXIT_WORK arm64/ptrace: Skip syscall exit reporting for PTRACE_SYSEMU_SINGLESTEP arm64: entry: Convert to generic entry arm64: Inline el0_svc_common() s390: Rename TIF_SINGLE_STEP to TIF_SINGLESTEP arm64: Use generic TIF bits for common thread flags kemal (1): selftests: sud_test: Support aarch64 arch/arm64/Kconfig | 3 +- arch/arm64/include/asm/entry-common.h | 76 ++++++++++++ arch/arm64/include/asm/syscall.h | 19 ++- arch/arm64/include/asm/thread_info.h | 76 ++++-------- arch/arm64/kernel/debug-monitors.c | 7 ++ arch/arm64/kernel/ptrace.c | 115 ------------------ arch/arm64/kernel/signal.c | 2 +- arch/arm64/kernel/syscall.c | 29 ++--- arch/s390/include/asm/thread_info.h | 7 +- arch/s390/kernel/process.c | 2 +- arch/s390/kernel/ptrace.c | 20 +-- arch/s390/kernel/signal.c | 6 +- arch/x86/include/asm/thread_info.h | 6 +- include/asm-generic/thread_info_tif.h | 5 + .../syscall_user_dispatch/sud_benchmark.c | 2 +- .../syscall_user_dispatch/sud_test.c | 4 + 16 files changed, 166 insertions(+), 213 deletions(-) -- 2.34.1

1 12

[PATCH v3 00/10] arm_mpam: Introduce the Narrow-PARTID feature for MPAM driver
by Zeng Heng 13 Mar '26

13 Mar '26

The patchset is based on mpam_resctrl_glue_v5_debugfs branch of https://gitlab.arm.com/linux-arm/linux-bh.git repository. The narrow-partid feature in MPAM allows for a more efficient use of PARTIDs by enabling a many-to-one mapping of reqpartids (requested PARTIDs) to intpartids (internal PARTIDs). This mapping reduces the number of unique PARTIDs needed, thus allowing more tasks or processes to be monitored and managed with the available resources. For a mixture of MSCs system, for MSCs that do not support narrow-partid, we use the PARTIDs exceeding the number of closids as reqPARTIDs for expanding the monitoring groups. Therefore, we will expand the information contained in the RMID, so that it includes not only PMG, but also reqPARTIDs information. The new RMID would be like: RMID = reqPARTID * NUM_PMG + PMG Each control group has m (req)PARTIDs, which are used to expand the number of monitoring groups under one control group. Therefore, the number of monitoring groups is no longer limited by the range of MPAM's PMG, which enhances the extensibility of the system's monitoring capabilities. --- Compared with v2: - Add dynamic reqPARTID allocation implementation. - Patch 4 has been merged into the repository, dropped from this series. Compared with v1: - Redefine the RMID information. - Refactor the resctrl_arch_rmid_idx_decode() and resctrl_arch_rmid_idx_encode(). - Simplify closid_rmid2reqpartid() to rmid2reqpartid() and replace it accordingly. Compared with RFC-v4: - Rebase the patch set on the v6.14-rc1 branch. Compared with RFC-v3: - Add limitation of the Narrow-PARTID feature (See Patch 2). - Remove redundant reqpartid2closid() and reqpartid_pmg2rmid(). - Refactor closid_rmid2reqpartid() partially. - Merge the PARTID conversion-related patches into a single patch for bisectability. - Skip adaptation of resctrl_arch_set_rmid() which is going to be removed. Compared with RFC-v2: - Refactor closid/rmid pair translation. - Simplify the logic of synchronize configuration. - Remove reqPARTID source bitmap. Compared with RFC-v1: - Rebase this patch set on latest MPAM driver of the v6.12-rc1 branch. v2: https://lore.kernel.org/all/20250222112448.2438586-1-zengheng4@huawei.com/ v1: https://lore.kernel.org/all/20250217031852.2014939-1-zengheng4@huawei.com/ RFC-v4: https://lore.kernel.org/all/20250104101224.873926-1-zengheng4@huawei.com/ RFC-v3: https://lore.kernel.org/all/20241207092136.2488426-1-zengheng4@huawei.com/ RFC-v2: https://lore.kernel.org/all/20241119135104.595630-1-zengheng4@huawei.com/ RFC-v1: https://lore.kernel.org/all/20241114135037.918470-1-zengheng4@huawei.com/ --- Ben Horgan (1): arm64/sysreg: Add MPAMSM_EL1 register Zeng Heng (9): arm_mpam: Add intPARTID and reqPARTID support for narrow PARTID feature arm_mpam: Disable Narrow-PARTID when MBA lacks support arm_mpam: Refactor rmid to reqPARTID/PMG mapping arm_mpam: Propagate control group config to sub-monitoring groups fs/resctrl: Add rmid_entry state helpers arm_mpam: Implement dynamic reqPARTID allocation for monitoring groups fs/resctrl: Wire up rmid expansion and reclaim functions arm64/mpam: Add mpam_sync_config() for dynamic rmid expansion fs/resctrl: Prevent rmid parsing errors by flushing limbo on umount Documentation/arch/arm64/index.rst | 1 + Documentation/arch/arm64/mpam.rst | 94 + Documentation/arch/arm64/silicon-errata.rst | 9 + arch/arm64/Kconfig | 6 +- arch/arm64/include/asm/el2_setup.h | 3 +- arch/arm64/include/asm/mpam.h | 96 + arch/arm64/include/asm/resctrl.h | 2 + arch/arm64/include/asm/thread_info.h | 3 + arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/cpufeature.c | 21 +- arch/arm64/kernel/mpam.c | 62 + arch/arm64/kernel/process.c | 7 + arch/arm64/kvm/hyp/include/hyp/switch.h | 12 +- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 9 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 16 + arch/arm64/kvm/sys_regs.c | 2 + arch/arm64/tools/sysreg | 8 + arch/x86/include/asm/resctrl.h | 7 + drivers/resctrl/Kconfig | 9 +- drivers/resctrl/Makefile | 1 + drivers/resctrl/mpam_devices.c | 340 ++- drivers/resctrl/mpam_internal.h | 112 +- drivers/resctrl/mpam_resctrl.c | 2094 +++++++++++++++++++ drivers/resctrl/test_mpam_resctrl.c | 364 ++++ fs/resctrl/monitor.c | 50 +- fs/resctrl/rdtgroup.c | 24 +- include/linux/arm_mpam.h | 49 + include/linux/resctrl.h | 21 + 28 files changed, 3368 insertions(+), 55 deletions(-) create mode 100644 Documentation/arch/arm64/mpam.rst create mode 100644 arch/arm64/include/asm/mpam.h create mode 100644 arch/arm64/include/asm/resctrl.h create mode 100644 arch/arm64/kernel/mpam.c create mode 100644 drivers/resctrl/mpam_resctrl.c create mode 100644 drivers/resctrl/test_mpam_resctrl.c -- 2.25.1

1 12

[PATCH OLK-6.6] arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc()
by Zeng Heng 13 Mar '26

13 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8686 ------------------ resctrl_arch_mon_ctx_alloc() triggers a scheduling state warning when calling kmalloc() while the task is in a non-running state: do not call blocking ops when !TASK_RUNNING; state=1 set at prepare_to_wait WARNING: CPU: 78 PID: 12592 at kernel/sched/core.c:10584 _might_sleep Call trace: _might_sleep+0x1cc/0xf8 _kmalloc_cache_alloc_node+0x3a0/0x4e0 kmalloc_trace+0x44/0x120 resctrl_arch_mon_ctx_alloc+0xf0/0x178 mon_event_read+0xa0/0x308 mkdir_mondata_subdir+0x24c/0x330 mkdir_mondata_all+0x17c/0x248 rdt_get_tree+0x2e8/0x680 vfs_get_tree+0x5c/0x190 do_new_mount+0x27c/0x408 path_mount+0x2ac/0x448 arm64_sys_mount+0x1d4/0x228 Ensure the allocation is performed in TASK_RUNNING state to avoid schedule state corrupted. Fixes: 9119da143939 ("arm_mpam: resctrl: Allow resctrl to allocate monitors") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_resctrl.c | 25 +++---------------------- 1 file changed, 3 insertions(+), 22 deletions(-) diff --git a/drivers/platform/mpam/mpam_resctrl.c b/drivers/platform/mpam/mpam_resctrl.c index 1a26a0ed2cff..b6681f328aaa 100644 --- a/drivers/platform/mpam/mpam_resctrl.c +++ b/drivers/platform/mpam/mpam_resctrl.c @@ -388,11 +388,11 @@ struct rdt_resource *resctrl_arch_get_resource(enum resctrl_res_level l) return &mpam_resctrl_exports[l].resctrl_res; } -static void *resctrl_arch_mon_ctx_alloc_no_wait(struct rdt_resource *r, - int evtid) +void *resctrl_arch_mon_ctx_alloc(struct rdt_resource *r, int evtid) { - u32 *ret = kmalloc(sizeof(*ret), GFP_KERNEL); + u32 *ret; + ret = kmalloc(sizeof(*ret), GFP_KERNEL); if (!ret) return ERR_PTR(-ENOMEM); @@ -400,25 +400,6 @@ static void *resctrl_arch_mon_ctx_alloc_no_wait(struct rdt_resource *r, return ret; } -void *resctrl_arch_mon_ctx_alloc(struct rdt_resource *r, int evtid) -{ - DEFINE_WAIT(wait); - void *ret; - - might_sleep(); - - do { - prepare_to_wait(&resctrl_mon_ctx_waiters, &wait, - TASK_INTERRUPTIBLE); - ret = resctrl_arch_mon_ctx_alloc_no_wait(r, evtid); - if (PTR_ERR(ret) == -ENOSPC) - schedule(); - } while (PTR_ERR(ret) == -ENOSPC && !signal_pending(current)); - finish_wait(&resctrl_mon_ctx_waiters, &wait); - - return ret; -} - void resctrl_arch_mon_ctx_free(struct rdt_resource *r, int evtid, void *arch_mon_ctx) { -- 2.25.1

2 1

[PATCH OLK-6.6] selftests/bpf: Add cross-build support for urandom_read et al
by Pu Lehui 12 Mar '26

12 Mar '26

From: Björn Töpel <bjorn(a)rivosinc.com> mainline inclusion from mainline-v6.7-rc1 commit 97a79e502e25e27a65b0506c9fb210cb2d89b52e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8638 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Some userland programs in the BPF test suite, e.g. urandom_read, is missing cross-build support. Add cross-build support for these programs Signed-off-by: Björn Töpel <bjorn(a)rivosinc.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20231004122721.54525-2-bjorn@kernel.org Conflicts: tools/testing/selftests/bpf/Makefile [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- tools/testing/selftests/bpf/Makefile | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index 8ce50befca91..e97ec89fe83d 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -208,15 +208,17 @@ endif # do not fail. Static builds leave urandom_read relying on system-wide shared libraries. $(OUTPUT)/liburandom_read.so: urandom_read_lib1.c urandom_read_lib2.c $(call msg,LIB,,$@) - $(Q)$(CLANG) $(filter-out -static,$(CFLAGS) $(LDFLAGS)) \ + $(Q)$(CLANG) $(CLANG_TARGET_ARCH) \ + $(filter-out -static,$(CFLAGS) $(LDFLAGS)) \ $^ $(filter-out -static,$(LDLIBS)) \ -fuse-ld=$(LLD) -Wl,-znoseparate-code -Wl,--build-id=sha1 \ -fPIC -shared -o $@ $(OUTPUT)/urandom_read: urandom_read.c urandom_read_aux.c $(OUTPUT)/liburandom_read.so $(call msg,BINARY,,$@) - $(Q)$(CLANG) $(filter-out -static,$(CFLAGS) $(LDFLAGS)) $(filter %.c,$^) \ - -lurandom_read $(filter-out -static,$(LDLIBS)) -L$(OUTPUT) \ + $(Q)$(CLANG) $(CLANG_TARGET_ARCH) \ + $(filter-out -static,$(CFLAGS) $(LDFLAGS)) $(filter %.c,$^) \ + -lurandom_read $(filter-out -static,$(LDLIBS)) -L$(OUTPUT) \ -fuse-ld=$(LLD) -Wl,-znoseparate-code -Wl,--build-id=sha1 \ -Wl,-rpath=. -o $@ -- 2.34.1

2 1

[PATCH OLK-6.6] arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc()
by Zeng Heng 12 Mar '26

12 Mar '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8686 ------------------ resctrl_arch_mon_ctx_alloc() triggers a scheduling state warning when calling kmalloc() while the task is in a non-running state: do not call blocking ops when !TASK_RUNNING; state=1 set at prepare_to_wait WARNING: CPU: 78 PID: 12592 at kernel/sched/core.c:10584 _might_sleep Call trace: _might_sleep+0x1cc/0xf8 _kmalloc_cache_alloc_node+0x3a0/0x4e0 kmalloc_trace+0x44/0x120 resctrl_arch_mon_ctx_alloc+0xf0/0x178 mon_event_read+0xa0/0x308 mkdir_mondata_subdir+0x24c/0x330 mkdir_mondata_all+0x17c/0x248 rdt_get_tree+0x2e8/0x680 vfs_get_tree+0x5c/0x190 do_new_mount+0x27c/0x408 path_mount+0x2ac/0x448 arm64_sys_mount+0x1d4/0x228 Ensure the allocation is performed in TASK_RUNNING state to avoid schedule state corrupted. Fixes: 9119da143939 ("arm_mpam: resctrl: Allow resctrl to allocate monitors") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_resctrl.c | 25 +++---------------------- 1 file changed, 3 insertions(+), 22 deletions(-) diff --git a/drivers/platform/mpam/mpam_resctrl.c b/drivers/platform/mpam/mpam_resctrl.c index 1a26a0ed2cff..b6681f328aaa 100644 --- a/drivers/platform/mpam/mpam_resctrl.c +++ b/drivers/platform/mpam/mpam_resctrl.c @@ -388,11 +388,11 @@ struct rdt_resource *resctrl_arch_get_resource(enum resctrl_res_level l) return &mpam_resctrl_exports[l].resctrl_res; } -static void *resctrl_arch_mon_ctx_alloc_no_wait(struct rdt_resource *r, - int evtid) +void *resctrl_arch_mon_ctx_alloc(struct rdt_resource *r, int evtid) { - u32 *ret = kmalloc(sizeof(*ret), GFP_KERNEL); + u32 *ret; + ret = kmalloc(sizeof(*ret), GFP_KERNEL); if (!ret) return ERR_PTR(-ENOMEM); @@ -400,25 +400,6 @@ static void *resctrl_arch_mon_ctx_alloc_no_wait(struct rdt_resource *r, return ret; } -void *resctrl_arch_mon_ctx_alloc(struct rdt_resource *r, int evtid) -{ - DEFINE_WAIT(wait); - void *ret; - - might_sleep(); - - do { - prepare_to_wait(&resctrl_mon_ctx_waiters, &wait, - TASK_INTERRUPTIBLE); - ret = resctrl_arch_mon_ctx_alloc_no_wait(r, evtid); - if (PTR_ERR(ret) == -ENOSPC) - schedule(); - } while (PTR_ERR(ret) == -ENOSPC && !signal_pending(current)); - finish_wait(&resctrl_mon_ctx_waiters, &wait); - - return ret; -} - void resctrl_arch_mon_ctx_free(struct rdt_resource *r, int evtid, void *arch_mon_ctx) { -- 2.25.1

2 1

[PATCH OLK-6.6] Revert "drivers: core: synchronize really_probe() and dev_uevent()"
by Lin Ruifeng 12 Mar '26

12 Mar '26

From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> stable inclusion from stable-v6.6.89 commit d29c2d53357fd35f24b7acba594725a5be6404d7 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8715 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dc1771f718548f7d4b93991b174c6e7b5e1ba410 upstream. This reverts commit c0a40097f0bc81deafc15f9195d1fb54595cd6d0. Probing a device can take arbitrary long time. In the field we observed that, for example, probing a bad micro-SD cards in an external USB card reader (or maybe cards were good but cables were flaky) sometimes takes longer than 2 minutes due to multiple retries at various levels of the stack. We can not block uevent_show() method for that long because udev is reading that attribute very often and that blocks udev and interferes with booting of the system. The change that introduced locking was concerned with dev_uevent() racing with unbinding the driver. However we can handle it without locking (which will be done in subsequent patch). There was also claim that synchronization with probe() is needed to properly load USB drivers, however this is a red herring: the change adding the lock was introduced in May of last year and USB loading and probing worked properly for many years before that. Revert the harmful locking. Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Reviewed-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Link: https://lore.kernel.org/r/20250311052417.1846985-1-dmitry.torokhov@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/base/core.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/base/core.c b/drivers/base/core.c index 9872ce765eaa..8a4c3bc7bafa 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -2707,11 +2707,8 @@ static ssize_t uevent_show(struct device *dev, struct device_attribute *attr, if (!env) return -ENOMEM; - /* Synchronize with really_probe() */ - device_lock(dev); /* let the kset specific function add its keys */ retval = kset->uevent_ops->uevent(&dev->kobj, env); - device_unlock(dev); if (retval) goto out; -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] Fix RT priority Setting
by Liu Kai 12 Mar '26

12 Mar '26

Fix RT priority Setting Liu Kai (3): xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness xsched: fix typo in xcu cgroup subsys released callback name xsched: initialize tgid before configuring RT priority include/linux/xsched.h | 29 ++++++++++++++--------------- kernel/xsched/cfs.c | 2 +- kernel/xsched/cgroup.c | 4 ++-- kernel/xsched/core.c | 3 +-- 4 files changed, 18 insertions(+), 20 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/3] optimize lightweight load balancing
by Chen Jinghuang 12 Mar '26

12 Mar '26

*** BLURB HERE *** Chen Jinghuang (2): sched: Fix kabi breakage of struct sched_domain for newidle_stats sched: expand sysctl_sched_features to unsigned long Peter Zijlstra (Intel) (1): sched/fair: Proportional newidle balance include/linux/sched/topology.h | 5 ++++ kernel/sched/core.c | 5 +++- kernel/sched/fair.c | 50 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 9 +++++- kernel/sched/topology.c | 6 ++++ 6 files changed, 74 insertions(+), 6 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] scsi: hisi_sas: Change the debugfs parameters dump count default value
by Yihang Li 12 Mar '26

12 Mar '26

driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8713 ----------------------------------------------------------------------------- The memory allocation time of the DFX is changed from device initialization to dump occurs, so restore the default setting hisi_sas_debugfs_dump_count to 50. Signed-off-by: Yihang Li <liyihang9(a)h-partners.com> --- drivers/scsi/hisi_sas/hisi_sas_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index a525d484d6e2..c58b77902782 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -2955,12 +2955,12 @@ EXPORT_SYMBOL_GPL(hisi_sas_remove); #if IS_ENABLED(CONFIG_SCSI_HISI_SAS_DEBUGFS_DEFAULT_ENABLE) #define DEBUGFS_ENABLE_DEFAULT "enabled" bool hisi_sas_debugfs_enable = true; +u32 hisi_sas_debugfs_dump_count = 50; #else #define DEBUGFS_ENABLE_DEFAULT "disabled" bool hisi_sas_debugfs_enable; -#endif - u32 hisi_sas_debugfs_dump_count = 1; +#endif EXPORT_SYMBOL_GPL(hisi_sas_debugfs_enable); module_param_named(debugfs_enable, hisi_sas_debugfs_enable, bool, 0444); -- 2.33.0

2 1

[PATCH OLK-5.10] nfsd: provide locking for v4_end_grace
by Li Lingfeng 12 Mar '26

12 Mar '26

From: NeilBrown <neil(a)brown.name> stable inclusion from stable-v5.10.248 commit ca97360860eb02e3ae4ba42c19b439a0fcecbf06 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13489 CVE: CVE-2026-22980 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2857bd59feb63fcf40fe4baf55401baea6b4feb4 ] Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly. We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is held while client_tracking_op->init() is called and that can wait for an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a deadlock. nfsd4_end_grace() is also called by the landromat work queue and this doesn't require locking as server shutdown will stop the work and wait for it before freeing anything that nfsd4_end_grace() might access. However, we must be sure that writing to v4_end_grace doesn't restart the work item after shutdown has already waited for it. For this we add a new flag protected with nn->client_lock. It is set only while it is safe to make client tracking calls, and v4_end_grace only schedules work while the flag is set with the spinlock held. So this patch adds a nfsd_net field "client_tracking_active" which is set as described. Another field "grace_end_forced", is set when v4_end_grace is written. After this is set, and providing client_tracking_active is set, the laundromat is scheduled. This "grace_end_forced" field bypasses other checks for whether the grace period has finished. This resolves a race which can result in use-after-free. Reported-by: Li Lingfeng <lilingfeng3(a)huawei.com> Closes: https://lore.kernel.org/linux-nfs/20250623030015.2353515-1-neil@brown.name/… Fixes: 7f5ef2e900d9 ("nfsd: add a v4_end_grace file to /proc/fs/nfsd") Cc: stable(a)vger.kernel.org Signed-off-by: NeilBrown <neil(a)brown.name> Tested-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> [ Adjust context ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfsd/nfs4state.c [Commit 5aa2c4a1fe28 ("NFSD: Add a nfsd4_file_hash_remove() helper") add declaration of nfsd4_file_hash_remove(); commit ea92c0768f98 ("nfsd: simplify nfsd_renew") change the return value; commit 438ef64bbfe4 ("NFSD: register/unregister of nfsd-client shrinker at nfsd startup/shutdown time") add unregister_shrinker() in nfs4_state_shutdown_net(); commit 67ef9e5fd737 ("NFSD: add courteous server support for thread with only delegation") move the position of declaration of laundry_wq.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/netns.h | 2 ++ fs/nfsd/nfs4state.c | 44 +++++++++++++++++++++++++++++++++++++++++--- fs/nfsd/nfsctl.c | 3 +-- fs/nfsd/state.h | 2 +- 4 files changed, 45 insertions(+), 6 deletions(-) diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h index 8500acac09e0..ca5c386aafce 100644 --- a/fs/nfsd/netns.h +++ b/fs/nfsd/netns.h @@ -40,6 +40,8 @@ struct nfsd_net { struct lock_manager nfsd4_manager; bool grace_ended; + bool grace_end_forced; + bool client_tracking_active; time64_t boot_time; struct dentry *nfsd_client_dir; diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 302bbad5cdc6..d17702a4a1ad 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -80,7 +80,7 @@ static u64 current_sessionid = 1; /* forward declarations */ static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner); static void nfs4_free_ol_stateid(struct nfs4_stid *stid); -void nfsd4_end_grace(struct nfsd_net *nn); +static void nfsd4_end_grace(struct nfsd_net *nn); static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps); /* Locking: */ @@ -5347,7 +5347,7 @@ nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, } void -nfsd4_end_grace(struct nfsd_net *nn) +static nfsd4_end_grace(struct nfsd_net *nn) { /* do nothing if grace period already ended */ if (nn->grace_ended) @@ -5379,6 +5379,34 @@ nfsd4_end_grace(struct nfsd_net *nn) */ } +static struct workqueue_struct *laundry_wq; +/** + * nfsd4_force_end_grace - forcibly end the NFSv4 grace period + * @nn: network namespace for the server instance to be updated + * + * Forces bypass of normal grace period completion, then schedules + * the laundromat to end the grace period immediately. Does not wait + * for the grace period to fully terminate before returning. + * + * Return values: + * %true: Grace termination schedule + * %false: No action was taken + */ +bool nfsd4_force_end_grace(struct nfsd_net *nn) +{ + if (!nn->client_tracking_ops) + return false; + spin_lock(&nn->client_lock); + if (nn->grace_ended || !nn->client_tracking_active) { + spin_unlock(&nn->client_lock); + return false; + } + WRITE_ONCE(nn->grace_end_forced, true); + mod_delayed_work(laundry_wq, &nn->laundromat_work, 0); + spin_unlock(&nn->client_lock); + return true; +} + /* * If we've waited a lease period but there are still clients trying to * reclaim, wait a little longer to give them a chance to finish. @@ -5388,6 +5416,8 @@ static bool clients_still_reclaiming(struct nfsd_net *nn) time64_t double_grace_period_end = nn->boot_time + 2 * nn->nfsd4_lease; + if (READ_ONCE(nn->grace_end_forced)) + return false; if (nn->track_reclaim_completes && atomic_read(&nn->nr_reclaim_complete) == nn->reclaim_str_hashtbl_size) @@ -5530,7 +5560,6 @@ nfs4_laundromat(struct nfsd_net *nn) return new_timeo; } -static struct workqueue_struct *laundry_wq; static void laundromat_main(struct work_struct *); static void @@ -7343,6 +7372,8 @@ static int nfs4_state_create_net(struct net *net) nn->unconf_name_tree = RB_ROOT; nn->boot_time = ktime_get_real_seconds(); nn->grace_ended = false; + nn->grace_end_forced = false; + nn->client_tracking_active = false; nn->nfsd4_manager.block_opens = true; INIT_LIST_HEAD(&nn->nfsd4_manager.list); INIT_LIST_HEAD(&nn->client_lru); @@ -7409,6 +7440,10 @@ nfs4_state_start_net(struct net *net) return ret; locks_start_grace(net, &nn->nfsd4_manager); nfsd4_client_tracking_init(net); + /* safe for laundromat to run now */ + spin_lock(&nn->client_lock); + nn->client_tracking_active = true; + spin_unlock(&nn->client_lock); if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0) goto skip_grace; printk(KERN_INFO "NFSD: starting %lld-second grace period (net %x)\n", @@ -7458,6 +7493,9 @@ nfs4_state_shutdown_net(struct net *net) struct nfsd_net *nn = net_generic(net, nfsd_net_id); cancel_delayed_work_sync(&nn->laundromat_work); + spin_lock(&nn->client_lock); + nn->client_tracking_active = false; + spin_unlock(&nn->client_lock); locks_end_grace(&nn->nfsd4_manager); INIT_LIST_HEAD(&reaplist); diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index 040340080b3d..e84c8cf8e2c0 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -1133,9 +1133,8 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size) case 'Y': case 'y': case '1': - if (!nn->nfsd_serv) + if (!nfsd4_force_end_grace(nn)) return -EBUSY; - nfsd4_end_grace(nn); break; default: return -EINVAL; diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index 9eae11a9d21c..0e4f98b41364 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -683,7 +683,7 @@ static inline void get_nfs4_file(struct nfs4_file *fi) struct nfsd_file *find_any_file(struct nfs4_file *f); /* grace period management */ -void nfsd4_end_grace(struct nfsd_net *nn); +bool nfsd4_force_end_grace(struct nfsd_net *nn); /* nfs4recover operations */ extern int nfsd4_client_tracking_init(struct net *net); -- 2.52.0

2 1

[PATCH OLK-6.6 0/2] arm64/mpam: Fix wrong closid config access when CDP is enabled
by Zeng Heng 12 Mar '26

12 Mar '26

Zeng Heng (2): Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" arm64/mpam: Fix wrong closid config access when CDP is enabled arch/x86/include/asm/resctrl.h | 4 ---- drivers/platform/mpam/mpam_resctrl.c | 35 +++++++++++++++++++++------- fs/resctrl/ctrlmondata.c | 28 +++------------------- include/linux/arm_mpam.h | 1 - 4 files changed, 29 insertions(+), 39 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/2] Fix TLBI broadcast optimization loss and incorrect dvmbm handling
by Tian Zheng 11 Mar '26

11 Mar '26

Fix 1 In the TLBI broadcast-optimization feature, the SYS_LSUDVM_CTRL_EL2 register controls whether the feature is enabled. When LPI low-power mode is enabled, this register is cleared as the pCPU powers down into LPI mode, causing the TLBI broadcast optimization to stop working. The fix saves and restores this control register in the callbacks for entering and exiting LPI mode. Fix 2 The current TLBI broadcast-optimization logic only supports normal VMs. If the feature is enabled globally, VMs that are not yet adapted for it, such as CCA will use an incorrect TLBI broadcast bitmap, which can cause a panic in CCA VMs. The fix moves the actual enable/disable of the dvmbm functionality into the vcpu load and vcpu put functions. Tian Zheng (2): KVM: arm64: Fix TLBI optimization broken in LPI mode KVM: arm64: Fix CCA guest panic when dvmbm is enabled arch/arm64/kvm/arm.c | 4 +++ arch/arm64/kvm/hisilicon/hisi_virt.c | 37 +++++++++++++++++++--------- arch/arm64/kvm/hisilicon/hisi_virt.h | 4 +++ 3 files changed, 33 insertions(+), 12 deletions(-) -- 2.33.0

1 2

[PATCH OLK-6.6 0/3] optimize lightweight load balancing
by Chen Jinghuang 11 Mar '26

11 Mar '26

*** BLURB HERE *** Chen Jinghuang (2): sched: Fix kabi breakage of struct sched_domain for newidle_stats sched: expand sysctl_sched_features to unsigned long Peter Zijlstra (Intel) (1): sched/fair: Proportional newidle balance include/linux/sched/topology.h | 7 ++++- kernel/sched/core.c | 5 +++- kernel/sched/fair.c | 48 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 9 ++++++- kernel/sched/topology.c | 6 +++++ 6 files changed, 73 insertions(+), 7 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/3] optimize lightweight load balancing
by Chen Jinghuang 11 Mar '26

11 Mar '26

*** BLURB HERE *** Chen Jinghuang (2): sched: Fix kabi breakage of struct sched_domain for newidle_stats sched: expand sysctl_sched_features to unsigned long Peter Zijlstra (Intel) (1): sched/fair: Proportional newidle balance include/linux/sched/topology.h | 7 ++++- kernel/sched/core.c | 5 +++- kernel/sched/fair.c | 48 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 7 +++++ kernel/sched/topology.c | 6 +++++ 6 files changed, 72 insertions(+), 6 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/2] Fix TLBI broadcast optimization loss and incorrect dvmbm handling
by Tian Zheng 11 Mar '26

11 Mar '26

Fix 1 In the TLBI broadcast-optimization feature, the SYS_LSUDVM_CTRL_EL2 register controls whether the feature is enabled. When LPI low-power mode is enabled, this register is cleared as the pCPU powers down into LPI mode, causing the TLBI broadcast optimization to stop working. The fix saves and restores this control register in the callbacks for entering and exiting LPI mode. Fix 2 The current TLBI broadcast-optimization logic only supports normal VMs. If the feature is enabled globally, VMs that are not yet adapted for it, such as CCA will use an incorrect TLBI broadcast bitmap, which can cause a panic in CCA VMs. The fix moves the actual enable/disable of the dvmbm functionality into the vcpu load and vcpu put functions. Tian Zheng (2): KVM: arm64: Fix TLBI optimization broken in LPI mode KVM: arm64: Fix CCA guest panic when dvmbm is enabled arch/arm64/kvm/arm.c | 4 ++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 28 ++++++++++++++++++++++------ arch/arm64/kvm/hisilicon/hisi_virt.h | 4 ++++ 3 files changed, 30 insertions(+), 6 deletions(-) -- 2.33.0

1 2

[PATCH OLK-6.6] platform/x86: classmate-laptop: Add missing NULL pointer checks
by Zeng Heng 11 Mar '26

11 Mar '26

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.19 commit fe747d7112283f47169e9c16e751179a9b38611e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13842 CVE: CVE-2026-23237 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In a few places in the Classmate laptop driver, code using the accel object may run before that object's address is stored in the driver data of the input device using it. For example, cmpc_accel_sensitivity_store_v4() is the "show" method of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), before calling dev_set_drvdata() for inputdev->dev. If the sysfs attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) call in in cmpc_accel_sensitivity_store_v4() returns NULL which leads to a NULL pointer dereference going forward. Moreover, sysfs attributes using the input device are added before initializing that device by cmpc_add_acpi_notify_device() and if one of them is accessed before running that function, a NULL pointer dereference will occur. For example, cmpc_accel_sensitivity_attr_v4 is added before calling cmpc_add_acpi_notify_device() and if it is read prematurely, the dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() returns NULL which leads to a NULL pointer dereference going forward. Fix this by adding NULL pointer checks in all of the relevant places. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Conflicts: drivers/platform/x86/classmate-laptop.c [Context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c index 2edaea2492df..053c8a86d5ec 100644 --- a/drivers/platform/x86/classmate-laptop.c +++ b/drivers/platform/x86/classmate-laptop.c @@ -208,7 +208,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; return sprintf(buf, "%d\n", accel->sensitivity); } @@ -225,7 +230,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; r = kstrtoul(buf, 0, &sensitivity); if (r) @@ -257,7 +267,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; return sprintf(buf, "%d\n", accel->g_select); } @@ -274,7 +289,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; r = kstrtoul(buf, 0, &g_select); if (r) @@ -303,6 +323,8 @@ static int cmpc_accel_open_v4(struct input_dev *input) acpi = to_acpi_device(input->dev.parent); accel = dev_get_drvdata(&input->dev); + if (!accel) + return -ENXIO; cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity); cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select); @@ -551,7 +573,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; return sprintf(buf, "%d\n", accel->sensitivity); } @@ -568,7 +595,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; r = kstrtoul(buf, 0, &sensitivity); if (r) -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] optimize lightweight load balancing
by Chen Jinghuang 11 Mar '26

11 Mar '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix kabi breakage of struct sched_domain for newidle_stats Peter Zijlstra (Intel) (1): sched/fair: Proportional newidle balance include/linux/sched/topology.h | 7 ++++- kernel/sched/core.c | 3 +++ kernel/sched/fair.c | 48 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 7 +++++ kernel/sched/topology.c | 6 +++++ 6 files changed, 71 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] optimize lightweight load balancing
by Chen Jinghuang 11 Mar '26

11 Mar '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix kabi breakage of struct sched_domain for newidle_stats Peter Zijlstra (Intel) (1): sched/fair: Proportional newidle balance include/linux/sched/topology.h | 8 +++++- kernel/sched/core.c | 3 +++ kernel/sched/fair.c | 48 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 7 +++++ kernel/sched/topology.c | 6 +++++ 6 files changed, 72 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH] arch/riscv: Add bitrev.h file to support rev8 and brev8
by Jinjie Ruan 11 Mar '26

11 Mar '26

The RISC-V Bit-manipulation Extension for Cryptography (Zbkb) provides the 'brev8' instruction, which reverses the bits within each byte. Combined with the 'rev8' instruction (from Zbb or Zbkb), which reverses the byte order of a register, we can efficiently implement 16-bit, 32-bit, and (on RV64) 64-bit bit reversal. This is significantly faster than the default software table-lookup implementation in lib/bitrev.c, as it replaces memory accesses and multiple arithmetic operations with just two or three hardware instructions. Select HAVE_ARCH_BITREVERSE and provide <asm/bitrev.h> to utilize these instructions when the Zbkb extension is available at runtime via the alternatives mechanism. Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/riscv/Kconfig | 1 + arch/riscv/include/asm/bitrev.h | 46 +++++++++++++++++++++++++++++++++ lib/bitrev.c | 3 --- 3 files changed, 47 insertions(+), 3 deletions(-) create mode 100644 arch/riscv/include/asm/bitrev.h diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig index 90c531e6abf5..e7a04b96c0c8 100644 --- a/arch/riscv/Kconfig +++ b/arch/riscv/Kconfig @@ -128,6 +128,7 @@ config RISCV select HAS_IOPORT if MMU select HAVE_ALIGNED_STRUCT_PAGE select HAVE_ARCH_AUDITSYSCALL + select HAVE_ARCH_BITREVERSE select HAVE_ARCH_HUGE_VMALLOC if HAVE_ARCH_HUGE_VMAP select HAVE_ARCH_HUGE_VMAP if MMU && 64BIT select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL diff --git a/arch/riscv/include/asm/bitrev.h b/arch/riscv/include/asm/bitrev.h new file mode 100644 index 000000000000..b1977600638a --- /dev/null +++ b/arch/riscv/include/asm/bitrev.h @@ -0,0 +1,46 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __ASM_BITREV_H +#define __ASM_BITREV_H + +#include <linux/types.h> +#include <asm/cpufeature-macros.h> +#include <asm/hwcap.h> + +extern u8 const byte_rev_table[256]; +static __always_inline __attribute_const__ u32 __arch_bitrev32(u32 x) +{ + if (IS_ENABLED(CONFIG_RISCV_ISA_ZBKB) && + riscv_has_extension_likely(RISCV_ISA_EXT_ZBKB)) { + unsigned long result = x; + + asm volatile( + ".option push\n" + ".option arch,+zbkb\n" + "rev8 %0, %0\n" + "brev8 %0, %0\n" + ".option pop" + : "+r" (result) + ); + + if (__riscv_xlen == 64) + return (u32)(result >> 32); + + return (u32)result; + } + + return (u32)byte_rev_table[x & 0xff] << 24 | + (u32)byte_rev_table[(x >> 8) & 0xff] << 16 | + (u32)byte_rev_table[(x >> 16) & 0xff] << 8 | + (u32)byte_rev_table[x >> 24]; +} + +static __always_inline __attribute_const__ u16 __arch_bitrev16(u16 x) +{ + return __arch_bitrev32((u32)x) >> 16; +} + +static __always_inline __attribute_const__ u8 __arch_bitrev8(u8 x) +{ + return __arch_bitrev32((u32)x) >> 24; +} +#endif diff --git a/lib/bitrev.c b/lib/bitrev.c index 81b56e0a7f32..05088231f31f 100644 --- a/lib/bitrev.c +++ b/lib/bitrev.c @@ -1,5 +1,4 @@ // SPDX-License-Identifier: GPL-2.0-only -#ifndef CONFIG_HAVE_ARCH_BITREVERSE #include <linux/types.h> #include <linux/module.h> #include <linux/bitrev.h> @@ -43,5 +42,3 @@ const u8 byte_rev_table[256] = { 0x1f, 0x9f, 0x5f, 0xdf, 0x3f, 0xbf, 0x7f, 0xff, }; EXPORT_SYMBOL_GPL(byte_rev_table); - -#endif /* CONFIG_HAVE_ARCH_BITREVERSE */ -- 2.34.1

1 0

[PATCH openEuler-26.09 0/3] Fix device memory leaks in XSched
by Liu Kai 11 Mar '26

11 Mar '26

Fix device memory leaks in XSched Liu Kai (3): xsched/dmem: ensure XSched Context creation before device memory allocation xsched/dmem: add size field to xsched_dmem_pool for dmem region tracking xsched/dmem: ensure dmem region release on AI task completion to prevent memory leaks include/linux/xsched.h | 2 ++ include/uapi/linux/xcu_vstream.h | 2 +- kernel/xsched/dmem.c | 38 +++++++++++++++++++++++++++----- kernel/xsched/vstream.c | 22 +++++++++++++++--- 4 files changed, 55 insertions(+), 9 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/2] optimize lightweight load balancing
by Chen Jinghuang 11 Mar '26

11 Mar '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix kabi breakage of struct sched_domain for newidle_stats Peter Zijlstra (Intel) (1): sched/fair: Proportional newidle balance include/linux/sched/topology.h | 4 +++ kernel/sched/core.c | 3 +++ kernel/sched/fair.c | 48 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 7 +++++ kernel/sched/topology.c | 6 +++++ 6 files changed, 69 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] Fix TLBI broadcast optimization loss and incorrect dvmbm handling
by Tian Zheng 11 Mar '26

11 Mar '26

Fix 1 In the TLBI broadcast-optimization feature, the SYS_LSUDVM_CTRL_EL2 register controls whether the feature is enabled. When LPI low-power mode is enabled, this register is cleared as the pCPU powers down into LPI mode, causing the TLBI broadcast optimization to stop working. The fix saves and restores this control register in the callbacks for entering and exiting LPI mode. Fix 2 The current TLBI broadcast-optimization logic only supports normal VMs. If the feature is enabled globally, VMs that are not yet adapted for it, such as CCA will use an incorrect TLBI broadcast bitmap, which can cause a panic in CCA VMs. The fix moves the actual enable/disable of the dvmbm functionality into the vcpu load and vcpu put functions. Tian Zheng (2): KVM: arm64: Fix TLBI optimization broken in LPI mode KVM: arm64: Fix CCA guest panic when dvmbm is enabled arch/arm64/kvm/arm.c | 6 ++++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 9 ++++----- arch/arm64/kvm/hisilicon/hisi_virt.h | 19 +++++++++++++++++++ 3 files changed, 29 insertions(+), 5 deletions(-) -- 2.33.0

1 2

[PATCH OLK-6.6 v4 0/4] Fix CVE-2025-21696.
by Ze Zuo 10 Mar '26

10 Mar '26

Fix CVE-2025-21696. Change since v3: -- internalize struct to reduce kABI exposure. David Hildenbrand (1): mm/mremap: fix WARN with uffd that has remap events disabled Lokesh Gidra (1): userfaultfd: move userfaultfd_ctx struct to header file Ryan Roberts (1): mm: clear uffd-wp PTE/PMD state on mremap() Ze Zuo (1): userfaultfd: fix kabi breakage due to struct userfaultfd_ctx fs/userfaultfd.c | 40 +---------------- include/linux/userfaultfd_k_ext.h | 62 ++++++++++++++++++++++++++ mm/huge_memory.c | 13 ++++++ mm/hugetlb.c | 15 ++++++- mm/mremap.c | 74 +++++++++++++++++++++++-------- 5 files changed, 145 insertions(+), 59 deletions(-) create mode 100644 include/linux/userfaultfd_k_ext.h -- 2.25.1

2 5

[PATCH OLK-6.6 0/2] optimize lightweight load balancing
by Chen Jinghuang 10 Mar '26

10 Mar '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix kabi breakage of struct sched_domain for newidle_stats Peter Zijlstra (Intel) (1): sched/fair: Proportional newidle balance include/linux/sched/topology.h | 6 +++++ kernel/sched/core.c | 3 +++ kernel/sched/fair.c | 44 ++++++++++++++++++++++++++++++---- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 7 ++++++ kernel/sched/topology.c | 6 +++++ 6 files changed, 67 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] optimize lightweight load balancing
by Chen Jinghuang 10 Mar '26

10 Mar '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix kabi breakage pf struct sched_domain for newidle_stats Peter Zijlstra (Intel) (1): sched/fair: Proportional newidle balance include/linux/sched/topology.h | 12 ++++++ kernel/sched/core.c | 3 ++ kernel/sched/fair.c | 78 ++++++++++++++++++++++++++++++++-- kernel/sched/features.h | 5 +++ kernel/sched/sched.h | 7 +++ kernel/sched/topology.c | 11 +++++ 6 files changed, 112 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 1/2] sched/fair: Proportional newidle balance
by Chen Jinghuang 10 Mar '26

10 Mar '26

From: "Peter Zijlstra (Intel)" <peterz(a)infradead.org> stable inclusion from stable-v6.6.120 commit 51445190c10a36d292e70db085d0fb6cc3bec94f category: perf bugzilla: https://atomgit.com/openeuler/kernel/issues/8555 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 33cf66d88306663d16e4759e9d24766b0aaa2e17 upstream. Add a randomized algorithm that runs newidle balancing proportional to its success rate. This improves schbench significantly: 6.18-rc4: 2.22 Mrps/s 6.18-rc4+revert: 2.04 Mrps/s 6.18-rc4+revert+random: 2.18 Mrps/S Conversely, per Adam Li this affects SpecJBB slightly, reducing it by 1%: 6.17: -6% 6.17+revert: 0% 6.17+revert+random: -1% Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Tested-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Tested-by: Chris Mason <clm(a)meta.com> Link: https://lkml.kernel.org/r/6825c50d-7fa7-45d8-9b81-c6e7e25738e2@meta.com Link: https://patch.msgid.link/20251107161739.770122091@infradead.org [ Ajay: Modified to apply on v6.6 ] Signed-off-by: Ajay Kaher <ajay.kaher(a)broadcom.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: kernel/sched/core.c kernel/sched/fair.c [context conflicts] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- include/linux/sched/topology.h | 3 +++ kernel/sched/core.c | 3 +++ kernel/sched/fair.c | 44 ++++++++++++++++++++++++++++++---- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 7 ++++++ kernel/sched/topology.c | 6 +++++ 6 files changed, 64 insertions(+), 4 deletions(-) diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h index 7eee852aa384..95e5d7772800 100644 --- a/include/linux/sched/topology.h +++ b/include/linux/sched/topology.h @@ -130,6 +130,9 @@ struct sched_domain { unsigned int nr_balance_failed; /* initialise to 0 */ /* idle_balance() stats */ + unsigned int newidle_call; + unsigned int newidle_success; + unsigned int newidle_ratio; u64 max_newidle_lb_cost; unsigned long last_decay_max_lb_cost; diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 69d10fdb84d8..cf45ea94bb05 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -119,6 +119,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_util_est_se_tp); EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +DEFINE_PER_CPU(struct rnd_state, sched_rnd_state); #ifdef CONFIG_QOS_SCHED static void sched_change_qos_group(struct task_struct *tsk, struct task_group *tg); @@ -9976,6 +9977,8 @@ void __init sched_init_smp(void) sched_init_numa(NUMA_NO_NODE); set_sched_cluster(); + prandom_init_once(&sched_rnd_state); + /* * There's no userspace yet to cause hotplug operations; hence all the * CPU masks are stable and all blatant races in the below code cannot diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index a4592d35da8b..d16c65d5fa34 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -13651,8 +13651,24 @@ void update_max_interval(void) max_load_balance_interval = HZ*num_online_cpus()/10; } -static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost) +static inline void update_newidle_stats(struct sched_domain *sd, unsigned int success) { + sd->newidle_call++; + sd->newidle_success += success; + + if (sd->newidle_call >= 1024) { + sd->newidle_ratio = sd->newidle_success; + sd->newidle_call /= 2; + sd->newidle_success /= 2; + } +} + +static inline bool +update_newidle_cost(struct sched_domain *sd, u64 cost, unsigned int success) +{ + if (cost) + update_newidle_stats(sd, success); + if (cost > sd->max_newidle_lb_cost) { /* * Track max cost of a domain to make sure to not delay the @@ -13700,7 +13716,7 @@ static void rebalance_domains(struct rq *rq, enum cpu_idle_type idle) * Decay the newidle max times here because this is a regular * visit to all the domains. */ - need_decay = update_newidle_cost(sd, 0); + need_decay = update_newidle_cost(sd, 0, 0); max_cost += sd->max_newidle_lb_cost; /* @@ -14336,6 +14352,22 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) break; if (sd->flags & SD_BALANCE_NEWIDLE) { + unsigned int weight = 1; + + if (sched_feat(NI_RANDOM)) { + /* + * Throw a 1k sided dice; and only run + * newidle_balance according to the success + * rate. + */ + u32 d1k = sched_rng() % 1024; + weight = 1 + sd->newidle_ratio; + if (d1k > weight) { + update_newidle_stats(sd, 0); + continue; + } + weight = (1024 + weight/2) / weight; + } pulled_task = load_balance(this_cpu, this_rq, sd, CPU_NEWLY_IDLE, @@ -14343,10 +14375,14 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) t1 = sched_clock_cpu(this_cpu); domain_cost = t1 - t0; - update_newidle_cost(sd, domain_cost); - curr_cost += domain_cost; t0 = t1; + + /* + * Track max cost of a domain to make sure to not delay the + * next wakeup on the CPU. + */ + update_newidle_cost(sd, domain_cost, weight * !!pulled_task); } /* diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 52ea0097c513..24a0c853a8a0 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -106,6 +106,11 @@ SCHED_FEAT(UTIL_EST_FASTUP, true) SCHED_FEAT(LATENCY_WARN, false) +/* + * Do newidle balancing proportional to its success rate using randomization. + */ +SCHED_FEAT(NI_RANDOM, false) + SCHED_FEAT(HZ_BW, true) SCHED_FEAT(IRQ_AVG, false) diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index bb581cbdae8d..0c3abb44f365 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -5,6 +5,7 @@ #ifndef _KERNEL_SCHED_SCHED_H #define _KERNEL_SCHED_SCHED_H +#include <linux/prandom.h> #include <linux/sched/affinity.h> #include <linux/sched/autogroup.h> #include <linux/sched/cpufreq.h> @@ -1377,6 +1378,12 @@ static inline bool is_migration_disabled(struct task_struct *p) } DECLARE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +DECLARE_PER_CPU(struct rnd_state, sched_rnd_state); + +static inline u32 sched_rng(void) +{ + return prandom_u32_state(this_cpu_ptr(&sched_rnd_state)); +} #define cpu_rq(cpu) (&per_cpu(runqueues, (cpu))) #define this_rq() this_cpu_ptr(&runqueues) diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c index 3023e67da0fd..cf847fdf1063 100644 --- a/kernel/sched/topology.c +++ b/kernel/sched/topology.c @@ -1644,6 +1644,12 @@ sd_init(struct sched_domain_topology_level *tl, .last_balance = jiffies, .balance_interval = sd_weight, + + /* 50% success rate */ + .newidle_call = 512, + .newidle_success = 256, + .newidle_ratio = 512, + .max_newidle_lb_cost = 0, .last_decay_max_lb_cost = jiffies, .child = child, -- 2.34.1

2 2

[PATCH OLK-6.6 1/2] [Backport] sched/fair: Proportional newidle balance
by Chen Jinghuang 10 Mar '26

10 Mar '26

From: "Peter Zijlstra (Intel)" <peterz(a)infradead.org> stable inclusion from stable-v6.6.120 commit 51445190c10a36d292e70db085d0fb6cc3bec94f category: perf bugzilla: https://atomgit.com/openeuler/kernel/issues/8555 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 33cf66d88306663d16e4759e9d24766b0aaa2e17 upstream. Add a randomized algorithm that runs newidle balancing proportional to its success rate. This improves schbench significantly: 6.18-rc4: 2.22 Mrps/s 6.18-rc4+revert: 2.04 Mrps/s 6.18-rc4+revert+random: 2.18 Mrps/S Conversely, per Adam Li this affects SpecJBB slightly, reducing it by 1%: 6.17: -6% 6.17+revert: 0% 6.17+revert+random: -1% Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Tested-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Tested-by: Chris Mason <clm(a)meta.com> Link: https://lkml.kernel.org/r/6825c50d-7fa7-45d8-9b81-c6e7e25738e2@meta.com Link: https://patch.msgid.link/20251107161739.770122091@infradead.org [ Ajay: Modified to apply on v6.6 ] Signed-off-by: Ajay Kaher <ajay.kaher(a)broadcom.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: kernel/sched/core.c kernel/sched/fair.c [context conflicts] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- include/linux/sched/topology.h | 3 +++ kernel/sched/core.c | 3 +++ kernel/sched/fair.c | 44 ++++++++++++++++++++++++++++++---- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 7 ++++++ kernel/sched/topology.c | 6 +++++ 6 files changed, 64 insertions(+), 4 deletions(-) diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h index 7eee852aa384..95e5d7772800 100644 --- a/include/linux/sched/topology.h +++ b/include/linux/sched/topology.h @@ -130,6 +130,9 @@ struct sched_domain { unsigned int nr_balance_failed; /* initialise to 0 */ /* idle_balance() stats */ + unsigned int newidle_call; + unsigned int newidle_success; + unsigned int newidle_ratio; u64 max_newidle_lb_cost; unsigned long last_decay_max_lb_cost; diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 69d10fdb84d8..cf45ea94bb05 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -119,6 +119,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_util_est_se_tp); EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +DEFINE_PER_CPU(struct rnd_state, sched_rnd_state); #ifdef CONFIG_QOS_SCHED static void sched_change_qos_group(struct task_struct *tsk, struct task_group *tg); @@ -9976,6 +9977,8 @@ void __init sched_init_smp(void) sched_init_numa(NUMA_NO_NODE); set_sched_cluster(); + prandom_init_once(&sched_rnd_state); + /* * There's no userspace yet to cause hotplug operations; hence all the * CPU masks are stable and all blatant races in the below code cannot diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index a4592d35da8b..d16c65d5fa34 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -13651,8 +13651,24 @@ void update_max_interval(void) max_load_balance_interval = HZ*num_online_cpus()/10; } -static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost) +static inline void update_newidle_stats(struct sched_domain *sd, unsigned int success) { + sd->newidle_call++; + sd->newidle_success += success; + + if (sd->newidle_call >= 1024) { + sd->newidle_ratio = sd->newidle_success; + sd->newidle_call /= 2; + sd->newidle_success /= 2; + } +} + +static inline bool +update_newidle_cost(struct sched_domain *sd, u64 cost, unsigned int success) +{ + if (cost) + update_newidle_stats(sd, success); + if (cost > sd->max_newidle_lb_cost) { /* * Track max cost of a domain to make sure to not delay the @@ -13700,7 +13716,7 @@ static void rebalance_domains(struct rq *rq, enum cpu_idle_type idle) * Decay the newidle max times here because this is a regular * visit to all the domains. */ - need_decay = update_newidle_cost(sd, 0); + need_decay = update_newidle_cost(sd, 0, 0); max_cost += sd->max_newidle_lb_cost; /* @@ -14336,6 +14352,22 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) break; if (sd->flags & SD_BALANCE_NEWIDLE) { + unsigned int weight = 1; + + if (sched_feat(NI_RANDOM)) { + /* + * Throw a 1k sided dice; and only run + * newidle_balance according to the success + * rate. + */ + u32 d1k = sched_rng() % 1024; + weight = 1 + sd->newidle_ratio; + if (d1k > weight) { + update_newidle_stats(sd, 0); + continue; + } + weight = (1024 + weight/2) / weight; + } pulled_task = load_balance(this_cpu, this_rq, sd, CPU_NEWLY_IDLE, @@ -14343,10 +14375,14 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) t1 = sched_clock_cpu(this_cpu); domain_cost = t1 - t0; - update_newidle_cost(sd, domain_cost); - curr_cost += domain_cost; t0 = t1; + + /* + * Track max cost of a domain to make sure to not delay the + * next wakeup on the CPU. + */ + update_newidle_cost(sd, domain_cost, weight * !!pulled_task); } /* diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 52ea0097c513..24a0c853a8a0 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -106,6 +106,11 @@ SCHED_FEAT(UTIL_EST_FASTUP, true) SCHED_FEAT(LATENCY_WARN, false) +/* + * Do newidle balancing proportional to its success rate using randomization. + */ +SCHED_FEAT(NI_RANDOM, false) + SCHED_FEAT(HZ_BW, true) SCHED_FEAT(IRQ_AVG, false) diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index bb581cbdae8d..0c3abb44f365 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -5,6 +5,7 @@ #ifndef _KERNEL_SCHED_SCHED_H #define _KERNEL_SCHED_SCHED_H +#include <linux/prandom.h> #include <linux/sched/affinity.h> #include <linux/sched/autogroup.h> #include <linux/sched/cpufreq.h> @@ -1377,6 +1378,12 @@ static inline bool is_migration_disabled(struct task_struct *p) } DECLARE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +DECLARE_PER_CPU(struct rnd_state, sched_rnd_state); + +static inline u32 sched_rng(void) +{ + return prandom_u32_state(this_cpu_ptr(&sched_rnd_state)); +} #define cpu_rq(cpu) (&per_cpu(runqueues, (cpu))) #define this_rq() this_cpu_ptr(&runqueues) diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c index 3023e67da0fd..cf847fdf1063 100644 --- a/kernel/sched/topology.c +++ b/kernel/sched/topology.c @@ -1644,6 +1644,12 @@ sd_init(struct sched_domain_topology_level *tl, .last_balance = jiffies, .balance_interval = sd_weight, + + /* 50% success rate */ + .newidle_call = 512, + .newidle_success = 256, + .newidle_ratio = 512, + .max_newidle_lb_cost = 0, .last_decay_max_lb_cost = jiffies, .child = child, -- 2.34.1

2 3

[PATCH 1/2] [Backport] sched/fair: Proportional newidle balance
by Chen Jinghuang 10 Mar '26

10 Mar '26

From: "Peter Zijlstra (Intel)" <peterz(a)infradead.org> stable inclusion from stable-v6.6.120 commit 51445190c10a36d292e70db085d0fb6cc3bec94f category: perf bugzilla: https://atomgit.com/openeuler/kernel/issues/8555 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 33cf66d88306663d16e4759e9d24766b0aaa2e17 upstream. Add a randomized algorithm that runs newidle balancing proportional to its success rate. This improves schbench significantly: 6.18-rc4: 2.22 Mrps/s 6.18-rc4+revert: 2.04 Mrps/s 6.18-rc4+revert+random: 2.18 Mrps/S Conversely, per Adam Li this affects SpecJBB slightly, reducing it by 1%: 6.17: -6% 6.17+revert: 0% 6.17+revert+random: -1% Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Tested-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Tested-by: Chris Mason <clm(a)meta.com> Link: https://lkml.kernel.org/r/6825c50d-7fa7-45d8-9b81-c6e7e25738e2@meta.com Link: https://patch.msgid.link/20251107161739.770122091@infradead.org [ Ajay: Modified to apply on v6.6 ] Signed-off-by: Ajay Kaher <ajay.kaher(a)broadcom.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: kernel/sched/core.c kernel/sched/fair.c [context conflicts] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- include/linux/sched/topology.h | 3 +++ kernel/sched/core.c | 3 +++ kernel/sched/fair.c | 44 ++++++++++++++++++++++++++++++---- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 7 ++++++ kernel/sched/topology.c | 6 +++++ 6 files changed, 64 insertions(+), 4 deletions(-) diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h index 7eee852aa384..95e5d7772800 100644 --- a/include/linux/sched/topology.h +++ b/include/linux/sched/topology.h @@ -130,6 +130,9 @@ struct sched_domain { unsigned int nr_balance_failed; /* initialise to 0 */ /* idle_balance() stats */ + unsigned int newidle_call; + unsigned int newidle_success; + unsigned int newidle_ratio; u64 max_newidle_lb_cost; unsigned long last_decay_max_lb_cost; diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 69d10fdb84d8..cf45ea94bb05 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -119,6 +119,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_util_est_se_tp); EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +DEFINE_PER_CPU(struct rnd_state, sched_rnd_state); #ifdef CONFIG_QOS_SCHED static void sched_change_qos_group(struct task_struct *tsk, struct task_group *tg); @@ -9976,6 +9977,8 @@ void __init sched_init_smp(void) sched_init_numa(NUMA_NO_NODE); set_sched_cluster(); + prandom_init_once(&sched_rnd_state); + /* * There's no userspace yet to cause hotplug operations; hence all the * CPU masks are stable and all blatant races in the below code cannot diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index a4592d35da8b..d16c65d5fa34 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -13651,8 +13651,24 @@ void update_max_interval(void) max_load_balance_interval = HZ*num_online_cpus()/10; } -static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost) +static inline void update_newidle_stats(struct sched_domain *sd, unsigned int success) { + sd->newidle_call++; + sd->newidle_success += success; + + if (sd->newidle_call >= 1024) { + sd->newidle_ratio = sd->newidle_success; + sd->newidle_call /= 2; + sd->newidle_success /= 2; + } +} + +static inline bool +update_newidle_cost(struct sched_domain *sd, u64 cost, unsigned int success) +{ + if (cost) + update_newidle_stats(sd, success); + if (cost > sd->max_newidle_lb_cost) { /* * Track max cost of a domain to make sure to not delay the @@ -13700,7 +13716,7 @@ static void rebalance_domains(struct rq *rq, enum cpu_idle_type idle) * Decay the newidle max times here because this is a regular * visit to all the domains. */ - need_decay = update_newidle_cost(sd, 0); + need_decay = update_newidle_cost(sd, 0, 0); max_cost += sd->max_newidle_lb_cost; /* @@ -14336,6 +14352,22 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) break; if (sd->flags & SD_BALANCE_NEWIDLE) { + unsigned int weight = 1; + + if (sched_feat(NI_RANDOM)) { + /* + * Throw a 1k sided dice; and only run + * newidle_balance according to the success + * rate. + */ + u32 d1k = sched_rng() % 1024; + weight = 1 + sd->newidle_ratio; + if (d1k > weight) { + update_newidle_stats(sd, 0); + continue; + } + weight = (1024 + weight/2) / weight; + } pulled_task = load_balance(this_cpu, this_rq, sd, CPU_NEWLY_IDLE, @@ -14343,10 +14375,14 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) t1 = sched_clock_cpu(this_cpu); domain_cost = t1 - t0; - update_newidle_cost(sd, domain_cost); - curr_cost += domain_cost; t0 = t1; + + /* + * Track max cost of a domain to make sure to not delay the + * next wakeup on the CPU. + */ + update_newidle_cost(sd, domain_cost, weight * !!pulled_task); } /* diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 52ea0097c513..24a0c853a8a0 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -106,6 +106,11 @@ SCHED_FEAT(UTIL_EST_FASTUP, true) SCHED_FEAT(LATENCY_WARN, false) +/* + * Do newidle balancing proportional to its success rate using randomization. + */ +SCHED_FEAT(NI_RANDOM, false) + SCHED_FEAT(HZ_BW, true) SCHED_FEAT(IRQ_AVG, false) diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index bb581cbdae8d..0c3abb44f365 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -5,6 +5,7 @@ #ifndef _KERNEL_SCHED_SCHED_H #define _KERNEL_SCHED_SCHED_H +#include <linux/prandom.h> #include <linux/sched/affinity.h> #include <linux/sched/autogroup.h> #include <linux/sched/cpufreq.h> @@ -1377,6 +1378,12 @@ static inline bool is_migration_disabled(struct task_struct *p) } DECLARE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +DECLARE_PER_CPU(struct rnd_state, sched_rnd_state); + +static inline u32 sched_rng(void) +{ + return prandom_u32_state(this_cpu_ptr(&sched_rnd_state)); +} #define cpu_rq(cpu) (&per_cpu(runqueues, (cpu))) #define this_rq() this_cpu_ptr(&runqueues) diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c index 3023e67da0fd..cf847fdf1063 100644 --- a/kernel/sched/topology.c +++ b/kernel/sched/topology.c @@ -1644,6 +1644,12 @@ sd_init(struct sched_domain_topology_level *tl, .last_balance = jiffies, .balance_interval = sd_weight, + + /* 50% success rate */ + .newidle_call = 512, + .newidle_success = 256, + .newidle_ratio = 512, + .max_newidle_lb_cost = 0, .last_decay_max_lb_cost = jiffies, .child = child, -- 2.34.1

1 1

[PATCH 1/2] [Backport] sched/fair: Proportional newidle balance
by Chen Jinghuang 10 Mar '26

10 Mar '26

From: "Peter Zijlstra (Intel)" <peterz(a)infradead.org> stable inclusion from stable-v6.6.120 commit 51445190c10a36d292e70db085d0fb6cc3bec94f category: perf bugzilla: https://atomgit.com/openeuler/kernel/issues/8555 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 33cf66d88306663d16e4759e9d24766b0aaa2e17 upstream. Add a randomized algorithm that runs newidle balancing proportional to its success rate. This improves schbench significantly: 6.18-rc4: 2.22 Mrps/s 6.18-rc4+revert: 2.04 Mrps/s 6.18-rc4+revert+random: 2.18 Mrps/S Conversely, per Adam Li this affects SpecJBB slightly, reducing it by 1%: 6.17: -6% 6.17+revert: 0% 6.17+revert+random: -1% Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Tested-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Tested-by: Chris Mason <clm(a)meta.com> Link: https://lkml.kernel.org/r/6825c50d-7fa7-45d8-9b81-c6e7e25738e2@meta.com Link: https://patch.msgid.link/20251107161739.770122091@infradead.org [ Ajay: Modified to apply on v6.6 ] Signed-off-by: Ajay Kaher <ajay.kaher(a)broadcom.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: kernel/sched/core.c kernel/sched/fair.c [context conflicts] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- include/linux/sched/topology.h | 3 +++ kernel/sched/core.c | 3 +++ kernel/sched/fair.c | 44 ++++++++++++++++++++++++++++++---- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 7 ++++++ kernel/sched/topology.c | 6 +++++ 6 files changed, 64 insertions(+), 4 deletions(-) diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h index 7eee852aa384..95e5d7772800 100644 --- a/include/linux/sched/topology.h +++ b/include/linux/sched/topology.h @@ -130,6 +130,9 @@ struct sched_domain { unsigned int nr_balance_failed; /* initialise to 0 */ /* idle_balance() stats */ + unsigned int newidle_call; + unsigned int newidle_success; + unsigned int newidle_ratio; u64 max_newidle_lb_cost; unsigned long last_decay_max_lb_cost; diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 69d10fdb84d8..cf45ea94bb05 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -119,6 +119,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_util_est_se_tp); EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +DEFINE_PER_CPU(struct rnd_state, sched_rnd_state); #ifdef CONFIG_QOS_SCHED static void sched_change_qos_group(struct task_struct *tsk, struct task_group *tg); @@ -9976,6 +9977,8 @@ void __init sched_init_smp(void) sched_init_numa(NUMA_NO_NODE); set_sched_cluster(); + prandom_init_once(&sched_rnd_state); + /* * There's no userspace yet to cause hotplug operations; hence all the * CPU masks are stable and all blatant races in the below code cannot diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index a4592d35da8b..d16c65d5fa34 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -13651,8 +13651,24 @@ void update_max_interval(void) max_load_balance_interval = HZ*num_online_cpus()/10; } -static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost) +static inline void update_newidle_stats(struct sched_domain *sd, unsigned int success) { + sd->newidle_call++; + sd->newidle_success += success; + + if (sd->newidle_call >= 1024) { + sd->newidle_ratio = sd->newidle_success; + sd->newidle_call /= 2; + sd->newidle_success /= 2; + } +} + +static inline bool +update_newidle_cost(struct sched_domain *sd, u64 cost, unsigned int success) +{ + if (cost) + update_newidle_stats(sd, success); + if (cost > sd->max_newidle_lb_cost) { /* * Track max cost of a domain to make sure to not delay the @@ -13700,7 +13716,7 @@ static void rebalance_domains(struct rq *rq, enum cpu_idle_type idle) * Decay the newidle max times here because this is a regular * visit to all the domains. */ - need_decay = update_newidle_cost(sd, 0); + need_decay = update_newidle_cost(sd, 0, 0); max_cost += sd->max_newidle_lb_cost; /* @@ -14336,6 +14352,22 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) break; if (sd->flags & SD_BALANCE_NEWIDLE) { + unsigned int weight = 1; + + if (sched_feat(NI_RANDOM)) { + /* + * Throw a 1k sided dice; and only run + * newidle_balance according to the success + * rate. + */ + u32 d1k = sched_rng() % 1024; + weight = 1 + sd->newidle_ratio; + if (d1k > weight) { + update_newidle_stats(sd, 0); + continue; + } + weight = (1024 + weight/2) / weight; + } pulled_task = load_balance(this_cpu, this_rq, sd, CPU_NEWLY_IDLE, @@ -14343,10 +14375,14 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) t1 = sched_clock_cpu(this_cpu); domain_cost = t1 - t0; - update_newidle_cost(sd, domain_cost); - curr_cost += domain_cost; t0 = t1; + + /* + * Track max cost of a domain to make sure to not delay the + * next wakeup on the CPU. + */ + update_newidle_cost(sd, domain_cost, weight * !!pulled_task); } /* diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 52ea0097c513..6cd6b5307430 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -106,6 +106,11 @@ SCHED_FEAT(UTIL_EST_FASTUP, true) SCHED_FEAT(LATENCY_WARN, false) +/* + * Do newidle balancing proportional to its success rate using randomization. + */ +SCHED_FEAT(NI_RANDOM, true) + SCHED_FEAT(HZ_BW, true) SCHED_FEAT(IRQ_AVG, false) diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index bb581cbdae8d..0c3abb44f365 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -5,6 +5,7 @@ #ifndef _KERNEL_SCHED_SCHED_H #define _KERNEL_SCHED_SCHED_H +#include <linux/prandom.h> #include <linux/sched/affinity.h> #include <linux/sched/autogroup.h> #include <linux/sched/cpufreq.h> @@ -1377,6 +1378,12 @@ static inline bool is_migration_disabled(struct task_struct *p) } DECLARE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +DECLARE_PER_CPU(struct rnd_state, sched_rnd_state); + +static inline u32 sched_rng(void) +{ + return prandom_u32_state(this_cpu_ptr(&sched_rnd_state)); +} #define cpu_rq(cpu) (&per_cpu(runqueues, (cpu))) #define this_rq() this_cpu_ptr(&runqueues) diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c index 3023e67da0fd..cf847fdf1063 100644 --- a/kernel/sched/topology.c +++ b/kernel/sched/topology.c @@ -1644,6 +1644,12 @@ sd_init(struct sched_domain_topology_level *tl, .last_balance = jiffies, .balance_interval = sd_weight, + + /* 50% success rate */ + .newidle_call = 512, + .newidle_success = 256, + .newidle_ratio = 512, + .max_newidle_lb_cost = 0, .last_decay_max_lb_cost = jiffies, .child = child, -- 2.34.1

1 1

[PATCH 1/2] [Backport] sched/fair: Proportional newidle balance
by Chen Jinghuang 10 Mar '26

10 Mar '26

From: "Peter Zijlstra (Intel)" <peterz(a)infradead.org> stable inclusion from stable-v6.6.120 commit 51445190c10a36d292e70db085d0fb6cc3bec94f category: perf bugzilla: https://atomgit.com/openeuler/kernel/issues/8555 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 33cf66d88306663d16e4759e9d24766b0aaa2e17 upstream. Add a randomized algorithm that runs newidle balancing proportional to its success rate. This improves schbench significantly: 6.18-rc4: 2.22 Mrps/s 6.18-rc4+revert: 2.04 Mrps/s 6.18-rc4+revert+random: 2.18 Mrps/S Conversely, per Adam Li this affects SpecJBB slightly, reducing it by 1%: 6.17: -6% 6.17+revert: 0% 6.17+revert+random: -1% Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Tested-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Tested-by: Chris Mason <clm(a)meta.com> Link: https://lkml.kernel.org/r/6825c50d-7fa7-45d8-9b81-c6e7e25738e2@meta.com Link: https://patch.msgid.link/20251107161739.770122091@infradead.org [ Ajay: Modified to apply on v6.6 ] Signed-off-by: Ajay Kaher <ajay.kaher(a)broadcom.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: kernel/sched/core.c kernel/sched/fair.c [context conflicts] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- include/linux/sched/topology.h | 3 +++ kernel/sched/core.c | 3 +++ kernel/sched/fair.c | 44 ++++++++++++++++++++++++++++++---- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 7 ++++++ kernel/sched/topology.c | 6 +++++ 6 files changed, 64 insertions(+), 4 deletions(-) diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h index 7eee852aa384..95e5d7772800 100644 --- a/include/linux/sched/topology.h +++ b/include/linux/sched/topology.h @@ -130,6 +130,9 @@ struct sched_domain { unsigned int nr_balance_failed; /* initialise to 0 */ /* idle_balance() stats */ + unsigned int newidle_call; + unsigned int newidle_success; + unsigned int newidle_ratio; u64 max_newidle_lb_cost; unsigned long last_decay_max_lb_cost; diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 69d10fdb84d8..cf45ea94bb05 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -119,6 +119,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_util_est_se_tp); EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +DEFINE_PER_CPU(struct rnd_state, sched_rnd_state); #ifdef CONFIG_QOS_SCHED static void sched_change_qos_group(struct task_struct *tsk, struct task_group *tg); @@ -9976,6 +9977,8 @@ void __init sched_init_smp(void) sched_init_numa(NUMA_NO_NODE); set_sched_cluster(); + prandom_init_once(&sched_rnd_state); + /* * There's no userspace yet to cause hotplug operations; hence all the * CPU masks are stable and all blatant races in the below code cannot diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index a4592d35da8b..d16c65d5fa34 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -13651,8 +13651,24 @@ void update_max_interval(void) max_load_balance_interval = HZ*num_online_cpus()/10; } -static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost) +static inline void update_newidle_stats(struct sched_domain *sd, unsigned int success) { + sd->newidle_call++; + sd->newidle_success += success; + + if (sd->newidle_call >= 1024) { + sd->newidle_ratio = sd->newidle_success; + sd->newidle_call /= 2; + sd->newidle_success /= 2; + } +} + +static inline bool +update_newidle_cost(struct sched_domain *sd, u64 cost, unsigned int success) +{ + if (cost) + update_newidle_stats(sd, success); + if (cost > sd->max_newidle_lb_cost) { /* * Track max cost of a domain to make sure to not delay the @@ -13700,7 +13716,7 @@ static void rebalance_domains(struct rq *rq, enum cpu_idle_type idle) * Decay the newidle max times here because this is a regular * visit to all the domains. */ - need_decay = update_newidle_cost(sd, 0); + need_decay = update_newidle_cost(sd, 0, 0); max_cost += sd->max_newidle_lb_cost; /* @@ -14336,6 +14352,22 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) break; if (sd->flags & SD_BALANCE_NEWIDLE) { + unsigned int weight = 1; + + if (sched_feat(NI_RANDOM)) { + /* + * Throw a 1k sided dice; and only run + * newidle_balance according to the success + * rate. + */ + u32 d1k = sched_rng() % 1024; + weight = 1 + sd->newidle_ratio; + if (d1k > weight) { + update_newidle_stats(sd, 0); + continue; + } + weight = (1024 + weight/2) / weight; + } pulled_task = load_balance(this_cpu, this_rq, sd, CPU_NEWLY_IDLE, @@ -14343,10 +14375,14 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) t1 = sched_clock_cpu(this_cpu); domain_cost = t1 - t0; - update_newidle_cost(sd, domain_cost); - curr_cost += domain_cost; t0 = t1; + + /* + * Track max cost of a domain to make sure to not delay the + * next wakeup on the CPU. + */ + update_newidle_cost(sd, domain_cost, weight * !!pulled_task); } /* diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 52ea0097c513..6cd6b5307430 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -106,6 +106,11 @@ SCHED_FEAT(UTIL_EST_FASTUP, true) SCHED_FEAT(LATENCY_WARN, false) +/* + * Do newidle balancing proportional to its success rate using randomization. + */ +SCHED_FEAT(NI_RANDOM, true) + SCHED_FEAT(HZ_BW, true) SCHED_FEAT(IRQ_AVG, false) diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index bb581cbdae8d..0c3abb44f365 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -5,6 +5,7 @@ #ifndef _KERNEL_SCHED_SCHED_H #define _KERNEL_SCHED_SCHED_H +#include <linux/prandom.h> #include <linux/sched/affinity.h> #include <linux/sched/autogroup.h> #include <linux/sched/cpufreq.h> @@ -1377,6 +1378,12 @@ static inline bool is_migration_disabled(struct task_struct *p) } DECLARE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +DECLARE_PER_CPU(struct rnd_state, sched_rnd_state); + +static inline u32 sched_rng(void) +{ + return prandom_u32_state(this_cpu_ptr(&sched_rnd_state)); +} #define cpu_rq(cpu) (&per_cpu(runqueues, (cpu))) #define this_rq() this_cpu_ptr(&runqueues) diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c index 3023e67da0fd..cf847fdf1063 100644 --- a/kernel/sched/topology.c +++ b/kernel/sched/topology.c @@ -1644,6 +1644,12 @@ sd_init(struct sched_domain_topology_level *tl, .last_balance = jiffies, .balance_interval = sd_weight, + + /* 50% success rate */ + .newidle_call = 512, + .newidle_success = 256, + .newidle_ratio = 512, + .max_newidle_lb_cost = 0, .last_decay_max_lb_cost = jiffies, .child = child, -- 2.34.1

1 1

[PATCH OLK-6.6] tools/interference: add ifstool utility for kernel interference statistics
by Tengda Wu 10 Mar '26

10 Mar '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/7429 -------------------------------- As real-time and high-performance workloads become more sensitive to execution jitter, observability into kernel-induced "noise" is critical. The CONFIG_CGROUP_IFS infrastructure provides this telemetry, but raw data from cgroups is difficult to parse and visualize manually. Introduce ifstool, a userspace utility to monitor and analyze the interference.stat interface. Key capabilities include: 1. High-Resolution Monitoring: - Samples raw counters and latency distributions at sub-second intervals. - Outputs structured CSV data for long-term profiling and integration with external post-processing tools. 2. Interactive Offline Reporting: - Generates self-contained HTML dashboards using Plotly. - Visualizes "Total Time Delta" trends to identify temporal spikes. - Renders latency heatmaps to expose the magnitude and frequency of interference events. Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- tools/Makefile | 11 +- tools/kspect/Makefile | 28 +++ tools/kspect/README | 65 ++++++ tools/kspect/ifstool | 409 ++++++++++++++++++++++++++++++++++ tools/kspect/ifstool.1 | 87 ++++++++ tools/kspect/requirements.txt | 2 + 6 files changed, 598 insertions(+), 4 deletions(-) create mode 100644 tools/kspect/Makefile create mode 100644 tools/kspect/README create mode 100644 tools/kspect/ifstool create mode 100644 tools/kspect/ifstool.1 create mode 100644 tools/kspect/requirements.txt diff --git a/tools/Makefile b/tools/Makefile index 37e9f6804832..153817f0cc17 100644 --- a/tools/Makefile +++ b/tools/Makefile @@ -22,6 +22,7 @@ help: @echo ' hv - tools used when in Hyper-V clients' @echo ' iio - IIO tools' @echo ' intel-speed-select - Intel Speed Select tool' + @echo ' kspect - KSPECT tools' @echo ' kvm_stat - top-like utility for displaying kvm statistics' @echo ' leds - LEDs tools' @echo ' nolibc - nolibc headers testing and installation' @@ -69,7 +70,7 @@ acpi: FORCE cpupower: FORCE $(call descend,power/$@) -cgroup counter firewire hv guest bootconfig spi usb virtio mm bpf iio gpio objtool leds wmi pci firmware debugging tracing: FORCE +cgroup counter firewire hv guest bootconfig spi usb virtio mm bpf iio gpio objtool leds wmi pci firmware debugging tracing kspect: FORCE $(call descend,$@) bpf/%: FORCE @@ -120,7 +121,8 @@ all: acpi cgroup counter cpupower gpio hv firewire \ perf selftests bootconfig spi turbostat usb \ virtio mm bpf x86_energy_perf_policy \ tmon freefall iio objtool kvm_stat wmi \ - pci debugging tracing thermal thermometer thermal-engine + pci debugging tracing thermal thermometer thermal-engine \ + kspect acpi_install: $(call descend,power/$(@:_install=),install) @@ -128,7 +130,7 @@ acpi_install: cpupower_install: $(call descend,power/$(@:_install=),install) -cgroup_install counter_install firewire_install gpio_install hv_install iio_install perf_install bootconfig_install spi_install usb_install virtio_install mm_install bpf_install objtool_install wmi_install pci_install debugging_install tracing_install: +cgroup_install counter_install firewire_install gpio_install hv_install iio_install perf_install bootconfig_install spi_install usb_install virtio_install mm_install bpf_install objtool_install wmi_install pci_install debugging_install tracing_install kspect_install: $(call descend,$(@:_install=),install) selftests_install: @@ -161,7 +163,8 @@ install: acpi_install cgroup_install counter_install cpupower_install gpio_insta virtio_install mm_install bpf_install x86_energy_perf_policy_install \ tmon_install freefall_install objtool_install kvm_stat_install \ wmi_install pci_install debugging_install intel-speed-select_install \ - tracing_install thermometer_install thermal-engine_install + tracing_install thermometer_install thermal-engine_install \ + kspect_install acpi_clean: $(call descend,power/acpi,clean) diff --git a/tools/kspect/Makefile b/tools/kspect/Makefile new file mode 100644 index 000000000000..ffb380ddc885 --- /dev/null +++ b/tools/kspect/Makefile @@ -0,0 +1,28 @@ +# SPDX-License-Identifier: GPL-2.0 + +PREFIX ?= /usr/local +BINDIR = $(PREFIX)/bin +MANDIR = $(PREFIX)/share/man/man1 + +MAN1 = ifstool.1 +TARGET = ifstool + +all: man + +man: $(MAN1) + +install-man: + install -d $(MANDIR) + install -m 0644 $(MAN1) $(MANDIR) + +install-tools: + install -d $(BINDIR) + install -m 0755 $(TARGET) $(BINDIR) + +install: install-tools install-man + +uninstall: + rm -f $(BINDIR)/$(TARGET) + rm -f $(MANDIR)/$(MAN1) + +.PHONY: all install-tools install-man install diff --git a/tools/kspect/README b/tools/kspect/README new file mode 100644 index 000000000000..618e02a202f7 --- /dev/null +++ b/tools/kspect/README @@ -0,0 +1,65 @@ +IFSTOOL - Interference Statistics Analytical Utility + +Overview +======== +IFSTOOL is a specialized userspace utility designed to facilitate the +monitoring and analysis of Interference Statistics (CONFIG_CGROUP_IFS). + +The IFS infrastructure is a kernel-level framework that provides critical +observability into execution jitter (noise) that disrupts task determinism. +It monitors and quantifies the CPU time stolen by kernel-level activities, +such as: interrupt handling, softirqs, and lock contention. The framework +exposes this telemetry via the interference.stat control file within the +cgroup hierarchy. + +IFSTOOL interfaces with the interference.stat file to export raw metrics +into structured CSV data and interactive HTML-based distribution reports. + +Setup +===== +The host environment must meet the following criteria: + +* Kernel: Compiled with `CONFIG_CGROUP_IFS=y`. +* Boot Parameters: `cgroup_ifs=1` added to the kernel command line (optional, + not needed if `CONFIG_CGROUP_IFS_DEFAULT_ENABLED=y`). +* Python Runtime: Python 3.x with `pandas` and `plotly` libraries. +* Cgroup Hierarchy: Either v2 unified or v1 with the cpu subsystem mounted. + +Build +===== +IFSTOOL provides a Makefile to streamline the installation of the +executable and its documentation. + + $ make install + +Run +=== +IFSTOOL operates via two primary functional modes: monitor and report. + +1. **Monitor:** Capture raw interference data from a target cgroup. + + $ ifstool monitor --cgroup docker/<cid> --interval 1 --output capture.csv + +2. **Report:** Transform captured CSV data into an interactive HTML dashboard. + + - Provide only --base for a single-session deep dive: + + $ ifstool report --base capture.csv + + - Provide both --base and --curr to render a differential report, + ideal for validating optimizations: + + $ ifstool report --base baseline.csv --curr current.csv + +HTML Description +================ +The generated HTML report provides a multi-dimensional view of kernel noise: + +- Total Time Delta Trend: A time-series line chart illustrating the incremental + nanoseconds of interference per category (e.g., irq, spinlock). +- Latency Heatmaps: A frequency-domain visualization of the kernel's internal + histogram. + - X-axis: Wall-clock time of the trace. + - Y-axis: Latency magnitude (logarithmic buckets from ns to s). + - Color Intensity: Represents the density (event count) of interference + within that specific latency window. diff --git a/tools/kspect/ifstool b/tools/kspect/ifstool new file mode 100644 index 000000000000..c17de045263a --- /dev/null +++ b/tools/kspect/ifstool @@ -0,0 +1,409 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: GPL-2.0-only +# +# ifstool: A tool to monitor and report interference statistics (CONFIG_CGROUP_IFS). +# +# Copyright(c) 2026. Huawei Technologies Co., Ltd +# +# Authors: +# Tengda Wu <wutengda2(a)huawei.com> + +import os +import time +import re +import csv +import argparse +import pandas as pd +import plotly.graph_objects as go +from plotly.subplots import make_subplots +from plotly.offline import get_plotlyjs + + +class InterferenceTool: + """ + A utility class to monitor Linux cgroup interference statistics (CONFIG_CGROUP_IFS) + and generate visual comparison reports between baseline and current data. + """ + + def __init__(self): + # Default path for cgroup v2 interference stats + self.base_path = "/sys/fs/cgroup" + + def parse_stat(self, content): + """ + Parses the raw content of the interference.stat file. + + Args: + content (str): Raw string content from the stat file. + Returns: + tuple: (total_times dict, distributions dict) + """ + + total_times, distributions = {}, {} + + # Split content into sections: Top-level totals and various distributions + # Uses positive lookahead to split before a word followed by ' distribution' + sections = re.split(r"\n(?=[a-z]+ distribution)", content) + + # Parse global total times (first section) + for line in sections[0].strip().split("\n"): + match = re.match(r"^([a-z]+)\s+(\d+)$", line.strip()) + if match: + total_times[match.group(1)] = int(match.group(2)) + + # Parse histogram distributions (subsequent sections) + for section in sections[1:]: + lines = section.strip().split("\n") + # Extract header name (e.g., 'spinlock distribution') + header = lines[0].replace(" distribution", "").strip() + # Parse bucket key-value pairs (e.g., '[64 ns, 128 ns) : 143791') + dist_data = { + l.split(":")[0].strip(): int(l.split(":")[1].strip()) + for l in lines[1:] + if ":" in l + } + distributions[header] = dist_data + + return total_times, distributions + + def monitor(self, cgroup_id, interval, duration, output_csv): + """ + Periodically samples interference stats and saves results to a CSV file. + + Args: + cgroup_id (str): The specific cgroup folder name. For example, + /sys/kernel/cgroup/A/B/C, when want to monitor level B, the + cgroup_id is A/B. + interval (float): Seconds between samples. + duration (int): Total monitoring time in seconds. + output_csv (str): Filename to save sampled data. + """ + + candidates = [ + os.path.join(self.base_path, cgroup_id), + os.path.join(self.base_path, "cpu", cgroup_id), # cgroup v1 + ] + path = next((p for p in candidates if os.path.exists(p)), None) + + if not path: + print( + f"\n[!] No access to cgroup: {os.path.join(self.base_path, cgroup_id)}" + ) + print(" Hint: You can find the correct cid by executing:") + print(" cat /proc/<PID>/cgroup") + return + + path = os.path.join(path, "interference.stat") + if not os.path.exists(path): + print(f"\n[!] Interface file '{path}' not found.") + print(" This usually happens due to one of the following:") + print(" 1. Kernel is not compiled with CONFIG_CGROUP_IFS=y") + print( + " 2. CONFIG_CGROUP_IFS_DEFAULT_ENABLED is not set to y", + "and the boot parameter 'cgroup_ifs=1' is not added", + ) + print(" 3. The current cgroup is not managed by the IFS controller") + return + + print( + f"[*] Starting monitor: {cgroup_id}, interval: {interval}s, duration: {duration}s" + ) + + data_list = [] + start_time = time.time() + + try: + while (time.time() - start_time) < duration: + ts = time.strftime("%H:%M:%S") + # Using fractional seconds in timestamp for sub-second intervals + if interval < 1.0: + ts = time.strftime("%H:%M:%S") + f".{int((time.time()%1)*100):02d}" + + with open(path, "r") as f: + total_times, dists = self.parse_stat(f.read()) + + # Append total time metrics + for cat, val in total_times.items(): + data_list.append([ts, cgroup_id, cat, "total_time_ns", val]) + + # Append bucket distribution metrics + for cat, dist in dists.items(): + for b, c in dist.items(): + data_list.append([ts, cgroup_id, cat, f"bucket_{b}", c]) + + time.sleep(interval) + except KeyboardInterrupt: + print("\n[!] Monitoring interrupted by user.") + + # Write buffered data to CSV + with open(output_csv, "w", newline="") as f: + writer = csv.writer(f) + writer.writerow( + ["timestamp", "cgroup_id", "category", "metric_type", "value"] + ) + writer.writerows(data_list) + print(f"[+] Data exported successfully: {output_csv}") + + def bucket_key(self, bucket_str): + """ + Parsing logic for histogram bucket labels to enable correct numerical sorting. + Example input: "bucket_[67.10 ms, 134.21 ms)" + + Returns: + float: The value converted to nanoseconds (ns). + """ + try: + # Regex to capture the first number and its unit (ns|us|ms|s) + match = re.search(r"(\d+\.?\d*)\s*(ns|us|ms|s)", bucket_str) + if not match: + return 0 + + value = float(match.group(1)) + unit = match.group(2).lower() + + # Conversion factors to nanoseconds + factors = {"ns": 1, "us": 1000, "ms": 1000000, "s": 1000000000} + + return value * factors.get(unit, 1) + except Exception: + return 0 + + def report(self, base_csv, curr_csv, output_html): + """ + Loads two CSV files and generates an interactive HTML dashboard. + + Args: + base_csv (str): Path to baseline data. + curr_csv (str): Path to current data. + output_html (str): Path to generate the HTML report. + """ + + df_b = pd.read_csv(base_csv) + single_mode = curr_csv is None or base_csv == curr_csv + df_c = None if single_mode else pd.read_csv(curr_csv) + + # Get unique union of categories present in both datasets + all_dfs = [df_b] if single_mode else [df_b, df_c] + categories = sorted( + list(set().union(*(df.category.unique() for df in all_dfs))) + ) + + # Color mapping to ensure consistent colors for categories across plots + color_sequence = [ + "#636EFA", + "#EF553B", + "#00CC96", + "#AB63FA", + "#FFA15A", + "#19D3F3", + "#FF6692", + "#B6E880", + "#FF97FF", + "#FECB52", + ] + color_map = { + cat: color_sequence[i % len(color_sequence)] + for i, cat in enumerate(categories) + } + + # Build HTML content with CSS for layout + html_parts = [ + "<html><head><title>IFS Analysis Dashboard</title>", + f"<script type='text/javascript'>{get_plotlyjs()}</script>", + ] + col_width = "100%" if single_mode else "49.5%" + html_parts.append( + f"""<style> + body{{font-family:'Segoe UI',sans-serif; background:#f0f2f5; padding:20px; color:#333;}} + .card{{background:white; padding:15px; margin-bottom:20px; border-radius:10px; box-shadow:0 2px 5px rgba(0,0,0,0.05);}} + .row-container{{display:flex; gap:15px; justify-content:space-between;}} + .col-item{{width:{col_width}; min-width:0;}} + .stat-box{{display:flex; gap:10px; margin:5px 0; font-size:0.85em; color:#555;}} + .stat-item{{background:#f1f3f5; padding:4px 8px; border-radius:4px; border-left:3px solid #007bff;}} + .section-header{{margin:30px 0 15px 0; padding-bottom:10px; border-bottom:2px solid #ddd;}} + </style></head><body>""" + ) + + title = "Performance Analysis" if single_mode else "Performance Comparison" + html_parts.append(f"<h2>{title} (CONFIG_CGROUP_IFS)</h2>") + info = ( + f"File: {base_csv}" + if single_mode + else f"Baseline: {base_csv} | Current: {curr_csv}" + ) + html_parts.append(f"<p style='color:#666;'>{info}</p>") + + # --- Part 1: Total Time Trends (Line Charts) --- + html_parts.append("<div class='card'>") + html_parts.append("<h3 style='margin-top:0;'>Total Time Delta (ns) Trend</h3>") + + # Subplots ensure Y-axis can be matched for direct visual comparison + fig_line = make_subplots( + rows=1, + cols=1 if single_mode else 2, + horizontal_spacing=0.05, + subplot_titles=("Latency",) if single_mode else ("Baseline", "Current"), + ) + + plot_configs = ( + [("Data", df_b)] if single_mode else [("Baseline", df_b), ("Current", df_c)] + ) + for i, (name, df) in enumerate(plot_configs, 1): + for cat in categories: + sub = df[ + (df["category"] == cat) & (df["metric_type"] == "total_time_ns") + ].sort_values("timestamp") + if not sub.empty: + y_val = sub["value"].diff().fillna(0) + fig_line.add_trace( + go.Scatter( + x=sub["timestamp"], + y=y_val, + name=f"{cat} ({name})", + legendgroup=cat, + mode="lines+markers", + line=dict(color=color_map[cat], width=2), + marker=dict(color=color_map[cat], size=6), + ), + row=1, + col=i, + ) + + # Sync Y-axes scale for baseline and current plots + if not single_mode: + fig_line.update_yaxes(matches="y", row=1, col=2) + fig_line.update_layout( + height=500, template="plotly_white", margin=dict(t=50, b=20) + ) + html_parts.append(fig_line.to_html(full_html=False, include_plotlyjs=False)) + html_parts.append("</div>") + + html_parts.append( + "<h3 class='section-header'>Detailed Latency Distribution</h3>" + ) + + # --- Part 2: Distribution Heatmaps --- + for cat in categories: + + def get_m_and_stats(df): + """Processes raw metrics into a delta-count matrix for heatmap visualization.""" + sub = df[ + (df["category"] == cat) + & (df["metric_type"].str.startswith("bucket_")) + ] + if sub.empty: + return pd.DataFrame(), {} + + # Transform to matrix (Buckets vs Time) + p = sub.pivot( + index="metric_type", columns="timestamp", values="value" + ).sort_index(axis=1) + # Sort Y-axis buckets based on numerical time value + p = p.reindex(sorted(p.index, key=self.bucket_key)) + # Calculate incremental change (delta) + delta = p.diff(axis=1).fillna(0) + return delta, { + "Total": int(delta.values.sum()), + "Peak": int(delta.values.max()), + } + + m_b, stats_b = get_m_and_stats(df_b) + m_c, stats_c = (None, None) if single_mode else get_m_and_stats(df_c) + + # Determine global max for heatmap color scaling consistency + z_vals = [m_b.values.max() if not m_b.empty else 0] + if not single_mode: + z_vals.append(m_c.values.max() if not m_c.empty else 0) + global_max_z = max(z_vals + [1]) + + html_parts.append(f"<div class='card'><h4>Category: {cat.upper()}</h4>") + html_parts.append("<div class='row-container'>") + + configs = ( + [("Data", m_b, stats_b)] + if single_mode + else [("Baseline", m_b, stats_b), ("Current", m_c, stats_c)] + ) + for name, m, stats in configs: + html_parts.append("<div class='col-item'>") + if not m.empty: + # Display summary statistics + html_parts.append("<div class='stat-box'>") + for k, v in stats.items(): + html_parts.append( + f"<div class='stat-item'><b>{k}:</b> {v}</div>" + ) + html_parts.append("</div>") + + # Generate Heatmap + fig = go.Figure( + data=go.Heatmap( + z=m.values, + x=m.columns, + y=m.index, + colorscale="Viridis", + zmin=0, + zmax=global_max_z, + colorbar=dict(title="Count", thickness=10, len=0.7), + ) + ) + fig.update_layout( + height=400, + margin=dict(l=120, r=0, t=10, b=30), + template="plotly_white", + ) + html_parts.append( + fig.to_html(full_html=False, include_plotlyjs=False) + ) + else: + html_parts.append( + "<div style='height:100px; display:flex; align-items:center; justify-content:center; background:#fafafa; color:#ccc;'>No Data</div>" + ) + html_parts.append("</div>") + + html_parts.append("</div></div>") # end row-container & card + + # Save the final HTML report + with open(output_html, "w") as f: + f.writelines(html_parts + ["</body></html>"]) + print(f"[+] Comparison report generated: {output_html}") + + +if __name__ == "__main__": + parser = argparse.ArgumentParser() + sub = parser.add_subparsers(dest="mode") + + # Monitor Mode Arguments + p_mon = sub.add_parser("monitor") + p_mon.add_argument( + "-G", + "--cgroup", + required=True, + help="Cgroup name (e.g. 'docker/cid'). " + "Tip: Find this via 'cat /proc/<PID>/cgroup'", + ) + p_mon.add_argument( + "-i", "--interval", type=float, default=1.0, help="Sampling interval (sec)" + ) + p_mon.add_argument( + "-d", "--duration", type=int, default=30, help="Sampling duration (sec)" + ) + p_mon.add_argument("-o", "--output", default="capture.csv") + + # Report Mode Arguments + p_comp = sub.add_parser("report") + p_comp.add_argument("-b", "--base", required=True, help="Baseline CSV file") + p_comp.add_argument( + "-c", "--curr", default=None, help="Current CSV file (optional, for comparison)" + ) + p_comp.add_argument("-o", "--output", default="report.html") + + args = parser.parse_args() + tool = InterferenceTool() + + if args.mode == "monitor": + tool.monitor(args.cgroup, args.interval, args.duration, args.output) + elif args.mode == "report": + tool.report(args.base, args.curr, args.output) + else: + parser.print_help() diff --git a/tools/kspect/ifstool.1 b/tools/kspect/ifstool.1 new file mode 100644 index 000000000000..7ff9d297fc08 --- /dev/null +++ b/tools/kspect/ifstool.1 @@ -0,0 +1,87 @@ +.TH IFSTOOL 1 "March 2026" "Linux" "User Commands" +.SH NAME +ifstool \- Analyze kernel interference statistics (CONFIG_CGROUP_IFS) +.SH SYNOPSIS +.B ifstool monitor +[\fB\-G\fR|\fB\-\-cgroup\fR \fICGROUP_ID\fR] [\fB\-d\fR|\fB\-\-duration\fR \fISEC\fR] [\fB\-i\fR|\fB\-\-interval\fR \fISEC\fR] [\fB\-o\fR|\fB\-\-output\fR \fICSV\fR] +.br +.B ifstool report +[\fB\-b\fR|\fB\-\-base\fR \fICSV\fR] [\fB\-c\fR|\fB\-\-curr\fR \fICSV\fR] [\fB\-o\fR|\fB\-\-output\fR \fIHTML\fR] + +.SH DESCRIPTION +.B IFSTOOL +is a specialized userspace utility designed to facilitate the monitoring and analysis of Interference Statistics (\fBCONFIG_CGROUP_IFS\fR). + +The \fBIFS infrastructure\fR is a kernel-level framework providing critical observability into execution jitter (noise) that disrupts task determinism. It quantifies CPU time stolen by kernel activities such as interrupt handling, softirqs, and lock contention. This telemetry is exposed via the \fBinterference.stat\fR control file within the cgroup hierarchy. + +\fBIFSTOOL\fR interfaces with this file to export raw metrics into structured CSV data and interactive HTML-based distribution reports. + +.SH SETUP +The host environment must meet the following criteria: +.IP \[bu] 2 +\fBKernel:\fR Compiled with \fBCONFIG_CGROUP_IFS=y\fR. +.IP \[bu] 2 +\fBBoot Parameters:\fR \fBcgroup_ifs=1\fR added to the kernel command line (optional, not needed if \fBCONFIG_CGROUP_IFS_DEFAULT_ENABLED=y\fR). +.IP \[bu] 2 +\fBPython Runtime:\fR Python 3.x with \fBpandas\fR and \fBplotly\fR libraries. +.IP \[bu] 2 +\fBCgroup Hierarchy:\fR Either v2 unified or v1 (with the \fBcpu\fR subsystem mounted). + +.SH COMMANDS +.SS monitor +Capture raw interference data from a target cgroup. +.TP +\fB\-G, \-\-cgroup\fR \fICGROUP_ID\fR +Specify the cgroup identifier (e.g., \fIdocker/<cid>\fR). For example, /sys/kernel/cgroup/A/B/C, when you want to monitor level B, the cgroup_id is A/B. Tip: Find this via cat \fI/proc/PID/cgroup\fR. +.TP +\fB\-d, \-\-duration\fR \fISEC\fR +Total collection time in seconds (default: 30). +.TP +\fB\-i, \-\-interval\fR \fISEC\fR +Sampling interval in seconds; supports floating point (default: 1.0). +.TP +\fB\-o, \-\-output\fR \fICSV\fR +Path to the output CSV file where raw sampled data will be stored (default: \fBcapture.csv\fR). + +.SS report +Transform captured CSV data into an interactive HTML dashboard. +.TP +\fB\-b, \-\-base\fR \fICSV\fR +Primary capture file for analysis. +.TP +\fB\-c, \-\-curr\fR \fICSV\fR +Optional secondary file for differential (comparison) analysis. +.TP +\fB\-o, \-\-output\fR \fIHTML\fR +Path to the generated interactive HTML dashboard (default: \fBreport.html\fR). + +.SH HTML REPORT STRUCTURE +The generated HTML report provides a multi-dimensional view of kernel noise: +.IP "Total Time Delta Trend" 4 +A time-series line chart illustrating the incremental nanoseconds of interference per category (e.g., irq, spinlock). +.IP "Latency Heatmaps" 4 +A frequency-domain visualization of the kernel's internal histogram: +.RS 8 +.IP "X-axis:" 8 +Wall-clock time of the trace. +.IP "Y-axis:" 8 +Latency magnitude (logarithmic buckets from ns to s). +.IP "Color Intensity:" 8 +Represents the event count (density) of interference within that specific latency window. +.RE + +.SH EXAMPLES +Monitor a Docker container for 10 seconds: +.IP +.B $ ifstool monitor \-\-cgroup docker/<cid> \-\-duration 10 \-\-interval 1 +.PP +Generate a single-session deep dive: +.IP +.B $ ifstool report \-\-base capture.csv +.PP +Generate a differential report between two traces: +.IP +.B $ ifstool report \-\-base baseline.csv \-\-curr current.csv + +.SH AUTHOR +Tengda Wu <wutengda2(a)huawei.com> \ No newline at end of file diff --git a/tools/kspect/requirements.txt b/tools/kspect/requirements.txt new file mode 100644 index 000000000000..8e5e376a0e9a --- /dev/null +++ b/tools/kspect/requirements.txt @@ -0,0 +1,2 @@ +pandas==3.* +plotly==6.* -- 2.34.1

2 1

[PATCH OLK-5.10] gic: Add hip09 support for HISILICON_ERRATUM_165010801
by Zeng Heng 10 Mar '26

10 Mar '26

From: Yifan Wu <wuyifan50(a)huawei.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7023 ---------------------------------------------------------------------- Add hip09 support for HISILICON_ERRATUM_165010801 Fixes: f0f9be237c22 ("gic: increase the arch_timer priority to avoid hardlockup") Signed-off-by: Yifan Wu <wuyifan50(a)huawei.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/Kconfig | 11 ++++++----- drivers/clocksource/arm_arch_timer.c | 5 +++++ 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 715c2810a43d..48fc9c71ed31 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -878,11 +878,12 @@ config HISILICON_ERRATUM_165010801 depends on ARCH_HISI default y help - On HIP12, when GIC receives multiple interrupts of the same priority and - different types, the interrupts are selected in the following sequence: - SPI > LPI > SGI > PPI. This scheduling rule may cause PPI starvation. - To prevent starvation from triggering system watchdog hardlockup, the - interrupt priority is explicitly increased in the arch_timer driver. + On HIP09/12 hardware, observations indicate that the GIC's handling of + equal-priority interrupts across different interrupt types may not always + provide balanced servicing. In some cases, this could result in prolonged + service delays for particular interrupt types, creating conditions where + system watchdog hardlockup detection might be triggered. The arch_timer + driver addresses this by proactively increasing affected interrupt priorities. config QCOM_FALKOR_ERRATUM_1003 bool "Falkor E1003: Incorrect translation due to ASID change" diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c index 7f29ee39af3a..c6664d435921 100644 --- a/drivers/clocksource/arm_arch_timer.c +++ b/drivers/clocksource/arm_arch_timer.c @@ -340,6 +340,11 @@ static struct ate_acpi_oem_info hisi_161010101_oem_info[] = { #ifdef CONFIG_HISILICON_ERRATUM_165010801 static struct ate_acpi_oem_info hisi_165010801_oem_info[] = { + { + .oem_id = "HISI ", + .oem_table_id = "HIP09 ", + .oem_revision = 0, + }, { .oem_id = "HISI ", .oem_table_id = "HIP12 ", -- 2.25.1

2 1

[PATCH OLK-6.6] net: yt6801: add link info for yt6801
by Frank_Sae 10 Mar '26

10 Mar '26

yt6801 inclusion category: bugfix bugzilla: https://https://atomgit.com/openeuler/kernel/issues/7229 -------------------------------------------------------------------- add link info for yt6801 to fix that the link info is not update on os installation. Fixes: b9f5c0893d16 ("net: yt6801: add link info for yt6801") Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com> --- .../ethernet/motorcomm/yt6801/yt6801_main.c | 90 +++++++++++++++++++ 1 file changed, 90 insertions(+) diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c index 01eed3ace..cb54329ef 100644 --- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c +++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c @@ -27,6 +27,95 @@ const struct net_device_ops *fxgmac_get_netdev_ops(void); static void fxgmac_napi_enable(struct fxgmac_pdata *priv); +const struct ethtool_ops *fxgmac_get_ethtool_ops(void); + +#define MII_SPEC_STATUS 0x11 /* PHY specific status */ +#define FXGMAC_EPHY_LINK_STATUS BIT(10) +#define PHY_MII_SPEC_DUPLEX BIT(13) + +static int fxgmac_get_link_ksettings(struct net_device *netdev, + struct ethtool_link_ksettings *cmd) +{ + struct fxgmac_pdata *pdata = netdev_priv(netdev); + struct phy_device *phydev = netdev->phydev; + u32 duplex, regval, link_status; + u32 adv = 0xFFFFFFFF; + + ethtool_link_ksettings_zero_link_mode(cmd, supported); + ethtool_link_ksettings_zero_link_mode(cmd, advertising); + + /* set the supported link speeds */ + ethtool_link_ksettings_add_link_mode(cmd, supported, 1000baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 100baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 100baseT_Half); + ethtool_link_ksettings_add_link_mode(cmd, supported, 10baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 10baseT_Half); + + /* Indicate pause support */ + ethtool_link_ksettings_add_link_mode(cmd, supported, Pause); + ethtool_link_ksettings_add_link_mode(cmd, supported, Asym_Pause); + + regval = phy_read(phydev, MII_ADVERTISE); + + if (field_get(ADVERTISE_PAUSE_CAP, regval)) + ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); + + if (field_get(ADVERTISE_PAUSE_ASYM, regval)) + ethtool_link_ksettings_add_link_mode(cmd, advertising, Asym_Pause); + + ethtool_link_ksettings_add_link_mode(cmd, supported, MII); + cmd->base.port = PORT_MII; + + ethtool_link_ksettings_add_link_mode(cmd, supported, Autoneg); + regval = phy_read(phydev, MII_BMCR); + + regval = field_get(BMCR_ANENABLE, regval); + if (regval) { + ethtool_link_ksettings_add_link_mode(cmd, advertising, Autoneg); + + regval = phy_read(phydev, MII_ADVERTISE); + + if (adv & ADVERTISE_10HALF) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half); + if (adv & ADVERTISE_10FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full); + if (adv & ADVERTISE_100HALF) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half); + if (adv & ADVERTISE_100FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full); + + adv = phy_read(phydev, MII_CTRL1000); + + if (adv & ADVERTISE_1000FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full); + } + + cmd->base.autoneg = 1; + + regval = phy_read(phydev, MII_SPEC_STATUS); + + link_status = field_get(FXGMAC_EPHY_LINK_STATUS, regval); + if (link_status) { + duplex = field_get(PHY_MII_SPEC_DUPLEX, regval); + cmd->base.duplex = duplex; + cmd->base.speed = pdata->mac_speed; + } else { + cmd->base.duplex = DUPLEX_UNKNOWN; + cmd->base.speed = SPEED_UNKNOWN; + } + + return 0; +} + +static const struct ethtool_ops fxgmac_ethtool_ops = { + .get_link = ethtool_op_get_link, + .get_link_ksettings = fxgmac_get_link_ksettings, +}; + +const struct ethtool_ops *fxgmac_get_ethtool_ops(void) +{ + return &fxgmac_ethtool_ops; +} #define PHY_WR_CONFIG(reg_offset) (0x8000205 + ((reg_offset) * 0x10000)) static int fxgmac_phy_write_reg(struct fxgmac_pdata *priv, u32 reg_id, u32 data) @@ -1899,6 +1988,7 @@ static int fxgmac_init(struct fxgmac_pdata *priv, bool save_private_reg) FXGMAC_JUMBO_PACKET_MTU + (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN); ndev->netdev_ops = fxgmac_get_netdev_ops();/* Set device operations */ + ndev->ethtool_ops = fxgmac_get_ethtool_ops();/* Set device operations */ /* Set device features */ if (priv->hw_feat.tso) { -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix TLBI broadcast optimization loss and incorrect dvmbm handling
by Tian Zheng 10 Mar '26

10 Mar '26

Fix 1 In the TLBI broadcast-optimization feature, the SYS_LSUDVM_CTRL_EL2 register controls whether the feature is enabled. When LPI low-power mode is enabled, this register is cleared as the pCPU powers down into LPI mode, causing the TLBI broadcast optimization to stop working. The fix saves and restores this control register in the callbacks for entering and exiting LPI mode. Fix 2 The current TLBI broadcast-optimization logic only supports normal VMs. If the feature is enabled globally, VMs that are not yet adapted for it, such as CCA will use an incorrect TLBI broadcast bitmap, which can cause a panic in CCA VMs. The fix moves the actual enable/disable of the dvmbm functionality into the vcpu load and vcpu put functions. Tian Zheng (2): KVM: arm64: Fix TLBI optimization broken in LPI mode KVM: arm64: Fix CCA guest panic when dvmbm is enabled arch/arm64/kvm/arm.c | 6 ++++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 9 ++++----- arch/arm64/kvm/hisilicon/hisi_virt.h | 19 +++++++++++++++++++ 3 files changed, 29 insertions(+), 5 deletions(-) -- 2.33.0

1 2

[PATCH openEuler-1.0-LTS] [Huawei] PCI: Fix AB-BA deadlock between aer_isr() and device_shutdown()
by Hongtao Zhang 10 Mar '26

10 Mar '26

From: Ziming Du <duziming2(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13854 CVE: NA Reference: NA -------------------------------- During system shutdown, a deadlock may occur between AER recovery process and device shutdown as follows: The device_shutdown path holds the device_lock throughout the entire process and waits for the irq handlers to complete when release nodes: device_shutdown device_lock # A hold device_lock pci_device_shutdown pcie_port_device_remove remove_iter device_unregister device_del bus_remove_device device_release_driver devres_release_all release_nodes # B wait for irq handlers The aer_isr path will acquire device_lock in pci_bus_reset(): aer_isr # B execute irq process aer_isr_one_error aer_process_err_devices handle_error_source pcie_do_recovery aer_root_reset pci_bus_error_reset pci_bus_reset # A acquire device_lock The circular dependency causes system hang. Fix it by using pci_bus_trylock() instead of pci_bus_lock() in pci_bus_reset(). When the lock is unavailable, return -EAGAIN, as in similar cases. Fixes: c4eed62a2143 ("PCI/ERR: Use slot reset if available") Signed-off-by: Ziming Du <duziming2(a)huawei.com> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/pci/pci.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index b93605616d4e4..d1a8531df0271 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5309,15 +5309,21 @@ static int pci_bus_reset(struct pci_bus *bus, int probe) if (probe) return 0; - pci_bus_lock(bus); + /* + * Replace blocking lock with trylock to prevent deadlock during bus reset. + * Same as above except return -EAGAIN if the bus cannot be locked. + */ + if (pci_bus_trylock(bus)) { + might_sleep(); - might_sleep(); + ret = pci_bridge_secondary_bus_reset(bus->self); - ret = pci_bridge_secondary_bus_reset(bus->self); + pci_bus_unlock(bus); - pci_bus_unlock(bus); + return ret; + } - return ret; + return -EAGAIN; } /** -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] [Huawei] PCI: Fix AB-BA deadlock between aer_isr() and device_shutdown()
by Hongtao Zhang 10 Mar '26

10 Mar '26

From: Ziming Du <duziming2(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13854 -------------------------------- During system shutdown, a deadlock may occur between AER recovery process and device shutdown as follows: The device_shutdown path holds the device_lock throughout the entire process and waits for the irq handlers to complete when release nodes: device_shutdown device_lock # A hold device_lock pci_device_shutdown pcie_port_device_remove remove_iter device_unregister device_del bus_remove_device device_release_driver devres_release_all release_nodes # B wait for irq handlers The aer_isr path will acquire device_lock in pci_bus_reset(): aer_isr # B execute irq process aer_isr_one_error aer_process_err_devices handle_error_source pcie_do_recovery aer_root_reset pci_bus_error_reset pci_bus_reset # A acquire device_lock The circular dependency causes system hang. Fix it by using pci_bus_trylock() instead of pci_bus_lock() in pci_bus_reset(). When the lock is unavailable, return -EAGAIN, as in similar cases. Fixes: c4eed62a2143 ("PCI/ERR: Use slot reset if available") Signed-off-by: Ziming Du <duziming2(a)huawei.com> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/pci/pci.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index b93605616d4e4..d1a8531df0271 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5309,15 +5309,21 @@ static int pci_bus_reset(struct pci_bus *bus, int probe) if (probe) return 0; - pci_bus_lock(bus); + /* + * Replace blocking lock with trylock to prevent deadlock during bus reset. + * Same as above except return -EAGAIN if the bus cannot be locked. + */ + if (pci_bus_trylock(bus)) { + might_sleep(); - might_sleep(); + ret = pci_bridge_secondary_bus_reset(bus->self); - ret = pci_bridge_secondary_bus_reset(bus->self); + pci_bus_unlock(bus); - pci_bus_unlock(bus); + return ret; + } - return ret; + return -EAGAIN; } /** -- 2.43.0

2 1

[PATCH OLK-6.6] sched: Add SOFT_DOMAIN feature interface for cgroup2
by Wang Tao 10 Mar '26

10 Mar '26

hulk inclusion category: other bugzilla: https://atomgit.com/openeuler/kernel/issues/8692 -------------------------------- Adapt interfaces 'soft_domain', 'soft_domain_nr_cpu', 'soft_domain_cpu_list' for the SOFT_DOMAIN feature to cgroup2. Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/sched/core.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index bf8022acd6ad..69d10fdb84d8 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -12292,6 +12292,25 @@ static struct cftype cpu_files[] = { .write = cpu_uclamp_max_write, }, #endif +#ifdef CONFIG_SCHED_SOFT_DOMAIN + { + .name = "soft_domain", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_soft_domain_read_s64, + .write_s64 = cpu_soft_domain_write_s64, + }, + { + .name = "soft_domain_nr_cpu", + .flags = CFTYPE_NOT_ON_ROOT, + .read_u64 = cpu_soft_domain_quota_read_u64, + .write_u64 = cpu_soft_domain_quota_write_u64, + }, + { + .name = "soft_domain_cpu_list", + .flags = CFTYPE_NOT_ON_ROOT, + .seq_show = soft_domain_cpu_list_seq_show, + }, +#endif #ifdef CONFIG_SCHED_SOFT_QUOTA { .name = "soft_quota", -- 2.34.1

2 1

[PATCH OLK-6.6 0/8] fix CVE-2025-39981
by Jiacheng Yu 09 Mar '26

09 Mar '26

CVE-2025-39981 Gustavo A. R. Silva (1): overflow: Fix direct struct member initialization in _DEFINE_FLEX() Jianpeng Chang (1): Bluetooth: MGMT: Fix memory leak in set_ssp_complete Kees Cook (2): overflow: Change DEFINE_FLEX to take __counted_by member overflow: Introduce __DEFINE_FLEX for having no initializer Luiz Augusto von Dentz (1): Bluetooth: MGMT: Fix possible UAFs Pauli Virtanen (1): Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete Przemek Kitszel (1): overflow: add DEFINE_FLEX() for on-stack allocs Roman Smirnov (1): Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() include/linux/compiler_types.h | 32 ++-- include/linux/fortify-string.h | 4 - include/linux/overflow.h | 65 ++++++++ include/net/bluetooth/mgmt.h | 2 +- lib/overflow_kunit.c | 19 +++ net/bluetooth/mgmt.c | 263 +++++++++++++++++++++++---------- net/bluetooth/mgmt_util.c | 46 ++++++ net/bluetooth/mgmt_util.h | 3 + 8 files changed, 342 insertions(+), 92 deletions(-) -- 2.43.0

2 9

[PATCH OLK-6.6 0/8] fix CVE-2025-39981
by Jiacheng Yu 09 Mar '26

09 Mar '26

CVE-2025-39981 Gustavo A. R. Silva (1): overflow: Fix direct struct member initialization in _DEFINE_FLEX() Jianpeng Chang (1): Bluetooth: MGMT: Fix memory leak in set_ssp_complete Kees Cook (2): overflow: Change DEFINE_FLEX to take __counted_by member overflow: Introduce __DEFINE_FLEX for having no initializer Luiz Augusto von Dentz (1): Bluetooth: MGMT: Fix possible UAFs Pauli Virtanen (1): Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete Przemek Kitszel (1): overflow: add DEFINE_FLEX() for on-stack allocs Roman Smirnov (1): Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() include/linux/compiler_types.h | 36 +++-- include/linux/fortify-string.h | 4 - include/linux/overflow.h | 65 ++++++++ include/net/bluetooth/mgmt.h | 2 +- lib/overflow_kunit.c | 19 +++ net/bluetooth/mgmt.c | 263 +++++++++++++++++++++++---------- net/bluetooth/mgmt_util.c | 46 ++++++ net/bluetooth/mgmt_util.h | 3 + 8 files changed, 346 insertions(+), 92 deletions(-) -- 2.43.0

2 9

[PATCH OLK-6.6] tools/interference: add ifstool utility for kernel interference statistics
by Tengda Wu 09 Mar '26

09 Mar '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/7429 -------------------------------- As real-time and high-performance workloads become more sensitive to execution jitter, observability into kernel-induced "noise" is critical. The CONFIG_IFS infrastructure provides this telemetry, but raw data from cgroups is difficult to parse and visualize manually. Introduce ifstool, a userspace utility to monitor and analyze the interference.stat interface. Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- tools/Makefile | 11 +- tools/kspect/Makefile | 28 +++ tools/kspect/README | 64 ++++++ tools/kspect/ifstool | 396 ++++++++++++++++++++++++++++++++++ tools/kspect/ifstool.1 | 81 +++++++ tools/kspect/requirements.txt | 2 + 6 files changed, 578 insertions(+), 4 deletions(-) create mode 100644 tools/kspect/Makefile create mode 100644 tools/kspect/README create mode 100644 tools/kspect/ifstool create mode 100644 tools/kspect/ifstool.1 create mode 100644 tools/kspect/requirements.txt diff --git a/tools/Makefile b/tools/Makefile index 37e9f6804832..153817f0cc17 100644 --- a/tools/Makefile +++ b/tools/Makefile @@ -22,6 +22,7 @@ help: @echo ' hv - tools used when in Hyper-V clients' @echo ' iio - IIO tools' @echo ' intel-speed-select - Intel Speed Select tool' + @echo ' kspect - KSPECT tools' @echo ' kvm_stat - top-like utility for displaying kvm statistics' @echo ' leds - LEDs tools' @echo ' nolibc - nolibc headers testing and installation' @@ -69,7 +70,7 @@ acpi: FORCE cpupower: FORCE $(call descend,power/$@) -cgroup counter firewire hv guest bootconfig spi usb virtio mm bpf iio gpio objtool leds wmi pci firmware debugging tracing: FORCE +cgroup counter firewire hv guest bootconfig spi usb virtio mm bpf iio gpio objtool leds wmi pci firmware debugging tracing kspect: FORCE $(call descend,$@) bpf/%: FORCE @@ -120,7 +121,8 @@ all: acpi cgroup counter cpupower gpio hv firewire \ perf selftests bootconfig spi turbostat usb \ virtio mm bpf x86_energy_perf_policy \ tmon freefall iio objtool kvm_stat wmi \ - pci debugging tracing thermal thermometer thermal-engine + pci debugging tracing thermal thermometer thermal-engine \ + kspect acpi_install: $(call descend,power/$(@:_install=),install) @@ -128,7 +130,7 @@ acpi_install: cpupower_install: $(call descend,power/$(@:_install=),install) -cgroup_install counter_install firewire_install gpio_install hv_install iio_install perf_install bootconfig_install spi_install usb_install virtio_install mm_install bpf_install objtool_install wmi_install pci_install debugging_install tracing_install: +cgroup_install counter_install firewire_install gpio_install hv_install iio_install perf_install bootconfig_install spi_install usb_install virtio_install mm_install bpf_install objtool_install wmi_install pci_install debugging_install tracing_install kspect_install: $(call descend,$(@:_install=),install) selftests_install: @@ -161,7 +163,8 @@ install: acpi_install cgroup_install counter_install cpupower_install gpio_insta virtio_install mm_install bpf_install x86_energy_perf_policy_install \ tmon_install freefall_install objtool_install kvm_stat_install \ wmi_install pci_install debugging_install intel-speed-select_install \ - tracing_install thermometer_install thermal-engine_install + tracing_install thermometer_install thermal-engine_install \ + kspect_install acpi_clean: $(call descend,power/acpi,clean) diff --git a/tools/kspect/Makefile b/tools/kspect/Makefile new file mode 100644 index 000000000000..ffb380ddc885 --- /dev/null +++ b/tools/kspect/Makefile @@ -0,0 +1,28 @@ +# SPDX-License-Identifier: GPL-2.0 + +PREFIX ?= /usr/local +BINDIR = $(PREFIX)/bin +MANDIR = $(PREFIX)/share/man/man1 + +MAN1 = ifstool.1 +TARGET = ifstool + +all: man + +man: $(MAN1) + +install-man: + install -d $(MANDIR) + install -m 0644 $(MAN1) $(MANDIR) + +install-tools: + install -d $(BINDIR) + install -m 0755 $(TARGET) $(BINDIR) + +install: install-tools install-man + +uninstall: + rm -f $(BINDIR)/$(TARGET) + rm -f $(MANDIR)/$(MAN1) + +.PHONY: all install-tools install-man install diff --git a/tools/kspect/README b/tools/kspect/README new file mode 100644 index 000000000000..afb92a7f98d0 --- /dev/null +++ b/tools/kspect/README @@ -0,0 +1,64 @@ +IFSTOOL - Interference Statistics Analytical Utility + +Overview +======== +IFSTOOL is a specialized userspace utility designed to facilitate the +monitoring and analysis of Interference Statistics (CONFIG_IFS). + +The IFS infrastructure is a kernel-level framework that provides critical +observability into execution jitter (noise) that disrupts task determinism. +It monitors and quantifies the CPU time stolen by kernel-level activities, +such as: interrupt handling, softirqs, and lock contention. The framework +exposes this telemetry via the interference.stat control file within the +cgroup hierarchy. + +IFSTOOL interfaces with the interference.stat file to export raw metrics +into structured CSV data and interactive HTML-based distribution reports. + +Setup +===== +The host environment must meet the following criteria: + +* Kernel: Compiled with `CONFIG_IFS=y`. +* Boot Parameters: `cgroup_ifs=1` added to the kernel command line. +* Python Runtime: Python 3.x with `pandas` and `plotly` libraries. +* Cgroup Hierarchy: Either v2 unified or v1 with the cpu subsystem mounted. + +Build +===== +IFSTOOL provides a Makefile to streamline the installation of the +executable and its documentation. + + $ make install + +Run +=== +IFSTOOL operates via two primary functional modes: monitor and report. + +1. **Monitor:** Capture raw interference data from a target cgroup. + + $ ifstool monitor --cgroup docker/<cid> --interval 1 --output capture.csv + +2. **Report:** Transform captured CSV data into an interactive HTML dashboard. + + - Provide only --base for a single-session deep dive: + + $ ifstool report --base capture.csv + + - Provide both --base and --curr to render a differential report, + ideal for validating optimizations: + + $ ifstool report --base baseline.csv --curr current.csv + +HTML Description +================ +The generated HTML report provides a multi-dimensional view of kernel noise: + +- Total Time Delta Trend: A time-series line chart illustrating the incremental + nanoseconds of interference per category (e.g., irq, spinlock). +- Latency Heatmaps: A frequency-domain visualization of the kernel's internal + histogram. + - X-axis: Wall-clock time of the trace. + - Y-axis: Latency magnitude (logarithmic buckets from ns to s). + - Color Intensity: Represents the density (event count) of interference + within that specific latency window. diff --git a/tools/kspect/ifstool b/tools/kspect/ifstool new file mode 100644 index 000000000000..dcaa8a84272d --- /dev/null +++ b/tools/kspect/ifstool @@ -0,0 +1,396 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: GPL-2.0-only +# +# ifstool: A tool to monitor and report interference statistics (CONFIG_IFS). +# +# Copyright(c) 2026. Huawei Technologies Co., Ltd +# +# Authors: +# Tengda Wu <wutengda2(a)huawei.com> + +import os +import time +import re +import csv +import argparse +import pandas as pd +import plotly.graph_objects as go +from plotly.subplots import make_subplots + + +class InterferenceTool: + """ + A utility class to monitor Linux cgroup interference statistics (CONFIG_IFS) + and generate visual comparison reports between baseline and current data. + """ + + def __init__(self): + # Default path for cgroup v2 interference stats + self.base_path = "/sys/fs/cgroup" + + def parse_stat(self, content): + """ + Parses the raw content of the interference.stat file. + + Args: + content (str): Raw string content from the stat file. + Returns: + tuple: (total_times dict, distributions dict) + """ + + total_times, distributions = {}, {} + + # Split content into sections: Top-level totals and various distributions + # Uses positive lookahead to split before a word followed by ' distribution' + sections = re.split(r"\n(?=[a-z]+ distribution)", content) + + # Parse global total times (first section) + for line in sections[0].strip().split("\n"): + match = re.match(r"^([a-z]+)\s+(\d+)$", line.strip()) + if match: + total_times[match.group(1)] = int(match.group(2)) + + # Parse histogram distributions (subsequent sections) + for section in sections[1:]: + lines = section.strip().split("\n") + # Extract header name (e.g., 'spinlock distribution') + header = lines[0].replace(" distribution", "").strip() + # Parse bucket key-value pairs (e.g., '[64 ns, 128 ns) : 143791') + dist_data = { + l.split(":")[0].strip(): int(l.split(":")[1].strip()) + for l in lines[1:] + if ":" in l + } + distributions[header] = dist_data + + return total_times, distributions + + def monitor(self, cgroup_id, interval, duration, output_csv): + """ + Periodically samples interference stats and saves results to a CSV file. + + Args: + cgroup_id (str): The specific cgroup folder name. + interval (float): Seconds between samples. + duration (int): Total monitoring time in seconds. + output_csv (str): Filename to save sampled data. + """ + + candidates = [ + os.path.join(self.base_path, cgroup_id), + os.path.join(self.base_path, "cpu", cgroup_id), # cgroup v1 + ] + path = next((p for p in candidates if os.path.exists(p)), None) + + if not path: + print( + f"\n[!] No access to cgroup: {os.path.join(self.base_path, cgroup_id)}" + ) + print(" Hint: You can find the correct cid by executing:") + print(" cat /proc/<PID>/cgroup") + return + + path = os.path.join(path, "interference.stat") + if not os.path.exists(path): + print(f"\n[!] Interface file '{path}' not found.") + print(" This usually happens due to one of the following:") + print(" 1. Kernel is not compiled with CONFIG_IFS=y") + print(" 2. Kernel boot parameter 'cgroup_ifs=1' is missing") + print(" 3. The current cgroup is not managed by the IFS controller") + return + + print( + f"[*] Starting monitor: {cgroup_id}, interval: {interval}s, duration: {duration}s" + ) + + data_list = [] + start_time = time.time() + + try: + while (time.time() - start_time) < duration: + ts = time.strftime("%H:%M:%S") + # Using fractional seconds in timestamp for sub-second intervals + if interval < 1.0: + ts = time.strftime("%H:%M:%S") + f".{int((time.time()%1)*100):02d}" + + with open(path, "r") as f: + total_times, dists = self.parse_stat(f.read()) + + # Append total time metrics + for cat, val in total_times.items(): + data_list.append([ts, cgroup_id, cat, "total_time_ns", val]) + + # Append bucket distribution metrics + for cat, dist in dists.items(): + for b, c in dist.items(): + data_list.append([ts, cgroup_id, cat, f"bucket_{b}", c]) + + time.sleep(interval) + except KeyboardInterrupt: + print("\n[!] Monitoring interrupted by user.") + + # Write buffered data to CSV + with open(output_csv, "w", newline="") as f: + writer = csv.writer(f) + writer.writerow( + ["timestamp", "cgroup_id", "category", "metric_type", "value"] + ) + writer.writerows(data_list) + print(f"[+] Data exported successfully: {output_csv}") + + def bucket_key(self, bucket_str): + """ + Parsing logic for histogram bucket labels to enable correct numerical sorting. + Example input: "bucket_[67.10 ms, 134.21 ms)" + + Returns: + float: The value converted to nanoseconds (ns). + """ + try: + # Regex to capture the first number and its unit (ns|us|ms|s) + match = re.search(r"(\d+\.?\d*)\s*(ns|us|ms|s)", bucket_str) + if not match: + return 0 + + value = float(match.group(1)) + unit = match.group(2).lower() + + # Conversion factors to nanoseconds + factors = {"ns": 1, "us": 1000, "ms": 1000000, "s": 1000000000} + + return value * factors.get(unit, 1) + except Exception: + return 0 + + def report(self, base_csv, curr_csv, output_html): + """ + Loads two CSV files and generates an interactive HTML dashboard. + + Args: + base_csv (str): Path to baseline data. + curr_csv (str): Path to current data. + output_html (str): Path to generate the HTML report. + """ + + df_b = pd.read_csv(base_csv) + single_mode = curr_csv is None or base_csv == curr_csv + df_c = None if single_mode else pd.read_csv(curr_csv) + + # Get unique union of categories present in both datasets + all_dfs = [df_b] if single_mode else [df_b, df_c] + categories = sorted( + list(set().union(*(df.category.unique() for df in all_dfs))) + ) + + # Color mapping to ensure consistent colors for categories across plots + color_sequence = [ + "#636EFA", + "#EF553B", + "#00CC96", + "#AB63FA", + "#FFA15A", + "#19D3F3", + "#FF6692", + "#B6E880", + "#FF97FF", + "#FECB52", + ] + color_map = { + cat: color_sequence[i % len(color_sequence)] + for i, cat in enumerate(categories) + } + + # Build HTML content with CSS for layout + html_parts = ["<html><head><title>IFS Analysis Dashboard</title>"] + col_width = "100%" if single_mode else "49.5%" + html_parts.append( + f"""<style> + body{{font-family:'Segoe UI',sans-serif; background:#f0f2f5; padding:20px; color:#333;}} + .card{{background:white; padding:15px; margin-bottom:20px; border-radius:10px; box-shadow:0 2px 5px rgba(0,0,0,0.05);}} + .row-container{{display:flex; gap:15px; justify-content:space-between;}} + .col-item{{width:{col_width}; min-width:0;}} + .stat-box{{display:flex; gap:10px; margin:5px 0; font-size:0.85em; color:#555;}} + .stat-item{{background:#f1f3f5; padding:4px 8px; border-radius:4px; border-left:3px solid #007bff;}} + .section-header{{margin:30px 0 15px 0; padding-bottom:10px; border-bottom:2px solid #ddd;}} + </style></head><body>""" + ) + + title = "Performance Analysis" if single_mode else "Performance Comparison" + html_parts.append(f"<h2>{title} (CONFIG_IFS)</h2>") + info = ( + f"File: {base_csv}" + if single_mode + else f"Baseline: {base_csv} | Current: {curr_csv}" + ) + html_parts.append(f"<p style='color:#666;'>{info}</p>") + + # --- Part 1: Total Time Trends (Line Charts) --- + html_parts.append("<div class='card'>") + html_parts.append("<h3 style='margin-top:0;'>Total Time Delta (ns) Trend</h3>") + + # Subplots ensure Y-axis can be matched for direct visual comparison + fig_line = make_subplots( + rows=1, + cols=1 if single_mode else 2, + horizontal_spacing=0.05, + subplot_titles=("Latency",) if single_mode else ("Baseline", "Current"), + ) + + plot_configs = ( + [("Data", df_b)] if single_mode else [("Baseline", df_b), ("Current", df_c)] + ) + for i, (name, df) in enumerate(plot_configs, 1): + for cat in categories: + sub = df[ + (df["category"] == cat) & (df["metric_type"] == "total_time_ns") + ].sort_values("timestamp") + if not sub.empty: + y_val = sub["value"].diff().fillna(0) + fig_line.add_trace( + go.Scatter( + x=sub["timestamp"], + y=y_val, + name=f"{cat} ({name})", + legendgroup=cat, + mode="lines+markers", + line=dict(color=color_map[cat], width=2), + marker=dict(color=color_map[cat], size=6), + ), + row=1, + col=i, + ) + + # Sync Y-axes scale for baseline and current plots + if not single_mode: + fig_line.update_yaxes(matches="y", row=1, col=2) + fig_line.update_layout( + height=500, template="plotly_white", margin=dict(t=50, b=20) + ) + html_parts.append(fig_line.to_html(full_html=False, include_plotlyjs="cdn")) + html_parts.append("</div>") + + html_parts.append( + "<h3 class='section-header'>Detailed Latency Distribution</h3>" + ) + + # --- Part 2: Distribution Heatmaps --- + for cat in categories: + + def get_m_and_stats(df): + """Processes raw metrics into a delta-count matrix for heatmap visualization.""" + sub = df[ + (df["category"] == cat) + & (df["metric_type"].str.startswith("bucket_")) + ] + if sub.empty: + return pd.DataFrame(), {} + + # Transform to matrix (Buckets vs Time) + p = sub.pivot( + index="metric_type", columns="timestamp", values="value" + ).sort_index(axis=1) + # Sort Y-axis buckets based on numerical time value + p = p.reindex(sorted(p.index, key=self.bucket_key)) + # Calculate incremental change (delta) + delta = p.diff(axis=1).fillna(0) + return delta, { + "Total": int(delta.values.sum()), + "Peak": int(delta.values.max()), + } + + m_b, stats_b = get_m_and_stats(df_b) + m_c, stats_c = (None, None) if single_mode else get_m_and_stats(df_c) + + # Determine global max for heatmap color scaling consistency + z_vals = [m_b.values.max() if not m_b.empty else 0] + if not single_mode: + z_vals.append(m_c.values.max() if not m_c.empty else 0) + global_max_z = max(z_vals + [1]) + + html_parts.append(f"<div class='card'><h4>Category: {cat.upper()}</h4>") + html_parts.append("<div class='row-container'>") + + configs = ( + [("Data", m_b, stats_b)] + if single_mode + else [("Baseline", m_b, stats_b), ("Current", m_c, stats_c)] + ) + for name, m, stats in configs: + html_parts.append("<div class='col-item'>") + if not m.empty: + # Display summary statistics + html_parts.append("<div class='stat-box'>") + for k, v in stats.items(): + html_parts.append( + f"<div class='stat-item'><b>{k}:</b> {v}</div>" + ) + html_parts.append("</div>") + + # Generate Heatmap + fig = go.Figure( + data=go.Heatmap( + z=m.values, + x=m.columns, + y=m.index, + colorscale="Viridis", + zmin=0, + zmax=global_max_z, + colorbar=dict(title="Count", thickness=10, len=0.7), + ) + ) + fig.update_layout( + height=400, + margin=dict(l=120, r=0, t=10, b=30), + template="plotly_white", + ) + html_parts.append( + fig.to_html(full_html=False, include_plotlyjs="cdn") + ) + else: + html_parts.append( + "<div style='height:100px; display:flex; align-items:center; justify-content:center; background:#fafafa; color:#ccc;'>No Data</div>" + ) + html_parts.append("</div>") + + html_parts.append("</div></div>") # end row-container & card + + # Save the final HTML report + with open(output_html, "w") as f: + f.writelines(html_parts + ["</body></html>"]) + print(f"[+] Comparison report generated: {output_html}") + + +if __name__ == "__main__": + parser = argparse.ArgumentParser() + sub = parser.add_subparsers(dest="mode") + + # Monitor Mode Arguments + p_mon = sub.add_parser("monitor") + p_mon.add_argument( + "-G", "--cgroup", required=True, help="Cgroup name (e.g. 'docker/cid'" + ) + p_mon.add_argument( + "-i", "--interval", type=float, default=1.0, help="Sampling interval (sec)" + ) + p_mon.add_argument( + "-d", "--duration", type=int, default=30, help="Sampling duration (sec)" + ) + p_mon.add_argument("-o", "--output", default="capture.csv") + + # Report Mode Arguments + p_comp = sub.add_parser("report") + p_comp.add_argument("-b", "--base", required=True, help="Baseline CSV file") + p_comp.add_argument( + "-c", "--curr", default=None, help="Current CSV file (optional, for comparison)" + ) + p_comp.add_argument("-o", "--output", default="report.html") + + args = parser.parse_args() + tool = InterferenceTool() + + if args.mode == "monitor": + tool.monitor(args.cgroup, args.interval, args.duration, args.output) + elif args.mode == "report": + tool.report(args.base, args.curr, args.output) + else: + parser.print_help() diff --git a/tools/kspect/ifstool.1 b/tools/kspect/ifstool.1 new file mode 100644 index 000000000000..347d54f36bec --- /dev/null +++ b/tools/kspect/ifstool.1 @@ -0,0 +1,81 @@ +.TH IFSTOOL 1 "March 2026" "Linux" "User Commands" +.SH NAME +ifstool \- Analyze kernel interference statistics (CONFIG_IFS) +.SH SYNOPSIS +.B ifstool monitor +[\fB\-G\fR|\fB\-\-cgroup\fR \fICGROUP_ID\fR] [\fB\-d\fR|\fB\-\-duration\fR \fISEC\fR] [\fB\-i\fR|\fB\-\-interval\fR \fISEC\fR] [\fB\-o\fR|\fB\-\-output\fR \fICSV\fR] +.br +.B ifstool report +[\fB\-b\fR|\fB\-\-base\fR \fICSV\fR] [\fB\-c\fR|\fB\-\-curr\fR \fICSV\fR] [\fB\-o\fR|\fB\-\-output\fR \fIHTML\fR] + +.SH DESCRIPTION +.B IFSTOOL +is a specialized userspace utility designed to facilitate the monitoring and analysis of Interference Statistics (\fBCONFIG_IFS\fR). + +The \fBIFS infrastructure\fR is a kernel-level framework providing critical observability into execution jitter (noise) that disrupts task determinism. It quantifies CPU time stolen by kernel activities such as interrupt handling, softirqs, and lock contention. This telemetry is exposed via the \fBinterference.stat\fR control file within the cgroup hierarchy. + +\fBIFSTOOL\fR interfaces with this file to export raw metrics into structured CSV data and interactive HTML-based distribution reports. + +.SH SETUP +The host environment must meet the following criteria: +.IP \[bu] 2 +\fBKernel:\fR Compiled with \fBCONFIG_IFS=y\fR. +.IP \[bu] 2 +\fBBoot Parameters:\fR \fBcgroup_ifs=1\fR must be added to the kernel command line. +.IP \[bu] 2 +\fBPython Runtime:\fR Python 3.x with \fBpandas\fR and \fBplotly\fR libraries. +.IP \[bu] 2 +\fBCgroup Hierarchy:\fR Either v2 unified or v1 (with the \fBcpu\fR subsystem mounted). + +.SH COMMANDS +.SS monitor +Capture raw interference data from a target cgroup. +.TP +\fB\-G, \-\-cgroup\fR \fICGROUP_ID\fR +Specify the cgroup identifier (e.g., \fIdocker/<cid>\fR or \fIsystem.slice\fR). +.TP +\fB\-d, \-\-duration\fR \fISEC\fR +Total collection time in seconds (default: 30). +.TP +\fB\-i, \-\-interval\fR \fISEC\fR +Sampling interval in seconds; supports floating point (default: 1.0). + +.SS report +Transform captured CSV data into an interactive HTML dashboard. +.TP +\fB\-b, \-\-base\fR \fICSV\fR +Primary capture file for analysis. +.TP +\fB\-c, \-\-curr\fR \fICSV\fR +Optional secondary file for differential (comparison) analysis. + +.SH HTML REPORT STRUCTURE +The generated HTML report provides a multi-dimensional view of kernel noise: +.IP "Total Time Delta Trend" 4 +A time-series line chart illustrating the incremental nanoseconds of interference per category (e.g., irq, spinlock). +.IP "Latency Heatmaps" 4 +A frequency-domain visualization of the kernel's internal histogram: +.RS 8 +.IP "X-axis:" 8 +Wall-clock time of the trace. +.IP "Y-axis:" 8 +Latency magnitude (logarithmic buckets from ns to s). +.IP "Color Intensity:" 8 +Represents the event count (density) of interference within that specific latency window. +.RE + +.SH EXAMPLES +Monitor a Docker container for 10 seconds: +.IP +.B $ ifstool monitor \-\-cgroup docker/<cid> \-\-duration 10 \-\-interval 1 +.PP +Generate a single-session deep dive: +.IP +.B $ ifstool report \-\-base capture.csv +.PP +Generate a differential report between two traces: +.IP +.B $ ifstool report \-\-base baseline.csv \-\-curr current.csv + +.SH AUTHOR +Tengda Wu <wutengda2(a)huawei.com> \ No newline at end of file diff --git a/tools/kspect/requirements.txt b/tools/kspect/requirements.txt new file mode 100644 index 000000000000..8e5e376a0e9a --- /dev/null +++ b/tools/kspect/requirements.txt @@ -0,0 +1,2 @@ +pandas==3.* +plotly==6.* -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] [Huawei] PCI: Fix AB-BA deadlock between aer_isr() and device_shutdown()
by Hongtao Zhang 09 Mar '26

09 Mar '26

From: Ziming Du <duziming2(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: 190803 -------------------------------- During system shutdown, a deadlock may occur between AER recovery process and device shutdown as follows: The device_shutdown path holds the device_lock throughout the entire process and waits for the irq handlers to complete when release nodes: device_shutdown device_lock # A hold device_lock pci_device_shutdown pcie_port_device_remove remove_iter device_unregister device_del bus_remove_device device_release_driver devres_release_all release_nodes # B wait for irq handlers The aer_isr path will acquire device_lock in pci_bus_reset(): aer_isr # B execute irq process aer_isr_one_error aer_process_err_devices handle_error_source pcie_do_recovery aer_root_reset pci_bus_error_reset pci_bus_reset # A acquire device_lock The circular dependency causes system hang. Fix it by using pci_bus_trylock() instead of pci_bus_lock() in pci_bus_reset(). When the lock is unavailable, return -EAGAIN, as in similar cases. Fixes: c4eed62a2143 ("PCI/ERR: Use slot reset if available") Signed-off-by: Ziming Du <duziming2(a)huawei.com> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/pci/pci.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index b93605616d4e4..d1a8531df0271 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5309,15 +5309,21 @@ static int pci_bus_reset(struct pci_bus *bus, int probe) if (probe) return 0; - pci_bus_lock(bus); + /* + * Replace blocking lock with trylock to prevent deadlock during bus reset. + * Same as above except return -EAGAIN if the bus cannot be locked. + */ + if (pci_bus_trylock(bus)) { + might_sleep(); - might_sleep(); + ret = pci_bridge_secondary_bus_reset(bus->self); - ret = pci_bridge_secondary_bus_reset(bus->self); + pci_bus_unlock(bus); - pci_bus_unlock(bus); + return ret; + } - return ret; + return -EAGAIN; } /** -- 2.43.0

2 1

[PATCH OLK-6.6 0/4] fixup CVE-2025-39981
by Jiacheng Yu 09 Mar '26

09 Mar '26

CVE-2025-39981 Jianpeng Chang (1): Bluetooth: MGMT: Fix memory leak in set_ssp_complete Luiz Augusto von Dentz (1): Bluetooth: MGMT: Fix possible UAFs Pauli Virtanen (1): Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete Roman Smirnov (1): Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() include/net/bluetooth/mgmt.h | 2 +- net/bluetooth/mgmt.c | 263 +++++++++++++++++++++++++---------- net/bluetooth/mgmt_util.c | 46 ++++++ net/bluetooth/mgmt_util.h | 3 + 4 files changed, 237 insertions(+), 77 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6] net: yt6801: add link info for yt6801
by Frank_Sae 09 Mar '26

09 Mar '26

yt6801 inclusion category: bugfix bugzilla: https://https://atomgit.com/openeuler/kernel/issues/7229 -------------------------------------------------------------------- add link info for yt6801 to fix that the link info is not update on os installation. Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com> --- .../ethernet/motorcomm/yt6801/yt6801_main.c | 90 +++++++++++++++++++ 1 file changed, 90 insertions(+) diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c index 01eed3ace..cb54329ef 100644 --- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c +++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c @@ -27,6 +27,95 @@ const struct net_device_ops *fxgmac_get_netdev_ops(void); static void fxgmac_napi_enable(struct fxgmac_pdata *priv); +const struct ethtool_ops *fxgmac_get_ethtool_ops(void); + +#define MII_SPEC_STATUS 0x11 /* PHY specific status */ +#define FXGMAC_EPHY_LINK_STATUS BIT(10) +#define PHY_MII_SPEC_DUPLEX BIT(13) + +static int fxgmac_get_link_ksettings(struct net_device *netdev, + struct ethtool_link_ksettings *cmd) +{ + struct fxgmac_pdata *pdata = netdev_priv(netdev); + struct phy_device *phydev = netdev->phydev; + u32 duplex, regval, link_status; + u32 adv = 0xFFFFFFFF; + + ethtool_link_ksettings_zero_link_mode(cmd, supported); + ethtool_link_ksettings_zero_link_mode(cmd, advertising); + + /* set the supported link speeds */ + ethtool_link_ksettings_add_link_mode(cmd, supported, 1000baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 100baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 100baseT_Half); + ethtool_link_ksettings_add_link_mode(cmd, supported, 10baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 10baseT_Half); + + /* Indicate pause support */ + ethtool_link_ksettings_add_link_mode(cmd, supported, Pause); + ethtool_link_ksettings_add_link_mode(cmd, supported, Asym_Pause); + + regval = phy_read(phydev, MII_ADVERTISE); + + if (field_get(ADVERTISE_PAUSE_CAP, regval)) + ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); + + if (field_get(ADVERTISE_PAUSE_ASYM, regval)) + ethtool_link_ksettings_add_link_mode(cmd, advertising, Asym_Pause); + + ethtool_link_ksettings_add_link_mode(cmd, supported, MII); + cmd->base.port = PORT_MII; + + ethtool_link_ksettings_add_link_mode(cmd, supported, Autoneg); + regval = phy_read(phydev, MII_BMCR); + + regval = field_get(BMCR_ANENABLE, regval); + if (regval) { + ethtool_link_ksettings_add_link_mode(cmd, advertising, Autoneg); + + regval = phy_read(phydev, MII_ADVERTISE); + + if (adv & ADVERTISE_10HALF) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half); + if (adv & ADVERTISE_10FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full); + if (adv & ADVERTISE_100HALF) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half); + if (adv & ADVERTISE_100FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full); + + adv = phy_read(phydev, MII_CTRL1000); + + if (adv & ADVERTISE_1000FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full); + } + + cmd->base.autoneg = 1; + + regval = phy_read(phydev, MII_SPEC_STATUS); + + link_status = field_get(FXGMAC_EPHY_LINK_STATUS, regval); + if (link_status) { + duplex = field_get(PHY_MII_SPEC_DUPLEX, regval); + cmd->base.duplex = duplex; + cmd->base.speed = pdata->mac_speed; + } else { + cmd->base.duplex = DUPLEX_UNKNOWN; + cmd->base.speed = SPEED_UNKNOWN; + } + + return 0; +} + +static const struct ethtool_ops fxgmac_ethtool_ops = { + .get_link = ethtool_op_get_link, + .get_link_ksettings = fxgmac_get_link_ksettings, +}; + +const struct ethtool_ops *fxgmac_get_ethtool_ops(void) +{ + return &fxgmac_ethtool_ops; +} #define PHY_WR_CONFIG(reg_offset) (0x8000205 + ((reg_offset) * 0x10000)) static int fxgmac_phy_write_reg(struct fxgmac_pdata *priv, u32 reg_id, u32 data) @@ -1899,6 +1988,7 @@ static int fxgmac_init(struct fxgmac_pdata *priv, bool save_private_reg) FXGMAC_JUMBO_PACKET_MTU + (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN); ndev->netdev_ops = fxgmac_get_netdev_ops();/* Set device operations */ + ndev->ethtool_ops = fxgmac_get_ethtool_ops();/* Set device operations */ /* Set device features */ if (priv->hw_feat.tso) { -- 2.34.1

2 1

[PATCH OLK-5.10] ksmbd: fix use-after-free in kerberos authentication
by Yongjian Sun 09 Mar '26

09 Mar '26

From: Sean Heelan <seanheelan(a)gmail.com> mainline inclusion from mainline-v6.15-rc5 commit e86e9134e1d1c90a960dd57f59ce574d27b9a124 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/10609 CVE: CVE-2025-37778 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user. However, it is possible another thread could be operating on the session and make use of sess->user after it has been passed to ksmbd_free_user but before sess->user is set to NULL. Cc: stable(a)vger.kernel.org Signed-off-by: Sean Heelan <seanheelan(a)gmail.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c fs/smb/server/auth.c fs/ksmbd/auth.c [mainline commit 38c8a9a52082 changed the file name] [mainline commit 1e440d5b25b7 still has issues] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ksmbd/auth.c | 14 +++++++++++++- fs/ksmbd/smb2pdu.c | 3 --- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/fs/ksmbd/auth.c b/fs/ksmbd/auth.c index d8dabd19823f..c5916064b85e 100644 --- a/fs/ksmbd/auth.c +++ b/fs/ksmbd/auth.c @@ -514,7 +514,19 @@ int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob, retval = -ENOMEM; goto out; } - sess->user = user; + + if (!sess->user) { + /* First successful authentication */ + sess->user = user; + } else { + if (!ksmbd_compare_user(sess->user, user)) { + ksmbd_debug(AUTH, "different user tried to reuse session\n"); + retval = -EPERM; + ksmbd_free_user(user); + goto out; + } + ksmbd_free_user(user); + } memcpy(sess->sess_key, resp->payload, resp->session_key_len); memcpy(out_blob, resp->payload + resp->session_key_len, diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 13f2a81d3621..1588867b4e71 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -1612,9 +1612,6 @@ static int krb5_authenticate(struct ksmbd_work *work, if (prev_sess_id && prev_sess_id != sess->id) destroy_previous_session(conn, sess->user, prev_sess_id); - if (sess->state == SMB2_SESSION_VALID) - ksmbd_free_user(sess->user); - retval = ksmbd_krb5_authenticate(sess, in_blob, in_len, out_blob, &out_len); if (retval) { -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] PCI: Fix pci_slot_trylock() error handling
by Ziming Du 09 Mar '26

09 Mar '26

From: Jinhui Guo <guojinhui.liam(a)bytedance.com> mainline inclusion from mainline-v7.0-rc1 commit 9368d1ee62829b08aa31836b3ca003803caf0b72 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8599 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in pci_slot_trylock(), but it forgets to remove the corresponding pci_dev_unlock() when pci_bus_trylock() fails. Before a4e772898f8b, the code did: if (!pci_dev_trylock(dev)) /* <- lock bridge device */ goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); /* <- unlock bridge device */ goto unlock; } } After a4e772898f8b the bridge-device lock is no longer taken, but the pci_dev_unlock(dev) on the failure path was left in place, leading to the bug. This yields one of two errors: 1. A warning that the lock is being unlocked when no one holds it. 2. An incorrect unlock of a lock that belongs to another thread. Fix it by removing the now-redundant pci_dev_unlock(dev) on the failure path. [Same patch later posted by Keith at https://patch.msgid.link/20260116184150.3013258-1-kbusch@meta.com] Fixes: a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") Signed-off-by: Jinhui Guo <guojinhui.liam(a)bytedance.com> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Dan Williams <dan.j.williams(a)intel.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20251212145528.2555-1-guojinhui.liam@bytedance.com Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/pci/pci.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index b93605616d4e4..fbef3c37f37fa 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5144,10 +5144,8 @@ static int pci_slot_trylock(struct pci_slot *slot) if (!dev->slot || dev->slot != slot) continue; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } } else if (!pci_dev_trylock(dev)) goto unlock; } -- 2.43.0

2 1

[PATCH OLK-5.10] [Backport] sched/rt: Skip currently executing CPU in rto_next_cpu()
by Chen Jinghuang 09 Mar '26

09 Mar '26

mainline inclusion from mainline-v7.0-rc1 commit 94894c9c477e53bcea052e075c53f89df3d2a33e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8689 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- CPU0 becomes overloaded when hosting a CPU-bound RT task, a non-CPU-bound RT task, and a CFS task stuck in kernel space. When other CPUs switch from RT to non-RT tasks, RT load balancing (LB) is triggered; with HAVE_RT_PUSH_IPI enabled, they send IPIs to CPU0 to drive the execution of rto_push_irq_work_func. During push_rt_task on CPU0, if next_task->prio < rq->donor->prio, resched_curr() sets NEED_RESCHED and after the push operation completes, CPU0 calls rto_next_cpu(). Since only CPU0 is overloaded in this scenario, rto_next_cpu() should ideally return -1 (no further IPI needed). However, multiple CPUs invoking tell_cpu_to_push() during LB increments rd->rto_loop_next. Even when rd->rto_cpu is set to -1, the mismatch between rd->rto_loop and rd->rto_loop_next forces rto_next_cpu() to restart its search from -1. With CPU0 remaining overloaded (satisfying rt_nr_migratory && rt_nr_total > 1), it gets reselected, causing CPU0 to queue irq_work to itself and send self-IPIs repeatedly. As long as CPU0 stays overloaded and other CPUs run pull_rt_tasks(), it falls into an infinite self-IPI loop, which triggers a CPU hardlockup due to continuous self-interrupts. The trigging scenario is as follows: cpu0 cpu1 cpu2 pull_rt_task tell_cpu_to_push <------------irq_work_queue_on rto_push_irq_work_func push_rt_task resched_curr(rq) pull_rt_task rto_next_cpu tell_cpu_to_push <-------------------------- atomic_inc(rto_loop_next) rd->rto_loop != next rto_next_cpu irq_work_queue_on rto_push_irq_work_func Fix redundant self-IPI by filtering the initiating CPU in rto_next_cpu(). This solution has been verified to effectively eliminate spurious self-IPIs and prevent CPU hardlockup scenarios. Fixes: 4bdced5c9a29 ("sched/rt: Simplify the IPI based RT balancing logic") Suggested-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Suggested-by: K Prateek Nayak <kprateek.nayak(a)amd.com> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Reviewed-by: Valentin Schneider <vschneid(a)redhat.com> Link: https://patch.msgid.link/20260122012533.673768-1-chenjinghuang2@huawei.com Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/rt.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index ddbc857a28b8..dbc3a40a68fa 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -2013,6 +2013,7 @@ static void push_rt_tasks(struct rq *rq) */ static int rto_next_cpu(struct root_domain *rd) { + int this_cpu = smp_processor_id(); int next; int cpu; @@ -2036,6 +2037,10 @@ static int rto_next_cpu(struct root_domain *rd) rd->rto_cpu = cpu; + /* Do not send IPI to self */ + if (cpu == this_cpu) + continue; + if (cpu < nr_cpu_ids) return cpu; -- 2.34.1

2 1

[PATCH OLK-6.6] arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc()
by Zeng Heng 09 Mar '26

09 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8686 ------------------ resctrl_arch_mon_ctx_alloc() triggers a scheduling state warning when calling kmalloc() while the task is in a non-running state: do not call blocking ops when !TASK_RUNNING; state=1 set at prepare_to_wait WARNING: CPU: 78 PID: 12592 at kernel/sched/core.c:10584 _might_sleep Call trace: _might_sleep+0x1cc/0xf8 _kmalloc_cache_alloc_node+0x3a0/0x4e0 kmalloc_trace+0x44/0x120 resctrl_arch_mon_ctx_alloc+0xf0/0x178 mon_event_read+0xa0/0x308 mkdir_mondata_subdir+0x24c/0x330 mkdir_mondata_all+0x17c/0x248 rdt_get_tree+0x2e8/0x680 vfs_get_tree+0x5c/0x190 do_new_mount+0x27c/0x408 path_mount+0x2ac/0x448 arm64_sys_mount+0x1d4/0x228 Refactor the call sequence in resctrl_arch_mon_ctx_alloc() and ensure the allocation is performed in TASK_RUNNING state to avoid schedule state corrupted. Fixes: 9119da143939 ("arm_mpam: resctrl: Allow resctrl to allocate monitors") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_resctrl.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/drivers/platform/mpam/mpam_resctrl.c b/drivers/platform/mpam/mpam_resctrl.c index 9950cc4eebf4..a33957651732 100644 --- a/drivers/platform/mpam/mpam_resctrl.c +++ b/drivers/platform/mpam/mpam_resctrl.c @@ -388,32 +388,30 @@ struct rdt_resource *resctrl_arch_get_resource(enum resctrl_res_level l) return &mpam_resctrl_exports[l].resctrl_res; } -static void *resctrl_arch_mon_ctx_alloc_no_wait(struct rdt_resource *r, - int evtid) +static u32 resctrl_arch_mon_ctx_alloc_no_wait(struct rdt_resource *r, + int evtid) { - u32 *ret = kmalloc(sizeof(*ret), GFP_KERNEL); - - if (!ret) - return ERR_PTR(-ENOMEM); - - *ret = __mon_is_rmid_idx; - return ret; + return __mon_is_rmid_idx; } void *resctrl_arch_mon_ctx_alloc(struct rdt_resource *r, int evtid) { DEFINE_WAIT(wait); - void *ret; + u32 *ret; + + ret = kmalloc(sizeof(*ret), GFP_KERNEL); + if (!ret) + return ERR_PTR(-ENOMEM); might_sleep(); do { prepare_to_wait(&resctrl_mon_ctx_waiters, &wait, TASK_INTERRUPTIBLE); - ret = resctrl_arch_mon_ctx_alloc_no_wait(r, evtid); - if (PTR_ERR(ret) == -ENOSPC) + *ret = resctrl_arch_mon_ctx_alloc_no_wait(r, evtid); + if (*ret == -ENOSPC) schedule(); - } while (PTR_ERR(ret) == -ENOSPC && !signal_pending(current)); + } while (*ret == -ENOSPC && !signal_pending(current)); finish_wait(&resctrl_mon_ctx_waiters, &wait); return ret; -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] Fix TLBI broadcast optimization loss and incorrect dvmbm handling
by Tian Zheng 09 Mar '26

09 Mar '26

Fix 1 In the TLBI broadcast-optimization feature, the SYS_LSUDVM_CTRL_EL2 register controls whether the feature is enabled. When LPI low-power mode is enabled, this register is cleared as the pCPU powers down into LPI mode, causing the TLBI broadcast optimization to stop working. The fix saves and restores this control register in the callbacks for entering and exiting LPI mode. Fix 2 The current TLBI broadcast-optimization logic only supports normal VMs. If the feature is enabled globally, VMs that are not yet adapted for it, such as CCA will use an incorrect TLBI broadcast bitmap, which can cause a panic in CCA VMs. The fix moves the actual enable/disable of the dvmbm functionality into the vcpu load and vcpu put functions. Tian Zheng (2): KVM: arm64: Fix TLBI optimization broken in LPI mode KVM: arm64: Fix CCA guest panic when dvmbm is enabled arch/arm64/kvm/arm.c | 6 ++++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 8 +++----- arch/arm64/kvm/hisilicon/hisi_virt.h | 19 +++++++++++++++++++ 3 files changed, 28 insertions(+), 5 deletions(-) -- 2.33.0

1 2

[PATCH OLK-5.10] SUNRPC: Ensure the transport backchannel association
by Dong Chenchen 09 Mar '26

09 Mar '26

From: Benjamin Coddington <bcodding(a)redhat.com> mainline inclusion from mainline-v5.12-rc6 commit 98b5cee37389b899de044bc4aac56e6ff33dbd4d category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8655 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the server sends CB_ calls on a connection that is not associated with the backchannel, refuse to process the call and shut down the connection. This avoids a NULL dereference crash in xprt_complete_bc_request(). There's not much more we can do in this situation unless we want to look into allowing all connections to be associated with the fore and back channel. Signed-off-by: Benjamin Coddington <bcodding(a)redhat.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sunrpc/xprtsock.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c index 1ef469ddea89..a6580946ab69 100644 --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -558,6 +558,10 @@ xs_read_stream_call(struct sock_xprt *transport, struct msghdr *msg, int flags) struct rpc_rqst *req; ssize_t ret; + /* Is this transport associated with the backchannel? */ + if (!xprt->bc_serv) + return -ESHUTDOWN; + /* Look up and lock the request corresponding to the given XID */ req = xprt_lookup_bc_request(xprt, transport->recv.xid); if (!req) { -- 2.25.1

2 1

[PATCH OLK-5.10] [Backport] procfs: fix missing RCU protection when reading real_parent in do_task_stat()
by Chen Jinghuang 09 Mar '26

09 Mar '26

From: Jinliang Zheng <alexjlzheng(a)tencent.com> stable inclusion from stable-v5.10.252 commit fefa0fcd78be465b7ad4c497fa6ec90d64194c04 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8688 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 76149d53502cf17ef3ae454ff384551236fba867 ] When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent. Link: https://lkml.kernel.org/r/20260128083007.3173016-1-alexjlzheng@tencent.com Fixes: 06fffb1267c9 ("do_task_stat: don't take rcu_read_lock()") Signed-off-by: Jinliang Zheng <alexjlzheng(a)tencent.com> Acked-by: Oleg Nesterov <oleg(a)redhat.com> Cc: David Hildenbrand <david(a)kernel.org> Cc: Ingo Molnar <mingo(a)kernel.org> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Mateusz Guzik <mjguzik(a)gmail.com> Cc: ruippan <ruippan(a)tencent.com> Cc: Usama Arif <usamaarif642(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/proc/array.c [context conflict] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- fs/proc/array.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/proc/array.c b/fs/proc/array.c index d5fed9281863..6bb4c81ba66e 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -510,7 +510,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, } sid = task_session_nr_ns(task, ns); - ppid = task_tgid_nr_ns(task->real_parent, ns); + ppid = task_ppid_nr_ns(task, ns); pgid = task_pgrp_nr_ns(task, ns); unlock_task_sighand(task, &flags); -- 2.34.1

2 1

[PATCH OLK-6.6] [Backport] procfs: fix missing RCU protection when reading real_parent in do_task_stat()
by Chen Jinghuang 09 Mar '26

09 Mar '26

From: Jinliang Zheng <alexjlzheng(a)tencent.com> stable inclusion from stable-v6.6.128 commit 0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8688 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 76149d53502cf17ef3ae454ff384551236fba867 ] When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent. Link: https://lkml.kernel.org/r/20260128083007.3173016-1-alexjlzheng@tencent.com Fixes: 06fffb1267c9 ("do_task_stat: don't take rcu_read_lock()") Signed-off-by: Jinliang Zheng <alexjlzheng(a)tencent.com> Acked-by: Oleg Nesterov <oleg(a)redhat.com> Cc: David Hildenbrand <david(a)kernel.org> Cc: Ingo Molnar <mingo(a)kernel.org> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Mateusz Guzik <mjguzik(a)gmail.com> Cc: ruippan <ruippan(a)tencent.com> Cc: Usama Arif <usamaarif642(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/proc/array.c [Context Conflicts] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- fs/proc/array.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/proc/array.c b/fs/proc/array.c index 6a4b0a850dce..288f19956e04 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -544,7 +544,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, } sid = task_session_nr_ns(task, ns); - ppid = task_tgid_nr_ns(task->real_parent, ns); + ppid = task_ppid_nr_ns(task, ns); pgid = task_pgrp_nr_ns(task, ns); unlock_task_sighand(task, &flags); -- 2.34.1

2 1

[PATCH OLK-6.6] [Backport] sched/rt: Skip currently executing CPU in rto_next_cpu()
by Chen Jinghuang 09 Mar '26

09 Mar '26

mainline inclusion from mainline-v7.0-rc1 commit 94894c9c477e53bcea052e075c53f89df3d2a33e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8689 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 94894c9c477e53bcea052e075c53f89df3d2a33e ] CPU0 becomes overloaded when hosting a CPU-bound RT task, a non-CPU-bound RT task, and a CFS task stuck in kernel space. When other CPUs switch from RT to non-RT tasks, RT load balancing (LB) is triggered; with HAVE_RT_PUSH_IPI enabled, they send IPIs to CPU0 to drive the execution of rto_push_irq_work_func. During push_rt_task on CPU0, if next_task->prio < rq->donor->prio, resched_curr() sets NEED_RESCHED and after the push operation completes, CPU0 calls rto_next_cpu(). Since only CPU0 is overloaded in this scenario, rto_next_cpu() should ideally return -1 (no further IPI needed). However, multiple CPUs invoking tell_cpu_to_push() during LB increments rd->rto_loop_next. Even when rd->rto_cpu is set to -1, the mismatch between rd->rto_loop and rd->rto_loop_next forces rto_next_cpu() to restart its search from -1. With CPU0 remaining overloaded (satisfying rt_nr_migratory && rt_nr_total > 1), it gets reselected, causing CPU0 to queue irq_work to itself and send self-IPIs repeatedly. As long as CPU0 stays overloaded and other CPUs run pull_rt_tasks(), it falls into an infinite self-IPI loop, which triggers a CPU hardlockup due to continuous self-interrupts. The trigging scenario is as follows: cpu0 cpu1 cpu2 pull_rt_task tell_cpu_to_push <------------irq_work_queue_on rto_push_irq_work_func push_rt_task resched_curr(rq) pull_rt_task rto_next_cpu tell_cpu_to_push <-------------------------- atomic_inc(rto_loop_next) rd->rto_loop != next rto_next_cpu irq_work_queue_on rto_push_irq_work_func Fix redundant self-IPI by filtering the initiating CPU in rto_next_cpu(). This solution has been verified to effectively eliminate spurious self-IPIs and prevent CPU hardlockup scenarios. Fixes: 4bdced5c9a29 ("sched/rt: Simplify the IPI based RT balancing logic") Suggested-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Suggested-by: K Prateek Nayak <kprateek.nayak(a)amd.com> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Reviewed-by: Valentin Schneider <vschneid(a)redhat.com> Link: https://patch.msgid.link/20260122012533.673768-1-chenjinghuang2@huawei.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/rt.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index 549b9ecfda7d..48d53bf0161b 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -2231,6 +2231,7 @@ static void push_rt_tasks(struct rq *rq) */ static int rto_next_cpu(struct root_domain *rd) { + int this_cpu = smp_processor_id(); int next; int cpu; @@ -2254,6 +2255,10 @@ static int rto_next_cpu(struct root_domain *rd) rd->rto_cpu = cpu; + /* Do not send IPI to self */ + if (cpu == this_cpu) + continue; + if (cpu < nr_cpu_ids) return cpu; -- 2.34.1

2 1

[PATCH OLK-6.6] [Backport] procfs: fix missing RCU protection when reading real_parent in do_task_stat()
by Chen Jinghuang 09 Mar '26

09 Mar '26

From: Jinliang Zheng <alexjlzheng(a)tencent.com> stable inclusion from stable-v6.6.128 commit 0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8688 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 76149d53502cf17ef3ae454ff384551236fba867 ] When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent. Link: https://lkml.kernel.org/r/20260128083007.3173016-1-alexjlzheng@tencent.com Fixes: 06fffb1267c9 ("do_task_stat: don't take rcu_read_lock()") Signed-off-by: Jinliang Zheng <alexjlzheng(a)tencent.com> Acked-by: Oleg Nesterov <oleg(a)redhat.com> Cc: David Hildenbrand <david(a)kernel.org> Cc: Ingo Molnar <mingo(a)kernel.org> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Mateusz Guzik <mjguzik(a)gmail.com> Cc: ruippan <ruippan(a)tencent.com> Cc: Usama Arif <usamaarif642(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- fs/proc/array.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/proc/array.c b/fs/proc/array.c index 6a4b0a850dce..288f19956e04 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -544,7 +544,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, } sid = task_session_nr_ns(task, ns); - ppid = task_tgid_nr_ns(task->real_parent, ns); + ppid = task_ppid_nr_ns(task, ns); pgid = task_pgrp_nr_ns(task, ns); unlock_task_sighand(task, &flags); -- 2.34.1

2 1

[PATCH OLK-6.6] [Backport] procfs: fix missing RCU protection when reading real_parent in do_task_stat()
by Chen Jinghuang 09 Mar '26

09 Mar '26

From: Jinliang Zheng <alexjlzheng(a)tencent.com> stable inclusion from stable-v6.6.128 commit 0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e category: bugfix bugzilla: AR.SR.IR20250327002298.006.012 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 76149d53502cf17ef3ae454ff384551236fba867 ] When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent. Link: https://lkml.kernel.org/r/20260128083007.3173016-1-alexjlzheng@tencent.com Fixes: 06fffb1267c9 ("do_task_stat: don't take rcu_read_lock()") Signed-off-by: Jinliang Zheng <alexjlzheng(a)tencent.com> Acked-by: Oleg Nesterov <oleg(a)redhat.com> Cc: David Hildenbrand <david(a)kernel.org> Cc: Ingo Molnar <mingo(a)kernel.org> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Mateusz Guzik <mjguzik(a)gmail.com> Cc: ruippan <ruippan(a)tencent.com> Cc: Usama Arif <usamaarif642(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- fs/proc/array.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/proc/array.c b/fs/proc/array.c index 6a4b0a850dce..288f19956e04 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -544,7 +544,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, } sid = task_session_nr_ns(task, ns); - ppid = task_tgid_nr_ns(task->real_parent, ns); + ppid = task_ppid_nr_ns(task, ns); pgid = task_pgrp_nr_ns(task, ns); unlock_task_sighand(task, &flags); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-57979
by Wang Hai 09 Mar '26

09 Mar '26

Calvin Owens (1): [Backport] pps: Fix a use-after-free Wang Hai (1): pps: Fix a use-after-free - fix kabi drivers/pps/clients/pps-gpio.c | 4 +- drivers/pps/clients/pps-ktimer.c | 4 +- drivers/pps/clients/pps-ldisc.c | 2 +- drivers/pps/kapi.c | 2 +- drivers/pps/pps.c | 84 +++++++++++++++++--------------- 5 files changed, 51 insertions(+), 45 deletions(-) -- 2.17.1

2 3