Kernel
Threads by month
- ----- 2026 -----
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2025 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- 16 participants
- 25354 discussions
[PATCH OLK-6.6] dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()
by Zhang Yuwei 07 May '26
by Zhang Yuwei 07 May '26
07 May '26
From: Tuo Li <islituo(a)gmail.com>
mainline inclusion
from mainline-v7.0-rc6
commit e1c9866173c5f8521f2d0768547a01508cb9ff27
category: bugfix
bugzilla: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
At the end of this function, d is the traversal cursor of flist, but the
code completes found instead. This can lead to issues such as NULL pointer
dereferences, double completion, or descriptor leaks.
Fix this by completing d instead of found in the final
list_for_each_entry_safe() loop.
Fixes: aa8d18becc0c ("dmaengine: idxd: add callback support for iaa crypto")
Signed-off-by: Tuo Li <islituo(a)gmail.com>
Reviewed-by: Dave Jiang <dave.jiang(a)intel.com>
Link: https://patch.msgid.link/20260106032428.162445-1-islituo@gmail.com
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
Conflicts:
drivers/dma/idxd/submit.c
[Context Conflicts]
Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com>
---
drivers/dma/idxd/submit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/idxd/submit.c b/drivers/dma/idxd/submit.c
index 817a564413b0..111e9dd8ebda 100644
--- a/drivers/dma/idxd/submit.c
+++ b/drivers/dma/idxd/submit.c
@@ -138,7 +138,7 @@ static void llist_abort_desc(struct idxd_wq *wq, struct idxd_irq_entry *ie,
*/
list_for_each_entry_safe(d, t, &flist, list) {
list_del_init(&d->list);
- idxd_dma_complete_txd(found, IDXD_COMPLETE_ABORT, true,
+ idxd_dma_complete_txd(d, IDXD_COMPLETE_ABORT, true,
NULL, NULL);
}
}
--
2.22.0
2
1
07 May '26
support mempool and NUMA.remote for 64KB page.
Jinjiang Tu (2):
mm/pfn_range_alloc: add support for CONFIG_ARM64_64K_PAGES
mm/numa_remote: remove depends on ARM64_4K_PAGES
arch/arm64/mm/Kconfig | 1 +
arch/arm64/mm/pfn_range_alloc.c | 31 ++++++++++++++++++++++++-------
drivers/base/Kconfig | 2 +-
3 files changed, 26 insertions(+), 8 deletions(-)
--
2.43.0
2
3
[PATCH OLK-6.6] PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
by Hongtao Zhang 06 May '26
by Hongtao Zhang 06 May '26
06 May '26
From: Koichiro Den <den(a)valinux.co.jp>
stable inclusion
from stable-v6.12.83
commit 6773cc24c004930903a57761132c1e7728907f8f
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14339
CVE: CVE-2026-31595
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit d799984233a50abd2667a7d17a9a710a3f10ebe2 upstream.
Disable the delayed work before clearing BAR mappings and doorbells to
avoid running the handler after resources have been torn down.
Unable to handle kernel paging request at virtual address ffff800083f46004
[...]
Internal error: Oops: 0000000096000007 [#1] SMP
[...]
Call trace:
epf_ntb_cmd_handler+0x54/0x200 [pci_epf_vntb] (P)
process_one_work+0x154/0x3b0
worker_thread+0x2c8/0x400
kthread+0x148/0x210
ret_from_fork+0x10/0x20
Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP")
Signed-off-by: Koichiro Den <den(a)valinux.co.jp>
Signed-off-by: Manivannan Sadhasivam <mani(a)kernel.org>
Reviewed-by: Frank Li <Frank.Li(a)nxp.com>
Cc: stable(a)vger.kernel.org
Link: https://patch.msgid.link/20260226084142.2226875-4-den@valinux.co.jp
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com>
---
drivers/pci/endpoint/functions/pci-epf-vntb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
index 33c3f9b980e68..990c27a2cd8d7 100644
--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
+++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
@@ -810,6 +810,7 @@ static int epf_ntb_epc_init(struct epf_ntb *ntb)
*/
static void epf_ntb_epc_cleanup(struct epf_ntb *ntb)
{
+ disable_delayed_work_sync(&ntb->cmd_handler);
epf_ntb_mw_bar_clear(ntb, ntb->num_mws);
epf_ntb_db_bar_clear(ntb);
epf_ntb_config_sspad_bar_clear(ntb);
--
2.43.0
2
1
From: Juergen Gross <jgross(a)suse.com>
stable inclusion
from stable-v6.6.137
commit 402d84ad9e89bd4cbfd07ca8598532b7021daf95
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14442
CVE: CVE-2026-31787
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 24daca4fc07f3ff8cd0e3f629cd982187f48436a upstream.
privcmd_vm_ops defines .close (privcmd_close), but neither .may_split
nor .open. When userspace does a partial munmap() on a privcmd mapping,
the kernel splits the VMA via __split_vma(). Since may_split is NULL,
the split is allowed. vm_area_dup() copies vm_private_data (a pages
array allocated in alloc_empty_pages()) into the new VMA without any
fixup, because there is no .open callback.
Both VMAs now point to the same pages array. When the unmapped portion
is closed, privcmd_close() calls:
- xen_unmap_domain_gfn_range()
- xen_free_unpopulated_pages()
- kvfree(pages)
The surviving VMA still holds the dangling pointer. When it is later
destroyed, the same sequence runs again, which leads to a double free.
Fix this issue by adding a .may_split callback denying the VMA split.
This is XSA-487 / CVE-2026-31787
Fixes: d71f513985c2 ("xen: privcmd: support autotranslated physmap guests.")
Reported-by: Atharva Vartak <atharva.a.vartak(a)gmail.com>
Suggested-by: Atharva Vartak <atharva.a.vartak(a)gmail.com>
Signed-off-by: Juergen Gross <jgross(a)suse.com>
Reviewed-by: Jan Beulich <jbeulich(a)suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com>
---
drivers/xen/privcmd.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 74d6a2bd6d04..5049182ec9e9 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -1211,6 +1211,12 @@ static void privcmd_close(struct vm_area_struct *vma)
kvfree(pages);
}
+static int privcmd_may_split(struct vm_area_struct *area, unsigned long addr)
+{
+ /* Forbid splitting, avoids double free via privcmd_close(). */
+ return -EINVAL;
+}
+
static vm_fault_t privcmd_fault(struct vm_fault *vmf)
{
printk(KERN_DEBUG "privcmd_fault: vma=%p %lx-%lx, pgoff=%lx, uv=%p\n",
@@ -1222,6 +1228,7 @@ static vm_fault_t privcmd_fault(struct vm_fault *vmf)
static const struct vm_operations_struct privcmd_vm_ops = {
.close = privcmd_close,
+ .may_split = privcmd_may_split,
.fault = privcmd_fault
};
--
2.43.0
2
1
06 May '26
From: Juergen Gross <jgross(a)suse.com>
stable inclusion
from stable-v5.10.254
commit dbf862ce9f009128ab86b234d91413a3e450beb4
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14442
CVE: CVE-2026-31787
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 24daca4fc07f3ff8cd0e3f629cd982187f48436a upstream.
privcmd_vm_ops defines .close (privcmd_close), but neither .may_split
nor .open. When userspace does a partial munmap() on a privcmd mapping,
the kernel splits the VMA via __split_vma(). Since may_split is NULL,
the split is allowed. vm_area_dup() copies vm_private_data (a pages
array allocated in alloc_empty_pages()) into the new VMA without any
fixup, because there is no .open callback.
Both VMAs now point to the same pages array. When the unmapped portion
is closed, privcmd_close() calls:
- xen_unmap_domain_gfn_range()
- xen_free_unpopulated_pages()
- kvfree(pages)
The surviving VMA still holds the dangling pointer. When it is later
destroyed, the same sequence runs again, which leads to a double free.
Fix this issue by adding a .may_split callback denying the VMA split.
This is XSA-487 / CVE-2026-31787
Fixes: d71f513985c2 ("xen: privcmd: support autotranslated physmap guests.")
Reported-by: Atharva Vartak <atharva.a.vartak(a)gmail.com>
Suggested-by: Atharva Vartak <atharva.a.vartak(a)gmail.com>
Signed-off-by: Juergen Gross <jgross(a)suse.com>
Reviewed-by: Jan Beulich <jbeulich(a)suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com>
---
drivers/xen/privcmd.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 3f198ded58b8..2aa40e58cb94 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -933,6 +933,12 @@ static void privcmd_close(struct vm_area_struct *vma)
kfree(pages);
}
+static int privcmd_may_split(struct vm_area_struct *area, unsigned long addr)
+{
+ /* Forbid splitting, avoids double free via privcmd_close(). */
+ return -EINVAL;
+}
+
static vm_fault_t privcmd_fault(struct vm_fault *vmf)
{
printk(KERN_DEBUG "privcmd_fault: vma=%p %lx-%lx, pgoff=%lx, uv=%p\n",
@@ -944,6 +950,7 @@ static vm_fault_t privcmd_fault(struct vm_fault *vmf)
static const struct vm_operations_struct privcmd_vm_ops = {
.close = privcmd_close,
+ .split = privcmd_may_split,
.fault = privcmd_fault
};
--
2.43.0
2
1
06 May '26
From: Juergen Gross <jgross(a)suse.com>
mainline inclusion
from mainline-v7.1-rc2
commit 27fdbab4221b375de54bf91919798d88520c6e28
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14442
CVE: CVE-2026-31786
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is
neither NUL terminated nor a string.
The first causes a buffer overflow as sprintf in buildid_show will
read and copy till it finds a NUL.
00000000 f4 91 51 f4 dd 38 9e 9d 65 47 52 eb 10 71 db 50 |..Q..8..eGR..q.P|
00000010 b9 a8 01 42 6f 2e 32 |...Bo.2|
00000017
So use a memcpy instead of sprintf to have the correct value:
00000000 f4 91 51 f4 dd 00 9e 9d 65 47 52 eb 10 71 db 50 |..Q.....eGR..q.P|
00000010 b9 a8 01 42 |...B|
00000014
(the above have a hack to embed a zero inside and check it's
returned correctly).
This is XSA-485 / CVE-2026-31786
Fixes: 84b7625728ea ("xen: add sysfs node for hypervisor build id")
Signed-off-by: Frediano Ziglio <frediano.ziglio(a)citrix.com>
Reviewed-by: Juergen Gross <jgross(a)suse.com>
Signed-off-by: Juergen Gross <jgross(a)suse.com>
Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com>
---
drivers/xen/sys-hypervisor.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/xen/sys-hypervisor.c b/drivers/xen/sys-hypervisor.c
index feb1d16252e7..989c9a6e1d18 100644
--- a/drivers/xen/sys-hypervisor.c
+++ b/drivers/xen/sys-hypervisor.c
@@ -364,6 +364,8 @@ static ssize_t buildid_show(struct hyp_sysfs_attr *attr, char *buffer)
ret = sprintf(buffer, "<denied>");
return ret;
}
+ if (ret > PAGE_SIZE)
+ return -ENOSPC;
buildid = kmalloc(sizeof(*buildid) + ret, GFP_KERNEL);
if (!buildid)
@@ -371,8 +373,10 @@ static ssize_t buildid_show(struct hyp_sysfs_attr *attr, char *buffer)
buildid->len = ret;
ret = HYPERVISOR_xen_version(XENVER_build_id, buildid);
- if (ret > 0)
- ret = sprintf(buffer, "%s", buildid->buf);
+ if (ret > 0) {
+ /* Build id is binary, not a string. */
+ memcpy(buffer, buildid->buf, ret);
+ }
kfree(buildid);
return ret;
--
2.43.0
2
1
*** fix CVE-2026-31443 ***
Dan Carpenter (1):
dmaengine: idxd: Delete unnecessary NULL check
Vinicius Costa Gomes (1):
dmaengine: idxd: Fix crash when the event log is disabled
drivers/dma/idxd/device.c | 3 +++
drivers/dma/idxd/init.c | 2 +-
2 files changed, 4 insertions(+), 1 deletion(-)
--
2.43.0
2
3
[PATCH OLK-6.6] spi: spi-dw-dma: fix print error log when wait finish transaction
by Lin Ruifeng 06 May '26
by Lin Ruifeng 06 May '26
06 May '26
From: Vladimir Yakovlev <vovchkir(a)gmail.com>
stable inclusion
from stable-v6.19.11
commit 184f5aaf72f1f1c73e66bae0b8d28e81c2f2a72f
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14306
CVE: CVE-2026-31560
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 3b46d61890632c8f8b117147b6923bff4b42ccb7 ]
If an error occurs, the device may not have a current message. In this
case, the system will crash.
In this case, it's better to use dev from the struct ctlr (struct spi_controller*).
Signed-off-by: Vladimir Yakovlev <vovchkir(a)gmail.com>
Link: https://patch.msgid.link/20260302222017.992228-2-vovchkir@gmail.com
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Conflicts:
drivers/spi/spi-dw-dma.c
[Context conflicts]
Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com>
---
drivers/spi/spi-dw-dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-dw-dma.c b/drivers/spi/spi-dw-dma.c
index 0ecbb6c36e23..a3bedcdf6f71 100644
--- a/drivers/spi/spi-dw-dma.c
+++ b/drivers/spi/spi-dw-dma.c
@@ -271,7 +271,7 @@ static int dw_spi_dma_wait(struct dw_spi *dws, unsigned int len, u32 speed)
msecs_to_jiffies(ms));
if (ms == 0) {
- dev_err(&dws->host->cur_msg->spi->dev,
+ dev_err(&dws->host->dev,
"DMA transaction timed out\n");
return -ETIMEDOUT;
}
--
2.43.0
2
1
[PATCH OLK-5.10] spi: spi-dw-dma: fix print error log when wait finish transaction
by Lin Ruifeng 06 May '26
by Lin Ruifeng 06 May '26
06 May '26
From: Vladimir Yakovlev <vovchkir(a)gmail.com>
stable inclusion
from stable-v6.19.11
commit 184f5aaf72f1f1c73e66bae0b8d28e81c2f2a72f
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14306
CVE: CVE-2026-31560
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 3b46d61890632c8f8b117147b6923bff4b42ccb7 ]
If an error occurs, the device may not have a current message. In this
case, the system will crash.
In this case, it's better to use dev from the struct ctlr (struct spi_controller*).
Signed-off-by: Vladimir Yakovlev <vovchkir(a)gmail.com>
Link: https://patch.msgid.link/20260302222017.992228-2-vovchkir@gmail.com
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Conflicts:
drivers/spi/spi-dw-dma.c
[Context conflicts]
Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com>
---
drivers/spi/spi-dw-dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-dw-dma.c b/drivers/spi/spi-dw-dma.c
index 32ac8f9068e8..35e36f75afbb 100644
--- a/drivers/spi/spi-dw-dma.c
+++ b/drivers/spi/spi-dw-dma.c
@@ -219,7 +219,7 @@ static int dw_spi_dma_wait(struct dw_spi *dws, unsigned int len, u32 speed)
msecs_to_jiffies(ms));
if (ms == 0) {
- dev_err(&dws->master->cur_msg->spi->dev,
+ dev_err(&dws->master->dev,
"DMA transaction timed out\n");
return -ETIMEDOUT;
}
--
2.43.0
2
1
[PATCH OLK-6.6] perf/x86: Fix potential bad container_of in intel_pmu_hw_config
by Luo Gengkun 06 May '26
by Luo Gengkun 06 May '26
06 May '26
From: Ian Rogers <irogers(a)google.com>
mainline inclusion
from mainline-v7.0-rc7
commit dbde07f06226438cd2cf1179745fa1bec5d8914a
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14532
CVE: CVE-2026-31782
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
----------------------------------------------------------------------
Auto counter reload may have a group of events with software events
present within it. The software event PMU isn't the x86_hybrid_pmu and
a container_of operation in intel_pmu_set_acr_caused_constr (via the
hybrid helper) could cause out of bound memory reads. Avoid this by
guarding the call to intel_pmu_set_acr_caused_constr with an
is_x86_event check.
Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload")
Signed-off-by: Ian Rogers <irogers(a)google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Reviewed-by: Thomas Falcon <thomas.falcon(a)intel.com>
Link: https://patch.msgid.link/20260312194305.1834035-1-irogers@google.com
Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com>
---
arch/x86/events/intel/core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 1844d4917bbb..dcaa72ba5dfd 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -4423,8 +4423,10 @@ static int intel_pmu_hw_config(struct perf_event *event)
intel_pmu_set_acr_caused_constr(leader, idx++, cause_mask);
if (leader->nr_siblings) {
- for_each_sibling_event(sibling, leader)
- intel_pmu_set_acr_caused_constr(sibling, idx++, cause_mask);
+ for_each_sibling_event(sibling, leader) {
+ if (is_x86_event(sibling))
+ intel_pmu_set_acr_caused_constr(sibling, idx++, cause_mask);
+ }
}
if (leader != event)
--
2.34.1
2
1
[PATCH OLK-6.6] drm/i915/gt: Check set_default_submission() before deferencing
by Hongtao Zhang 06 May '26
by Hongtao Zhang 06 May '26
06 May '26
From: Rahul Bukte <rahul.bukte(a)sony.com>
stable inclusion
from stable-v6.6.130
commit df1f4a7d9cf689b4e96c95255228896505f44c31
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14286
CVE: CVE-2026-31540
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 0162ab3220bac870e43e229e6e3024d1a21c3f26 ]
When the i915 driver firmware binaries are not present, the
set_default_submission pointer is not set. This pointer is
dereferenced during suspend anyways.
Add a check to make sure it is set before dereferencing.
[ 23.289926] PM: suspend entry (deep)
[ 23.293558] Filesystems sync: 0.000 seconds
[ 23.298010] Freezing user space processes
[ 23.302771] Freezing user space processes completed (elapsed 0.000 seconds)
[ 23.309766] OOM killer disabled.
[ 23.313027] Freezing remaining freezable tasks
[ 23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)
[ 23.342038] serial 00:05: disabled
[ 23.345719] serial 00:02: disabled
[ 23.349342] serial 00:01: disabled
[ 23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache
[ 23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache
[ 23.361635] ata1.00: Entering standby power mode
[ 23.368863] ata2.00: Entering standby power mode
[ 23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 23.452194] #PF: supervisor instruction fetch in kernel mode
[ 23.457896] #PF: error_code(0x0010) - not-present page
[ 23.463065] PGD 0 P4D 0
[ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI
[ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S W 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)
[ 23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
[ 23.496511] Workqueue: async async_run_entry_fn
[ 23.501087] RIP: 0010:0x0
[ 23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246
[ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f
[ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000
[ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff
[ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8
[ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68
[ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000
[ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0
[ 23.572539] PKRU: 55555554
[ 23.575281] Call Trace:
[ 23.577770] <TASK>
[ 23.579905] intel_engines_reset_default_submission+0x42/0x60
[ 23.585695] __intel_gt_unset_wedged+0x191/0x200
[ 23.590360] intel_gt_unset_wedged+0x20/0x40
[ 23.594675] gt_sanitize+0x15e/0x170
[ 23.598290] i915_gem_suspend_late+0x6b/0x180
[ 23.602692] i915_drm_suspend_late+0x35/0xf0
[ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10
[ 23.611843] dpm_run_callback+0x78/0x1c0
[ 23.615817] device_suspend_late+0xde/0x2e0
[ 23.620037] async_suspend_late+0x18/0x30
[ 23.624082] async_run_entry_fn+0x25/0xa0
[ 23.628129] process_one_work+0x15b/0x380
[ 23.632182] worker_thread+0x2a5/0x3c0
[ 23.635973] ? __pfx_worker_thread+0x10/0x10
[ 23.640279] kthread+0xf6/0x1f0
[ 23.643464] ? __pfx_kthread+0x10/0x10
[ 23.647263] ? __pfx_kthread+0x10/0x10
[ 23.651045] ret_from_fork+0x131/0x190
[ 23.654837] ? __pfx_kthread+0x10/0x10
[ 23.658634] ret_from_fork_asm+0x1a/0x30
[ 23.662597] </TASK>
[ 23.664826] Modules linked in:
[ 23.667914] CR2: 0000000000000000
[ 23.671271] ------------[ cut here ]------------
Signed-off-by: Rahul Bukte <rahul.bukte(a)sony.com>
Reviewed-by: Suraj Kandpal <suraj.kandpal(a)intel.com>
Signed-off-by: Suraj Kandpal <suraj.kandpal(a)intel.com>
Link: https://patch.msgid.link/20260203044839.1555147-1-suraj.kandpal@intel.com
(cherry picked from commit daa199abc3d3d1740c9e3a2c3e9216ae5b447cad)
Fixes: ff44ad51ebf8 ("drm/i915: Move engine->submit_request selection to a vfunc")
Signed-off-by: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com>
---
drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
index 0729ab5955171..6ea2c14f78160 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
@@ -1973,7 +1973,8 @@ void intel_engines_reset_default_submission(struct intel_gt *gt)
if (engine->sanitize)
engine->sanitize(engine);
- engine->set_default_submission(engine);
+ if (engine->set_default_submission)
+ engine->set_default_submission(engine);
}
}
--
2.43.0
2
1
CVE
Helen Koike (1):
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
Hyunwoo Kim (3):
Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
Bluetooth: L2CAP: Validate PDU length before reading SDU length in
l2cap_ecred_data_rcv()
Luiz Augusto von Dentz (1):
Bluetooth: MGMT: Fix dangling pointer on
mgmt_add_adv_patterns_monitor_complete
net/bluetooth/l2cap_core.c | 32 ++++++++++++++++++++------------
net/bluetooth/l2cap_sock.c | 3 +++
net/bluetooth/mgmt.c | 2 +-
3 files changed, 24 insertions(+), 13 deletions(-)
--
2.34.1
2
6
06 May '26
From: Kohei Enju <kohei(a)enjuk.jp>
mainline inclusion
from mainline-v7.0-rc6
commit fecacfc95f195b99c71c579a472120d0b4ed65fa
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14241
CVE: CVE-2026-31505
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
iavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the
value could change in runtime, we should use num_tx_queues instead.
Moreover iavf_get_ethtool_stats() uses num_active_queues while
iavf_get_sset_count() and iavf_get_stat_strings() use
real_num_tx_queues, which triggers out-of-bounds writes when we do
"ethtool -L" and "ethtool -S" simultaneously [1].
For example when we change channels from 1 to 8, Thread 3 could be
scheduled before Thread 2, and out-of-bounds writes could be triggered
in Thread 3:
Thread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S)
iavf_set_channels()
...
iavf_alloc_queues()
-> num_active_queues = 8
iavf_schedule_finish_config()
iavf_get_sset_count()
real_num_tx_queues: 1
-> buffer for 1 queue
iavf_get_ethtool_stats()
num_active_queues: 8
-> out-of-bounds!
iavf_finish_config()
-> real_num_tx_queues = 8
Use immutable num_tx_queues in all related functions to avoid the issue.
[1]
BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270
Write of size 8 at addr ffffc900031c9080 by task ethtool/5800
CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x6f/0xb0
print_report+0x170/0x4f3
kasan_report+0xe1/0x180
iavf_add_one_ethtool_stat+0x200/0x270
iavf_get_ethtool_stats+0x14c/0x2e0
__dev_ethtool+0x3d0c/0x5830
dev_ethtool+0x12d/0x270
dev_ioctl+0x53c/0xe30
sock_do_ioctl+0x1a9/0x270
sock_ioctl+0x3d4/0x5e0
__x64_sys_ioctl+0x137/0x1c0
do_syscall_64+0xf3/0x690
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7da0e6e36d
...
</TASK>
The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830
The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000
index:0xffff88813a013de0 pfn:0x13a013
flags: 0x200000000000000(node=0|zone=2)
raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
^
ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
Fixes: 64430f70ba6f ("iavf: Fix displaying queue statistics shown by ethtool")
Signed-off-by: Kohei Enju <kohei(a)enjuk.jp>
Reviewed-by: Simon Horman <horms(a)kernel.org>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel(a)intel.com>
Reviewed-by: Paul Menzel <pmenzel(a)molgen.mpg.de>
Tested-by: Rafal Romanowski <rafal.romanowski(a)intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com>
Conflicts:
drivers/net/ethernet/intel/iavf/iavf_ethtool.c
[Context conflicts due to ummerged commit
53844673d555 ("iavf: kill "legacy-rx" for good")]
Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com>
---
.../net/ethernet/intel/iavf/iavf_ethtool.c | 31 +++++++++----------
1 file changed, 15 insertions(+), 16 deletions(-)
diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
index 1ac97bd606e3..f2288e2aedb0 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
@@ -334,14 +334,13 @@ static int iavf_get_sset_count(struct net_device *netdev, int sset)
{
/* Report the maximum number queues, even if not every queue is
* currently configured. Since allocation of queues is in pairs,
- * use netdev->real_num_tx_queues * 2. The real_num_tx_queues is set
- * at device creation and never changes.
+ * use netdev->num_tx_queues * 2. The num_tx_queues is set at
+ * device creation and never changes.
*/
if (sset == ETH_SS_STATS)
return IAVF_STATS_LEN +
- (IAVF_QUEUE_STATS_LEN * 2 *
- netdev->real_num_tx_queues);
+ (IAVF_QUEUE_STATS_LEN * 2 * netdev->num_tx_queues);
else if (sset == ETH_SS_PRIV_FLAGS)
return IAVF_PRIV_FLAGS_STR_LEN;
else
@@ -368,19 +367,19 @@ static void iavf_get_ethtool_stats(struct net_device *netdev,
iavf_add_ethtool_stats(&data, adapter, iavf_gstrings_stats);
rcu_read_lock();
- /* As num_active_queues describe both tx and rx queues, we can use
- * it to iterate over rings' stats.
+ /* Use num_tx_queues to report stats for the maximum number of queues.
+ * Queues beyond num_active_queues will report zero.
*/
- for (i = 0; i < adapter->num_active_queues; i++) {
- struct iavf_ring *ring;
+ for (i = 0; i < netdev->num_tx_queues; i++) {
+ struct iavf_ring *tx_ring = NULL, *rx_ring = NULL;
- /* Tx rings stats */
- ring = &adapter->tx_rings[i];
- iavf_add_queue_stats(&data, ring);
+ if (i < adapter->num_active_queues) {
+ tx_ring = &adapter->tx_rings[i];
+ rx_ring = &adapter->rx_rings[i];
+ }
- /* Rx rings stats */
- ring = &adapter->rx_rings[i];
- iavf_add_queue_stats(&data, ring);
+ iavf_add_queue_stats(&data, tx_ring);
+ iavf_add_queue_stats(&data, rx_ring);
}
rcu_read_unlock();
}
@@ -417,9 +416,9 @@ static void iavf_get_stat_strings(struct net_device *netdev, u8 *data)
iavf_add_stat_strings(&data, iavf_gstrings_stats);
/* Queues are always allocated in pairs, so we just use
- * real_num_tx_queues for both Tx and Rx queues.
+ * num_tx_queues for both Tx and Rx queues.
*/
- for (i = 0; i < netdev->real_num_tx_queues; i++) {
+ for (i = 0; i < netdev->num_tx_queues; i++) {
iavf_add_stat_strings(&data, iavf_gstrings_queue_stats,
"tx", i);
iavf_add_stat_strings(&data, iavf_gstrings_queue_stats,
--
2.34.1
2
1
Douya Le (1):
crypto: algif_aead - snapshot IV for async AEAD requests
Eric Biggers (3):
crypto: scatterwalk - Backport memcpy_sglist()
crypto: algif_aead - use memcpy_sglist() instead of null skcipher
crypto: authenc - use memcpy_sglist() instead of null skcipher
Herbert Xu (5):
crypto: algif_aead - Fix minimum RX size check for decryption
crypto: algif_aead - Revert to operating out-of-place
crypto: authencesn - Do not place hiseq at end of dst for out-of-place
decryption
crypto: authencesn - Fix src offset when decrypting in-place
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
crypto/Kconfig | 2 -
crypto/af_alg.c | 51 ++-------
crypto/algif_aead.c | 205 +++++++----------------------------
crypto/algif_skcipher.c | 6 +-
crypto/authenc.c | 32 +-----
crypto/authencesn.c | 84 ++++++--------
crypto/scatterwalk.c | 94 ++++++++++++++++
include/crypto/if_alg.h | 5 +-
include/crypto/scatterwalk.h | 31 ++++++
9 files changed, 216 insertions(+), 294 deletions(-)
--
2.34.1
2
10
Douya Le (1):
crypto: algif_aead - snapshot IV for async AEAD requests
Eric Biggers (3):
crypto: scatterwalk - Backport memcpy_sglist()
crypto: algif_aead - use memcpy_sglist() instead of null skcipher
crypto: authenc - use memcpy_sglist() instead of null skcipher
Herbert Xu (5):
crypto: algif_aead - Revert to operating out-of-place
crypto: authencesn - Do not place hiseq at end of dst for out-of-place
decryption
crypto: authencesn - Fix src offset when decrypting in-place
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
crypto: algif_aead - Fix minimum RX size check for decryption
Randy Dunlap (1):
crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c
crypto/Kconfig | 2 -
crypto/af_alg.c | 138 +++++++++++-------------
crypto/algif_aead.c | 203 ++++++++---------------------------
crypto/algif_skcipher.c | 6 +-
crypto/authenc.c | 32 +-----
crypto/authencesn.c | 84 ++++++---------
crypto/scatterwalk.c | 98 +++++++++++++++++
include/crypto/if_alg.h | 5 +-
include/crypto/scatterwalk.h | 32 ++++++
9 files changed, 270 insertions(+), 330 deletions(-)
--
2.43.0
2
11
Douya Le (1):
crypto: algif_aead - snapshot IV for async AEAD requests
Eric Biggers (3):
crypto: scatterwalk - Backport memcpy_sglist()
crypto: algif_aead - use memcpy_sglist() instead of null skcipher
crypto: authenc - use memcpy_sglist() instead of null skcipher
Herbert Xu (5):
crypto: algif_aead - Revert to operating out-of-place
crypto: authencesn - Do not place hiseq at end of dst for out-of-place
decryption
crypto: authencesn - Fix src offset when decrypting in-place
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
crypto: algif_aead - Fix minimum RX size check for decryption
Randy Dunlap (1):
crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c
crypto/Kconfig | 2 -
crypto/af_alg.c | 138 +++++++++++-------------
crypto/algif_aead.c | 203 ++++++++---------------------------
crypto/algif_skcipher.c | 6 +-
crypto/authenc.c | 32 +-----
crypto/authencesn.c | 84 ++++++---------
crypto/scatterwalk.c | 98 +++++++++++++++++
include/crypto/if_alg.h | 5 +-
include/crypto/scatterwalk.h | 32 ++++++
9 files changed, 270 insertions(+), 330 deletions(-)
--
2.43.0
2
12
Douya Le (1):
crypto: algif_aead - snapshot IV for async AEAD requests
Eric Biggers (3):
crypto: scatterwalk - Backport memcpy_sglist()
crypto: algif_aead - use memcpy_sglist() instead of null skcipher
crypto: authenc - use memcpy_sglist() instead of null skcipher
Herbert Xu (5):
crypto: algif_aead - Revert to operating out-of-place
crypto: authencesn - Do not place hiseq at end of dst for out-of-place
decryption
crypto: authencesn - Fix src offset when decrypting in-place
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
crypto: algif_aead - Fix minimum RX size check for decryption
Randy Dunlap (1):
crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c
crypto/Kconfig | 2 -
crypto/af_alg.c | 138 +++++++++++-------------
crypto/algif_aead.c | 203 ++++++++---------------------------
crypto/algif_skcipher.c | 6 +-
crypto/authenc.c | 32 +-----
crypto/authencesn.c | 84 ++++++---------
crypto/scatterwalk.c | 98 +++++++++++++++++
include/crypto/if_alg.h | 5 +-
include/crypto/scatterwalk.h | 32 ++++++
9 files changed, 270 insertions(+), 330 deletions(-)
--
2.43.0
2
11
CVE-2026-31431
Douya Le (1):
crypto: algif_aead - snapshot IV for async AEAD requests
Eric Biggers (3):
crypto: scatterwalk - Backport memcpy_sglist()
crypto: algif_aead - use memcpy_sglist() instead of null skcipher
crypto: authenc - use memcpy_sglist() instead of null skcipher
Herbert Xu (5):
crypto: algif_aead - Revert to operating out-of-place
crypto: authencesn - Do not place hiseq at end of dst for out-of-place
decryption
crypto: authencesn - Fix src offset when decrypting in-place
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
crypto: algif_aead - Fix minimum RX size check for decryption
Randy Dunlap (1):
crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c
crypto/Kconfig | 2 -
crypto/af_alg.c | 138 +++++++++++-------------
crypto/algif_aead.c | 203 ++++++++---------------------------
crypto/algif_skcipher.c | 6 +-
crypto/authenc.c | 32 +-----
crypto/authencesn.c | 84 ++++++---------
crypto/scatterwalk.c | 98 +++++++++++++++++
include/crypto/if_alg.h | 5 +-
include/crypto/scatterwalk.h | 32 ++++++
9 files changed, 270 insertions(+), 330 deletions(-)
--
2.43.0
2
11
fix CVE-2026-31431.
Douya Le (1):
crypto: algif_aead - snapshot IV for async AEAD requests
Eric Biggers (3):
crypto: scatterwalk - Backport memcpy_sglist()
crypto: algif_aead - use memcpy_sglist() instead of null skcipher
crypto: authenc - use memcpy_sglist() instead of null skcipher
Herbert Xu (4):
crypto: algif_aead - Revert to operating out-of-place
crypto: authencesn - Do not place hiseq at end of dst for out-of-place
decryption
crypto: authencesn - Fix src offset when decrypting in-place
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
crypto/Kconfig | 2 -
crypto/af_alg.c | 51 ++-------
crypto/algif_aead.c | 203 +++++++----------------------------
crypto/algif_skcipher.c | 6 +-
crypto/authenc.c | 32 +-----
crypto/authencesn.c | 84 ++++++---------
crypto/scatterwalk.c | 94 ++++++++++++++++
include/crypto/if_alg.h | 5 +-
include/crypto/scatterwalk.h | 31 ++++++
9 files changed, 215 insertions(+), 293 deletions(-)
--
2.34.1
2
9
fix CVE-2026-31431.
Douya Le (1):
crypto: algif_aead - snapshot IV for async AEAD requests
Eric Biggers (3):
crypto: scatterwalk - Backport memcpy_sglist()
crypto: algif_aead - use memcpy_sglist() instead of null skcipher
crypto: authenc - use memcpy_sglist() instead of null skcipher
Herbert Xu (5):
crypto: algif_aead - Revert to operating out-of-place
crypto: authencesn - Do not place hiseq at end of dst for out-of-place
decryption
crypto: authencesn - Fix src offset when decrypting in-place
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
crypto: algif_aead - Fix minimum RX size check for decryption
Randy Dunlap (1):
crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c
Taeyang Lee (1):
crypto: authencesn - reject too-short AAD (assoclen<8) to match
ESP/ESN spec
crypto/Kconfig | 2 -
crypto/af_alg.c | 137 +++++++++++------------
crypto/algif_aead.c | 203 ++++++++---------------------------
crypto/algif_skcipher.c | 6 +-
crypto/authenc.c | 32 +-----
crypto/authencesn.c | 88 +++++++--------
crypto/scatterwalk.c | 98 +++++++++++++++++
include/crypto/if_alg.h | 5 +-
include/crypto/scatterwalk.h | 32 ++++++
lib/crypto/chacha.c | 4 +-
10 files changed, 277 insertions(+), 330 deletions(-)
--
2.34.1
2
13
[PATCH openEuler-1.0-LTS] crypto: algif_aead - Revert to operating out-of-place
by Yi Yang 30 Apr '26
by Yi Yang 30 Apr '26
30 Apr '26
From: Herbert Xu <herbert(a)gondor.apana.org.au>
mainline inclusion
from mainline-v7.0-rc7
commit a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14174
CVE: CVE-2026-31431
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
This mostly reverts commit 72548b093ee3 except for the copying of
the associated data.
There is no benefit in operating in-place in algif_aead since the
source and destination come from different mappings. Get rid of
all the complexity added for in-place operation and just copy the
AD directly.
Fixes: 72548b093ee3 ("crypto: algif_aead - copy AAD from src to dst")
Reported-by: Taeyang Lee <0wn(a)theori.io>
Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au>
Conflicts:
crypto/af_alg.c
crypto/algif_aead.c
crypto/algif_skcipher.c
include/crypto/if_alg.h
[Commit 99bd99d3e3a7 ("crypto: algif_skcipher - Fix stream cipher
chaining") was not merged.Context conflicts.]
Signed-off-by: Yi Yang <yiyang13(a)huawei.com>
---
crypto/af_alg.c | 48 ++++--------------
crypto/algif_aead.c | 108 ++++++++--------------------------------
crypto/algif_skcipher.c | 6 +--
include/crypto/if_alg.h | 5 +-
4 files changed, 37 insertions(+), 130 deletions(-)
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 69c21b047566..1d66daf3c735 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -525,15 +525,13 @@ EXPORT_SYMBOL_GPL(af_alg_alloc_tsgl);
/**
* aead_count_tsgl - Count number of TX SG entries
*
- * The counting starts from the beginning of the SGL to @bytes. If
- * an offset is provided, the counting of the SG entries starts at the offset.
+ * The counting starts from the beginning of the SGL to @bytes.
*
* @sk socket of connection to user space
* @bytes Count the number of SG entries holding given number of bytes.
- * @offset Start the counting of SG entries from the given offset.
* @return Number of TX SG entries found given the constraints
*/
-unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset)
+unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes)
{
struct alg_sock *ask = alg_sk(sk);
struct af_alg_ctx *ctx = ask->private;
@@ -548,25 +546,12 @@ unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset)
struct scatterlist *sg = sgl->sg;
for (i = 0; i < sgl->cur; i++) {
- size_t bytes_count;
- /* Skip offset */
- if (offset >= sg[i].length) {
- offset -= sg[i].length;
- bytes -= sg[i].length;
- continue;
- }
-
- bytes_count = sg[i].length - offset;
-
- offset = 0;
sgl_count++;
-
- /* If we have seen requested number of bytes, stop */
- if (bytes_count >= bytes)
+ if (sg[i].length >= bytes)
return sgl_count;
- bytes -= bytes_count;
+ bytes -= sg[i].length;
}
}
@@ -578,19 +563,14 @@ EXPORT_SYMBOL_GPL(af_alg_count_tsgl);
* aead_pull_tsgl - Release the specified buffers from TX SGL
*
* If @dst is non-null, reassign the pages to dst. The caller must release
- * the pages. If @dst_offset is given only reassign the pages to @dst starting
- * at the @dst_offset (byte). The caller must ensure that @dst is large
- * enough (e.g. by using af_alg_count_tsgl with the same offset).
+ * the pages.
*
* @sk socket of connection to user space
* @used Number of bytes to pull from TX SGL
* @dst If non-NULL, buffer is reassigned to dst SGL instead of releasing. The
* caller must release the buffers in dst.
- * @dst_offset Reassign the TX SGL from given offset. All buffers before
- * reaching the offset is released.
*/
-void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
- size_t dst_offset)
+void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst)
{
struct alg_sock *ask = alg_sk(sk);
struct af_alg_ctx *ctx = ask->private;
@@ -615,18 +595,10 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
* SG entries in dst.
*/
if (dst) {
- if (dst_offset >= plen) {
- /* discard page before offset */
- dst_offset -= plen;
- } else {
- /* reassign page to dst after offset */
- get_page(page);
- sg_set_page(dst + j, page,
- plen - dst_offset,
- sg[i].offset + dst_offset);
- dst_offset = 0;
- j++;
- }
+ /* reassign page to dst after offset */
+ get_page(page);
+ sg_set_page(dst + j, page, plen, sg[i].offset);
+ j++;
}
sg[i].length -= plen;
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index 43a861a79209..3cb0cb6b815a 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -30,7 +30,6 @@
#include <crypto/internal/aead.h>
#include <crypto/scatterwalk.h>
#include <crypto/if_alg.h>
-#include <crypto/skcipher.h>
#include <crypto/null.h>
#include <linux/init.h>
#include <linux/list.h>
@@ -100,9 +99,8 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
struct aead_tfm *aeadc = pask->private;
struct crypto_aead *tfm = aeadc->aead;
struct crypto_skcipher *null_tfm = aeadc->null_tfm;
- unsigned int i, as = crypto_aead_authsize(tfm);
+ unsigned int as = crypto_aead_authsize(tfm);
struct af_alg_async_req *areq;
- struct af_alg_tsgl *tsgl, *tmp;
struct scatterlist *rsgl_src, *tsgl_src = NULL;
int err = 0;
size_t used = 0; /* [in] TX bufs to be en/decrypted */
@@ -182,23 +180,24 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
outlen -= less;
}
+ /*
+ * Create a per request TX SGL for this request which tracks the
+ * SG entries from the global TX SGL.
+ */
processed = used + ctx->aead_assoclen;
- list_for_each_entry_safe(tsgl, tmp, &ctx->tsgl_list, list) {
- for (i = 0; i < tsgl->cur; i++) {
- struct scatterlist *process_sg = tsgl->sg + i;
-
- if (!(process_sg->length) || !sg_page(process_sg))
- continue;
- tsgl_src = process_sg;
- break;
- }
- if (tsgl_src)
- break;
- }
- if (processed && !tsgl_src) {
- err = -EFAULT;
+ areq->tsgl_entries = af_alg_count_tsgl(sk, processed);
+ if (!areq->tsgl_entries)
+ areq->tsgl_entries = 1;
+ areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl),
+ areq->tsgl_entries),
+ GFP_KERNEL);
+ if (!areq->tsgl) {
+ err = -ENOMEM;
goto free;
}
+ sg_init_table(areq->tsgl, areq->tsgl_entries);
+ af_alg_pull_tsgl(sk, processed, areq->tsgl);
+ tsgl_src = areq->tsgl;
/*
* Copy of AAD from source to destination
@@ -207,81 +206,18 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
* when user space uses an in-place cipher operation, the kernel
* will copy the data as it does not see whether such in-place operation
* is initiated.
- *
- * To ensure efficiency, the following implementation ensure that the
- * ciphers are invoked to perform a crypto operation in-place. This
- * is achieved by memory management specified as follows.
*/
/* Use the RX SGL as source (and destination) for crypto op. */
rsgl_src = areq->first_rsgl.sgl.sg;
- if (ctx->enc) {
- /*
- * Encryption operation - The in-place cipher operation is
- * achieved by the following operation:
- *
- * TX SGL: AAD || PT
- * | |
- * | copy |
- * v v
- * RX SGL: AAD || PT || Tag
- */
- err = crypto_aead_copy_sgl(null_tfm, tsgl_src,
- areq->first_rsgl.sgl.sg, processed);
- if (err)
- goto free;
- af_alg_pull_tsgl(sk, processed, NULL, 0);
- } else {
- /*
- * Decryption operation - To achieve an in-place cipher
- * operation, the following SGL structure is used:
- *
- * TX SGL: AAD || CT || Tag
- * | | ^
- * | copy | | Create SGL link.
- * v v |
- * RX SGL: AAD || CT ----+
- */
-
- /* Copy AAD || CT to RX SGL buffer for in-place operation. */
- err = crypto_aead_copy_sgl(null_tfm, tsgl_src,
- areq->first_rsgl.sgl.sg, outlen);
- if (err)
- goto free;
-
- /* Create TX SGL for tag and chain it to RX SGL. */
- areq->tsgl_entries = af_alg_count_tsgl(sk, processed,
- processed - as);
- if (!areq->tsgl_entries)
- areq->tsgl_entries = 1;
- areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl),
- areq->tsgl_entries),
- GFP_KERNEL);
- if (!areq->tsgl) {
- err = -ENOMEM;
- goto free;
- }
- sg_init_table(areq->tsgl, areq->tsgl_entries);
-
- /* Release TX SGL, except for tag data and reassign tag data. */
- af_alg_pull_tsgl(sk, processed, areq->tsgl, processed - as);
-
- /* chain the areq TX SGL holding the tag with RX SGL */
- if (usedpages) {
- /* RX SGL present */
- struct af_alg_sgl *sgl_prev = &areq->last_rsgl->sgl;
-
- sg_unmark_end(sgl_prev->sg + sgl_prev->npages - 1);
- sg_chain(sgl_prev->sg, sgl_prev->npages + 1,
- areq->tsgl);
- } else
- /* no RX SGL present (e.g. authentication only) */
- rsgl_src = areq->tsgl;
- }
+ err = crypto_aead_copy_sgl(null_tfm, tsgl_src,
+ areq->first_rsgl.sgl.sg, ctx->aead_assoclen);
+ if (err)
+ goto free;
/* Initialize the crypto operation */
- aead_request_set_crypt(&areq->cra_u.aead_req, rsgl_src,
+ aead_request_set_crypt(&areq->cra_u.aead_req, tsgl_src,
areq->first_rsgl.sgl.sg, used, ctx->iv);
aead_request_set_ad(&areq->cra_u.aead_req, ctx->aead_assoclen);
aead_request_set_tfm(&areq->cra_u.aead_req, tfm);
@@ -536,7 +472,7 @@ static void aead_sock_destruct(struct sock *sk)
struct crypto_aead *tfm = aeadc->aead;
unsigned int ivlen = crypto_aead_ivsize(tfm);
- af_alg_pull_tsgl(sk, ctx->used, NULL, 0);
+ af_alg_pull_tsgl(sk, ctx->used, NULL);
sock_kzfree_s(sk, ctx->iv, ivlen);
sock_kfree_s(sk, ctx, ctx->len);
af_alg_release_parent(sk);
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index c5813e14e905..e4c3aab2de4e 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -97,7 +97,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
* Create a per request TX SGL for this request which tracks the
* SG entries from the global TX SGL.
*/
- areq->tsgl_entries = af_alg_count_tsgl(sk, len, 0);
+ areq->tsgl_entries = af_alg_count_tsgl(sk, len);
if (!areq->tsgl_entries)
areq->tsgl_entries = 1;
areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl),
@@ -108,7 +108,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
goto free;
}
sg_init_table(areq->tsgl, areq->tsgl_entries);
- af_alg_pull_tsgl(sk, len, areq->tsgl, 0);
+ af_alg_pull_tsgl(sk, len, areq->tsgl);
/* Initialize the crypto operation */
skcipher_request_set_tfm(&areq->cra_u.skcipher_req, tfm);
@@ -328,7 +328,7 @@ static void skcipher_sock_destruct(struct sock *sk)
struct alg_sock *pask = alg_sk(psk);
struct crypto_skcipher *tfm = pask->private;
- af_alg_pull_tsgl(sk, ctx->used, NULL, 0);
+ af_alg_pull_tsgl(sk, ctx->used, NULL);
sock_kzfree_s(sk, ctx->iv, crypto_skcipher_ivsize(tfm));
sock_kfree_s(sk, ctx, ctx->len);
af_alg_release_parent(sk);
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index ca3cd8118639..17447b4600f9 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -238,9 +238,8 @@ static inline bool af_alg_readable(struct sock *sk)
}
int af_alg_alloc_tsgl(struct sock *sk);
-unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset);
-void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
- size_t dst_offset);
+unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes);
+void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst);
void af_alg_free_areq_sgls(struct af_alg_async_req *areq);
int af_alg_wait_for_wmem(struct sock *sk, unsigned int flags);
void af_alg_wmem_wakeup(struct sock *sk);
--
2.25.1
2
2
30 Apr '26
From: Herbert Xu <herbert(a)gondor.apana.org.au>
mainline inclusion
from mainline-v7.0-rc7
commit a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14174
CVE: CVE-2026-31431
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
This mostly reverts commit 72548b093ee3 except for the copying of
the associated data.
There is no benefit in operating in-place in algif_aead since the
source and destination come from different mappings. Get rid of
all the complexity added for in-place operation and just copy the
AD directly.
Fixes: 72548b093ee3 ("crypto: algif_aead - copy AAD from src to dst")
Reported-by: Taeyang Lee <0wn(a)theori.io>
Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au>
Conflicts:
crypto/af_alg.c
crypto/algif_aead.c
crypto/algif_skcipher.c
include/crypto/if_alg.h
[Commit 99bd99d3e3a7 ("crypto: algif_skcipher - Fix stream cipher
chaining") was not merged.Context conflicts.]
Signed-off-by: Yi Yang <yiyang13(a)huawei.com>
---
crypto/af_alg.c | 49 ++++--------------
crypto/algif_aead.c | 109 +++++++++-------------------------------
crypto/algif_skcipher.c | 6 +--
include/crypto/if_alg.h | 5 +-
4 files changed, 38 insertions(+), 131 deletions(-)
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index b7e132967650..7fc775249ae3 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -527,15 +527,13 @@ static int af_alg_alloc_tsgl(struct sock *sk)
/**
* aead_count_tsgl - Count number of TX SG entries
*
- * The counting starts from the beginning of the SGL to @bytes. If
- * an offset is provided, the counting of the SG entries starts at the offset.
+ * The counting starts from the beginning of the SGL to @bytes.
*
* @sk socket of connection to user space
* @bytes Count the number of SG entries holding given number of bytes.
- * @offset Start the counting of SG entries from the given offset.
* @return Number of TX SG entries found given the constraints
*/
-unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset)
+unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes)
{
const struct alg_sock *ask = alg_sk(sk);
const struct af_alg_ctx *ctx = ask->private;
@@ -550,25 +548,11 @@ unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset)
const struct scatterlist *sg = sgl->sg;
for (i = 0; i < sgl->cur; i++) {
- size_t bytes_count;
-
- /* Skip offset */
- if (offset >= sg[i].length) {
- offset -= sg[i].length;
- bytes -= sg[i].length;
- continue;
- }
-
- bytes_count = sg[i].length - offset;
-
- offset = 0;
sgl_count++;
-
- /* If we have seen requested number of bytes, stop */
- if (bytes_count >= bytes)
+ if (sg[i].length >= bytes)
return sgl_count;
- bytes -= bytes_count;
+ bytes -= sg[i].length;
}
}
@@ -580,19 +564,14 @@ EXPORT_SYMBOL_GPL(af_alg_count_tsgl);
* aead_pull_tsgl - Release the specified buffers from TX SGL
*
* If @dst is non-null, reassign the pages to dst. The caller must release
- * the pages. If @dst_offset is given only reassign the pages to @dst starting
- * at the @dst_offset (byte). The caller must ensure that @dst is large
- * enough (e.g. by using af_alg_count_tsgl with the same offset).
+ * the pages.
*
* @sk socket of connection to user space
* @used Number of bytes to pull from TX SGL
* @dst If non-NULL, buffer is reassigned to dst SGL instead of releasing. The
* caller must release the buffers in dst.
- * @dst_offset Reassign the TX SGL from given offset. All buffers before
- * reaching the offset is released.
*/
-void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
- size_t dst_offset)
+void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst)
{
struct alg_sock *ask = alg_sk(sk);
struct af_alg_ctx *ctx = ask->private;
@@ -617,18 +596,10 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
* SG entries in dst.
*/
if (dst) {
- if (dst_offset >= plen) {
- /* discard page before offset */
- dst_offset -= plen;
- } else {
- /* reassign page to dst after offset */
- get_page(page);
- sg_set_page(dst + j, page,
- plen - dst_offset,
- sg[i].offset + dst_offset);
- dst_offset = 0;
- j++;
- }
+ /* reassign page to dst after offset */
+ get_page(page);
+ sg_set_page(dst + j, page, plen, sg[i].offset);
+ j++;
}
sg[i].length -= plen;
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index 42493b4d8ce4..5d98db4e7558 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -26,7 +26,6 @@
#include <crypto/internal/aead.h>
#include <crypto/scatterwalk.h>
#include <crypto/if_alg.h>
-#include <crypto/skcipher.h>
#include <crypto/null.h>
#include <linux/init.h>
#include <linux/list.h>
@@ -96,9 +95,8 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
struct aead_tfm *aeadc = pask->private;
struct crypto_aead *tfm = aeadc->aead;
struct crypto_sync_skcipher *null_tfm = aeadc->null_tfm;
- unsigned int i, as = crypto_aead_authsize(tfm);
+ unsigned int as = crypto_aead_authsize(tfm);
struct af_alg_async_req *areq;
- struct af_alg_tsgl *tsgl, *tmp;
struct scatterlist *rsgl_src, *tsgl_src = NULL;
int err = 0;
size_t used = 0; /* [in] TX bufs to be en/decrypted */
@@ -178,23 +176,24 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
outlen -= less;
}
+ /*
+ * Create a per request TX SGL for this request which tracks the
+ * SG entries from the global TX SGL.
+ */
processed = used + ctx->aead_assoclen;
- list_for_each_entry_safe(tsgl, tmp, &ctx->tsgl_list, list) {
- for (i = 0; i < tsgl->cur; i++) {
- struct scatterlist *process_sg = tsgl->sg + i;
-
- if (!(process_sg->length) || !sg_page(process_sg))
- continue;
- tsgl_src = process_sg;
- break;
- }
- if (tsgl_src)
- break;
- }
- if (processed && !tsgl_src) {
- err = -EFAULT;
+ areq->tsgl_entries = af_alg_count_tsgl(sk, processed);
+ if (!areq->tsgl_entries)
+ areq->tsgl_entries = 1;
+ areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl),
+ areq->tsgl_entries),
+ GFP_KERNEL);
+ if (!areq->tsgl) {
+ err = -ENOMEM;
goto free;
}
+ sg_init_table(areq->tsgl, areq->tsgl_entries);
+ af_alg_pull_tsgl(sk, processed, areq->tsgl);
+ tsgl_src = areq->tsgl;
/*
* Copy of AAD from source to destination
@@ -203,81 +202,19 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
* when user space uses an in-place cipher operation, the kernel
* will copy the data as it does not see whether such in-place operation
* is initiated.
- *
- * To ensure efficiency, the following implementation ensure that the
- * ciphers are invoked to perform a crypto operation in-place. This
- * is achieved by memory management specified as follows.
*/
/* Use the RX SGL as source (and destination) for crypto op. */
rsgl_src = areq->first_rsgl.sgl.sg;
- if (ctx->enc) {
- /*
- * Encryption operation - The in-place cipher operation is
- * achieved by the following operation:
- *
- * TX SGL: AAD || PT
- * | |
- * | copy |
- * v v
- * RX SGL: AAD || PT || Tag
- */
- err = crypto_aead_copy_sgl(null_tfm, tsgl_src,
- areq->first_rsgl.sgl.sg, processed);
- if (err)
- goto free;
- af_alg_pull_tsgl(sk, processed, NULL, 0);
- } else {
- /*
- * Decryption operation - To achieve an in-place cipher
- * operation, the following SGL structure is used:
- *
- * TX SGL: AAD || CT || Tag
- * | | ^
- * | copy | | Create SGL link.
- * v v |
- * RX SGL: AAD || CT ----+
- */
-
- /* Copy AAD || CT to RX SGL buffer for in-place operation. */
- err = crypto_aead_copy_sgl(null_tfm, tsgl_src,
- areq->first_rsgl.sgl.sg, outlen);
- if (err)
- goto free;
-
- /* Create TX SGL for tag and chain it to RX SGL. */
- areq->tsgl_entries = af_alg_count_tsgl(sk, processed,
- processed - as);
- if (!areq->tsgl_entries)
- areq->tsgl_entries = 1;
- areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl),
- areq->tsgl_entries),
- GFP_KERNEL);
- if (!areq->tsgl) {
- err = -ENOMEM;
- goto free;
- }
- sg_init_table(areq->tsgl, areq->tsgl_entries);
-
- /* Release TX SGL, except for tag data and reassign tag data. */
- af_alg_pull_tsgl(sk, processed, areq->tsgl, processed - as);
-
- /* chain the areq TX SGL holding the tag with RX SGL */
- if (usedpages) {
- /* RX SGL present */
- struct af_alg_sgl *sgl_prev = &areq->last_rsgl->sgl;
-
- sg_unmark_end(sgl_prev->sg + sgl_prev->npages - 1);
- sg_chain(sgl_prev->sg, sgl_prev->npages + 1,
- areq->tsgl);
- } else
- /* no RX SGL present (e.g. authentication only) */
- rsgl_src = areq->tsgl;
- }
+ err = crypto_aead_copy_sgl(null_tfm, tsgl_src,
+ areq->first_rsgl.sgl.sg,
+ ctx->aead_assoclen);
+ if (err)
+ goto free;
/* Initialize the crypto operation */
- aead_request_set_crypt(&areq->cra_u.aead_req, rsgl_src,
+ aead_request_set_crypt(&areq->cra_u.aead_req, tsgl_src,
areq->first_rsgl.sgl.sg, used, ctx->iv);
aead_request_set_ad(&areq->cra_u.aead_req, ctx->aead_assoclen);
aead_request_set_tfm(&areq->cra_u.aead_req, tfm);
@@ -526,7 +463,7 @@ static void aead_sock_destruct(struct sock *sk)
struct crypto_aead *tfm = aeadc->aead;
unsigned int ivlen = crypto_aead_ivsize(tfm);
- af_alg_pull_tsgl(sk, ctx->used, NULL, 0);
+ af_alg_pull_tsgl(sk, ctx->used, NULL);
sock_kzfree_s(sk, ctx->iv, ivlen);
sock_kfree_s(sk, ctx, ctx->len);
af_alg_release_parent(sk);
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index bd9401e37706..edbdc19cdb31 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -95,7 +95,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
* Create a per request TX SGL for this request which tracks the
* SG entries from the global TX SGL.
*/
- areq->tsgl_entries = af_alg_count_tsgl(sk, len, 0);
+ areq->tsgl_entries = af_alg_count_tsgl(sk, len);
if (!areq->tsgl_entries)
areq->tsgl_entries = 1;
areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl),
@@ -106,7 +106,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
goto free;
}
sg_init_table(areq->tsgl, areq->tsgl_entries);
- af_alg_pull_tsgl(sk, len, areq->tsgl, 0);
+ af_alg_pull_tsgl(sk, len, areq->tsgl);
/* Initialize the crypto operation */
skcipher_request_set_tfm(&areq->cra_u.skcipher_req, tfm);
@@ -319,7 +319,7 @@ static void skcipher_sock_destruct(struct sock *sk)
struct alg_sock *pask = alg_sk(psk);
struct crypto_skcipher *tfm = pask->private;
- af_alg_pull_tsgl(sk, ctx->used, NULL, 0);
+ af_alg_pull_tsgl(sk, ctx->used, NULL);
sock_kzfree_s(sk, ctx->iv, crypto_skcipher_ivsize(tfm));
sock_kfree_s(sk, ctx, ctx->len);
af_alg_release_parent(sk);
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index a406e281ae57..719a38d7e8bb 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -228,9 +228,8 @@ static inline bool af_alg_readable(struct sock *sk)
return PAGE_SIZE <= af_alg_rcvbuf(sk);
}
-unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset);
-void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
- size_t dst_offset);
+unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes);
+void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst);
void af_alg_wmem_wakeup(struct sock *sk);
int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min);
int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
--
2.25.1
2
2
30 Apr '26
From: Herbert Xu <herbert(a)gondor.apana.org.au>
mainline inclusion
from mainline-v7.0-rc7
commit a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14174
CVE: CVE-2026-31431
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
This mostly reverts commit 72548b093ee3 except for the copying of
the associated data.
There is no benefit in operating in-place in algif_aead since the
source and destination come from different mappings. Get rid of
all the complexity added for in-place operation and just copy the
AD directly.
Fixes: 72548b093ee3 ("crypto: algif_aead - copy AAD from src to dst")
Reported-by: Taeyang Lee <0wn(a)theori.io>
Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au>
Conflicts:
crypto/algif_aead.c
crypto/algif_skcipher.c
[Commit 99bd99d3e3a7 ("crypto: algif_skcipher - Fix stream cipher
chaining") was not merged.Context conflicts.]
Signed-off-by: Yi Yang <yiyang13(a)huawei.com>
---
crypto/af_alg.c | 49 ++++--------------
crypto/algif_aead.c | 111 +++++++++-------------------------------
crypto/algif_skcipher.c | 6 +--
include/crypto/if_alg.h | 5 +-
4 files changed, 38 insertions(+), 133 deletions(-)
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 55e58dfbcca1..ed8751bb3456 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -634,15 +634,13 @@ static int af_alg_alloc_tsgl(struct sock *sk)
/**
* af_alg_count_tsgl - Count number of TX SG entries
*
- * The counting starts from the beginning of the SGL to @bytes. If
- * an @offset is provided, the counting of the SG entries starts at the @offset.
+ * The counting starts from the beginning of the SGL to @bytes.
*
* @sk: socket of connection to user space
* @bytes: Count the number of SG entries holding given number of bytes.
- * @offset: Start the counting of SG entries from the given offset.
* Return: Number of TX SG entries found given the constraints
*/
-unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset)
+unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes)
{
const struct alg_sock *ask = alg_sk(sk);
const struct af_alg_ctx *ctx = ask->private;
@@ -657,25 +655,11 @@ unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset)
const struct scatterlist *sg = sgl->sg;
for (i = 0; i < sgl->cur; i++) {
- size_t bytes_count;
-
- /* Skip offset */
- if (offset >= sg[i].length) {
- offset -= sg[i].length;
- bytes -= sg[i].length;
- continue;
- }
-
- bytes_count = sg[i].length - offset;
-
- offset = 0;
sgl_count++;
-
- /* If we have seen requested number of bytes, stop */
- if (bytes_count >= bytes)
+ if (sg[i].length >= bytes)
return sgl_count;
- bytes -= bytes_count;
+ bytes -= sg[i].length;
}
}
@@ -687,19 +671,14 @@ EXPORT_SYMBOL_GPL(af_alg_count_tsgl);
* af_alg_pull_tsgl - Release the specified buffers from TX SGL
*
* If @dst is non-null, reassign the pages to @dst. The caller must release
- * the pages. If @dst_offset is given only reassign the pages to @dst starting
- * at the @dst_offset (byte). The caller must ensure that @dst is large
- * enough (e.g. by using af_alg_count_tsgl with the same offset).
+ * the pages.
*
* @sk: socket of connection to user space
* @used: Number of bytes to pull from TX SGL
* @dst: If non-NULL, buffer is reassigned to dst SGL instead of releasing. The
* caller must release the buffers in dst.
- * @dst_offset: Reassign the TX SGL from given offset. All buffers before
- * reaching the offset is released.
*/
-void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
- size_t dst_offset)
+void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst)
{
struct alg_sock *ask = alg_sk(sk);
struct af_alg_ctx *ctx = ask->private;
@@ -724,18 +703,10 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
* SG entries in dst.
*/
if (dst) {
- if (dst_offset >= plen) {
- /* discard page before offset */
- dst_offset -= plen;
- } else {
- /* reassign page to dst after offset */
- get_page(page);
- sg_set_page(dst + j, page,
- plen - dst_offset,
- sg[i].offset + dst_offset);
- dst_offset = 0;
- j++;
- }
+ /* reassign page to dst after offset */
+ get_page(page);
+ sg_set_page(dst + j, page, plen, sg[i].offset);
+ j++;
}
sg[i].length -= plen;
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index 7d58cbbce4af..1c6d98b2832b 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -26,7 +26,6 @@
#include <crypto/internal/aead.h>
#include <crypto/scatterwalk.h>
#include <crypto/if_alg.h>
-#include <crypto/skcipher.h>
#include <crypto/null.h>
#include <linux/init.h>
#include <linux/list.h>
@@ -96,9 +95,8 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
struct aead_tfm *aeadc = pask->private;
struct crypto_aead *tfm = aeadc->aead;
struct crypto_sync_skcipher *null_tfm = aeadc->null_tfm;
- unsigned int i, as = crypto_aead_authsize(tfm);
+ unsigned int as = crypto_aead_authsize(tfm);
struct af_alg_async_req *areq;
- struct af_alg_tsgl *tsgl, *tmp;
struct scatterlist *rsgl_src, *tsgl_src = NULL;
int err = 0;
size_t used = 0; /* [in] TX bufs to be en/decrypted */
@@ -178,23 +176,24 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
outlen -= less;
}
+ /*
+ * Create a per request TX SGL for this request which tracks the
+ * SG entries from the global TX SGL.
+ */
processed = used + ctx->aead_assoclen;
- list_for_each_entry_safe(tsgl, tmp, &ctx->tsgl_list, list) {
- for (i = 0; i < tsgl->cur; i++) {
- struct scatterlist *process_sg = tsgl->sg + i;
-
- if (!(process_sg->length) || !sg_page(process_sg))
- continue;
- tsgl_src = process_sg;
- break;
- }
- if (tsgl_src)
- break;
- }
- if (processed && !tsgl_src) {
- err = -EFAULT;
+ areq->tsgl_entries = af_alg_count_tsgl(sk, processed);
+ if (!areq->tsgl_entries)
+ areq->tsgl_entries = 1;
+ areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl),
+ areq->tsgl_entries),
+ GFP_KERNEL);
+ if (!areq->tsgl) {
+ err = -ENOMEM;
goto free;
}
+ sg_init_table(areq->tsgl, areq->tsgl_entries);
+ af_alg_pull_tsgl(sk, processed, areq->tsgl);
+ tsgl_src = areq->tsgl;
/*
* Copy of AAD from source to destination
@@ -203,83 +202,19 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
* when user space uses an in-place cipher operation, the kernel
* will copy the data as it does not see whether such in-place operation
* is initiated.
- *
- * To ensure efficiency, the following implementation ensure that the
- * ciphers are invoked to perform a crypto operation in-place. This
- * is achieved by memory management specified as follows.
*/
/* Use the RX SGL as source (and destination) for crypto op. */
rsgl_src = areq->first_rsgl.sgl.sgt.sgl;
- if (ctx->enc) {
- /*
- * Encryption operation - The in-place cipher operation is
- * achieved by the following operation:
- *
- * TX SGL: AAD || PT
- * | |
- * | copy |
- * v v
- * RX SGL: AAD || PT || Tag
- */
- err = crypto_aead_copy_sgl(null_tfm, tsgl_src,
- areq->first_rsgl.sgl.sgt.sgl,
- processed);
- if (err)
- goto free;
- af_alg_pull_tsgl(sk, processed, NULL, 0);
- } else {
- /*
- * Decryption operation - To achieve an in-place cipher
- * operation, the following SGL structure is used:
- *
- * TX SGL: AAD || CT || Tag
- * | | ^
- * | copy | | Create SGL link.
- * v v |
- * RX SGL: AAD || CT ----+
- */
-
- /* Copy AAD || CT to RX SGL buffer for in-place operation. */
- err = crypto_aead_copy_sgl(null_tfm, tsgl_src,
- areq->first_rsgl.sgl.sgt.sgl,
- outlen);
- if (err)
- goto free;
-
- /* Create TX SGL for tag and chain it to RX SGL. */
- areq->tsgl_entries = af_alg_count_tsgl(sk, processed,
- processed - as);
- if (!areq->tsgl_entries)
- areq->tsgl_entries = 1;
- areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl),
- areq->tsgl_entries),
- GFP_KERNEL);
- if (!areq->tsgl) {
- err = -ENOMEM;
- goto free;
- }
- sg_init_table(areq->tsgl, areq->tsgl_entries);
-
- /* Release TX SGL, except for tag data and reassign tag data. */
- af_alg_pull_tsgl(sk, processed, areq->tsgl, processed - as);
-
- /* chain the areq TX SGL holding the tag with RX SGL */
- if (usedpages) {
- /* RX SGL present */
- struct af_alg_sgl *sgl_prev = &areq->last_rsgl->sgl;
- struct scatterlist *sg = sgl_prev->sgt.sgl;
-
- sg_unmark_end(sg + sgl_prev->sgt.nents - 1);
- sg_chain(sg, sgl_prev->sgt.nents + 1, areq->tsgl);
- } else
- /* no RX SGL present (e.g. authentication only) */
- rsgl_src = areq->tsgl;
- }
+ err = crypto_aead_copy_sgl(null_tfm, tsgl_src,
+ areq->first_rsgl.sgl.sgt.sgl,
+ ctx->aead_assoclen);
+ if (err)
+ goto free;
/* Initialize the crypto operation */
- aead_request_set_crypt(&areq->cra_u.aead_req, rsgl_src,
+ aead_request_set_crypt(&areq->cra_u.aead_req, tsgl_src,
areq->first_rsgl.sgl.sgt.sgl, used, ctx->iv);
aead_request_set_ad(&areq->cra_u.aead_req, ctx->aead_assoclen);
aead_request_set_tfm(&areq->cra_u.aead_req, tfm);
@@ -514,7 +449,7 @@ static void aead_sock_destruct(struct sock *sk)
struct crypto_aead *tfm = aeadc->aead;
unsigned int ivlen = crypto_aead_ivsize(tfm);
- af_alg_pull_tsgl(sk, ctx->used, NULL, 0);
+ af_alg_pull_tsgl(sk, ctx->used, NULL);
sock_kzfree_s(sk, ctx->iv, ivlen);
sock_kfree_s(sk, ctx, ctx->len);
af_alg_release_parent(sk);
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 097ad4f9a077..2ef20d9b3f44 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -95,7 +95,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
* Create a per request TX SGL for this request which tracks the
* SG entries from the global TX SGL.
*/
- areq->tsgl_entries = af_alg_count_tsgl(sk, len, 0);
+ areq->tsgl_entries = af_alg_count_tsgl(sk, len);
if (!areq->tsgl_entries)
areq->tsgl_entries = 1;
areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl),
@@ -106,7 +106,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
goto free;
}
sg_init_table(areq->tsgl, areq->tsgl_entries);
- af_alg_pull_tsgl(sk, len, areq->tsgl, 0);
+ af_alg_pull_tsgl(sk, len, areq->tsgl);
/* Initialize the crypto operation */
skcipher_request_set_tfm(&areq->cra_u.skcipher_req, tfm);
@@ -305,7 +305,7 @@ static void skcipher_sock_destruct(struct sock *sk)
struct alg_sock *pask = alg_sk(psk);
struct crypto_skcipher *tfm = pask->private;
- af_alg_pull_tsgl(sk, ctx->used, NULL, 0);
+ af_alg_pull_tsgl(sk, ctx->used, NULL);
sock_kzfree_s(sk, ctx->iv, crypto_skcipher_ivsize(tfm));
sock_kfree_s(sk, ctx, ctx->len);
af_alg_release_parent(sk);
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index 2e43d7704d1d..33da71c1d2a1 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -237,9 +237,8 @@ static inline bool af_alg_readable(struct sock *sk)
return PAGE_SIZE <= af_alg_rcvbuf(sk);
}
-unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset);
-void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
- size_t dst_offset);
+unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes);
+void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst);
void af_alg_wmem_wakeup(struct sock *sk);
int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min);
int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
--
2.25.1
2
1
Kuniyuki Iwashima (1):
tcp: Rearrange tests in inet_csk_bind_conflict().
Martin KaFai Lau (1):
udp: Fix wildcard bind conflict check when using hash2
include/net/inet_hashtables.h | 14 ++++++++
net/ipv4/inet_connection_sock.c | 58 ++++++++++++---------------------
net/ipv4/udp.c | 2 +-
3 files changed, 36 insertions(+), 38 deletions(-)
--
2.34.1
2
5
[PATCH openEuler-1.0-LTS] net: fix fanout UAF in packet_release() via NETDEV_UP race
by Li Xiasong 30 Apr '26
by Li Xiasong 30 Apr '26
30 Apr '26
From: Yochai Eisenrich <echelonh(a)gmail.com>
mainline inclusion
from mainline-v7.0-rc6
commit 42156f93d123436f2a27c468f18c966b7e5db796
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14240--cate
CVE: CVE-2026-31504
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
`packet_release()` has a race window where `NETDEV_UP` can re-register a
socket into a fanout group's `arr[]` array. The re-registration is not
cleaned up by `fanout_release()`, leaving a dangling pointer in the fanout
array.
`packet_release()` does NOT zero `po->num` in its `bind_lock` section.
After releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex`
still matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`
that already found the socket in `sklist` can re-register the hook.
For fanout sockets, this re-registration calls `__fanout_link(sk, po)`
which adds the socket back into `f->arr[]` and increments `f->num_members`,
but does NOT increment `f->sk_ref`.
The fix sets `po->num` to zero in `packet_release` while `bind_lock` is
held to prevent NETDEV_UP from linking, preventing the race window.
This bug was found following an additional audit with Claude Code based
on CVE-2025-38617.
Fixes: ce06b03e60fc ("packet: Add helpers to register/unregister ->prot_hook")
Link: https://blog.calif.io/p/a-race-within-a-race-exploiting-cve
Signed-off-by: Yochai Eisenrich <echelonh(a)gmail.com>
Reviewed-by: Willem de Bruijn <willemb(a)google.com>
Link: https://patch.msgid.link/20260319200610.25101-1-echelonh@gmail.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Conflicts:
net/packet/af_packet.c
[conflicts due to not merge f1d9268e0618 ("net: add net device refcount tracker to struct packet_type") and
d62607c3fe45 ("net: rename reference+tracking helpers") and
b3cb764aa1d7 ("net: drop nopreempt requirement on sock_prot_inuse_add()").]
Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com>
---
net/packet/af_packet.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 3938c9df92da..f8f8728cff53 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3052,6 +3052,7 @@ static int packet_release(struct socket *sock)
spin_lock(&po->bind_lock);
unregister_prot_hook(sk, false);
+ WRITE_ONCE(po->num, 0);
packet_cached_dev_reset(po);
if (po->prot_hook.dev) {
--
2.34.1
2
2
Pablo Neira Ayuso (2):
netfilter: nf_conntrack_expect: honor expectation helper field
netfilter: nf_conntrack_expect: use expect->helper
include/net/netfilter/nf_conntrack_expect.h | 2 +-
net/netfilter/nf_conntrack_broadcast.c | 2 +-
net/netfilter/nf_conntrack_expect.c | 16 +++++++++++--
net/netfilter/nf_conntrack_h323_main.c | 12 +++++-----
net/netfilter/nf_conntrack_helper.c | 11 +++++----
net/netfilter/nf_conntrack_netlink.c | 26 +++++++++------------
net/netfilter/nf_conntrack_sip.c | 4 ++--
7 files changed, 41 insertions(+), 32 deletions(-)
--
2.34.1
2
3
Hangbin Liu (1):
bonding: do not set usable_slaves for broadcast mode
Tonghao Zhang (1):
net: bonding: update the slave array for broadcast mode
Xiang Mei (1):
net: bonding: fix use-after-free in bond_xmit_broadcast()
drivers/net/bonding/bond_main.c | 32 ++++++++++++++++++++++----------
1 file changed, 22 insertions(+), 10 deletions(-)
--
2.34.1
2
4
[PATCH OLK-6.6] futex: Clear stale exiting pointer in futex_lock_pi() retry path
by Jiacheng Yu 29 Apr '26
by Jiacheng Yu 29 Apr '26
29 Apr '26
From: Davidlohr Bueso <dave(a)stgolabs.net>
stable inclusion
from stable-v6.6.131
commit de7c0c04ad868f2cee6671b11c0a6d20421af1da
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14301
CVE: CVE-2026-31555
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 210d36d892de5195e6766c45519dfb1e65f3eb83 upstream.
Fuzzying/stressing futexes triggered:
WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524
When futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY
and stores a refcounted task pointer in 'exiting'.
After wait_for_owner_exiting() consumes that reference, the local pointer
is never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a
different error, the bogus pointer is passed to wait_for_owner_exiting().
CPU0 CPU1 CPU2
futex_lock_pi(uaddr)
// acquires the PI futex
exit()
futex_cleanup_begin()
futex_state = EXITING;
futex_lock_pi(uaddr)
futex_lock_pi_atomic()
attach_to_pi_owner()
// observes EXITING
*exiting = owner; // takes ref
return -EBUSY
wait_for_owner_exiting(-EBUSY, owner)
put_task_struct(); // drops ref
// exiting still points to owner
goto retry;
futex_lock_pi_atomic()
lock_pi_update_atomic()
cmpxchg(uaddr)
*uaddr ^= WAITERS // whatever
// value changed
return -EAGAIN;
wait_for_owner_exiting(-EAGAIN, exiting) // stale
WARN_ON_ONCE(exiting)
Fix this by resetting upon retry, essentially aligning it with requeue_pi.
Fixes: 3ef240eaff36 ("futex: Prevent exit livelock")
Signed-off-by: Davidlohr Bueso <dave(a)stgolabs.net>
Signed-off-by: Thomas Gleixner <tglx(a)kernel.org>
Cc: stable(a)vger.kernel.org
Link: https://patch.msgid.link/20260326001759.4129680-1-dave@stgolabs.net
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com>
---
kernel/futex/pi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/futex/pi.c b/kernel/futex/pi.c
index ce2889f123755..9496084b6dcd8 100644
--- a/kernel/futex/pi.c
+++ b/kernel/futex/pi.c
@@ -930,9 +930,9 @@ int fixup_pi_owner(u32 __user *uaddr, struct futex_q *q, int locked)
int futex_lock_pi(u32 __user *uaddr, unsigned int flags, ktime_t *time, int trylock)
{
struct hrtimer_sleeper timeout, *to;
- struct task_struct *exiting = NULL;
struct rt_mutex_waiter rt_waiter;
struct futex_hash_bucket *hb;
+ struct task_struct *exiting;
struct futex_q q = futex_q_init;
int res, ret;
@@ -945,6 +945,7 @@ int futex_lock_pi(u32 __user *uaddr, unsigned int flags, ktime_t *time, int tryl
to = futex_setup_timer(time, &timeout, flags, 0);
retry:
+ exiting = NULL;
ret = get_futex_key(uaddr, flags & FLAGS_SHARED, &q.key, FUTEX_WRITE);
if (unlikely(ret != 0))
goto out;
--
2.43.0
2
1
[PATCH OLK-5.10] drivers:misc:sdma-dae: Write the CQ head pointer correctly.
by Jiacheng Yu 29 Apr '26
by Jiacheng Yu 29 Apr '26
29 Apr '26
From: wangzijian970910 <wangzijian22(a)huawei.com>
kunpeng inclusion
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14439
CVE: NA
-----------------------------------------------------------------
When writing the CQ head pointer for SDMA, the passed-in val
should be written to the register.However, the code currently
hardcodes the CQ head pointer to 1.This bug causes the CQ
head and tail pointers to never match during driver unloading,
resulting in an infinite loop.
Fixes: 42aacec658a8 ("drivers:misc:sdma-dae: optimize kernel code")
Signed-off-by: wangzijian970910 <wangzijian22(a)huawei.com>
---
drivers/misc/sdma-dae/sdma_hal.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/sdma-dae/sdma_hal.h b/drivers/misc/sdma-dae/sdma_hal.h
index 437fb755bca3c..8924ad0c5f103 100644
--- a/drivers/misc/sdma-dae/sdma_hal.h
+++ b/drivers/misc/sdma-dae/sdma_hal.h
@@ -270,7 +270,7 @@ static inline void sdma_channel_set_cq_head(struct hisi_sdma_channel *pchan, u32
u32 reg_val = readl(pchan->io_base + HISI_SDMA_CH_CQHDBR_REG);
reg_val &= ~HISI_SDMA_U32_MSK;
- reg_val |= FIELD_PREP(HISI_SDMA_U32_MSK, 1);
+ reg_val |= FIELD_PREP(HISI_SDMA_U32_MSK, val);
writel(reg_val, pchan->io_base + HISI_SDMA_CH_CQHDBR_REG);
}
--
2.43.0
2
4
[PATCH OLK-6.6] futex: Clear stale exiting pointer in futex_lock_pi() retry path
by Jiacheng Yu 29 Apr '26
by Jiacheng Yu 29 Apr '26
29 Apr '26
From: Davidlohr Bueso <dave(a)stgolabs.net>
stable inclusion
from stable-v6.6.131
commit de7c0c04ad868f2cee6671b11c0a6d20421af1da
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14301
CVE: CVE-2026-31555
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 210d36d892de5195e6766c45519dfb1e65f3eb83 upstream.
Fuzzying/stressing futexes triggered:
WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524
When futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY
and stores a refcounted task pointer in 'exiting'.
After wait_for_owner_exiting() consumes that reference, the local pointer
is never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a
different error, the bogus pointer is passed to wait_for_owner_exiting().
CPU0 CPU1 CPU2
futex_lock_pi(uaddr)
// acquires the PI futex
exit()
futex_cleanup_begin()
futex_state = EXITING;
futex_lock_pi(uaddr)
futex_lock_pi_atomic()
attach_to_pi_owner()
// observes EXITING
*exiting = owner; // takes ref
return -EBUSY
wait_for_owner_exiting(-EBUSY, owner)
put_task_struct(); // drops ref
// exiting still points to owner
goto retry;
futex_lock_pi_atomic()
lock_pi_update_atomic()
cmpxchg(uaddr)
*uaddr ^= WAITERS // whatever
// value changed
return -EAGAIN;
wait_for_owner_exiting(-EAGAIN, exiting) // stale
WARN_ON_ONCE(exiting)
Fix this by resetting upon retry, essentially aligning it with requeue_pi.
Fixes: 3ef240eaff36 ("futex: Prevent exit livelock")
Signed-off-by: Davidlohr Bueso <dave(a)stgolabs.net>
Signed-off-by: Thomas Gleixner <tglx(a)kernel.org>
Cc: stable(a)vger.kernel.org
Link: https://patch.msgid.link/20260326001759.4129680-1-dave@stgolabs.net
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com>
---
kernel/futex/pi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/futex/pi.c b/kernel/futex/pi.c
index ce2889f123755..9496084b6dcd8 100644
--- a/kernel/futex/pi.c
+++ b/kernel/futex/pi.c
@@ -930,9 +930,9 @@ int fixup_pi_owner(u32 __user *uaddr, struct futex_q *q, int locked)
int futex_lock_pi(u32 __user *uaddr, unsigned int flags, ktime_t *time, int trylock)
{
struct hrtimer_sleeper timeout, *to;
- struct task_struct *exiting = NULL;
struct rt_mutex_waiter rt_waiter;
struct futex_hash_bucket *hb;
+ struct task_struct *exiting;
struct futex_q q = futex_q_init;
int res, ret;
@@ -945,6 +945,7 @@ int futex_lock_pi(u32 __user *uaddr, unsigned int flags, ktime_t *time, int tryl
to = futex_setup_timer(time, &timeout, flags, 0);
retry:
+ exiting = NULL;
ret = get_futex_key(uaddr, flags & FLAGS_SHARED, &q.key, FUTEX_WRITE);
if (unlikely(ret != 0))
goto out;
--
2.43.0
2
1
[PATCH OLK-6.6] Bluetooth: hci_sync: fix double unlock in hci_discovery_filter_clear()
by Fanhua Li 29 Apr '26
by Fanhua Li 29 Apr '26
29 Apr '26
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/9070
--------------------------------
hci_discovery_filter_clear() acquires hdev->discovery.lock only once,
but due to the patch being applied repeatedly, spin_unlock() is called
twice. This leads to an unmatched unlock and may cause preempt count
underflow, resulting in scheduling warnings or other unexpected behavior.
Delete the extra spin_unlock() at the end of the function.
Fixes: ec03e0b8aa81 ("Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'")
Fixes: 5b70b93fc768 ("Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'")
Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com>
---
include/net/bluetooth/hci_core.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 9a15072d77f8..4d4923d43cb1 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -903,7 +903,6 @@ static inline void hci_discovery_filter_clear(struct hci_dev *hdev)
hdev->discovery.scan_start = 0;
hdev->discovery.scan_duration = 0;
- spin_unlock(&hdev->discovery.lock);
}
bool hci_discovery_active(struct hci_dev *hdev);
--
2.43.0
2
1
[PATCH OLK-6.6] device property: Make modifications of fwnode "flags" thread safe
by Chen Jinghuang 29 Apr '26
by Chen Jinghuang 29 Apr '26
29 Apr '26
From: Douglas Anderson <dianders(a)chromium.org>
mainline inclusion
fromt mainline-v7.1-rc2
commit f72e77c33e4b5657af35125e75bab249256030f3
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/9069
CVE: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
----------------------------------------------------------------------
In various places in the kernel, we modify the fwnode "flags" member
by doing either:
fwnode->flags |= SOME_FLAG;
fwnode->flags &= ~SOME_FLAG;
This type of modification is not thread-safe. If two threads are both
mucking with the flags at the same time then one can clobber the
other.
While flags are often modified while under the "fwnode_link_lock",
this is not universally true.
Create some accessor functions for setting, clearing, and testing the
FWNODE flags and move all users to these accessor functions. New
accessor functions use set_bit() and clear_bit(), which are
thread-safe.
Cc: stable(a)vger.kernel.org
Fixes: c2c724c868c4 ("driver core: Add fw_devlink_parse_fwtree()")
Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Acked-by: Mark Brown <broonie(a)kernel.org>
Reviewed-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com>
Signed-off-by: Douglas Anderson <dianders(a)chromium.org>
Reviewed-by: Rafael J. Wysocki (Intel) <rafael(a)kernel.org>
Reviewed-by: Saravana Kannan <saravanak(a)kernel.org>
Link: https://patch.msgid.link/20260317090112.v2.1.I0a4d03104ecd5103df3d76f66c8d2…
[ Fix fwnode_clear_flag() argument alignment, restore dropped blank
line in fwnode_dev_initialized(), and remove unnecessary parentheses
around fwnode_test_flag() calls. - Danilo ]
Signed-off-by: Danilo Krummrich <dakr(a)kernel.org>
Conflicts:
include/linux/fwnode.h
drivers/of/platform.c
[context conflicts]
Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com>
---
drivers/base/core.c | 24 ++++++++++-----------
drivers/bus/imx-weim.c | 2 +-
drivers/i2c/i2c-core-of.c | 2 +-
drivers/of/base.c | 2 +-
drivers/of/dynamic.c | 2 +-
drivers/of/platform.c | 2 +-
drivers/spi/spi.c | 2 +-
include/linux/fwnode.h | 45 ++++++++++++++++++++++++++++-----------
8 files changed, 51 insertions(+), 30 deletions(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 8a4c3bc7bafa..35bcac9b6597 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -191,7 +191,7 @@ void fw_devlink_purge_absent_suppliers(struct fwnode_handle *fwnode)
if (fwnode->dev)
return;
- fwnode->flags |= FWNODE_FLAG_NOT_DEVICE;
+ fwnode_set_flag(fwnode, FWNODE_FLAG_NOT_DEVICE);
fwnode_links_purge_consumers(fwnode);
fwnode_for_each_available_child_node(fwnode, child)
@@ -237,7 +237,7 @@ static void __fw_devlink_pickup_dangling_consumers(struct fwnode_handle *fwnode,
if (fwnode->dev && fwnode->dev->bus)
return;
- fwnode->flags |= FWNODE_FLAG_NOT_DEVICE;
+ fwnode_set_flag(fwnode, FWNODE_FLAG_NOT_DEVICE);
__fwnode_links_move_consumers(fwnode, new_sup);
fwnode_for_each_available_child_node(fwnode, child)
@@ -1019,7 +1019,7 @@ static void device_links_missing_supplier(struct device *dev)
static bool dev_is_best_effort(struct device *dev)
{
return (fw_devlink_best_effort && dev->can_match) ||
- (dev->fwnode && (dev->fwnode->flags & FWNODE_FLAG_BEST_EFFORT));
+ (dev->fwnode && fwnode_test_flag(dev->fwnode, FWNODE_FLAG_BEST_EFFORT));
}
static struct fwnode_handle *fwnode_links_check_suppliers(
@@ -1735,11 +1735,11 @@ bool fw_devlink_is_strict(void)
static void fw_devlink_parse_fwnode(struct fwnode_handle *fwnode)
{
- if (fwnode->flags & FWNODE_FLAG_LINKS_ADDED)
+ if (fwnode_test_flag(fwnode, FWNODE_FLAG_LINKS_ADDED))
return;
fwnode_call_int_op(fwnode, add_links);
- fwnode->flags |= FWNODE_FLAG_LINKS_ADDED;
+ fwnode_set_flag(fwnode, FWNODE_FLAG_LINKS_ADDED);
}
static void fw_devlink_parse_fwtree(struct fwnode_handle *fwnode)
@@ -1898,7 +1898,7 @@ static bool fwnode_init_without_drv(struct fwnode_handle *fwnode)
struct device *dev;
bool ret;
- if (!(fwnode->flags & FWNODE_FLAG_INITIALIZED))
+ if (!fwnode_test_flag(fwnode, FWNODE_FLAG_INITIALIZED))
return false;
dev = get_dev_from_fwnode(fwnode);
@@ -1957,10 +1957,10 @@ static bool __fw_devlink_relax_cycles(struct fwnode_handle *con_handle,
* We aren't trying to find all cycles. Just a cycle between con and
* sup_handle.
*/
- if (sup_handle->flags & FWNODE_FLAG_VISITED)
+ if (fwnode_test_flag(sup_handle, FWNODE_FLAG_VISITED))
return false;
- sup_handle->flags |= FWNODE_FLAG_VISITED;
+ fwnode_set_flag(sup_handle, FWNODE_FLAG_VISITED);
/* Termination condition. */
if (sup_handle == con_handle) {
@@ -2030,7 +2030,7 @@ static bool __fw_devlink_relax_cycles(struct fwnode_handle *con_handle,
}
out:
- sup_handle->flags &= ~FWNODE_FLAG_VISITED;
+ fwnode_clear_flag(sup_handle, FWNODE_FLAG_VISITED);
put_device(sup_dev);
put_device(con_dev);
put_device(par_dev);
@@ -2083,7 +2083,7 @@ static int fw_devlink_create_devlink(struct device *con,
* When such a flag is set, we can't create device links where P is the
* supplier of C as that would delay the probe of C.
*/
- if (sup_handle->flags & FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD &&
+ if (fwnode_test_flag(sup_handle, FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD) &&
fwnode_is_ancestor_of(sup_handle, con->fwnode))
return -EINVAL;
@@ -2106,7 +2106,7 @@ static int fw_devlink_create_devlink(struct device *con,
else
flags = FW_DEVLINK_FLAGS_PERMISSIVE;
- if (sup_handle->flags & FWNODE_FLAG_NOT_DEVICE)
+ if (fwnode_test_flag(sup_handle, FWNODE_FLAG_NOT_DEVICE))
sup_dev = fwnode_get_next_parent_dev(sup_handle);
else
sup_dev = get_dev_from_fwnode(sup_handle);
@@ -2118,7 +2118,7 @@ static int fw_devlink_create_devlink(struct device *con,
* supplier device indefinitely.
*/
if (sup_dev->links.status == DL_DEV_NO_DRIVER &&
- sup_handle->flags & FWNODE_FLAG_INITIALIZED) {
+ fwnode_test_flag(sup_handle, FWNODE_FLAG_INITIALIZED)) {
dev_dbg(con,
"Not linking %pfwf - dev might never probe\n",
sup_handle);
diff --git a/drivers/bus/imx-weim.c b/drivers/bus/imx-weim.c
index f9fd1582f150..5244013d328f 100644
--- a/drivers/bus/imx-weim.c
+++ b/drivers/bus/imx-weim.c
@@ -335,7 +335,7 @@ static int of_weim_notify(struct notifier_block *nb, unsigned long action,
* fw_devlink doesn't skip adding consumers to this
* device.
*/
- rd->dn->fwnode.flags &= ~FWNODE_FLAG_NOT_DEVICE;
+ fwnode_clear_flag(&rd->dn->fwnode, FWNODE_FLAG_NOT_DEVICE);
if (!of_platform_device_create(rd->dn, NULL, &pdev->dev)) {
dev_err(&pdev->dev,
"Failed to create child device '%pOF'\n",
diff --git a/drivers/i2c/i2c-core-of.c b/drivers/i2c/i2c-core-of.c
index a6c407d36800..50e97e2ed2cf 100644
--- a/drivers/i2c/i2c-core-of.c
+++ b/drivers/i2c/i2c-core-of.c
@@ -182,7 +182,7 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action,
* Clear the flag before adding the device so that fw_devlink
* doesn't skip adding consumers to this device.
*/
- rd->dn->fwnode.flags &= ~FWNODE_FLAG_NOT_DEVICE;
+ fwnode_clear_flag(&rd->dn->fwnode, FWNODE_FLAG_NOT_DEVICE);
client = of_i2c_register_device(adap, rd->dn);
if (IS_ERR(client)) {
dev_err(&adap->dev, "failed to create client for '%pOF'\n",
diff --git a/drivers/of/base.c b/drivers/of/base.c
index ccadc22f18c0..bbe05053c7f1 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1759,7 +1759,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
if (name)
of_stdout = of_find_node_opts_by_path(name, &of_stdout_options);
if (of_stdout)
- of_stdout->fwnode.flags |= FWNODE_FLAG_BEST_EFFORT;
+ fwnode_set_flag(&of_stdout->fwnode, FWNODE_FLAG_BEST_EFFORT);
}
if (!of_aliases)
diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index 18393800546c..ab109bb92cf4 100644
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -224,7 +224,7 @@ static void __of_attach_node(struct device_node *np)
np->sibling = np->parent->child;
np->parent->child = np;
of_node_clear_flag(np, OF_DETACHED);
- np->fwnode.flags |= FWNODE_FLAG_NOT_DEVICE;
+ fwnode_set_flag(&np->fwnode, FWNODE_FLAG_NOT_DEVICE);
raw_spin_unlock_irqrestore(&devtree_lock, flags);
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 89a44f6bdc7e..77940d41d101 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -788,7 +788,7 @@ static int of_platform_notify(struct notifier_block *nb,
* Clear the flag before adding the device so that fw_devlink
* doesn't skip adding consumers to this device.
*/
- rd->dn->fwnode.flags &= ~FWNODE_FLAG_NOT_DEVICE;
+ fwnode_clear_flag(&rd->dn->fwnode, FWNODE_FLAG_NOT_DEVICE);
/* pdev_parent may be NULL when no bus platform device */
pdev_parent = of_find_device_by_node(rd->dn->parent);
pdev = of_platform_device_create(rd->dn, NULL,
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 2ca4ea45e3b2..9ec4426ffe1b 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -4528,7 +4528,7 @@ static int of_spi_notify(struct notifier_block *nb, unsigned long action,
* Clear the flag before adding the device so that fw_devlink
* doesn't skip adding consumers to this device.
*/
- rd->dn->fwnode.flags &= ~FWNODE_FLAG_NOT_DEVICE;
+ fwnode_clear_flag(&rd->dn->fwnode, FWNODE_FLAG_NOT_DEVICE);
spi = of_register_spi_device(ctlr, rd->dn);
put_device(&ctlr->dev);
diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h
index ec86debcefe5..4ab0682ae3bf 100644
--- a/include/linux/fwnode.h
+++ b/include/linux/fwnode.h
@@ -12,6 +12,7 @@
#include <linux/types.h>
#include <linux/list.h>
#include <linux/bits.h>
+#include <linux/bitops.h>
#include <linux/err.h>
#include <linux/kabi.h>
@@ -32,12 +33,12 @@ struct device;
* suppliers. Only enforce ordering with suppliers that have
* drivers.
*/
-#define FWNODE_FLAG_LINKS_ADDED BIT(0)
-#define FWNODE_FLAG_NOT_DEVICE BIT(1)
-#define FWNODE_FLAG_INITIALIZED BIT(2)
-#define FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD BIT(3)
-#define FWNODE_FLAG_BEST_EFFORT BIT(4)
-#define FWNODE_FLAG_VISITED BIT(5)
+#define FWNODE_FLAG_LINKS_ADDED 0
+#define FWNODE_FLAG_NOT_DEVICE 1
+#define FWNODE_FLAG_INITIALIZED 2
+#define FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD 3
+#define FWNODE_FLAG_BEST_EFFORT 4
+#define FWNODE_FLAG_VISITED 5
struct fwnode_handle {
struct fwnode_handle *secondary;
@@ -45,8 +46,7 @@ struct fwnode_handle {
struct device *dev;
struct list_head suppliers;
struct list_head consumers;
- u8 flags;
- KABI_RESERVE(1)
+ KABI_USE(1, unsigned long flags)
KABI_RESERVE(2)
};
@@ -204,16 +204,37 @@ static inline void fwnode_init(struct fwnode_handle *fwnode,
INIT_LIST_HEAD(&fwnode->suppliers);
}
+static inline void fwnode_set_flag(struct fwnode_handle *fwnode,
+ unsigned int bit)
+{
+ set_bit(bit, &fwnode->flags);
+}
+
+static inline void fwnode_clear_flag(struct fwnode_handle *fwnode,
+ unsigned int bit)
+{
+ clear_bit(bit, &fwnode->flags);
+}
+
+static inline void fwnode_assign_flag(struct fwnode_handle *fwnode,
+ unsigned int bit, bool value)
+{
+ assign_bit(bit, &fwnode->flags, value);
+}
+
+static inline bool fwnode_test_flag(struct fwnode_handle *fwnode,
+ unsigned int bit)
+{
+ return test_bit(bit, &fwnode->flags);
+}
+
static inline void fwnode_dev_initialized(struct fwnode_handle *fwnode,
bool initialized)
{
if (IS_ERR_OR_NULL(fwnode))
return;
- if (initialized)
- fwnode->flags |= FWNODE_FLAG_INITIALIZED;
- else
- fwnode->flags &= ~FWNODE_FLAG_INITIALIZED;
+ fwnode_assign_flag(fwnode, FWNODE_FLAG_INITIALIZED, initialized);
}
extern bool fw_devlink_is_strict(void);
--
2.34.1
2
1
[PATCH OLK-6.6 0/1] Revert "cpufreq: Fix re-boost issue after hotplugging a CPU"
by Lifeng Zheng 29 Apr '26
by Lifeng Zheng 29 Apr '26
29 Apr '26
From: Hongye Lin <linhongye(a)h-partners.com>
driver inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/8995
----------------------------------------------------------------------
Lifeng Zheng (1):
Revert "cpufreq: Fix re-boost issue after hotplugging a CPU"
drivers/cpufreq/cpufreq.c | 4 ----
1 file changed, 4 deletions(-)
--
2.33.0
2
2
[PATCH OLK-6.6 0/1] cpufreq: conservative: Reset requested_freq on limits change
by Lifeng Zheng 29 Apr '26
by Lifeng Zheng 29 Apr '26
29 Apr '26
From: Hongye Lin <linhongye(a)h-partners.com>
mainline inclusion
from mainline-v7.0-rc6
commit 6a28fb8cb28b9eb39a392e531d938a889eacafc5
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/8993
CVE: NA
Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm…
----------------------------------------------------------------------
A recently reported issue highlighted that the cached requested_freq
is not guaranteed to stay in sync with policy->cur. If the platform
changes the actual CPU frequency after the governor sets one (e.g.
due to platform-specific frequency scaling) and a re-sync occurs
later, policy->cur may diverge from requested_freq.
This can lead to incorrect behavior in the conservative governor.
For example, the governor may assume the CPU is already running at
the maximum frequency and skip further increases even though there
is still headroom.
Avoid this by resetting the cached requested_freq to policy->cur on
detecting a change in policy limits.
Viresh Kumar (1):
cpufreq: conservative: Reset requested_freq on limits change
drivers/cpufreq/cpufreq_conservative.c | 12 ++++++++++++
drivers/cpufreq/cpufreq_governor.c | 3 +++
drivers/cpufreq/cpufreq_governor.h | 1 +
3 files changed, 16 insertions(+)
--
2.33.0
2
2
[PATCH OLK-5.10] NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
by Li Lingfeng 29 Apr '26
by Li Lingfeng 29 Apr '26
29 Apr '26
From: Chuck Lever <chuck.lever(a)oracle.com>
stable inclusion
from stable-v5.10.253
commit 76740c28050dc6db2f5550f1325b00a11bbb3255
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14129
CVE: CVE-2026-31403
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit e7fcf179b82d3a3730fd8615da01b087cc654d0b ]
The /proc/fs/nfs/exports proc entry is created at module init
and persists for the module's lifetime. exports_proc_open()
captures the caller's current network namespace and stores
its svc_export_cache in seq->private, but takes no reference
on the namespace. If the namespace is subsequently torn down
(e.g. container destruction after the opener does setns() to a
different namespace), nfsd_net_exit() calls nfsd_export_shutdown()
which frees the cache. Subsequent reads on the still-open fd
dereference the freed cache_detail, walking a freed hash table.
Hold a reference on the struct net for the lifetime of the open
file descriptor. This prevents nfsd_net_exit() from running --
and thus prevents nfsd_export_shutdown() from freeing the cache
-- while any exports fd is open. cache_detail already stores
its net pointer (cd->net, set by cache_create_net()), so
exports_release() can retrieve it without additional per-file
storage.
Reported-by: Misbah Anjum N <misanjum(a)linux.ibm.com>
Closes: https://lore.kernel.org/linux-nfs/dcd371d3a95815a84ba7de52cef447b8@linux.ib…
Fixes: 96d851c4d28d ("nfsd: use proper net while reading "exports" file")
Cc: stable(a)vger.kernel.org
Reviewed-by: Jeff Layton <jlayton(a)kernel.org>
Reviewed-by: NeilBrown <neil(a)brown.name>
Tested-by: Olga Kornievskaia <okorniev(a)redhat.com>
Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Conflicts:
fs/nfsd/nfsctl.c
[Commit 97a32539b956 ("proc: convert everything to "struct proc_ops"")
convert exports_proc_operations to exports_proc_ops.]
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
fs/nfsd/nfsctl.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index e84c8cf8e2c0..2bfd200bcd05 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -149,9 +149,19 @@ static int exports_net_open(struct net *net, struct file *file)
seq = file->private_data;
seq->private = nn->svc_export_cache;
+ get_net(net);
return 0;
}
+static int exports_release(struct inode *inode, struct file *file)
+{
+ struct seq_file *seq = file->private_data;
+ struct cache_detail *cd = seq->private;
+
+ put_net(cd->net);
+ return seq_release(inode, file);
+}
+
static int exports_proc_open(struct inode *inode, struct file *file)
{
return exports_net_open(current->nsproxy->net_ns, file);
@@ -161,7 +171,7 @@ static const struct proc_ops exports_proc_ops = {
.proc_open = exports_proc_open,
.proc_read = seq_read,
.proc_lseek = seq_lseek,
- .proc_release = seq_release,
+ .proc_release = exports_release,
};
static int exports_nfsd_open(struct inode *inode, struct file *file)
@@ -173,7 +183,7 @@ static const struct file_operations exports_nfsd_operations = {
.open = exports_nfsd_open,
.read = seq_read,
.llseek = seq_lseek,
- .release = seq_release,
+ .release = exports_release,
};
static int export_features_show(struct seq_file *m, void *v)
--
2.52.0
2
1
[PATCH OLK-6.6] KVM: x86: Use scratch field in MMIO fragment to hold small write values
by Xinyu Zheng 29 Apr '26
by Xinyu Zheng 29 Apr '26
29 Apr '26
From: Sean Christopherson <seanjc(a)google.com>
mainline inclusion
from mainline-v7.1-rc1
commit 0b16e69d17d8c35c5c9d5918bf596c75a44655d3
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14416
CVE: CVE-2026-31588
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
When exiting to userspace to service an emulated MMIO write, copy the
to-be-written value to a scratch field in the MMIO fragment if the size
of the data payload is 8 bytes or less, i.e. can fit in a single chunk,
instead of pointing the fragment directly at the source value.
This fixes a class of use-after-free bugs that occur when the emulator
initiates a write using an on-stack, local variable as the source, the
write splits a page boundary, *and* both pages are MMIO pages. Because
KVM's ABI only allows for physically contiguous MMIO requests, accesses
that split MMIO pages are separated into two fragments, and are sent to
userspace one at a time. When KVM attempts to complete userspace MMIO in
response to KVM_RUN after the first fragment, KVM will detect the second
fragment and generate a second userspace exit, and reference the on-stack
variable.
The issue is most visible if the second KVM_RUN is performed by a separate
task, in which case the stack of the initiating task can show up as truly
freed data.
==================================================================
BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420
Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984
CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace:
dump_stack+0xbe/0xfd
print_address_description.constprop.0+0x19/0x170
__kasan_report.cold+0x6c/0x84
kasan_report+0x3a/0x50
check_memory_region+0xfd/0x1f0
memcpy+0x20/0x60
complete_emulated_mmio+0x305/0x420
kvm_arch_vcpu_ioctl_run+0x63f/0x6d0
kvm_vcpu_ioctl+0x413/0xb20
__se_sys_ioctl+0x111/0x160
do_syscall_64+0x30/0x40
entry_SYSCALL_64_after_hwframe+0x67/0xd1
RIP: 0033:0x42477d
Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c
R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720
The buggy address belongs to the page:
page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c37
flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
The bug can also be reproduced with a targeted KVM-Unit-Test by hacking
KVM to fill a large on-stack variable in complete_emulated_mmio(), i.e. by
overwrite the data value with garbage.
Limit the use of the scratch fields to 8-byte or smaller accesses, and to
just writes, as larger accesses and reads are not affected thanks to
implementation details in the emulator, but add a sanity check to ensure
those details don't change in the future. Specifically, KVM never uses
on-stack variables for accesses larger that 8 bytes, e.g. uses an operand
in the emulator context, and *all* reads are buffered through the mem_read
cache.
Note! Using the scratch field for reads is not only unnecessary, it's
also extremely difficult to handle correctly. As above, KVM buffers all
reads through the mem_read cache, and heavily relies on that behavior when
re-emulating the instruction after a userspace MMIO read exit. If a read
splits a page, the first page is NOT an MMIO page, and the second page IS
an MMIO page, then the MMIO fragment needs to point at _just_ the second
chunk of the destination, i.e. its position in the mem_read cache. Taking
the "obvious" approach of copying the fragment value into the destination
when re-emulating the instruction would clobber the first chunk of the
destination, i.e. would clobber the data that was read from guest memory.
Fixes: f78146b0f923 ("KVM: Fix page-crossing MMIO")
Suggested-by: Yashu Zhang <zhangjiaji1(a)huawei.com>
Reported-by: Yashu Zhang <zhangjiaji1(a)huawei.com>
Closes: https://lore.kernel.org/all/369eaaa2b3c1425c85e8477066391bc7@huawei.com
Cc: stable(a)vger.kernel.org
Tested-by: Tom Lendacky <thomas.lendacky(a)gmail.com>
Tested-by: Rick Edgecombe <rick.p.edgecombe(a)intel.com>
Link: https://patch.msgid.link/20260225012049.920665-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc(a)google.com>
Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com>
---
arch/x86/kvm/x86.c | 14 +++++++++++++-
include/linux/kvm_host.h | 3 ++-
2 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 947dae594ddb..18b733c8bb5f 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7814,7 +7814,13 @@ static int emulator_read_write_onepage(unsigned long addr, void *val,
WARN_ON(vcpu->mmio_nr_fragments >= KVM_MAX_MMIO_FRAGMENTS);
frag = &vcpu->mmio_fragments[vcpu->mmio_nr_fragments++];
frag->gpa = gpa;
- frag->data = val;
+ if (write && bytes <= 8u) {
+ frag->val = 0;
+ frag->data = &frag->val;
+ memcpy(&frag->val, val, bytes);
+ } else {
+ frag->data = val;
+ }
frag->len = bytes;
return X86EMUL_CONTINUE;
}
@@ -7829,6 +7835,9 @@ static int emulator_read_write(struct x86_emulate_ctxt *ctxt,
gpa_t gpa;
int rc;
+ if (WARN_ON_ONCE((bytes > 8u || !ops->write) && object_is_on_stack(val)))
+ return X86EMUL_UNHANDLEABLE;
+
if (ops->read_write_prepare &&
ops->read_write_prepare(vcpu, val, bytes))
return X86EMUL_CONTINUE;
@@ -11272,6 +11281,9 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
frag++;
vcpu->mmio_cur_fragment++;
} else {
+ if (WARN_ON_ONCE(frag->data == &frag->val))
+ return -EIO;
+
/* Go forward to the next mmio piece. */
frag->data += len;
frag->gpa += len;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 480196639480..ae7053b044f7 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -317,7 +317,8 @@ static inline bool kvm_vcpu_can_poll(ktime_t cur, ktime_t stop)
struct kvm_mmio_fragment {
gpa_t gpa;
void *data;
- unsigned len;
+ u64 val;
+ unsigned int len;
};
struct kvm_vcpu {
--
2.34.1
2
1
[PATCH OLK-5.10] KVM: x86: Use scratch field in MMIO fragment to hold small write values
by Xinyu Zheng 29 Apr '26
by Xinyu Zheng 29 Apr '26
29 Apr '26
From: Sean Christopherson <seanjc(a)google.com>
mainline inclusion
from mainline-v7.1-rc1
commit 0b16e69d17d8c35c5c9d5918bf596c75a44655d3
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14416
CVE: CVE-2026-31588
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
When exiting to userspace to service an emulated MMIO write, copy the
to-be-written value to a scratch field in the MMIO fragment if the size
of the data payload is 8 bytes or less, i.e. can fit in a single chunk,
instead of pointing the fragment directly at the source value.
This fixes a class of use-after-free bugs that occur when the emulator
initiates a write using an on-stack, local variable as the source, the
write splits a page boundary, *and* both pages are MMIO pages. Because
KVM's ABI only allows for physically contiguous MMIO requests, accesses
that split MMIO pages are separated into two fragments, and are sent to
userspace one at a time. When KVM attempts to complete userspace MMIO in
response to KVM_RUN after the first fragment, KVM will detect the second
fragment and generate a second userspace exit, and reference the on-stack
variable.
The issue is most visible if the second KVM_RUN is performed by a separate
task, in which case the stack of the initiating task can show up as truly
freed data.
==================================================================
BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420
Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984
CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace:
dump_stack+0xbe/0xfd
print_address_description.constprop.0+0x19/0x170
__kasan_report.cold+0x6c/0x84
kasan_report+0x3a/0x50
check_memory_region+0xfd/0x1f0
memcpy+0x20/0x60
complete_emulated_mmio+0x305/0x420
kvm_arch_vcpu_ioctl_run+0x63f/0x6d0
kvm_vcpu_ioctl+0x413/0xb20
__se_sys_ioctl+0x111/0x160
do_syscall_64+0x30/0x40
entry_SYSCALL_64_after_hwframe+0x67/0xd1
RIP: 0033:0x42477d
Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c
R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720
The buggy address belongs to the page:
page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c37
flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
The bug can also be reproduced with a targeted KVM-Unit-Test by hacking
KVM to fill a large on-stack variable in complete_emulated_mmio(), i.e. by
overwrite the data value with garbage.
Limit the use of the scratch fields to 8-byte or smaller accesses, and to
just writes, as larger accesses and reads are not affected thanks to
implementation details in the emulator, but add a sanity check to ensure
those details don't change in the future. Specifically, KVM never uses
on-stack variables for accesses larger that 8 bytes, e.g. uses an operand
in the emulator context, and *all* reads are buffered through the mem_read
cache.
Note! Using the scratch field for reads is not only unnecessary, it's
also extremely difficult to handle correctly. As above, KVM buffers all
reads through the mem_read cache, and heavily relies on that behavior when
re-emulating the instruction after a userspace MMIO read exit. If a read
splits a page, the first page is NOT an MMIO page, and the second page IS
an MMIO page, then the MMIO fragment needs to point at _just_ the second
chunk of the destination, i.e. its position in the mem_read cache. Taking
the "obvious" approach of copying the fragment value into the destination
when re-emulating the instruction would clobber the first chunk of the
destination, i.e. would clobber the data that was read from guest memory.
Fixes: f78146b0f923 ("KVM: Fix page-crossing MMIO")
Suggested-by: Yashu Zhang <zhangjiaji1(a)huawei.com>
Reported-by: Yashu Zhang <zhangjiaji1(a)huawei.com>
Closes: https://lore.kernel.org/all/369eaaa2b3c1425c85e8477066391bc7@huawei.com
Cc: stable(a)vger.kernel.org
Tested-by: Tom Lendacky <thomas.lendacky(a)gmail.com>
Tested-by: Rick Edgecombe <rick.p.edgecombe(a)intel.com>
Link: https://patch.msgid.link/20260225012049.920665-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc(a)google.com>
Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com>
---
arch/x86/kvm/x86.c | 14 +++++++++++++-
include/linux/kvm_host.h | 3 ++-
2 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 947dae594ddb..18b733c8bb5f 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7814,7 +7814,13 @@ static int emulator_read_write_onepage(unsigned long addr, void *val,
WARN_ON(vcpu->mmio_nr_fragments >= KVM_MAX_MMIO_FRAGMENTS);
frag = &vcpu->mmio_fragments[vcpu->mmio_nr_fragments++];
frag->gpa = gpa;
- frag->data = val;
+ if (write && bytes <= 8u) {
+ frag->val = 0;
+ frag->data = &frag->val;
+ memcpy(&frag->val, val, bytes);
+ } else {
+ frag->data = val;
+ }
frag->len = bytes;
return X86EMUL_CONTINUE;
}
@@ -7829,6 +7835,9 @@ static int emulator_read_write(struct x86_emulate_ctxt *ctxt,
gpa_t gpa;
int rc;
+ if (WARN_ON_ONCE((bytes > 8u || !ops->write) && object_is_on_stack(val)))
+ return X86EMUL_UNHANDLEABLE;
+
if (ops->read_write_prepare &&
ops->read_write_prepare(vcpu, val, bytes))
return X86EMUL_CONTINUE;
@@ -11272,6 +11281,9 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
frag++;
vcpu->mmio_cur_fragment++;
} else {
+ if (WARN_ON_ONCE(frag->data == &frag->val))
+ return -EIO;
+
/* Go forward to the next mmio piece. */
frag->data += len;
frag->gpa += len;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 480196639480..ae7053b044f7 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -317,7 +317,8 @@ static inline bool kvm_vcpu_can_poll(ktime_t cur, ktime_t stop)
struct kvm_mmio_fragment {
gpa_t gpa;
void *data;
- unsigned len;
+ u64 val;
+ unsigned int len;
};
struct kvm_vcpu {
--
2.34.1
2
1
[PATCH OLK-5.10] [Backport] KVM: x86: Use scratch field in MMIO fragment to hold small write values
by Xinyu Zheng 29 Apr '26
by Xinyu Zheng 29 Apr '26
29 Apr '26
From: Sean Christopherson <seanjc(a)google.com>
mainline inclusion
from mainline-v7.1-rc1
commit 0b16e69d17d8c35c5c9d5918bf596c75a44655d3
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14416
CVE: CVE-2026-31588
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
When exiting to userspace to service an emulated MMIO write, copy the
to-be-written value to a scratch field in the MMIO fragment if the size
of the data payload is 8 bytes or less, i.e. can fit in a single chunk,
instead of pointing the fragment directly at the source value.
This fixes a class of use-after-free bugs that occur when the emulator
initiates a write using an on-stack, local variable as the source, the
write splits a page boundary, *and* both pages are MMIO pages. Because
KVM's ABI only allows for physically contiguous MMIO requests, accesses
that split MMIO pages are separated into two fragments, and are sent to
userspace one at a time. When KVM attempts to complete userspace MMIO in
response to KVM_RUN after the first fragment, KVM will detect the second
fragment and generate a second userspace exit, and reference the on-stack
variable.
The issue is most visible if the second KVM_RUN is performed by a separate
task, in which case the stack of the initiating task can show up as truly
freed data.
==================================================================
BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420
Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984
CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace:
dump_stack+0xbe/0xfd
print_address_description.constprop.0+0x19/0x170
__kasan_report.cold+0x6c/0x84
kasan_report+0x3a/0x50
check_memory_region+0xfd/0x1f0
memcpy+0x20/0x60
complete_emulated_mmio+0x305/0x420
kvm_arch_vcpu_ioctl_run+0x63f/0x6d0
kvm_vcpu_ioctl+0x413/0xb20
__se_sys_ioctl+0x111/0x160
do_syscall_64+0x30/0x40
entry_SYSCALL_64_after_hwframe+0x67/0xd1
RIP: 0033:0x42477d
Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c
R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720
The buggy address belongs to the page:
page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c37
flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
The bug can also be reproduced with a targeted KVM-Unit-Test by hacking
KVM to fill a large on-stack variable in complete_emulated_mmio(), i.e. by
overwrite the data value with garbage.
Limit the use of the scratch fields to 8-byte or smaller accesses, and to
just writes, as larger accesses and reads are not affected thanks to
implementation details in the emulator, but add a sanity check to ensure
those details don't change in the future. Specifically, KVM never uses
on-stack variables for accesses larger that 8 bytes, e.g. uses an operand
in the emulator context, and *all* reads are buffered through the mem_read
cache.
Note! Using the scratch field for reads is not only unnecessary, it's
also extremely difficult to handle correctly. As above, KVM buffers all
reads through the mem_read cache, and heavily relies on that behavior when
re-emulating the instruction after a userspace MMIO read exit. If a read
splits a page, the first page is NOT an MMIO page, and the second page IS
an MMIO page, then the MMIO fragment needs to point at _just_ the second
chunk of the destination, i.e. its position in the mem_read cache. Taking
the "obvious" approach of copying the fragment value into the destination
when re-emulating the instruction would clobber the first chunk of the
destination, i.e. would clobber the data that was read from guest memory.
Fixes: f78146b0f923 ("KVM: Fix page-crossing MMIO")
Suggested-by: Yashu Zhang <zhangjiaji1(a)huawei.com>
Reported-by: Yashu Zhang <zhangjiaji1(a)huawei.com>
Closes: https://lore.kernel.org/all/369eaaa2b3c1425c85e8477066391bc7@huawei.com
Cc: stable(a)vger.kernel.org
Tested-by: Tom Lendacky <thomas.lendacky(a)gmail.com>
Tested-by: Rick Edgecombe <rick.p.edgecombe(a)intel.com>
Link: https://patch.msgid.link/20260225012049.920665-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc(a)google.com>
Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com>
---
arch/x86/kvm/x86.c | 14 +++++++++++++-
include/linux/kvm_host.h | 3 ++-
2 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 947dae594ddb..18b733c8bb5f 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7814,7 +7814,13 @@ static int emulator_read_write_onepage(unsigned long addr, void *val,
WARN_ON(vcpu->mmio_nr_fragments >= KVM_MAX_MMIO_FRAGMENTS);
frag = &vcpu->mmio_fragments[vcpu->mmio_nr_fragments++];
frag->gpa = gpa;
- frag->data = val;
+ if (write && bytes <= 8u) {
+ frag->val = 0;
+ frag->data = &frag->val;
+ memcpy(&frag->val, val, bytes);
+ } else {
+ frag->data = val;
+ }
frag->len = bytes;
return X86EMUL_CONTINUE;
}
@@ -7829,6 +7835,9 @@ static int emulator_read_write(struct x86_emulate_ctxt *ctxt,
gpa_t gpa;
int rc;
+ if (WARN_ON_ONCE((bytes > 8u || !ops->write) && object_is_on_stack(val)))
+ return X86EMUL_UNHANDLEABLE;
+
if (ops->read_write_prepare &&
ops->read_write_prepare(vcpu, val, bytes))
return X86EMUL_CONTINUE;
@@ -11272,6 +11281,9 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
frag++;
vcpu->mmio_cur_fragment++;
} else {
+ if (WARN_ON_ONCE(frag->data == &frag->val))
+ return -EIO;
+
/* Go forward to the next mmio piece. */
frag->data += len;
frag->gpa += len;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 480196639480..ae7053b044f7 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -317,7 +317,8 @@ static inline bool kvm_vcpu_can_poll(ktime_t cur, ktime_t stop)
struct kvm_mmio_fragment {
gpa_t gpa;
void *data;
- unsigned len;
+ u64 val;
+ unsigned int len;
};
struct kvm_vcpu {
--
2.34.1
2
1
[PATCH OLK-6.6] [Backport] KVM: x86: Use scratch field in MMIO fragment to hold small write values
by Xinyu Zheng 29 Apr '26
by Xinyu Zheng 29 Apr '26
29 Apr '26
From: Sean Christopherson <seanjc(a)google.com>
mainline inclusion
from mainline-v7.1-rc1
commit 0b16e69d17d8c35c5c9d5918bf596c75a44655d3
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14416
CVE: CVE-2026-31588
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
When exiting to userspace to service an emulated MMIO write, copy the
to-be-written value to a scratch field in the MMIO fragment if the size
of the data payload is 8 bytes or less, i.e. can fit in a single chunk,
instead of pointing the fragment directly at the source value.
This fixes a class of use-after-free bugs that occur when the emulator
initiates a write using an on-stack, local variable as the source, the
write splits a page boundary, *and* both pages are MMIO pages. Because
KVM's ABI only allows for physically contiguous MMIO requests, accesses
that split MMIO pages are separated into two fragments, and are sent to
userspace one at a time. When KVM attempts to complete userspace MMIO in
response to KVM_RUN after the first fragment, KVM will detect the second
fragment and generate a second userspace exit, and reference the on-stack
variable.
The issue is most visible if the second KVM_RUN is performed by a separate
task, in which case the stack of the initiating task can show up as truly
freed data.
==================================================================
BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420
Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984
CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace:
dump_stack+0xbe/0xfd
print_address_description.constprop.0+0x19/0x170
__kasan_report.cold+0x6c/0x84
kasan_report+0x3a/0x50
check_memory_region+0xfd/0x1f0
memcpy+0x20/0x60
complete_emulated_mmio+0x305/0x420
kvm_arch_vcpu_ioctl_run+0x63f/0x6d0
kvm_vcpu_ioctl+0x413/0xb20
__se_sys_ioctl+0x111/0x160
do_syscall_64+0x30/0x40
entry_SYSCALL_64_after_hwframe+0x67/0xd1
RIP: 0033:0x42477d
Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c
R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720
The buggy address belongs to the page:
page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c37
flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
The bug can also be reproduced with a targeted KVM-Unit-Test by hacking
KVM to fill a large on-stack variable in complete_emulated_mmio(), i.e. by
overwrite the data value with garbage.
Limit the use of the scratch fields to 8-byte or smaller accesses, and to
just writes, as larger accesses and reads are not affected thanks to
implementation details in the emulator, but add a sanity check to ensure
those details don't change in the future. Specifically, KVM never uses
on-stack variables for accesses larger that 8 bytes, e.g. uses an operand
in the emulator context, and *all* reads are buffered through the mem_read
cache.
Note! Using the scratch field for reads is not only unnecessary, it's
also extremely difficult to handle correctly. As above, KVM buffers all
reads through the mem_read cache, and heavily relies on that behavior when
re-emulating the instruction after a userspace MMIO read exit. If a read
splits a page, the first page is NOT an MMIO page, and the second page IS
an MMIO page, then the MMIO fragment needs to point at _just_ the second
chunk of the destination, i.e. its position in the mem_read cache. Taking
the "obvious" approach of copying the fragment value into the destination
when re-emulating the instruction would clobber the first chunk of the
destination, i.e. would clobber the data that was read from guest memory.
Fixes: f78146b0f923 ("KVM: Fix page-crossing MMIO")
Suggested-by: Yashu Zhang <zhangjiaji1(a)huawei.com>
Reported-by: Yashu Zhang <zhangjiaji1(a)huawei.com>
Closes: https://lore.kernel.org/all/369eaaa2b3c1425c85e8477066391bc7@huawei.com
Cc: stable(a)vger.kernel.org
Tested-by: Tom Lendacky <thomas.lendacky(a)gmail.com>
Tested-by: Rick Edgecombe <rick.p.edgecombe(a)intel.com>
Link: https://patch.msgid.link/20260225012049.920665-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc(a)google.com>
Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com>
---
arch/x86/kvm/x86.c | 14 +++++++++++++-
include/linux/kvm_host.h | 3 ++-
2 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 947dae594ddb..18b733c8bb5f 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7814,7 +7814,13 @@ static int emulator_read_write_onepage(unsigned long addr, void *val,
WARN_ON(vcpu->mmio_nr_fragments >= KVM_MAX_MMIO_FRAGMENTS);
frag = &vcpu->mmio_fragments[vcpu->mmio_nr_fragments++];
frag->gpa = gpa;
- frag->data = val;
+ if (write && bytes <= 8u) {
+ frag->val = 0;
+ frag->data = &frag->val;
+ memcpy(&frag->val, val, bytes);
+ } else {
+ frag->data = val;
+ }
frag->len = bytes;
return X86EMUL_CONTINUE;
}
@@ -7829,6 +7835,9 @@ static int emulator_read_write(struct x86_emulate_ctxt *ctxt,
gpa_t gpa;
int rc;
+ if (WARN_ON_ONCE((bytes > 8u || !ops->write) && object_is_on_stack(val)))
+ return X86EMUL_UNHANDLEABLE;
+
if (ops->read_write_prepare &&
ops->read_write_prepare(vcpu, val, bytes))
return X86EMUL_CONTINUE;
@@ -11272,6 +11281,9 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
frag++;
vcpu->mmio_cur_fragment++;
} else {
+ if (WARN_ON_ONCE(frag->data == &frag->val))
+ return -EIO;
+
/* Go forward to the next mmio piece. */
frag->data += len;
frag->gpa += len;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 480196639480..ae7053b044f7 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -317,7 +317,8 @@ static inline bool kvm_vcpu_can_poll(ktime_t cur, ktime_t stop)
struct kvm_mmio_fragment {
gpa_t gpa;
void *data;
- unsigned len;
+ u64 val;
+ unsigned int len;
};
struct kvm_vcpu {
--
2.34.1
2
1
29 Apr '26
From: Chuck Lever <chuck.lever(a)oracle.com>
mainline inclusion
from mainline-v7.0-rc5
commit 48db892356d6cb80f6942885545de4a6dd8d2a29
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14130
CVE: CVE-2026-31404
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
svc_export_put() calls path_put() and auth_domain_put() immediately
when the last reference drops, before the RCU grace period. RCU
readers in e_show() and c_show() access both ex_path (via
seq_path/d_path) and ex_client->name (via seq_escape) without
holding a reference. If cache_clean removes the entry and drops the
last reference concurrently, the sub-objects are freed while still
in use, producing a NULL pointer dereference in d_path.
Commit 2530766492ec ("nfsd: fix UAF when access ex_uuid or
ex_stats") moved kfree of ex_uuid and ex_stats into the
call_rcu callback, but left path_put() and auth_domain_put() running
before the grace period because both may sleep and call_rcu
callbacks execute in softirq context.
Replace call_rcu/kfree_rcu with queue_rcu_work(), which defers the
callback until after the RCU grace period and executes it in process
context where sleeping is permitted. This allows path_put() and
auth_domain_put() to be moved into the deferred callback alongside
the other resource releases. Apply the same fix to expkey_put(),
which has the identical pattern with ek_path and ek_client.
A dedicated workqueue scopes the shutdown drain to only NFSD
export release work items; flushing the shared
system_unbound_wq would stall on unrelated work from other
subsystems. nfsd_export_shutdown() uses rcu_barrier() followed
by flush_workqueue() to ensure all deferred release callbacks
complete before the export caches are destroyed.
Reported-by: Misbah Anjum N <misanjum(a)linux.ibm.com>
Closes: https://lore.kernel.org/linux-nfs/dcd371d3a95815a84ba7de52cef447b8@linux.ib…
Fixes: c224edca7af0 ("nfsd: no need get cache ref when protected by rcu")
Fixes: 1b10f0b603c0 ("SUNRPC: no need get cache ref when protected by rcu")
Cc: stable(a)vger.kernel.org
Reviwed-by: Jeff Layton <jlayton(a)kernel.org>
Reviewed-by: NeilBrown <neil(a)brown.name>
Tested-by: Olga Kornievskaia <okorniev(a)redhat.com>
Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com>
Conflicts:
fs/nfsd/export.c
fs/nfsd/export.h
fs/nfsd/nfsctl.c
[Commit 20ad856e4732 ("nfsd: report per-export stats") add
EXP_STATS_COUNTERS_NUM in export_stats_reset();
commit 20ad856e4732 ("nfsd: report per-export stats") add
"percpu_counter.h" in fs/nfsd/export.h;
commit f7fb730cac9a ("NFSD: fix race between nfsd registration and
exports_proc") move create_proc_exports_entry() down in init_nfsd().]
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
fs/nfsd/export.c | 63 +++++++++++++++++++++++++++++++++++++++++-------
fs/nfsd/export.h | 7 ++++--
fs/nfsd/nfsctl.c | 8 +++++-
3 files changed, 66 insertions(+), 12 deletions(-)
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 0e1caf71296e..5eba1cd9a72e 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -36,19 +36,30 @@
* second map contains a reference to the entry in the first map.
*/
+static struct workqueue_struct *nfsd_export_wq;
+
#define EXPKEY_HASHBITS 8
#define EXPKEY_HASHMAX (1 << EXPKEY_HASHBITS)
#define EXPKEY_HASHMASK (EXPKEY_HASHMAX -1)
-static void expkey_put(struct kref *ref)
+static void expkey_release(struct work_struct *work)
{
- struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
+ struct svc_expkey *key = container_of(to_rcu_work(work),
+ struct svc_expkey, ek_rwork);
if (test_bit(CACHE_VALID, &key->h.flags) &&
!test_bit(CACHE_NEGATIVE, &key->h.flags))
path_put(&key->ek_path);
auth_domain_put(key->ek_client);
- kfree_rcu(key, ek_rcu);
+ kfree(key);
+}
+
+static void expkey_put(struct kref *ref)
+{
+ struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
+
+ INIT_RCU_WORK(&key->ek_rwork, expkey_release);
+ queue_rcu_work(nfsd_export_wq, &key->ek_rwork);
}
static int expkey_upcall(struct cache_detail *cd, struct cache_head *h)
@@ -331,11 +342,13 @@ static void nfsd4_fslocs_free(struct nfsd4_fs_locations *fsloc)
fsloc->locations = NULL;
}
-static void svc_export_release(struct rcu_head *rcu_head)
+static void svc_export_release(struct work_struct *work)
{
- struct svc_export *exp = container_of(rcu_head, struct svc_export,
- ex_rcu);
+ struct svc_export *exp = container_of(to_rcu_work(work),
+ struct svc_export, ex_rwork);
+ path_put(&exp->ex_path);
+ auth_domain_put(exp->ex_client);
nfsd4_fslocs_free(&exp->ex_fslocs);
kfree(exp->ex_uuid);
kfree(exp);
@@ -345,9 +358,8 @@ static void svc_export_put(struct kref *ref)
{
struct svc_export *exp = container_of(ref, struct svc_export, h.ref);
- path_put(&exp->ex_path);
- auth_domain_put(exp->ex_client);
- call_rcu(&exp->ex_rcu, svc_export_release);
+ INIT_RCU_WORK(&exp->ex_rwork, svc_export_release);
+ queue_rcu_work(nfsd_export_wq, &exp->ex_rwork);
}
static int svc_export_upcall(struct cache_detail *cd, struct cache_head *h)
@@ -1268,6 +1280,36 @@ const struct seq_operations nfs_exports_op = {
.show = e_show,
};
+/**
+ * nfsd_export_wq_init - allocate the export release workqueue
+ *
+ * Called once at module load. The workqueue runs deferred svc_export and
+ * svc_expkey release work scheduled by queue_rcu_work() in the cache put
+ * callbacks.
+ *
+ * Return values:
+ * %0: workqueue allocated
+ * %-ENOMEM: allocation failed
+ */
+int nfsd_export_wq_init(void)
+{
+ nfsd_export_wq = alloc_workqueue("nfsd_export", WQ_UNBOUND, 0);
+ if (!nfsd_export_wq)
+ return -ENOMEM;
+ return 0;
+}
+
+/**
+ * nfsd_export_wq_shutdown - drain and free the export release workqueue
+ *
+ * Called once at module unload. Per-namespace teardown in
+ * nfsd_export_shutdown() has already drained all deferred work.
+ */
+void nfsd_export_wq_shutdown(void)
+{
+ destroy_workqueue(nfsd_export_wq);
+}
+
/*
* Initialize the exports module.
*/
@@ -1329,6 +1371,9 @@ nfsd_export_shutdown(struct net *net)
cache_unregister_net(nn->svc_expkey_cache, net);
cache_unregister_net(nn->svc_export_cache, net);
+ /* Drain deferred export and expkey release work. */
+ rcu_barrier();
+ flush_workqueue(nfsd_export_wq);
cache_destroy_net(nn->svc_expkey_cache, net);
cache_destroy_net(nn->svc_export_cache, net);
svcauth_unix_purge(net);
diff --git a/fs/nfsd/export.h b/fs/nfsd/export.h
index e7daa1f246f0..d87fd4b57ea2 100644
--- a/fs/nfsd/export.h
+++ b/fs/nfsd/export.h
@@ -6,6 +6,7 @@
#define NFSD_EXPORT_H
#include <linux/sunrpc/cache.h>
+#include <linux/workqueue.h>
#include <uapi/linux/nfsd/export.h>
#include <linux/nfs4.h>
@@ -61,7 +62,7 @@ struct svc_export {
u32 ex_layout_types;
struct nfsd4_deviceid_map *ex_devid_map;
struct cache_detail *cd;
- struct rcu_head ex_rcu;
+ struct rcu_work ex_rwork;
};
/* an "export key" (expkey) maps a filehandlefragement to an
@@ -76,7 +77,7 @@ struct svc_expkey {
u32 ek_fsid[6];
struct path ek_path;
- struct rcu_head ek_rcu;
+ struct rcu_work ek_rwork;
};
#define EX_ISSYNC(exp) (!((exp)->ex_flags & NFSEXP_ASYNC))
@@ -89,6 +90,8 @@ __be32 check_nfsd_access(struct svc_export *exp, struct svc_rqst *rqstp);
/*
* Function declarations
*/
+int nfsd_export_wq_init(void);
+void nfsd_export_wq_shutdown(void);
int nfsd_export_init(struct net *);
void nfsd_export_shutdown(struct net *);
void nfsd_export_flush(struct net *);
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index e84c8cf8e2c0..7ede258033a1 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1529,9 +1529,12 @@ static int __init init_nfsd(void)
if (retval)
goto out_free_stat;
nfsd_lockd_init(); /* lockd->nfsd callbacks */
- retval = create_proc_exports_entry();
+ retval = nfsd_export_wq_init();
if (retval)
goto out_free_lockd;
+ retval = create_proc_exports_entry();
+ if (retval)
+ goto out_free_export_wq;
retval = register_pernet_subsys(&nfsd_net_ops);
if (retval < 0)
goto out_free_exports;
@@ -1549,6 +1552,8 @@ static int __init init_nfsd(void)
out_free_exports:
remove_proc_entry("fs/nfs/exports", NULL);
remove_proc_entry("fs/nfs", NULL);
+out_free_export_wq:
+ nfsd_export_wq_shutdown();
out_free_lockd:
nfsd_lockd_shutdown();
nfsd_drc_slab_free();
@@ -1566,6 +1571,7 @@ static void __exit exit_nfsd(void)
unregister_filesystem(&nfsd_fs_type);
unregister_cld_notifier();
unregister_pernet_subsys(&nfsd_net_ops);
+ nfsd_export_wq_shutdown();
nfsd_drc_slab_free();
remove_proc_entry("fs/nfs/exports", NULL);
remove_proc_entry("fs/nfs", NULL);
--
2.52.0
2
1
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/8335
CVE: NA
--------------------------------
After commit 137a3f0724c8
("bpf: move sleepable flag from bpf_prog_aux to bpf_prog"), the sleepable
variable is no longer usable. However, commit 038a41427a20
("bpf: Reject sleepable kprobe_multi programs at attach time") uses it
accidentally.
Fix it by using prog->sleepable.
Fixes: 137a3f0724c8 ("bpf: move sleepable flag from bpf_prog_aux to bpf_prog")
Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com>
---
kernel/trace/bpf_trace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 52cb76dd27c8..768159fad93c 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2900,7 +2900,7 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
return -EOPNOTSUPP;
/* kprobe_multi is not allowed to be sleepable. */
- if (prog->aux->sleepable)
+ if (prog->sleepable)
return -EINVAL;
if (prog->expected_attach_type != BPF_TRACE_KPROBE_MULTI)
--
2.34.1
2
1
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/8335
CVE: NA
--------------------------------
After commit 137a3f0724c8
("bpf: move sleepable flag from bpf_prog_aux to bpf_prog"), the sleepable
variable is no longer usable. However, commit 038a41427a20
("bpf: Reject sleepable kprobe_multi programs at attach time") uses it
accidentally.
Fix it by using prog->sleepable.
Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com>
---
kernel/trace/bpf_trace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 52cb76dd27c8..768159fad93c 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2900,7 +2900,7 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
return -EOPNOTSUPP;
/* kprobe_multi is not allowed to be sleepable. */
- if (prog->aux->sleepable)
+ if (prog->sleepable)
return -EINVAL;
if (prog->expected_attach_type != BPF_TRACE_KPROBE_MULTI)
--
2.34.1
2
1
[PATCH openEuler-1.0-LTS] KVM: x86: Use scratch field in MMIO fragment to hold small write values
by Xinyu Zheng 28 Apr '26
by Xinyu Zheng 28 Apr '26
28 Apr '26
From: Sean Christopherson <seanjc(a)google.com>
mainline inclusion
from mainline-v7.1-rc1
commit 0b16e69d17d8c35c5c9d5918bf596c75a44655d3
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14416
CVE: CVE-2026-31588
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
When exiting to userspace to service an emulated MMIO write, copy the
to-be-written value to a scratch field in the MMIO fragment if the size
of the data payload is 8 bytes or less, i.e. can fit in a single chunk,
instead of pointing the fragment directly at the source value.
This fixes a class of use-after-free bugs that occur when the emulator
initiates a write using an on-stack, local variable as the source, the
write splits a page boundary, *and* both pages are MMIO pages. Because
KVM's ABI only allows for physically contiguous MMIO requests, accesses
that split MMIO pages are separated into two fragments, and are sent to
userspace one at a time. When KVM attempts to complete userspace MMIO in
response to KVM_RUN after the first fragment, KVM will detect the second
fragment and generate a second userspace exit, and reference the on-stack
variable.
The issue is most visible if the second KVM_RUN is performed by a separate
task, in which case the stack of the initiating task can show up as truly
freed data.
==================================================================
BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420
Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984
CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace:
dump_stack+0xbe/0xfd
print_address_description.constprop.0+0x19/0x170
__kasan_report.cold+0x6c/0x84
kasan_report+0x3a/0x50
check_memory_region+0xfd/0x1f0
memcpy+0x20/0x60
complete_emulated_mmio+0x305/0x420
kvm_arch_vcpu_ioctl_run+0x63f/0x6d0
kvm_vcpu_ioctl+0x413/0xb20
__se_sys_ioctl+0x111/0x160
do_syscall_64+0x30/0x40
entry_SYSCALL_64_after_hwframe+0x67/0xd1
RIP: 0033:0x42477d
Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c
R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720
The buggy address belongs to the page:
page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c37
flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
The bug can also be reproduced with a targeted KVM-Unit-Test by hacking
KVM to fill a large on-stack variable in complete_emulated_mmio(), i.e. by
overwrite the data value with garbage.
Limit the use of the scratch fields to 8-byte or smaller accesses, and to
just writes, as larger accesses and reads are not affected thanks to
implementation details in the emulator, but add a sanity check to ensure
those details don't change in the future. Specifically, KVM never uses
on-stack variables for accesses larger that 8 bytes, e.g. uses an operand
in the emulator context, and *all* reads are buffered through the mem_read
cache.
Note! Using the scratch field for reads is not only unnecessary, it's
also extremely difficult to handle correctly. As above, KVM buffers all
reads through the mem_read cache, and heavily relies on that behavior when
re-emulating the instruction after a userspace MMIO read exit. If a read
splits a page, the first page is NOT an MMIO page, and the second page IS
an MMIO page, then the MMIO fragment needs to point at _just_ the second
chunk of the destination, i.e. its position in the mem_read cache. Taking
the "obvious" approach of copying the fragment value into the destination
when re-emulating the instruction would clobber the first chunk of the
destination, i.e. would clobber the data that was read from guest memory.
Fixes: f78146b0f923 ("KVM: Fix page-crossing MMIO")
Suggested-by: Yashu Zhang <zhangjiaji1(a)huawei.com>
Reported-by: Yashu Zhang <zhangjiaji1(a)huawei.com>
Closes: https://lore.kernel.org/all/369eaaa2b3c1425c85e8477066391bc7@huawei.com
Cc: stable(a)vger.kernel.org
Tested-by: Tom Lendacky <thomas.lendacky(a)gmail.com>
Tested-by: Rick Edgecombe <rick.p.edgecombe(a)intel.com>
Link: https://patch.msgid.link/20260225012049.920665-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc(a)google.com>
Conflicts:
include/linux/kvm_host.h
[context conflicts]
Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com>
---
arch/x86/kvm/x86.c | 14 +++++++++++++-
include/linux/kvm_host.h | 3 ++-
2 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 83d215d43eb3..c4de9cc7bfce 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5425,7 +5425,13 @@ static int emulator_read_write_onepage(unsigned long addr, void *val,
WARN_ON(vcpu->mmio_nr_fragments >= KVM_MAX_MMIO_FRAGMENTS);
frag = &vcpu->mmio_fragments[vcpu->mmio_nr_fragments++];
frag->gpa = gpa;
- frag->data = val;
+ if (write && bytes <= 8u) {
+ frag->val = 0;
+ frag->data = &frag->val;
+ memcpy(&frag->val, val, bytes);
+ } else {
+ frag->data = val;
+ }
frag->len = bytes;
return X86EMUL_CONTINUE;
}
@@ -5440,6 +5446,9 @@ static int emulator_read_write(struct x86_emulate_ctxt *ctxt,
gpa_t gpa;
int rc;
+ if (WARN_ON_ONCE((bytes > 8u || !ops->write) && object_is_on_stack(val)))
+ return X86EMUL_UNHANDLEABLE;
+
if (ops->read_write_prepare &&
ops->read_write_prepare(vcpu, val, bytes))
return X86EMUL_CONTINUE;
@@ -8086,6 +8095,9 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
frag++;
vcpu->mmio_cur_fragment++;
} else {
+ if (WARN_ON_ONCE(frag->data == &frag->val))
+ return -EIO;
+
/* Go forward to the next mmio piece. */
frag->data += len;
frag->gpa += len;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index f34f0989e453..23731239a228 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -234,7 +234,8 @@ enum {
struct kvm_mmio_fragment {
gpa_t gpa;
void *data;
- unsigned len;
+ u64 val;
+ unsigned int len;
};
struct kvm_vcpu {
--
2.34.1
2
1
[PATCH openEuler-1.0-LTS] KVM: x86: Use scratch field in MMIO fragment to hold small write values
by Xinyu Zheng 28 Apr '26
by Xinyu Zheng 28 Apr '26
28 Apr '26
From: Sean Christopherson <seanjc(a)google.com>
mainline inclusion
from mainline-v7.1-rc1
commit 0b16e69d17d8c35c5c9d5918bf596c75a44655d3
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14416
CVE: CVE-2026-31588
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
When exiting to userspace to service an emulated MMIO write, copy the
to-be-written value to a scratch field in the MMIO fragment if the size
of the data payload is 8 bytes or less, i.e. can fit in a single chunk,
instead of pointing the fragment directly at the source value.
This fixes a class of use-after-free bugs that occur when the emulator
initiates a write using an on-stack, local variable as the source, the
write splits a page boundary, *and* both pages are MMIO pages. Because
KVM's ABI only allows for physically contiguous MMIO requests, accesses
that split MMIO pages are separated into two fragments, and are sent to
userspace one at a time. When KVM attempts to complete userspace MMIO in
response to KVM_RUN after the first fragment, KVM will detect the second
fragment and generate a second userspace exit, and reference the on-stack
variable.
The issue is most visible if the second KVM_RUN is performed by a separate
task, in which case the stack of the initiating task can show up as truly
freed data.
==================================================================
BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420
Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984
CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace:
dump_stack+0xbe/0xfd
print_address_description.constprop.0+0x19/0x170
__kasan_report.cold+0x6c/0x84
kasan_report+0x3a/0x50
check_memory_region+0xfd/0x1f0
memcpy+0x20/0x60
complete_emulated_mmio+0x305/0x420
kvm_arch_vcpu_ioctl_run+0x63f/0x6d0
kvm_vcpu_ioctl+0x413/0xb20
__se_sys_ioctl+0x111/0x160
do_syscall_64+0x30/0x40
entry_SYSCALL_64_after_hwframe+0x67/0xd1
RIP: 0033:0x42477d
Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c
R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720
The buggy address belongs to the page:
page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c37
flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
The bug can also be reproduced with a targeted KVM-Unit-Test by hacking
KVM to fill a large on-stack variable in complete_emulated_mmio(), i.e. by
overwrite the data value with garbage.
Limit the use of the scratch fields to 8-byte or smaller accesses, and to
just writes, as larger accesses and reads are not affected thanks to
implementation details in the emulator, but add a sanity check to ensure
those details don't change in the future. Specifically, KVM never uses
on-stack variables for accesses larger that 8 bytes, e.g. uses an operand
in the emulator context, and *all* reads are buffered through the mem_read
cache.
Note! Using the scratch field for reads is not only unnecessary, it's
also extremely difficult to handle correctly. As above, KVM buffers all
reads through the mem_read cache, and heavily relies on that behavior when
re-emulating the instruction after a userspace MMIO read exit. If a read
splits a page, the first page is NOT an MMIO page, and the second page IS
an MMIO page, then the MMIO fragment needs to point at _just_ the second
chunk of the destination, i.e. its position in the mem_read cache. Taking
the "obvious" approach of copying the fragment value into the destination
when re-emulating the instruction would clobber the first chunk of the
destination, i.e. would clobber the data that was read from guest memory.
Fixes: 9c7af565c58e ["centos 8.1: import linux-4.18.0-147.5.1.el8_1"]
Suggested-by: Yashu Zhang <zhangjiaji1(a)huawei.com>
Reported-by: Yashu Zhang <zhangjiaji1(a)huawei.com>
Closes: https://lore.kernel.org/all/369eaaa2b3c1425c85e8477066391bc7@huawei.com
Cc: stable(a)vger.kernel.org
Tested-by: Tom Lendacky <thomas.lendacky(a)gmail.com>
Tested-by: Rick Edgecombe <rick.p.edgecombe(a)intel.com>
Link: https://patch.msgid.link/20260225012049.920665-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc(a)google.com>
Conflicts:
include/linux/kvm_host.h
[context conflicts]
Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com>
---
arch/x86/kvm/x86.c | 14 +++++++++++++-
include/linux/kvm_host.h | 3 ++-
2 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 83d215d43eb3..c4de9cc7bfce 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5425,7 +5425,13 @@ static int emulator_read_write_onepage(unsigned long addr, void *val,
WARN_ON(vcpu->mmio_nr_fragments >= KVM_MAX_MMIO_FRAGMENTS);
frag = &vcpu->mmio_fragments[vcpu->mmio_nr_fragments++];
frag->gpa = gpa;
- frag->data = val;
+ if (write && bytes <= 8u) {
+ frag->val = 0;
+ frag->data = &frag->val;
+ memcpy(&frag->val, val, bytes);
+ } else {
+ frag->data = val;
+ }
frag->len = bytes;
return X86EMUL_CONTINUE;
}
@@ -5440,6 +5446,9 @@ static int emulator_read_write(struct x86_emulate_ctxt *ctxt,
gpa_t gpa;
int rc;
+ if (WARN_ON_ONCE((bytes > 8u || !ops->write) && object_is_on_stack(val)))
+ return X86EMUL_UNHANDLEABLE;
+
if (ops->read_write_prepare &&
ops->read_write_prepare(vcpu, val, bytes))
return X86EMUL_CONTINUE;
@@ -8086,6 +8095,9 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
frag++;
vcpu->mmio_cur_fragment++;
} else {
+ if (WARN_ON_ONCE(frag->data == &frag->val))
+ return -EIO;
+
/* Go forward to the next mmio piece. */
frag->data += len;
frag->gpa += len;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index f34f0989e453..23731239a228 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -234,7 +234,8 @@ enum {
struct kvm_mmio_fragment {
gpa_t gpa;
void *data;
- unsigned len;
+ u64 val;
+ unsigned int len;
};
struct kvm_vcpu {
--
2.34.1
2
2
From: Harin Lee <me(a)harin.net>
mainline inclusion
from mainline-v7.0-rc4
commit e9418da50d9e5c496c22fe392e4ad74c038a94eb
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14346
CVE: CVE-2026-31602
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256
playback streams, but the additional pages are not used by the card
correctly. The CT20K2 hardware already has multiple VMEM_PTPAL
registers, but using them separately would require refactoring the
entire virtual memory allocation logic.
ct_vm_map() always uses PTEs in vm->ptp[0].area regardless of
CT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When
aggregate memory allocations exceed this limit, ct_vm_map() tries to
access beyond the allocated space and causes a page fault:
BUG: unable to handle page fault for address: ffffd4ae8a10a000
Oops: Oops: 0002 [#1] SMP PTI
RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi]
Call Trace:
atc_pcm_playback_prepare+0x225/0x3b0
ct_pcm_playback_prepare+0x38/0x60
snd_pcm_do_prepare+0x2f/0x50
snd_pcm_action_single+0x36/0x90
snd_pcm_action_nonatomic+0xbf/0xd0
snd_pcm_ioctl+0x28/0x40
__x64_sys_ioctl+0x97/0xe0
do_syscall_64+0x81/0x610
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Revert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count
remain unchanged.
Fixes: 391e69143d0a ("ALSA: ctxfi: Bump playback substreams to 256")
Cc: stable(a)vger.kernel.org
Signed-off-by: Harin Lee <me(a)harin.net>
Link: https://patch.msgid.link/20260406074857.216034-1-me@harin.net
Signed-off-by: Takashi Iwai <tiwai(a)suse.de>
Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com>
---
sound/pci/ctxfi/ctvmem.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/ctxfi/ctvmem.h b/sound/pci/ctxfi/ctvmem.h
index 54818a3c245d..a3154e55bd44 100644
--- a/sound/pci/ctxfi/ctvmem.h
+++ b/sound/pci/ctxfi/ctvmem.h
@@ -15,7 +15,7 @@
#ifndef CTVMEM_H
#define CTVMEM_H
-#define CT_PTP_NUM 4 /* num of device page table pages */
+#define CT_PTP_NUM 1 /* num of device page table pages */
#include <linux/mutex.h>
#include <linux/list.h>
--
2.22.0
2
1
From: Harin Lee <me(a)harin.net>
mainline inclusion
from mainline-v7.0-rc4
commit e9418da50d9e5c496c22fe392e4ad74c038a94eb
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14346
CVE: CVE-2026-31602
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256
playback streams, but the additional pages are not used by the card
correctly. The CT20K2 hardware already has multiple VMEM_PTPAL
registers, but using them separately would require refactoring the
entire virtual memory allocation logic.
ct_vm_map() always uses PTEs in vm->ptp[0].area regardless of
CT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When
aggregate memory allocations exceed this limit, ct_vm_map() tries to
access beyond the allocated space and causes a page fault:
BUG: unable to handle page fault for address: ffffd4ae8a10a000
Oops: Oops: 0002 [#1] SMP PTI
RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi]
Call Trace:
atc_pcm_playback_prepare+0x225/0x3b0
ct_pcm_playback_prepare+0x38/0x60
snd_pcm_do_prepare+0x2f/0x50
snd_pcm_action_single+0x36/0x90
snd_pcm_action_nonatomic+0xbf/0xd0
snd_pcm_ioctl+0x28/0x40
__x64_sys_ioctl+0x97/0xe0
do_syscall_64+0x81/0x610
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Revert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count
remain unchanged.
Fixes: 391e69143d0a ("ALSA: ctxfi: Bump playback substreams to 256")
Cc: stable(a)vger.kernel.org
Signed-off-by: Harin Lee <me(a)harin.net>
Link: https://patch.msgid.link/20260406074857.216034-1-me@harin.net
Signed-off-by: Takashi Iwai <tiwai(a)suse.de>
Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com>
---
sound/pci/ctxfi/ctvmem.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/ctxfi/ctvmem.h b/sound/pci/ctxfi/ctvmem.h
index da54cbcdb0be..43a0065b40c3 100644
--- a/sound/pci/ctxfi/ctvmem.h
+++ b/sound/pci/ctxfi/ctvmem.h
@@ -15,7 +15,7 @@
#ifndef CTVMEM_H
#define CTVMEM_H
-#define CT_PTP_NUM 4 /* num of device page table pages */
+#define CT_PTP_NUM 1 /* num of device page table pages */
#include <linux/mutex.h>
#include <linux/list.h>
--
2.22.0
2
1
1. mark node as critical_err on remote RAS error
2. add sysfs interface to set/clear node's critical err status
changelog since v2:
- remote unsless config check in patch #1 since stub exists
changelog since v1:
- fix incorrect patch changelog
Wupeng Ma (2):
mm: mark node as critical_err on remote RAS error
numa: add critical_err sysfs interface for remote node recovery
drivers/acpi/apei/ghes.c | 14 +++++++----
drivers/base/numa_remote.c | 48 ++++++++++++++++++++++++++++++++++----
include/linux/mm.h | 19 +++++++++++++++
include/linux/mmzone.h | 4 ++++
mm/migrate.c | 3 +++
5 files changed, 79 insertions(+), 9 deletions(-)
--
2.43.0
2
3
From: Chaitanya Kulkarni <kch(a)nvidia.com>
stable inclusion
from stable-v6.12.80
commit 49c7c50ee6325a084216e94395e067ecde8088fa
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14303
CVE: CVE-2026-31557
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 2922e3507f6d5caa7f1d07f145e186fc6f317a4e ]
For target nvmet_ctrl_free() flushes ctrl->async_event_work.
If nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue
completion for the same worker:-
A. Async event work queued on nvmet-wq (prior to disconnect):
nvmet_execute_async_event()
queue_work(nvmet_wq, &ctrl->async_event_work)
nvmet_add_async_event()
queue_work(nvmet_wq, &ctrl->async_event_work)
B. Full pre-work chain (RDMA CM path):
nvmet_rdma_cm_handler()
nvmet_rdma_queue_disconnect()
__nvmet_rdma_queue_disconnect()
queue_work(nvmet_wq, &queue->release_work)
process_one_work()
lock((wq_completion)nvmet-wq) <--------- 1st
nvmet_rdma_release_queue_work()
C. Recursive path (same worker):
nvmet_rdma_release_queue_work()
nvmet_rdma_free_queue()
nvmet_sq_destroy()
nvmet_ctrl_put()
nvmet_ctrl_free()
flush_work(&ctrl->async_event_work)
__flush_work()
touch_wq_lockdep_map()
lock((wq_completion)nvmet-wq) <--------- 2nd
Lockdep splat:
============================================
WARNING: possible recursive locking detected
6.19.0-rc3nvme+ #14 Tainted: G N
--------------------------------------------
kworker/u192:42/44933 is trying to acquire lock:
ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90
but task is already holding lock:
ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660
3 locks held by kworker/u192:42/44933:
#0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660
#1: ffffc9000e6cbe28 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x660
#2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530
Workqueue: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma]
Call Trace:
__flush_work+0x268/0x530
nvmet_ctrl_free+0x140/0x310 [nvmet]
nvmet_cq_put+0x74/0x90 [nvmet]
nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma]
nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma]
process_one_work+0x206/0x660
worker_thread+0x184/0x320
kthread+0x10c/0x240
ret_from_fork+0x319/0x390
Move async event work to a dedicated nvmet-aen-wq to avoid reentrant
flush on nvmet-wq.
Reviewed-by: Christoph Hellwig <hch(a)lst.de>
Signed-off-by: Chaitanya Kulkarni <kch(a)nvidia.com>
Signed-off-by: Keith Busch <kbusch(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Conflicts:
drivers/nvme/target/core.c
[nvme-debugfs has not supported, not affect this patch.]
Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com>
---
drivers/nvme/target/admin-cmd.c | 2 +-
drivers/nvme/target/core.c | 14 ++++++++++++--
drivers/nvme/target/nvmet.h | 1 +
drivers/nvme/target/rdma.c | 1 +
4 files changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index 39cb570f833d..096bb9f4dd34 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -973,11 +973,11 @@ void nvmet_execute_async_event(struct nvmet_req *req)
return;
}
ctrl->async_event_cmds[ctrl->nr_async_event_cmds++] = req;
mutex_unlock(&ctrl->lock);
- queue_work(nvmet_wq, &ctrl->async_event_work);
+ queue_work(nvmet_aen_wq, &ctrl->async_event_work);
}
void nvmet_execute_keep_alive(struct nvmet_req *req)
{
struct nvmet_ctrl *ctrl = req->sq->ctrl;
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 1cf6dfac1836..5939480842ca 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -23,10 +23,12 @@ struct workqueue_struct *zbd_wq;
static const struct nvmet_fabrics_ops *nvmet_transports[NVMF_TRTYPE_MAX];
static DEFINE_IDA(cntlid_ida);
struct workqueue_struct *nvmet_wq;
EXPORT_SYMBOL_GPL(nvmet_wq);
+struct workqueue_struct *nvmet_aen_wq;
+EXPORT_SYMBOL_GPL(nvmet_aen_wq);
/*
* This read/write semaphore is used to synchronize access to configuration
* information on a target system that will result in discovery log page
* information change for at least one host.
@@ -209,11 +211,11 @@ void nvmet_add_async_event(struct nvmet_ctrl *ctrl, u8 event_type,
mutex_lock(&ctrl->lock);
list_add_tail(&aen->entry, &ctrl->async_events);
mutex_unlock(&ctrl->lock);
- queue_work(nvmet_wq, &ctrl->async_event_work);
+ queue_work(nvmet_aen_wq, &ctrl->async_event_work);
}
static void nvmet_add_to_changed_ns_log(struct nvmet_ctrl *ctrl, __le32 nsid)
{
u32 i;
@@ -1680,21 +1682,28 @@ static int __init nvmet_init(void)
nvmet_wq = alloc_workqueue("nvmet-wq", WQ_MEM_RECLAIM, 0);
if (!nvmet_wq)
goto out_free_buffered_work_queue;
+ nvmet_aen_wq = alloc_workqueue("nvmet-aen-wq",
+ WQ_MEM_RECLAIM | WQ_UNBOUND, 0);
+ if (!nvmet_aen_wq)
+ goto out_free_nvmet_work_queue;
+
error = nvmet_init_discovery();
if (error)
- goto out_free_nvmet_work_queue;
+ goto out_free_nvmet_aen_work_queue;
error = nvmet_init_configfs();
if (error)
goto out_exit_discovery;
return 0;
out_exit_discovery:
nvmet_exit_discovery();
+out_free_nvmet_aen_work_queue:
+ destroy_workqueue(nvmet_aen_wq);
out_free_nvmet_work_queue:
destroy_workqueue(nvmet_wq);
out_free_buffered_work_queue:
destroy_workqueue(buffered_io_wq);
out_free_zbd_work_queue:
@@ -1707,10 +1716,11 @@ static int __init nvmet_init(void)
static void __exit nvmet_exit(void)
{
nvmet_exit_configfs();
nvmet_exit_discovery();
ida_destroy(&cntlid_ida);
+ destroy_workqueue(nvmet_aen_wq);
destroy_workqueue(nvmet_wq);
destroy_workqueue(buffered_io_wq);
destroy_workqueue(zbd_wq);
kmem_cache_destroy(nvmet_bvec_cache);
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 3539f8e2d2d3..1a874ba90d1b 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -399,10 +399,11 @@ struct nvmet_req {
#define NVMET_MAX_MPOOL_BVEC 16
extern struct kmem_cache *nvmet_bvec_cache;
extern struct workqueue_struct *buffered_io_wq;
extern struct workqueue_struct *zbd_wq;
extern struct workqueue_struct *nvmet_wq;
+extern struct workqueue_struct *nvmet_aen_wq;
static inline void nvmet_set_result(struct nvmet_req *req, u32 result)
{
req->cqe->result.u32 = cpu_to_le32(result);
}
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 298c46834a53..5942949c18af 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -2057,10 +2057,11 @@ static void nvmet_rdma_remove_one(struct ib_device *ib_device, void *client_data
__nvmet_rdma_queue_disconnect(queue);
}
mutex_unlock(&nvmet_rdma_queue_mutex);
flush_workqueue(nvmet_wq);
+ flush_workqueue(nvmet_aen_wq);
}
static struct ib_client nvmet_rdma_ib_client = {
.name = "nvmet_rdma",
.remove = nvmet_rdma_remove_one
--
2.52.0
2
1
27 Apr '26
From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
mainline inclusion
from mainline-v7.1-rc1
commit 3df690bba28edec865cf7190be10708ad0ddd67e
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14418
CVE: CVE-2026-31613
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message()
returns success without any length validation, leaving the symlink
parsers as the only defense against an untrusted server.
symlink_data() walks SMB 3.1.1 error contexts with the loop test "p <
end", but reads p->ErrorId at offset 4 and p->ErrorDataLength at offset
0. When the server-controlled ErrorDataLength advances p to within 1-7
bytes of end, the next iteration will read past it. When the matching
context is found, sym->SymLinkErrorTag is read at offset 4 from
p->ErrorContextData with no check that the symlink header itself fits.
smb2_parse_symlink_response() then bounds-checks the substitute name
using SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from
iov_base. That value is computed as sizeof(smb2_err_rsp) +
sizeof(smb2_symlink_err_rsp), which is correct only when
ErrorContextCount == 0.
With at least one error context the symlink data sits 8 bytes deeper,
and each skipped non-matching context shifts it further by 8 +
ALIGN(ErrorDataLength, 8). The check is too short, allowing the
substitute name read to run past iov_len. The out-of-bound heap bytes
are UTF-16-decoded into the symlink target and returned to userspace via
readlink(2).
Fix this all up by making the loops test require the full context header
to fit, rejecting sym if its header runs past end, and bound the
substitute name against the actual position of sym->PathBuffer rather
than a fixed offset.
Because sub_offs and sub_len are 16bits, the pointer math will not
overflow here with the new greater-than.
Cc: Ronnie Sahlberg <ronniesahlberg(a)gmail.com>
Cc: Shyam Prasad N <sprasad(a)microsoft.com>
Cc: Tom Talpey <tom(a)talpey.com>
Cc: Bharath SM <bharathsm(a)microsoft.com>
Cc: linux-cifs(a)vger.kernel.org
Cc: samba-technical(a)lists.samba.org
Cc: stable <stable(a)kernel.org>
Reviewed-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.org>
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
Conflicts:
fs/smb/client/smb2file.c
[Commit 215b7f9ecb8d ("smb: client: correctly handle ErrorContextData as a
flexible array") change the type of ErrorContextData.]
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
fs/smb/client/smb2file.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/fs/smb/client/smb2file.c b/fs/smb/client/smb2file.c
index 4e7d5c612256..dc91d75aa1bf 100644
--- a/fs/smb/client/smb2file.c
+++ b/fs/smb/client/smb2file.c
@@ -27,10 +27,11 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)
{
struct smb2_err_rsp *err = iov->iov_base;
struct smb2_symlink_err_rsp *sym = ERR_PTR(-EINVAL);
+ u8 *end = (u8 *)err + iov->iov_len;
u32 len;
if (err->ErrorContextCount) {
- struct smb2_error_context_rsp *p, *end;
+ struct smb2_error_context_rsp *p;
len = (u32)err->ErrorContextCount * (offsetof(struct smb2_error_context_rsp,
ErrorContextData) +
@@ -39,8 +40,7 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)
return ERR_PTR(-EINVAL);
p = (struct smb2_error_context_rsp *)err->ErrorData;
- end = (struct smb2_error_context_rsp *)((u8 *)err + iov->iov_len);
- do {
+ while ((u8 *)p + sizeof(*p) <= end) {
if (le32_to_cpu(p->ErrorId) == SMB2_ERROR_ID_DEFAULT) {
sym = (struct smb2_symlink_err_rsp *)&p->ErrorContextData;
break;
@@ -50,14 +50,16 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)
len = ALIGN(le32_to_cpu(p->ErrorDataLength), 8);
p = (struct smb2_error_context_rsp *)((u8 *)&p->ErrorContextData + len);
- } while (p < end);
+ };
} else if (le32_to_cpu(err->ByteCount) >= sizeof(*sym) &&
iov->iov_len >= SMB2_SYMLINK_STRUCT_SIZE) {
sym = (struct smb2_symlink_err_rsp *)err->ErrorData;
}
- if (!IS_ERR(sym) && (le32_to_cpu(sym->SymLinkErrorTag) != SYMLINK_ERROR_TAG ||
- le32_to_cpu(sym->ReparseTag) != IO_REPARSE_TAG_SYMLINK))
+ if (!IS_ERR(sym) &&
+ ((u8 *)sym + sizeof(*sym) > end ||
+ le32_to_cpu(sym->SymLinkErrorTag) != SYMLINK_ERROR_TAG ||
+ le32_to_cpu(sym->ReparseTag) != IO_REPARSE_TAG_SYMLINK))
sym = ERR_PTR(-EINVAL);
return sym;
@@ -82,8 +84,10 @@ int smb2_parse_symlink_response(struct cifs_sb_info *cifs_sb, const struct kvec
print_len = le16_to_cpu(sym->PrintNameLength);
print_offs = le16_to_cpu(sym->PrintNameOffset);
- if (iov->iov_len < SMB2_SYMLINK_STRUCT_SIZE + sub_offs + sub_len ||
- iov->iov_len < SMB2_SYMLINK_STRUCT_SIZE + print_offs + print_len)
+ if ((char *)sym->PathBuffer + sub_offs + sub_len >
+ (char *)iov->iov_base + iov->iov_len ||
+ (char *)sym->PathBuffer + print_offs + print_len >
+ (char *)iov->iov_base + iov->iov_len)
return -EINVAL;
return smb2_parse_native_symlink(path,
--
2.52.0
2
1
27 Apr '26
From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
mainline inclusion
from mainline-v7.1-rc1
commit 3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14356
CVE: CVE-2026-31614
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
The bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA
name and value, but ea_data sits at offset sizeof(struct
smb2_file_full_ea_info) = 8 from ea, not at offset 0. The strncmp()
later reads ea->ea_data[0..nlen-1] and the value bytes follow at
ea_data[nlen+1..nlen+vlen], so the actual end is ea->ea_data + nlen + 1
+ vlen. Isn't pointer math fun?
The earlier check (u8 *)ea > end - sizeof(*ea) only guarantees the
8-byte header is in bounds, but since the last EA is placed within 8
bytes of the end of the response, the name and value bytes are read past
the end of iov.
Fix this mess all up by using ea->ea_data as the base for the bounds
check.
An "untrusted" server can use this to leak up to 8 bytes of kernel heap
into the EA name comparison and influence which WSL xattr the data is
interpreted as.
Cc: Ronnie Sahlberg <ronniesahlberg(a)gmail.com>
Cc: Shyam Prasad N <sprasad(a)microsoft.com>
Cc: Tom Talpey <tom(a)talpey.com>
Cc: Bharath SM <bharathsm(a)microsoft.com>
Cc: linux-cifs(a)vger.kernel.org
Cc: samba-technical(a)lists.samba.org
Cc: stable <stable(a)kernel.org>
Assisted-by: gregkh_clanker_t1000
Reviewed-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
fs/smb/client/smb2inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
index d6086394d0b8..cb2fc520f3e5 100644
--- a/fs/smb/client/smb2inode.c
+++ b/fs/smb/client/smb2inode.c
@@ -125,7 +125,7 @@ static int check_wsl_eas(struct kvec *rsp_iov)
nlen = ea->ea_name_length;
vlen = le16_to_cpu(ea->ea_value_length);
if (nlen != SMB2_WSL_XATTR_NAME_LEN ||
- (u8 *)ea + nlen + 1 + vlen > end)
+ (u8 *)ea->ea_data + nlen + 1 + vlen > end)
return -EINVAL;
switch (vlen) {
--
2.52.0
2
1
FIX CVE-2026-31449
Baokun Li (2):
ext4: refactor ext4_ext_rm_idx() to index 'path'
ext4: prevent partial update of the extents path
Tejas Bharambe (1):
ext4: validate p_idx bounds in ext4_ext_correct_indexes
fs/ext4/extents.c | 78 ++++++++++++++++++++++++++++++++++-------------
1 file changed, 57 insertions(+), 21 deletions(-)
--
2.52.0
2
5
27 Apr '26
From: Li Chen <me(a)linux.beauty>
stable inclusion
from stable-v5.10.253
commit 2d2b648960147d078b000b9a7494017082024366
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14193
CVE: CVE-2026-31450
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 1aec30021edd410b986c156f195f3d23959a9d11 ]
ext4_inode_attach_jinode() publishes ei->jinode to concurrent users.
It used to set ei->jinode before jbd2_journal_init_jbd_inode(),
allowing a reader to observe a non-NULL jinode with i_vfs_inode
still unset.
The fast commit flush path can then pass this jinode to
jbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and
may crash.
Below is the crash I observe:
```
BUG: unable to handle page fault for address: 000000010beb47f4
PGD 110e51067 P4D 110e51067 PUD 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014
RIP: 0010:xas_find_marked+0x3d/0x2e0
Code: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f <49> 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02
RSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246
RAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003
RDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10
RBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec
R10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000
R13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88
FS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
<TASK>
filemap_get_folios_tag+0x87/0x2a0
__filemap_fdatawait_range+0x5f/0xd0
? srso_alias_return_thunk+0x5/0xfbef5
? __schedule+0x3e7/0x10c0
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
? srso_alias_return_thunk+0x5/0xfbef5
? cap_safe_nice+0x37/0x70
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
? srso_alias_return_thunk+0x5/0xfbef5
filemap_fdatawait_range_keep_errors+0x12/0x40
ext4_fc_commit+0x697/0x8b0
? ext4_file_write_iter+0x64b/0x950
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
? srso_alias_return_thunk+0x5/0xfbef5
? vfs_write+0x356/0x480
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
ext4_sync_file+0xf7/0x370
do_fsync+0x3b/0x80
? syscall_trace_enter+0x108/0x1d0
__x64_sys_fdatasync+0x16/0x20
do_syscall_64+0x62/0x2c0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
...
```
Fix this by initializing the jbd2_inode first.
Use smp_wmb() and WRITE_ONCE() to publish ei->jinode after
initialization. Readers use READ_ONCE() to fetch the pointer.
Fixes: a361293f5fede ("jbd2: Fix oops in jbd2_journal_file_inode()")
Cc: stable(a)vger.kernel.org
Signed-off-by: Li Chen <me(a)linux.beauty>
Reviewed-by: Jan Kara <jack(a)suse.cz>
Link: https://patch.msgid.link/20260225082617.147957-1-me@linux.beauty
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Cc: stable(a)kernel.org
[ adapted READ_ONCE(jinode) wrapping to split ext4_fc_submit_inode_data_all() and ext4_fc_wait_inode_data_all() ]
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Conflicts:
fs/ext4/fast_commit.c
[This kernel version has not support fast_commit.]
Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com>
---
fs/ext4/inode.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 8f38837f41f3..737f04bc2be6 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -121,21 +121,23 @@ static void ext4_inode_csum_set(struct inode *inode, struct ext4_inode *raw,
}
static inline int ext4_begin_ordered_truncate(struct inode *inode,
loff_t new_size)
{
+ struct jbd2_inode *jinode = READ_ONCE(EXT4_I(inode)->jinode);
+
trace_ext4_begin_ordered_truncate(inode, new_size);
/*
* If jinode is zero, then we never opened the file for
* writing, so there's no need to call
* jbd2_journal_begin_ordered_truncate() since there's no
* outstanding writes we need to flush.
*/
- if (!EXT4_I(inode)->jinode)
+ if (!jinode)
return 0;
return jbd2_journal_begin_ordered_truncate(EXT4_JOURNAL(inode),
- EXT4_I(inode)->jinode,
+ jinode,
new_size);
}
static void ext4_invalidatepage(struct page *page, unsigned int offset,
unsigned int length);
@@ -4446,12 +4448,17 @@ int ext4_inode_attach_jinode(struct inode *inode)
if (!ei->jinode) {
if (!jinode) {
spin_unlock(&inode->i_lock);
return -ENOMEM;
}
- ei->jinode = jinode;
- jbd2_journal_init_jbd_inode(ei->jinode, inode);
+ jbd2_journal_init_jbd_inode(jinode, inode);
+ /*
+ * Publish ->jinode only after it is fully initialized so that
+ * readers never observe a partially initialized jbd2_inode.
+ */
+ smp_wmb();
+ WRITE_ONCE(ei->jinode, jinode);
jinode = NULL;
}
spin_unlock(&inode->i_lock);
if (unlikely(jinode != NULL))
jbd2_free_inode(jinode);
--
2.52.0
2
1
Fix CVE-2026-31449
Baokun Li (2):
ext4: refactor ext4_ext_rm_idx() to index 'path'
ext4: prevent partial update of the extents path
Tejas Bharambe (1):
ext4: validate p_idx bounds in ext4_ext_correct_indexes
fs/ext4/extents.c | 78 ++++++++++++++++++++++++++++++++++-------------
1 file changed, 57 insertions(+), 21 deletions(-)
--
2.52.0
2
4
1. mark node as critical_err on remote RAS error
2. add sysfs interface to set/clear node's critical err status
changelog since v1:
- fix incorrect patch changelog
Wupeng Ma (2):
mm: mark node as critical_err on remote RAS error
numa: add critical_err sysfs interface for remote node recovery
drivers/acpi/apei/ghes.c | 14 +++++++----
drivers/base/numa_remote.c | 48 ++++++++++++++++++++++++++++++++++----
include/linux/mm.h | 19 +++++++++++++++
include/linux/mmzone.h | 4 ++++
mm/migrate.c | 4 ++++
5 files changed, 80 insertions(+), 9 deletions(-)
--
2.43.0
2
3
From: David Vernet <void(a)manifault.com>
mainline inclusion
from mainline-v6.8-rc1
commit 8b7b0e5fe47de90ba6c350f9abece589fb637f79
category: feature
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8335
CVE: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
----------------------------------------------------------------------
In libbpf, when determining whether we need to load vmlinux btf, we're
currently (among other things) checking whether there is any struct_ops
program present in the object. This works for most realistic struct_ops
maps, as a struct_ops map is of course typically composed of one or more
struct_ops programs. However, that technically need not be the case. A
struct_ops interface could be defined which allows a map to be specified
which one or more non-prog fields, and which provides default behavior
if no struct_ops progs is actually provided otherwise. For sched_ext,
for example, you technically only need to specify the name of the
scheduler in the struct_ops map, with the core scheduler logic providing
default behavior if no prog is actually specified.
If we were to define and try to load such a struct_ops map, we would
crash in libbpf when initializing it as obj->btf_vmlinux will be NULL:
Reading symbols from minimal...
(gdb) r
Starting program: minimal_example
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
Program received signal SIGSEGV, Segmentation fault.
0x000055555558308c in btf__type_cnt (btf=0x0) at btf.c:612
612 return btf->start_id + btf->nr_types;
(gdb) bt
type_name=0x5555555d99e3 "sched_ext_ops", kind=4) at btf.c:914
kind=4) at btf.c:942
type=0x7fffffffe558, type_id=0x7fffffffe548, ...
data_member=0x7fffffffe568) at libbpf.c:948
kern_btf=0x0) at libbpf.c:1017
at libbpf.c:8059
So as to account for such bare-bones struct_ops maps, let's update
obj_needs_vmlinux_btf() to also iterate over an obj's maps and check
whether any of them are struct_ops maps.
Signed-off-by: David Vernet <void(a)manifault.com>
Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org>
Reviewed-by: Alan Maguire <alan.maguire(a)oracle.com>
Link: https://lore.kernel.org/bpf/20231208061704.400463-1-void@manifault.com
Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com>
---
tools/lib/bpf/libbpf.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 5f8f0dd589e7..034b4074d690 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -3083,9 +3083,15 @@ static bool prog_needs_vmlinux_btf(struct bpf_program *prog)
return false;
}
+static bool map_needs_vmlinux_btf(struct bpf_map *map)
+{
+ return bpf_map__is_struct_ops(map);
+}
+
static bool obj_needs_vmlinux_btf(const struct bpf_object *obj)
{
struct bpf_program *prog;
+ struct bpf_map *map;
int i;
/* CO-RE relocations need kernel BTF, only when btf_custom_path
@@ -3110,6 +3116,11 @@ static bool obj_needs_vmlinux_btf(const struct bpf_object *obj)
return true;
}
+ bpf_object__for_each_map(map, obj) {
+ if (map_needs_vmlinux_btf(map))
+ return true;
+ }
+
return false;
}
--
2.34.1
2
1
[PATCH OLK-6.6] bpf: Use kallsyms to find the function name of a struct_ops's stub function
by Luo Gengkun 27 Apr '26
by Luo Gengkun 27 Apr '26
27 Apr '26
From: Martin KaFai Lau <martin.lau(a)kernel.org>
mainline inclusion
from mainline-v6.15-rc1
commit 12fdd29d5d71d2987a1aec434b704d850a4d7fcb
category: feature
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8335
CVE: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
----------------------------------------------------------------------
In commit 1611603537a4 ("bpf: Create argument information for nullable arguments."),
it introduced a "__nullable" tagging at the argument name of a
stub function. Some background on the commit:
it requires to tag the stub function instead of directly tagging
the "ops" of a struct. This is because the btf func_proto of the "ops"
does not have the argument name and the "__nullable" is tagged at
the argument name.
To find the stub function of a "ops", it currently relies on a naming
convention on the stub function "st_ops__ops_name".
e.g. tcp_congestion_ops__ssthresh. However, the new kernel
sub system implementing bpf_struct_ops have missed this and
have been surprised that the "__nullable" and the to-be-landed
"__ref" tagging was not effective.
One option would be to give a warning whenever the stub function does
not follow the naming convention, regardless if it requires arg tagging
or not.
Instead, this patch uses the kallsyms_lookup approach and removes
the requirement on the naming convention. The st_ops->cfi_stubs has
all the stub function kernel addresses. kallsyms_lookup() is used to
lookup the function name. With the function name, BTF can be used to
find the BTF func_proto. The existing "__nullable" arg name searching
logic will then fall through.
One notable change is,
if it failed in kallsyms_lookup or it failed in looking up the stub
function name from the BTF, the bpf_struct_ops registration will fail.
This is different from the previous behavior that it silently ignored
the "st_ops__ops_name" function not found error.
The "tcp_congestion_ops", "sched_ext_ops", and "hid_bpf_ops" can still be
registered successfully after this patch. There is struct_ops_maybe_null
selftest to cover the "__nullable" tagging.
Other minor changes:
1. Removed the "%s__%s" format from the pr_warn because the naming
convention is removed.
2. The existing bpf_struct_ops_supported() is also moved earlier
because prepare_arg_info needs to use it to decide if the
stub function is NULL before calling the prepare_arg_info.
Cc: Tejun Heo <tj(a)kernel.org>
Cc: Benjamin Tissoires <bentiss(a)kernel.org>
Cc: Yonghong Song <yonghong.song(a)linux.dev>
Cc: Amery Hung <ameryhung(a)gmail.com>
Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org>
Reviewed-by: Amery Hung <ameryhung(a)gmail.com>
Link: https://lore.kernel.org/r/20250127222719.2544255-1-martin.lau@linux.dev
Signed-off-by: Alexei Starovoitov <ast(a)kernel.org>
Conflicts:
kernel/bpf/bpf_struct_ops.c
[Fix conflict because e42ac1418055
("bpf: Check unsupported ops from the bpf_struct_ops's cfi_stubs'") is not
merged.]
Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com>
---
kernel/bpf/bpf_struct_ops.c | 91 ++++++++++++++++++-------------------
1 file changed, 44 insertions(+), 47 deletions(-)
diff --git a/kernel/bpf/bpf_struct_ops.c b/kernel/bpf/bpf_struct_ops.c
index 32143bc7f73b..a1387f47997d 100644
--- a/kernel/bpf/bpf_struct_ops.c
+++ b/kernel/bpf/bpf_struct_ops.c
@@ -143,39 +143,6 @@ void bpf_struct_ops_image_free(void *image)
}
#define MAYBE_NULL_SUFFIX "__nullable"
-#define MAX_STUB_NAME 128
-
-/* Return the type info of a stub function, if it exists.
- *
- * The name of a stub function is made up of the name of the struct_ops and
- * the name of the function pointer member, separated by "__". For example,
- * if the struct_ops type is named "foo_ops" and the function pointer
- * member is named "bar", the stub function name would be "foo_ops__bar".
- */
-static const struct btf_type *
-find_stub_func_proto(const struct btf *btf, const char *st_op_name,
- const char *member_name)
-{
- char stub_func_name[MAX_STUB_NAME];
- const struct btf_type *func_type;
- s32 btf_id;
- int cp;
-
- cp = snprintf(stub_func_name, MAX_STUB_NAME, "%s__%s",
- st_op_name, member_name);
- if (cp >= MAX_STUB_NAME) {
- pr_warn("Stub function name too long\n");
- return NULL;
- }
- btf_id = btf_find_by_name_kind(btf, stub_func_name, BTF_KIND_FUNC);
- if (btf_id < 0)
- return NULL;
- func_type = btf_type_by_id(btf, btf_id);
- if (!func_type)
- return NULL;
-
- return btf_type_by_id(btf, func_type->type); /* FUNC_PROTO */
-}
/* Prepare argument info for every nullable argument of a member of a
* struct_ops type.
@@ -200,27 +167,42 @@ find_stub_func_proto(const struct btf *btf, const char *st_op_name,
static int prepare_arg_info(struct btf *btf,
const char *st_ops_name,
const char *member_name,
- const struct btf_type *func_proto,
+ const struct btf_type *func_proto, void *stub_func_addr,
struct bpf_struct_ops_arg_info *arg_info)
{
const struct btf_type *stub_func_proto, *pointed_type;
const struct btf_param *stub_args, *args;
struct bpf_ctx_arg_aux *info, *info_buf;
u32 nargs, arg_no, info_cnt = 0;
+ char ksym[KSYM_SYMBOL_LEN];
+ const char *stub_fname;
+ s32 stub_func_id;
u32 arg_btf_id;
int offset;
- stub_func_proto = find_stub_func_proto(btf, st_ops_name, member_name);
- if (!stub_func_proto)
- return 0;
+ stub_fname = kallsyms_lookup((unsigned long)stub_func_addr, NULL, NULL, NULL, ksym);
+ if (!stub_fname) {
+ pr_warn("Cannot find the stub function name for the %s in struct %s\n",
+ member_name, st_ops_name);
+ return -ENOENT;
+ }
+
+ stub_func_id = btf_find_by_name_kind(btf, stub_fname, BTF_KIND_FUNC);
+ if (stub_func_id < 0) {
+ pr_warn("Cannot find the stub function %s in btf\n", stub_fname);
+ return -ENOENT;
+ }
+
+ stub_func_proto = btf_type_by_id(btf, stub_func_id);
+ stub_func_proto = btf_type_by_id(btf, stub_func_proto->type);
/* Check if the number of arguments of the stub function is the same
* as the number of arguments of the function pointer.
*/
nargs = btf_type_vlen(func_proto);
if (nargs != btf_type_vlen(stub_func_proto)) {
- pr_warn("the number of arguments of the stub function %s__%s does not match the number of arguments of the member %s of struct %s\n",
- st_ops_name, member_name, member_name, st_ops_name);
+ pr_warn("the number of arguments of the stub function %s does not match the number of arguments of the member %s of struct %s\n",
+ stub_fname, member_name, st_ops_name);
return -EINVAL;
}
@@ -250,21 +232,21 @@ static int prepare_arg_info(struct btf *btf,
&arg_btf_id);
if (!pointed_type ||
!btf_type_is_struct(pointed_type)) {
- pr_warn("stub function %s__%s has %s tagging to an unsupported type\n",
- st_ops_name, member_name, MAYBE_NULL_SUFFIX);
+ pr_warn("stub function %s has %s tagging to an unsupported type\n",
+ stub_fname, MAYBE_NULL_SUFFIX);
goto err_out;
}
offset = btf_ctx_arg_offset(btf, func_proto, arg_no);
if (offset < 0) {
- pr_warn("stub function %s__%s has an invalid trampoline ctx offset for arg#%u\n",
- st_ops_name, member_name, arg_no);
+ pr_warn("stub function %s has an invalid trampoline ctx offset for arg#%u\n",
+ stub_fname, arg_no);
goto err_out;
}
if (args[arg_no].type != stub_args[arg_no].type) {
- pr_warn("arg#%u type in stub function %s__%s does not match with its original func_proto\n",
- arg_no, st_ops_name, member_name);
+ pr_warn("arg#%u type in stub function %s does not match with its original func_proto\n",
+ arg_no, stub_fname);
goto err_out;
}
@@ -321,6 +303,13 @@ static bool is_module_member(const struct btf *btf, u32 id)
return !strcmp(btf_name_by_offset(btf, t->name_off), "module");
}
+int bpf_struct_ops_supported(const struct bpf_struct_ops *st_ops, u32 moff)
+{
+ void *func_ptr = *(void **)(st_ops->cfi_stubs + moff);
+
+ return func_ptr ? 0 : -ENOTSUPP;
+}
+
int bpf_struct_ops_desc_init(struct bpf_struct_ops_desc *st_ops_desc,
struct btf *btf,
struct bpf_verifier_log *log)
@@ -379,7 +368,10 @@ int bpf_struct_ops_desc_init(struct bpf_struct_ops_desc *st_ops_desc,
for_each_member(i, t, member) {
const struct btf_type *func_proto;
+ void **stub_func_addr;
+ u32 moff;
+ moff = __btf_member_bit_offset(t, member) / 8;
mname = btf_name_by_offset(btf, member->name_off);
if (!*mname) {
pr_warn("anon member in struct %s is not supported\n",
@@ -405,7 +397,11 @@ int bpf_struct_ops_desc_init(struct bpf_struct_ops_desc *st_ops_desc,
func_proto = btf_type_resolve_func_ptr(btf,
member->type,
NULL);
- if (!func_proto)
+
+ /* The member is not a function pointer or
+ * the function pointer is not supported.
+ */
+ if (!func_proto || bpf_struct_ops_supported(st_ops, moff))
continue;
if (btf_distill_func_proto(log, btf,
@@ -417,8 +413,9 @@ int bpf_struct_ops_desc_init(struct bpf_struct_ops_desc *st_ops_desc,
goto errout;
}
+ stub_func_addr = *(void **)(st_ops->cfi_stubs + moff);
err = prepare_arg_info(btf, st_ops->name, mname,
- func_proto,
+ func_proto, stub_func_addr,
arg_info + i);
if (err)
goto errout;
--
2.34.1
2
1
1. mark node as critical_err on remote RAS error
2. add sysfs interface to set/clear node's critical err status
Wupeng Ma (2):
mm: mark node as critical_err on remote RAS error
numa: add critical_err sysfs interface for remote node recovery
drivers/acpi/apei/ghes.c | 14 +++++++----
drivers/base/numa_remote.c | 48 ++++++++++++++++++++++++++++++++++----
include/linux/mm.h | 19 +++++++++++++++
include/linux/mmzone.h | 4 ++++
mm/migrate.c | 4 ++++
5 files changed, 80 insertions(+), 9 deletions(-)
--
2.43.0
2
3
Fix CVE-2026-31449
Baokun Li (2):
ext4: refactor ext4_ext_rm_idx() to index 'path'
ext4: prevent partial update of the extents path
Tejas Bharambe (1):
ext4: validate p_idx bounds in ext4_ext_correct_indexes
fs/ext4/extents.c | 78 ++++++++++++++++++++++++++++++++++-------------
1 file changed, 57 insertions(+), 21 deletions(-)
--
2.52.0
2
4
您好！
Kernel 邀请您参加 2026-05-08 14:00 召开的WeLink会议(自动录制)
会议主题：openEuler Kernel SIG双周例会
会议发起人： LiaoTao_Wave
会议内容：
1. 进展update
2. 议题征集中（新增议题可直接填报至会议纪要看板）
会议链接：https://meeting.huaweicloud.com:36443/#/j/961112036
会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings
更多资讯尽在：https://www.openeuler.org/zh/
Hello!
Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-05-08 14:00
The subject of the conference is openEuler Kernel SIG双周例会
The sponsor of the conference is LiaoTao_Wave
Summary:
1. 进展update
2. 议题征集中（新增议题可直接填报至会议纪要看板）
You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/961112036
Add topics at https://etherpad.openeuler.org/p/Kernel-meetings
More information: https://www.openeuler.org/en/
1
0
27 Apr '26
From: "Masami Hiramatsu (Google)" <mhiramat(a)kernel.org>
stable inclusion
from stable-v6.6.135
commit 8b6767e4141b2a42745b544d4555cf1614ba1a2d
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/9015
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit e113f0b46d19626ec15388bcb91432c9a4fd6261 upstream.
After we hit ftrace is killed by some errors, the kernel crash if
we remove modules in which kprobe probes.
BUG: unable to handle page fault for address: fffffbfff805000d
PGD 817fcc067 P4D 817fcc067 PUD 817fc8067 PMD 101555067 PTE 0
Oops: Oops: 0000 [#1] SMP KASAN PTI
CPU: 4 UID: 0 PID: 2012 Comm: rmmod Tainted: G W OE
Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
RIP: 0010:kprobes_module_callback+0x89/0x790
RSP: 0018:ffff88812e157d30 EFLAGS: 00010a02
RAX: 1ffffffff805000d RBX: dffffc0000000000 RCX: ffffffff86a8de90
RDX: ffffed1025c2af9b RSI: 0000000000000008 RDI: ffffffffc0280068
RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed1025c2af9a
R10: ffff88812e157cd7 R11: 205d323130325420 R12: 0000000000000002
R13: ffffffffc0290488 R14: 0000000000000002 R15: ffffffffc0280040
FS: 00007fbc450dd740(0000) GS:ffff888420331000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff805000d CR3: 000000010f624000 CR4: 00000000000006f0
Call Trace:
<TASK>
notifier_call_chain+0xc6/0x280
blocking_notifier_call_chain+0x60/0x90
__do_sys_delete_module.constprop.0+0x32a/0x4e0
do_syscall_64+0x5d/0xfa0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
This is because the kprobe on ftrace does not correctly handles
the kprobe_ftrace_disabled flag set by ftrace_kill().
To prevent this error, check kprobe_ftrace_disabled in
__disarm_kprobe_ftrace() and skip all ftrace related operations.
Link: https://lore.kernel.org/all/176473947565.1727781.13110060700668331950.stgit…
Reported-by: Ye Bin <yebin10(a)huawei.com>
Closes: https://lore.kernel.org/all/20251125020536.2484381-1-yebin@huaweicloud.com/
Fixes: ae6aa16fdc16 ("kprobes: introduce ftrace based optimization")
Cc: stable(a)vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
Acked-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Tengda Wu <wutengda2(a)huawei.com>
---
kernel/kprobes.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 367da1154fb1..a4a9846cd495 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1116,6 +1116,10 @@ static int __disarm_kprobe_ftrace(struct kprobe *p, struct ftrace_ops *ops,
int ret;
lockdep_assert_held(&kprobe_mutex);
+ if (unlikely(kprobe_ftrace_disabled)) {
+ /* Now ftrace is disabled forever, disarm is already done. */
+ return 0;
+ }
if (*cnt == 1) {
ret = unregister_ftrace_function(ops);
--
2.34.1
2
1
[PATCH OLK-5.10] netfilter: xt_CT: drop pending enqueued packets on template removal
by Dong Chenchen 27 Apr '26
by Dong Chenchen 27 Apr '26
27 Apr '26
From: Pablo Neira Ayuso <pablo(a)netfilter.org>
mainline inclusion
from mainline-v7.0-rc3
commit f62a218a946b19bb59abdd5361da85fa4606b96b
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14022
CVE: CVE-2026-23391
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
Templates refer to objects that can go away while packets are sitting in
nfqueue refer to:
- helper, this can be an issue on module removal.
- timeout policy, nfnetlink_cttimeout might remove it.
The use of templates with zone and event cache filter are safe, since
this just copies values.
Flush these enqueued packets in case the template rule gets removed.
Fixes: 24de58f46516 ("netfilter: xt_CT: allow to attach timeout policy + glue code")
Reported-by: Yiming Qian <yimingqian591(a)gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org>
Signed-off-by: Florian Westphal <fw(a)strlen.de>
Conflicts:
net/netfilter/xt_CT.c
[commit e14575fa7529 is not backport]
Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com>
---
net/netfilter/xt_CT.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index d4deee39158b..cb071354d247 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -16,6 +16,7 @@
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_timeout.h>
#include <net/netfilter/nf_conntrack_zones.h>
+#include "nf_internals.h"
static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
{
@@ -271,6 +272,9 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
struct nf_conn_help *help;
if (ct) {
+ if (info->helper[0] || info->timeout[0])
+ nf_queue_nf_hook_drop(par->net);
+
help = nfct_help(ct);
if (help)
nf_conntrack_helper_put(help->helper);
--
2.25.1
2
1
[PATCH OLK-5.10] netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
by Dong Chenchen 27 Apr '26
by Dong Chenchen 27 Apr '26
27 Apr '26
From: Yuan Tan <tanyuan98(a)outlook.com>
mainline inclusion
from mainline-v7.0-rc2
commit 329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13902
CVE: CVE-2026-23274
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
IDLETIMER revision 0 rules reuse existing timers by label and always call
mod_timer() on timer->timer.
If the label was created first by revision 1 with XT_IDLETIMER_ALARM,
the object uses alarm timer semantics and timer->timer is never initialized.
Reusing that object from revision 0 causes mod_timer() on an uninitialized
timer_list, triggering debugobjects warnings and possible panic when
panic_on_warn=1.
Fix this by rejecting revision 0 rule insertion when an existing timer with
the same label is of ALARM type.
Fixes: 68983a354a65 ("netfilter: xtables: Add snapshot of hardidletimer target")
Co-developed-by: Yifan Wu <yifanwucs(a)gmail.com>
Signed-off-by: Yifan Wu <yifanwucs(a)gmail.com>
Co-developed-by: Juefei Pu <tomapufckgml(a)gmail.com>
Signed-off-by: Juefei Pu <tomapufckgml(a)gmail.com>
Signed-off-by: Yuan Tan <tanyuan98(a)outlook.com>
Signed-off-by: Xin Liu <dstsmallbird(a)foxmail.com>
Signed-off-by: Florian Westphal <fw(a)strlen.de>
Conflicts:
net/netfilter/xt_IDLETIMER.c
[commit f4293c2baf6f is not backport]
Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com>
---
net/netfilter/xt_IDLETIMER.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index 2f7cf5ecebf4..d35ff0a2cad8 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -320,6 +320,12 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par)
info->timer = __idletimer_tg_find_by_label(info->label);
if (info->timer) {
+ if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
+ pr_debug("Adding/Replacing rule with same label and different timer type is not allowed\n");
+ mutex_unlock(&list_mutex);
+ return -EINVAL;
+ }
+
info->timer->refcnt++;
mod_timer(&info->timer->timer,
msecs_to_jiffies(info->timeout * 1000) + jiffies);
--
2.25.1
2
1
[PATCH OLK-5.10] netfilter: nf_tables: unconditionally bump set->nelems before insertion
by Dong Chenchen 27 Apr '26
by Dong Chenchen 27 Apr '26
27 Apr '26
From: Pablo Neira Ayuso <pablo(a)netfilter.org>
mainline inclusion
from mainline-v7.0-rc1
commit def602e498a4f951da95c95b1b8ce8ae68aa733a
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13901
CVE: CVE-2026-23272
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
In case that the set is full, a new element gets published then removed
without waiting for the RCU grace period, while RCU reader can be
walking over it already.
To address this issue, add the element transaction even if set is full,
but toggle the set_full flag to report -ENFILE so the abort path safely
unwinds the set to its previous state.
As for element updates, decrement set->nelems to restore it.
A simpler fix is to call synchronize_rcu() in the error path.
However, with a large batch adding elements to already maxed-out set,
this could cause noticeable slowdown of such batches.
Fixes: 35d0ac9070ef ("netfilter: nf_tables: fix set->nelems counting with no NLM_F_EXCL")
Reported-by: Inseo An <y0un9sa(a)gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org>
Signed-off-by: Florian Westphal <fw(a)strlen.de>
Conflicts:
net/netfilter/nf_tables_api.c
[commit 664899e85c13, 078996fcd657, 34aae2c2fb1e, 4201f3938914,
d4b7f29eb85c and 4ee29181216d are not backport]
Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com>
---
net/netfilter/nf_tables_api.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 649b27999102..2beef989cced 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5581,6 +5581,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
struct nft_data_desc desc;
enum nft_registers dreg;
struct nft_trans *trans;
+ bool set_full = false;
u32 flags = 0;
u64 timeout;
u64 expiration;
@@ -5785,10 +5786,14 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
goto err_elem_expr;
expr = NULL;
+ if (set->size &&
+ atomic_inc_return(&set->nelems) > (set->size + set->ndeact))
+ set_full = true;
+
trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
if (trans == NULL) {
err = -ENOMEM;
- goto err_elem_expr;
+ goto err_set_size;
}
ext->genmask = nft_genmask_cur(ctx->net);
@@ -5820,20 +5825,14 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
goto err_element_clash;
}
- if (set->size &&
- !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
- err = -ENFILE;
- goto err_set_full;
- }
-
nft_trans_elem(trans) = elem;
nft_trans_commit_list_add_tail(ctx->net, trans);
- return 0;
+ return set_full ? -ENFILE : 0;
-err_set_full:
- set->ops->remove(ctx->net, set, &elem);
err_element_clash:
kfree(trans);
+err_set_size:
+ atomic_dec(&set->nelems);
err_elem_expr:
nf_tables_set_elem_destroy(ctx, set, elem.priv);
err_parse_data:
--
2.25.1
2
1
[PATCH OLK-5.10] net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
by Dong Chenchen 27 Apr '26
by Dong Chenchen 27 Apr '26
27 Apr '26
From: Koichiro Den <den(a)valinux.co.jp>
mainline inclusion
from mainline-v7.0-rc1
commit 7f083faf59d14c04e01ec05a7507f036c965acf8
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13941
CVE: CVE-2026-23340
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
When shrinking the number of real tx queues,
netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush
qdiscs for queues which will no longer be used.
qdisc_reset_all_tx_gt() currently serializes qdisc_reset() with
qdisc_lock(). However, for lockless qdiscs, the dequeue path is
serialized by qdisc_run_begin/end() using qdisc->seqlock instead, so
qdisc_reset() can run concurrently with __qdisc_run() and free skbs
while they are still being dequeued, leading to UAF.
This can easily be reproduced on e.g. virtio-net by imposing heavy
traffic while frequently changing the number of queue pairs:
iperf3 -ub0 -c $peer -t 0 &
while :; do
ethtool -L eth0 combined 1
ethtool -L eth0 combined 2
done
With KASAN enabled, this leads to reports like:
BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760
...
Call Trace:
<TASK>
...
__qdisc_run+0x133f/0x1760
__dev_queue_xmit+0x248f/0x3550
ip_finish_output2+0xa42/0x2110
ip_output+0x1a7/0x410
ip_send_skb+0x2e6/0x480
udp_send_skb+0xb0a/0x1590
udp_sendmsg+0x13c9/0x1fc0
...
</TASK>
Allocated by task 1270 on cpu 5 at 44.558414s:
...
alloc_skb_with_frags+0x84/0x7c0
sock_alloc_send_pskb+0x69a/0x830
__ip_append_data+0x1b86/0x48c0
ip_make_skb+0x1e8/0x2b0
udp_sendmsg+0x13a6/0x1fc0
...
Freed by task 1306 on cpu 3 at 44.558445s:
...
kmem_cache_free+0x117/0x5e0
pfifo_fast_reset+0x14d/0x580
qdisc_reset+0x9e/0x5f0
netif_set_real_num_tx_queues+0x303/0x840
virtnet_set_channels+0x1bf/0x260 [virtio_net]
ethnl_set_channels+0x684/0xae0
ethnl_default_set_doit+0x31a/0x890
...
Serialize qdisc_reset_all_tx_gt() against the lockless dequeue path by
taking qdisc->seqlock for TCQ_F_NOLOCK qdiscs, matching the
serialization model already used by dev_reset_queue().
Additionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state
reflects an empty queue, avoiding needless re-scheduling.
Fixes: 6b3ba9146fe6 ("net: sched: allow qdiscs to handle locking")
Signed-off-by: Koichiro Den <den(a)valinux.co.jp>
Link: https://patch.msgid.link/20260228145307.3955532-1-den@valinux.co.jp
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Conflicts:
include/net/sch_generic.h
[commit c4fef01ba479 is not backport]
Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com>
---
include/net/sch_generic.h | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 46afe852c455..d010017d69f1 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -751,13 +751,22 @@ static inline bool skb_skip_tc_classify(struct sk_buff *skb)
static inline void qdisc_reset_all_tx_gt(struct net_device *dev, unsigned int i)
{
struct Qdisc *qdisc;
+ bool nolock;
for (; i < dev->num_tx_queues; i++) {
qdisc = rtnl_dereference(netdev_get_tx_queue(dev, i)->qdisc);
if (qdisc) {
+ nolock = qdisc->flags & TCQ_F_NOLOCK;
+
+ if (nolock)
+ spin_lock_bh(&qdisc->seqlock);
spin_lock_bh(qdisc_lock(qdisc));
qdisc_reset(qdisc);
spin_unlock_bh(qdisc_lock(qdisc));
+ if (nolock) {
+ clear_bit(__QDISC_STATE_MISSED, &qdisc->state);
+ spin_unlock_bh(&qdisc->seqlock);
+ }
}
}
}
--
2.25.1
2
1
Fix CVE-2026-23351
Florian Westphal (2):
netfilter: nf_tables: de-constify set commit ops function argument
netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
include/net/netfilter/nf_tables.h | 7 +++-
net/netfilter/nf_tables_api.c | 5 ---
net/netfilter/nft_set_pipapo.c | 54 ++++++++++++++++++++++++-------
net/netfilter/nft_set_pipapo.h | 2 ++
4 files changed, 51 insertions(+), 17 deletions(-)
--
2.25.1
2
3
27 Apr '26
From: Eric Dumazet <edumazet(a)google.com>
mainline inclusion
from mainline-v6.19-rc7
commit c84fcb79e5dbde0b8d5aeeaf04282d2149aebcf6
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13633
CVE: CVE-2026-23099
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
BOND_MODE_8023AD makes sense for ARPHRD_ETHER only.
syzbot reported:
BUG: KASAN: global-out-of-bounds in __hw_addr_create net/core/dev_addr_lists.c:63 [inline]
BUG: KASAN: global-out-of-bounds in __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118
Read of size 16 at addr ffffffff8bf94040 by task syz.1.3580/19497
CPU: 1 UID: 0 PID: 19497 Comm: syz.1.3580 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:200
__asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
__hw_addr_create net/core/dev_addr_lists.c:63 [inline]
__hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118
__dev_mc_add net/core/dev_addr_lists.c:868 [inline]
dev_mc_add+0xa1/0x120 net/core/dev_addr_lists.c:886
bond_enslave+0x2b8b/0x3ac0 drivers/net/bonding/bond_main.c:2180
do_set_master+0x533/0x6d0 net/core/rtnetlink.c:2963
do_setlink+0xcf0/0x41c0 net/core/rtnetlink.c:3165
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x161c/0x1c90 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:742
____sys_sendmsg+0x505/0x820 net/socket.c:2592
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2646
__sys_sendmsg+0x164/0x220 net/socket.c:2678
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
__do_fast_syscall_32+0x1dc/0x560 arch/x86/entry/syscall_32.c:307
do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:332
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
</TASK>
The buggy address belongs to the variable:
lacpdu_mcast_addr+0x0/0x40
Fixes: 872254dd6b1f ("net/bonding: Enable bonding to enslave non ARPHRD_ETHER")
Reported-by: syzbot+9c081b17773615f24672(a)syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6966946b.a70a0220.245e30.0002.GAE@google.com…
Signed-off-by: Eric Dumazet <edumazet(a)google.com>
Cc: Andrew Lunn <andrew+netdev(a)lunn.ch>
Acked-by: Jay Vosburgh <jv(a)jvosburgh.net>
Link: https://patch.msgid.link/20260113191201.3970737-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Conflicts:
drivers/net/bonding/bond_main.c
[commit 6569fa2d4e014 is not backport]
Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com>
---
drivers/net/bonding/bond_main.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 6eb2db8d07c0..f0029195bce4 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1799,6 +1799,12 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
*/
if (!bond_has_slaves(bond)) {
if (bond_dev->type != slave_dev->type) {
+ if (slave_dev->type != ARPHRD_ETHER &&
+ BOND_MODE(bond) == BOND_MODE_8023AD) {
+ NL_SET_ERR_MSG(extack, "8023AD mode requires Ethernet devices");
+ slave_err(bond_dev, slave_dev, "Error: 8023AD mode requires Ethernet devices\n");
+ return -EINVAL;
+ }
slave_dbg(bond_dev, slave_dev, "change device type from %d to %d\n",
bond_dev->type, slave_dev->type);
--
2.25.1
2
1
[PATCH OLK-5.10] media: dvb-net: fix OOB access in ULE extension header tables
by Liu Kai 25 Apr '26
by Liu Kai 25 Apr '26
25 Apr '26
From: Ariel Silver <arielsilver77(a)gmail.com>
mainline inclusion
from mainline-v7.0-rc3
commit 24d87712727a5017ad142d63940589a36cd25647
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14132
CVE: CVE-2026-31405
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables
in handle_one_ule_extension() are declared with 255 elements (valid
indices 0-254), but the index htype is derived from network-controlled
data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When
htype equals 255, an out-of-bounds read occurs on the function pointer
table, and the OOB value may be called as a function pointer.
Add a bounds check on htype against the array size before either table
is accessed. Out-of-range values now cause the SNDU to be discarded.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Ariel Silver <arielsilver77(a)gmail.com>
Signed-off-by: Ariel Silver <arielsilver77(a)gmail.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
Signed-off-by: Liu Kai <liukai284(a)huawei.com>
---
drivers/media/dvb-core/dvb_net.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c
index c594b1bdfcaa..c8cbe901bcf0 100644
--- a/drivers/media/dvb-core/dvb_net.c
+++ b/drivers/media/dvb-core/dvb_net.c
@@ -228,6 +228,9 @@ static int handle_one_ule_extension( struct dvb_net_priv *p )
unsigned char hlen = (p->ule_sndu_type & 0x0700) >> 8;
unsigned char htype = p->ule_sndu_type & 0x00FF;
+ if (htype >= ARRAY_SIZE(ule_mandatory_ext_handlers))
+ return -1;
+
/* Discriminate mandatory and optional extension headers. */
if (hlen == 0) {
/* Mandatory extension header */
--
2.34.1
2
1
25 Apr '26
From: Hyunwoo Kim <imv4bel(a)gmail.com>
mainline inclusion
from mainline-v7.0-rc6
commit 9bbb19d21ded7d78645506f20d8c44895e3d0fb9
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14217
CVE: CVE-2026-31476
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
When a multichannel session binding request fails (e.g. wrong password),
the error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED.
However, during binding, sess points to the target session looked up via
ksmbd_session_lookup_slowpath() -- which belongs to another connection's
user. This allows a remote attacker to invalidate any active session by
simply sending a binding request with a wrong password (DoS).
Fix this by skipping session expiration when the failed request was
a binding attempt, since the session does not belong to the current
connection. The reference taken by ksmbd_session_lookup_slowpath() is
still correctly released via ksmbd_user_session_put().
Cc: stable(a)vger.kernel.org
Signed-off-by: Hyunwoo Kim <imv4bel(a)gmail.com>
Acked-by: Namjae Jeon <linkinjeon(a)kernel.org>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
Conflicts:
fs/smb/server/smb2pdu.c
[Commit 38c8a9a52082 ("smb: move client and server files to common
directory fs/smb") move smb2pdu.c from fs/ksmbd to fs/smb/server.]
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
fs/ksmbd/smb2pdu.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
index d75de3035327..176a6a51be6d 100644
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -1912,8 +1912,14 @@ int smb2_sess_setup(struct ksmbd_work *work)
if (sess->user && sess->user->flags & KSMBD_USER_FLAG_DELAY_SESSION)
try_delay = true;
- sess->last_active = jiffies;
- sess->state = SMB2_SESSION_EXPIRED;
+ /*
+ * For binding requests, session belongs to another
+ * connection. Do not expire it.
+ */
+ if (!(req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) {
+ sess->last_active = jiffies;
+ sess->state = SMB2_SESSION_EXPIRED;
+ }
if (try_delay) {
ksmbd_conn_set_need_reconnect(conn);
ssleep(5);
--
2.52.0
2
1
From: Keith Busch <kbusch(a)kernel.org>
stable inclusion
from stable-v5.10.253
commit 965e2c943f065122f14282a88d70a8a92e12a4da
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14256
CVE: CVE-2026-31523
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 166e31d7dbf6aa44829b98aa446bda5c9580f12a ]
A user can change the polled queue count at run time. There's a brief
window during a reset where a hipri task may try to poll that queue
before the block layer has updated the queue maps, which would race with
the now interrupt driven queue and may cause double completions.
Reviewed-by: Christoph Hellwig <hch(a)lst.de>
Reviewed-by: Kanchan Joshi <joshi.k(a)samsung.com>
Signed-off-by: Keith Busch <kbusch(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
drivers/nvme/host/pci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 5591ecff6ee8..8be07d3c99a5 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1102,7 +1102,8 @@ static int nvme_poll(struct blk_mq_hw_ctx *hctx)
struct nvme_queue *nvmeq = hctx->driver_data;
bool found;
- if (!nvme_cqe_pending(nvmeq))
+ if (!test_bit(NVMEQ_POLLED, &nvmeq->flags) ||
+ !nvme_cqe_pending(nvmeq))
return 0;
spin_lock(&nvmeq->cq_poll_lock);
--
2.52.0
2
1
From: Keith Busch <kbusch(a)kernel.org>
stable inclusion
from stable-v6.6.131
commit 6f12734c4b619f923a4df0b1a46b8098b187d324
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14256
CVE: CVE-2026-31523
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 166e31d7dbf6aa44829b98aa446bda5c9580f12a ]
A user can change the polled queue count at run time. There's a brief
window during a reset where a hipri task may try to poll that queue
before the block layer has updated the queue maps, which would race with
the now interrupt driven queue and may cause double completions.
Reviewed-by: Christoph Hellwig <hch(a)lst.de>
Reviewed-by: Kanchan Joshi <joshi.k(a)samsung.com>
Signed-off-by: Keith Busch <kbusch(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
drivers/nvme/host/pci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index d01712c3b144..da4bb0da4f27 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1131,7 +1131,8 @@ static int nvme_poll(struct blk_mq_hw_ctx *hctx, struct io_comp_batch *iob)
struct nvme_queue *nvmeq = hctx->driver_data;
bool found;
- if (!nvme_cqe_pending(nvmeq))
+ if (!test_bit(NVMEQ_POLLED, &nvmeq->flags) ||
+ !nvme_cqe_pending(nvmeq))
return 0;
spin_lock(&nvmeq->cq_poll_lock);
--
2.52.0
2
1
25 Apr '26
From: Edward Adam Davis <eadavis(a)qq.com>
stable inclusion
from stable-v6.6.131
commit ecc50bfca9b5c2ee6aeef998181689b80477367b
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14191
CVE: CVE-2026-31448
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 5422fe71d26d42af6c454ca9527faaad4e677d6c upstream.
On the mkdir/mknod path, when mapping logical blocks to physical blocks,
if inserting a new extent into the extent tree fails (in this example,
because the file system disabled the huge file feature when marking the
inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to
reclaim the physical block without deleting the corresponding data in
the extent tree. This causes subsequent mkdir operations to reference
the previously reclaimed physical block number again, even though this
physical block is already being used by the xattr block. Therefore, a
situation arises where both the directory and xattr are using the same
buffer head block in memory simultaneously.
The above causes ext4_xattr_block_set() to enter an infinite loop about
"inserted" and cannot release the inode lock, ultimately leading to the
143s blocking problem mentioned in [1].
If the metadata is corrupted, then trying to remove some extent space
can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE
was passed, remove space wrongly update quota information.
Jan Kara suggests distinguishing between two cases:
1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully
consistent and we must maintain its consistency including all the
accounting. However these errors can happen only early before we've
inserted the extent into the extent tree. So current code works correctly
for this case.
2) Some other error - this means metadata is corrupted. We should strive to
do as few modifications as possible to limit damage. So I'd just skip
freeing of allocated blocks.
[1]
INFO: task syz.0.17:5995 blocked for more than 143 seconds.
Call Trace:
inode_lock_nested include/linux/fs.h:1073 [inline]
__start_dirop fs/namei.c:2923 [inline]
start_dirop fs/namei.c:2934 [inline]
Reported-by: syzbot+512459401510e2a9a39f(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1659aaaaa8d9d11265d7
Tested-by: syzbot+1659aaaaa8d9d11265d7(a)syzkaller.appspotmail.com
Reported-by: syzbot+1659aaaaa8d9d11265d7(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=512459401510e2a9a39f
Tested-by: syzbot+1659aaaaa8d9d11265d7(a)syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis(a)qq.com>
Reviewed-by: Jan Kara <jack(a)suse.cz>
Tested-by: syzbot+512459401510e2a9a39f(a)syzkaller.appspotmail.com
Link: https://patch.msgid.link/tencent_43696283A68450B761D76866C6F360E36705@qq.com
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Cc: stable(a)kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Conflicts:
fs/ext4/extents.c
[Commit fb138df7d886 ("ext4: get rid of ppath in
ext4_ext_insert_extent()") change the way to judge the result of
ext4_ext_insert_extent() in ext4_ext_map_blocks().]
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
fs/ext4/extents.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 4c77284be84d..7045784f9340 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4373,9 +4373,13 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
err = ext4_ext_insert_extent(handle, inode, &path, &newex, flags);
if (err) {
- if (allocated_clusters) {
+ /*
+ * Gracefully handle out of space conditions. If the filesystem
+ * is inconsistent, we'll just leak allocated blocks to avoid
+ * causing even more damage.
+ */
+ if (allocated_clusters && (err == -EDQUOT || err == -ENOSPC)) {
int fb_flags = 0;
-
/*
* free data blocks we just allocated.
* not a good idea to call discard here directly,
--
2.52.0
2
1
25 Apr '26
From: Edward Adam Davis <eadavis(a)qq.com>
stable inclusion
from stable-v6.6.131
commit ecc50bfca9b5c2ee6aeef998181689b80477367b
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14191
CVE: CVE-2026-31448
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 5422fe71d26d42af6c454ca9527faaad4e677d6c upstream.
On the mkdir/mknod path, when mapping logical blocks to physical blocks,
if inserting a new extent into the extent tree fails (in this example,
because the file system disabled the huge file feature when marking the
inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to
reclaim the physical block without deleting the corresponding data in
the extent tree. This causes subsequent mkdir operations to reference
the previously reclaimed physical block number again, even though this
physical block is already being used by the xattr block. Therefore, a
situation arises where both the directory and xattr are using the same
buffer head block in memory simultaneously.
The above causes ext4_xattr_block_set() to enter an infinite loop about
"inserted" and cannot release the inode lock, ultimately leading to the
143s blocking problem mentioned in [1].
If the metadata is corrupted, then trying to remove some extent space
can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE
was passed, remove space wrongly update quota information.
Jan Kara suggests distinguishing between two cases:
1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully
consistent and we must maintain its consistency including all the
accounting. However these errors can happen only early before we've
inserted the extent into the extent tree. So current code works correctly
for this case.
2) Some other error - this means metadata is corrupted. We should strive to
do as few modifications as possible to limit damage. So I'd just skip
freeing of allocated blocks.
[1]
INFO: task syz.0.17:5995 blocked for more than 143 seconds.
Call Trace:
inode_lock_nested include/linux/fs.h:1073 [inline]
__start_dirop fs/namei.c:2923 [inline]
start_dirop fs/namei.c:2934 [inline]
Reported-by: syzbot+512459401510e2a9a39f(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1659aaaaa8d9d11265d7
Tested-by: syzbot+1659aaaaa8d9d11265d7(a)syzkaller.appspotmail.com
Reported-by: syzbot+1659aaaaa8d9d11265d7(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=512459401510e2a9a39f
Tested-by: syzbot+1659aaaaa8d9d11265d7(a)syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis(a)qq.com>
Reviewed-by: Jan Kara <jack(a)suse.cz>
Tested-by: syzbot+512459401510e2a9a39f(a)syzkaller.appspotmail.com
Link: https://patch.msgid.link/tencent_43696283A68450B761D76866C6F360E36705@qq.com
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Cc: stable(a)kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Conflicts:
fs/ext4/extents.c
[Commit fb138df7d886 ("ext4: get rid of ppath in
ext4_ext_insert_extent()") change the way to judge the result of
ext4_ext_insert_extent() in ext4_ext_map_blocks().]
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
fs/ext4/extents.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index dbc2154f7d4e..997c437685a0 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4381,9 +4381,13 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
err = ext4_ext_insert_extent(handle, inode, &path, &newex, flags);
if (err) {
- if (allocated_clusters) {
+ /*
+ * Gracefully handle out of space conditions. If the filesystem
+ * is inconsistent, we'll just leak allocated blocks to avoid
+ * causing even more damage.
+ */
+ if (allocated_clusters && (err == -EDQUOT || err == -ENOSPC)) {
int fb_flags = 0;
-
/*
* free data blocks we just allocated.
* not a good idea to call discard here directly,
--
2.52.0
2
1
24 Apr '26
From: Asim Viladi Oglu Manizada <manizada(a)pm.me>
mainline inclusion
from mainline-v7.0-rc7
commit fda9522ed6afaec45cabc198d8492270c394c7bc
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14175
CVE: CVE-2026-31402
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
When a compound request such as READ + QUERY_INFO(Security) is received,
and the first command (READ) consumes most of the response buffer,
ksmbd could write beyond the allocated buffer while building a security
descriptor.
The root cause was that smb2_get_info_sec() checked buffer space using
ppntsd_size from xattr, while build_sec_desc() often synthesized a
significantly larger descriptor from POSIX ACLs.
This patch introduces smb_acl_sec_desc_scratch_len() to accurately
compute the final descriptor size beforehand, performs proper buffer
checking with smb2_calc_max_out_buf_len(), and uses exact-sized
allocation + iov pinning.
Cc: stable(a)vger.kernel.org
Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound")
Signed-off-by: Asim Viladi Oglu Manizada <manizada(a)pm.me>
Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
Conflicts:
fs/smb/server/smb2pdu.c
[Commit 0066f623bce8 ("ksmbd: use __GFP_RETRY_MAYFAIL") change the way to
alloc smb_ntsd.]
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
fs/smb/server/smb2pdu.c | 121 +++++++++++++++++++++++++++++-----------
fs/smb/server/smbacl.c | 43 ++++++++++++++
fs/smb/server/smbacl.h | 2 +
3 files changed, 134 insertions(+), 32 deletions(-)
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 3681006c7ac8..ea7d467bd5cf 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3369,20 +3369,24 @@ int smb2_open(struct ksmbd_work *work)
KSMBD_SHARE_FLAG_ACL_XATTR)) {
struct smb_fattr fattr;
struct smb_ntsd *pntsd;
- int pntsd_size, ace_num = 0;
+ int pntsd_size;
+ size_t scratch_len;
ksmbd_acls_fattr(&fattr, idmap, inode);
- if (fattr.cf_acls)
- ace_num = fattr.cf_acls->a_count;
- if (fattr.cf_dacls)
- ace_num += fattr.cf_dacls->a_count;
-
- pntsd = kmalloc(sizeof(struct smb_ntsd) +
- sizeof(struct smb_sid) * 3 +
- sizeof(struct smb_acl) +
- sizeof(struct smb_ace) * ace_num * 2,
- GFP_KERNEL);
+ scratch_len = smb_acl_sec_desc_scratch_len(&fattr,
+ NULL, 0,
+ OWNER_SECINFO | GROUP_SECINFO |
+ DACL_SECINFO);
+ if (!scratch_len || scratch_len == SIZE_MAX) {
+ rc = -EFBIG;
+ posix_acl_release(fattr.cf_acls);
+ posix_acl_release(fattr.cf_dacls);
+ goto err_out;
+ }
+
+ pntsd = kvzalloc(scratch_len, GFP_KERNEL);
if (!pntsd) {
+ rc = -ENOMEM;
posix_acl_release(fattr.cf_acls);
posix_acl_release(fattr.cf_dacls);
goto err_out;
@@ -3397,7 +3401,7 @@ int smb2_open(struct ksmbd_work *work)
posix_acl_release(fattr.cf_acls);
posix_acl_release(fattr.cf_dacls);
if (rc) {
- kfree(pntsd);
+ kvfree(pntsd);
goto err_out;
}
@@ -3407,7 +3411,7 @@ int smb2_open(struct ksmbd_work *work)
pntsd,
pntsd_size,
false);
- kfree(pntsd);
+ kvfree(pntsd);
if (rc)
pr_err("failed to store ntacl in xattr : %d\n",
rc);
@@ -5301,8 +5305,9 @@ static int smb2_get_info_file(struct ksmbd_work *work,
if (test_share_config_flag(work->tcon->share_conf,
KSMBD_SHARE_FLAG_PIPE)) {
/* smb2 info file called for pipe */
- return smb2_get_info_file_pipe(work->sess, req, rsp,
+ rc = smb2_get_info_file_pipe(work->sess, req, rsp,
work->response_buf);
+ goto iov_pin_out;
}
if (work->next_smb2_rcv_hdr_off) {
@@ -5402,6 +5407,12 @@ static int smb2_get_info_file(struct ksmbd_work *work,
rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength),
rsp, work->response_buf);
ksmbd_fd_put(work, fp);
+
+iov_pin_out:
+ if (!rc)
+ rc = ksmbd_iov_pin_rsp(work, (void *)rsp,
+ offsetof(struct smb2_query_info_rsp, Buffer) +
+ le32_to_cpu(rsp->OutputBufferLength));
return rc;
}
@@ -5621,6 +5632,11 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work,
rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength),
rsp, work->response_buf);
path_put(&path);
+
+ if (!rc)
+ rc = ksmbd_iov_pin_rsp(work, (void *)rsp,
+ offsetof(struct smb2_query_info_rsp, Buffer) +
+ le32_to_cpu(rsp->OutputBufferLength));
return rc;
}
@@ -5630,13 +5646,14 @@ static int smb2_get_info_sec(struct ksmbd_work *work,
{
struct ksmbd_file *fp;
struct mnt_idmap *idmap;
- struct smb_ntsd *pntsd = (struct smb_ntsd *)rsp->Buffer, *ppntsd = NULL;
+ struct smb_ntsd *pntsd = NULL, *ppntsd = NULL;
struct smb_fattr fattr = {{0}};
struct inode *inode;
__u32 secdesclen = 0;
unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID;
int addition_info = le32_to_cpu(req->AdditionalInformation);
- int rc = 0, ppntsd_size = 0;
+ int rc = 0, ppntsd_size = 0, max_len;
+ size_t scratch_len = 0;
if (addition_info & ~(OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO |
PROTECTED_DACL_SECINFO |
@@ -5644,6 +5661,11 @@ static int smb2_get_info_sec(struct ksmbd_work *work,
ksmbd_debug(SMB, "Unsupported addition info: 0x%x)\n",
addition_info);
+ pntsd = kzalloc(ALIGN(sizeof(struct smb_ntsd), 8),
+ GFP_KERNEL);
+ if (!pntsd)
+ return -ENOMEM;
+
pntsd->revision = cpu_to_le16(1);
pntsd->type = cpu_to_le16(SELF_RELATIVE | DACL_PROTECTED);
pntsd->osidoffset = 0;
@@ -5652,9 +5674,7 @@ static int smb2_get_info_sec(struct ksmbd_work *work,
pntsd->dacloffset = 0;
secdesclen = sizeof(struct smb_ntsd);
- rsp->OutputBufferLength = cpu_to_le32(secdesclen);
-
- return 0;
+ goto iov_pin;
}
if (work->next_smb2_rcv_hdr_off) {
@@ -5686,18 +5706,58 @@ static int smb2_get_info_sec(struct ksmbd_work *work,
&ppntsd);
/* Check if sd buffer size exceeds response buffer size */
- if (smb2_resp_buf_len(work, 8) > ppntsd_size)
- rc = build_sec_desc(idmap, pntsd, ppntsd, ppntsd_size,
- addition_info, &secdesclen, &fattr);
+ max_len = smb2_calc_max_out_buf_len(work,
+ offsetof(struct smb2_query_info_rsp, Buffer),
+ le32_to_cpu(req->OutputBufferLength));
+ if (max_len < 0) {
+ rc = -EINVAL;
+ goto release_acl;
+ }
+
+ scratch_len = smb_acl_sec_desc_scratch_len(&fattr, ppntsd,
+ ppntsd_size, addition_info);
+ if (!scratch_len || scratch_len == SIZE_MAX) {
+ rc = -EFBIG;
+ goto release_acl;
+ }
+
+ pntsd = kvzalloc(scratch_len, GFP_KERNEL);
+ if (!pntsd) {
+ rc = -ENOMEM;
+ goto release_acl;
+ }
+
+ rc = build_sec_desc(idmap, pntsd, ppntsd, ppntsd_size,
+ addition_info, &secdesclen, &fattr);
+
+release_acl:
posix_acl_release(fattr.cf_acls);
posix_acl_release(fattr.cf_dacls);
kfree(ppntsd);
ksmbd_fd_put(work, fp);
+
+ if (!rc && ALIGN(secdesclen, 8) > scratch_len)
+ rc = -EFBIG;
if (rc)
- return rc;
+ goto err_out;
+iov_pin:
rsp->OutputBufferLength = cpu_to_le32(secdesclen);
- return 0;
+ rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength),
+ rsp, work->response_buf);
+ if (rc)
+ goto err_out;
+
+ rc = ksmbd_iov_pin_rsp_read(work, (void *)rsp,
+ offsetof(struct smb2_query_info_rsp, Buffer),
+ pntsd, secdesclen);
+err_out:
+ if (rc) {
+ rsp->OutputBufferLength = 0;
+ kvfree(pntsd);
+ }
+
+ return rc;
}
/**
@@ -5721,6 +5781,9 @@ int smb2_query_info(struct ksmbd_work *work)
goto err_out;
}
+ rsp->StructureSize = cpu_to_le16(9);
+ rsp->OutputBufferOffset = cpu_to_le16(72);
+
switch (req->InfoType) {
case SMB2_O_INFO_FILE:
ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILE\n");
@@ -5741,14 +5804,6 @@ int smb2_query_info(struct ksmbd_work *work)
}
ksmbd_revert_fsids(work);
- if (!rc) {
- rsp->StructureSize = cpu_to_le16(9);
- rsp->OutputBufferOffset = cpu_to_le16(72);
- rc = ksmbd_iov_pin_rsp(work, (void *)rsp,
- offsetof(struct smb2_query_info_rsp, Buffer) +
- le32_to_cpu(rsp->OutputBufferLength));
- }
-
err_out:
if (rc < 0) {
if (rc == -EACCES)
@@ -5759,6 +5814,8 @@ int smb2_query_info(struct ksmbd_work *work)
rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR;
else if (rc == -ENOMEM)
rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES;
+ else if (rc == -EINVAL && rsp->hdr.Status == 0)
+ rsp->hdr.Status = STATUS_INVALID_PARAMETER;
else if (rc == -EOPNOTSUPP || rsp->hdr.Status == 0)
rsp->hdr.Status = STATUS_INVALID_INFO_CLASS;
smb2_set_err_rsp(work);
diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index 07d31dee99c0..b7818241e295 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -915,6 +915,49 @@ int parse_sec_desc(struct mnt_idmap *idmap, struct smb_ntsd *pntsd,
return 0;
}
+size_t smb_acl_sec_desc_scratch_len(struct smb_fattr *fattr,
+ struct smb_ntsd *ppntsd, int ppntsd_size, int addition_info)
+{
+ size_t len = sizeof(struct smb_ntsd);
+ size_t tmp;
+
+ if (addition_info & OWNER_SECINFO)
+ len += sizeof(struct smb_sid);
+ if (addition_info & GROUP_SECINFO)
+ len += sizeof(struct smb_sid);
+ if (!(addition_info & DACL_SECINFO))
+ return len;
+
+ len += sizeof(struct smb_acl);
+ if (ppntsd && ppntsd_size > 0) {
+ unsigned int dacl_offset = le32_to_cpu(ppntsd->dacloffset);
+
+ if (dacl_offset < ppntsd_size &&
+ check_add_overflow(len, ppntsd_size - dacl_offset, &len))
+ return 0;
+ }
+
+ if (fattr->cf_acls) {
+ if (check_mul_overflow((size_t)fattr->cf_acls->a_count,
+ 2 * sizeof(struct smb_ace), &tmp) ||
+ check_add_overflow(len, tmp, &len))
+ return 0;
+ } else {
+ /* default/minimum DACL */
+ if (check_add_overflow(len, 5 * sizeof(struct smb_ace), &len))
+ return 0;
+ }
+
+ if (fattr->cf_dacls) {
+ if (check_mul_overflow((size_t)fattr->cf_dacls->a_count,
+ sizeof(struct smb_ace), &tmp) ||
+ check_add_overflow(len, tmp, &len))
+ return 0;
+ }
+
+ return len;
+}
+
/* Convert permission bits from mode to equivalent CIFS ACL */
int build_sec_desc(struct mnt_idmap *idmap,
struct smb_ntsd *pntsd, struct smb_ntsd *ppntsd,
diff --git a/fs/smb/server/smbacl.h b/fs/smb/server/smbacl.h
index 2b52861707d8..64e6f8ebb68e 100644
--- a/fs/smb/server/smbacl.h
+++ b/fs/smb/server/smbacl.h
@@ -210,6 +210,8 @@ int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon,
bool type_check, bool get_write);
void id_to_sid(unsigned int cid, uint sidtype, struct smb_sid *ssid);
void ksmbd_init_domain(u32 *sub_auth);
+size_t smb_acl_sec_desc_scratch_len(struct smb_fattr *fattr,
+ struct smb_ntsd *ppntsd, int ppntsd_size, int addition_info);
static inline uid_t posix_acl_uid_translate(struct mnt_idmap *idmap,
struct posix_acl_entry *pace)
--
2.52.0
2
1
[PATCH OLK-6.6] sched/fair: Clear rel_deadline when initializing forked entities
by Zicheng Qu 24 Apr '26
by Zicheng Qu 24 Apr '26
24 Apr '26
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14279
CVE: NA
--------------------------------
A yield-triggered crash can happen when a newly forked sched_entity
enters the fair class with se->rel_deadline unexpectedly set.
The failing sequence is:
1. A task is forked while se->rel_deadline is still set.
2. __sched_fork() initializes vruntime, vlag and other sched_entity
state, but does not clear rel_deadline.
3. On the first enqueue, enqueue_entity() calls place_entity().
4. Because se->rel_deadline is set, place_entity() treats se->deadline
as a relative deadline and converts it to an absolute deadline by
adding the current vruntime.
5. However, the forked entity's deadline is not a valid inherited
relative deadline for this new scheduling instance, so the conversion
produces an abnormally large deadline.
6. If the task later calls sched_yield(), yield_task_fair() advances
se->vruntime to se->deadline.
7. The inflated vruntime is then used by the following enqueue path,
where the vruntime-derived key can overflow when multiplied by the
entity weight.
8. This corrupts cfs_rq->sum_w_vruntime, breaks EEVDF eligibility
calculation, and can eventually make all entities appear ineligible.
pick_next_entity() may then return NULL unexpectedly, leading to a
later NULL dereference.
A captured trace shows the effect clearly. Before yield, the entity's
vruntime was around:
9834017729983308
After yield_task_fair() executed:
se->vruntime = se->deadline
the vruntime jumped to:
19668035460670230
and the deadline was later advanced further to:
19668035463470230
This shows that the deadline had already become abnormally large before
yield_task_fair() copied it into vruntime.
rel_deadline is only meaningful when se->deadline really carries a
relative deadline that still needs to be placed against vruntime. A
freshly forked sched_entity should not inherit or retain this state.
Clear se->rel_deadline in __sched_fork(), together with the other
sched_entity runtime state, so that the first enqueue does not interpret
the new entity's deadline as a stale relative deadline.
Fixes: 82e9d0456e06 ("sched/fair: Avoid re-setting virtual deadline on 'migrations'")
Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com>
---
kernel/sched/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index b833c69d000e..cc0ea2b06f2e 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4543,6 +4543,7 @@ static void __sched_fork(unsigned long clone_flags, struct task_struct *p)
p->se.vruntime = 0;
p->se.vlag = 0;
p->se.slice = sysctl_sched_base_slice;
+ p->se.rel_deadline = 0;
INIT_LIST_HEAD(&p->se.group_node);
#ifdef CONFIG_FAIR_GROUP_SCHED
--
2.34.1
2
1
[PATCH OLK-6.6] perf/x86/intel: Add missing branch counters constraint apply
by Luo Gengkun 24 Apr '26
by Luo Gengkun 24 Apr '26
24 Apr '26
From: Dapeng Mi <dapeng1.mi(a)linux.intel.com>
mainline inclusion
from mainline-v7.0-rc5
commit 1d07bbd7ea36ea0b8dfa8068dbe67eb3a32d9590
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14277
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
----------------------------------------------------------------------
When running the command:
'perf record -e "{instructions,instructions:p}" -j any,counter sleep 1',
a "shift-out-of-bounds" warning is reported on CWF.
UBSAN: shift-out-of-bounds in /kbuild/src/consumer/arch/x86/events/intel/lbr.c:970:15
shift exponent 64 is too large for 64-bit type 'long long unsigned int'
......
intel_pmu_lbr_counters_reorder.isra.0.cold+0x2a/0xa7
intel_pmu_lbr_save_brstack+0xc0/0x4c0
setup_arch_pebs_sample_data+0x114b/0x2400
The warning occurs because the second "instructions:p" event, which
involves branch counters sampling, is incorrectly programmed to fixed
counter 0 instead of the general-purpose (GP) counters 0-3 that support
branch counters sampling. Currently only GP counters 0-3 support branch
counters sampling on CWF, any event involving branch counters sampling
should be programed on GP counters 0-3. Since the counter index of fixed
counter 0 is 32, it leads to the "src" value in below code is right
shifted 64 bits and trigger the "shift-out-of-bounds" warning.
cnt = (src >> (order[j] * LBR_INFO_BR_CNTR_BITS)) & LBR_INFO_BR_CNTR_MASK;
The root cause is the loss of the branch counters constraint for the
new event in the branch counters sampling event group. Since it isn't
yet part of the sibling list. This results in the second
"instructions:p" event being programmed on fixed counter 0 incorrectly
instead of the appropriate GP counters 0-3.
To address this, we apply the missing branch counters constraint for
the last event in the group. Additionally, we introduce a new function,
`intel_set_branch_counter_constr()`, to apply the branch counters
constraint and avoid code duplication.
Fixes: 33744916196b ("perf/x86/intel: Support branch counters logging")
Reported-by: Xudong Hao <xudong.hao(a)intel.com>
Signed-off-by: Dapeng Mi <dapeng1.mi(a)linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Link: https://patch.msgid.link/20260228053320.140406-2-dapeng1.mi@linux.intel.com
Cc: stable(a)vger.kernel.org
Conflicts:
arch/x86/events/intel/core.c
[Fix conflict because of context diff.]
Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com>
---
arch/x86/events/intel/core.c | 31 +++++++++++++++++++++----------
1 file changed, 21 insertions(+), 10 deletions(-)
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 5c6673124520..1844d4917bbb 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -4210,6 +4210,19 @@ static inline void intel_pmu_set_acr_caused_constr(struct perf_event *event,
event->hw_ext->dyn_constraint &= hybrid(event->pmu, acr_cause_mask64);
}
+static inline int intel_set_branch_counter_constr(struct perf_event *event,
+ int *num)
+{
+ if (branch_sample_call_stack(event))
+ return -EINVAL;
+ if (branch_sample_counters(event)) {
+ (*num)++;
+ event->hw_ext->dyn_constraint &= x86_pmu.lbr_counters;
+ }
+
+ return 0;
+}
+
static int intel_pmu_hw_config(struct perf_event *event)
{
int ret = x86_pmu_hw_config(event);
@@ -4265,21 +4278,19 @@ static int intel_pmu_hw_config(struct perf_event *event)
* group, which requires the extra space to store the counters.
*/
leader = event->group_leader;
- if (branch_sample_call_stack(leader))
+ if (intel_set_branch_counter_constr(leader, &num))
return -EINVAL;
- if (branch_sample_counters(leader)) {
- num++;
- leader->hw_ext->dyn_constraint &= x86_pmu.lbr_counters;
- }
leader->hw.flags |= PERF_X86_EVENT_BRANCH_COUNTERS;
for_each_sibling_event(sibling, leader) {
- if (branch_sample_call_stack(sibling))
+ if (intel_set_branch_counter_constr(sibling, &num))
+ return -EINVAL;
+ }
+
+ /* event isn't installed as a sibling yet. */
+ if (event != leader) {
+ if (intel_set_branch_counter_constr(event, &num))
return -EINVAL;
- if (branch_sample_counters(sibling)) {
- num++;
- sibling->hw_ext->dyn_constraint &= x86_pmu.lbr_counters;
- }
}
if (num > fls(x86_pmu.lbr_counters))
--
2.34.1
2
1
Luo Gengkun (1):
perf: Fix kabi breakage of perf_output_handle
Peter Zijlstra (2):
perf: Extract a few helpers
perf: Make sure to use pmu_ctx->pmu for groups
Peter Zijlstra (Intel) (1):
perf: Avoid the read if the count is already updated
include/linux/perf_event.h | 9 +++-
kernel/events/core.c | 91 +++++++++++++++++++------------------
kernel/events/ring_buffer.c | 1 +
3 files changed, 55 insertions(+), 46 deletions(-)
--
2.34.1
2
6
[PATCH OLK-6.6] bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
by Pu Lehui 24 Apr '26
by Pu Lehui 24 Apr '26
24 Apr '26
From: Jenny Guanni Qu <qguanni(a)gmail.com>
stable inclusion
from stable-v6.6.131
commit 694ea55f1b1c74f9942d91ec366ae9e822422e42
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14258
CVE: CVE-2026-31525
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit c77b30bd1dcb61f66c640ff7d2757816210c7cb0 ]
The BPF interpreter's signed 32-bit division and modulo handlers use
the kernel abs() macro on s32 operands. The abs() macro documentation
(include/linux/math.h) explicitly states the result is undefined when
the input is the type minimum. When DST contains S32_MIN (0x80000000),
abs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged
on arm64/x86. This value is then sign-extended to u64 as
0xFFFFFFFF80000000, causing do_div() to compute the wrong result.
The verifier's abstract interpretation (scalar32_min_max_sdiv) computes
the mathematically correct result for range tracking, creating a
verifier/interpreter mismatch that can be exploited for out-of-bounds
map value access.
Introduce abs_s32() which handles S32_MIN correctly by casting to u32
before negating, avoiding signed overflow entirely. Replace all 8
abs((s32)...) call sites in the interpreter's sdiv32/smod32 handlers.
s32 is the only affected case -- the s64 division/modulo handlers do
not use abs().
Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.")
Acked-by: Yonghong Song <yonghong.song(a)linux.dev>
Acked-by: Mykyta Yatsenko <yatsenko(a)meta.com>
Signed-off-by: Jenny Guanni Qu <qguanni(a)gmail.com>
Link: https://lore.kernel.org/r/20260311011116.2108005-2-qguanni@gmail.com
Signed-off-by: Alexei Starovoitov <ast(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Pu Lehui <pulehui(a)huawei.com>
---
kernel/bpf/core.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 72a7503a59d0..e9ca3e36783e 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1668,6 +1668,12 @@ bool bpf_opcode_in_insntable(u8 code)
}
#ifndef CONFIG_BPF_JIT_ALWAYS_ON
+/* Absolute value of s32 without undefined behavior for S32_MIN */
+static u32 abs_s32(s32 x)
+{
+ return x >= 0 ? (u32)x : -(u32)x;
+}
+
/**
* ___bpf_prog_run - run eBPF program on a given context
* @regs: is the array of MAX_BPF_EXT_REG eBPF pseudo-registers
@@ -1832,8 +1838,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)
DST = do_div(AX, (u32) SRC);
break;
case 1:
- AX = abs((s32)DST);
- AX = do_div(AX, abs((s32)SRC));
+ AX = abs_s32((s32)DST);
+ AX = do_div(AX, abs_s32((s32)SRC));
if ((s32)DST < 0)
DST = (u32)-AX;
else
@@ -1860,8 +1866,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)
DST = do_div(AX, (u32) IMM);
break;
case 1:
- AX = abs((s32)DST);
- AX = do_div(AX, abs((s32)IMM));
+ AX = abs_s32((s32)DST);
+ AX = do_div(AX, abs_s32((s32)IMM));
if ((s32)DST < 0)
DST = (u32)-AX;
else
@@ -1887,8 +1893,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)
DST = (u32) AX;
break;
case 1:
- AX = abs((s32)DST);
- do_div(AX, abs((s32)SRC));
+ AX = abs_s32((s32)DST);
+ do_div(AX, abs_s32((s32)SRC));
if (((s32)DST < 0) == ((s32)SRC < 0))
DST = (u32)AX;
else
@@ -1914,8 +1920,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)
DST = (u32) AX;
break;
case 1:
- AX = abs((s32)DST);
- do_div(AX, abs((s32)IMM));
+ AX = abs_s32((s32)DST);
+ do_div(AX, abs_s32((s32)IMM));
if (((s32)DST < 0) == ((s32)IMM < 0))
DST = (u32)AX;
else
--
2.34.1
2
1
Peter Zijlstra (2):
perf: Extract a few helpers
perf: Make sure to use pmu_ctx->pmu for groups
Peter Zijlstra (Intel) (1):
perf: Avoid the read if the count is already updated
include/linux/perf_event.h | 8 +++-
kernel/events/core.c | 91 +++++++++++++++++++------------------
kernel/events/ring_buffer.c | 1 +
3 files changed, 54 insertions(+), 46 deletions(-)
--
2.34.1
2
4
Fix CVE-2026-31467.
Jiucheng Xu (1):
erofs: add GFP_NOIO in the bio completion if needed
fs/erofs/zdata.c | 3 +++
1 file changed, 3 insertions(+)
--
2.34.1
2
2
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/9010
----------------------------------------
The current bpf_sched_set_task_prefer_nid() passes the full node mask
directly to set_prefer_cpus_ptr(), which may result in preferred CPUs
being outside of task->cpus_ptr.
In such cases, the scheduler will ignore the preferred CPUs completely,
causing the preferred node setting to NOT work at all.
Fix this by computing the intersection between task->cpus_ptr and
cpumask_of_node(nid), ensuring the resulting preferred mask is a
subset of the task's allowed CPUs.
Fixes: 4e47cb331dc0 ("sched/ebpf: Add kfunc to set the preferred NUMA node for the task")
Signed-off-by: Hui Tang <tanghui20(a)huawei.com>
---
kernel/sched/bpf_sched.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/kernel/sched/bpf_sched.c b/kernel/sched/bpf_sched.c
index 6849a58439b2..ffe13eed601c 100644
--- a/kernel/sched/bpf_sched.c
+++ b/kernel/sched/bpf_sched.c
@@ -212,13 +212,16 @@ __bpf_kfunc long bpf_sched_tag_of_entity(struct sched_entity *se)
__bpf_kfunc int bpf_sched_set_task_prefer_nid(struct task_struct *task, int nid)
{
+ cpumask_t mask;
+
if (!task)
return -EINVAL;
if ((unsigned int)nid >= nr_node_ids)
return -EINVAL;
- return set_prefer_cpus_ptr(task, cpumask_of_node(nid));
+ cpumask_and(&mask, task->cpus_ptr, cpumask_of_node(nid));
+ return set_prefer_cpus_ptr(task, &mask);
}
BTF_SET8_START(sched_task_kfunc_btf_ids)
--
2.34.1
2
1
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/9010
----------------------------------------
The current bpf_sched_set_task_prefer_nid() passes the full node mask
directly to set_prefer_cpus_ptr(), which may result in preferred CPUs
being outside of task->cpus_ptr.
In such cases, the scheduler will ignore the preferred CPUs completely,
causing the preferred node setting to NOT work at all.
Fix this by computing the intersection between task->cpus_ptr and
cpumask_of_node(nid), ensuring the resulting preferred mask is a
subset of the task's allowed CPUs.
Fixes: 4e47cb331dc0b ("sched/ebpf: Add kfunc to set the preferred...")
Signed-off-by: Hui Tang <tanghui20(a)huawei.com>
---
kernel/sched/bpf_sched.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/kernel/sched/bpf_sched.c b/kernel/sched/bpf_sched.c
index 6849a58439b2..ffe13eed601c 100644
--- a/kernel/sched/bpf_sched.c
+++ b/kernel/sched/bpf_sched.c
@@ -212,13 +212,16 @@ __bpf_kfunc long bpf_sched_tag_of_entity(struct sched_entity *se)
__bpf_kfunc int bpf_sched_set_task_prefer_nid(struct task_struct *task, int nid)
{
+ cpumask_t mask;
+
if (!task)
return -EINVAL;
if ((unsigned int)nid >= nr_node_ids)
return -EINVAL;
- return set_prefer_cpus_ptr(task, cpumask_of_node(nid));
+ cpumask_and(&mask, task->cpus_ptr, cpumask_of_node(nid));
+ return set_prefer_cpus_ptr(task, &mask);
}
BTF_SET8_START(sched_task_kfunc_btf_ids)
--
2.34.1
2
1
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/9010
----------------------------------------
The current bpf_sched_set_task_prefer_nid() passes the full node mask
directly to set_prefer_cpus_ptr(), which may result in preferred CPUs
being outside of task->cpus_ptr.
In such cases, the scheduler will ignore the preferred CPUs completely,
causing the preferred node setting to NOT work at all.
Fix this by computing the intersection between task->cpus_ptr and
cpumask_of_node(nid), ensuring the resulting preferred mask is a
subset of the task's allowed CPUs.
Fixes: 4e47cb331dc0b ("sched/ebpf: Add kfunc to set the preferred...")
Signed-off-by: Hui Tang <tanghui20(a)huawei.com>
---
kernel/sched/bpf_sched.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/kernel/sched/bpf_sched.c b/kernel/sched/bpf_sched.c
index 6849a58439b2..ffe13eed601c 100644
--- a/kernel/sched/bpf_sched.c
+++ b/kernel/sched/bpf_sched.c
@@ -212,13 +212,16 @@ __bpf_kfunc long bpf_sched_tag_of_entity(struct sched_entity *se)
__bpf_kfunc int bpf_sched_set_task_prefer_nid(struct task_struct *task, int nid)
{
+ cpumask_t mask;
+
if (!task)
return -EINVAL;
if ((unsigned int)nid >= nr_node_ids)
return -EINVAL;
- return set_prefer_cpus_ptr(task, cpumask_of_node(nid));
+ cpumask_and(&mask, task->cpus_ptr, cpumask_of_node(nid));
+ return set_prefer_cpus_ptr(task, &mask);
}
BTF_SET8_START(sched_task_kfunc_btf_ids)
--
2.34.1
1
0
Fix CVE-2026-31398.
David Hildenbrand (4):
mm: convert FPB_IGNORE_* into FPB_RESPECT_*
mm: smaller folio_pte_batch() improvements
mm: split folio_pte_batch() into folio_pte_batch() and
folio_pte_batch_flags()
mm: remove boolean output parameters from folio_pte_batch_ext()
Dev Jain (2):
mm: introduce FPB_RESPECT_WRITE for PTE batching infrastructure
mm/rmap: fix incorrect pte restoration for lazyfree folios
Petr Vaněk (1):
mm: fix folio_pte_batch() on XEN PV
mm/internal.h | 151 +++++++++++++++++++++++++++----------------------
mm/madvise.c | 27 ++-------
mm/memory.c | 21 +++----
mm/mempolicy.c | 5 +-
mm/mremap.c | 4 +-
mm/rmap.c | 11 +++-
mm/util.c | 29 ++++++++++
7 files changed, 135 insertions(+), 113 deletions(-)
--
2.43.0
2
8
Daniel Borkmann (1):
bpf: Fix incorrect pruning due to atomic fetch precision tracking
Qi Tang (1):
bpf: reject direct access to nullable PTR_TO_BUF pointers
Varun R Mallya (1):
bpf: Reject sleepable kprobe_multi programs at attach time
kernel/bpf/verifier.c | 28 ++++++++++++++++++++++++----
kernel/trace/bpf_trace.c | 4 ++++
2 files changed, 28 insertions(+), 4 deletions(-)
--
2.34.1
2
4
Daniel Borkmann (1):
bpf: Fix incorrect pruning due to atomic fetch precision tracking
Qi Tang (1):
bpf: reject direct access to nullable PTR_TO_BUF pointers
Varun R Mallya (1):
bpf: Reject sleepable kprobe_multi programs at attach time
kernel/bpf/verifier.c | 28 ++++++++++++++++++++++++----
kernel/trace/bpf_trace.c | 4 ++++
2 files changed, 28 insertions(+), 4 deletions(-)
--
2.34.1
2
4
22 Apr '26
From: Varun R Mallya <varunrmallya(a)gmail.com>
mainline inclusion
from mainline-v7.0-rc7
commit eb7024bfcc5f68ed11ed9dd4891a3073c15f04a8
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/9004
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
kprobe.multi programs run in atomic/RCU context and cannot sleep.
However, bpf_kprobe_multi_link_attach() did not validate whether the
program being attached had the sleepable flag set, allowing sleepable
helpers such as bpf_copy_from_user() to be invoked from a non-sleepable
context.
This causes a "sleeping function called from invalid context" splat:
BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1787, name: sudo
preempt_count: 1, expected: 0
RCU nest depth: 2, expected: 0
Fix this by rejecting sleepable programs early in
bpf_kprobe_multi_link_attach(), before any further processing.
Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
Signed-off-by: Varun R Mallya <varunrmallya(a)gmail.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com>
Acked-by: Leon Hwang <leon.hwang(a)linux.dev>
Acked-by: Jiri Olsa <jolsa(a)kernel.org>
Link: https://lore.kernel.org/r/20260401191126.440683-1-varunrmallya@gmail.com
Signed-off-by: Alexei Starovoitov <ast(a)kernel.org>
Conflicts:
kernel/trace/bpf_trace.c
[ctx conflicts]
Signed-off-by: Pu Lehui <pulehui(a)huawei.com>
---
kernel/trace/bpf_trace.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 50556b239023..1cdb832b9be5 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2901,6 +2901,10 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
if (sizeof(u64) != sizeof(void *))
return -EOPNOTSUPP;
+ /* kprobe_multi is not allowed to be sleepable. */
+ if (prog->sleepable)
+ return -EINVAL;
+
if (prog->expected_attach_type != BPF_TRACE_KPROBE_MULTI)
return -EINVAL;
--
2.34.1
2
1
Jinqian Yang (4):
arm64: add check for GICv4.1 before enabling vtimer
KVM: arm64: Fix mbigen vtimer interrupt loss bug
irqchip/gic-v3-its: Read ITS_VERSION with vendor checking
mbigen: fix soft pg bug on HIP12
Zhou Wang (1):
irqchip: add hip12 support for vtimer irq bypass
arch/arm64/kvm/arch_timer.c | 23 +++-
arch/arm64/kvm/vgic/vgic-v3.c | 2 +-
drivers/irqchip/irq-gic-v3-its.c | 2 +-
drivers/irqchip/irq-gic-v3.c | 8 ++
drivers/irqchip/irq-mbigen.c | 202 +++++++++++++++++++++++++------
5 files changed, 195 insertions(+), 42 deletions(-)
--
2.33.0
2
6
Fix CVE-2026-31398.
David Hildenbrand (4):
mm: convert FPB_IGNORE_* into FPB_RESPECT_*
mm: smaller folio_pte_batch() improvements
mm: split folio_pte_batch() into folio_pte_batch() and
folio_pte_batch_flags()
mm: remove boolean output parameters from folio_pte_batch_ext()
Dev Jain (2):
mm: introduce FPB_RESPECT_WRITE for PTE batching infrastructure
mm/rmap: fix incorrect pte restoration for lazyfree folios
Petr Vaněk (1):
mm: fix folio_pte_batch() on XEN PV
mm/internal.h | 151 +++++++++++++++++++++++++++----------------------
mm/madvise.c | 27 ++-------
mm/memory.c | 21 +++----
mm/mempolicy.c | 5 +-
mm/mremap.c | 4 +-
mm/rmap.c | 11 +++-
mm/util.c | 29 ++++++++++
7 files changed, 135 insertions(+), 113 deletions(-)
--
2.43.0
2
8
[PATCH OLK-6.6] net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
by Quanmin Yan 21 Apr '26
by Quanmin Yan 21 Apr '26
21 Apr '26
From: Tobi Gaertner <tob.gaertner(a)me.com>
stable inclusion
from stable-v6.6.130
commit 125f932a76a97904ef8a555f1dd53e5d0e288c54
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14087
CVE: CVE-2026-23447
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 77914255155e68a20aa41175edeecf8121dac391 ]
The same bounds-check bug fixed for NDP16 in the previous patch also
exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated
against the total skb length without accounting for ndpoffset, allowing
out-of-bounds reads when the NDP32 is placed near the end of the NTB.
Add ndpoffset to the nframes bounds check and use struct_size_t() to
express the NDP-plus-DPE-array size more clearly.
Compile-tested only.
Fixes: 0fa81b304a79 ("cdc_ncm: Implement the 32-bit version of NCM Transfer Block")
Signed-off-by: Tobi Gaertner <tob.gaertner(a)me.com>
Link: https://patch.msgid.link/20260314054640.2895026-3-tob.gaertner@me.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Quanmin Yan <yanquanmin1(a)huawei.com>
---
drivers/net/usb/cdc_ncm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index ae7a2829fe49..56dfd4cd2aa4 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1693,6 +1693,7 @@ int cdc_ncm_rx_verify_ndp32(struct sk_buff *skb_in, int ndpoffset)
struct usbnet *dev = netdev_priv(skb_in->dev);
struct usb_cdc_ncm_ndp32 *ndp32;
int ret = -EINVAL;
+ size_t ndp_len;
if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp32)) > skb_in->len) {
netif_dbg(dev, rx_err, dev->net, "invalid NDP offset <%u>\n",
@@ -1712,8 +1713,8 @@ int cdc_ncm_rx_verify_ndp32(struct sk_buff *skb_in, int ndpoffset)
sizeof(struct usb_cdc_ncm_dpe32));
ret--; /* we process NDP entries except for the last one */
- if ((sizeof(struct usb_cdc_ncm_ndp32) +
- ret * (sizeof(struct usb_cdc_ncm_dpe32))) > skb_in->len) {
+ ndp_len = struct_size_t(struct usb_cdc_ncm_ndp32, dpe32, ret);
+ if (ndpoffset + ndp_len > skb_in->len) {
netif_dbg(dev, rx_err, dev->net, "Invalid nframes = %d\n", ret);
ret = -EINVAL;
}
--
2.43.0
2
1
From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
stable inclusion
from stable-v6.6.130
commit 72f90f481c6a059680b9b976695d4cfb04fba1f3
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13969
CVE: CVE-2026-23312
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 4b063c002ca759d1b299988ee23f564c9609c875 upstream.
The kaweth driver should validate that the device it is probing has the
proper number and types of USB endpoints it is expecting before it binds
to it. If a malicious device were to not have the same urbs the driver
will crash later on when it blindly accesses these endpoints.
Cc: stable <stable(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Reviewed-by: Simon Horman <horms(a)kernel.org>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Link: https://patch.msgid.link/2026022305-substance-virtual-c728@gregkh
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com>
---
drivers/net/usb/kaweth.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index c9efb7df892e..a8c3ecf7d810 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -885,6 +885,13 @@ static int kaweth_probe(
const eth_addr_t bcast_addr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
int result = 0;
int rv = -EIO;
+ static const u8 bulk_ep_addr[] = {
+ 1 | USB_DIR_IN,
+ 2 | USB_DIR_OUT,
+ 0};
+ static const u8 int_ep_addr[] = {
+ 3 | USB_DIR_IN,
+ 0};
dev_dbg(dev,
"Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x\n",
@@ -898,6 +905,12 @@ static int kaweth_probe(
(int)udev->descriptor.bLength,
(int)udev->descriptor.bDescriptorType);
+ if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) ||
+ !usb_check_int_endpoints(intf, int_ep_addr)) {
+ dev_err(dev, "couldn't find required endpoints\n");
+ return -ENODEV;
+ }
+
netdev = alloc_etherdev(sizeof(*kaweth));
if (!netdev)
return -ENOMEM;
--
2.43.0
2
1
[PATCH OLK-6.6] perf/core: Fix race between perf_event_exit_task and perf_pending_task
by Luo Gengkun 21 Apr '26
by Luo Gengkun 21 Apr '26
21 Apr '26
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14165
--------------------------------
A race condition exists between perf_event_exit_task() and
perf_pending_task().
During begin_new_exec(), perf_event_exit_task() may be called, and the
PF_EXITING flag is not set on task. so perf_sigtrap() continues to execute
and triggers WARN_ON_ONCE(event->ctx->task != current).
To fix this problem, also check if the event->ctx->task is TASK_TOMBSTONE.
Fixes: 97ba62b27867 ("perf: Add support for SIGTRAP on perf events")
Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com>
---
kernel/events/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index cdd34d6e3dd4..7657ddf008ce 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6782,7 +6782,7 @@ static void perf_sigtrap(struct perf_event *event)
* Both perf_pending_task() and perf_pending_irq() can race with the
* task exiting.
*/
- if (current->flags & PF_EXITING)
+ if (current->flags & PF_EXITING || event->ctx->task == TASK_TOMBSTONE)
return;
/*
--
2.34.1
2
1
[PATCH OLK-6.6] arm64: mm: fix pass user prot to ioremap_prot in generic_access_phys
by Jinjiang Tu 20 Apr '26
by Jinjiang Tu 20 Apr '26
20 Apr '26
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/8982
----------------------------------------
Here is a syzkaller error log:
[0000000020ffc000] pgd=080000010598d403, p4d=080000010598d403, pud=0800000125ddb403,
pmd=080000007833c403, pte=01608000007fcfcf
Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000
KASAN: probably user-memory-access in range [0x0000000475448000-0x0000000475448007]
Mem abort info:
ESR = 0x000000009600000f
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x0f: level 3 permission fault
Data abort info:
ISV = 0, ISS = 0x0000000f, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000001244aa000
[ffff80008ea89000] pgd=100000013ffff403, p4d=100000013ffff403, pud=100000013fffe403,
pmd=100000010a453403, pte=01608000007fcfcf
Internal error: Oops: 000000009600000f [#1] SMP
Modules linked in: team
CPU: 1 PID: 10840 Comm: syz.9.83 Kdump: loaded Tainted: G
Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __memcpy_fromio+0x80/0xf8
lr : generic_access_phys+0x20c/0x2b8
sp : ffff8000a0507960
x29: ffff8000a0507960 x28: 1ffff000140a0f44 x27: ffff00003833cfe0
x26: 0000000000000000 x25: 0000000000001000 x24: 0010000000000001
x23: ffff80008ea89000 x22: ffff00004ea63000 x21: 0000000000001000
x20: ffff80008ea89000 x19: ffff00004ea62000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000806f1e3c
x14: ffff8000806f1d44 x13: 0000000041b58ab3 x12: ffff7000140a0f23
x11: 1ffff000140a0f22 x10: ffff7000140a0f22 x9 : ffff800080579d24
x8 : 0000000000000004 x7 : 0000000000000003 x6 : 0000000000000001
x5 : ffff8000a0507910 x4 : ffff7000140a0f22 x3 : dfff800000000000
x2 : 0000000000001000 x1 : ffff80008ea89000 x0 : ffff00004ea62000
Call trace:
__memcpy_fromio+0x80/0xf8
generic_access_phys+0x20c/0x2b8
__access_remote_vm+0x46c/0x5b8
access_remote_vm+0x18/0x30
environ_read+0x238/0x3e8
vfs_read+0xe4/0x2b0
ksys_read+0xcc/0x178
__arm64_sys_read+0x4c/0x68
invoke_syscall+0x68/0x1a0
el0_svc_common.constprop.0+0x11c/0x150
do_el0_svc+0x38/0x50
el0_svc+0x50/0x258
el0t_64_sync_handler+0xc0/0xc8
el0t_64_sync+0x1a4/0x1a8
Code: 91002339 aa1403f7 8b190276 d503201f (f94002f8)
The local syzkaller first maps I/O address from /dev/mem to userspace,
overiding the stack vma with MAP_FIXED flag. As a result, when reading
/proc/$pid/environ, generic_access_phys() is called to access the region,
which triggers a PAN permission-check fault and causes a kernel access
fault.
The root cause is that generic_access_phys() passes a user pte to
ioremap_prot(), the user pte sets PTE_USER and PTE_NG bits. Consequently,
any subsequent kernel-mode access to the remapped address raises a fault.
To fix it, define arch_mk_kernel_prot() to convert user prot to kernel
prot for arm64, and call arch_mk_kernel_prot() in generic_access_phys(),
so that a user prot is passed to ioremap_prot().
Mainline kernel fixes this issue by commit f6bf47ab32e0 ("arm64: io:
Rename ioremap_prot() to __ioremap_prot()") and commit 8f098037139b
("arm64: io: Extract user memory type in ioremap_prot()"), which breaks
KABI. So don't fix with the mainline kernel approach.
Fixes: 893dea9ccd08 ("arm64: Add HAVE_IOREMAP_PROT support")
Signed-off-by: Zeng Heng <zengheng4(a)huawei.com>
Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com>
---
arch/arm64/include/asm/io.h | 11 +++++++++++
mm/memory.c | 14 ++++++++++++--
2 files changed, 23 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h
index e9d6bcfddf35..227c16c8fc1d 100644
--- a/arch/arm64/include/asm/io.h
+++ b/arch/arm64/include/asm/io.h
@@ -146,6 +146,17 @@ int arm64_ioremap_prot_hook_register(const ioremap_prot_hook_t hook);
#define ioremap_prot ioremap_prot
+#define arch_mk_kernel_prot arch_mk_kernel_prot
+static inline unsigned long arch_mk_kernel_prot(unsigned long user_prot)
+{
+ unsigned long kernel_prot_val;
+
+ kernel_prot_val = _PAGE_KERNEL & ~PTE_ATTRINDX_MASK;
+ kernel_prot_val |= user_prot & PTE_ATTRINDX_MASK;
+
+ return kernel_prot_val;
+}
+
#define _PAGE_IOREMAP PROT_DEVICE_nGnRE
#define ioremap_wc(addr, size) \
diff --git a/mm/memory.c b/mm/memory.c
index 794233ef55eb..28de289fe973 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -6536,6 +6536,14 @@ int follow_phys(struct vm_area_struct *vma,
return ret;
}
+#ifndef arch_mk_kernel_prot
+#define arch_mk_kernel_prot arch_mk_kernel_prot
+static inline unsigned long arch_mk_kernel_prot(unsigned long user_prot)
+{
+ return user_prot;
+}
+#endif
+
/**
* generic_access_phys - generic implementation for iomem mmap access
* @vma: the vma to access
@@ -6552,7 +6560,8 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
void *buf, int len, int write)
{
resource_size_t phys_addr;
- unsigned long prot = 0;
+ unsigned long user_prot = 0;
+ unsigned long prot;
void __iomem *maddr;
pte_t *ptep, pte;
spinlock_t *ptl;
@@ -6568,12 +6577,13 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
pte = ptep_get(ptep);
pte_unmap_unlock(ptep, ptl);
- prot = pgprot_val(pte_pgprot(pte));
+ user_prot = pgprot_val(pte_pgprot(pte));
phys_addr = (resource_size_t)pte_pfn(pte) << PAGE_SHIFT;
if ((write & FOLL_WRITE) && !pte_write(pte))
return -EINVAL;
+ prot = arch_mk_kernel_prot(user_prot);
maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot);
if (!maddr)
return -ENOMEM;
--
2.43.0
2
1
[PATCH OLK-6.6] drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
by Jiacheng Yu 20 Apr '26
by Jiacheng Yu 20 Apr '26
20 Apr '26
From: Felix Gu <ustc.gu(a)gmail.com>
stable inclusion
from stable-v6.6.130
commit 0bd326dffd9e103335d77d9c31275c0d5a7979eb
category: bugfix
bugzilla: http://atomgit.com/src-openeuler/kernel/issues/14066
CVE: CVE-2026-23426
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit fef0e649f8b42bdffe4a916dd46e1b1e9ad2f207 ]
The logicvc_drm_config_parse() function calls of_get_child_by_name() to
find the "layers" node but fails to release the reference, leading to a
device node reference leak.
Fix this by using the __free(device_node) cleanup attribute to automatic
release the reference when the variable goes out of scope.
Fixes: efeeaefe9be5 ("drm: Add support for the LogiCVC display controller")
Signed-off-by: Felix Gu <ustc.gu(a)gmail.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli(a)bootlin.com>
Reviewed-by: Kory Maincent <kory.maincent(a)bootlin.com>
Link: https://patch.msgid.link/20260130-logicvc_drm-v1-1-04366463750c@gmail.com
Signed-off-by: Luca Ceresoli <luca.ceresoli(a)bootlin.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com>
---
drivers/gpu/drm/logicvc/logicvc_drm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/logicvc/logicvc_drm.c b/drivers/gpu/drm/logicvc/logicvc_drm.c
index 749debd3d6a57..df74572e6d2ea 100644
--- a/drivers/gpu/drm/logicvc/logicvc_drm.c
+++ b/drivers/gpu/drm/logicvc/logicvc_drm.c
@@ -90,7 +90,6 @@ static int logicvc_drm_config_parse(struct logicvc_drm *logicvc)
struct device *dev = drm_dev->dev;
struct device_node *of_node = dev->of_node;
struct logicvc_drm_config *config = &logicvc->config;
- struct device_node *layers_node;
int ret;
logicvc_of_property_parse_bool(of_node, LOGICVC_OF_PROPERTY_DITHERING,
@@ -126,7 +125,8 @@ static int logicvc_drm_config_parse(struct logicvc_drm *logicvc)
if (ret)
return ret;
- layers_node = of_get_child_by_name(of_node, "layers");
+ struct device_node *layers_node __free(device_node) =
+ of_get_child_by_name(of_node, "layers");
if (!layers_node) {
drm_err(drm_dev, "Missing non-optional layers node\n");
return -EINVAL;
--
2.43.0
2
1
[PATCH OLK-6.6] perf/core: Fix race between perf_event_exit_task and perf_pending_task
by Luo Gengkun 20 Apr '26
by Luo Gengkun 20 Apr '26
20 Apr '26
Offering: HULK
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14165
--------------------------------
A race condition exists between perf_event_exit_task() and
perf_pending_task().
During begin_new_exec(), perf_event_exit_task() may be called, and the
PF_EXITING flag is not set on task. so perf_sigtrap() continues to execute
and triggers WARN_ON_ONCE(event->ctx->task != current).
To fix this problem, also check if the event->ctx->task is TASK_TOMBSTONE.
Fixes: 97ba62b27867 ("perf: Add support for SIGTRAP on perf events")
Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com>
---
kernel/events/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index cdd34d6e3dd4..7657ddf008ce 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6782,7 +6782,7 @@ static void perf_sigtrap(struct perf_event *event)
* Both perf_pending_task() and perf_pending_irq() can race with the
* task exiting.
*/
- if (current->flags & PF_EXITING)
+ if (current->flags & PF_EXITING || event->ctx->task == TASK_TOMBSTONE)
return;
/*
--
2.34.1
2
1
[PATCH OLK-6.6 0/2] ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
by Pan Taixi 20 Apr '26
by Pan Taixi 20 Apr '26
20 Apr '26
Backport "ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz" to
OLK-6.6
Include "xsk: introduce helper to determine rxq->frag_size" to introduce the helper
function xsk_pool_get_rx_frag_step()
Larysa Zaremba (2):
xsk: introduce helper to determine rxq->frag_size
ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
drivers/net/ethernet/intel/ice/ice_base.c | 7 ++++---
include/net/xdp_sock_drv.h | 10 ++++++++++
2 files changed, 14 insertions(+), 3 deletions(-)
--
2.34.1
2
1
[PATCH OLK-6.6 2/2] ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
by Pan Taixi 20 Apr '26
by Pan Taixi 20 Apr '26
20 Apr '26
From: Larysa Zaremba <larysa.zaremba(a)intel.com>
mainline inclusion
from mainline-v7.0-rc3
commit e142dc4ef0f451b7ef99d09aaa84e9389af629d7
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14020/
CVE: CVE-2026-23377
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
The only user of frag_size field in XDP RxQ info is
bpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead
of DMA write size. Different assumptions in ice driver configuration lead
to negative tailroom.
This allows to trigger kernel panic, when using
XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to
6912 and the requested offset to a huge value, e.g.
XSK_UMEM__MAX_FRAME_SIZE * 100.
Due to other quirks of the ZC configuration in ice, panic is not observed
in ZC mode, but tailroom growing still fails when it should not.
Use fill queue buffer truesize instead of DMA write size in XDP RxQ info.
Fix ZC mode too by using the new helper.
Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side")
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com>
Signed-off-by: Larysa Zaremba <larysa.zaremba(a)intel.com>
Link: https://patch.msgid.link/20260305111253.2317394-5-larysa.zaremba@intel.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Conflicts:
drivers/net/ethernet/intel/ice/ice_base.c
[Adapted calculation of frag size. truesize is introduced into mainline in patch
93f53db9f9dc ("ice: switch to Page Pool"), which is not merged. Use frame_sz as
the truesize of underlying buffer.]
Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com>
---
drivers/net/ethernet/intel/ice/ice_base.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_base.c b/drivers/net/ethernet/intel/ice/ice_base.c
index 9a0682b05c4f..1408089a6549 100644
--- a/drivers/net/ethernet/intel/ice/ice_base.c
+++ b/drivers/net/ethernet/intel/ice/ice_base.c
@@ -557,7 +557,7 @@ int ice_vsi_cfg_rxq(struct ice_rx_ring *ring)
err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev,
ring->q_index,
ring->q_vector->napi.napi_id,
- ring->rx_buf_len);
+ ice_get_frame_sz(ring));
if (err)
return err;
}
@@ -568,10 +568,11 @@ int ice_vsi_cfg_rxq(struct ice_rx_ring *ring)
ring->rx_buf_len =
xsk_pool_get_rx_frame_size(ring->xsk_pool);
+ u32 frag_size = xsk_pool_get_rx_frag_step(ring->xsk_pool);
err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev,
ring->q_index,
ring->q_vector->napi.napi_id,
- ring->rx_buf_len);
+ frag_size);
if (err)
return err;
err = xdp_rxq_info_reg_mem_model(&ring->xdp_rxq,
@@ -588,7 +589,7 @@ int ice_vsi_cfg_rxq(struct ice_rx_ring *ring)
err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev,
ring->q_index,
ring->q_vector->napi.napi_id,
- ring->rx_buf_len);
+ ice_get_frame_sz(ring));
if (err)
return err;
}
--
2.34.1
1
0
20 Apr '26
From: Larysa Zaremba <larysa.zaremba(a)intel.com>
stable inclusion
from stable-v6.6.130
commit 183f940bdf9074f4fd7d32badeb0d73c93dc2070
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14020/
CVE: CVE-2026-23377
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 16394d80539937d348dd3b9ea32415c54e67a81b ]
rxq->frag_size is basically a step between consecutive strictly aligned
frames. In ZC mode, chunk size fits exactly, but if chunks are unaligned,
there is no safe way to determine accessible space to grow tailroom.
Report frag_size to be zero, if chunks are unaligned, chunk_size otherwise.
Fixes: 24ea50127ecf ("xsk: support mbuf on ZC RX")
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com>
Signed-off-by: Larysa Zaremba <larysa.zaremba(a)intel.com>
Link: https://patch.msgid.link/20260305111253.2317394-3-larysa.zaremba@intel.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com>
---
include/net/xdp_sock_drv.h | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/include/net/xdp_sock_drv.h b/include/net/xdp_sock_drv.h
index 5425f7ad5ebd..e1e46de7a875 100644
--- a/include/net/xdp_sock_drv.h
+++ b/include/net/xdp_sock_drv.h
@@ -41,6 +41,11 @@ static inline u32 xsk_pool_get_rx_frame_size(struct xsk_buff_pool *pool)
return xsk_pool_get_chunk_size(pool) - xsk_pool_get_headroom(pool);
}
+static inline u32 xsk_pool_get_rx_frag_step(struct xsk_buff_pool *pool)
+{
+ return pool->unaligned ? 0 : xsk_pool_get_chunk_size(pool);
+}
+
static inline void xsk_pool_set_rxq_info(struct xsk_buff_pool *pool,
struct xdp_rxq_info *rxq)
{
@@ -263,6 +268,11 @@ static inline u32 xsk_pool_get_rx_frame_size(struct xsk_buff_pool *pool)
return 0;
}
+static inline u32 xsk_pool_get_rx_frag_step(struct xsk_buff_pool *pool)
+{
+ return 0;
+}
+
static inline void xsk_pool_set_rxq_info(struct xsk_buff_pool *pool,
struct xdp_rxq_info *rxq)
{
--
2.34.1
1
0
[PATCH OLK-6.6] mm/numa_remote: set default distance between remote nodes to 255
by Jinjiang Tu 20 Apr '26
by Jinjiang Tu 20 Apr '26
20 Apr '26
hulk inclusion
category: other
bugzilla: https://atomgit.com/openeuler/kernel/issues/8974
----------------------------------------
Set default distance between remote nodes to 255, indicating unreachable.
Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com>
---
drivers/base/numa_remote.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/base/numa_remote.c b/drivers/base/numa_remote.c
index 19f16d265820..74eb87ac8b26 100644
--- a/drivers/base/numa_remote.c
+++ b/drivers/base/numa_remote.c
@@ -16,8 +16,8 @@
/* The default distance between local node and remote node */
#define REMOTE_TO_LOCAL_DISTANCE 100
-/* The default distance between two remtoe node */
-#define REMOTE_TO_REMOTE_DISTANCE 254
+/* The default distance between two remote node */
+#define REMOTE_TO_REMOTE_DISTANCE 255
bool numa_remote_enabled __ro_after_init;
static bool numa_remote_nofallback_mode __ro_after_init;
--
2.43.0
2
1
[PATCH OLK-6.6 v8 0/2] kvm: arm64: Transition from CPU Type to MIDR Register for Virtualization Feature Detection
by liqiqi 20 Apr '26
by liqiqi 20 Apr '26
20 Apr '26
Currently, there are two methods for determining whether a chip supports
specific virtualization features:
1. Reading the chip's CPU type from BIOS
2. Reading the value of the MIDR register
The issue with the first method is that each time a new chip is introduced,
the new CPU type must be defined, which leads to poor code portability and
maintainability.
Therefore, the second method has been adopted to replace the first. This
approach eliminates the dependency on CPU type by using the MIDR register.
liqiqi (2):
kvm: arm64: Add MIDR definitions and use MIDR to determine whether
features are supported
kvm: arm64: Remove cpu_type definition and it's related interfaces
arch/arm64/include/asm/cputype.h | 4 +
arch/arm64/kvm/arm.c | 1 -
arch/arm64/kvm/hisilicon/hisi_virt.c | 110 +++------------------------
arch/arm64/kvm/hisilicon/hisi_virt.h | 12 ---
4 files changed, 14 insertions(+), 113 deletions(-)
--
2.43.0
2
3
[PATCH OLK-5.10] ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
by Xinyu Zheng 20 Apr '26
by Xinyu Zheng 20 Apr '26
20 Apr '26
From: Weiming Shi <bestswngs(a)gmail.com>
stable inclusion
from stable-v6.6.131
commit 9c886e63b69658959633937e3acb7ca8addf7499
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14159
CVE: CVE-2026-31426
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
When ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware
platforms, it has already started the EC and installed the address
space handler with the struct acpi_ec pointer as handler context.
However, acpi_ec_setup() propagates the error without any cleanup.
The caller acpi_ec_add() then frees the struct acpi_ec for non-boot
instances, leaving a dangling handler context in ACPICA.
Any subsequent AML evaluation that accesses an EC OpRegion field
dispatches into acpi_ec_space_handler() with the freed pointer,
causing a use-after-free:
BUG: KASAN: slab-use-after-free in mutex_lock (kernel/locking/mutex.c:289)
Write of size 8 at addr ffff88800721de38 by task init/1
Call Trace:
<TASK>
mutex_lock (kernel/locking/mutex.c:289)
acpi_ec_space_handler (drivers/acpi/ec.c:1362)
acpi_ev_address_space_dispatch (drivers/acpi/acpica/evregion.c:293)
acpi_ex_access_region (drivers/acpi/acpica/exfldio.c:246)
acpi_ex_field_datum_io (drivers/acpi/acpica/exfldio.c:509)
acpi_ex_extract_from_field (drivers/acpi/acpica/exfldio.c:700)
acpi_ex_read_data_from_field (drivers/acpi/acpica/exfield.c:327)
acpi_ex_resolve_node_to_value (drivers/acpi/acpica/exresolv.c:392)
</TASK>
Allocated by task 1:
acpi_ec_alloc (drivers/acpi/ec.c:1424)
acpi_ec_add (drivers/acpi/ec.c:1692)
Freed by task 1:
kfree (mm/slub.c:6876)
acpi_ec_add (drivers/acpi/ec.c:1751)
The bug triggers on reduced-hardware EC platforms (ec->gpe < 0)
when the GPIO IRQ provider defers probing. Once the stale handler
exists, any unprivileged sysfs read that causes AML to touch an
EC OpRegion (battery, thermal, backlight) exercises the dangling
pointer.
Fix this by calling ec_remove_handlers() in the error path of
acpi_ec_setup() before clearing first_ec. ec_remove_handlers()
checks each EC_FLAGS_* bit before acting, so it is safe to call
regardless of how far ec_install_handlers() progressed:
-ENODEV (handler not installed): only calls acpi_ec_stop()
-EPROBE_DEFER (handler installed): removes handler, stops EC
Fixes: 03e9a0e05739 ("ACPI: EC: Consolidate event handler installation code")
Reported-by: Xiang Mei <xmei5(a)asu.edu>
Signed-off-by: Weiming Shi <bestswngs(a)gmail.com>
Link: https://patch.msgid.link/20260324165458.1337233-2-bestswngs@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
Conflicts:
drivers/acpi/ec.c
[context conflict]
Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com>
---
drivers/acpi/ec.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index b20206316fbe..79b4dd9b733b 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1618,8 +1618,10 @@ static int acpi_ec_setup(struct acpi_ec *ec, struct acpi_device *device)
int ret;
ret = ec_install_handlers(ec, device);
- if (ret)
+ if (ret) {
+ ec_remove_handlers(ec);
return ret;
+ }
/* First EC capable of handling transactions */
if (!first_ec)
--
2.34.1
2
1
[OLK-5.10] [Backport] ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
by Xinyu Zheng 20 Apr '26
by Xinyu Zheng 20 Apr '26
20 Apr '26
From: Weiming Shi <bestswngs(a)gmail.com>
stable inclusion
from stable-v6.6.131
commit 9c886e63b69658959633937e3acb7ca8addf7499
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14159
CVE: CVE-2026-31426
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
When ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware
platforms, it has already started the EC and installed the address
space handler with the struct acpi_ec pointer as handler context.
However, acpi_ec_setup() propagates the error without any cleanup.
The caller acpi_ec_add() then frees the struct acpi_ec for non-boot
instances, leaving a dangling handler context in ACPICA.
Any subsequent AML evaluation that accesses an EC OpRegion field
dispatches into acpi_ec_space_handler() with the freed pointer,
causing a use-after-free:
BUG: KASAN: slab-use-after-free in mutex_lock (kernel/locking/mutex.c:289)
Write of size 8 at addr ffff88800721de38 by task init/1
Call Trace:
<TASK>
mutex_lock (kernel/locking/mutex.c:289)
acpi_ec_space_handler (drivers/acpi/ec.c:1362)
acpi_ev_address_space_dispatch (drivers/acpi/acpica/evregion.c:293)
acpi_ex_access_region (drivers/acpi/acpica/exfldio.c:246)
acpi_ex_field_datum_io (drivers/acpi/acpica/exfldio.c:509)
acpi_ex_extract_from_field (drivers/acpi/acpica/exfldio.c:700)
acpi_ex_read_data_from_field (drivers/acpi/acpica/exfield.c:327)
acpi_ex_resolve_node_to_value (drivers/acpi/acpica/exresolv.c:392)
</TASK>
Allocated by task 1:
acpi_ec_alloc (drivers/acpi/ec.c:1424)
acpi_ec_add (drivers/acpi/ec.c:1692)
Freed by task 1:
kfree (mm/slub.c:6876)
acpi_ec_add (drivers/acpi/ec.c:1751)
The bug triggers on reduced-hardware EC platforms (ec->gpe < 0)
when the GPIO IRQ provider defers probing. Once the stale handler
exists, any unprivileged sysfs read that causes AML to touch an
EC OpRegion (battery, thermal, backlight) exercises the dangling
pointer.
Fix this by calling ec_remove_handlers() in the error path of
acpi_ec_setup() before clearing first_ec. ec_remove_handlers()
checks each EC_FLAGS_* bit before acting, so it is safe to call
regardless of how far ec_install_handlers() progressed:
-ENODEV (handler not installed): only calls acpi_ec_stop()
-EPROBE_DEFER (handler installed): removes handler, stops EC
Fixes: 03e9a0e05739 ("ACPI: EC: Consolidate event handler installation code")
Reported-by: Xiang Mei <xmei5(a)asu.edu>
Signed-off-by: Weiming Shi <bestswngs(a)gmail.com>
Link: https://patch.msgid.link/20260324165458.1337233-2-bestswngs@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
Conflicts:
drivers/acpi/ec.c
[context conflict]
Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com>
---
drivers/acpi/ec.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index b20206316fbe..79b4dd9b733b 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1618,8 +1618,10 @@ static int acpi_ec_setup(struct acpi_ec *ec, struct acpi_device *device)
int ret;
ret = ec_install_handlers(ec, device);
- if (ret)
+ if (ret) {
+ ec_remove_handlers(ec);
return ret;
+ }
/* First EC capable of handling transactions */
if (!first_ec)
--
2.34.1
1
0
[PATCH OLK-6.6] jfs: add dmapctl integrity check to prevent invalid operations
by Li Lingfeng 20 Apr '26
by Li Lingfeng 20 Apr '26
20 Apr '26
From: Yun Zhou <yun.zhou(a)windriver.com>
mainline inclusion
from mainline-v7.1-rc1
commit cce219b203c4b9cb445e910c7090d1f58af847c5
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/8972
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
Add check_dmapctl() to validate dmapctl structure integrity, focusing on
preventing invalid operations caused by on-disk corruption.
Key checks:
- nleafs bounded by [0, LPERCTL] (maximum leaf nodes per dmapctl).
- l2nleafs bounded by [0, L2LPERCTL] and consistent with nleafs
(nleafs must be 2^l2nleafs).
- leafidx must be exactly CTLLEAFIND (expected leaf index position).
- height bounded by [0, L2LPERCTL >> 1] (valid tree height range).
- budmin validity: NOFREE only if nleafs=0; otherwise >= BUDMIN.
- Leaf nodes fit within stree array (leafidx + nleafs <= CTLTREESIZE).
- Leaf node values are either non-negative or NOFREE.
Invoked in dbAllocAG(), dbFindCtl(), dbAdjCtl() and dbExtendFS() when
accessing dmapctl pages, catching corruption early before dmap operations
trigger invalid memory access or logic errors.
This fixes the following UBSAN warning.
[58245.668090][T14017] ------------[ cut here ]------------
[58245.668103][T14017] UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:2641:11
[58245.668119][T14017] shift exponent 110 is too large for 32-bit type 'int'
[58245.668137][T14017] CPU: 0 UID: 0 PID: 14017 Comm: 4c1966e88c28fa9 Tainted: G E 6.18.0-rc4-00253-g21ce5d4ba045-dirty #124 PREEMPT_{RT,(full)}
[58245.668174][T14017] Tainted: [E]=UNSIGNED_MODULE
[58245.668176][T14017] Hardware name: QEMU Ubuntu 25.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[58245.668184][T14017] Call Trace:
[58245.668200][T14017] <TASK>
[58245.668208][T14017] dump_stack_lvl+0x189/0x250
[58245.668288][T14017] ? __pfx_dump_stack_lvl+0x10/0x10
[58245.668301][T14017] ? __pfx__printk+0x10/0x10
[58245.668315][T14017] ? lock_metapage+0x303/0x400 [jfs]
[58245.668406][T14017] ubsan_epilogue+0xa/0x40
[58245.668422][T14017] __ubsan_handle_shift_out_of_bounds+0x386/0x410
[58245.668462][T14017] dbSplit+0x1f8/0x200 [jfs]
[58245.668543][T14017] dbAdjCtl+0x34c/0xa20 [jfs]
[58245.668628][T14017] dbAllocNear+0x2ee/0x3d0 [jfs]
[58245.668710][T14017] dbAlloc+0x933/0xba0 [jfs]
[58245.668797][T14017] ea_write+0x374/0xdd0 [jfs]
[58245.668888][T14017] ? __pfx_ea_write+0x10/0x10 [jfs]
[58245.668966][T14017] ? __jfs_setxattr+0x76e/0x1120 [jfs]
[58245.669046][T14017] __jfs_setxattr+0xa01/0x1120 [jfs]
[58245.669135][T14017] ? __pfx___jfs_setxattr+0x10/0x10 [jfs]
[58245.669216][T14017] ? mutex_lock_nested+0x154/0x1d0
[58245.669252][T14017] ? __jfs_xattr_set+0xb9/0x170 [jfs]
[58245.669333][T14017] __jfs_xattr_set+0xda/0x170 [jfs]
[58245.669430][T14017] ? __pfx___jfs_xattr_set+0x10/0x10 [jfs]
[58245.669509][T14017] ? xattr_full_name+0x6f/0x90
[58245.669546][T14017] ? jfs_xattr_set+0x33/0x60 [jfs]
[58245.669636][T14017] ? __pfx_jfs_xattr_set+0x10/0x10 [jfs]
[58245.669726][T14017] __vfs_setxattr+0x43c/0x480
[58245.669743][T14017] __vfs_setxattr_noperm+0x12d/0x660
[58245.669756][T14017] vfs_setxattr+0x16b/0x2f0
[58245.669768][T14017] ? __pfx_vfs_setxattr+0x10/0x10
[58245.669782][T14017] filename_setxattr+0x274/0x600
[58245.669795][T14017] ? __pfx_filename_setxattr+0x10/0x10
[58245.669806][T14017] ? getname_flags+0x1e5/0x540
[58245.669829][T14017] path_setxattrat+0x364/0x3a0
[58245.669840][T14017] ? __pfx_path_setxattrat+0x10/0x10
[58245.669859][T14017] ? __se_sys_chdir+0x1b9/0x280
[58245.669876][T14017] __x64_sys_lsetxattr+0xbf/0xe0
[58245.669888][T14017] do_syscall_64+0xfa/0xfa0
[58245.669901][T14017] ? lockdep_hardirqs_on+0x9c/0x150
[58245.669913][T14017] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[58245.669927][T14017] ? exc_page_fault+0xab/0x100
[58245.669937][T14017] entry_SYSCALL_64_after_hwframe+0x77/0x7f
Reported-by: syzbot+4c1966e88c28fa96e053(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4c1966e88c28fa96e053
Signed-off-by: Yun Zhou <yun.zhou(a)windriver.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com>
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
fs/jfs/jfs_dmap.c | 114 ++++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 111 insertions(+), 3 deletions(-)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 7c010ef6edb0..3369b951bcc9 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -133,6 +133,93 @@ static const s8 budtab[256] = {
2, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, -1
};
+/*
+ * check_dmapctl - Validate integrity of a dmapctl structure
+ * @dcp: Pointer to the dmapctl structure to check
+ *
+ * Return: true if valid, false if corrupted
+ */
+static bool check_dmapctl(struct dmapctl *dcp)
+{
+ s8 budmin = dcp->budmin;
+ u32 nleafs, l2nleafs, leafidx, height;
+ int i;
+
+ nleafs = le32_to_cpu(dcp->nleafs);
+ /* Check basic field ranges */
+ if (unlikely(nleafs > LPERCTL)) {
+ jfs_err("dmapctl: invalid nleafs %u (max %u)",
+ nleafs, LPERCTL);
+ return false;
+ }
+
+ l2nleafs = le32_to_cpu(dcp->l2nleafs);
+ if (unlikely(l2nleafs > L2LPERCTL)) {
+ jfs_err("dmapctl: invalid l2nleafs %u (max %u)",
+ l2nleafs, L2LPERCTL);
+ return false;
+ }
+
+ /* Verify nleafs matches l2nleafs (must be power of two) */
+ if (unlikely((1U << l2nleafs) != nleafs)) {
+ jfs_err("dmapctl: nleafs %u != 2^%u",
+ nleafs, l2nleafs);
+ return false;
+ }
+
+ leafidx = le32_to_cpu(dcp->leafidx);
+ /* Check leaf index matches expected position */
+ if (unlikely(leafidx != CTLLEAFIND)) {
+ jfs_err("dmapctl: invalid leafidx %u (expected %u)",
+ leafidx, CTLLEAFIND);
+ return false;
+ }
+
+ height = le32_to_cpu(dcp->height);
+ /* Check tree height is within valid range */
+ if (unlikely(height > (L2LPERCTL >> 1))) {
+ jfs_err("dmapctl: invalid height %u (max %u)",
+ height, L2LPERCTL >> 1);
+ return false;
+ }
+
+ /* Check budmin is valid (cannot be NOFREE for non-empty tree) */
+ if (budmin == NOFREE) {
+ if (unlikely(nleafs > 0)) {
+ jfs_err("dmapctl: budmin is NOFREE but nleafs %u",
+ nleafs);
+ return false;
+ }
+ } else if (unlikely(budmin < BUDMIN)) {
+ jfs_err("dmapctl: invalid budmin %d (min %d)",
+ budmin, BUDMIN);
+ return false;
+ }
+
+ /* Check leaf nodes fit within stree array */
+ if (unlikely(leafidx + nleafs > CTLTREESIZE)) {
+ jfs_err("dmapctl: leaf range exceeds stree size (end %u > %u)",
+ leafidx + nleafs, CTLTREESIZE);
+ return false;
+ }
+
+ /* Check leaf nodes have valid values */
+ for (i = leafidx; i < leafidx + nleafs; i++) {
+ s8 val = dcp->stree[i];
+
+ if (unlikely(val < NOFREE)) {
+ jfs_err("dmapctl: invalid leaf value %d at index %d",
+ val, i);
+ return false;
+ } else if (unlikely(val > 31)) {
+ jfs_err("dmapctl: leaf value %d too large at index %d", val, i);
+ return false;
+ }
+ }
+
+ return true;
+}
+
/*
* NAME: dbMount()
*
@@ -1376,7 +1463,7 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results)
dcp = (struct dmapctl *) mp->data;
budmin = dcp->budmin;
- if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) {
+ if (unlikely(!check_dmapctl(dcp))) {
jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page\n");
release_metapage(mp);
return -EIO;
@@ -1706,7 +1793,7 @@ static int dbFindCtl(struct bmap * bmp, int l2nb, int level, s64 * blkno)
dcp = (struct dmapctl *) mp->data;
budmin = dcp->budmin;
- if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) {
+ if (unlikely(!check_dmapctl(dcp))) {
jfs_error(bmp->db_ipbmap->i_sb,
"Corrupt dmapctl page\n");
release_metapage(mp);
@@ -2489,7 +2576,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
return -EIO;
dcp = (struct dmapctl *) mp->data;
- if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) {
+ if (unlikely(!check_dmapctl(dcp))) {
jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page\n");
release_metapage(mp);
return -EIO;
@@ -3458,6 +3545,11 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks)
return -EIO;
}
l2dcp = (struct dmapctl *) l2mp->data;
+ if (unlikely(!check_dmapctl(l2dcp))) {
+ jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");
+ release_metapage(l2mp);
+ return -EIO;
+ }
/* compute start L1 */
k = blkno >> L2MAXL1SIZE;
@@ -3475,6 +3567,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks)
if (l1mp == NULL)
goto errout;
l1dcp = (struct dmapctl *) l1mp->data;
+ if (unlikely(!check_dmapctl(l1dcp))) {
+ jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");
+ goto errout;
+ }
/* compute start L0 */
j = (blkno & (MAXL1SIZE - 1)) >> L2MAXL0SIZE;
@@ -3488,6 +3584,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks)
goto errout;
l1dcp = (struct dmapctl *) l1mp->data;
+ if (unlikely(!check_dmapctl(l1dcp))) {
+ jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");
+ goto errout;
+ }
/* compute start L0 */
j = 0;
@@ -3507,6 +3607,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks)
if (l0mp == NULL)
goto errout;
l0dcp = (struct dmapctl *) l0mp->data;
+ if (unlikely(!check_dmapctl(l0dcp))) {
+ jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");
+ goto errout;
+ }
/* compute start dmap */
i = (blkno & (MAXL0SIZE - 1)) >>
@@ -3522,6 +3626,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks)
goto errout;
l0dcp = (struct dmapctl *) l0mp->data;
+ if (unlikely(!check_dmapctl(l0dcp))) {
+ jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");
+ goto errout;
+ }
/* compute start dmap */
i = 0;
--
2.52.0
2
1
[PATCH OLK-6.6] ACPI: APEI: GHES: Don't send SIGBUS to kernel threads on ARM HW errors
by Wupeng Ma 20 Apr '26
by Wupeng Ma 20 Apr '26
20 Apr '26
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/8386
------------------------------------------
On arm64, when a Synchronous External Abort (SEA) occurs in kernel
context (e.g., during memory compaction via kcompactd), the error
follows this path:
do_sea()
-> do_apei_claim_sea()
-> apei_claim_sea()
-> ghes_notify_sea()
-> ghes_in_nmi_spool_from_list()
-> irq_work_queue(&ghes_proc_irq_work)
-> ghes_proc_in_irq() [IRQ context]
-> ghes_do_proc()
-> ghes_handle_arm_hw_error()
When ghes_handle_arm_hw_error() returns false (error not recoverable),
ghes_do_proc() sends SIGBUS to the current task via force_sig(SIGBUS).
However, kernel threads (e.g., kcompactd) have current->mm == NULL.
Sending SIGBUS to a kernel thread is meaningless and may cause
unexpected behavior. The SIGBUS signal should only be delivered to
user-space processes.
Fix by adding a check for current->mm before sending the signal.
This ensures that only tasks with a valid userspace memory mapping
receive the SIGBUS signal when a hardware error cannot be recovered.
Fixes: 9c72f69e011e ("arm64: add support for ARCH_HAS_COPY_MC")
Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com>
---
drivers/acpi/apei/ghes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 51cd04307ee4..faf521a45dbd 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -818,7 +818,7 @@ static void ghes_do_proc(struct ghes *ghes,
* If no memory failure work is queued for abnormal synchronous
* errors, do a force kill.
*/
- if (sync && !queued) {
+ if (sync && !queued && current->mm) {
pr_err("Sending SIGBUS to current task due to memory error not recovered");
force_sig(SIGBUS);
}
--
2.43.0
2
1
20 Apr '26
From: Larysa Zaremba <larysa.zaremba(a)intel.com>
stable inclusion
from stable-v6.6.130
commit 183f940bdf9074f4fd7d32badeb0d73c93dc2070
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14020/
CVE: CVE-2026-23377
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 16394d80539937d348dd3b9ea32415c54e67a81b ]
rxq->frag_size is basically a step between consecutive strictly aligned
frames. In ZC mode, chunk size fits exactly, but if chunks are unaligned,
there is no safe way to determine accessible space to grow tailroom.
Report frag_size to be zero, if chunks are unaligned, chunk_size otherwise.
Fixes: 24ea50127ecf ("xsk: support mbuf on ZC RX")
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com>
Signed-off-by: Larysa Zaremba <larysa.zaremba(a)intel.com>
Link: https://patch.msgid.link/20260305111253.2317394-3-larysa.zaremba@intel.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com>
---
include/net/xdp_sock_drv.h | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/include/net/xdp_sock_drv.h b/include/net/xdp_sock_drv.h
index 5425f7ad5ebd..e1e46de7a875 100644
--- a/include/net/xdp_sock_drv.h
+++ b/include/net/xdp_sock_drv.h
@@ -41,6 +41,11 @@ static inline u32 xsk_pool_get_rx_frame_size(struct xsk_buff_pool *pool)
return xsk_pool_get_chunk_size(pool) - xsk_pool_get_headroom(pool);
}
+static inline u32 xsk_pool_get_rx_frag_step(struct xsk_buff_pool *pool)
+{
+ return pool->unaligned ? 0 : xsk_pool_get_chunk_size(pool);
+}
+
static inline void xsk_pool_set_rxq_info(struct xsk_buff_pool *pool,
struct xdp_rxq_info *rxq)
{
@@ -263,6 +268,11 @@ static inline u32 xsk_pool_get_rx_frame_size(struct xsk_buff_pool *pool)
return 0;
}
+static inline u32 xsk_pool_get_rx_frag_step(struct xsk_buff_pool *pool)
+{
+ return 0;
+}
+
static inline void xsk_pool_set_rxq_info(struct xsk_buff_pool *pool,
struct xdp_rxq_info *rxq)
{
--
2.34.1
2
1
[PATCH OLK-6.6 2/2] ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
by Pan Taixi 20 Apr '26
by Pan Taixi 20 Apr '26
20 Apr '26
From: Larysa Zaremba <larysa.zaremba(a)intel.com>
mainline inclusion
from mainline-v7.0-rc3
commit e142dc4ef0f451b7ef99d09aaa84e9389af629d7
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14020/
CVE: CVE-2026-23377
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
The only user of frag_size field in XDP RxQ info is
bpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead
of DMA write size. Different assumptions in ice driver configuration lead
to negative tailroom.
This allows to trigger kernel panic, when using
XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to
6912 and the requested offset to a huge value, e.g.
XSK_UMEM__MAX_FRAME_SIZE * 100.
Due to other quirks of the ZC configuration in ice, panic is not observed
in ZC mode, but tailroom growing still fails when it should not.
Use fill queue buffer truesize instead of DMA write size in XDP RxQ info.
Fix ZC mode too by using the new helper.
Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side")
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com>
Signed-off-by: Larysa Zaremba <larysa.zaremba(a)intel.com>
Link: https://patch.msgid.link/20260305111253.2317394-5-larysa.zaremba@intel.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Conflicts:
drivers/net/ethernet/intel/ice/ice_base.c
[Adapted calculation of frag size. truesize is introduced into mainline in patch
93f53db9f9dc ("ice: switch to Page Pool"), which is not merged. Use frame_sz as
the truesize of underlying buffer.]
Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com>
---
drivers/net/ethernet/intel/ice/ice_base.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_base.c b/drivers/net/ethernet/intel/ice/ice_base.c
index 9a0682b05c4f..1408089a6549 100644
--- a/drivers/net/ethernet/intel/ice/ice_base.c
+++ b/drivers/net/ethernet/intel/ice/ice_base.c
@@ -557,7 +557,7 @@ int ice_vsi_cfg_rxq(struct ice_rx_ring *ring)
err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev,
ring->q_index,
ring->q_vector->napi.napi_id,
- ring->rx_buf_len);
+ ice_get_frame_sz(ring));
if (err)
return err;
}
@@ -568,10 +568,11 @@ int ice_vsi_cfg_rxq(struct ice_rx_ring *ring)
ring->rx_buf_len =
xsk_pool_get_rx_frame_size(ring->xsk_pool);
+ u32 frag_size = xsk_pool_get_rx_frag_step(ring->xsk_pool);
err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev,
ring->q_index,
ring->q_vector->napi.napi_id,
- ring->rx_buf_len);
+ frag_size);
if (err)
return err;
err = xdp_rxq_info_reg_mem_model(&ring->xdp_rxq,
@@ -588,7 +589,7 @@ int ice_vsi_cfg_rxq(struct ice_rx_ring *ring)
err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev,
ring->q_index,
ring->q_vector->napi.napi_id,
- ring->rx_buf_len);
+ ice_get_frame_sz(ring));
if (err)
return err;
}
--
2.34.1
1
0
FIX CVE-2026-23473
Jens Axboe (2):
io_uring/poll: improve readability of poll reference decrementing
io_uring/poll: fix multishot recv missing EOF on wakeup race
io_uring/poll.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--
2.39.2
2
3
[PATCH OLK-6.6 0/2] ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
by Pan Taixi 18 Apr '26
by Pan Taixi 18 Apr '26
18 Apr '26
Backport "ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz" to
OLK-6.6
Include "xsk: introduce helper to determine rxq->frag_size" to introduce the helper
function xsk_pool_get_rx_frag_step()
Larysa Zaremba (2):
xsk: introduce helper to determine rxq->frag_size
ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
drivers/net/ethernet/intel/ice/ice_base.c | 7 ++++---
include/net/xdp_sock_drv.h | 10 ++++++++++
2 files changed, 14 insertions(+), 3 deletions(-)
--
2.34.1
1
0
From: Paulo Alcantara <pc(a)manguebit.org>
stable inclusion
from stable-v6.1.167
commit fd4547830720647d4af02ee50f883c4b1cca06e4
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14118
CVE: CVE-2026-31392
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 12b4c5d98cd7ca46d5035a57bcd995df614c14e1 upstream.
Customer reported that some of their krb5 mounts were failing against
a single server as the client was trying to mount the shares with
wrong credentials. It turned out the client was reusing SMB session
from first mount to try mounting the other shares, even though a
different username= option had been specified to the other mounts.
By using username mount option along with sec=krb5 to search for
principals from keytab is supported by cifs.upcall(8) since
cifs-utils-4.8. So fix this by matching username mount option in
match_session() even with Kerberos.
For example, the second mount below should fail with -ENOKEY as there
is no 'foobar' principal in keytab (/etc/krb5.keytab). The client
ends up reusing SMB session from first mount to perform the second
one, which is wrong.
```
$ ktutil
ktutil: add_entry -password -p testuser -k 1 -e aes256-cts
Password for testuser(a)ZELDA.TEST:
ktutil: write_kt /etc/krb5.keytab
ktutil: quit
$ klist -ke
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- ----------------------------------------------------------------
1 testuser(a)ZELDA.TEST (aes256-cts-hmac-sha1-96)
$ mount.cifs //w22-root2/scratch /mnt/1 -o sec=krb5,username=testuser
$ mount.cifs //w22-root2/scratch /mnt/2 -o sec=krb5,username=foobar
$ mount -t cifs | grep -Po 'username=\K\w+'
testuser
testuser
```
Reported-by: Oscar Santos <ossantos(a)redhat.com>
Signed-off-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.org>
Cc: David Howells <dhowells(a)redhat.com>
Cc: linux-cifs(a)vger.kernel.org
Cc: stable(a)vger.kernel.org
Signed-off-by: Steve French <stfrench(a)microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Conflicts:
fs/cifs/connect.c
fs/smb/client/connect.c
[Linux has moved cifs to the smb/client.]
Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com>
---
fs/cifs/connect.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 287230b70e51..a69f6f1f31bc 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2737,10 +2737,14 @@ static int match_session(struct cifs_ses *ses, struct smb_vol *vol)
switch (ses->sectype) {
case Kerberos:
if (!uid_eq(vol->cred_uid, ses->cred_uid))
return 0;
+ if (strncmp(ses->user_name ?: "",
+ vol->username ?: "",
+ CIFS_MAX_USERNAME_LEN))
+ return 0;
break;
default:
/* NULL username means anonymous session */
if (ses->user_name == NULL) {
if (!vol->nullauth)
--
2.39.2
2
1
Introduce xSched dmem
Alexander Pavlenko (2):
xSched/dmem: introduce xsched_dmem_alloc()
xSched/dmem: introduce xsched_dmem_free()
Liu Kai (2):
xSched/dmem: add support for XPU devices to register/unregister dmem
regions
xSched/dmem: introduce xsched_dmem_cleanup()
include/linux/cgroup_dmem.h | 2 -
include/linux/xsched.h | 14 ++
include/uapi/linux/xsched/xcu_vstream.h | 9 +
kernel/xsched/Makefile | 1 +
kernel/xsched/core.c | 3 +
kernel/xsched/dmem.c | 263 ++++++++++++++++++++++++
kernel/xsched/vstream.c | 114 ++++++++++
7 files changed, 404 insertions(+), 2 deletions(-)
create mode 100644 kernel/xsched/dmem.c
--
2.34.1
2
5
Introduce xSched dmem
Alexander Pavlenko (2):
xSched/dmem: introduce xsched_dmem_alloc()
xSched/dmem: introduce xsched_dmem_free()
Liu Kai (2):
xSched/dmem: add support for XPU devices to register/unregister dmem
regions
xSched/dmem: introduce xsched_dmem_cleanup()
include/linux/cgroup_dmem.h | 2 -
include/linux/xsched.h | 14 ++
include/uapi/linux/xsched/xcu_vstream.h | 9 +
kernel/xsched/Makefile | 1 +
kernel/xsched/core.c | 3 +
kernel/xsched/dmem.c | 263 ++++++++++++++++++++++++
kernel/xsched/vstream.c | 114 ++++++++++
7 files changed, 404 insertions(+), 2 deletions(-)
create mode 100644 kernel/xsched/dmem.c
--
2.34.1
2
5
Alan Maguire (16):
kbuild,bpf: Switch to using --btf_features for pahole v1.26 and later
kbuild, bpf: Use test-ge check for v1.25-only pahole
libbpf: Add btf__distill_base() creating split BTF with distilled base
BTF
selftests/bpf: Test distilled base, split BTF generation
libbpf: Split BTF relocation
selftests/bpf: Extend distilled BTF tests to cover BTF relocation
resolve_btfids: Handle presence of .BTF.base section
libbpf: BTF relocation followup fixing naming, loop logic
module, bpf: Store BTF base pointer in struct module
libbpf: Split field iter code into its own file kernel
libbpf,bpf: Share BTF relocate-related code with kernel
kbuild,bpf: Add module-specific pahole flags for distilled base BTF
selftests/bpf: Add kfunc_call test for simple dtor in bpf_testmod
bpf: fix build when CONFIG_DEBUG_INFO_BTF[_MODULES] is undefined
libbpf: Fix error handling in btf__distill_base()
libbpf: Fix license for btf_relocate.c
Alexander Lobakin (1):
bitops: make BYTES_TO_BITS() treewide-available
Alexei Starovoitov (2):
s390/bpf: Fix indirect trampoline generation
bpf: Introduce "volatile compare" macros
Andrii Nakryiko (13):
bpf: Emit global subprog name in verifier logs
bpf: Validate global subprogs lazily
selftests/bpf: Add lazy global subprog validation tests
libbpf: Add btf__new_split() API that was declared but not implemented
bpf: move sleepable flag from bpf_prog_aux to bpf_prog
libbpf: Add BTF field iterator
libbpf: Make use of BTF field iterator in BPF linker code
libbpf: Make use of BTF field iterator in BTF handling code
bpftool: Use BTF field iterator in btfgen
libbpf: Remove callback-based type/string BTF field visitor helpers
bpf: extract iterator argument type and name validation logic
bpf: allow passing struct bpf_iter_<type> as kfunc arguments
selftests/bpf: test passing iterator to a kfunc
Benjamin Tissoires (1):
bpf: introduce in_sleepable() helper
Christophe Leroy (2):
bpf: Remove arch_unprotect_bpf_trampoline()
bpf: Check return from set_memory_rox()
Chuyi Zhou (13):
cgroup: Prepare for using css_task_iter_*() in BPF
bpf: Introduce css_task open-coded iterator kfuncs
bpf: Introduce task open coded iterator kfuncs
bpf: Introduce css open-coded iterator kfuncs
bpf: teach the verifier to enforce css_iter and task_iter in RCU CS
bpf: Let bpf_iter_task_new accept null task ptr
selftests/bpf: rename bpf_iter_task.c to bpf_iter_tasks.c
selftests/bpf: Add tests for open-coded task and css iter
bpf: Relax allowlist for css_task iter
selftests/bpf: Add tests for css_task iter combining with cgroup iter
selftests/bpf: Add test for using css_task iter in sleepable progs
bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg
selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly
Daniel Xu (3):
bpf: btf: Support flags for BTF_SET8 sets
bpf: btf: Add BTF_KFUNCS_START/END macro pair
bpf: treewide: Annotate BPF kfuncs in BTF
Dave Marchevsky (6):
bpf: Don't explicitly emit BTF for struct btf_iter_num
selftests/bpf: Rename bpf_iter_task_vma.c to bpf_iter_task_vmas.c
bpf: Introduce task_vma open-coded iterator kfuncs
selftests/bpf: Add tests for open-coded task_vma iter
bpf: Add __bpf_kfunc_{start,end}_defs macros
bpf: Add __bpf_hook_{start,end} macros
David Vernet (2):
bpf: Add ability to pin bpf timer to calling CPU
selftests/bpf: Test pinning bpf timer to a core
Eduard Zingerman (2):
libbpf: Make btf_parse_elf process .BTF.base transparently
selftests/bpf: Check if distilled base inherits source endianness
Geliang Tang (1):
bpf, btf: Check btf for register_bpf_struct_ops
Hou Tao (6):
bpf: Free dynamically allocated bits in bpf_iter_bits_destroy()
bpf: Add bpf_mem_alloc_check_size() helper
bpf: Check the validity of nr_words in bpf_iter_bits_new()
bpf: Use __u64 to save the bits in bits iterator
selftests/bpf: Add three test cases for bits_iter
selftests/bpf: Use -4095 as the bad address for bits iterator
Kui-Feng Lee (29):
bpf: refactory struct_ops type initialization to a function.
bpf: get type information with BTF_ID_LIST
bpf, net: introduce bpf_struct_ops_desc.
bpf: add struct_ops_tab to btf.
bpf: make struct_ops_map support btfs other than btf_vmlinux.
bpf: pass btf object id in bpf_map_info.
bpf: lookup struct_ops types from a given module BTF.
bpf: pass attached BTF to the bpf_struct_ops subsystem
bpf: hold module refcnt in bpf_struct_ops map creation and prog
verification.
bpf: validate value_type
bpf, net: switch to dynamic registration
libbpf: Find correct module BTFs for struct_ops maps and progs.
bpf: export btf_ctx_access to modules.
selftests/bpf: test case for register_bpf_struct_ops().
bpf: Fix error checks against bpf_get_btf_vmlinux().
bpf: Remove an unnecessary check.
selftests/bpf: Suppress warning message of an unused variable.
bpf: add btf pointer to struct bpf_ctx_arg_aux.
bpf: Move __kfunc_param_match_suffix() to btf.c.
bpf: Create argument information for nullable arguments.
selftests/bpf: Test PTR_MAYBE_NULL arguments of struct_ops operators.
libbpf: Set btf_value_type_id of struct bpf_map for struct_ops.
libbpf: Convert st_ops->data to shadow type.
bpftool: Generated shadow variables for struct_ops maps.
bpftool: Add an example for struct_ops map and shadow type.
selftests/bpf: Test if shadow types work correctly.
bpf, net: validate struct_ops when updating value.
bpf: struct_ops supports more than one page for trampolines.
selftests/bpf: Test struct_ops maps with a large number of struct_ops
program.
Kumar Kartikeya Dwivedi (4):
bpf: Allow calling static subprogs while holding a bpf_spin_lock
selftests/bpf: Add test for static subprog call in lock cs
bpf: Transfer RCU lock state between subprog calls
selftests/bpf: Add tests for RCU lock transfer between subprogs
Luo Gengkun (7):
bpf: Fix kabi-breakage for bpf_func_info_aux
bpf: Fix kabi-breakage for bpf_tramp_image
bpf: Fix kabi for bpf_attr
bpf_verifier: Fix kabi for bpf_verifier_env
bpf: Fix kabi for bpf_ctx_arg_aux
bpf: Fix kabi for bpf_prog_aux and bpf_prog
selftests/bpf: modify test_loader that didn't support running
bpf_prog_type_syscall programs
Martin KaFai Lau (4):
libbpf: Ensure undefined bpf_attr field stays 0
bpf: Remove unnecessary err < 0 check in
bpf_struct_ops_map_update_elem
bpf: Fix a crash when btf_parse_base() returns an error pointer
bpf: Reject struct_ops registration that uses module ptr and the
module btf_id is missing
Masahiro Yamada (1):
kbuild: avoid too many execution of scripts/pahole-flags.sh
Matthieu Baerts (1):
bpf: fix compilation error without CGROUPS
Peter Zijlstra (6):
cfi: Flip headers
x86/cfi,bpf: Fix BPF JIT call
x86/cfi,bpf: Fix bpf_callback_t CFI
x86/cfi,bpf: Fix bpf_struct_ops CFI
cfi: Add CFI_NOSEAL()
bpf: Fix dtor CFI
Pu Lehui (8):
riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops
bpf: Fix kabi breakage in struct module
riscv, bpf: Fix out-of-bounds issue when preparing trampoline image
selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill
test
libbpf: Fix return zero when elf_begin failed
libbpf: Fix incorrect traversal end type ID when marking
BTF_IS_EMBEDDED
selftests/bpf: Add distilled BTF test about marking BTF_IS_EMBEDDED
selftests/bpf: Add file_read_pattern to gitignore
Song Liu (8):
bpf: Charge modmem for struct_ops trampoline
bpf: Let bpf_prog_pack_free handle any pointer
bpf: Adjust argument names of arch_prepare_bpf_trampoline()
bpf: Add helpers for trampoline image management
bpf, x86: Adjust arch_prepare_bpf_trampoline return value
bpf: Add arch_bpf_trampoline_size()
bpf: Use arch_bpf_trampoline_size
x86, bpf: Use bpf_prog_pack for bpf trampoline
T.J. Mercier (1):
bpf, docs: Fix broken link to renamed bpf_iter_task_vmas.c
Tony Ambardar (1):
libbpf: Ensure new BTF objects inherit input endianness
Yafang Shao (2):
bpf: Add bits iterator
selftests/bpf: Add selftest for bits iter
Documentation/bpf/bpf_iterators.rst | 2 +-
Documentation/bpf/kfuncs.rst | 14 +-
MAINTAINERS | 2 +-
Makefile | 4 +-
arch/arm64/kernel/bpf-rvi.c | 4 +-
arch/arm64/net/bpf_jit_comp.c | 55 +-
arch/riscv/include/asm/cfi.h | 3 +-
arch/riscv/kernel/cfi.c | 2 +-
arch/riscv/net/bpf_jit_comp64.c | 48 +-
arch/s390/net/bpf_jit_comp.c | 59 +-
arch/x86/include/asm/cfi.h | 126 ++-
arch/x86/kernel/alternative.c | 87 +-
arch/x86/kernel/cfi.c | 4 +-
arch/x86/net/bpf_jit_comp.c | 261 ++++--
block/blk-cgroup.c | 4 +-
drivers/hid/bpf/hid_bpf_dispatch.c | 12 +-
fs/proc/stat.c | 4 +-
include/asm-generic/Kbuild | 1 +
include/asm-generic/cfi.h | 5 +
include/linux/bitops.h | 2 +
include/linux/bpf.h | 130 ++-
include/linux/bpf_mem_alloc.h | 3 +
include/linux/bpf_verifier.h | 21 +-
include/linux/btf.h | 105 +++
include/linux/btf_ids.h | 21 +-
include/linux/cfi.h | 12 +
include/linux/cgroup.h | 12 +-
include/linux/filter.h | 2 +-
include/linux/module.h | 5 +
include/uapi/linux/bpf.h | 16 +-
kernel/bpf-rvi/common_kfuncs.c | 4 +-
kernel/bpf/Makefile | 8 +-
kernel/bpf/bpf_iter.c | 12 +-
kernel/bpf/bpf_struct_ops.c | 748 ++++++++++++------
kernel/bpf/bpf_struct_ops_types.h | 12 -
kernel/bpf/btf.c | 431 ++++++++--
kernel/bpf/cgroup_iter.c | 65 +-
kernel/bpf/core.c | 76 +-
kernel/bpf/cpumask.c | 18 +-
kernel/bpf/dispatcher.c | 7 +-
kernel/bpf/helpers.c | 202 ++++-
kernel/bpf/map_iter.c | 10 +-
kernel/bpf/memalloc.c | 14 +-
kernel/bpf/syscall.c | 12 +-
kernel/bpf/task_iter.c | 242 +++++-
kernel/bpf/trampoline.c | 99 ++-
kernel/bpf/verifier.c | 317 ++++++--
kernel/cgroup/cgroup.c | 18 +-
kernel/cgroup/cpuset.c | 4 +-
kernel/cgroup/rstat.c | 13 +-
kernel/events/core.c | 2 +-
kernel/module/main.c | 5 +-
kernel/sched/bpf_sched.c | 8 +-
kernel/sched/cpuacct.c | 4 +-
kernel/trace/bpf_trace.c | 12 +-
kernel/trace/trace_probe.c | 2 -
net/bpf/bpf_dummy_struct_ops.c | 72 +-
net/bpf/test_run.c | 30 +-
net/core/filter.c | 33 +-
net/core/xdp.c | 10 +-
net/ipv4/bpf_tcp_ca.c | 93 ++-
net/ipv4/fou_bpf.c | 10 +-
net/ipv4/tcp_bbr.c | 4 +-
net/ipv4/tcp_cong.c | 6 +-
net/ipv4/tcp_cubic.c | 4 +-
net/ipv4/tcp_dctcp.c | 4 +-
net/netfilter/nf_conntrack_bpf.c | 10 +-
net/netfilter/nf_nat_bpf.c | 10 +-
net/socket.c | 8 +-
net/xfrm/xfrm_interface_bpf.c | 10 +-
scripts/Makefile.btf | 33 +
scripts/Makefile.modfinal | 2 +-
scripts/pahole-flags.sh | 30 -
.../bpf/bpftool/Documentation/bpftool-gen.rst | 58 +-
tools/bpf/bpftool/gen.c | 253 +++++-
tools/bpf/resolve_btfids/main.c | 8 +
tools/include/linux/bitops.h | 2 +
tools/include/uapi/linux/bpf.h | 14 +-
tools/lib/bpf/Build | 2 +-
tools/lib/bpf/bpf.c | 4 +-
tools/lib/bpf/bpf.h | 4 +-
tools/lib/bpf/btf.c | 704 ++++++++++++-----
tools/lib/bpf/btf.h | 36 +
tools/lib/bpf/btf_iter.c | 177 +++++
tools/lib/bpf/btf_relocate.c | 519 ++++++++++++
tools/lib/bpf/libbpf.c | 86 +-
tools/lib/bpf/libbpf.map | 4 +-
tools/lib/bpf/libbpf_internal.h | 29 +-
tools/lib/bpf/libbpf_probes.c | 1 +
tools/lib/bpf/linker.c | 58 +-
tools/perf/util/probe-finder.c | 4 +-
tools/testing/selftests/bpf/.gitignore | 1 +
.../testing/selftests/bpf/bpf_experimental.h | 96 +++
.../selftests/bpf/bpf_testmod/bpf_testmod.c | 160 +++-
.../selftests/bpf/bpf_testmod/bpf_testmod.h | 61 ++
.../bpf/bpf_testmod/bpf_testmod_kfunc.h | 9 +
.../selftests/bpf/prog_tests/bpf_iter.c | 44 +-
.../selftests/bpf/prog_tests/btf_distill.c | 692 ++++++++++++++++
.../selftests/bpf/prog_tests/cgroup_iter.c | 33 +
.../testing/selftests/bpf/prog_tests/iters.c | 209 +++++
.../selftests/bpf/prog_tests/kfunc_call.c | 1 +
.../selftests/bpf/prog_tests/rcu_read_lock.c | 6 +
.../selftests/bpf/prog_tests/spin_lock.c | 2 +
.../prog_tests/test_struct_ops_maybe_null.c | 46 ++
.../bpf/prog_tests/test_struct_ops_module.c | 86 ++
.../prog_tests/test_struct_ops_multi_pages.c | 30 +
.../testing/selftests/bpf/prog_tests/timer.c | 4 +
.../selftests/bpf/prog_tests/verifier.c | 4 +
...f_iter_task_vma.c => bpf_iter_task_vmas.c} | 0
.../{bpf_iter_task.c => bpf_iter_tasks.c} | 0
tools/testing/selftests/bpf/progs/iters_css.c | 72 ++
.../selftests/bpf/progs/iters_css_task.c | 102 +++
.../testing/selftests/bpf/progs/iters_task.c | 41 +
.../selftests/bpf/progs/iters_task_failure.c | 105 +++
.../selftests/bpf/progs/iters_task_vma.c | 43 +
.../selftests/bpf/progs/iters_testmod_seq.c | 50 ++
.../selftests/bpf/progs/kfunc_call_test.c | 37 +
.../selftests/bpf/progs/rcu_read_lock.c | 120 +++
.../bpf/progs/struct_ops_maybe_null.c | 29 +
.../bpf/progs/struct_ops_maybe_null_fail.c | 24 +
.../selftests/bpf/progs/struct_ops_module.c | 37 +
.../bpf/progs/struct_ops_multi_pages.c | 102 +++
.../selftests/bpf/progs/test_global_func12.c | 4 +-
.../selftests/bpf/progs/test_spin_lock.c | 65 ++
.../selftests/bpf/progs/test_spin_lock_fail.c | 44 ++
tools/testing/selftests/bpf/progs/timer.c | 63 +-
.../selftests/bpf/progs/verifier_bits_iter.c | 232 ++++++
.../bpf/progs/verifier_global_subprogs.c | 92 +++
.../selftests/bpf/progs/verifier_spin_lock.c | 2 +-
.../bpf/progs/verifier_subprog_precision.c | 4 +-
tools/testing/selftests/bpf/test_loader.c | 10 +-
131 files changed, 7326 insertions(+), 1139 deletions(-)
create mode 100644 include/asm-generic/cfi.h
delete mode 100644 kernel/bpf/bpf_struct_ops_types.h
create mode 100644 scripts/Makefile.btf
delete mode 100755 scripts/pahole-flags.sh
create mode 100644 tools/lib/bpf/btf_iter.c
create mode 100644 tools/lib/bpf/btf_relocate.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_distill.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_maybe_null.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_module.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_pages.c
rename tools/testing/selftests/bpf/progs/{bpf_iter_task_vma.c => bpf_iter_task_vmas.c} (100%)
rename tools/testing/selftests/bpf/progs/{bpf_iter_task.c => bpf_iter_tasks.c} (100%)
create mode 100644 tools/testing/selftests/bpf/progs/iters_css.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_css_task.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task_failure.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task_vma.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null_fail.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_module.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_multi_pages.c
create mode 100644 tools/testing/selftests/bpf/progs/verifier_bits_iter.c
create mode 100644 tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
--
2.34.1
2
141
This patch set support ext4 hardware atomic write.
Alan Adamson (1):
nvme: Atomic write support
John Garry (10):
block: Pass blk_queue_get_max_sectors() a request pointer
block: Generalize chunk_sectors support as boundary support
block: Add core atomic write support
block: Call blkdev_dio_unaligned() from blkdev_direct_IO()
block: Add fops atomic write support
block/fs: Pass an iocb to generic_atomic_write_valid()
fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid()
block: Add bdev atomic write limits helpers
fs: Export generic_atomic_write_valid()
fs: iomap: Atomic write support
Long Li (3):
block: fix kabi broken in struct queue_limits
fs: fix kabi broken in struct kstat
block: fix kabi broken in enum req_flag_bits
Prasad Singamsetty (2):
fs: Initial atomic write support
fs: Add initial atomic write support info to statx
Ritesh Harjani (IBM) (12):
ext4: Add statx support for atomic writes
ext4: Check for atomic writes support in write iter
ext4: Support setting FMODE_CAN_ATOMIC_WRITE
ext4: Do not fallback to buffered-io for DIO atomic write
ext4: Document an edge case for overwrites
ext4: Check if inode uses extents in ext4_inode_can_atomic_write()
ext4: Make ext4_meta_trans_blocks() non-static for later use
ext4: Add support for EXT4_GET_BLOCKS_QUERY_LEAF_BLOCKS
ext4: Add multi-fsblock atomic write support with bigalloc
ext4: Enable support for ext4 multi-fsblock atomic write using
bigalloc
ext4: Add atomic block write documentation
iomap: Lift blocksize restriction on atomic writes
Documentation/ABI/stable/sysfs-block | 53 +++
.../filesystems/ext4/atomic_writes.rst | 225 ++++++++++++
Documentation/filesystems/ext4/overview.rst | 1 +
block/blk-core.c | 19 +
block/blk-merge.c | 67 +++-
block/blk-mq.c | 2 +-
block/blk-settings.c | 87 +++++
block/blk-sysfs.c | 33 ++
block/blk.h | 9 +-
block/fops.c | 51 ++-
drivers/md/dm.c | 2 +-
drivers/nvme/host/core.c | 54 ++-
fs/aio.c | 8 +-
fs/btrfs/ioctl.c | 2 +-
fs/ext4/ext4.h | 35 +-
fs/ext4/extents.c | 99 +++++
fs/ext4/file.c | 31 +-
fs/ext4/inode.c | 346 ++++++++++++++++--
fs/ext4/super.c | 34 ++
fs/iomap/direct-io.c | 38 +-
fs/iomap/trace.h | 3 +-
fs/read_write.c | 22 +-
fs/stat.c | 34 ++
include/linux/blk_types.h | 8 +-
include/linux/blkdev.h | 84 ++++-
include/linux/fs.h | 18 +-
include/linux/iomap.h | 1 +
include/linux/stat.h | 5 +-
include/uapi/linux/fs.h | 5 +-
include/uapi/linux/stat.h | 11 +-
io_uring/rw.c | 8 +-
31 files changed, 1308 insertions(+), 87 deletions(-)
create mode 100644 Documentation/filesystems/ext4/atomic_writes.rst
--
2.39.2
3
30
[PATCH v3 OLK-6.6 0/5] arm64/ras: Firmware-first SEI error handling with ESB synchronization
by Wupeng Ma 15 Apr '26
by Wupeng Ma 15 Apr '26
15 Apr '26
This series introduces firmware-first RAS (Reliability, Availability, and
Serviceability) error handling for ARM64 SEI (Synchronous External Interrupt)
errors, with support for ESB (Error Synchronization Barrier) synchronization.
The implementation includes:
- Boot parameter to enable/disable ESB synchronization for SEI
- Entry code patching to use ESB instruction for SEI handling
- Vendor-specific SEI error handling via APEI/GHES
- Sysctl interface for runtime control of vendor SEI handling
Change log since v2:
- Fix memory leaks in hisi_sei_kill_task if task_work_add fails
Change log since v1:
- Fix memory leaks in err_pool_alloc and err_pa=0 paths in hisi_sei_kill_task
Liao Chang (1):
arm64/entry: Add support to synchronize SEI at the exception boundary
Wupeng Ma (3):
ACPI/APEI/arm64: add vendor SEI handling for firmware-first RAS
ACPI: APEI: add runtime switch for HiSilicon vendor SEI handling
arm64: openeuler_defconfig: enable CONFIG_ARM64_SYNC_SEI by default
Zheng Chuan (1):
arm64: Add boot parameter to control ESB for SEI synchronization
.../admin-guide/kernel-parameters.txt | 8 +
Documentation/admin-guide/sysctl/kernel.rst | 27 +++
arch/arm64/Kconfig | 14 ++
arch/arm64/configs/openeuler_defconfig | 1 +
arch/arm64/include/asm/acpi.h | 2 +
arch/arm64/include/asm/setup.h | 9 +
arch/arm64/kernel/Makefile | 1 +
arch/arm64/kernel/arm64_sync_sei.c | 45 +++++
arch/arm64/kernel/entry.S | 44 ++++
arch/arm64/kernel/traps.c | 15 ++
arch/arm64/kernel/xcall/entry.S | 2 +
drivers/acpi/apei/apei-internal.h | 2 +
drivers/acpi/apei/ghes-vendor-info.c | 191 +++++++++++++++++-
drivers/acpi/apei/ghes.c | 5 +
14 files changed, 365 insertions(+), 1 deletion(-)
create mode 100644 arch/arm64/kernel/arm64_sync_sei.c
--
2.43.0
2
6
您好！
Kernel 邀请您参加 2026-04-17 14:00 召开的WeLink会议(自动录制)
会议主题：openEuler Kernel SIG双周例会
会议发起人： LiaoTao_Wave
会议内容：
1. 进展update
2. 议题征集中，新增议题可直接填报至会议纪要看板。
会议链接：https://meeting.huaweicloud.com:36443/#/j/964248867
会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings
更多资讯尽在：https://www.openeuler.org/zh/
Hello!
Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-04-17 14:00
The subject of the conference is openEuler Kernel SIG双周例会
The sponsor of the conference is LiaoTao_Wave
Summary:
1. 进展update
2. 议题征集中，新增议题可直接填报至会议纪要看板。
You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/964248867
Add topics at https://etherpad.openeuler.org/p/Kernel-meetings
More information: https://www.openeuler.org/en/
1
0
[PATCH v2 OLK-6.6 0/5] arm64/ras: Firmware-first SEI error handling with ESB synchronization
by Wupeng Ma 15 Apr '26
by Wupeng Ma 15 Apr '26
15 Apr '26
This series introduces firmware-first RAS (Reliability, Availability, and
Serviceability) error handling for ARM64 SEI (Synchronous External Interrupt)
errors, with support for ESB (Error Synchronization Barrier) synchronization.
The implementation includes:
- Boot parameter to enable/disable ESB synchronization for SEI
- Entry code patching to use ESB instruction for SEI handling
- Vendor-specific SEI error handling via APEI/GHES
- Sysctl interface for runtime control of vendor SEI handling
Change log since v1:
- Fix memory leaks in err_pool_alloc and err_pa=0 paths in hisi_sei_kill_task
Liao Chang (1):
arm64/entry: Add support to synchronize SEI at the exception boundary
Wupeng Ma (3):
ACPI/APEI/arm64: add vendor SEI handling for firmware-first RAS
ACPI: APEI: add runtime switch for HiSilicon vendor SEI handling
arm64: openeuler_defconfig: enable CONFIG_ARM64_SYNC_SEI by default
Zheng Chuan (1):
arm64: Add boot parameter to control ESB for SEI synchronization
.../admin-guide/kernel-parameters.txt | 8 +
Documentation/admin-guide/sysctl/kernel.rst | 27 +++
arch/arm64/Kconfig | 14 ++
arch/arm64/configs/openeuler_defconfig | 1 +
arch/arm64/include/asm/acpi.h | 2 +
arch/arm64/include/asm/setup.h | 9 +
arch/arm64/kernel/Makefile | 1 +
arch/arm64/kernel/arm64_sync_sei.c | 45 +++++
arch/arm64/kernel/entry.S | 44 +++++
arch/arm64/kernel/traps.c | 15 ++
arch/arm64/kernel/xcall/entry.S | 2 +
drivers/acpi/apei/apei-internal.h | 2 +
drivers/acpi/apei/ghes-vendor-info.c | 187 +++++++++++++++++-
drivers/acpi/apei/ghes.c | 5 +
14 files changed, 361 insertions(+), 1 deletion(-)
create mode 100644 arch/arm64/kernel/arm64_sync_sei.c
--
2.43.0
2
6
Luo Gengkun (1):
perf: Fix Wdeclaration-after-statement
Peter Zijlstra (1):
perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
kernel/events/core.c | 57 ++++++++++++++++++++++++++++++++++++++++----
1 file changed, 52 insertions(+), 5 deletions(-)
--
2.34.1
2
3
14 Apr '26
From: Jeff Layton <jlayton(a)kernel.org>
mainline inclusion
from mainline-v7.0-rc5
commit 5133b61aaf437e5f25b1b396b14242a6bb0508e2
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14128
CVE: CVE-2026-31402
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
The NFSv4.0 replay cache uses a fixed 112-byte inline buffer
(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.
This size was calculated based on OPEN responses and does not account
for LOCK denied responses, which include the conflicting lock owner as
a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).
When a LOCK operation is denied due to a conflict with an existing lock
that has a large owner, nfsd4_encode_operation() copies the full encoded
response into the undersized replay buffer via read_bytes_from_xdr_buf()
with no bounds check. This results in a slab-out-of-bounds write of up
to 944 bytes past the end of the buffer, corrupting adjacent heap memory.
This can be triggered remotely by an unauthenticated attacker with two
cooperating NFSv4.0 clients: one sets a lock with a large owner string,
then the other requests a conflicting lock to provoke the denial.
We could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full
opaque, but that would increase the size of every stateowner, when most
lockowners are not that large.
Instead, fix this by checking the encoded response length against
NFSD4_REPLAY_ISIZE before copying into the replay buffer. If the
response is too large, set rp_buflen to 0 to skip caching the replay
payload. The status is still cached, and the client already received the
correct response on the original request.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable(a)kernel.org
Reported-by: Nicholas Carlini <npc(a)anthropic.com>
Tested-by: Nicholas Carlini <npc(a)anthropic.com>
Signed-off-by: Jeff Layton <jlayton(a)kernel.org>
Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com>
Conflicts:
fs/nfsd/nfs4xdr.c
[Commit 438f81e0e92a ("nfsd: move error choice for incorrect object types
to version-specific code.") add mapping for status.]
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
fs/nfsd/nfs4xdr.c | 9 +++++++--
fs/nfsd/state.h | 17 ++++++++++++-----
2 files changed, 19 insertions(+), 7 deletions(-)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 821c0ad5baa0..b8976c2f17fe 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -5233,9 +5233,14 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op)
int len = xdr->buf->len - post_err_offset;
so->so_replay.rp_status = op->status;
- so->so_replay.rp_buflen = len;
- read_bytes_from_xdr_buf(xdr->buf, post_err_offset,
+ if (len <= NFSD4_REPLAY_ISIZE) {
+ so->so_replay.rp_buflen = len;
+ read_bytes_from_xdr_buf(xdr->buf,
+ post_err_offset,
so->so_replay.rp_buf, len);
+ } else {
+ so->so_replay.rp_buflen = 0;
+ }
}
status:
/* Note that op->status is already in network byte order: */
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index 0e4f98b41364..f398effabeef 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -395,11 +395,18 @@ struct nfs4_client_reclaim {
struct xdr_netobj cr_princhash;
};
-/* A reasonable value for REPLAY_ISIZE was estimated as follows:
- * The OPEN response, typically the largest, requires
- * 4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) + 8(verifier) +
- * 4(deleg. type) + 8(deleg. stateid) + 4(deleg. recall flag) +
- * 20(deleg. space limit) + ~32(deleg. ace) = 112 bytes
+/*
+ * REPLAY_ISIZE is sized for an OPEN response with delegation:
+ * 4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) +
+ * 8(verifier) + 4(deleg. type) + 8(deleg. stateid) +
+ * 4(deleg. recall flag) + 20(deleg. space limit) +
+ * ~32(deleg. ace) = 112 bytes
+ *
+ * Some responses can exceed this. A LOCK denial includes the conflicting
+ * lock owner, which can be up to 1024 bytes (NFS4_OPAQUE_LIMIT). Responses
+ * larger than REPLAY_ISIZE are not cached in rp_ibuf; only rp_status is
+ * saved. Enlarging this constant increases the size of every
+ * nfs4_stateowner.
*/
#define NFSD4_REPLAY_ISIZE 112
--
2.52.0
2
1
Luo Gengkun (1):
perf: Fix Wdeclaration-after-statement
Peter Zijlstra (1):
perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
kernel/events/core.c | 57 ++++++++++++++++++++++++++++++++++++++++----
1 file changed, 52 insertions(+), 5 deletions(-)
--
2.34.1
2
3
[PATCH OLK-6.6 0/5] arm64/ras: Firmware-first SEI error handling with ESB synchronization
by Wupeng Ma 14 Apr '26
by Wupeng Ma 14 Apr '26
14 Apr '26
This series introduces firmware-first RAS (Reliability, Availability, and
Serviceability) error handling for ARM64 SEI (Synchronous External Interrupt)
errors, with support for ESB (Error Synchronization Barrier) synchronization.
The implementation includes:
- Boot parameter to enable/disable ESB synchronization for SEI
- Entry code patching to use ESB instruction for SEI handling
- Vendor-specific SEI error handling via APEI/GHES
- Sysctl interface for runtime control of vendor SEI handling
Liao Chang (1):
arm64/entry: Add support to synchronize SEI at the exception boundary
Wupeng Ma (3):
ACPI/APEI/arm64: add vendor SEI handling for firmware-first RAS
ACPI: APEI: add runtime switch for HiSilicon vendor SEI handling
arm64: openeuler_defconfig: enable CONFIG_ARM64_SYNC_SEI by default
Zheng Chuan (1):
arm64: Add boot parameter to control ESB for SEI synchronization
.../admin-guide/kernel-parameters.txt | 8 +
Documentation/admin-guide/sysctl/kernel.rst | 27 +++
arch/arm64/Kconfig | 14 ++
arch/arm64/configs/openeuler_defconfig | 1 +
arch/arm64/include/asm/acpi.h | 2 +
arch/arm64/include/asm/setup.h | 9 +
arch/arm64/kernel/Makefile | 1 +
arch/arm64/kernel/arm64_sync_sei.c | 45 +++++
arch/arm64/kernel/entry.S | 44 +++++
arch/arm64/kernel/traps.c | 15 ++
arch/arm64/kernel/xcall/entry.S | 2 +
drivers/acpi/apei/apei-internal.h | 2 +
drivers/acpi/apei/ghes-vendor-info.c | 186 +++++++++++++++++-
drivers/acpi/apei/ghes.c | 5 +
14 files changed, 360 insertions(+), 1 deletion(-)
create mode 100644 arch/arm64/kernel/arm64_sync_sei.c
--
2.43.0
2
6
Introduce xSched dmem
Alexander Pavlenko (2):
xSched/dmem: introduce xsched_dmem_alloc()
xSched/dmem: introduce xsched_dmem_free()
Liu Kai (2):
xSched/dmem: add support for XPU devices to register/unregister dmem
regions
xSched/dmem: introduce xsched_dmem_cleanup()
include/linux/cgroup_dmem.h | 2 -
include/linux/xsched.h | 14 ++
include/uapi/linux/xsched/xcu_vstream.h | 9 +
kernel/xsched/Makefile | 1 +
kernel/xsched/core.c | 3 +
kernel/xsched/dmem.c | 226 ++++++++++++++++++++++++
kernel/xsched/vstream.c | 99 +++++++++++
7 files changed, 352 insertions(+), 2 deletions(-)
create mode 100644 kernel/xsched/dmem.c
--
2.34.1
2
5
[PATCH OLK-6.6] fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error
by Zizhi Wo 14 Apr '26
by Zizhi Wo 14 Apr '26
14 Apr '26
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/8926
--------------------------------
[BUG]
Recently, our internal syzkaller testing uncovered a null pointer
dereference issue:
BUG: kernel NULL pointer dereference, address: 0000000000000000
...
[ 51.111664] filemap_read_folio+0x25/0xe0
[ 51.112410] filemap_fault+0xad7/0x1250
[ 51.113112] __do_fault+0x4b/0x460
[ 51.113699] do_pte_missing+0x5bc/0x1db0
[ 51.114250] ? __pte_offset_map+0x23/0x170
[ 51.114822] __handle_mm_fault+0x9f8/0x1680
[ 51.115408] handle_mm_fault+0x24c/0x570
[ 51.115958] do_user_addr_fault+0x226/0xa50
...
Crash analysis showed the file involved was an AIO ring file.
[CAUSE]
PARENT process CHILD process
t=0 io_setup(1, &ctx)
[access ctx addr]
fork()
io_destroy
vm_munmap // not affect child vma
percpu_ref_put
...
put_aio_ring_file
t=1 [access ctx addr] // pagefault
...
__do_fault
filemap_fault
max_idx = DIV_ROUND_UP
t=2 truncate_setsize
truncate_pagecache
t=3 filemap_get_folio // no folio
__filemap_get_folio(FGP_CREAT, ...)
filemap_read_folio(xxx->read_folio)
At t=0, the parent process calls io_setup and then fork. The child process
gets its own VMA but without any PTEs. The parent then calls io_destroy.
Before i_size is truncated to 0, at t=1 the child process accesses this AIO
ctx address and triggers a pagefault. After the max_idx check passes, at
t=2 the parent calls truncate_setsize and truncate_pagecache. At t=3 the
child fails to obtain the folio, falls into the "page_not_uptodate" path,
and hits this problem because AIO does not implement "read_folio".
[Fix]
Fix this by marking the AIO ring buffer VMA with VM_DONTCOPY so
that fork()'s dup_mmap() skips it entirely. This is the correct
semantic because:
1) The child's ioctx_table is already reset to NULL by mm_init_aio() during
fork(), so the child has no AIO context and no way to perform any AIO
operations on this mapping.
2) The AIO ring VMA is only meaningful in conjunction with its associated
kioctx, which is never inherited across fork(). So child process with no
AIO context has no legitimate reason to access the ring buffer. Delivering
SIGSEGV on such an erroneous access is preferable to a kernel crash.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com>
---
fs/aio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/aio.c b/fs/aio.c
index c3614193d749..8b27c02db8a6 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -392,11 +392,11 @@ static const struct vm_operations_struct aio_ring_vm_ops = {
#endif
};
static int aio_ring_mmap(struct file *file, struct vm_area_struct *vma)
{
- vm_flags_set(vma, VM_DONTEXPAND);
+ vm_flags_set(vma, VM_DONTEXPAND | VM_DONTCOPY);
vma->vm_ops = &aio_ring_vm_ops;
return 0;
}
static const struct file_operations aio_ring_fops = {
--
2.39.2
2
1
[PATCH OLK-5.10] fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error
by Zizhi Wo 14 Apr '26
by Zizhi Wo 14 Apr '26
14 Apr '26
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/8927
--------------------------------
[BUG]
Recently, our internal syzkaller testing uncovered a null pointer
dereference issue:
BUG: kernel NULL pointer dereference, address: 0000000000000000
...
[ 51.111664] filemap_read_folio+0x25/0xe0
[ 51.112410] filemap_fault+0xad7/0x1250
[ 51.113112] __do_fault+0x4b/0x460
[ 51.113699] do_pte_missing+0x5bc/0x1db0
[ 51.114250] ? __pte_offset_map+0x23/0x170
[ 51.114822] __handle_mm_fault+0x9f8/0x1680
[ 51.115408] handle_mm_fault+0x24c/0x570
[ 51.115958] do_user_addr_fault+0x226/0xa50
...
Crash analysis showed the file involved was an AIO ring file.
[CAUSE]
PARENT process CHILD process
t=0 io_setup(1, &ctx)
[access ctx addr]
fork()
io_destroy
vm_munmap // not affect child vma
percpu_ref_put
...
put_aio_ring_file
t=1 [access ctx addr] // pagefault
...
__do_fault
filemap_fault
max_idx = DIV_ROUND_UP
t=2 truncate_setsize
truncate_pagecache
t=3 filemap_get_folio // no folio
__filemap_get_folio(FGP_CREAT, ...)
filemap_read_folio(xxx->read_folio)
At t=0, the parent process calls io_setup and then fork. The child process
gets its own VMA but without any PTEs. The parent then calls io_destroy.
Before i_size is truncated to 0, at t=1 the child process accesses this AIO
ctx address and triggers a pagefault. After the max_idx check passes, at
t=2 the parent calls truncate_setsize and truncate_pagecache. At t=3 the
child fails to obtain the folio, falls into the "page_not_uptodate" path,
and hits this problem because AIO does not implement "read_folio".
[Fix]
Fix this by marking the AIO ring buffer VMA with VM_DONTCOPY so
that fork()'s dup_mmap() skips it entirely. This is the correct
semantic because:
1) The child's ioctx_table is already reset to NULL by mm_init_aio() during
fork(), so the child has no AIO context and no way to perform any AIO
operations on this mapping.
2) The AIO ring VMA is only meaningful in conjunction with its associated
kioctx, which is never inherited across fork(). So child process with no
AIO context has no legitimate reason to access the ring buffer. Delivering
SIGSEGV on such an erroneous access is preferable to a kernel crash.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com>
---
fs/aio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/aio.c b/fs/aio.c
index 78aaeaf35436..4ab74699cd3d 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -366,11 +366,11 @@ static const struct vm_operations_struct aio_ring_vm_ops = {
#endif
};
static int aio_ring_mmap(struct file *file, struct vm_area_struct *vma)
{
- vma->vm_flags |= VM_DONTEXPAND;
+ vma->vm_flags |= VM_DONTEXPAND | VM_DONTCOPY;
vma->vm_ops = &aio_ring_vm_ops;
return 0;
}
static const struct file_operations aio_ring_fops = {
--
2.39.2
2
1
Luo Gengkun (1):
perf: Fix Wdeclaration-after-statement
Peter Zijlstra (1):
perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
kernel/events/core.c | 57 ++++++++++++++++++++++++++++++++++++++++----
1 file changed, 52 insertions(+), 5 deletions(-)
--
2.34.1
2
3
[PATCH OLK-6.6] Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
by Xia Fukun 14 Apr '26
by Xia Fukun 14 Apr '26
14 Apr '26
From: Shaurya Rane <ssrane_b23(a)ee.vjti.ac.in>
stable inclusion
from stable-v6.6.130
commit 11a87dd5df428a4b79a84d2790cac7f3c73f1f0d
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14101
CVE: CVE-2026-23461
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 752a6c9596dd25efd6978a73ff21f3b592668f4a ]
After commit ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in
hci_chan_del"), l2cap_conn_del() uses conn->lock to protect access to
conn->users. However, l2cap_register_user() and l2cap_unregister_user()
don't use conn->lock, creating a race condition where these functions can
access conn->users and conn->hchan concurrently with l2cap_conn_del().
This can lead to use-after-free and list corruption bugs, as reported
by syzbot.
Fix this by changing l2cap_register_user() and l2cap_unregister_user()
to use conn->lock instead of hci_dev_lock(), ensuring consistent locking
for the l2cap_conn structure.
Reported-by: syzbot+14b6d57fb728e27ce23c(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=14b6d57fb728e27ce23c
Fixes: ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del")
Signed-off-by: Shaurya Rane <ssrane_b23(a)ee.vjti.ac.in>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Xia Fukun <xiafukun(a)huawei.com>
---
net/bluetooth/l2cap_core.c | 20 ++++++++------------
1 file changed, 8 insertions(+), 12 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 76c52d18b9b2..09ef1ccc6960 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1686,17 +1686,15 @@ static void l2cap_info_timeout(struct work_struct *work)
int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
{
- struct hci_dev *hdev = conn->hcon->hdev;
int ret;
/* We need to check whether l2cap_conn is registered. If it is not, we
- * must not register the l2cap_user. l2cap_conn_del() is unregisters
- * l2cap_conn objects, but doesn't provide its own locking. Instead, it
- * relies on the parent hci_conn object to be locked. This itself relies
- * on the hci_dev object to be locked. So we must lock the hci device
- * here, too. */
+ * must not register the l2cap_user. l2cap_conn_del() unregisters
+ * l2cap_conn objects under conn->lock, and we use the same lock here
+ * to protect access to conn->users and conn->hchan.
+ */
- hci_dev_lock(hdev);
+ mutex_lock(&conn->lock);
if (!list_empty(&user->list)) {
ret = -EINVAL;
@@ -1717,16 +1715,14 @@ int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
ret = 0;
out_unlock:
- hci_dev_unlock(hdev);
+ mutex_unlock(&conn->lock);
return ret;
}
EXPORT_SYMBOL(l2cap_register_user);
void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
{
- struct hci_dev *hdev = conn->hcon->hdev;
-
- hci_dev_lock(hdev);
+ mutex_lock(&conn->lock);
if (list_empty(&user->list))
goto out_unlock;
@@ -1735,7 +1731,7 @@ void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
user->remove(conn, user);
out_unlock:
- hci_dev_unlock(hdev);
+ mutex_unlock(&conn->lock);
}
EXPORT_SYMBOL(l2cap_unregister_user);
--
2.34.1
2
1
xSched dmem
Liu Kai (2):
xSched/cgroup: prevent to init xse when xcu cgroup is disabled
xSched: remove redundant lookup in alloc_ctx_from_vstream to enforce
allocation semantics
include/linux/xsched.h | 2 ++
kernel/xsched/cgroup.c | 2 +-
kernel/xsched/core.c | 3 +++
kernel/xsched/vstream.c | 4 ----
4 files changed, 6 insertions(+), 5 deletions(-)
--
2.34.1
2
3
14 Apr '26
From: Jeff Layton <jlayton(a)kernel.org>
stable inclusion
from stable-v6.6.130
commit 8afb437ea1f70cacb4bbdf11771fb5c4d720b965
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14128
CVE: CVE-2026-31402
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 5133b61aaf437e5f25b1b396b14242a6bb0508e2 ]
The NFSv4.0 replay cache uses a fixed 112-byte inline buffer
(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.
This size was calculated based on OPEN responses and does not account
for LOCK denied responses, which include the conflicting lock owner as
a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).
When a LOCK operation is denied due to a conflict with an existing lock
that has a large owner, nfsd4_encode_operation() copies the full encoded
response into the undersized replay buffer via read_bytes_from_xdr_buf()
with no bounds check. This results in a slab-out-of-bounds write of up
to 944 bytes past the end of the buffer, corrupting adjacent heap memory.
This can be triggered remotely by an unauthenticated attacker with two
cooperating NFSv4.0 clients: one sets a lock with a large owner string,
then the other requests a conflicting lock to provoke the denial.
We could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full
opaque, but that would increase the size of every stateowner, when most
lockowners are not that large.
Instead, fix this by checking the encoded response length against
NFSD4_REPLAY_ISIZE before copying into the replay buffer. If the
response is too large, set rp_buflen to 0 to skip caching the replay
payload. The status is still cached, and the client already received the
correct response on the original request.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable(a)kernel.org
Reported-by: Nicholas Carlini <npc(a)anthropic.com>
Tested-by: Nicholas Carlini <npc(a)anthropic.com>
Signed-off-by: Jeff Layton <jlayton(a)kernel.org>
Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com>
[ replaced `op_status_offset + XDR_UNIT` with existing `post_err_offset` variable ]
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
fs/nfsd/nfs4xdr.c | 9 +++++++--
fs/nfsd/state.h | 17 ++++++++++++-----
2 files changed, 19 insertions(+), 7 deletions(-)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 3eff780fd8da..3c9d19321df5 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -5420,9 +5420,14 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op)
int len = xdr->buf->len - post_err_offset;
so->so_replay.rp_status = op->status;
- so->so_replay.rp_buflen = len;
- read_bytes_from_xdr_buf(xdr->buf, post_err_offset,
+ if (len <= NFSD4_REPLAY_ISIZE) {
+ so->so_replay.rp_buflen = len;
+ read_bytes_from_xdr_buf(xdr->buf,
+ post_err_offset,
so->so_replay.rp_buf, len);
+ } else {
+ so->so_replay.rp_buflen = 0;
+ }
}
status:
*p = op->status;
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index 5da7785609b0..d1450fe7e2b9 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -430,11 +430,18 @@ struct nfs4_client_reclaim {
struct xdr_netobj cr_princhash;
};
-/* A reasonable value for REPLAY_ISIZE was estimated as follows:
- * The OPEN response, typically the largest, requires
- * 4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) + 8(verifier) +
- * 4(deleg. type) + 8(deleg. stateid) + 4(deleg. recall flag) +
- * 20(deleg. space limit) + ~32(deleg. ace) = 112 bytes
+/*
+ * REPLAY_ISIZE is sized for an OPEN response with delegation:
+ * 4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) +
+ * 8(verifier) + 4(deleg. type) + 8(deleg. stateid) +
+ * 4(deleg. recall flag) + 20(deleg. space limit) +
+ * ~32(deleg. ace) = 112 bytes
+ *
+ * Some responses can exceed this. A LOCK denial includes the conflicting
+ * lock owner, which can be up to 1024 bytes (NFS4_OPAQUE_LIMIT). Responses
+ * larger than REPLAY_ISIZE are not cached in rp_ibuf; only rp_status is
+ * saved. Enlarging this constant increases the size of every
+ * nfs4_stateowner.
*/
#define NFSD4_REPLAY_ISIZE 112
--
2.52.0
2
1
[PATCH OLK-6.6] NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
by Li Lingfeng 13 Apr '26
by Li Lingfeng 13 Apr '26
13 Apr '26
From: Chuck Lever <chuck.lever(a)oracle.com>
stable inclusion
from stable-v6.6.130
commit d1a19217995df9c7e4118f5a2820c5032fef2945
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14129
CVE: CVE-2026-31403
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit e7fcf179b82d3a3730fd8615da01b087cc654d0b upstream.
The /proc/fs/nfs/exports proc entry is created at module init
and persists for the module's lifetime. exports_proc_open()
captures the caller's current network namespace and stores
its svc_export_cache in seq->private, but takes no reference
on the namespace. If the namespace is subsequently torn down
(e.g. container destruction after the opener does setns() to a
different namespace), nfsd_net_exit() calls nfsd_export_shutdown()
which frees the cache. Subsequent reads on the still-open fd
dereference the freed cache_detail, walking a freed hash table.
Hold a reference on the struct net for the lifetime of the open
file descriptor. This prevents nfsd_net_exit() from running --
and thus prevents nfsd_export_shutdown() from freeing the cache
-- while any exports fd is open. cache_detail already stores
its net pointer (cd->net, set by cache_create_net()), so
exports_release() can retrieve it without additional per-file
storage.
Reported-by: Misbah Anjum N <misanjum(a)linux.ibm.com>
Closes: https://lore.kernel.org/linux-nfs/dcd371d3a95815a84ba7de52cef447b8@linux.ib…
Fixes: 96d851c4d28d ("nfsd: use proper net while reading "exports" file")
Cc: stable(a)vger.kernel.org
Reviewed-by: Jeff Layton <jlayton(a)kernel.org>
Reviewed-by: NeilBrown <neil(a)brown.name>
Tested-by: Olga Kornievskaia <okorniev(a)redhat.com>
Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
fs/nfsd/nfsctl.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index b821c50b062f..f80cbd734988 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -151,9 +151,19 @@ static int exports_net_open(struct net *net, struct file *file)
seq = file->private_data;
seq->private = nn->svc_export_cache;
+ get_net(net);
return 0;
}
+static int exports_release(struct inode *inode, struct file *file)
+{
+ struct seq_file *seq = file->private_data;
+ struct cache_detail *cd = seq->private;
+
+ put_net(cd->net);
+ return seq_release(inode, file);
+}
+
static int exports_nfsd_open(struct inode *inode, struct file *file)
{
return exports_net_open(inode->i_sb->s_fs_info, file);
@@ -163,7 +173,7 @@ static const struct file_operations exports_nfsd_operations = {
.open = exports_nfsd_open,
.read = seq_read,
.llseek = seq_lseek,
- .release = seq_release,
+ .release = exports_release,
};
static int export_features_show(struct seq_file *m, void *v)
@@ -1476,7 +1486,7 @@ static const struct proc_ops exports_proc_ops = {
.proc_open = exports_proc_open,
.proc_read = seq_read,
.proc_lseek = seq_lseek,
- .proc_release = seq_release,
+ .proc_release = exports_release,
};
static int create_proc_exports_entry(void)
--
2.52.0
2
1
[PATCH OLK-5.10] perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
by Luo Gengkun 13 Apr '26
by Luo Gengkun 13 Apr '26
13 Apr '26
From: Peter Zijlstra <peterz(a)infradead.org>
mainline inclusion
from mainline-v7.0-rc2
commit c9bc1753b3cc41d0e01fbca7f035258b5f4db0ae
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13907
CVE: CVE-2026-23271
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
----------------------------------------------------------------------
Make sure that __perf_event_overflow() runs with IRQs disabled for all
possible callchains. Specifically the software events can end up running
it with only preemption disabled.
This opens up a race vs perf_event_exit_event() and friends that will go
and free various things the overflow path expects to be present, like
the BPF program.
Fixes: 592903cdcbf6 ("perf_counter: add an event_list")
Reported-by: Simond Hu <cmdhh1767(a)gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Tested-by: Simond Hu <cmdhh1767(a)gmail.com>
Link: https://patch.msgid.link/20260224122909.GV1395416@noisy.programming.kicks-a…
Conflicts:
kernel/events/core.c
[Fix ctx conflicts and guard conflict.]
Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com>
---
kernel/events/core.c | 56 ++++++++++++++++++++++++++++++++++++++++----
1 file changed, 52 insertions(+), 4 deletions(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index d1ffd5fb9c6f..a0ac222caca0 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -8972,6 +8972,13 @@ int perf_event_overflow(struct perf_event *event,
struct perf_sample_data *data,
struct pt_regs *regs)
{
+ /*
+ * Entry point from hardware PMI, interrupts should be disabled here.
+ * This serializes us against perf_event_remove_from_context() in
+ * things like perf_event_release_kernel().
+ */
+ lockdep_assert_irqs_disabled();
+
return __perf_event_overflow(event, 1, data, regs);
}
@@ -9051,7 +9058,21 @@ static void perf_swevent_event(struct perf_event *event, u64 nr,
struct pt_regs *regs)
{
struct hw_perf_event *hwc = &event->hw;
+ unsigned long flags;
+ /*
+ * This is:
+ * - software preempt
+ * - tracepoint preempt
+ * - tp_target_task irq (ctx->lock)
+ * - uprobes preempt/irq
+ * - kprobes preempt/irq
+ * - hw_breakpoint irq
+ *
+ * Any of these are sufficient to hold off RCU and thus ensure @event
+ * exists.
+ */
+ lockdep_assert_preemption_disabled();
local64_add(nr, &event->count);
if (!regs)
@@ -9060,19 +9081,36 @@ static void perf_swevent_event(struct perf_event *event, u64 nr,
if (!is_sampling_event(event))
return;
+ /*
+ * Serialize against event_function_call() IPIs like normal overflow
+ * event handling. Specifically, must not allow
+ * perf_event_release_kernel() -> perf_remove_from_context() to make
+ * progress and 'release' the event from under us.
+ */
+ local_irq_save(flags);
+ if (event->state != PERF_EVENT_STATE_ACTIVE) {
+ local_irq_restore(flags);
+ return;
+ }
+
if ((event->attr.sample_type & PERF_SAMPLE_PERIOD) && !event->attr.freq) {
data->period = nr;
+ local_irq_restore(flags);
return perf_swevent_overflow(event, 1, data, regs);
} else
data->period = event->hw.last_period;
- if (nr == 1 && hwc->sample_period == 1 && !event->attr.freq)
+ if (nr == 1 && hwc->sample_period == 1 && !event->attr.freq) {
+ local_irq_restore(flags);
return perf_swevent_overflow(event, 1, data, regs);
+ }
- if (local64_add_negative(nr, &hwc->period_left))
+ if (local64_add_negative(nr, &hwc->period_left)) {
+ local_irq_restore(flags);
return;
-
+ }
perf_swevent_overflow(event, 0, data, regs);
+ local_irq_restore(flags);
}
static int perf_exclude_event(struct perf_event *event,
@@ -9476,6 +9514,11 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size,
struct perf_sample_data data;
struct perf_event *event;
+ /*
+ * Per being a tracepoint, this runs with preemption disabled.
+ */
+ lockdep_assert_preemption_disabled();
+
struct perf_raw_record raw = {
.frag = {
.size = entry_size,
@@ -9908,6 +9951,11 @@ void perf_bp_event(struct perf_event *bp, void *data)
struct perf_sample_data sample;
struct pt_regs *regs = data;
+ /*
+ * Exception context, will have interrupts disabled.
+ */
+ lockdep_assert_irqs_disabled();
+
perf_sample_data_init(&sample, bp->attr.bp_addr, 0);
if (!bp->hw.state && !perf_exclude_event(bp, regs))
@@ -10361,7 +10409,7 @@ static enum hrtimer_restart perf_swevent_hrtimer(struct hrtimer *hrtimer)
if (regs && !perf_exclude_event(event, regs)) {
if (!(event->attr.exclude_idle && is_idle_task(current)))
- if (__perf_event_overflow(event, 1, &data, regs))
+ if (perf_event_overflow(event, &data, regs))
ret = HRTIMER_NORESTART;
}
--
2.34.1
2
1
*** BLURB HERE ***
Alan Maguire (16):
kbuild,bpf: Switch to using --btf_features for pahole v1.26 and later
kbuild, bpf: Use test-ge check for v1.25-only pahole
libbpf: Add btf__distill_base() creating split BTF with distilled base
BTF
selftests/bpf: Test distilled base, split BTF generation
libbpf: Split BTF relocation
selftests/bpf: Extend distilled BTF tests to cover BTF relocation
resolve_btfids: Handle presence of .BTF.base section
libbpf: BTF relocation followup fixing naming, loop logic
module, bpf: Store BTF base pointer in struct module
libbpf: Split field iter code into its own file kernel
libbpf,bpf: Share BTF relocate-related code with kernel
kbuild,bpf: Add module-specific pahole flags for distilled base BTF
selftests/bpf: Add kfunc_call test for simple dtor in bpf_testmod
bpf: fix build when CONFIG_DEBUG_INFO_BTF[_MODULES] is undefined
libbpf: Fix error handling in btf__distill_base()
libbpf: Fix license for btf_relocate.c
Alexander Lobakin (1):
bitops: make BYTES_TO_BITS() treewide-available
Alexei Starovoitov (2):
s390/bpf: Fix indirect trampoline generation
bpf: Introduce "volatile compare" macros
Andrii Nakryiko (13):
bpf: Emit global subprog name in verifier logs
bpf: Validate global subprogs lazily
selftests/bpf: Add lazy global subprog validation tests
libbpf: Add btf__new_split() API that was declared but not implemented
bpf: move sleepable flag from bpf_prog_aux to bpf_prog
libbpf: Add BTF field iterator
libbpf: Make use of BTF field iterator in BPF linker code
libbpf: Make use of BTF field iterator in BTF handling code
bpftool: Use BTF field iterator in btfgen
libbpf: Remove callback-based type/string BTF field visitor helpers
bpf: extract iterator argument type and name validation logic
bpf: allow passing struct bpf_iter_<type> as kfunc arguments
selftests/bpf: test passing iterator to a kfunc
Benjamin Tissoires (1):
bpf: introduce in_sleepable() helper
Christophe Leroy (2):
bpf: Remove arch_unprotect_bpf_trampoline()
bpf: Check return from set_memory_rox()
Chuyi Zhou (13):
cgroup: Prepare for using css_task_iter_*() in BPF
bpf: Introduce css_task open-coded iterator kfuncs
bpf: Introduce task open coded iterator kfuncs
bpf: Introduce css open-coded iterator kfuncs
bpf: teach the verifier to enforce css_iter and task_iter in RCU CS
bpf: Let bpf_iter_task_new accept null task ptr
selftests/bpf: rename bpf_iter_task.c to bpf_iter_tasks.c
selftests/bpf: Add tests for open-coded task and css iter
bpf: Relax allowlist for css_task iter
selftests/bpf: Add tests for css_task iter combining with cgroup iter
selftests/bpf: Add test for using css_task iter in sleepable progs
bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg
selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly
Daniel Xu (3):
bpf: btf: Support flags for BTF_SET8 sets
bpf: btf: Add BTF_KFUNCS_START/END macro pair
bpf: treewide: Annotate BPF kfuncs in BTF
Dave Marchevsky (6):
bpf: Don't explicitly emit BTF for struct btf_iter_num
selftests/bpf: Rename bpf_iter_task_vma.c to bpf_iter_task_vmas.c
bpf: Introduce task_vma open-coded iterator kfuncs
selftests/bpf: Add tests for open-coded task_vma iter
bpf: Add __bpf_kfunc_{start,end}_defs macros
bpf: Add __bpf_hook_{start,end} macros
David Vernet (2):
bpf: Add ability to pin bpf timer to calling CPU
selftests/bpf: Test pinning bpf timer to a core
Eduard Zingerman (2):
libbpf: Make btf_parse_elf process .BTF.base transparently
selftests/bpf: Check if distilled base inherits source endianness
Geliang Tang (1):
bpf, btf: Check btf for register_bpf_struct_ops
Hou Tao (6):
bpf: Free dynamically allocated bits in bpf_iter_bits_destroy()
bpf: Add bpf_mem_alloc_check_size() helper
bpf: Check the validity of nr_words in bpf_iter_bits_new()
bpf: Use __u64 to save the bits in bits iterator
selftests/bpf: Add three test cases for bits_iter
selftests/bpf: Use -4095 as the bad address for bits iterator
Kui-Feng Lee (29):
bpf: refactory struct_ops type initialization to a function.
bpf: get type information with BTF_ID_LIST
bpf, net: introduce bpf_struct_ops_desc.
bpf: add struct_ops_tab to btf.
bpf: make struct_ops_map support btfs other than btf_vmlinux.
bpf: pass btf object id in bpf_map_info.
bpf: lookup struct_ops types from a given module BTF.
bpf: pass attached BTF to the bpf_struct_ops subsystem
bpf: hold module refcnt in bpf_struct_ops map creation and prog
verification.
bpf: validate value_type
bpf, net: switch to dynamic registration
libbpf: Find correct module BTFs for struct_ops maps and progs.
bpf: export btf_ctx_access to modules.
selftests/bpf: test case for register_bpf_struct_ops().
bpf: Fix error checks against bpf_get_btf_vmlinux().
bpf: Remove an unnecessary check.
selftests/bpf: Suppress warning message of an unused variable.
bpf: add btf pointer to struct bpf_ctx_arg_aux.
bpf: Move __kfunc_param_match_suffix() to btf.c.
bpf: Create argument information for nullable arguments.
selftests/bpf: Test PTR_MAYBE_NULL arguments of struct_ops operators.
libbpf: Set btf_value_type_id of struct bpf_map for struct_ops.
libbpf: Convert st_ops->data to shadow type.
bpftool: Generated shadow variables for struct_ops maps.
bpftool: Add an example for struct_ops map and shadow type.
selftests/bpf: Test if shadow types work correctly.
bpf, net: validate struct_ops when updating value.
bpf: struct_ops supports more than one page for trampolines.
selftests/bpf: Test struct_ops maps with a large number of struct_ops
program.
Kumar Kartikeya Dwivedi (4):
bpf: Allow calling static subprogs while holding a bpf_spin_lock
selftests/bpf: Add test for static subprog call in lock cs
bpf: Transfer RCU lock state between subprog calls
selftests/bpf: Add tests for RCU lock transfer between subprogs
Luo Gengkun (7):
bpf: Fix kabi-breakage for bpf_func_info_aux
bpf: Fix kabi-breakage for bpf_tramp_image
bpf: Fix kabi for bpf_attr
bpf_verifier: Fix kabi for bpf_verifier_env
bpf: Fix kabi for bpf_ctx_arg_aux
bpf: Fix kabi for bpf_prog_aux and bpf_prog
selftests/bpf: modify test_loader that didn't support running
bpf_prog_type_syscall programs
Martin KaFai Lau (4):
libbpf: Ensure undefined bpf_attr field stays 0
bpf: Remove unnecessary err < 0 check in
bpf_struct_ops_map_update_elem
bpf: Fix a crash when btf_parse_base() returns an error pointer
bpf: Reject struct_ops registration that uses module ptr and the
module btf_id is missing
Masahiro Yamada (1):
kbuild: avoid too many execution of scripts/pahole-flags.sh
Matthieu Baerts (1):
bpf: fix compilation error without CGROUPS
Peter Zijlstra (6):
cfi: Flip headers
x86/cfi,bpf: Fix BPF JIT call
x86/cfi,bpf: Fix bpf_callback_t CFI
x86/cfi,bpf: Fix bpf_struct_ops CFI
cfi: Add CFI_NOSEAL()
bpf: Fix dtor CFI
Pu Lehui (8):
riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops
bpf: Fix kabi breakage in struct module
riscv, bpf: Fix out-of-bounds issue when preparing trampoline image
selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill
test
libbpf: Fix return zero when elf_begin failed
libbpf: Fix incorrect traversal end type ID when marking
BTF_IS_EMBEDDED
selftests/bpf: Add distilled BTF test about marking BTF_IS_EMBEDDED
selftests/bpf: Add file_read_pattern to gitignore
Song Liu (8):
bpf: Charge modmem for struct_ops trampoline
bpf: Let bpf_prog_pack_free handle any pointer
bpf: Adjust argument names of arch_prepare_bpf_trampoline()
bpf: Add helpers for trampoline image management
bpf, x86: Adjust arch_prepare_bpf_trampoline return value
bpf: Add arch_bpf_trampoline_size()
bpf: Use arch_bpf_trampoline_size
x86, bpf: Use bpf_prog_pack for bpf trampoline
T.J. Mercier (1):
bpf, docs: Fix broken link to renamed bpf_iter_task_vmas.c
Tony Ambardar (1):
libbpf: Ensure new BTF objects inherit input endianness
Yafang Shao (2):
bpf: Add bits iterator
selftests/bpf: Add selftest for bits iter
Documentation/bpf/bpf_iterators.rst | 2 +-
Documentation/bpf/kfuncs.rst | 14 +-
MAINTAINERS | 2 +-
Makefile | 4 +-
arch/arm64/kernel/bpf-rvi.c | 4 +-
arch/arm64/net/bpf_jit_comp.c | 55 +-
arch/riscv/include/asm/cfi.h | 3 +-
arch/riscv/kernel/cfi.c | 2 +-
arch/riscv/net/bpf_jit_comp64.c | 48 +-
arch/s390/net/bpf_jit_comp.c | 59 +-
arch/x86/include/asm/cfi.h | 126 ++-
arch/x86/kernel/alternative.c | 87 +-
arch/x86/kernel/cfi.c | 4 +-
arch/x86/net/bpf_jit_comp.c | 261 ++++--
block/blk-cgroup.c | 4 +-
drivers/hid/bpf/hid_bpf_dispatch.c | 12 +-
fs/proc/stat.c | 4 +-
include/asm-generic/Kbuild | 1 +
include/asm-generic/cfi.h | 5 +
include/linux/bitops.h | 2 +
include/linux/bpf.h | 130 ++-
include/linux/bpf_mem_alloc.h | 3 +
include/linux/bpf_verifier.h | 21 +-
include/linux/btf.h | 105 +++
include/linux/btf_ids.h | 21 +-
include/linux/cfi.h | 12 +
include/linux/cgroup.h | 12 +-
include/linux/filter.h | 2 +-
include/linux/module.h | 5 +
include/uapi/linux/bpf.h | 16 +-
kernel/bpf-rvi/common_kfuncs.c | 4 +-
kernel/bpf/Makefile | 8 +-
kernel/bpf/bpf_iter.c | 12 +-
kernel/bpf/bpf_struct_ops.c | 748 ++++++++++++------
kernel/bpf/bpf_struct_ops_types.h | 12 -
kernel/bpf/btf.c | 431 ++++++++--
kernel/bpf/cgroup_iter.c | 65 +-
kernel/bpf/core.c | 76 +-
kernel/bpf/cpumask.c | 18 +-
kernel/bpf/dispatcher.c | 7 +-
kernel/bpf/helpers.c | 202 ++++-
kernel/bpf/map_iter.c | 10 +-
kernel/bpf/memalloc.c | 14 +-
kernel/bpf/syscall.c | 12 +-
kernel/bpf/task_iter.c | 242 +++++-
kernel/bpf/trampoline.c | 99 ++-
kernel/bpf/verifier.c | 317 ++++++--
kernel/cgroup/cgroup.c | 18 +-
kernel/cgroup/cpuset.c | 4 +-
kernel/cgroup/rstat.c | 13 +-
kernel/events/core.c | 2 +-
kernel/module/main.c | 5 +-
kernel/sched/bpf_sched.c | 8 +-
kernel/sched/cpuacct.c | 4 +-
kernel/trace/bpf_trace.c | 12 +-
kernel/trace/trace_probe.c | 2 -
net/bpf/bpf_dummy_struct_ops.c | 72 +-
net/bpf/test_run.c | 30 +-
net/core/filter.c | 33 +-
net/core/xdp.c | 10 +-
net/ipv4/bpf_tcp_ca.c | 93 ++-
net/ipv4/fou_bpf.c | 10 +-
net/ipv4/tcp_bbr.c | 4 +-
net/ipv4/tcp_cong.c | 6 +-
net/ipv4/tcp_cubic.c | 4 +-
net/ipv4/tcp_dctcp.c | 4 +-
net/netfilter/nf_conntrack_bpf.c | 10 +-
net/netfilter/nf_nat_bpf.c | 10 +-
net/socket.c | 8 +-
net/xfrm/xfrm_interface_bpf.c | 10 +-
scripts/Makefile.btf | 33 +
scripts/Makefile.modfinal | 2 +-
scripts/pahole-flags.sh | 30 -
.../bpf/bpftool/Documentation/bpftool-gen.rst | 58 +-
tools/bpf/bpftool/gen.c | 253 +++++-
tools/bpf/resolve_btfids/main.c | 8 +
tools/include/linux/bitops.h | 2 +
tools/include/uapi/linux/bpf.h | 14 +-
tools/lib/bpf/Build | 2 +-
tools/lib/bpf/bpf.c | 4 +-
tools/lib/bpf/bpf.h | 4 +-
tools/lib/bpf/btf.c | 704 ++++++++++++-----
tools/lib/bpf/btf.h | 36 +
tools/lib/bpf/btf_iter.c | 177 +++++
tools/lib/bpf/btf_relocate.c | 519 ++++++++++++
tools/lib/bpf/libbpf.c | 86 +-
tools/lib/bpf/libbpf.map | 4 +-
tools/lib/bpf/libbpf_internal.h | 29 +-
tools/lib/bpf/libbpf_probes.c | 1 +
tools/lib/bpf/linker.c | 58 +-
tools/perf/util/probe-finder.c | 4 +-
tools/testing/selftests/bpf/.gitignore | 1 +
.../testing/selftests/bpf/bpf_experimental.h | 96 +++
.../selftests/bpf/bpf_testmod/bpf_testmod.c | 160 +++-
.../selftests/bpf/bpf_testmod/bpf_testmod.h | 61 ++
.../bpf/bpf_testmod/bpf_testmod_kfunc.h | 9 +
.../selftests/bpf/prog_tests/bpf_iter.c | 44 +-
.../selftests/bpf/prog_tests/btf_distill.c | 692 ++++++++++++++++
.../selftests/bpf/prog_tests/cgroup_iter.c | 33 +
.../testing/selftests/bpf/prog_tests/iters.c | 209 +++++
.../selftests/bpf/prog_tests/kfunc_call.c | 1 +
.../selftests/bpf/prog_tests/rcu_read_lock.c | 6 +
.../selftests/bpf/prog_tests/spin_lock.c | 2 +
.../prog_tests/test_struct_ops_maybe_null.c | 46 ++
.../bpf/prog_tests/test_struct_ops_module.c | 86 ++
.../prog_tests/test_struct_ops_multi_pages.c | 30 +
.../testing/selftests/bpf/prog_tests/timer.c | 4 +
.../selftests/bpf/prog_tests/verifier.c | 4 +
...f_iter_task_vma.c => bpf_iter_task_vmas.c} | 0
.../{bpf_iter_task.c => bpf_iter_tasks.c} | 0
tools/testing/selftests/bpf/progs/iters_css.c | 72 ++
.../selftests/bpf/progs/iters_css_task.c | 102 +++
.../testing/selftests/bpf/progs/iters_task.c | 41 +
.../selftests/bpf/progs/iters_task_failure.c | 105 +++
.../selftests/bpf/progs/iters_task_vma.c | 43 +
.../selftests/bpf/progs/iters_testmod_seq.c | 50 ++
.../selftests/bpf/progs/kfunc_call_test.c | 37 +
.../selftests/bpf/progs/rcu_read_lock.c | 120 +++
.../bpf/progs/struct_ops_maybe_null.c | 29 +
.../bpf/progs/struct_ops_maybe_null_fail.c | 24 +
.../selftests/bpf/progs/struct_ops_module.c | 37 +
.../bpf/progs/struct_ops_multi_pages.c | 102 +++
.../selftests/bpf/progs/test_global_func12.c | 4 +-
.../selftests/bpf/progs/test_spin_lock.c | 65 ++
.../selftests/bpf/progs/test_spin_lock_fail.c | 44 ++
tools/testing/selftests/bpf/progs/timer.c | 63 +-
.../selftests/bpf/progs/verifier_bits_iter.c | 232 ++++++
.../bpf/progs/verifier_global_subprogs.c | 92 +++
.../selftests/bpf/progs/verifier_spin_lock.c | 2 +-
.../bpf/progs/verifier_subprog_precision.c | 4 +-
tools/testing/selftests/bpf/test_loader.c | 10 +-
131 files changed, 7326 insertions(+), 1139 deletions(-)
create mode 100644 include/asm-generic/cfi.h
delete mode 100644 kernel/bpf/bpf_struct_ops_types.h
create mode 100644 scripts/Makefile.btf
delete mode 100755 scripts/pahole-flags.sh
create mode 100644 tools/lib/bpf/btf_iter.c
create mode 100644 tools/lib/bpf/btf_relocate.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_distill.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_maybe_null.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_module.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_pages.c
rename tools/testing/selftests/bpf/progs/{bpf_iter_task_vma.c => bpf_iter_task_vmas.c} (100%)
rename tools/testing/selftests/bpf/progs/{bpf_iter_task.c => bpf_iter_tasks.c} (100%)
create mode 100644 tools/testing/selftests/bpf/progs/iters_css.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_css_task.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task_failure.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task_vma.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null_fail.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_module.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_multi_pages.c
create mode 100644 tools/testing/selftests/bpf/progs/verifier_bits_iter.c
create mode 100644 tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
--
2.34.1
2
141
[PATCH OLK-5.10] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
by Chen Jinghuang 13 Apr '26
by Chen Jinghuang 13 Apr '26
13 Apr '26
From: Jens Axboe <axboe(a)kernel.dk>
mainline inclusion
from mainline-v7.0-rc2
commit bfbc0b5b32a8f28ce284add619bf226716a59bc0
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13873
CVE: CVE-2026-23253
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the
DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which
reinitializes the waitqueue list head to empty.
Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the
same DVR device share it), this orphans any existing waitqueue entries
from io_uring poll or epoll, leaving them with stale prev/next pointers
while the list head is reset to {self, self}.
The waitqueue and spinlock in dvr_buffer are already properly
initialized once in dvb_dmxdev_init(). The open path only needs to
reset the buffer data pointer, size, and read/write positions.
Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct
assignment of data/size and a call to dvb_ringbuffer_reset(), which
properly resets pread, pwrite, and error with correct memory ordering
without touching the waitqueue or spinlock.
Cc: stable(a)vger.kernel.org
Fixes: 34731df288a5f ("V4L/DVB (3501): Dmxdev: use dvb_ringbuffer")
Reported-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com
Tested-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/698a26d3.050a0220.3b3015.007d.GAE@google.com/
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
Conflicts:
drivers/media/dvb-core/dmxdev.c
[context conflict]
Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com>
---
drivers/media/dvb-core/dmxdev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index 12b7f698f562..c32adebd0e16 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -178,7 +178,9 @@ static int dvb_dvr_open(struct inode *inode, struct file *file)
mutex_unlock(&dmxdev->mutex);
return -ENOMEM;
}
- dvb_ringbuffer_init(&dmxdev->dvr_buffer, mem, DVR_BUFFER_SIZE);
+ dmxdev->dvr_buffer.data = mem;
+ dmxdev->dvr_buffer.size = DVR_BUFFER_SIZE;
+ dvb_ringbuffer_reset(&dmxdev->dvr_buffer);
if (dmxdev->may_do_mmap)
dvb_vb2_init(&dmxdev->dvr_vb2_ctx, "dvr",
file->f_flags & O_NONBLOCK);
--
2.34.1
2
1
[PATCH OLK-5.10] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
by Chen Jinghuang 13 Apr '26
by Chen Jinghuang 13 Apr '26
13 Apr '26
From: Jens Axboe <axboe(a)kernel.dk>
mainline inclusion
from mainline-v7.0-rc2
commit bfbc0b5b32a8f28ce284add619bf226716a59bc0
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13873
CVE: CVE-2026-23253
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the
DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which
reinitializes the waitqueue list head to empty.
Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the
same DVR device share it), this orphans any existing waitqueue entries
from io_uring poll or epoll, leaving them with stale prev/next pointers
while the list head is reset to {self, self}.
The waitqueue and spinlock in dvr_buffer are already properly
initialized once in dvb_dmxdev_init(). The open path only needs to
reset the buffer data pointer, size, and read/write positions.
Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct
assignment of data/size and a call to dvb_ringbuffer_reset(), which
properly resets pread, pwrite, and error with correct memory ordering
without touching the waitqueue or spinlock.
Cc: stable(a)vger.kernel.org
Fixes: 34731df288a5f ("V4L/DVB (3501): Dmxdev: use dvb_ringbuffer")
Reported-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com
Tested-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/698a26d3.050a0220.3b3015.007d.GAE@google.com/
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
Conflicts:
drivers/media/dvb-core/dmxdev.c
[context conflict]
Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com>
---
drivers/media/dvb-core/dmxdev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index 12b7f698f562..c32adebd0e16 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -178,7 +178,9 @@ static int dvb_dvr_open(struct inode *inode, struct file *file)
mutex_unlock(&dmxdev->mutex);
return -ENOMEM;
}
- dvb_ringbuffer_init(&dmxdev->dvr_buffer, mem, DVR_BUFFER_SIZE);
+ dmxdev->dvr_buffer.data = mem;
+ dmxdev->dvr_buffer.size = DVR_BUFFER_SIZE;
+ dvb_ringbuffer_reset(&dmxdev->dvr_buffer);
if (dmxdev->may_do_mmap)
dvb_vb2_init(&dmxdev->dvr_vb2_ctx, "dvr",
file->f_flags & O_NONBLOCK);
--
2.34.1
2
1
Aaron Lu (7):
[Backport] sched/fair: Task based throttle time accounting
[Backport] sched/fair: Get rid of throttled_lb_pair()
[Backport] sched/fair: Propagate load for throttled cfs_rq
[Backport] sched/fair: update_cfs_group() for throttled cfs_rqs
[Backport] sched/fair: Do not balance task to a throttled cfs_rq
[Backport] sched/fair: Prevent cfs_rq from being unthrottled with zero
runtime_remaining
[Backport] sched/fair: Do not special case tasks in throttled
hierarchy
K Prateek Nayak (1):
[Backport] sched/fair: Start a cfs_rq on throttled hierarchy with PELT
clock throttled
Valentin Schneider (3):
[Backport] sched/fair: Add related data structure for task based
throttle
[Backport] sched/fair: Implement throttle task work and related
helpers
[Backport] sched/fair: Switch to task based throttle model
Wang Tao (2):
[Huawei] sched: Fix kabi broken of struct task_struct and struct
cfs_rq
[Huawei] sched: Fix kabi broken of struct cfs_rq
Zhang Qiao (2):
[Huawei] sched/fair: Use separate throttle functions for QoS
[Huawei] sched/fair: Use separate qos_throttled and qos_throttle_count
include/linux/sched.h | 8 +
kernel/sched/core.c | 5 +-
kernel/sched/fair.c | 622 ++++++++++++++++++++++++++----------------
kernel/sched/pelt.h | 4 +-
kernel/sched/sched.h | 17 +-
5 files changed, 409 insertions(+), 247 deletions(-)
--
2.18.0
1
15
[PATCH OLK-5.10] apparmor: validate DFA start states are in bounds in unpack_pdb
by Zhao Yipeng 11 Apr '26
by Zhao Yipeng 11 Apr '26
11 Apr '26
From: Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com>
mainline inclusion
from mainline-v7.0-rc4
commit 9063d7e2615f4a7ab321de6b520e23d370e58816
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13880
CVE: CVE-2026-23269
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
Start states are read from untrusted data and used as indexes into the
DFA state tables. The aa_dfa_next() function call in unpack_pdb() will
access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds
the number of states in the DFA, this results in an out-of-bound read.
==================================================================
BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360
Read of size 4 at addr ffff88811956fb90 by task su/1097
...
Reject policies with out-of-bounds start states during unpacking
to prevent the issue.
Fixes: ad5ff3db53c6 ("AppArmor: Add ability to load extended policy")
Reported-by: Qualys Security Advisory <qsa(a)qualys.com>
Tested-by: Salvatore Bonaccorso <carnil(a)debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia(a)canonical.com>
Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com>
Signed-off-by: John Johansen <john.johansen(a)canonical.com>
Conflicts:
security/apparmor/policy_unpack.c
[The conflict is due to the commit ad596ea74e746
("apparmor: group dfa policydb unpacking") and 98b824ff8984f
("apparmor: refcount the pdb") not being merged. The first commit
change profile->policy to *policy and move to a new function:
unpack_pdb. And the second commit change *policy to *pdb. So keep
use profile-policy in this commit.]
Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com>
---
security/apparmor/policy_unpack.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 33fac6489077..bac5cccbf2e9 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -860,6 +860,12 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
if (!unpack_u32(e, &profile->policy.start[0], "start"))
/* default start state */
profile->policy.start[0] = DFA_START;
+
+ if (profile->policy.start[0] >= profile->policy.dfa->tables[YYTD_ID_BASE]->td_lolen) {
+ info = "invalid dfa start state";
+ goto fail;
+ }
+
/* setup class index */
for (i = AA_CLASS_FILE; i <= AA_CLASS_LAST; i++) {
profile->policy.start[i] =
@@ -890,6 +896,12 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
} else
profile->file.dfa = aa_get_dfa(nulldfa);
+ if (profile->file.dfa && profile->file.start >=
+ profile->file.dfa->tables[YYTD_ID_BASE]->td_lolen) {
+ info = "invalid file dfa start state";
+ goto fail;
+ }
+
if (!unpack_trans_table(e, profile)) {
info = "failed to unpack profile transition table";
goto fail;
--
2.34.1
2
1
Chen Yu (1):
sched/eevdf: Fix wakeup-preempt by checking cfs_rq->nr_running
Ingo Molnar (2):
sched/fair: Rename cfs_rq::avg_load to cfs_rq::sum_weight
sched/fair: Rename cfs_rq::avg_vruntime to ::sum_w_vruntime, and
helper functions
Peter Zijlstra (10):
sched/fair: Fix zero_vruntime tracking
sched/fair: Fix EEVDF entity placement bug causing scheduling lag
sched/fair: Adhere to place_entity() constraints
sched: Unify runtime accounting across classes
sched: Remove vruntime from trace_sched_stat_runtime()
sched: Unify more update_curr*()
sched/eevdf: Allow shorter slices to wakeup-preempt
sched/fair: Only set slice protection at pick time
sched/fair: Fix zero_vruntime tracking fix
sched/debug: Fix avg_vruntime() usage
Vincent Guittot (2):
sched/fair: Use protect_slice() instead of direct comparison
sched/fair: Fix NO_RUN_TO_PARITY case
Wang Tao (1):
sched/eevdf: Update se->vprot in reweight_entity()
Xia Fukun (1):
sched: fix kabi broken in struct sched_statistics
Zhang Qiao (1):
sched: Fix struct sched_entity kabi broken
Zicheng Qu (5):
sched: Re-evaluate scheduling when migrating queued tasks out of
throttled cgroups
sched: Fix kabi breakage of struct cfs_rq for sum_weight
sched: Fix kabi breakage of struct cfs_rq for sum_w_vruntime
sched/eevdf: Disable shorter slices to wakeup-preempt
sched/fair: Fix vruntime drift by preventing double lag scaling during
reweight
zihan zhou (1):
sched: Cancel the slice protection of the idle entity
include/linux/sched.h | 15 +-
include/trace/events/sched.h | 15 +-
kernel/sched/core.c | 4 +-
kernel/sched/deadline.c | 15 +-
kernel/sched/debug.c | 4 +-
kernel/sched/fair.c | 477 +++++++++++++++++++----------------
kernel/sched/features.h | 5 +
kernel/sched/rt.c | 15 +-
kernel/sched/sched.h | 18 +-
kernel/sched/stop_task.c | 13 +-
10 files changed, 304 insertions(+), 277 deletions(-)
--
2.34.1
2
25
From: NeilBrown <neil(a)brown.name>
stable inclusion
from stable-v5.10.248
commit ca97360860eb02e3ae4ba42c19b439a0fcecbf06
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13489
CVE: CVE-2026-22980
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 2857bd59feb63fcf40fe4baf55401baea6b4feb4 ]
Writing to v4_end_grace can race with server shutdown and result in
memory being accessed after it was freed - reclaim_str_hashtbl in
particularly.
We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is
held while client_tracking_op->init() is called and that can wait for
an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a
deadlock.
nfsd4_end_grace() is also called by the landromat work queue and this
doesn't require locking as server shutdown will stop the work and wait
for it before freeing anything that nfsd4_end_grace() might access.
However, we must be sure that writing to v4_end_grace doesn't restart
the work item after shutdown has already waited for it. For this we
add a new flag protected with nn->client_lock. It is set only while it
is safe to make client tracking calls, and v4_end_grace only schedules
work while the flag is set with the spinlock held.
So this patch adds a nfsd_net field "client_tracking_active" which is
set as described. Another field "grace_end_forced", is set when
v4_end_grace is written. After this is set, and providing
client_tracking_active is set, the laundromat is scheduled.
This "grace_end_forced" field bypasses other checks for whether the
grace period has finished.
This resolves a race which can result in use-after-free.
Reported-by: Li Lingfeng <lilingfeng3(a)huawei.com>
Closes: https://lore.kernel.org/linux-nfs/20250623030015.2353515-1-neil@brown.name/…
Fixes: 7f5ef2e900d9 ("nfsd: add a v4_end_grace file to /proc/fs/nfsd")
Cc: stable(a)vger.kernel.org
Signed-off-by: NeilBrown <neil(a)brown.name>
Tested-by: Li Lingfeng <lilingfeng3(a)huawei.com>
Reviewed-by: Jeff Layton <jlayton(a)kernel.org>
Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Conflicts:
fs/nfsd/nfs4state.c
[Commit 5aa2c4a1fe28 ("NFSD: Add a nfsd4_file_hash_remove() helper") add
declaration of nfsd4_file_hash_remove();
commit ea92c0768f98 ("nfsd: simplify nfsd_renew") change the return value;
commit 438ef64bbfe4 ("NFSD: register/unregister of nfsd-client shrinker at
nfsd startup/shutdown time") add unregister_shrinker() in
nfs4_state_shutdown_net();
commit 67ef9e5fd737 ("NFSD: add courteous server support for thread with
only delegation") move the position of declaration of laundry_wq.]
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
fs/nfsd/netns.h | 2 ++
fs/nfsd/nfs4state.c | 44 +++++++++++++++++++++++++++++++++++++++++---
fs/nfsd/nfsctl.c | 3 +--
fs/nfsd/state.h | 2 +-
4 files changed, 45 insertions(+), 6 deletions(-)
diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h
index 8500acac09e0..ca5c386aafce 100644
--- a/fs/nfsd/netns.h
+++ b/fs/nfsd/netns.h
@@ -40,6 +40,8 @@ struct nfsd_net {
struct lock_manager nfsd4_manager;
bool grace_ended;
+ bool grace_end_forced;
+ bool client_tracking_active;
time64_t boot_time;
struct dentry *nfsd_client_dir;
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 302bbad5cdc6..ee28d5456dde 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -80,7 +80,7 @@ static u64 current_sessionid = 1;
/* forward declarations */
static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner);
static void nfs4_free_ol_stateid(struct nfs4_stid *stid);
-void nfsd4_end_grace(struct nfsd_net *nn);
+static void nfsd4_end_grace(struct nfsd_net *nn);
static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps);
/* Locking: */
@@ -5346,7 +5346,7 @@ nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
return status;
}
-void
+static void
nfsd4_end_grace(struct nfsd_net *nn)
{
/* do nothing if grace period already ended */
@@ -5379,6 +5379,34 @@ nfsd4_end_grace(struct nfsd_net *nn)
*/
}
+static struct workqueue_struct *laundry_wq;
+/**
+ * nfsd4_force_end_grace - forcibly end the NFSv4 grace period
+ * @nn: network namespace for the server instance to be updated
+ *
+ * Forces bypass of normal grace period completion, then schedules
+ * the laundromat to end the grace period immediately. Does not wait
+ * for the grace period to fully terminate before returning.
+ *
+ * Return values:
+ * %true: Grace termination schedule
+ * %false: No action was taken
+ */
+bool nfsd4_force_end_grace(struct nfsd_net *nn)
+{
+ if (!nn->client_tracking_ops)
+ return false;
+ spin_lock(&nn->client_lock);
+ if (nn->grace_ended || !nn->client_tracking_active) {
+ spin_unlock(&nn->client_lock);
+ return false;
+ }
+ WRITE_ONCE(nn->grace_end_forced, true);
+ mod_delayed_work(laundry_wq, &nn->laundromat_work, 0);
+ spin_unlock(&nn->client_lock);
+ return true;
+}
+
/*
* If we've waited a lease period but there are still clients trying to
* reclaim, wait a little longer to give them a chance to finish.
@@ -5388,6 +5416,8 @@ static bool clients_still_reclaiming(struct nfsd_net *nn)
time64_t double_grace_period_end = nn->boot_time +
2 * nn->nfsd4_lease;
+ if (READ_ONCE(nn->grace_end_forced))
+ return false;
if (nn->track_reclaim_completes &&
atomic_read(&nn->nr_reclaim_complete) ==
nn->reclaim_str_hashtbl_size)
@@ -5530,7 +5560,6 @@ nfs4_laundromat(struct nfsd_net *nn)
return new_timeo;
}
-static struct workqueue_struct *laundry_wq;
static void laundromat_main(struct work_struct *);
static void
@@ -7343,6 +7372,8 @@ static int nfs4_state_create_net(struct net *net)
nn->unconf_name_tree = RB_ROOT;
nn->boot_time = ktime_get_real_seconds();
nn->grace_ended = false;
+ nn->grace_end_forced = false;
+ nn->client_tracking_active = false;
nn->nfsd4_manager.block_opens = true;
INIT_LIST_HEAD(&nn->nfsd4_manager.list);
INIT_LIST_HEAD(&nn->client_lru);
@@ -7409,6 +7440,10 @@ nfs4_state_start_net(struct net *net)
return ret;
locks_start_grace(net, &nn->nfsd4_manager);
nfsd4_client_tracking_init(net);
+ /* safe for laundromat to run now */
+ spin_lock(&nn->client_lock);
+ nn->client_tracking_active = true;
+ spin_unlock(&nn->client_lock);
if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0)
goto skip_grace;
printk(KERN_INFO "NFSD: starting %lld-second grace period (net %x)\n",
@@ -7458,6 +7493,9 @@ nfs4_state_shutdown_net(struct net *net)
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
cancel_delayed_work_sync(&nn->laundromat_work);
+ spin_lock(&nn->client_lock);
+ nn->client_tracking_active = false;
+ spin_unlock(&nn->client_lock);
locks_end_grace(&nn->nfsd4_manager);
INIT_LIST_HEAD(&reaplist);
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 040340080b3d..e84c8cf8e2c0 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1133,9 +1133,8 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size)
case 'Y':
case 'y':
case '1':
- if (!nn->nfsd_serv)
+ if (!nfsd4_force_end_grace(nn))
return -EBUSY;
- nfsd4_end_grace(nn);
break;
default:
return -EINVAL;
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index 9eae11a9d21c..0e4f98b41364 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -683,7 +683,7 @@ static inline void get_nfs4_file(struct nfs4_file *fi)
struct nfsd_file *find_any_file(struct nfs4_file *f);
/* grace period management */
-void nfsd4_end_grace(struct nfsd_net *nn);
+bool nfsd4_force_end_grace(struct nfsd_net *nn);
/* nfs4recover operations */
extern int nfsd4_client_tracking_init(struct net *net);
--
2.52.0
2
1
From: Hongye Lin <linhongye(a)h-partners.com>
mainline inclusion
from mainline-v6.8-rc1
commit e3a649ecf8b9253cb1d05ceb085544472b06446f
category: feature
bugzilla: https://atomgit.com/openeuler/kernel/issues/8904
CVE: NA
Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm…
----------------------------------------------------------------------
DDI0601 2023-09 defines a new sysrem register FPMR (Floating Point Mode
Register) which configures the new FP8 features. Add a definition of this
register.
Qinxin Xia (18):
arm64/sysreg: Add definition for ID_AA64PFR2_EL1
arm64/sysreg: Add definition for ID_AA64ISAR3_EL1
arm64/sysreg: Add definition for ID_AA64FPFR0_EL1
arm64/sysreg: Add definition for FPMR
arm64/sysreg: Add EnFPM field for SCTLR_EL1 and HCRX_EL2
arm64/sysreg: Add LUT field for ID_AA64ISAR2_EL1
arm64/cpufeature: Hook new identification registers up to cpufeature
arm64/fpsimd: Support FEAT_FPMR
arm64/hwcap: Define hwcaps for 2023 DPISA features
kselftest/arm64: Add basic FPMR test
kselftest/arm64: Handle FPMR context in generic signal frame parser
kselftest/arm64: Add 2023 DPISA hwcap test coverage
arm64: Kconfig: Detect toolchain support for LSUI
arm64: cpufeature: add FEAT_LSUI
arm64/signal: Add FPMR signal handling
arm64/ptrace: Expose FPMR via ptrace
Fix kabi for thread struct with FPMR
Add support "arm64.nocnp" for start option
Yifan Wu (4):
arm64/hwcap: Add support for FEAT_CMPBR
kselftest/arm64: Add FEAT_CMPBR to the hwcap selftest
arm64/sysreg: Update ID_AA64ISAR2_EL1 for FEAT_CMPBR
selftest/arm64: Fix sve2p1_sigill() to hwcap test
Documentation/arch/arm64/elf_hwcaps.rst | 30 +++++
arch/arm64/Kconfig | 5 +
arch/arm64/include/asm/cpu.h | 3 +
arch/arm64/include/asm/cpufeature.h | 6 +
arch/arm64/include/asm/fpsimd.h | 2 +
arch/arm64/include/asm/hwcap.h | 10 ++
arch/arm64/include/asm/processor.h | 5 +
arch/arm64/include/asm/signal_common.h | 16 +++
arch/arm64/include/uapi/asm/hwcap.h | 10 ++
arch/arm64/include/uapi/asm/sigcontext.h | 8 ++
arch/arm64/kernel/cpufeature.c | 70 +++++++++-
arch/arm64/kernel/cpuinfo.c | 3 +
arch/arm64/kernel/fpsimd.c | 13 ++
arch/arm64/kernel/hwcap_str.h | 10 ++
arch/arm64/kernel/idreg-override.c | 11 ++
arch/arm64/kernel/ptrace.c | 42 ++++++
arch/arm64/kernel/signal.c | 46 +++++++
arch/arm64/tools/cpucaps | 2 +
arch/arm64/tools/sysreg | 122 +++++++++++++++++-
include/uapi/linux/elf.h | 1 +
tools/testing/selftests/arm64/abi/hwcap.c | 120 ++++++++++++++++-
.../testing/selftests/arm64/signal/.gitignore | 1 +
.../arm64/signal/testcases/fpmr_siginfo.c | 82 ++++++++++++
.../arm64/signal/testcases/testcases.c | 8 ++
.../arm64/signal/testcases/testcases.h | 1 +
25 files changed, 621 insertions(+), 6 deletions(-)
create mode 100644 tools/testing/selftests/arm64/signal/testcases/fpmr_siginfo.c
--
2.33.0
2
23
Chen Yu (1):
sched/eevdf: Fix wakeup-preempt by checking cfs_rq->nr_running
Ingo Molnar (2):
sched/fair: Rename cfs_rq::avg_load to cfs_rq::sum_weight
sched/fair: Rename cfs_rq::avg_vruntime to ::sum_w_vruntime, and
helper functions
Peter Zijlstra (10):
sched/fair: Fix zero_vruntime tracking
sched/fair: Fix EEVDF entity placement bug causing scheduling lag
sched/fair: Adhere to place_entity() constraints
sched: Unify runtime accounting across classes
sched: Remove vruntime from trace_sched_stat_runtime()
sched: Unify more update_curr*()
sched/eevdf: Allow shorter slices to wakeup-preempt
sched/fair: Only set slice protection at pick time
sched/fair: Fix zero_vruntime tracking fix
sched/debug: Fix avg_vruntime() usage
Vincent Guittot (2):
sched/fair: Use protect_slice() instead of direct comparison
sched/fair: Fix NO_RUN_TO_PARITY case
Wang Tao (1):
sched/eevdf: Update se->vprot in reweight_entity()
Zhang Qiao (1):
sched: Fix struct sched_entity kabi broken
Zicheng Qu (5):
sched: Re-evaluate scheduling when migrating queued tasks out of
throttled cgroups
sched: Fix kabi breakage of struct cfs_rq for sum_weight
sched: Fix kabi breakage of struct cfs_rq for sum_w_vruntime
sched/eevdf: Disable shorter slices to wakeup-preempt
sched/fair: Fix vruntime drift by preventing double lag scaling during
reweight
zihan zhou (1):
sched: Cancel the slice protection of the idle entity
include/linux/sched.h | 15 +-
include/trace/events/sched.h | 15 +-
kernel/sched/core.c | 4 +-
kernel/sched/deadline.c | 15 +-
kernel/sched/debug.c | 4 +-
kernel/sched/fair.c | 477 +++++++++++++++++++----------------
kernel/sched/features.h | 5 +
kernel/sched/rt.c | 15 +-
kernel/sched/sched.h | 18 +-
kernel/sched/stop_task.c | 13 +-
10 files changed, 304 insertions(+), 277 deletions(-)
--
2.34.1
2
24
10 Apr '26
Jinjiang Tu (3):
arm64: mm: hardcode domain info and add get_domain_cpumask()
arm64: mm: Track CPUs that a task has run on for TLBID optimization
arm64: tlbflush: Optimize flush_tlb_mm() by using TLBID
Marc Zyngier (2):
arm64: cpufeature: Add ID_AA64MMFR4_EL1 handling
arm64: sysreg: Add layout for ID_AA64MMFR4_EL1
Zeng Heng (1):
arm64: cpufeature: Add TLBID (Domain-based TLB Invalidation) detection
arch/arm64/Kconfig | 12 ++
arch/arm64/include/asm/cpu.h | 1 +
arch/arm64/include/asm/cpufeature.h | 6 +
arch/arm64/include/asm/mmu_context.h | 3 +
arch/arm64/include/asm/tlbflush.h | 74 ++++++++-
arch/arm64/kernel/cpufeature.c | 17 ++
arch/arm64/kernel/cpuinfo.c | 1 +
arch/arm64/mm/context.c | 224 ++++++++++++++++++++++++++-
arch/arm64/tools/cpucaps | 1 +
arch/arm64/tools/sysreg | 41 +++++
10 files changed, 375 insertions(+), 5 deletions(-)
--
2.25.1
3
8
Introduce dmem cgroup
Chen Ridong (3):
cgroup/dmem: fix NULL pointer dereference when setting max
cgroup/dmem: avoid rcu warning when unregister region
cgroup/dmem: avoid pool UAF
Friedrich Vock (1):
cgroup/dmem: Don't open-code css_for_each_descendant_pre
Geert Uytterhoeven (1):
cgroup/rdma: Drop bogus PAGE_COUNTER select
Jiapeng Chong (1):
kernel/cgroup: Remove the unused variable climit
Liu Kai (2):
cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI
dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig
Maarten Lankhorst (2):
mm/page_counter: move calculating protection values to page_counter
kernel/cgroup: Add "dmem" memory accounting cgroup
Maxime Ripard (3):
cgroup/dmem: Select PAGE_COUNTER
cgroup/dmem: Fix parameters documentation
doc/cgroup: Fix title underline length
Roman Gushchin (1):
mm: page_counters: put page_counter_calculate_protection() under
CONFIG_MEMCG
Documentation/admin-guide/cgroup-v2.rst | 58 +-
Documentation/core-api/cgroup.rst | 9 +
Documentation/core-api/index.rst | 1 +
Documentation/gpu/drm-compute.rst | 54 ++
arch/arm64/configs/openeuler_defconfig | 1 +
arch/x86/configs/openeuler_defconfig | 1 +
include/linux/cgroup_dmem.h | 71 ++
include/linux/cgroup_subsys.h | 4 +-
include/linux/device_cgroup.h | 20 +
include/linux/page_counter.h | 10 +
init/Kconfig | 10 +
kernel/cgroup/Makefile | 1 +
kernel/cgroup/dmem.c | 1025 +++++++++++++++++++++++
mm/memcontrol.c | 154 +---
mm/page_counter.c | 175 ++++
security/device_cgroup.c | 63 +-
16 files changed, 1492 insertions(+), 165 deletions(-)
create mode 100644 Documentation/core-api/cgroup.rst
create mode 100644 Documentation/gpu/drm-compute.rst
create mode 100644 include/linux/cgroup_dmem.h
create mode 100644 kernel/cgroup/dmem.c
--
2.34.1
2
15
[PATCH OLK-6.6] serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
by Gu Bowen 09 Apr '26
by Gu Bowen 09 Apr '26
09 Apr '26
From: Jiayuan Chen <jiayuan.chen(a)shopee.com>
mainline inclusion
from mainline-v7.0-rc5
commit 455ce986fa356ff43a43c0d363ba95fa152f21d5
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14111
CVE: CVE-2026-23472
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
uart_write_room() and uart_write() behave inconsistently when
xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were
never properly initialized):
- uart_write_room() returns kfifo_avail() which can be > 0
- uart_write() checks xmit_buf and returns 0 if NULL
This inconsistency causes an infinite loop in drivers that rely on
tty_write_room() to determine if they can write:
while (tty_write_room(tty) > 0) {
written = tty->ops->write(...);
// written is always 0, loop never exits
}
For example, caif_serial's handle_tx() enters an infinite loop when
used with PORT_UNKNOWN serial ports, causing system hangs.
Fix by making uart_write_room() also check xmit_buf and return 0 if
it's NULL, consistent with uart_write().
Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13
Signed-off-by: Jiayuan Chen <jiayuan.chen(a)shopee.com>
Cc: stable <stable(a)kernel.org>
Link: https://patch.msgid.link/20260204074327.226165-1-jiayuan.chen@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Conflicts:
drivers/tty/serial/serial_core.c
[Context conflicts.]
Signed-off-by: Gu Bowen <gubowen5(a)huawei.com>
---
drivers/tty/serial/serial_core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 7ce9c87750da..bc3241d47665 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -643,7 +643,10 @@ static unsigned int uart_write_room(struct tty_struct *tty)
unsigned int ret;
port = uart_port_lock(state, flags);
- ret = uart_circ_chars_free(&state->xmit);
+ if (!state->xmit.buf)
+ ret = 0;
+ else
+ ret = uart_circ_chars_free(&state->xmit);
uart_port_unlock(port, flags);
return ret;
}
--
2.43.0
2
1
Introduce dmem cgroup
Chen Ridong (3):
cgroup/dmem: fix NULL pointer dereference when setting max
cgroup/dmem: avoid rcu warning when unregister region
cgroup/dmem: avoid pool UAF
Friedrich Vock (1):
cgroup/dmem: Don't open-code css_for_each_descendant_pre
Geert Uytterhoeven (1):
cgroup/rdma: Drop bogus PAGE_COUNTER select
Jiapeng Chong (1):
kernel/cgroup: Remove the unused variable climit
Liu Kai (1):
cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI
Maarten Lankhorst (2):
mm/page_counter: move calculating protection values to page_counter
kernel/cgroup: Add "dmem" memory accounting cgroup
Maxime Ripard (3):
cgroup/dmem: Select PAGE_COUNTER
cgroup/dmem: Fix parameters documentation
doc/cgroup: Fix title underline length
Roman Gushchin (1):
mm: page_counters: put page_counter_calculate_protection() under
CONFIG_MEMCG
Documentation/admin-guide/cgroup-v2.rst | 58 +-
Documentation/core-api/cgroup.rst | 9 +
Documentation/core-api/index.rst | 1 +
Documentation/gpu/drm-compute.rst | 54 ++
include/linux/cgroup_dmem.h | 71 ++
include/linux/cgroup_subsys.h | 4 +-
include/linux/device_cgroup.h | 20 +
include/linux/page_counter.h | 10 +
init/Kconfig | 10 +
kernel/cgroup/Makefile | 1 +
kernel/cgroup/dmem.c | 1025 +++++++++++++++++++++++
mm/memcontrol.c | 154 +---
mm/page_counter.c | 175 ++++
security/device_cgroup.c | 63 +-
14 files changed, 1490 insertions(+), 165 deletions(-)
create mode 100644 Documentation/core-api/cgroup.rst
create mode 100644 Documentation/gpu/drm-compute.rst
create mode 100644 include/linux/cgroup_dmem.h
create mode 100644 kernel/cgroup/dmem.c
--
2.34.1
2
14
From: Johan Hovold <johan(a)kernel.org>
stable inclusion
from stable-v6.6.130
commit f13100b1f5f111989f0750540a795fdef47492af
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14114
CVE: CVE-2026-23475
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit dee0774bbb2abb172e9069ce5ffef579b12b3ae9 upstream.
The controller per-cpu statistics is not allocated until after the
controller has been registered with driver core, which leaves a window
where accessing the sysfs attributes can trigger a NULL-pointer
dereference.
Fix this by moving the statistics allocation to controller allocation
while tying its lifetime to that of the controller (rather than using
implicit devres).
Fixes: 6598b91b5ac3 ("spi: spi.c: Convert statistics to per-cpu u64_stats_t")
Cc: stable(a)vger.kernel.org # 6.0
Cc: David Jander <david(a)protonic.nl>
Signed-off-by: Johan Hovold <johan(a)kernel.org>
Link: https://patch.msgid.link/20260312151817.32100-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com>
---
drivers/spi/spi.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 66f694457a8b..2ca4ea45e3b2 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2773,6 +2773,8 @@ static void spi_controller_release(struct device *dev)
struct spi_controller *ctlr;
ctlr = container_of(dev, struct spi_controller, dev);
+
+ free_percpu(ctlr->pcpu_statistics);
kfree(ctlr);
}
@@ -2924,6 +2926,12 @@ struct spi_controller *__spi_alloc_controller(struct device *dev,
if (!ctlr)
return NULL;
+ ctlr->pcpu_statistics = spi_alloc_pcpu_stats(NULL);
+ if (!ctlr->pcpu_statistics) {
+ kfree(ctlr);
+ return NULL;
+ }
+
device_initialize(&ctlr->dev);
INIT_LIST_HEAD(&ctlr->queue);
spin_lock_init(&ctlr->queue_lock);
@@ -3212,13 +3220,6 @@ int spi_register_controller(struct spi_controller *ctlr)
if (status)
goto del_ctrl;
}
- /* Add statistics */
- ctlr->pcpu_statistics = spi_alloc_pcpu_stats(dev);
- if (!ctlr->pcpu_statistics) {
- dev_err(dev, "Error allocating per-cpu statistics\n");
- status = -ENOMEM;
- goto destroy_queue;
- }
mutex_lock(&board_lock);
list_add_tail(&ctlr->list, &spi_controller_list);
@@ -3231,8 +3232,6 @@ int spi_register_controller(struct spi_controller *ctlr)
acpi_register_spi_devices(ctlr);
return status;
-destroy_queue:
- spi_destroy_queue(ctlr);
del_ctrl:
device_del(&ctlr->dev);
free_bus_id:
--
2.43.0
2
1
[PATCH OLK-6.6] netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove
by Dong Chenchen 09 Apr '26
by Dong Chenchen 09 Apr '26
09 Apr '26
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14141
CVE: CVE-2026-23272
--------------------------------
The initialization process of elem is missing in nft_add_set_elem(),
which lead to null-ptr-deref of nft_setelem_remove as below.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000014
Call trace:
nft_setelem_remove+0x28/0xe0 [nf_tables]
__nf_tables_abort+0x5f8/0xbe8 [nf_tables]
nf_tables_abort+0x64/0x1c8 [nf_tables]
nfnetlink_rcv_batch+0x2d8/0x850 [nfnetlink]
nfnetlink_rcv+0x168/0x1a8 [nfnetlink]
netlink_unicast_kernel+0x7c/0x160
netlink_unicast+0x1ac/0x250
netlink_sendmsg+0x21c/0x458
__sock_sendmsg+0x4c/0xa8
____sys_sendmsg+0x280/0x300
___sys_sendmsg+0x8c/0xf8
__sys_sendmsg+0x74/0xe0
__arm64_sys_sendmsg+0x2c/0x40
invoke_syscall+0x50/0x128
el0_svc_common.constprop.0+0xc8/0xf0
do_el0_svc+0x48/0x78
el0_slow_syscall+0x44/0x1b8
el0t_64_sync_handler+0x100/0x130
el0t_64_sync+0x188/0x190
Initialize elem to fix it.
Fixes: e7a6bffde0fe ("netfilter: nf_tables: unconditionally bump set->nelems before insertion")
Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com>
---
net/netfilter/nf_tables_api.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index d8057efc777d..ef4f6f8c7a3f 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -7144,6 +7144,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
goto err_element_clash;
}
+ nft_trans_elem(trans) = elem;
nft_trans_commit_list_add_tail(ctx->net, trans);
return set_full ? -ENFILE : 0;
--
2.25.1
2
1
[PATCH OLK-6.6] wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
by Yi Yang 09 Apr '26
by Yi Yang 09 Apr '26
09 Apr '26
From: Felix Fietkau <nbd(a)nbd.name>
mainline inclusion
from mainline-v7.0-rc5
commit d5ad6ab61cbd89afdb60881f6274f74328af3ee9
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14084
CVE: CVE-2026-23444
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
ieee80211_tx_prepare_skb() has three error paths, but only two of them
free the skb. The first error path (ieee80211_tx_prepare() returning
TX_DROP) does not free it, while invoke_tx_handlers() failure and the
fragmentation check both do.
Add kfree_skb() to the first error path so all three are consistent,
and remove the now-redundant frees in callers (ath9k, mt76,
mac80211_hwsim) to avoid double-free.
Document the skb ownership guarantee in the function's kdoc.
Signed-off-by: Felix Fietkau <nbd(a)nbd.name>
Link: https://patch.msgid.link/20260314065455.2462900-1-nbd@nbd.name
Fixes: 06be6b149f7e ("mac80211: add ieee80211_tx_prepare_skb() helper function")
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
Conflicts:
drivers/net/wireless/mediatek/mt76/scan.c
[Commit 31083e38548f ("ifi: mt76: add code for emulating hardware
scanning") was not merged. No problematic function is introduced.]
include/net/mac80211.h
[Commit 0e9824e0d59b2 ("wifi: mac80211: Add missing return value
documentation") was not merged. Context conflicts.]
Signed-off-by: Yi Yang <yiyang13(a)huawei.com>
---
drivers/net/wireless/ath/ath9k/channel.c | 6 ++----
drivers/net/wireless/virtual/mac80211_hwsim.c | 1 -
include/net/mac80211.h | 4 ++++
net/mac80211/tx.c | 4 +++-
4 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/channel.c b/drivers/net/wireless/ath/ath9k/channel.c
index 571062f2e82a..ba8ec5112afe 100644
--- a/drivers/net/wireless/ath/ath9k/channel.c
+++ b/drivers/net/wireless/ath/ath9k/channel.c
@@ -1011,7 +1011,7 @@ static void ath_scan_send_probe(struct ath_softc *sc,
skb_set_queue_mapping(skb, IEEE80211_AC_VO);
if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, NULL))
- goto error;
+ return;
txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
if (ath_tx_start(sc->hw, skb, &txctl))
@@ -1124,10 +1124,8 @@ ath_chanctx_send_vif_ps_frame(struct ath_softc *sc, struct ath_vif *avp,
skb->priority = 7;
skb_set_queue_mapping(skb, IEEE80211_AC_VO);
- if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta)) {
- dev_kfree_skb_any(skb);
+ if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta))
return false;
- }
break;
default:
return false;
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index 1214e7dcc812..bf12ff0ab06a 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -2892,7 +2892,6 @@ static void hw_scan_work(struct work_struct *work)
hwsim->tmp_chan->band,
NULL)) {
rcu_read_unlock();
- kfree_skb(probe);
continue;
}
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index adaa1b2323d2..85d785060e76 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -7032,6 +7032,10 @@ void ieee80211_report_wowlan_wakeup(struct ieee80211_vif *vif,
* @band: the band to transmit on
* @sta: optional pointer to get the station to send the frame to
*
+ * Return: %true if the skb was prepared, %false otherwise.
+ * On failure, the skb is freed by this function; callers must not
+ * free it again.
+ *
* Note: must be called under RCU lock
*/
bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 7eddcb6f9645..2a708132320c 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1911,8 +1911,10 @@ bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
struct ieee80211_tx_data tx;
struct sk_buff *skb2;
- if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP)
+ if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP) {
+ kfree_skb(skb);
return false;
+ }
info->band = band;
info->control.vif = vif;
--
2.25.1
2
1
---
tools/testing/sharepool/Makefile | 36 +
tools/testing/sharepool/libs/Makefile | 8 +
.../sharepool/libs/default_args_main.c | 87 ++
tools/testing/sharepool/libs/default_main.c | 85 ++
tools/testing/sharepool/libs/sem_use.c | 116 ++
tools/testing/sharepool/libs/sem_use.h | 13 +
tools/testing/sharepool/libs/sharepool_lib.c | 218 ++++
tools/testing/sharepool/libs/sharepool_lib.h | 534 ++++++++
tools/testing/sharepool/libs/test_lib.h | 324 +++++
tools/testing/sharepool/module/Makefile | 14 +
.../sharepool/module/check_sharepool_alloc.c | 132 ++
.../sharepool/module/check_sharepool_fault.c | 63 +
.../testing/sharepool/module/sharepool_dev.c | 1130 +++++++++++++++++
.../testing/sharepool/module/sharepool_dev.h | 149 +++
tools/testing/sharepool/test.sh | 55 +
tools/testing/sharepool/test_end.sh | 8 +
tools/testing/sharepool/test_loop.sh | 35 +
tools/testing/sharepool/test_prepare.sh | 8 +
tools/testing/sharepool/testcase/Makefile | 12 +
.../sharepool/testcase/api_test/Makefile | 14 +
.../sharepool/testcase/api_test/api_test.sh | 15 +
.../api_test/is_sharepool_addr/Makefile | 13 +
.../test_is_sharepool_addr.c | 90 ++
.../testcase/api_test/sp_alloc/Makefile | 13 +
.../api_test/sp_alloc/test_sp_alloc.c | 543 ++++++++
.../api_test/sp_alloc/test_sp_alloc2.c | 131 ++
.../api_test/sp_alloc/test_sp_alloc3.c | 147 +++
.../api_test/sp_alloc/test_spa_error.c | 109 ++
.../api_test/sp_alloc_nodemask/Makefile | 13 +
.../sp_alloc_nodemask/start_vm_test_16.sh | 49 +
.../sp_alloc_nodemask/start_vm_test_4.sh | 25 +
.../sp_alloc_nodemask/test_nodemask.c | 782 ++++++++++++
.../api_test/sp_config_dvpp_range/Makefile | 13 +
.../test_sp_config_dvpp_range.c | 367 ++++++
.../test_sp_multi_numa_node.c | 289 +++++
.../testcase/api_test/sp_free/Makefile | 13 +
.../testcase/api_test/sp_free/test_sp_free.c | 127 ++
.../api_test/sp_group_add_task/Makefile | 13 +
.../test_sp_group_add_task.c | 568 +++++++++
.../test_sp_group_add_task2.c | 254 ++++
.../test_sp_group_add_task3.c | 250 ++++
.../test_sp_group_add_task4.c | 148 +++
.../test_sp_group_add_task5.c | 113 ++
.../api_test/sp_group_del_task/Makefile | 13 +
.../test_sp_group_del_task.c | 1083 ++++++++++++++++
.../api_test/sp_group_id_by_pid/Makefile | 13 +
.../test_sp_group_id_by_pid.c | 179 +++
.../test_sp_group_id_by_pid2.c | 318 +++++
.../api_test/sp_id_of_current/Makefile | 13 +
.../sp_id_of_current/test_sp_id_of_current.c | 112 ++
.../api_test/sp_make_share_k2u/Makefile | 13 +
.../test_sp_make_share_k2u.c | 624 +++++++++
.../test_sp_make_share_k2u2.c | 361 ++++++
.../api_test/sp_make_share_u2k/Makefile | 13 +
.../test_sp_make_share_u2k.c | 307 +++++
.../testcase/api_test/sp_numa_maps/Makefile | 13 +
.../api_test/sp_numa_maps/test_sp_numa_maps.c | 164 +++
.../testcase/api_test/sp_reg_hpage/Makefile | 13 +
.../api_test/sp_reg_hpage/test_sp_hpage_reg.c | 44 +
.../test_sp_hpage_reg_after_alloc.c | 84 ++
.../sp_reg_hpage/test_sp_hpage_reg_exec.c | 82 ++
.../testcase/api_test/sp_unshare/Makefile | 13 +
.../api_test/sp_unshare/test_sp_unshare.c | 394 ++++++
.../sp_walk_page_range_and_free/Makefile | 13 +
.../test_sp_walk_page_range_and_free.c | 339 +++++
.../testcase/dts_bugfix_test/Makefile | 15 +
.../dts_bugfix_test/dts_bugfix_test.sh | 43 +
.../test_01_coredump_k2u_alloc.c | 603 +++++++++
.../dts_bugfix_test/test_02_spg_not_alive.c | 166 +++
.../dts_bugfix_test/test_03_hugepage_rsvd.c | 84 ++
.../dts_bugfix_test/test_04_spg_add_del.c | 100 ++
.../dts_bugfix_test/test_05_cgroup_limit.c | 76 ++
.../testcase/dts_bugfix_test/test_06_clone.c | 176 +++
.../dts_bugfix_test/test_08_addr_offset.c | 156 +++
.../dts_bugfix_test/test_09_spg_del_exit.c | 150 +++
.../test_10_walk_page_range_AA_lock.c | 124 ++
.../dts_bugfix_test/test_dvpp_readonly.c | 71 ++
.../sharepool/testcase/function_test/Makefile | 36 +
.../testcase/function_test/function_test.sh | 32 +
.../test_alloc_free_two_process.c | 303 +++++
.../function_test/test_alloc_readonly.c | 588 +++++++++
.../function_test/test_dvpp_multi_16G_alloc.c | 690 ++++++++++
.../test_dvpp_multi_16G_k2task.c | 604 +++++++++
.../function_test/test_dvpp_pass_through.c | 191 +++
.../function_test/test_dvpp_readonly.c | 147 +++
.../test_hugetlb_alloc_hugepage.c | 113 ++
.../testcase/function_test/test_k2u.c | 804 ++++++++++++
.../test_mm_mapped_to_multi_groups.c | 435 +++++++
.../function_test/test_non_dvpp_group.c | 167 +++
.../testcase/function_test/test_sp_ro.c | 719 +++++++++++
.../function_test/test_two_user_process.c | 626 +++++++++
.../testcase/function_test/test_u2k.c | 490 +++++++
.../sharepool/testcase/generate_list.sh | 46 +
.../testcase/performance_test/Makefile | 17 +
.../performance_test/performance_test.sh | 5 +
.../performance_test/test_perf_process_kill.c | 174 +++
.../performance_test/test_perf_sp_add_group.c | 375 ++++++
.../performance_test/test_perf_sp_alloc.c | 618 +++++++++
.../performance_test/test_perf_sp_k2u.c | 860 +++++++++++++
.../testcase/reliability_test/Makefile | 11 +
.../reliability_test/coredump/Makefile | 13 +
.../reliability_test/coredump/test_coredump.c | 581 +++++++++
.../coredump/test_coredump2.c | 202 +++
.../coredump/test_coredump_k2u_alloc.c | 562 ++++++++
.../reliability_test/fragment/Makefile | 13 +
.../fragment/test_external_fragmentation.c | 37 +
.../test_external_fragmentation_trigger.c | 58 +
.../reliability_test/k2u_u2k/Makefile | 13 +
.../k2u_u2k/test_k2u_and_kill.c | 276 ++++
.../k2u_u2k/test_k2u_unshare.c | 188 +++
.../k2u_u2k/test_malloc_u2k.c | 187 +++
.../k2u_u2k/test_u2k_and_kill.c | 155 +++
.../reliability_test/kthread/Makefile | 13 +
.../kthread/test_add_strange_task.c | 46 +
.../kthread/test_del_kthread.c | 61 +
.../testcase/reliability_test/others/Makefile | 13 +
.../reliability_test/others/test_judge_addr.c | 104 ++
.../others/test_kill_sp_process.c | 430 +++++++
.../reliability_test/others/test_kthread.c | 195 +++
.../others/test_mmap_sp_address.c | 223 ++++
.../others/test_notifier_block.c | 101 ++
.../reliability_test/reliability_test.sh | 51 +
.../reliability_test/sp_add_group/Makefile | 13 +
.../sp_add_group/test_add_exiting_task.c | 61 +
.../sp_add_group/test_add_group1.c | 118 ++
.../sp_add_group/test_add_strange_task.c | 46 +
.../reliability_test/sp_unshare/Makefile | 13 +
.../sp_unshare/test_unshare1.c | 325 +++++
.../sp_unshare/test_unshare2.c | 202 +++
.../sp_unshare/test_unshare3.c | 243 ++++
.../sp_unshare/test_unshare4.c | 516 ++++++++
.../sp_unshare/test_unshare5.c | 185 +++
.../sp_unshare/test_unshare6.c | 93 ++
.../sp_unshare/test_unshare7.c | 159 +++
.../sp_unshare/test_unshare_kill.c | 150 +++
.../testing/sharepool/testcase/remove_list.sh | 22 +
.../sharepool/testcase/scenario_test/Makefile | 15 +
.../testcase/scenario_test/scenario_test.sh | 45 +
.../test_auto_check_statistics.c | 338 +++++
.../scenario_test/test_dfx_heavy_load.c | 143 +++
.../scenario_test/test_dvpp_16g_limit.c | 68 +
.../testcase/scenario_test/test_failure.c | 630 +++++++++
.../testcase/scenario_test/test_hugepage.c | 231 ++++
.../scenario_test/test_hugepage_setting.sh | 51 +
.../scenario_test/test_max_50000_groups.c | 138 ++
.../testcase/scenario_test/test_oom.c | 135 ++
.../scenario_test/test_proc_sp_group_state.c | 170 +++
.../scenario_test/test_vmalloc_cgroup.c | 65 +
.../sharepool/testcase/stress_test/Makefile | 15 +
.../stress_test/sp_ro_fault_injection.sh | 21 +
.../testcase/stress_test/stress_test.sh | 47 +
.../stress_test/test_alloc_add_and_kill.c | 347 +++++
.../stress_test/test_alloc_free_two_process.c | 303 +++++
.../stress_test/test_concurrent_debug.c | 359 ++++++
.../testcase/stress_test/test_mult_u2k.c | 514 ++++++++
.../test_sharepool_enhancement_stress_cases.c | 692 ++++++++++
.../stress_test/test_u2k_add_and_kill.c | 358 ++++++
.../sharepool/testcase/test_all/Makefile | 8 +
.../sharepool/testcase/test_all/test_all.c | 285 +++++
.../testcase/test_mult_process/Makefile | 16 +
.../mult_add_group_test/Makefile | 13 +
.../test_add_multi_cases.c | 255 ++++
.../test_alloc_add_and_kill.c | 347 +++++
.../test_max_group_per_process.c | 94 ++
.../test_mult_alloc_and_add_group.c | 138 ++
.../test_mult_process_thread_exit.c | 498 ++++++++
.../test_mult_thread_add_group.c | 220 ++++
.../test_u2k_add_and_kill.c | 358 ++++++
.../mult_debug_test/Makefile | 13 +
.../test_add_group_and_print.c | 182 +++
.../mult_debug_test/test_concurrent_debug.c | 359 ++++++
.../mult_debug_test/test_debug_loop.c | 43 +
.../test_proc_interface_process.c | 636 ++++++++++
.../mult_debug_test/test_statistics_stress.c | 302 +++++
.../test_mult_process/mult_k2u_test/Makefile | 13 +
.../mult_k2u_test/test_mult_k2u.c | 855 +++++++++++++
.../mult_k2u_test/test_mult_pass_through.c | 405 ++++++
.../mult_k2u_test/test_mult_thread_k2u.c | 197 +++
.../test_mult_process/mult_u2k_test/Makefile | 13 +
.../mult_u2k_test/test_mult_u2k.c | 514 ++++++++
.../mult_u2k_test/test_mult_u2k3.c | 314 +++++
.../mult_u2k_test/test_mult_u2k4.c | 310 +++++
.../test_mult_process/stress_test/Makefile | 13 +
.../stress_test/test_alloc_free_two_process.c | 303 +++++
.../test_mult_process/stress_test/test_fuzz.c | 543 ++++++++
.../stress_test/test_mult_proc_interface.c | 701 ++++++++++
.../test_mult_process/test_mult_process.sh | 53 +
.../test_mult_process/test_proc_interface.sh | 19 +
188 files changed, 39522 insertions(+)
create mode 100644 tools/testing/sharepool/Makefile
create mode 100644 tools/testing/sharepool/libs/Makefile
create mode 100644 tools/testing/sharepool/libs/default_args_main.c
create mode 100644 tools/testing/sharepool/libs/default_main.c
create mode 100644 tools/testing/sharepool/libs/sem_use.c
create mode 100644 tools/testing/sharepool/libs/sem_use.h
create mode 100644 tools/testing/sharepool/libs/sharepool_lib.c
create mode 100644 tools/testing/sharepool/libs/sharepool_lib.h
create mode 100644 tools/testing/sharepool/libs/test_lib.h
create mode 100644 tools/testing/sharepool/module/Makefile
create mode 100644 tools/testing/sharepool/module/check_sharepool_alloc.c
create mode 100644 tools/testing/sharepool/module/check_sharepool_fault.c
create mode 100644 tools/testing/sharepool/module/sharepool_dev.c
create mode 100644 tools/testing/sharepool/module/sharepool_dev.h
create mode 100755 tools/testing/sharepool/test.sh
create mode 100755 tools/testing/sharepool/test_end.sh
create mode 100755 tools/testing/sharepool/test_loop.sh
create mode 100755 tools/testing/sharepool/test_prepare.sh
create mode 100644 tools/testing/sharepool/testcase/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/Makefile
create mode 100755 tools/testing/sharepool/testcase/api_test/api_test.sh
create mode 100644 tools/testing/sharepool/testcase/api_test/is_sharepool_addr/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/is_sharepool_addr/test_is_sharepool_addr.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_alloc/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_alloc/test_sp_alloc.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_alloc/test_sp_alloc2.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_alloc/test_sp_alloc3.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_alloc/test_spa_error.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/Makefile
create mode 100755 tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/start_vm_test_16.sh
create mode 100755 tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/start_vm_test_4.sh
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/test_nodemask.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_config_dvpp_range/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_config_dvpp_range/test_sp_config_dvpp_range.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_config_dvpp_range/test_sp_multi_numa_node.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_free/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_free/test_sp_free.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_group_add_task/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task2.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task3.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task4.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task5.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_group_del_task/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_group_del_task/test_sp_group_del_task.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_group_id_by_pid/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_group_id_by_pid/test_sp_group_id_by_pid.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_group_id_by_pid/test_sp_group_id_by_pid2.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_id_of_current/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_id_of_current/test_sp_id_of_current.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_make_share_k2u/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_make_share_k2u/test_sp_make_share_k2u.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_make_share_k2u/test_sp_make_share_k2u2.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_make_share_u2k/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_make_share_u2k/test_sp_make_share_u2k.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_numa_maps/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_numa_maps/test_sp_numa_maps.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_reg_hpage/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_reg_hpage/test_sp_hpage_reg.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_reg_hpage/test_sp_hpage_reg_after_alloc.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_reg_hpage/test_sp_hpage_reg_exec.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_unshare/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_unshare/test_sp_unshare.c
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_walk_page_range_and_free/Makefile
create mode 100644 tools/testing/sharepool/testcase/api_test/sp_walk_page_range_and_free/test_sp_walk_page_range_and_free.c
create mode 100644 tools/testing/sharepool/testcase/dts_bugfix_test/Makefile
create mode 100755 tools/testing/sharepool/testcase/dts_bugfix_test/dts_bugfix_test.sh
create mode 100644 tools/testing/sharepool/testcase/dts_bugfix_test/test_01_coredump_k2u_alloc.c
create mode 100644 tools/testing/sharepool/testcase/dts_bugfix_test/test_02_spg_not_alive.c
create mode 100644 tools/testing/sharepool/testcase/dts_bugfix_test/test_03_hugepage_rsvd.c
create mode 100644 tools/testing/sharepool/testcase/dts_bugfix_test/test_04_spg_add_del.c
create mode 100644 tools/testing/sharepool/testcase/dts_bugfix_test/test_05_cgroup_limit.c
create mode 100644 tools/testing/sharepool/testcase/dts_bugfix_test/test_06_clone.c
create mode 100644 tools/testing/sharepool/testcase/dts_bugfix_test/test_08_addr_offset.c
create mode 100644 tools/testing/sharepool/testcase/dts_bugfix_test/test_09_spg_del_exit.c
create mode 100644 tools/testing/sharepool/testcase/dts_bugfix_test/test_10_walk_page_range_AA_lock.c
create mode 100644 tools/testing/sharepool/testcase/dts_bugfix_test/test_dvpp_readonly.c
create mode 100644 tools/testing/sharepool/testcase/function_test/Makefile
create mode 100755 tools/testing/sharepool/testcase/function_test/function_test.sh
create mode 100644 tools/testing/sharepool/testcase/function_test/test_alloc_free_two_process.c
create mode 100644 tools/testing/sharepool/testcase/function_test/test_alloc_readonly.c
create mode 100644 tools/testing/sharepool/testcase/function_test/test_dvpp_multi_16G_alloc.c
create mode 100644 tools/testing/sharepool/testcase/function_test/test_dvpp_multi_16G_k2task.c
create mode 100644 tools/testing/sharepool/testcase/function_test/test_dvpp_pass_through.c
create mode 100644 tools/testing/sharepool/testcase/function_test/test_dvpp_readonly.c
create mode 100644 tools/testing/sharepool/testcase/function_test/test_hugetlb_alloc_hugepage.c
create mode 100644 tools/testing/sharepool/testcase/function_test/test_k2u.c
create mode 100644 tools/testing/sharepool/testcase/function_test/test_mm_mapped_to_multi_groups.c
create mode 100644 tools/testing/sharepool/testcase/function_test/test_non_dvpp_group.c
create mode 100644 tools/testing/sharepool/testcase/function_test/test_sp_ro.c
create mode 100644 tools/testing/sharepool/testcase/function_test/test_two_user_process.c
create mode 100644 tools/testing/sharepool/testcase/function_test/test_u2k.c
create mode 100755 tools/testing/sharepool/testcase/generate_list.sh
create mode 100644 tools/testing/sharepool/testcase/performance_test/Makefile
create mode 100755 tools/testing/sharepool/testcase/performance_test/performance_test.sh
create mode 100644 tools/testing/sharepool/testcase/performance_test/test_perf_process_kill.c
create mode 100644 tools/testing/sharepool/testcase/performance_test/test_perf_sp_add_group.c
create mode 100644 tools/testing/sharepool/testcase/performance_test/test_perf_sp_alloc.c
create mode 100644 tools/testing/sharepool/testcase/performance_test/test_perf_sp_k2u.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/Makefile
create mode 100644 tools/testing/sharepool/testcase/reliability_test/coredump/Makefile
create mode 100644 tools/testing/sharepool/testcase/reliability_test/coredump/test_coredump.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/coredump/test_coredump2.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/coredump/test_coredump_k2u_alloc.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/fragment/Makefile
create mode 100644 tools/testing/sharepool/testcase/reliability_test/fragment/test_external_fragmentation.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/fragment/test_external_fragmentation_trigger.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/k2u_u2k/Makefile
create mode 100644 tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_k2u_and_kill.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_k2u_unshare.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_malloc_u2k.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_u2k_and_kill.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/kthread/Makefile
create mode 100644 tools/testing/sharepool/testcase/reliability_test/kthread/test_add_strange_task.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/kthread/test_del_kthread.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/others/Makefile
create mode 100644 tools/testing/sharepool/testcase/reliability_test/others/test_judge_addr.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/others/test_kill_sp_process.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/others/test_kthread.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/others/test_mmap_sp_address.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/others/test_notifier_block.c
create mode 100755 tools/testing/sharepool/testcase/reliability_test/reliability_test.sh
create mode 100644 tools/testing/sharepool/testcase/reliability_test/sp_add_group/Makefile
create mode 100644 tools/testing/sharepool/testcase/reliability_test/sp_add_group/test_add_exiting_task.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/sp_add_group/test_add_group1.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/sp_add_group/test_add_strange_task.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/sp_unshare/Makefile
create mode 100644 tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare1.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare2.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare3.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare4.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare5.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare6.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare7.c
create mode 100644 tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare_kill.c
create mode 100755 tools/testing/sharepool/testcase/remove_list.sh
create mode 100644 tools/testing/sharepool/testcase/scenario_test/Makefile
create mode 100755 tools/testing/sharepool/testcase/scenario_test/scenario_test.sh
create mode 100644 tools/testing/sharepool/testcase/scenario_test/test_auto_check_statistics.c
create mode 100644 tools/testing/sharepool/testcase/scenario_test/test_dfx_heavy_load.c
create mode 100644 tools/testing/sharepool/testcase/scenario_test/test_dvpp_16g_limit.c
create mode 100644 tools/testing/sharepool/testcase/scenario_test/test_failure.c
create mode 100644 tools/testing/sharepool/testcase/scenario_test/test_hugepage.c
create mode 100755 tools/testing/sharepool/testcase/scenario_test/test_hugepage_setting.sh
create mode 100644 tools/testing/sharepool/testcase/scenario_test/test_max_50000_groups.c
create mode 100644 tools/testing/sharepool/testcase/scenario_test/test_oom.c
create mode 100644 tools/testing/sharepool/testcase/scenario_test/test_proc_sp_group_state.c
create mode 100644 tools/testing/sharepool/testcase/scenario_test/test_vmalloc_cgroup.c
create mode 100644 tools/testing/sharepool/testcase/stress_test/Makefile
create mode 100644 tools/testing/sharepool/testcase/stress_test/sp_ro_fault_injection.sh
create mode 100755 tools/testing/sharepool/testcase/stress_test/stress_test.sh
create mode 100644 tools/testing/sharepool/testcase/stress_test/test_alloc_add_and_kill.c
create mode 100644 tools/testing/sharepool/testcase/stress_test/test_alloc_free_two_process.c
create mode 100644 tools/testing/sharepool/testcase/stress_test/test_concurrent_debug.c
create mode 100644 tools/testing/sharepool/testcase/stress_test/test_mult_u2k.c
create mode 100644 tools/testing/sharepool/testcase/stress_test/test_sharepool_enhancement_stress_cases.c
create mode 100644 tools/testing/sharepool/testcase/stress_test/test_u2k_add_and_kill.c
create mode 100644 tools/testing/sharepool/testcase/test_all/Makefile
create mode 100644 tools/testing/sharepool/testcase/test_all/test_all.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/Makefile
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/Makefile
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_add_multi_cases.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_alloc_add_and_kill.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_max_group_per_process.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_mult_alloc_and_add_group.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_mult_process_thread_exit.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_mult_thread_add_group.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_u2k_add_and_kill.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/Makefile
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_add_group_and_print.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_concurrent_debug.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_debug_loop.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_proc_interface_process.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_statistics_stress.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/Makefile
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/test_mult_k2u.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/test_mult_pass_through.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/test_mult_thread_k2u.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/Makefile
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/test_mult_u2k.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/test_mult_u2k3.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/test_mult_u2k4.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/stress_test/Makefile
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/stress_test/test_alloc_free_two_process.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/stress_test/test_fuzz.c
create mode 100644 tools/testing/sharepool/testcase/test_mult_process/stress_test/test_mult_proc_interface.c
create mode 100755 tools/testing/sharepool/testcase/test_mult_process/test_mult_process.sh
create mode 100755 tools/testing/sharepool/testcase/test_mult_process/test_proc_interface.sh
diff --git a/tools/testing/sharepool/Makefile b/tools/testing/sharepool/Makefile
new file mode 100644
index 000000000000..aeb3181d1e69
--- /dev/null
+++ b/tools/testing/sharepool/Makefile
@@ -0,0 +1,36 @@
+ARCH?=arm64
+
+KERNEL_DIR?=
+
+TOOL_BIN_DIR?=$(shell realpath ./install)
+export ARCH KERNEL_DIR TOOL_BIN_DIR
+export KBUILD_MODPOST_WARN=1
+
+SHARELIB_DIR:=$(shell realpath libs)
+DEV_INC:=$(shell realpath module)
+MODULEDIR=module libs testcase
+
+sharepool_extra_ccflags:=-I$(SHARELIB_DIR) \
+ -I$(DEV_INC) \
+ -Wno-pointer-to-int-cast \
+ -Wno-int-to-pointer-cast \
+ -Wno-int-conversion
+
+sharepool_lib_ccflags:=-L$(SHARELIB_DIR) \
+ -lsharepool_lib
+
+export sharepool_extra_ccflags
+export sharepool_lib_ccflags
+
+.PHONY: all tooldir install clean
+
+all:tooldir
+tooldir:
+ for n in $(MODULEDIR); do $(MAKE) -C $$n; done
+install:
+ mkdir -p $(TOOL_BIN_DIR)
+ cp test.sh test_loop.sh test_prepare.sh test_end.sh $(TOOL_BIN_DIR)
+ for n in $(MODULEDIR); do $(MAKE) -C $$n install; done
+clean:
+ for n in $(MODULEDIR); do $(MAKE) -C $$n clean; done
+ rm -rf install
diff --git a/tools/testing/sharepool/libs/Makefile b/tools/testing/sharepool/libs/Makefile
new file mode 100644
index 000000000000..510fd0b4d919
--- /dev/null
+++ b/tools/testing/sharepool/libs/Makefile
@@ -0,0 +1,8 @@
+libsharepool_lib.so: sharepool_lib.c sharepool_lib.h sem_use.c sem_use.h test_lib.h
+ $(CROSS_COMPILE)gcc sharepool_lib.c sem_use.c -shared -fPIC -o libsharepool_lib.so -I../module
+
+install: libsharepool_lib.so
+ cp $^ $(TOOL_BIN_DIR)
+
+clean:
+ rm -rf libsharepool_lib.so
diff --git a/tools/testing/sharepool/libs/default_args_main.c b/tools/testing/sharepool/libs/default_args_main.c
new file mode 100644
index 000000000000..1395ed571295
--- /dev/null
+++ b/tools/testing/sharepool/libs/default_args_main.c
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri May 14 02:15:29 2021
+ */
+
+/*
+ * 提供一个默认main函数实现，使用者需要定义两个变量
+ * - dev_fd 设备文件的fd
+ * - testcases 测试用例数组
+ */
+
+#define STRLENGTH 500
+
+static int run_testcase(struct testcase_s *tc)
+{
+ int ret = 0;
+
+ printf(">>>> start testcase: %s", tc->name);
+ if (!tc->expect_ret)
+ printf(", expecting error info\n");
+ else
+ printf("\n");
+
+ if (tc->run_as_child) {
+ pid_t pid;
+
+ FORK_CHILD_ARGS(pid, tc->func());
+
+ if (!tc->exit_signal_check)
+ WAIT_CHILD_STATUS(pid, out);
+ else
+ WAIT_CHILD_SIGNAL(pid, tc->signal, out);
+ } else
+ ret = tc->func();
+
+out:
+ printf("<<<< end testcase: %s, result: %s\n", tc->name, ret != 0 ? "failed" : "passed");
+
+ return ret;
+}
+
+int main(int argc, char *argv[])
+{
+ int num = -1;
+ int passed = 0, failed = 0;
+ int ret;
+
+ dev_fd = open_device();
+ if (dev_fd < 0)
+ return -1;
+
+ ret = parse_opt(argc, argv);
+ if (ret) {
+ pr_info("parse opt failed!");
+ return -1;
+ } else
+ pr_info("parse opt finished.");
+
+ if (num >= 0 && num < ARRAY_SIZE(testcases)) {
+ if (run_testcase(testcases + num))
+ failed++;
+ else
+ passed++;
+ get_filename();
+ printf("-------------------------");
+ printf("%s testcase%d finished, %s", test_group.name, num + 1, passed ? "passed" : "failed" );
+ printf("-------------------------\n");
+ } else {
+ for (num = 0; num < ARRAY_SIZE(testcases); num++) {
+ if (testcases[num].manual)
+ continue;
+ if (run_testcase(testcases + num))
+ failed++;
+ else
+ passed++;
+ }
+ get_filename();
+ printf("-------------------------");
+ printf("%s All %d testcases finished, passing: %d, failing: %d", test_group.name, passed + failed, passed, failed);
+ printf("-------------------------\n");
+ }
+
+
+ close_device(dev_fd);
+ return failed ? -1 : 0;
+}
diff --git a/tools/testing/sharepool/libs/default_main.c b/tools/testing/sharepool/libs/default_main.c
new file mode 100644
index 000000000000..26f42ac39db9
--- /dev/null
+++ b/tools/testing/sharepool/libs/default_main.c
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri May 14 02:15:29 2021
+ */
+
+/*
+ * 提供一个默认main函数实现，使用者需要定义两个变量
+ * - dev_fd 设备文件的fd
+ * - testcases 测试用例数组
+ */
+#include <stdlib.h>
+#define STRLENGTH 500
+
+static int run_testcase(struct testcase_s *tc)
+{
+ int ret = 0;
+
+ printf("\n======================================================\n");
+ printf(">>>> START TESTCASE: %s\n", tc->name);
+ printf("测试点：%s\n", tc->comment);
+
+ if (tc->run_as_child) {
+ pid_t pid;
+
+ FORK_CHILD_ARGS(pid, tc->func());
+
+ if (!tc->exit_signal_check)
+ WAIT_CHILD_STATUS(pid, out);
+ else
+ WAIT_CHILD_SIGNAL(pid, tc->signal, out);
+ } else
+ ret = tc->func();
+
+out:
+ printf("<<<< END TESTCASE: %s, RESULT: %s\n", tc->name, ret != 0 ? "FAILED" : "PASSED");
+ printf("======================================================\n");
+ return ret;
+}
+
+int main(int argc, char *argv[])
+{
+ int num = -1;
+ int passed = 0, failed = 0;
+
+ dev_fd = open_device();
+ if (dev_fd < 0)
+ return -1;
+
+ if (argc > 1)
+ num = atoi(argv[1]) - 1;
+
+#ifdef pre_hook
+ pre_hook();
+#endif
+ if (num >= 0 && num < ARRAY_SIZE(testcases)) {
+ if (run_testcase(testcases + num))
+ failed++;
+ else
+ passed++;
+ get_filename();
+ printf("-------------------------");
+ printf("%s TESTCASE%d FINISHED, %s", test_group.name, num + 1, passed ? "passed" : "failed" );
+ printf("-------------------------\n\n");
+ } else {
+ for (num = 0; num < ARRAY_SIZE(testcases); num++) {
+ if (testcases[num].manual)
+ continue;
+ if (run_testcase(testcases + num))
+ failed++;
+ else
+ passed++;
+ }
+ get_filename();
+ printf("-------------------------");
+ printf("%s ALL %d TESTCASES FINISHED, passing: %d, failing: %d", test_group.name, passed + failed, passed, failed);
+ printf("-------------------------\n\n");
+ }
+#ifdef post_hook
+ post_hook();
+#endif
+
+ close_device(dev_fd);
+ return failed ? -1 : 0;
+}
diff --git a/tools/testing/sharepool/libs/sem_use.c b/tools/testing/sharepool/libs/sem_use.c
new file mode 100644
index 000000000000..da4dc98d8849
--- /dev/null
+++ b/tools/testing/sharepool/libs/sem_use.c
@@ -0,0 +1,116 @@
+#include "sem_use.h"
+#include <sys/sem.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+
+int sem_set_value(int semid, short val)
+{
+ int ret;
+ if (val) {
+ if (val < 0) {
+ printf("sem can not be set negative value.\n");
+ return -1;
+ }
+ union semun {
+ int val; /* Value for SETVAL */
+ struct semid_ds *buf; /* Buffer for IPC_STAT, IPC_SET */
+ unsigned short *array; /* Array for GETALL, SETALL */
+ struct seminfo *__buf; /* Buffer for IPC_INFO
+ (Linux-specific) */
+ };
+ union semun su;
+ su.val = val;
+ ret = semctl(semid, 0, SETVAL, su);
+ } else {
+ ret = semctl(semid, 0, SETVAL, 0);
+ }
+
+ return ret;
+}
+
+int sem_get_value(int semid)
+{
+ int ret;
+ ret = semctl(semid, 0, GETVAL);
+ return ret;
+}
+
+int sem_dec_by_one(int semid)
+{
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = -1,
+ .sem_flg = 0,
+ };
+ semop(semid, &sembuf, 1);
+ return 0;
+}
+
+int sem_inc_by_one(int semid)
+{
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = 1,
+ .sem_flg = 0,
+ };
+ semop(semid, &sembuf, 1);
+ return 0;
+}
+
+int sem_dec_by_val(int semid, short val)
+{
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = -val,
+ .sem_flg = 0,
+ };
+ semop(semid, &sembuf, 1);
+ return 0;
+}
+
+int sem_inc_by_val(int semid, short val)
+{
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = val,
+ .sem_flg = 0,
+ };
+ semop(semid, &sembuf, 1);
+ return 0;
+}
+
+int sem_check_zero(int semid)
+{
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = 0,
+ .sem_flg = 0,
+ };
+ semop(semid, &sembuf, 1);
+ return 0;
+}
+
+int sem_create(key_t semkey, char *name)
+{
+ // I suppose a normal semid will not be -1
+ int semid = semget(semkey, 1, IPC_CREAT);
+ if (semid < 0) {
+ printf("open semaphore %s failed, errno: %s\n", name, strerror(errno));
+ return -1;
+ }
+ sem_set_value(semid, 0);
+
+ return semid;
+}
+
+int sem_close(int semid)
+{
+ if (semctl(semid, 0, IPC_RMID) != 0) {
+ printf("sem remove fail, errno: %s\n", strerror(errno));
+ return -1;
+ }
+ return 0;
+}
diff --git a/tools/testing/sharepool/libs/sem_use.h b/tools/testing/sharepool/libs/sem_use.h
new file mode 100644
index 000000000000..7109f4597586
--- /dev/null
+++ b/tools/testing/sharepool/libs/sem_use.h
@@ -0,0 +1,13 @@
+
+#include <sys/sem.h>
+
+int sem_set_value(int semid, short val);
+int sem_get_value(int semid);
+int sem_dec_by_one(int semid);
+int sem_inc_by_one(int semid);
+int sem_dec_by_val(int semid, short val);
+int sem_inc_by_val(int semid, short val);
+int sem_check_zero(int semid);
+int sem_create(key_t semkey, char *name);
+
+
diff --git a/tools/testing/sharepool/libs/sharepool_lib.c b/tools/testing/sharepool/libs/sharepool_lib.c
new file mode 100644
index 000000000000..4a0b1e0c01e5
--- /dev/null
+++ b/tools/testing/sharepool/libs/sharepool_lib.c
@@ -0,0 +1,218 @@
+/*
+ * compile: gcc sharepool_lib.c -shared -fPIC -o sharepool_lib.so
+ */
+
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <errno.h>
+
+#include "sharepool_lib.h"
+
+int open_device()
+{
+ int fd;
+
+ fd = open(DEVICE_FILE_NAME, O_RDWR);
+ if (fd < 0) {
+ printf("open device %s failed\n", DEVICE_FILE_NAME);
+ }
+
+ return fd;
+}
+
+void close_device(int fd)
+{
+ if (fd > 0) {
+ close(fd);
+ }
+}
+
+int ioctl_add_group(int fd, struct sp_add_group_info *info)
+{
+ int ret;
+
+ /* Do not allow invalid flags, because the original testcase define the info in stack
+ * and may not initialize the new flag members */
+ if (info->flag & ~SPG_FLAG_NON_DVPP)
+ info->flag = 0;
+
+ ret = ioctl(fd, SP_IOCTL_ADD_GROUP, info);
+ if (ret < 0) {
+ //printf("ioctl SP_IOCTL_ADD_GROUP failed, errno is %d\n", errno);
+ }
+
+ return ret;
+}
+
+int ioctl_alloc(int fd, struct sp_alloc_info *info)
+{
+ int ret;
+
+ ret = ioctl(fd, SP_IOCTL_ALLOC, info);
+ if (ret < 0) {
+ printf("ioctl SP_IOCTL_ALLOC failed, errno is %d\n", errno);
+ }
+
+ return ret;
+}
+
+int ioctl_free(int fd, struct sp_alloc_info *info)
+{
+ int ret;
+
+ ret = ioctl(fd, SP_IOCTL_FREE, info);
+ if (ret < 0) {
+ //printf("ioctl SP_IOCTL_FREE failed, errno is %d\n", errno);
+ }
+
+ return ret;
+}
+
+int ioctl_u2k(int fd, struct sp_make_share_info *info)
+{
+ int ret;
+
+ ret = ioctl(fd, SP_IOCTL_U2K, info);
+ if (ret < 0) {
+ //printf("ioctl SP_IOCTL_U2K failed, errno is %d\n", errno);
+ }
+
+ return ret;
+}
+
+int ioctl_k2u(int fd, struct sp_make_share_info *info)
+{
+ int ret;
+
+ ret = ioctl(fd, SP_IOCTL_K2U, info);
+ if (ret < 0) {
+ //printf("ioctl SP_IOCTL_K2U failed, errno is %d\n", errno);
+ }
+
+ return ret;
+}
+
+int ioctl_unshare(int fd, struct sp_make_share_info *info)
+{
+ int ret;
+
+ ret = ioctl(fd, SP_IOCTL_UNSHARE, info);
+ if (ret < 0) {
+ //printf("ioctl SP_IOCTL_UNSHARE failed, errno is %d\n", errno);
+ }
+
+ return ret;
+}
+
+int ioctl_find_group_by_pid(int fd, struct sp_group_id_by_pid_info *info)
+{
+ int ret;
+
+ ret = ioctl(fd, SP_IOCTL_FIND_GROUP_BY_PID, info);
+ if (ret < 0) {
+ //printf("ioctl SP_IOCTL_FIND_GROUP_BY_PID failed, errno is %d\n", errno);
+ }
+
+ return ret;
+}
+
+int ioctl_judge_addr(int fd, unsigned long addr)
+{
+ /* return true or false */
+ return ioctl(fd, SP_IOCTL_JUDGE_ADDR, &addr);
+}
+
+int ioctl_vmalloc(int fd, struct vmalloc_info *info)
+{
+ int ret;
+
+ ret = ioctl(fd, SP_IOCTL_VMALLOC, info);
+ if (ret < 0) {
+ //printf("ioctl SP_IOCTL_VMALLOC failed, errno is %d\n", errno);
+ }
+
+ return ret;
+}
+
+int ioctl_vmalloc_hugepage(int fd, struct vmalloc_info *info)
+{
+ int ret;
+
+ ret = ioctl(fd, SP_IOCTL_VMALLOC_HUGEPAGE, info);
+ if (ret < 0) {
+ //printf("ioctl SP_IOCTL_VMALLOC failed, errno is %d\n", errno);
+ }
+
+ return ret;
+}
+
+int ioctl_vfree(int fd, struct vmalloc_info *info)
+{
+ /* in fact, no return value */
+ return ioctl(fd, SP_IOCTL_VFREE, info);
+}
+
+int ioctl_karea_access(int fd, struct karea_access_info *info)
+{
+ return ioctl(fd, SP_IOCTL_KACCESS, info);
+}
+
+int ioctl_walk_page_range(int fd, struct sp_walk_page_range_info *info)
+{
+ return ioctl(fd, SP_IOCTL_WALK_PAGE_RANGE, info);
+}
+
+int ioctl_walk_page_free(int fd, struct sp_walk_page_range_info *info)
+{
+ return ioctl(fd, SP_IOCTL_WALK_PAGE_FREE, info);
+}
+
+int ioctl_config_dvpp_range(int fd, struct sp_config_dvpp_range_info *info)
+{
+ // return ioctl(fd, SP_IOCTL_CONFIG_DVPP_RANGE, info);
+ return 0;
+}
+
+int ioctl_register_notifier_block(int fd, struct sp_notifier_block_info *info)
+{
+ return ioctl(fd, SP_IOCTL_REGISTER_NOTIFIER_BLOCK, info);
+}
+
+int ioctl_unregister_notifier_block(int fd, struct sp_notifier_block_info *info)
+{
+ return ioctl(fd, SP_IOCTL_UNREGISTER_NOTIFIER_BLOCK, info);
+}
+
+int ioctl_del_from_group(int fd, struct sp_del_from_group_info *info)
+{
+ return ioctl(fd, SP_IOCTL_DEL_FROM_GROUP, info);
+}
+
+int ioctl_id_of_current(int fd, struct sp_id_of_curr_info *info)
+{
+ return ioctl(fd, SP_IOCTL_ID_OF_CURRENT, info);
+}
+
+/*test for sp_walk_data == NULL*/
+int ioctl_walk_page_range_null(int fd, struct sp_walk_page_range_info *info)
+{
+ return ioctl(fd, SP_IOCTL_WALK_PAGE_RANGE_NULL, info);
+}
+
+int ioctl_hpage_reg_test_suite(int fd, void *info)
+{
+ return ioctl(fd, SP_IOCTL_HPAGE_REG_TESTSUITE, info);
+}
+
+int ioctl_hpage_reg_after_alloc(int fd, void *info)
+{
+ return ioctl(fd, SP_IOCTL_HPAGE_REG_AFTER_ALLOC, info);
+}
+
+int ioctl_hpage_reg_test_exec(int fd, void *info)
+{
+ return ioctl(fd, SP_IOCTL_HPAGE_REG_EXEC, info);
+}
\ No newline at end of file
diff --git a/tools/testing/sharepool/libs/sharepool_lib.h b/tools/testing/sharepool/libs/sharepool_lib.h
new file mode 100644
index 000000000000..0754353d4962
--- /dev/null
+++ b/tools/testing/sharepool/libs/sharepool_lib.h
@@ -0,0 +1,534 @@
+#include <sys/mman.h> // for PROT_READ and PROT_WRITE
+#include <sys/types.h>
+#include <sys/wait.h> // for wait
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+#include <stdbool.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <sys/resource.h>
+#include <string.h>
+#include <sys/ioctl.h>
+
+#include "sharepool_dev.h"
+#include "test_lib.h"
+
+#define SP_HUGEPAGE (1 << 0)
+#define SP_HUGEPAGE_ONLY (1 << 1)
+#define SP_DVPP (1 << 2)
+#define SP_PROT_RO (1 << 16)
+#define SP_PROT_FOCUS (1 << 17)
+#define SP_SPEC_NODE_ID (1 << 3)
+
+#define NODES_SHIFT 10UL
+#define DEVICE_ID_BITS 4UL
+#define DEVICE_ID_MASK ((1UL << DEVICE_ID_BITS) - 1UL)
+#define DEVICE_ID_SHIFT 32UL
+#define NODE_ID_BITS NODES_SHIFT
+#define NODE_ID_MASK ((1UL << NODE_ID_BITS) - 1UL)
+#define NODE_ID_SHIFT (DEVICE_ID_SHIFT + DEVICE_ID_BITS)
+
+#define SPG_ID_DEFAULT 0
+#define SPG_ID_MIN 1
+#define SPG_ID_MAX 99999
+#define SPG_ID_AUTO_MIN 100000
+#define SPG_ID_AUTO_MAX 199999
+#define SPG_ID_AUTO 200000
+
+#define SPG_ID_NONE (-1)
+#define SPG_FLAG_NON_DVPP 1UL
+
+#define DVPP_16G 0x400000000UL
+#define DVPP_BASE 0x100000000000ULL
+#define DVPP_END (DVPP_BASE + DVPP_16G * 64)
+
+#define MMAP_SHARE_POOL_NORMAL_START 0xe80000000000UL
+#define MMAP_SHARE_POOL_RO_SIZE 0x1000000000UL
+#define MMAP_SHARE_POOL_DVPP_START 0xf00000000000UL
+#define MMAP_SHARE_POOL_RO_START (MMAP_SHARE_POOL_DVPP_START - MMAP_SHARE_POOL_RO_SIZE)
+
+int open_device();
+void close_device(int fd);
+
+int ioctl_add_group(int fd, struct sp_add_group_info *info);
+int ioctl_alloc(int fd, struct sp_alloc_info *info);
+int ioctl_free(int fd, struct sp_alloc_info *info);
+int ioctl_u2k(int fd, struct sp_make_share_info *info);
+int ioctl_k2u(int fd, struct sp_make_share_info *info);
+int ioctl_unshare(int fd, struct sp_make_share_info *info);
+int ioctl_find_group_by_pid(int fd, struct sp_group_id_by_pid_info *info);
+int ioctl_judge_addr(int fd, unsigned long addr);
+int ioctl_vmalloc(int fd, struct vmalloc_info *info);
+int ioctl_vmalloc_hugepage(int fd, struct vmalloc_info *info);
+int ioctl_vfree(int fd, struct vmalloc_info *info);
+int ioctl_karea_access(int fd, struct karea_access_info *info);
+int ioctl_walk_page_range(int fd, struct sp_walk_page_range_info *info);
+int ioctl_walk_page_free(int fd, struct sp_walk_page_range_info *info);
+int ioctl_config_dvpp_range(int fd, struct sp_config_dvpp_range_info *info);
+int ioctl_register_notifier_block(int fd, struct sp_notifier_block_info *info);
+int ioctl_unregister_notifier_block(int fd, struct sp_notifier_block_info *info);
+int ioctl_del_from_group(int fd, struct sp_del_from_group_info *info);
+/*for error handling path test*/
+int ioctl_walk_page_range_null(int fd, struct sp_walk_page_range_info *info);
+
+static int inline ioctl_find_first_group(int fd, int pid)
+{
+ int spg_id, num = 1, ret;
+ struct sp_group_id_by_pid_info info = {
+ .pid = pid,
+ .spg_ids = &spg_id,
+ .num = &num,
+ };
+ ret = ioctl_find_group_by_pid(fd, &info);
+
+ return ret < 0 ? ret : spg_id;
+}
+
+#define KAREA_ACCESS_CHECK(val, address, sz, out)\
+ do { \
+ struct karea_access_info __karea_info = { \
+ .mod = KAREA_CHECK, \
+ .value = val, \
+ .addr = address, \
+ .size = sz, \
+ }; \
+ ret = ioctl_karea_access(dev_fd, &__karea_info);\
+ if (ret < 0) { \
+ pr_info("karea check failed, errno%d", errno);\
+ goto out; \
+ } \
+ } while (0)
+
+#define KAREA_ACCESS_SET(val, address, sz, out) \
+ do { \
+ struct karea_access_info __karea_info = { \
+ .mod = KAREA_SET, \
+ .value = val, \
+ .addr = address, \
+ .size = sz, \
+ }; \
+ ret = ioctl_karea_access(dev_fd, &__karea_info);\
+ if (ret < 0) { \
+ pr_info("karea set failed, errno%d", errno);\
+ goto out; \
+ } \
+ } while (0)
+
+static int dev_fd;
+
+static inline unsigned long wrap_vmalloc(unsigned long size, bool ishuge)
+{
+ int ret;
+ struct vmalloc_info ka_info = {
+ .size = size,
+ };
+ if (ishuge) {
+ ret = ioctl_vmalloc_hugepage(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc_hugepage failed, errno: %d", errno);
+ return 0;
+ }
+ } else {
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return 0;
+ }
+ }
+ return ka_info.addr;
+}
+
+static inline void wrap_vfree(unsigned long addr)
+{
+ struct vmalloc_info ka_info = {
+ .addr = addr,
+ };
+ ioctl_vfree(dev_fd, &ka_info);
+}
+
+static inline int wrap_add_group_flag(int pid, int prot, int spg_id, unsigned long flag)
+{
+ int ret;
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = prot,
+ .spg_id = spg_id,
+ .flag = flag,
+ };
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+ ret = ag_info.spg_id;
+out:
+ return ret;
+}
+
+static inline int wrap_add_group(int pid, int prot, int spg_id)
+{
+ return wrap_add_group_flag(pid, prot, spg_id, 0);
+}
+
+static inline int wrap_add_group_non_dvpp(int pid, int prot, int spg_id)
+{
+ return wrap_add_group_flag(pid, prot, spg_id, SPG_FLAG_NON_DVPP);
+}
+
+static inline unsigned long wrap_k2u(unsigned long kva, unsigned long size, int spg_id, unsigned long sp_flags)
+{
+ int ret;
+ unsigned long uva = 0;
+ struct sp_make_share_info k2u_infos = {
+ .kva = kva,
+ .size = size,
+ .spg_id = spg_id,
+ .sp_flags = sp_flags,
+ };
+ TEST_CHECK(ioctl_k2u(dev_fd, &k2u_infos), out);
+ uva = k2u_infos.addr;
+
+out:
+ return uva;
+}
+
+static inline unsigned long wrap_u2k(unsigned long uva, unsigned long size)
+{
+ int ret;
+
+ struct sp_make_share_info u2k_info = {
+ .uva = uva,
+ .size = size,
+ };
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ return 0;
+ }
+
+ return u2k_info.addr;
+}
+
+static inline int wrap_walk_page_range(unsigned long uva, unsigned long size)
+{
+ int ret = 0;
+ struct sp_walk_page_range_info wpr_info = {
+ .uva = uva,
+ .size = size,
+ };
+ TEST_CHECK(ioctl_walk_page_range(dev_fd, &wpr_info), out);
+out:
+ return ret;
+}
+
+static inline int wrap_unshare(unsigned long addr, unsigned long size)
+{
+ int ret;
+ struct sp_make_share_info info = {
+ .addr = addr,
+ .size = size,
+ };
+
+ TEST_CHECK(ioctl_unshare(dev_fd, &info), out);
+out:
+ return ret;
+}
+
+/*
+ * return:
+ * 0: alloc fails, see errno for reason.
+ * non-zero value: success.
+ */
+static inline void *wrap_sp_alloc(int spg_id, unsigned long size, unsigned long flag)
+{
+ int ret;
+ unsigned long addr = 0;
+ struct sp_alloc_info info = {
+ .spg_id = spg_id,
+ .flag = flag,
+ .size = size,
+ };
+ TEST_CHECK(ioctl_alloc(dev_fd, &info), out);
+ addr = info.addr;
+
+out:
+ /* if fail, return 0. because we cannot tell a errno from a normal
+ * addr. On the other side, the va will never be 0.
+ */
+ return ret < 0? (void *)-1: (void *)addr;
+}
+
+static inline int wrap_sp_free(void *addr)
+{
+ int ret;
+ struct sp_alloc_info info = {
+ .addr = (unsigned long)addr,
+ .spg_id = SPG_ID_DEFAULT,
+ };
+ TEST_CHECK(ioctl_free(dev_fd, &info), out);
+
+out:
+ return ret;
+}
+
+static inline int wrap_sp_free_by_id(void *addr, int spg_id)
+{
+ int ret = 0;
+ struct sp_alloc_info info = {
+ .addr = (unsigned long)addr,
+ .spg_id = spg_id,
+ };
+ TEST_CHECK(ioctl_free(dev_fd, &info), out);
+
+out:
+ return ret;
+}
+
+static inline int wrap_sp_group_id_by_pid(pid_t pid, int spg_id[], int *num)
+{
+ int ret;
+ struct sp_group_id_by_pid_info info = {
+ .pid = pid,
+ .spg_ids = spg_id,
+ .num = num,
+ };
+ TEST_CHECK(ioctl_find_group_by_pid(dev_fd, &info), out);
+
+out:
+ return ret;
+}
+
+static inline int wrap_del_from_group(pid_t pid, int spg_id)
+{
+ int ret;
+ struct sp_del_from_group_info info = {
+ .pid = pid,
+ .spg_id = spg_id,
+ };
+ TEST_CHECK(ioctl_del_from_group(dev_fd, &info), out);
+
+out:
+ return ret;
+}
+
+static inline int wrap_sp_id_of_current()
+{
+ int ret;
+ struct sp_id_of_curr_info info;
+ ret = ioctl(dev_fd, SP_IOCTL_ID_OF_CURRENT, &info);
+ if (ret < 0)
+ return -errno;
+
+ return info.spg_id;
+}
+
+static inline int sharepool_log(char *log_title)
+{
+ printf("%s", log_title);
+
+ char *logname[2] = {"sp_proc_log", "sp_spa_log"};
+ char *procname[2] = {"/proc/sharepool/proc_stat", "/proc/sharepool/spa_stat"};
+
+ read_proc(procname[0], logname[0], SIZE, 0);
+ read_proc(procname[1], logname[1], SIZE, 0);
+
+ return 0;
+}
+
+static inline int sharepool_print()
+{
+ printf("\n%20s", " ****** ");
+ printf("sharepool_print");
+ printf("%-20s\n", " ****** ");
+
+ char *logname[5] = {
+ "1.log",
+ "2.log",
+ "3.log",
+ };
+
+ char *procname[5] = {
+ "/proc/sharepool/proc_stat",
+ "/proc/sharepool/proc_overview",
+ "/proc/sharepool/spa_stat"
+ };
+
+ read_proc(procname[0], logname[0], SIZE, 1);
+ read_proc(procname[1], logname[1], SIZE, 1);
+ read_proc(procname[2], logname[2], SIZE, 1);
+
+ return 0;
+}
+
+static inline int spa_stat()
+{
+ printf("\n%20s", " ****** ");
+ printf("cat /proc/sharepool/spa_stat");
+ printf("%-20s\n", " ****** ");
+
+ char *logname = "spa_stat_log";
+ char *procname = "/proc/sharepool/spa_stat";
+
+ read_proc(procname, logname, SIZE, 1);
+
+ return 0;
+}
+
+static inline int proc_stat()
+{
+ printf("\n%20s", " ****** ");
+ printf("cat /proc/sharepool/proc_stat");
+ printf("%-20s\n", " ****** ");
+
+ char *logname = "proc_stat_log";
+ char *procname = "/proc/sharepool/proc_stat";
+
+ read_proc(procname, logname, SIZE, 1);
+
+ return 0;
+}
+
+static inline int proc_overview()
+{
+ printf("\n%20s", " ****** ");
+ printf("cat /proc/sharepool/proc_overview");
+ printf("%-20s\n", " ****** ");
+
+ char *logname = "proc_overview_log";
+ char *procname = "/proc/sharepool/proc_overview";
+
+ read_proc(procname, logname, SIZE, 1);
+
+ return 0;
+}
+
+static inline int cat_attr(char *attr)
+{
+ printf("\n%20s", " ****** ");
+ printf("cat %s", attr);
+ printf("%-20s\n", " ****** ");
+
+ char *logname = "attr_log";
+
+ read_proc(attr, logname, SIZE, 1);
+
+ return 0;
+}
+
+static int create_multi_groups(int pid, int group_num, int *group_ids)
+{
+ int ret;
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ };
+ for (int i = 0; i < group_num; i++) {
+ group_ids[i] = i + 1;
+ ag_info.spg_id = group_ids[i];
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("proc%d add group%d failed", pid, group_ids[i]);
+ return -1;
+ }
+ }
+
+ return ret;
+}
+
+static int add_multi_groups(int pid, int group_num, int *group_ids)
+{
+ int ret;
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ };
+ for (int i = 0; i < group_num; i++) {
+ ag_info.spg_id = group_ids[i];
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("proc%d add group%d failed", pid, group_ids[i]);
+ return -1;
+ }
+ }
+
+ return ret;
+}
+
+static inline void *ioctl_alloc_huge_memory(int nid, int flags, unsigned long addr, unsigned long size)
+{
+ int ret;
+ struct alloc_huge_memory alloc_info = {
+ .nid = nid,
+ .flags = flags,
+ .addr = addr,
+ .size = size,
+ };
+
+ ret = ioctl(dev_fd, SP_IOCTL_ALLOC_HUGE_MEMORY, &alloc_info);
+ if (ret < 0)
+ return NULL;
+
+ return (void *)alloc_info.addr;
+}
+
+static inline int ioctl_check_memory_node(unsigned long uva, unsigned long len, int node)
+{
+ int ret;
+ struct check_memory_node info = {
+ .uva = uva,
+ .len = len,
+ .node = node,
+ };
+
+ ret = ioctl(dev_fd, SP_IOCTL_CHECK_MEMORY_NODE, &info);
+ if (ret < 0)
+ return -errno;
+
+ return 0;
+}
+
+static inline int ioctl_kthread_start(int fd, struct sp_kthread_info *info)
+{
+ int ret;
+
+ pr_info("we are kthread");
+ ret = ioctl(fd, SP_IOCTL_KTHREAD_START, info);
+ if (ret < 0) {
+ pr_info("ioctl ktread failed errno: %d", ret);
+ }
+ return ret;
+}
+
+static inline int ioctl_kthread_end(int fd, struct sp_kthread_info *info)
+{
+ int ret;
+
+ pr_info("we are kthread end");
+ ret = ioctl(fd, SP_IOCTL_KTHREAD_END, &info);
+ if (ret < 0) {
+ pr_info("ioctl ktread failed errno: %d", ret);
+ }
+ return ret;
+}
+
+static inline int ioctl_kmalloc(int fd, struct vmalloc_info *info)
+{
+ int ret;
+
+ pr_info("we are kmalloc");
+ ret = ioctl(fd, SP_IOCTL_KMALLOC, info);
+ if (ret < 0) {
+ pr_info("ioctl ktread failed errno: %d", ret);
+ }
+ return ret;
+}
+
+static inline int ioctl_kfree(int fd, struct vmalloc_info *info)
+{
+ int ret;
+
+ pr_info("we are kfree");
+ ret = ioctl(fd, SP_IOCTL_KFREE, info);
+ if (ret < 0) {
+ pr_info("ioctl ktread failed errno: %d", ret);
+ }
+ return ret;
+}
diff --git a/tools/testing/sharepool/libs/test_lib.h b/tools/testing/sharepool/libs/test_lib.h
new file mode 100644
index 000000000000..161390c73380
--- /dev/null
+++ b/tools/testing/sharepool/libs/test_lib.h
@@ -0,0 +1,324 @@
+#include <string.h>
+#include <errno.h>
+#include <sys/mman.h> // for PROT_READ and PROT_WRITE
+#include <sys/types.h>
+#include <sys/wait.h> // for wait
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+#include <stdbool.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <sys/resource.h>
+#include <stdlib.h>
+
+#define PMD_SIZE 0x200000
+#define PAGE_SIZE 4096UL
+
+#define MAX_ERRNO 4095
+#define IS_ERR_VALUE(x) ((unsigned long)(void *)(x) >= (unsigned long)-MAX_ERRNO)
+#define COMMENT_LEN 1000 // testcase cmt
+#define SIZE 5000 // size for cat output
+
+struct testcase_s {
+ int (*func)(void);
+ const char *name;
+ bool run_as_child;
+ bool exit_signal_check;
+ bool manual;
+ const char *expect_ret;
+ int signal;
+ const char *comment;
+};
+
+#define TEST_ADD(_num, cmt, expc) \
+ struct testcase_s test##_num = { \
+ .name = "tc"#_num, \
+ .func = testcase##_num, \
+ .comment = cmt, \
+ .expect_ret = expc, \
+ }
+
+#define STRLENGTH 500
+struct test_group {
+ char name[STRLENGTH];
+ struct testcase_s *testcases;
+};
+
+char* extract_filename(char *filename, char filepath[])
+{
+
+ int i = 0, last_slash = -1, real_len = 0;
+ while (i < STRLENGTH && filepath[i] != '\0') {
+ if (filepath[i] == '/')
+ last_slash = i;
+ i++;
+ real_len++;
+ };
+
+ if (real_len >= STRLENGTH) {
+ printf("file path too long");
+ return NULL;
+ }
+
+ for (int j = last_slash + 1; j <= real_len; j++)
+ filename[j - last_slash - 1] = filepath[j];
+
+ return filename;
+}
+
+static int inline testcase_stub_pass(void) { return 0; }
+
+#define TESTCASE(tc, cmt) { .func = tc, .name = #tc, .manual = false, .run_as_child = false, .exit_signal_check = false, .comment = cmt},
+#define TESTCASE_CHILD(tc, cmt) { .func = tc, .name = #tc, .manual = false, .run_as_child = true, .exit_signal_check = false, .comment = cmt},
+#define TESTCASE_CHILD_MANUAL(tc, cmt) { .func = tc, .name = #tc, .manual = true, .run_as_child = true, .exit_signal_check = false, .comment = cmt},
+#define TESTCASE_CHILD_SIGNAL(tc, sig, cmt) { .func = tc, .name = #tc, .manual = false, .run_as_child = true, .exit_signal_check = true, .signal = sig, .comment = cmt},
+#define TESTCASE_STUB(tc, cmt) { .func = testcase_stub_pass, .name = #tc, .manual = false, .run_as_child = false, .exit_signal_check = false, .comment = cmt},
+
+
+#define ARRAY_SIZE(array) (sizeof(array) / sizeof(array[0]))
+
+#define pr_info(fmt, args...) \
+ printf("[file:%s, func:%s, line:%d] " fmt "\n", __FILE__, __func__, __LINE__, ##args)
+
+#define SEM_INIT(sync, idx) \
+ do { \
+ char sem_name[256]; \
+ snprintf(sem_name, 256, "/%s%d_%d", __FILE__, __LINE__, idx); \
+ sync = sem_open(sem_name, O_CREAT, O_RDWR, 0); \
+ if (sync == SEM_FAILED) { \
+ pr_info("sem_open failed"); \
+ return -1; \
+ } \
+ sem_unlink(sem_name); \
+ } while (0)
+
+#define SEM_WAIT(sync) \
+ do { \
+ do { \
+ ret = sem_wait(sync); \
+ } while (ret && errno == EINTR); \
+ } while (0)
+
+#define FORK_CHILD_ARGS(pid, child) \
+ do { \
+ pid = fork(); \
+ if (pid < 0) { \
+ pr_info("fork failed"); \
+ return -1; \
+ } else if (pid == 0) \
+ exit(child); \
+ } while (0)
+
+static inline int deadloop_child(void)
+{
+ while (1);
+ return -1;
+}
+
+static inline int sleep_child(void)
+{
+ pause();
+ return -1;
+}
+
+#define FORK_CHILD_DEADLOOP(pid) FORK_CHILD_ARGS(pid, deadloop_child())
+#define FORK_CHILD_SLEEP(pid) FORK_CHILD_ARGS(pid, sleep_child())
+
+#define TEST_CHECK(fn, out) \
+ do { \
+ ret = fn; \
+ if (ret < 0) { \
+ pr_info(#fn " failed, errno: %d", errno); \
+ goto out; \
+ } \
+ } while (0)
+
+#define TEST_CHECK_FAIL(fn, err, out) \
+ do { \
+ ret = fn; \
+ if (!(ret < 0 && errno == err)) { \
+ pr_info(#fn " failed, ret: %d, errno: %d", ret, errno); \
+ ret = -1; \
+ goto out; \
+ } else \
+ ret = 0; \
+ } while (0)
+
+#define KILL_CHILD(pid) \
+ do { \
+ kill(pid, SIGKILL); \
+ waitpid(pid, NULL, 0); \
+ } while (0)
+
+#define CHECK_CHILD_STATUS(pid) \
+ do { \
+ int __status; \
+ waitpid(pid, &__status, 0);\
+ if (!(WIFEXITED(__status) && !WEXITSTATUS(__status))) { \
+ if (WIFSIGNALED(__status)) { \
+ pr_info("child pid %d, killed by signal %d", pid, WTERMSIG(__status)); \
+ } else { \
+ pr_info("child, pid: %d, exit unexpected, status: %d", pid, __status);\
+ } \
+ ret = -1; \
+ } else { \
+ pr_info("child pid %d exit normal.", pid); \
+ } \
+ } while (0)
+
+#define WAIT_CHILD_STATUS(pid, out) \
+ do { \
+ int __status; \
+ waitpid(pid, &__status, 0);\
+ if (!(WIFEXITED(__status) && !WEXITSTATUS(__status))) { \
+ if (WIFSIGNALED(__status)) { \
+ pr_info("child pid %d, killed by signal %d", pid, WTERMSIG(__status)); \
+ } else { \
+ pr_info("child pid: %d, exit unexpected, status: %d", pid, WEXITSTATUS(__status));\
+ } \
+ ret = -1; \
+ goto out; \
+ } \
+ } while (0)
+
+#define WAIT_CHILD_SIGNAL(pid, sig, out)\
+ do { \
+ int __status; \
+ waitpid(pid, &__status, 0); \
+ if (!WIFSIGNALED(__status)) { \
+ pr_info("child, pid: %d, exit unexpected, status: %d", pid, __status);\
+ ret = -1; \
+ goto out; \
+ } else if (WTERMSIG(__status) != sig) { \
+ pr_info("child, pid: %d, killed by unexpected sig:%d, expected:%d ", pid, WTERMSIG(__status), sig);\
+ ret = -1; \
+ goto out; \
+ } \
+ } while (0)
+
+
+static inline int setCore()
+{
+ struct rlimit core_lim;
+ if (getrlimit(RLIMIT_CORE, &core_lim)) {
+ printf("getrlimit failed, err: %s\n", strerror(errno));
+ return -1;
+ } else
+ printf("current rlimit for RLIMIT_CORE is: %lx, %lx\n", core_lim.rlim_cur, core_lim.rlim_max);
+ core_lim.rlim_cur = RLIM_INFINITY;
+ if (setrlimit(RLIMIT_CORE, &core_lim)) {
+ printf("setrlimit failed, err: %s\n", strerror(errno));
+ return -1;
+ } else
+ printf("setrlimit for RLIMIT_CORE to unlimited\n");
+ return 0;
+}
+
+static inline int generateCoredump()
+{
+ char *a = NULL;
+ *a = 5; /* SIGSEGV */
+ return 0;
+}
+
+static inline void read_proc(char procname[], char logname[], int size, int print_or_log)
+{
+ FILE *proc, *log;
+ char str[SIZE];
+
+ log = fopen(logname, "a");
+ if (!log) {
+ printf("open %s failed.\n", logname);
+ return;
+ }
+
+ proc = fopen(procname, "r");
+ if (!proc) {
+ printf("open %s failed.\n", procname);
+ return;
+ }
+
+ // read information into a string
+ if (print_or_log)
+ printf("\n ----- %s -----\n", procname);
+
+ while (fgets(str, size, proc) != NULL) {
+ if (print_or_log)
+ printf("%s", str);
+ fputs(str, log);
+ }
+
+ fclose(proc);
+ fclose(log);
+
+ return;
+}
+
+static inline void read_attr(char procname[], char result[], int size)
+{
+ FILE *proc;
+ char str[SIZE];
+
+ proc = fopen(procname, "r");
+ if (!proc) {
+ printf("open %s failed.\n", procname);
+ return;
+ }
+
+ while (fgets(str, size, proc) != NULL)
+ strcpy(result, str);
+
+ fclose(proc);
+ return;
+}
+
+static int get_attr(char *attr, char** result, int row_size, int col_size,
+ int *row_real)
+{
+ // get attr, put result into result array
+ FILE *proc;
+ char str[SIZE];
+ int row = 0;
+
+ *row_real = 0;
+
+ proc = fopen(attr, "r");
+ if (!proc) {
+ printf("open %s failed.\n", attr);
+ return -1;
+ }
+
+ while (fgets(str, SIZE, proc) != NULL) {
+ if (strlen(str) > col_size) {
+ printf("get_attr %s failed, column size %d < strlen %d\n",
+ attr, col_size, strlen(str));
+ fclose(proc);
+ return -1;
+ }
+
+ if (row >= row_size) {
+ printf("get_attr %s failed, row limit %d too small\n",
+ attr, row_size);
+ fclose(proc);
+ return -1;
+ }
+
+ strcat(result[row++], str);
+ (*row_real)++;
+ }
+
+ fclose(proc);
+ return 0;
+}
+
+static inline int mem_show()
+{
+ char *meminfo = "/proc/meminfo";
+ char *logname = "meminfo_log";
+
+ read_proc(meminfo, logname, SIZE, 1);
+
+ return 0;
+}
+
diff --git a/tools/testing/sharepool/module/Makefile b/tools/testing/sharepool/module/Makefile
new file mode 100644
index 000000000000..aaf49e10112d
--- /dev/null
+++ b/tools/testing/sharepool/module/Makefile
@@ -0,0 +1,14 @@
+ifneq ($(KERNELRELEASE),)
+obj-m += sharepool_dev.o
+obj-m += check_sharepool_fault.o
+obj-m += check_sharepool_alloc.o
+else
+all:
+ make -C $(KERNEL_DIR) M=$$PWD modules
+
+clean:
+ make -C $(KERNEL_DIR) M=$$PWD clean
+
+install:
+ cp *.ko $(TOOL_BIN_DIR)
+endif
diff --git a/tools/testing/sharepool/module/check_sharepool_alloc.c b/tools/testing/sharepool/module/check_sharepool_alloc.c
new file mode 100644
index 000000000000..e6e9f7e806a2
--- /dev/null
+++ b/tools/testing/sharepool/module/check_sharepool_alloc.c
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2019.All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Jan 25 07:38:03 2021
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/kprobes.h>
+#include <linux/version.h>
+#include <linux/namei.h>
+#include <linux/stacktrace.h>
+#include <linux/delay.h>
+
+static void check(unsigned long addr) {
+ unsigned long long pfn;
+ struct mm_struct *mm;
+ struct vm_area_struct *vma;
+ unsigned long long val;
+ unsigned long long vf;
+ pgd_t *pgdp;
+ pgd_t pgd;
+
+ p4d_t *p4dp, p4d;
+ pud_t *pudp, pud;
+ pmd_t *pmdp, pmd;
+ pte_t *ptep, pte;
+
+ mm = current->active_mm;
+ vma = find_vma(mm, addr);
+
+ vf = VM_NORESERVE | VM_SHARE_POOL | VM_DONTCOPY | VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP;
+
+ WARN((vma->vm_flags & vf) != vf, "vma->flags of sharepool is not expected");
+ pgdp = pgd_offset(mm, addr);
+ pgd = READ_ONCE(*pgdp);
+
+ do {
+ if (pgd_none(pgd) || pgd_bad(pgd))
+ break;
+
+ p4dp = p4d_offset(pgdp, addr);
+ p4d = READ_ONCE(*p4dp);
+ if (p4d_none(p4d) || p4d_bad(p4d))
+ break;
+
+ pudp = pud_offset(p4dp, addr);
+ pud = READ_ONCE(*pudp);
+ if (pud_none(pud) || pud_bad(pud))
+ break;
+
+ pmdp = pmd_offset(pudp, addr);
+ pmd = READ_ONCE(*pmdp);
+ val = pmd_val(pmd);
+ pfn = pmd_pfn(pmd);
+ if (pmd_none(pmd) || pmd_bad(pmd))
+ break;
+
+ ptep = pte_offset_map(pmdp, addr);
+ pte = READ_ONCE(*ptep);
+ val = pte_val(pte);
+ pfn = pte_pfn(pte);
+ pte_unmap(ptep);
+ } while(0);
+
+ if (vma->vm_flags & VM_MAYWRITE) {
+ if (val & PTE_RDONLY)
+ WARN(1, "Pte(0x%llx) has PTE_RDONLY(0x%llx)\n",
+ val, PTE_RDONLY);
+ if (!(val & PTE_DIRTY))
+ WARN(1, "Pte(0x%llx) has no PTE_DIRTY(0x%llx)\n",
+ val, PTE_DIRTY);
+ }
+
+ if (!(val & PTE_AF))
+ WARN(1, "Pte(0x%llx) no has PTE_AF(0x%llx)\n",
+ val, PTE_AF);
+/* 静态大页lru会指向hstat->activelist
+ struct folio *folio;
+ folio = pfn_folio(pfn);
+ if (list_empty(&folio->lru)) {
+ WARN(1, "folio->lru is not empty\n");
+ }
+
+ if (folio_test_ksm(folio) || folio_test_anon(folio) || folio->mapping) {
+ WARN(1, "folio has rmap\n");
+ }
+*/
+}
+
+static int ret_handler(struct kretprobe_instance *ri, struct pt_regs *regs)
+{
+ unsigned long addr = regs->regs[0];
+ if (!IS_ERR_OR_NULL((void *)addr))
+ check(addr);
+
+ return 0;
+}
+
+static struct kretprobe krp = {
+ .handler =ret_handler,
+ // .entry_handler = entry_handler,
+};
+
+static int kretprobe_init(void)
+{
+ int ret;
+ krp.kp.symbol_name = "__mg_sp_alloc_nodemask";
+ ret = register_kretprobe(&krp);
+ pr_err("register_kretprobe\n");
+
+ if (ret < 0) {
+ printk(KERN_INFO "register_kretprobe failed, returned %d\n", ret);
+ }
+
+ return ret;
+}
+
+int mg_sp_alloc_nodemask_init(void)
+{
+ kretprobe_init();
+ return 0;
+}
+
+void mg_sp_alloc_nodemask_exit(void)
+{
+ unregister_kretprobe(&krp);
+}
+
+module_init(mg_sp_alloc_nodemask_init);
+module_exit(mg_sp_alloc_nodemask_exit);
+MODULE_LICENSE("GPL");
diff --git a/tools/testing/sharepool/module/check_sharepool_fault.c b/tools/testing/sharepool/module/check_sharepool_fault.c
new file mode 100644
index 000000000000..b4729c326ccd
--- /dev/null
+++ b/tools/testing/sharepool/module/check_sharepool_fault.c
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2019.All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Jan 25 07:38:03 2021
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/kprobes.h>
+#include <linux/version.h>
+#include <linux/namei.h>
+#include <linux/stacktrace.h>
+
+static int handler_pre(struct kprobe *p, struct pt_regs *regs)
+{
+ struct vm_area_struct *vma = (void *)regs->regs[0];
+ unsigned long address = regs->regs[1];
+
+ if (vma->vm_flags & VM_SHARE_POOL) {
+ WARN(1, "fault of sharepool at 0x%lx\n", address);
+ }
+
+ return 0;
+}
+
+static struct kprobe kp = {
+ .pre_handler = handler_pre,
+};
+
+static int kprobe_init(void)
+{
+ int ret;
+ kp.symbol_name = "handle_mm_fault";
+ ret = register_kprobe(&kp);
+
+ if (ret < 0) {
+ printk(KERN_INFO "%d register_kprobe failed, returned %d\n",
+ __LINE__, ret);
+ }
+
+ return ret;
+}
+
+static void kprobe_uninit(void)
+{
+ unregister_kprobe(&kp);
+}
+
+int sharepool_fault_debug_init(void)
+{
+ kprobe_init();
+
+ return 0;
+}
+
+void sharepool_fault_debug_exit(void)
+{
+ kprobe_uninit();
+}
+
+module_init(sharepool_fault_debug_init);
+module_exit(sharepool_fault_debug_exit);
+MODULE_LICENSE("GPL");
diff --git a/tools/testing/sharepool/module/sharepool_dev.c b/tools/testing/sharepool/module/sharepool_dev.c
new file mode 100644
index 000000000000..d7eac14cd52c
--- /dev/null
+++ b/tools/testing/sharepool/module/sharepool_dev.c
@@ -0,0 +1,1130 @@
+/*
+ * sharepool_dev.c - Create an input/output character device for share pool
+ */
+#define pr_fmt(fmt) "sp_test: " fmt
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/uaccess.h>
+#include <linux/vmalloc.h>
+#include <linux/printk.h>
+#include <linux/ratelimit.h>
+#include <linux/notifier.h>
+#include <linux/mm.h>
+#include <linux/hugetlb.h>
+#include <linux/kthread.h>
+#include <linux/share_pool.h>
+
+#include "sharepool_dev.h"
+
+static int dev_open(struct inode *inode, struct file *file)
+{
+ return 0;
+}
+struct task_struct *ktask;
+struct sp_kthread_info kt_info;
+int sp_kthread(void *index)
+{
+ int ret;
+ unsigned size = 4096;
+ unsigned long flag = 0;
+ int spg_id = 1;
+ void *addr;
+
+ addr = mg_sp_alloc(size, flag, spg_id);
+ if (IS_ERR(addr)) {
+ pr_info("alloc failed as expected\n");
+ }
+
+ ret = mg_sp_free(0, 1);
+ if (ret < 0) {
+ pr_info("free failed as expected\n");
+ }
+
+ ret = mg_sp_unshare(0, 0, 1);
+ if (ret < 0) {
+ pr_info("unshare failed as expected\n");
+ }
+
+ addr = mg_sp_make_share_k2u(0, 0, 0, 1, 1);
+ if (IS_ERR(addr)) {
+ pr_info("k2u failed as expected\n");
+ }
+
+ addr = mg_sp_make_share_u2k(0, 0, 1);
+ if (IS_ERR(addr)) {
+ pr_info("k2u failed as expected\n");
+ }
+
+ return 0;
+}
+
+int sp_free_kthread(void *arg)
+{
+ int ret;
+ struct sp_kthread_info *info = (struct sp_kthread_info *)arg;
+
+ pr_info("in sp_free_kthread\n");
+ current->flags &= (~PF_KTHREAD);
+ ret = mg_sp_free(info->addr, info->spg_id);
+ if (ret < 0) {
+ pr_info("kthread free failed\n");
+ return ret;
+ }
+ return 0;
+}
+
+int sp_unshare_kthread(void *arg)
+{
+ int ret;
+ struct sp_kthread_info *info = (struct sp_kthread_info *)arg;
+
+ pr_info("in sp_unshare_kthread\n");
+ current->flags &= (~PF_KTHREAD);
+ ret = mg_sp_unshare(info->addr, info->size, info->spg_id);
+ if (ret < 0) {
+ pr_info("kthread unshare failed\n");
+ return ret;
+ }
+ return 0;
+}
+
+static int dev_sp_kthread_start(unsigned long __user *arg)
+{
+ int ret = 0;
+ pr_info("dev_sp_kthread\n");
+
+ ret = copy_from_user(&kt_info, (void __user *)arg, sizeof(struct sp_kthread_info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ if (kt_info.type == 0) {
+ ktask = kthread_run(sp_kthread, NULL, "kthread test");
+ if (!ktask) {
+ pr_info("kthread run fail\n");
+ return -ECHILD;
+ }
+ }
+
+ if (kt_info.type == 1) {
+ ktask = kthread_run(sp_free_kthread, &kt_info, "kthread free test");
+ if (!ktask) {
+ pr_info("kthread run fail\n");
+ return -ECHILD;
+ }
+
+ }
+
+ if (kt_info.type == 2) {
+ ktask = kthread_run(sp_unshare_kthread, &kt_info, "kthread unshare test");
+ if (!ktask) {
+ pr_info("kthread run fail\n");
+ return -ECHILD;
+ }
+ }
+
+ return 0;
+}
+
+static int dev_sp_kthread_end(unsigned long __user *arg)
+{
+ if (ktask) {
+ pr_info("we are going to end the kthread\n");
+ kthread_stop(ktask);
+ ktask = NULL;
+ }
+
+ return 0;
+}
+
+static long dev_sp_add_group(unsigned long __user *arg)
+{
+ struct sp_add_group_info info;
+ int ret = 0;
+
+ ret = copy_from_user(&info, (void __user *)arg, sizeof(struct sp_add_group_info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ ret = mg_sp_group_add_task(info.pid, info.prot, info.spg_id);
+ if (ret < 0) {
+ pr_err_ratelimited("%s sp_group_add_task failed: %d, pid is %d, spg_id is %d\n",
+ __func__, ret, info.pid, info.spg_id);
+ return ret;
+ }
+
+ info.spg_id = ret;
+ ret = copy_to_user((void __user *)arg, &info, sizeof(struct sp_add_group_info));
+ if (ret) {
+ pr_err("%s copy to user failed: %d\n", __func__, ret);
+ }
+
+ return ret;
+}
+
+static long dev_sp_alloc(unsigned long __user *arg)
+{
+ struct sp_alloc_info info;
+ void *addr;
+ int ret = 0;
+
+ ret = copy_from_user(&info, (void __user *)arg, sizeof(struct sp_alloc_info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ addr = mg_sp_alloc(info.size, info.flag, info.spg_id);
+ if (IS_ERR(addr)) {
+ pr_err_ratelimited("%s sp_alloc failed: %ld\n", __func__, PTR_ERR(addr));
+ return PTR_ERR(addr);
+ }
+
+ info.addr = (unsigned long)addr;
+ ret = copy_to_user((void __user *)arg, &info, sizeof(struct sp_alloc_info));
+ if (ret) {
+ pr_err("%s copy to user failed: %d\n", __func__, ret);
+ ret = mg_sp_free(info.addr, SPG_ID_DEFAULT);
+ if (ret < 0)
+ pr_err("%s sp_free failed: %d\n", __func__, ret);
+ }
+
+ return ret;
+}
+
+static long dev_sp_free(unsigned long __user *arg)
+{
+ struct sp_alloc_info info;
+ int ret = 0;
+
+ ret = copy_from_user(&info, (void __user *)arg, sizeof(struct sp_alloc_info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ ret = mg_sp_free(info.addr, info.spg_id);
+ if (ret < 0)
+ pr_err_ratelimited("%s sp_free failed: %d\n", __func__, ret);
+
+ return ret;
+}
+
+static long dev_sp_u2k(unsigned long __user *arg)
+{
+ struct sp_make_share_info info;
+ void *addr;
+ char *kva;
+ int ret = 0;
+
+ ret = copy_from_user(&info, (void __user *)arg, sizeof(struct sp_make_share_info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ addr = mg_sp_make_share_u2k(info.uva, info.size, info.pid);
+ if (IS_ERR(addr)) {
+ pr_err_ratelimited("%s u2k failed: %ld\n", __func__, PTR_ERR(addr));
+ return PTR_ERR(addr);
+ }
+
+ /* a small, easy checker */
+ if (info.u2k_checker) {
+ kva = (char *)addr;
+ if (kva[0] != 'd' || kva[PAGE_SIZE - 1] != 'c' ||
+ kva[PAGE_SIZE] != 'b' || kva[PAGE_SIZE * 2 - 1] != 'a') {
+ pr_err("%s u2k check normal page failed\n", __func__);
+ return -EFAULT;
+ }
+ }
+ if (info.u2k_hugepage_checker) {
+ kva = (char *)addr;
+ if (kva[0] != 'd' || kva[PMD_SIZE - 1] != 'c' ||
+ kva[PMD_SIZE] != 'b' || kva[PMD_SIZE * 2 - 1] != 'a') {
+ pr_err("%s u2k check hugepage failed\n", __func__);
+ return -EFAULT;
+ }
+ }
+
+ info.addr = (unsigned long)addr;
+ ret = copy_to_user((void __user *)arg, &info, sizeof(struct sp_make_share_info));
+ if (ret) {
+ pr_err("%s copy to user failed: %d\n", __func__, ret);
+ ret = mg_sp_unshare(info.addr, info.size, SPG_ID_DEFAULT);
+ if (ret < 0)
+ pr_err("%s sp_unshare failed: %d\n", __func__, ret);
+ }
+
+ return ret;
+}
+
+static long dev_sp_k2u(unsigned long __user *arg)
+{
+ struct sp_make_share_info info;
+ void *addr;
+ int ret = 0;
+
+ ret = copy_from_user(&info, (void __user *)arg, sizeof(struct sp_make_share_info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ addr = mg_sp_make_share_k2u(info.kva, info.size, info.sp_flags, info.pid, info.spg_id);
+ if (IS_ERR(addr)) {
+ pr_err_ratelimited("%s k2u failed: %ld\n", __func__, PTR_ERR(addr));
+ return PTR_ERR(addr);
+ }
+
+ info.addr = (unsigned long)addr;
+ ret = copy_to_user((void __user *)arg, &info, sizeof(struct sp_make_share_info));
+ if (ret) {
+ pr_err("%s copy to user failed: %d\n", __func__, ret);
+ ret = mg_sp_unshare(info.addr, info.size, SPG_ID_DEFAULT);
+ if (ret < 0)
+ pr_err("%s sp_unshare failed: %d\n", __func__, ret);
+ }
+
+ return ret;
+}
+
+static long dev_sp_unshare(unsigned long __user *arg)
+{
+ struct sp_make_share_info info;
+ int ret = 0;
+
+ ret = copy_from_user(&info, (void __user *)arg, sizeof(struct sp_make_share_info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ ret = mg_sp_unshare(info.addr, info.size, info.spg_id);
+
+ if (ret < 0)
+ pr_err_ratelimited("%s sp_unshare failed: %d\n", __func__, ret);
+
+ return ret;
+}
+
+static long dev_sp_find_group_by_pid(unsigned long __user *arg)
+{
+ struct sp_group_id_by_pid_info info;
+ int ret = 0, num;
+ int spg_ids[1000]; // 假设用户只加不超过1000个组
+ int *pspg_ids = spg_ids;
+ int *pnum = #
+
+ ret = copy_from_user(&info, (void __user *)arg, sizeof(info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ if (info.num) {
+ if (get_user(num, info.num)) {
+ pr_err("get num from user failed\n");
+ return -EFAULT;
+ }
+ } else
+ pnum = NULL;
+
+ if (!info.spg_ids)
+ pspg_ids = NULL;
+
+ ret = mg_sp_group_id_by_pid(info.pid, pspg_ids, pnum);
+ if (ret < 0) {
+ pr_err_ratelimited("%s sp_group_id_by_pid failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ ret = copy_to_user(info.spg_ids, spg_ids, sizeof(int) * num);
+ if (ret) {
+ pr_err("copy spg_ids to user failed\n");
+ return -EFAULT;
+ }
+
+ if (put_user(num, info.num)) {
+ pr_err("put num to user failed\n");
+ return -EFAULT;
+ }
+
+ return ret;
+}
+
+static long dev_sp_walk_page_range(unsigned long __user *arg)
+{
+ int ret = 0;
+ struct sp_walk_data wdata;
+ struct sp_walk_page_range_info wpinfo;
+
+ ret = copy_from_user(&wpinfo, arg, sizeof(wpinfo));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ ret = mg_sp_walk_page_range(wpinfo.uva, wpinfo.size, current, &wdata);
+ if (ret < 0) {
+ pr_err_ratelimited("%s sp_walk_page_range failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ wpinfo.pages = wdata.pages;
+ wpinfo.page_count = wdata.page_count;
+ wpinfo.uva_aligned = wdata.uva_aligned;
+ wpinfo.page_size = wdata.page_size;
+ wpinfo.is_hugepage = wdata.is_hugepage;
+ ret = copy_to_user(arg, &wpinfo, sizeof(wpinfo));
+ if (ret < 0) {
+ pr_err("%s copy to user failed, %d", __func__, ret);
+ mg_sp_walk_page_free(&wdata);
+ }
+
+ return ret;
+}
+
+static long dev_sp_walk_page_free(unsigned long __user *arg)
+{
+ struct sp_walk_page_range_info wpinfo;
+ struct sp_walk_data wdata;
+ int ret = copy_from_user(&wpinfo, arg, sizeof(wpinfo));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ wdata.pages = wpinfo.pages,
+ wdata.page_count = wpinfo.page_count,
+ wdata.uva_aligned = wpinfo.uva_aligned,
+ wdata.page_size = wpinfo.page_size,
+ wdata.is_hugepage = wpinfo.is_hugepage,
+ mg_sp_walk_page_free(&wdata);
+
+ return 0;
+}
+
+static long dev_check_memory_node(unsigned long arg)
+{
+ int ret, i;
+ struct sp_walk_data wdata;
+ struct check_memory_node info;
+
+ ret = copy_from_user(&info, (void __user *)arg, sizeof(info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ ret = mg_sp_walk_page_range(info.uva, info.len, current, &wdata);
+ if (ret < 0) {
+ pr_err_ratelimited("%s sp_walk_page_range failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ for (i = 0; i < wdata.page_count; i++) {
+ struct page *page = wdata.pages[i];
+
+ if (page_to_nid(page) != info.node) {
+ pr_err("check nid failed, i:%d, expect:%d, actual:%d\n",
+ i, info.node, page_to_nid(page));
+ ret = -EINVAL;
+ goto out;
+ }
+ }
+
+out:
+ mg_sp_walk_page_free(&wdata);
+
+ return ret;
+}
+
+static long dev_sp_judge_addr(unsigned long __user *arg)
+{
+ unsigned long addr;
+ int ret = 0;
+
+ ret = copy_from_user(&addr, (void __user *)arg, sizeof(unsigned long));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ ret = mg_is_sharepool_addr(addr);
+
+ return ret;
+}
+
+static long dev_vmalloc(unsigned long __user *arg)
+{
+ struct vmalloc_info info;
+ char *addr;
+ int ret = 0;
+
+ ret = copy_from_user(&info, (void __user *)arg, sizeof(struct vmalloc_info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ addr = vmalloc_user(info.size);
+ if (IS_ERR(addr)) {
+ pr_err("%s k2u failed: %ld\n", __func__, PTR_ERR(addr));
+ return PTR_ERR(addr);
+ }
+ /* be convenient for k2u, we set some values in the first two page */
+ if (info.size >= PAGE_SIZE) {
+ addr[0] = 'a';
+ addr[PAGE_SIZE - 1] = 'b';
+ }
+ if (info.size >= 2 * PAGE_SIZE) {
+ addr[PAGE_SIZE] = 'c';
+ addr[2 * PAGE_SIZE - 1] = 'd';
+ }
+
+ info.addr = (unsigned long)addr;
+ ret = copy_to_user((void __user *)arg, &info, sizeof(struct vmalloc_info));
+ if (ret) {
+ pr_err("%s copy to user failed: %d\n", __func__, ret);
+ vfree(addr);
+ }
+
+ return ret;
+}
+
+static long dev_kmalloc(unsigned long __user *arg)
+{
+ struct vmalloc_info info;
+ char *addr;
+ int ret = 0;
+
+ ret = copy_from_user(&info, (void __user *)arg, sizeof(struct vmalloc_info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ addr = kmalloc(info.size, GFP_KERNEL);
+ if (IS_ERR(addr)) {
+ pr_err("%s kmalloc failed: %ld\n", __func__, PTR_ERR(addr));
+ return PTR_ERR(addr);
+ }
+
+ info.addr = (unsigned long)addr;
+ ret = copy_to_user((void __user *)arg, &info, sizeof(struct vmalloc_info));
+ if (ret) {
+ pr_err("%s copy to user failed: %d\n", __func__, ret);
+ vfree(addr);
+ }
+
+ return ret;
+}
+
+static long dev_vmalloc_hugepage(unsigned long __user *arg)
+{
+ struct vmalloc_info info;
+ char *addr;
+ int ret = 0;
+
+ ret = copy_from_user(&info, (void __user *)arg, sizeof(struct vmalloc_info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ addr = vmalloc_hugepage_user(info.size);
+ if (IS_ERR(addr)) {
+ pr_err("%s k2u failed: %ld\n", __func__, PTR_ERR(addr));
+ return PTR_ERR(addr);
+ }
+ /* be convenient for k2u, we set some values in the first two hugepage */
+ if (info.size >= PMD_SIZE) {
+ addr[0] = 'a';
+ addr[PMD_SIZE - 1] = 'b';
+ }
+ if (info.size >= 2 * PMD_SIZE) {
+ addr[PMD_SIZE] = 'c';
+ addr[2 * PMD_SIZE - 1] = 'd';
+ }
+
+
+ info.addr = (unsigned long)addr;
+ ret = copy_to_user((void __user *)arg, &info, sizeof(struct vmalloc_info));
+ if (ret) {
+ pr_err("%s copy to user failed: %d\n", __func__, ret);
+ vfree(addr);
+ }
+
+ return ret;
+}
+
+static long dev_vfree(unsigned long __user *arg)
+{
+ struct vmalloc_info info;
+ int ret = 0;
+
+ ret = copy_from_user(&info, (void __user *)arg, sizeof(struct vmalloc_info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ vfree((void *)info.addr);
+
+ return 0;
+}
+
+static long dev_kfree(unsigned long __user *arg)
+{
+ struct vmalloc_info info;
+ int ret = 0;
+
+ ret = copy_from_user(&info, (void __user *)arg, sizeof(struct vmalloc_info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ kfree((void *)info.addr);
+
+ return 0;
+}
+
+static int kern_addr_check(unsigned long addr)
+{
+ /* TODO: */
+ if (!addr)
+ return 0;
+
+ return 1;
+}
+
+static long dev_karea_access(const void __user *arg)
+{
+ int ret, i;
+ struct karea_access_info info;
+
+ ret = copy_from_user(&info, arg, sizeof(info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ if (!kern_addr_check(info.addr)) {
+ pr_err("%s kaddr check failed\n", __func__);
+ return -EFAULT;
+ }
+
+ if (info.mod == KAREA_CHECK) {
+ for (i = 0; i < info.size; i++)
+ if (*(char *)info.addr != info.value)
+ return -EINVAL;
+ } else
+ memset((void *)info.addr, info.value, info.size);
+
+ return 0;
+}
+
+static long dev_sp_config_dvpp_range(const void __user *arg)
+{
+ struct sp_config_dvpp_range_info info;
+
+ int ret = copy_from_user(&info, arg, sizeof(info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ return mg_sp_config_dvpp_range(info.start, info.size, info.device_id, info.pid) ? 0 : 1;
+}
+
+int func1(struct notifier_block *nb, unsigned long action, void *data)
+{
+ pr_info("%s is triggered", __FUNCTION__);
+ return 0;
+}
+
+int func2(struct notifier_block *nb, unsigned long action, void *data)
+{
+ pr_info("%s is triggered", __FUNCTION__);
+
+ /*
+ if (spg->id == 2)
+ pr_info("sp group 2 exits.");
+ else
+ pr_info("sp group %d exits, skipped by %s", spg->id, __FUNCTION__);
+*/
+ return 0;
+}
+
+static struct notifier_block nb1 = {
+ .notifier_call = func1,
+};
+static struct notifier_block nb2 = {
+ .notifier_call = func2,
+};
+
+static long dev_register_notifier_block(unsigned long __user *arg)
+{
+ return 0;
+#if 0
+ // 注册一个notifier block chain
+ struct sp_notifier_block_info info;
+
+ int ret = copy_from_user(&info, arg, sizeof(info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ if (info.i == 1) {
+ ret = sp_register_notifier(&nb1);
+ if (ret != 0)
+ pr_info("register func1 failed, errno is %d", ret);
+ else
+ pr_info("register notifier for func 1 success.");
+ }
+ else if (info.i == 2) {
+ ret = sp_register_notifier(&nb2);
+ if (ret != 0)
+ pr_info("register func2 failed, errno is %d", ret);
+ else
+ pr_info("register notifier for func 2 success.");
+ } else {
+ pr_info("not valid user arg");
+ ret = -1;
+ }
+
+ return ret;
+#endif
+}
+
+static long dev_unregister_notifier_block(unsigned long __user *arg)
+{
+ return 0;
+#if 0
+ // 取消注册一个notifier block chain
+ struct sp_notifier_block_info info;
+
+ int ret = copy_from_user(&info, arg, sizeof(info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+ if (info.i == 1) {
+ ret = sp_unregister_notifier(&nb1);
+ if (ret != 0)
+ pr_info("unregister func1 failed, errno is %d", ret);
+ else
+ pr_info("unregister func1 success.");
+ }
+ else if (info.i == 2) {
+ ret = sp_unregister_notifier(&nb2);
+ if (ret != 0)
+ pr_info("unregister func2 failed, errno is %d", ret);
+ else
+ pr_info("unregister func2 success.");
+ }
+ else {
+ pr_info("not valid user arg");
+ ret = -1;
+ }
+
+ return ret;
+#endif
+}
+
+static long dev_sp_del_from_group(unsigned long __user *arg)
+{
+ return 0;
+#if 0
+ struct sp_del_from_group_info info;
+ int ret = 0;
+
+ ret = copy_from_user(&info, (void __user *)arg, sizeof(struct sp_del_from_group_info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ ret = mg_sp_group_del_task(info.pid, info.spg_id);
+ if (ret < 0) {
+ pr_err_ratelimited("%s sp_group_del_task failed: %d, pid is %d, spg_id is %d\n",
+ __func__, ret, info.pid, info.spg_id);
+ return ret;
+ }
+
+ ret = copy_to_user((void __user *)arg, &info, sizeof(struct sp_del_from_group_info));
+ if (ret) {
+ pr_err("%s copy to user failed: %d\n", __func__, ret);
+ }
+
+ return ret;
+#endif
+}
+
+static long dev_sp_id_of_curr(unsigned long __user *arg)
+{
+ int ret, spg_id;
+ struct sp_id_of_curr_info info;
+
+ spg_id = mg_sp_id_of_current();
+ if (spg_id <= 0) {
+ pr_err("get id of current failed %d\n", spg_id);
+ return spg_id;
+ }
+
+ info.spg_id = spg_id;
+ ret = copy_to_user((void __user *)arg, &info, sizeof(struct sp_id_of_curr_info));
+ if (ret)
+ pr_err("%s copy to user failed: %d\n", __func__, ret);
+
+ return ret;
+}
+
+/*
+ * 底软调用场景：
+ * 1. A进程调用mmap，申请地址空间，指定驱动的设备文件
+ * 2. B进程（host进程）下发任务给A进程
+ * 3. 由B触发，在device侧用一worker线程给A分配内存和建立页表(mm是在mmap内核回调中保存的)，没有
+ * 在mmap中申请内存是因为到这一点才会真正使用到内存。
+ * 4. 内存的释放时单独提供了一个ioctl接口
+ *
+ * 申请大页并映射到用户态进程
+ * 1. 如果没有指定addr(NULL)，则调用vm_mmap为进程申请内存，否则用指定的addr，用户自己指定地址时需要保证2M对齐
+ * 2. remote，是否在当前进程中调用内存申请和建立页表
+ */
+static long dev_alloc_huge_memory(struct file *file, void __user *arg)
+{
+ return -EFAULT;
+#if 0
+ int ret;
+ unsigned long addr, off, size;
+ struct vm_area_struct *vma;
+ struct alloc_huge_memory alloc_info;
+ struct page **pages;
+
+ ret = copy_from_user(&alloc_info, arg, sizeof(alloc_info));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return -EFAULT;
+ }
+
+ size = ALIGN(alloc_info.size, PMD_SIZE);
+ // TODO: 入参检查
+ if (!alloc_info.addr) {
+ /*
+ * 对用户态做大页映射的时候必须要2M对齐，所以对申请的虚拟地址多申请了2M，方便后面做对齐处理
+ */
+ addr = vm_mmap(file, 0, size + PMD_SIZE, PROT_READ | PROT_WRITE,
+ MAP_SHARED, 0);
+ if ((long)addr < 0) {
+ pr_err("vm_mmap failed, %ld\n", (long)addr);
+ return addr;
+ }
+ addr = ALIGN(addr, PMD_SIZE);
+ } else
+ addr = alloc_info.addr;
+
+ vma = find_vma(current->mm, addr);
+ if (!range_in_vma(vma, addr, addr + size)) {
+ pr_err("invalid address\n");
+ return -EINVAL;
+ }
+
+ pages = kzalloc((size / PMD_SIZE + 1) * sizeof(*pages), GFP_KERNEL);
+ if (!pages) {
+ pr_err("alloc vma private pages array failed\n");
+ return -ENOMEM;
+ }
+ vma->vm_private_data = pages;
+
+ for (off = 0; off < size; off += PMD_SIZE) {
+ struct page *page;
+
+ page = hugetlb_alloc_hugepage(alloc_info.nid, alloc_info.flags);
+ if (!page) {
+ pr_err("alloc hugepage failed, nid:%d, flags:%d\n", alloc_info.nid, alloc_info.flags);
+ return -ENOMEM; // TODO: 资源清理
+ }
+ *(pages++) = page;
+
+ ret = hugetlb_insert_hugepage_pte_by_pa(current->mm, addr + off,
+ __pgprot(pgprot_val(vma->vm_page_prot) & ~PTE_RDONLY), page_to_phys(page));
+ if (ret < 0) {
+ pr_err("insert hugepage failed, %d\n", ret);
+ return ret; // TODO: 资源清理
+ }
+ // 没有下面一行会导致用户进程退出的时候报BadRss错误，原因是走进程默认的释放页表
+ // 的流程会减去此处建立的大页映射，加上下面这一行会导致用例在5.10上面ko插入失败，
+ // 因为有符号没有导出
+ //add_mm_counter(current->mm, mm_counter_file(page), HPAGE_PMD_NR);
+ }
+
+ if (!alloc_info.addr) {
+ alloc_info.addr = addr;
+ if (copy_to_user(arg, &alloc_info, sizeof(alloc_info))) {
+ pr_err("copy_to_user failed\n");
+ return -EFAULT; // TODO: 资源清理
+ }
+ }
+
+ return 0;
+#endif
+}
+
+static unsigned long test_alloc_hugepage(unsigned long size, int nid,
+ nodemask_t *nodemask)
+{
+ pr_err_ratelimited("test_alloc_hugepage: execute succ.\n");
+ return -ENOMEM;
+}
+
+static long dev_hpage_reg_test_suite(void *arg)
+{
+ int ret;
+
+ ret = sp_register_hugepage_allocator(NULL);
+ if (ret != -EINVAL) {
+ pr_err_ratelimited("%s expect return -EINVAL, but return %d\n", __func__, ret);
+ return -EINVAL;
+ }
+
+ /* First call succeeds */
+ ret = sp_register_hugepage_allocator(test_alloc_hugepage);
+ if (ret != 0) {
+ pr_err_ratelimited("%s expect return 0, but return %d\n", __func__, ret);
+ return -EINVAL;
+ }
+
+ /* Second call fails with -EBUSY */
+ ret = sp_register_hugepage_allocator(test_alloc_hugepage);
+ if (ret != -EBUSY) {
+ pr_err_ratelimited("%s expect return -EBUSY, but return %d\n", __func__, ret);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
+static long dev_hpage_reg_after_alloc(void *arg)
+{
+ int ret;
+
+ ret = sp_register_hugepage_allocator(test_alloc_hugepage);
+ if (ret != -EBUSY) {
+ pr_err_ratelimited("%s expect return -EBUSY, but return %d\n", __func__, ret);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
+static long dev_hpage_reg_exec(void *arg)
+{
+ int ret;
+
+ ret = sp_register_hugepage_allocator(test_alloc_hugepage);
+ if (ret != 0) {
+ pr_err_ratelimited("%s expect return 0, but return %d\n", __func__, ret);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
+/*int this func wdata == NULL*/
+static long dev_sp_walk_page_range_null(unsigned long __user *arg)
+{
+ int ret = 0;
+ struct sp_walk_page_range_info wpinfo;
+
+ ret = copy_from_user(&wpinfo, arg, sizeof(wpinfo));
+ if (ret) {
+ pr_err("%s copy from user failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ ret = mg_sp_walk_page_range(wpinfo.uva, wpinfo.size, current, NULL);
+ if (ret < 0) {
+ pr_err_ratelimited("%s sp_walk_page_range failed: %d\n", __func__, ret);
+ return ret;
+ }
+
+ return ret;
+}
+
+long dev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+ int ret = 0;
+
+ if (!arg)
+ return -EINVAL;
+
+ switch (cmd) {
+ case SP_IOCTL_ADD_GROUP:
+ ret = dev_sp_add_group((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_ALLOC:
+ ret = dev_sp_alloc((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_FREE:
+ ret = dev_sp_free((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_U2K:
+ ret = dev_sp_u2k((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_K2U:
+ ret = dev_sp_k2u((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_UNSHARE:
+ ret = dev_sp_unshare((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_FIND_GROUP_BY_PID:
+ ret = dev_sp_find_group_by_pid((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_WALK_PAGE_RANGE:
+ ret = dev_sp_walk_page_range((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_WALK_PAGE_FREE:
+ ret = dev_sp_walk_page_free((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_CHECK_MEMORY_NODE:
+ ret = dev_check_memory_node(arg);
+ break;
+ case SP_IOCTL_JUDGE_ADDR:
+ ret = dev_sp_judge_addr((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_VMALLOC:
+ ret = dev_vmalloc((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_VMALLOC_HUGEPAGE:
+ ret = dev_vmalloc_hugepage((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_VFREE:
+ ret = dev_vfree((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_KACCESS:
+ ret = dev_karea_access((void __user *)arg);
+ break;
+ case SP_IOCTL_CONFIG_DVPP_RANGE:
+ ret = dev_sp_config_dvpp_range((void __user *)arg);
+ break;
+ case SP_IOCTL_REGISTER_NOTIFIER_BLOCK:
+ ret = dev_register_notifier_block((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_UNREGISTER_NOTIFIER_BLOCK:
+ ret = dev_unregister_notifier_block((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_DEL_FROM_GROUP:
+ ret = dev_sp_del_from_group((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_ID_OF_CURRENT:
+ ret = dev_sp_id_of_curr((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_ALLOC_HUGE_MEMORY:
+ ret = dev_alloc_huge_memory(file, (unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_WALK_PAGE_RANGE_NULL:
+ ret = dev_sp_walk_page_range_null((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_KTHREAD_START:
+ ret = dev_sp_kthread_start((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_KTHREAD_END:
+ ret = dev_sp_kthread_end((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_KMALLOC:
+ ret = dev_kmalloc((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_KFREE:
+ ret = dev_kfree((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_HPAGE_REG_TESTSUITE:
+ ret = dev_hpage_reg_test_suite((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_HPAGE_REG_AFTER_ALLOC:
+ ret = dev_hpage_reg_after_alloc((unsigned long __user *)arg);
+ break;
+ case SP_IOCTL_HPAGE_REG_EXEC:
+ ret = dev_hpage_reg_exec((unsigned long __user *)arg);
+ break;
+ default:
+ ret = -EINVAL;
+ }
+
+ return ret;
+}
+#if 0
+static void sp_vm_close(struct vm_area_struct *vma)
+{
+ struct page **pages = vma->vm_private_data;
+ if (!pages)
+ return;
+
+ for (; *pages; pages++)
+ put_page(*pages);
+
+ kfree(vma->vm_private_data);
+ vma->vm_private_data = NULL;
+}
+
+static struct vm_operations_struct sp_vm_ops = {
+ .close = sp_vm_close,
+};
+
+#define VM_HUGE_SPECIAL 0x800000000
+static int dev_mmap(struct file *file, struct vm_area_struct *vma)
+{
+ pr_info("wws: vma range: [%#lx, %#lx], vm_mm:%pK\n", vma->vm_start, vma->vm_end, vma->vm_mm);
+ // 标记这个VMA建立的是大页映射，在4.19上面使用，在u2k流程中walk_page_range的时候使用到
+ vma->vm_flags |= VM_HUGE_SPECIAL;
+ vma->vm_flags |= VM_DONTCOPY; // mmap 的设备内存不需要fork，否则需要特殊处理
+ vma->vm_ops = &sp_vm_ops;
+ return 0;
+}
+#endif
+
+struct file_operations fops = {
+ .owner = THIS_MODULE,
+ .open = dev_open,
+ .unlocked_ioctl = dev_ioctl,
+// .mmap = dev_mmap,
+};
+
+/*
+ * before userspace use: mknod DEVICE_FILE_NAME c MAJOR_NUM 0
+ * e.g. insmod sharepool_dev.ko && mknod sharepool_dev c 100 0
+ */
+static int __init dev_init_module(void)
+{
+ int ret;
+
+ ret = register_chrdev(MAJOR_NUM, DEVICE_FILE_NAME, &fops);
+
+ if (ret < 0) {
+ pr_err("error in sharepool_init_module: %d\n", ret);
+ return ret;
+ }
+
+ pr_info("register share pool device success. the major device number is %d\n", MAJOR_NUM);
+ return 0;
+}
+
+static void __exit dev_cleanup_module(void)
+{
+ unregister_chrdev(MAJOR_NUM, DEVICE_FILE_NAME);
+}
+
+module_init(dev_init_module);
+module_exit(dev_cleanup_module);
+
+MODULE_DESCRIPTION("share pool device driver");
+MODULE_LICENSE("GPL v2");
+
diff --git a/tools/testing/sharepool/module/sharepool_dev.h b/tools/testing/sharepool/module/sharepool_dev.h
new file mode 100644
index 000000000000..769d1cc12f57
--- /dev/null
+++ b/tools/testing/sharepool/module/sharepool_dev.h
@@ -0,0 +1,149 @@
+/*
+ * sharepool_dev.h - the header file with the ioctl definitions.
+ *
+ * The declarations here have to be in a header file, because
+ * they need to be known both to the kernel module
+ * (in sharepool_dev.c) and the process / shared lib calling ioctl.
+ */
+
+#ifndef SHAREPOOL_DEV_H
+#define SHAREPOOL_DEV_H
+
+#include <linux/ioctl.h>
+
+/* major num can be changed when necessary */
+#define MAJOR_NUM 100
+
+#define DEVICE_FILE_NAME "sharepool_dev"
+struct sp_kthread_info {
+ unsigned long addr;
+ unsigned long size;
+ int spg_id;
+ int type;
+};
+
+struct sp_add_group_info {
+ int pid;
+ int prot;
+ int spg_id;
+ unsigned long flag;
+};
+
+struct sp_alloc_info {
+ unsigned long addr; /* return value */
+ unsigned long size;
+ unsigned long flag;
+ int spg_id;
+};
+
+struct sp_make_share_info {
+ unsigned long addr; /* return value */
+ unsigned long uva; /* for u2k */
+ unsigned long kva; /* for k2u */
+ unsigned long size;
+ unsigned long sp_flags; /* for k2u */
+ int pid;
+ int spg_id;
+ bool u2k_checker;
+ bool u2k_hugepage_checker;
+};
+
+struct sp_walk_page_range_info {
+ unsigned long uva;
+ unsigned long size;
+ struct page **pages;
+ unsigned int page_count;
+ unsigned long uva_aligned;
+ unsigned long page_size;
+ bool is_hugepage;
+};
+
+/* for vmalloc_user and vmalloc_hugepage_user */
+struct vmalloc_info {
+ unsigned long addr;
+ unsigned long size;
+};
+
+#define KAREA_CHECK 0
+#define KAREA_SET 1
+struct karea_access_info {
+ int mod;
+ char value;
+ unsigned long addr;
+ unsigned long size;
+};
+
+struct sp_config_dvpp_range_info {
+ unsigned long start;
+ unsigned long size;
+ int device_id; // must be zero
+ int pid;
+};
+
+struct sp_group_id_by_pid_info {
+ int pid;
+ int *spg_ids;
+ int *num;
+};
+
+struct sp_notifier_block_info {
+ int i;
+};
+
+struct sp_del_from_group_info {
+ int pid;
+ int spg_id;
+};
+
+struct sp_id_of_curr_info {
+ int spg_id;
+};
+
+#define HUGETLB_ALLOC_NONE 0x00
+#define HUGETLB_ALLOC_NORMAL 0x01 /* normal hugepage */
+#define HUGETLB_ALLOC_BUDDY 0x02 /* buddy hugepage */
+
+struct alloc_huge_memory {
+ int nid; // nid
+ int flags; // 申请大页的类型，0,1,2
+ unsigned long addr; // 返回地址
+ unsigned long size; // 申请大小
+};
+
+struct check_memory_node {
+ unsigned long uva;
+ unsigned long len;
+ int node;
+};
+
+#define SP_IOCTL_ADD_GROUP _IOWR(MAJOR_NUM, 0, struct sp_add_group_info *)
+#define SP_IOCTL_ALLOC _IOWR(MAJOR_NUM, 1, struct sp_alloc_info *)
+#define SP_IOCTL_FREE _IOW(MAJOR_NUM, 2, struct sp_alloc_info *)
+#define SP_IOCTL_U2K _IOWR(MAJOR_NUM, 3, struct sp_u2k_info *)
+#define SP_IOCTL_K2U _IOWR(MAJOR_NUM, 4, struct sp_k2u_info *)
+#define SP_IOCTL_UNSHARE _IOW(MAJOR_NUM, 5, struct sp_unshare_info *)
+#define SP_IOCTL_FIND_GROUP_BY_PID _IOWR(MAJOR_NUM, 6, struct sp_group_id_by_pid_info *)
+#define SP_IOCTL_WALK_PAGE_RANGE _IOWR(MAJOR_NUM, 7, struct sp_walk_page_range_info *)
+#define SP_IOCTL_WALK_PAGE_FREE _IOW(MAJOR_NUM, 8, struct sp_walk_page_range_info *)
+#define SP_IOCTL_JUDGE_ADDR _IOW(MAJOR_NUM, 9, unsigned long)
+#define SP_IOCTL_VMALLOC _IOWR(MAJOR_NUM, 10, struct vmalloc_info *)
+#define SP_IOCTL_VMALLOC_HUGEPAGE _IOWR(MAJOR_NUM, 11, struct vmalloc_info *)
+#define SP_IOCTL_VFREE _IOW(MAJOR_NUM, 12, struct vmalloc_info *)
+#define SP_IOCTL_KACCESS _IOW(MAJOR_NUM, 13, struct karea_access_info *)
+#define SP_IOCTL_CONFIG_DVPP_RANGE _IOW(MAJOR_NUM, 14, struct sp_config_dvpp_range_info *)
+#define SP_IOCTL_REGISTER_NOTIFIER_BLOCK _IOWR(MAJOR_NUM, 15, struct sp_notifier_block_info *)
+#define SP_IOCTL_DEL_FROM_GROUP _IOWR(MAJOR_NUM, 16, struct sp_del_from_group_info *)
+#define SP_IOCTL_ID_OF_CURRENT _IOW(MAJOR_NUM, 17, struct sp_id_of_curr_info *)
+#define SP_IOCTL_ALLOC_HUGE_MEMORY _IOWR(MAJOR_NUM, 18, struct alloc_huge_memory)
+#define SP_IOCTL_CHECK_MEMORY_NODE _IOW(MAJOR_NUM, 19, struct check_memory_node)
+#define SP_IOCTL_UNREGISTER_NOTIFIER_BLOCK _IOWR(MAJOR_NUM, 20, struct sp_notifier_block_info *)
+#define SP_IOCTL_WALK_PAGE_RANGE_NULL _IOWR(MAJOR_NUM, 21, struct sp_walk_page_range_info *)
+#define SP_IOCTL_KTHREAD_START _IOWR(MAJOR_NUM, 22, struct sp_kthread_info *)
+#define SP_IOCTL_KTHREAD_END _IOWR(MAJOR_NUM, 23, struct sp_kthread_info *)
+#define SP_IOCTL_KMALLOC _IOWR(MAJOR_NUM, 24, struct vmalloc_info *)
+#define SP_IOCTL_KFREE _IOW(MAJOR_NUM, 25, struct vmalloc_info *)
+#define SP_IOCTL_HPAGE_REG_TESTSUITE _IOW(MAJOR_NUM, 26, void *)
+#define SP_IOCTL_HPAGE_REG_AFTER_ALLOC _IOW(MAJOR_NUM, 27, void *)
+#define SP_IOCTL_HPAGE_REG_EXEC _IOW(MAJOR_NUM, 28, void *)
+#endif
+
diff --git a/tools/testing/sharepool/test.sh b/tools/testing/sharepool/test.sh
new file mode 100755
index 000000000000..0f00c8b21248
--- /dev/null
+++ b/tools/testing/sharepool/test.sh
@@ -0,0 +1,55 @@
+#!/bin/sh
+
+set -x
+
+trap "rmmod sharepool_dev && rm -f sharepool_dev && echo 0 > /proc/sys/vm/nr_overcommit_hugepages" EXIT
+
+insmod sharepool_dev.ko
+if [ $? -ne 0 ] ;then
+ echo "insmod failed"
+ exit 1
+fi
+mknod sharepool_dev c 100 0
+
+if uname -r | grep "^6.6" > /dev/null ; then
+ echo 10000000 > /proc/sys/vm/nr_overcommit_hugepages
+fi
+export LD_LIBRARY_PATH=.
+
+# 运行维测监控进程
+./test_mult_process/test_debug_loop > debug.log &
+
+testlist="test_all api_test.sh function_test.sh scenario_test.sh dts_bugfix_test.sh test_mult_process.sh"
+
+while getopts "as" opt; do
+ case $opt in
+ a)
+ # -a 全量测试（含压力测试）
+ testlist="$testlist stress_test.sh"
+ ;;
+ s)
+ # -s 仅压力测试
+ testlist="stress_test.sh"
+ ;;
+ \?)
+ echo "用法: $0 [-a] [-s]"
+ exit 1
+ ;;
+ esac
+done
+
+for line in $testlist
+do
+ ./$line
+ if [ $? -ne 0 ] ;then
+ echo "testcase $line failed"
+ killall test_debug_loop
+ exit 1
+ fi
+done
+
+killall test_debug_loop
+echo ">>>> SHAREPOOL ALL TESTCASES FINISH <<<<"
+
+# 异常调用场景用例
+#./reliability_test.sh
diff --git a/tools/testing/sharepool/test_end.sh b/tools/testing/sharepool/test_end.sh
new file mode 100755
index 000000000000..6231046db778
--- /dev/null
+++ b/tools/testing/sharepool/test_end.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -x
+rmmod sharepool_dev.ko
+rm -rf sharepool_dev
+
+if uname -r | grep "^6.6" > /dev/null ; then
+ echo 0 > /proc/sys/vm/nr_overcommit_hugepages
+fi
diff --git a/tools/testing/sharepool/test_loop.sh b/tools/testing/sharepool/test_loop.sh
new file mode 100755
index 000000000000..94789c720755
--- /dev/null
+++ b/tools/testing/sharepool/test_loop.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+let i=1
+
+while true
+do
+ echo ================= TEST NO. $i ===============
+ let i++
+
+ ./test.sh
+ if [ $? -ne 0 ]
+ then
+ echo test failed
+ exit 1
+ fi
+
+ sleep 3 # dropping spa and spg may have latency
+ free -m
+
+ ret=`cat /proc/sharepool/spa_stat | wc -l`
+ if [ $ret -ge 15 ]
+ then
+ cat /proc/sharepool/spa_stat
+ echo spa_stat not clean
+ exit 1
+ fi
+
+ ret=`cat /proc/sharepool/proc_stat | wc -l`
+ if [ $ret -ge 15 ]
+ then
+ cat /proc/sharepool/proc_stat
+ echo proc_stat not clean
+ exit 1
+ fi
+done
diff --git a/tools/testing/sharepool/test_prepare.sh b/tools/testing/sharepool/test_prepare.sh
new file mode 100755
index 000000000000..72392a5b0aff
--- /dev/null
+++ b/tools/testing/sharepool/test_prepare.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -x
+mknod sharepool_dev c 100 0
+insmod sharepool_dev.ko
+
+if uname -r | grep "^6.6" > /dev/null ; then
+ echo 10000000 > /proc/sys/vm/nr_overcommit_hugepages
+fi
diff --git a/tools/testing/sharepool/testcase/Makefile b/tools/testing/sharepool/testcase/Makefile
new file mode 100644
index 000000000000..d40d1b325142
--- /dev/null
+++ b/tools/testing/sharepool/testcase/Makefile
@@ -0,0 +1,12 @@
+MODULEDIR:=test_all test_mult_process api_test function_test reliability_test performance_test dts_bugfix_test scenario_test stress_test
+
+export CC:=$(CROSS_COMPILE)gcc $(sharepool_extra_ccflags)
+
+all:tooldir
+
+tooldir:
+ for n in $(MODULEDIR); do $(MAKE) CC="$(CC) $(sharepool_extra_ccflags)" -C $$n; done
+install:
+ for n in $(MODULEDIR); do $(MAKE) -C $$n install; done
+clean:
+ for n in $(MODULEDIR); do $(MAKE) -C $$n clean; done
diff --git a/tools/testing/sharepool/testcase/api_test/Makefile b/tools/testing/sharepool/testcase/api_test/Makefile
new file mode 100644
index 000000000000..664007daa9e6
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/Makefile
@@ -0,0 +1,14 @@
+MODULEDIR:=is_sharepool_addr sp_alloc sp_config_dvpp_range sp_free sp_group_add_task sp_group_id_by_pid sp_make_share_k2u sp_make_share_u2k sp_unshare sp_walk_page_range_and_free sp_id_of_current sp_numa_maps
+
+manual_test:=test_sp_config_dvpp_range
+
+all:tooldir
+
+tooldir:
+ for n in $(MODULEDIR); do $(MAKE) -C $$n; done
+install:
+ mkdir -p $(TOOL_BIN_DIR)/api_test && cp api_test.sh $(TOOL_BIN_DIR)
+ for n in $(MODULEDIR); do $(MAKE) -C $$n install; done
+ mkdir -p $(TOOL_BIN_DIR)/api_test/manual_test && cd $(TOOL_BIN_DIR)/api_test/ && mv $(manual_test) manual_test && cd -
+clean:
+ for n in $(MODULEDIR); do $(MAKE) -C $$n clean; done
diff --git a/tools/testing/sharepool/testcase/api_test/api_test.sh b/tools/testing/sharepool/testcase/api_test/api_test.sh
new file mode 100755
index 000000000000..29db2e449dea
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/api_test.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+set -x
+
+echo 0 > /proc/sys/vm/sharepool_ac_mode
+
+ls ./api_test | grep -v manual_test | while read line
+do
+ ./api_test/$line
+ if [ $? -ne 0 ] ;then
+ echo "testcase api_test/$line failed"
+ exit 1
+ fi
+ cat /proc/meminfo
+done
diff --git a/tools/testing/sharepool/testcase/api_test/is_sharepool_addr/Makefile b/tools/testing/sharepool/testcase/api_test/is_sharepool_addr/Makefile
new file mode 100644
index 000000000000..592e58e18fc9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/is_sharepool_addr/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/is_sharepool_addr/test_is_sharepool_addr.c b/tools/testing/sharepool/testcase/api_test/is_sharepool_addr/test_is_sharepool_addr.c
new file mode 100644
index 000000000000..3ba63605ed51
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/is_sharepool_addr/test_is_sharepool_addr.c
@@ -0,0 +1,90 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Sat Dec 19 11:29:06 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdbool.h>
+
+#include "sharepool_lib.h"
+
+#define MMAP_SHARE_POOL_START 0xe80000000000UL
+#define MMAP_SHARE_POOL_END 0xf80000000000UL
+
+enum TEST_RESULT {
+ SUCCESS,
+ FAIL
+};
+
+/*
+ * testcase1: 边界值测试：MMAP_SHARE_POOL_START，MMAP_SHARE_POOL_END，预期成功。
+ */
+
+static int testcase1(void)
+{
+ bool judge_ret = 0;
+ judge_ret = ioctl_judge_addr(dev_fd, MMAP_SHARE_POOL_START);
+ if (judge_ret != true)
+ return -1;
+
+ judge_ret = ioctl_judge_addr(dev_fd, MMAP_SHARE_POOL_END);
+ if (judge_ret != false)
+ return -1;
+
+ return 0;
+}
+
+/*
+ * testcase1: DVPP地址测试：dvpp_start, dvpp_start + 10，预期成功。
+ */
+
+static int testcase2(void)
+{
+ struct sp_config_dvpp_range_info cdr_info = {
+ .start = DVPP_BASE + DVPP_16G,
+ .size = DVPP_16G - 1,
+ .device_id = 0,
+ .pid = getpid(),
+ };
+ int ret;
+ bool judge_ret = 0;
+
+ ret = ioctl_config_dvpp_range(dev_fd, &cdr_info);
+
+ if (ret < 0) {
+ pr_info("dvpp config failed. errno: %d", errno);
+ return ret;
+ } else
+ pr_info("dvpp config success.");
+
+ judge_ret = ioctl_judge_addr(dev_fd, cdr_info.start);
+ if (judge_ret != true)
+ return -1;
+
+ judge_ret = ioctl_judge_addr(dev_fd, cdr_info.start + cdr_info.size - 1);
+ if (judge_ret != true)
+ return -1;
+
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE(testcase1, "边界值测试：MMAP_SHARE_POOL_START，MMAP_SHARE_POOL_END，预期成功。")
+ TESTCASE(testcase2, "DVPP地址测试：dvpp_start, dvpp_end - 1，预期成功")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_alloc/Makefile b/tools/testing/sharepool/testcase/api_test/sp_alloc/Makefile
new file mode 100644
index 000000000000..592e58e18fc9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_alloc/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/sp_alloc/test_sp_alloc.c b/tools/testing/sharepool/testcase/api_test/sp_alloc/test_sp_alloc.c
new file mode 100644
index 000000000000..a6cc430f18e6
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_alloc/test_sp_alloc.c
@@ -0,0 +1,543 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 14 16:47:36 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+#define ALIGN_UP(x, align_to) (((x) + ((align_to)-1)) & ~((align_to)-1))
+#define CMD_LEN 100
+#define UNIT 1024
+#define PAGE_NUM 100
+#define HGPAGE_NUM 10
+#define LARGE_PAGE_NUM 1000000
+#define ATOMIC_TEST_SIZE (1024UL * 1024UL * 1024UL) // 1G
+/*
+ * 前置条件：进程先加组。
+ * testcase1: 申请共享组内存，flag为0。预期申请成功。
+ * testcase2: 申请共享组内存，flag为HP，size不对齐。预期申请到对齐大页大小size的内存。
+ * testcase3: 申请共享组内存，flag为HPONLY。预期申请成功，或空间不足时返回ENOMEM。
+ * testcase4: 申请共享组内存，flag为DVPP。预期申请成功，虚拟地址空间范围在dvpp地址空间。
+ * testcase5: 申请共享组内存，flag为DVPP|HP。预期申请到对齐大页大小size的内存，虚拟地址空间范围在dvpp地址空间。
+ * testcase6: 申请共享组内存，flag为DVPP|ONLY。预期申请成功，虚拟地址空间范围在dvpp地址空间，或空间不足时返回ENOMEM。
+ * testcase7: 申请共享组内存，flag非法。预期申请失败，返回EINVAL。
+ * testcase8: size指定为0，远超出物理内存大小。预期申请失败。
+ * testcase9: spg_id为NONE，未使用过的正常范围内数值，DVPP，或超出范围。预期申请失败。
+ * testcase10: 申请指定memory node节点内存，flag中包含用户传入的device id，对应memory node
+ * testcase11: 单进程申请8G，观察维测结构打印是否正常
+ */
+
+static int addgroup(void)
+{
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static int cleanup(struct sp_alloc_info *alloc_info)
+{
+ int ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_free failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static int testcase1(void)
+{
+ int ret;
+ if (addgroup() != 0) {
+ return -1;
+ }
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = PAGE_NUM * PAGE_SIZE,
+ .spg_id = 1,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret != 0) {
+ //pr_info("testcase1 ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+
+ return cleanup(&alloc_info);
+}
+
+static int testcase2(void)
+{
+ int ret;
+ if (addgroup() != 0) {
+ return -1;
+ }
+ struct sp_alloc_info alloc_info = {
+ .flag = SP_HUGEPAGE,
+ .size = (HGPAGE_NUM * PMD_SIZE - 1),
+ .spg_id = 1,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret != 0) {
+ pr_info("testcase2 ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ if (alloc_info.addr != ALIGN_UP(alloc_info.addr, PMD_SIZE)) {
+ pr_info("testcase2 ioctl_alloc addr = %p is not aligned", alloc_info.addr);
+ }
+
+ return cleanup(&alloc_info);
+}
+
+static int testcase3(void)
+{
+ int ret;
+ if (addgroup() != 0) {
+ return -1;
+ }
+ struct sp_alloc_info alloc_info = {
+ .flag = SP_HUGEPAGE,
+ .size = HGPAGE_NUM * PMD_SIZE,
+ .spg_id = 1,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret != 0 && errno == ENOMEM) {
+ //pr_info("testcase3 ioctl_alloc failed as expected, errno: ENOMEM");
+ return 0;
+ } else if (ret != 0) {
+ //pr_info("testcase3 ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+
+ return cleanup(&alloc_info);
+}
+
+static int testcase4(void)
+{
+ int ret;
+ if (addgroup() != 0) {
+ return -1;
+ }
+ struct sp_alloc_info alloc_info = {
+ .flag = SP_DVPP,
+ .size = PAGE_NUM * PAGE_SIZE,
+ .spg_id = 1,
+ };
+
+ unsigned long dvpp_size1;
+ unsigned long dvpp_size2;
+ char cmd[CMD_LEN] = "cat /proc/sharepool/spa_stat | grep \"dvpp size\" | awk '{print $4}'";
+ FILE *p_file1 = NULL;
+ FILE *p_file2 = NULL;
+ if ((p_file1 = popen(cmd, "r")) == NULL) {
+ pr_info("testcase4 popen1 failed");
+ return -1;
+ }
+ fscanf(p_file1, "%lu", &dvpp_size1);
+ pclose(p_file1);
+
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret != 0) {
+ pr_info("testcase4 ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+
+ if ((p_file2 = popen(cmd, "r")) == NULL) {
+ pr_info("testcase4 popen2 failed");
+ return -1;
+ }
+ fscanf(p_file2, "%lu", &dvpp_size2);
+ pclose(p_file2);
+ if ((dvpp_size2 - dvpp_size1) * UNIT != alloc_info.size) {
+ pr_info("testcase4 dvpp_size check failed, dvpp_size1 %lu, dvpp_size2 %lu", dvpp_size1, dvpp_size2);
+ return -1;
+ }
+
+ return cleanup(&alloc_info);
+}
+
+static int testcase5(void)
+{
+ int ret;
+ if (addgroup() != 0) {
+ return -1;
+ }
+ struct sp_alloc_info alloc_info = {
+ .flag = SP_DVPP | SP_HUGEPAGE,
+ .size = (HGPAGE_NUM * PMD_SIZE - 1),
+ .spg_id = 1,
+ };
+
+ unsigned long dvpp_size1;
+ unsigned long dvpp_size2;
+ char cmd[CMD_LEN] = "cat /proc/sharepool/spa_stat | grep \"dvpp size\" | awk '{print $4}'";
+ FILE *p_file1 = NULL;
+ FILE *p_file2 = NULL;
+ if ((p_file1 = popen(cmd, "r")) == NULL) {
+ pr_info("testcase5 popen1 failed");
+ return -1;
+ }
+ fscanf(p_file1, "%lu", &dvpp_size1);
+ pclose(p_file1);
+
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret != 0) {
+ pr_info("testcase5 ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ if (alloc_info.addr != ALIGN_UP(alloc_info.addr, PMD_SIZE)) {
+ pr_info("testcase5 ioctl_alloc addr = %p is not aligned", alloc_info.addr);
+ }
+
+ if ((p_file2 = popen(cmd, "r")) == NULL) {
+ pr_info("testcase5 popen2 failed");
+ return -1;
+ }
+ fscanf(p_file2, "%lu", &dvpp_size2);
+ pclose(p_file2);
+ if ((dvpp_size2 - dvpp_size1) * UNIT != (alloc_info.size + 1)) {
+ pr_info("testcase5 dvpp_size check failed, dvpp_size1 %lu, dvpp_size2 %lu", dvpp_size1, dvpp_size2);
+ return -1;
+ }
+
+ return cleanup(&alloc_info);
+}
+
+static int testcase6(void)
+{
+ int ret;
+ if (addgroup() != 0) {
+ return -1;
+ }
+ struct sp_alloc_info alloc_info = {
+ .flag = SP_DVPP,
+ .size = HGPAGE_NUM * PMD_SIZE,
+ .spg_id = 1,
+ };
+
+ unsigned long dvpp_size1;
+ unsigned long dvpp_size2;
+ char cmd[CMD_LEN] = "cat /proc/sharepool/spa_stat | grep \"dvpp size\" | awk '{print $4}'";
+ FILE *p_file1 = NULL;
+ FILE *p_file2 = NULL;
+ if ((p_file1 = popen(cmd, "r")) == NULL) {
+ pr_info("testcase6 popen1 failed");
+ return -1;
+ }
+ fscanf(p_file1, "%lu", &dvpp_size1);
+ pclose(p_file1);
+
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret != 0 && errno == ENOMEM) {
+ pr_info("testcase6 ioctl_alloc failed as expected, errno: ENOMEM");
+ return 0;
+ } else if (ret != 0) {
+ pr_info("testcase6 ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ if ((p_file2 = popen(cmd, "r")) == NULL) {
+ pr_info("testcase6 popen2 failed");
+ return -1;
+ }
+ fscanf(p_file2, "%lu", &dvpp_size2);
+ pclose(p_file2);
+ if ((dvpp_size2 - dvpp_size1) * UNIT != alloc_info.size) {
+ pr_info("testcase6 dvpp_size check failed, dvpp_size1 %lu, dvpp_size2 %lu", dvpp_size1, dvpp_size2);
+ return -1;
+ }
+
+ return cleanup(&alloc_info);
+}
+
+static int testcase7(void)
+{
+ int ret;
+ if (addgroup() != 0) {
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_infos[] = {
+ {
+ .flag = (1 << 3),
+ .size = PAGE_NUM * PAGE_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .flag = -1,
+ .size = PAGE_NUM * PAGE_SIZE,
+ .spg_id = 1,
+ },
+ };
+
+ for (int i = 0; i < sizeof(alloc_infos) / sizeof(alloc_infos[0]); i++) {
+ ret = ioctl_alloc(dev_fd, &alloc_infos[i]);
+ if (ret != 0 && errno == EINVAL) {
+ pr_info("testcase7 ioctl_alloc %d failed as expected", i);
+ ret = 0;
+ } else if (ret != 0) {
+ pr_info("testcase7 ioctl_alloc %d failed unexpected, errno: %d", i, errno);
+ } else {
+ if (i == 0)
+ continue;
+ pr_info("testcase7 ioctl_alloc %d success unexpected", i);
+ cleanup(&alloc_infos[i]);
+ ret = -1;
+ }
+ }
+
+ return ret;
+}
+
+static int testcase8(void)
+{
+ // 用例会触发oom，暂时注掉
+ return 0;
+ int ret;
+ if (addgroup() != 0) {
+ return -1;
+ }
+ struct sp_alloc_info alloc_infos[] = {
+ {
+ .flag = 0,
+ .size = 0,
+ .spg_id = 1,
+ },
+ {
+ .flag = 0,
+ .size = LARGE_PAGE_NUM * PAGE_SIZE,
+ .spg_id = 1,
+ },
+ };
+ int errs[] = {EINVAL, EOVERFLOW};
+
+ for (int i = 0; i < sizeof(alloc_infos) / sizeof(alloc_infos[0]); i++) {
+ ret = ioctl_alloc(dev_fd, &alloc_infos[i]);
+ if (ret != 0 && errno == errs[i]) {
+ //pr_info("testcase8 ioctl_alloc %d failed as expected", i);
+ } else if (ret != 0) {
+ //pr_info("testcase8 ioctl_alloc %d failed unexpected, errno: %d", i, errno);
+ return ret;
+ } else {
+ //pr_info("testcase8 ioctl_alloc %d success unexpected", i);
+ cleanup(&alloc_infos[i]);
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase9(void)
+{
+ int ret;
+ if (addgroup() != 0) {
+ return -1;
+ }
+ struct sp_alloc_info alloc_infos[] = {
+ {
+ .flag = 0,
+ .size = PAGE_NUM * PAGE_SIZE,
+ .spg_id = -1,
+ },
+ {
+ .flag = 0,
+ .size = PAGE_NUM * PAGE_SIZE,
+ .spg_id = SPG_ID_AUTO_MIN,
+ },
+ };
+ int errs[] = {EINVAL, ENODEV};
+
+ for (int i = 0; i < sizeof(alloc_infos) / sizeof(alloc_infos[0]); i++) {
+ errno = 0;
+ ret = ioctl_alloc(dev_fd, &alloc_infos[i]);
+ if (ret != 0 && errno == errs[i]) {
+ pr_info("testcase9 ioctl_alloc %d failed as expected", i);
+ } else if (ret != 0) {
+ pr_info("testcase9 ioctl_alloc %d failed unexpected, errno: %d", i, errno);
+ return ret;
+ } else {
+ pr_info("testcase9 ioctl_alloc %d success unexpected", i);
+ cleanup(&alloc_infos[i]);
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase10(void)
+{
+ int ret;
+ if (addgroup() != 0) {
+ return -1;
+ }
+ struct sp_alloc_info alloc_infos[] = {
+ {
+ .flag = 0,
+ .size = PAGE_NUM * PAGE_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .flag = 2,
+ .size = PAGE_NUM * PMD_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .flag = 0x100000000,
+ .size = PAGE_NUM * PAGE_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .flag = 0x100000002,
+ .size = PAGE_NUM * PMD_SIZE,
+ .spg_id = 1,
+ },
+ };
+
+ for (int i = 0; i < sizeof(alloc_infos) / sizeof(alloc_infos[0]); i++) {
+ ret = ioctl_alloc(dev_fd, &alloc_infos[i]);
+ if (ret != 0) {
+ pr_info("testcase1 ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ } else {
+ sleep(3);
+ cleanup(&alloc_infos[i]);
+ }
+ }
+ return 0;
+}
+
+static int alloc_large_repeat(bool hugepage)
+{
+ int ret;
+ if (addgroup() != 0) {
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = hugepage ? 1 : 0,
+ .size = ATOMIC_TEST_SIZE,
+ .spg_id = 1,
+ };
+
+ sharepool_print();
+
+ pr_info("start to alloc...");
+ for (int i = 0; i < 5; i++) {
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret != 0) {
+ pr_info("alloc %s failed. errno %d",
+ hugepage ? "huge page" : "normal page",
+ errno);
+ return ret;
+ } else {
+ pr_info("alloc %s success %d time.",
+ hugepage ? "huge page" : "normal page",
+ i + 1);
+ }
+ sharepool_print();
+ mem_show();
+ }
+ return 0;
+}
+
+static int testcase11(void)
+{
+ return alloc_large_repeat(false);
+}
+
+static int testcase12(void)
+{
+ return alloc_large_repeat(true);
+}
+
+int semid;
+static int testcase13(void)
+{
+ int ret = 0;
+ int friend = 0;
+ int spg_id = 1;
+ void *addr;
+
+ semid = sem_create(1234, "sem");
+ friend = fork();
+ if (friend == 0) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, spg_id);
+ if (ret < 0) {
+ pr_info("add group failed!");
+ exit(-1);
+ }
+ sleep(1);
+ sem_inc_by_one(semid);
+ while (1) {
+
+ }
+ }
+
+ sem_dec_by_one(semid);
+ addr = wrap_sp_alloc(spg_id, 4096, 0);
+ if (addr == (void *)-1) {
+ pr_info("alloc from other group failed as expected.");
+ ret = 0;
+ } else {
+ pr_info("alloc from other group success unexpected.");
+ ret = -1;
+ }
+
+ KILL_CHILD(friend);
+ sem_close(semid);
+ return ret;
+}
+
+/* testcase1: 申请共享组内存，flag为0。预期申请成功。
+ * testcase2: 申请共享组内存，flag为HP，size不对齐。预期申请到对齐大页大小size的内存。
+ * testcase3: 申请共享组内存，flag为HPONLY。预期申请成功，或空间不足时返回ENOMEM。
+ * testcase4: 申请共享组内存，flag为DVPP。预期申请成功，虚拟地址空间范围在dvpp地址空间。
+ * testcase5: 申请共享组内存，flag为DVPP|HP。预期申请到对齐大页大小size的内存，虚拟地址空间范围在dvpp地址空间。
+ * testcase6: 申请共享组内存，flag为DVPP|ONLY。预期申请成功，虚拟地址空间范围在dvpp地址空间，或空间不足时返回ENOMEM。
+ * testcase7: 申请共享组内存，flag非法。预期申请失败，返回EINVAL。
+ * testcase8: size指定为0，远超出物理内存大小。预期申请失败。
+ * testcase9: spg_id为NONE，未使用过的正常范围内数值，DVPP，或超出范围。预期申请失败。
+ * testcase10: 申请指定memory node节点内存，flag中包含用户传入的device id，对应memory node
+ * testcase11: 单进程申请8G，观察维测结构打印是否正常
+*/
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "申请共享组内存，flag为0。预期申请成功。")
+ TESTCASE_CHILD(testcase2, "申请共享组内存，flag为HP，size不对齐。预期申请到对齐大页大小size的内存。")
+ TESTCASE_CHILD(testcase3, "申请共享组内存，flag为HPONLY。预期申请成功，或空间不足时返回ENOMEM。")
+ TESTCASE_CHILD(testcase4, "申请共享组内存，flag为DVPP。预期申请成功，虚拟地址空间范围在dvpp地址空间。")
+ TESTCASE_CHILD(testcase5, "申请共享组内存，flag为DVPP|HP。预期申请到对齐大页大小size的内存，虚拟地址空间范围在dvpp地址空间。")
+ TESTCASE_CHILD(testcase6, "申请共享组内存，flag为DVPP|ONLY。预期申请成功，虚拟地址空间范围在dvpp地址空间，或空间不足时返回ENOMEM。")
+ TESTCASE_CHILD(testcase7, "申请共享组内存，flag非法。预期申请失败，返回EINVAL。")
+ TESTCASE_CHILD(testcase8, "size指定为0，远超出物理内存大小。预期申请失败。")
+ TESTCASE_CHILD(testcase9, "spg_id为NONE，未使用过的正常范围内数值，DVPP，或超出范围。预期申请失败。")
+ TESTCASE_CHILD_MANUAL(testcase10, "申请指定memory node节点内存，flag中包含用户传入的device id，对应memory node")
+ TESTCASE_CHILD(testcase11, "单进程申请1G普通页，重复5次，然后退出。观察维测结构打印是否正常")
+ TESTCASE_CHILD(testcase12, "单进程申请1G大页，重复5次，然后退出。观察维测结构打印是否正常")
+ TESTCASE_CHILD(testcase13, "sp_alloc尝试从未加入的组申请内存，预期失败")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_alloc/test_sp_alloc2.c b/tools/testing/sharepool/testcase/api_test/sp_alloc/test_sp_alloc2.c
new file mode 100644
index 000000000000..451cb987934d
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_alloc/test_sp_alloc2.c
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon May 31 07:19:22 2021
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <signal.h>
+#include <unistd.h>
+#include <stdlib.h> // for exit
+#include <sys/mman.h>
+
+#include "sharepool_lib.h"
+
+
+#define ADD_GROUP \
+ struct sp_add_group_info ag_info = { \
+ .pid = getpid(), \
+ .prot = PROT_READ | PROT_WRITE, \
+ .spg_id = SPG_ID_AUTO, \
+ }; \
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+
+/*
+ * size = 0
+ * 错误码，EINVAL
+ */
+static int testcase1(void)
+{
+ int ret;
+ pid_t pid;
+
+ ADD_GROUP
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 0,
+ .spg_id = ag_info.spg_id,
+ };
+ TEST_CHECK_FAIL(ioctl_alloc(dev_fd, &alloc_info), EINVAL, out);
+
+out:
+ return ret;
+}
+
+/*
+ * size = -1
+ * 错误码，EINVAL
+ */
+static int testcase2(void)
+{
+ int ret;
+ pid_t pid;
+
+ ADD_GROUP
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = -1,
+ .spg_id = ag_info.spg_id,
+ };
+ TEST_CHECK_FAIL(ioctl_alloc(dev_fd, &alloc_info), EINVAL, out);
+
+out:
+ return ret;
+}
+
+/*
+ * size = 1 << 48
+ * 错误码，EINVAL
+ */
+static int testcase3(void)
+{
+ int ret;
+ pid_t pid;
+
+ ADD_GROUP
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 1UL << 48,
+ .spg_id = ag_info.spg_id,
+ };
+ TEST_CHECK_FAIL(ioctl_alloc(dev_fd, &alloc_info), EINVAL, out);
+
+out:
+ return ret;
+}
+
+/*
+ * size = 1 << 36
+ * 会oom，手动执行，需要无内存泄漏等异常
+ */
+static int testcase4(void)
+{
+ int ret;
+ pid_t pid;
+
+ ADD_GROUP
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 1UL << 36, // 64G
+ .spg_id = ag_info.spg_id,
+ };
+ TEST_CHECK(ioctl_alloc(dev_fd, &alloc_info), out);
+
+out:
+ return ret;
+}
+
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "size = 0，错误码EINVAL")
+ TESTCASE_CHILD(testcase2, "size = -1，错误码EINVAL")
+ TESTCASE_CHILD(testcase3, "size = 1 << 48，错误码EINVAL")
+ TESTCASE_CHILD_MANUAL(testcase4, "size = 1 << 36，会oom，手动执行，预期无内存泄漏")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_alloc/test_sp_alloc3.c b/tools/testing/sharepool/testcase/api_test/sp_alloc/test_sp_alloc3.c
new file mode 100644
index 000000000000..4334b1d365bc
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_alloc/test_sp_alloc3.c
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Jun 07 02:10:29 2021
+ */
+#include <stdio.h>
+#include <string.h>
+#include <signal.h>
+#include <unistd.h>
+#include <stdlib.h> // for exit
+#include <sys/mman.h>
+#include <errno.h>
+
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+/*
+ * 申请直调内存，写入，释放
+ * 预期申请内存成功，写入、释放无异常
+ */
+
+#define SIZE_1K (1024UL)
+#define SIZE_PAGE (4 * 1024UL)
+#define SIZE_HUGEPAGE (2 * 1024 * 1024UL)
+
+static int alloc_from_spg_none(unsigned long flag)
+{
+ void *buf;
+ char *cbuf;
+
+ unsigned long size[3] = {
+ SIZE_1K,
+ SIZE_PAGE,
+ SIZE_HUGEPAGE
+ };
+
+ for ( int i = 0; i < sizeof(size) / sizeof(size[0]); i++) {
+ buf = (void *)wrap_sp_alloc(SPG_ID_DEFAULT, size[i], flag);
+ if (!buf) {
+ pr_info("alloc failed by size %d, flag %d, errno: %d",
+ size[i], flag, errno);
+ return -1;
+ } else {
+ pr_info("alloc success by size %d, flag %d. va: 0x%lx",
+ size[i], flag, buf);
+ // 写入
+ cbuf = (char *)buf;
+ for (int j = 0; j < size[i]; j++)
+ *(cbuf + i) = 'A';
+
+ // 释放
+ wrap_sp_free(buf);
+ }
+ }
+
+ return 0;
+}
+
+/* testcase4
+ * N个组并发加入spg_none, 并发申请内存，然后并发退出
+ */
+#define PROC_NUM 10
+#define REPEAT 10
+#define ALLOC_SIZE SIZE_HUGEPAGE
+#define PRT PROT_READ | PROT_WRITE
+int sem_tc4;
+static int testcase_child(bool hugepage)
+{
+ int ret;
+ sem_dec_by_one(sem_tc4);
+
+ if (wrap_sp_alloc(SPG_ID_DEFAULT, ALLOC_SIZE, hugepage? 2 : 0) == (void *)-1) {
+ pr_info("child %d alloc hugepage failed.", getpid());
+ return -1;
+ }
+ pr_info("alloc success. child %d", getpid());
+
+ sem_check_zero(sem_tc4);
+ sleep(3);
+ sem_dec_by_one(sem_tc4);
+ pr_info("exit success. child %d", getpid());
+
+ return 0;
+}
+
+static int testcase(bool hugepage)
+{
+ int ret = 0;
+ int child[PROC_NUM];
+
+ sem_tc4 = sem_create(1234, "sem for testcase4");
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ FORK_CHILD_ARGS(child[i], testcase_child(hugepage));
+ }
+
+ // 并发申请内存
+ pr_info("all start to allocate...");
+ sem_inc_by_val(sem_tc4, PROC_NUM);
+ sem_check_zero(sem_tc4);
+ sleep(5);
+
+ // 并发退出组
+ pr_info("all start to exit...");
+ sem_inc_by_val(sem_tc4, PROC_NUM);
+ sleep(5);
+ sem_check_zero(sem_tc4);
+
+ for (int i = 0; i < PROC_NUM; i++)
+ WAIT_CHILD_STATUS(child[i], out);
+
+ sem_close(sem_tc4);
+ return 0;
+
+out:
+ for (int i = 0; i < PROC_NUM; i++)
+ KILL_CHILD(child[i]);
+ sem_close(sem_tc4);
+ return -1;
+}
+
+
+static int testcase1(void) { return alloc_from_spg_none(0); }
+static int testcase2(void) { return alloc_from_spg_none(SP_HUGEPAGE);}
+static int testcase3(void) { return alloc_from_spg_none(SP_HUGEPAGE_ONLY); }
+static int testcase4(void) { return testcase(1); }
+static int testcase5(void) { return testcase(0); }
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "申请直调内存 普通页")
+ TESTCASE_CHILD(testcase2, "申请直调内存 大页")
+ TESTCASE_CHILD(testcase3, "申请直调内存 大页only")
+ TESTCASE_CHILD(testcase4, "并发申请直调内存大页，写入，释放。预期申请内存成功，写入、释放无异常")
+ TESTCASE_CHILD(testcase5, "并发申请直调内存普通页，写入，释放。预期申请内存成功，写入、释放无异常")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_alloc/test_spa_error.c b/tools/testing/sharepool/testcase/api_test/sp_alloc/test_spa_error.c
new file mode 100644
index 000000000000..d0fec0bfbb23
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_alloc/test_spa_error.c
@@ -0,0 +1,109 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 14 16:47:36 2020
+ */
+#include <stdio.h>
+#include <sys/ioctl.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+
+#include "sharepool_lib.h"
+
+#define ALIGN_UP(x, align_to) (((x) + ((align_to)-1)) & ~((align_to)-1))
+#define CMD_LEN 100
+#define UNIT 1024
+#define PAGE_NUM 1
+#define HGPAGE_NUM 10
+#define LARGE_PAGE_NUM 1000000
+#define ATOMIC_TEST_SIZE (1024UL * 1024UL * 1024UL) // 1G
+#define SPG_ID_AUTO 200000
+#define DAVINCI_IOCTL_VA_TO_PA 0xfff9
+#define DVPP_START (0x100000000000UL)
+#define DVPP_SIZE 0x400000000UL
+
+
+static int addgroup(void)
+{
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = SPG_ID_AUTO,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ } else {
+ ret = ag_info.spg_id;
+ }
+ return ret;
+}
+
+static int cleanup(struct sp_alloc_info *alloc_info)
+{
+ int ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_free failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static int testcase1(void)
+{
+ int ret;
+ int fd;
+ long err;
+ unsigned long phys_addr;
+ int spg_id = 0;
+
+ spg_id = addgroup();
+ if (spg_id <= 0) {
+ pr_info("spgid <= 0, value: %d", spg_id);
+ return -1;
+ } else {
+ pr_info("spg id %d", spg_id);
+ }
+
+ struct sp_alloc_info alloc_infos[] = {
+ {
+ .flag = ((10UL << 32) | 0x7), // 普通大页
+ .size = PAGE_NUM * PMD_SIZE,
+ .spg_id = spg_id,
+ },
+ };
+
+ for (int i = 0; i < sizeof(alloc_infos) / sizeof(alloc_infos[0]); i++) {
+ ret = ioctl_alloc(dev_fd, &alloc_infos[i]);
+ if (ret != 0) {
+ pr_info("testcase1 ioctl_alloc failed as expected, errno: %d", errno);
+ } else {
+ pr_info("alloc success unexpected, type, va: %lx", alloc_infos[i].addr);
+ return -1;
+ }
+ }
+
+ for (int i = 0; i < sizeof(alloc_infos) / sizeof(alloc_infos[0]); i++)
+ cleanup(&alloc_infos[i]);
+
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "sp_alloc传入非法flag，预期sp_area返回错误值，sp_alloc失败")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/Makefile b/tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/Makefile
new file mode 100644
index 000000000000..ef670b48300a
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $< -o $@ -L$(SHARELIB_DIR) -lsharepool_lib -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(INSTALL_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/start_vm_test_16.sh b/tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/start_vm_test_16.sh
new file mode 100755
index 000000000000..64b92606094b
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/start_vm_test_16.sh
@@ -0,0 +1,49 @@
+qemu-system-aarch64 \
+ -m \
+ 16G \
+ -object memory-backend-ram,size=1G,id=mem0 \
+ -object memory-backend-ram,size=1G,id=mem1 \
+ -object memory-backend-ram,size=1G,id=mem2 \
+ -object memory-backend-ram,size=1G,id=mem3 \
+ -object memory-backend-ram,size=1G,id=mem4 \
+ -object memory-backend-ram,size=1G,id=mem5 \
+ -object memory-backend-ram,size=1G,id=mem6 \
+ -object memory-backend-ram,size=1G,id=mem7 \
+ -object memory-backend-ram,size=1G,id=mem8 \
+ -object memory-backend-ram,size=1G,id=mem9 \
+ -object memory-backend-ram,size=1G,id=mem10 \
+ -object memory-backend-ram,size=1G,id=mem11 \
+ -object memory-backend-ram,size=1G,id=mem12 \
+ -object memory-backend-ram,size=1G,id=mem13 \
+ -object memory-backend-ram,size=1G,id=mem14 \
+ -object memory-backend-ram,size=1G,id=mem15 \
+ -numa node,memdev=mem0,nodeid=0 \
+ -numa node,memdev=mem1,nodeid=1 \
+ -numa node,memdev=mem2,nodeid=2 \
+ -numa node,memdev=mem3,nodeid=3 \
+ -numa node,memdev=mem4,nodeid=4 \
+ -numa node,memdev=mem5,nodeid=5 \
+ -numa node,memdev=mem6,nodeid=6 \
+ -numa node,memdev=mem7,nodeid=7 \
+ -numa node,memdev=mem8,nodeid=8 \
+ -numa node,memdev=mem9,nodeid=9 \
+ -numa node,memdev=mem10,nodeid=10 \
+ -numa node,memdev=mem11,nodeid=11 \
+ -numa node,memdev=mem12,nodeid=12 \
+ -numa node,memdev=mem13,nodeid=13 \
+ -numa node,memdev=mem14,nodeid=14 \
+ -numa node,memdev=mem15,nodeid=15 \
+ -kernel \
+ /home/data/qemu/images/openEuler-22.03-arm64/Image \
+ -drive file=/home/data/qemu/images/openEuler-22.03-arm64/rootfs.qcow2,if=none,format=qcow2,cache=none,id=root -device virtio-blk,drive=root,id=d_root \
+ -device virtio-scsi-pci -drive file=/home/data/qemu/images/disk/disk.img,if=none,format=raw,id=dd_1 -device scsi-hd,drive=dd_1,id=disk_1 \
+ -M virt -cpu cortex-a57 \
+ -smp \
+ 8 \
+ -net nic,model=virtio-net-pci \
+ -net \
+ user,host=10.0.2.2,hostfwd=tcp::10022-:22 \
+ -fsdev local,security_model=passthrough,id=fsdev0,path=/tmp -device virtio-9p-pci,id=fs0,fsdev=fsdev0,mount_tag=hostshare \
+ -append \
+ "console=ttyAMA0 root=/dev/vda2 rw printk.time=y oops=panic panic_on_oops=1 panic_on_warn=1 panic=-1 net.ifnames=0 ftrace_dump_on_oops=orig_cpu debug earlyprintk=serial slub_debug=UZ selinux=0 highres=off earlycon systemd.default_timeout_start_sec=600 crashkernel=256M enable_ascend_share_pool" \
+ -nographic
diff --git a/tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/start_vm_test_4.sh b/tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/start_vm_test_4.sh
new file mode 100755
index 000000000000..b4d95a5857f4
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/start_vm_test_4.sh
@@ -0,0 +1,25 @@
+qemu-system-aarch64 \
+ -m \
+ 16G \
+ -object memory-backend-ram,size=4G,id=mem0 \
+ -object memory-backend-ram,size=4G,id=mem1 \
+ -object memory-backend-ram,size=4G,id=mem2 \
+ -object memory-backend-ram,size=4G,id=mem3 \
+ -numa node,memdev=mem0,nodeid=0 \
+ -numa node,memdev=mem1,nodeid=1 \
+ -numa node,memdev=mem2,nodeid=2 \
+ -numa node,memdev=mem3,nodeid=3 \
+ -kernel \
+ /home/data/qemu/images/openEuler-22.03-arm64/Image \
+ -drive file=/home/data/qemu/images/openEuler-22.03-arm64/rootfs.qcow2,if=none,format=qcow2,cache=none,id=root -device virtio-blk,drive=root,id=d_root \
+ -device virtio-scsi-pci -drive file=/home/data/qemu/images/disk/disk.img,if=none,format=raw,id=dd_1 -device scsi-hd,drive=dd_1,id=disk_1 \
+ -M virt -cpu cortex-a57 \
+ -smp \
+ 8 \
+ -net nic,model=virtio-net-pci \
+ -net \
+ user,host=10.0.2.2,hostfwd=tcp::10022-:22 \
+ -fsdev local,security_model=passthrough,id=fsdev0,path=/tmp -device virtio-9p-pci,id=fs0,fsdev=fsdev0,mount_tag=hostshare \
+ -append \
+ "console=ttyAMA0 root=/dev/vda2 rw printk.time=y oops=panic panic_on_oops=1 panic_on_warn=1 panic=-1 net.ifnames=0 ftrace_dump_on_oops=orig_cpu debug earlyprintk=serial slub_debug=UZ selinux=0 highres=off earlycon systemd.default_timeout_start_sec=600 crashkernel=256M enable_ascend_share_pool" \
+ -nographic
diff --git a/tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/test_nodemask.c b/tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/test_nodemask.c
new file mode 100644
index 000000000000..1c1fbf023327
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_alloc_nodemask/test_nodemask.c
@@ -0,0 +1,782 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 14 16:47:36 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+#include <string.h>
+
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+#define ALIGN_UP(x, align_to) (((x) + ((align_to)-1)) & ~((align_to)-1))
+#define CMD_LEN 100
+#define UNIT 1024
+#define PAGE_NUM 100
+#define HGPAGE_NUM 10
+#define LARGE_PAGE_NUM 1000000
+#define ATOMIC_TEST_SIZE (1024UL * 1024UL * 1024UL) // 1G
+
+static int check_mem_in_node(unsigned long addr, int huge, unsigned long *mask, int max_node)
+{
+ FILE *fp;
+ char buffer[512];
+ char *cmd;
+ char *p;
+ int ret;
+
+ cmd = malloc(64 + 32 * max_node);
+
+ p = cmd;
+ p += sprintf(p, "cat /proc/%d/numa_maps | grep %lx | grep kernelpagesize_kB=4", getpid(), addr);
+ fp = popen(cmd, "r");
+ if (fgets(buffer, sizeof(buffer), fp))
+ ret = !huge;
+ else
+ ret = huge;
+ fclose(fp);
+
+ p = cmd;
+ p += sprintf(p, "cat /proc/%d/numa_maps | grep %lx ", getpid(), addr);
+
+ for (int i = 0; i < max_node; i++) {
+ if (mask[i / 64] & (1UL << (i % 64))) {
+ p += sprintf(p, "| sed -r \"s/N%d=[0-9]+ //g\" ", i);
+ }
+ }
+
+ p += sprintf(p, "| sed -nr \"/N[0-9]+=[0-9]+ /p\"");
+
+ fp = popen(cmd, "r");
+ if (fgets(buffer, sizeof(buffer), fp))
+ ret = 0;
+ else
+ ret = 1;
+
+ printf("cmd: %s\n", cmd);
+ printf("%s\n", buffer);
+
+ fclose(fp);
+ free(cmd);
+ return ret;
+}
+
+static int check_mem_not_in_node(unsigned long addr, int huge, unsigned long *mask, int max_node)
+{
+ FILE *fp;
+ char buffer[256];
+ char *cmd;
+ char *p;
+ int ret;
+ int tmp = 0;
+
+ cmd = malloc(64 + 32 * max_node);
+
+ p = cmd;
+ p += sprintf(p, "cat /proc/%d/numa_maps | grep %lx | grep kernelpagesize_kB=4", getpid(), addr);
+ fp = popen(cmd, "r");
+ if (fgets(buffer, sizeof(buffer), fp))
+ ret = !huge;
+ else
+ ret = huge;
+ fclose(fp);
+
+ for (int i = 0; i < max_node / 64 + 1; i++) {
+ tmp |= mask[i];
+ }
+
+ if (!tmp) /* no node provided */
+ goto out;
+
+ p = cmd;
+ p += sprintf(p, "cat /proc/%d/numa_maps | grep %lx | ", getpid(), addr);
+ p += sprintf(p, "sed -nr \"/");
+ for (int i = 0; i < max_node; i++) {
+ if (mask[i / 64] & (1UL << (i % 64))) {
+ printf("mask[%d / 64]: %lx\n", i, mask[i / 64]);
+ p += sprintf(p, "(N%d)|", i);
+ }
+ }
+ p += sprintf(p, "(XXX)=[0-9]+ /p\"\n");
+
+ fp = popen(cmd, "r");
+ if (fgets(buffer, sizeof(buffer), fp))
+ ret = 1;
+ else
+ ret = 0;
+
+ printf("cmd: %s\n", cmd);
+ printf("%s\n", buffer);
+
+ fclose(fp);
+out:
+ free(cmd);
+
+ return ret;
+}
+
+/*
+ * mg_sp_alloc & mg_sp_alloc_nodemask 内存申请混合操作场景
+ * 同时混合sharepool用户态接口打印操作
+ * 测试环境需求 numa节点数 4
+ */
+static int testcase1_1(void)
+{
+ int default_id = 1;
+ int page_size = 4096;
+ int ret = 0;
+
+ int proc_num = 10;
+ int childs[proc_num];
+ int prints_num = 3;
+ int prints[prints_num];
+
+ unsigned long node_id = 1;
+ unsigned long flags = node_id << 36 | SP_SPEC_NODE_ID;
+ unsigned long nodemask[2];
+ unsigned long max_node = 128;
+ nodemask[0] = 0xFUL;
+ nodemask[1] = 0x0UL;
+
+ // 持续打印维测接口
+ for(int i = 0; i < prints_num; i++){
+ int pid = fork();
+ if (pid == 0) {
+ while (1) {
+ sharepool_print();
+ usleep(10000);
+ }
+ } else {
+ prints[i] = pid;
+ }
+ }
+
+ for(int i=0; i<proc_num; i++){
+ int pid = fork();
+ if (pid == 0){
+ int ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+ while(1){
+ void *addr;
+ int ret;
+ addr = wrap_sp_alloc(default_id, page_size, 0);
+ if (addr == (void *)-1) {
+ pr_info("process %d alloc failed.", getpid());
+ } else {
+ pr_info("process %d alloc success.", getpid());
+ }
+ ret = wrap_sp_free(addr);
+ if (ret < 0) {
+ pr_info("process %d free failed.", getpid());
+ } else {
+ pr_info("process %d free success.", getpid());
+ }
+ addr = wrap_sp_alloc_nodemask(SPG_ID_DEFAULT, page_size, flags, nodemask, max_node);
+ if (addr == (void *)-1) {
+ pr_info("process %d multinode alloc failed.", getpid());
+ } else {
+ pr_info("process %d multinode alloc success.", getpid());
+ }
+ ret = wrap_sp_free(addr);
+ if (ret < 0) {
+ pr_info("process %d multinode free failed.", getpid());
+ } else {
+ pr_info("process %d multinode free success.", getpid());
+ }
+ }
+ }
+ else{
+ childs[i] = pid;
+ }
+ }
+
+ sleep(10);
+
+ int status;
+
+ for (int i = 0; i < proc_num; i++) {
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], &status, 0);
+ }
+ for (int i = 0; i < prints_num; i++) {
+ kill(prints[i], SIGKILL);
+ waitpid(prints[i], &status, 0);
+ }
+
+ return 0;
+}
+
+/*
+ * mg_sp_alloc & mg_sp_alloc_nodemask 内存申请混合操作场景
+ * 测试环境需求 numa节点数 4 每个node配置4GB内存
+ * 申请内存量增加 确保申请到不同的node
+ * 附加内存读写验证操作
+ */
+static int testcase1_2(void)
+{
+ int default_id = 1;
+ unsigned long mem_size = 1UL * 1024 * 1024 * 1024;
+ int page_size = 4096;
+ int ret = 0;
+
+ int proc_num = 5;
+ int childs[proc_num];
+ int prints_num = 3;
+ int prints[prints_num];
+
+ unsigned long flags = 0;
+ unsigned long nodemask[2];
+ unsigned long max_node = 128;
+ nodemask[0] = 0xFUL;
+ nodemask[1] = 0x0UL;
+
+ for(int i=0; i<proc_num; i++){
+ int pid = fork();
+ if (pid == 0){
+ int ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+ for(int j=0; j<2; j++){
+ char *addr;
+ int ret;
+ char ori_c = 'a';
+ addr = wrap_sp_alloc(default_id, page_size, 0);
+ if (addr == (void *)-1) {
+ pr_info("process %d alloc failed.", getpid());
+ } else {
+ pr_info("process %d alloc success.", getpid());
+ }
+
+ memset(addr, ori_c, page_size);
+ for (size_t i = 0; i < page_size; i = i + 2)
+ {
+ char c = addr[i];
+ if (c != ori_c) {
+ wrap_sp_free(addr);
+ perror("memory contect check error \n");
+ return 1;
+ }
+ }
+
+ ret = wrap_sp_free(addr);
+ if (ret < 0) {
+ pr_info("process %d free failed.", getpid());
+ } else {
+ pr_info("process %d free success.", getpid());
+ }
+
+ addr = wrap_sp_alloc_nodemask(SPG_ID_DEFAULT, mem_size, flags, nodemask, max_node);
+ if (addr == (void *)-1) {
+ pr_info("process %d multinode alloc failed.", getpid());
+ } else {
+ pr_info("process %d multinode alloc success.", getpid());
+ }
+
+ memset(addr, ori_c, mem_size);
+ for (size_t i = 0; i < mem_size; i = i + 2) {
+ char c = addr[i];
+ if (c != ori_c) {
+ wrap_sp_free(addr);
+ perror("memory contect check error \n");
+ return 1;
+ }
+ }
+
+ ret = wrap_sp_free(addr);
+ if (ret < 0) {
+ pr_info("process %d multinode free failed.", getpid());
+ } else {
+ pr_info("process %d multinode free success.", getpid());
+ }
+ }
+ }
+ else{
+ childs[i] = pid;
+ }
+ }
+
+ sleep(10);
+
+ int status;
+
+ for (int i = 0; i < proc_num; i++) {
+ waitpid(childs[i], &status, 0);
+ }
+
+ return status;
+}
+/*
+ * mg_sp_alloc_nodemask 并发申请内存小页 大页场景
+ * 同时混合sharepool用户态接口打印操作
+ * 测试环境需求 numa节点数 4
+ */
+static int testcase2(void)
+{
+ int default_id = 1;
+ int page_size = 4096;
+ int ret = 0;
+
+ int proc_num = 10;
+ int childs[proc_num];
+ int prints_num = 3;
+ int prints[prints_num];
+
+ unsigned long node_id = 1;
+ unsigned long flags_p = node_id << 36 | SP_SPEC_NODE_ID;
+ unsigned long flags_hp = node_id << 36 | SP_SPEC_NODE_ID | SP_HUGEPAGE | SP_HUGEPAGE_ONLY;
+ unsigned long nodemask[2];
+ unsigned long max_node = 128;
+ nodemask[0] = 0x2UL;
+ nodemask[1] = 0x0UL;
+
+ // 持续打印维测接口
+ for(int i = 0; i < prints_num; i++){
+ int pid = fork();
+ if (pid == 0) {
+ while (1) {
+ sharepool_print();
+ usleep(10000);
+ }
+ } else {
+ prints[i] = pid;
+ }
+ }
+
+ // 创建子进程申请和释放4K内存
+ for(int i=0; i<proc_num; i++){
+ int pid = fork();
+ if (pid == 0){
+ int ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+ while(1){
+ void *addr;
+ int ret;
+ addr = wrap_sp_alloc_nodemask(SPG_ID_DEFAULT, page_size, flags_p, nodemask, max_node);
+ if (addr == (void *)-1) {
+ pr_info("process %d multinode alloc failed.", getpid());
+ } else {
+ pr_info("process %d multinode alloc success.", getpid());
+ }
+ ret = wrap_sp_free(addr);
+ if (ret < 0) {
+ pr_info("process %d multinode free failed.", getpid());
+ } else {
+ pr_info("process %d multinode free success.", getpid());
+ }
+ addr = wrap_sp_alloc_nodemask(SPG_ID_DEFAULT, page_size, flags_hp, nodemask, max_node);
+ if (addr == (void *)-1) {
+ pr_info("process %d multinode hugepage alloc failed.", getpid());
+ } else {
+ pr_info("process %d multinode hugepage alloc success.", getpid());
+ }
+ ret = wrap_sp_free(addr);
+ if (ret < 0) {
+ pr_info("process %d multinode hugepage free failed.", getpid());
+ } else {
+ pr_info("process %d multinode hugepage free success.", getpid());
+ }
+ }
+ }
+ else{
+ childs[i] = pid;
+ }
+ }
+
+ sleep(10);
+
+ int status;
+
+ for (int i = 0; i < proc_num; i++) {
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], &status, 0);
+ }
+ for (int i = 0; i < prints_num; i++) {
+ kill(prints[i], SIGKILL);
+ waitpid(prints[i], &status, 0);
+ }
+
+ return 0;
+}
+
+/*
+ * 多组使用 mg_sp_alloc_nodemask 并发内存申请场景
+ * 同时混合sharepool用户态接口打印操作
+ * 测试环境需求 numa节点数 4
+ */
+static int testcase3(void)
+{
+ int group_num = 10;
+ int page_size = 4096;
+ int ret = 0;
+ int childs[group_num];
+ int prints_num = 3;
+ int prints[prints_num];
+
+ unsigned long node_id = 1;
+ unsigned long flags_p = node_id << 36 | SP_SPEC_NODE_ID;
+ unsigned long flags_hp = node_id << 36 | SP_SPEC_NODE_ID | SP_HUGEPAGE | SP_HUGEPAGE_ONLY;
+ unsigned long nodemask[2];
+ unsigned long max_node = 128;
+ nodemask[0] = 0x2UL;
+ nodemask[1] = 0x0UL;
+
+ // 持续打印维测接口
+ for(int i = 0; i < prints_num; i++){
+ int pid = fork();
+ if (pid == 0) {
+ while (1) {
+ sharepool_print();
+ usleep(10000);
+ }
+ } else {
+ prints[i] = pid;
+ }
+ }
+
+ // 创建子进程申请和释放4K内存
+ for(int i=0; i<group_num; i++){
+ int pid = fork();
+ if (pid == 0){
+ int ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, i);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), i);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), i);
+ }
+ while(1){
+ void *addr;
+ int ret;
+ addr = wrap_sp_alloc_nodemask(SPG_ID_DEFAULT, page_size, flags_p, nodemask, max_node);
+ if (addr == (void *)-1) {
+ pr_info("process %d multinode alloc failed.", getpid());
+ } else {
+ pr_info("process %d multinode alloc success.", getpid());
+ }
+ ret = wrap_sp_free(addr);
+ if (ret < 0) {
+ pr_info("process %d multinode free failed.", getpid());
+ } else {
+ pr_info("process %d multinode free success.", getpid());
+ }
+ addr = wrap_sp_alloc_nodemask(SPG_ID_DEFAULT, page_size, flags_hp, nodemask, max_node);
+ if (addr == (void *)-1) {
+ pr_info("process %d multinode hugepage alloc failed.", getpid());
+ } else {
+ pr_info("process %d multinode hugepage alloc success.", getpid());
+ }
+ ret = wrap_sp_free(addr);
+ if (ret < 0) {
+ pr_info("process %d multinode hugepage free failed.", getpid());
+ } else {
+ pr_info("process %d multinode hugepage free success.", getpid());
+ }
+ }
+ }
+ else{
+ childs[i] = pid;
+ }
+ }
+
+ sleep(10);
+
+ int status;
+
+ for (int i = 0; i < group_num; i++) {
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], &status, 0);
+ }
+ for (int i = 0; i < prints_num; i++) {
+ kill(prints[i], SIGKILL);
+ waitpid(prints[i], &status, 0);
+ }
+
+ return 0;
+}
+
+/*
+ * mg_sp_alloc_nodemask 内存读写验证
+ * 同时混合sharepool用户态接口打印操作
+ * 测试环境需求 numa节点数 4
+ */
+static int testcase4(void)
+{
+ int default_id = 1;
+ int page_size = 4096;
+ int ret = 0;
+
+ unsigned long node_id = 1;
+ unsigned long flags_p = node_id << 36 | SP_SPEC_NODE_ID;
+ unsigned long nodemask[2];
+ unsigned long max_node = 128;
+ nodemask[0] = 0xFUL;
+ nodemask[1] = 0x0UL;
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ char *addr;
+ addr = wrap_sp_alloc_nodemask(SPG_ID_DEFAULT, page_size, flags_p, nodemask, max_node);
+ if (addr == (void *)-1) {
+ pr_info("process %d multinode alloc failed.", getpid());
+ } else {
+ pr_info("process %d multinode alloc success.", getpid());
+ }
+
+ char ori_c = 'a';
+ memset(addr, ori_c, page_size);
+
+ for (size_t i = 0; i < page_size; i = i + 2)
+ {
+ char c = addr[i];
+ if (c != ori_c) {
+ wrap_sp_free(addr);
+ perror("memory contect check error \n");
+ return 1;
+ }
+ }
+
+ ret = wrap_sp_free(addr);
+ if (ret < 0) {
+ pr_info("process %d multinode free failed.", getpid());
+ } else {
+ pr_info("process %d multinode free success.", getpid());
+ }
+
+ unsigned long nodemask_c[2];
+ nodemask[0] = 0x1UL;
+ nodemask[1] = 0x0UL;
+
+ if (!check_mem_not_in_node(addr, 0, nodemask, max_node)) {
+ pr_info("page is not expected");
+ ret = -1;
+ }
+
+ return 0;
+}
+
+/*
+ * 虚拟机配置 numa节点数16 每个节点配置1GB内存 共计16GB
+ */
+static int testcase5(void)
+{
+ int default_id = 1;
+ int mem_size = 1UL * 1024 * 1024 * 1024;
+ int ret = 0;
+ int proc_num = 10;
+ int childs[proc_num];
+
+ unsigned long node_id = 1;
+ unsigned long flags_p = node_id << 36 | SP_SPEC_NODE_ID;
+ unsigned long nodemask[2];
+ unsigned long max_node = 128;
+ nodemask[0] = 0xFFFFUL;
+ nodemask[1] = 0x0UL;
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ for(int i=0; i<proc_num; i++){
+ int pid = fork();
+ if (pid == 0){
+ int ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+ for(int j=0; j<3; j++){
+ void *addr;
+ int ret;
+ addr = wrap_sp_alloc_nodemask(SPG_ID_DEFAULT, mem_size, flags_p, nodemask, max_node);
+ if (addr == (void *)-1) {
+ pr_info("process %d multinode alloc failed.", getpid());
+ } else {
+ pr_info("process %d multinode alloc success.", getpid());
+ }
+ ret = wrap_sp_free(addr);
+ if (ret < 0) {
+ pr_info("process %d multinode free failed.", getpid());
+ } else {
+ pr_info("process %d multinode free success.", getpid());
+ }
+ }
+ return ret;
+ }
+ else{
+ childs[i] = pid;
+ }
+ }
+
+ int status;
+ for (int i = 0; i < proc_num; i++) {
+ waitpid(childs[i], &status, 0);
+ }
+
+ return 0;
+}
+
+/*
+ * 虚拟机配置 numa节点数4 每个节点配置4GB内存 共计16GB
+ */
+static int testcase6_1(void)
+{
+ system("echo 0 > /proc/sys/vm/enable_oom_killer");
+ int default_id = 1;
+ unsigned long mem_size = 9UL * 1024 * 1024 *1024;
+ int ret = 0;
+
+ unsigned long flags_p = SP_SPEC_NODE_ID;
+ unsigned long nodemask[2];
+ unsigned long max_node = 128;
+ nodemask[0] = 0x3UL;
+ nodemask[1] = 0x0UL;
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ char *addr;
+ addr = wrap_sp_alloc_nodemask(SPG_ID_DEFAULT, mem_size, flags_p, nodemask, max_node);
+ if (addr == MAP_FAILED) {
+ if (errno == ENOMEM || errno == EINTR) { /* EINTR for OOM */
+ ret = 0;
+ } else {
+ printf("errno[%d] is not expected\n", errno);
+ ret = -1;
+ }
+ } else {
+ printf("alloc should fail\n");
+ wrap_sp_free(addr);
+ ret = -1;
+ }
+
+ return ret;
+}
+
+/*
+ * 虚拟机配置 numa节点数4 每个节点配置4GB内存 共计16GB
+ */
+static int testcase6_2(void)
+{
+ int default_id = 1;
+ unsigned long mem_size = 12UL * 1024 * 1024 *1024;
+ int ret = 0;
+
+ unsigned long flags_p = SP_SPEC_NODE_ID;
+ unsigned long nodemask[2];
+ unsigned long max_node = 128;
+ nodemask[0] = 0xFUL;
+ nodemask[1] = 0x0UL;
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ char *addr;
+ addr = wrap_sp_alloc_nodemask(SPG_ID_DEFAULT, mem_size, flags_p, nodemask, max_node);
+ if (addr == MAP_FAILED) {
+ pr_info("alloc failed, errno:%d", errno);
+ return -1;
+ }else{
+ pr_info("alloc success");
+ }
+
+ ret = wrap_sp_free(addr);
+ if (ret < 0) {
+ pr_info("process %d multinode free failed.", getpid());
+ } else {
+ pr_info("process %d multinode free success.", getpid());
+ }
+
+ return 0;
+}
+
+/*
+ * 虚拟机配置 numa节点数4 每个节点配置4GB内存 共计16GB
+ * cgroup限制内存的总量为1G
+ * echo 0 > /proc/sys/vm/enable_oom_killer
+ */
+static int testcase6_3(void)
+{
+ int default_id = 1;
+ unsigned long mem_size = 2UL * 1024 * 1024 *1024;
+ int ret = 0;
+
+ unsigned long node_id = 2;
+ unsigned long flags_p = node_id << 36 | SP_SPEC_NODE_ID;
+ unsigned long nodemask[2];
+ unsigned long max_node = 128;
+ nodemask[0] = 0xFUL;
+ nodemask[1] = 0x0UL;
+
+ char *addr;
+ addr = wrap_sp_alloc_nodemask(SPG_ID_DEFAULT, mem_size, 0, nodemask, max_node);
+ if (addr == MAP_FAILED) {
+ if (errno == ENOMEM || errno == EINTR) { /* EINTR for OOM */
+ ret = 0;
+ } else {
+ printf("errno[%d] is not expected\n", errno);
+ ret = -1;
+ }
+ } else {
+ printf("alloc should fail\n");
+ ret = -1;
+ }
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1_1, "mg_sp_alloc & mg_sp_alloc_nodemask 内存申请混合操作场景")
+ TESTCASE_CHILD(testcase1_2, "mg_sp_alloc & mg_sp_alloc_nodemask 内存申请混合操作场景 内存大量申请 混合读写验证操作")
+ TESTCASE_CHILD(testcase2, "mg_sp_alloc_nodemask 并发申请内存小页 大页场景")
+ TESTCASE_CHILD(testcase3, "多组使用 mg_sp_alloc_nodemask 并发内存申请场景")
+ TESTCASE_CHILD(testcase4, "mg_sp_alloc_nodemask 内存读写验证")
+ //TESTCASE_CHILD(testcase5, "极大数量node测试")
+ TESTCASE_CHILD(testcase6_1, "mg_sp_alloc_nodemask 两个numa node内存不足")
+ TESTCASE_CHILD(testcase6_2, "mg_sp_alloc_nodemask 使用4个numa node申请足量内存")
+ //TESTCASE_CHILD(testcase6_3, "mg_sp_alloc_nodemask cgroup限制内存的使用")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_config_dvpp_range/Makefile b/tools/testing/sharepool/testcase/api_test/sp_config_dvpp_range/Makefile
new file mode 100644
index 000000000000..592e58e18fc9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_config_dvpp_range/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/sp_config_dvpp_range/test_sp_config_dvpp_range.c b/tools/testing/sharepool/testcase/api_test/sp_config_dvpp_range/test_sp_config_dvpp_range.c
new file mode 100644
index 000000000000..251e28618d61
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_config_dvpp_range/test_sp_config_dvpp_range.c
@@ -0,0 +1,367 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Dec 16 08:38:18 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include "sem_use.h"
+#include "sharepool_lib.h"
+#define PAGE_NUM 100
+
+static int addgroup(int group_id)
+{
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static int cleanup(struct sp_alloc_info *alloc_info)
+{
+ int ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_free failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+/* 进程未加组，配置dvpp地址空间，预期成功 */
+static int testcase1(void)
+{
+ struct sp_config_dvpp_range_info cdr_info = {
+ .start = DVPP_BASE + DVPP_16G,
+ .size = DVPP_16G / 2,
+ .device_id = 0,
+ .pid = getpid(),
+ };
+
+ if (ioctl_config_dvpp_range(dev_fd, &cdr_info)) {
+ pr_info("ioctl_config_dvpp_range failed unexpected");
+ return -1;
+ }
+
+ return 0;
+}
+
+/* 进程加组，但是size、pid、device_id非法 */
+static int testcase2(void)
+{
+ if (addgroup(10))
+ return -1;
+
+ struct sp_config_dvpp_range_info cdr_infos[] = {
+ {
+ .start = DVPP_BASE + DVPP_16G,
+ .size = DVPP_16G / 2,
+ .device_id = 100, // 非法
+ .pid = getpid(),
+ },
+ {
+ .start = DVPP_BASE + DVPP_16G,
+ .size = DVPP_16G / 2,
+ .device_id = 0,
+ .pid = -1, // 非法
+ },
+ {
+ .start = DVPP_BASE + DVPP_16G,
+ .size = DVPP_16G / 2,
+ .device_id = 0,
+ .pid = 32769, // 非法
+ },
+ {
+ .start = DVPP_BASE + DVPP_16G,
+ .size = 0xfffffffff, // 超过16G，非法
+ .device_id = 0,
+ .pid = getpid(),
+ },
+ };
+
+ for (int i = 0; i < sizeof(cdr_infos) / sizeof(cdr_infos[0]); i++) {
+ if (!ioctl_config_dvpp_range(dev_fd, cdr_infos + i)) {
+ pr_info("ioctl_config_dvpp_range success unexpected");
+ // return -1;
+ }
+ }
+
+ return 0;
+}
+
+/* 进程加组，参数合理，预期成功, 并且申请dvpp内存，确认是否是设置的范围 */
+static int testcase3(void)
+{
+ int ret;
+
+ if (addgroup(100))
+ return -1;
+
+ struct sp_config_dvpp_range_info cdr_info = {
+ .start = DVPP_BASE + DVPP_16G,
+ .size = DVPP_16G / 2,
+ .device_id = 0,
+ .pid = getpid(),
+ };
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 4,
+ .size = PAGE_NUM * PAGE_SIZE,
+ .spg_id = 100,
+ };
+
+ if (ioctl_config_dvpp_range(dev_fd, &cdr_info)) {
+ pr_info("ioctl_config_dvpp_range failed unexpected");
+ return -1;
+ }
+
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if(ret != 0) {
+ pr_info("sp_alloc failed errno %d\n", errno);
+ return ret;
+ } else if (alloc_info.addr < cdr_info.start &&
+ alloc_info.addr >= cdr_info.start + cdr_info.size) {
+ pr_info("the range of addr is invalid 0x%llx\n", alloc_info.addr);
+ return -1;
+ } else
+ cleanup(&alloc_info);
+
+ return 0;
+}
+
+/* 进程加组，参数合理，重复设置，预期失败 */
+static int testcase4(void)
+{
+ if (addgroup(10))
+ return -1;
+
+ struct sp_config_dvpp_range_info cdr_info = {
+ .start = DVPP_BASE + DVPP_16G,
+ .size = DVPP_16G / 2,
+ .device_id = 0,
+ .pid = getpid(),
+ };
+
+ if (ioctl_config_dvpp_range(dev_fd, &cdr_info)) {
+ pr_info("ioctl_config_dvpp_range failed unexpected");
+ return -1;
+ }
+ if (!ioctl_config_dvpp_range(dev_fd, &cdr_info)) {
+ pr_info("ioctl_config_dvpp_range successed unexpected");
+ return -1;
+ }
+
+ return 0;
+}
+
+/* 进程A配置dvpp地址空间，并且创建共享组。
+ * 申请内存，应该落在进程A的区间内。
+ * 进程B也配置不同的dvpp地址空间。
+ * 然后加组。预期成功但是有warning.
+ * 再次申请内存，所属地址空间是在进程A的。
+ * */
+
+/* size: 4 0000 0000 (16G)
+ * proc A: 0x e700 0000 0000 ~ 0x e704 0000 0000
+ * proc B: 0x e600 0000 0000 ~ 0x e604 0000 0000
+ */
+struct sp_config_dvpp_range_info dvpp_infos[] = {
+ {
+ .start = DVPP_BASE + DVPP_16G,
+ .size = DVPP_16G / 2,
+ .device_id = 0,
+ },
+ {
+ .start = DVPP_BASE + 3 * DVPP_16G,
+ .size = DVPP_16G / 2,
+ .device_id = 0,
+ },
+};
+static int semid;
+static int testcase5(void)
+{
+ int ret;
+ pid_t procA, procB;
+ unsigned long addr;
+ int spg_id = 1;
+ unsigned long size;
+
+ semid = sem_create(1234, "proc A then proc B");
+ procA = fork();
+ if (procA == 0) {
+ /* 配置dvpp地址空间 */
+ dvpp_infos[0].pid = getpid();
+ if (ioctl_config_dvpp_range(dev_fd, &dvpp_infos[0])) {
+ pr_info("proc A config dvpp failed. errno: %d", errno);
+ exit(-1);
+ }
+ if (addgroup(spg_id) < 0) {
+ pr_info("add group failed.");
+ exit(-1);
+ }
+ size = PMD_SIZE;
+ addr = (unsigned long)wrap_sp_alloc(spg_id, size, SP_DVPP | SP_HUGEPAGE);
+ if (addr == -1) {
+ pr_info("alloc failed.");
+ exit(-1);
+ }
+ if (addr < dvpp_infos[0].start ||
+ addr + size > dvpp_infos[0].start + dvpp_infos[0].size) {
+ pr_info("alloc dvpp range incorrect. addr: %lx", addr);
+ exit(-1);
+ }
+ sem_inc_by_one(semid);
+ pr_info(" proc A finished.");
+ sem_check_zero(semid);
+ sem_dec_by_one(semid);
+ exit(0);
+ }
+
+ procB = fork();
+ if (procB == 0) {
+ sem_dec_by_one(semid);
+ pr_info(" proc B started.");
+ /* 配置dvpp地址空间 */
+ dvpp_infos[1].pid = getpid();
+ if (ioctl_config_dvpp_range(dev_fd, &dvpp_infos[1])) {
+ pr_info("proc B config dvpp failed. errno: %d", errno);
+ sem_inc_by_one(semid);
+ exit(-1);
+ }
+ if (addgroup(spg_id) < 0) {
+ pr_info("add group failed");
+ sem_inc_by_one(semid);
+ exit(-1);
+ }
+ sem_inc_by_one(semid);
+ exit(0);
+ }
+
+ WAIT_CHILD_STATUS(procA, out_a);
+ WAIT_CHILD_STATUS(procB, out_b);
+out_a:
+ KILL_CHILD(procB);
+out_b:
+ sem_close(semid);
+ return ret;
+}
+
+/* 进程A配置dvpp地址空间，并且创建共享组。
+ * 但不申请内存。
+ * 进程B也配置不同的dvpp地址空间，并且申请直调内存。
+ * 然后加组。预期成功但是有warning.
+ * 再次申请内存，所属地址空间在进程B的。
+ * */
+static int testcase6(void)
+{
+ int ret;
+ pid_t procA, procB;
+ unsigned long addr;
+ int spg_id = 1;
+ unsigned long size;
+
+ semid = sem_create(1234, "proc A then proc B");
+ procA = fork();
+ if (procA == 0) {
+ /* 配置dvpp地址空间 */
+ dvpp_infos[0].pid = getpid();
+ if (ioctl_config_dvpp_range(dev_fd, &dvpp_infos[0])) {
+ pr_info("proc A config dvpp failed. errno: %d", errno);
+ exit(-1);
+ }
+ if (addgroup(spg_id) < 0) {
+ pr_info("add group failed.");
+ exit(-1);
+ }
+ sem_inc_by_one(semid);
+ pr_info(" proc A finished.");
+ sem_check_zero(semid);
+ sem_dec_by_one(semid);
+ exit(0);
+ }
+
+ procB = fork();
+ if (procB == 0) {
+ sem_dec_by_one(semid);
+ pr_info(" proc B started.");
+ /* 配置dvpp地址空间 */
+ dvpp_infos[1].pid = getpid();
+ if (ioctl_config_dvpp_range(dev_fd, &dvpp_infos[1])) {
+ pr_info("proc B config dvpp failed. errno: %d", errno);
+ sem_inc_by_one(semid);
+ exit(-1);
+ }
+ size = PMD_SIZE;
+ addr = (unsigned long)wrap_sp_alloc(SPG_ID_DEFAULT, size, SP_DVPP | SP_HUGEPAGE);
+ if (addr == -1) {
+ pr_info("alloc pass through failed.");
+ sem_inc_by_one(semid);
+ exit(-1);
+ }
+ if (addr < dvpp_infos[1].start ||
+ addr + size > dvpp_infos[1].start + dvpp_infos[1].size) {
+ pr_info("alloc dvpp range incorrect. addr: %lx", addr);
+ sem_inc_by_one(semid);
+ exit(-1);
+ }
+ if (addgroup(spg_id) < 0) {
+ pr_info("add group failed");
+ sem_inc_by_one(semid);
+ exit(-1);
+ }
+ /* 再次申请内存，检验区间 */
+ addr = (unsigned long)wrap_sp_alloc(spg_id, size, SP_DVPP | SP_HUGEPAGE);
+ if (addr == -1) {
+ pr_info("alloc failed.");
+ sem_inc_by_one(semid);
+ exit(-1);
+ }
+ if (addr < dvpp_infos[1].start ||
+ addr + size > dvpp_infos[1].start + dvpp_infos[1].size) {
+ pr_info("alloc dvpp range incorrect. addr: %lx", addr);
+ sem_inc_by_one(semid);
+ exit(-1);
+ }
+ sem_inc_by_one(semid);
+ exit(0);
+ }
+
+ WAIT_CHILD_STATUS(procA, out_a);
+ WAIT_CHILD_STATUS(procB, out_b);
+out_a:
+ KILL_CHILD(procB);
+out_b:
+ sem_close(semid);
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "进程未加组，调用dvpp_config，预期失败")
+ // TESTCASE_CHILD(testcase2, "进程加组，但是size、pid、device_id非法，预期失败")
+ TESTCASE_CHILD(testcase3, "进程加组，参数合理，预期成功, 并且申请dvpp内存，确认是否是设置的范围")
+ //TESTCASE_CHILD(testcase4, "进程加组，参数合理，重复设置，预期失败")
+ // TESTCASE_CHILD(testcase5, "DVPP地址空间合并：设置dvpp但未申请内存的进程加入已经设置不同dvpp且已申请内存的组，预期成功，有warning打印")
+ // TESTCASE_CHILD(testcase6, "DVPP地址空间合并：设置dvpp且已申请内存的进程加入已经设置不同dvpp但未申请内存的组，预期成功，有warning打印")
+
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_config_dvpp_range/test_sp_multi_numa_node.c b/tools/testing/sharepool/testcase/api_test/sp_config_dvpp_range/test_sp_multi_numa_node.c
new file mode 100644
index 000000000000..02d7a2317f25
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_config_dvpp_range/test_sp_multi_numa_node.c
@@ -0,0 +1,289 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Dec 16 08:38:18 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+
+#include "sharepool_lib.h"
+
+#define NUMA_NODES 4
+#define PAGE_NUM 10
+#define ALLOC_SIZE (1024UL * 1024UL * 20UL)
+#define DVPP_SIZE (0xffff0000)
+#define DEVICE_SHIFT 32
+static int addgroup(int group_id)
+{
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static int cleanup(struct sp_alloc_info *alloc_info)
+{
+ int ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_free failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+struct sp_config_dvpp_range_info cdr_infos[] = { // config 两P环境, pg0和pg1
+ {
+ .start = DVPP_BASE + DVPP_16G,
+ .size = DVPP_SIZE,
+ .device_id = 0,
+ },
+ {
+ .start = DVPP_BASE + DVPP_16G * 3,
+ .size = DVPP_SIZE,
+ .device_id = 1,
+ },
+};
+
+/* 进程加组，参数合理，预期成功, 并且申请dvpp内存，确认是否是设置的范围 */
+static int testcase1(void)
+{
+ int ret;
+
+ if (addgroup(100))
+ return -1;
+
+ for (int i = 0; i < sizeof(cdr_infos) / sizeof(cdr_infos[0]); i++) {
+ cdr_infos[i].pid = getpid();
+ if (ioctl_config_dvpp_range(dev_fd, &cdr_infos[i])) {
+ pr_info("ioctl_config_dvpp_range failed unexpected, errno: %d", errno);
+ return -1;
+ } else
+ pr_info("ioctl_config_dvpp_range success: node %d, start: %lx, size: %lx",
+ i, cdr_infos[i].start, cdr_infos[i].size);
+ }
+
+ return 0;
+}
+
+static int testcase2(void)
+{
+ int ret = 0;
+
+ if (addgroup(100))
+ return -1;
+
+ struct sp_alloc_info alloc_info = {
+ .flag = SP_DVPP, // 4
+ .size = ALLOC_SIZE,
+ .spg_id = 100,
+ };
+
+
+ // 用device_id申请，device_id=0申请到node0，device_id=1申请到node1
+ for (int i = 0; i < 2; i++) {
+ unsigned long device_id = i;
+ device_id = device_id << DEVICE_SHIFT;
+ alloc_info.flag = SP_DVPP | device_id;
+ pr_info("alloc %d time, flag: 0x%lx", i, alloc_info.flag);
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if(ret == -1) {
+ pr_info("sp_alloc failed errno %d\n", errno);
+ return -1;
+ } else {
+ pr_info("alloc at device %d success! va: 0x%lx", i, alloc_info.addr);
+ }
+ }
+
+ return 0;
+}
+
+static int testcase3(void)
+{
+ int ret = 0;
+
+ if (addgroup(100))
+ return -1;
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0, // 4
+ .size = ALLOC_SIZE,
+ .spg_id = 100,
+ };
+
+ for (int i = 0; i < NUMA_NODES; i++) {
+ unsigned long node_id = i;
+ node_id = node_id << NODE_ID_SHIFT;
+ alloc_info.flag = SP_SPEC_NODE_ID | node_id;
+ pr_info("alloc at node %d, flag: 0x%lx", i, alloc_info.flag);
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if(ret == -1) {
+ pr_info("sp_alloc failed errno %d\n", errno);
+ ret = -1;
+ } else {
+ pr_info("alloc at node %d success! va: 0x%lx", i, alloc_info.addr);
+ }
+ }
+
+ return 0;
+}
+
+static int testcase4(void)
+{
+ int ret = 0;
+ struct vmalloc_info vmalloc_info = {
+ .size = ALLOC_SIZE,
+ };
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'a',
+ .addr = vmalloc_info.addr,
+ .size = vmalloc_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ goto out;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = vmalloc_info.addr,
+ .size = vmalloc_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = SP_DVPP,
+ .pid = getpid(),
+ };
+
+ for (int i = 0; i < 2; i++) {
+ // 配置DVPP地址空间
+ cdr_infos[i].pid = getpid();
+ if (ioctl_config_dvpp_range(dev_fd, &cdr_infos[i])) {
+ pr_info("ioctl_config_dvpp_range failed unexpected, errno: %d", errno);
+ return -1;
+ } else
+ pr_info("ioctl_config_dvpp_range success: node %d, start: %lx, size: %lx",
+ i, cdr_infos[i].start, cdr_infos[i].size);
+
+ unsigned long device_id = i;
+ device_id = device_id << DEVICE_SHIFT;
+ k2u_info.sp_flags |= device_id;
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ goto out;
+ } else if (k2u_info.addr < cdr_infos[i].start ||
+ k2u_info.addr >= cdr_infos[i].start + cdr_infos[i].size) {
+ pr_info("the range of addr is invalid 0x%llx\n", k2u_info.addr);
+ // return -1;
+ } else
+ pr_info("k2u success for device %d, addr: %#x", i, k2u_info.addr);
+
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0)
+ pr_info("unshare failed");
+ }
+
+out:
+ ioctl_vfree(dev_fd, &vmalloc_info);
+ return ret;
+};
+
+/*
+ * 前置条件：系统中node数量不少于2，node的空闲内存不少于100M
+ * 测试步骤：1. 进程加组，从node1申请内存
+ * 2. 反复测试100次
+ * 3. 加组\直调，DVPP\normal，大页\小页组合分别测试
+ * 预期结果：申请前后node1的free内存减少的数量应不少于申请的内存数量
+ */
+#define SIZE_1M 0x100000UL
+static int test_child(int spg_id, unsigned long flags)
+{
+ int node_id = 3;
+ unsigned long size = SIZE_1M * 10;
+
+ if (spg_id != SPG_ID_DEFAULT) {
+ spg_id = wrap_add_group(getpid(), PROT_READ|PROT_WRITE, SPG_ID_AUTO);
+ if (spg_id < 0)
+ return -1;
+ }
+
+ flags |= (unsigned long)node_id << NODE_ID_SHIFT;
+ flags |= SP_SPEC_NODE_ID;
+ void *addr = wrap_sp_alloc(spg_id, size, flags);
+ if (addr == (void *)-1)
+ return -1;
+
+ int ret = ioctl_check_memory_node((unsigned long)addr, size, node_id);
+
+ wrap_sp_free(addr);
+
+ return ret;
+}
+
+static int test_route(int spg_id, unsigned long flags)
+{
+ int i, ret = 0;
+
+ for (i = 0; i < 20; i++) {
+ pid_t pid;
+ FORK_CHILD_ARGS(pid, test_child(spg_id, flags));
+
+ WAIT_CHILD_STATUS(pid, out);
+ }
+
+out:
+ if (ret)
+ pr_info("numa node alloc test failed: spg_id:%d, flag:%u, i:%d", spg_id, flags, i);
+
+ return ret;
+}
+
+static int testcase5(void) { return test_route(0, 0); } // 直调，小页
+static int testcase6(void) { return test_route(0, SP_HUGEPAGE); } // 直调，大页
+static int testcase7(void) { return test_route(1, 0); } // 加组，小页
+static int testcase8(void) { return test_route(1, SP_HUGEPAGE); } // 加组，大页
+static int testcase9(void) { return test_route(0, SP_DVPP | 0); } // 直调，小页，DVPP
+static int testcase10(void) { return test_route(0, SP_DVPP | SP_HUGEPAGE); } // 直调，大页，DVPP
+static int testcase11(void) { return test_route(1, SP_DVPP | 0); } // 加组，小页，DVPP
+static int testcase12(void) { return test_route(1, SP_DVPP | SP_HUGEPAGE); } // 加组，大页，DVPP
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "进程分别在device 0和device 1进行dvpp config，传入start和size，预期成功")
+ TESTCASE_CHILD(testcase2, "config dvpp地址空间后，用device_id申请内存，预期成功（未校验device/node是否正确）")
+ TESTCASE_CHILD(testcase3, "config dvpp地址空间后，用node_id申请内存，预期成功（未校验node是否正确）")
+ TESTCASE_CHILD(testcase4, "config dvpp地址空间后，用device_id进行k2u，并校验地址在config区间内。预期成功")
+ TESTCASE_CHILD(testcase5, "系统中node数量不少于2，node的空闲内存不少于100M。测试步骤：1. 进程加组，从node1申请内存 2. 反复测试100次 3. 加组/直调，DVPP/normal，大页/小页组合分别测试。预期结果：申请前后node1的free内存减少的数量应不少于申请的内存数量. 直调，小页")
+ TESTCASE_CHILD(testcase6, "直调，大页")
+ TESTCASE_CHILD(testcase7, "加组，小页")
+ TESTCASE_CHILD(testcase8, "加组，大页")
+ TESTCASE_CHILD(testcase9, "直调，小页，DVPP")
+ TESTCASE_CHILD(testcase10, "直调，大页，DVPP")
+ TESTCASE_CHILD(testcase11, "加组，小页，DVPP")
+ TESTCASE_CHILD(testcase12, "加组，大页，DVPP")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_free/Makefile b/tools/testing/sharepool/testcase/api_test/sp_free/Makefile
new file mode 100644
index 000000000000..592e58e18fc9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_free/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/sp_free/test_sp_free.c b/tools/testing/sharepool/testcase/api_test/sp_free/test_sp_free.c
new file mode 100644
index 000000000000..246f710f4ca8
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_free/test_sp_free.c
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Tue Dec 15 20:41:34 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <string.h>
+
+#include "sharepool_lib.h"
+
+#define PAGE_NUM 100
+
+static int addgroup(void)
+{
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+/*
+ * testcase1: 释放地址为非sp_alloc申请地址，预期失败。
+ */
+static int testcase1(void)
+{
+ int ret;
+
+ if (addgroup())
+ return -1;
+
+ char *user_addr = malloc(PAGE_NUM * PAGE_SIZE);
+ if (user_addr == NULL) {
+ pr_info("testcase1 malloc failed, errno: %d", errno);
+ return -1;
+ }
+ memset((void *)user_addr, 'q', PAGE_NUM * PAGE_SIZE);
+
+ struct sp_alloc_info fake_alloc_info = {
+ .flag = 0,
+ .size = PAGE_NUM * PAGE_SIZE,
+ .spg_id = 1,
+ .addr = (unsigned long)user_addr,
+ };
+
+ ret = ioctl_free(dev_fd, &fake_alloc_info);
+ if (ret < 0 && errno == EINVAL) {
+ pr_info("testcase1 ioctl_free failed expected");
+ free(user_addr);
+ return 0;
+ } else {
+ pr_info("testcase1 ioctl_free failed unexpected");
+ free(user_addr);
+ return -1;
+ }
+}
+
+/*
+ * testcase2: 释放地址不是sp_alloc()分配内存的起始地址，预期失败。
+ */
+static int testcase2(void)
+{
+ int ret;
+ int result;
+
+ if (addgroup())
+ return -1;
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = PAGE_NUM * PAGE_SIZE,
+ .spg_id = 1,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret != 0) {
+ pr_info("testcase2 ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+
+ alloc_info.addr += 1;
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret == 0) {
+ pr_info("testcase2 ioctl_free success unexpected");
+ return -1;
+ } else if (ret < 0 && errno == EINVAL) {
+ pr_info("testcase2 ioctl_free failed expected");
+ result = 0;
+ } else {
+ pr_info("testcase2 ioctl_free failed unexpected, errno = %d", errno);
+ result = -1;
+ }
+
+ // clean up
+ alloc_info.addr -= 1;
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("testcase2 ioctl_free failed, errno: %d", errno);
+ }
+ return result;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "释放地址为非sp_alloc申请地址，预期失败。")
+ TESTCASE_CHILD(testcase2, "释放地址不是sp_alloc()分配内存的起始地址，预期失败。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_group_add_task/Makefile b/tools/testing/sharepool/testcase/api_test/sp_group_add_task/Makefile
new file mode 100644
index 000000000000..592e58e18fc9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_group_add_task/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task.c b/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task.c
new file mode 100644
index 000000000000..54d353d9afd1
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task.c
@@ -0,0 +1,568 @@
+#include <stdio.h>
+#include <errno.h>
+#include <signal.h>
+#include <unistd.h>
+#include <stdlib.h> // for exit
+#include <pthread.h>
+#include <sys/types.h>
+#include <sys/wait.h> // for wait
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+
+/*
+ * testcase1
+ * 测试点：有效pid加组
+ * 预期结果：加组成功，返回正确组id
+ */
+static int testcase1(void)
+{
+ int ret;
+ int group_id = 10;
+ pid_t pid;
+
+ pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ while (1);
+ exit(-1);
+ } else {
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0 || ag_info.spg_id != group_id) {
+ pr_info("unexpect result, ret:%d, ag_info.spg_id:%d", ret, ag_info.spg_id);
+ ret = -1;
+ } else {
+ //pr_info("testcase1 success!!");
+ ret = 0;
+ }
+
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+ }
+
+ return ret;
+}
+
+/*
+ * testcase2
+ * 测试点：进程退出时加入指定共享组
+ * 预期结果：加组失败，错误码 -ESRCH
+ */
+static int testcase2_result = 0;
+static struct sp_add_group_info testcase2_ag_info = {
+ .spg_id = 10,
+ .prot = PROT_READ | PROT_WRITE,
+};
+
+static void testcase2_sigchld_handler(int num)
+{
+ int ret = ioctl_add_group(dev_fd, &testcase2_ag_info);
+ if (!(ret < 0 && errno == ESRCH)) {
+ pr_info("unexpect result, ret: %d, errno: %d", ret, errno);
+ testcase2_result = -1;
+ }
+}
+
+static int testcase2(void)
+{
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ while (1);
+ exit(-1);
+ } else {
+ struct sigaction osa = {0};
+ struct sigaction sa = {0};
+ sa.sa_handler = testcase2_sigchld_handler;
+ sigaction(SIGCHLD, &sa, &osa);
+ testcase2_ag_info.pid = pid;
+
+ kill(pid, SIGKILL);
+
+ waitpid(pid, NULL, 0);
+ sigaction(SIGCHLD, &osa, NULL);
+ }
+
+ return testcase2_result;
+}
+
+/*
+ * testcase3
+ * 测试点：无效pid加入共享组
+ * 预期结果：加组失败，错误码-ESRCH
+ */
+static int testcase3(void)
+{
+ struct sp_add_group_info ag_info = {
+ .pid = -1,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 10,
+ };
+
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (!(ret < 0 && errno == ESRCH)) {
+ pr_info("failed, ret:%d, errno:%d", ret, errno);
+ return -1;
+ } else {
+ //pr_info("testcase3 success!!");
+ return 0;
+ }
+}
+
+/*
+ * testcase4
+ * 测试点：有效pid（进程非退出状态）重复加入不同组
+ * 预期结果：加组失败，错误码-EEXIST
+ */
+static int testcase4(void)
+{
+ int ret;
+ int group_id = 10;
+ pid_t pid;
+
+ // 多组场景可以单进程加多组，用例失效
+ return 0;
+
+ pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ while (1);
+ exit(-1);
+ } else {
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0 || ag_info.spg_id != group_id) {
+ pr_info("first add failed, ret:%d, ag_info.spg_id:%d", ret, ag_info.spg_id);
+ ret = -1;
+ goto error_out;
+ }
+
+ ag_info.spg_id = group_id + 1;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (!(ret < 0 && errno == EEXIST)) {
+ pr_info("failed, ret:%d, errno:%d", ret, errno);
+ ret = -1;
+ } else {
+ //pr_info("testcase4 success!!");
+ ret = 0;
+ }
+
+error_out:
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+ return ret;
+ }
+}
+
+/*
+ * testcase5
+ * 测试点：有效pid（进程非退出状态）重复加入相同组
+ * 预期结果：加组失败，错误码-EEXIST
+ */
+static int testcase5(void)
+{
+ int ret;
+ int group_id = 10;
+ pid_t pid;
+
+ pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ while (1);
+ exit(-1);
+ } else {
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0 || ag_info.spg_id != group_id) {
+ pr_info("first add failed, ret:%d, ag_info.spg_id:%d", ret, ag_info.spg_id);
+ ret = -1;
+ goto error_out;
+ }
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (!(ret < 0 && errno == EEXIST)) {
+ pr_info("failed, ret:%d, errno:%d", ret, errno);
+ ret = -1;
+ } else {
+ //pr_info("testcase5 success!!");
+ ret = 0;
+ }
+
+error_out:
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+ return ret;
+ }
+}
+
+/*
+ * testcase6
+ * 测试点：不同线程加相同组
+ * 预期结果：第一个线程加组成功，其他线程加组失败，错误码-EEXIST
+ */
+static void *testcase6_7_thread1(void *data)
+{
+ int group_id = *(int *)data;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0 || ag_info.spg_id != group_id) {
+ pr_info("first add failed, ret:%d, ag_info.spg_id:%d", ret, ag_info.spg_id);
+ ret = -1;
+ }
+
+ return (void *)ret;
+}
+
+static void *testcase6_7_thread2(void *data)
+{
+ int group_id = *(int *)data;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (!(ret < 0 && errno == EEXIST)) {
+ pr_info("failed, ret:%d, errno:%d", ret, errno);
+ ret = -1;
+ } else
+ ret = 0;
+
+ return (void *)ret;
+}
+
+static int testcase6_7_child_process(int arg)
+{
+ int ret;
+ pthread_t p1, p2;
+
+ int group1 = 10;
+ int group2 = group1 + arg;
+
+ ret = pthread_create(&p1, NULL, testcase6_7_thread1, &group1);
+ if (ret) {
+ pr_info("create thread1 failed, ret: %d", ret);
+ return -1;
+ }
+ void *result = NULL;
+ pthread_join(p1, &result);
+ if (result)
+ return -1;
+
+ ret = pthread_create(&p2, NULL, testcase6_7_thread2, &group2);
+ if (ret) {
+ pr_info("create thread2 failed, ret: %d", ret);
+ return -1;
+ }
+ pthread_join(p2, &result);
+ if (result)
+ return -1;
+
+ return 0;
+}
+
+static int testcase6(void)
+{
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ int ret = testcase6_7_child_process(0);
+ if (ret)
+ pr_info("testcase6 failed!!");
+ else
+ //pr_info("testcase6 success!!");
+ exit(ret);
+ } else {
+ int status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status)) {
+ pr_info("child process exited unexpected");
+ return -1;
+ }
+ return (char)WEXITSTATUS(status);
+ }
+}
+
+/*
+ * testcase7
+ * 测试点：不同线程加不同组
+ * 预期结果：第一个线程加组成功，其他线程加组失败，错误码-EEXIST
+ */
+static int testcase7(void)
+{
+ // 多组场景可以单进程加多组，用例失效
+ return 0;
+
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ int ret = testcase6_7_child_process(1);
+ if (ret)
+ pr_info("testcase7 failed!!");
+ else
+ //pr_info("testcase7 success!!");
+ exit(ret);
+ } else {
+ int status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status)) {
+ pr_info("child process exited unexpected");
+ return -1;
+ }
+ return (char)WEXITSTATUS(status);
+ }
+}
+
+/*
+ * testcase8
+ * 测试点：父进程加组后fork子进程加相同的组
+ * 预期结果：子进程加组失败，错误码-EEXIST
+ */
+
+/*
+ * 入参为0表示父子进程加入相同的组，非0表示加入不同的组
+ */
+static int testcase8_9_child(int arg)
+{
+ int group_id = 10;
+ pid_t pid;
+
+ char *sem_name = "/add_task_testcase8";
+ sem_t *sync = sem_open(sem_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sem_name);
+
+ pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ int ret;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id + arg,
+ };
+
+ do {
+ ret = sem_wait(sync);
+ } while (ret && errno == EINTR);
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed, ret:%d, errno:%d", ret, errno);
+ } else {
+ ret = 0;
+ }
+
+ exit(ret);
+ } else {
+ int ret;
+ int status = 0;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ sem_post(sync);
+ if (ret < 0) {
+ pr_info("add group failed");
+ ret = -1;
+ goto error_out;
+ }
+
+error_out:
+ waitpid(pid, &status, 0);
+ if (!ret)
+ ret = (char)WEXITSTATUS(status);
+ return ret;
+ }
+}
+
+static int testcase8(void)
+{
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(testcase8_9_child(0));
+ } else {
+ int status = 0;
+ waitpid(pid, &status, 0);
+ int ret = (char)WEXITSTATUS(status);
+ if (ret) {
+ return -1;
+ } else {
+ return 0;
+ }
+ }
+}
+
+/*
+ * testcase9
+ * 测试点：父进程加组后fork子进程加不同的组
+ * 预期结果：子进程加组成功
+ */
+static int testcase9(void)
+{
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(testcase8_9_child(1));
+ } else {
+ int status = 0;
+ waitpid(pid, &status, 0);
+ int ret = (char)WEXITSTATUS(status);
+ if (ret) {
+ return -1;
+ } else {
+ return 0;
+ }
+ }
+}
+
+/*
+ * testcase10
+ * 测试点：有效pid加入非法组
+ * 预期结果：加组失败，错误码-EINVAL
+ */
+static int testcase10(void)
+{
+ int ret = 0;
+ int group_ids[] = {0, -1, 100000, 200001, 800000, 900001};
+
+ for (int i = 0; !ret && i < sizeof(group_ids) / sizeof(int); i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ while (1);
+ exit(-1);
+ } else {
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_ids[i],
+ };
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (!(ret < 0 && errno == EINVAL)) {
+ pr_info("failed, ret: %d, errno: %d", ret, errno);
+ ret = -1;
+ } else
+ ret = 0;
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+ }
+ }
+
+ return ret;
+}
+
+/*
+ * testcase11
+ * 测试点：有效pid加组，spg_id=SPG_ID_AUTO
+ * 预期结果：加组成功，自动生成[SPG_ID_AUTO_MIN, SPG_ID_AUTO_MAX]之间的组id
+ */
+static int testcase11(void)
+{
+ int ret;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ while (1);
+ exit(-1);
+ } else {
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = SPG_ID_AUTO,
+ };
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0 || ag_info.spg_id < SPG_ID_AUTO_MIN
+ || ag_info.spg_id > SPG_ID_AUTO_MAX) {
+ pr_info("failed, ret: %d, errno: %d, spg_id: %d",
+ ret, errno, ag_info.spg_id);
+ ret = -1;
+ }
+
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+ }
+
+ //pr_info("testcase11 %s!!", ret ? "failed" : "success");
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE(testcase1, "有效pid加组，预期成功，返回正确组Id")
+ TESTCASE(testcase2, "进程退出时加入指定共享组，预期结果：加组失败，错误码 -ESRCH")
+ TESTCASE(testcase3, "无效pid加入共享组，预期结果：加组失败，错误码-ESRCH")
+ TESTCASE(testcase4, "有效pid（进程非退出状态）重复加入不同组，预期结果：加组失败，错误码-EEXIST")
+ TESTCASE(testcase5, "有效pid（进程非退出状态）重复加入相同组，预期结果：加组失败，错误码-EEXIST")
+ TESTCASE(testcase6, "不同线程加相同组，预期结果：第一个线程加组成功，其他线程加组失败，错误码-EEXIST")
+ TESTCASE(testcase7, "不同线程加不同组，预期结果：第一个线程加组成功，其他线程加组失败，错误码-EEXIST")
+ TESTCASE(testcase8, "父进程加组后fork子进程加相同的组，预期结果：子进程加组失败，错误码-EEXIST")
+ TESTCASE(testcase9, "父进程加组后fork子进程加不同的组，预期结果：子进程加组成功")
+ TESTCASE(testcase10, "有效pid加入非法组，预期结果：加组失败，错误码-EINVAL")
+ TESTCASE(testcase11, "有效pid加组，spg_id=SPG_ID_AUTO，预期结果：加组成功，自动生成[SPG_ID_AUTO_MIN, SPG_ID_AUTO_MAX]之间的组id")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task2.c b/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task2.c
new file mode 100644
index 000000000000..d31e409e110e
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task2.c
@@ -0,0 +1,254 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Tue May 18 03:09:01 2021
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <signal.h>
+#include <unistd.h>
+#include <stdlib.h> // for exit
+#include <sys/mman.h>
+
+#include "sharepool_lib.h"
+
+
+/*
+ * 单进程两次加不同组
+ * 预期加组成功
+ */
+static int testcase1(void)
+{
+ int ret;
+ pid_t pid;
+
+ FORK_CHILD_DEADLOOP(pid);
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = SPG_ID_AUTO,
+ };
+
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+ ag_info.spg_id = SPG_ID_AUTO;
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+
+out:
+ KILL_CHILD(pid);
+ return ret;
+}
+
+/*
+ * 单进程两次加相同组
+ * 预期第二次加组失败，错误码EEXIST
+ */
+static int testcase2(void)
+{
+ int ret;
+ pid_t pid;
+
+ FORK_CHILD_DEADLOOP(pid);
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = SPG_ID_AUTO,
+ };
+
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+ TEST_CHECK_FAIL(ioctl_add_group(dev_fd, &ag_info), EEXIST, out);
+
+out:
+ KILL_CHILD(pid);
+ return ret;
+}
+
+/*
+ * 多个进程都加入多个组
+ * 预期加组成功
+ */
+#define testcase3_group_num 10
+#define testcase3_child_num 20
+static int testcase3_child(int idx, sem_t *sync)
+{
+ int ret;
+
+ SEM_WAIT(sync);
+
+ pr_info("child idx: %d", idx);
+
+ return 0;
+}
+
+static int testcase3(void)
+{
+ int ret, i, j;
+ pid_t pid[testcase3_child_num];
+ sem_t *sync[testcase3_child_num];
+ int group_num = testcase3_group_num;
+ int groups[testcase3_group_num];
+
+ for (i = 0; i < testcase3_child_num; i++)
+ SEM_INIT(sync[i], i);
+
+ for (i = 0; i < testcase3_child_num; i++)
+ FORK_CHILD_ARGS(pid[i], testcase3_child(i, sync[i]));
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid[0],
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = SPG_ID_AUTO,
+ };
+
+ for (i = 0; i < group_num; i++) {
+ ag_info.spg_id = SPG_ID_AUTO;
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+ groups[i] = ag_info.spg_id;
+ }
+
+ for (i = 0; i < group_num; i++) {
+ ag_info.spg_id = groups[i];
+ for (j = 1; j < testcase3_child_num; j++) {
+ ag_info.pid = pid[j];
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+ }
+ }
+
+ for (i = 0; i < testcase3_child_num; i++)
+ sem_post(sync[i]);
+
+ for (i = 0; i < testcase3_child_num;i++)
+ waitpid(pid[0], NULL, 0);
+
+out:
+ return ret;
+}
+
+/*
+ * 多个进程都加入多个组，首进程申请内存，并写入，后面的进程读数据
+ * 预期加组成功，读写内存成功
+ */
+#define testcase4_group_num 10
+#define testcase4_child_num 11
+#define testcase4_buf_size 0x1024
+
+struct testcase4_data {
+ int group_id;
+ void *share_area;
+};
+
+static int testcase4_writer(sem_t **sync, struct testcase4_data *data)
+{
+ int ret, i;
+
+ SEM_WAIT(sync[0]);
+
+ for (i = 0; i < testcase4_group_num; i++) {
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = testcase4_buf_size,
+ .spg_id = data[i].group_id,
+ };
+ TEST_CHECK(ioctl_alloc(dev_fd, &alloc_info), out);
+ data[i].share_area = (void *)alloc_info.addr;
+ memset(data[i].share_area, 'a', testcase4_buf_size);
+ }
+
+ for (i = 1; i < testcase4_child_num; i++)
+ sem_post(sync[i]);
+
+out:
+ return ret;
+}
+
+static int testcase4_reader(sem_t *sync, struct testcase4_data *data)
+{
+ int ret, i, j;
+
+ SEM_WAIT(sync);
+
+ for (i = 0; i < testcase4_group_num; i++) {
+ char *base = data[i].share_area;
+ for (j = 0; j < testcase4_buf_size; j++)
+ if (base[j] != 'a') {
+ pr_info("unexpect result: i = %d, base[%d]: %d", i, j, base[j]);
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase4(void)
+{
+ int ret, i, j, fd;
+ pid_t pid[testcase4_child_num];
+ sem_t *sync[testcase4_child_num];
+ struct testcase4_data *data = mmap(NULL, sizeof(*data) * testcase4_child_num,
+ PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+ if (data == MAP_FAILED) {
+ pr_info("map failed");
+ return -1;
+ }
+
+ for (i = 0; i < testcase4_child_num; i++)
+ SEM_INIT(sync[i], i);
+
+ FORK_CHILD_ARGS(pid[0], testcase4_writer(sync, data));
+ for (i = 1; i < testcase4_child_num; i++)
+ FORK_CHILD_ARGS(pid[i], testcase4_reader(sync[i], data));
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid[0],
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = SPG_ID_AUTO,
+ };
+
+ for (i = 0; i < testcase4_group_num; i++) {
+ ag_info.spg_id = SPG_ID_AUTO;
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out_kill);
+ data[i].group_id = ag_info.spg_id;
+ }
+
+ for (i = 0; i < testcase4_group_num; i++) {
+ ag_info.spg_id = data[i].group_id;
+ for (j = 1; j < testcase4_child_num; j++) {
+ ag_info.pid = pid[j];
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out_kill);
+ }
+ }
+
+ sem_post(sync[0]);
+
+ for (i = 0; i < testcase4_child_num; i++)
+ WAIT_CHILD_STATUS(pid[i], out_kill);
+
+ return 0;
+
+out_kill:
+ for (i = 0; i < testcase4_child_num; i++)
+ kill(pid[i], SIGKILL);
+out:
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE(testcase1, "单进程两次加不同组，预期：加组成功")
+ TESTCASE(testcase2, "单进程两次加相同组，预期：第二次加组失败，错误码EEXIST")
+ TESTCASE(testcase3, "多个进程都加入多个组，预期：加组成功")
+ TESTCASE(testcase4, "多个进程都加入多个组，首进程申请内存，并写入，后面的进程读数据。预期：加组成功，读写内存成功")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task3.c b/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task3.c
new file mode 100644
index 000000000000..b56999ba371e
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task3.c
@@ -0,0 +1,250 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed May 19 06:19:21 2021
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <signal.h>
+#include <unistd.h>
+#include <stdlib.h> // for exit
+#include <sys/mman.h>
+
+#include "sharepool_lib.h"
+
+
+/*
+ * 进程加组，设置成只读权限，尝试读写普通内存和共享内存
+ * 预期普通内存读写成功，共享内存读成功，写失败
+ */
+static int testcase1(void)
+{
+ int ret;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ,
+ .spg_id = SPG_ID_AUTO,
+ };
+
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+
+ char *buf = mmap(NULL, 1024, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
+ if (buf == MAP_FAILED) {
+ pr_info("mmap failed");
+ return -1;
+ }
+ memset(buf, 'a', 10);
+ memcpy(buf + 20, buf, 10);
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 1024,
+ .spg_id = ag_info.spg_id,
+ };
+ TEST_CHECK(ioctl_alloc(dev_fd, &alloc_info), out);
+
+ buf = (char *)alloc_info.addr;
+ /* 这一步应该触发segment fault */
+ memset(buf, 'a', 10);
+ memcpy(buf + 20, buf, 10);
+ if (strncmp(buf, buf + 20, 10))
+ pr_info("compare failed");
+ else
+ pr_info("compare success");
+
+ // unaccessable
+ pr_info("ERROR!! unaccessable statement reach");
+ return -1;
+out:
+ return ret;
+}
+
+/*
+ * 进程A加组，申请共享内存，读写；进程B加组，设置成只读权限，读写进程A申请的共享内存。
+ * 预期进程B读成功，写失败。
+ */
+static int testcase2_child(char *addr, sem_t *sync)
+{
+ int ret;
+ pr_info("in child process");
+
+ SEM_WAIT(sync);
+
+ pr_info("first two char: %c %c", addr[0], addr[1]);
+ if (addr[0] != 'a' || addr[1] != 'a') {
+ pr_info("memory context check failed");
+ return -1;
+ }
+
+ addr[1] = 'b';
+
+ // unaccessable
+ pr_info("ERROR!! unaccessable statement reach");
+
+ return -1;
+}
+
+static int testcase2(void)
+{
+ int ret;
+ pid_t pid;
+ sem_t *sync;
+ SEM_INIT(sync, 0);
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = SPG_ID_AUTO,
+ };
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 1024,
+ .spg_id = ag_info.spg_id,
+ };
+ TEST_CHECK(ioctl_alloc(dev_fd, &alloc_info), out);
+ char *buf = (char *)alloc_info.addr;
+ memset(buf, 'a', 10);
+
+ FORK_CHILD_ARGS(pid, testcase2_child(buf, sync));
+ ag_info.pid = pid;
+ ag_info.prot = PROT_READ;
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+
+ sem_post(sync);
+
+ WAIT_CHILD_SIGNAL(pid, SIGSEGV, out);
+
+out:
+ return ret;
+}
+
+/*
+ * 测试步骤：两个进程加同一组，A读写，B只读，然后A申请内存，A读写内存，B读、写
+ * 预期结果：加组成功， A写成功，B读成功，写失败
+ */
+static int testcase3_child(char **paddr, sem_t *sync)
+{
+ int ret;
+ pr_info("in child process");
+
+ SEM_WAIT(sync);
+
+ char *addr = *paddr;
+
+ pr_info("first two char: %c %c", addr[0], addr[1]);
+ if (addr[0] != 'a' || addr[1] != 'a') {
+ pr_info("memory context check failed");
+ return -1;
+ }
+
+ addr[1] = 'b';
+
+ // unaccessable
+ pr_info("ERROR!! unaccessable statement reach");
+
+ return -1;
+}
+
+static int testcase3(void)
+{
+ int ret;
+ pid_t pid;
+ sem_t *sync;
+ SEM_INIT(sync, 0);
+
+ char **paddr = mmap(NULL, sizeof(*paddr), PROT_READ | PROT_WRITE,
+ MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = SPG_ID_AUTO,
+ };
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+
+ FORK_CHILD_ARGS(pid, testcase3_child(paddr, sync));
+ ag_info.pid = pid;
+ ag_info.prot = PROT_READ;
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 1024,
+ .spg_id = ag_info.spg_id,
+ };
+ TEST_CHECK(ioctl_alloc(dev_fd, &alloc_info), out);
+ char *buf = (char *)alloc_info.addr;
+ memset(buf, 'a', 10);
+ *paddr = buf;
+
+ sem_post(sync);
+
+ WAIT_CHILD_SIGNAL(pid, SIGSEGV, out);
+
+out:
+ return ret;
+}
+
+/*
+ * 进程加组，权限位无效，0，设置无效bit
+ * 预期返回错误
+ */
+static int testcase4(void)
+{
+ int i, ret;
+
+ struct sp_add_group_info ag_info[] = {
+ {
+ .pid = getpid(),
+ .prot = 0,
+ .spg_id = SPG_ID_AUTO,
+ },
+ {
+ .pid = getpid(),
+ .prot = PROT_EXEC,
+ .spg_id = SPG_ID_AUTO,
+ },
+ {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_EXEC,
+ .spg_id = SPG_ID_AUTO,
+ },
+ {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE | PROT_EXEC,
+ .spg_id = SPG_ID_AUTO,
+ },
+ };
+
+ for (i = 0; i < ARRAY_SIZE(ag_info); i++) {
+ ret = ioctl_add_group(dev_fd, ag_info + i);
+ if (!(ret == -1 && errno == EINVAL)) {
+ pr_info("ioctl_add_group return unexpected, i:%d, ret:%d, errno:%d", i, ret, errno);
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD_SIGNAL(testcase1, SIGSEGV, "进程加组，设置成只读权限，尝试读写普通内存和共享内存。预期：普通内存读写成功，共享内存读成功，写失败")
+ TESTCASE_CHILD(testcase2, "进程A加组，申请共享内存，读写；进程B加组，设置成只读权限，读写进程A申请的共享内存。预期：进程B读成功，写失败。")
+ TESTCASE_CHILD(testcase3, "两个进程加同一组，A读写，B只读，然后A申请内存，A读写内存，B读、写。预期：加组成功， A写成功，B读成功，写失败")
+ TESTCASE_CHILD(testcase4, "进程加组，权限位无效，0，设置无效bit。预期：返回错误")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task4.c b/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task4.c
new file mode 100644
index 000000000000..fbd2073333d6
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task4.c
@@ -0,0 +1,148 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Sat May 29 07:24:40 2021
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <signal.h>
+#include <unistd.h>
+#include <stdlib.h> // for exit
+#include <sys/mman.h>
+#include <pthread.h>
+
+#include "sharepool_lib.h"
+
+
+#define MAX_PROCESS_PER_GROUP 1024
+#define MAX_GROUP_PER_PROCESS 3000
+
+/*
+ * 测试步骤：单进程循环加组
+ * 预期结果：第3000次加组失败，前面加组成功
+ */
+static int testcase1(void)
+{
+ int i, ret;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ,
+ };
+
+ for (i = 0; i < MAX_GROUP_PER_PROCESS - 1; i++) {
+ ag_info.spg_id = SPG_ID_AUTO;
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+ }
+
+ ag_info.spg_id = SPG_ID_AUTO;
+ TEST_CHECK_FAIL(ioctl_add_group(dev_fd, &ag_info), ENOSPC, out);
+
+out:
+ return ret;
+}
+
+/*
+ * 测试步骤：多线程并发加组
+ * 预期结果，所有线程加组成功次数为2999
+ */
+static void *test2_thread(void *arg)
+{
+ int i, ret = 0;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ,
+ };
+
+ for (i = 0; i < MAX_GROUP_PER_PROCESS - 1; i++) {
+ ag_info.spg_id = SPG_ID_AUTO;
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+ }
+
+out:
+ pr_info("thread%d, returned, %d groups has been added successfully", (int)arg, i);
+ return (void *)i;
+}
+
+#define TEST2_THERAD_NUM 20
+static int testcase2(void)
+{
+ int i, ret, sum = 0;
+ void *val;
+ pthread_t th[TEST2_THERAD_NUM];
+
+ for (i = 0; i < ARRAY_SIZE(th); i++)
+ TEST_CHECK(pthread_create(th + i, NULL, test2_thread, (void *)i), out);
+
+ for (i = 0; i < ARRAY_SIZE(th); i++) {
+ TEST_CHECK(pthread_join(th[i], &val), out);
+ sum += (int)val;
+ }
+
+ if (sum != MAX_GROUP_PER_PROCESS - 1) {
+ pr_info("MAX_GROUP_PER_PROCESS check failed, %d", sum);
+ return -1;
+ }
+
+out:
+ return ret;
+}
+
+/*
+ * 功能未实现
+ * 测试点：单组进程上限1024
+ * 测试步骤：进程不断fork，并且给子进程加组
+ * 预期结果：有1023个进程加组成功
+ */
+
+static int testcase3(void)
+{
+ int i = 0, ret;
+ pid_t pid[MAX_PROCESS_PER_GROUP + 1];
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+
+ for (i = 0; i < MAX_PROCESS_PER_GROUP + 1; i++) {
+ FORK_CHILD_SLEEP(pid[i]);
+ ag_info.pid = pid[i];
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+ }
+
+out:
+ if (i == MAX_PROCESS_PER_GROUP - 1) {
+ ret = 0;
+ pr_info("%d processes added to a group, success", i);
+ } else {
+ ret = -1;
+ pr_info("%d processes added to a group, failed", i);
+ }
+
+ while (i >= 0) {
+ KILL_CHILD(pid[i]);
+ i--;
+ }
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "单进程循环加组。预期结果：第3000次加组失败，前面加组成功")
+ TESTCASE_CHILD(testcase2, "多线程并发加组。预期结果：所有线程加组成功次数为2999")
+ TESTCASE_CHILD(testcase3, "单组进程上限1024；进程不断fork，并且给子进程加组。预期结果：有1023个进程加组成功")
+};
+
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task5.c b/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task5.c
new file mode 100644
index 000000000000..30ae4e1f6cf9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_group_add_task/test_sp_group_add_task5.c
@@ -0,0 +1,113 @@
+#include <stdio.h>
+#include <errno.h>
+#include <signal.h>
+#include <unistd.h>
+#include <stdlib.h> // for exit
+#include <pthread.h>
+#include <sys/types.h>
+#include <sys/wait.h> // for wait
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+#include "sem_use.h"
+
+#define GROUP_NUM 2999
+#define PROC_NUM 100
+
+int sem;
+int sem_dump;
+
+void *thread_dump(void *arg)
+{
+ sem_dec_by_one(sem_dump);
+ generateCoredump();
+ return (void *)0;
+}
+
+static int tc1_child(void)
+{
+ int ret = 0;
+ pthread_t thread;
+
+ pthread_create(&thread, NULL, thread_dump, NULL);
+ sem_dec_by_one(sem);
+ pr_info("child %d starts add group", getpid());
+ for (int i = 0; i < GROUP_NUM; i++) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, i + 1);
+ if (ret < 0)
+ break;
+ }
+
+ return 0;
+}
+
+/*
+ * testcase1
+ * 测试点：有效pid加组
+ * 预期结果：加组成功，返回正确组id
+ */
+static int testcase1(void)
+{
+ int ret;
+ int pid;
+ int child[PROC_NUM];
+
+ sem = sem_create(1234, "12");
+ sem_dump = sem_create(3456, "sem for coredump control");
+
+ for (int i = 0; i < GROUP_NUM; i++) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, i + 1);
+ if (ret < 0) {
+ pr_info("create group failed");
+ return -1;
+ }
+ for (int j = 0; j < 5; j++)
+ ret = wrap_sp_alloc(i + 1, 4096, 0);
+ }
+ pr_info("create all groups success\n");
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(tc1_child());
+ } else {
+ child[i] = pid;
+ }
+ }
+
+ sem_inc_by_val(sem, PROC_NUM);
+ pr_info("create all processes success\n");
+
+ sleep(3);
+
+ sem_inc_by_val(sem_dump, PROC_NUM);
+
+ for (int i = 0; i < PROC_NUM; i++)
+ WAIT_CHILD_STATUS(child[i], out);
+out:
+ sem_close(sem);
+ sem_close(sem_dump);
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE(testcase1, "拉起多个进程创建组，上限49999，同时令其coredump")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_group_del_task/Makefile b/tools/testing/sharepool/testcase/api_test/sp_group_del_task/Makefile
new file mode 100644
index 000000000000..592e58e18fc9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_group_del_task/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/sp_group_del_task/test_sp_group_del_task.c b/tools/testing/sharepool/testcase/api_test/sp_group_del_task/test_sp_group_del_task.c
new file mode 100644
index 000000000000..090cfd514dae
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_group_del_task/test_sp_group_del_task.c
@@ -0,0 +1,1083 @@
+#include "sharepool_lib.h"
+#include "sem_use.h"
+#include <stdlib.h>
+#include <errno.h>
+#include <assert.h>
+#include <pthread.h>
+#include <sys/types.h>
+
+#define PROC_NUM 8
+#define THREAD_NUM 5
+#define GROUP_NUM 16
+#define ALLOC_TYPE 4
+#define REPEAT_TIMES 2
+#define ALLOC_SIZE PAGE_SIZE
+#define PROT (PROT_READ | PROT_WRITE)
+
+static int group_ids[GROUP_NUM];
+static int default_id = 1;
+static int semid;
+
+static int add_multi_group();
+static int check_multi_group();
+static int delete_multi_group();
+static int process();
+void *thread_and_process_helper(int group_id);
+void *del_group_thread(void *arg);
+void *del_proc_from_group(void *arg);
+
+/* testcase1: A and B 加组，A调用sp_group_del_task退出组。预期成功 */
+static int testcase1(void)
+{
+ int ret= 0;
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ int pid = fork();
+ if (pid == 0) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+ sharepool_print();
+ ret = wrap_del_from_group(getpid(), default_id);
+ pr_info("\nafter delete process %d\n", getpid());
+ sharepool_print();
+ exit(ret);
+ }
+
+ int status;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status)) {
+ pr_info("child process exited unexpected");
+ return -1;
+ }
+
+ return 0;
+}
+
+/* testcase2: A and B 加组，B申请了内存。A调用sp_group_del_task退出组。预期失败 */
+static int testcase2(void)
+{
+ int ret = 0;
+ void *pret;
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+ pret = wrap_sp_alloc(default_id, ALLOC_SIZE, 0);
+ if (pret == (void *)-1) {
+ pr_info("process %d alloc failed.", getpid());
+ ret = -1;
+ } else {
+ pr_info("process %d alloc success.", getpid());
+ ret = 0;
+ }
+
+ int pid = fork();
+ if (pid == 0) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+ sharepool_print();
+ ret = wrap_del_from_group(getpid(), default_id);
+ if (ret < 0) {
+ pr_info("delete failed, errno: %d", errno);
+ } else {
+ pr_info("delete success");
+ }
+ pr_info("\nafter delete process %d\n", getpid());
+ sharepool_print();
+ exit(ret);
+ }
+
+ int status;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status)) {
+ pr_info("child process exited unexpected");
+ return -1;
+ }
+
+ return 0;
+}
+
+/* testcase3: A加组，A调用sp_group_del_task退出组。预期成功 */
+static int testcase3(void)
+{
+ int ret = 0;
+
+ int pid = fork();
+ if (pid == 0) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+ sharepool_print();
+ ret = wrap_del_from_group(getpid(), default_id);
+ if (ret < 0) {
+ pr_info("delete failed, errno: %d", errno);
+ } else {
+ pr_info("delete success");
+ }
+ pr_info("\nafter delete process %d\n", getpid());
+ sharepool_print();
+ exit(ret);
+ }
+
+ int status;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status)) {
+ pr_info("child process exited unexpected");
+ return -1;
+ }
+
+ return 0;
+}
+
+/* testcase4: A加组并申请内存。A调用sp_group_del_task退出组。预期失败。再free再del，预期成功 */
+static int testcase4(void)
+{
+ int ret = 0;
+
+ int pid = fork();
+ if (pid == 0) {
+ void *addr;
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ addr = wrap_sp_alloc(default_id, PAGE_SIZE, 0);
+ if (addr == (void *)-1) {
+ pr_info("process %d alloc failed.", getpid());
+ } else {
+ pr_info("process %d alloc success.", getpid());
+ }
+ sharepool_print();
+
+ ret = wrap_del_from_group(getpid(), default_id);
+ if (ret < 0) {
+ pr_info("delete failed, errno: %d", errno);
+ } else {
+ pr_info("delete success");
+ }
+
+ ret = wrap_sp_free(addr);
+ if (ret < 0) {
+ pr_info("process %d free failed.", getpid());
+ } else {
+ pr_info("process %d free success.", getpid());
+ }
+
+ ret = wrap_del_from_group(getpid(), default_id);
+ if (ret < 0) {
+ pr_info("delete failed, errno: %d", errno);
+ } else {
+ pr_info("delete success");
+ }
+
+ pr_info("\nafter delete process %d\n", getpid());
+ sharepool_print();
+ exit(ret);
+ }
+
+ int status;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status)) {
+ pr_info("child process exited unexpected");
+ return -1;
+ }
+
+ return 0;
+}
+
+/* testcase5: N个进程在未申请内存的组中，并发退组。预期成功 */
+static int testcase5(void)
+{
+ int ret = 0;
+ pid_t childs[PROC_NUM];
+
+ semid = sem_create(1234, "concurrent delete from group");
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed.");
+ return -1;
+ } else if (pid == 0) {
+ ret = add_multi_group();
+ if (ret < 0) {
+ pr_info("process %d add all groups failed.", getpid());
+ exit(-1);
+ }
+ ret = check_multi_group();
+ if (ret < 0) {
+ pr_info("process %d check all groups failed.", getpid());
+ exit(-1);
+ } else {
+ pr_info("process %d check all groups success.", getpid());
+ }
+
+ sem_inc_by_one(semid);
+ sem_check_zero(semid);
+
+ ret = delete_multi_group();
+ exit(ret);
+ } else {
+ childs[i] = pid;
+ }
+ }
+
+ sem_dec_by_val(semid, PROC_NUM);
+ for (int i = 0; i < PROC_NUM; i++) {
+ int status = 0;
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d test failed, %d", i, status);
+ ret = -1;
+ }
+ }
+
+ sem_close(semid);
+ return ret;
+}
+
+/* testcase6: N个进程在申请内存的组中，并发退组。预期失败 */
+static int testcase6(void)
+{
+ int ret = 0;
+ void *pret;
+ pid_t childs[PROC_NUM];
+
+ semid = sem_create(1234, "concurrent delete from group");
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed.");
+ return -1;
+ } else if (pid == 0) {
+ pr_info("fork child %d success", getpid());
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("add group failed %d", getpid());
+ sem_inc_by_one(semid);
+ exit(-1);
+ }
+ pret = wrap_sp_alloc(default_id, ALLOC_SIZE, 0);
+ if (pret == (void *)-1) {
+ pr_info("alloc failed %d", getpid());
+ sem_inc_by_one(semid);
+ exit(-1);
+ } else {
+ pr_info("alloc addr: %lx", pret);
+ }
+
+ sem_inc_by_one(semid);
+ sem_check_zero(semid);
+
+ pr_info("child %d del", getpid());
+ ret = wrap_del_from_group(getpid(), default_id);
+ if (ret == 0)
+ exit(-1);
+ exit(0);
+ } else {
+ childs[i] = pid;
+ }
+ }
+
+ sem_dec_by_val(semid, PROC_NUM);
+ for (int i = 0; i < PROC_NUM; i++) {
+ int status = 0;
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d test failed, %d", i, status);
+ ret = -1;
+ } else {
+ pr_info("child%d test success, %d", i, status);
+ }
+ }
+
+ sem_close(semid);
+ sharepool_print();
+
+ return ret;
+}
+
+/* testcase7: 主进程申请释放，子进程一边加组一边退组。一段时间后杀死，预期无死锁/泄漏 */
+static int testcase7(void)
+{
+ int ret = 0;
+ int childs[PROC_NUM];
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("parent %d add into group failed. errno: %d", getpid(), ret);
+ return -1;
+ }
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ int pid = fork();
+ if (pid == 0) {
+ while (1) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0)
+ pr_info("child %d add into group failed. errno: %d", getpid(), ret);
+ ret = wrap_del_from_group(getpid(), default_id);
+ if (ret < 0)
+ pr_info("child %d del from group failed. errno: %d", getpid(), ret);
+ }
+ } else {
+ childs[i] = pid;
+ }
+ }
+
+ int alloc_time = 200, j = 0;
+ void *pret;
+ while (j++ < 200) {
+ pret = wrap_sp_alloc(default_id, ALLOC_SIZE, 0);
+ if (pret == (void *)-1)
+ pr_info("alloc failed errno %d", errno);
+ else {
+ ret = wrap_sp_free(ret);
+ if (ret < 0) {
+ pr_info("free failed errno %d", ret);
+ goto free_error;
+ }
+ }
+ }
+
+free_error:
+ for (int i = 0; i < PROC_NUM; i++) {
+ kill(childs[i], SIGKILL);
+ int status;
+ waitpid(childs[i], &status, 0);
+ }
+
+ sharepool_print();
+ return 0;
+}
+
+/* testcase8: N个进程加组，一半进程退组，一半进程退出。预期稳定 */
+static int testcase8(void)
+{
+ int ret = 0;
+ int childs[PROC_NUM];
+
+ semid = sem_create(1234, "half exit, half delete");
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ int pid = fork();
+ if (pid == 0) {
+ //ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ add_multi_group();
+ check_multi_group();
+
+ sem_inc_by_one(semid);
+ sem_check_zero(semid);
+
+ if (getpid() % 2) {
+ pr_info("child %d exit", getpid());
+ exit(0);
+ } else {
+ pr_info("child %d del", getpid());
+ //ret = wrap_del_from_group(getpid(), default_id);
+ ret = delete_multi_group();
+ exit(ret);
+ }
+ } else {
+ childs[i] = pid;
+ }
+ }
+
+ sem_dec_by_val(semid, PROC_NUM);
+ for (int i = 0; i < PROC_NUM; i++) {
+ int status = 0;
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d test failed, %d", i, status);
+ ret = -1;
+ }
+ }
+
+ sharepool_print();
+ sem_close(semid);
+ return ret;
+}
+
+/* testcase9: N个进程加组，顺序进行加组-alloc-free-u2k-k2u-退组。预期稳定 */
+static int testcase9(void)
+{
+ int ret = 0;
+ int childs[PROC_NUM];
+
+ return 0;
+ for (int i = 0; i < PROC_NUM; i++) {
+ int pid = fork();
+ if (pid == 0) {
+ add_multi_group();
+ if (check_multi_group()) {
+ pr_info("child %d add all groups check failed.", getpid());
+ exit(-1);
+ }
+ exit(process());
+ } else {
+ childs[i] = pid;
+ }
+ }
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ int status = 0;
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d test failed, %d", i, status);
+ ret = -1;
+ }
+ }
+
+ sharepool_print();
+ return ret;
+}
+
+/* testcase10: 多线程并发调用删除接口。预期只有一个执行成功 */
+static int testcase10(void)
+{
+ int ret = 0;
+ int del_fail = 0, del_succ = 0;
+ void *tret;
+ pthread_t threads[THREAD_NUM];
+
+ semid = sem_create(1234, "call del_group when all threads are ready.");
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process add group failed.");
+ return -1;
+ }
+ for (int i = 0; i < THREAD_NUM; i++) {
+ ret = pthread_create(threads + i, NULL, del_group_thread, (void *)i);
+ if (ret < 0) {
+ pr_info("pthread create failed.");
+ return -1;
+ }
+ }
+
+ // wait until all threads are created.
+ sharepool_print();
+ sem_dec_by_val(semid, THREAD_NUM);
+
+ for (int i = 0; i < THREAD_NUM; i++) {
+ ret = pthread_join(threads[i], &tret);
+ if (ret < 0) {
+ pr_info("pthread %d join failed.", i);
+ ret = -1;
+ }
+ if ((long)tret < 0) {
+ pr_info("thread %dth del failed", i);
+ del_fail++;
+ } else {
+ pr_info("thread %dth del success", i);
+ del_succ++;
+ }
+ }
+
+ pr_info("thread total num: %d, del fail %d, del success %d\n",
+ THREAD_NUM, del_fail, del_succ);
+ sharepool_print();
+ return ret;
+}
+
+/* testcase11: 退组和alloc接口并发。预期无死锁/泄漏 */
+static int testcase11(void)
+{
+ int ret = 0;
+ int childs[PROC_NUM];
+
+ semid = sem_create(1234, "half delete, half alloc");
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ int pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed!");
+ return -1;
+ } else if (pid == 0) {
+ //ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group failed.", getpid());
+ return -1;
+ } else {
+ pr_info("process %d add group success.", getpid());
+ }
+
+ sem_inc_by_one(semid);
+ sem_check_zero(semid);
+
+ if (getpid() % 2) {
+ ret = wrap_sp_alloc(default_id, ALLOC_SIZE, 0);
+ if (ret == -1)
+ pr_info("child %d alloc failed. errno is: %d", getpid(), errno);
+ else
+ pr_info("child %d alloc success.", getpid());
+ } else {
+ ret = wrap_del_from_group(getpid(), default_id);
+ if (ret < 0)
+ pr_info("child %d del failed. errno is: %d", getpid(), errno);
+ else
+ pr_info("child %d del success.", getpid());
+ }
+
+ pr_info("child %d finish, sem val is %d", getpid(), sem_get_value(semid));
+ while(1) {
+
+ }
+ } else {
+ childs[i] = pid;
+ }
+ }
+
+ sem_dec_by_val(semid, PROC_NUM); /* let child process alloc or del */
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ int status = 0;
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], &status, 0);
+ }
+
+ sharepool_print(); /* observe the result */
+ sem_close(semid);
+ return ret;
+}
+
+/* testcase12: A进程调用del将C进程退出组，同时B进程也调用del将C进程退出组。预期成功 */
+static int testcase12(void)
+{
+ int ret = 0;
+ int childs[PROC_NUM];
+ int ppid;
+ int del_fail = 0, del_succ = 0;
+
+ ppid = getpid();
+ semid = sem_create(1234, "half exit, half delete");
+ ret = wrap_add_group(ppid, PROT, default_id);
+ if (ret < 0) {
+ pr_info("parent proc %d add group failed.", ppid);
+ return -1;
+ }
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ int pid = fork();
+ if (pid == 0) {
+ sem_inc_by_one(semid);
+ /* a2 add group finish*/
+ sem_check_zero(semid);
+ sem_dec_by_one(semid);
+
+ ret = wrap_del_from_group(ppid, default_id);
+ exit(ret);
+ } else {
+ childs[i] = pid;
+ }
+ }
+
+ sem_dec_by_val(semid, PROC_NUM);
+ for (int i = 0; i < PROC_NUM; i++) {
+ ret = wrap_add_group(childs[i], PROT, default_id);
+ if (ret < 0) {
+ pr_info("p %d add group failed.", childs[i]);
+ return -1;
+ }
+ }/* a1 add group finish */
+ sharepool_print();
+ sem_inc_by_val(semid, PROC_NUM);
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ int status = 0;
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("proc %dth del failed", i);
+ del_fail++;
+ } else {
+ pr_info("proc %dth del success", i);
+ del_succ++;
+ }
+ }
+
+ pr_info("del fail: %d, del success: %d", del_fail, del_succ);
+ sharepool_print();
+ sem_close(semid);
+ return del_succ == 1 ? 0 : -1;
+}
+
+/* testcase13: A进程调用del将N个进程退出组，同时N个进程exit */
+static int testcase13(void)
+{
+ int ret = 0;
+ void *tret;
+ int childs[PROC_NUM];
+ pthread_t threads[PROC_NUM]; /* one thread del one proc, so use PROC_NUM here */
+ int del_fail = 0, del_succ = 0;
+
+ semid = sem_create(1234, "exit & del group");
+ ret = wrap_add_group(getpid(), PROT, default_id);
+ if (ret < 0) {
+ pr_info("parent proc %d add group failed.", getpid());
+ return -1;
+ }
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ int pid = fork();
+ if (pid == 0) {
+ sem_inc_by_one(semid);
+ /* a2 add group finish*/
+ sem_check_zero(semid);
+ sem_dec_by_one(semid);
+
+ exit(0);
+ } else {
+ childs[i] = pid;
+ }
+ }
+
+ sem_dec_by_val(semid, PROC_NUM);
+ for (int i = 0; i < PROC_NUM; i++) {
+ ret = wrap_add_group(childs[i], PROT, default_id);
+ if (ret < 0) {
+ pr_info("p %d add group failed.", childs[i]);
+ return -1;
+ }
+ }/* a1 add group finish */
+ sharepool_print();
+
+ for (int j = 0; j < PROC_NUM; j++) {
+ ret = pthread_create(threads + j, NULL, del_proc_from_group, (void *)childs[j]);
+ }
+ sem_inc_by_val(semid, 2 * PROC_NUM);
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ int status = 0;
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("proc %dth exit unexpected", i);
+ }
+ }
+
+ for (int j = 0; j < PROC_NUM; j++) {
+ ret = pthread_join(threads[j], &tret);
+ if (ret < 0) {
+ pr_info("pthread %d join failed.", j);
+ ret = -1;
+ }
+ if ((long)tret < 0) {
+ pr_info("thread %dth del failed", j);
+ del_fail++;
+ } else {
+ pr_info("thread %dth del success", j);
+ del_succ++;
+ }
+ }
+
+ pr_info("del fail: %d, del success: %d", del_fail, del_succ);
+ sharepool_print();
+ sem_close(semid);
+ return 0;
+}
+
+/*
+* A 进程加组1000，B进程不加组，A调用删组接口将B从组1000中删除，预期失败
+*/
+static int testcase14(void)
+{
+ pid_t pid;
+ int ret, group_id = 1000;
+
+ ret = wrap_add_group(getpid(), PROT, group_id);
+ if (ret < 0) {
+ pr_info("add group failed.");
+ return -1;
+ }
+
+ pid = fork();
+ if (pid == 0) {
+ /* do nothing for child */
+ while (1);
+ }
+
+ ret = wrap_del_from_group(pid, group_id);
+ if (!ret) {
+ pr_info("del task from group success unexpected");
+ ret = -1;
+ } else {
+ pr_info("del task from group failed as expected");
+ ret = 0;
+ }
+
+ kill(pid, SIGKILL);
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "A and B 加组，A调用sp_group_del_task退出组。预期成功")
+ TESTCASE_CHILD(testcase2, "A and B 加组，B申请了内存。A调用sp_group_del_task退出组。预期失败")
+ TESTCASE_CHILD(testcase3, "A加组，A调用sp_group_del_task退出组。预期成功")
+ TESTCASE_CHILD(testcase4, "A加组并申请内存。A调用sp_group_del_task退出组。预期失败。再free再del，预期成功")
+ TESTCASE_CHILD(testcase5, "N个进程在未申请内存的组中，并发退组。预期成功")
+ TESTCASE_CHILD(testcase6, "N个进程在申请内存的组中，并发退组。预期失败")
+ TESTCASE_CHILD(testcase7, "主进程申请释放，子进程一边加组一边退组。一段时间后杀死，预期无死锁/泄漏")
+ TESTCASE_CHILD(testcase8, "N个进程加组，一半进程退组，一半进程退出。预期稳定")
+ //TESTCASE_CHILD(testcase9, "N个进程加组，顺序进行加组-alloc-free-u2k-k2u-退组。预期稳定")
+ TESTCASE_CHILD(testcase10, "多线程并发调用删除接口。预期只有一个执行成功")
+ TESTCASE_CHILD(testcase11, "退组和alloc接口并发。预期无死锁/泄漏")
+ TESTCASE_CHILD(testcase12, "A进程调用del将C进程退出组，同时B进程也调用del将C进程退出组。预期成功")
+ TESTCASE_CHILD(testcase13, "A进程调用del将N个进程退出组，同时N个进程exit")
+ TESTCASE_CHILD(testcase14, "A 进程加组1000，B进程不加组，A调用删组接口将B从组1000中删除，预期失败")
+};
+
+static int add_multi_group()
+{
+ int ret;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ };
+ for (int i = 0; i < GROUP_NUM; i++) {
+ group_ids[i] = i + 1;
+ ag_info.spg_id = group_ids[i];
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("proc%d add group%d failed", getpid(), group_ids[i]);
+ return -1;
+ }
+ }
+
+ return ret;
+}
+
+static int check_multi_group()
+{
+ int ret;
+ // query groups
+ int spg_ids[GROUP_NUM];
+ int group_num = GROUP_NUM;
+ struct sp_group_id_by_pid_info find_group_info = {
+ .num = &group_num,
+ .spg_ids = spg_ids,
+ .pid = getpid(),
+ };
+ ret = ioctl_find_group_by_pid(dev_fd, &find_group_info);
+ if (ret < 0) {
+ pr_info("find group id by pid failed");
+ return ret;
+ } else
+ for (int i = 0; i < GROUP_NUM; i++)
+ if (spg_ids[i] != group_ids[i]) {
+ pr_info("group id %d not consistent", i);
+ ret = -1;
+ }
+ return ret;
+}
+
+static int delete_multi_group()
+{
+ int ret = 0;
+ int fail = 0, suc = 0;
+ // delete from all groups
+ for (int i = 0; i < GROUP_NUM; i++) {
+ ret = wrap_del_from_group(getpid(), group_ids[i]);
+ if (ret < 0) {
+ //pr_info("process %d delete from group %d failed, errno: %d", getpid(), group_ids[i], errno);
+ fail++;
+ }
+ else {
+ pr_info("process %d delete from group %d success", getpid(), group_ids[i]);
+ suc++;
+ }
+ }
+
+ return fail;
+}
+
+static int process()
+{
+ int ret = 0;
+ for (int j = 0; j < REPEAT_TIMES; j++) {
+ for (int i = 0; i < GROUP_NUM; i++) {
+ ret = thread_and_process_helper(group_ids[i]);
+ if (ret < 0) {
+ pr_info("thread_and_process_helper failed");
+ return -1;
+ }
+ }
+ }
+
+ return ret;
+}
+
+static int try_del_from_group(int group_id)
+{
+ int ret = wrap_del_from_group(getpid(), group_id);
+ return -errno;
+}
+
+void *thread_and_process_helper(int group_id)
+{
+ int ret = 0, i;
+ pid_t pid;
+ bool judge_ret = true;
+ struct sp_alloc_info alloc_info[ALLOC_TYPE] = {0};
+ struct sp_make_share_info u2k_info[ALLOC_TYPE] = {0}, k2u_info = {0}, k2u_huge_info = {0};
+ struct vmalloc_info vmalloc_info = {0}, vmalloc_huge_info = {0};
+ char *addr;
+
+ /* check sp group */
+ pid = getpid();
+
+ // 大页
+ alloc_info[0].flag = SP_HUGEPAGE;
+ alloc_info[0].spg_id = group_id;
+ alloc_info[0].size = 2 * PMD_SIZE;
+
+ // 大页 DVPP
+ alloc_info[1].flag = SP_DVPP | SP_HUGEPAGE;
+ alloc_info[1].spg_id = group_id;
+ alloc_info[1].size = 2 * PMD_SIZE;
+
+ // 普通页 DVPP
+ alloc_info[2].flag = SP_DVPP;
+ alloc_info[2].spg_id = group_id;
+ alloc_info[2].size = 4 * PAGE_SIZE;
+
+ // 普通页
+ alloc_info[3].flag = 0;
+ alloc_info[3].spg_id = group_id;
+ alloc_info[3].size = 4 * PAGE_SIZE;
+
+ /* alloc & u2k */
+ for (i = 0; i < ALLOC_TYPE; i++) {
+ /* sp_alloc */
+ ret = ioctl_alloc(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed at %dth alloc.\n", i);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(alloc_info[i].addr)) {
+ pr_info("sp_alloc return err is %ld\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("sp_alloc return addr %lx\n", alloc_info[i].addr);
+ }
+ }
+
+ /* check sp_alloc addr */
+ judge_ret = ioctl_judge_addr(dev_fd, alloc_info[i].addr);
+ if (judge_ret != true) {
+ pr_info("expect a valid share pool addr %lx\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("addr %lx is a valid share pool addr\n", alloc_info[i].addr);
+ }
+
+ /* prepare for u2k */
+ addr = (char *)alloc_info[i].addr;
+ if (alloc_info[i].flag & SP_HUGEPAGE) {
+ addr[0] = 'd';
+ addr[PMD_SIZE - 1] = 'c';
+ addr[PMD_SIZE] = 'b';
+ addr[PMD_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_hugepage_checker = true;
+ } else {
+ addr[0] = 'd';
+ addr[PAGE_SIZE - 1] = 'c';
+ addr[PAGE_SIZE] = 'b';
+ addr[PAGE_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_checker = true;
+ }
+
+ u2k_info[i].uva = alloc_info[i].addr;
+ u2k_info[i].size = alloc_info[i].size;
+ u2k_info[i].pid = pid;
+
+ /* u2k */
+ ret = ioctl_u2k(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl u2k failed\n");
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(u2k_info[i].addr)) {
+ pr_info("u2k return err is %ld.\n", u2k_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("u2k return addr %lx, check memory content succ.\n",
+ // u2k_info[i].addr);
+ }
+ }
+ }
+ assert(try_del_from_group(group_id) == -EINVAL);
+
+ /* prepare for vmalloc */
+ vmalloc_info.size = 3 * PAGE_SIZE;
+ vmalloc_huge_info.size = 3 * PMD_SIZE;
+
+ /* vmalloc */
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vmalloc_hugepage(dev_fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vmalloc huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* prepare for k2u */
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+ k2u_info.sp_flags = 0;
+ k2u_info.pid = pid;
+ k2u_info.spg_id = group_id;
+
+ k2u_huge_info.kva = vmalloc_huge_info.addr;
+ k2u_huge_info.size = vmalloc_huge_info.size;
+ k2u_huge_info.sp_flags = SP_DVPP;
+ k2u_huge_info.pid = pid;
+ k2u_huge_info.spg_id = group_id;
+
+ /* k2u */
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_info.addr)) {
+ pr_info("k2u return err is %ld.\n",
+ k2u_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u return addr %lx\n", k2u_info.addr);
+ }
+ }
+
+ ret = ioctl_k2u(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u hugepage error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_huge_info.addr)) {
+ pr_info("k2u hugepage return err is %ld.\n",
+ k2u_huge_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u hugepage return addr %lx\n", k2u_huge_info.addr);
+ }
+ }
+ assert(try_del_from_group(group_id) == -EINVAL);
+
+ /* check k2u memory content */
+ addr = (char *)k2u_info.addr;
+ if (addr[0] != 'a' || addr[PAGE_SIZE - 1] != 'b' ||
+ addr[PAGE_SIZE] != 'c' || addr[2 * PAGE_SIZE - 1] != 'd') {
+ pr_info("check vmalloc memory failed\n");
+ goto error;
+ } else {
+ //pr_info("check vmalloc memory succeess\n");
+ }
+
+ addr = (char *)k2u_huge_info.addr;
+ if (addr[0] != 'a' || addr[PMD_SIZE - 1] != 'b' ||
+ addr[PMD_SIZE] != 'c' || addr[2 * PMD_SIZE - 1] != 'd') {
+ pr_info("check vmalloc_hugepage memory failed: %c %c %c %c\n",
+ addr[0], addr[PMD_SIZE - 1], addr[PMD_SIZE], addr[2 * PMD_SIZE - 1]);
+ goto error;
+ } else {
+ //pr_info("check vmalloc_hugepage memory succeess\n");
+ }
+
+ /* unshare uva */
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("sp unshare uva error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_unshare(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("sp unshare hugepage uva error: %d\n", ret);
+ goto error;
+ }
+
+ /* kvfree */
+ ioctl_vfree(dev_fd, &vmalloc_info);
+ ioctl_vfree(dev_fd, &vmalloc_huge_info);
+ assert(try_del_from_group(group_id) == -EINVAL);
+
+ /* unshare kva & sp_free*/
+ for (i = 0; i < ALLOC_TYPE; i++) {
+ /* unshare kva */
+ ret = ioctl_unshare(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("sp_unshare kva return error: %d\n", ret);
+ goto error;
+ }
+
+ /* sp_free */
+ ret = ioctl_free(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("sp_free return error: %d\n", ret);
+ goto error;
+ }
+ }
+
+ return 0;
+
+error:
+ return -1;
+}
+
+void *del_group_thread(void *arg)
+{
+ int ret = 0;
+ int i = (int)arg;
+
+ sem_inc_by_one(semid);
+ sem_check_zero(semid);
+
+ pr_info("thread %d now tries to exit from group %d", getpid() + i + 1, default_id);
+ ret = wrap_del_from_group(getpid() + i + 1, default_id);
+ if (ret < 0)
+ pthread_exit((void *)-1);
+ pthread_exit((void *)0);
+}
+
+void *del_proc_from_group(void *arg)
+{
+ sem_dec_by_one(semid);
+ pthread_exit((void *)(wrap_del_from_group((int)arg, default_id)));
+}
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_group_id_by_pid/Makefile b/tools/testing/sharepool/testcase/api_test/sp_group_id_by_pid/Makefile
new file mode 100644
index 000000000000..592e58e18fc9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_group_id_by_pid/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/sp_group_id_by_pid/test_sp_group_id_by_pid.c b/tools/testing/sharepool/testcase/api_test/sp_group_id_by_pid/test_sp_group_id_by_pid.c
new file mode 100644
index 000000000000..604de856f9ab
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_group_id_by_pid/test_sp_group_id_by_pid.c
@@ -0,0 +1,179 @@
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+
+#include "sharepool_lib.h"
+
+
+
+/*
+ * testcase1
+ * 测试点：有效pid，已加组查询
+ * 预期结果：查询成功，返回正确的group_id
+ */
+static int testcase1(void)
+{
+ int group_id = 10;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ while (1);
+ exit(-1);
+ }
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret) {
+ pr_info("add group failed, errno: %d", errno);
+ goto out;
+ }
+
+ ret = ioctl_find_first_group(dev_fd, pid);
+ if (ret != group_id) {
+ pr_info("failed, group_id: %d, expected: %d", ret, group_id);
+ ret = -1;
+ } else {
+ //pr_info("testcase1 success!!");
+ ret = 0;
+ }
+
+out:
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+ return ret;
+}
+
+/*
+ * testcase2
+ * 测试点：有效pid，进程处于退出状态并且已经加过组
+ * 预期结果：查询失败，错误码-ESRCH
+ */
+static int testcase2_result = -1;
+static pid_t testcase2_child_pid;
+static void testcase2_sigchld_handler(int num)
+{
+ int ret = ioctl_find_first_group(dev_fd, testcase2_child_pid);
+ if (!(ret < 0 && errno == ESRCH)) {
+ pr_info("failed, ret: %d, errno: %d", ret, errno);
+ pr_info("testcase2 failed!!");
+ testcase2_result = -1;
+ } else {
+ //pr_info("testcase2 success!!");
+ testcase2_result = 0;
+ }
+}
+
+static int testcase2(void)
+{
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ pr_info("child pid %d", getpid());
+ while (1);
+ exit(-1);
+ }
+
+ struct sigaction sa = {0};
+ struct sigaction osa = {0};
+ sa.sa_handler = testcase2_sigchld_handler;
+ sigaction(SIGCHLD, &sa, &osa);
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 10,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret)
+ pr_info("add group failed, errno: %d", errno);
+
+ testcase2_child_pid = pid;
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+
+ sigaction(SIGCHLD, &osa, NULL);
+
+ return testcase2_result;
+}
+
+/*
+ * testcase3
+ * 测试点：有效pid，未加组查询
+ * 预期结果：查询失败，错误码 -ENODEV
+ */
+static int testcase3(void)
+{
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ while (1);
+ exit(-1);
+ }
+
+ int ret = ioctl_find_first_group(dev_fd, pid);
+ if (!(ret < 0 && errno == ENODEV)) {
+ pr_info("failed, ret: %d, errno: %d", ret, errno);
+ pr_info("testcase3 failed!!");
+ ret = -1;
+ } else {
+ //pr_info("testcase3 success!!");
+ ret = 0;
+ }
+
+out:
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+ return ret;
+}
+
+/*
+ * testcase4
+ * 测试点：无效pid查询
+ * 预期结果：查询失败，错误码 -ESRCH
+ */
+static int testcase4(void)
+{
+ int ret = ioctl_find_first_group(dev_fd, -1);
+ if (!(ret < 0 && errno == ESRCH)) {
+ pr_info("failed, ret: %d, errno: %d", ret, errno);
+ pr_info("testcase4 failed!!");
+ ret = -1;
+ } else {
+ //pr_info("testcase4 success!!");
+ ret = 0;
+ }
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE(testcase1, "有效pid，已加组查询。预期结果：查询成功，返回正确的group_id")
+ TESTCASE(testcase2, "有效pid，进程处于退出状态并且已经加过组。预期结果：查询失败，错误码-ESRCH")
+ TESTCASE(testcase3, "有效pid，未加组查询。预期结果：查询失败，错误码 -ENODEV")
+ TESTCASE(testcase4, "无效pid查询。预期结果：查询失败，错误码 -ESRCH")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_group_id_by_pid/test_sp_group_id_by_pid2.c b/tools/testing/sharepool/testcase/api_test/sp_group_id_by_pid/test_sp_group_id_by_pid2.c
new file mode 100644
index 000000000000..7b82e591fce7
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_group_id_by_pid/test_sp_group_id_by_pid2.c
@@ -0,0 +1,318 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed May 26 06:20:07 2021
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+
+#include "sharepool_lib.h"
+
+
+static int spg_id_query(int id, int *ids, int len)
+{
+ for (int i = 0; i < len; i++)
+ if (id == ids[i])
+ return i;
+
+ return -1;
+}
+
+/*
+ * 进程加n个组，查询组id
+ * 预期加组成功，组ID查询结果正确
+ */
+static int testcase1(void)
+{
+#define group_nr_test1 10
+ int ret = 0, nr, i;
+ int spg_id1[group_nr_test1];
+ int spg_id2[group_nr_test1 + 1];
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ };
+
+ for (i = 0; i < ARRAY_SIZE(spg_id1); i++) {
+ ag_info.spg_id = SPG_ID_AUTO;
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+ spg_id1[i] = ag_info.spg_id;
+ }
+
+ nr = ARRAY_SIZE(spg_id2);
+ struct sp_group_id_by_pid_info info = {
+ .pid = getpid(),
+ .spg_ids = spg_id2,
+ .num = &nr,
+ };
+ TEST_CHECK(ioctl_find_group_by_pid(dev_fd, &info), out);
+
+ if (nr != ARRAY_SIZE(spg_id1)) {
+ pr_info("sp_group_id_by_pid check failed, group_nr:%d, expect:%d", nr, ARRAY_SIZE(spg_id1));
+ return -1;
+ }
+
+ for (i = 0; i < group_nr_test1; i++)
+ if (spg_id_query(spg_id2[i], spg_id1, ARRAY_SIZE(spg_id1)) < 0) {
+ pr_info("sp_group_id_by_pid check failed, spg_id %d no found", spg_id2[i]);
+ return -1;
+ }
+
+out:
+ return ret;
+}
+
+/*
+ * 进程加n个组，查询组id
+ * 预期加组成功，组ID查询失败，错误码E2BIG
+ */
+static int testcase2(void)
+{
+#define group_nr_test2 10
+ int ret = 0, nr, i;
+ int spg_id2[group_nr_test2 - 1];
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ };
+
+ for (i = 0; i < group_nr_test2; i++) {
+ ag_info.spg_id = SPG_ID_AUTO;
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+ }
+
+ nr = ARRAY_SIZE(spg_id2);
+ struct sp_group_id_by_pid_info info = {
+ .pid = getpid(),
+ .spg_ids = spg_id2,
+ .num = &nr,
+ };
+ TEST_CHECK_FAIL(ioctl_find_group_by_pid(dev_fd, &info), E2BIG, out);
+
+out:
+ return ret;
+}
+
+/*
+ * 进程不加组，查询组id
+ * 查询失败，错误码ENODEV
+ */
+static int testcase3(void)
+{
+ int ret = 0, nr, i;
+ int spg_id2[3];
+
+ nr = ARRAY_SIZE(spg_id2);
+ struct sp_group_id_by_pid_info info = {
+ .pid = getpid(),
+ .spg_ids = spg_id2,
+ .num = &nr,
+ };
+ TEST_CHECK_FAIL(ioctl_find_group_by_pid(dev_fd, &info), ENODEV, out);
+
+out:
+ return ret;
+}
+
+/*
+ * 查询内核线程组id
+ * 查询失败，错误码ENODEV
+ */
+static int testcase4(void)
+{
+ int ret = 0, nr, i;
+ int spg_id2[3];
+
+ nr = ARRAY_SIZE(spg_id2);
+ struct sp_group_id_by_pid_info info = {
+ .pid = 2, // kthreadd
+ .spg_ids = spg_id2,
+ .num = &nr,
+ };
+ TEST_CHECK_FAIL(ioctl_find_group_by_pid(dev_fd, &info), ENODEV, out);
+
+out:
+ return ret;
+}
+
+/*
+ * 非法pid
+ * 预期加组成功，组ID查询失败，错误码ESRCH
+ */
+static int testcase5(void)
+{
+ int ret = 0, nr, i;
+ int spg_id2[3];
+
+ nr = ARRAY_SIZE(spg_id2);
+ struct sp_group_id_by_pid_info info = {
+ .pid = -1,
+ .spg_ids = spg_id2,
+ .num = &nr,
+ };
+ TEST_CHECK_FAIL(ioctl_find_group_by_pid(dev_fd, &info), ESRCH, out);
+
+out:
+ return ret;
+}
+
+static int testcase6(void)
+{
+ int ret = 0, nr, i;
+ int spg_id2[2];
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = SPG_ID_AUTO,
+ };
+
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+
+ nr = ARRAY_SIZE(spg_id2);
+ struct sp_group_id_by_pid_info info = {
+ .pid = getpid(),
+ .spg_ids = spg_id2,
+ .num = NULL
+ };
+ TEST_CHECK_FAIL(ioctl_find_group_by_pid(dev_fd, &info), EINVAL, out);
+ info.num = &nr;
+ info.spg_ids = NULL;
+ TEST_CHECK_FAIL(ioctl_find_group_by_pid(dev_fd, &info), EINVAL, out);
+
+out:
+ return ret;
+}
+
+/*
+ * 子进程加n个组，查询组id
+ * 预期加组成功，组ID查询结果正确
+ */
+static int testcase7(void)
+{
+#define group_nr_test7 10
+ pid_t pid;
+ int ret = 0, nr, i;
+ int spg_id1[group_nr_test7];
+ int spg_id2[group_nr_test7 + 1];
+
+ FORK_CHILD_DEADLOOP(pid);
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ };
+
+ for (i = 0; i < ARRAY_SIZE(spg_id1); i++) {
+ ag_info.spg_id = SPG_ID_AUTO;
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+ spg_id1[i] = ag_info.spg_id;
+ }
+
+ nr = ARRAY_SIZE(spg_id2);
+ struct sp_group_id_by_pid_info info = {
+ .pid = pid,
+ .spg_ids = spg_id2,
+ .num = &nr,
+ };
+ TEST_CHECK(ioctl_find_group_by_pid(dev_fd, &info), out);
+
+ if (nr != ARRAY_SIZE(spg_id1)) {
+ pr_info("sp_group_id_by_pid check failed, group_nr:%d, expect:%d", nr, ARRAY_SIZE(spg_id1));
+ ret = -1;
+ goto out;
+ }
+
+ for (i = 0; i < ARRAY_SIZE(spg_id1); i++)
+ if (spg_id_query(spg_id2[i], spg_id1, ARRAY_SIZE(spg_id1)) < 0) {
+ pr_info("sp_group_id_by_pid check failed, spg_id %d no found", spg_id2[i]);
+ ret = -1;
+ goto out;
+ }
+
+out:
+ KILL_CHILD(pid);
+ return ret;
+}
+
+/*
+ * 测试步骤：进程直调申请内存，然后查询组
+ * 预期结果：查询失败，错误码ENODEV
+ */
+static int testcase8(void)
+{
+ int ret = 0;
+ void *buf;
+ unsigned long size = 1024;
+
+ buf = (void *)wrap_sp_alloc(SPG_ID_DEFAULT, size, 0);
+ if (buf == (void *)-1)
+ return -1;
+
+ TEST_CHECK_FAIL(ioctl_find_first_group(dev_fd, getpid()), ENODEV, out);
+ return 0;
+
+out:
+ return ret;
+}
+
+/*
+ * 测试步骤：做k2task，然后查询组
+ * 预期结果：查询失败，错误码ENODEV
+ */
+static int testcase9(void)
+{
+ int ret = 0;
+ void *buf;
+ unsigned long kva, uva;
+ unsigned long size = 1024;
+
+ kva = wrap_vmalloc(size, true);
+ if (!kva)
+ return -1;
+
+ uva = wrap_k2u(kva, size, SPG_ID_DEFAULT, 0);
+ if (!uva) {
+ ret = -1;
+ goto out_vfree;
+ }
+
+ TEST_CHECK_FAIL(ioctl_find_first_group(dev_fd, getpid()), ENODEV, out_unshare);
+ ret = 0;
+
+out_unshare:
+ wrap_unshare(uva, size);
+out_vfree:
+ wrap_vfree(kva);
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "进程加n个组，查询组id。预期加组成功，组ID查询结果正确")
+ TESTCASE_CHILD(testcase2, "进程加n个组，查询组id。预期加组成功，组ID查询失败，错误码E2BIG")
+ TESTCASE(testcase3, "进程不加组，查询组id。预期查询失败，错误码ENODEV")
+ TESTCASE(testcase4, "查询内核线程组id。预期查询失败，错误码ENODEV")
+ TESTCASE(testcase5, "非法pid。预期加组成功，组ID查询失败，错误码ESRCH")
+ TESTCASE_CHILD(testcase6, "使用auto组id，传入空info指针/空返回值指针，预期失败，错误码EINVAL")
+ TESTCASE(testcase7, "子进程加n个组，查询组id。预期加组成功，组ID查询结果正确")
+ TESTCASE_CHILD(testcase8, "进程直调申请内存，然后查询组。预期结果：查询失败，错误码ENODEV")
+ TESTCASE_CHILD(testcase9, "k2task，然后查询组。预期结果：查询失败，错误码ENODEV")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_id_of_current/Makefile b/tools/testing/sharepool/testcase/api_test/sp_id_of_current/Makefile
new file mode 100644
index 000000000000..592e58e18fc9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_id_of_current/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/sp_id_of_current/test_sp_id_of_current.c b/tools/testing/sharepool/testcase/api_test/sp_id_of_current/test_sp_id_of_current.c
new file mode 100644
index 000000000000..7aa05b2bdca6
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_id_of_current/test_sp_id_of_current.c
@@ -0,0 +1,112 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Sat Dec 19 11:29:06 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdbool.h>
+#include <pthread.h>
+
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+/*
+ * case1: 进程不加组，多线程并发获取进程的local 组ID
+ * 预期都能获取成功
+ */
+/* 等待一个信号，然后开始查询 */
+static void *thread1(void *arg)
+{
+ int semid = *(int *)arg;
+
+ sem_dec_by_one(semid);
+ for (int i = 0; i < 20; i++) {
+ int ret = wrap_sp_id_of_current();
+ if (ret < 0)
+ return (void *)-1;
+ }
+
+ return NULL;
+}
+
+#define TEST1_CHILD_NUM 20
+#define TEST1_THREAD_NUM 20
+static int child1(int idx)
+{
+ void *thread_ret;
+ int semid, j, ret = 0;
+ pthread_t threads[TEST1_THREAD_NUM];
+
+ semid = sem_create(4466 + idx, "sp_id_of_current sem");
+ if (semid < 0)
+ return semid;
+
+ for (j = 0; j < TEST1_THREAD_NUM; j++) {
+ ret = pthread_create(threads + j, NULL, thread1, &semid);
+ if (ret < 0) {
+ pr_info("pthread create failed");
+ goto out_pthread_join;
+ }
+ }
+
+ sem_set_value(semid, TEST1_THREAD_NUM);
+
+out_pthread_join:
+ for (j--; j >= 0; j--) {
+ pthread_join(threads[j], &thread_ret);
+ if (thread_ret != NULL) {
+ pr_info("child thread%d exited unexpected", j + 1);
+ ret = -1;
+ }
+ }
+
+ sem_close(semid);
+
+ return ret;
+}
+
+static int testcase1(void)
+{
+ int ret = 0;
+ pid_t child[TEST1_CHILD_NUM];
+
+ for (int i = 0; i < TEST1_CHILD_NUM; i++) {
+ pid_t pid = fork();
+ if (pid == 0)
+ exit(child1(i));
+ child[i] = pid;
+ }
+
+ // 等待子进程退出
+ for (int i = 0; i < TEST1_CHILD_NUM; i++) {
+ int status;
+ waitpid(child[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d exited unexpected", i);
+ ret = -1;
+ }
+ child[i] = 0;
+ }
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE(testcase1, "进程不加组，多线程并发获取进程的local 组ID，预期都能获取成功")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_make_share_k2u/Makefile b/tools/testing/sharepool/testcase/api_test/sp_make_share_k2u/Makefile
new file mode 100644
index 000000000000..592e58e18fc9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_make_share_k2u/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/sp_make_share_k2u/test_sp_make_share_k2u.c b/tools/testing/sharepool/testcase/api_test/sp_make_share_k2u/test_sp_make_share_k2u.c
new file mode 100644
index 000000000000..24fe1d2320ca
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_make_share_k2u/test_sp_make_share_k2u.c
@@ -0,0 +1,624 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Dec 16 10:45:21 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+#define FAKE_NUM 3
+
+/*
+ * testcase1: vmalloc_user申请共享内存，k2u的pid未加组，spg_id == SPG_ID_DEFAULT或SPG_ID_NONE。预期成功。
+ * testcase2: vmalloc_user申请共享内存，k2u的pid已加组，(1) spg_id == SPG_ID_DEFAULT。预期成功。
+ * (2) spg_id == SPG_ID_NONE。预期失败，返回EINVAL。
+ * testcase3: vmalloc_huge_user申请共享内存，(1) k2u的pid已加组，spg_id有效范围内未使用过。预期失败。
+ * testcase4: vmalloc_user申请共享内存，(1) k2u的kva不存在。预期失败。(2) k2u的size超出申请大小、size为0。预期失败。
+ * testcase5: vmalloc_huge_user申请共享内存，(1) k2u的pid未加组，spg_id == SPG_ID_NONE。预期成功。
+ * (2) k2u的kva、size不对齐。预期成功。(3) k2u的sp_flags=SP_DVPP。预期成功。
+ */
+static int addgroup(void)
+{
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static int prepare(struct vmalloc_info *ka_info, bool ishuge)
+{
+ int ret;
+ if (ishuge) {
+ ret = ioctl_vmalloc_hugepage(dev_fd, ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc_hugepage failed, errno: %d", errno);
+ return -1;
+ }
+ } else {
+ ret = ioctl_vmalloc(dev_fd, ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'a',
+ .addr = ka_info->addr,
+ .size = ka_info->size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, ka_info);
+ }
+ return ret;
+}
+
+static int testcase1(void)
+{
+ int ret;
+ struct vmalloc_info ka_info = {
+ .size = PAGE_SIZE,
+ };
+ if (prepare(&ka_info, false) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info k2u_infos[] = {
+ {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ },
+ {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ },
+ };
+ for (int i = 0; i < sizeof(k2u_infos) / sizeof(k2u_infos[0]); i++) {
+ ret = ioctl_k2u(dev_fd, &k2u_infos[i]);
+ if (ret < 0) {
+ pr_info("testcase1 ioctl_k2u %d failed unexpected, errno: %d", i, errno);
+ goto out;
+ } else {
+ //pr_info("testcase1 ioctl_k2u %d success expected", i);
+ ret = ioctl_unshare(dev_fd, &k2u_infos[i]);
+ if (ret < 0) {
+ pr_info("testcase1 ioctl_unshare %d failed, errno: %d", i, errno);
+ goto out;
+ }
+ }
+ }
+
+out:
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+}
+
+static int testcase2(void)
+{
+ int ret;
+ struct vmalloc_info ka_info = {
+ .size = PAGE_SIZE,
+ };
+ if (addgroup() != 0) {
+ return -1;
+ }
+ if (prepare(&ka_info, false) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info k2u_infos[] = {
+ {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ },
+ {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ },
+ };
+
+ ret = ioctl_k2u(dev_fd, &k2u_infos[0]);
+ if (ret < 0) {
+ pr_info("testcase2 ioctl_k2u 0 failed unexpected, errno: %d", errno);
+ goto out;
+ } else {
+ //pr_info("testcase2 ioctl_k2u 0 success unexpected");
+ ret = ioctl_unshare(dev_fd, &k2u_infos[0]);
+ if (ret < 0) {
+ pr_info("testcase2 ioctl_unshare 0 failed, errno: %d", errno);
+ goto out;
+ }
+ }
+
+ ret = ioctl_k2u(dev_fd, &k2u_infos[1]);
+ if (ret != 0 && errno == EINVAL) {
+ //pr_info("testcase2 ioctl_k2u 1 failed expected");
+ ret = 0;
+ goto out;
+ } else if (ret != 0) {
+ pr_info("testcase2 ioctl_k2u 1 failed unexpected, errno: %d", errno);
+ goto out;
+ } else {
+ pr_info("testcase2 ioctl_k2u 1 success unexpected");
+ ioctl_unshare(dev_fd, &k2u_infos[1]);
+ ret = -1;
+ goto out;
+ }
+
+out:
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+}
+
+static int testcase3(void)
+{
+ int ret;
+ struct vmalloc_info ka_info = {
+ .size = PMD_SIZE,
+ };
+ if (prepare(&ka_info, true) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info k2u_infos[] = {
+ {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_AUTO_MIN,
+ .sp_flags = 0,
+ .pid = getpid(),
+ },
+ };
+ int errs[] = {EINVAL, ESRCH};
+
+ if (addgroup() != 0) {
+ return -1;
+ }
+
+ for (int i = 0; i < sizeof(k2u_infos) / sizeof(k2u_infos[0]); i++) {
+ ret = ioctl_k2u(dev_fd, &k2u_infos[i]);
+ if (ret != 0 && errno == errs[i]) {
+ //pr_info("testcase3 ioctl_k2u %d failed expected", i);
+ ret = 0;
+ } else if (ret != 0) {
+ pr_info("testcase3 ioctl_k2u %d failed unexpected, errno: %d", i, errno);
+ goto out;
+ } else {
+ pr_info("testcase3 ioctl_k2u %d success unexpected", i);
+ ioctl_unshare(dev_fd, &k2u_infos[i]);
+ ret = -1;
+ goto out;
+ }
+ }
+
+out:
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+}
+
+static int testcase4(void)
+{
+ int ret;
+ struct vmalloc_info ka_info = {
+ .size = PAGE_SIZE,
+ };
+ if (prepare(&ka_info, false) != 0) {
+ return -1;
+ }
+
+ struct vmalloc_info fake_ka_info = {
+ .size = PAGE_SIZE,
+ };
+ ret = ioctl_vmalloc(dev_fd, &fake_ka_info);
+ if (ret < 0) {
+ pr_info("testcase4 vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+ ioctl_vfree(dev_fd, &fake_ka_info);
+
+ struct sp_make_share_info k2u_infos[] = {
+ {
+ .kva = fake_ka_info.addr,
+ .size = fake_ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ },
+ /*{
+ .kva = ka_info.addr,
+ .size = ka_info.size * FAKE_NUM,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ },
+ */{
+ .kva = ka_info.addr,
+ .size = 0,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ },
+ {
+ .kva = ka_info.addr,
+ .size = 0,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ },
+ };
+
+ for (int i = 0; i < sizeof(k2u_infos) / sizeof(k2u_infos[0]); i++) {
+ ret = ioctl_k2u(dev_fd, &k2u_infos[i]);
+ if (ret != 0 && errno == EINVAL) {
+ //pr_info("testcase4 ioctl_k2u %d failed expected", i);
+ ret = 0;
+ } else if (ret != 0) {
+ pr_info("testcase4 ioctl_k2u %d failed unexpected, errno: %d", i, errno);
+ goto out;
+ } else {
+ pr_info("testcase4 ioctl_k2u %d success unexpected", i);
+ ioctl_unshare(dev_fd, &k2u_infos[i]);
+ ret = -1;
+ goto out;
+ }
+ }
+
+out:
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+}
+
+static int testcase5(void)
+{
+ int ret;
+ struct vmalloc_info ka_info = {
+ .size = PMD_SIZE,
+ };
+ if (prepare(&ka_info, true) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info k2u_infos[] = {
+ {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ },
+ {
+ .kva = ka_info.addr,
+ .size = ka_info.size - 1,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ },
+ {
+ .kva = ka_info.addr + 1,
+ .size = ka_info.size - 1,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ },
+ {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = SP_DVPP,
+ .pid = getpid(),
+ },
+ };
+
+ for (int i = 0; i < sizeof(k2u_infos) / sizeof(k2u_infos[0]); i++) {
+ ret = ioctl_k2u(dev_fd, &k2u_infos[i]);
+ if (ret < 0) {
+ pr_info("testcase5 ioctl_k2u %d failed unexpected, errno: %d", i, errno);
+ goto out;
+ } else {
+ //pr_info("testcase5 ioctl_k2u %d success expected", i);
+ ret = ioctl_unshare(dev_fd, &k2u_infos[i]);
+ if (ret < 0) {
+ pr_info("testcase5 ioctl_unshare %d failed, errno: %d", i, errno);
+ goto out;
+ }
+ }
+ }
+
+out:
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+}
+
+static int testcase6(void)
+{
+ int ret = 0;
+
+ struct sp_make_share_info k2u_info = {
+ .kva = 0,
+ .size = 4096,
+ .spg_id = 1,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("testcase5 ioctl_k2u failed expected", errno);
+ return 0;
+ } else {
+ pr_info("testcase5 ioctl_k2u success unexpected");
+ ioctl_unshare(dev_fd, &k2u_info);
+ return -1;
+ }
+}
+
+static int testcase7(void)
+{
+ int ret = 0;
+
+ struct vmalloc_info ka_info = {
+ .size = PMD_SIZE,
+ };
+ if (prepare(&ka_info, true) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = 1,
+ .sp_flags = 25,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("testcase5 ioctl_k2u failed expected", errno);
+ ret = 0;
+ } else {
+ pr_info("testcase5 ioctl_k2u success unexpected");
+ ioctl_unshare(dev_fd, &k2u_info);
+ ret = -1;
+ }
+
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+}
+
+static int testcase8(void)
+{
+ int ret = 0;
+
+ struct vmalloc_info ka_info = {
+ .size = PMD_SIZE,
+ };
+ if (prepare(&ka_info, true) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 25,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("testcase5 ioctl_k2u failed expected", errno);
+ ret = 0;
+ } else {
+ pr_info("testcase5 ioctl_k2u success unexpected");
+ ioctl_unshare(dev_fd, &k2u_info);
+ ret = -1;
+ }
+
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+}
+
+static int testcase9(void)
+{
+ int ret = 0;
+#if 0
+ unsigned long flag;
+ int node_id = 5;
+
+ struct vmalloc_info ka_info = {
+ .size = PMD_SIZE,
+ };
+ if (prepare(&ka_info, true) != 0) {
+ return -1;
+ }
+
+ flag |= (unsigned long)node_id << NODE_ID_SHIFT;
+ flag |= SP_SPEC_NODE_ID;
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = flag,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("testcase5 ioctl_k2u failed expected", errno);
+ ret = 0;
+ } else {
+ pr_info("testcase5 ioctl_k2u success unexpected");
+ ioctl_unshare(dev_fd, &k2u_info);
+ ret = -1;
+ }
+
+ ioctl_vfree(dev_fd, &ka_info);
+#endif
+ return ret;
+}
+
+static int testcase10(void)
+{
+ int ret = 0;
+#if 0
+ unsigned long flag;
+ int node_id = 5;
+
+ struct vmalloc_info ka_info = {
+ .size = PMD_SIZE,
+ };
+ if (prepare(&ka_info, true) != 0) {
+ return -1;
+ }
+
+ flag |= (unsigned long)node_id << NODE_ID_SHIFT;
+ flag |= SP_SPEC_NODE_ID;
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = 1,
+ .sp_flags = flag,
+ .pid = getpid(),
+ };
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, 1);
+ if (ret < 0)
+ return -1;
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("testcase5 ioctl_k2u failed expected", errno);
+ ret = 0;
+ } else {
+ pr_info("testcase5 ioctl_k2u success unexpected");
+ ioctl_unshare(dev_fd, &k2u_info);
+ ret = -1;
+ }
+
+ ioctl_vfree(dev_fd, &ka_info);
+#endif
+ return ret;
+}
+
+static int testcase11(void)
+{
+ int ret = 0;
+ unsigned long flag;
+ int node_id = 5;
+
+ struct vmalloc_info ka_info = {
+ .size = PAGE_SIZE,
+ };
+ if (ioctl_kmalloc(dev_fd, &ka_info) < 0) {
+ pr_info("kmalloc failed");
+ return -1;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = 1,
+ .sp_flags = flag,
+ .pid = getpid(),
+ };
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, 1);
+ if (ret < 0)
+ return -1;
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("k2u failed as expected");
+ ret = 0;
+ } else {
+ pr_info("k2u success unexpected");
+ ret = -1;
+ }
+
+ ioctl_kfree(dev_fd, &ka_info);
+ return ret;
+}
+
+#define PROC_NUM 100
+static int testcase12(void) {
+ pid_t child[PROC_NUM];
+ pid_t pid;
+ int ret = 0;
+ int semid = sem_create(1234, "sem");
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ pid = fork();
+ if (pid == 0) {
+ sem_dec_by_one(semid);
+ pr_info("child %d started!", getpid());
+ exit(testcase4());
+ } else {
+ child[i] = pid;
+ }
+ }
+
+ sem_inc_by_val(semid, PROC_NUM);
+ pr_info("sem released!");
+ for (int i = 0; i < PROC_NUM; i++) {
+ WAIT_CHILD_STATUS(child[i], out);
+ }
+out:
+ sem_close(semid);
+ return ret;
+}
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "vmalloc_user申请共享内存，k2u的pid未加组，spg_id == SPG_ID_DEFAULT或SPG_ID_NONE。预期成功。")
+ TESTCASE_CHILD_MANUAL(testcase2, "vmalloc_user申请共享内存，k2u的pid已加组，(1) spg_id == SPG_ID_DEFAULT。预期成功。(2) spg_id == SPG_ID_NONE。预期失败，返回EINVAL。") // single only
+ TESTCASE_CHILD_MANUAL(testcase3, "vmalloc_huge_user申请共享内存，(1) k2u的pid已加组，spg_id有效范围内未使用过。预期失败。") // single only
+ TESTCASE_CHILD(testcase4, "vmalloc_user申请共享内存，(1) k2u的kva不存在。预期失败。(2) k2u的size超出申请大小、size为0。预期失败。")
+ TESTCASE_CHILD(testcase5, "vmalloc_huge_user申请共享内存，(1) k2u的pid未加组，spg_id == SPG_ID_NONE。预期成功。(2) k2u的kva、size不对齐。预期成功。(3) k2u的sp_flags=SP_DVPP。预期成功。")
+ TESTCASE_CHILD(testcase6, "kva is 0")
+ TESTCASE_CHILD(testcase7, "k2spg invalid flag")
+ TESTCASE_CHILD(testcase8, "k2task invalid flag")
+ TESTCASE_CHILD(testcase9, "用例废弃：k2spg invalid numa node flag")
+ TESTCASE_CHILD(testcase10, "用例废弃：k2task invalid numa node flag")
+ TESTCASE_CHILD(testcase11, "use kmalloc memory for k2u")
+ TESTCASE_CHILD(testcase12, "BUG test")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_make_share_k2u/test_sp_make_share_k2u2.c b/tools/testing/sharepool/testcase/api_test/sp_make_share_k2u/test_sp_make_share_k2u2.c
new file mode 100644
index 000000000000..79bf2ee7c665
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_make_share_k2u/test_sp_make_share_k2u2.c
@@ -0,0 +1,361 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Thu Jun 03 06:35:49 2021
+ */
+#include <stdio.h>
+#include <string.h>
+#include <signal.h>
+#include <unistd.h>
+#include <stdlib.h> // for exit
+#include <sys/mman.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 测试步骤：进程A加组，内核申请内存，做k2spg，用户写，内核check，用户调用unshare----先加组，后k2spg
+ * 预期结果：内核check内存成功
+ */
+static int testcase1(bool is_hugepage)
+{
+ int ret = 0, spg_id;
+ unsigned long kva, uva;
+ unsigned long size = 1024;
+
+ spg_id = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, SPG_ID_AUTO);
+ if (spg_id < 0)
+ return -1;
+
+ // 加组两次
+ spg_id = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, SPG_ID_AUTO);
+ if (spg_id < 0) {
+ pr_info("add group failed. ret %d", spg_id);
+ return -1;
+ }
+
+ kva = wrap_vmalloc(size, is_hugepage);
+ if (!kva) {
+ pr_info("kva null");
+ return -1;
+ }
+
+ uva = wrap_k2u(kva, size, spg_id, 0);
+ if (!uva) {
+ pr_info("k2u failed");
+ ret = -1;
+ goto out_vfree;
+ }
+
+ pr_info("memset to uva 0x%lx", uva);
+ sleep(1);
+ for ( int i = 0; i < size; i++) {
+ memset((void *)uva + i, 'a', 1);
+ pr_info("memset success at %dth byte", i);
+ KAREA_ACCESS_CHECK('a', kva + i, 1, out_unshare);
+ pr_info("kva check success at %dth byte", i);
+ }
+
+out_unshare:
+ wrap_unshare(uva, size);
+out_vfree:
+ wrap_vfree(kva);
+
+ return ret;
+}
+
+/*
+ * 测试步骤：父进程加组，并申请内核内存，做k2spg，写内存，fork子进程，子进程加相同组，子进程读(check)、写共享内存，
+ * 内核check-----先做k2spg，然后加组
+ */
+static int testcase2_child(sem_t *sync, unsigned long uva, unsigned long kva, unsigned long size)
+{
+ int ret = 0, i;
+
+ SEM_WAIT(sync);
+
+ for (i = 0; i < size; i++)
+ if (((char *)uva)[i] != 'a') {
+ pr_info("buf check failed, i:%d, value:%d", i, ((char *)uva)[i]);
+ return -1;
+ }
+
+ memset((void *)uva, 'b', size);
+ KAREA_ACCESS_CHECK('b', kva, size, out);
+
+out:
+ return ret;
+}
+
+static int testcase2(bool is_hugepage)
+{
+ pid_t pid;
+ int ret = 0, spg_id;
+ unsigned long kva, uva;
+ unsigned long size = 1024;
+ sem_t *sync;
+
+ SEM_INIT(sync, (int)is_hugepage);
+
+ spg_id = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, SPG_ID_AUTO);
+ if (spg_id < 0)
+ return -1;
+
+ // 加组两次
+ spg_id = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, SPG_ID_AUTO);
+ if (spg_id < 0)
+ return -1;
+
+ kva = wrap_vmalloc(size, is_hugepage);
+ if (!kva)
+ return -1;
+
+ uva = wrap_k2u(kva, size, spg_id, 0);
+ if (!uva) {
+ ret = -1;
+ goto out_vfree;
+ }
+
+ memset((void *)uva, 'a', size);
+
+ FORK_CHILD_ARGS(pid, testcase2_child(sync, uva, kva, size));
+ ret = wrap_add_group(pid, PROT_READ | PROT_WRITE, spg_id);
+ if (ret < 0 || ret != spg_id) {
+ pr_info("add child to group %d failed, ret: %d, errno: %d", spg_id, ret, errno);
+ ret = -1;
+ KILL_CHILD(pid);
+ goto out_unshare;
+ } else
+ ret = 0;
+
+ sem_post(sync);
+
+ WAIT_CHILD_STATUS(pid, out_unshare);
+
+out_unshare:
+ wrap_unshare(uva, size);
+out_vfree:
+ wrap_vfree(kva);
+
+ return ret;
+}
+
+/*
+ * 测试步骤：父进程加组，并申请内核内存，fork子进程，子进程加相同组，设置成只读权限，父进程执行k2spg，并且写共享内存----先加组，然后k2spg
+ * 预期结果：用户写失败，触发segment fault
+ */
+static int testcase3_child(sem_t *sync, unsigned long *puva, unsigned long size)
+{
+ int ret;
+ SEM_WAIT(sync);
+
+ memset((void *)(*puva), 'a', size);
+
+ // unaccessable
+ pr_info("ERROR!! unaccessable statement reach");
+
+ return -1;
+}
+
+static int testcase3(bool is_hugepage)
+{
+ pid_t pid;
+ int ret = 0, spg_id;
+ unsigned long kva, uva;
+ unsigned long size = 1024;
+ unsigned long *puva;
+ sem_t *sync;
+
+ SEM_INIT(sync, (int)is_hugepage);
+
+ puva = mmap(NULL, sizeof(*puva), PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+ if (puva == MAP_FAILED) {
+ pr_info("map failed");
+ return -1;
+ }
+
+ spg_id = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, SPG_ID_AUTO);
+ if (spg_id < 0)
+ return -1;
+
+ // 加组两次
+ spg_id = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, SPG_ID_AUTO);
+ if (spg_id < 0)
+ return -1;
+
+ kva = wrap_vmalloc(size, is_hugepage);
+ if (!kva)
+ return -1;
+
+ FORK_CHILD_ARGS(pid, testcase3_child(sync, puva, size));
+ ret = wrap_add_group(pid, PROT_READ, spg_id);
+ if (ret < 0 || ret != spg_id) {
+ pr_info("add child to group %d failed, ret: %d, errno: %d", spg_id, ret, errno);
+ ret = -1;
+ KILL_CHILD(pid);
+ goto out_vfree;
+ } else
+ ret = 0;
+
+ uva = wrap_k2u(kva, size, spg_id, 0);
+ if (!uva) {
+ pr_info("k2u failed");
+ ret = -1;
+ KILL_CHILD(pid);
+ goto out_vfree;
+ }
+ *puva = uva;
+
+ sem_post(sync);
+
+ WAIT_CHILD_SIGNAL(pid, SIGSEGV, out_unshare);
+
+out_unshare:
+ wrap_unshare(uva, size);
+out_vfree:
+ wrap_vfree(kva);
+
+ return ret;
+}
+
+/*
+ * 测试步骤：父进程加组，并申请内核内存，做k2spg，fork子进程，子进程加相同组，设置成只读权限，子进程写共享内存-----先做k2spg，然后加组
+ * 预期结果：用户写失败，触发segment fault
+ */
+static int testcase4_child(sem_t *sync, unsigned long uva, unsigned long size)
+{
+ int ret;
+ SEM_WAIT(sync);
+
+ memset((void *)uva, 'a', size);
+
+ // unaccessable
+ pr_info("ERROR!! unaccessable statement reach");
+
+ return -1;
+}
+
+static int testcase4(bool is_hugepage)
+{
+ pid_t pid;
+ int ret = 0, spg_id;
+ unsigned long kva, uva;
+ unsigned long size = 1024;
+ sem_t *sync;
+
+ SEM_INIT(sync, (int)is_hugepage);
+
+ spg_id = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, SPG_ID_AUTO);
+ if (spg_id < 0)
+ return -1;
+
+ // 加组两次
+ spg_id = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, SPG_ID_AUTO);
+ if (spg_id < 0)
+ return -1;
+
+ kva = wrap_vmalloc(size, is_hugepage);
+ if (!kva)
+ return -1;
+
+ uva = wrap_k2u(kva, size, spg_id, 0);
+ if (!uva) {
+ ret = -1;
+ goto out_vfree;
+ }
+
+ FORK_CHILD_ARGS(pid, testcase4_child(sync, uva, size));
+ ret = wrap_add_group(pid, PROT_READ, spg_id);
+ if (ret < 0 || ret != spg_id) {
+ pr_info("add child to group %d failed, ret: %d, errno: %d", spg_id, ret, errno);
+ ret = -1;
+ KILL_CHILD(pid);
+ goto out_unshare;
+ } else
+ ret = 0;
+
+ sem_post(sync);
+
+ WAIT_CHILD_SIGNAL(pid, SIGSEGV, out_unshare);
+
+out_unshare:
+ wrap_unshare(uva, size);
+out_vfree:
+ wrap_vfree(kva);
+
+ return ret;
+}
+
+/*
+ * 测试步骤：内核申请内存，k2task，用户写，内核check，内核重写，用户check，用户unshare
+ * 预期结果：内核check内存成功，用户check成功，无其他异常
+ */
+static int testcase5(bool is_hugepage)
+{
+ int ret = 0, i;
+ unsigned long kva, uva;
+ unsigned long size = 1024;
+
+ kva = wrap_vmalloc(size, is_hugepage);
+ if (!kva)
+ return -1;
+
+ uva = wrap_k2u(kva, size, SPG_ID_DEFAULT, 0);
+ if (!uva) {
+ ret = -1;
+ goto out_vfree;
+ }
+
+ memset((void *)uva, 'a', size);
+ KAREA_ACCESS_CHECK('a', kva, size, out_unshare);
+ KAREA_ACCESS_SET('b', kva, size, out_unshare);
+
+ for (i = 0; i < size; i++)
+ if (((char *)uva)[i] != 'b') {
+ pr_info("buf check failed, i:%d, val:%d", i, ((char *)uva)[i]);
+ ret = -1;
+ break;
+ }
+
+out_unshare:
+ wrap_unshare(uva, size);
+out_vfree:
+ wrap_vfree(kva);
+
+ return ret;
+}
+
+static int test1(void) { return testcase1(false); }
+static int test2(void) { return testcase1(true); }
+static int test3(void) { return testcase2(false); }
+static int test4(void) { return testcase2(true); }
+static int test5(void) { return testcase3(false); }
+static int test6(void) { return testcase3(true); }
+static int test7(void) { return testcase4(false); }
+static int test8(void) { return testcase4(true); }
+static int test9(void) { return testcase5(false); }
+static int test10(void) { return testcase5(true); }
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(test1, "进程A加组，内核申请小页，做k2spg，用户写，内核check，用户调用unshare。预期结果：内核check内存成功")
+ TESTCASE_CHILD(test2, "进程A加组，内核申请大页，做k2spg，用户写，内核check，用户调用unshare。预期结果：内核check内存成功")
+ TESTCASE_CHILD(test3, "父进程加组，并申请内核内存小页，做k2spg，写内存，fork子进程，子进程加相同组，子进程读(check)、写共享内存，内核check-----先做k2spg，然后加组")
+ TESTCASE_CHILD(test4, "父进程加组，并申请内核内存大页，做k2spg，写内存，fork子进程，子进程加相同组，子进程读(check)、写共享内存，内核check -----先做k2spg，然后加组")
+ TESTCASE_CHILD(test5, "父进程加组，并申请内核内存小页，fork子进程，子进程加相同组，设置成只读权限，父进程执行k2spg，并且写共享内存----先加组，然后k2spg。预期结果：用户写失败，触发segment fault")
+ TESTCASE_CHILD(test6, "父进程加组，并申请内核内存大页，fork子进程，子进程加相同组，设置成只读权限，父进程执行k2spg，并且写共享内存----先加组，然后k2spg。预期结果：用户写失败，触发segment fault")
+ TESTCASE_CHILD(test7, "父进程加组，并申请内核内存小页，做k2spg，fork子进程，子进程加相同组，设置成只读权限，子进程写共享内存-----先做k2spg，然后加组预期结果：用户写失败，触发segment fault")
+ TESTCASE_CHILD(test8, "父进程加组，并申请内核内存大页，做k2spg，fork子进程，子进程加相同组，设置成只读权限，子进程写共享内存-----先做k2spg，然后加组预期结果：用户写失败，触发segment fault")
+ TESTCASE_CHILD(test9, "内核申请内存小页，k2task，用户写，内核check，内核重写，用户check，用户unshare。预期结果：内核check内存成功，用户check成功，无其他异常")
+ TESTCASE_CHILD(test10, "内核申请内存大页，k2task，用户写，内核check，内核重写，用户check，用户unshare。预期结果：内核check内存成功，用户check成功，无其他异常")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_make_share_u2k/Makefile b/tools/testing/sharepool/testcase/api_test/sp_make_share_u2k/Makefile
new file mode 100644
index 000000000000..592e58e18fc9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_make_share_u2k/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/sp_make_share_u2k/test_sp_make_share_u2k.c b/tools/testing/sharepool/testcase/api_test/sp_make_share_u2k/test_sp_make_share_u2k.c
new file mode 100644
index 000000000000..828b6bf4691a
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_make_share_u2k/test_sp_make_share_u2k.c
@@ -0,0 +1,307 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Dec 16 10:45:21 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+
+#include "sharepool_lib.h"
+
+#define LARGE_PAGE_NUM 100000
+
+/*
+ * testcase1: 用户地址映射到内核，参数均有效。预期成功。
+ * testcase2: 用户地址映射到内核，pid无效。预期失败。
+ * testcase3: 用户地址映射到内核，uva无效(未申请过，在sp范围内)。预期失败。
+ * testcase4: 用户地址映射到内核，size超出范围。预期失败。
+ * testcase5: 用户地址映射到内核，size为0、uva、size未对齐。预期成功。
+ * testcase6: 用户态申请大页内存，参数有效，映射给内核，内核check。
+ */
+
+static int prepare(struct sp_alloc_info *alloc_info)
+{
+ int ret;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_alloc(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ memset((void *)alloc_info->addr, 'q', alloc_info->size);
+ return ret;
+}
+
+static int cleanup(struct sp_make_share_info *u2k_info, struct sp_alloc_info *alloc_info)
+{
+ int ret = 0;
+ if (u2k_info != NULL) {
+ ret = ioctl_unshare(dev_fd, u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+ }
+
+ if (alloc_info != NULL) {
+ ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_free failed, errno: %d", errno);
+ return ret;
+ }
+ }
+
+ return ret;
+}
+
+static int testcase1(void)
+{
+ int ret;
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = PAGE_SIZE,
+ .spg_id = 1,
+ };
+ if (prepare(&alloc_info) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("testcase1 ioctl_u2k failed, errno: %d", errno);
+ cleanup(NULL, &alloc_info);
+ return ret;
+ }
+
+ return cleanup(&u2k_info, &alloc_info);
+}
+
+static int testcase2(void)
+{
+ int ret;
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = PAGE_SIZE,
+ .spg_id = 1,
+ };
+ if (prepare(&alloc_info) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = 0,
+ };
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret != 0 && errno == ESRCH) {
+ //pr_info("testcase2 ioctl_u2k failed as expected, errno: %d", errno);
+ } else if (ret != 0) {
+ pr_info("testcase2 ioctl_u2k failed unexpected, errno: %d", errno);
+ cleanup(NULL, &alloc_info);
+ return ret;
+ } else {
+ pr_info("testcase2 ioctl_u2k success unexpected");
+ cleanup(&u2k_info, &alloc_info);
+ return -1;
+ }
+
+ return cleanup(NULL, &alloc_info);
+}
+
+static int testcase3(void)
+{
+ int ret;
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = PAGE_SIZE,
+ .spg_id = 1,
+ };
+ if (prepare(&alloc_info) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+ if (cleanup(NULL, &alloc_info) != 0) {
+ return -1;
+ }
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret != 0 && errno == EFAULT) {
+ //pr_info("testcase3 ioctl_u2k failed as expected, errno: %d", errno);
+ return 0;
+ } else if (ret != 0) {
+ pr_info("testcase3 ioctl_u2k failed unexpected, errno: %d", errno);
+ return ret;
+ } else {
+ pr_info("testcase3 ioctl_u2k success unexpected");
+ cleanup(&u2k_info, NULL);
+ return -1;
+ }
+}
+
+static int testcase4(void)
+{
+ int ret;
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = PAGE_SIZE,
+ .spg_id = 1,
+ };
+ if (prepare(&alloc_info) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info u2k_infos[] = {
+ {
+ .uva = alloc_info.addr,
+ .size = LARGE_PAGE_NUM * PAGE_SIZE,
+ .pid = getpid(),
+ },
+ };
+
+ for (int i = 0; i < sizeof(u2k_infos) / sizeof(u2k_infos[0]); i++) {
+ ret = ioctl_u2k(dev_fd, &u2k_infos[i]);
+ if (ret != 0 && errno == EFAULT) {
+ //pr_info("testcase4 ioctl_u2k %d failed as expected, errno: %d", i, errno);
+ } else if (ret != 0) {
+ pr_info("testcase4 ioctl_u2k %d failed unexpected, errno: %d", i, errno);
+ cleanup(NULL, &alloc_info);
+ return ret;
+ } else {
+ pr_info("testcase4 ioctl_u2k %d success unexpected", i);
+ cleanup(&u2k_infos[i], &alloc_info);
+ return -1;
+ }
+ }
+
+ return cleanup(NULL, &alloc_info);
+}
+
+static int testcase5(void)
+{
+ int ret;
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = PAGE_SIZE,
+ .spg_id = 1,
+ };
+ if (prepare(&alloc_info) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info u2k_infos[] = {
+ {
+ .uva = alloc_info.addr,
+ .size = 0,
+ .pid = getpid(),
+ },
+ {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size - 1,
+ .pid = getpid(),
+ },
+ {
+ .uva = alloc_info.addr + 1,
+ .size = alloc_info.size - 1,
+ .pid = getpid(),
+ },
+ };
+
+ for (int i = 0; i < sizeof(u2k_infos) / sizeof(u2k_infos[0]); i++) {
+ ret = ioctl_u2k(dev_fd, &u2k_infos[i]);
+ if (ret != 0) {
+ pr_info("testcase5 ioctl_u2k %d failed unexpected, errno: %d", i, errno);
+ cleanup(NULL, &alloc_info);
+ return ret;
+ } else {
+ //pr_info("testcase5 ioctl_u2k %d success expected", i);
+ if (cleanup(&u2k_infos[i], NULL) != 0) {
+ return -1;
+ }
+ }
+ }
+ return cleanup(NULL, &alloc_info);
+}
+
+static int testcase6(void)
+{
+ int ret;
+ struct sp_alloc_info alloc_info = {
+ .flag = SP_HUGEPAGE,
+ .size = PMD_SIZE * 2,
+ .spg_id = 1,
+ };
+ if (prepare(&alloc_info) != 0) {
+ return -1;
+ }
+
+ char *addr = (char *)alloc_info.addr;
+ addr[0] = 'd';
+ addr[PMD_SIZE - 1] = 'c';
+ addr[PMD_SIZE] = 'b';
+ addr[PMD_SIZE * 2 - 1] = 'a';
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ .u2k_hugepage_checker = true,
+ };
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("testcase1 ioctl_u2k failed, errno: %d", errno);
+ cleanup(NULL, &alloc_info);
+ return ret;
+ }
+
+ return cleanup(&u2k_info, &alloc_info);
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "用户地址映射到内核，参数均有效。预期成功。")
+ TESTCASE_STUB(testcase2, "用户地址映射到内核，pid无效。预期失败。")
+ TESTCASE_CHILD(testcase3, "用户地址映射到内核，uva无效(未申请过，在sp范围内)。预期失败。")
+ TESTCASE_CHILD(testcase4, "用户地址映射到内核，size超出范围。预期失败。")
+ TESTCASE_CHILD(testcase5, "用户地址映射到内核，size为0、uva、size未对齐。预期成功。")
+ TESTCASE_CHILD(testcase6, "用户态申请大页内存，参数有效，映射给内核，内核check。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_numa_maps/Makefile b/tools/testing/sharepool/testcase/api_test/sp_numa_maps/Makefile
new file mode 100644
index 000000000000..b640edb83546
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_numa_maps/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+# install: $(testcases)
+# cp $(testcases) $(TOOL_BIN_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/sp_numa_maps/test_sp_numa_maps.c b/tools/testing/sharepool/testcase/api_test/sp_numa_maps/test_sp_numa_maps.c
new file mode 100644
index 000000000000..42cedd4457e7
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_numa_maps/test_sp_numa_maps.c
@@ -0,0 +1,164 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2026-2026. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+static int addgroup(void)
+{
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static int testcase1(void)
+{
+ int ret;
+ unsigned long node_id = 0;
+ if (addgroup() != 0) {
+ return -1;
+ }
+
+ /* normal */
+ struct sp_alloc_info alloc_info = {
+ .flag = (node_id << 36UL) | SP_SPEC_NODE_ID,
+ .size = 100 * PAGE_SIZE,
+ .spg_id = 1,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret != 0) {
+ pr_info("testcase1 ioctl_alloc failed1, errno: %d", errno);
+ return ret;
+ }
+
+ node_id = 1;
+
+ struct sp_alloc_info alloc_info2 = {
+ .flag = (node_id << 36) | SP_SPEC_NODE_ID,
+ .size = 200 * PAGE_SIZE,
+ .spg_id = 1,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info2);
+ if (ret != 0) {
+ pr_info("testcase1 ioctl_alloc failed2, errno: %d", errno);
+ return ret;
+ }
+
+ /* hugetlb */
+ node_id = 2;
+
+ struct sp_alloc_info alloc_info3 = {
+ .flag = (node_id << 36) | SP_SPEC_NODE_ID | SP_HUGEPAGE,
+ .size = 10 * PMD_SIZE,
+ .spg_id = 1,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info3);
+ if (ret != 0) {
+ pr_info("testcase1 ioctl_alloc failed3, errno: %d", errno);
+ return ret;
+ }
+
+
+ /* remote */
+ // struct sp_add_group_info ag_info = {
+ // .pid = getpid(),
+ // .prot = PROT_READ | PROT_WRITE,
+ // .spg_id = 20,
+ // };
+ // ret = ioctl_add_group(dev_fd, &ag_info);
+ // if (ret < 0) {
+ // pr_info("ioctl_add_group failed, errno: %d", errno);
+ // }
+
+ // struct register_remote_range_struct info = {
+ // .spg_id = 20,
+ // .va = 0xe8b000000000,
+ // .pa = 0x1ff0000000,
+ // .size = 8 * 1024 *1024, // 8M
+ // };
+
+ // ret = ioctl_register_remote_range(dev_fd, &info);
+ // if (ret != 0 && errno == ENOMEM) {
+ // printf("ioctl_register_remote_range failed, ret: %d\n", ret);
+ // return -1;
+ // } else if (ret != 0) {
+ // printf("ioctl_register_remote_range failed, ret: %d\n", ret);
+ // return -1;
+ // }
+
+
+ /* k2u */
+ struct vmalloc_info vmalloc_info = {
+ .size = 20 * PMD_SIZE,
+ };
+
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'a',
+ .addr = vmalloc_info.addr,
+ .size = vmalloc_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ return -1;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = vmalloc_info.addr,
+ .size = vmalloc_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = SP_DVPP,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ return -1;
+ } else
+ pr_info("k2u success, addr: %#x", k2u_info.addr);
+
+ /* 手动 Ctrl + Z，然后 cat /proc/sharepool/proc_stat */
+ sleep(10);
+
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "Ctrl + Z, and then `cat /proc/sharepool/proc_stat` to show numa maps; 预期: N0: 400, N2: 20480; REMOTE: 8192")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_reg_hpage/Makefile b/tools/testing/sharepool/testcase/api_test/sp_reg_hpage/Makefile
new file mode 100644
index 000000000000..592e58e18fc9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_reg_hpage/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/sp_reg_hpage/test_sp_hpage_reg.c b/tools/testing/sharepool/testcase/api_test/sp_reg_hpage/test_sp_hpage_reg.c
new file mode 100644
index 000000000000..ac06e14e1e64
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_reg_hpage/test_sp_hpage_reg.c
@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 14 16:47:36 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+static int testcase1(void)
+{
+ int ret;
+
+ ret = ioctl_hpage_reg_test_suite(dev_fd, (void *)1);
+ if (ret != 0) {
+ pr_info("testcase1 ioctl_hpage_reg_test_suite failed, ret: %d\n", ret);
+ return ret;
+ }
+
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "入参合法性检查 & 注册一次成功，第二次失败")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_reg_hpage/test_sp_hpage_reg_after_alloc.c b/tools/testing/sharepool/testcase/api_test/sp_reg_hpage/test_sp_hpage_reg_after_alloc.c
new file mode 100644
index 000000000000..797c1595240a
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_reg_hpage/test_sp_hpage_reg_after_alloc.c
@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 14 16:47:36 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+#define PAGE_NUM 100
+
+static int addgroup(void)
+{
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static int cleanup(struct sp_alloc_info *alloc_info)
+{
+ int ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_free failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static int testcase1(void)
+{
+ int ret;
+ if (addgroup() != 0) {
+ return -1;
+ }
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = PAGE_NUM * PAGE_SIZE,
+ .spg_id = 1,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret != 0) {
+ pr_info("testcase1 ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_hpage_reg_after_alloc(dev_fd, (void *)1);
+ if (ret != 0) {
+ pr_info("testcase1 ioctl_hpage_reg_after_alloc failed, ret: %d\n", ret);
+ return ret;
+ }
+
+ return cleanup(&alloc_info);
+}
+
+/* testcase1: "先申请内存，后注册"
+*/
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "先申请内存，后注册")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_reg_hpage/test_sp_hpage_reg_exec.c b/tools/testing/sharepool/testcase/api_test/sp_reg_hpage/test_sp_hpage_reg_exec.c
new file mode 100644
index 000000000000..e88d83688149
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_reg_hpage/test_sp_hpage_reg_exec.c
@@ -0,0 +1,82 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 14 16:47:36 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+static int addgroup(void)
+{
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static int cleanup(struct sp_alloc_info *alloc_info)
+{
+ int ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_free failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+
+static int testcase1(void)
+{
+ int ret;
+
+ ret = ioctl_hpage_reg_test_exec(dev_fd, (void *)1);
+ if (ret != 0) {
+ pr_info("testcase1 ioctl_hpage_reg_test_exec failed, ret: %d\n", ret);
+ return ret;
+ }
+
+ if (addgroup() != 0) {
+ return -1;
+ }
+ struct sp_alloc_info alloc_info = {
+ .flag = SP_HUGEPAGE,
+ .size = PMD_SIZE,
+ .spg_id = 1,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret != -ENOMEM) {
+ pr_info("testcase1 ioctl_alloc unexpected, ret: 0x%d, errno: %d", ret, errno);
+ return ret;
+ }
+
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "大页申请函数注册后，能够成功执行到。预期dmesg打印：test_alloc_hugepage: execute succ.")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_unshare/Makefile b/tools/testing/sharepool/testcase/api_test/sp_unshare/Makefile
new file mode 100644
index 000000000000..592e58e18fc9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_unshare/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/sp_unshare/test_sp_unshare.c b/tools/testing/sharepool/testcase/api_test/sp_unshare/test_sp_unshare.c
new file mode 100644
index 000000000000..823060626fd9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_unshare/test_sp_unshare.c
@@ -0,0 +1,394 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Dec 16 10:45:21 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+
+#include "sharepool_lib.h"
+
+
+/*
+ * testcase1: k2u后，解映射用户空间地址范围，size超出申请范围；spg_id非法。预期失败。
+ * testcase2: k2u后，解映射用户地址空间范围，va、size未对齐；size为0；pid非法，预期成功。
+ * testcase3: u2k后，解映射内核地址空间范围，size为0或超出申请范围；pid和spg_id非法；va、size未对齐。预期成功。
+ */
+
+static int prepare_kva(struct vmalloc_info *ka_info)
+{
+ int ret;
+ ret = ioctl_vmalloc(dev_fd, ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'a',
+ .addr = ka_info->addr,
+ .size = ka_info->size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, ka_info);
+ }
+ return ret;
+}
+
+static int prepare_uva(struct sp_alloc_info *alloc_info)
+{
+ int ret;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_alloc(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ memset((void *)alloc_info->addr, 'q', alloc_info->size);
+ return ret;
+}
+
+static int testcase1(void)
+{
+ int ret;
+ struct vmalloc_info ka_info = {
+ .size = PAGE_SIZE,
+ };
+ if (prepare_kva(&ka_info) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("testcase1 ioctl_k2u failed unexpected, errno: %d", errno);
+ goto out2;
+ }
+ struct sp_make_share_info back_k2u_info = k2u_info;
+
+ struct sp_make_share_info unshare_info[] = {
+ {
+ .size = ka_info.size * 2,
+ .spg_id = 20,
+ .pid = getpid(),
+ },
+ };
+
+ for (int i = 0; i < sizeof(unshare_info) / sizeof(unshare_info[0]); i++) {
+ k2u_info.size = unshare_info[i].size;
+ k2u_info.spg_id = unshare_info[i].spg_id;
+ k2u_info.pid = unshare_info[i].pid;
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret != 0 && errno == EINVAL) {
+ pr_info("testcase1 ioctl_unshare %d failed expected", i);
+ ret = 0;
+ } else if (ret != 0) {
+ pr_info("testcase1 ioctl_unshare %d failed unexpected, errno: %d", i, errno);
+ goto out1;
+ } else {
+ pr_info("testcase1 ioctl_unshare %d success unexpected", i);
+ ret = -1;
+ goto out2;
+ }
+ }
+
+out1:
+ if (ioctl_unshare(dev_fd, &back_k2u_info) != 0) {
+ pr_info("testcase1 cleanup ioctl_unshare failed unexpected");
+ return -1;
+ }
+out2:
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+}
+
+static int testcase2(void)
+{
+ int ret;
+ struct vmalloc_info ka_info = {
+ .size = PAGE_SIZE,
+ };
+ if (prepare_kva(&ka_info) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+ struct sp_make_share_info back_k2u_info1 = k2u_info;
+
+ struct sp_make_share_info unshare_info[] = {
+ {
+ .addr = 1,
+ .size = ka_info.size - 1,
+ .pid = getpid(),
+ },
+ {
+ .addr = 0,
+ .size = ka_info.size - 1,
+ .pid = getpid(),
+ },
+ {
+ .addr = 0,
+ .size = 0,
+ .pid = getpid(),
+ },
+ {
+ .addr = 0,
+ .size = ka_info.size - 1,
+ .pid = 0,
+ },
+ };
+
+ struct sp_make_share_info back_k2u_info2;
+
+ for (int i = 0; i < sizeof(unshare_info) / sizeof(unshare_info[0]); i++) {
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("testcase2 ioctl_k2u failed unexpected, errno: %d", errno);
+ goto out2;
+ }
+ back_k2u_info2 = k2u_info;
+ k2u_info.addr += unshare_info[i].addr;
+ k2u_info.size = unshare_info[i].size;
+ k2u_info.pid = unshare_info[i].pid;
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret != 0) {
+ pr_info("testcase2 ioctl_unshare %d failed unexpected, errno: %d", i, errno);
+ goto out1;
+ } else {
+ pr_info("testcase2 ioctl_unshare %d success expected", i);
+ }
+ k2u_info = back_k2u_info1;
+ }
+ goto out2;
+
+out1:
+ if (ioctl_unshare(dev_fd, &back_k2u_info2) != 0) {
+ pr_info("testcase2 cleanup ioctl_unshare failed unexpected");
+ return -1;
+ }
+out2:
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+}
+/*
+static int testcase3(void)
+{
+ int ret;
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = PAGE_SIZE,
+ .spg_id = 1,
+ };
+ if (prepare_uva(&alloc_info) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("testcase3 ioctl_u2k failed unexpected, errno: %d", errno);
+ goto out2;
+ }
+ struct sp_make_share_info back_u2k_info = u2k_info;
+
+ struct sp_make_share_info unshare_info[] = {
+ {
+ .size = 0,
+ .spg_id = 1,
+ .pid = getpid(),
+ },
+ {
+ .size = alloc_info.size * 2,
+ .spg_id = 1,
+ .pid = getpid(),
+ },
+ {
+ .size = alloc_info.size,
+ .spg_id = 1,
+ .pid = 0,
+ },
+ {
+ .size = alloc_info.size,
+ .spg_id = SPG_ID_AUTO_MIN,
+ .pid = getpid(),
+ },
+ };
+
+ for (int i = 0; i < sizeof(unshare_info) / sizeof(unshare_info[0]); i++) {
+ u2k_info.size = unshare_info[i].size;
+ u2k_info.spg_id = unshare_info[i].spg_id;
+ u2k_info.pid = unshare_info[i].pid;
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret != 0 && errno == EINVAL) {
+ pr_info("testcase3 ioctl_unshare %d failed expected", i);
+ ret = 0;
+ } else if (ret != 0) {
+ pr_info("testcase3 ioctl_unshare %d failed unexpected, errno: %d", i, errno);
+ goto out1;
+ } else {
+ pr_info("testcase3 ioctl_unshare %d success unexpected", i);
+ ret = -1;
+ goto out2;
+ }
+ }
+
+out1:
+ if (ioctl_unshare(dev_fd, &back_u2k_info) != 0) {
+ pr_info("testcase3 cleanup ioctl_unshare failed unexpected");
+ return -1;
+ }
+out2:
+ if (ioctl_free(dev_fd, &alloc_info) != 0) {
+ pr_info("testcase3 cleanup ioctl_free failed unexpected");
+ return -1;
+ }
+ return ret;
+}
+*/
+
+static int testcase3(void)
+{
+ int ret;
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = PAGE_SIZE,
+ .spg_id = 1,
+ };
+ if (prepare_uva(&alloc_info) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+ struct sp_make_share_info back_u2k_info1 = u2k_info;
+
+ struct sp_make_share_info unshare_info[] = {
+ {
+ .addr = 1,
+ .size = alloc_info.size - 1,
+ .spg_id = 1,
+ .pid = getpid(),
+ },
+ {
+ .addr = 0,
+ .size = alloc_info.size - 1,
+ .spg_id = 1,
+ .pid = getpid(),
+ },
+ {
+ .addr = 0,
+ .size = 0,
+ .spg_id = 1,
+ .pid = getpid(),
+ },
+ {
+ .addr = 0,
+ .size = alloc_info.size / 2,
+ .spg_id = 1,
+ .pid = getpid(),
+ },
+ {
+ .addr = 0,
+ .size = alloc_info.size,
+ .spg_id = 1,
+ .pid = 0,
+ },
+ {
+ .addr = 0,
+ .size = alloc_info.size,
+ .spg_id = SPG_ID_AUTO_MIN,
+ .pid = getpid(),
+ },
+ };
+
+ struct sp_make_share_info back_u2k_info2;
+
+ for (int i = 0; i < sizeof(unshare_info) / sizeof(unshare_info[0]); i++) {
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("testcase3 ioctl_u2k failed unexpected, errno: %d", errno);
+ goto out2;
+ }
+ back_u2k_info2 = u2k_info;
+ u2k_info.addr += unshare_info[i].addr;
+ u2k_info.size = unshare_info[i].size;
+ u2k_info.spg_id = unshare_info[i].spg_id;
+ u2k_info.pid = unshare_info[i].pid;
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret != 0) {
+ pr_info("testcase3 ioctl_unshare %d failed unexpected, errno: %d", i, errno);
+ goto out1;
+ } else {
+ pr_info("testcase3 ioctl_unshare %d success expected", i);
+ }
+ u2k_info = back_u2k_info1;
+ }
+ goto out2;
+
+out1:
+ if (ioctl_unshare(dev_fd, &back_u2k_info2) != 0) {
+ pr_info("testcase4 cleanup ioctl_unshare failed unexpected");
+ return -1;
+ }
+out2:
+ if (ioctl_free(dev_fd, &alloc_info) != 0) {
+ pr_info("testcase3 cleanup ioctl_free failed unexpected");
+ return -1;
+ }
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "k2u后，解映射用户空间地址范围，size超出申请范围；spg_id非法。预期失败。")
+ TESTCASE_CHILD(testcase2, "k2u后，解映射用户地址空间范围，va、size未对齐；size为0；pid非法，预期成功。")
+ TESTCASE_CHILD(testcase3, "u2k后，解映射内核地址空间范围，size为0或超出申请范围；pid和spg_id非法；va、size未对齐。预期成功。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/api_test/sp_walk_page_range_and_free/Makefile b/tools/testing/sharepool/testcase/api_test/sp_walk_page_range_and_free/Makefile
new file mode 100644
index 000000000000..592e58e18fc9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_walk_page_range_and_free/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/api_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/api_test/sp_walk_page_range_and_free/test_sp_walk_page_range_and_free.c b/tools/testing/sharepool/testcase/api_test/sp_walk_page_range_and_free/test_sp_walk_page_range_and_free.c
new file mode 100644
index 000000000000..7669dc57cd83
--- /dev/null
+++ b/tools/testing/sharepool/testcase/api_test/sp_walk_page_range_and_free/test_sp_walk_page_range_and_free.c
@@ -0,0 +1,339 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Sat Nov 28 08:13:17 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <signal.h>
+#include <unistd.h>
+#include <stdlib.h> // for exit
+#include <sys/types.h>
+#include <sys/wait.h> // for wait
+
+#include "sharepool_lib.h"
+
+
+
+static int child(struct sp_alloc_info *alloc_info)
+{
+ int ret = 0;
+ int group_id = alloc_info->spg_id;
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("add group failed, errno: %d", errno);
+ return -1;
+ }
+
+ ret = ioctl_alloc(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct sp_walk_page_range_info wpr_info = {
+ .uva = alloc_info->addr,
+ .size = alloc_info->size,
+ };
+ ret = ioctl_walk_page_range(dev_fd, &wpr_info);
+ if (ret < 0) {
+ pr_info("ioctl_walk_page_range failed, errno: %d", errno);
+ return -1;
+ }
+
+ ioctl_walk_page_free(dev_fd, &wpr_info);
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+ struct sp_alloc_info alloc_infos[] = {
+ {
+ .flag = 0,
+ .spg_id = 10,
+ .size = 10 * PAGE_SIZE,
+ },
+ {
+ .flag = SP_HUGEPAGE,
+ .spg_id = 12,
+ .size = 10 * PMD_SIZE,
+ },
+ {
+ .flag = SP_DVPP,
+ .spg_id = 19,
+ .size = 100000,
+ },
+ {
+ .flag = SP_DVPP | SP_HUGEPAGE,
+ .spg_id = 19,
+ .size = 10000000,
+ },
+ };
+
+ for (int i = 0; i < sizeof(alloc_infos) / sizeof(alloc_infos[0]); i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork error");
+ return -1;
+ } else if (pid == 0) {
+ exit(child(alloc_infos + i));
+ }
+
+ int status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("testcase1 failed!!, i: %d", i);
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+/* uva 无效 */
+static int testcase2(void)
+{
+ struct sp_walk_page_range_info wpr_info = {
+ .uva = 0xe800000000,
+ .size = 1000,
+ };
+ int ret = ioctl_walk_page_range(dev_fd, &wpr_info);
+ if (!ret) {
+ pr_info("ioctl_walk_page_range successed unexpected");
+ return -1;
+ }
+
+ return 0;
+}
+
+/* size 为0，size超限制 */
+static int testcase3(void)
+{
+ int ret = 0;
+ int group_id = 100;
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("add group failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .spg_id = group_id,
+ .size = 12345,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return -1;
+ }
+ struct sp_walk_page_range_info wpr_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size * 10,
+ };
+ ret = ioctl_walk_page_range(dev_fd, &wpr_info);
+ if (!ret) {
+ pr_info("ioctl_walk_page_range successed unexpected");
+ return -1;
+ }
+
+ return 0;
+}
+
+/* size超限制，范围内存在未映射的物理页 */
+static int testcase4(void)
+{
+ int ret = 0;
+ int group_id = 130;
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("add group failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = SP_HUGEPAGE,
+ .spg_id = group_id,
+ .size = PMD_SIZE * 2,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return -1;
+ }
+ struct sp_walk_page_range_info wpr_info = {
+ .uva = alloc_info.addr - PMD_SIZE,
+ .size = alloc_info.size * 10,
+ };
+ pr_info("uva is %lx, size is %lx", wpr_info.uva, wpr_info.size);
+ ret = ioctl_walk_page_range(dev_fd, &wpr_info);
+ if (!ret) {
+ pr_info("ioctl_walk_page_range successed unexpected");
+ return 0;
+ }
+
+ return 0;
+}
+
+/* uva正常，size越界 */
+static int testcase5(void)
+{
+ unsigned long size = 0xffffffffffffffff;
+ int ret = 0;
+ unsigned long addr;
+
+ if (wrap_add_group(getpid(), PROT_READ | PROT_WRITE, 1) < 0)
+ return -1;
+
+ addr = (unsigned long)wrap_sp_alloc(1, PMD_SIZE, 1);
+ if (addr == -1) {
+ pr_info("alloc failed");
+ return -1;
+ }
+
+ ret = wrap_walk_page_range(addr, size);
+ if (!ret) {
+ pr_info("ioctl_walk_page_range successed unexpected");
+ return -1;
+ }
+
+ return 0;
+}
+
+/* uva和size均正常，但vma中存在未建立页表的空洞，预期失败，无泄漏 */
+static int testcase6(void)
+{
+ int ret = 0;
+ void *addr;
+ unsigned long size = 3 * PAGE_SIZE;
+
+ addr = mmap(NULL, size, PROT_WRITE | PROT_READ,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ if (addr == MAP_FAILED) {
+ pr_info("mmap failed! errno %d", errno);
+ return -1;
+ }
+
+ /* 先不踩页，walk_page预期失败 */
+ ret = wrap_walk_page_range(addr, size);
+ if (!ret) {
+ pr_info("ioctl_walk_page_range successed unexpected");
+ return -1;
+ }
+
+ /* 踩页，再次walk_page相应的大小，预期成功 */
+ size = 2 * PAGE_SIZE;
+ memset(addr, 0, size);
+
+ struct sp_walk_page_range_info wpr_info = {
+ .uva = addr,
+ .size = size,
+ };
+ pr_info("uva is %lx, size is %lx", wpr_info.uva, wpr_info.size);
+ ret = ioctl_walk_page_range(dev_fd, &wpr_info);
+ if (ret < 0) {
+ pr_info("ioctl_walk_page_range failed unexpected, errno %d", ret);
+ return -1;
+ }
+ ret = ioctl_walk_page_free(dev_fd, &wpr_info);
+ if (ret < 0) {
+ pr_info("ioctl_walk_page_free failed unexpected, errno %d", ret);
+ return -1;
+ }
+
+ return 0;
+}
+
+/* uva和size均正常，但vma中存在未建立页表的空洞，预期失败，无泄漏 */
+static int testcase7(void)
+{
+ int ret = 0;
+ void *addr;
+ unsigned long size = 20 * PMD_SIZE;
+
+ addr = mmap(NULL, size, PROT_WRITE | PROT_READ,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ if (addr == MAP_FAILED) {
+ pr_info("mmap failed! errno %d", errno);
+ return -1;
+ }
+
+ /* 先不踩页，walk_page预期失败 */
+ ret = wrap_walk_page_range(addr, size);
+ if (!ret) {
+ pr_info("ioctl_walk_page_range successed unexpected");
+ return -1;
+ }
+
+ /* 踩页，再次walk_page相应的大小，预期成功 */
+ size = 5 * PMD_SIZE;
+ memset(addr, 0, size);
+ /* 额外多walk_page一页，预期失败 */
+ ret = wrap_walk_page_range(addr, size + PMD_SIZE);
+ if (!ret) {
+ pr_info("ioctl_walk_page_range success unexpected");
+ return -1;
+ }
+
+ return 0;
+}
+
+#define TASK_SIZE 0xffffffffffff
+/* uva为TASK_SIZE-1，找不到vma，预期失败 */
+static int testcase8(void)
+{
+ int ret = 0;
+ void *addr = (void *)(TASK_SIZE);
+ unsigned long size = 3 * PAGE_SIZE;
+
+ ret = wrap_walk_page_range(addr, size);
+ if (!ret) {
+ pr_info("ioctl_walk_page_range successed unexpected");
+ return -1;
+ }
+
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "遍历小页、大页、dvpp小页、dvpp大页，预期成功")
+ TESTCASE_CHILD(testcase2, "uva 无效 预期失败")
+ TESTCASE_CHILD(testcase3, "size 为0，size超限制 预期失败")
+// TESTCASE_CHILD(testcase4, "size超限制，范围内存在未映射的物理页 预期失败")
+ TESTCASE_CHILD(testcase5, "uva正常，size越界 预期失败")
+ TESTCASE_CHILD(testcase6, "uva和size均正常，但vma未建立页表，预期失败，无泄漏。踩页后再次walk该vma，预期成功")
+ TESTCASE_CHILD(testcase7, "uva和size均正常，但vma未建立页表，预期失败，无泄漏。踩页后再次walk该vma且额外walk一个页大小，预期失败")
+ TESTCASE_CHILD(testcase8, "传入uva = (TASK_SIZE - 1), 预期找不到vma，失败")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/dts_bugfix_test/Makefile b/tools/testing/sharepool/testcase/dts_bugfix_test/Makefile
new file mode 100644
index 000000000000..e5f6e448e506
--- /dev/null
+++ b/tools/testing/sharepool/testcase/dts_bugfix_test/Makefile
@@ -0,0 +1,15 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ mkdir -p $(TOOL_BIN_DIR)/dts_bugfix_test
+ cp $(testcases) $(TOOL_BIN_DIR)/dts_bugfix_test
+ cp dts_bugfix_test.sh $(TOOL_BIN_DIR)
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/dts_bugfix_test/dts_bugfix_test.sh b/tools/testing/sharepool/testcase/dts_bugfix_test/dts_bugfix_test.sh
new file mode 100755
index 000000000000..f22ee6d0d0db
--- /dev/null
+++ b/tools/testing/sharepool/testcase/dts_bugfix_test/dts_bugfix_test.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+
+set -x
+
+echo 'test_01_coredump_k2u_alloc
+ test_02_spg_not_alive
+ test_08_addr_offset' | while read line
+do
+ let flag=0
+ ./dts_bugfix_test/$line
+ if [ $? -ne 0 ] ;then
+ echo "testcase dts_bugfix_test/$line failed"
+ let flag=1
+ fi
+
+ sleep 3
+
+ #打印spa_stat
+ ret=`cat /proc/sharepool/spa_stat | wc -l`
+ if [ $ret -ge 15 ] ;then
+ cat /proc/sharepool/spa_stat
+ echo spa_stat not clean
+ let flag=1
+ fi
+ #打印proc_stat
+ ret=`cat /proc/sharepool/proc_stat | wc -l`
+ if [ $ret -ge 15 ] ;then
+ cat /proc/sharepool/proc_stat
+ echo proc_stat not clean
+ let flag=1
+ fi
+
+ cat /proc/sharepool/proc_overview
+ #如果泄漏 -->exit
+ if [ $flag -eq 1 ] ;then
+ exit 1
+ fi
+ echo "testcase dts_bugfix_test/$line success"
+
+ cat /proc/meminfo
+ free -m
+
+done
diff --git a/tools/testing/sharepool/testcase/dts_bugfix_test/test_01_coredump_k2u_alloc.c b/tools/testing/sharepool/testcase/dts_bugfix_test/test_01_coredump_k2u_alloc.c
new file mode 100644
index 000000000000..4842fde68720
--- /dev/null
+++ b/tools/testing/sharepool/testcase/dts_bugfix_test/test_01_coredump_k2u_alloc.c
@@ -0,0 +1,603 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Dec 16 06:59:45 2020
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <signal.h>
+#include <sys/time.h>
+#include <sys/resource.h>
+#include <stdlib.h> /* rand() and srand() */
+#include <time.h> /* time() */
+#include <pthread.h>
+
+#include "sharepool_lib.h"
+#include "sem_use.h"
+
+#define PROC_NUM 128
+#define GROUP_ID 1
+#define K2U_UNSHARE_TIME 2
+#define ALLOC_FREE_TIME 2
+#define VMALLOC_SIZE 4096
+#define PROT (PROT_READ | PROT_WRITE)
+#define GROUP_NUM 4
+#define K2U_CONTINUOUS_TIME 2000
+#define min(a,b) ((a)<(b)?(a):(b))
+
+/* testcase base:
+ * 每个组都拉起一个进程负责k2u/alloc，其他N个进程加多组后依次coredump，所有组k2u/alloc每次都应该返回成功。
+ * 打印维测信息正常。
+ * 所有进程coredump后，测试退出，打印维测信息，组和spa均为0，无泄漏。
+ */
+
+static int semid[PROC_NUM];
+static int sem_task;
+static int group_ids[GROUP_NUM];
+
+struct k2u_args {
+ int with_print;
+ int k2u_whole_times; // repeat times
+ int (*k2u_tsk)(struct k2u_args);
+};
+
+struct task_param {
+ bool with_print;
+};
+
+struct test_setting {
+ int (*task)(struct task_param*);
+ struct task_param *task_param;
+};
+
+static int init_sem();
+static int close_sem();
+static int k2u_unshare_task(struct task_param *task_param);
+static int k2u_continuous_task(struct task_param *task_param);
+static int child_process(int index);
+static int alloc_free_task(struct task_param *task_param);
+static int alloc_continuous_task(struct task_param *task_param);
+static int testcase_combine(int (*task1)(struct task_param*),
+ int (*task2)(struct task_param*), struct task_param *param);
+
+static int testcase_base(struct test_setting test_setting)
+{
+ int status;
+ int pid;
+ int child[PROC_NUM];
+ int ret;
+ int pid_k2u;
+
+ setCore();
+ // 初始化sem
+ ret = init_sem();
+ if (ret < 0) {
+ pr_info("init sem failed");
+ return -1;
+ }
+
+ // 创建组
+ //ret = wrap_add_group(getpid(), PROT, GROUP_ID);
+ ret = create_multi_groups(getpid(), GROUP_NUM, group_ids);
+ if (ret < 0) {
+ pr_info("add group failed %d", getpid());
+ return -1;
+ }
+
+ // 拉起功能进程，负责k2u或者alloc
+ pid_k2u = fork();
+ if (pid_k2u < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid_k2u == 0) {
+ ret = add_multi_groups(getpid(), GROUP_NUM, group_ids);
+ if (ret < 0) {
+ pr_info("add group failed %d", getpid());
+ exit(-1);
+ } else {
+ pr_info("functional process add group succuess.");
+ }
+ exit(test_setting.task(test_setting.task_param));
+ }
+
+ // 拉起子进程
+ for (int i = 0; i < PROC_NUM; i++) {
+ pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed, deleting procs...");
+ goto delete_procs;
+ } else if (pid == 0) {
+ // 拉起子进程 hanging
+ exit(child_process(i));
+ } else {
+ child[i] = pid;
+ //ret = wrap_add_group(pid, PROT, GROUP_ID);
+ ret = add_multi_groups(pid, GROUP_NUM, group_ids);
+ if (ret < 0) {
+ pr_info("add group failed %d", pid);
+ goto delete_procs;
+ }
+ }
+ }
+
+ // 依次让子进程coredump
+ for (int i = 0; i < PROC_NUM; i++) {
+ pr_info("coredump process %d", child[i]);
+ sem_inc_by_one(semid[i]);
+ waitpid(child[i], &status, 0);
+ usleep(200000);
+ }
+
+ // 功能进程退出
+ sem_inc_by_one(sem_task);
+ waitpid(pid_k2u, &status, 0);
+
+ close_sem();
+ return 0;
+
+delete_procs:
+ return -1;
+}
+
+static int testcase_combine(int (*task1)(struct task_param*),
+ int (*task2)(struct task_param*), struct task_param *param)
+{
+ int status;
+ int pid;
+ int child[PROC_NUM];
+ int ret;
+ int pid_k2u, pid_alloc;
+
+ setCore();
+ // 初始化sem
+ ret = init_sem();
+ if (ret < 0) {
+ pr_info("init sem failed");
+ return -1;
+ }
+
+ // 创建组
+ //ret = wrap_add_group(getpid(), PROT, GROUP_ID);
+ ret = create_multi_groups(getpid(), GROUP_NUM, group_ids);
+ if (ret < 0) {
+ pr_info("add group failed %d", getpid());
+ return -1;
+ }
+
+ // 拉起功能进程，负责k2u或者alloc
+ pid_k2u = fork();
+ if (pid_k2u < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid_k2u == 0) {
+ ret = add_multi_groups(getpid(), GROUP_NUM, group_ids);
+ if (ret < 0) {
+ pr_info("add group failed %d", getpid());
+ exit(-1);
+ } else {
+ pr_info("functional process add group succuess.");
+ }
+ exit(task1(param));
+ }
+
+ pid_alloc = fork();
+ if (pid_alloc < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid_alloc == 0) {
+ ret = add_multi_groups(getpid(), GROUP_NUM, group_ids);
+ if (ret < 0) {
+ pr_info("add group failed %d", getpid());
+ exit(-1);
+ } else {
+ pr_info("functional process add group succuess.");
+ }
+ exit(task2(param));
+ }
+
+ // 拉起子进程
+ for (int i = 0; i < PROC_NUM; i++) {
+ pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed, deleting procs...");
+ goto delete_procs;
+ } else if (pid == 0) {
+ // 拉起子进程 hanging
+ exit(child_process(i));
+ } else {
+ child[i] = pid;
+ //ret = wrap_add_group(pid, PROT, GROUP_ID);
+ ret = add_multi_groups(pid, GROUP_NUM, group_ids);
+ if (ret < 0) {
+ pr_info("add group failed %d", pid);
+ goto delete_procs;
+ }
+ }
+ }
+
+ // 依次让子进程coredump
+ for (int i = 0; i < PROC_NUM; i++) {
+ pr_info("coredump process %d", child[i]);
+ sem_inc_by_one(semid[i]);
+ waitpid(child[i], &status, 0);
+ usleep(200000);
+ }
+
+ // 功能进程退出
+ sem_inc_by_val(sem_task, 2);
+ waitpid(pid_k2u, &status, 0);
+ waitpid(pid_alloc, &status, 0);
+
+ close_sem();
+ return 0;
+
+delete_procs:
+ return -1;
+}
+
+static struct task_param task_param_table[] = {
+ {
+ .with_print = false,
+ },
+ {
+ .with_print = true,
+ },
+ {
+ .with_print = false,
+ },
+ {
+ .with_print = false,
+ },
+};
+
+static struct test_setting test_setting_table[] = {
+ {
+ .task_param = &task_param_table[0],
+ .task = k2u_unshare_task,
+ },
+ {
+ .task_param = &task_param_table[1],
+ .task = k2u_unshare_task,
+ },
+ {
+ .task_param = &task_param_table[2],
+ .task = k2u_continuous_task,
+ },
+ {
+ .task_param = &task_param_table[3],
+ .task = alloc_free_task,
+ },
+ {
+ .task_param = &task_param_table[3],
+ .task = alloc_continuous_task,
+ },
+ {
+ .task_param = &task_param_table[1],
+ .task = alloc_free_task,
+ },
+};
+
+/* testcase1
+ * 执行k2u_unshare_task
+ */
+static int testcase1(void)
+{
+ return testcase_base(test_setting_table[0]);
+}
+/* testcase2
+ * 执行k2u_unshare_task, 同时打印维测
+ */
+static int testcase2(void)
+{
+ return testcase_base(test_setting_table[1]);
+}
+/* testcase3
+ * 执行k2u_continuous_task
+ */
+static int testcase3(void)
+{
+ return testcase_base(test_setting_table[2]);
+}
+/* testcase4
+ * 执行alloc_free_task
+ */
+static int testcase4(void)
+{
+ return testcase_base(test_setting_table[3]);
+}
+/* testcase5
+ * 执行alloc_continuous_task
+ */
+static int testcase5(void)
+{
+ return testcase_base(test_setting_table[4]);
+}
+/* testcase6
+ * 执行alloc_free_task, 同时打印维测
+ */
+static int testcase6(void)
+{
+ return testcase_base(test_setting_table[5]);
+}
+/* testcase7
+ * 混合执行k2u_continuous_task和alloc_continuous_task, 同时打印维测
+ */
+static int testcase7(void)
+{
+ return testcase_combine(k2u_continuous_task, alloc_continuous_task, &task_param_table[0]);
+}
+
+static int close_sem()
+{
+ int ret;
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ ret = sem_close(semid[i]);
+ if (ret < 0) {
+ pr_info("sem close failed");
+ return ret;
+ }
+ }
+ sem_close(sem_task);
+ pr_info("all sems deleted.");
+ return 0;
+}
+
+static int init_sem()
+{
+ int i = 0;
+
+ sem_task = sem_create(PROC_NUM, "sem_task");
+
+ for (i = 0; i < PROC_NUM; i++) {
+ key_t key = i;
+ semid[i] = sem_create(key, "sem_child");
+ if (semid[i] < 0) {
+ pr_info("semid %d init failed. errno: %d", i, errno);
+ goto delete_sems;
+ }
+ }
+ pr_info("all sems initialized.");
+ return 0;
+
+delete_sems:
+ for (int j = 0; j < i; j++) {
+ sem_close(semid[j]);
+ }
+ return -1;
+}
+
+static int child_process(int index)
+{
+ pr_info("child process %d created", getpid());
+ // 收到coredump信号后coredump
+ sem_dec_by_one(semid[index]);
+ pr_info("child process %d coredump", getpid());
+ generateCoredump();
+ return 0;
+}
+
+/* k2u_unshare_task
+ * 快速的k2u -> unshare -> k2u -> unshare 循环
+ */
+static int k2u_unshare_task(struct task_param *task_param)
+{
+ int ret;
+ int i;
+ struct vmalloc_info vmalloc_info;
+ struct sp_make_share_info k2u_info;
+ unsigned long uva[K2U_UNSHARE_TIME];
+
+ vmalloc_info.size = VMALLOC_SIZE;
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed.");
+ return -1;
+ } else {
+ pr_info("vmalloc %ld success.", vmalloc_info.size);
+ }
+
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+ k2u_info.sp_flags = 0;
+ k2u_info.pid = getpid();
+ k2u_info.spg_id = GROUP_ID;
+
+repeat:
+ memset(uva, 0, sizeof(unsigned long) * K2U_UNSHARE_TIME);
+ for (i = 0; i < K2U_UNSHARE_TIME; i++) {
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("k2u failed at %d time.", i);
+ goto unshare;
+ } else {
+ pr_info("k2u success %d time, addr = %lx", i, k2u_info.addr);
+ uva[i] = k2u_info.addr;
+ }
+ }
+
+ if (task_param->with_print)
+ sharepool_print();
+
+unshare:
+ for (int j = 0; j < i; j++) {
+ pr_info("uva[%d] is %ld", j, uva[j]);
+ k2u_info.addr = uva[j];
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("unshare failed at %d", j);
+ return -1;
+ }
+ }
+
+ if (sem_get_value(sem_task) == 0)
+ goto repeat;
+
+ ioctl_vfree(dev_fd, &vmalloc_info);
+
+ return 0;
+}
+
+/* k2u_continuous_task
+ * 先连续k2u 很多次 再连续unshare 很多次
+ */
+static int k2u_continuous_task(struct task_param *task_param)
+{
+ int ret;
+ int i, h;
+ struct vmalloc_info vmalloc_info;
+ struct sp_make_share_info k2u_info;
+ unsigned long *uva;
+
+ vmalloc_info.size = VMALLOC_SIZE;
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed.");
+ return -1;
+ } else {
+ pr_info("vmalloc %ld success.", vmalloc_info.size);
+ }
+
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+ k2u_info.sp_flags = 0;
+ k2u_info.pid = getpid();
+ //k2u_info.spg_id = GROUP_ID;
+
+ uva = malloc(sizeof(unsigned long) * K2U_CONTINUOUS_TIME * GROUP_NUM);
+
+ memset(uva, 0, sizeof(unsigned long) * K2U_CONTINUOUS_TIME * GROUP_NUM);
+ for (i = 0; i < K2U_CONTINUOUS_TIME; i++) {
+ for (h = 0; h < GROUP_NUM; h++) {
+ k2u_info.spg_id = group_ids[h];
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("k2u failed at %d time in group %d.", i, group_ids[h]);
+ goto unshare;
+ } else {
+ pr_info("k2u success %d time, addr = %lx", i, k2u_info.addr);
+ uva[i * GROUP_NUM + h] = k2u_info.addr;
+ }
+ }
+ }
+
+unshare:
+ for (int j = 0; j < min((i * GROUP_NUM + h), K2U_CONTINUOUS_TIME * GROUP_NUM); j++) {
+ pr_info("uva[%d] is %ld", j, uva[j]);
+ k2u_info.addr = uva[j];
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("unshare failed at %d", j);
+ return -1;
+ }
+ }
+
+ ioctl_vfree(dev_fd, &vmalloc_info);
+
+ return 0;
+}
+
+/* alloc_free_task
+ * 快速的alloc-free-alloc-free循环*/
+#define ALLOC_SIZE 4096
+#define ALLOC_FLAG 0
+static int alloc_free_task(struct task_param *task_param)
+{
+ int ret = 0;
+ int i, h;
+ unsigned long ret_addr = -1;
+ unsigned long addr[ALLOC_FREE_TIME][GROUP_NUM];
+
+repeat:
+ for (i = 0; i < ALLOC_FREE_TIME; i++) {
+ for (h = 0; h < GROUP_NUM; h++) {
+ ret_addr = wrap_sp_alloc(group_ids[h], ALLOC_SIZE, ALLOC_FLAG);
+ if (!ret_addr) {
+ pr_info("alloc failed %d time %d group", i, h + 1);
+ return ret_addr;
+ } else {
+ addr[i][h] = ret_addr;
+ pr_info("alloc success addr %x", ret_addr);
+ }
+ }
+ }
+
+ if (task_param->with_print)
+ sharepool_print();
+
+free:
+ for (i = 0; i < ALLOC_FREE_TIME; i++) {
+ for (h = 0; h < GROUP_NUM; h++) {
+ ret = wrap_sp_free(addr[i][h]);
+ if (ret < 0) {
+ pr_info("free failed %d time group %d", i, h + 1);
+ return ret;
+ }
+ }
+ }
+
+ if (sem_get_value(sem_task) == 0)
+ goto repeat;
+
+ return ret;
+}
+
+/* alloc_continuous_task
+ * 先连续alloc 很多次 再连续free 很多次
+ */
+
+#define ALLOC_CONTINUOUS_TIME 2000
+static int alloc_continuous_task(struct task_param *task_param)
+{
+ int ret = 0;
+ int i, h;
+ unsigned long ret_addr = -1;
+ unsigned long addr[ALLOC_FREE_TIME][GROUP_NUM];
+ for (i = 0; i < ALLOC_CONTINUOUS_TIME; i++) {
+ for (h = 0; h < GROUP_NUM; h++) {
+ ret_addr = wrap_sp_alloc(group_ids[h], ALLOC_SIZE, ALLOC_FLAG);
+ if (!ret_addr) {
+ pr_info("alloc failed %d time %d group", i, h + 1);
+ return ret_addr;
+ } else {
+ addr[i][h] = ret_addr;
+ pr_info("alloc success addr %x", ret_addr);
+ }
+ }
+ }
+ for (i = 0; i < ALLOC_CONTINUOUS_TIME; i++) {
+ for (h = 0; h < GROUP_NUM; h++) {
+ ret = wrap_sp_free(addr[i][h]);
+ if (ret < 0) {
+ pr_info("free failed %d time group %d", i, h + 1);
+ return ret;
+ }
+ }
+ }
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "1")
+ TESTCASE_CHILD(testcase2, "2")
+ TESTCASE_CHILD(testcase3, "3")
+ TESTCASE_CHILD(testcase4, "4")
+ TESTCASE_CHILD(testcase5, "5")
+ TESTCASE_CHILD(testcase6, "6")
+ TESTCASE_CHILD(testcase7, "7")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/dts_bugfix_test/test_02_spg_not_alive.c b/tools/testing/sharepool/testcase/dts_bugfix_test/test_02_spg_not_alive.c
new file mode 100644
index 000000000000..0da0356b34d8
--- /dev/null
+++ b/tools/testing/sharepool/testcase/dts_bugfix_test/test_02_spg_not_alive.c
@@ -0,0 +1,166 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include "sharepool_lib.h"
+#include "sem_use.h"
+
+#define GROUP_ID 1
+#define ALLOC_SIZE (4096UL)
+#define TEST_SIZE 10
+#define MAX_RETRY 10
+#define REPEAT 30000
+#define PROT (PROT_READ | PROT_WRITE)
+int semid_add, semid_exit, semid_create;
+int sem1, sem2;
+
+static int fault_verify(void)
+{
+ int ret;
+ int test_pid[TEST_SIZE];
+ int pid;
+
+ ret = wrap_sp_alloc(GROUP_ID, ALLOC_SIZE, 0);
+ if (ret < 0) {
+ printf("fault verify --- alloc failed.\n");
+ }
+
+ for (int i = 0; i < TEST_SIZE; i++) {
+ pid = fork();
+ if (pid == 0) {
+ exit(wrap_add_group(getpid(), PROT, GROUP_ID));
+ }
+ }
+
+ printf("fault is verified!\n");
+ return 0;
+}
+
+static int child_process(int semid)
+{
+ int ret = 0;
+ int spg_id = 0;
+ int retry_time = 0;
+
+ printf("process %d created.\n", getpid());
+
+ sem_dec_by_one(semid);
+retry:
+ ret = wrap_add_group(getpid(), PROT, GROUP_ID);
+ if (errno == ENODEV || errno == ENOSPC) {
+ printf("process %d add group failed once, retry...\n", getpid());
+ errno = 0;
+ if (retry_time++ < MAX_RETRY)
+ goto retry;
+ }
+
+ retry_time = 0;
+ if (ret < 0) {
+ printf("process %d add group unexpected error, ret is %d\n",
+ getpid(), ret);
+ sem_dec_by_one(semid);
+ return -1;
+ }
+ printf("process %d add group success\n", getpid());
+
+ errno = 0;
+ spg_id = ioctl_find_first_group(dev_fd, getpid());
+ if (spg_id < 0 && errno == ENODEV) {
+ printf("fault is found.\n");
+ ret = fault_verify();
+ sem_dec_by_one(semid);
+ return -1;
+ }
+ if (spg_id != GROUP_ID) {
+ printf("unexpected find group fault %d\n", spg_id);
+ return -1;
+ }
+
+ sem_dec_by_one(semid);
+ // printf("process %d exit.\n", getpid());
+ return 0;
+}
+
+static int testcase1(void)
+{
+ int ret = 0;
+ int status;
+ int sem;
+ pid_t first, prev, current;
+
+ semid_add = sem_create(2234, "spg not alive test add group");
+ semid_exit = sem_create(3234, "spg not alive test exit group");
+ semid_create = sem_create(4234, "create");
+
+ sem1 = sem_create(1234, "sem lock for prev process");
+ sem2 = sem_create(4321, "sem lock for new process");
+
+ sem_inc_by_one(sem1);
+ first = fork();
+ if (first < 0)
+ goto close_sem;
+ else if (first == 0)
+ exit(child_process(sem1));
+ prev = first;
+ sem_check_zero(sem1);
+ sem = sem2;
+
+ for (int i = 0; i < REPEAT; i++) {
+ current = fork();
+ if (current < 0) {
+ printf("fork failed.\n");
+ kill(prev, SIGKILL);
+ ret = -1;
+ goto close_sem;
+ } else if (current == 0) {
+ exit(child_process(sem));
+ }
+
+ sem_inc_by_one(sem1); // 1退出 2加组
+ sem_inc_by_one(sem2); // 2加组 1退出
+
+ sem_check_zero(sem1);
+ sem_check_zero(sem2);
+
+ waitpid(prev, &status, 0);
+
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("process %d exit unexpected, %d", status);
+ ret = -1;
+ goto end;
+ } else
+ pr_info("process %d exit", prev);
+ prev = current;
+
+ if (sem == sem1) {
+ sem = sem2;
+ } else if (sem == sem2) {
+ sem = sem1;
+ } else {
+ printf("unexpected error: weird sem value: %d\n", sem);
+ goto end;
+ }
+ }
+end:
+ kill(current, SIGKILL);
+ waitpid(current, &status, 0);
+close_sem:
+ sem_close(sem1);
+ sem_close(sem2);
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE(testcase1, "加组和组销毁并发")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/dts_bugfix_test/test_03_hugepage_rsvd.c b/tools/testing/sharepool/testcase/dts_bugfix_test/test_03_hugepage_rsvd.c
new file mode 100644
index 000000000000..a442ab98b45c
--- /dev/null
+++ b/tools/testing/sharepool/testcase/dts_bugfix_test/test_03_hugepage_rsvd.c
@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 14 16:47:36 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+
+#include "sharepool_lib.h"
+
+#define HP_SIZE (3UL * 1024UL * 1024UL) // 1G
+static int addgroup(void)
+{
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static int cleanup(struct sp_alloc_info *alloc_info)
+{
+ int ret = ioctl_free(dev_fd, alloc_info);
+ return ret;
+}
+
+static int testcase1(void)
+{
+ int ret;
+ int i;
+ if (addgroup() != 0) {
+ return -1;
+ }
+ struct sp_alloc_info alloc_infos[100];
+
+ for (i = 0; i < 4; i++) {
+ alloc_infos[i].flag = 3;
+ alloc_infos[i].size = HP_SIZE;
+ alloc_infos[i].spg_id = 1;
+ ret = ioctl_alloc(dev_fd, &alloc_infos[i]);
+ if (ret != 0) {
+ pr_info("%dth testcase1 ioctl_alloc failed, errno: %d", i+1, errno);
+ goto out;
+ }
+ }
+
+ while(1);
+out:
+ for (int j = 0; j < i; j++) {
+ ret = cleanup(&alloc_infos[j]);
+ if (ret < 0) {
+ pr_info("ioctl_free failed, errno: %d", errno);
+ } else
+ pr_info("free %d success", j+1);
+ }
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, true)
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/dts_bugfix_test/test_04_spg_add_del.c b/tools/testing/sharepool/testcase/dts_bugfix_test/test_04_spg_add_del.c
new file mode 100644
index 000000000000..f87c7fc4b8f6
--- /dev/null
+++ b/tools/testing/sharepool/testcase/dts_bugfix_test/test_04_spg_add_del.c
@@ -0,0 +1,100 @@
+#include <stdio.h>
+#include <errno.h>
+#include <signal.h>
+#include <unistd.h>
+#include <stdlib.h> // for exit
+#include <pthread.h>
+#include <sys/types.h>
+#include <sys/wait.h> // for wait
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+#define PROC_NUM 2
+#define PRINT_NUM 3
+
+/*
+ * testcase1
+ * 测试点：有效pid加组
+ * 预期结果：加组成功，返回正确组id
+ */
+
+static int add_del_child(int group_id)
+{
+ int ret = 0;
+
+ pr_info("child %d created", getpid());
+ while (1) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, group_id);
+ if (ret < 0)
+ pr_info("child %d add group failed, ret %d", getpid(), ret);
+
+ ret = wrap_del_from_group(getpid(), group_id);
+ if (ret < 0)
+ pr_info("child %d del from group failed, ret %d", getpid(), ret);
+ }
+
+ return 0;
+}
+
+static int print_child(void)
+{
+ while (1) {
+ sharepool_print();
+ sleep(2);
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+ int ret = 0;
+ int group_id = 1;
+ pid_t child[PROC_NUM];
+ pid_t printer[PRINT_NUM];
+
+ /*
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, group_id);
+ if (ret < 0) {
+ pr_info(" add group failed");
+ return -1;
+ }
+ */
+
+ pr_info("test 1");
+ for (int i = 0; i < PROC_NUM; i++)
+ FORK_CHILD_ARGS(child[i], add_del_child(group_id));
+
+ for (int i = 0; i < PRINT_NUM; i++)
+ FORK_CHILD_ARGS(printer[i], print_child());
+
+ sleep(30);
+
+ for (int i = 0; i < PROC_NUM; i++)
+ KILL_CHILD(child[i]);
+
+ for (int i = 0; i < PRINT_NUM; i++)
+ KILL_CHILD(printer[i]);
+
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE(testcase1, "有效pid加组，预期成功，返回正确组Id")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/dts_bugfix_test/test_05_cgroup_limit.c b/tools/testing/sharepool/testcase/dts_bugfix_test/test_05_cgroup_limit.c
new file mode 100644
index 000000000000..7a4a2be9264a
--- /dev/null
+++ b/tools/testing/sharepool/testcase/dts_bugfix_test/test_05_cgroup_limit.c
@@ -0,0 +1,76 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 14 16:47:36 2020
+ */
+#include <stdio.h>
+#include <sys/ioctl.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+
+#include "sharepool_lib.h"
+
+#define ALLOC_NUM 2
+
+static int testcase1(void)
+{
+ int ret = 0;
+ void *addr;
+ unsigned long va[ALLOC_NUM];
+ int spg_id = 1;
+ unsigned long size = 1 * 1024UL * 1024UL * 1024UL;
+ int i;
+
+ if (wrap_add_group(getpid(), PROT_READ | PROT_WRITE, spg_id) < 0) {
+ pr_info("add group failed");
+ return -1;
+ }
+
+ // 申请小页 5次 预计第5次失败，然后释放所有内存
+ for (i = 0; i < ALLOC_NUM; i++) {
+ addr = wrap_sp_alloc(spg_id, size, 0);
+ if (addr == (void *)-1) {
+ pr_info("alloc %d time failed, errno: %d", i + 1, errno);
+ i--;
+ break;
+ } else {
+ pr_info("alloc %d time success, va: 0x%lx", i + 1, addr);
+ va[i] = (unsigned long)addr;
+ }
+ }
+
+ // 将申请的内存释放
+ for ( ; i >= 0; i--) {
+ ret = wrap_sp_free_by_id(va[i], spg_id);
+ if (ret < 0) {
+ pr_info("free %d time failed, errno: %d", i + 1, ret);
+ return -1;
+ } else {
+ pr_info("free %d time success", i + 1);
+ }
+ }
+
+ sleep(1200);
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "将cgroup设置为N个GB + xxx个MB,进程申请N次内存后，预期第N+1次失败；释放已申请的内存，并挂起。观察cgroup中剩余内存")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/dts_bugfix_test/test_06_clone.c b/tools/testing/sharepool/testcase/dts_bugfix_test/test_06_clone.c
new file mode 100644
index 000000000000..267112eff125
--- /dev/null
+++ b/tools/testing/sharepool/testcase/dts_bugfix_test/test_06_clone.c
@@ -0,0 +1,176 @@
+#define _GNU_SOURCE
+#include <sys/wait.h>
+#include <sys/utsname.h>
+#include <sched.h>
+#include <string.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/mman.h>
+
+#include "sharepool_lib.h"
+
+#define STACK_SIZE (1024 * 1024) /* Stack size for cloned child */
+
+/* case 1 */
+static int /* Start function for cloned child */
+childFunc_1(void *arg)
+{
+ printf("child finished\n");
+}
+
+int testcase1(void)
+{
+ char *stack; /* Start of stack buffer */
+ char *stackTop; /* End of stack buffer */
+ pid_t pid;
+ int ret = 0;
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, 1);
+ if (ret != 1) {
+ printf("Add group failed, ret is %d\n", ret);
+ return -1;
+ }
+
+ /* Allocate memory to be used for the stack of the child. */
+
+ stack = mmap(NULL, STACK_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0);
+ stackTop = stack + STACK_SIZE; /* Assume stack grows downward */
+
+ pid = clone(childFunc_1, stackTop, CLONE_VM, NULL);
+ if (pid == -1)
+ printf("clone failed\n");
+
+ printf("clone() returned %jd\n", (intmax_t) pid);
+
+ return 0;
+}
+
+/* case 2 */
+static volatile int flag_2 = 0;
+static int /* start function for cloned child */
+childFunc_2(void *arg)
+{
+ while(!flag_2) {}
+
+ sleep(5);
+
+ printf("child finished\n");
+}
+
+int testcase2(void)
+{
+ char *stack; /* start of stack buffer */
+ char *stacktop; /* end of stack buffer */
+ pid_t pid;
+ int ret = 0;
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, 1);
+ if (ret != 1) {
+ printf("Add group [1] failed, ret is %d\n", ret);
+ return -1;
+ }
+
+ /* allocate memory to be used for the stack of the child. */
+ stack = mmap(NULL, STACK_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0);
+ stacktop = stack + STACK_SIZE; /* assume stack grows downward */
+
+ pid = clone(childFunc_2, stacktop, CLONE_VM, NULL);
+ if (pid == -1)
+ printf("clone failed\n");
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, 2);
+ if (ret != 2) {
+ printf("Add group [2] failed, ret is %d\n", ret);
+ return -1;
+ }
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, 3);
+ if (ret != 3) {
+ printf("Add group [3] failed, ret is %d\n", ret);
+ return -1;
+ }
+
+ printf("clone() returned %jd\n", (intmax_t) pid);
+
+ flag_2 = 1;
+ printf("parent finished\n");
+
+ return 0;
+}
+
+/* case 3 */
+static volatile int flag_3 = 0;
+static int /* start function for cloned child */
+childFunc_3(void *arg)
+{
+ int ret = 0;
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, 2);
+ if (ret == 2) {
+ printf("add group [2] should failed, ret is %d\n", ret);
+ return -1;
+ }
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, 3);
+ if (ret == 3) {
+ printf("add group [3] should failed, ret is %d\n", ret);
+ return -1;
+ }
+
+ flag_3 = 1;
+
+ printf("child finished\n");
+}
+
+int testcase3(void)
+{
+ char *stack; /* start of stack buffer */
+ char *stacktop; /* end of stack buffer */
+ pid_t pid;
+ int ret;
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, 1);
+ if (ret != 1) {
+ printf("Add group [1] failed, ret is %d\n", ret);
+ return -1;
+ }
+
+ /* allocate memory to be used for the stack of the child. */
+ stack = mmap(NULL, STACK_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0);
+ stacktop = stack + STACK_SIZE; /* assume stack grows downward */
+
+ pid = clone(childFunc_3, stacktop, CLONE_VM, NULL);
+ if (pid == -1)
+ printf("clone failed\n");
+
+ printf("clone() returned %jd\n", (intmax_t) pid);
+
+ while(!flag_3) {}
+
+ sleep(5);
+
+ printf("parent finished\n");
+
+ return 0;
+}
+
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "进程添加组后, 进程clone(CLONE_VM)创建子进程，父子进程可以正常退出")
+ TESTCASE_CHILD(testcase2, "进程添加组后，进程clone(CLONE_VM)创建子进程，父进程退出后，子进程添加多组，子进程可以正常退出")
+ TESTCASE_CHILD(testcase3, "进程添加组后，进程clone(CLONE_VM)创建子进程，子进程退出后，父进程添加多组，父进程可以正常退出")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
+
diff --git a/tools/testing/sharepool/testcase/dts_bugfix_test/test_08_addr_offset.c b/tools/testing/sharepool/testcase/dts_bugfix_test/test_08_addr_offset.c
new file mode 100644
index 000000000000..cd19273fd058
--- /dev/null
+++ b/tools/testing/sharepool/testcase/dts_bugfix_test/test_08_addr_offset.c
@@ -0,0 +1,156 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 14 16:47:36 2020
+ */
+#include <stdio.h>
+#include <sys/ioctl.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+
+#include "sharepool_lib.h"
+
+#define ALIGN_UP(x, align_to) (((x) + ((align_to)-1)) & ~((align_to)-1))
+#define CMD_LEN 100
+#define UNIT 1024
+#define PAGE_NUM 1
+#define HGPAGE_NUM 10
+#define LARGE_PAGE_NUM 1000000
+#define ATOMIC_TEST_SIZE (1024UL * 1024UL * 1024UL) // 1G
+#define SPG_ID_AUTO 200000
+#define DAVINCI_IOCTL_VA_TO_PA 0xfff9
+#define DVPP_START (0x100000000000UL)
+#define DVPP_SIZE 0x400000000UL
+
+
+static int addgroup(void)
+{
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = SPG_ID_AUTO,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ } else {
+ ret = ag_info.spg_id;
+ }
+ return ret;
+}
+
+static int cleanup(struct sp_alloc_info *alloc_info)
+{
+ int ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_free failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static int testcase1(void)
+{
+ int ret;
+ int fd;
+ long err;
+ unsigned long phys_addr;
+ int spg_id = 0;
+
+ spg_id = addgroup();
+ if (spg_id <= 0) {
+ pr_info("spgid <= 0, value: %d", spg_id);
+ return -1;
+ } else {
+ pr_info("spg id %d", spg_id);
+ }
+
+ struct sp_config_dvpp_range_info cdr_info = {
+ .start = DVPP_START,
+ .size = DVPP_SIZE,
+ .device_id = 0,
+ .pid = getpid(),
+ };
+ ret = ioctl_config_dvpp_range(dev_fd, &cdr_info);
+ if (ret < 0) {
+ pr_info("dvpp config failed. errno: %d", errno);
+ return ret;
+ } else
+ pr_info("dvpp config success.");
+
+ struct sp_alloc_info alloc_infos[] = {
+ {
+ .flag = 1, // 普通大页
+ .size = PAGE_NUM * PMD_SIZE,
+ .spg_id = spg_id,
+ },
+ {
+ .flag = 1, // 普通大页
+ .size = PAGE_NUM * PMD_SIZE,
+ .spg_id = spg_id,
+ },
+ {
+ .flag = 5, // DVPP大页
+ .size = PAGE_NUM * PMD_SIZE,
+ .spg_id = spg_id,
+ },
+ {
+ .flag = 1, // 普通大页
+ .size = PAGE_NUM * PMD_SIZE,
+ .spg_id = spg_id,
+ },
+ {
+ .flag = 5, // DVPP大页
+ .size = PAGE_NUM * PMD_SIZE,
+ .spg_id = spg_id,
+ },
+ };
+
+ for (int i = 0; i < sizeof(alloc_infos) / sizeof(alloc_infos[0]); i++) {
+ ret = ioctl_alloc(dev_fd, &alloc_infos[i]);
+ if (ret != 0) {
+ pr_info("testcase1 ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ pr_info("alloc success, type: %s, va: %lx",
+ alloc_infos[i].flag == 5 ? "SP_DVPP" : "NORMAL",
+ alloc_infos[i].addr);
+ }
+
+ ret = memset((void *)(alloc_infos[2].addr), 'b', alloc_infos[2].size);
+ ret = memset((void *)(alloc_infos[0].addr), 'a', alloc_infos[0].size);
+ if (ret < 0)
+ pr_info("memset failed");
+ char *p;
+ p = (char *)(alloc_infos[2].addr);
+ if (*p != 'a') {
+ pr_info("pa not same. char: %c", *p);
+ ret = 0;
+ }else {
+ pr_info("pa same. char: %c", *p);
+ ret = -1;
+ }
+ for (int i = 0; i < sizeof(alloc_infos) / sizeof(alloc_infos[0]); i++)
+ cleanup(&alloc_infos[i]);
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "测试dvpp文件地址与普通alloc文件地址不重叠")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/dts_bugfix_test/test_09_spg_del_exit.c b/tools/testing/sharepool/testcase/dts_bugfix_test/test_09_spg_del_exit.c
new file mode 100644
index 000000000000..73b3d07992e9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/dts_bugfix_test/test_09_spg_del_exit.c
@@ -0,0 +1,150 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include "sharepool_lib.h"
+#include "sem_use.h"
+
+#define GROUP_ID 1
+#define ALLOC_SIZE (4096UL)
+#define TEST_SIZE 10
+#define MAX_RETRY 10
+#define REPEAT 30000
+#define PROT (PROT_READ | PROT_WRITE)
+int semid_add, semid_exit, semid_create;
+int sem1, sem2;
+
+static int fault_verify(void)
+{
+ int ret;
+ int test_pid[TEST_SIZE];
+ int pid;
+
+ ret = wrap_sp_alloc(GROUP_ID, ALLOC_SIZE, 0);
+ if (ret < 0) {
+ printf("fault verify --- alloc failed.\n");
+ }
+
+ for (int i = 0; i < TEST_SIZE; i++) {
+ pid = fork();
+ if (pid == 0) {
+ exit(wrap_add_group(getpid(), PROT, GROUP_ID));
+ }
+ }
+
+ printf("fault is verified!\n");
+ return 0;
+}
+
+static int child_process(int semid)
+{
+ int ret = 0;
+ int spg_id = 0;
+ int retry_time = 0;
+
+ printf("process %d created.\n", getpid());
+
+ while (1) {
+ sem_dec_by_one(semid);
+retry:
+ ret = wrap_add_group(getpid(), PROT, GROUP_ID);
+ if (errno == ENODEV || errno == ENOSPC) {
+ printf("process %d add group failed once, retry...\n", getpid());
+ errno = 0;
+ if (retry_time++ < MAX_RETRY)
+ goto retry;
+ }
+
+ retry_time = 0;
+ if (ret < 0) {
+ printf("process %d add group unexpected error, ret is %d\n",
+ getpid(), ret);
+ sem_dec_by_one(semid);
+ return -1;
+ }
+ printf("process %d add group%d success!\n", getpid(), GROUP_ID);
+
+ errno = 0;
+ spg_id = ioctl_find_first_group(dev_fd, getpid());
+ if (spg_id < 0 && errno == ENODEV) {
+ printf("fault is found.\n");
+ ret = fault_verify();
+ sem_dec_by_one(semid);
+ return -1;
+ }
+ if (spg_id != GROUP_ID) {
+ printf("unexpected find group fault %d\n", spg_id);
+ return -1;
+ }
+
+ sem_dec_by_one(semid);
+ ret = wrap_del_from_group(getpid(), GROUP_ID);
+ if (ret < 0)
+ pr_info("del failed!");
+ else
+ pr_info("process %d del from group%d success!", getpid(), GROUP_ID);
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+ int ret = 0;
+ int status;
+ int sem;
+ pid_t first, second;
+
+ semid_add = sem_create(2234, "spg not alive test add group");
+ semid_exit = sem_create(3234, "spg not alive test exit group");
+ semid_create = sem_create(4234, "create");
+
+ sem1 = sem_create(1234, "sem lock for first process");
+ sem2 = sem_create(4321, "sem lock for second process");
+
+ sem_inc_by_one(sem1);
+ first = fork();
+ if (first < 0)
+ goto close_sem;
+ else if (first == 0)
+ exit(child_process(sem1));
+ sem_check_zero(sem1);
+
+ second = fork();
+ if (second < 0)
+ goto close_sem;
+ else if (second == 0)
+ exit(child_process(sem2));
+ sem_check_zero(sem2);
+
+ for (int i = 0; i < REPEAT; i++) {
+ sem_inc_by_one(sem1); // 1退组
+ sem_inc_by_one(sem2); // 2加组
+
+ sem_check_zero(sem1); // 1加组
+ sem_check_zero(sem2); // 2退组
+ }
+
+end:
+ kill(first, SIGKILL);
+ kill(second, SIGKILL);
+close_sem:
+ sem_close(sem1);
+ sem_close(sem2);
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE(testcase1, "加组和退组并发")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/dts_bugfix_test/test_10_walk_page_range_AA_lock.c b/tools/testing/sharepool/testcase/dts_bugfix_test/test_10_walk_page_range_AA_lock.c
new file mode 100644
index 000000000000..db70e7cf6718
--- /dev/null
+++ b/tools/testing/sharepool/testcase/dts_bugfix_test/test_10_walk_page_range_AA_lock.c
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2023. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri May 19 16:06:03 2023
+ */
+#include <sys/ioctl.h>
+#include <sys/syscall.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+#include "sharepool_lib.h"
+
+#define TEST_SIZE 0x200000
+#define NUM 200
+
+/*
+ * sharepool 升级适配的5.10的时候引入一个bug，mg_sp_walk_page_range遍历的内存正在
+ * 发生页迁移的时候触发 AA死锁，重复拿页表的锁；
+ */
+static int case1()
+{
+ int err = 0;
+ int i, count = NUM;
+ unsigned long *addr[NUM] = {0};
+
+ for (i = 0; i < count; i++) {
+ addr[i] = wrap_sp_alloc(SPG_ID_DEFAULT, TEST_SIZE, 0);
+ if (addr[i] == (void *)-1) {
+ printf("ioctl alloc failed, %s.\n", strerror(errno));
+ count = i;
+ err = -1;
+ goto out;
+ }
+ }
+ printf("memory allocation done.\n");
+
+ // 先释放一半内存，更容易构造碎片化场景，增加页迁移概率
+ for (i = 0; i < count; i += 2) {
+ wrap_sp_free(addr[i]);
+ addr[i] = NULL;
+ }
+
+ for (i = 0; i < count; i++) {
+ if (!addr[i])
+ continue;
+
+ struct sp_walk_page_range_info wpr_info = {
+ .uva = addr[i],
+ .size = TEST_SIZE,
+ };
+ err = ioctl_walk_page_range(dev_fd, &wpr_info);
+ if (err < 0) {
+ pr_info("ioctl_walk_page_range failed,XXXXXXX errno: %d", errno);
+ err = -1;
+ goto out;
+ }
+
+ ioctl_walk_page_free(dev_fd, &wpr_info);
+ }
+ printf("walk_page_reange done\n");
+
+out:
+ for (i = 0; i < count; i++) {
+ if (addr[i])
+ wrap_sp_free(addr[i]);
+ }
+ printf("memory free done.\n");
+
+ return err;
+}
+
+static int case1_child(void)
+{
+ int i = 1;
+
+ while (1) {
+ printf("memory compact start: %d\n", i++);
+ system("echo 1 > /proc/sys/vm/compact_memory");
+ sleep(1);
+ }
+
+ return 0;
+}
+
+static int testcase1()
+{
+ int ret = 0;
+ pid_t pid;
+
+ FORK_CHILD_ARGS(pid, case1_child());
+
+ for (int i = 0; i < 100; i++) {
+ printf("loop count: %d\n", i);
+ ret = case1();
+ if (ret < 0)
+ break;
+ }
+
+ KILL_CHILD(pid);
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "申请内存，mg_sp_walk_page_range， 释放内存，循环跑，并且后台执行内存规整")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/dts_bugfix_test/test_dvpp_readonly.c b/tools/testing/sharepool/testcase/dts_bugfix_test/test_dvpp_readonly.c
new file mode 100644
index 000000000000..02d3161fb506
--- /dev/null
+++ b/tools/testing/sharepool/testcase/dts_bugfix_test/test_dvpp_readonly.c
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Nov 20 01:38:40 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+static int testcase1(void)
+{
+ int ret = 0;
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = SP_PROT_RO,
+ .size = 40960,
+ .spg_id = 1,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret != 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+
+ ret = mprotect(alloc_info.addr, 40960, PROT_WRITE);
+ if (ret) {
+ pr_info("mprotect failed, %d, %d\n", ret, errno);
+ return ret;
+ }
+ memset(alloc_info.addr, 0, alloc_info.size);
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE(testcase1, true)
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/function_test/Makefile b/tools/testing/sharepool/testcase/function_test/Makefile
new file mode 100644
index 000000000000..0d4d24db842a
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/Makefile
@@ -0,0 +1,36 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+dvpp?=true
+
+ifeq ($(dvpp),true)
+ testcases:=test_two_user_process \
+ test_dvpp_pass_through \
+ test_u2k test_k2u \
+ test_alloc_free_two_process \
+ test_mm_mapped_to_multi_groups \
+ test_sp_ro \
+ test_alloc_readonly \
+ test_dvpp_multi_16G_alloc \
+ test_dvpp_readonly \
+ test_dvpp_multi_16G_k2task \
+ test_non_dvpp_group \
+ test_hugetlb_alloc_hugepage
+else
+ testcases:=test_two_user_process \
+ test_dvpp_pass_through \
+ test_u2k test_k2u \
+ test_alloc_free_two_process \
+ test_mm_mapped_to_multi_groups \
+ test_sp_ro
+endif
+
+default: $(testcases)
+
+install:
+ mkdir -p $(TOOL_BIN_DIR)/function_test
+ cp $(testcases) $(TOOL_BIN_DIR)/function_test
+ cp function_test.sh $(TOOL_BIN_DIR)
+
+clean:
+ rm -rf $(testcases)
+
diff --git a/tools/testing/sharepool/testcase/function_test/function_test.sh b/tools/testing/sharepool/testcase/function_test/function_test.sh
new file mode 100755
index 000000000000..dc49a9cb2e0b
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/function_test.sh
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+for line in test_two_user_process \
+ test_alloc_free_two_process \
+ test_mm_mapped_to_multi_groups \
+ test_alloc_readonly \
+ test_dvpp_pass_through \
+ test_u2k \
+ test_k2u \
+ test_dvpp_multi_16G_alloc \
+ test_dvpp_multi_16G_k2task \
+ test_non_dvpp_group \
+ test_dvpp_readonly
+do
+ ./function_test/$line
+ if [ $? -ne 0 ] ;then
+ echo "testcase function_test/$line failed"
+ exit 1
+ fi
+ cat /proc/meminfo
+ free -m
+done
+
+#echo 100 > /proc/sys/vm/nr_hugepages
+#line=test_hugetlb_alloc_hugepage
+#./function_test/$line
+#if [ $? -ne 0 ] ;then
+# echo "testcase function_test/$line failed"
+# echo 0 > /proc/sys/vm/nr_hugepages
+# exit 1
+#fi
+#echo 0 > /proc/sys/vm/nr_hugepages
diff --git a/tools/testing/sharepool/testcase/function_test/test_alloc_free_two_process.c b/tools/testing/sharepool/testcase/function_test/test_alloc_free_two_process.c
new file mode 100644
index 000000000000..263821bee137
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/test_alloc_free_two_process.c
@@ -0,0 +1,303 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 11 07:12:29 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 两个组，每组两个进程，同时多次申请释放内存
+ *
+ * 用信号量进行同步，进程创建完成后先睡眠
+ */
+
+#define NR_GROUP 100
+#define MAX_PROC_PER_GRP 100
+
+static int group_num = 2;
+static int process_per_group = 3;
+static int alloc_num = 1000;
+static size_t alloc_size = 4 * PAGE_SIZE;
+
+static int grandchild_process(int arg, sem_t *child_sync, sem_t *grandchild_sync)
+{
+#define pr_local_info(fmt, args...) printf("[grandchild%d, pid:%d] " fmt "\n", arg, getpid(), ##args)
+ int ret;
+
+ struct sp_alloc_info *alloc_infos = malloc(sizeof(*alloc_infos) * alloc_num);
+ if (!alloc_infos) {
+ pr_local_info("malloc failed");
+ return -1;
+ }
+
+ /* 等待父进程加组 */
+ do {
+ ret = sem_wait(child_sync);
+ } while ((ret != 0) && errno == EINTR);
+
+ sleep(1); // it seems sem_wait doesn't work as expected
+ pr_local_info("start!!, ret is %d, errno is %d", ret, errno);
+
+ int group_id = ioctl_find_first_group(dev_fd, getpid());
+ if (group_id < 0) {
+ pr_local_info("ioctl_find_group_by_pid failed, %d", group_id);
+ goto error_out;
+ }
+
+ for (int i = 0; i < alloc_num; i++) {
+ (alloc_infos + i)->flag = 0,
+ (alloc_infos + i)->spg_id = group_id,
+ (alloc_infos + i)->size = alloc_size,
+ /* sp_alloc */
+ ret = ioctl_alloc(dev_fd, alloc_infos + i);
+ if (ret < 0) {
+ pr_local_info("ioctl alloc failed\n");
+ goto error_out;
+ } else {
+ if (IS_ERR_VALUE(alloc_infos[i].addr)) {
+ pr_local_info("sp_alloc return err is %ld\n", alloc_infos[i].addr);
+ goto error_out;
+ }
+ }
+
+ memset((void *)alloc_infos[i].addr, 'z', alloc_infos[i].size);
+ }
+
+ sem_post(grandchild_sync);
+ do {
+ ret = sem_wait(child_sync);
+ } while (ret < 0 && errno == EINTR);
+
+ for (int i = 0; i < alloc_num; i++) {
+ ret = ioctl_free(dev_fd, alloc_infos + i);
+ if (ret < 0) {
+ pr_local_info("ioctl free failed, errno: %d", errno);
+ goto error_out;
+ }
+ }
+ sem_post(grandchild_sync);
+ free(alloc_infos);
+ pr_local_info("exit!!");
+ return 0;
+
+error_out:
+ sem_post(grandchild_sync);
+ free(alloc_infos);
+ return -1;
+#undef pr_local_info
+}
+
+static int child_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[child%d , pid:%d] " fmt "\n", arg, getpid(), ##args)
+ pr_local_info("start!!");
+
+ int ret, status = 0;
+ int group_id = arg + 100;
+ pid_t childs[MAX_PROC_PER_GRP] = {0};
+ sem_t *child_sync[MAX_PROC_PER_GRP] = {0};
+ sem_t *grandchild_sync[MAX_PROC_PER_GRP] = {0};
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0)
+ return -1;
+
+ // create syncs for grandchilds
+ for (int i = 0; i < process_per_group; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_grandchild_sync%d", i);
+ grandchild_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (grandchild_sync[i] == SEM_FAILED) {
+ pr_local_info("grandchild sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ // create syncs for childs
+ for (int i = 0; i < process_per_group; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_child_sync%d", i);
+ child_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (child_sync[i] == SEM_FAILED) {
+ pr_local_info("child sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ // 创建子进程并将之加组
+ for (int i = 0; i < process_per_group; i++) {
+ int num = arg * MAX_PROC_PER_GRP + i;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(num, child_sync[i], grandchild_sync[i]);
+ exit(ret);
+ } else {
+ pr_local_info("fork grandchild%d, pid: %d", num, pid);
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", num, group_id);
+ goto error_out;
+ } else
+ pr_local_info("add grandchild%d to group %d successfully", num, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[i]);
+ }
+ }
+
+ for (int i = 0; i < process_per_group; i++)
+ do {
+ ret = sem_wait(grandchild_sync[i]);
+ } while (ret < 0 && errno == EINTR);
+
+ for (int i = 0; i < process_per_group; i++)
+ sem_post(child_sync[i]);
+ pr_local_info("grandchild-processes start to do sp_free");
+
+ for (int i = 0; i < process_per_group && childs[i] > 0; i++) {
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_local_info("grandchild%d test failed, %d", arg * MAX_PROC_PER_GRP + i, status);
+ ret = -1;
+ }
+ }
+ pr_local_info("exit!!");
+ return ret;
+
+error_out:
+ for (int i = 0; i < process_per_group && childs[i] > 0; i++) {
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], NULL, 0);
+ };
+ pr_local_info("exit!!");
+ return -1;
+#undef pr_local_info
+}
+
+static void print_help()
+{
+ printf("Usage:\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "p:g:n:s:")) != -1) {
+ switch (opt) {
+ case 'p': // 每组进程数
+ process_per_group = atoi(optarg);
+ if (process_per_group > MAX_PROC_PER_GRP || process_per_group <= 0) {
+ printf("process number invalid\n");
+ return -1;
+ }
+ break;
+ case 'g': // group 数量
+ group_num = atoi(optarg);
+ if (group_num > NR_GROUP || group_num <= 0) {
+ printf("group number invalid\n");
+ return -1;
+ }
+ break;
+ case 'n': // 内存申请次数
+ alloc_num = atoi(optarg);
+ if (alloc_num > 100000 || alloc_num <= 0) {
+ printf("alloc number invalid\n");
+ return -1;
+ }
+ break;
+ case 's':
+ alloc_size = atol(optarg);
+ if (alloc_size <= 0) {
+ printf("alloc size invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+#define pr_local_info(fmt, args...) printf("[parent , pid:%d] " fmt "\n", getpid(), ##args)
+
+ int ret = 0;
+ int status = 0;
+ pid_t childs[NR_GROUP];
+
+ pr_local_info("group: %d, process_per_group: %d", group_num, process_per_group);
+
+ for (int i = 0; i < group_num; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed, error %d", pid);
+ exit(-1);
+ } else if (pid == 0) {
+ ret = child_process(i);
+ exit(ret);
+ } else {
+ childs[i] = pid;
+
+ pr_local_info("fork child%d, pid: %d", i, pid);
+ }
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_local_info("child%d test failed, %d", i, status);
+ ret = -1;
+ }
+ }
+
+ pr_local_info("exit!!");
+
+ return ret;
+#undef pr_local_info
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "两个组每组两个进程，同时申请释放内存，简单验证")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/function_test/test_alloc_readonly.c b/tools/testing/sharepool/testcase/function_test/test_alloc_readonly.c
new file mode 100644
index 000000000000..3278cbbb2a0e
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/test_alloc_readonly.c
@@ -0,0 +1,588 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Nov 23 02:17:32 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/shm.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include <pthread.h>
+#include "sharepool_lib.h"
+
+#define GROUP_ID 1
+
+static bool is_addr_ro_range(unsigned long addr)
+{
+ return addr >= MMAP_SHARE_POOL_RO_START && addr < MMAP_SHARE_POOL_DVPP_START;
+}
+
+static jmp_buf sigsegv_env;
+static void sigsegv_handler(int num)
+{
+ pr_info("SIGSEGV 11 received.");
+ longjmp(sigsegv_env, 1);
+}
+
+static unsigned long alloc_readonly(int spg_id, unsigned long size, unsigned long flag)
+{
+ unsigned long va;
+ unsigned sp_flag = flag | SP_PROT_FOCUS | SP_PROT_RO;
+ void *addr = wrap_sp_alloc(spg_id, size, sp_flag);
+ if (addr == (void *)-1) {
+ pr_info("alloc read only memory failed, size %lx, flag %lx",
+ size, sp_flag);
+ return -1;
+ }
+
+ va = (unsigned long)addr;
+ if (!is_addr_ro_range(va)) {
+ pr_info("address not in read only range. %lx", va);
+ return -1;
+ }
+
+ return va;
+}
+
+int GROUP_TYPE[] = {
+ 1,
+ SPG_ID_AUTO,
+ SPG_ID_DEFAULT,
+};
+
+bool ALLOC_FLAG[] = {
+ false,
+ true,
+};
+
+unsigned long ALLOC_TYPE[] = {
+ SP_PROT_FOCUS | SP_PROT_RO,
+ 0,
+ SP_DVPP,
+};
+
+static int test(int spg_id, bool is_hugepage)
+{
+ int ret = 0;
+ unsigned long sp_flag = 0;
+ unsigned long size = PMD_SIZE;
+ void *addr;
+ char *caddr;
+ unsigned long uva, kva;
+ struct sigaction sa = {0};
+ sa.sa_handler = sigsegv_handler;
+ sa.sa_flags |= SA_NODEFER;
+ sigaction(SIGSEGV, &sa, NULL);
+
+ /* 申请只读内存 */
+ sp_flag |= SP_PROT_FOCUS;
+ sp_flag |= SP_PROT_RO;
+ if (is_hugepage)
+ sp_flag |= SP_HUGEPAGE;
+ pr_info("sp_flag: %lx, group_id:%d", sp_flag, spg_id);
+
+ addr = wrap_sp_alloc(spg_id, size, sp_flag);
+ if ((unsigned long)addr == -1) {
+ pr_info("alloc readonly memory failed, errno %d", errno);
+ return ret;
+ }
+
+ /* 是否在只读区间范围内 */
+ pr_info("address is %lx", addr);
+ if (!is_addr_ro_range((unsigned long)addr)) {
+ pr_info("address not in read only range.");
+ return -1;
+ }
+
+ /* 尝试直接读，预期不太清楚 有可能收到SIGSEGV */
+ caddr = (char *)addr;
+ ret = setjmp(sigsegv_env);
+ if (!ret) {
+ pr_info("value at addr[0] is %d", (int)caddr[0]);
+ pr_info("read success expected.");
+ }
+
+ /* 尝试写，预期收到signal11 SIGSEGV */
+ ret = setjmp(sigsegv_env);
+ if (!ret) {
+ memset(caddr, 'A', size);
+ pr_info("memset success unexpected.");
+ return -1;
+ }
+ pr_info("memset failed expected.");
+
+ /* u2k 然后让内核写 */
+ uva = (unsigned long)addr;
+ kva = wrap_u2k(uva, size);
+ if (!kva) {
+ pr_info("u2k failed, errno %d", errno);
+ return -1;
+ }
+ KAREA_ACCESS_SET('A', kva, size, out);
+ pr_info("kernel write success");
+ KAREA_ACCESS_CHECK('A', kva, size, out);
+ pr_info("kernel read success");
+
+ /* 用户进程再尝试读 */
+ for( int i = 0; i < size; i++) {
+ if (caddr[i] != 'A') {
+ pr_info("caddr[%d] is %c, not %c", i, caddr[i], 'A');
+ return -1;
+ }
+ }
+ pr_info("user read success");
+
+ /* 再尝试写，预期收到signal11 SIGSEGV */
+ sigaction(SIGSEGV, &sa, NULL);
+ ret = setjmp(sigsegv_env);
+ if (!ret) {
+ memset(caddr, 'A', size);
+ pr_info("memset success unexpected.");
+ return -1;
+ }
+ pr_info("memset failed expected.");
+
+ /* 从内核unshare 该uva */
+ if (wrap_unshare(kva, size) < 0) {
+ pr_info("unshare failed");
+ return -1;
+ }
+
+ /* free uva*/
+ if (wrap_sp_free_by_id(uva, spg_id) < 0) {
+ pr_info("free failed");
+ return -1;
+ }
+ pr_info("free success");
+
+ return 0;
+out:
+ return ret;
+
+}
+
+static int testcase1(void)
+{
+ int i, j;
+
+ for (i = 0; i < sizeof(GROUP_TYPE) / sizeof(GROUP_TYPE[0]); i++) {
+ /* 读写权限加组 */
+ int group_id = GROUP_TYPE[i];
+ if (group_id != SPG_ID_DEFAULT) {
+ int ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, group_id);
+ if (ret < 0) {
+ pr_info("add group failed, errno %d", errno);
+ return ret;
+ }
+ group_id = ret;
+ }
+
+ for (j = 0; j < sizeof(ALLOC_FLAG) / sizeof(ALLOC_FLAG[0]); j++)
+ if (test(group_id, ALLOC_FLAG[j]))
+ goto out;
+ }
+
+ return 0;
+out:
+ pr_info("test failed for group id %d type %s",
+ GROUP_TYPE[i], ALLOC_FLAG[i] & SP_HUGEPAGE ? "hugepage" : "normal page");
+ return -1;
+}
+
+#define PROC_NUM 10
+static unsigned long UVA[2];
+static int tc2_child(int idx)
+{
+ int ret = 0;
+ unsigned long size = 10 * PMD_SIZE;
+ struct sigaction sa = {0};
+ sa.sa_handler = sigsegv_handler;
+ sa.sa_flags |= SA_NODEFER;
+ sigaction(SIGSEGV, &sa, NULL);
+
+ /* 子进程加组 */
+ if (wrap_add_group(getpid(), PROT_READ | PROT_WRITE, GROUP_ID) < 0)
+ return -1;
+
+ /* 尝试写内存 */
+ for (int i = 0; i < sizeof(UVA) / sizeof(UVA[0]); i++) {
+ ret = setjmp(sigsegv_env);
+ if(!ret) {
+ memset(UVA[i], 'A', size);
+ pr_info("child process write success unexpected");
+ return -1;
+ }
+ pr_info("child process %d write %s failed expected.",
+ idx, ALLOC_FLAG[i] & SP_HUGEPAGE ? "huge page" : "normal page");
+ }
+
+ return 0;
+}
+static int testcase2(void)
+{
+ int ret = 0;
+ unsigned long size = 10 * PMD_SIZE;
+ unsigned long uva;
+ pid_t child[PROC_NUM];
+
+ if (wrap_add_group(getpid(), PROT_READ | PROT_WRITE, GROUP_ID) < 0)
+ return -1;
+
+ /* 申请内存 小页/大页/dvpp */
+ for (int i = 0; i < sizeof(ALLOC_FLAG) / sizeof(ALLOC_FLAG[0]); i++) {
+ uva = alloc_readonly(GROUP_ID, size, ALLOC_FLAG[i]);
+ if (uva == -1) {
+ pr_info("alloc uva size %lx, flag %lx failed", size, ALLOC_FLAG[i]);
+ return -1;
+ }
+ UVA[i] = uva;
+ }
+
+ /* fork 子进程加组 */
+ for (int i = 0; i < PROC_NUM; i++) {
+ FORK_CHILD_ARGS(child[i], tc2_child(i));
+ }
+
+ /* 回收子进程 */
+ for (int i = 0; i < PROC_NUM; i++) {
+ WAIT_CHILD_STATUS(child[i], out);
+ }
+
+ /* free 内存*/
+ for (int i = 0; i < sizeof(UVA) / sizeof(UVA[0]); i++) {
+ if(wrap_sp_free_by_id(UVA[i], GROUP_ID) < 0) {
+ pr_info("free uva[%d] failed", i);
+ return -1;
+ }
+ }
+
+ return 0;
+out:
+ return ret;
+}
+
+#define REPEAT 20
+
+static void *thread_alloc_rdonly(void *spg_id)
+{
+ unsigned long size = PMD_SIZE;
+ /* 申请只读内存小页/大页各2M，重复REPEAT次 */
+ for (int i = 0; i < REPEAT; i++) {
+ if (alloc_readonly(spg_id, size, 0) < 0 ||
+ alloc_readonly(spg_id, size, 1) < 0)
+ return (void *)-1;
+ if (i % 10 == 0)
+ pr_info("%dMB RDONLY memory allocated in group %d", i * 4, spg_id);
+ }
+ return (void *)0;
+}
+
+static void *thread_alloc_normal(void *spg_id)
+{
+ unsigned long size = PMD_SIZE;
+ /* 申请普通内存小页/大页各2M，重复REPEAT次 */
+ for (int i = 0; i < REPEAT; i++) {
+ if (wrap_sp_alloc(spg_id, size, 0) == (void *)-1 ||
+ wrap_sp_alloc(spg_id, size, 1) == (void *)-1)
+ return (void *)-1;
+ if (i % 10 == 0)
+ pr_info("%dMB memory allocated in group %d", i * 4, spg_id);
+ }
+ return (void *)0;
+}
+
+static void *thread_alloc_dvpp(void *spg_id)
+{
+ unsigned long size = PMD_SIZE;
+ /* 申请dvpp内存小页/大页各2M，重复REPEAT次 */
+ for (int i = 0; i < REPEAT; i++) {
+ if (wrap_sp_alloc(spg_id, size, SP_DVPP) == (void *)-1 ||
+ wrap_sp_alloc(spg_id, size, SP_DVPP | SP_HUGEPAGE) == (void *)-1)
+ return (void *)-1;
+ if (i % 10 == 0)
+ pr_info("%dMB dvpp memory allocated in group %d", i * 4, spg_id);
+ }
+ return (void *)0;
+}
+
+void * (*thread_func[]) (void *) = {
+ thread_alloc_rdonly,
+ thread_alloc_normal,
+ thread_alloc_dvpp,
+};
+static int testcase3(void)
+{
+ int ret = 0;
+ pthread_t threads[3];
+ void *pret;
+
+ if (wrap_add_group(getpid(), PROT_READ | PROT_WRITE, GROUP_ID) < 0)
+ return -1;
+
+ for (int i = 0; i < ARRAY_SIZE(thread_func); i++) {
+ pthread_create(threads + i, NULL, thread_func[i], (void *)GROUP_ID);
+ if (ret < 0) {
+ pr_info("pthread create failed.");
+ return -1;
+ }
+ }
+
+ for (int i = 0; i < ARRAY_SIZE(threads); i++) {
+ pthread_join(threads[i], &pret);
+ if (ret < 0) {
+ pr_info("pthread join failed.");
+ return -1;
+ }
+ if (pret == (void *)-1)
+ pr_info("thread %d failed", i);
+ }
+
+
+ pr_info("threads allocating different memory from group success!");
+
+ for (int i = 0; i < ARRAY_SIZE(thread_func); i++) {
+ pthread_create(threads + i, NULL, thread_func[i], (void *)0);
+ if (ret < 0) {
+ pr_info("pthread create failed.");
+ return -1;
+ }
+ }
+
+ for (int i = 0; i < ARRAY_SIZE(threads); i++) {
+ pthread_join(threads[i], &pret);
+ if (ret < 0) {
+ pr_info("pthread join failed.");
+ return -1;
+ }
+ if (pret == (void *)-1)
+ pr_info("thread %d failed", i);
+ }
+
+ pr_info("threads allocating different memory pass-through success!");
+
+ return 0;
+}
+
+static int testcase4(void)
+{
+ int ret = 0;
+ unsigned long size = 4UL * PMD_SIZE;
+ unsigned long va;
+ int count = 0;
+
+ if (wrap_add_group(getpid(), PROT_READ | PROT_WRITE, GROUP_ID) < 0)
+ return -1;
+
+ while (1) {
+ va = alloc_readonly(GROUP_ID, size, 0);
+ if (va == -1) {
+ pr_info("alloc 4M memory %dth time failed.", count + 1);
+ return -1;
+ }
+ count++;
+ if (count % 100 == 0)
+ pr_info("memory allocated %dMB", 8 * count);
+ }
+
+ return 0;
+}
+
+static int testcase5(void)
+{
+ int ret = 0;
+ unsigned long size = PMD_SIZE;
+ unsigned long sp_flag = SP_DVPP | SP_PROT_RO | SP_PROT_FOCUS;
+
+ if (wrap_add_group(getpid(), PROT_READ | PROT_WRITE, GROUP_ID) < 0)
+ return -1;
+
+ if (wrap_sp_alloc(GROUP_ID, PMD_SIZE, sp_flag) == (void *)-1) {
+ pr_info("alloc for dvpp readonly memory failed as expected");
+ } else {
+ pr_info("alloc for dvpp readonly memory success unexpected");
+ ret = -1;
+ }
+
+ return ret;
+}
+
+static int testcase6(void)
+{
+ int ret = 0;
+ unsigned long size = PMD_SIZE;
+ unsigned long sp_flag = SP_PROT_RO | SP_PROT_FOCUS;
+
+ if (wrap_add_group(getpid(), PROT_READ | PROT_WRITE, GROUP_ID) < 0)
+ return -1;
+
+ if (wrap_sp_alloc(GROUP_ID, PMD_SIZE, sp_flag) == (void *)-1) {
+ pr_info("alloc for dvpp readonly memory failed unexpected");
+ return -1;
+ }
+
+ sleep(1);
+ sharepool_print();
+
+ return ret;
+
+}
+
+#define RD_NUM 10
+#define WR_NUM 10
+static int testcase7(void)
+{
+ int ret = 0;
+ int spg_id = 1;
+ unsigned long sp_flag = 0;
+ unsigned long size = PMD_SIZE;
+ void *addr;
+ void *addr_rd[RD_NUM];
+ void *addr_wr[WR_NUM];
+ char *caddr;
+ int count = 0;
+ unsigned long uva, kva;
+ struct sigaction sa = {0};
+ bool is_hugepage = true;
+ pid_t pid;
+
+ sa.sa_handler = sigsegv_handler;
+ sa.sa_flags |= SA_NODEFER;
+ sigaction(SIGSEGV, &sa, NULL);
+
+ /* A进程读写权限加组 */
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, spg_id);
+ if (ret < 0) {
+ pr_info("add group failed, errno %d", errno);
+ return ret;
+ }
+
+ /* 申请只读内存 N个 */
+ sp_flag |= SP_PROT_FOCUS;
+ sp_flag |= SP_PROT_RO;
+ if (is_hugepage)
+ sp_flag |= SP_HUGEPAGE;
+ pr_info("sp_flag: %lx", sp_flag);
+
+ for (int i = 0; i < RD_NUM; i++) {
+ addr = wrap_sp_alloc(spg_id, size, sp_flag);
+ if ((unsigned long)addr == -1) {
+ pr_info("alloc readonly memory failed, errno %d", errno);
+ return ret;
+ }
+ /* 是否在只读区间范围内 */
+ pr_info("address is %lx", addr);
+ if (!is_addr_ro_range((unsigned long)addr)) {
+ pr_info("address not in read only range.");
+ return -1;
+ }
+ addr_rd[i] = addr;
+
+ caddr = (char *)addr;
+ /* 尝试写，预期收到signal11 SIGSEGV */
+ ret = setjmp(sigsegv_env);
+ if (!ret) {
+ memset(caddr, 'A', size);
+ pr_info("memset success unexpected.");
+ return -1;
+ }
+ pr_info("memset failed expected.");
+ }
+
+ /* 申请读写内存 N个 */
+ sp_flag = 0;
+ if (is_hugepage)
+ sp_flag |= SP_HUGEPAGE;
+ pr_info("sp_flag: %lx", sp_flag);
+
+ for (int i = 0; i < WR_NUM; i++) {
+ addr = wrap_sp_alloc(spg_id, size, sp_flag);
+ if ((unsigned long)addr == -1) {
+ pr_info("alloc wr memory failed, errno %d", errno);
+ return ret;
+ }
+ addr_wr[i] = addr;
+
+ /* 尝试写，预期成功 */
+ caddr = (char *)addr;
+ memset(caddr, 'Q', size);
+ }
+
+ /* B进程正常加组 */
+ pid = fork();
+ if (pid == 0) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, spg_id);
+ if (ret < 0) {
+ pr_info("add child to group failed");
+ exit(-1);
+ }
+
+ sigaction(SIGSEGV, &sa, NULL);
+
+ for (int i = 0; i < WR_NUM; i++) {
+ ret = setjmp(sigsegv_env);
+ if (!ret) {
+ memset(addr_rd[i], 'B', size);
+ pr_info("memset success unexpected.");
+ exit(-1);
+ }
+ pr_info("memset %d RD area failed expected.", i);
+ }
+
+ sharepool_print();
+
+ for (int i = 0; i < WR_NUM; i++) {
+ ret = setjmp(sigsegv_env);
+ if (!ret) {
+ pr_info("gonna memset addr 0x%lx", addr_wr[i]);
+ memset(addr_wr[i], 'B', size);
+ pr_info("memset %d WR area success expected.", i);
+ } else {
+ pr_info("memset %d WR area failed unexpected.", i);
+ exit(-1);
+ }
+ }
+
+ exit(0);
+ }
+
+ ret = 0;
+ WAIT_CHILD_STATUS(pid, out);
+
+out:
+ return ret;
+
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "进程以读写权限加组，申请只读内存，地址在预置地址空间范围内；u2k给内核，内核读写，预期成功；用户态进程再次读写，预期读成功，写失败.")
+ TESTCASE_CHILD(testcase2, "进程A加组并申请只读内存后，进程B以读写权限加组，并尝试读写这块内存，预期读成功，写失败。")
+ TESTCASE_CHILD(testcase3, "进程A循环申请只读内存，普通内存，dvpp内存，预期地址空间均相符")
+ TESTCASE_CHILD_MANUAL(testcase4, "进程A反复申请只读内存，直至地址空间耗尽")
+ TESTCASE_CHILD(testcase5, "尝试申请dvpp只读内存，预期失败")
+ TESTCASE_CHILD(testcase6, "申请只读内存并打印维测查看")
+ TESTCASE_CHILD(testcase7, "A进程加组，申请2块只读内存和2块读写内存；B进程加组，尝试写4块内存，预期前两块失败，后两块成功。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/function_test/test_dvpp_multi_16G_alloc.c b/tools/testing/sharepool/testcase/function_test/test_dvpp_multi_16G_alloc.c
new file mode 100644
index 000000000000..edc189df398c
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/test_dvpp_multi_16G_alloc.c
@@ -0,0 +1,690 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Nov 20 01:38:40 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+#define ALLOC_LOOP 10
+
+static int dvpp_alloc_group(int spg_id, unsigned long size, struct sp_alloc_info *array, int array_num)
+{
+ int i, ret;
+ for (i = 0; i < array_num; i++) {
+ array[i].flag = SP_DVPP;
+ array[i].spg_id = spg_id;
+ array[i].size = size;
+
+ ret = ioctl_alloc(dev_fd, &array[i]);
+ if (ret < 0) {
+ pr_info("alloc DVPP failed, errno: %d", errno);
+ return -1;
+ }
+ memset(array[i].addr, 0, array[i].size);
+ }
+}
+
+/*
+ * 测试流程:
+ * 1、用户态进程A加组
+ * 2、申请10次DVPP共享内存
+ * 3、申请10次DVPP直调内存
+ * 预期结果：
+ * 1、以上操作均成功；
+ * 2、申请的地址不重复；
+ */
+static int testcase_dvpp_multi_16G_01(void)
+{
+ int ret, i, spg_id = 996;
+ struct sp_alloc_info alloc_group_info[ALLOC_LOOP];
+ struct sp_alloc_info alloc_local_info[ALLOC_LOOP];
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = spg_id,
+ };
+
+ /* 1、用户态进程A加组 */
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group, ret: %d, errno: %d", ret, errno);
+ return -1;
+ }
+
+ /* 2、申请10次DVPP共享内存 */
+ dvpp_alloc_group(spg_id, 40960, alloc_group_info, ALLOC_LOOP);
+
+ /* 3、申请10次DVPP直调内存 */
+ dvpp_alloc_group(SPG_ID_DEFAULT, 40960, alloc_local_info, ALLOC_LOOP);
+
+ pr_info("Alloc DVPP memory\n");
+ sharepool_print();
+
+ for (i = 0; i < ALLOC_LOOP; i++) {
+ ret = ioctl_free(dev_fd, &alloc_group_info[i]);
+ if (ret < 0) {
+ pr_info("free group failed, errno: %d", errno);
+ return -1;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_local_info[i]);
+ if (ret < 0) {
+ pr_info("free local failed, errno: %d", errno);
+ return -1;
+ }
+ }
+ pr_info("Free DVPP memory\n");
+ sharepool_print();
+}
+
+static int child(sem_t *sync, sem_t *childsync)
+{
+ int i, ret;
+ struct sp_alloc_info alloc_group_info[ALLOC_LOOP];
+ struct sp_alloc_info alloc_local_info[ALLOC_LOOP];
+
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ /* 2、申请10次DVPP共享内存 */
+ dvpp_alloc_group(996, 40960, alloc_group_info, ALLOC_LOOP);
+
+ /* 3、申请10次DVPP直调内存 */
+ dvpp_alloc_group(SPG_ID_DEFAULT, 40960, alloc_local_info, ALLOC_LOOP);
+
+ sem_post(childsync);
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ for (i = 0; i < ALLOC_LOOP; i++) {
+ ret = ioctl_free(dev_fd, &alloc_group_info[i]);
+ if (ret < 0) {
+ pr_info("free group failed, errno: %d", errno);
+ sem_post(sync);
+ break;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_local_info[i]);
+ if (ret < 0) {
+ pr_info("free local failed, errno: %d", errno);
+ sem_post(sync);
+ break;
+ }
+ }
+
+ sem_post(childsync);
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+}
+
+/*
+ * 测试流程:
+ * 1、用户态进程A/B加入相同组，分别执行下面两个动作；
+ * 2、申请10次DVPP共享内存
+ * 3、申请10次DVPP直调内存
+ * 预期结果：
+ * 1、以上操作均成功；
+ * 2、申请的地址不重复；
+ */
+static int testcase_dvpp_multi_16G_02(void)
+{
+ int ret, status, i, spg_id = 996;
+ struct sp_alloc_info alloc_group_info[ALLOC_LOOP];
+ struct sp_alloc_info alloc_local_info[ALLOC_LOOP];
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = spg_id,
+ };
+
+ char *sync_name = "/dvpp_pass_through";
+ sem_t *sync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name);
+
+ char *childsync_name = "/dvpp_pass_through_child";
+ sem_t *childsync = sem_open(childsync_name, O_CREAT, O_RDWR, 0);
+ if (childsync == SEM_FAILED) {
+ pr_info("sem_open child failed");
+ return -1;
+ }
+ sem_unlink(childsync_name);
+
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(child(sync, childsync));
+ }
+
+ /* 1、用户态进程A/B加相同组 */
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group, ret: %d, errno: %d", ret, errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group child, ret: %d, errno: %d", ret, errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ /* 2、申请10次DVPP共享内存 */
+ dvpp_alloc_group(spg_id, 40960, alloc_group_info, ALLOC_LOOP);
+
+ /* 3、申请10次DVPP直调内存 */
+ dvpp_alloc_group(SPG_ID_DEFAULT, 40960, alloc_local_info, ALLOC_LOOP);
+
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+
+ pr_info("Alloc DVPP memory\n");
+ sharepool_print();
+
+ for (i = 0; i < ALLOC_LOOP; i++) {
+ ret = ioctl_free(dev_fd, &alloc_group_info[i]);
+ if (ret < 0) {
+ pr_info("free group failed, errno: %d", errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_local_info[i]);
+ if (ret < 0) {
+ pr_info("free local failed, errno: %d", errno);
+ sem_post(sync);
+ goto out;
+ }
+ }
+
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+ pr_info("Free DVPP memory\n");
+ sharepool_print();
+ sem_post(sync);
+out:
+ status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status))
+ ret = -1;
+
+ return ret;
+}
+
+/*
+ * 测试流程:
+ * 1、用户态进程A/B加入不同组，分别执行下面两个动作；
+ * 2、申请10次DVPP共享内存
+ * 3、申请10次DVPP直调内存
+ * 预期结果：
+ * 1、以上操作均成功；
+ * 2、申请的地址不重复；
+ */
+static int testcase_dvpp_multi_16G_03(void)
+{
+ int ret, status, i, spg_id = 9116;
+ struct sp_alloc_info alloc_group_info[ALLOC_LOOP];
+ struct sp_alloc_info alloc_local_info[ALLOC_LOOP];
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = spg_id,
+ };
+
+ char *sync_name = "/dvpp_pass_through";
+ sem_t *sync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name);
+
+ char *childsync_name = "/dvpp_pass_through_child";
+ sem_t *childsync = sem_open(childsync_name, O_CREAT, O_RDWR, 0);
+ if (childsync == SEM_FAILED) {
+ pr_info("sem_open child failed");
+ return -1;
+ }
+ sem_unlink(childsync_name);
+
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(child(sync, childsync));
+ }
+
+ /* 1、用户态进程A/B加相同组 */
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group, ret: %d, errno: %d", ret, errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ ag_info.pid = pid;
+ ag_info.spg_id = 996;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group child, ret: %d, errno: %d", ret, errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ /* 2、申请10次DVPP共享内存 */
+ dvpp_alloc_group(spg_id, 40960, alloc_group_info, ALLOC_LOOP);
+
+ /* 3、申请10次DVPP直调内存 */
+ dvpp_alloc_group(SPG_ID_DEFAULT, 40960, alloc_local_info, ALLOC_LOOP);
+
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+
+ pr_info("Alloc DVPP memory\n");
+ sharepool_print();
+
+ for (i = 0; i < ALLOC_LOOP; i++) {
+ ret = ioctl_free(dev_fd, &alloc_group_info[i]);
+ if (ret < 0) {
+ pr_info("free group failed, errno: %d", errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_local_info[i]);
+ if (ret < 0) {
+ pr_info("free local failed, errno: %d", errno);
+ sem_post(sync);
+ goto out;
+ }
+ }
+
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+ pr_info("Free DVPP memory\n");
+ sharepool_print();
+ sem_post(sync);
+out:
+ status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status))
+ ret = -1;
+
+ return ret;
+}
+
+/*
+ * 测试流程:
+ * 1、申请10次DVPP直调内存
+ * 2、进程A加入共享组
+ * 3、申请10次DVPP直调内存
+ * 预期结果：
+ * 1、以上操作均成功；
+ * 2、申请的地址不重复；
+ */
+static int testcase_dvpp_multi_16G_04(void)
+{
+ int ret, i, spg_id = 996;
+ struct sp_alloc_info alloc_group_info[ALLOC_LOOP];
+ struct sp_alloc_info alloc_local_info[ALLOC_LOOP];
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = spg_id,
+ };
+
+ /* 1、申请10次DVPP直调内存 */
+ dvpp_alloc_group(SPG_ID_DEFAULT, 40960, alloc_local_info, ALLOC_LOOP);
+
+ /* 2、用户态进程A加组 */
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group, ret: %d, errno: %d", ret, errno);
+ return -1;
+ }
+
+ /* 3、申请10次DVPP共享内存 */
+ dvpp_alloc_group(spg_id, 40960, alloc_group_info, ALLOC_LOOP);
+
+ pr_info("Alloc DVPP memory\n");
+ sharepool_print();
+
+ for (i = 0; i < ALLOC_LOOP; i++) {
+ ret = ioctl_free(dev_fd, &alloc_group_info[i]);
+ if (ret < 0) {
+ pr_info("free group failed, errno: %d", errno);
+ return -1;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_local_info[i]);
+ if (ret < 0) {
+ pr_info("free local failed, errno: %d", errno);
+ return -1;
+ }
+ }
+ pr_info("Free DVPP memory\n");
+ sharepool_print();
+}
+
+static int child05(sem_t *sync, sem_t *childsync)
+{
+ int ret;
+
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ sem_post(childsync);
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+ sem_post(childsync);
+}
+
+/*
+ * 测试流程:
+ * 1、进程A申请10次DVPP直调内存
+ * 2、进程B加入共享组
+ * 3、进程A加入共享组
+ * 预期结果：
+ * 1、1和2操作成功，3加组失败；
+ */
+static int testcase_dvpp_multi_16G_05(void)
+{
+ int ret, status, i, spg_id = 9116;
+ struct sp_alloc_info alloc_local_info[ALLOC_LOOP];
+
+ struct sp_add_group_info ag_info = {
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = spg_id,
+ };
+
+ char *sync_name = "/dvpp_pass_through";
+ sem_t *sync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name);
+
+ char *childsync_name = "/dvpp_pass_through_child";
+ sem_t *childsync = sem_open(childsync_name, O_CREAT, O_RDWR, 0);
+ if (childsync == SEM_FAILED) {
+ pr_info("sem_open child failed");
+ return -1;
+ }
+ sem_unlink(childsync_name);
+
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(child05(sync, childsync));
+ }
+
+ /* 1、申请10次DVPP直调内存 */
+ dvpp_alloc_group(SPG_ID_DEFAULT, 40960, alloc_local_info, ALLOC_LOOP);
+
+ /* 2、用户态进程B加组 */
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group, ret: %d, errno: %d", ret, errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ /* 3、用户态进程A加组 */
+ ag_info.pid = getpid();
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0)
+ pr_info("failed add group child, ret: %d, errno: %d", ret, errno);
+
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+
+ pr_info("Alloc DVPP memory\n");
+ sharepool_print();
+
+ for (i = 0; i < ALLOC_LOOP; i++) {
+ ret = ioctl_free(dev_fd, &alloc_local_info[i]);
+ if (ret < 0) {
+ pr_info("free local failed, errno: %d", errno);
+ sem_post(sync);
+ goto out;
+ }
+ }
+
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+ pr_info("Free DVPP memory\n");
+ sharepool_print();
+out:
+ status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status))
+ ret = -1;
+
+ return ret;
+}
+
+static int child06(sem_t *sync, sem_t *childsync)
+{
+ int i, ret;
+ struct sp_alloc_info alloc_group_info[ALLOC_LOOP];
+ struct sp_alloc_info alloc_local_info[ALLOC_LOOP];
+
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ /* 4、申请10次DVPP共享内存 */
+ dvpp_alloc_group(996, 40960, alloc_group_info, ALLOC_LOOP);
+
+ /* 4、申请10次DVPP直调内存 */
+ dvpp_alloc_group(SPG_ID_DEFAULT, 40960, alloc_local_info, ALLOC_LOOP);
+
+ sem_post(childsync);
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ for (i = 0; i < ALLOC_LOOP; i++) {
+ ret = ioctl_free(dev_fd, &alloc_group_info[i]);
+ if (ret < 0) {
+ pr_info("free group failed, errno: %d", errno);
+ sem_post(sync);
+ break;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_local_info[i]);
+ if (ret < 0) {
+ pr_info("free local failed, errno: %d", errno);
+ sem_post(sync);
+ break;
+ }
+ }
+
+ sem_post(childsync);
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+}
+
+/*
+ * 测试流程:
+ * 1、进程A申请10次DVPP直调内存
+ * 2、进程A加入共享组
+ * 3、进程B加入共享组
+ * 4、进程A申请共享内存，进程B申请共享，直调内存
+ * 预期结果：
+ * 1、以上操作均执行成功
+ * 2、申请的内存地址不相同
+ */
+static int testcase_dvpp_multi_16G_06(void)
+{
+ int ret, status, i, spg_id = 996;
+ struct sp_alloc_info alloc_local_info[ALLOC_LOOP];
+ struct sp_alloc_info alloc_group_info[ALLOC_LOOP];
+
+ struct sp_add_group_info ag_info = {
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = spg_id,
+ };
+
+ char *sync_name = "/dvpp_pass_through";
+ sem_t *sync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name);
+
+ char *childsync_name = "/dvpp_pass_through_child";
+ sem_t *childsync = sem_open(childsync_name, O_CREAT, O_RDWR, 0);
+ if (childsync == SEM_FAILED) {
+ pr_info("sem_open child failed");
+ return -1;
+ }
+ sem_unlink(childsync_name);
+
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(child06(sync, childsync));
+ }
+
+ /* 1、申请10次DVPP直调内存 */
+ dvpp_alloc_group(SPG_ID_DEFAULT, 40960, alloc_local_info, ALLOC_LOOP);
+
+ /* 2、用户态进程A加共享组 */
+ ag_info.pid = getpid();
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group, ret: %d, errno: %d", ret, errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ /* 3、用户态进程B加共享组 */
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0){
+ pr_info("failed add group child, ret: %d, errno: %d", ret, errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ /* 4 */
+ dvpp_alloc_group(spg_id, 40960, alloc_group_info, ALLOC_LOOP);
+
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+
+ pr_info("Alloc DVPP memory\n");
+ sharepool_print();
+
+ for (i = 0; i < ALLOC_LOOP; i++) {
+ ret = ioctl_free(dev_fd, &alloc_local_info[i]);
+ if (ret < 0) {
+ pr_info("free local failed, errno: %d", errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_group_info[i]);
+ if (ret < 0) {
+ pr_info("free group failed, errno: %d", errno);
+ sem_post(sync);
+ goto out;
+ }
+ }
+
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+ pr_info("Free DVPP memory\n");
+ sharepool_print();
+ sem_post(sync);
+out:
+ status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status))
+ ret = -1;
+
+ return ret;
+}
+
+static int testcase1(void) { return testcase_dvpp_multi_16G_01(); }
+static int testcase2(void) { return testcase_dvpp_multi_16G_02(); }
+static int testcase3(void) { return testcase_dvpp_multi_16G_03(); }
+static int testcase4(void) { return testcase_dvpp_multi_16G_04(); }
+static int testcase5(void) { return testcase_dvpp_multi_16G_05(); }
+static int testcase6(void) { return testcase_dvpp_multi_16G_06(); }
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "用户态进程A加组，申请10次DVPP共享内存，再申请10次DVPP直调内存，预期成功")
+ TESTCASE_CHILD(testcase2, "用户态进程A/B加入相同组，分别申请10次DVPP共享内存，再申请10次DVPP直调内存，预期成功")
+ TESTCASE_CHILD(testcase3, "用户态进程A/B加入不同组，分别申请10次DVPP共享内存，再申请10次DVPP直调内存，预期成功")
+ TESTCASE_CHILD(testcase4, "申请10次DVPP直调内存，然后进程A加入共享组，申请10次DVPP直调内存")
+ TESTCASE_CHILD(testcase5, "1、进程A申请10次DVPP直调内存 2、进程B加入共享组 3、进程A加入共享组")
+ TESTCASE_CHILD(testcase6, "1、进程A申请10次DVPP直调内存 2、进程A加入共享组 3、进程B加入共享组 4、进程A申请共享内存，进程B申请共享，直调内存")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/function_test/test_dvpp_multi_16G_k2task.c b/tools/testing/sharepool/testcase/function_test/test_dvpp_multi_16G_k2task.c
new file mode 100644
index 000000000000..a938ffa0382f
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/test_dvpp_multi_16G_k2task.c
@@ -0,0 +1,604 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Nov 20 01:38:40 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+#define ALLOC_LOOP 10
+
+static int dvpp_alloc_group(int spg_id, unsigned long size, struct sp_alloc_info *array, int array_num)
+{
+ int i, ret;
+ for (i = 0; i < array_num; i++) {
+ array[i].flag = SP_DVPP;
+ array[i].spg_id = spg_id;
+ array[i].size = size;
+
+ ret = ioctl_alloc(dev_fd, &array[i]);
+ if (ret < 0) {
+ pr_info("alloc DVPP failed, errno: %d", errno);
+ return -1;
+ }
+ memset(array[i].addr, 0, array[i].size);
+ }
+}
+
+static int dvpp_k2u_group(int spg_id, unsigned long size, unsigned long kva,
+ struct sp_make_share_info *array, int array_num)
+{
+ int i, ret;
+
+ for (i = 0; i < array_num; i++) {
+ array[i].kva = kva,
+ array[i].size = size,
+ array[i].spg_id = spg_id,
+ array[i].sp_flags = SP_DVPP,
+ array[i].pid = getpid(),
+
+ ret = ioctl_k2u(dev_fd, &array[i]);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ return -1;;
+ }
+ memset(array[i].addr, 0, array[i].size);
+ }
+}
+
+/*
+ * 测试流程:
+ * 1、用户态进程A加组
+ * 2、申请10次DVPP共享，直调内存
+ * 3、申请10次K2TASK内存
+ * 预期结果：
+ * 1、以上操作均成功；
+ * 2、申请的地址不重复；
+ */
+static int testcase_dvpp_multi_16G_01(void)
+{
+ int ret, i, group_id = 996;
+ struct sp_alloc_info alloc_group_info[ALLOC_LOOP];
+ struct sp_alloc_info alloc_local_info[ALLOC_LOOP];
+ struct sp_make_share_info k2u_task_info[ALLOC_LOOP];
+
+ struct vmalloc_info ka_info = {
+ .size = 40960,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ return -1;;
+ }
+
+ /* 1、用户态进程A加组 */
+ struct sp_add_group_info ag_info = {
+ .spg_id = group_id,
+ .prot = PROT_READ | PROT_WRITE,
+ .pid = getpid(),
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+
+ /* 2、申请10次DVPP共享，直调内存 */
+ dvpp_alloc_group(group_id, 40960, alloc_group_info, ALLOC_LOOP);
+ dvpp_alloc_group(SPG_ID_DEFAULT, 40960, alloc_local_info, ALLOC_LOOP);
+
+ /* 3、申请10次K2TASK内存 */
+ dvpp_k2u_group(SPG_ID_DEFAULT, 40960, ka_info.addr, k2u_task_info, ALLOC_LOOP);
+
+ pr_info("Alloc DVPP memory\n");
+ sharepool_print();
+
+ for (i = 0; i < ALLOC_LOOP; i++) {
+ ret = ioctl_free(dev_fd, &alloc_group_info[i]);
+ if (ret < 0) {
+ pr_info("free group failed, errno: %d", errno);
+ return -1;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_local_info[i]);
+ if (ret < 0) {
+ pr_info("free local failed, errno: %d", errno);
+ return -1;
+ }
+
+ ret = ioctl_unshare(dev_fd, &k2u_task_info[i]);
+ if (ret < 0) {
+ pr_info("unshare k2task failed, errno: %d", errno);
+ return -1;
+ }
+ }
+
+ ioctl_vfree(dev_fd, &ka_info);
+ pr_info("Free DVPP memory\n");
+ sharepool_print();
+}
+
+/*
+ * 测试流程:
+ * 1、申请10次DVPP k2task内存
+ * 2、用户态进程A加组
+ * 3、申请10次直调、共享内存
+ * 预期结果：
+ * 1、以上操作均成功；
+ * 2、申请的地址不重复；
+ */
+static int testcase_dvpp_multi_16G_02(void)
+{
+ int ret, i, group_id = 996;
+ struct sp_alloc_info alloc_group_info[ALLOC_LOOP];
+ struct sp_alloc_info alloc_local_info[ALLOC_LOOP];
+ struct sp_make_share_info k2u_task_info[ALLOC_LOOP];
+
+ struct vmalloc_info ka_info = {
+ .size = 40960,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ return -1;;
+ }
+
+ /* 1、申请10次K2TASK内存 */
+ dvpp_k2u_group(SPG_ID_DEFAULT, 40960, ka_info.addr, k2u_task_info, ALLOC_LOOP);
+
+ /* 2、用户态进程A加组 */
+ struct sp_add_group_info ag_info = {
+ .spg_id = group_id,
+ .prot = PROT_READ | PROT_WRITE,
+ .pid = getpid(),
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+
+ /* 2、申请10次DVPP共享，直调内存 */
+ dvpp_alloc_group(group_id, 40960, alloc_group_info, ALLOC_LOOP);
+ dvpp_alloc_group(SPG_ID_DEFAULT, 40960, alloc_local_info, ALLOC_LOOP);
+
+ pr_info("Alloc DVPP memory\n");
+ sharepool_print();
+
+ for (i = 0; i < ALLOC_LOOP; i++) {
+ ret = ioctl_free(dev_fd, &alloc_group_info[i]);
+ if (ret < 0) {
+ pr_info("free group failed, errno: %d", errno);
+ return -1;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_local_info[i]);
+ if (ret < 0) {
+ pr_info("free local failed, errno: %d", errno);
+ return -1;
+ }
+
+ ret = ioctl_unshare(dev_fd, &k2u_task_info[i]);
+ if (ret < 0) {
+ pr_info("unshare k2task failed, errno: %d", errno);
+ return -1;
+ }
+ }
+
+ ioctl_vfree(dev_fd, &ka_info);
+ pr_info("Free DVPP memory\n");
+ sharepool_print();
+}
+
+static int child(sem_t *sync, sem_t *childsync)
+{
+ int i, ret;
+ struct sp_alloc_info alloc_group_info[ALLOC_LOOP];
+ struct sp_alloc_info alloc_local_info[ALLOC_LOOP];
+ struct sp_make_share_info k2u_task_info[ALLOC_LOOP];
+
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ struct vmalloc_info ka_info = {
+ .size = 40960,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ return -1;;
+ }
+
+ /* 2、申请10次K2TASK内存 */
+ dvpp_k2u_group(SPG_ID_DEFAULT, 40960, ka_info.addr, k2u_task_info, ALLOC_LOOP);
+
+ /* 3、申请10次DVPP共享内存 */
+ dvpp_alloc_group(996, 40960, alloc_group_info, ALLOC_LOOP);
+
+ /* 4、申请10次DVPP直调内存 */
+ dvpp_alloc_group(SPG_ID_DEFAULT, 40960, alloc_local_info, ALLOC_LOOP);
+
+ sem_post(childsync);
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ for (i = 0; i < ALLOC_LOOP; i++) {
+ ret = ioctl_free(dev_fd, &alloc_group_info[i]);
+ if (ret < 0) {
+ pr_info("free group failed, errno: %d", errno);
+ sem_post(sync);
+ break;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_local_info[i]);
+ if (ret < 0) {
+ pr_info("free local failed, errno: %d", errno);
+ sem_post(sync);
+ break;
+ }
+
+ ret = ioctl_unshare(dev_fd, &k2u_task_info[i]);
+ if (ret < 0) {
+ pr_info("unshare k2task failed, errno: %d", errno);
+ sem_post(sync);
+ break;
+ }
+ }
+ ioctl_vfree(dev_fd, &ka_info);
+
+ sem_post(childsync);
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+}
+
+/*
+ * 测试流程:
+ * 1、用户态进程A/B加入相同组，分别执行下面两个动作；
+ * 2、申请10次k2task内存
+ * 3、申请10次DVPP共享内存
+ * 4、申请10次DVPP直调内存
+ * 预期结果：
+ * 1、以上操作均成功；
+ * 2、申请的地址不重复；
+ */
+static int testcase_dvpp_multi_16G_03(void)
+{
+ int ret, status, i, spg_id = 996;
+ struct sp_alloc_info alloc_group_info[ALLOC_LOOP];
+ struct sp_alloc_info alloc_local_info[ALLOC_LOOP];
+ struct sp_make_share_info k2u_task_info[ALLOC_LOOP];
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = spg_id,
+ };
+
+ char *sync_name = "/dvpp_pass_through";
+ sem_t *sync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name);
+
+ char *childsync_name = "/dvpp_pass_through_child";
+ sem_t *childsync = sem_open(childsync_name, O_CREAT, O_RDWR, 0);
+ if (childsync == SEM_FAILED) {
+ pr_info("sem_open child failed");
+ return -1;
+ }
+ sem_unlink(childsync_name);
+
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(child(sync, childsync));
+ }
+
+ struct vmalloc_info ka_info = {
+ .size = 40960,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ return -1;;
+ }
+
+ /* 1、用户态进程A/B加相同组 */
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group, ret: %d, errno: %d", ret, errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group child, ret: %d, errno: %d", ret, errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ /* 2、申请10次K2TASK内存 */
+ dvpp_k2u_group(SPG_ID_DEFAULT, 40960, ka_info.addr, k2u_task_info, ALLOC_LOOP);
+
+ /* 3、申请10次DVPP共享内存 */
+ dvpp_alloc_group(spg_id, 40960, alloc_group_info, ALLOC_LOOP);
+
+ /* 4、申请10次DVPP直调内存 */
+ dvpp_alloc_group(SPG_ID_DEFAULT, 40960, alloc_local_info, ALLOC_LOOP);
+
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+
+ pr_info("Alloc DVPP memory\n");
+ sharepool_print();
+
+ for (i = 0; i < ALLOC_LOOP; i++) {
+ ret = ioctl_free(dev_fd, &alloc_group_info[i]);
+ if (ret < 0) {
+ pr_info("free group failed, errno: %d", errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_local_info[i]);
+ if (ret < 0) {
+ pr_info("free local failed, errno: %d", errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ ret = ioctl_unshare(dev_fd, &k2u_task_info[i]);
+ if (ret < 0) {
+ pr_info("unshare k2task failed, errno: %d", errno);
+ sem_post(sync);
+ goto out;
+ }
+ }
+
+ ioctl_vfree(dev_fd, &ka_info);
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+ pr_info("Free DVPP memory\n");
+ sharepool_print();
+ sem_post(sync);
+out:
+ status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status))
+ ret = -1;
+
+ return ret;
+}
+
+/*
+ * 测试流程:
+ * 1、用户态进程A/B加入不同组，分别执行下面两个动作；
+ * 2、申请10次k2task内存
+ * 3、申请10次DVPP共享内存
+ * 4、申请10次DVPP直调内存
+ * 预期结果：
+ * 1、以上操作均成功；
+ * 2、申请的地址不重复；
+ */
+static int testcase_dvpp_multi_16G_04(void)
+{
+ int ret, status, i, spg_id = 9116;
+ struct sp_alloc_info alloc_group_info[ALLOC_LOOP];
+ struct sp_alloc_info alloc_local_info[ALLOC_LOOP];
+ struct sp_make_share_info k2u_task_info[ALLOC_LOOP];
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = spg_id,
+ };
+
+ char *sync_name = "/dvpp_pass_through";
+ sem_t *sync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name);
+
+ char *childsync_name = "/dvpp_pass_through_child";
+ sem_t *childsync = sem_open(childsync_name, O_CREAT, O_RDWR, 0);
+ if (childsync == SEM_FAILED) {
+ pr_info("sem_open child failed");
+ return -1;
+ }
+ sem_unlink(childsync_name);
+
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(child(sync, childsync));
+ }
+
+ struct vmalloc_info ka_info = {
+ .size = 40960,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ return -1;;
+ }
+
+ /* 1、用户态进程A/B加不同组 */
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group, ret: %d, errno: %d", ret, errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ ag_info.pid = pid;
+ ag_info.spg_id = 996;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group child, ret: %d, errno: %d", ret, errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ /* 2、申请10次K2TASK内存 */
+ dvpp_k2u_group(SPG_ID_DEFAULT, 40960, ka_info.addr, k2u_task_info, ALLOC_LOOP);
+
+ /* 3、申请10次DVPP共享内存 */
+ dvpp_alloc_group(spg_id, 40960, alloc_group_info, ALLOC_LOOP);
+
+ /* 4、申请10次DVPP直调内存 */
+ dvpp_alloc_group(SPG_ID_DEFAULT, 40960, alloc_local_info, ALLOC_LOOP);
+
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+
+ pr_info("Alloc DVPP memory\n");
+ sharepool_print();
+
+ for (i = 0; i < ALLOC_LOOP; i++) {
+ ret = ioctl_free(dev_fd, &alloc_group_info[i]);
+ if (ret < 0) {
+ pr_info("free group failed, errno: %d", errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_local_info[i]);
+ if (ret < 0) {
+ pr_info("free local failed, errno: %d", errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ ret = ioctl_unshare(dev_fd, &k2u_task_info[i]);
+ if (ret < 0) {
+ pr_info("unshare k2task failed, errno: %d", errno);
+ sem_post(sync);
+ goto out;
+ }
+ }
+
+ ioctl_vfree(dev_fd, &ka_info);
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+ pr_info("Free DVPP memory\n");
+ sharepool_print();
+ sem_post(sync);
+out:
+ status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status))
+ ret = -1;
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase_dvpp_multi_16G_01, "1、用户态进程A加组 2、申请10次DVPP共享，直调内存 3、申请10次K2TASK内存")
+ TESTCASE_CHILD(testcase_dvpp_multi_16G_02, "1、申请10次DVPP k2task内存 2、用户态进程A加组 3、申请10次直调、共享内存")
+ TESTCASE_CHILD(testcase_dvpp_multi_16G_03, "1、用户态进程A/B加入相同组，分别执行下面3个动作；2、申请10次k2task内存 3、申请10次DVPP共享内存 4、申请10次DVPP直调内存")
+ TESTCASE_CHILD(testcase_dvpp_multi_16G_04, "1、用户态进程A/B加入相同组，分别执行下面3个动作；2、申请10次k2task内存 3、申请10次DVPP共享内存 4、申请10次DVPP直调内存")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+#include "default_main.c"
+
diff --git a/tools/testing/sharepool/testcase/function_test/test_dvpp_pass_through.c b/tools/testing/sharepool/testcase/function_test/test_dvpp_pass_through.c
new file mode 100644
index 000000000000..010bf0e5bdf6
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/test_dvpp_pass_through.c
@@ -0,0 +1,191 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Nov 20 01:38:40 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h> // for wait
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+/*
+ * 测试流程：
+ * 1、用户态进程A未加组，直接分配内存N。
+ * 2、进程B查询进程A的组id，尝试加组。
+ * 3、进程A调用u2k将内存N共享给内核，内核模块读N。
+ * 4、进程A释放内存N。
+ * 5、内核再次读内存。
+ * 预期结果：
+ * 1、预期进入DVPP直调场景。
+ * 2、查询失败，加组成功。
+ * 3、共享成功，内核读成功。
+ * 4、释放成功。
+ * 5、内核读成功。
+ */
+static int child(sem_t *sync, sem_t *childsync)
+{
+ int ret;
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ ret = ioctl_find_first_group(dev_fd, getpid());
+ if (!(ret < 0 && errno == ENODEV)) {
+ pr_info("unexpected parent group id. ret %d, errno %d", ret, errno);
+ ret = -1;
+ goto out;
+ } else {
+ pr_info("find first group failed as expected, ret: %d", errno);
+ }
+
+ struct sp_add_group_info ag_info = {
+ .pid = getppid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 996,
+ };
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group, ret: %d, errno: %d", ret, errno);
+ ret = -1;
+ goto out;
+ } else {
+ ret = 0;
+ }
+
+out:
+ sem_post(childsync);
+ return ret;
+}
+
+static int testcase1(void)
+{
+ int ret, status;
+
+ char *sync_name = "/dvpp_pass_through";
+ sem_t *sync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ ret = -1;
+ goto out;
+ }
+ sem_unlink(sync_name);
+
+ char *childsync_name = "/dvpp_pass_through_child";
+ sem_t *childsync = sem_open(childsync_name, O_CREAT, O_RDWR, 0);
+ if (childsync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ ret = -1;
+ goto out;
+ }
+ sem_unlink(childsync_name);
+
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(child(sync, childsync));
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = SP_DVPP,
+ .spg_id = SPG_ID_DEFAULT,
+ .size = 10000,
+ };
+
+ alloc_info.flag = SP_HUGEPAGE;
+ alloc_info.size = PMD_SIZE;
+
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ sem_post(sync);
+ goto out;
+ }
+
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl u2k failed, errno: %d", errno);
+ goto out;
+ }
+
+ memset((void *)alloc_info.addr, 'k', alloc_info.size);
+ struct karea_access_info kaccess_info = {
+ .mod = KAREA_CHECK,
+ .value = 'k',
+ .addr = u2k_info.addr,
+ .size = u2k_info.size,
+ };
+
+ ret = ioctl_karea_access(dev_fd, &kaccess_info);
+ if (ret < 0) {
+ pr_info("karea read failed, errno: %d", errno);
+ goto out;
+ }
+
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("unshare u2k failed, errno: %d", errno);
+ goto out;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_free failed, errno: %d", errno);
+ goto out;
+ }
+/*
+ ret = ioctl_karea_access(dev_fd, &kaccess_info);
+ if (ret < 0) {
+ pr_info("karea read failed, errno: %d", errno);
+ goto out;
+ }
+ */
+
+out:
+ status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status))
+ ret = -1;
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE(testcase1, "1、用户态进程A未加组，直接分配内存N。 2、进程B查询进程A的组id，尝试加组。 3、进程A调用u2k将内存N共享给内核，内核模块读N。 4、进程A释放内存N。 5、内核再次读内存。预期结果：1、预期进入DVPP直调场景。2、查询失败，加组成功。 3、共享成功，内核读成功。4、释放成功。5、内核读成功。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/function_test/test_dvpp_readonly.c b/tools/testing/sharepool/testcase/function_test/test_dvpp_readonly.c
new file mode 100644
index 000000000000..efc51a9411b2
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/test_dvpp_readonly.c
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Nov 20 01:38:40 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+static unsigned long kva_size = 0x200000;
+static unsigned long kva_normal;
+static unsigned long kva_huge;
+
+/*
+ * 测试点：
+ * sp_alloc、k2u 加组，直调 大页、小页、DVPP、非DVPP
+ *
+ * 测试步骤：
+ * 1. 加组(或者直调不加组)
+ * 2. 申请用户内存(sp_alloc或k2u)，附加只读属性
+ * 3. mprotect() 预期失败
+ * 4. memset 预期进程挂掉
+ */
+static int test_route(bool k2u, bool auto_group, unsigned long sp_flags)
+{
+ int spg_id = 0, ret;
+ unsigned long uva;
+ unsigned long size = 0x1000;
+
+ if (auto_group) {
+ spg_id = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, SPG_ID_AUTO);
+ if (spg_id < 0) {
+ pr_info("add group failed, %d, para: %s, %s, %lx",
+ errno, k2u ? "k2u" : "sp_alloc",
+ auto_group ? "add_group" : "passthrough", sp_flags);
+ return -1;
+ }
+ }
+
+ if (k2u) {
+ unsigned long kva = (sp_flags & SP_HUGEPAGE_ONLY) ? kva_huge : kva_normal;
+ uva = wrap_k2u(kva, size, spg_id, sp_flags | SP_PROT_RO);
+ } else
+ uva = (unsigned long)wrap_sp_alloc(spg_id, size, sp_flags | SP_PROT_RO);
+
+ if (!uva) {
+ pr_info("alloc user memory failed, %d, para: %s, %s, %lx",
+ errno, k2u ? "k2u" : "sp_alloc",
+ auto_group ? "add_group" : "passthrough", sp_flags);
+ return -1;
+ }
+
+ ret = mprotect(uva, size, PROT_WRITE);
+ if (!(ret && errno == EACCES)) {
+ pr_info("mprotect failed, ret:%d, err:%d, para: %s, %s, %lx",
+ ret, errno, k2u ? "k2u" : "sp_alloc",
+ auto_group ? "add_group" : "passthrough", sp_flags);
+ return ret;
+ }
+ memset((void *)uva, 0, size);
+
+ // should never access this line
+ return -1;
+}
+
+static void pre_hook()
+{
+ kva_normal = wrap_vmalloc(kva_size, false);
+ if (!kva_normal)
+ exit(1);
+ kva_huge = wrap_vmalloc(kva_size, true);
+ if (!kva_huge) {
+ wrap_vfree(kva_normal);
+ exit(1);
+ }
+}
+#define pre_hook pre_hook
+
+static void post_hook()
+{
+ wrap_vfree(kva_huge);
+ wrap_vfree(kva_normal);
+}
+#define post_hook post_hook
+
+
+// sp_alloc，直调
+static int testcase1() { return test_route(false, false, 0); };
+static int testcase2() { return test_route(false, false, SP_DVPP); };
+static int testcase3() { return test_route(false, false, SP_HUGEPAGE_ONLY); };
+static int testcase4() { return test_route(false, false, SP_DVPP | SP_HUGEPAGE_ONLY); };
+// sp_alloc，非直调
+static int testcase5() { return test_route(false, true, 0); };
+static int testcase6() { return test_route(false, true, SP_DVPP); };
+static int testcase7() { return test_route(false, true, SP_HUGEPAGE_ONLY); };
+static int testcase8() { return test_route(false, true, SP_DVPP | SP_HUGEPAGE_ONLY); };
+// k2task
+static int testcase9() { return test_route(true, false, 0); };
+static int testcase10() { return test_route(true, false, SP_DVPP); };
+static int testcase11() { return test_route(true, false, SP_HUGEPAGE_ONLY); };
+static int testcase12() { return test_route(true, false, SP_DVPP | SP_HUGEPAGE_ONLY); };
+// k2spg
+static int testcase13() { return test_route(true, true, 0); };
+static int testcase14() { return test_route(true, true, SP_DVPP); };
+static int testcase15() { return test_route(true, true, SP_HUGEPAGE_ONLY); };
+static int testcase16() { return test_route(true, true, SP_DVPP | SP_HUGEPAGE_ONLY); };
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD_SIGNAL(testcase1, SIGSEGV, "sp_alloc 直调 普通页")
+ TESTCASE_CHILD_SIGNAL(testcase2, SIGSEGV, "sp_alloc 直调 dvpp")
+ TESTCASE_CHILD_SIGNAL(testcase3, SIGSEGV, "sp_alloc 直调 大页")
+ TESTCASE_CHILD_SIGNAL(testcase4, SIGSEGV, "sp_alloc 直调 dvpp 大页")
+ TESTCASE_CHILD_SIGNAL(testcase5, SIGSEGV, "sp_alloc 非直调 普通页")
+ TESTCASE_CHILD_SIGNAL(testcase6, SIGSEGV, "sp_alloc 非直调 dvpp")
+ TESTCASE_CHILD_SIGNAL(testcase7, SIGSEGV, "sp_alloc 非直调 大页")
+ TESTCASE_CHILD_SIGNAL(testcase8, SIGSEGV, "sp_alloc 非直调 dvpp 大页")
+ TESTCASE_CHILD_SIGNAL(testcase9, SIGSEGV, "k2task")
+ TESTCASE_CHILD_SIGNAL(testcase10, SIGSEGV, "k2task dvpp")
+ TESTCASE_CHILD_SIGNAL(testcase11, SIGSEGV, "k2task 大页")
+ TESTCASE_CHILD_SIGNAL(testcase12, SIGSEGV, "k2task dvpp 大页")
+ TESTCASE_CHILD_SIGNAL(testcase13, SIGSEGV, "k2spg")
+ TESTCASE_CHILD_SIGNAL(testcase14, SIGSEGV, "k2spg dvpp")
+ TESTCASE_CHILD_SIGNAL(testcase15, SIGSEGV, "k2spg 大页")
+ TESTCASE_CHILD_SIGNAL(testcase16, SIGSEGV, "k2spg dvpp 大页")
+};
+
+static struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/function_test/test_hugetlb_alloc_hugepage.c b/tools/testing/sharepool/testcase/function_test/test_hugetlb_alloc_hugepage.c
new file mode 100644
index 000000000000..12fc8ab52cae
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/test_hugetlb_alloc_hugepage.c
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2022. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Tue Jan 04 07:33:23 2022
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 测试点在于对用户态大页做u2k。DVPP流程中有这种场景，其中用户态大页内存是
+ * 通过底软的接口申请的，对应的vma没有标记成大页，需要特殊处理。
+ *
+ * 申请大页内存，读写访问，做u2k，内核check、写，用户态读
+ * 预期用户态读写成功，u2k成功，内核写成功，用户态check成功
+ */
+static int testcase_route(int flags, unsigned long len)
+{
+ int i, ret;
+ char *addr;
+
+ addr = ioctl_alloc_huge_memory(0, flags, 0, len);
+ if (!addr) {
+ pr_info("alloc huge memory failed, %d", errno);
+ return -1;
+ } else
+ pr_info("alloc huge memory success, %p, size:%#lx, flags: %d", addr, len, flags);
+
+ memset(addr, 'b', len);
+
+ for (i = 0; i < len; i++) {
+ if (addr[i] != 'b') {
+ pr_info("memset resut check failed, i:%d, %c", i, addr[i]);
+ return -1;
+ }
+ }
+ pr_info("check memset sueccess");
+
+ unsigned long kaddr = wrap_u2k(addr, len);
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_CHECK,
+ .value = 'b',
+ .addr = kaddr,
+ .size = len,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ return -1;
+ }
+
+ karea_info.mod = KAREA_SET;
+ karea_info.value = 'c';
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ return -1;
+ }
+
+ for (i = 0; i < len; i++) {
+ if (addr[i] != 'c') {
+ pr_info("memset resut check failed, i:%d, %c", i, addr[i]);
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+#define TEST_FUNC(num, flags, len) \
+static int testcase##num() \
+{ \
+ return testcase_route(flags, len); \
+}
+
+TEST_FUNC(1, 0, 0x100)
+TEST_FUNC(2, 0, 0x200000)
+TEST_FUNC(3, 0, 0x2000000)
+TEST_FUNC(4, 1, 0x100)
+TEST_FUNC(5, 1, 0x200000)
+TEST_FUNC(6, 1, 0x2000000)
+TEST_FUNC(7, 2, 0x100)
+TEST_FUNC(8, 2, 0x200000)
+TEST_FUNC(9, 2, 0x2000000)
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "对用户态大页做u2k。DVPP流程中有这种场景，其中用户态大页内存是通过底软的接口申请的，对应的vma没有标记成大页，需要特殊处理")
+ TESTCASE_CHILD(testcase2, "对用户态大页做u2k。DVPP流程中有这种场景，其中用户态大页内存是通过底软的接口申请的，对应的vma没有标记成大页，需要特殊处理")
+ TESTCASE_CHILD(testcase3, "对用户态大页做u2k。DVPP流程中有这种场景，其中用户态大页内存是通过底软的接口申请的，对应的vma没有标记成大页，需要特殊处理")
+ TESTCASE_CHILD(testcase4, "对用户态大页做u2k。DVPP流程中有这种场景，其中用户态大页内存是通过底软的接口申请的，对应的vma没有标记成大页，需要特殊处理")
+ TESTCASE_CHILD(testcase5, "对用户态大页做u2k。DVPP流程中有这种场景，其中用户态大页内存是通过底软的接口申请的，对应的vma没有标记成大页，需要特殊处理")
+ TESTCASE_CHILD(testcase6, "对用户态大页做u2k。DVPP流程中有这种场景，其中用户态大页内存是通过底软的接口申请的，对应的vma没有标记成大页，需要特殊处理")
+ TESTCASE_CHILD(testcase7, "对用户态大页做u2k。DVPP流程中有这种场景，其中用户态大页内存是通过底软的接口申请的，对应的vma没有标记成大页，需要特殊处理")
+ TESTCASE_CHILD(testcase8, "对用户态大页做u2k。DVPP流程中有这种场景，其中用户态大页内存是通过底软的接口申请的，对应的vma没有标记成大页，需要特殊处理")
+ TESTCASE_CHILD(testcase9, "对用户态大页做u2k。DVPP流程中有这种场景，其中用户态大页内存是通过底软的接口申请的，对应的vma没有标记成大页，需要特殊处理")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/function_test/test_k2u.c b/tools/testing/sharepool/testcase/function_test/test_k2u.c
new file mode 100644
index 000000000000..ebae2395ac5d
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/test_k2u.c
@@ -0,0 +1,804 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Nov 23 02:17:32 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/shm.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+#define tc1_MSG_KEY 20
+#define tc1_MSG_TYPE 100
+struct msgbuf_alloc_info {
+ long type;
+ union {
+ struct sp_alloc_info alloc_info;
+ struct sp_make_share_info share_info;
+ };
+};
+
+/*
+ * 内核模块分配并写内存N，k2u共享给一个进程（进程未加组），该进程读内存N成功，内核模块释放内存N。
+ */
+static int testcase1(void)
+{
+ int ret;
+
+ struct vmalloc_info ka_info = {
+ .size = 10000,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ goto out_free;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ goto out_free;
+ }
+
+ char *buf = (char *)k2u_info.addr;
+ for (int i = 0; i < k2u_info.size; i++) {
+ if (buf[i] != 'b') {
+ pr_info("check k2u context failed");
+ ret = -1;
+ break;
+ }
+ }
+
+ if (ioctl_unshare(dev_fd, &k2u_info)) {
+ pr_info("unshare memory failed, errno: %d", errno);
+ ret = -1;
+ }
+
+out_free:
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret < 0 ? -1 : 0;
+}
+
+/*
+ * 内核模块分配并写内存N，k2u共享给一个进程（进程已加组）。
+ * 该进程读内存成功。新进程B加入该组，进程B读内存N成功。内核模块释放内存N。
+ * 内核执行unshare操作，用户态进程不能访问。
+ */
+static jmp_buf testcase2_env;
+static int testcase2_sigsegv_result = -1;
+static void testcase2_sigsegv_handler(int num)
+{
+ pr_info("segment fault occurs");
+ testcase2_sigsegv_result = 0;
+ longjmp(testcase2_env, 1);
+}
+
+static int testcase2(void)
+{
+ int ret, status = 0, group_id = 10;
+ pid_t pid;
+
+ char *sync_name = "/testcase2_k2u";
+ sem_t *sync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name);
+
+ char *sync_name2 = "/testcase2_k2u2";
+ sem_t *sync2 = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync2 == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name2);
+
+ struct vmalloc_info ka_info = {
+ .size = 10000,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ goto out;
+ }
+
+ struct sp_add_group_info ag_info = {
+ .spg_id = group_id,
+ .prot = PROT_READ | PROT_WRITE,
+ .pid = getpid(),
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ goto out;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = group_id,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ goto out;
+ }
+
+ char *buf = (char *)k2u_info.addr;
+ for (int i = 0; i < k2u_info.size; i++) {
+ if (buf[i] != 'b') {
+ pr_info("check k2u context failed");
+ ret = -1;
+ goto out;
+ }
+ }
+
+ pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ ret = -1;
+ goto out;
+ } else if (pid == 0) {
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ ret = ioctl_find_first_group(dev_fd, getpid());
+ if (ret != group_id) {
+ pr_info("child: unexpected group_id: %d", ret);
+ sem_post(sync2);
+ exit(-1);
+ }
+
+ char *buf = (char *)k2u_info.addr;
+ for (int i = 0; i < k2u_info.size; i++) {
+ if (buf[i] != 'b') {
+ pr_info("child: check k2u context failed, buf:%lx, i:%d, buf[i]:%d",
+ buf, i, (int)buf[i]);
+ sem_post(sync2);
+ exit(-1);
+ }
+ }
+ sem_post(sync2);
+ exit(0);
+ }
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ sem_post(sync);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ goto out_wait;
+ }
+
+ do {
+ ret = sem_wait(sync2);
+ } while (ret < 0 && errno == EINTR);
+
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ goto out_wait;
+ }
+
+ testcase2_sigsegv_result = -1;
+ struct sigaction sa = {0};
+ sa.sa_handler = testcase2_sigsegv_handler;
+ sigaction(SIGSEGV, &sa, NULL);
+ ret = setjmp(testcase2_env);
+ if (!ret) {
+ *(char *)k2u_info.addr = 'a';
+ pr_info("setjmp success, set char as 'a' success.");
+ }
+
+ if (testcase2_sigsegv_result) {
+ pr_info("ioctl unshare has no effect");
+ ret = -1;
+ goto out_wait;
+ } else
+ ret = 0;
+
+out_wait:
+ waitpid(pid, &status, 0);
+ if (ret || !WIFEXITED(status) || WEXITSTATUS(status))
+ ret = -1;
+ if (WIFSIGNALED(status))
+ pr_info("child killed by signal: %d", WTERMSIG(status));
+
+out:
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+}
+
+/*
+ * 内核模块分配并写内存N，k2u共享给一个进程（进程已加组），
+ * 该组内所有进程读内存N成功。内核模块释放内存N。
+ * 内核执行unshare操作，用户态进程不能访问。
+ */
+static int childprocess3(sem_t *sync, sem_t *childsync)
+{
+ int ret;
+
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ int msgid = msgget(tc1_MSG_KEY, 0);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ sem_post(childsync);
+ return -1;
+ }
+
+ struct msgbuf_alloc_info msgbuf = {0};
+ struct sp_make_share_info *k2u_info = &msgbuf.share_info;
+ ret = msgrcv(msgid, &msgbuf, sizeof(*k2u_info), tc1_MSG_TYPE, IPC_NOWAIT);
+ if (ret < 0) {
+ pr_info("msgrcv failed, errno: %d", errno);
+ sem_post(childsync);
+ return -1;
+ }
+
+ char *buf = (char *)k2u_info->addr;
+ for (int i = 0; i < k2u_info->size; i++) {
+ if (buf[i] != 'p') {
+ pr_info("child: check k2u context failed, buf:%lx, i:%d, buf[i]:%d",
+ buf, i, (int)buf[i]);
+ sem_post(childsync);
+ return -1;
+ }
+ }
+ sem_post(childsync);
+ return 0;
+}
+
+static int testcase3(void)
+{
+ int ret, status = 0, group_id = 18;
+ pid_t pid;
+
+ char *sync_name = "/testcase2_k2u";
+ sem_t *sync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name);
+
+ char *sync_name2 = "/testcase2_k2u2";
+ sem_t *childsync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (childsync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name2);
+
+ struct vmalloc_info ka_info = {
+ .size = 10000,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'p',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ goto out;
+ }
+
+ struct sp_add_group_info ag_info = {
+ .spg_id = group_id,
+ .prot = PROT_READ | PROT_WRITE,
+ .pid = getpid(),
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ goto out;
+ }
+
+ pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ goto out;
+ } else if (pid == 0) {
+ exit(childprocess3(sync, childsync));
+ }
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ goto out_fork;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = group_id,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ goto out;
+ }
+
+ int msgid = msgget(tc1_MSG_KEY, IPC_CREAT | 0666);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ goto out_fork;
+ }
+
+ struct msgbuf_alloc_info msgbuf = {0};
+ msgbuf.type = tc1_MSG_TYPE;
+ memcpy(&msgbuf.share_info, &k2u_info, sizeof(k2u_info));
+ ret = msgsnd(msgid, &msgbuf, sizeof(k2u_info), 0);
+ if (ret < 0) {
+ pr_info("msgsnd failed, errno: %d", errno);
+ goto out_fork;
+ }
+
+ sem_post(sync);
+
+ char *buf = (char *)k2u_info.addr;
+ for (int i = 0; i < k2u_info.size; i++) {
+ if (buf[i] != 'p') {
+ pr_info("check k2u context failed");
+ ret = -1;
+ goto out_fork;
+ }
+ }
+
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ goto out_fork;
+ }
+
+ testcase2_sigsegv_result = -1;
+ struct sigaction sa = {0};
+ sa.sa_handler = testcase2_sigsegv_handler;
+ sigaction(SIGSEGV, &sa, NULL);
+ ret = setjmp(testcase2_env);
+ if (!ret)
+ *(char *)k2u_info.addr = 'a';
+ if (testcase2_sigsegv_result) {
+ pr_info("ioctl unshare has no effect");
+ ret = -1;
+ goto out_fork;
+ }
+
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("childprocess3 exits unexpected");
+ ret = -1;
+ } else
+ ret = 0;
+ goto out;
+
+out_fork:
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+out:
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+}
+
+/*
+ * 内核模块分配并写内存N，k2u共享给一个组（进程已加组），
+ * 该组内所有进程读N成功。进程B加入该组，进程B读N成功。内核模块停止共享，
+ * 该组内所有进程读N失败。内核模块再次k2u共享给该组（换用B的pid），该组内
+ * 所有进程读N成功。内核模块释放内存N。
+ */
+
+static pid_t fork_and_add_group(int idx, int group_id, int (*child)(int, sem_t *, sem_t *),
+ sem_t *sync, sem_t *childsync)
+{
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(child(idx, sync, childsync));
+ }
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+ return -1;
+ } else
+ return pid;
+}
+
+static int per_test_init(int i, sem_t **sync, sem_t **childsync)
+{
+ char buf[100];
+ sprintf(buf, "/test_k2u%d", i);
+ *sync = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (*sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+
+ sprintf(buf, "/test_k2u_child%d", i);
+ *childsync = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (*childsync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+
+ return 0;
+}
+
+#define TEST4_SHM_KEY 1348
+#define TEST4_PROC_NUM 5
+
+struct shm_data {
+ struct sp_make_share_info k2u_info;
+ int results[TEST4_PROC_NUM];
+};
+
+static int childprocess4(int idx, sem_t *sync, sem_t *childsync)
+{
+ int ret;
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ int shmid = shmget(TEST4_SHM_KEY, sizeof(struct shm_data), IPC_CREAT | 0666);
+ if (shmid < 0) {
+ pr_info("shmget failed, errno: %d", errno);
+ goto error;
+ }
+
+ struct shm_data *shmd = shmat(shmid, NULL, 0);
+ if (shmd == (void *)-1) {
+ pr_info("shmat failed, errno: %d", errno);
+ goto error;
+ }
+
+ ret = ioctl_find_first_group(dev_fd, getpid());
+ if (ret < 0) {
+ pr_info("get group id failed");
+ goto error;
+ }
+
+ if (!ioctl_judge_addr(dev_fd, shmd->k2u_info.addr)) {
+ pr_info("unexpected k2u addr: 0x%lx", shmd->k2u_info.addr);
+ goto error;
+ }
+
+ char *buf = (char *)shmd->k2u_info.addr;
+ for (int i = 0; i < shmd->k2u_info.size; i++) {
+ if (buf[i] != 'x') {
+ pr_info("memory check failed");
+ goto error;
+ }
+ }
+ shmd->results[idx] = 0;
+
+ sem_post(childsync);
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ testcase2_sigsegv_result = -1;
+ struct sigaction sa = {0};
+ sa.sa_handler = testcase2_sigsegv_handler;
+ sigaction(SIGSEGV, &sa, NULL);
+ ret = setjmp(testcase2_env);
+ if (!ret)
+ *(char *)shmd->k2u_info.addr = 'a';
+ if (testcase2_sigsegv_result) {
+ pr_info("ioctl unshare has no effect");
+ goto error;
+ }
+ shmd->results[idx] = 0;
+
+ sem_post(childsync);
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ if (!ioctl_judge_addr(dev_fd, shmd->k2u_info.addr)) {
+ pr_info("unexpected k2u addr: 0x%lx", shmd->k2u_info.addr);
+ goto error;
+ }
+
+ buf = (char *)shmd->k2u_info.addr;
+ for (int i = 0; i < shmd->k2u_info.size; i++) {
+ if (buf[i] != 'l') {
+ pr_info("memory check failed");
+ goto error;
+ }
+ }
+ shmd->results[idx] = 0;
+ sem_post(childsync);
+
+ return 0;
+
+error:
+ sem_post(childsync);
+ return -1;
+}
+
+static int testcase4(void)
+{
+ int child_num, i, ret;
+ int group_id = 15;
+
+ sem_t *syncs[TEST4_PROC_NUM];
+ sem_t *syncchilds[TEST4_PROC_NUM];
+ pid_t childs[TEST4_PROC_NUM] = {0};
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+
+ int shmid = shmget(TEST4_SHM_KEY, sizeof(struct shm_data), IPC_CREAT | 0666);
+ if (shmid < 0) {
+ pr_info("shmget failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct shm_data *shmd = shmat(shmid, NULL, 0);
+ if (shmd == (void *)-1) {
+ pr_info("shmat failed, errno: %d", errno);
+ return -1;
+ }
+ memset(shmd, 0, sizeof(*shmd));
+ for (i = 0; i < TEST4_PROC_NUM; i++)
+ shmd->results[i] = -1;
+ for (i = 0; i < TEST4_PROC_NUM - 1; i++) {
+ if (per_test_init(i, syncs + i, syncchilds + i)) {
+ child_num = i;
+ goto unfork;
+ }
+ pid_t pid = fork_and_add_group(i, group_id, childprocess4, syncs[i], syncchilds[i]);
+ if (pid < 0) {
+ child_num = i;
+ goto unfork;
+ }
+ childs[i] = pid;
+ }
+ child_num = i;
+
+ struct vmalloc_info ka_info = {
+ .size = 10000,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ goto unfork;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'x',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ goto vfree;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = group_id,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ goto vfree;
+ }
+
+ memcpy(&shmd->k2u_info, &k2u_info, sizeof(k2u_info));
+
+ for (i = 0; i < child_num; i++)
+ sem_post(syncs[i]);
+ for (i = 0; i < child_num; i++) {
+ do {
+ ret = sem_wait(syncchilds[i]);
+ } while (ret < 0 && errno == EINTR);
+ if (shmd->results[i]) {
+ pr_info("test4 child%d read k2u memory faild", i);
+ goto unshare;
+ }
+ shmd->results[i] = -1;
+ }
+
+// TODO: 存在问题，后加组的进程不能共享k2spg的内存，待修复后删掉在测试
+#if 1
+ // 创建新进程B，并加组，判断进程B是否能读共享内存成功
+ if (per_test_init(child_num, syncs + child_num, syncchilds + child_num))
+ goto unshare;
+ childs[child_num] = fork_and_add_group(child_num, group_id, childprocess4,
+ syncs[child_num], syncchilds[child_num]);
+ if (childs[child_num] < 0)
+ goto unshare;
+ child_num++;
+
+ sem_post(syncs[child_num - 1]);
+ do {
+ ret = sem_wait(syncchilds[child_num - 1]);
+ } while (ret < 0 && errno == EINTR);
+ if (shmd->results[child_num - 1]) {
+ pr_info("test4 child%d read k2u memory faild", child_num - 1);
+ goto unshare;
+ }
+ shmd->results[child_num - 1] = -1;
+#endif
+
+ // unshare 之后其他进程读失败
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl unshare failed, errno: %d", errno);
+ goto unshare;
+ }
+
+ for (i = 0; i < child_num; i++)
+ sem_post(syncs[i]);
+ for (i = 0; i < child_num; i++) {
+ do {
+ ret = sem_wait(syncchilds[i]);
+ } while (ret < 0 && errno == EINTR);
+ if (shmd->results[i]) {
+ pr_info("test4 child%d read k2u memory faild", i);
+ goto unshare;
+ }
+ shmd->results[i] = -1;
+ }
+
+ // 再次调用k2u，其他进程读内存成功
+ karea_info.value = 'l';
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ goto vfree;
+ }
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ goto vfree;
+ }
+ memcpy(&shmd->k2u_info, &k2u_info, sizeof(k2u_info));
+
+ for (i = 0; i < child_num; i++)
+ sem_post(syncs[i]);
+ for (i = 0; i < child_num; i++) {
+ do {
+ ret = sem_wait(syncchilds[i]);
+ } while (ret < 0 && errno == EINTR);
+ if (shmd->results[i]) {
+ pr_info("test4 child%d read k2u memory faild", i);
+ goto unshare;
+ }
+ shmd->results[i] = -1;
+ }
+
+ for (i = 0; i < child_num; i++) {
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], NULL, 0);
+ }
+
+ ret = ioctl_vfree(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("ioctl_vfree failed.");
+ return -1;
+ }
+
+ return 0;
+
+unshare:
+ ioctl_unshare(dev_fd, &k2u_info);
+vfree:
+ ioctl_vfree(dev_fd, &ka_info);
+unfork:
+ for (i = 0; i < child_num; i++) {
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], NULL, 0);
+ }
+ return -1;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "内核模块分配并写内存N，k2u共享给一个进程（进程未加组），该进程读内存N成功，内核模块释放内存N。")
+ TESTCASE_CHILD(testcase2, "内核模块分配并写内存N，k2u共享给一个进程（进程已加组）。该进程读内存成功。新进程B加入该组，进程B读内存N成功。内核模块释放内存N。内核执行unshare操作，用户态进程不能访问。")
+ TESTCASE_CHILD(testcase3, "内核模块分配并写内存N，k2u共享给一个进程（进程已加组），该组内所有进程读内存N成功。内核模块释放内存N。内核执行unshare操作，用户态进程不能访问。")
+ TESTCASE_CHILD(testcase4, "内核模块分配并写内存N，k2u共享给一个组（进程已加组），该组内所有进程读N成功。进程B加入该组，进程B读N成功。内核模块停止共享，该组内所有进程读N失败。内核模块再次k2u共享给该组（换用B的pid），该组内所有进程读N成功。内核模块释放内存N。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/function_test/test_mm_mapped_to_multi_groups.c b/tools/testing/sharepool/testcase/function_test/test_mm_mapped_to_multi_groups.c
new file mode 100644
index 000000000000..1144655a97b9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/test_mm_mapped_to_multi_groups.c
@@ -0,0 +1,435 @@
+#include <stdlib.h>
+#include <pthread.h>
+#include <stdbool.h>
+#include "sharepool_lib.h"
+
+#define PROCESS_NUM 20
+#define THREAD_NUM 20
+#define GROUP_NUM 50
+#define ALLOC_TYPES 4
+
+static pthread_mutex_t mutex;
+static int group_ids[GROUP_NUM];
+static int add_success, add_fail;
+
+int query_func(int *group_num, int *ids)
+{
+ int ret = 0;
+ // query groups
+ int spg_ids[GROUP_NUM];
+ if (!ids)
+ ids = spg_ids;
+ *group_num = GROUP_NUM;
+ struct sp_group_id_by_pid_info find_group_info = {
+ .num = group_num,
+ .spg_ids = ids,
+ .pid = getpid(),
+ };
+ ret = ioctl_find_group_by_pid(dev_fd, &find_group_info);
+ if (ret < 0) {
+ pr_info("find group id by pid failed");
+ return ret;
+ } else {
+ return 0;
+ }
+}
+
+int work_func(int group_id)
+{
+ int ret = 0, i;
+ pid_t pid;
+ bool judge_ret = true;
+ struct sp_alloc_info alloc_info[ALLOC_TYPES] = {0};
+ struct sp_make_share_info u2k_info[ALLOC_TYPES] = {0}, k2u_info = {0}, k2u_huge_info = {0};
+ struct vmalloc_info vmalloc_info = {0}, vmalloc_huge_info = {0};
+ char *addr;
+
+ /* check sp group */
+ pid = getpid();
+
+ // 大页
+ alloc_info[0].flag = SP_HUGEPAGE;
+ alloc_info[0].spg_id = group_id;
+ alloc_info[0].size = 2 * PMD_SIZE;
+
+ // 大页 DVPP
+ alloc_info[1].flag = SP_DVPP | SP_HUGEPAGE;
+ alloc_info[1].spg_id = group_id;
+ alloc_info[1].size = 2 * PMD_SIZE;
+
+ // 普通页 DVPP
+ alloc_info[2].flag = SP_DVPP;
+ alloc_info[2].spg_id = group_id;
+ alloc_info[2].size = 4 * PAGE_SIZE;
+
+ // 普通页
+ alloc_info[3].flag = 0;
+ alloc_info[3].spg_id = group_id;
+ alloc_info[3].size = 4 * PAGE_SIZE;
+
+ /* alloc & u2k */
+ for (i = 0; i < ALLOC_TYPES; i++) {
+ /* sp_alloc */
+ ret = ioctl_alloc(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed at %dth alloc.\n", i);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(alloc_info[i].addr)) {
+ pr_info("sp_alloc return err is %ld\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("sp_alloc return addr %lx\n", alloc_info[i].addr);
+ }
+ }
+
+ /* check sp_alloc addr */
+ judge_ret = ioctl_judge_addr(dev_fd, alloc_info[i].addr);
+ if (judge_ret != true) {
+ pr_info("expect a valid share pool addr %lx\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("addr %lx is a valid share pool addr\n", alloc_info[i].addr);
+ }
+
+ /* prepare for u2k */
+ addr = (char *)alloc_info[i].addr;
+ if (alloc_info[i].flag & SP_HUGEPAGE) {
+ addr[0] = 'd';
+ addr[PMD_SIZE - 1] = 'c';
+ addr[PMD_SIZE] = 'b';
+ addr[PMD_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_hugepage_checker = true;
+ } else {
+ addr[0] = 'd';
+ addr[PAGE_SIZE - 1] = 'c';
+ addr[PAGE_SIZE] = 'b';
+ addr[PAGE_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_checker = true;
+ }
+
+ u2k_info[i].uva = alloc_info[i].addr;
+ u2k_info[i].size = alloc_info[i].size;
+ u2k_info[i].pid = pid;
+
+ /* u2k */
+ ret = ioctl_u2k(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl u2k failed\n");
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(u2k_info[i].addr)) {
+ pr_info("u2k return err is %ld.\n", u2k_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("u2k return addr %lx, check memory content succ.\n",
+ // u2k_info[i].addr);
+ }
+ }
+ //pr_info("\n");
+ }
+
+ /* prepare for vmalloc */
+ vmalloc_info.size = 3 * PAGE_SIZE;
+ vmalloc_huge_info.size = 3 * PMD_SIZE;
+
+ /* vmalloc */
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vmalloc_hugepage(dev_fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vmalloc huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* prepare for k2u */
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+ k2u_info.sp_flags = 0;
+ k2u_info.pid = pid;
+ k2u_info.spg_id = group_id;
+
+ k2u_huge_info.kva = vmalloc_huge_info.addr;
+ k2u_huge_info.size = vmalloc_huge_info.size;
+ k2u_huge_info.sp_flags = SP_DVPP;
+ k2u_huge_info.pid = pid;
+ k2u_huge_info.spg_id = group_id;
+
+ /* k2u */
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_info.addr)) {
+ pr_info("k2u return err is %ld.\n",
+ k2u_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u return addr %lx\n", k2u_info.addr);
+ }
+ }
+
+ ret = ioctl_k2u(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u hugepage error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_huge_info.addr)) {
+ pr_info("k2u hugepage return err is %ld.\n",
+ k2u_huge_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u hugepage return addr %lx\n", k2u_huge_info.addr);
+ }
+ }
+
+ /* check k2u memory content */
+ addr = (char *)k2u_info.addr;
+ if (addr[0] != 'a' || addr[PAGE_SIZE - 1] != 'b' ||
+ addr[PAGE_SIZE] != 'c' || addr[2 * PAGE_SIZE - 1] != 'd') {
+ pr_info("check vmalloc memory failed\n");
+ goto error;
+ } else {
+ //pr_info("check vmalloc memory succeess\n");
+ }
+
+ addr = (char *)k2u_huge_info.addr;
+ if (addr[0] != 'a' || addr[PMD_SIZE - 1] != 'b' ||
+ addr[PMD_SIZE] != 'c' || addr[2 * PMD_SIZE - 1] != 'd') {
+ pr_info("check vmalloc_hugepage memory failed: %c %c %c %c\n",
+ addr[0], addr[PMD_SIZE - 1], addr[PMD_SIZE], addr[2 * PMD_SIZE - 1]);
+ goto error;
+ } else {
+ //pr_info("check vmalloc_hugepage memory succeess\n");
+ }
+
+ /* unshare uva */
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("sp unshare uva error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_unshare(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("sp unshare hugepage uva error: %d\n", ret);
+ goto error;
+ }
+
+ /* kvfree */
+ ret = ioctl_vfree(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vfree small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vfree(dev_fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vfree huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* unshare kva & sp_free*/
+ for (i = 0; i < ALLOC_TYPES; i++) {
+ /* unshare kva */
+ ret = ioctl_unshare(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("sp_unshare kva return error: %d\n", ret);
+ goto error;
+ }
+
+ /* sp_free */
+ ret = ioctl_free(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("sp_free return error: %d\n", ret);
+ goto error;
+ }
+ }
+
+ //close_device(dev_fd);
+ return 0;
+
+error:
+ //close_device(dev_fd);
+ return -1;
+}
+
+void *thread_query_and_work(void *arg)
+{
+ int ret = -1;
+ int group_num = 0;
+ int ids[GROUP_NUM];
+
+ for (int i = 0; i < 10 && ret; i++)
+ ret = query_func(&group_num, ids);
+
+ if (ret) {
+ pr_info("query_func failed: %d", ret);
+ pthread_exit((void *)0);
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ ret = work_func(0);
+ if (ret != 0) {
+ pr_info("\nthread %lu finish running with error, spg_id: %d\n", pthread_self(), 0);
+ pthread_exit((void *)1);
+ }
+ }
+
+ pthread_exit((void *)0);
+}
+
+void *thread_add_group(void *arg)
+{
+ int ret = 0;
+ for(int i = 0; i < GROUP_NUM; i++)
+ {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, i + 1);
+ if (pthread_mutex_lock(&mutex) != 0) {
+ pr_info("get pthread mutex failed.");
+ }
+ if (ret < 0)
+ add_fail++;
+ else
+ add_success++;
+ pthread_mutex_unlock(&mutex);
+ }
+ pthread_exit((void *)0);
+}
+
+static int process_routine(void)
+{
+ int ret = 0;
+
+ // threads for alloc and u2k k2u
+ pthread_t tid1[THREAD_NUM];
+ for (int i = 0; i < THREAD_NUM; i++) {
+ ret = pthread_create(tid1 + i, NULL, thread_query_and_work, NULL);
+ if (ret < 0) {
+ pr_info("thread create failed.");
+ return -1;
+ }
+ }
+
+ // N threads for add M groups, N*M attempts, only M attempts shall success
+ pthread_t tid2[THREAD_NUM];
+ for (int j = 0; j < THREAD_NUM; j++) {
+ ret = pthread_create(tid2 + j, NULL, thread_add_group, NULL);
+ if (ret < 0) {
+ pr_info("thread create failed.");
+ return -1;
+ }
+ }
+
+ // wait for add_group threads to return
+ for (int j = 0; j < THREAD_NUM; j++) {
+ void *tret;
+ ret = pthread_join(tid2[j], &tret);
+ if (ret < 0) {
+ pr_info("thread join failed.");
+ ret = -1;
+ }
+ if ((long)tret != 0) {
+ pr_info("thread %d failed.", j);
+ ret = -1;
+ } else {
+ pr_info("add group thread %d return success!!", j);
+ }
+ }
+
+ // wait for work threads to return
+ for (int i = 0; i < THREAD_NUM; i++) {
+ void *tret;
+ ret = pthread_join(tid1[i], &tret);
+ if (ret < 0) {
+ pr_info("thread join failed.");
+ ret = -1;
+ }
+ if ((long)tret != 0) {
+ pr_info("thread %d failed.", i);
+ ret = -1;
+ } else {
+ pr_info("work thread %d return success!!", i);
+ }
+ }
+
+ return ret;
+}
+
+/* testcase1: 10个线程对所有加入的组执行查询 + alloc routine，另外10个线程负责加入新组*/
+static int testcase1(void)
+{
+ int ret = 0;
+
+ ret = process_routine();
+
+ int group_query_final;
+ query_func(&group_query_final, NULL);
+ pr_info("group query final is %d", group_query_final);
+ if (group_query_final != GROUP_NUM)
+ ret = -1;
+
+ pr_info("add_success: %d, add_fail: %d", add_success, add_fail);
+ if (add_success != GROUP_NUM || (add_fail + add_success) != THREAD_NUM * GROUP_NUM)
+ ret = -1;
+
+ add_success = add_fail = 0;
+ return ret;
+}
+
+/* testcase2: fork 新进程，令其一边调用alloc/k2u/u2k等API，一边开新线程加入新组 */
+static int testcase2(void)
+{
+ int ret = 0;
+
+ ret = process_routine();
+
+ // fork child processes, they should not copy parent's group
+ pid_t childs[PROCESS_NUM];
+ for (int k = 0; k < PROCESS_NUM; k++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed.");
+ return -1;
+ } else if (pid == 0) {
+ exit(process_routine());
+ }
+ childs[k] = pid;
+ }
+
+ for (int k = 0; k < PROCESS_NUM; k++) {
+ int status;
+ if (waitpid(childs[k], &status, 0) < 0) {
+ pr_info("waitpid failed");
+ ret = -1;
+ }
+ if (status != 0) {
+ pr_info("child process %d pid %d exit unexpected, return value = %d", k, childs[k], status);
+ ret = -1;
+ } else {
+ pr_info("process %d exit success", k);
+ }
+ childs[k] = 0;
+ }
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "10个线程对所有加入的组执行查询 + alloc routine，另外10个线程负责加入新组")
+ TESTCASE_CHILD(testcase2, "进程一边调用alloc/k2u/u2k等API，一边开新线程加入新组")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/function_test/test_non_dvpp_group.c b/tools/testing/sharepool/testcase/function_test/test_non_dvpp_group.c
new file mode 100644
index 000000000000..008b0f803cb9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/test_non_dvpp_group.c
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2022. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Tue Apr 26 09:20:13 2022
+ */
+
+/*
+ * 针对non_dvpp组进行测试
+ * 1. 进程加组，设置non_dvpp标志，申请普通内存，申请成功
+ * 2. 进程加组，设置non_dvpp标志，申请dvpp内存，申请失败
+ * 3. 进程加组，设置non_dvpp标志，k2u 普通内存，成功
+ * 4. 进程加组，设置non_dvpp标志，k2u DVPP内存，失败
+ * 5. 进程加两个组，分别为普通组和non_dvpp组，两个组分别申请普通内存和DVPP内存，调整申请顺序和加组顺序来一遍
+ * 6. 进程加两个组，分别为普通组和non_dvpp组，两个组分别申请普通内存和DVPP内存
+ * 大页重复一遍
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/shm.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+// 加组内存
+static int case1(unsigned long flag)
+{
+ int ret = wrap_add_group_non_dvpp(getpid(), PROT_READ|PROT_WRITE, SPG_ID_AUTO);
+ if (ret < 0) {
+ pr_info("add group failed: %d", ret);
+ abort();
+ }
+
+ char *buf = wrap_sp_alloc(ret, 1024, flag);
+ if (buf == (void *)-1)
+ return -1;
+
+ *buf = 'a';
+
+ return 0;
+}
+
+static int testcase1(void) { return case1(0); } // 小页，普通内存，成功
+static int testcase2(void) { return case1(SP_HUGEPAGE_ONLY); } // 大页，普通内存，成功
+static int testcase3(void) { return !case1(SP_DVPP); } // 小页，DVPP内存，失败
+static int testcase4(void) { return !case1(SP_DVPP|SP_HUGEPAGE_ONLY); } // 大页，DVPP内存，失败
+
+// 直调内存
+static int case2(unsigned long flag)
+{
+ int ret = wrap_add_group_non_dvpp(getpid(), PROT_READ|PROT_WRITE, SPG_ID_AUTO);
+ if (ret < 0) {
+ pr_info("add group failed: %d", ret);
+ abort();
+ }
+
+ char *buf = wrap_sp_alloc(SPG_ID_DEFAULT, 1024, flag);
+ if (buf == (void *)-1)
+ return -1;
+
+ *buf = 'a';
+
+ return 0;
+}
+
+static int testcase5(void) { return case2(0); } // 小页，普通内存，成功
+static int testcase6(void) { return case2(SP_HUGEPAGE_ONLY); } // 大页，普通内存，成功
+static int testcase7(void) { return case2(SP_DVPP); } // 小页，DVPP内存，成功
+static int testcase8(void) { return case2(SP_DVPP|SP_HUGEPAGE_ONLY); } // 大页，DVPP内存，成功
+
+// k2group
+static int case3(unsigned long flag)
+{
+ int ret = wrap_add_group_non_dvpp(getpid(), PROT_READ|PROT_WRITE, SPG_ID_AUTO);
+ if (ret < 0) {
+ pr_info("add group failed: %d", ret);
+ abort();
+ }
+
+ unsigned long kva = wrap_vmalloc(1024, flag & SP_HUGEPAGE_ONLY);
+ if (!kva) {
+ pr_info("alloc kva failed: %#lx", flag);
+ abort();
+ }
+
+ char *buf = (char *)wrap_k2u(kva, 1024, ret, flag & ~SP_HUGEPAGE_ONLY);
+ if (!buf)
+ return -1;
+
+ *buf = 'a';
+
+ return 0;
+}
+
+static int testcase9(void) { return case3(0); } // 小页，普通内存，成功
+static int testcase10(void) { return case3(SP_HUGEPAGE_ONLY); } // 大页，普通内存，成功
+static int testcase11(void) { return !case3(SP_DVPP); } // 小页，DVPP内存，失败
+static int testcase12(void) { return !case3(SP_DVPP|SP_HUGEPAGE_ONLY); } // 大页，DVPP内存，失败
+
+// k2task
+static int case4(unsigned long flag)
+{
+ int ret = wrap_add_group_non_dvpp(getpid(), PROT_READ|PROT_WRITE, SPG_ID_AUTO);
+ if (ret < 0) {
+ pr_info("add group failed: %d", ret);
+ abort();
+ }
+
+ unsigned long kva = wrap_vmalloc(1024, flag & SP_HUGEPAGE_ONLY);
+ if (!kva) {
+ pr_info("alloc kva failed: %#lx", flag);
+ abort();
+ }
+
+ char *buf = (char *)wrap_k2u(kva, 1024, SPG_ID_DEFAULT, flag & ~SP_HUGEPAGE_ONLY);
+ if ((unsigned long)buf < 0)
+ return -1;
+
+ *buf = 'a';
+
+ return 0;
+}
+static int testcase13(void) { return case4(0); } // 小页，普通内存，成功
+static int testcase14(void) { return case4(SP_HUGEPAGE_ONLY); } // 大页，普通内存，成功
+static int testcase15(void) { return case4(SP_DVPP); } // 小页，DVPP内存，成功
+static int testcase16(void) { return case4(SP_DVPP|SP_HUGEPAGE_ONLY); } // 大页，DVPP内存，成功
+
+static struct testcase_s testcases[] = {
+// TESTCASE_CHILD(testcase1, true)
+// TESTCASE_CHILD(testcase2, true)
+// TESTCASE_CHILD(testcase3, false)
+// TESTCASE_CHILD(testcase4, false)
+// TESTCASE_CHILD(testcase5, true)
+// TESTCASE_CHILD(testcase6, true)
+// TESTCASE_CHILD(testcase7, true)
+// TESTCASE_CHILD(testcase8, true)
+// TESTCASE_CHILD(testcase9, true)
+// TESTCASE_CHILD(testcase10, true)
+// TESTCASE_CHILD(testcase11, false)
+// TESTCASE_CHILD(testcase12, false)
+// TESTCASE_CHILD(testcase13, true)
+// TESTCASE_CHILD(testcase14, true)
+// TESTCASE_CHILD(testcase15, true)
+// TESTCASE_CHILD(testcase16, true)
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/function_test/test_sp_ro.c b/tools/testing/sharepool/testcase/function_test/test_sp_ro.c
new file mode 100644
index 000000000000..769feb7afa94
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/test_sp_ro.c
@@ -0,0 +1,719 @@
+#include "sharepool_lib.h"
+#include "sem_use.h"
+#include <stdlib.h>
+#include <errno.h>
+#include <assert.h>
+#include <pthread.h>
+#include <sys/types.h>
+
+#define PROC_NUM 8
+#define THREAD_NUM 5
+#define GROUP_NUM 16
+#define ALLOC_TYPE 4
+#define REPEAT_TIMES 2
+#define ALLOC_SIZE PAGE_SIZE
+#define PROT (PROT_READ | PROT_WRITE)
+
+static int group_ids[GROUP_NUM];
+static int default_id = 1;
+static int semid;
+
+static int add_multi_group();
+static int check_multi_group();
+static int delete_multi_group();
+static int process();
+void *thread_and_process_helper(int group_id);
+void *del_group_thread(void *arg);
+void *del_proc_from_group(void *arg);
+
+// SP_PROT_FOCUS 内存申请测试
+static int testcase1(void)
+{
+ int ret = 0;
+ void *pret;
+ unsigned long page_size = PAGE_SIZE;
+
+ // add process to group
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ // alloc memory with SP_PROT_FOCUS | SP_PROT_RO
+ pret = wrap_sp_alloc(default_id, page_size, SP_PROT_FOCUS | SP_PROT_RO);
+ if (pret == (void *)-1) {
+ pr_info("process %d alloc failed.", getpid());
+ ret = -1;
+ } else {
+ pr_info("process %d alloc success.", getpid());
+ ret = 0;
+ }
+
+ // mprotect() should fail
+ ret = mprotect(pret, page_size, PROT_WRITE);
+ if (!(ret && errno == EACCES)) {
+ pr_info("mprotect should fail, %d, %d\n", ret, errno);
+ return ret;
+ }
+
+ // memset should fail and generate a SIGSEGV
+ memset((void *)pret, 0, page_size);
+
+ return -1;
+}
+
+// SP_PROT_FOCUS 单独使用测试
+static int testcase2(void)
+{
+ int ret = 0;
+ void *pret;
+ unsigned long page_size = PAGE_SIZE;
+
+ // add process to group
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ // alloc memory with SP_PROT_FOCUS, should fail
+ pret = wrap_sp_alloc(default_id, page_size, SP_PROT_FOCUS);
+ if (pret == (void *)-1) {
+ pr_info("process %d alloc failed.", getpid());
+ ret = 0;
+ } else {
+ pr_info("process %d alloc success.", getpid());
+ ret = -1;
+ }
+
+ return ret;
+}
+
+// SP_PROT_FOCUS | SP_HUGEPAGE 错误使用测试
+static int testcase3(void)
+{
+ int ret = 0;
+ void *pret;
+ unsigned long page_size = PAGE_SIZE;
+
+ // add process to group
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ // alloc memory with SP_PROT_FOCUS | SP_HUGEPAGE, should fail
+ pret = wrap_sp_alloc(default_id, page_size, SP_PROT_FOCUS | SP_HUGEPAGE);
+ if (pret == (void *)-1) {
+ pr_info("process %d alloc failed.", getpid());
+ ret = 0;
+ } else {
+ pr_info("process %d alloc success.", getpid());
+ ret = -1;
+ }
+
+ return ret;
+}
+
+// SP_PROT_FOCUS | SP_DVPP 错误使用测试
+static int testcase4(void)
+{
+ int ret = 0;
+ void *pret;
+ unsigned long page_size = PAGE_SIZE;
+
+ // add process to group
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ // alloc memory with SP_PROT_FOCUS | SP_DVPP, should fail
+ pret = wrap_sp_alloc(default_id, page_size, SP_PROT_FOCUS | SP_DVPP);
+ if (pret == (void *)-1) {
+ pr_info("process %d alloc failed.", getpid());
+ ret = 0;
+ } else {
+ pr_info("process %d alloc success.", getpid());
+ ret = -1;
+ }
+
+ return ret;
+}
+
+// SP_PROT_FOCUS | SP_PROT_RO | SP_HUGEPAGE 联合使用测试，预计成功
+static int testcase5(void)
+{
+ int ret = 0;
+ void *pret;
+ unsigned long page_size = PAGE_SIZE;
+
+ // add process to group
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ // alloc memory with SP_PROT_FOCUS | SP_PROT_RO | SP_HUGEPAGE, should succes
+ pret = wrap_sp_alloc(default_id, page_size, SP_PROT_FOCUS | SP_PROT_RO | SP_HUGEPAGE);
+ pr_info("pret is %d", pret);
+ if (pret == (void *)-1) {
+ pr_info("process %d alloc failed.", getpid());
+ ret = -1;
+ } else {
+ pr_info("process %d alloc success.", getpid());
+ ret = 0;
+ }
+
+ return ret;
+}
+
+// SP_PROT_FOCUS | SP_PROT_RO | SP_DVPP 错误使用测试
+static int testcase6(void)
+{
+ int ret = 0;
+ void *pret;
+ unsigned long page_size = PAGE_SIZE;
+
+ // add process to group
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ // alloc memory with SP_PROT_FOCUS | SP_PROT_RO | SP_DVPP, should fail
+ pret = wrap_sp_alloc(default_id, page_size, SP_PROT_FOCUS | SP_PROT_RO | SP_DVPP);
+ if (pret == (void *)-1) {
+ pr_info("process %d alloc failed.", getpid());
+ ret = 0;
+ } else {
+ pr_info("process %d alloc success.", getpid());
+ ret = -1;
+ }
+
+ return ret;
+}
+
+// SP_RO区域内存上限测试
+static int testcase7(void)
+{
+ int ret = 0;
+ void *pret;
+ unsigned long page_size = PAGE_SIZE;
+ unsigned long sp_ro_1GB = 1073741824;
+
+ // add process to group
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ // alloc 64GB memory in SP_RO area
+ for (int i = 0; i < 64; i++){
+ pret = wrap_sp_alloc(default_id, sp_ro_1GB, SP_PROT_FOCUS | SP_PROT_RO);
+ if (pret == (void *)-1) {
+ pr_info("process %d alloc 1GB %d time failed.", getpid(),i+1);
+ ret = -1;
+ return ret;
+ } else {
+ pr_info("process %d alloc 1GB %d time success.", getpid(),i+1);
+ ret = 0;
+ }
+ }
+
+ // alloc another 4k memory in SP_RO area
+ pret = wrap_sp_alloc(default_id, page_size, SP_PROT_FOCUS | SP_PROT_RO);
+ if (pret == (void *)-1) {
+ pr_info("process %d alloc another 4k failed.", getpid());
+ ret = 0;
+ } else {
+ pr_info("process %d alloc another 4k success.", getpid());
+ ret = -1;
+ }
+
+ return ret;
+}
+
+// SP_RO区域内存最小粒度测试
+static int testcase8(void)
+{
+ int ret = 0;
+ void *pret;
+ unsigned long page_size = PAGE_SIZE;
+ int times = 32768;
+
+ // add process to group
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ // min memory block in SP_RO area is 2M, alloc 32768 times memory in SP_RO area can exhaust whole 64GB memory
+ for (int i = 0; i < times; i++){
+ pret = wrap_sp_alloc(default_id, page_size, SP_PROT_FOCUS | SP_PROT_RO);
+ unsigned long addr_to_print = (unsigned long)pret;
+ pr_info("memory address is %lx",addr_to_print);
+ if (pret == (void *)-1) {
+ pr_info("process %d alloc memory %d time failed.", getpid(),i+1);
+ ret = -1;
+ return ret;
+ } else {
+ pr_info("process %d alloc memory %d time success.", getpid(),i+1);
+ ret = 0;
+ }
+ }
+
+ // alloc another 4k memory in SP_RO area
+ pret = wrap_sp_alloc(default_id, page_size, SP_PROT_FOCUS | SP_PROT_RO);
+
+ if (pret == (void *)-1) {
+ pr_info("process %d alloc another 4k failed.", getpid());
+ ret = 0;
+ } else {
+ pr_info("process %d alloc another 4k success.", getpid());
+ ret = -1;
+ }
+
+ return ret;
+}
+
+//多进程SP_RO内存申请释放并发压力测试
+static int testcase9(void)
+{
+ int proc_num = 1000;
+ int prints_num = 3;
+ int ret = 0;
+ unsigned long page_size = PAGE_SIZE;
+ int childs[proc_num];
+ int prints[prints_num];
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("parent %d add into group failed. errno: %d", getpid(), ret);
+ return -1;
+ }
+
+ // create process alloc and free SP_RO memory
+ for (int i = 0; i < proc_num; i++) {
+ int pid = fork();
+ if (pid == 0) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+
+ while (1) {
+ void * pret;
+ pret = wrap_sp_alloc(default_id, page_size, SP_PROT_FOCUS | SP_PROT_RO);
+ if (pret == (void *)-1) {
+ pr_info("process %d alloc failed.", getpid());
+ } else {
+ pr_info("process %d alloc success.", getpid());
+ }
+ ret = wrap_sp_free(pret);
+ if (ret < 0) {
+ pr_info("process %d free failed.", getpid());
+ } else {
+ pr_info("process %d free success.", getpid());
+ }
+ }
+ }
+ else {
+ childs[i] = pid;
+ }
+ }
+
+ // print sharepool maintenance interface
+ for(int i = 0; i < prints_num; i++){
+ int pid = fork();
+ if (pid == 0) {
+ while (1) {
+ sharepool_print();
+ usleep(10000);
+ }
+ }
+ else {
+ prints[i] = pid;
+ }
+ }
+
+ sleep(1);
+
+ // clear the process
+ for (int i = 0; i < PROC_NUM; i++) {
+ kill(childs[i], SIGKILL);
+ int status;
+ waitpid(childs[i], &status, 0);
+ }
+ for (int i = 0; i < prints_num; i++) {
+ kill(prints[i], SIGKILL);
+ int status;
+ waitpid(prints[i], &status, 0);
+ }
+
+ return 0;
+}
+
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD_SIGNAL(testcase1, SIGSEGV, "SP_PROT_FOCUS 内存申请测试")
+ TESTCASE_CHILD(testcase2, "SP_PROT_FOCUS 单独使用测试")
+ TESTCASE_CHILD(testcase3, "SP_PROT_FOCUS | SP_HUGEPAGE 错误使用测试")
+ TESTCASE_CHILD(testcase4, "SP_PROT_FOCUS | SP_DVPP 错误使用测试")
+ TESTCASE_CHILD(testcase5, "SP_PROT_FOCUS | SP_PROT_RO | SP_HUGEPAGE 错误使用测试")
+ TESTCASE_CHILD(testcase6, "SP_PROT_FOCUS | SP_PROT_RO | SP_DVPP 错误使用测试")
+ TESTCASE_CHILD(testcase7, "SP_RO区域内存上限测试")
+ TESTCASE_CHILD(testcase8, "SP_RO区域内存最小粒度测试")
+ //TESTCASE_CHILD(testcase9, "多进程SP_RO内存申请释放并发压力测试")
+};
+
+
+static int add_multi_group()
+{
+ int ret;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ };
+ for (int i = 0; i < GROUP_NUM; i++) {
+ group_ids[i] = i + 1;
+ ag_info.spg_id = group_ids[i];
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("proc%d add group%d failed", getpid(), group_ids[i]);
+ return -1;
+ }
+ }
+
+ return ret;
+}
+
+static int check_multi_group()
+{
+ int ret;
+ // query groups
+ int spg_ids[GROUP_NUM];
+ int group_num = GROUP_NUM;
+ struct sp_group_id_by_pid_info find_group_info = {
+ .num = &group_num,
+ .spg_ids = spg_ids,
+ .pid = getpid(),
+ };
+ ret = ioctl_find_group_by_pid(dev_fd, &find_group_info);
+ if (ret < 0) {
+ pr_info("find group id by pid failed");
+ return ret;
+ } else
+ for (int i = 0; i < GROUP_NUM; i++)
+ if (spg_ids[i] != group_ids[i]) {
+ pr_info("group id %d not consistent", i);
+ ret = -1;
+ }
+ return ret;
+}
+
+static int delete_multi_group()
+{
+ int ret = 0;
+ int fail = 0, suc = 0;
+ // delete from all groups
+ for (int i = 0; i < GROUP_NUM; i++) {
+ ret = wrap_del_from_group(getpid(), group_ids[i]);
+ if (ret < 0) {
+ //pr_info("process %d delete from group %d failed, errno: %d", getpid(), group_ids[i], errno);
+ fail++;
+ }
+ else {
+ pr_info("process %d delete from group %d success", getpid(), group_ids[i]);
+ suc++;
+ }
+ }
+
+ return fail;
+}
+
+static int process()
+{
+ int ret = 0;
+ for (int j = 0; j < REPEAT_TIMES; j++) {
+ for (int i = 0; i < GROUP_NUM; i++) {
+ ret = thread_and_process_helper(group_ids[i]);
+ if (ret < 0) {
+ pr_info("thread_and_process_helper failed");
+ return -1;
+ }
+ }
+ }
+
+ return ret;
+}
+
+static int try_del_from_group(int group_id)
+{
+ int ret = wrap_del_from_group(getpid(), group_id);
+ return -errno;
+}
+
+void *thread_and_process_helper(int group_id)
+{
+ int ret = 0, i;
+ pid_t pid;
+ bool judge_ret = true;
+ struct sp_alloc_info alloc_info[ALLOC_TYPE] = {0};
+ struct sp_make_share_info u2k_info[ALLOC_TYPE] = {0}, k2u_info = {0}, k2u_huge_info = {0};
+ struct vmalloc_info vmalloc_info = {0}, vmalloc_huge_info = {0};
+ char *addr;
+
+ /* check sp group */
+ pid = getpid();
+
+ // 大页
+ alloc_info[0].flag = SP_HUGEPAGE;
+ alloc_info[0].spg_id = group_id;
+ alloc_info[0].size = 2 * PMD_SIZE;
+
+ // 大页 DVPP
+ alloc_info[1].flag = SP_DVPP | SP_HUGEPAGE;
+ alloc_info[1].spg_id = group_id;
+ alloc_info[1].size = 2 * PMD_SIZE;
+
+ // 普通页 DVPP
+ alloc_info[2].flag = SP_DVPP;
+ alloc_info[2].spg_id = group_id;
+ alloc_info[2].size = 4 * PAGE_SIZE;
+
+ // 普通页
+ alloc_info[3].flag = 0;
+ alloc_info[3].spg_id = group_id;
+ alloc_info[3].size = 4 * PAGE_SIZE;
+
+ /* alloc & u2k */
+ for (i = 0; i < ALLOC_TYPE; i++) {
+ /* sp_alloc */
+ ret = ioctl_alloc(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed at %dth alloc.\n", i);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(alloc_info[i].addr)) {
+ pr_info("sp_alloc return err is %ld\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("sp_alloc return addr %lx\n", alloc_info[i].addr);
+ }
+ }
+
+ /* check sp_alloc addr */
+ judge_ret = ioctl_judge_addr(dev_fd, alloc_info[i].addr);
+ if (judge_ret != true) {
+ pr_info("expect a valid share pool addr %lx\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("addr %lx is a valid share pool addr\n", alloc_info[i].addr);
+ }
+
+ /* prepare for u2k */
+ addr = (char *)alloc_info[i].addr;
+ if (alloc_info[i].flag & SP_HUGEPAGE) {
+ addr[0] = 'd';
+ addr[PMD_SIZE - 1] = 'c';
+ addr[PMD_SIZE] = 'b';
+ addr[PMD_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_hugepage_checker = true;
+ } else {
+ addr[0] = 'd';
+ addr[PAGE_SIZE - 1] = 'c';
+ addr[PAGE_SIZE] = 'b';
+ addr[PAGE_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_checker = true;
+ }
+
+ u2k_info[i].uva = alloc_info[i].addr;
+ u2k_info[i].size = alloc_info[i].size;
+ u2k_info[i].pid = pid;
+
+ /* u2k */
+ ret = ioctl_u2k(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl u2k failed\n");
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(u2k_info[i].addr)) {
+ pr_info("u2k return err is %ld.\n", u2k_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("u2k return addr %lx, check memory content succ.\n",
+ // u2k_info[i].addr);
+ }
+ }
+ }
+ assert(try_del_from_group(group_id) == -EINVAL);
+
+ /* prepare for vmalloc */
+ vmalloc_info.size = 3 * PAGE_SIZE;
+ vmalloc_huge_info.size = 3 * PMD_SIZE;
+
+ /* vmalloc */
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vmalloc_hugepage(dev_fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vmalloc huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* prepare for k2u */
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+ k2u_info.sp_flags = 0;
+ k2u_info.pid = pid;
+ k2u_info.spg_id = group_id;
+
+ k2u_huge_info.kva = vmalloc_huge_info.addr;
+ k2u_huge_info.size = vmalloc_huge_info.size;
+ k2u_huge_info.sp_flags = SP_DVPP;
+ k2u_huge_info.pid = pid;
+ k2u_huge_info.spg_id = group_id;
+
+ /* k2u */
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_info.addr)) {
+ pr_info("k2u return err is %ld.\n",
+ k2u_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u return addr %lx\n", k2u_info.addr);
+ }
+ }
+
+ ret = ioctl_k2u(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u hugepage error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_huge_info.addr)) {
+ pr_info("k2u hugepage return err is %ld.\n",
+ k2u_huge_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u hugepage return addr %lx\n", k2u_huge_info.addr);
+ }
+ }
+ assert(try_del_from_group(group_id) == -EINVAL);
+
+ /* check k2u memory content */
+ addr = (char *)k2u_info.addr;
+ if (addr[0] != 'a' || addr[PAGE_SIZE - 1] != 'b' ||
+ addr[PAGE_SIZE] != 'c' || addr[2 * PAGE_SIZE - 1] != 'd') {
+ pr_info("check vmalloc memory failed\n");
+ goto error;
+ } else {
+ //pr_info("check vmalloc memory succeess\n");
+ }
+
+ addr = (char *)k2u_huge_info.addr;
+ if (addr[0] != 'a' || addr[PMD_SIZE - 1] != 'b' ||
+ addr[PMD_SIZE] != 'c' || addr[2 * PMD_SIZE - 1] != 'd') {
+ pr_info("check vmalloc_hugepage memory failed: %c %c %c %c\n",
+ addr[0], addr[PMD_SIZE - 1], addr[PMD_SIZE], addr[2 * PMD_SIZE - 1]);
+ goto error;
+ } else {
+ //pr_info("check vmalloc_hugepage memory succeess\n");
+ }
+
+ /* unshare uva */
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("sp unshare uva error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_unshare(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("sp unshare hugepage uva error: %d\n", ret);
+ goto error;
+ }
+
+ /* kvfree */
+ ioctl_vfree(dev_fd, &vmalloc_info);
+ ioctl_vfree(dev_fd, &vmalloc_huge_info);
+ assert(try_del_from_group(group_id) == -EINVAL);
+
+ /* unshare kva & sp_free*/
+ for (i = 0; i < ALLOC_TYPE; i++) {
+ /* unshare kva */
+ ret = ioctl_unshare(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("sp_unshare kva return error: %d\n", ret);
+ goto error;
+ }
+
+ /* sp_free */
+ ret = ioctl_free(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("sp_free return error: %d\n", ret);
+ goto error;
+ }
+ }
+
+ return 0;
+
+error:
+ return -1;
+}
+
+void *del_group_thread(void *arg)
+{
+ int ret = 0;
+ int i = (int)arg;
+
+ sem_inc_by_one(semid);
+ sem_check_zero(semid);
+
+ pr_info("thread %d now tries to exit from group %d", getpid() + i + 1, default_id);
+ ret = wrap_del_from_group(getpid() + i + 1, default_id);
+ if (ret < 0)
+ pthread_exit((void *)-1);
+ pthread_exit((void *)0);
+}
+
+void *del_proc_from_group(void *arg)
+{
+ sem_dec_by_one(semid);
+ pthread_exit((void *)(wrap_del_from_group((int)arg, default_id)));
+}
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/function_test/test_two_user_process.c b/tools/testing/sharepool/testcase/function_test/test_two_user_process.c
new file mode 100644
index 000000000000..62d44eaf154f
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/test_two_user_process.c
@@ -0,0 +1,626 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 18 06:46:36 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h> // exit
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+
+static jmp_buf testcase1_env;
+static int testcase1_sigsegv_result = -1;
+static void testcase1_sigsegv_handler(int num)
+{
+ pr_info("segment fault occurs");
+ testcase1_sigsegv_result = 0;
+ longjmp(testcase1_env, 1);
+}
+
+/*
+ * 测试点1：用户态进程A加组后分配内存，A创建B，并且给B加组，进程B加组成功后写内存成功，
+ * 进程A读内存成功，然后释放内存，进程B写失败。
+ * (申请者读，free，其他进程写)
+ */
+static int testcase1_grandchild1(sem_t *sync, sem_t *grandsync, int group_id,
+ unsigned long addr, unsigned long size)
+{
+ int ret;
+
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ ret = ioctl_find_first_group(dev_fd, getpid());
+ if (ret != group_id) {
+ pr_info("unexpected group_id: %d", ret);
+ sem_post(grandsync);
+ return -1;
+ }
+
+ if (!ioctl_judge_addr(dev_fd, addr)) {
+ pr_info("invalid address");
+ sem_post(grandsync);
+ return -1;
+ }
+
+ memset((void *)addr, 'm', size);
+
+ sem_post(grandsync);
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ testcase1_sigsegv_result = -1;
+ struct sigaction sa = {0};
+ sa.sa_handler = testcase1_sigsegv_handler;
+ sigaction(SIGSEGV, &sa, NULL);
+ ret = setjmp(testcase1_env);
+ if (!ret)
+ *(char *)addr = 'a';
+ if (testcase1_sigsegv_result) {
+ pr_info("sp_free has no effect");
+ ret = -1;
+ } else
+ ret = 0;
+
+ return ret;
+}
+
+static int testcase1_child1(struct sp_alloc_info *alloc_info)
+{
+ int ret;
+ int group_id = alloc_info->spg_id;
+
+ char *sync_name = "/testcase1_sync1";
+ sem_t *sync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name);
+
+ char *grandsync_name = "/testcase1_grandsync1";
+ sem_t *grandsync = sem_open(grandsync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(grandsync_name);
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret) {
+ pr_info("add group failed, errno: %d", errno);
+ return -1;
+ }
+
+ ret = ioctl_alloc(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork error");
+ return -1;
+ } else if (pid == 0) {
+ exit(testcase1_grandchild1(sync, grandsync, group_id, alloc_info->addr, alloc_info->size));
+ }
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret) {
+ pr_info("add group failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ sem_post(sync);
+ ret = sem_wait(grandsync);
+ if (ret < 0) {
+ pr_info("sem wait failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ char *buf = (char *)alloc_info->addr;
+ for (unsigned long i = 0; i < alloc_info->size; i++) {
+ if (buf[i] != 'm') {
+ pr_info("data check failed");
+ goto error_out;
+ }
+ }
+
+ ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ sem_post(sync);
+
+ int status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status))
+ return -1;
+
+ ret = ioctl_find_first_group(dev_fd, pid);
+ if (!(ret < 0)) {
+ pr_info("ioctl_find_group_by_pid failed, ret: %d, errno: %d", ret, errno);
+ return -1;
+ } else
+ return 0;
+
+error_out:
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+
+ return ret;
+}
+
+/*
+ * 测试点2：用户态进程A加组，A创建B，并且给B加组，A申请内存，并写入内容，
+ * B读内存成功，然后释放内存N，进程A写失败。
+ * (申请者写，其他进程读，free)
+ */
+#define tc1_MSG_KEY 20
+#define tc1_MSG_TYPE 100
+struct msgbuf_alloc_info {
+ long type;
+ struct sp_alloc_info alloc_info;
+};
+
+static int testcase1_grandchild2(sem_t *sync, sem_t *grandsync, int group_id)
+{
+ int ret;
+
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ ret = ioctl_find_first_group(dev_fd, getpid());
+ if (ret != group_id) {
+ pr_info("unexpected group_id: %d", ret);
+ goto error_out;
+ }
+
+ int msgid = msgget(tc1_MSG_KEY, 0);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ struct msgbuf_alloc_info msgbuf = {0};
+ struct sp_alloc_info *alloc_info = &msgbuf.alloc_info;
+ ret = msgrcv(msgid, &msgbuf, sizeof(*alloc_info), tc1_MSG_TYPE, IPC_NOWAIT);
+ if (ret < 0) {
+ pr_info("msgrcv failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ if (!ioctl_judge_addr(dev_fd, alloc_info->addr)) {
+ pr_info("invalid address");
+ goto error_out;
+ }
+
+ char *buf = (char *)alloc_info->addr;
+ for (unsigned long i = 0; i < alloc_info->size; i++) {
+ if (buf[i] != 'a') {
+ pr_info("data check failed");
+ goto error_out;
+ }
+ }
+
+ ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ sem_post(grandsync);
+
+ return 0;
+
+error_out:
+ sem_post(grandsync);
+ return -1;
+}
+
+static int testcase1_child2(struct sp_alloc_info *alloc_info)
+{
+ int ret;
+ int group_id = ++(alloc_info->spg_id);
+
+ char *sync_name = "/testcase1_sync2";
+ sem_t *sync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name);
+
+ char *grandsync_name = "/testcase1_grandsync2";
+ sem_t *grandsync = sem_open(grandsync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(grandsync_name);
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret) {
+ pr_info("add group failed, errno: %d", errno);
+ return -1;
+ }
+
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork error");
+ return -1;
+ } else if (pid == 0) {
+ exit(testcase1_grandchild2(sync, grandsync, group_id));
+ }
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret) {
+ pr_info("add group failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ ret = ioctl_alloc(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ int msgid = msgget(tc1_MSG_KEY, IPC_CREAT | 0666);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ struct msgbuf_alloc_info msgbuf = {0};
+ msgbuf.type = tc1_MSG_TYPE;
+ memcpy(&msgbuf.alloc_info, alloc_info, sizeof(*alloc_info));
+ ret = msgsnd(msgid, &msgbuf, sizeof(*alloc_info), 0);
+ if (ret < 0) {
+ pr_info("msgsnd failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ memset((void *)alloc_info->addr, 'a', alloc_info->size);
+
+ sem_post(sync);
+ ret = sem_wait(grandsync);
+ if (ret < 0) {
+ pr_info("sem wait failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ testcase1_sigsegv_result = -1;
+ struct sigaction sa = {0};
+ sa.sa_handler = testcase1_sigsegv_handler;
+ sigaction(SIGSEGV, &sa, NULL);
+ ret = setjmp(testcase1_env);
+ if (!ret)
+ *(char *)alloc_info->addr = 'a';
+ if (testcase1_sigsegv_result) {
+ pr_info("sp_free has no effect");
+ ret = -1;
+ goto error_out;
+ }
+
+ waitpid(pid, NULL, 0);
+ ret = ioctl_find_first_group(dev_fd, pid);
+ if (!(ret < 0)) {
+ pr_info("ioctl_find_group_by_pid failed, ret: %d, errno: %d", ret, errno);
+ ret = -1;
+ return ret;
+ } else
+ return 0;
+
+error_out:
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+
+ return ret;
+}
+
+/*
+ * 测试点3：用户态进程，A创建B，并且给B和A加组，B申请内存，并写入内容，
+ * A读内存成功，然后释放内存，进程B写失败。
+ * (其他进程申请内存，写入，owner读，free)
+ */
+static int testcase1_grandchild3(sem_t *sync, sem_t *grandsync, struct sp_alloc_info *alloc_info)
+{
+ int ret;
+ int group_id = alloc_info->spg_id;
+
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ ret = ioctl_find_first_group(dev_fd, getpid());
+ if (ret != group_id) {
+ pr_info("unexpected group_id: %d", ret);
+ goto error_out;
+ }
+
+ ret = ioctl_alloc(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ int msgid = msgget(tc1_MSG_KEY, IPC_CREAT | 0666);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ struct msgbuf_alloc_info msgbuf = {0};
+ msgbuf.type = tc1_MSG_TYPE;
+ memcpy(&msgbuf.alloc_info, alloc_info, sizeof(*alloc_info));
+ ret = msgsnd(msgid, &msgbuf, sizeof(*alloc_info), 0);
+ if (ret < 0) {
+ pr_info("msgsnd failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ memset((void *)alloc_info->addr, 'x', alloc_info->size);
+
+ sem_post(grandsync);
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ sem_post(grandsync);
+
+ return 0;
+
+error_out:
+ sem_post(grandsync);
+ return -1;
+}
+
+static int testcase1_child3(struct sp_alloc_info *alloc_info)
+{
+ int ret;
+ int group_id = alloc_info->spg_id;
+
+ char *sync_name = "/testcase1_sync3";
+ sem_t *sync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name);
+
+ char *grandsync_name = "/testcase1_grandsync3";
+ sem_t *grandsync = sem_open(grandsync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(grandsync_name);
+
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork error");
+ return -1;
+ } else if (pid == 0) {
+ exit(testcase1_grandchild3(sync, grandsync, alloc_info));
+ }
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret) {
+ pr_info("add group failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret) {
+ pr_info("add group failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ sem_post(sync);
+ ret = sem_wait(grandsync);
+ if (ret < 0) {
+ pr_info("sem wait failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ int msgid = msgget(tc1_MSG_KEY, 0);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+ struct msgbuf_alloc_info msgbuf = {0};
+ alloc_info = &msgbuf.alloc_info;
+ ret = msgrcv(msgid, &msgbuf, sizeof(*alloc_info), tc1_MSG_TYPE, IPC_NOWAIT);
+ if (ret < 0) {
+ pr_info("msgrcv failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ if (!ioctl_judge_addr(dev_fd, alloc_info->addr)) {
+ pr_info("invalid address");
+ goto error_out;
+ }
+
+ char *buf = (char *)alloc_info->addr;
+ for (unsigned long i = 0; i < alloc_info->size; i++) {
+ if (buf[i] != 'x') {
+ pr_info("data check failed");
+ goto error_out;
+ }
+ }
+
+ sem_post(sync);
+ do {
+ ret = sem_wait(grandsync);
+ } while (ret < 0 && errno == EINTR);
+
+ testcase1_sigsegv_result = -1;
+ struct sigaction sa = {0};
+ sa.sa_handler = testcase1_sigsegv_handler;
+ sigaction(SIGSEGV, &sa, NULL);
+ ret = setjmp(testcase1_env);
+ if (!ret)
+ *(char *)alloc_info->addr = 'a';
+ if (testcase1_sigsegv_result) {
+ pr_info("sp_free has no effect");
+ ret = -1;
+ goto error_out;
+ }
+
+ waitpid(pid, NULL, 0);
+ ret = ioctl_find_first_group(dev_fd, pid);
+ if (!(ret < 0)) {
+ pr_info("ioctl_find_group_by_pid failed, ret: %d, errno: %d", ret, errno);
+ ret = -1;
+ return ret;
+ }
+
+ return 0;
+
+error_out:
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+
+ return ret;
+}
+
+static int testcase1(void)
+{
+ struct sp_alloc_info alloc_infos[] = {
+ {
+ .flag = 0,
+ .spg_id = 10,
+ .size = 100 * PAGE_SIZE,
+ },
+ {
+ .flag = SP_HUGEPAGE,
+ .spg_id = 12,
+ .size = 10 * PMD_SIZE,
+ },
+ {
+ .flag = SP_DVPP,
+ .spg_id = 19,
+ .size = 100000,
+ },
+ {
+ .flag = SP_DVPP | SP_HUGEPAGE,
+ .spg_id = 19,
+ .size = 10000000,
+ },
+ };
+
+ int (*child_funcs[])(struct sp_alloc_info *) = {
+ testcase1_child1,
+ testcase1_child2,
+ testcase1_child3,
+ };
+
+ for (int j = 0; j < sizeof(child_funcs) / sizeof(child_funcs[0]); j++) {
+ for (int i = 0; i < sizeof(alloc_infos) / sizeof(alloc_infos[0]); i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork error");
+ return -1;
+ } else if (pid == 0) {
+ exit(child_funcs[j](alloc_infos + i));
+ }
+
+ int status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("testcase1 failed!!, i: %d, j: %d", i, j);
+ return -1;
+ }
+ }
+ }
+
+ pr_info("testcase1 success!!");
+ return 0;
+}
+
+/*
+int main()
+{
+ int ret = 0;
+ dev_fd = open_device();
+ if (dev_fd < 0)
+ return -1;
+
+ ret += testcase1();
+
+ close_device(dev_fd);
+ return ret;
+}
+*/
+
+static struct testcase_s testcases[] = {
+ TESTCASE(testcase1, "测试点1：用户态进程A加组后分配内存，A创建B，并且给B加组，进程B加组成功后写内存成功，进程A读内存成功，然后释放内存，进程B写失败。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/function_test/test_u2k.c b/tools/testing/sharepool/testcase/function_test/test_u2k.c
new file mode 100644
index 000000000000..c8d525db8929
--- /dev/null
+++ b/tools/testing/sharepool/testcase/function_test/test_u2k.c
@@ -0,0 +1,490 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Sat Nov 21 02:21:35 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+
+#define tc1_MSG_KEY 20
+#define tc1_MSG_TYPE 100
+struct msgbuf_alloc_info {
+ long type;
+ union {
+ struct sp_alloc_info alloc_info;
+ struct sp_make_share_info share_info;
+ };
+};
+
+/*
+ * 用户态进程A加组后分配并写内存N，u2k共享给内核，内核模块读N成功，
+ * 进程B加组后读N成功。进程A停止共享N后，内核模块读N失败，进程B读N成功。进程A释放内存N。
+ */
+static int grandchild1(sem_t *sync, sem_t *childsync)
+{
+ int ret;
+
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ int msgid = msgget(tc1_MSG_KEY, 0);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ struct msgbuf_alloc_info msgbuf = {0};
+ struct sp_alloc_info *alloc_info = &msgbuf.alloc_info;
+ ret = msgrcv(msgid, &msgbuf, sizeof(*alloc_info), tc1_MSG_TYPE, IPC_NOWAIT);
+ if (ret < 0) {
+ pr_info("msgrcv failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ ret = ioctl_find_first_group(dev_fd, getpid());
+ if (ret != alloc_info->spg_id) {
+ pr_info("unexpected group_id: %d", ret);
+ goto error_out;
+ }
+
+ if (!ioctl_judge_addr(dev_fd, alloc_info->addr)) {
+ pr_info("invalid address");
+ goto error_out;
+ }
+
+ char *buf = (char *)alloc_info->addr;
+ for (int i = 0; i < alloc_info->size; i++) {
+ if (buf[i] != 'z') {
+ pr_info("memory check failed");
+ goto error_out;
+ }
+ }
+
+ sem_post(childsync);
+ return 0;
+
+error_out:
+ sem_post(childsync);
+ return -1;
+}
+
+static int child1(pid_t pid, sem_t *sync, sem_t *childsync)
+{
+ int group_id = 10, ret;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 12345,
+ .spg_id = group_id,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ goto error_out;
+ }
+ memset((void *)alloc_info.addr, 'z', alloc_info.size);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_CHECK,
+ .value = 'z',
+ .addr = u2k_info.addr,
+ .size = u2k_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ goto error_out;
+ }
+
+ pr_info("unshare u2k");
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ /*
+ * unshare之后再访问内存会导致内核挂掉，在手工测试的时候执行
+ */
+#if 0
+ pr_info("recheck karea");
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ goto error_out;
+ }
+
+ pr_info("recheck karea");
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ goto error_out;
+ }
+
+ pr_info("recheck karea");
+ karea_info.mod = KAREA_SET;
+ karea_info.value = 'a';
+ karea_info.size = 1;
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ goto error_out;
+ }
+ pr_info("after karea set, the value is '%c%c'",
+ ((char *)alloc_info.addr)[0], ((char *)alloc_info.addr)[3]);
+#endif
+
+ int msgid = msgget(tc1_MSG_KEY, IPC_CREAT | 0666);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ struct msgbuf_alloc_info msgbuf = {0};
+ msgbuf.type = tc1_MSG_TYPE;
+ memcpy(&msgbuf.alloc_info, &alloc_info, sizeof(alloc_info));
+ ret = msgsnd(msgid, &msgbuf, sizeof(alloc_info), 0);
+ if (ret < 0) {
+ pr_info("msgsnd failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ int status = 0;
+ waitpid(pid, &status, 0);
+
+ return !WIFEXITED(status) || WEXITSTATUS(status) ? -1 : 0;
+
+error_out:
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+ return -1;
+}
+
+static int grandchild2(sem_t *sync, sem_t *childsync)
+{
+ int ret;
+
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ int msgid = msgget(tc1_MSG_KEY, 0);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ struct msgbuf_alloc_info msgbuf1 = {0};
+ struct sp_alloc_info *alloc_info = &msgbuf1.alloc_info;
+ ret = msgrcv(msgid, &msgbuf1, sizeof(*alloc_info), tc1_MSG_TYPE, IPC_NOWAIT);
+ if (ret < 0) {
+ pr_info("msgrcv failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ struct msgbuf_alloc_info msgbuf2 = {0};
+ struct sp_make_share_info *u2k_info = &msgbuf2.share_info;
+ ret = msgrcv(msgid, &msgbuf2, sizeof(*u2k_info), tc1_MSG_TYPE, IPC_NOWAIT);
+ if (ret < 0) {
+ pr_info("msgrcv failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ ret = ioctl_find_first_group(dev_fd, getpid());
+ if (ret != alloc_info->spg_id) {
+ pr_info("unexpected group_id: %d", ret);
+ goto error_out;
+ }
+
+ if (!ioctl_judge_addr(dev_fd, alloc_info->addr)) {
+ pr_info("invalid address");
+ goto error_out;
+ }
+
+ char *buf = (char *)alloc_info->addr;
+ for (int i = 0; i < alloc_info->size; i++) {
+ if (buf[i] != 'k') {
+ pr_info("memory check failed");
+ goto error_out;
+ }
+ }
+
+ pr_info("unshare u2k");
+ ret = ioctl_unshare(dev_fd, u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ /*
+ * unshare之后再访问内存会导致内核挂掉，在手工测试的时候执行
+ */
+#if 0
+ struct karea_access_info karea_info = {
+ .mod = KAREA_CHECK,
+ .value = 'k',
+ .addr = u2k_info->addr,
+ .size = u2k_info->size,
+ };
+ pr_info("recheck karea");
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ goto error_out;
+ }
+
+ pr_info("recheck karea");
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ goto error_out;
+ }
+
+ pr_info("recheck karea");
+ karea_info.mod = KAREA_SET;
+ karea_info.value = 'a';
+ karea_info.size = 1;
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ goto error_out;
+ }
+ pr_info("after karea set, the value is '%c%c'",
+ ((char *)alloc_info->addr)[0], ((char *)alloc_info->addr)[3]);
+#endif
+
+ ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ sem_post(childsync);
+ return 0;
+
+error_out:
+ sem_post(childsync);
+ return -1;
+}
+
+static int child2(pid_t pid, sem_t *sync, sem_t *childsync)
+{
+ int group_id = 10, ret;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 12345,
+ .spg_id = group_id,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ goto error_out;
+ }
+ memset((void *)alloc_info.addr, 'k', alloc_info.size);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_CHECK,
+ .value = 'k',
+ .addr = u2k_info.addr,
+ .size = u2k_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ goto error_out;
+ }
+
+ int msgid = msgget(tc1_MSG_KEY, IPC_CREAT | 0666);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ struct msgbuf_alloc_info msgbuf = {0};
+ msgbuf.type = tc1_MSG_TYPE;
+ memcpy(&msgbuf.alloc_info, &alloc_info, sizeof(alloc_info));
+ ret = msgsnd(msgid, &msgbuf, sizeof(alloc_info), 0);
+ if (ret < 0) {
+ pr_info("msgsnd failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ memcpy(&msgbuf.share_info, &u2k_info, sizeof(u2k_info));
+ ret = msgsnd(msgid, &msgbuf, sizeof(u2k_info), 0);
+ if (ret < 0) {
+ pr_info("msgsnd failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ sem_post(sync);
+ do {
+ ret = sem_wait(childsync);
+ } while (ret < 0 && errno == EINTR);
+
+ int status = 0;
+ waitpid(pid, &status, 0);
+
+ return !WIFEXITED(status) || WEXITSTATUS(status) ? -1 : 0;
+
+error_out:
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+ return -1;
+}
+static int per_test_init(int i, sem_t **sync, sem_t **childsync)
+{
+ char buf[100];
+ sprintf(buf, "/test_u2k%d", i);
+ *sync = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (*sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+
+ sprintf(buf, "/test_u2k_child%d", i);
+ *childsync = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (*childsync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+
+ return 0;
+}
+
+static int testcase(int i, int (*child)(pid_t, sem_t *, sem_t *), int (*grandchild)(sem_t *, sem_t *))
+{
+ sem_t *sync, *childsync;
+ if (per_test_init(i, &sync, &childsync))
+ return -1;
+
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed i=%d", i);
+ return -1;
+ } else if (pid == 0) {
+ exit(grandchild(sync, childsync));
+ }
+
+ return child(pid, sync, childsync);
+}
+
+static struct {
+ int (*child)(pid_t, sem_t *, sem_t *);
+ int (*grandchild)(sem_t *, sem_t *);
+} functions[] = {
+ {
+ .child = child1,
+ .grandchild = grandchild1,
+ },
+ {
+ .child = child2,
+ .grandchild = grandchild2,
+ },
+};
+
+static int testcase1(void) { return testcase(0, functions[0].child, functions[0].grandchild); }
+static int testcase2(void) { return testcase(1, functions[1].child, functions[1].grandchild); }
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "用户态进程A加组后分配并写内存N，u2k共享给内核，内核模块读N成功，进程B加组后读N成功。进程A停止共享N后，内核模块读N失败，进程B读N成功。进程A释放内存N。")
+ TESTCASE_CHILD(testcase2, "用户态进程A加组后分配并写内存N，u2k共享给内核，内核模块读N成功，进程B加组后读N成功。进程A停止共享N后，内核模块读N失败，进程B读N成功。进程A释放内存N。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/generate_list.sh b/tools/testing/sharepool/testcase/generate_list.sh
new file mode 100755
index 000000000000..caba42837a54
--- /dev/null
+++ b/tools/testing/sharepool/testcase/generate_list.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+
+# 在顶层文件夹中
+ # 收集子文件夹中的list文件
+ # 收集文件夹中.c文件的comment
+ # 形成一个list文件
+name=tc_list
+collect_comments()
+{
+ curdir=$1
+ echo $curdir
+
+ cd $curdir
+ rm -rf $name
+
+ subdirs=`ls -d */`
+
+# echo "" >> $name
+ echo "===============================" >> $name
+ echo $curdir >> $name
+ echo "===============================" >> $name
+
+ for dir in $subdirs
+ do
+ dir=${dir%*/}
+ local tmp_dir=$dir
+ collect_comments $dir
+ cat $tmp_dir/$name >> $name
+ echo "" >> $name
+ done
+
+ cfiles=`ls | grep '\.'c`
+ echo $cfiles
+
+ for cfile in $cfiles
+ do
+ echo $cfile >> $name
+ grep "TESTCASE" $cfile -r >> $name
+ echo "" >> $name
+ done
+
+ cd ..
+ echo "back to `pwd`"
+}
+
+collect_comments `pwd`
diff --git a/tools/testing/sharepool/testcase/performance_test/Makefile b/tools/testing/sharepool/testcase/performance_test/Makefile
new file mode 100644
index 000000000000..258bd6582414
--- /dev/null
+++ b/tools/testing/sharepool/testcase/performance_test/Makefile
@@ -0,0 +1,17 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+testcases:=test_perf_sp_alloc \
+ test_perf_sp_k2u \
+ test_perf_sp_add_group \
+ test_perf_process_kill
+
+default: $(testcases)
+
+install: $(testcases) performance_test.sh
+ mkdir -p $(TOOL_BIN_DIR)/performance_test
+ cp $(testcases) $(TOOL_BIN_DIR)/performance_test
+ cp performance_test.sh $(TOOL_BIN_DIR)
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/performance_test/performance_test.sh b/tools/testing/sharepool/testcase/performance_test/performance_test.sh
new file mode 100755
index 000000000000..d3944d7431e7
--- /dev/null
+++ b/tools/testing/sharepool/testcase/performance_test/performance_test.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+./performance_test/test_perf_sp_alloc | grep result | awk -F ']' '{print $2}'
+./performance_test/test_perf_sp_k2u | grep result | awk -F ']' '{print $2}'
+./performance_test/test_perf_sp_add_group | grep result | awk -F ']' '{print $2}'
diff --git a/tools/testing/sharepool/testcase/performance_test/test_perf_process_kill.c b/tools/testing/sharepool/testcase/performance_test/test_perf_process_kill.c
new file mode 100644
index 000000000000..e6abbf8c2d1d
--- /dev/null
+++ b/tools/testing/sharepool/testcase/performance_test/test_perf_process_kill.c
@@ -0,0 +1,174 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Jan 18 08:58:29 2021
+ */
+
+#include <stdlib.h>
+#include <time.h>
+#include "sharepool_lib.h"
+#include "sem_use.h"
+
+#define ALLOC_SIZE (6UL * 1024UL * 1024UL * 1024UL)
+#define CHILD_PROCESS_NUM 12
+
+static int semid;
+
+struct sp_alloc_memory_type {
+ unsigned long normal;
+ unsigned long huge;
+};
+
+struct sp_alloc_memory_type test_memory_types[] = {
+ {
+ .normal = 0,
+ .huge = ALLOC_SIZE,
+ },
+ {
+ .normal = ALLOC_SIZE * (1.0 / 6),
+ .huge = ALLOC_SIZE * (5.0 / 6),
+ },
+ {
+ .normal = ALLOC_SIZE * (3.0 / 6),
+ .huge = ALLOC_SIZE * (3.0 / 6),
+ },
+ {
+ .normal = ALLOC_SIZE * (5.0 / 6),
+ .huge = ALLOC_SIZE * (1.0 / 6),
+ },
+ {
+ .normal = ALLOC_SIZE,
+ .huge = 0,
+ },
+};
+
+static int testcase1_child(int test_index)
+{
+ int ret = 0;
+ int spg_id = test_index + 1;
+ unsigned long normal = test_memory_types[test_index].normal;
+ unsigned long huge = test_memory_types[test_index].huge;
+ time_t kill_start, now;
+
+ sem_set_value(semid, 0);
+
+ // 创建组，申请6G内存，变量为小页占比
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, spg_id);
+ if (ret < 0) {
+ pr_info("add group failed.");
+ return ret;
+ }
+
+ // 申请test-memory-type的内存
+ pr_info("test-momery-type %d test started, allocating memory...", test_index);
+ unsigned long addr = 0;
+ if (normal != 0) {
+ addr = wrap_sp_alloc(spg_id, normal, 0);
+ if (addr == 0) {
+ pr_info("alloc normal memory failed.");
+ return -1;
+ }
+ }
+ if (huge != 0) {
+ addr = wrap_sp_alloc(spg_id, huge, SP_HUGEPAGE_ONLY);
+ if (addr == 0) {
+ pr_info("alloc huge memory failed.");
+ return -1;
+ }
+ }
+ pr_info("child %d alloc memory %lx normal, %lx huge success.", test_index, normal, huge);
+
+ // 将12个子进程加组
+ pid_t child[CHILD_PROCESS_NUM];
+ sem_check_zero(semid);
+ for (int i = 0; i < CHILD_PROCESS_NUM; i++) {
+ int pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed.");
+ return -1;
+ } else if (pid == 0) {
+ wrap_add_group(getpid(), PROT_READ | PROT_WRITE, spg_id);
+ sem_inc_by_one(semid);
+ while (1) {
+
+ }
+ } else {
+ child[i] = pid;
+ }
+ }
+ pr_info("fork all child processes success.");
+
+ // ----- DO -----
+
+ // ----- END -----
+
+ // 并发kill所有子进程
+ sem_dec_by_val(semid, CHILD_PROCESS_NUM);
+ pr_info("all child processes add group success.");
+ time(&now);
+ pr_info("time before kill signal sent is: %d", now);
+ for (int i = 0; i < CHILD_PROCESS_NUM; i++)
+ kill(child[i], SIGKILL);
+ time(&kill_start);
+ pr_info("time after kill signal sent is: %d", kill_start);
+
+ // 记录waitpid完成后所需的时间
+ for (int i = 0; i < CHILD_PROCESS_NUM; i++) {
+ int status;
+ ret = waitpid(child[i], &status, 0);
+
+ time(&now);
+ pr_info("time when child %d exit is %d, time taken is %d seconds.", i, now, now - kill_start);
+ if (ret < 0) {
+ pr_info("waitpid failed.");
+ }
+
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d test failed, %d", i, status);
+ ret = -1;
+ }
+ }
+ sem_check_zero(semid);
+ time(&now);
+ pr_info("time when all child processes exit is %d, time taken is %d seconds.", now, now - kill_start);
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+ int ret = 0;
+ semid = sem_create(1234, "process_sync");
+
+ for (int i = 0; i < sizeof(test_memory_types) / sizeof(test_memory_types[0]); i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork testcase1 child failed.");
+ return -1;
+ } else if (pid == 0) {
+ exit(testcase1_child(i));
+ }
+ int status;
+ waitpid(pid, &status, 0);
+ pr_info("test-momery-type %d test finished.", i);
+ }
+
+ sem_close(semid);
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, true)
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
\ No newline at end of file
diff --git a/tools/testing/sharepool/testcase/performance_test/test_perf_sp_add_group.c b/tools/testing/sharepool/testcase/performance_test/test_perf_sp_add_group.c
new file mode 100644
index 000000000000..c2882be7b0e1
--- /dev/null
+++ b/tools/testing/sharepool/testcase/performance_test/test_perf_sp_add_group.c
@@ -0,0 +1,375 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Description:
+ * Author: Huawei OS Kernel Lab
+ * Create: Sat Mar 13 15:17:32 2021
+ */
+#define _GNU_SOURCE
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+#include <sys/sem.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/sysinfo.h>
+#include <sched.h> /* sched_setaffinity */
+#include <pthread.h>
+
+#include "sharepool_lib.h"
+
+#define NSEC2SEC 1000000000
+
+
+static int cpu_num;
+static int thread_sync;
+
+struct test_perf {
+ int (*perf_start)(void *);
+ int (*perf_point)(void *);
+ int (*perf_end)(void *);
+
+ int count;
+ void *arg;
+ char *name;
+};
+
+struct test_params {
+ int spg_id;
+ unsigned int process_num;
+ /* 申请太小的内存不具生产环境意义，现网至少按GB开始 */
+ unsigned long mem_size_normal; /* unit: MB */
+ unsigned long mem_size_huge; /* unit: MB */
+};
+
+static int test_perf_child(struct test_perf *test_perf)
+{
+ int ret = 0;
+ long dur;
+ struct timespec ts_start, ts_end;
+
+ if (!test_perf->perf_point) {
+ pr_info("you must supply a perf_point routine");
+ return -1;
+ }
+
+ if (test_perf->perf_start) {
+ if (test_perf->perf_start(test_perf->arg)) {
+ pr_info("testcase init failed");
+ ret = -1;
+ goto end;
+ }
+ }
+
+ pr_info(">> testcase %s start <<", test_perf->name);
+ clock_gettime(CLOCK_MONOTONIC, &ts_start);
+ if (test_perf->perf_point(test_perf->arg)) {
+ pr_info("testcase point failed");
+ ret = -1;
+ goto end;
+ }
+ clock_gettime(CLOCK_MONOTONIC, &ts_end);
+
+ dur = (ts_end.tv_sec - ts_start.tv_sec) * NSEC2SEC + (ts_end.tv_nsec - ts_start.tv_nsec);
+
+end:
+ if (test_perf->perf_end) {
+ if (test_perf->perf_end(test_perf->arg)) {
+ pr_info("testcase exit failed");
+ return -1;
+ }
+ }
+
+ if (!ret) {
+ pr_info("%50s result: %10ld", test_perf->name, dur);
+ return 0;
+ } else {
+ return ret;
+ }
+}
+
+static int test_perf_routing(struct test_perf *test_perf)
+{
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(test_perf_child(test_perf));
+ }
+
+ int status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("testcase %s failed", test_perf->name);
+ return -1;
+ }
+
+ return 0;
+}
+
+#define MAX_CHILD_NR 100
+static pid_t childs[MAX_CHILD_NR];
+
+static int sp_add_group_start(void *arg)
+{
+ cpu_set_t mask;
+ struct test_params *params = arg;
+ struct sp_alloc_info alloc_info;
+ unsigned long i, times;
+
+ CPU_ZERO(&mask);
+ CPU_SET(0, &mask); /* parent process runs on CPU0 */
+ if (sched_setaffinity(0, sizeof(cpu_set_t), &mask) == -1) {
+ pr_info("parent process sched_setaffinity failed, errno: %d", errno);
+ return -1;
+ }
+ cpu_num = get_nprocs();
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = params->spg_id,
+ };
+ if (ioctl_add_group(dev_fd, &ag_info)) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+
+ /* allocation begins */
+ alloc_info.spg_id = params->spg_id;
+ alloc_info.flag = 0;
+ alloc_info.size = 16 * PAGE_SIZE;
+ times = params->mem_size_normal * 16; /* from MB to 16 pages */
+ for (i = 0; i < times; i++) {
+ if (ioctl_alloc(dev_fd, &alloc_info)) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return -1;
+ }
+ }
+
+ alloc_info.flag = SP_HUGEPAGE;
+ alloc_info.size = 2 * PMD_SIZE;
+ times = params->mem_size_huge / 4; /* from MB to 2 hugepages */
+ for (i = 0; i < times; i++) {
+ if (ioctl_alloc(dev_fd, &alloc_info)) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return -1;
+ }
+ }
+ /* end of allocation */
+
+ int semid = semget(0xabcd9116, 1, IPC_CREAT | 0644);
+ if (semid < 0) {
+ pr_info("open systemV semaphore failed, errno: %s", strerror(errno));
+ return -1;
+ }
+ int ret = semctl(semid, 0, SETVAL, 0);
+ if (ret < 0) {
+ pr_info("sem setval failed, %s", strerror(errno));
+ goto sem_remove;
+ }
+
+ for (i = 0; i < params->process_num; i++) {
+ pid_t pid = fork();
+
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = 1,
+ .sem_flg = 0,
+ };
+ semop(semid, &sembuf, 1);
+
+ CPU_ZERO(&mask);
+ CPU_SET(i % cpu_num, &mask);
+ if (sched_setaffinity(0, sizeof(cpu_set_t), &mask) == -1) {
+ pr_info("child process %d sched_setaffinity failed, errno: %d", i, errno);
+ return -1;
+ }
+
+ sleep(3600);
+ }
+
+ childs[i] = pid;
+ }
+
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = -params->process_num,
+ .sem_flg = 0,
+ };
+ semop(semid, &sembuf, 1);
+
+sem_remove:
+ if (semctl(semid, IPC_RMID, NULL) < 0)
+ pr_info("sem remove failed, %s", strerror(errno));
+
+ return 0;
+}
+
+static int sp_add_group_point(void *arg)
+{
+ struct test_params *params = arg;
+ struct sp_add_group_info ag_info = {
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = params->spg_id,
+ };
+
+ for (int i = 0; i < params->process_num; i++) {
+ ag_info.pid = childs[i];
+ if (ioctl_add_group(dev_fd, &ag_info)) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+ }
+ return 0;
+}
+
+void *thread_add_group(void *arg)
+{
+ struct sp_add_group_info *ag_info = arg;
+ ag_info->prot = PROT_READ | PROT_WRITE;
+
+ __sync_fetch_and_add(&thread_sync, 1);
+ __sync_synchronize();
+ while (1) {
+ if (thread_sync == 0) {
+ break;
+ }
+ }
+
+ if (ioctl_add_group(dev_fd, ag_info)) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ pthread_exit((void *)1);
+ }
+ pthread_exit((void *)0);
+}
+
+static int sp_add_group_concurrent_point(void *arg)
+{
+ struct test_params *params = arg;
+ struct sp_add_group_info ag_info[MAX_CHILD_NR];
+ pthread_t tid[MAX_CHILD_NR];
+ cpu_set_t mask;
+ int i, ret;
+ void *tret;
+
+ thread_sync = -params->process_num;
+
+ for (i = 0; i < params->process_num; i++) {
+ ag_info[i].spg_id = params->spg_id;
+ ag_info[i].pid = childs[i];
+ ret = pthread_create(tid + i, NULL, thread_add_group, ag_info + i);
+ if (ret != 0) {
+ pr_info("create thread %d error\n", i);
+ return -1;
+ }
+ CPU_ZERO(&mask);
+ CPU_SET(i % cpu_num, &mask);
+ if (pthread_setaffinity_np(tid[i], sizeof(cpu_set_t), &mask) == -1) {
+ pr_info("set thread %d affinity failed, errno: %d", i, errno);
+ return -1;
+ }
+ }
+
+ for (i = 0; i < params->process_num; i++) {
+ ret = pthread_join(tid[i], &tret);
+ if (ret != 0) {
+ pr_info("can't join thread %d\n", i);
+ return -1;
+ }
+ if ((long)tret != 0) {
+ pr_info("testcase execution failed, thread %d exited unexpectedly\n", i);
+ return -1;
+ }
+ }
+ return 0;
+}
+
+static int sp_add_group_end(void *arg)
+{
+ int ret;
+
+ for (int i = 0; i < MAX_CHILD_NR && childs[i]; i++) {
+ kill(childs[i], SIGINT);
+ }
+ return 0;
+}
+
+static struct test_params params[] = {
+ {
+ .spg_id = 1,
+ .process_num = 30,
+ .mem_size_normal = 32,
+ .mem_size_huge = 32,
+ },
+ {
+ .spg_id = 1,
+ .process_num = 30,
+ .mem_size_normal = 1024 * 3.5,
+ .mem_size_huge = 1024 * 5,
+ },
+};
+
+static struct test_perf testcases[] = {
+ {
+ .perf_start = sp_add_group_start,
+ .perf_point = sp_add_group_point,
+ .perf_end = sp_add_group_end,
+ .name = "sp_add_group_P30_N0G_H0G",
+ .arg = ¶ms[0],
+ },
+ {
+ .perf_start = sp_add_group_start,
+ .perf_point = sp_add_group_concurrent_point,
+ .perf_end = sp_add_group_end,
+ .name = "sp_add_group_C_P4_N1G_H1G",
+ .arg = ¶ms[0],
+ },
+ {
+ .perf_start = sp_add_group_start,
+ .perf_point = sp_add_group_point,
+ .perf_end = sp_add_group_end,
+ .name = "sp_add_group_P30_N3.5G_H5G",
+ .arg = ¶ms[1],
+ },
+ {
+ .perf_start = sp_add_group_start,
+ .perf_point = sp_add_group_concurrent_point,
+ .perf_end = sp_add_group_end,
+ .name = "sp_add_group_C_P30_N3.5G_H5G",
+ .arg = ¶ms[1],
+ },
+};
+
+#define STRLENGTH 500
+static char filename[STRLENGTH];
+
+int main()
+{
+ int ret = 0;
+ dev_fd = open_device();
+ if (dev_fd < 0)
+ return -1;
+
+ int passed = 0, failed = 0;
+
+ for (int i = 0; i < sizeof(testcases) / sizeof(testcases[0]); i++) {
+ ret = test_perf_routing(&testcases[i]);
+ ret == 0? passed++: failed++;
+ }
+
+ close_device(dev_fd);
+
+ pr_info("----------------------------");
+ printf("%s All %d testcases finished, passing: %d, failing: %d", extract_filename(filename, __FILE__), passed + failed, passed, failed);
+ printf("-------------------------\n");
+
+ return failed == 0? 0: -1;
+}
diff --git a/tools/testing/sharepool/testcase/performance_test/test_perf_sp_alloc.c b/tools/testing/sharepool/testcase/performance_test/test_perf_sp_alloc.c
new file mode 100644
index 000000000000..1f61dd47719b
--- /dev/null
+++ b/tools/testing/sharepool/testcase/performance_test/test_perf_sp_alloc.c
@@ -0,0 +1,618 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Jan 18 08:58:29 2021
+ */
+
+#define _GNU_SOURCE
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+#include <sys/sem.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/sysinfo.h>
+#include <sched.h> /* sched_setaffinity */
+
+#include "sharepool_lib.h"
+
+#define NSEC2SEC 1000000000
+
+
+static int nr_child_process = 8;
+
+struct test_perf {
+ int (*perf_start)(void *);
+ int (*perf_point)(void *);
+ int (*perf_end)(void *);
+
+ int count;
+ void *arg;
+ char *name;
+};
+
+static int test_perf_child(struct test_perf *test_perf)
+{
+ long sum, max, min, dur;
+ struct timespec ts_start, ts_end;
+
+ sum = max = 0;
+ min = ((unsigned long)-1) >> 1;
+
+ if (!test_perf->perf_point) {
+ pr_info("you must supply a perf_point routine");
+ return -1;
+ }
+
+ if (test_perf->perf_start) {
+ if (test_perf->perf_start(test_perf->arg)) {
+ pr_info("testcase init failed");
+ if (test_perf->perf_end) {
+ if (test_perf->perf_end(test_perf->arg)) {
+ pr_info("testcase exit failed");
+ return -1;
+ }
+ }
+ return -1;
+ }
+ }
+
+ pr_info(">> testcase %s start <<", test_perf->name);
+ for (int i = 0; i < test_perf->count; i++) {
+ clock_gettime(CLOCK_MONOTONIC, &ts_start);
+ if (test_perf->perf_point(test_perf->arg)) {
+ pr_info("testcase point failed, i: %d", i);
+ return -1;
+ }
+ clock_gettime(CLOCK_MONOTONIC, &ts_end);
+
+ dur = (ts_end.tv_sec - ts_start.tv_sec) * NSEC2SEC + (ts_end.tv_nsec - ts_start.tv_nsec);
+ sum += dur;
+ max = max > dur ? max : dur;
+ min = min < dur ? min : dur;
+ }
+ if (test_perf->perf_end) {
+ if (test_perf->perf_end(test_perf->arg)) {
+ pr_info("testcase exit failed");
+ return -1;
+ }
+ }
+
+ pr_info("%50s result: avg: %10ld, max: %10ld, min: %10ld", test_perf->name, sum / test_perf->count, max, min);
+
+ return 0;
+}
+
+static int test_perf_routing(struct test_perf *test_perf)
+{
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(test_perf_child(test_perf));
+ }
+
+ int status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("testcase %s failed", test_perf->name);
+ return -1;
+ } else {
+ pr_info("testcase %s success", test_perf->name);
+ }
+
+ return 0;
+}
+
+static int sp_alloc_start(void *arg)
+{
+ struct sp_alloc_info *alloc_info = arg;
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = alloc_info->spg_id,
+ };
+ if (ioctl_add_group(dev_fd, &ag_info)) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+
+ return 0;
+}
+
+static int sp_alloc_point(void *arg)
+{
+ struct sp_alloc_info *alloc_info = arg;
+
+ if (ioctl_alloc(dev_fd, alloc_info)) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ return 0;
+}
+
+static int sp_alloc_and_free_point(void *arg)
+{
+ struct sp_alloc_info *alloc_info = arg;
+
+ if (ioctl_alloc(dev_fd, alloc_info)) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ if (ioctl_free(dev_fd, alloc_info)) {
+ pr_info("ioctl_free failed, errno: %d", errno);
+ return -1;
+ }
+
+ return 0;
+}
+
+#define MAX_CHILD_NR 100
+static pid_t childs[MAX_CHILD_NR];
+
+/*
+ * 同时创建N个进程加组，后续只有父进程分配内存，预期各个子进程由于建页表
+ * 的开销，会慢一些
+ */
+static int sp_alloc_mult_process_start(void *arg)
+{
+ cpu_set_t mask;
+ struct sp_alloc_info *alloc_info = arg;
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = alloc_info->spg_id,
+ };
+ if (ioctl_add_group(dev_fd, &ag_info)) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+
+ CPU_ZERO(&mask);
+ CPU_SET(0, &mask); /* parent process runs on CPU0 */
+ if (sched_setaffinity(0, sizeof(cpu_set_t), &mask) == -1) {
+ pr_info("parent process sched_setaffinity failed, errno: %d", errno);
+ return -1;
+ }
+
+ for (int i = 0; i < nr_child_process; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ CPU_ZERO(&mask);
+ int cpu_count = get_nprocs();
+ CPU_SET((i + 1) % cpu_count, &mask);
+ if (sched_setaffinity(0, sizeof(cpu_set_t), &mask) == -1) {
+ pr_info("child process %d sched_setaffinity failed, errno: %d", i, errno);
+ exit(-1);
+ }
+
+ while (1) {};
+ }
+
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ if (ioctl_add_group(dev_fd, &ag_info)) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+/* 同时创建7进程 */
+static int sp_alloc_mult_process_start_7(void *arg)
+{
+ nr_child_process = 7;
+ sp_alloc_mult_process_start(arg);
+}
+
+/* 同时创建15进程 */
+static int sp_alloc_mult_process_start_15(void *arg)
+{
+ nr_child_process = 15;
+ sp_alloc_mult_process_start(arg);
+}
+
+static int sp_alloc_end(void *arg)
+{
+ for (int i = 0; i < MAX_CHILD_NR && childs[i]; i++) {
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], NULL, 0);
+ childs[i] = 0;
+ }
+
+ return 0;
+}
+
+// 同时创建N个进程加组，并且子进程也在申请内存
+static int sp_alloc_mult_alloc_start(void *arg)
+{
+ cpu_set_t mask;
+ struct sp_alloc_info *alloc_info = arg;
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = alloc_info->spg_id,
+ };
+ if (ioctl_add_group(dev_fd, &ag_info)) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+
+ CPU_ZERO(&mask);
+ CPU_SET(0, &mask); /* parent process runs on CPU0 */
+ if (sched_setaffinity(0, sizeof(cpu_set_t), &mask) == -1) {
+ pr_info("parent process sched_setaffinity failed, errno: %d\n", errno);
+ return -1;
+ }
+
+ int semid = semget(0xabcd996, 1, IPC_CREAT | 0644);
+ if (semid < 0) {
+ pr_info("open systemV semaphore failed, errno: %s", strerror(errno));
+ return -1;
+ }
+ int ret = semctl(semid, 0, SETVAL, 0);
+ if (ret < 0) {
+ pr_info("sem setval failed, %s", strerror(errno));
+ goto sem_remove;
+ }
+
+ for (int i = 0; i < nr_child_process; i++) {
+ struct timespec delay;
+ pid_t pid = fork();
+
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = -1,
+ .sem_flg = 0,
+ };
+ semop(semid, &sembuf, 1);
+
+ CPU_ZERO(&mask);
+ int cpu_count = get_nprocs();
+ CPU_SET((i + 1) % cpu_count, &mask);
+ if (sched_setaffinity(0, sizeof(cpu_set_t), &mask) == -1) {
+ pr_info("child process %d sched_setaffinity failed, errno: %d\n", i, errno);
+ return -1;
+ }
+
+ delay.tv_sec = 0;
+ delay.tv_nsec = 3000000; /* 3ms */
+
+ while (1) {
+ sp_alloc_and_free_point(alloc_info);
+ nanosleep(&delay, NULL);
+ }
+ }
+
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ if (ioctl_add_group(dev_fd, &ag_info)) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+ }
+
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = nr_child_process,
+ .sem_flg = 0,
+ };
+ semop(semid, &sembuf, 1);
+
+sem_remove:
+ if (semctl(semid, IPC_RMID, NULL) < 0)
+ pr_info("sem remove failed, %s", strerror(errno));
+
+ return 0;
+}
+
+/* 同时创建7进程 */
+static int sp_alloc_mult_alloc_start_7(void *arg)
+{
+ nr_child_process = 7;
+ sp_alloc_mult_alloc_start(arg);
+}
+
+/* 同时创建15进程 */
+static int sp_alloc_mult_alloc_start_15(void *arg)
+{
+ nr_child_process = 15;
+ sp_alloc_mult_alloc_start(arg);
+}
+
+static struct sp_alloc_info alloc_infos[] = {
+ {
+ .flag = 0,
+ .size = 2 * PAGE_SIZE, // 8K
+ .spg_id = 1,
+ },
+ {
+ .flag = SP_HUGEPAGE,
+ .size = 2 * PMD_SIZE, // 4M
+ .spg_id = 1,
+ },
+ {
+ .flag = 0,
+ .size = 1024 * PAGE_SIZE, // 4M
+ .spg_id = 1,
+ },
+ {
+ .flag = 0,
+ .size = 512 * PAGE_SIZE, // 2M
+ .spg_id = 1,
+ },
+ {
+ .flag = SP_HUGEPAGE,
+ .size = PMD_SIZE, // 2M
+ .spg_id = 1,
+ },
+};
+
+static struct test_perf testcases[] = {
+ /* 单进程 */
+ {
+ .perf_start = sp_alloc_start,
+ .perf_point = sp_alloc_point,
+ .perf_end = NULL,
+ .count = 1000,
+ .name = "sp_alloc_2_pages",
+ .arg = &alloc_infos[0],
+ },
+ {
+ /*
+ * 如果只做sp_alloc不做sp_free，随内存消耗的增加，分配大页
+ * 内存的速率将越来越慢
+ */
+ .perf_start = sp_alloc_start,
+ .perf_point = sp_alloc_point,
+ .perf_end = NULL,
+ .count = 1000, // 4G 大页 预计很慢
+ .name = "sp_alloc_2_hugepage",
+ .arg = &alloc_infos[1],
+ },
+ {
+ .perf_start = sp_alloc_start,
+ .perf_point = sp_alloc_and_free_point,
+ .perf_end = NULL,
+ .count = 1000,
+ .name = "sp_alloc_and_free_2_pages",
+ .arg = &alloc_infos[0],
+ },
+ {
+ .perf_start = sp_alloc_start,
+ .perf_point = sp_alloc_and_free_point,
+ .perf_end = NULL,
+ .count = 1000,
+ .name = "sp_alloc_and_free_2_hugepage",
+ .arg = &alloc_infos[1],
+ },
+ {
+ .perf_start = sp_alloc_start,
+ .perf_point = sp_alloc_point,
+ .perf_end = NULL,
+ .count = 1000,
+ .name = "sp_alloc_1024_pages",
+ .arg = &alloc_infos[2],
+ },
+ {
+ .perf_start = sp_alloc_start,
+ .perf_point = sp_alloc_and_free_point,
+ .perf_end = NULL,
+ .count = 1000,
+ .name = "sp_alloc_and_free_1024_pages",
+ .arg = &alloc_infos[2],
+ },
+ {
+ .perf_start = sp_alloc_start,
+ .perf_point = sp_alloc_point,
+ .perf_end = NULL,
+ .count = 1000,
+ .name = "sp_alloc_512_pages",
+ .arg = &alloc_infos[3],
+ },
+ {
+ .perf_start = sp_alloc_start,
+ .perf_point = sp_alloc_and_free_point,
+ .perf_end = NULL,
+ .count = 1000,
+ .name = "sp_alloc_and_free_512_pages",
+ .arg = &alloc_infos[3],
+ },
+ {
+ .perf_start = sp_alloc_start,
+ .perf_point = sp_alloc_point,
+ .perf_end = NULL,
+ .count = 1000, // 2G 大页 预计很慢
+ .name = "sp_alloc_1_hugepage",
+ .arg = &alloc_infos[4],
+ },
+ {
+ .perf_start = sp_alloc_start,
+ .perf_point = sp_alloc_and_free_point,
+ .perf_end = NULL,
+ .count = 1000,
+ .name = "sp_alloc_and_free_1_hugepage",
+ .arg = &alloc_infos[4],
+ },
+ /* 父进程申请，子进程仅建页表 */
+ /* 总共8进程 */
+ {
+ .perf_start = sp_alloc_mult_process_start_7,
+ .perf_point = sp_alloc_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_mult_7_proc_populate_2_pages",
+ .arg = &alloc_infos[0],
+ },
+ {
+ .perf_start = sp_alloc_mult_process_start_7,
+ .perf_point = sp_alloc_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_mult_7_proc_populate_2_hugepage",
+ .arg = &alloc_infos[1],
+ },
+ {
+ .perf_start = sp_alloc_mult_process_start_7,
+ .perf_point = sp_alloc_and_free_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_and_free_mult_7_proc_populate_2_pages",
+ .arg = &alloc_infos[0],
+ },
+ {
+ .perf_start = sp_alloc_mult_process_start_7,
+ .perf_point = sp_alloc_and_free_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_and_free_mult_7_proc_populate_2_hugepage",
+ .arg = &alloc_infos[1],
+ },
+ /* 16进程 */
+ {
+ .perf_start = sp_alloc_mult_process_start_15,
+ .perf_point = sp_alloc_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_mult_15_proc_populate_2_pages",
+ .arg = &alloc_infos[0],
+ },
+ {
+ .perf_start = sp_alloc_mult_process_start_15,
+ .perf_point = sp_alloc_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_mult_15_proc_populate_2_hugepage",
+ .arg = &alloc_infos[1],
+ },
+ {
+ .perf_start = sp_alloc_mult_process_start_15,
+ .perf_point = sp_alloc_and_free_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_and_free_mult_15_proc_populate_2_pages",
+ .arg = &alloc_infos[0],
+ },
+ {
+ .perf_start = sp_alloc_mult_process_start_15,
+ .perf_point = sp_alloc_and_free_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_and_free_mult_15_proc_populate_2_hugepage",
+ .arg = &alloc_infos[1],
+ },
+ /* 父子进程都加组并申请内存 */
+ /* 8进程 */
+ {
+ .perf_start = sp_alloc_mult_alloc_start_7,
+ .perf_point = sp_alloc_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_mult_7_alloc_2_pages",
+ .arg = &alloc_infos[0],
+ },
+ {
+ .perf_start = sp_alloc_mult_alloc_start_7,
+ .perf_point = sp_alloc_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_mult_7_alloc_2_hugepage",
+ .arg = &alloc_infos[1],
+ },
+ {
+ .perf_start = sp_alloc_mult_alloc_start_7,
+ .perf_point = sp_alloc_and_free_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_and_free_mult_7_alloc_2_pages",
+ .arg = &alloc_infos[0],
+ },
+ {
+ .perf_start = sp_alloc_mult_alloc_start_7,
+ .perf_point = sp_alloc_and_free_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_and_free_mult_7_alloc_2_hugepage",
+ .arg = &alloc_infos[1],
+ },
+ /* 16进程 */
+ {
+ .perf_start = sp_alloc_mult_alloc_start_15,
+ .perf_point = sp_alloc_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_mult_15_alloc_2_pages",
+ .arg = &alloc_infos[0],
+ },
+ {
+ .perf_start = sp_alloc_mult_alloc_start_15,
+ .perf_point = sp_alloc_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_mult_15_alloc_2_hugepage",
+ .arg = &alloc_infos[1],
+ },
+ {
+ .perf_start = sp_alloc_mult_alloc_start_15,
+ .perf_point = sp_alloc_and_free_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_and_free_mult_15_alloc_2_pages",
+ .arg = &alloc_infos[0],
+ },
+ {
+ .perf_start = sp_alloc_mult_alloc_start_15,
+ .perf_point = sp_alloc_and_free_point,
+ .perf_end = sp_alloc_end,
+ .count = 1000,
+ .name = "sp_alloc_and_free_mult_15_alloc_2_hugepage",
+ .arg = &alloc_infos[1],
+ },
+};
+
+
+#define STRLENGTH 500
+static char filename[STRLENGTH];
+
+int main()
+{
+ int ret = 0;
+ dev_fd = open_device();
+ if (dev_fd < 0)
+ return -1;
+
+ int passed = 0, failed = 0;
+
+ for (int i = 0; i < sizeof(testcases) / sizeof(testcases[0]); i++) {
+ ret = test_perf_routing(&testcases[i]);
+ ret == 0? passed++: failed++;
+ }
+
+ close_device(dev_fd);
+
+ pr_info("----------------------------");
+ printf("%s All %d testcases finished, passing: %d, failing: %d", extract_filename(filename, __FILE__), passed + failed, passed, failed);
+ printf("-------------------------\n");
+
+ return failed == 0? 0: -1;
+}
diff --git a/tools/testing/sharepool/testcase/performance_test/test_perf_sp_k2u.c b/tools/testing/sharepool/testcase/performance_test/test_perf_sp_k2u.c
new file mode 100644
index 000000000000..21b7ae4d97e0
--- /dev/null
+++ b/tools/testing/sharepool/testcase/performance_test/test_perf_sp_k2u.c
@@ -0,0 +1,860 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Jan 18 08:58:29 2021
+ */
+
+#define _GNU_SOURCE
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+#include <sys/sem.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sched.h> /* sched_setaffinity */
+#include <sys/sysinfo.h>
+
+#include "sharepool_lib.h"
+
+#define NSEC2SEC 1000000000
+
+
+static int nr_child_process = 8;
+static unsigned long vm_addr;
+
+struct test_perf {
+ int (*perf_start)(void *);
+ int (*perf_point)(void *);
+ int (*perf_end)(void *);
+
+ int count;
+ void *arg;
+ char *name;
+};
+
+static int test_perf_child(struct test_perf *test_perf)
+{
+ long sum, max, min, dur;
+ struct timespec ts_start, ts_end;
+
+ sum = max = 0;
+ min = ((unsigned long)-1) >> 1;
+
+ if (!test_perf->perf_point) {
+ pr_info("you must supply a perf_point routine");
+ return -1;
+ }
+
+ if (test_perf->perf_start) {
+ if (test_perf->perf_start(test_perf->arg)) {
+ pr_info("testcase init failed");
+ if (test_perf->perf_end) {
+ if (test_perf->perf_end(test_perf->arg)) {
+ pr_info("testcase exit failed");
+ return -1;
+ }
+ }
+ return -1;
+ }
+ }
+
+ //pr_info(">> testcase %s start <<", test_perf->name);
+ for (int i = 0; i < test_perf->count; i++) {
+ pr_info(">> testcase %s %dth time begins, %d times left. <<",
+ test_perf->name, i + 1, test_perf->count - (i + 1));
+ clock_gettime(CLOCK_MONOTONIC, &ts_start);
+ if (test_perf->perf_point(test_perf->arg)) {
+ pr_info("testcase %s %dth point failed.", test_perf->name, i + 1);
+ return -1;
+ }
+ clock_gettime(CLOCK_MONOTONIC, &ts_end);
+
+ dur = (ts_end.tv_sec - ts_start.tv_sec) * NSEC2SEC + (ts_end.tv_nsec - ts_start.tv_nsec);
+ sum += dur;
+ max = max > dur ? max : dur;
+ min = min < dur ? min : dur;
+ }
+
+ if (test_perf->perf_end) {
+ if (test_perf->perf_end(test_perf->arg)) {
+ pr_info("testcase exit failed");
+ return -1;
+ }
+ }
+
+ pr_info("%50s result: avg: %10ld, max: %10ld, min: %10ld", test_perf->name, sum / test_perf->count, max, min);
+
+ return 0;
+}
+
+static int test_perf_routing(struct test_perf *test_perf)
+{
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(test_perf_child(test_perf));
+ }
+
+ int status = 0;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ return -1;
+ }
+
+ return 0;
+}
+
+static int vmalloc_and_store(unsigned long size)
+{
+ struct vmalloc_info vmalloc_info = {
+ .size = size,
+ };
+
+ if (ioctl_vmalloc(dev_fd, &vmalloc_info)) {
+ pr_info("vmalloc small page failed, errno: %d", errno);
+ return -1;
+ } else {
+ pr_info("vmalloc success: %lx", vmalloc_info.addr);
+ pr_info("vm_addr before: %lx", vm_addr);
+ vm_addr = vmalloc_info.addr;
+ pr_info("vm_addr after: %lx", vm_addr);
+ }
+
+ return 0;
+}
+
+static int vmalloc_hugepage_and_store(unsigned long size)
+{
+ struct vmalloc_info vmalloc_info = {
+ .size = size,
+ };
+
+ if (ioctl_vmalloc_hugepage(dev_fd, &vmalloc_info)) {
+ pr_info("vmalloc small page failed, errno: %d", errno);
+ return -1;
+ } else {
+ pr_info("vmalloc success: %lx", vmalloc_info.addr);
+ pr_info("vm_addr before: %lx", vm_addr);
+ vm_addr = vmalloc_info.addr;
+ pr_info("vm_addr after: %lx", vm_addr);
+ }
+
+ return 0;
+}
+
+static int vfree(unsigned long size)
+{
+ struct vmalloc_info vmalloc_info = {
+ .addr = vm_addr,
+ .size = size,
+ };
+ pr_info("gonna vfree address: %lx", vm_addr);
+ if (ioctl_vfree(dev_fd, &vmalloc_info)) {
+ pr_info("vfree failed, errno: %d", errno);
+ return -1;
+ } else {
+ pr_info("vfree success.");
+ return 0;
+ }
+}
+
+static int sp_k2u_start(void *arg)
+{
+ pid_t pid = getpid();
+
+ struct sp_make_share_info *k2u_info = arg;
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = k2u_info->spg_id,
+ };
+ if (ioctl_add_group(dev_fd, &ag_info)) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+
+ vmalloc_and_store(k2u_info->size);
+
+ k2u_info->pid = pid;
+ k2u_info->kva = vm_addr;
+
+ return 0;
+}
+
+static int sp_k2u_huge_start(void *arg)
+{
+ pid_t pid = getpid();
+
+ struct sp_make_share_info *k2u_info = arg;
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = k2u_info->spg_id,
+ };
+ if (ioctl_add_group(dev_fd, &ag_info)) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+
+ vmalloc_hugepage_and_store(k2u_info->size);
+
+ k2u_info->pid = pid;
+ k2u_info->kva = vm_addr;
+ return 0;
+}
+
+/*
+ * 这样做无法完全回收k2u的uva，进而做vfree会提示错误。因此，不调用本函数，
+ * 本用例暂定为会导致内存泄漏
+ */
+static int sp_k2u_end(void *arg)
+{
+ struct sp_make_share_info *k2u_info = arg;
+
+ if (vfree(k2u_info->size) < 0)
+ return -1;
+
+ return 0;
+}
+
+static int sp_k2u_point(void *arg)
+{
+ struct sp_make_share_info *k2u_info = arg;
+
+ if (ioctl_k2u(dev_fd, k2u_info)) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ return -1;
+ }
+
+ return 0;
+}
+
+static int sp_k2u_and_unshare_point(void *arg)
+{
+ struct sp_make_share_info *k2u_info = arg;
+
+ if (ioctl_k2u(dev_fd, k2u_info)) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ return -1;
+ }
+
+ if (ioctl_unshare(dev_fd, k2u_info)) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ return -1;
+ }
+
+ return 0;
+}
+
+#define MAX_CHILD_NR 100
+static pid_t childs[MAX_CHILD_NR];
+
+static int sp_k2u_mult_end(void *arg)
+{
+ struct sp_make_share_info *k2u_info = arg;
+ for (int i = 0; i < MAX_CHILD_NR && childs[i]; i++) {
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], NULL, 0);
+ childs[i] = 0;
+ }
+
+ if (vfree(k2u_info->size) < 0)
+ return -1;
+
+ return 0;
+}
+
+/* 同时创建N个进程加组，并且子进程也在死循环 */
+static int sp_k2u_1_vs_mult_start(void *arg)
+{
+ cpu_set_t mask;
+ pid_t pid = getpid();
+ struct sp_make_share_info *k2u_info = arg;
+ k2u_info->pid = pid;
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = k2u_info->spg_id,
+ };
+ if (ioctl_add_group(dev_fd, &ag_info)) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ } else {
+ pr_info("test parent process %d add group %d success.", getpid(), ag_info.spg_id);
+ }
+
+ CPU_ZERO(&mask);
+ CPU_SET(0, &mask); /* parent process runs on CPU0 */
+ if (sched_setaffinity(0, sizeof(cpu_set_t), &mask) == -1) {
+ pr_info("parent process sched_setaffinity failed, errno: %d", errno);
+ return -1;
+ }
+
+ int cpu_count = get_nprocs();
+ pr_info("cpu count is %d", cpu_count);
+ int i;
+ for (i = 0; i < nr_child_process; i++) {
+ pid_t pid = fork();
+
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ CPU_ZERO(&mask);
+ CPU_SET((i + 1) % cpu_count, &mask);
+ if (sched_setaffinity(0, sizeof(cpu_set_t), &mask) == -1) {
+ pr_info("set %dth child process %d sched_setaffinity failed, errno: %d", i, getpid(), errno);
+ exit(-1);
+ } else {
+ pr_info("set %dth child process %d sched_setaffinity success", i, getpid());
+ }
+ while (1) {};
+ exit(0);
+ }
+
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ if (ioctl_add_group(dev_fd, &ag_info)) {
+ pr_info("add %dth child process %d to group failed, errno: %d", i, pid, errno);
+ return -1;
+ } {
+ pr_info("add %dth child process %d to group success", i, pid);
+ }
+ }
+
+ return 0;
+/*
+error:
+ //回收子进程，不在这里回收，则需要在end中回收
+ while (--i >= 0) {
+ kill(childs[i], SIGKILL);
+ int status;
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child process %d ended unexpected.", childs[i]);
+ }
+ childs[i] = 0;
+ }
+ return ret;
+*/
+}
+
+/* 同时创建7睡眠进程，小页 */
+static int sp_k2u_1_vs_mult_start_7(void *arg)
+{
+ struct sp_make_share_info *k2u_info = arg;
+
+ vmalloc_and_store(k2u_info->size);
+ k2u_info->kva = vm_addr;
+
+ nr_child_process = 7;
+ return sp_k2u_1_vs_mult_start(arg);
+}
+
+/* 同时创建7睡眠进程，大页 */
+static int sp_k2u_huge_1_vs_mult_start_7(void *arg)
+{
+ struct sp_make_share_info *k2u_info = arg;
+
+ vmalloc_hugepage_and_store(k2u_info->size);
+ k2u_info->kva = vm_addr;
+
+ nr_child_process = 7;
+ return sp_k2u_1_vs_mult_start(arg);
+}
+
+/* 同时创建15睡眠进程，小页 */
+static int sp_k2u_1_vs_mult_start_15(void *arg)
+{
+ struct sp_make_share_info *k2u_info = arg;
+
+ vmalloc_and_store(k2u_info->size);
+ k2u_info->kva = vm_addr;
+
+ nr_child_process = 15;
+ return sp_k2u_1_vs_mult_start(arg);
+}
+
+/* 同时创建15睡眠进程，大页 */
+static int sp_k2u_huge_1_vs_mult_start_15(void *arg)
+{
+ struct sp_make_share_info *k2u_info = arg;
+
+ vmalloc_hugepage_and_store(k2u_info->size);
+ k2u_info->kva = vm_addr;
+
+ nr_child_process = 15;
+ return sp_k2u_1_vs_mult_start(arg);
+}
+/*
+ * 同时创建N个进程加组，后续只有父进程和子进程同时做sp_k2u和unshare(如果有)
+ */
+static int sp_k2u_mult_start(void *arg)
+{
+ cpu_set_t mask;
+ pid_t pid = getpid();
+ struct sp_make_share_info *k2u_info = arg;
+ k2u_info->pid = pid;
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = k2u_info->spg_id,
+ };
+ if (ioctl_add_group(dev_fd, &ag_info)) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+
+ CPU_ZERO(&mask);
+ CPU_SET(0, &mask); /* parent process runs on CPU0 */
+ int cpu_count = get_nprocs();
+
+ if (sched_setaffinity(0, sizeof(cpu_set_t), &mask) == -1) {
+ pr_info("parent process sched_setaffinity failed, errno: %d", errno);
+ return -1;
+ }
+
+ int semid = semget(0xabcd996, 1, IPC_CREAT | 0644);
+ if (semid < 0) {
+ pr_info("open systemV semaphore failed, errno: %s", strerror(errno));
+ return -1;
+ }
+ int ret = semctl(semid, 0, SETVAL, 0);
+ if (ret < 0) {
+ pr_info("sem setval failed, %s", strerror(errno));
+ goto sem_remove;
+ }
+
+ for (int i = 0; i < nr_child_process; i++) {
+ struct timespec delay;
+ pid_t pid = fork();
+
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = -1,
+ .sem_flg = 0,
+ };
+ semop(semid, &sembuf, 1);
+
+ CPU_ZERO(&mask);
+ CPU_SET((i + 1) % cpu_count, &mask);
+ if (sched_setaffinity(0, sizeof(cpu_set_t), &mask) == -1) {
+ pr_info("child process %d sched_setaffinity failed, errno: %d", i, errno);
+ return -1;
+ }
+
+ delay.tv_sec = 0;
+ delay.tv_nsec = 300000; /* 300us */
+
+ while (1) {
+ sp_k2u_and_unshare_point(k2u_info);
+ nanosleep(&delay, NULL);
+ }
+ }
+
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ if (ioctl_add_group(dev_fd, &ag_info)) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+ }
+
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = nr_child_process,
+ .sem_flg = 0,
+ };
+ semop(semid, &sembuf, 1);
+
+sem_remove:
+ if (semctl(semid, IPC_RMID, NULL) < 0)
+ pr_info("sem remove failed, %s", strerror(errno));
+
+ return 0;
+}
+
+/* 同时创建7进程，小页 */
+static int sp_k2u_mult_start_7(void *arg)
+{
+ struct sp_make_share_info *k2u_info = arg;
+
+ vmalloc_and_store(k2u_info->size);
+ k2u_info->kva = vm_addr;
+
+ nr_child_process = 7;
+ return sp_k2u_mult_start(arg);
+}
+
+/* 同时创建7进程，大页 */
+static int sp_k2u_huge_mult_start_7(void *arg)
+{
+ struct sp_make_share_info *k2u_info = arg;
+
+ vmalloc_hugepage_and_store(k2u_info->size);
+ k2u_info->kva = vm_addr;
+
+ nr_child_process = 7;
+ return sp_k2u_mult_start(arg);
+}
+
+/* 同时创建15进程，小页 */
+static int sp_k2u_mult_start_15(void *arg)
+{
+ struct sp_make_share_info *k2u_info = arg;
+
+ vmalloc_and_store(k2u_info->size);
+ k2u_info->kva = vm_addr;
+
+ nr_child_process = 15;
+ return sp_k2u_mult_start(arg);
+}
+
+/* 同时创建15进程，大页 */
+static int sp_k2u_huge_mult_start_15(void *arg)
+{
+ struct sp_make_share_info *k2u_info = arg;
+
+ vmalloc_hugepage_and_store(k2u_info->size);
+ k2u_info->kva = vm_addr;
+
+ nr_child_process = 15;
+ return sp_k2u_mult_start(arg);
+}
+
+static struct sp_make_share_info k2u_infos[] = {
+ /* 每个用例一个数组元素，防止用例修改kva和pid带来潜在干扰 */
+ /* 单进程 */
+ {
+ .sp_flags = 0,
+ .size = 2 * PAGE_SIZE, /* =vmalloc size */
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PMD_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PAGE_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PMD_SIZE,
+ .spg_id = 1,
+ },
+ /* 单进程k2u，其他同组进程sleep */
+ /* 8进程 */
+ {
+ .sp_flags = 0,
+ .size = 2 * PAGE_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PMD_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PAGE_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PMD_SIZE,
+ .spg_id = 1,
+ },
+ /* 16进程 */
+ {
+ .sp_flags = 0,
+ .size = 2 * PAGE_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PMD_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PAGE_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PMD_SIZE,
+ .spg_id = 1,
+ },
+ /* 单进程k2u，其他同组进程也做k2u */
+ /* 8进程 */
+ {
+ .sp_flags = 0,
+ .size = 2 * PAGE_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PMD_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PAGE_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PMD_SIZE,
+ .spg_id = 1,
+ },
+ /* 16进程 */
+ {
+ .sp_flags = 0,
+ .size = 2 * PAGE_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PMD_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PAGE_SIZE,
+ .spg_id = 1,
+ },
+ {
+ .sp_flags = 0,
+ .size = 2 * PMD_SIZE,
+ .spg_id = 1,
+ },
+};
+
+static struct test_perf testcases[] = {
+ /* 单进程 */
+ {
+ .perf_start = sp_k2u_start,
+ .perf_point = sp_k2u_point,
+ .perf_end = sp_k2u_end,
+ .count = 1000,
+ .name = "sp_k2u_2_pages",
+ .arg = &k2u_infos[0],
+ },
+ {
+ .perf_start = sp_k2u_huge_start,
+ .perf_point = sp_k2u_point,
+ .perf_end = sp_k2u_end,
+ .count = 1000,
+ .name = "sp_k2u_2_hugepage",
+ .arg = &k2u_infos[1],
+ },
+ {
+ .perf_start = sp_k2u_start,
+ .perf_point = sp_k2u_and_unshare_point,
+ .perf_end = sp_k2u_end,
+ .count = 1000,
+ .name = "sp_k2u_and_unshare_2_pages",
+ .arg = &k2u_infos[2],
+ },
+ {
+ .perf_start = sp_k2u_huge_start,
+ .perf_point = sp_k2u_and_unshare_point,
+ .perf_end = sp_k2u_end,
+ .count = 1000,
+ .name = "sp_k2u_and_unshare_2_hugepage",
+ .arg = &k2u_infos[3],
+ },
+ /* 父进程申请，子进程仅建页表 */
+ /* 总共8进程 */
+ {
+ .perf_start = sp_k2u_1_vs_mult_start_7,
+ .perf_point = sp_k2u_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_1_vs_mult7_proc2_pages",
+ .arg = &k2u_infos[4],
+ },
+ {
+ .perf_start = sp_k2u_huge_1_vs_mult_start_7,
+ .perf_point = sp_k2u_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_1_vs_mult7_proc2_hugepages",
+ .arg = &k2u_infos[5],
+ },
+ {
+ .perf_start = sp_k2u_1_vs_mult_start_7,
+ .perf_point = sp_k2u_and_unshare_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_and_unshare_1_vs_mult7_proc2_pages",
+ .arg = &k2u_infos[6],
+ },
+ {
+ .perf_start = sp_k2u_huge_1_vs_mult_start_7,
+ .perf_point = sp_k2u_and_unshare_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_and_unshare_1_vs_mult7_proc2_hugepages",
+ .arg = &k2u_infos[7],
+ },
+ /* 总共16进程 */
+ {
+ .perf_start = sp_k2u_1_vs_mult_start_15,
+ .perf_point = sp_k2u_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_1_vs_mult15_proc2_pages",
+ .arg = &k2u_infos[8],
+ },
+ {
+ .perf_start = sp_k2u_huge_1_vs_mult_start_15,
+ .perf_point = sp_k2u_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_1_vs_mult15_proc2_hugepages",
+ .arg = &k2u_infos[9],
+ },
+ {
+ .perf_start = sp_k2u_1_vs_mult_start_15,
+ .perf_point = sp_k2u_and_unshare_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_and_unshare_1_vs_mult15_proc2_pages", // failed.
+ .arg = &k2u_infos[10],
+ },
+ {
+ .perf_start = sp_k2u_huge_1_vs_mult_start_15,
+ .perf_point = sp_k2u_and_unshare_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_and_unshare_1_vs_mult15_proc2_hugepages",
+ .arg = &k2u_infos[11],
+ },
+ /* 父子进程都加组并申请内存 */
+ /* 8进程 */
+ {
+ .perf_start = sp_k2u_mult_start_7,
+ .perf_point = sp_k2u_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_mult7_2_pages",
+ .arg = &k2u_infos[12],
+ },
+ {
+ .perf_start = sp_k2u_huge_mult_start_7,
+ .perf_point = sp_k2u_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_mult7_2_hugepage",
+ .arg = &k2u_infos[13],
+ },
+ {
+ .perf_start = sp_k2u_mult_start_7,
+ .perf_point = sp_k2u_and_unshare_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_and_unshare_mult7_2_pages",
+ .arg = &k2u_infos[14],
+ },
+ {
+ .perf_start = sp_k2u_huge_mult_start_7,
+ .perf_point = sp_k2u_and_unshare_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_and_unshare_mult7_2_hugepage",
+ .arg = &k2u_infos[15],
+ },
+ /* 16进程 */
+ {
+ .perf_start = sp_k2u_mult_start_15,
+ .perf_point = sp_k2u_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_mult15_2_pages",
+ .arg = &k2u_infos[16],
+ },
+ {
+ .perf_start = sp_k2u_huge_mult_start_15,
+ .perf_point = sp_k2u_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_mult15_2_hugepage",
+ .arg = &k2u_infos[17],
+ },
+ {
+ .perf_start = sp_k2u_mult_start_15,
+ .perf_point = sp_k2u_and_unshare_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_and_unshare_mult15_2_pages",
+ .arg = &k2u_infos[18],
+ },
+ {
+ .perf_start = sp_k2u_huge_mult_start_15,
+ .perf_point = sp_k2u_and_unshare_point,
+ .perf_end = sp_k2u_mult_end,
+ .count = 1000,
+ .name = "sp_k2u_and_unshare_mult15_2_hugepage",
+ .arg = &k2u_infos[19],
+ },
+};
+
+#define STRLENGTH 500
+static char filename[STRLENGTH];
+
+int main(int argc, char *argv[])
+{
+ int ret = 0;
+ dev_fd = open_device();
+ if (dev_fd < 0)
+ return -1;
+
+ int passed = 0, failed = 0;
+
+ if (argc == 1) {
+ for (int i = 0; i < sizeof(testcases) / sizeof(testcases[0]); i++) {
+ printf(">>>> start testcase%d: %s", i + 1, testcases[i].name);
+ ret = test_perf_routing(&testcases[i]);
+ ret == 0? passed++: failed++;
+ printf("<<<< end testcase%d: %s, result: %s\n", i + 1, testcases[i].name, ret != 0 ? "failed" : "passed");
+ }
+ pr_info("----------------------------");
+ printf("%s All %d testcases finished, passing: %d, failing: %d", extract_filename(filename, __FILE__), passed + failed, passed, failed);
+ printf("-------------------------\n");
+ } else {
+ int testnum = atoi(argv[1]);
+ printf(">>>> start testcase%d: %s", testnum, testcases[testnum - 1].name);
+ ret = test_perf_routing(&testcases[testnum - 1]);
+ printf("<<<< end testcase%d: %s, result: %s\n", testnum, testcases[testnum - 1].name, ret != 0 ? "failed" : "passed");
+ pr_info("----------------------------");
+ printf("%s testcase%d finished, %s", extract_filename(filename, __FILE__), testnum, ret == 0 ? "passed." : "failed.");
+ printf("-------------------------\n");
+ }
+
+
+
+ close_device(dev_fd);
+
+
+
+ return failed == 0? 0: -1;
+}
diff --git a/tools/testing/sharepool/testcase/reliability_test/Makefile b/tools/testing/sharepool/testcase/reliability_test/Makefile
new file mode 100644
index 000000000000..aaee60d8872b
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/Makefile
@@ -0,0 +1,11 @@
+MODULEDIR:=coredump fragment k2u_u2k sp_add_group sp_unshare kthread others
+
+all:tooldir
+
+tooldir:
+ for n in $(MODULEDIR); do $(MAKE) -C $$n; done
+install:
+ mkdir -p $(TOOL_BIN_DIR)/reliability_test && cp reliability_test.sh $(TOOL_BIN_DIR)
+ for n in $(MODULEDIR); do $(MAKE) -C $$n install; done
+clean:
+ for n in $(MODULEDIR); do $(MAKE) -C $$n clean; done
diff --git a/tools/testing/sharepool/testcase/reliability_test/coredump/Makefile b/tools/testing/sharepool/testcase/reliability_test/coredump/Makefile
new file mode 100644
index 000000000000..5370208dbd64
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/coredump/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/reliability_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/reliability_test/coredump/test_coredump.c b/tools/testing/sharepool/testcase/reliability_test/coredump/test_coredump.c
new file mode 100644
index 000000000000..bc488692a08a
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/coredump/test_coredump.c
@@ -0,0 +1,581 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Dec 16 06:59:45 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <signal.h>
+#include <sys/time.h>
+#include <sys/resource.h>
+#include <stdlib.h> /* rand() and srand() */
+#include <time.h> /* time() */
+#include <pthread.h>
+
+#include "sharepool_lib.h"
+#include "sem_use.h"
+
+#define ALLOC_TEST_TYPES 4
+#define GROUP_ID 1
+#define THREAD_NUM 3
+#define KILL_TIME 1000
+static int semid;
+
+void *alloc_thread(void *arg)
+{
+ int ret;
+ bool judge_ret = true;
+ struct sp_alloc_info alloc_info[ALLOC_TEST_TYPES] = {
+ {
+ // 大页
+ .flag = SP_HUGEPAGE,
+ .spg_id = GROUP_ID,
+ .size = 2 * PMD_SIZE,
+ },
+ {
+ // 大页 DVPP
+ .flag = SP_DVPP | SP_HUGEPAGE,
+ .spg_id = GROUP_ID,
+ .size = 2 * PMD_SIZE,
+ },
+ {
+ // 普通页 DVPP
+ .flag = SP_DVPP,
+ .spg_id = GROUP_ID,
+ .size = 4 * PAGE_SIZE,
+ },
+ {
+ // 普通页
+ .flag = 0,
+ .spg_id = GROUP_ID,
+ .size = 4 * PAGE_SIZE,
+ },
+};
+ while (1) {
+ pr_info("%s run time %d", __FUNCTION__, sem_get_value(semid));
+ for (int i = 0; i < ALLOC_TEST_TYPES; i++) {
+ /* sp_alloc */
+ ret = ioctl_alloc(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed at %dth alloc.\n", i);
+ return -1;
+ } else {
+ if (IS_ERR_VALUE(alloc_info[i].addr)) {
+ pr_info("sp_alloc return err is %ld\n", alloc_info[i].addr);
+ return -1;
+ }
+ }
+
+ /* check sp_alloc addr */
+ judge_ret = ioctl_judge_addr(dev_fd, alloc_info[i].addr);
+ if (judge_ret != true) {
+ pr_info("expect a valid share pool addr %lx\n", alloc_info[i].addr);
+ return -1;
+ }
+ }
+ for (int i = 0; i < ALLOC_TEST_TYPES; i++) {
+ /* sp_free */
+ ret = ioctl_free(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("sp_free return error: %d\n", ret);
+ return -1;
+ }
+ }
+ sem_inc_by_one(semid);
+ if (ret)
+ break;
+ }
+ return ret;
+}
+
+struct vmalloc_info vmalloc_infos[THREAD_NUM] = {0}, vmalloc_huge_infos[THREAD_NUM] = {0};
+sig_atomic_t thread_index = 0;
+void *k2u_thread(void *arg)
+{
+ int ret;
+
+ struct sp_make_share_info k2u_info = {0}, k2u_huge_info = {0};
+ int vm_index = thread_index++;
+ while (1) {
+ pr_info("k2u_thread run time %d", sem_get_value(semid));
+ pr_info("atomic index is %d, thread index is %d", vm_index, thread_index);
+
+ int group_id = (int)arg;
+ int pid = getpid();
+ k2u_info.kva = vmalloc_infos[vm_index].addr;
+ k2u_info.size = vmalloc_infos[vm_index].size;
+ k2u_info.sp_flags = 0;
+ k2u_info.pid = pid;
+ k2u_info.spg_id = group_id;
+
+ k2u_huge_info.kva = vmalloc_huge_infos[vm_index].addr;
+ k2u_huge_info.size = vmalloc_huge_infos[vm_index].size;
+ k2u_huge_info.sp_flags = SP_DVPP;
+ k2u_huge_info.pid = pid;
+ k2u_huge_info.spg_id = group_id;
+
+ /* k2u */
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_info.addr)) {
+ pr_info("k2u return err is %ld.\n",
+ k2u_info.addr);
+ goto error;
+ }
+ }
+
+ ret = ioctl_k2u(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u hugepage error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_huge_info.addr)) {
+ pr_info("k2u hugepage return err is %ld.\n",
+ k2u_huge_info.addr);
+ goto error;
+ }
+ }
+
+ /* check k2u memory content */
+ char *addr = (char *)k2u_info.addr;
+ if (addr[0] != 'a' || addr[PAGE_SIZE - 1] != 'b' ||
+ addr[PAGE_SIZE] != 'c' || addr[2 * PAGE_SIZE - 1] != 'd') {
+ pr_info("check vmalloc memory failed\n");
+ goto error;
+ }
+
+ addr = (char *)k2u_huge_info.addr;
+ if (addr[0] != 'a' || addr[PMD_SIZE - 1] != 'b' ||
+ addr[PMD_SIZE] != 'c' || addr[2 * PMD_SIZE - 1] != 'd') {
+ pr_info("check vmalloc_hugepage memory failed: %c %c %c %c\n",
+ addr[0], addr[PMD_SIZE - 1], addr[PMD_SIZE], addr[2 * PMD_SIZE - 1]);
+ goto error;
+ }
+
+ /* unshare uva */
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("sp unshare uva error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_unshare(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("sp unshare hugepage uva error: %d\n", ret);
+ goto error;
+ }
+
+ sem_inc_by_one(semid);
+ }
+
+ return ret;
+error:
+ return -1;
+}
+
+void *k2task_thread(void *arg)
+{
+ k2u_thread(SPG_ID_DEFAULT);
+}
+
+void *addgroup_thread(void *arg)
+{
+ int ret = 0;
+ while (1) {
+ pr_info("add_group_thread run time %d", sem_get_value(semid));
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, SPG_ID_AUTO);
+ int num = KILL_TIME;
+ int spg_id[KILL_TIME];
+ ret = wrap_sp_group_id_by_pid(getpid(), spg_id, &num);
+ pr_info("add to %d groups", num);
+ sem_inc_by_one(semid);
+ }
+ return ret;
+}
+
+void *u2k_thread(void *arg)
+{
+ int ret = 0;
+ bool judge_ret = true;
+ char *addr;
+ int group_id = (int)arg;
+ int pid = getpid();
+ struct sp_alloc_info alloc_info[ALLOC_TEST_TYPES] = {
+ {
+ // 大页
+ .flag = SP_HUGEPAGE,
+ .spg_id = GROUP_ID,
+ .size = 2 * PMD_SIZE,
+ },
+ {
+ // 大页 DVPP
+ .flag = SP_DVPP | SP_HUGEPAGE,
+ .spg_id = GROUP_ID,
+ .size = 2 * PMD_SIZE,
+ },
+ {
+ // 普通页 DVPP
+ .flag = SP_DVPP,
+ .spg_id = GROUP_ID,
+ .size = 4 * PAGE_SIZE,
+ },
+ {
+ // 普通页
+ .flag = 0,
+ .spg_id = GROUP_ID,
+ .size = 4 * PAGE_SIZE,
+ },
+};
+ struct sp_make_share_info u2k_info[ALLOC_TEST_TYPES] = {0};
+ while (1) {
+ pr_info("u2k_thread run time %d", sem_get_value(semid));
+ for (int i = 0; i < ALLOC_TEST_TYPES; i++) {
+ /* sp_alloc */
+ ret = ioctl_alloc(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed at %dth alloc.\n", i);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(alloc_info[i].addr)) {
+ pr_info("sp_alloc return err is %ld\n", alloc_info[i].addr);
+ goto error;
+ }
+ }
+
+ /* check sp_alloc addr */
+ judge_ret = ioctl_judge_addr(dev_fd, alloc_info[i].addr);
+ if (judge_ret != true) {
+ pr_info("expect a valid share pool addr %lx\n", alloc_info[i].addr);
+ goto error;
+ }
+
+ /* prepare for u2k */
+ addr = (char *)alloc_info[i].addr;
+ if (alloc_info[i].flag & SP_HUGEPAGE) {
+ addr[0] = 'd';
+ addr[PMD_SIZE - 1] = 'c';
+ addr[PMD_SIZE] = 'b';
+ addr[PMD_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_hugepage_checker = true;
+ } else {
+ addr[0] = 'd';
+ addr[PAGE_SIZE - 1] = 'c';
+ addr[PAGE_SIZE] = 'b';
+ addr[PAGE_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_checker = true;
+ }
+
+ u2k_info[i].uva = alloc_info[i].addr;
+ u2k_info[i].size = alloc_info[i].size;
+ u2k_info[i].pid = pid;
+
+ /* u2k */
+ ret = ioctl_u2k(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl u2k failed\n");
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(u2k_info[i].addr)) {
+ pr_info("u2k return err is %ld.\n", u2k_info[i].addr);
+ goto error;
+ }
+ }
+ }
+
+ for (int i = 0; i < ALLOC_TEST_TYPES; i++) {
+ /* unshare kva */
+ ret = ioctl_unshare(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("sp_unshare kva return error: %d\n", ret);
+ goto error;
+ }
+
+ /* sp_free */
+ ret = ioctl_free(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("sp_free return error: %d\n", ret);
+ goto error;
+ }
+ }
+
+ sem_inc_by_one(semid);
+ }
+error:
+ //close_device(dev_fd);
+ return -1;
+}
+
+void *walkpagerange_thread(void *arg)
+{
+ int ret = 0;
+ // alloc
+ struct sp_alloc_info alloc_info[ALLOC_TEST_TYPES] = {
+ {
+ // 大页
+ .flag = SP_HUGEPAGE,
+ .spg_id = GROUP_ID,
+ .size = 2 * PMD_SIZE,
+ },
+ {
+ // 大页 DVPP
+ .flag = SP_DVPP | SP_HUGEPAGE,
+ .spg_id = GROUP_ID,
+ .size = 2 * PMD_SIZE,
+ },
+ {
+ // 普通页 DVPP
+ .flag = SP_DVPP,
+ .spg_id = GROUP_ID,
+ .size = 4 * PAGE_SIZE,
+ },
+ {
+ // 普通页
+ .flag = 0,
+ .spg_id = GROUP_ID,
+ .size = 4 * PAGE_SIZE,
+ },
+};
+ for (int i = 0; i < ALLOC_TEST_TYPES; i++) {
+ ret = ioctl_alloc(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed at %dth alloc.\n", i);
+ return -1;
+ } else {
+ if (IS_ERR_VALUE(alloc_info[i].addr)) {
+ pr_info("sp_alloc return err is %ld\n", alloc_info[i].addr);
+ return -1;
+ }
+ }
+ }
+
+ struct sp_walk_page_range_info wpr_info[ALLOC_TEST_TYPES] = {0};
+ while (1) {
+ pr_info("%s run time %d", __FUNCTION__, sem_get_value(semid));
+ for (int i = 0; i < ALLOC_TEST_TYPES; i++) {
+ wpr_info[i].uva = alloc_info[i].addr;
+ wpr_info[i].size = alloc_info[i].size;
+ ret = ioctl_walk_page_range(dev_fd, wpr_info + i);
+ if (ret < 0) {
+ pr_info("ioctl_walk_page_range failed, errno: %d", errno);
+ return -1;
+ }
+ }
+ for (int i = 0; i < ALLOC_TEST_TYPES; i++) {
+ ret = ioctl_walk_page_free(dev_fd, wpr_info + i);
+ if (ret < 0) {
+ pr_info("ioctl_walk_page_range_free failed, errno: %d", errno);
+ return -1;
+ }
+ }
+ sem_inc_by_one(semid);
+ }
+
+ // free
+ for (int i = 0; i < ALLOC_TEST_TYPES; i++) {
+ /* sp_free */
+ ret = ioctl_free(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("sp_free return error: %d\n", ret);
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+int vmallocAll()
+{
+ int ret;
+ for (int i = 0; i < THREAD_NUM; i++) {
+ vmalloc_infos[i].size = 3 * PAGE_SIZE;
+ ret = ioctl_vmalloc(dev_fd, vmalloc_infos + i);
+ if(ret < 0) {
+ pr_info("vmalloc failed");
+ } else {
+ pr_info("vmalloc success");
+ }
+ vmalloc_huge_infos[i].size = 3 * PMD_SIZE;
+ ret = ioctl_vmalloc_hugepage(dev_fd, vmalloc_huge_infos + i);
+ if(ret < 0) {
+ pr_info("vmalloc hugepage failed");
+ } else {
+ pr_info("vmalloc hugepage success");
+ }
+ }
+ return ret;
+}
+
+int vfreeAll()
+{
+ pr_info("now inside %s, thread index is %d", __FUNCTION__, thread_index);
+
+ int ret;
+
+ for (int i = 0; i < THREAD_NUM; i++) {
+ ret = ioctl_vfree(dev_fd, vmalloc_infos + i);
+ if (ret != 0) {
+ pr_info("vfree failed, errno is %d", errno);
+ } else {
+ pr_info("vfree success");
+ }
+ ret = ioctl_vfree(dev_fd, vmalloc_huge_infos + i);
+ if (ret != 0) {
+ pr_info("vfree failed, errno is %d", errno);
+ } else {
+ pr_info("vfree hugepage success");
+ }
+ }
+ thread_index = 0;
+ return 0;
+}
+
+int startThreads(void *(thread)(void *))
+{
+ int ret = 0;
+ semid = sem_create(1234, "core_dump_after_xxx_time_count");
+ setCore();
+
+ // add group
+ int group_id = GROUP_ID;
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, group_id);
+ if (ret < 0) {
+ printf("add task(pid%d) to group(%d) failed, err: %s\n", getpid(), group_id, strerror(errno));
+ return -1;
+ } else
+ printf("add task(pid%d) to group(%d) success\n", getpid(), group_id);
+
+ // 重复
+ pthread_t threads[THREAD_NUM];
+ thread_index = 0;
+ for (int i = 0; i < THREAD_NUM; i++) {
+ pthread_create(threads + i, NULL, thread, (void *)group_id);
+ }
+
+ sem_dec_by_val(semid, KILL_TIME);
+
+ sem_close(semid);
+ if (thread_index > THREAD_NUM) {
+ pr_info("failure, thread index: %d not correct!!", thread_index);
+ return -1;
+ }
+ ret = generateCoredump();
+
+ sleep(3);
+
+ return ret;
+}
+
+/* testcase1: alloc后产生coredump */
+static int testcase1(void)
+{
+ int status;
+ int pid = fork();
+ if (pid == 0) {
+ exit(startThreads(alloc_thread));
+ } else if (pid > 0){
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ // expected status is 139 = 128 + 11 (SIGSEGV)
+ pr_info("coredump as expected, return value is %d", status);
+ }
+ }
+ return 0;
+}
+
+/* testcase2: k2spg中coredump */
+static int testcase2(void)
+{
+ int pid;
+ vmallocAll();
+ FORK_CHILD_ARGS(pid, startThreads(k2u_thread));
+ int status;
+ waitpid(pid, &status, 0);
+ vfreeAll();
+}
+
+/* testcase3: u2k中coredump */
+static int testcase3(void)
+{
+ int status;
+ int pid = fork();
+ if (pid == 0) {
+ exit(startThreads(u2k_thread));
+ } else if (pid > 0){
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ // expected status is 139 = 128 + 11 (SIGSEGV)
+ pr_info("coredump as expected, return value is %d", status);
+ }
+ }
+ return 0;
+}
+
+/* testcase4: add group and query中coredump */
+static int testcase4(void)
+{
+ int status;
+ int pid = fork();
+ if (pid == 0) {
+ exit(startThreads(addgroup_thread));
+ } else if (pid > 0){
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ // expected status is 139 = 128 + 11 (SIGSEGV)
+ pr_info("coredump as expected, return value is %d", status);
+ }
+ }
+ return 0;
+}
+
+/* testcase5: k2task中coredump */
+static int testcase5(void)
+{
+ int pid;
+ vmallocAll();
+ FORK_CHILD_ARGS(pid, startThreads(k2task_thread));
+ int status;
+ waitpid(pid, &status, 0);
+ vfreeAll();
+}
+
+/* testcase6: walkpagerange中coredump - 会有kmemory leak*/
+static int testcase6(void)
+{
+ int status;
+ int pid = fork();
+ if (pid == 0) {
+ exit(startThreads(walkpagerange_thread));
+ } else if (pid > 0){
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ // expected status is 139 = 128 + 11 (SIGSEGV)
+ pr_info("coredump as expected, return value is %d", status);
+ }
+ }
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "alloc后产生coredump")
+ TESTCASE_CHILD(testcase2, "k2spg中coredump")
+ TESTCASE_CHILD(testcase3, "u2k中coredump")
+ TESTCASE_CHILD(testcase4, "add group and query中coredump")
+ TESTCASE_CHILD(testcase5, "k2task中coredump")
+ TESTCASE_CHILD(testcase6, "walkpagerange中coredump - 会有kmemory leak")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/coredump/test_coredump2.c b/tools/testing/sharepool/testcase/reliability_test/coredump/test_coredump2.c
new file mode 100644
index 000000000000..9ff36b1e68e4
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/coredump/test_coredump2.c
@@ -0,0 +1,202 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri May 21 07:23:31 2021
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <signal.h>
+#include <unistd.h>
+#include <stdlib.h> // for exit
+#include <sys/mman.h>
+#include <time.h> /* time() */
+#include <sys/resource.h>
+
+#include "sharepool_lib.h"
+
+
+static int init_env(void)
+{
+ struct rlimit core_lim;
+
+ if (getrlimit(RLIMIT_CORE, &core_lim)) {
+ printf("getrlimit failed, err: %s\n", strerror(errno));
+ return -1;
+ } else
+ printf("current rlimit for RLIMIT_CORE is: %lx, %lx\n", core_lim.rlim_cur, core_lim.rlim_max);
+
+ core_lim.rlim_cur = RLIM_INFINITY;
+ if (setrlimit(RLIMIT_CORE, &core_lim)) {
+ printf("setrlimit failed, err: %s\n", strerror(errno));
+ return -1;
+ } else
+ printf("setrlimit for RLIMIT_CORE to unlimited\n");
+
+ return 0;
+}
+
+/* do nothing */
+static int child_do_nothing(sem_t *sync)
+{
+ int ret;
+
+ SEM_WAIT(sync);
+
+ pr_info("child pid: %d", getpid());
+
+ while (1);
+
+ return 0;
+}
+
+static int child_sp_alloc(sem_t *sync)
+{
+ int ret;
+
+ SEM_WAIT(sync);
+
+ pr_info("child pid: %d wake up.", getpid());
+out:
+ while (1) {
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 1024,
+ .spg_id = SPG_ID_DEFAULT,
+ };
+ TEST_CHECK(ioctl_alloc(dev_fd, &alloc_info), out);
+ TEST_CHECK(ioctl_free(dev_fd, &alloc_info), out);
+ }
+
+ return 0;
+}
+
+static int child_sp_alloc_and_free(sem_t *sync)
+{
+ int ret;
+
+ SEM_WAIT(sync);
+
+ pr_info("child pid: %d", getpid());
+out:
+ while (1) {
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 1024,
+ .spg_id = SPG_ID_DEFAULT,
+ };
+ TEST_CHECK(ioctl_alloc(dev_fd, &alloc_info), out);
+ TEST_CHECK(ioctl_free(dev_fd, &alloc_info), out);
+ }
+
+ return 0;
+}
+
+#define test_child_num 20
+#define test_group_num 10
+
+static int fork_or_coredump(int (*child)(sem_t *))
+{
+ int ret, i, j;
+ pid_t pid[test_child_num];
+ int groups[test_group_num];
+ sem_t *sync[test_child_num];
+ int repeat = 100;
+
+ for (i = 0; i < test_child_num; i++)
+ SEM_INIT(sync[i], i);
+
+ for (i = 0; i < test_child_num; i++)
+ FORK_CHILD_ARGS(pid[i], child(sync[i]));
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid[0],
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = SPG_ID_AUTO,
+ };
+
+ for (i = 0; i < test_group_num; i++) {
+ ag_info.spg_id = SPG_ID_AUTO;
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out_kill);
+ groups[i] = ag_info.spg_id;
+ }
+
+ for (i = 1; i < test_child_num; i++) {
+ ag_info.pid = pid[i];
+ for (j = 0; j < test_group_num; j++) {
+ ag_info.spg_id = groups[j];
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out_kill);
+ }
+ }
+
+ for (i = 0; i < test_child_num; i++)
+ sem_post(sync[i]);
+
+ int alive_process = test_child_num;
+ srand((unsigned)time(NULL));
+
+ for (i = 0; i < repeat; i++) {
+ pr_info("kill time %dth, %d times left.", i + 1, repeat - (i + 1));
+ int idx = rand() % test_child_num;
+ /* 不能把所有进程都杀掉， 否则进程退出，组正在销毁，后面加组会失败 */
+ if (pid[idx] && alive_process > 1) {
+ kill(pid[idx], SIGSEGV);
+ waitpid(pid[idx], 0, NULL);
+ pid[idx] = 0;
+ alive_process--;
+ } else {
+ FORK_CHILD_ARGS(pid[idx], child(sync[idx]));
+ ag_info.pid = pid[idx];
+ for (j = 0; j < test_group_num; j++) {
+ ag_info.spg_id = groups[j];
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out_kill);
+ }
+ sem_post(sync[idx]);
+ alive_process++;
+ }
+ }
+
+ return 0;
+
+out_kill:
+ for (i = 0; i < test_child_num; i++)
+ kill(pid[i], SIGKILL);
+out:
+ return ret;
+}
+
+static int testcase1(void)
+{
+ setCore();
+ return fork_or_coredump(child_do_nothing);
+}
+
+static int testcase2(void)
+{
+ setCore();
+ return fork_or_coredump(child_sp_alloc);
+}
+
+static int testcase3(void)
+{
+ init_env();
+ return fork_or_coredump(child_sp_alloc_and_free);
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE(testcase1, "N个加组后什么也不做，coredump")
+ TESTCASE(testcase2, "N个进程加组后alloc，然后coredump")
+ TESTCASE(testcase3, "N个进程加组后alloc-free，然后coredump")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/coredump/test_coredump_k2u_alloc.c b/tools/testing/sharepool/testcase/reliability_test/coredump/test_coredump_k2u_alloc.c
new file mode 100644
index 000000000000..782615493a85
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/coredump/test_coredump_k2u_alloc.c
@@ -0,0 +1,562 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Dec 16 06:59:45 2020
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <signal.h>
+#include <sys/time.h>
+#include <sys/resource.h>
+#include <stdlib.h> /* rand() and srand() */
+#include <time.h> /* time() */
+#include <pthread.h>
+
+#include "sharepool_lib.h"
+#include "sem_use.h"
+
+#define PROC_NUM 64
+#define GROUP_ID 1
+#define K2U_UNSHARE_TIME 2
+#define ALLOC_FREE_TIME 2
+#define VMALLOC_SIZE 4096
+#define PROT (PROT_READ | PROT_WRITE)
+#define GROUP_NUM 4
+#define K2U_CONTINUOUS_TIME 200
+#define min(a,b) ((a)<(b)?(a):(b))
+
+/* testcase1:
+ * 每个组都拉起一个进程负责k2u，其他N个进程加多组后依次coredump，所有组k2u每次都应该返回成功。
+ * 打印维测信息，k2u正常。
+ * 所有进程coredump后，测试退出，打印维测信息，组和spa均为0，无泄漏。
+ */
+
+static int semid[PROC_NUM];
+static int sem_task;
+static int group_ids[GROUP_NUM];
+
+struct k2u_args {
+ int with_print;
+ int k2u_whole_times; // repeat times
+ int (*k2u_tsk)(struct k2u_args);
+};
+
+struct task_param {
+ bool with_print;
+};
+
+struct test_setting {
+ int (*task)(struct task_param*);
+ struct task_param *task_param;
+};
+
+static int init_sem();
+static int close_sem();
+static int k2u_unshare_task(struct task_param *task_param);
+static int k2u_continuous_task(struct task_param *task_param);
+static int child_process(int index);
+static int alloc_free_task(struct task_param *task_param);
+static int alloc_continuous_task(struct task_param *task_param);
+static int testcase_combine(int (*task1)(struct task_param*),
+ int (*task2)(struct task_param*), struct task_param *param);
+
+static int testcase_base(struct test_setting test_setting)
+{
+ int status;
+ int pid;
+ int child[PROC_NUM];
+ int ret;
+ int pid_k2u;
+
+ setCore();
+ // 初始化sem
+ ret = init_sem();
+ if (ret < 0) {
+ pr_info("init sem failed");
+ return -1;
+ }
+
+ // 创建组
+ //ret = wrap_add_group(getpid(), PROT, GROUP_ID);
+ ret = create_multi_groups(getpid(), GROUP_NUM, group_ids);
+ if (ret < 0) {
+ pr_info("add group failed %d", getpid());
+ return -1;
+ }
+
+ // 拉起功能进程，负责k2u或者alloc
+ pid_k2u = fork();
+ if (pid_k2u < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid_k2u == 0) {
+ ret = add_multi_groups(getpid(), GROUP_NUM, group_ids);
+ if (ret < 0) {
+ pr_info("add group failed %d", getpid());
+ exit(-1);
+ } else {
+ pr_info("functional process add group succuess.");
+ }
+ exit(test_setting.task(test_setting.task_param));
+ }
+
+ // 拉起子进程
+ for (int i = 0; i < PROC_NUM; i++) {
+ pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed, deleting procs...");
+ goto delete_procs;
+ } else if (pid == 0) {
+ // 拉起子进程 hanging
+ exit(child_process(i));
+ } else {
+ child[i] = pid;
+ //ret = wrap_add_group(pid, PROT, GROUP_ID);
+ ret = add_multi_groups(pid, GROUP_NUM, group_ids);
+ if (ret < 0) {
+ pr_info("add group failed %d", pid);
+ goto delete_procs;
+ }
+ }
+ }
+
+ // 依次让子进程coredump
+ for (int i = 0; i < PROC_NUM; i++) {
+ pr_info("coredump process %d", child[i]);
+ sem_inc_by_one(semid[i]);
+ waitpid(child[i], &status, 0);
+ usleep(200000);
+ }
+
+ // 功能进程退出
+ sem_inc_by_one(sem_task);
+ waitpid(pid_k2u, &status, 0);
+
+ close_sem();
+ return 0;
+
+delete_procs:
+ return -1;
+}
+
+static int testcase_combine(int (*task1)(struct task_param*),
+ int (*task2)(struct task_param*), struct task_param *param)
+{
+ int status;
+ int pid;
+ int child[PROC_NUM];
+ int ret;
+ int pid_k2u, pid_alloc;
+
+ setCore();
+ // 初始化sem
+ ret = init_sem();
+ if (ret < 0) {
+ pr_info("init sem failed");
+ return -1;
+ }
+
+ // 创建组
+ //ret = wrap_add_group(getpid(), PROT, GROUP_ID);
+ ret = create_multi_groups(getpid(), GROUP_NUM, group_ids);
+ if (ret < 0) {
+ pr_info("add group failed %d", getpid());
+ return -1;
+ }
+
+ // 拉起功能进程，负责k2u或者alloc
+ pid_k2u = fork();
+ if (pid_k2u < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid_k2u == 0) {
+ ret = add_multi_groups(getpid(), GROUP_NUM, group_ids);
+ if (ret < 0) {
+ pr_info("add group failed %d", getpid());
+ exit(-1);
+ } else {
+ pr_info("functional process add group succuess.");
+ }
+ exit(task1(param));
+ }
+
+ pid_alloc = fork();
+ if (pid_alloc < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid_alloc == 0) {
+ ret = add_multi_groups(getpid(), GROUP_NUM, group_ids);
+ if (ret < 0) {
+ pr_info("add group failed %d", getpid());
+ exit(-1);
+ } else {
+ pr_info("functional process add group succuess.");
+ }
+ exit(task2(param));
+ }
+
+ // 拉起子进程
+ for (int i = 0; i < PROC_NUM; i++) {
+ pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed, deleting procs...");
+ goto delete_procs;
+ } else if (pid == 0) {
+ // 拉起子进程 hanging
+ exit(child_process(i));
+ } else {
+ child[i] = pid;
+ //ret = wrap_add_group(pid, PROT, GROUP_ID);
+ ret = add_multi_groups(pid, GROUP_NUM, group_ids);
+ if (ret < 0) {
+ pr_info("add group failed %d", pid);
+ goto delete_procs;
+ }
+ }
+ }
+
+ // 依次让子进程coredump
+ for (int i = 0; i < PROC_NUM; i++) {
+ pr_info("coredump process %d", child[i]);
+ sem_inc_by_one(semid[i]);
+ waitpid(child[i], &status, 0);
+ usleep(200000);
+ }
+
+ // 功能进程退出
+ sem_inc_by_val(sem_task, 2);
+ waitpid(pid_k2u, &status, 0);
+ waitpid(pid_alloc, &status, 0);
+
+ close_sem();
+ return 0;
+
+delete_procs:
+ return -1;
+}
+
+static struct task_param task_param_table[] = {
+ {
+ .with_print = false, // 不打印维测
+ },
+ {
+ .with_print = true, // 打印维测
+ },
+};
+
+static struct test_setting test_setting_table[] = {
+ {
+ .task_param = &task_param_table[0],
+ .task = k2u_unshare_task, // k2u->unshare 重复N次
+ },
+ {
+ .task_param = &task_param_table[1],
+ .task = k2u_unshare_task, // k2u->unshare 重复N次
+ },
+ {
+ .task_param = &task_param_table[0],
+ .task = k2u_continuous_task, // k2u重复N次，再unshare重复N次
+ },
+ {
+ .task_param = &task_param_table[0],
+ .task = alloc_free_task, // alloc->free 重复N次
+ },
+ {
+ .task_param = &task_param_table[0],
+ .task = alloc_continuous_task, // alloc N块内存，再free掉，重复M次
+ },
+};
+
+static int testcase1(void)
+{
+ return testcase_base(test_setting_table[0]);
+}
+
+static int testcase2(void)
+{
+ return testcase_base(test_setting_table[1]);
+}
+
+static int testcase3(void)
+{
+ return testcase_base(test_setting_table[2]);
+}
+
+static int testcase4(void)
+{
+ return testcase_base(test_setting_table[3]);
+}
+
+static int testcase5(void)
+{
+ return testcase_base(test_setting_table[4]);
+}
+
+static int testcase6(void)
+{
+ return testcase_combine(k2u_continuous_task, alloc_continuous_task, &task_param_table[0]);
+}
+
+/* testcase4: k2u负责进程coredump */
+static int close_sem()
+{
+ int ret;
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ ret = sem_close(semid[i]);
+ if (ret < 0) {
+ pr_info("sem close failed");
+ return ret;
+ }
+ }
+ sem_close(sem_task);
+ pr_info("all sems deleted.");
+ return 0;
+}
+
+static int init_sem()
+{
+ int i = 0;
+
+ sem_task = sem_create(PROC_NUM, "sem_task");
+
+ for (i = 0; i < PROC_NUM; i++) {
+ key_t key = i;
+ semid[i] = sem_create(key, "sem_child");
+ if (semid[i] < 0) {
+ pr_info("semid %d init failed. errno: %d", i, errno);
+ goto delete_sems;
+ }
+ }
+ pr_info("all sems initialized.");
+ return 0;
+
+delete_sems:
+ for (int j = 0; j < i; j++) {
+ sem_close(semid[j]);
+ }
+ return -1;
+}
+
+static int child_process(int index)
+{
+ pr_info("child process %d created", getpid());
+ // 收到coredump信号后coredump
+ sem_dec_by_one(semid[index]);
+ pr_info("child process %d coredump", getpid());
+ generateCoredump();
+ return 0;
+}
+
+static int k2u_unshare_task(struct task_param *task_param)
+{
+ int ret;
+ int i;
+ struct vmalloc_info vmalloc_info;
+ struct sp_make_share_info k2u_info;
+ unsigned long uva[K2U_UNSHARE_TIME];
+
+ vmalloc_info.size = VMALLOC_SIZE;
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed.");
+ return -1;
+ } else {
+ pr_info("vmalloc %ld success.", vmalloc_info.size);
+ }
+
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+ k2u_info.sp_flags = 0;
+ k2u_info.pid = getpid();
+ k2u_info.spg_id = GROUP_ID;
+
+repeat:
+ memset(uva, 0, sizeof(unsigned long) * K2U_UNSHARE_TIME);
+ for (i = 0; i < K2U_UNSHARE_TIME; i++) {
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("k2u failed at %d time.", i);
+ goto unshare;
+ } else {
+ pr_info("k2u success %d time, addr = %lx", i, k2u_info.addr);
+ uva[i] = k2u_info.addr;
+ }
+ }
+
+ if (task_param->with_print)
+ sharepool_print();
+
+unshare:
+ for (int j = 0; j < i; j++) {
+ pr_info("uva[%d] is %ld", j, uva[j]);
+ k2u_info.addr = uva[j];
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("unshare failed at %d", j);
+ return -1;
+ }
+ }
+
+ if (sem_get_value(sem_task) == 0)
+ goto repeat;
+
+ ioctl_vfree(dev_fd, &vmalloc_info);
+
+ return 0;
+}
+
+static int k2u_continuous_task(struct task_param *task_param)
+{
+ int ret;
+ int i, h;
+ struct vmalloc_info vmalloc_info;
+ struct sp_make_share_info k2u_info;
+ unsigned long *uva;
+
+ vmalloc_info.size = VMALLOC_SIZE;
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed.");
+ return -1;
+ } else {
+ pr_info("vmalloc %ld success.", vmalloc_info.size);
+ }
+
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+ k2u_info.sp_flags = 0;
+ k2u_info.pid = getpid();
+ //k2u_info.spg_id = GROUP_ID;
+
+ uva = malloc(sizeof(unsigned long) * K2U_CONTINUOUS_TIME * GROUP_NUM);
+
+ memset(uva, 0, sizeof(unsigned long) * K2U_CONTINUOUS_TIME * GROUP_NUM);
+ for (i = 0; i < K2U_CONTINUOUS_TIME; i++) {
+ for (h = 0; h < GROUP_NUM; h++) {
+ k2u_info.spg_id = group_ids[h];
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("k2u failed at %d time in group %d.", i, group_ids[h]);
+ goto unshare;
+ } else {
+ pr_info("k2u success %d time, addr = %lx", i, k2u_info.addr);
+ uva[i * GROUP_NUM + h] = k2u_info.addr;
+ }
+ }
+ }
+
+unshare:
+ for (int j = 0; j < min((i * GROUP_NUM + h), K2U_CONTINUOUS_TIME * GROUP_NUM); j++) {
+ pr_info("uva[%d] is %ld", j, uva[j]);
+ k2u_info.addr = uva[j];
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("unshare failed at %d", j);
+ return -1;
+ }
+ }
+
+ ioctl_vfree(dev_fd, &vmalloc_info);
+
+ return 0;
+}
+
+/* 已加组，持续alloc-free*/
+#define ALLOC_SIZE 4096
+#define ALLOC_FLAG 0
+static int alloc_free_task(struct task_param *task_param)
+{
+ int ret = 0;
+ int i, h;
+ unsigned long ret_addr = -1;
+ unsigned long addr[ALLOC_FREE_TIME][GROUP_NUM];
+
+repeat:
+ for (i = 0; i < ALLOC_FREE_TIME; i++) {
+ for (h = 0; h < GROUP_NUM; h++) {
+ ret_addr = wrap_sp_alloc(group_ids[h], ALLOC_SIZE, ALLOC_FLAG);
+ if (!ret_addr) {
+ pr_info("alloc failed %d time %d group", i, h + 1);
+ return ret_addr;
+ } else {
+ addr[i][h] = ret_addr;
+ pr_info("alloc success addr %x", ret_addr);
+ }
+ }
+ }
+
+ if (task_param->with_print)
+ sharepool_print();
+
+free:
+ for (i = 0; i < ALLOC_FREE_TIME; i++) {
+ for (h = 0; h < GROUP_NUM; h++) {
+ ret = wrap_sp_free(addr[i][h]);
+ if (ret < 0) {
+ pr_info("free failed %d time group %d", i, h + 1);
+ return ret;
+ }
+ }
+ }
+
+ if (sem_get_value(sem_task) == 0)
+ goto repeat;
+
+ return ret;
+}
+
+#define ALLOC_CONTINUOUS_TIME 200
+static int alloc_continuous_task(struct task_param *task_param)
+{
+ int ret = 0;
+ int i, h;
+ unsigned long ret_addr = -1;
+ unsigned long addr[ALLOC_CONTINUOUS_TIME][GROUP_NUM];
+ for (i = 0; i < ALLOC_CONTINUOUS_TIME; i++) {
+ for (h = 0; h < GROUP_NUM; h++) {
+ ret_addr = wrap_sp_alloc(group_ids[h], ALLOC_SIZE, ALLOC_FLAG);
+ if (!ret_addr) {
+ pr_info("alloc failed %d time %d group", i, h + 1);
+ return ret_addr;
+ } else {
+ addr[i][h] = ret_addr;
+ pr_info("alloc success addr %x", ret_addr);
+ }
+ }
+ }
+ for (i = 0; i < ALLOC_CONTINUOUS_TIME; i++) {
+ for (h = 0; h < GROUP_NUM; h++) {
+ ret = wrap_sp_free(addr[i][h]);
+ if (ret < 0) {
+ pr_info("free failed %d time group %d", i, h + 1);
+ return ret;
+ }
+ }
+ }
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "每个组都拉起一个进程负责k2u，其他N个进程加多组后依次coredump，所有组k2u每次都应该返回成功。")
+ TESTCASE_CHILD(testcase2, "testcase1, 但打印维测")
+ TESTCASE_CHILD(testcase3, "持续地k2u并且coredump")
+ TESTCASE_CHILD(testcase4, "alloc-free循环的coredump")
+ TESTCASE_CHILD(testcase5, "alloc-coredump, free-coredump")
+ TESTCASE_CHILD(testcase6, "持续地k2u, alloc, 无维测")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/fragment/Makefile b/tools/testing/sharepool/testcase/reliability_test/fragment/Makefile
new file mode 100644
index 000000000000..5370208dbd64
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/fragment/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/reliability_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/reliability_test/fragment/test_external_fragmentation.c b/tools/testing/sharepool/testcase/reliability_test/fragment/test_external_fragmentation.c
new file mode 100644
index 000000000000..1e1d88705a00
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/fragment/test_external_fragmentation.c
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Description: test external fragmentation
+ * Author: Huawei OS Kernel Lab
+ * Create: Tue Apr 20 22:23:51 2021
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+
+/*
+ * I recomend you run this test twice in parallel then kill one of them
+ * so that external fragmentation is created.
+ */
+
+int main(int argc, char *argv[]) {
+ char *p;
+ int i, times;
+ pid_t pid = getpid();
+
+ times = atoi(argv[1]);
+ printf("Fragmentation test pid %d will allocate %d 4K pages\n", pid, times);
+
+ p = sbrk(0);
+
+ for (i = 0; i < times; i++) {
+ sbrk(4096);
+ memset(p + i * 4096, 'a', 4096);
+ }
+
+ printf("Test %d allocation finished. begin sleep.\n", pid);
+ sleep(1200);
+ return 0;
+}
diff --git a/tools/testing/sharepool/testcase/reliability_test/fragment/test_external_fragmentation_trigger.c b/tools/testing/sharepool/testcase/reliability_test/fragment/test_external_fragmentation_trigger.c
new file mode 100644
index 000000000000..310c7c240177
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/fragment/test_external_fragmentation_trigger.c
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Description: trigger
+ * Author: Huawei OS Kernel Lab
+ * Create: Tue Apr 20 23:17:22 2021
+ */
+
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <sys/types.h>
+
+#include "sharepool_lib.h"
+
+#define GROUP_ID 1
+
+int main(void) {
+
+ int i, fd, ret;
+ fd = open_device();
+ if (fd < 0) {
+ printf("open fd error\n");
+ return -1;
+ }
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = GROUP_ID,
+ };
+ ret = ioctl_add_group(fd, &ag_info);
+ if (ret < 0) {
+ printf("add group failed, ret is %d, error is %d\n", ret, errno);
+ goto error;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = SP_HUGEPAGE,
+ .spg_id = GROUP_ID,
+ .size = PMD_SIZE,
+ };
+
+ // alloc 400MB try to trigger memory compaction
+ for (i = 0; i < 200; i++) {
+ ret = ioctl_alloc(fd, &alloc_info);
+ if (ret) {
+ printf("alloc failed, ret is %d, error is %d\n", ret, errno);
+ goto error;
+ }
+ }
+
+ close_device(fd);
+ return 0;
+error:
+ close_device(fd);
+ return -1;
+}
diff --git a/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/Makefile b/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/Makefile
new file mode 100644
index 000000000000..5370208dbd64
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/reliability_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_k2u_and_kill.c b/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_k2u_and_kill.c
new file mode 100644
index 000000000000..e0b7287faba0
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_k2u_and_kill.c
@@ -0,0 +1,276 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Thu Dec 17 03:09:02 2020
+ */
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+#include <sys/ipc.h>
+#include <sys/msg.h>
+
+#include <pthread.h>
+
+#include "sharepool_lib.h"
+
+#define CHILD_NUM 50
+#define THREAD_PER_PROCESS 20
+#define KILL_NUM 50
+#define VMALLOC_SIZE (3 * PAGE_SIZE)
+
+static int vmalloc_count;
+static int vfree_count;
+static struct vmalloc_info vm_data[CHILD_NUM];
+
+struct msgbuf {
+ long mtype;
+ struct vmalloc_info vmalloc_info;
+};
+
+static void send_msg(int msgid, int msgtype, struct vmalloc_info ka_info)
+{
+ struct msgbuf msg = {
+ .mtype = msgtype,
+ .vmalloc_info = ka_info,
+ };
+
+ if(msgsnd(msgid, (void *) &msg, sizeof(msg.vmalloc_info),
+ IPC_NOWAIT) == -1) {
+ perror("msgsnd error");
+ exit(EXIT_FAILURE);
+ } else {
+ pr_info("child %d message sent success: size: %x, addr: %lx",
+ msgtype - 1, ka_info.size, ka_info.addr);
+ }
+}
+
+static void get_msg(int msgid, int msgtype)
+{
+ struct msgbuf msg;
+ if (msgrcv(msgid, (void *) &msg, sizeof(msg.vmalloc_info), msgtype,
+ MSG_NOERROR) == -1) {
+ if (errno != ENOMSG) {
+ perror("msgrcv");
+ exit(EXIT_FAILURE);
+ }
+ pr_info("No message available for msgrcv()");
+ } else {
+ pr_info("child %d message received success: size: %x, addr: %lx",
+ msgtype - 1, msg.vmalloc_info.size, msg.vmalloc_info.addr);
+ vm_data[msgtype - 1] = msg.vmalloc_info;
+ vmalloc_count++;
+ }
+}
+
+static void *child_thread(void *arg)
+{
+ int ret;
+ struct sp_make_share_info k2u_info = *(struct sp_make_share_info *)arg;
+ while (1) {
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ } else {
+ //pr_info("ioctl_k2u success");
+ }
+
+ memset((void *)k2u_info.addr, 'a', k2u_info.size);
+
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+ }
+
+ return NULL;
+}
+
+static int child_process(int idx, int msgid)
+{
+ int ret;
+
+ struct vmalloc_info ka_info = {
+ .size = VMALLOC_SIZE,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+
+ if (ret < 0) {
+ pr_info("child%d: ioctl_vmalloc failed", idx);
+ return -1;
+ } else {
+ send_msg(msgid, idx + 1, ka_info);
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .pid = getpid(),
+ };
+
+ pthread_t threads[THREAD_PER_PROCESS] = {0};
+ for (int i = 0; i < THREAD_PER_PROCESS; i++) {
+ ret = pthread_create(threads + i, NULL, child_thread, &k2u_info);
+ if (ret < 0) {
+ pr_info("child%d: pthread_create failed, err:%d", idx, ret);
+ return -1;
+ }
+ }
+
+ for (int i = 0; i < THREAD_PER_PROCESS; i++)
+ if (threads[i])
+ pthread_join(threads[i], NULL);
+
+ return 0;
+}
+
+static pid_t fork_and_add_group(int idx, int group_id, int (*child)(int, int), int msgid, char ch)
+{
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(child(idx, msgid));
+ }
+
+ if (group_id == SPG_ID_DEFAULT)
+ return pid;
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+ return -1;
+ } else {
+ return pid;
+ }
+}
+
+/*
+ * group_id == SPG_ID_DEFAULT 不加组
+ * group_id == SPG_ID_DEFAULT 所有进程加不同组
+ * 其他，所有进程加指定组
+ */
+static int testcase_routing(int group_id, char ch)
+{
+ int ret = 0;
+ pid_t child[CHILD_NUM] = {0};
+
+ int msgid;
+ int msgkey = 1234;
+ msgid = msgget(msgkey, IPC_CREAT | 0666);
+ pr_info("msg id is %d", msgid);
+
+ for (int i = 0; i < CHILD_NUM; i++) {
+ pid_t pid = fork_and_add_group(i, group_id == SPG_ID_DEFAULT ? i + 1 : group_id, child_process, msgid, ch);
+ if (pid < 0) {
+ ret = -1;
+ goto out;
+ }
+ child[i] = pid;
+ get_msg(msgid, i + 1);
+ }
+
+ unsigned int sed = time(NULL);
+ srand(sed);
+ pr_info("rand sed: %u", sed);
+
+ int count = 0;
+ for (int i = 0; i < KILL_NUM; i++) {
+ int idx = rand() % CHILD_NUM;
+ if (child[idx] > 0) {
+ kill(child[idx], SIGKILL);
+ waitpid(child[idx], NULL, 0);
+ //pr_info("vfree address is %lx", vm_data[idx].addr);
+ //vm_data[idx].size = VMALLOC_SIZE;
+ if (ioctl_vfree(dev_fd, &vm_data[idx]) < 0) {
+ pr_info("vfree %d failed", idx);
+ } else {
+ vfree_count++;
+ pr_info("vfree %d finished.", idx);
+ }
+ pr_info("count: %d, kill child: %d, pid: %d", ++count, idx, child[idx]);
+ child[idx] = 0;
+ } else {
+ pid_t pid = fork_and_add_group(idx, group_id == SPG_ID_DEFAULT ? idx + 1 : group_id,
+ child_process, msgid, ch);
+ if (pid < 0) {
+ ret = -1;
+ goto out;
+ }
+ child[idx] = pid;
+ pr_info("fork child: %d, pid: %d", idx, child[idx]);
+ get_msg(msgid, idx + 1);
+ }
+// sleep(1);
+ }
+
+out:
+ for (int i = 0; i < CHILD_NUM; i++)
+ if (child[i] > 0) {
+ kill(child[i], SIGKILL);
+ //pr_info("vfree2 address is %lx", vm_data[i].addr);
+ //vm_data[i].size = VMALLOC_SIZE;
+ if (ioctl_vfree(dev_fd, &vm_data[i]) < 0) {
+ pr_info("vfree2 %d failed, errno is %d", i, errno);
+ } else {
+ vfree_count++;
+ pr_info("vfree2 %d finished.", i);
+ }
+ }
+
+ pr_info("vmalloc %d times, vfree %d times.", vmalloc_count, vfree_count);
+ vmalloc_count = 0;
+ vfree_count = 0;
+
+ return ret;
+}
+
+// 所有进程不加组
+static int testcase1(void)
+{
+ return testcase_routing(SPG_ID_DEFAULT, 'a');
+}
+
+// 所有进程加不同组
+static int testcase2(void)
+{
+ return testcase_routing(SPG_ID_DEFAULT, 'b');
+}
+
+// 所有进程加同一组
+static int testcase3(void)
+{
+ return testcase_routing(100, 'c');
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "k2u and kill, 所有进程不加组")
+ TESTCASE_CHILD(testcase2, "k2u and kill, 所有进程加不同组")
+ TESTCASE_CHILD(testcase3, "k2u and kill, 所有进程加同一组")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_k2u_unshare.c b/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_k2u_unshare.c
new file mode 100644
index 000000000000..85ad9ce5af01
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_k2u_unshare.c
@@ -0,0 +1,188 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Nov 30 18:27:26 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+#define pr_info(fmt, args...) \
+ printf("[file:%s, func:%s, line:%d] " fmt "\n", __FILE__, __func__, __LINE__, ##args)
+
+static int dev_fd;
+
+/*
+ * 内存共享后，先释放内存再停止共享。
+ * testcase1: vmalloc并k2task后，不unshare直接vfree，预计失败。kill进程再vfree。预计成功。
+ */
+
+static int testcase1_child(struct vmalloc_info ka_info)
+{
+ int ret = 0;
+
+ while (1);
+
+ return ret;
+}
+
+/* testcase1: 测试发送signal 9 给进程 */
+static int testcase1(void)
+{
+ int ret;
+ int pid;
+ int status;
+
+ struct vmalloc_info ka_info = {
+ .size = 10000,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+ }
+
+ pid = fork();
+ if (pid < 0)
+ printf("fork failed");
+ else if (pid == 0)
+ exit(testcase1_child(ka_info));
+ else {
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = pid,
+ };
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+ }
+
+ // 测试点1：不经过unshare()直接vfree，预期失败，有警告打印
+ printf("test point 1: vfree no unshare. ----------\n");
+ ioctl_vfree(dev_fd, &ka_info);
+
+ // 测试点2：使用SIGKILL杀死进程，再vfree，预期成功，无警告打印
+ printf("test point 2: vfree after kill process. ----------\n");
+ kill(pid, SIGKILL);
+ waitpid(pid, &status, 0);
+
+ ioctl_vfree(dev_fd, &ka_info);
+ }
+
+ return ret;
+}
+
+/* testcase2: 测试发送signal 2 给进程 */
+static int testcase2(void)
+{
+ int ret;
+ int pid;
+ int status;
+
+ struct vmalloc_info ka_info = {
+ .size = 10000,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+ }
+
+ pid = fork();
+ if (pid < 0)
+ printf("fork failed");
+ else if (pid == 0)
+ exit(testcase1_child(ka_info));
+ else {
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = pid,
+ };
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+ }
+
+ // 测试点1：不经过unshare()直接vfree，预期失败，有警告打印
+ printf("test point 1: vfree no unshare. ----------\n");
+ ioctl_vfree(dev_fd, &ka_info);
+
+ // 测试点2：用SIGINT杀死进程，再vfree，预期成功，无警告打印
+ printf("test point 2: vfree after kill process. ----------\n");
+ kill(pid, SIGINT);
+ waitpid(pid, &status, 0);
+
+ ioctl_vfree(dev_fd, &ka_info);
+ }
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "k2task之后，测试点1：不经过unshare()直接vfree，预期失败，有警告打印；测试点2：使用SIGKILL杀死进程，再vfree，预期成功，无警告打印")
+ TESTCASE_CHILD(testcase2, "k2task之后，测试点1：不经过unshare()直接vfree，预期失败，有警告打印；测试点2：使用SIGINT杀死进程，再vfree，预期成功，无警告打印")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_malloc_u2k.c b/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_malloc_u2k.c
new file mode 100644
index 000000000000..168ad1139648
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_malloc_u2k.c
@@ -0,0 +1,187 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Dec 04 17:20:10 2020
+ */
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <pthread.h>
+#include <fcntl.h> /* For O_* constants */
+
+#include <sys/wait.h>
+#include <sys/types.h>
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+/*
+ * testcase1: 用户态调用malloc，再调用u2k。预期成功。
+ */
+
+static int testcase1(void)
+{
+ int ret;
+
+ int psize = getpagesize();
+ char *user_addr = malloc(1000 * psize);
+ if (user_addr == NULL) {
+ pr_info("malloc failed, errno: %d", errno);
+ return -1;
+ }
+ memset((void *)user_addr, 'q', 1000 * psize);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = (unsigned long)user_addr,
+ .size = 1000 * psize,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_CHECK,
+ .value = 'q',
+ .addr = u2k_info.addr,
+ .size = u2k_info.size,
+ };
+
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+
+ free(user_addr);
+ return ret;
+}
+
+#define TEST2_MEM_SIZE (64 * 1024 * 1024) // 64MB
+char *test2_p;
+
+static void *testcase2_thread(void *arg)
+{
+ int ret = 0;
+ sem_t *sync = (sem_t *)arg;
+ struct sp_make_share_info u2k_info = {
+ // 由于malloc分配的首地址往往不是页对齐的，这里映射时故意减少1个页
+ .size = 3 * PAGE_SIZE,
+ .pid = getpid(),
+ };
+
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ for (unsigned long i = 0; i < TEST2_MEM_SIZE / PAGE_SIZE / 4; i++) {
+ // we expect page migration may happen here
+ test2_p[i * 4 * PAGE_SIZE] = 'b';
+
+ u2k_info.uva = (unsigned long)(&test2_p[i * 4 * PAGE_SIZE]);
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ pthread_exit((void *)1);
+ }
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ pthread_exit((void *)1);
+ }
+ }
+
+ pthread_exit((void *)0);
+}
+
+/*
+ * 尝试构造页迁移，线程绑核需结合NUMA节点的配置，建议在QEMU中运行
+ */
+static int testcase2(void)
+{
+ int ret = 0;
+ pthread_t tid, self;
+ char *sync_name = "/testcase2_sync";
+
+ sem_t *sync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name);
+
+ self = pthread_self();
+ cpu_set_t cpuset;
+ CPU_ZERO(&cpuset);
+ CPU_SET(0, &cpuset); // 需检查：0号核的NUMA节点
+ ret = pthread_setaffinity_np(self, sizeof(cpu_set_t), &cpuset);
+ if (ret < 0) {
+ pr_info("set cpu affinity for main thread failed %d", ret);
+ return -1;
+ }
+
+ ret = pthread_create(&tid, NULL, testcase2_thread, sync);
+ if (ret != 0) {
+ pr_info("pthread_create failed, errno: %d", errno);
+ return -1;
+ }
+
+ CPU_ZERO(&cpuset);
+ CPU_SET(5, &cpuset); // 需检查：5号核的NUMA节点
+ ret = pthread_setaffinity_np(tid, sizeof(cpu_set_t), &cpuset);
+ if (ret < 0) {
+ pr_info("set cpu affinity for test thread failed %d", ret);
+ return -1;
+ }
+
+ test2_p = malloc(TEST2_MEM_SIZE);
+ // 所有的页全踩一遍
+ for (unsigned int i = 0; i < TEST2_MEM_SIZE / PAGE_SIZE; i++) {
+ test2_p[i * PAGE_SIZE] = 'a';
+ }
+
+ sem_post(sync);
+
+ void *thread_ret;
+ ret = pthread_join(tid, &thread_ret);
+ if (ret != 0) {
+ pr_info("can't join thread %d", ret);
+ return -1;
+ }
+ if ((int)thread_ret != 0) {
+ pr_info("join thread failed %d", (int)thread_ret);
+ return -1;
+ }
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "用户态调用malloc，再调用u2k。预期成功。")
+ TESTCASE_CHILD(testcase2, "尝试构造页迁移，线程绑核需结合NUMA节点的配置，建议在QEMU中运行")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_u2k_and_kill.c b/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_u2k_and_kill.c
new file mode 100644
index 000000000000..f6022aa59bd0
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/k2u_u2k/test_u2k_and_kill.c
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Tue Dec 08 01:48:57 2020
+ */
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <pthread.h>
+
+#include "sharepool_lib.h"
+
+
+
+/*
+ * 异常用例，用来看护u2k接口，会oom，单独跑，内核没挂就通过
+ *
+ * 多进程多线程并发执行u2k，然后随机杀掉进程
+ * 可能存在内存泄漏
+ */
+#define CHILD_NUM 5
+#define THREAD_PER_PROCESS 10
+#define KILL_NUM 1000
+
+static void *child_thread(void *arg)
+{
+ int ret;
+ struct sp_make_share_info u2k_info = *(struct sp_make_share_info *)arg;
+ while (1) {
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ return (void *)ret;
+ } else {
+ //pr_info("ioctl_u2k success");
+ }
+
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ return (void *)ret;
+ }
+ }
+
+ return NULL;
+}
+
+static int child_process(void)
+{
+ int ret;
+ int psize = getpagesize();
+ char *user_addr = malloc(psize);
+ if (user_addr == NULL) {
+ pr_info("malloc failed, errno: %d", errno);
+ return -1;
+ }
+ memset((void *)user_addr, 'q', psize);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = (unsigned long)user_addr,
+ .size = psize,
+ .pid = getpid(),
+ };
+
+ pthread_t threads[THREAD_PER_PROCESS] = {0};
+ for (int i = 0; i < THREAD_PER_PROCESS; i++) {
+ ret = pthread_create(threads + i, NULL, child_thread, &u2k_info);
+ if (ret < 0) {
+ pr_info("pthread_create failed, err:%d", ret);
+ return -1;
+ }
+ }
+
+ for (int i = 0; i < THREAD_PER_PROCESS; i++)
+ if (threads[i])
+ pthread_join(threads[i], NULL);
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+ int ret = 0;
+ pid_t child[CHILD_NUM] = {0};
+
+ for (int i = 0; i < CHILD_NUM; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ ret = -1;
+ goto out;
+ } else if (pid == 0) {
+ exit(child_process());
+ }
+ child[i] = pid;
+ }
+
+ unsigned int sed = time(NULL);
+ srand(sed);
+ pr_info("rand sed: %u", sed);
+
+ int count = 0;
+ for (int i = 0; i < KILL_NUM; i++) {
+ int idx = rand() % CHILD_NUM;
+ if (child[idx] > 0) {
+ kill(child[idx], SIGKILL);
+ waitpid(child[idx], NULL, 0);
+
+ pr_info("count: %d, kill child: %d, pid: %d", ++count, idx, child[idx]);
+
+ child[idx] = 0;
+ } else {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ ret = -1;
+ goto out;
+ } else if (pid == 0) {
+ exit(child_process());
+ }
+ child[idx] = pid;
+ pr_info("fork child: %d, pid: %d", idx, child[idx]);
+ }
+// sleep(1);
+ }
+
+out:
+ for (int i = 0; i < CHILD_NUM; i++)
+ if (child[i] > 0)
+ kill(child[i], SIGKILL);
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "多进程多线程并发执行u2k，然后随机杀掉进程")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/kthread/Makefile b/tools/testing/sharepool/testcase/reliability_test/kthread/Makefile
new file mode 100644
index 000000000000..5370208dbd64
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/kthread/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/reliability_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/reliability_test/kthread/test_add_strange_task.c b/tools/testing/sharepool/testcase/reliability_test/kthread/test_add_strange_task.c
new file mode 100644
index 000000000000..e97ae46a2e81
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/kthread/test_add_strange_task.c
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Dec 16 02:28:23 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 增加某个进程到某个组
+ */
+
+int main(int argc, char *argv[])
+{
+ if (argc != 3) {
+ printf("Usage:\n"
+ "\t%s <pid> <group_id>", argv[0]);
+ return -1;
+ }
+
+ int dev_fd = open_device();
+ if (dev_fd < 0)
+ return -1;
+
+ pid_t pid = atoi(argv[1]);
+ int group_id = atoi(argv[2]);
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ printf("add task(pid%d) to group(%d) failed, err: %s\n", pid, group_id, strerror(errno));
+ return -1;
+ } else {
+ printf("add task(pid%d) to group(%d) success\n", pid, group_id);
+ return 0;
+ }
+}
diff --git a/tools/testing/sharepool/testcase/reliability_test/kthread/test_del_kthread.c b/tools/testing/sharepool/testcase/reliability_test/kthread/test_del_kthread.c
new file mode 100644
index 000000000000..649e716ed769
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/kthread/test_del_kthread.c
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Dec 16 02:28:23 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 增加某个进程到某个组
+ */
+
+int main(int argc, char *argv[])
+{
+ int ret = 0;
+ if (argc != 3) {
+ printf("Usage:\n"
+ "\t%s <pid> <group_id>", argv[0]);
+ return -1;
+ }
+
+ int dev_fd = open_device();
+ if (dev_fd < 0)
+ return -1;
+
+ pid_t pid = atoi(argv[1]);
+ int group_id = atoi(argv[2]);
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ printf("add task(pid%d) to group(%d) failed, err: %s\n", ag_info.pid, group_id, strerror(errno));
+ goto error_out;
+ }
+
+ // 尝试将传入的进程退组
+ struct sp_del_from_group_info del_info = {
+ .pid = pid,
+ .spg_id = group_id,
+ };
+ ret = ioctl_del_from_group(dev_fd, &del_info);
+ if (ret < 0) {
+ printf("try delete task(pid%d) from group(%d) failed, err: %s\n", pid, group_id, strerror(errno));
+ goto error_out;
+ }
+
+ close_device(dev_fd);
+ return 0;
+
+error_out:
+ close_device(dev_fd);
+ return -1;
+}
diff --git a/tools/testing/sharepool/testcase/reliability_test/others/Makefile b/tools/testing/sharepool/testcase/reliability_test/others/Makefile
new file mode 100644
index 000000000000..5370208dbd64
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/others/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/reliability_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/reliability_test/others/test_judge_addr.c b/tools/testing/sharepool/testcase/reliability_test/others/test_judge_addr.c
new file mode 100644
index 000000000000..cdb168a0cddb
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/others/test_judge_addr.c
@@ -0,0 +1,104 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Tue Dec 08 20:38:39 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+/*
+ * testcase1: 进程调用u2k得到的kva，用is_sharepool_addr去查询，预期false。
+ */
+
+static int testcase1(void)
+{
+ int ret;
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return ret;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 12345,
+ .spg_id = 1,
+ };
+
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ memset((void *)alloc_info.addr, 'q', alloc_info.size);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ }
+
+ if (!ioctl_judge_addr(dev_fd, u2k_info.addr)) {
+ pr_info("invalid address as expected, errno: %d", errno);
+ } else {
+ pr_info("valid address unexpected");
+ return -1;
+ }
+
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ return ret;
+ }
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "进程调用u2k得到的kva，用is_sharepool_addr去查询，预期false")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/others/test_kill_sp_process.c b/tools/testing/sharepool/testcase/reliability_test/others/test_kill_sp_process.c
new file mode 100644
index 000000000000..37093689a59a
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/others/test_kill_sp_process.c
@@ -0,0 +1,430 @@
+#include "sharepool_lib.h"
+#include "sem_use.h"
+#include <pthread.h>
+#include <stdlib.h>
+
+#define ALLOC_TEST_TYPES 4
+
+#define PROCESS_NUM 5
+#define GROUP_NUM 2
+#define KILL_TIME 1000
+
+static int group_ids[GROUP_NUM];
+static int semid;
+static struct vmalloc_info vmalloc_infos[PROCESS_NUM][GROUP_NUM] = {0};
+static struct vmalloc_info vmalloc_huge_infos[PROCESS_NUM][GROUP_NUM] = {0};
+
+static int add_multi_group()
+{
+ int ret;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ };
+ for (int i = 0; i < GROUP_NUM; i++) {
+ group_ids[i] = i + 1;
+ ag_info.spg_id = group_ids[i];
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("proc%d add group%d failed", getpid(), group_ids[i]);
+ return -1;
+ }
+ }
+
+ return ret;
+}
+
+static int check_multi_group()
+{
+ int ret;
+ // query groups
+ int spg_ids[GROUP_NUM];
+ int group_num = GROUP_NUM;
+ struct sp_group_id_by_pid_info find_group_info = {
+ .num = &group_num,
+ .spg_ids = spg_ids,
+ .pid = getpid(),
+ };
+ ret = ioctl_find_group_by_pid(dev_fd, &find_group_info);
+ if (ret < 0) {
+ pr_info("find group id by pid failed");
+ return ret;
+ } else {
+ for (int i = 0; i < GROUP_NUM; i++)
+ if (spg_ids[i] != group_ids[i]) {
+ pr_info("group id %d not consistent", i);
+ ret = -1;
+ }
+ }
+
+ return ret;
+}
+
+/*
+ * alloc - u2k - vmalloc - k2u - unshare - vfree - unshare - free
+ * 对大页/大页dvpp/小页/小页dvpp都测一下
+ * 多组：对每一组都测一下（query 进程所在的group）
+ */
+void *thread_and_process_helper(int arg)
+{
+ pr_info("thread_and_process_helper start.");
+ int ret, i;
+ pid_t pid;
+ bool judge_ret = true;
+ struct sp_alloc_info alloc_info[ALLOC_TEST_TYPES] = {0};
+ struct sp_make_share_info u2k_info[ALLOC_TEST_TYPES] = {0}, k2u_info = {0}, k2u_huge_info = {0};
+ char *addr;
+
+ int process_index = arg / 100;
+ int group_index = arg % 100;
+ int group_id = group_ids[group_index];
+
+ /* check sp group */
+ pid = getpid();
+
+ // 大页
+ alloc_info[0].flag = SP_HUGEPAGE;
+ alloc_info[0].spg_id = group_id;
+ alloc_info[0].size = 2 * PMD_SIZE;
+
+ // 大页 DVPP
+ alloc_info[1].flag = SP_DVPP | SP_HUGEPAGE;
+ alloc_info[1].spg_id = group_id;
+ alloc_info[1].size = 2 * PMD_SIZE;
+
+ // 普通页 DVPP
+ alloc_info[2].flag = SP_DVPP;
+ alloc_info[2].spg_id = group_id;
+ alloc_info[2].size = 4 * PAGE_SIZE;
+
+ // 普通页
+ alloc_info[3].flag = 0;
+ alloc_info[3].spg_id = group_id;
+ alloc_info[3].size = 4 * PAGE_SIZE;
+
+ /* alloc & u2k */
+ for (i = 0; i < ALLOC_TEST_TYPES; i++) {
+ /* sp_alloc */
+ ret = ioctl_alloc(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed at %dth alloc.\n", i);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(alloc_info[i].addr)) {
+ pr_info("sp_alloc return err is %ld\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("sp_alloc return addr %lx\n", alloc_info[i].addr);
+ }
+ }
+
+ /* check sp_alloc addr */
+ judge_ret = ioctl_judge_addr(dev_fd, alloc_info[i].addr);
+ if (judge_ret != true) {
+ pr_info("expect a valid share pool addr %lx\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("addr %lx is a valid share pool addr\n", alloc_info[i].addr);
+ }
+
+ /* prepare for u2k */
+ addr = (char *)alloc_info[i].addr;
+ if (alloc_info[i].flag & SP_HUGEPAGE) {
+ addr[0] = 'd';
+ addr[PMD_SIZE - 1] = 'c';
+ addr[PMD_SIZE] = 'b';
+ addr[PMD_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_hugepage_checker = true;
+ } else {
+ addr[0] = 'd';
+ addr[PAGE_SIZE - 1] = 'c';
+ addr[PAGE_SIZE] = 'b';
+ addr[PAGE_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_checker = true;
+ }
+
+ u2k_info[i].uva = alloc_info[i].addr;
+ u2k_info[i].size = alloc_info[i].size;
+ u2k_info[i].pid = pid;
+
+ /* u2k */
+ ret = ioctl_u2k(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl u2k failed\n");
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(u2k_info[i].addr)) {
+ pr_info("u2k return err is %ld.\n", u2k_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("u2k return addr %lx, check memory content succ.\n",
+ // u2k_info[i].addr);
+ }
+ }
+ //pr_info("\n");
+ }
+
+ /* prepare for vmalloc */
+ vmalloc_infos[process_index][group_index].size = 3 * PAGE_SIZE;
+ vmalloc_huge_infos[process_index][group_index].size = 3 * PMD_SIZE;
+
+ /* vmalloc */
+ ret = ioctl_vmalloc(dev_fd, &(vmalloc_infos[process_index][group_index]));
+ if (ret < 0) {
+ pr_info("vmalloc small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vmalloc_hugepage(dev_fd, &(vmalloc_huge_infos[process_index][group_index]));
+ if (ret < 0) {
+ pr_info("vmalloc huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* prepare for k2u */
+ k2u_info.kva = vmalloc_infos[process_index][group_index].addr;
+ k2u_info.size = vmalloc_infos[process_index][group_index].size;
+ k2u_info.sp_flags = 0;
+ k2u_info.pid = pid;
+ k2u_info.spg_id = group_id;
+
+ k2u_huge_info.kva = vmalloc_huge_infos[process_index][group_index].addr;
+ k2u_huge_info.size = vmalloc_huge_infos[process_index][group_index].size;
+ k2u_huge_info.sp_flags = SP_DVPP;
+ k2u_huge_info.pid = pid;
+ k2u_huge_info.spg_id = group_id;
+
+ /* k2u */
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_info.addr)) {
+ pr_info("k2u return err is %ld.\n",
+ k2u_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u return addr %lx\n", k2u_info.addr);
+ }
+ }
+
+ ret = ioctl_k2u(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u hugepage error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_huge_info.addr)) {
+ pr_info("k2u hugepage return err is %ld.\n",
+ k2u_huge_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u hugepage return addr %lx\n", k2u_huge_info.addr);
+ }
+ }
+
+ /* check k2u memory content */
+ addr = (char *)k2u_info.addr;
+ if (addr[0] != 'a' || addr[PAGE_SIZE - 1] != 'b' ||
+ addr[PAGE_SIZE] != 'c' || addr[2 * PAGE_SIZE - 1] != 'd') {
+ pr_info("check vmalloc memory failed\n");
+ goto error;
+ } else {
+ //pr_info("check vmalloc memory succeess\n");
+ }
+
+ addr = (char *)k2u_huge_info.addr;
+ if (addr[0] != 'a' || addr[PMD_SIZE - 1] != 'b' ||
+ addr[PMD_SIZE] != 'c' || addr[2 * PMD_SIZE - 1] != 'd') {
+ pr_info("check vmalloc_hugepage memory failed: %c %c %c %c\n",
+ addr[0], addr[PMD_SIZE - 1], addr[PMD_SIZE], addr[2 * PMD_SIZE - 1]);
+ goto error;
+ } else {
+ //pr_info("check vmalloc_hugepage memory succeess\n");
+ }
+
+ /* unshare uva */
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("sp unshare uva error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_unshare(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("sp unshare hugepage uva error: %d\n", ret);
+ goto error;
+ }
+
+ /* kvfree */
+ ret = ioctl_vfree(dev_fd, &(vmalloc_infos[process_index][group_index]));
+ if (ret < 0) {
+ pr_info("vfree small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vfree(dev_fd, &(vmalloc_huge_infos[process_index][group_index]));
+ if (ret < 0) {
+ pr_info("vfree huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* unshare kva & sp_free*/
+ for (i = 0; i < ALLOC_TEST_TYPES; i++) {
+ /* unshare kva */
+ ret = ioctl_unshare(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("sp_unshare kva return error: %d\n", ret);
+ goto error;
+ }
+
+ /* sp_free */
+ ret = ioctl_free(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("sp_free return error: %d\n", ret);
+ goto error;
+ }
+ }
+
+ //close_device(dev_fd);
+ return 0;
+
+error:
+ //close_device(dev_fd);
+ return -1;
+}
+
+void *thread(void *arg)
+{
+ int ret = 0;
+ int count = 0;
+ while (1) {
+ ret = thread_and_process_helper(arg);
+ pr_info("thread finished, count: %d", count);
+ if (ret < 0) {
+ pr_info("thread_and_process helper failed, spg %d.", (int)arg);
+ return -1;
+ }
+ sem_inc_by_one(semid);
+ int sem_val = sem_get_value(semid);
+ pr_info("thread run %d times, %d left.", sem_val, KILL_TIME - sem_val);
+ }
+
+ return ret;
+}
+
+static int process(int index)
+{
+ int ret = 0;
+
+ // 每个组创建一个线程，循环执行helper
+ pthread_t threads[GROUP_NUM];
+ for (int i = 0; i < GROUP_NUM; i++) {
+ ret = pthread_create(threads + i, NULL, thread, index * 100 + i);
+ if (ret < 0) {
+ pr_info("pthread %d create failed.", i);
+ return -1;
+ }
+ }
+
+ for (int i = 0; i < GROUP_NUM; i++) {
+ void *tret;
+ ret = pthread_join(threads[i], &tret);
+ if (ret < 0) {
+ pr_info("pthread %d join failed.", i);
+ ret = -1;
+ }
+ if ((long)tret != 0) {
+ pr_info("testcase execution failed, thread %d exited unexpectedly\n", i);
+ ret = -1;
+ }
+ }
+
+ return ret;
+}
+
+static int vfreeAll()
+{
+ int ret = 0;
+ for (int i = 0; i < PROCESS_NUM; i++) {
+ for (int j = 0; j < GROUP_NUM; j++) {
+ ioctl_vfree(dev_fd, &(vmalloc_infos[i][j]));
+ ioctl_vfree(dev_fd, &(vmalloc_huge_infos[i][j]));
+ }
+ }
+ return ret;
+}
+
+/*
+ * testcase1: 创建N个进程，加入所有组，并创建M个线程执行sharepool任务: u2k/k2u...;
+ * 并发kill所有进程，期望能顺利结束。
+ */
+static int testcase1(void)
+{
+ int ret;
+
+ semid = sem_create(1234, "kill all after N times api calls");
+ sem_set_value(semid, 0);
+
+ // 创建N个进程，加入所有组;
+ pid_t childs[PROCESS_NUM];
+ for (int i = 0; i < PROCESS_NUM; i++) {
+ pid_t pid_child = fork();
+ if (pid_child < 0) {
+ pr_info("fork failed, error %d", pid_child);
+ exit(-1);
+ } else if (pid_child == 0) {
+ if (add_multi_group())
+ return -1;
+ if (check_multi_group())
+ return -1;
+ pr_info("%s add %dth child to all groups success, %d left",
+ __FUNCTION__, i + 1, PROCESS_NUM - i - 1);
+ exit(process(i));
+ } else {
+ childs[i] = pid_child;
+ pr_info("fork child%d, pid: %d", i, pid_child);
+ }
+ }
+
+ // 计数达到xxx后，并发kill进程
+ sem_dec_by_val(semid, KILL_TIME);
+ pr_info("start to kill all process...");
+ for (int i = 0; i < PROCESS_NUM; i++) {
+ kill(childs[i], SIGKILL);
+ }
+
+ // waitpid
+ for (int i = 0; i < PROCESS_NUM; i++) {
+ int status;
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d test failed, %d", i, status);
+ ret = 0;
+ } else {
+ pr_info("child%d test success, status: %d, %d processes left", i, status, PROCESS_NUM - i);
+ }
+ childs[i] = 0;
+ }
+
+ // vfree the vmalloc memories
+ if (vfreeAll() < 0) {
+ pr_info("not all are vfreed.");
+ }
+
+ sem_close(semid);
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "创建N个进程，加入所有组，并创建M个线程执行sharepool任务: u2k/k2u...; 并发kill所有进程，期望能顺利结束。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/others/test_kthread.c b/tools/testing/sharepool/testcase/reliability_test/others/test_kthread.c
new file mode 100644
index 000000000000..a7d0b5dc0d73
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/others/test_kthread.c
@@ -0,0 +1,195 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Tue Dec 08 20:38:39 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+static int testcase1(void)
+{
+ int ret;
+ struct sp_kthread_info info;
+ ret = ioctl_kthread_start(dev_fd, &info);
+ if (ret < 0) {
+ pr_info("kthread start failed, errno: %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_kthread_end(dev_fd, &info);
+ if (ret < 0) {
+ pr_info("kthread end failed, errno: %d", errno);
+ return ret;
+ }
+
+ return ret;
+}
+
+static int testcase2(void)
+{
+ int ret;
+ int spg_id = 1;
+ void *addr;
+ unsigned long va;
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, spg_id);
+ if (ret < 0) {
+ pr_info("add group failed");
+ return -1;
+ }
+
+ addr = wrap_sp_alloc(spg_id, 4096, 0);
+ if (addr == (void *)-1) {
+ pr_info("alloc failed");
+ return -1;
+ }
+ va = (unsigned long)addr;
+
+ struct sp_kthread_info info = {
+ .type = 1,
+ .addr = va,
+ .size = 4096,
+ .spg_id = spg_id,
+ };
+
+ ret = ioctl_kthread_start(dev_fd, &info);
+ if (ret < 0) {
+ pr_info("kthread start failed, errno: %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_kthread_end(dev_fd, &info);
+ if (ret < 0) {
+ pr_info("kthread end failed, errno: %d", errno);
+ return ret;
+ }
+
+ return ret;
+}
+
+static int prepare(struct vmalloc_info *ka_info, bool ishuge)
+{
+ int ret;
+ if (ishuge) {
+ ret = ioctl_vmalloc_hugepage(dev_fd, ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc_hugepage failed, errno: %d", errno);
+ return -1;
+ }
+ } else {
+ ret = ioctl_vmalloc(dev_fd, ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'a',
+ .addr = ka_info->addr,
+ .size = ka_info->size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, ka_info);
+ }
+ return ret;
+}
+
+static int testcase3(void)
+{
+ int ret;
+ int spg_id = 1;
+ void *addr;
+ unsigned long va;
+ unsigned long flag = 0;
+ struct vmalloc_info ka_info = {
+ .size = PAGE_SIZE,
+ };
+
+ if (prepare(&ka_info, false) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = spg_id,
+ .sp_flags = flag,
+ .pid = getpid(),
+ };
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, spg_id);
+ if (ret < 0)
+ return -1;
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("testcase ioctl_k2u failed unexpected", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ return -1;
+ } else {
+ pr_info("testcase5 ioctl_k2u success expected");
+ }
+
+ struct sp_kthread_info info = {
+ .type = 2,
+ .addr = k2u_info.addr,
+ .size = k2u_info.size,
+ .spg_id = spg_id,
+ };
+
+ ret = ioctl_kthread_start(dev_fd, &info);
+ if (ret < 0) {
+ pr_info("kthread start failed, errno: %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+ }
+
+ sleep(2);
+
+ ret = ioctl_kthread_end(dev_fd, &info);
+ if (ret < 0) {
+ pr_info("kthread end failed, errno: %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+ }
+
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "内核线程调用")
+ TESTCASE_CHILD(testcase2, "内核线程调用 sp free")
+ TESTCASE_CHILD(testcase3, "内核线程调用 sp unshare")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/others/test_mmap_sp_address.c b/tools/testing/sharepool/testcase/reliability_test/others/test_mmap_sp_address.c
new file mode 100644
index 000000000000..01416b647cbd
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/others/test_mmap_sp_address.c
@@ -0,0 +1,223 @@
+#include <stdio.h>
+#include <unistd.h>
+#include <errno.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "sharepool_lib.h"
+
+#define start_addr 0xe80000000000UL
+#define end_addr 0xf80000000000UL
+
+static int try_mmap(void *addr, unsigned long size)
+{
+ int *result;
+ int ret = 0;
+ result = mmap(addr, size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
+ if (result == MAP_FAILED) {
+ printf("mmap failed as expected, errno is %d\n", errno);
+ ret = 0;
+ }
+ else {
+ printf("mmap success unexpected, addr is %lx\n", (unsigned long)result);
+ ret = -1;
+ }
+ return ret;
+}
+
+/* testcase1: 试图通过mmap()映射sharepool内存地址（未使用），预期失败 */
+static int testcase1(void)
+{
+ int ret;
+
+ void *addr = start_addr;
+
+ int *result = mmap(addr, sizeof(int), PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
+ if (result == MAP_FAILED) {
+ printf("mmap failed as expected, errno is %d\n", errno);
+ ret = 0;
+ }
+ else {
+ printf("mmap success unexpected, addr is %lx\n", (unsigned long)result);
+ ret = -1;
+ }
+
+ return ret;
+}
+
+/* testcase2: 试图通过mmap()映射sharepool内存地址（已使用），预期失败 */
+static int testcase2(void)
+{
+ int *result;
+ int ret;
+ int spg_id = 1;
+
+ // 加组，申请内存，用返回地址进行mmap
+ if (wrap_add_group(getpid(), PROT_READ | PROT_WRITE, spg_id) < 0)
+ return -1;
+
+ unsigned long addr;
+ addr = (unsigned long)wrap_sp_alloc(spg_id, PAGE_SIZE, 0);
+ pr_info("sp_alloc first address is %lx", addr);
+
+ addr = (unsigned long)wrap_sp_alloc(spg_id, PAGE_SIZE, 0);
+ pr_info("sp_alloc second address is %lx", addr);
+
+ addr = (unsigned long)wrap_sp_alloc(spg_id, PMD_SIZE, 0);
+ pr_info("sp_alloc third address is %lx", addr);
+
+ addr = (unsigned long)wrap_sp_alloc(spg_id, PMD_SIZE, 0);
+ pr_info("sp_alloc fourth address is %lx", addr);
+
+ result = mmap(addr, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
+ if (result == MAP_FAILED) {
+ printf("mmap failed as expected, errno is %d\n", errno);
+ ret = 0;
+ }
+ else {
+ printf("mmap success unexpected, addr is %lx\n", (unsigned long)result);
+ ret = -1;
+ }
+
+ return ret;
+}
+
+/* testcase3: 加组，申请内存，用返回地址进行munmap，再sp_free */
+static int testcase3(void)
+{
+ int *result;
+ int ret;
+ int spg_id = 1;
+
+
+ if (wrap_add_group(getpid(), PROT_READ | PROT_WRITE, spg_id) < 0)
+ return -1;
+
+ unsigned long addr1;
+ addr1 = (unsigned long)wrap_sp_alloc(spg_id, PAGE_SIZE, 0);
+ pr_info("sp_alloc small page is %lx", addr1);
+
+ // 尝试munmap小页
+ ret = munmap(addr1, PAGE_SIZE);
+ if (ret < 0)
+ pr_info("munmap failed");
+ else
+ pr_info("munmap success");
+
+
+ // 尝试munmap大页
+ unsigned long addr2;
+ addr2 = (unsigned long)wrap_sp_alloc(spg_id, PMD_SIZE, 0);
+ pr_info("sp_alloc hugepage is %lx", addr2);
+
+ ret = munmap(addr2, PMD_SIZE);
+ if (ret < 0) {
+ pr_info("munmap hugepage failed");
+ ret = 0;
+ }
+ else {
+ pr_info("munmap hugepage success.");
+ return -1;
+ }
+
+ // 再sp free,再munmap
+ ret = wrap_sp_free(addr2);
+ if (ret < 0) {
+ pr_info("sp_free hugepage failed.");
+ } else {
+ pr_info("sp_free hugepage success.");
+ }
+
+ return ret;
+}
+
+/* testcase4: 加组，申请内存，用返回地址进行mmap和munmap，再sp_free。 */
+static int testcase4(void)
+{
+ int *result;
+ int ret;
+ int spg_id = 1;
+
+ // alloc
+ if (wrap_add_group(getpid(), PROT_READ | PROT_WRITE, spg_id) < 0)
+ return -1;
+
+ unsigned long addr1;
+ addr1 = (unsigned long)wrap_sp_alloc(spg_id, PAGE_SIZE, 0);
+ pr_info("sp_alloc addr1 is %lx", addr1);
+
+ // mmap & munmap
+ result = mmap(addr1, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
+ if (result == MAP_FAILED) {
+ printf("mmap addr1 failed as expected, errno is %d\n", errno);
+ ret = 0;
+ }
+ else {
+ printf("mmap addr1 success unexpected, addr is %lx\n", (unsigned long)result);
+ ret = munmap(addr1, PAGE_SIZE);
+ if (ret < 0)
+ pr_info("munmap after mmap failed");
+ else
+ pr_info("munmap after mmap success");
+ }
+
+ // 再free
+ ret = wrap_sp_free(addr1);
+ if (ret < 0) {
+ pr_info("sp_free addr1 failed.");
+ } else {
+ pr_info("sp_free addr1 success.");
+ }
+
+ return ret;
+}
+
+/* testcase5: alloc和mmap交叉进行 */
+static int testcase5(void)
+{
+ int *result;
+ int ret;
+ int spg_id = 1;
+
+ // 加组，申请内存，用返回地址进行mmap
+ if (wrap_add_group(getpid(), PROT_READ | PROT_WRITE, spg_id) < 0)
+ return -1;
+
+ unsigned long addr;
+ addr = (unsigned long)wrap_sp_alloc(spg_id, PAGE_SIZE, 0);
+ pr_info("sp_alloc first address is %lx", addr);
+ ret = try_mmap(addr, PAGE_SIZE);
+
+ addr = (unsigned long)wrap_sp_alloc(spg_id, PAGE_SIZE, 0);
+ pr_info("sp_alloc second address is %lx", addr);
+ ret = try_mmap(addr, PAGE_SIZE);
+
+ addr = (unsigned long)wrap_sp_alloc(spg_id, PMD_SIZE, 0);
+ pr_info("sp_alloc third address is %lx", addr);
+ ret = try_mmap(addr, PMD_SIZE);
+
+ addr = (unsigned long)wrap_sp_alloc(spg_id, PMD_SIZE, 0);
+ pr_info("sp_alloc fourth address is %lx", addr);
+ ret = try_mmap(addr, PMD_SIZE);
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "试图通过mmap()映射sharepool内存地址（未使用），预期失败")
+ TESTCASE_CHILD(testcase2, "试图通过mmap()映射sharepool内存地址（已使用），预期失败")
+ TESTCASE_CHILD(testcase3, "加组，申请内存，用返回地址进行munmap，预期失败，再sp_free，预期成功")
+ TESTCASE_CHILD(testcase4, "加组，申请内存，用返回地址进行mmap和munmap，预期失败，再sp_free，预期成功")
+ TESTCASE_CHILD(testcase5, "alloc和mmap交叉进行")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/others/test_notifier_block.c b/tools/testing/sharepool/testcase/reliability_test/others/test_notifier_block.c
new file mode 100644
index 000000000000..856142a15a85
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/others/test_notifier_block.c
@@ -0,0 +1,101 @@
+#include <stdlib.h>
+#include <errno.h>
+#include <string.h>
+#include "sharepool_lib.h"
+
+#define PROC_NUM 4
+#define GROUP_ID 1
+
+int register_notifier_block(int id)
+{
+ int ret = 0;
+
+ /* see sharepool_dev.c for more details*/
+ struct sp_notifier_block_info notifier_info = {
+ .i = id,
+ };
+ ret = ioctl_register_notifier_block(dev_fd, ¬ifier_info);
+ if (ret != 0)
+ pr_info("proc %d register notifier block %d failed. ret is %d. errno is %s.",
+ getpid(), id, ret, strerror(errno));
+ else
+ pr_info("proc %d register notifier for func %d success!!", getpid(), id);
+
+ return ret;
+}
+
+int unregister_notifier_block(int id)
+{
+ int ret = 0;
+
+ /* see sharepool_dev.c for more details*/
+ struct sp_notifier_block_info notifier_info = {
+ .i = id,
+ };
+ ret = ioctl_unregister_notifier_block(dev_fd, ¬ifier_info);
+ if (ret != 0)
+ pr_info("proc %d unregister notifier block %d failed. ret is %d. errno is %s.",
+ getpid(), id, ret, strerror(errno));
+ else
+ pr_info("proc %d unregister notifier for func %d success!!", getpid(), id);
+
+ return ret;
+}
+
+static int testcase1(void)
+{
+ pid_t childs[PROC_NUM];
+
+ register_notifier_block(1);
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed.");
+ return -1;
+ } else if (pid == 0) {
+ if (wrap_add_group(getpid(), PROT_READ | PROT_WRITE, i + 1) < 0) {
+ pr_info("add group failed.");
+ return -1;
+ }
+ while (1) {
+
+ }
+ } else {
+ childs[i] = pid;
+ }
+ }
+
+ sleep(2);
+
+ for (int i = 0; i < PROC_NUM / 2; i++) {
+ pr_info("group %d is exiting...", i + 1);
+ KILL_CHILD(childs[i]);
+ }
+
+ unregister_notifier_block(1);
+ sleep(2);
+
+ for (int i = PROC_NUM / 2; i < PROC_NUM; i++) {
+ pr_info("group %d is exiting...", i + 1);
+ KILL_CHILD(childs[i]);
+ }
+
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "测试注册组销毁通知的效果")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/reliability_test.sh b/tools/testing/sharepool/testcase/reliability_test/reliability_test.sh
new file mode 100755
index 000000000000..7d47a35cfd0d
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/reliability_test.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+
+set -x
+
+for line in test_add_group1 \
+ test_unshare1 \
+ test_unshare2 \
+ test_unshare3 \
+ test_unshare4 \
+ test_unshare5 \
+ test_unshare6 \
+ test_unshare7 \
+ test_malloc_u2k \
+ test_judge_addr
+do
+ ./reliability_test/$line
+ if [ $? -ne 0 ] ;then
+ echo "testcase reliability_test/$line failed"
+ exit 1
+ fi
+done
+
+# 异常用例，用来看护u2k接口，会oom，单独跑，内核没有挂就通过
+./reliability_test/test_u2k_and_kill
+
+# 异常用例，用来看护k2u接口，会oom，单独跑，内核没有挂就通过
+./reliability_test/test_k2u_and_kill
+
+# 添加当前shell到组11，不崩溃即可
+./reliability_test/test_add_strange_task $$ 11
+# 添加kthread线程到组99999，不崩溃即可
+./reliability_test/test_add_strange_task 2 99999
+# 添加init进程到组10，不崩溃即可
+#./reliability_test/test_add_strange_task 1 11
+# 添加守护进程到组12，不崩溃即可(ps命令查看，进程名用方括号包含的是守护进程)
+#./reliability_test/test_add_strange_task 2 11
+
+# coredump程序运行时，同组其它进程正在做share pool各项基础操作
+# 这里不再额外编程，快速复用已有的用例，但要注意：
+# 1. 检查两个用例的共享组id是否相等
+# 2. 在背景用例执行完之前触发test_coredump的coredump
+./test_mult_process/test_proc_interface_process 1 &
+./reliability_test/test_coredump
+
+# 构造外部碎片，平时不运行该用例
+# 120000 * 4K ~= 500MB. Please kill one of the process after allocation is done.
+#./reliability_test/test_external_fragmentation 100000 & ./reliability_test/test_external_fragmentation 100000 &
+#echo "now sleep 20 sec, please kill one of the process above"
+#sleep 20
+#./reliability_test/test_external_fragmentation_trigger
+
diff --git a/tools/testing/sharepool/testcase/reliability_test/sp_add_group/Makefile b/tools/testing/sharepool/testcase/reliability_test/sp_add_group/Makefile
new file mode 100644
index 000000000000..5370208dbd64
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/sp_add_group/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/reliability_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/reliability_test/sp_add_group/test_add_exiting_task.c b/tools/testing/sharepool/testcase/reliability_test/sp_add_group/test_add_exiting_task.c
new file mode 100644
index 000000000000..a72eceffa38c
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/sp_add_group/test_add_exiting_task.c
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 28 02:21:42 2020
+ */
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include "sharepool_lib.h"
+
+static int testcase1(void)
+{
+ int ret = 0;
+
+ srand((unsigned int)time(NULL));
+ for (int i = 0; i < 10000; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ if (!(i % 100))
+ pr_info("child process %d", i);
+ exit(0);
+ }
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = rand() % (SPG_ID_AUTO_MIN - 1) + 1,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d, pid: %d, spg_id: %d",
+ errno, pid, ag_info.spg_id);
+ }
+ waitpid(pid, NULL, 0);
+ }
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "将正在退出的task加入组中。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/sp_add_group/test_add_group1.c b/tools/testing/sharepool/testcase/reliability_test/sp_add_group/test_add_group1.c
new file mode 100644
index 000000000000..fb64b0c379c9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/sp_add_group/test_add_group1.c
@@ -0,0 +1,118 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Nov 30 15:24:35 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+#define MAX_CHILD 100
+#define CHILD_EXIT 5
+
+static int group_id = SPG_ID_MAX;
+/*
+ * 多进程并发加入指定组，预期只有第一个进程会加组成功。
+ */
+
+static int testcase1(void)
+{
+ pid_t child_pid;
+ int status;
+ int ret;
+ int child_result;
+
+ pr_info("start test: child num = %d", MAX_CHILD);
+ for (int i = 0; i < MAX_CHILD; i++) {
+ child_pid = fork();
+ if (child_pid == -1 || child_pid == 0) { // ensure only parent do fork()
+ break;
+ }
+ }
+ if (child_pid == -1) {
+ pr_info("fork failed");
+ } else if (child_pid == 0) {
+ int child_ret = 0;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+
+ child_ret = ioctl_add_group(dev_fd, &ag_info);
+ sleep(10);
+ if (child_ret == 0) {
+ exit(EXIT_SUCCESS);
+ } else if (child_ret < 0 && errno == EPERM) {
+ exit(CHILD_EXIT);
+ } else {
+ pr_info("ioctl_add_group failed unexpected: errno = %d", errno);
+ exit(EXIT_FAILURE);
+ }
+
+ } else {
+ for (int i = 0; i < MAX_CHILD; i++) {
+ ret = waitpid(-1, &status, 0);
+ if (WIFEXITED(status)) {
+ pr_info("child execute success, ret value : %d, pid = %d", WEXITSTATUS(status), ret);
+ if (WEXITSTATUS(status) == CHILD_EXIT) {
+ child_result++;
+ }
+ } else if (WIFSIGNALED(status)) {
+ pr_info("child execute failed, killed by signal : %d, pid = %d", WTERMSIG(status), ret);
+ ret = -1;
+ goto error_out;
+ } else if (WIFSTOPPED(status)) {
+ printf("child execute failed, stoped by signal : %d, pid = %d", WSTOPSIG(status), ret);
+ ret = -1;
+ goto error_out;
+ } else {
+ printf("child execute failed, WIFEXITED(status) : %d, pid = %d", WIFEXITED(status), ret);
+ ret = -1;
+ goto error_out;
+ }
+ }
+ if (child_result == 0) {
+ pr_info("testcase success!!");
+ ret = 0;
+ } else {
+ pr_info("testcase failed!! %d childs add group failed", child_result);
+ ret = -1;
+ goto error_out;
+ }
+ }
+
+error_out:
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "多进程并发加入指定组，预期都会加组成功。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/sp_add_group/test_add_strange_task.c b/tools/testing/sharepool/testcase/reliability_test/sp_add_group/test_add_strange_task.c
new file mode 100644
index 000000000000..e97ae46a2e81
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/sp_add_group/test_add_strange_task.c
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Dec 16 02:28:23 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 增加某个进程到某个组
+ */
+
+int main(int argc, char *argv[])
+{
+ if (argc != 3) {
+ printf("Usage:\n"
+ "\t%s <pid> <group_id>", argv[0]);
+ return -1;
+ }
+
+ int dev_fd = open_device();
+ if (dev_fd < 0)
+ return -1;
+
+ pid_t pid = atoi(argv[1]);
+ int group_id = atoi(argv[2]);
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ printf("add task(pid%d) to group(%d) failed, err: %s\n", pid, group_id, strerror(errno));
+ return -1;
+ } else {
+ printf("add task(pid%d) to group(%d) success\n", pid, group_id);
+ return 0;
+ }
+}
diff --git a/tools/testing/sharepool/testcase/reliability_test/sp_unshare/Makefile b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/Makefile
new file mode 100644
index 000000000000..5370208dbd64
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/reliability_test
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare1.c b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare1.c
new file mode 100644
index 000000000000..08d14a6c2d95
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare1.c
@@ -0,0 +1,325 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Nov 30 18:27:26 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+/*
+ * 内存共享后，先释放内存再停止共享。
+ * testcase1: vmalloc并k2task后，直接vfree kva（预期成功），然后unshare uva（预期成功）。
+ * testcase2: vmalloc并k2spg后，直接vfree kva（预期失败），然后unshare uva（预期成功）
+ * testcase3: 父进程vmalloc，子进程加组，父进程k2u给子进程所在组，子进程退出，组销毁。父进程vfree。（成功, 无报错）
+ * testcase4: sp_alloc并u2k后，直接sp_free uva（预期成功），然后unshare kva（预期成功）。
+ */
+
+static int testcase1(void)
+{
+ int ret;
+
+ struct vmalloc_info vmalloc_info = {
+ .size = 10000,
+ };
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = vmalloc_info.addr,
+ .size = vmalloc_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &vmalloc_info);
+ return ret;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = vmalloc_info.addr,
+ .size = vmalloc_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ ioctl_vfree(dev_fd, &vmalloc_info);
+ return ret;
+ }
+
+ ret = ioctl_vfree(dev_fd, &vmalloc_info); /* 预期失败 */
+ if (ret < 0) {
+ pr_info("ioctl vfree failed for the first time, errno: %d", errno);
+ }
+
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ }
+ ret = ioctl_vfree(dev_fd, &vmalloc_info); /* 预期成功 */
+ if (ret < 0) {
+ pr_info("ioctl vfree failed for the second time, errno: %d", errno);
+ }
+ return ret;
+}
+
+#define GROUP_ID 1
+static int testcase2(void)
+{
+ int ret;
+
+ /* k2u prepare*/
+ struct vmalloc_info vmalloc_info = {
+ .size = 10000,
+ };
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = vmalloc_info.addr,
+ .size = vmalloc_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &vmalloc_info);
+ return ret;
+ }
+
+ struct sp_make_share_info k2spg_info = {
+ .kva = vmalloc_info.addr,
+ .size = vmalloc_info.size,
+ .spg_id = GROUP_ID,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, GROUP_ID);
+ if (ret < 0) {
+ pr_info("process add group %d failed, errno: %d", GROUP_ID, errno);
+ } else {
+ pr_info("process %d add group %d success", getpid(), GROUP_ID);
+ }
+
+ ret = ioctl_k2u(dev_fd, &k2spg_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ ioctl_vfree(dev_fd, &vmalloc_info);
+ return ret;
+ } else {
+ pr_info("process k2u success");
+ }
+
+ /* the vm_area has SP_FLAG in it, vfree shall cause warning*/
+ ioctl_vfree(dev_fd, &vmalloc_info);
+ //ret = sharepool_log("vfree without unshare");
+
+ ret = ioctl_unshare(dev_fd, &k2spg_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ }
+ //ret = sharepool_log("after unshare");
+
+ ioctl_vfree(dev_fd, &vmalloc_info); /* 预期成功 */
+ //ret = sharepool_log("vfree again");
+
+ return 0;
+}
+
+static int testcase3(void)
+{
+ int ret;
+ sem_t *sem_addgroup, *sem_k2u;
+ sem_addgroup = sem_open("/child_process_add_group_finish", O_CREAT, O_RDWR, 0);
+ sem_k2u = sem_open("/child_process_k2u_finish", O_CREAT, O_RDWR, 0);
+
+ /* k2u prepare*/
+ struct vmalloc_info vmalloc_info = {
+ .size = 10000,
+ };
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = vmalloc_info.addr,
+ .size = vmalloc_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &vmalloc_info);
+ return ret;
+ }
+
+ struct sp_make_share_info k2spg_info = {
+ .kva = vmalloc_info.addr,
+ .size = vmalloc_info.size,
+ .spg_id = GROUP_ID,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+
+ /* fork child */
+ pid_t child = fork();
+ if (child == 0) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, GROUP_ID);
+ if (ret < 0) {
+ pr_info("child process add group %d failed, errno: %d", GROUP_ID, errno);
+ } else {
+ pr_info("child process add group %d success", GROUP_ID);
+ }
+ sem_post(sem_addgroup);
+ /*wait parent make share kernel address to child */
+ sem_wait(sem_k2u);
+ exit(0);
+ }
+ pr_info("parent process is %d, child process is %d", getpid(), child);
+
+ sem_wait(sem_addgroup);
+ /* k2u to child */
+ k2spg_info.pid = child;
+ ret = ioctl_k2u(dev_fd, &k2spg_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed as exepected, errno: %d", errno);
+ ret = 0;
+ } else {
+ pr_info("parent process %d k2u success unexpected.", getpid());
+ ret = -1;
+ }
+ sem_post(sem_k2u);
+
+ int status;
+ waitpid(child, &status, 0);
+ pr_info("child process %d exited.", child);
+
+ /* the vm_area has SP_FLAG in it, vfree shall cause warning*/
+ ioctl_vfree(dev_fd, &vmalloc_info);
+
+ sem_unlink("/child_process_add_group_finish");
+ sem_unlink("/child_process_k2u_finish");
+ return ret;
+}
+
+static int testcase4(void)
+{
+ int ret;
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return ret;
+ } else {
+ pr_info("process %d add group %d success.", getpid(), ag_info.spg_id);
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 12345,
+ .spg_id = 1,
+ };
+
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ memset((void *)alloc_info.addr, 'q', alloc_info.size);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_CHECK,
+ .value = 'q',
+ .addr = u2k_info.addr,
+ .size = u2k_info.size,
+ };
+
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret == 0) {
+ pr_info("ioctl_free succeed as expected, ret: %d, errno: %d", ret, errno);
+ } else {
+ pr_info("ioctl_free result unexpected, ret: %d, errno: %d", ret, errno);
+ return -1;
+ }
+
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ ioctl_unshare(dev_fd, &u2k_info);
+ return ret;
+ }
+
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "vmalloc并k2task后，直接vfree kva（预期成功），然后unshare uva（预期成功）")
+ TESTCASE_CHILD(testcase2, "vmalloc并k2spg后，直接vfree kva（预期失败），然后unshare uva（预期成功）")
+ TESTCASE_CHILD(testcase3, "父进程vmalloc，子进程加组，父进程k2u给子进程所在组，子进程退出，组销毁。父进程vfree。（成功, 无报错）")
+ TESTCASE_CHILD(testcase4, "sp_alloc并u2k后，直接sp_free uva（预期成功），然后unshare kva（预期成功）")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
+
diff --git a/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare2.c b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare2.c
new file mode 100644
index 000000000000..fc1eeb623f49
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare2.c
@@ -0,0 +1,202 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Tue Dec 01 09:10:50 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+/*
+ * testcase1: 进程A分配并共享内存后，由不同组的进程B进行停止共享（B得到了A的pid和spg_id）。
+ * testcase2: 进程A分配内存后，由不同组的进程B进行释放。
+ */
+
+/*
+ * A进程u2k得到的kva，没有办法判断合法的unshare调用方是谁。B进程如果猜到了kva，它去unshare kva，也能成功
+ * 这个一直是设计缺失的。我们认为现网用户态没法拿到kva，也无法调用unshare kva. 只有驱动内核态才能调。
+ */
+
+#define TESTCASE2_MSG_KEY 20
+#define TESTCASE2_MSG_TYPE 200
+// 利用消息队列在进程间传递struct sp_alloc_info
+struct msgbuf_alloc_info {
+ long type;
+ struct sp_alloc_info alloc_info;
+};
+
+static int testcase2_child(sem_t *sync, sem_t *grandsync)
+{
+ int ret;
+
+ do {
+ ret = sem_wait(sync);
+ } while (ret < 0 && errno == EINTR);
+
+ int msgid = msgget(TESTCASE2_MSG_KEY, 0);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ struct msgbuf_alloc_info msgbuf = {0};
+ struct sp_alloc_info *alloc_info = &msgbuf.alloc_info;
+ ret = msgrcv(msgid, &msgbuf, sizeof(*alloc_info), TESTCASE2_MSG_TYPE, IPC_NOWAIT);
+ if (ret < 0) {
+ pr_info("msgrcv failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ if (!ioctl_judge_addr(dev_fd, alloc_info->addr)) {
+ pr_info("invalid address");
+ goto error_out;
+ }
+
+ ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0 && errno == EPERM) {
+ pr_info("ioctl_free failed as expected, errno: %d", errno);
+ } else {
+ pr_info("ioctl_free succeed unexpected, ret: %d", ret);
+ goto error_out;
+ }
+
+ sem_post(grandsync);
+ return 0;
+
+error_out:
+ sem_post(grandsync);
+ return -1;
+}
+
+static int testcase2(struct sp_alloc_info *alloc_info)
+{
+ int ret, status = 0;
+ int group_id = alloc_info->spg_id;
+
+ char *sync_name = "/testcase2_sync";
+ sem_t *sync = sem_open(sync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(sync_name);
+
+ char *grandsync_name = "/testcase2_childsync";
+ sem_t *grandsync = sem_open(grandsync_name, O_CREAT, O_RDWR, 0);
+ if (sync == SEM_FAILED) {
+ pr_info("sem_open failed");
+ return -1;
+ }
+ sem_unlink(grandsync_name);
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret) {
+ pr_info("add group failed, errno: %d", errno);
+ return -1;
+ }
+
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork error");
+ return -1;
+ } else if (pid == 0) {
+ exit(testcase2_child(sync, grandsync));
+ }
+
+ ret = ioctl_alloc(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ int msgid = msgget(TESTCASE2_MSG_KEY, IPC_CREAT | 0666);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ struct msgbuf_alloc_info msgbuf = {0};
+ msgbuf.type = TESTCASE2_MSG_TYPE;
+ memcpy(&msgbuf.alloc_info, alloc_info, sizeof(*alloc_info));
+ ret = msgsnd(msgid, &msgbuf, sizeof(*alloc_info), 0);
+ if (ret < 0) {
+ pr_info("msgsnd failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ memset((void *)alloc_info->addr, 'a', alloc_info->size);
+
+ sem_post(sync);
+ ret = sem_wait(grandsync);
+ if (ret < 0) {
+ pr_info("sem wait failed, errno: %d", errno);
+ goto error_out;
+ } else {
+ goto out;
+ }
+
+error_out:
+ kill(pid, SIGKILL);
+out:
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child failed!!");
+ return -1;
+ } else
+ pr_info("child success!!");
+
+ if (ioctl_free(dev_fd, alloc_info) < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ return -1;
+ }
+ return ret;
+}
+
+struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 12345,
+ .spg_id = 100,
+};
+
+static int test2(void) { return testcase2(&alloc_info); }
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(test2, "进程A分配内存后，由不同组的进程B进行释放")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
+
diff --git a/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare3.c b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare3.c
new file mode 100644
index 000000000000..9735b1e30d72
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare3.c
@@ -0,0 +1,243 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Tue Dec 01 19:49:36 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+/*
+ * 内存共享后，由另一方停止共享。预期停止共享失败。
+ * testcase1: k2u后，由用户态进程停止共享。（用户态进程用内核vm area地址调用unshare，预期失败)
+ * testcase2: k2u后，由用户态进程停止共享。（用户态进程用进程内vma地址调用unshare，预期成功)
+ * testcase3: u2k后，由内核模块停止共享。
+ */
+static int testcase2(void)
+{
+ int ret;
+
+ struct vmalloc_info kva_info = {
+ .size = 10000,
+ };
+ ret = ioctl_vmalloc(dev_fd, &kva_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'a',
+ .addr = kva_info.addr,
+ .size = kva_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ goto out;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = kva_info.addr,
+ .size = kva_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ goto out;
+ }
+
+ unsigned long user_va = k2u_info.addr; // user vma
+ //k2u_info.addr = kva_info.addr; //kernel vm area
+ ret = ioctl_unshare(dev_fd, &k2u_info); // user process try to unshare user vma (back to kernel), shall success
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed unexpected, errno: %d", errno);
+ ret = -1;
+ } else {
+ pr_info("ioctl_unshare succeed as expected");
+ ret = 0;
+ }
+
+ /*
+ k2u_info.addr = user_va;
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ ret = -1;
+ goto out;
+ }
+ */
+
+out:
+ ioctl_vfree(dev_fd, &kva_info);
+ return ret;
+}
+
+static int testcase3(void)
+{
+ int ret;
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return ret;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 12345,
+ .spg_id = 1,
+ };
+
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ memset((void *)alloc_info.addr, 'q', alloc_info.size);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ }
+
+ unsigned long kernel_va = u2k_info.addr;
+ u2k_info.addr = alloc_info.addr;
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ //pr_info("ioctl_unshare failed as expected, errno: %d", errno);
+ ret = 0;
+ } else {
+ pr_info("ioctl_unshare result unexpected, ret: %d, errno: %d", ret, errno);
+ ret = -1;
+ }
+
+ /*
+ u2k_info.addr = kernel_va;
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+ */
+
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ ret = -1;
+ } else {
+ pr_info("u2k area freed.");
+ }
+ return ret;
+}
+
+static int testcase4(void)
+{
+ int ret;
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return ret;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 12345,
+ .spg_id = 1,
+ };
+
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ memset((void *)alloc_info.addr, 'q', alloc_info.size);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ }
+
+ unsigned long kernel_va = u2k_info.addr;
+ //u2k_info.addr = alloc_info.addr;
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed unexpected, errno: %d", errno);
+ ret = -1;
+ } else {
+ pr_info("ioctl_unshare result succeed as expected.");
+ ret = 0;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ ret = -1;
+ } else {
+ pr_info("u2k area freed.");
+ }
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+// TESTCASE_CHILD(testcase1, false)
+ TESTCASE_CHILD(testcase2, "k2u后，由用户态进程停止共享。（用户态进程用进程内vma地址调用unshare，预期成功")
+ TESTCASE_CHILD(testcase3, "u2k后，由内核模块停止共享。")
+ TESTCASE_CHILD(testcase4, "TBD")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare4.c b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare4.c
new file mode 100644
index 000000000000..2edfe9ffbd06
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare4.c
@@ -0,0 +1,516 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Dec 02 09:38:57 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+#define MAX_PROC_PER_GRP 500
+#define CHILD_EXIT 5
+
+static int process_pre_group = 100;
+static sem_t *sync1[MAX_PROC_PER_GRP];
+static sem_t *grandsync1[MAX_PROC_PER_GRP];
+static sem_t *sync2[MAX_PROC_PER_GRP];
+static sem_t *grandsync2[MAX_PROC_PER_GRP];
+
+/*
+ * testcase1: 进程A分配并共享内存后，组内所有进程并发调用unshare。预期只有其中一个是成功的
+ * -> 本用例想的很不错，但是sp_unshare_kva无法防住并发。
+ * testcase2: 进程A分配内存后，组内所有进程并发调用free。预期只有其中一个是成功的。
+ */
+#if 0
+#define TESTCASE1_MSG_KEY 10
+// 利用消息队列在进程间传递struct sp_alloc_info
+struct msgbuf_share_info {
+ long type;
+ struct sp_make_share_info u2k_info;
+};
+
+static int testcase1_child(int num)
+{
+ int ret;
+ /* 等待父进程加组 */
+ do {
+ ret = sem_wait(sync1[num]);
+ } while (ret < 0 && errno == EINTR);
+
+ int group_id = ioctl_find_first_group(dev_fd, getpid());
+ /* 通知父进程加组成功 */
+ sem_post(grandsync1[num]);
+ if (group_id < 0) {
+ pr_info("ioctl_find_group_by_pid failed, %d", group_id);
+ return -1;
+ }
+
+ /* 等待父进程共享 */
+ do {
+ ret = sem_wait(sync1[num]);
+ } while (ret < 0 && errno == EINTR);
+
+ int msgid = msgget(TESTCASE1_MSG_KEY, 0);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ struct msgbuf_share_info msgbuf = {0};
+ struct sp_make_share_info *u2k_info = &msgbuf.u2k_info;
+ ret = msgrcv(msgid, &msgbuf, sizeof(*u2k_info), (num + 1), IPC_NOWAIT);
+ if (ret < 0) {
+ pr_info("msgrcv failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ ret = ioctl_unshare(dev_fd, u2k_info);
+ if (ret == 0) {
+ pr_info("ioctl_unshare success");
+ } else {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ ret = CHILD_EXIT;
+ }
+
+ sem_post(grandsync1[num]);
+ return ret;
+
+error_out:
+ sem_post(grandsync1[num]);
+ return -1;
+}
+
+static int testcase1(struct sp_alloc_info *alloc_info)
+{
+ int ret, status = 0;
+ int group_id = alloc_info->spg_id;
+ pid_t childs[MAX_PROC_PER_GRP] = {0};
+ int child_succ = 0;
+ int child_fail = 0;
+
+ for (int i = 0; i < process_pre_group; i++) {
+ char buf[100];
+ sprintf(buf, "/testcase1_sync%d", i);
+ sync1[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (sync1[i] == SEM_FAILED) {
+ pr_info("grandchild sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ for (int i = 0; i < process_pre_group; i++) {
+ char buf[100];
+ sprintf(buf, "/testcase1_childsync%d", i);
+ grandsync1[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (grandsync1[i] == SEM_FAILED) {
+ pr_info("child sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret) {
+ pr_info("add group failed, errno: %d", errno);
+ return -1;
+ }
+
+ for (int i = 0; i < process_pre_group; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork error");
+ return -1;
+ } else if (pid == 0) {
+ exit(testcase1_child(i));
+ } else {
+ pr_info("fork grandchild%d, pid: %d", i, pid);
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("add grandchild%d to group %d failed", i, group_id);
+ goto error_out;
+ } else
+ pr_info("add grandchild%d to group %d successfully", i, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(sync1[i]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandsync1[i]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+
+ ret = ioctl_alloc(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ memset((void *)alloc_info->addr, 'a', alloc_info->size);
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info->addr,
+ .size = alloc_info->size,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ int msgid = msgget(TESTCASE1_MSG_KEY, IPC_CREAT | 0666);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ struct msgbuf_share_info msgbuf = {0};
+ memcpy(&msgbuf.u2k_info, &u2k_info, sizeof(u2k_info));
+ for (int i = 0; i < process_pre_group; i++) {
+ msgbuf.type = i + 1;
+ ret = msgsnd(msgid, &msgbuf, sizeof(u2k_info), 0);
+ if (ret < 0) {
+ pr_info("msgsnd failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+ }
+
+
+ /* 通知子进程共享成功 */
+ for (int i = 0; i < process_pre_group; i++) {
+ sem_post(sync1[i]);
+ }
+
+ for (int i = 0; i < process_pre_group; i++) {
+ ret = sem_wait(grandsync1[i]);
+ if (ret < 0) {
+ pr_info("sem wait failed, errno: %d", errno);
+ goto error_out;
+ }
+ }
+ goto out;
+
+error_out:
+ for (int i = 0; i < process_pre_group && childs[i] > 0; i++) {
+ if (kill(childs[i], SIGKILL) != 0) {
+ return -1;
+ }
+ }
+out:
+ for (int i = 0; i < process_pre_group && childs[i] > 0; i++) {
+ waitpid(childs[i], &status, 0);
+ if (WIFEXITED(status)) {
+ pr_info("grandchild%d execute success, ret: %d", i, WEXITSTATUS(status));
+ if (WEXITSTATUS(status) == CHILD_EXIT) {
+ child_fail++;
+ } else if (WEXITSTATUS(status) == 0) {
+ child_succ++;
+ }
+ }
+ }
+
+ if (ioctl_free(dev_fd, alloc_info) < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ return -1;
+ }
+
+ if (child_succ == 1 && child_fail == (process_pre_group - 1)) {
+ pr_info("testcase1: child unshare test success!!");
+ return 0;
+ } else {
+ pr_info("testcase1: child unshare test failed!! child_succ: %d, child_fail: %d", child_succ, child_fail);
+ return -1;
+ }
+
+ return ret;
+}
+#endif
+
+#define TESTCASE2_MSG_KEY 20
+// 利用消息队列在进程间传递struct sp_alloc_info
+struct msgbuf_alloc_info {
+ long type;
+ struct sp_alloc_info alloc_info;
+};
+
+static int testcase2_child(int num)
+{
+ int ret;
+ /* 等待父进程加组 */
+ do {
+ ret = sem_wait(sync2[num]);
+ } while (ret < 0 && errno == EINTR);
+
+ int group_id = ioctl_find_first_group(dev_fd, getpid());
+ /* 通知父进程加组成功 */
+ sem_post(grandsync2[num]);
+ if (group_id < 0) {
+ pr_info("ioctl_find_group_by_pid failed, %d", group_id);
+ return -1;
+ }
+
+ /* 等待父进程共享 */
+ do {
+ ret = sem_wait(sync2[num]);
+ } while (ret < 0 && errno == EINTR);
+
+ int msgid = msgget(TESTCASE2_MSG_KEY, 0);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ struct msgbuf_alloc_info msgbuf = {0};
+ struct sp_alloc_info *alloc_info = &msgbuf.alloc_info;
+ ret = msgrcv(msgid, &msgbuf, sizeof(*alloc_info), (num + 1), IPC_NOWAIT);
+ if (ret < 0) {
+ pr_info("msgrcv failed, errno: %d", errno);
+ goto error_out;
+ }
+
+ if (!ioctl_judge_addr(dev_fd, alloc_info->addr)) {
+ pr_info("invalid address");
+ goto error_out;
+ }
+
+ ret = ioctl_free(dev_fd, alloc_info);
+ if (ret == 0) {
+ pr_info("ioctl_free success, errno: %d", errno);
+ } else {
+ pr_info("ioctl_free failed, errno: %d", errno);
+ ret = CHILD_EXIT;
+ }
+
+ sem_post(grandsync2[num]);
+ return ret;
+
+error_out:
+ sem_post(grandsync2[num]);
+ return -1;
+}
+
+static int test(struct sp_alloc_info *alloc_info)
+{
+ int ret, status = 0;
+ int group_id = alloc_info->spg_id;
+ pid_t childs[MAX_PROC_PER_GRP] = {0};
+ int child_succ = 0;
+ int child_fail = 0;
+
+ for (int i = 0; i < process_pre_group; i++) {
+ char buf[100];
+ sprintf(buf, "/testcase2_sync%d", i);
+ sync2[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (sync2[i] == SEM_FAILED) {
+ pr_info("grandchild sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ for (int i = 0; i < process_pre_group; i++) {
+ char buf[100];
+ sprintf(buf, "/testcase2_childsync%d", i);
+ grandsync2[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (grandsync2[i] == SEM_FAILED) {
+ pr_info("child sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret) {
+ pr_info("add group failed, errno: %d", errno);
+ return -1;
+ }
+
+ for (int i = 0; i < process_pre_group; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork error");
+ return -1;
+ } else if (pid == 0) {
+ exit(testcase2_child(i));
+ } else {
+ pr_info("fork grandchild%d, pid: %d", i, pid);
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("add grandchild%d to group %d failed", i, group_id);
+ goto error_out;
+ } else
+ pr_info("add grandchild%d to group %d successfully", i, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(sync2[i]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandsync2[i]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+
+ ret = ioctl_alloc(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ int msgid = msgget(TESTCASE2_MSG_KEY, IPC_CREAT | 0666);
+ if (msgid < 0) {
+ pr_info("msgget failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ struct msgbuf_alloc_info msgbuf = {0};
+ memcpy(&msgbuf.alloc_info, alloc_info, sizeof(*alloc_info));
+ for (int i = 0; i < process_pre_group; i++) {
+ msgbuf.type = i + 1;
+ ret = msgsnd(msgid, &msgbuf, sizeof(*alloc_info), 0);
+ if (ret < 0) {
+ pr_info("msgsnd failed, errno: %d", errno);
+ ret = -1;
+ goto error_out;
+ }
+ }
+
+ memset((void *)alloc_info->addr, 'a', alloc_info->size);
+
+ /* 通知子进程alloc成功 */
+ for (int i = 0; i < process_pre_group; i++) {
+ sem_post(sync2[i]);
+ }
+
+ for (int i = 0; i < process_pre_group; i++) {
+ ret = sem_wait(grandsync2[i]);
+ if (ret < 0) {
+ pr_info("sem wait failed, errno: %d", errno);
+ goto error_out;
+ }
+ }
+ goto out;
+
+error_out:
+ for (int i = 0; i < process_pre_group && childs[i] > 0; i++) {
+ if (kill(childs[i], SIGKILL) != 0) {
+ return -1;
+ }
+ }
+out:
+ for (int i = 0; i < process_pre_group && childs[i] > 0; i++) {
+ waitpid(childs[i], &status, 0);
+ if (WIFEXITED(status)) {
+ pr_info("grandchild%d execute success, ret: %d", i, WEXITSTATUS(status));
+ if (WEXITSTATUS(status) == CHILD_EXIT) {
+ child_fail++;
+ } else if (WEXITSTATUS(status) == 0) {
+ child_succ++;
+ }
+ }
+ }
+
+ if (child_succ == 1 && child_fail == (process_pre_group - 1)) {
+ pr_info("testcase2: child unshare test success!!");
+ return 0;
+ } else {
+ pr_info("testcase2: child unshare test failed!! child_succ: %d, child_fail: %d", child_succ, child_fail);
+ return -1;
+ }
+
+ return ret;
+}
+
+static void print_help()
+{
+ printf("Usage:./test_unshare4 -p process_num\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "p:")) != -1) {
+ switch (opt) {
+ case 'p': // 组内子进程个数
+ process_pre_group = atoi(optarg);
+ if (process_pre_group > MAX_PROC_PER_GRP || process_pre_group <= 0) {
+ printf("process num invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 12345,
+ .spg_id = 100,
+ };
+
+ return test(&alloc_info);
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "进程A分配内存后，组内所有进程并发调用free。预期只有其中一个是成功的。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare5.c b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare5.c
new file mode 100644
index 000000000000..dd8e704e390c
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare5.c
@@ -0,0 +1,185 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Thu Dec 03 11:27:42 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+/*
+ * 内存共享后，先释放内存再停止共享。预期停止共享失败。
+ * testcase1: 内核调用k2u得到的uva，用sp_free去释放，再由内核调用unshare
+ * testcase2: 进程调用u2k得到的kva，用vfree去释放，再由用户态调用unshare, 再用free去释放。
+ */
+
+static int testcase1(void)
+{
+ int ret;
+
+ struct vmalloc_info ka_info = {
+ .size = 10000,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ return ret;
+ }
+
+ struct sp_alloc_info uva_info = {
+ .addr = k2u_info.addr,
+ .size = 10000,
+ };
+
+ ret = ioctl_free(dev_fd, &uva_info);
+ if (ret < 0) {
+ pr_info("ioctl_free failed as expected, errno: %d", errno);
+ ret = 0;
+ } else {
+ pr_info("ioctl_free result unexpected, ret: %d, errno: %d", ret, errno);
+ return -1;
+ }
+
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ } else {
+ pr_info("ioctl_unshare k2u succeeded.");
+ }
+
+ ret = ioctl_vfree(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("ioctl_vfree failed, errno: %d", errno);
+ } else {
+ pr_info("ioctl_vfree succeeded.");
+ }
+ return ret;
+}
+
+static int testcase2(void)
+{
+ int ret;
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return ret;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 12345,
+ .spg_id = 1,
+ };
+
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ memset((void *)alloc_info.addr, 'q', alloc_info.size);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ }
+
+ struct vmalloc_info kva_info = {
+ .addr = u2k_info.addr,
+ .size = 12345,
+ };
+
+ if (ioctl_vfree(dev_fd, &kva_info) < 0) {
+ pr_info("vfree u2k kernel vm area failed.");
+ ret = -1;
+ } else {
+ pr_info("vfree u2k kernal vm area succeeded.");
+ }
+
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed as expected, errno: %d", errno);
+ } else {
+ pr_info("ioctl_unshare result unexpected, ret: %d, errno: %d", ret, errno);
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("free u2k vma failed, errno: %d", errno);
+ } else {
+ pr_info("free u2k vma succeeded");
+ }
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "内核调用k2u得到的uva，用sp_free去释放，再由内核调用unshare")
+ TESTCASE_CHILD(testcase2, "进程调用u2k得到的kva，用vfree去释放，再由用户态调用unshare, 再用free去释放。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare6.c b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare6.c
new file mode 100644
index 000000000000..389402e9ebc0
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare6.c
@@ -0,0 +1,93 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Dec 04 17:20:10 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+/*
+ * testcase1: 用户态进程sp_alloc分配得到的uva用sp_unshare去停止共享，预期失败。
+ */
+
+static int testcase1(void)
+{
+ int ret;
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return ret;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = 12345,
+ .spg_id = 1,
+ };
+
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ memset((void *)alloc_info.addr, 'q', alloc_info.size);
+
+ struct sp_make_share_info u2k_info = {
+ .addr = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed as expected, errno: %d", errno);
+ } else {
+ pr_info("ioctl_unshare result unexpected, ret: %d, errno: %d", ret, errno);
+ return -1;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ return ret;
+ }
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "用户态进程sp_alloc分配得到的uva用sp_unshare去停止共享，预期失败。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare7.c b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare7.c
new file mode 100644
index 000000000000..b85171c50995
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare7.c
@@ -0,0 +1,159 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Nov 30 18:27:26 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/* testcase1: 验证未加组的进程能否k2spg */
+
+#define GROUP_ID 1
+
+static int testcase1(void)
+{
+ int ret;
+
+ /* sync prepare*/
+ sem_t *sem_addgroup, *sem_k2u;
+ sem_addgroup = sem_open("/child_process_add_group_finish", O_CREAT, O_RDWR, 0);
+ sem_k2u = sem_open("/child_process_k2u_finish", O_CREAT, O_RDWR, 0);
+
+ /* k2u prepare*/
+ struct vmalloc_info vmalloc_info = {
+ .size = 10000,
+ };
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = vmalloc_info.addr,
+ .size = vmalloc_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &vmalloc_info);
+ return ret;
+ }
+
+ struct sp_make_share_info k2spg_info = {
+ .kva = vmalloc_info.addr,
+ .size = vmalloc_info.size,
+ .spg_id = GROUP_ID,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+
+ /* fork child */
+ pid_t child = fork();
+ if (child == 0) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, GROUP_ID);
+ if (ret < 0) {
+ pr_info("child process add group %d failed, errno: %d", GROUP_ID, errno);
+ } else {
+ pr_info("child process %d add group %d success", getpid(), GROUP_ID);
+ }
+ sem_post(sem_addgroup);
+ /*wait parent make share kernel address to child */
+ sem_wait(sem_k2u);
+ /* check kernel shared address */
+
+ exit(0);
+ }
+
+ sem_wait(sem_addgroup);
+ /* k2u to child */
+ k2spg_info.pid = child;
+ ret = ioctl_k2u(dev_fd, &k2spg_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed as expected, errno: %d", errno);
+ ioctl_vfree(dev_fd, &vmalloc_info);
+ ret = 0;
+ goto end;
+ } else {
+ pr_info("parent process k2u success unexpected.");
+ ret = -1;
+ }
+
+ /* fork a new process and add into group to check k2u address*/
+ pid_t proc_check = fork();
+ if (proc_check == 0) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, GROUP_ID);
+ if (ret < 0) {
+ pr_info("child process %d add group %d failed, errno: %d", getpid(), GROUP_ID, errno);
+ } else {
+ pr_info("child process %d add group %d success", getpid(), GROUP_ID);
+ }
+ char *addr = (char *)k2spg_info.addr;
+ if (addr[0] != 'b') {
+ pr_info("addr value is not b! k2spg failed.");
+ } else {
+ pr_info("addr value is b! k2spg success.");
+ }
+ exit(0);
+ }
+
+ int status;
+ waitpid(proc_check, &status, 0);
+ pr_info("k2spg check process exited.");
+
+end:
+ sem_post(sem_k2u);
+
+ waitpid(child, &status, 0);
+ pr_info("child process %d exited.", child);
+
+ /* the vm_area has SP_FLAG in it, vfree shall cause warning*/
+ ioctl_vfree(dev_fd, &vmalloc_info);
+ pr_info("ioctl vfree success.");
+
+ /* parent try create same group id and unshare, expect success */
+ // ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, GROUP_ID);
+ // if (ret < 0) {
+ // pr_info("add group failed, errno: %d", errno);
+ // } else {
+ // pr_info("parent add group %d success", GROUP_ID);
+ // }
+
+ sem_unlink("/child_process_add_group_finish");
+ sem_unlink("/child_process_k2u_finish");
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "验证未加组的进程能否k2spg ")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
+
diff --git a/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare_kill.c b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare_kill.c
new file mode 100644
index 000000000000..94c2401a7376
--- /dev/null
+++ b/tools/testing/sharepool/testcase/reliability_test/sp_unshare/test_unshare_kill.c
@@ -0,0 +1,150 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Nov 30 18:27:26 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <setjmp.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+#include <pthread.h>
+
+#include "sharepool_lib.h"
+#include "sem_use.h"
+
+#define PROC_NUM 200
+#define PROT (PROT_WRITE | PROT_READ)
+#define REPEAT 20
+#define THREAD_NUM 50
+/*
+ * 内存共享后，先释放内存再停止共享。
+ * testcase1: vmalloc并k2task后，直接vfree kva（预期成功），然后unshare uva（预期成功）。
+ */
+struct sp_make_share_info k2u_info;
+int sem;
+
+static void *tc1_thread(void *arg)
+{
+ int ret;
+ int gid = (int)arg;
+ struct sp_make_share_info infos[REPEAT];
+
+ pr_info("gid is %d\n", gid);
+ for (int i = 0; i < REPEAT; i++) {
+ infos[i].spg_id = SPG_ID_DEFAULT;
+ infos[i].pid = getpid();
+ infos[i].kva = k2u_info.kva;
+ infos[i].size = k2u_info.size;
+ infos[i].sp_flags = 0;
+ ret = ioctl_k2u(dev_fd, &infos[i]);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, child %d errno: %d", gid, errno);
+ sem_inc_by_one(sem);
+ return ret;
+ }
+ }
+
+ sem_inc_by_one(sem);
+ sem_check_zero(sem);
+
+ for (int i = 0; i < REPEAT; i++) {
+ ret = ioctl_unshare(dev_fd, &infos[i]);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, child %d errno: %d", getpid(), errno);
+ return ret;
+ }
+ }
+
+ return 0;
+}
+
+static int tc1_child(int gid)
+{
+ int ret;
+ pthread_t threads[THREAD_NUM];
+ void *tret;
+
+ ret = wrap_add_group(getpid(), PROT, gid);
+ if (ret < 0) {
+ pr_info("add group failed child %d", gid);
+ sem_inc_by_val(sem, THREAD_NUM);
+ return ret;
+ }
+
+ for (int i = 0; i < THREAD_NUM; i++)
+ pthread_create(threads + i, NULL, tc1_thread, (void *)gid);
+
+ for (int i = 0; i < THREAD_NUM; i++)
+ pthread_join(threads[i], &tret);
+
+ pr_info("child %d finish all work", gid);
+ return 0;
+}
+
+static int testcase1(void)
+{
+ int ret;
+ pid_t child[PROC_NUM];
+ struct vmalloc_info vmalloc_info = {
+ .size = 4096,
+ };
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ sem = sem_create(1234, "sem");
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ FORK_CHILD_ARGS(child[i], tc1_child(i + 1));
+ }
+
+ pr_info("\nwaits to kill all child...\n");
+ sem_dec_by_val(sem, PROC_NUM * THREAD_NUM);
+ pr_info("\nstarts to kill child...\n");
+ for (int i = 0; i < PROC_NUM; i++)
+ kill(child[i], SIGKILL);
+ for (int i = 0; i < PROC_NUM; i++)
+ waitpid(child[i], NULL, 0);
+
+ pr_info("finish kill child...\n");
+ ret = ioctl_vfree(dev_fd, &vmalloc_info); /* 预期失败 */
+ if (ret < 0) {
+ pr_info("ioctl vfree failed for the first time, errno: %d", errno);
+ }
+
+out:
+ sem_close(sem);
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "vmalloc并k2task后，直接vfree kva（预期成功），然后unshare uva（预期成功）")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
+
diff --git a/tools/testing/sharepool/testcase/remove_list.sh b/tools/testing/sharepool/testcase/remove_list.sh
new file mode 100755
index 000000000000..03287c09ea6e
--- /dev/null
+++ b/tools/testing/sharepool/testcase/remove_list.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+rm_list()
+{
+ curdir=$1
+ echo $curdir
+
+ cd $curdir
+ rm -rf tc_list
+
+ subdirs=`ls -d */`
+
+ for dir in $subdirs
+ do
+ rm_list $dir
+ done
+
+ cd ..
+ echo "back to `pwd`"
+}
+
+rm_list `pwd`
+
diff --git a/tools/testing/sharepool/testcase/scenario_test/Makefile b/tools/testing/sharepool/testcase/scenario_test/Makefile
new file mode 100644
index 000000000000..826d5ba6b255
--- /dev/null
+++ b/tools/testing/sharepool/testcase/scenario_test/Makefile
@@ -0,0 +1,15 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ mkdir -p $(TOOL_BIN_DIR)/scenario_test
+ cp $(testcases) $(TOOL_BIN_DIR)/scenario_test
+ cp test_hugepage_setting.sh $(TOOL_BIN_DIR)/
+ cp scenario_test.sh $(TOOL_BIN_DIR)/
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/scenario_test/scenario_test.sh b/tools/testing/sharepool/testcase/scenario_test/scenario_test.sh
new file mode 100755
index 000000000000..f344ae0dda17
--- /dev/null
+++ b/tools/testing/sharepool/testcase/scenario_test/scenario_test.sh
@@ -0,0 +1,45 @@
+#!/bin/sh
+
+set -x
+
+echo 'test_dfx_heavy_load
+ test_dvpp_16g_limit
+ test_max_50000_groups
+ test_proc_sp_group_state
+ test_oom ' | while read line
+do
+ let flag=0
+ ./scenario_test/$line
+ if [ $? -ne 0 ] ;then
+ echo "testcase scenario_test/$line failed"
+ let flag=1
+ fi
+
+ sleep 3
+
+ #打印spa_stat
+ ret=`cat /proc/sharepool/spa_stat | wc -l`
+ if [ $ret -ge 15 ] ;then
+ cat /proc/sharepool/spa_stat
+ echo spa_stat not clean
+ let flag=1
+ fi
+ #打印proc_stat
+ ret=`cat /proc/sharepool/proc_stat | wc -l`
+ if [ $ret -ge 15 ] ;then
+ cat /proc/sharepool/proc_stat
+ echo proc_stat not clean
+ let flag=1
+ fi
+
+ cat /proc/sharepool/proc_overview
+ #如果泄漏 -->exit
+ if [ $flag -eq 1 ] ;then
+ exit 1
+ fi
+ echo "testcase scenario_test/$line success"
+
+ cat /proc/meminfo
+ free -m
+
+done
diff --git a/tools/testing/sharepool/testcase/scenario_test/test_auto_check_statistics.c b/tools/testing/sharepool/testcase/scenario_test/test_auto_check_statistics.c
new file mode 100644
index 000000000000..904a5bbee2ad
--- /dev/null
+++ b/tools/testing/sharepool/testcase/scenario_test/test_auto_check_statistics.c
@@ -0,0 +1,338 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Nov 20 01:38:40 2020
+ */
+
+#include <errno.h>
+#include <fcntl.h> /* For O_* constants */
+#include <semaphore.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h> /* For mode constants */
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+static int semid;
+
+#define PROC_NUM 1023
+#define GROUP_NUM 2999
+#define GROUP_ID 1
+
+#define ROW_MAX 100
+#define COL_MAX 300
+
+#define byte2kb(x) (x) / 1024
+#define byte2mb(x) (x) / 1024UL / 1024UL
+
+#define SPA_STAT "/proc/sharepool/spa_stat"
+#define PROC_STAT "/proc/sharepool/proc_stat"
+#define PROC_OVERVIEW "/proc/sharepool/proc_overview"
+
+static void __reset(char **array, int end)
+{
+ for (int i = 0; i < end; i++)
+ memset(array[i], 0, COL_MAX);
+}
+
+static int test_route(unsigned long flag, unsigned long size, int spg_id)
+{
+ int ret = 0;
+ pid_t pid;
+ unsigned long addr;
+ char pidstr[SIZE];
+ char pidattr[SIZE];
+ int row_num, column_num;
+ char **result;
+ char **exp;
+ int row_real;
+ bool flag_out = false;
+ unsigned long size_dvpp = 0;
+
+ strcat(pidattr, "/proc/");
+ sprintf(pidstr, "%d", getpid());
+ strcat(pidattr, pidstr);
+ strcat(pidattr, "/sp_group");
+
+ if (flag & SP_DVPP)
+ size_dvpp = PMD_SIZE;
+
+ // 加组
+ if (spg_id == SPG_ID_DEFAULT)
+ goto alloc;
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, GROUP_ID);
+ if (ret < 0) {
+ pr_info("add group failed!");
+ return ret;
+ }
+
+ // 起一个工具进程加组，工具进程的统计也要正确
+ pid = fork();
+ if (pid == 0) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, GROUP_ID);
+ if (ret < 0) {
+ pr_info("tool proc add group failed!");
+ exit(-1);
+ }
+ while (1) {
+
+ }
+ }
+
+alloc:
+ // sp_alloc flag=大页/小页 dvpp/非dvpp size
+ addr = (unsigned long)wrap_sp_alloc(spg_id, size, flag);
+ if (addr == -1) {
+ pr_info("alloc memory failed, size %lx, flag %lx", size, flag);
+ ret = -1;
+ goto kill_child;
+ }
+
+ sleep(5);
+
+ // 检查spa_stat
+ result = (char **)calloc(ROW_MAX, sizeof(char *));
+ exp = (char **)calloc(ROW_MAX, sizeof(char *));
+ for (int i = 0; i < ROW_MAX; i++) {
+ result[i] = (char *)calloc(COL_MAX, sizeof(char));
+ exp[i] = (char *)calloc(COL_MAX, sizeof(char));
+ }
+
+ get_attr(SPA_STAT, result, ROW_MAX, COL_MAX, &row_real);
+ for (int i = 0; i < row_real; i++) {
+ printf("%s", result[i]);
+ }
+ pr_info("\nrow_real is %d", row_real);
+
+ sprintf(exp[0], "Share pool total size: %d KB, spa total num: %d.\n",
+ byte2kb(size), 1);
+ sprintf(exp[1],
+ "Group %6d size: %lld KB, spa num: %d, total alloc: %lld KB, normal alloc: %lld KB, huge alloc: %lld KB\n",
+ spg_id, byte2kb(size), 1, byte2kb(size),
+ flag & SP_HUGEPAGE ? 0 : byte2kb(size),
+ flag & SP_HUGEPAGE ? byte2kb(size) : 0);
+ sprintf(exp[2], "%s", "\n");
+ sprintf(exp[3], "Spa total num %u.\n", 1);
+ sprintf(exp[4], "Spa alloc num %u, k2u(task) num %u, k2u(spg) num %u.\n",
+ 1, 0, 0);
+ sprintf(exp[5], "Spa total size: %13lu KB\n", byte2kb(size));
+ sprintf(exp[6], "Spa alloc size: %13lu KB\n", byte2kb(size));
+ sprintf(exp[7], "Spa k2u(task) size: %13lu KB\n", 0);
+ sprintf(exp[8], "Spa k2u(spg) size: %13lu KB\n", 0);
+ sprintf(exp[9], "Spa dvpp size: %13lu KB\n",
+ flag & SP_DVPP ? byte2kb(size) : 0);
+ sprintf(exp[10], "Spa dvpp va size: %13lu MB\n", byte2mb(size_dvpp));
+
+ sprintf(exp[11], "%s", "\n");
+ sprintf(exp[12], "%-10s %-16s %-16s %-10s %-7s %-5s %-8s %-8s\n",
+ "Group ID", "va_start", "va_end", "Size(KB)", "Type", "Huge", "PID", "Ref");
+ sprintf(exp[13], "%-10d %2s%-14lx %2s%-14lx %-10ld %-7s %-5s %-8d %-8d\n",
+ spg_id,
+ "0x", flag & SP_DVPP ? 0xf00000000000 : 0xe80000000000,
+ "0x", flag & SP_DVPP ? 0xf00000200000 : 0xe80000200000,
+ byte2kb(size), "ALLOC", flag & SP_HUGEPAGE ? "Y" : "N", getpid(), 3);
+ for (int i = 0; i < row_real; i++) {
+ if (strcmp(result[i], exp[i]) != 0) {
+ pr_info("a not same with b,\na: %sb: %s", result[i], exp[i]);
+ flag_out = true;
+ }
+ }
+
+ // 检查proc_stat
+ __reset(result, row_real);
+ __reset(exp, row_real);
+ get_attr(PROC_STAT, result, ROW_MAX, COL_MAX, &row_real);
+ for (int i = 0; i < row_real; i++) {
+ printf("%s", result[i]);
+ }
+ pr_info("\nrow_real is %d\n", row_real);
+
+ sprintf(exp[0], "Share pool total size: %d KB, spa total num: %d.\n",
+ byte2kb(size), 1);
+ sprintf(exp[1],
+ "Group %6d size: %lld KB, spa num: %d, total alloc: %lld KB, normal alloc: %lld KB, huge alloc: %lld KB\n",
+ spg_id, byte2kb(size), 1, byte2kb(size),
+ flag & SP_HUGEPAGE ? 0 : byte2kb(size),
+ flag & SP_HUGEPAGE ? byte2kb(size) : 0);
+ sprintf(exp[2], "%s", "\n");
+ sprintf(exp[3], "Spa total num %u.\n", 1);
+ sprintf(exp[4], "Spa alloc num %u, k2u(task) num %u, k2u(spg) num %u.\n",
+ 1, 0, 0);
+ sprintf(exp[5], "Spa total size: %13lu KB\n", byte2kb(size));
+ sprintf(exp[6], "Spa alloc size: %13lu KB\n", byte2kb(size));
+ sprintf(exp[7], "Spa k2u(task) size: %13lu KB\n", 0);
+ sprintf(exp[8], "Spa k2u(spg) size: %13lu KB\n", 0);
+ sprintf(exp[9], "Spa dvpp size: %13lu KB\n",
+ flag & SP_DVPP ? byte2kb(size) : 0);
+ sprintf(exp[10], "Spa dvpp va size: %13lu MB\n", byte2mb(size_dvpp));
+ sprintf(exp[11], "%s", "\n");
+ sprintf(exp[12], "%-8s %-8s %-9s %-9s %-9s %-8s %-7s %-7s %-4s\n",
+ "PID", "Group_ID", "SP_ALLOC", "SP_K2U", "SP_RES", "VIRT", "RES",
+ "Shm", "PROT");
+ sprintf(exp[13], "%-8s %-8s %-9lld %-9lld\n", "guard", "-", 0, 0);
+ sprintf(exp[14], "%-8d %-8d %-9ld %-9ld %-9ld %-8ld %-7ld %-7ld %-4s\n",
+ getpid(), spg_id, byte2kb(size), 0, byte2kb(size), 0, 0, 0, "RW");
+ sprintf(exp[15], "%-8d %-8d %-9ld %-9ld %-9ld %-8ld %-7ld %-7ld %-4s\n",
+ pid, spg_id, 0, 0, byte2kb(size), 0, 0, 0, "RW");
+ sprintf(exp[16], "%-8d %-8d %-9ld %-9ld %-9ld %-8ld %-7ld %-7ld %-4s \n",
+ getpid(), 200001, 0, 0, 0, 0, 0, 0, "RW");
+ sprintf(exp[17], "%-8d %-8d %-9ld %-9ld %-9ld %-8ld %-7ld %-7ld %-4s \n",
+ pid, 200002, 0, 0, 0, 0, 0, 0, "RW");
+
+ for (int i = 0; i < row_real; i++) {
+ if (i < 14)
+ ret = strcmp(result[i], exp[i]);
+ else
+ ret = strncmp(result[i], exp[i], 43);
+
+ if (ret == 0)
+ continue;
+
+ pr_info("a not same with b,\na: %sb: %s", result[i], exp[i]);
+ flag_out = true;
+ }
+
+ // 检查proc_overview
+ __reset(result, row_real);
+ __reset(exp, row_real);
+ get_attr(PROC_OVERVIEW, result, ROW_MAX, COL_MAX, &row_real);
+ for (int i = 0; i < row_real; i++) {
+ printf("%s", result[i]);
+ }
+ pr_info("\nrow_real is %d\n", row_real);
+ sprintf(exp[0], "%-8s %-16s %-9s %-9s %-9s %-10s %-10s %-8s\n",
+ "PID", "COMM", "SP_ALLOC", "SP_K2U", "SP_RES", "Non-SP_RES",
+ "Non-SP_Shm", "VIRT");
+ sprintf(exp[1], "%-8d %-16s %-9ld %-9ld %-9ld %-10ld %-10ld %-8ld\n",
+ getpid(), "test_auto_check",
+ byte2kb(size), 0, byte2kb(size), 0, 0, 0);
+ sprintf(exp[2], "%-8d %-16s %-9ld %-9ld %-9ld %-10ld %-10ld %-8ld\n",
+ pid, "test_auto_check", 0, 0, byte2kb(size), 0, 0, 0);
+ for (int i = 0; i < row_real; i++) {
+ if (i < 1)
+ ret = strcmp(result[i], exp[i]);
+ else
+ ret = strncmp(result[i], exp[i], 51);
+
+ if (ret == 0)
+ continue;
+
+ pr_info("a not same with b,\na: %sb: %s", result[i], exp[i]);
+ flag_out = true;
+ }
+
+ // 检查sp_group
+ __reset(result, row_real);
+ __reset(exp, row_real);
+ get_attr(pidattr, result, ROW_MAX, COL_MAX, &row_real);
+ for (int i = 0; i < row_real; i++) {
+ printf("%s", result[i]);
+ }
+ pr_info("\nrow_real is %d\n", row_real);
+ sprintf(exp[0], "Share Pool Aggregate Data of This Process\n");
+ sprintf(exp[1], "\n");
+ sprintf(exp[2], "%-8s %-16s %-9s %-9s %-9s %-10s %-10s %-8s\n",
+ "PID", "COMM", "SP_ALLOC", "SP_K2U", "SP_RES", "Non-SP_RES",
+ "Non-SP_Shm", "VIRT");
+ sprintf(exp[3], "%-8d %-16s %-9ld %-9ld %-9ld %-10ld %-10ld %-8ld\n",
+ getpid(), "test_auto_check", byte2kb(size), 0, byte2kb(size),
+ 0, 0, 0);
+ sprintf(exp[4], "\n");
+ sprintf(exp[5], "\n");
+ sprintf(exp[6], "Process in Each SP Group\n");
+ sprintf(exp[7], "\n");
+ sprintf(exp[8], "%-8s %-9s %-9s %-9s %-4s\n",
+ "Group_ID", "SP_ALLOC", "SP_K2U", "SP_RES", "PROT");
+ sprintf(exp[9], "%-8d %-9ld %-9ld %-9ld %s\n",
+ 200001, 0, 0, 0, "RW");
+ sprintf(exp[10], "%-8d %-9ld %-9ld %-9ld %s\n",
+ spg_id, byte2kb(size), 0, byte2kb(size), "RW");
+
+ for (int i = 0; i < row_real; i++) {
+ if (i != 3)
+ ret = strcmp(result[i], exp[i]);
+ else
+ ret = strncmp(result[i], exp[i], 51);
+
+ if (ret == 0)
+ continue;
+
+ pr_info("a not same with b,\na: %sb: %s", result[i], exp[i]);
+ flag_out = true;
+ }
+
+ // 释放
+ struct sp_alloc_info info = {
+ .addr = addr,
+ .spg_id = spg_id,
+ };
+ ret = ioctl_free(dev_fd, &info);
+ if (ret < 0) {
+ pr_info("free memory failed, size %lx, flag %lx", size, flag);
+ goto out;
+ }
+ pr_info("\n\nfree memory finished\n\n");
+
+out:
+ // 回收array
+ for (int i = 0; i < ROW_MAX; i++) {
+ free(result[i]);
+ free(exp[i]);
+ }
+ free(result);
+ free(exp);
+
+kill_child:
+ // 回收工具进程
+ if (spg_id != SPG_ID_DEFAULT)
+ KILL_CHILD(pid);
+ if (flag_out)
+ return -1;
+ return ret;
+}
+
+static int testcase1(void) { return test_route(0, 4096, 1); }
+static int testcase2(void) { return test_route(SP_HUGEPAGE, 2 * 1024UL * 1024UL, 1); }
+static int testcase3(void) { return test_route(SP_DVPP, 4096, 1); }
+static int testcase4(void) { return test_route(SP_HUGEPAGE | SP_DVPP, 2 * 1024UL * 1024UL, 1); }
+
+static int testcase5(void) {
+ if (wrap_add_group(getpid(), PROT_READ, 1) < 0)
+ return -1;
+
+ sharepool_print();
+ sleep(1);
+
+ if (wrap_del_from_group(getpid(), 1) < 0)
+ return -1;
+
+ sharepool_print();
+ sleep(1);
+
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "共享组申请一个小页")
+ TESTCASE_CHILD(testcase2, "共享组申请一个大页")
+ TESTCASE_CHILD(testcase3, "共享组申请一个dvpp小页")
+ TESTCASE_CHILD(testcase4, "共享组申请一个dvpp大页")
+ TESTCASE_CHILD(testcase5, "进程先加入共享组，再主动退出共享组")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/scenario_test/test_dfx_heavy_load.c b/tools/testing/sharepool/testcase/scenario_test/test_dfx_heavy_load.c
new file mode 100644
index 000000000000..16ec53d046bb
--- /dev/null
+++ b/tools/testing/sharepool/testcase/scenario_test/test_dfx_heavy_load.c
@@ -0,0 +1,143 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 14 16:47:36 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+#define MAX_GROUP 49999
+#define SPG_ID_AUTO_MIN 100000
+#define PROC_NUM 20
+
+int sem_id;
+int msg_id;
+struct msgbuf {
+ long mtype;
+ int group_num;
+};
+
+int group_count;
+
+static void send_msg(int msgid, int msgtype, int group_num)
+{
+ struct msgbuf msg = {
+ .mtype = msgtype,
+ .group_num = group_num,
+ };
+
+ if(msgsnd(msgid, (void *) &msg, sizeof(msg.group_num),
+ IPC_NOWAIT) == -1) {
+ perror("msgsnd error");
+ exit(EXIT_FAILURE);
+ } else {
+ pr_info("child %d message sent success: group_num: %d",
+ msgtype - 1, group_num);
+ }
+}
+
+static void get_msg(int msgid, int msgtype)
+{
+ struct msgbuf msg;
+ if (msgrcv(msgid, (void *) &msg, sizeof(msg.group_num), msgtype,
+ MSG_NOERROR) == -1) {
+ if (errno != ENOMSG) {
+ perror("msgrcv");
+ exit(EXIT_FAILURE);
+ }
+ pr_info("No message available for msgrcv()");
+ } else {
+ pr_info("child %d message received success: group_num: %d",
+ msgtype - 1, msg.group_num);
+ group_count += msg.group_num;
+ }
+}
+
+/* 子进程创建组直至失败 */
+static int test1(void)
+{
+ int ret = 0;
+ int count = 0;
+ int spg_id = 0;
+
+ while (1) {
+ spg_id = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, SPG_ID_AUTO);
+ if (spg_id < 0)
+ break;
+ wrap_sp_alloc(spg_id, 4096, 0);
+ count++;
+ }
+
+ pr_info("proc %d add %d groups", getpid(), count);
+ send_msg(msg_id, getpid(), count);
+ sem_inc_by_one(sem_id);
+ while (1) {
+
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+ int ret = 0;
+ int count = 0;
+ int status = 0;
+ char cpid[SIZE];
+ pid_t child[PROC_NUM];
+
+ sem_id = sem_create(1234, "semid");
+ int msgkey = 2345;
+ msg_id = msgget(msgkey, IPC_CREAT | 0666);
+
+ for (int i = 0; i < PROC_NUM; i++)
+ FORK_CHILD_ARGS(child[i], test1());
+
+ for (int i = 0; i < PROC_NUM; i++)
+ get_msg(msg_id, (int)child[i]);
+
+ sem_dec_by_val(sem_id, PROC_NUM);
+ pr_info("\n%d Groups are created.\n", group_count);
+ sleep(2);
+
+ pr_info("Gonna cat /proc/sharepool/proc_stat...\n");
+ ret = cat_attr("/proc/sharepool/proc_stat");
+
+ msgctl(msg_id, IPC_RMID, 0);
+ sem_close(sem_id);
+
+ for (int i = 0; i < PROC_NUM; i++)
+ KILL_CHILD(child[i]);
+
+ return ret;
+}
+
+/*
+ * testcase2: 申请共享组，使用AUTO，预期最多49999个。
+*/
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "申请49999个共享组后，cat /proc/sharepool/proc_stat")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/scenario_test/test_dvpp_16g_limit.c b/tools/testing/sharepool/testcase/scenario_test/test_dvpp_16g_limit.c
new file mode 100644
index 000000000000..9b61c86901b4
--- /dev/null
+++ b/tools/testing/sharepool/testcase/scenario_test/test_dvpp_16g_limit.c
@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 14 16:47:36 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+
+#include "sharepool_lib.h"
+
+#define MEM_1G_SIZE (1024UL * 1024UL * 1024UL)
+#define MAX_DVPP_16G 16
+
+static int test_route(int spg_id)
+{
+ int ret = 0;
+ unsigned long addr;
+ int count = 0;
+
+ if (spg_id != SPG_ID_DEFAULT) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, spg_id);
+ if (ret < 0)
+ return -1;
+ }
+
+ while (1) {
+ addr = (unsigned long)wrap_sp_alloc(spg_id, MEM_1G_SIZE,
+ SP_HUGEPAGE | SP_DVPP);
+ if (addr == -1)
+ break;
+ pr_info("alloc %dG success", ++count);
+ }
+
+ if (count != MAX_DVPP_16G) {
+ pr_info("count is %d unexpected", count);
+ return -1;
+ }
+
+ return 0;
+}
+
+static int testcase1(void) { return test_route(1); }
+static int testcase2(void) { return test_route(SPG_ID_DEFAULT); }
+
+/* testcase1: 申请共享组，指定ID，预期最多49999个。
+ * testcase2: 申请共享组，使用AUTO，预期最多49999个。
+*/
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "申请共享组，指定ID，预期最多49999个。")
+ TESTCASE_CHILD(testcase2, "申请共享组，使用AUTO，预期最多49999个")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/scenario_test/test_failure.c b/tools/testing/sharepool/testcase/scenario_test/test_failure.c
new file mode 100644
index 000000000000..7e0e7919ac30
--- /dev/null
+++ b/tools/testing/sharepool/testcase/scenario_test/test_failure.c
@@ -0,0 +1,630 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 11 07:12:29 2020
+ */
+
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 执行流程：sp_alloc直至触发OOM
+ */
+
+#define GROUP_ID 1
+#define PROC_NUM 20
+#define PROT (PROT_READ | PROT_WRITE)
+#define HP_SIZE (2 * 1024 * 1024UL)
+
+static int testcase1(void)
+{
+ int i;
+ int ret = 0;
+ pid_t pid = getpid();
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+
+ sleep(1);
+
+ struct sp_del_from_group_info info = {
+ .pid = pid,
+ .spg_id = -3,
+ };
+
+ ret = ioctl_del_from_group(dev_fd, &info);
+ if (ret < 0) {
+ pr_info("ioctl_del_group failed, errno: %d", errno);
+ }
+
+ return ret;
+}
+
+static int testcase2(void)
+{
+ int i;
+ int ret = 0;
+ unsigned long ret_addr;
+ pid_t pid = getpid();
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = GROUP_ID,
+ };
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+
+ ret_addr = (unsigned long)wrap_sp_alloc(GROUP_ID, 0, 0);
+ if (ret_addr == -1)
+ pr_info("alloc failed!");
+ else {
+ pr_info("alloc success!");
+ }
+
+ return ret;
+}
+
+static int testcase3(void)
+{
+ int i;
+ int ret = 0;
+ unsigned long ret_addr;
+ pid_t pid = getpid();
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .size = PAGE_SIZE,
+ .spg_id = 1,
+ };
+
+ ret_addr = (unsigned long)ioctl_alloc(dev_fd, &alloc_info);
+ if (ret_addr == -1)
+ pr_info("alloc failed!");
+ else {
+ pr_info("alloc success!");
+ }
+
+ return ret;
+}
+
+static int testcase4(void)
+{
+ int i;
+ int ret;
+ pid_t pid = getpid();
+
+ struct sp_walk_page_range_info wpr_info = {
+ .uva = 0,
+ .size = 1000,
+ };
+ ret = ioctl_walk_page_range_null(dev_fd, &wpr_info);
+ if (!ret) {
+ pr_info("ioctl_walk_page_range successed unexpected");
+ return -1;
+ }
+ return ret;
+}
+
+static int testcase5(void)
+{
+ int i;
+ int ret;
+ pid_t pid = getpid();
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ,
+ .spg_id = GROUP_ID,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0)
+ return -1;
+
+ cat_attr("/proc/sharepool/proc_stat");
+ return ret;
+}
+
+static int prepare(struct vmalloc_info *ka_info, bool ishuge)
+{
+ int ret;
+ if (ishuge) {
+ ret = ioctl_vmalloc_hugepage(dev_fd, ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc_hugepage failed, errno: %d", errno);
+ return -1;
+ }
+ } else {
+ ret = ioctl_vmalloc(dev_fd, ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'a',
+ .addr = ka_info->addr,
+ .size = ka_info->size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, ka_info);
+ }
+ return ret;
+}
+
+static int testcase6(void)
+{
+ int i;
+ int ret;
+ pid_t pid;
+ pid = fork();
+
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ pid_t pid = getpid();
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 2,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0)
+ return -1;
+ while(1)
+ sleep(1);
+ }
+
+ /*try to k2u*/
+ struct vmalloc_info ka_info = {
+ .size = PAGE_SIZE,
+ };
+ if (prepare(&ka_info, false) != 0) {
+ return -1;
+ }
+
+ /*add group to group 1*/
+ struct sp_add_group_info ag_info = {
+ .spg_id = GROUP_ID,
+ .prot = PROT_READ | PROT_WRITE,
+ .pid = getpid(),
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+
+ /*try to share with group 2*/
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = 2,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ }
+
+ return -1;
+}
+
+static int testcase7(void)
+{
+ int ret;
+ struct vmalloc_info ka_info = {
+ .size = 1,
+ .addr = -PAGE_SIZE,
+ };
+ if (prepare(&ka_info, false) != 0) {
+ return -1;
+ }
+
+ struct sp_add_group_info ag_info = {
+ .spg_id = GROUP_ID,
+ .prot = PROT_READ | PROT_WRITE,
+ .pid = getpid(),
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = GROUP_ID,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ }
+
+ k2u_info.size = 1;
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("unshare failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ }
+
+ return ret;
+}
+
+static int testcase8(void)
+{
+ int ret;
+ struct vmalloc_info ka_info = {
+ .size = PAGE_SIZE,
+ };
+ if (prepare(&ka_info, false) != 0) {
+ return -1;
+ }
+
+ struct sp_add_group_info ag_info = {
+ .spg_id = GROUP_ID,
+ .prot = PROT_READ | PROT_WRITE,
+ .pid = getpid(),
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = GROUP_ID,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ }
+
+ k2u_info.kva = 281474976710656 * 2,
+ k2u_info.addr = 281474976710656 * 2,
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("unshare failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ }
+
+ return ret;
+}
+
+static int testcase9(void)
+{
+ int ret;
+ int id = 1;
+
+ /* see sharepool_dev.c for more details*/
+ struct sp_notifier_block_info notifier_info = {
+ .i = id,
+ };
+ ret = ioctl_register_notifier_block(dev_fd, ¬ifier_info);
+ if (ret != 0)
+ pr_info("proc %d register notifier block %d failed. ret is %d. errno is %s.",
+ getpid(), id, ret, strerror(errno));
+ else
+ pr_info("proc %d register notifier for func %d success!!", getpid(), id);
+
+ /* see sharepool_dev.c for more details*/
+ ret = ioctl_unregister_notifier_block(dev_fd, ¬ifier_info);
+ if (ret != 0)
+ pr_info("proc %d unregister notifier block %d failed. ret is %d. errno is %s.",
+ getpid(), id, ret, strerror(errno));
+ else
+ pr_info("proc %d unregister notifier for func %d success!!", getpid(), id);
+
+ return ret;
+}
+
+static int testcase10(void)
+{
+ void *ret;
+
+ struct sp_add_group_info ag_info = {
+ .spg_id = GROUP_ID,
+ .prot = PROT_READ | PROT_WRITE,
+ .pid = getpid(),
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+
+ // 申请MAX个
+ for (int i = 0; i < 1000; i++) {
+ ret = wrap_sp_alloc(GROUP_ID, 100 * PMD_SIZE, SP_HUGEPAGE_ONLY);
+ if (ret == (void *)-1) {
+ pr_info("alloc hugepage failed.");
+ return -1;
+ }
+ }
+ return ret;
+}
+
+static int testcase11(void)
+{
+ int ret;
+ int group_id = 100;
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("add group failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .spg_id = group_id,
+ .size = 12345,
+ };
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return -1;
+ }
+ struct sp_walk_page_range_info wpr_info = {
+ .uva = alloc_info.addr,
+ .size = -PAGE_SIZE,
+ };
+ ret = ioctl_walk_page_range(dev_fd, &wpr_info);
+ if (!ret) {
+ pr_info("ioctl_walk_page_range successed unexpected");
+ return -1;
+ }
+
+ return 0;
+}
+
+static int testcase12(void)
+{
+ int ret;
+ struct vmalloc_info ka_info = {
+ .size = PAGE_SIZE,
+ };
+ if (prepare(&ka_info, false) != 0) {
+ return -1;
+ }
+
+ struct sp_add_group_info ag_info = {
+ .spg_id = GROUP_ID,
+ .prot = PROT_READ | PROT_WRITE,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = GROUP_ID,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ }
+
+ k2u_info.kva = 281474976710656 - 100,
+ k2u_info.addr = 281474976710656 - 100,
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("unshare failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ }
+
+ return ret;
+}
+
+static int testcase13(void)
+{
+ int ret;
+ struct vmalloc_info ka_info = {
+ .size = PAGE_SIZE,
+ };
+
+ if (prepare(&ka_info, false) != 0) {
+ return -1;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ }
+
+ struct sp_add_group_info ag_info = {
+ .spg_id = GROUP_ID,
+ .prot = PROT_READ | PROT_WRITE,
+ .pid = getpid(),
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+
+ pid_t pid = fork();
+
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ struct sp_add_group_info ag_info = {
+ .spg_id = GROUP_ID,
+ .prot = PROT_READ | PROT_WRITE,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+
+ struct sp_make_share_info k2u_info2 = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+ ret = ioctl_k2u(dev_fd, &k2u_info2);
+
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ // if (ret < 0) {
+ // pr_info("unshare failed, errno %d", errno);
+ // ioctl_vfree(dev_fd, &ka_info2);
+ // }
+ exit(0);
+ }
+
+ int status;
+ wait(&status);
+
+ return 0;
+}
+
+static int testcase14(void)
+{
+ int ret;
+ struct vmalloc_info ka_info = {
+ .size = PAGE_SIZE,
+ };
+
+ if (prepare(&ka_info, false) != 0) {
+ return -1;
+ }
+
+ struct sp_add_group_info ag_info = {
+ .spg_id = GROUP_ID,
+ .prot = PROT_READ | PROT_WRITE,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = GROUP_ID,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ ioctl_vfree(dev_fd, &ka_info);
+ }
+
+
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ struct sp_add_group_info ag_info = {
+ .spg_id = 2,
+ .prot = PROT_READ | PROT_WRITE,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ // if (ret < 0) {
+ // pr_info("unshare failed, errno %d", errno);
+ // ioctl_vfree(dev_fd, &ka_info2);
+ // }
+ exit(0);
+ }
+
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "传入非法group id")
+ TESTCASE_CHILD(testcase2, "传入sp_alloc size 传入0")
+ TESTCASE_CHILD(testcase3, "spalloc 时进程未进组")
+ TESTCASE_CHILD(testcase4, "调用walk_page_range,其中sp_walk_data == NULL")
+ TESTCASE_CHILD(testcase5, "cat 一个 group prot 为 READ")
+ TESTCASE_CHILD(testcase6, "k2u to task 时当前进程不在组内")
+ TESTCASE_CHILD(testcase7, "ushare kva时 kva + size出现溢出")
+ TESTCASE_CHILD(testcase8, "ushare kva时, kva == 1")
+ TESTCASE_CHILD(testcase9, "test register and unregister notifier")
+ TESTCASE_CHILD(testcase10,"alloc huge page to OOM")
+ TESTCASE_CHILD(testcase11,"sp_walk_page_range uva_aligned + size_aligned overflow")
+ TESTCASE_CHILD(testcase12,"sp_unshare_uva uva is invalid")
+ TESTCASE_CHILD(testcase13,"sp_unshare_uva unshare uva(to task) no permission")
+ TESTCASE_CHILD(testcase14,"sp_unshare_uva not in the group")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/scenario_test/test_hugepage.c b/tools/testing/sharepool/testcase/scenario_test/test_hugepage.c
new file mode 100644
index 000000000000..f7797a03aaeb
--- /dev/null
+++ b/tools/testing/sharepool/testcase/scenario_test/test_hugepage.c
@@ -0,0 +1,231 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 11 07:12:29 2020
+ */
+
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 执行流程：sp_alloc直至触发OOM
+ */
+
+#define PROT (PROT_READ | PROT_WRITE)
+#define ALLOC_NUM_MAX 100
+#define GROUP_ID 1
+
+static int alloc_num = 50;
+static int nr_hugepages = 0;
+static int nr_overcommit = 0;
+static int cgroup_on = 0;
+
+char *prefix = "/sys/kernel/mm/hugepages/hugepages-2048kB/";
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "n:o:a:c:")) != -1) {
+ switch (opt) {
+ case 'n': // 系统配置静态大页数
+ nr_hugepages = atoi(optarg);
+ printf("nr_hugepages = %d\n", nr_hugepages);
+ break;
+ case 'o': // 系统配置overcommit大页数
+ nr_overcommit = atoi(optarg);
+ printf("nr_overcommit_hugepages = %d\n", nr_overcommit);
+ break;
+ case 'a': // 申请sp大页数量
+ alloc_num = atoi(optarg);
+ printf("want to alloc hugepages = %d\n", alloc_num);
+ break;
+ case 'c': // cgroup是否开启
+ cgroup_on = atoi(optarg);
+ printf("cgroup is %s\n", cgroup_on ? "on" : "off");
+ break;
+ default:
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+char *fields[] = {
+ "nr_hugepages",
+ "free_hugepages",
+ "resv_hugepages",
+ "surplus_hugepages"
+};
+
+static int check_val(char *field, int val)
+{
+ char path[SIZE];
+ char result[SIZE];
+ int real_val;
+
+ strcpy(path, prefix);
+ strcat(path, field);
+ read_attr(path, result, SIZE);
+ real_val = atoi(result);
+ pr_info("%s val is %d", path, real_val);
+ if (real_val != val) {
+ pr_info("Val %s incorrect. expected: %d, now: %d", field, val, real_val);
+ return -1;
+ }
+ return 0;
+}
+
+static int check_vals(int val[])
+{
+ for (int i = 0; i < ARRAY_SIZE(fields); i++)
+ if (check_val(fields[i], val[i]))
+ return -1;
+ return 0;
+}
+
+static void *addr[ALLOC_NUM_MAX];
+static int exp_vals[4];
+
+static int alloc_hugepages_check(void)
+{
+ void *ret;
+
+ // 申请MAX个
+ for (int i = 0; i < alloc_num; i++) {
+ ret = wrap_sp_alloc(GROUP_ID, PMD_SIZE, SP_HUGEPAGE_ONLY);
+ if (ret == (void *)-1) {
+ pr_info("alloc hugepage failed.");
+ return -1;
+ }
+ addr[i] = ret;
+ }
+ pr_info("Alloc %d hugepages success!", alloc_num);
+
+ // 检查 meminfoi f(N)
+ mem_show();
+ if (nr_hugepages >= alloc_num) {
+ exp_vals[0] = nr_hugepages;
+ exp_vals[1] = nr_hugepages - alloc_num;
+ exp_vals[2] = 0;
+ exp_vals[3] = 0;
+ } else if (nr_hugepages + nr_overcommit >= alloc_num) {
+ exp_vals[0] = alloc_num;
+ exp_vals[1] = 0;
+ exp_vals[2] = 0;
+ exp_vals[3] = alloc_num - nr_hugepages;
+ } else {
+ exp_vals[0] = alloc_num;
+ exp_vals[1] = 0;
+ exp_vals[2] = 0;
+ exp_vals[3] = nr_overcommit;
+ }
+
+ if (check_vals(exp_vals)) {
+ pr_info("Check /proc/meminfo hugepages failed.");
+ return -1;
+ }
+ pr_info("Check /proc/meminfo hugepages success");
+ return 0;
+}
+
+static int free_hugepages_check(void)
+{
+ // 释放N个
+ for (int i = 0; i < alloc_num; i++) {
+ if (wrap_sp_free((unsigned long)addr[i])) {
+ pr_info("free failed");
+ return -1;
+ }
+ }
+ pr_info("Free /proc/meminfo hugepages success.");
+
+ // 检查 meminfo
+ mem_show();
+ exp_vals[0] = nr_hugepages;
+ exp_vals[1] = nr_hugepages;
+ exp_vals[2] = 0;
+ exp_vals[3] = 0;
+ if (check_vals(exp_vals)) {
+ pr_info("Check /proc/meminfo hugepages failed.");
+ return -1;
+ }
+ pr_info("Check /proc/meminfo hugepages success");
+ return 0;
+}
+
+/* testcase1:
+ * 申请大页，检查计数；再释放大页，检查计数 */
+static int testcase1(void) {
+ if (wrap_add_group(getpid(), PROT, GROUP_ID) < 0) {
+ pr_info("add group failed");
+ return -1;
+ }
+
+ return alloc_hugepages_check() || free_hugepages_check();
+}
+
+/* testcase2:
+ * 子进程申请大页，检查计数；然后子进程退出
+ * 父进程检查计数 */
+static int testcase2_child(void)
+{
+ if (wrap_add_group(getpid(), PROT, GROUP_ID) < 0) {
+ pr_info("add group failed");
+ return -1;
+ }
+ return alloc_hugepages_check();
+}
+
+static int testcase2(void) {
+ int ret;
+ pid_t child;
+
+ FORK_CHILD_ARGS(child, testcase2_child());
+ WAIT_CHILD_STATUS(child, out);
+
+ // 检查 meminfo
+ mem_show();
+ exp_vals[0] = nr_hugepages;
+ exp_vals[1] = nr_hugepages;
+ exp_vals[2] = 0;
+ exp_vals[3] = 0;
+ if (check_vals(exp_vals)) {
+ pr_info("Check /proc/meminfo hugepages failed.");
+ return -1;
+ }
+ pr_info("Check /proc/meminfo hugepages success");
+ return 0;
+
+out:
+ return -1;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "检查进程申请-主动释放大页过程中，HugePages_xx计数是否正确")
+ TESTCASE_CHILD(testcase2, "检查进程申请-kill并被动释放大页过程中，HugePages_xx计数是否正确")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/scenario_test/test_hugepage_setting.sh b/tools/testing/sharepool/testcase/scenario_test/test_hugepage_setting.sh
new file mode 100755
index 000000000000..917893247e18
--- /dev/null
+++ b/tools/testing/sharepool/testcase/scenario_test/test_hugepage_setting.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+set -x
+
+nr_hpages=/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages
+nr_overcmt=/proc/sys/vm/nr_overcommit_hugepages
+meminfo=/proc/meminfo
+
+# 测试点1：
+# sharepool临时大页体现在HugePages_Total和HugePages_Surp上；
+# setting:
+# 设置静态大页数目=0，overcommit=0
+
+set_nr(){
+ echo $1 > $nr_hpages
+ echo $2 > $nr_overcmt
+ ret=`cat $nr_hpages`
+ if [ $ret -ne $1 ] ;then
+ echo set nr_hugepages failed!
+ return 1
+ fi
+ ret=`cat $nr_overcmt`
+ if [ $ret -ne $2 ] ;then
+ echo set nr_overcommit_hugepages failed!
+ return 1
+ fi
+ return 0
+}
+
+test_hpage(){
+ set_nr $1 $2
+ ./scenario_test/test_hugepage -n $1 -o $2 -a 50 -c 0
+ if [ $? -ne 0 ] ;then
+ return 1
+ fi
+ return 0
+}
+
+echo 'test_hpage 0 0 0
+ test_hpage 20 0 0
+ test_hpage 60 0 0
+ test_hpage 20 20 0
+ test_hpage 20 40 0
+ test_hpage 0 60 0' | while read line
+do
+ $line
+ if [ $? -ne 0 ] ;then
+ echo "$line failed!"
+ exit 1
+ fi
+ echo "$line success"
+done
diff --git a/tools/testing/sharepool/testcase/scenario_test/test_max_50000_groups.c b/tools/testing/sharepool/testcase/scenario_test/test_max_50000_groups.c
new file mode 100644
index 000000000000..cc8a1278c08d
--- /dev/null
+++ b/tools/testing/sharepool/testcase/scenario_test/test_max_50000_groups.c
@@ -0,0 +1,138 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 14 16:47:36 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+#define MAX_GROUP 49999
+#define SPG_ID_AUTO_MIN 100000
+#define PROC_NUM 20
+
+int sem_id;
+int msg_id;
+struct msgbuf {
+ long mtype;
+ int group_num;
+};
+
+int group_count;
+
+static void send_msg(int msgid, int msgtype, int group_num)
+{
+ struct msgbuf msg = {
+ .mtype = msgtype,
+ .group_num = group_num,
+ };
+
+ if(msgsnd(msgid, (void *) &msg, sizeof(msg.group_num),
+ IPC_NOWAIT) == -1) {
+ perror("msgsnd error");
+ exit(EXIT_FAILURE);
+ } else {
+ pr_info("child %d message sent success: group_num: %d",
+ msgtype - 1, group_num);
+ }
+}
+
+static void get_msg(int msgid, int msgtype)
+{
+ struct msgbuf msg;
+ if (msgrcv(msgid, (void *) &msg, sizeof(msg.group_num), msgtype,
+ MSG_NOERROR) == -1) {
+ if (errno != ENOMSG) {
+ perror("msgrcv");
+ exit(EXIT_FAILURE);
+ }
+ pr_info("No message available for msgrcv()");
+ } else {
+ pr_info("child %d message received success: group_num: %d",
+ msgtype - 1, msg.group_num);
+ group_count += msg.group_num;
+ }
+}
+
+/* 子进程创建组直至失败 */
+static int test1(void)
+{
+ int ret = 0;
+ int count = 0;
+
+ while (1) {
+ if (wrap_add_group(getpid(), PROT_READ, SPG_ID_AUTO) < 0)
+ break;
+ count++;
+ }
+
+ pr_info("proc %d add %d groups", getpid(), count);
+ send_msg(msg_id, getpid(), count);
+ sem_inc_by_one(sem_id);
+ while (1) {
+
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+ int ret = 0;
+ int count = 0;
+ int status = 0;
+ char cpid[SIZE];
+ pid_t child[PROC_NUM];
+
+ sem_id = sem_create(1234, "semid");
+ int msgkey = 2345;
+ msg_id = msgget(msgkey, IPC_CREAT | 0666);
+
+ for (int i = 0; i < PROC_NUM; i++)
+ FORK_CHILD_ARGS(child[i], test1());
+
+ for (int i = 0; i < PROC_NUM; i++)
+ get_msg(msg_id, (int)child[i]);
+
+ pr_info("\n%d Groups are created.\n", group_count);
+ sleep(5);
+
+ sem_dec_by_val(sem_id, PROC_NUM);
+// cat_attr("/proc/sharepool/spa_stat");
+
+ for (int i = 0; i < PROC_NUM; i++)
+ KILL_CHILD(child[i]);
+
+ msgctl(msg_id, IPC_RMID, 0);
+ sem_close(sem_id);
+ return ret;
+}
+
+/*
+ * testcase2: 申请共享组，使用AUTO，预期最多49999个。
+*/
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "申请共享组，使用AUTO，预期最多49999个")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/scenario_test/test_oom.c b/tools/testing/sharepool/testcase/scenario_test/test_oom.c
new file mode 100644
index 000000000000..ca78d71fbc1a
--- /dev/null
+++ b/tools/testing/sharepool/testcase/scenario_test/test_oom.c
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 11 07:12:29 2020
+ */
+
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 执行流程：sp_alloc直至触发OOM
+ */
+
+#define PROC_NUM 20
+#define PROT (PROT_READ | PROT_WRITE)
+#define HP_SIZE (2 * 1024 * 1024UL)
+
+static int testcase1(void)
+{
+ int ret = 0;
+ unsigned long ret_addr;
+ int status;
+ pid_t child[PROC_NUM];
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ int pid = fork();
+ if (pid == 0) {
+ int count = 0;
+ TEST_CHECK(wrap_add_group(getpid(), PROT, i + 1), error);
+ while (1) {
+ ret_addr = (unsigned long)wrap_sp_alloc(i + 1, HP_SIZE, 0);
+ if (ret_addr == -1)
+ pr_info("alloc failed! ret_addr: %lx, errno: %d", ret_addr, errno);
+ else
+ pr_info("proc%d: alloc success %d time.", i, ++count);
+ }
+ }
+ child[i] = pid;
+ }
+
+ for (int i = 0; i < PROC_NUM; i++)
+ waitpid(child[i], &status, 0);
+
+error:
+ return ret;
+}
+
+static int testcase2(void)
+{
+ int ret = 0;
+ unsigned long ret_addr;
+ int status;
+ pid_t child[PROC_NUM];
+ pid_t add_workers[PROC_NUM];
+
+ // 拉起加组进程，反复加入和退出组
+ for (int i = 0; i < PROC_NUM; i++) {
+ int pid = fork();
+ if (pid == 0) { // add group -> del group
+ int count = 0;
+ while (1) {
+ int grp_id = PROC_NUM + i + 1;
+ ret = wrap_add_group(getpid(), PROT, grp_id);
+ if (ret < 0) {
+ pr_info("add group %d failed. ret: %d", grp_id, ret);
+ continue;
+ }
+ pr_info("add group %d success.", grp_id);
+ ret = wrap_del_from_group(getpid(), grp_id);
+ if (ret < 0) {
+ pr_info("del from group %d failed unexpected. ret: %d", grp_id, ret);
+ break;
+ }
+ }
+ exit(ret);
+ }
+ add_workers[i] = pid;
+ }
+
+ // 拉起申请进程
+ for (int i = 0; i < PROC_NUM; i++) {
+ int pid = fork();
+ if (pid == 0) {
+ int count = 0;
+ TEST_CHECK(wrap_add_group(getpid(), PROT, i + 1), error); // group id [1, PROC_NUM]
+ while (1) {
+ ret_addr = (unsigned long)wrap_sp_alloc(i + 1, HP_SIZE, 0);
+ if (ret_addr == -1)
+ pr_info("alloc failed! ret_addr: %lx, errno: %d", ret_addr, errno);
+ else
+ pr_info("proc%d: alloc success %d time.", i, ++count);
+ }
+ }
+ child[i] = pid;
+ }
+
+ // 等待申请进程OOM
+ for (int i = 0; i < PROC_NUM; i++)
+ waitpid(child[i], &status, 0);
+
+ // kill加组进程
+ for (int i = 0; i < PROC_NUM; i++)
+ KILL_CHILD(add_workers[i]);
+
+error:
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "执行流程：sp_alloc直至触发OOM")
+ TESTCASE_CHILD(testcase2, "执行sp_alloc，直到oom；同时拉起加组进程，反复加入和退出组")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/scenario_test/test_proc_sp_group_state.c b/tools/testing/sharepool/testcase/scenario_test/test_proc_sp_group_state.c
new file mode 100644
index 000000000000..8e4ba2881800
--- /dev/null
+++ b/tools/testing/sharepool/testcase/scenario_test/test_proc_sp_group_state.c
@@ -0,0 +1,170 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 14 16:47:36 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+
+#include "sharepool_lib.h"
+
+#define ALIGN_UP(x, align_to) (((x) + ((align_to)-1)) & ~((align_to)-1))
+#define CMD_LEN 100
+#define UNIT 1024
+#define PAGE_NUM 100
+#define HGPAGE_NUM 10
+#define LARGE_PAGE_NUM 1000000
+#define ATOMIC_TEST_SIZE (1024UL * 1024UL * 1024UL) // 1G
+/*
+ * 前置条件：进程先加组。
+ * testcase1: 申请共享组内存，flag为0。预期申请成功。
+ * testcase2: 申请共享组内存，flag为HP，size不对齐。预期申请到对齐大页大小size的内存。
+ */
+
+static int addgroup(void)
+{
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = 1,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static int cleanup(struct sp_alloc_info *alloc_info)
+{
+ int ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_free failed, errno: %d", errno);
+ }
+ return ret;
+}
+
+static int alloc_large_repeat(bool hugepage, int repeat)
+{
+ int ret;
+ if (addgroup() != 0) {
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = hugepage ? 1 : 0,
+ .size = ATOMIC_TEST_SIZE,
+ .spg_id = 1,
+ };
+
+ pr_info("start to alloc...");
+ for (int i = 0; i < repeat; i++) {
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret != 0) {
+ pr_info("alloc %s failed. errno %d",
+ hugepage ? "huge page" : "normal page",
+ errno);
+ return ret;
+ } else {
+ pr_info("alloc %s success %d time.",
+ hugepage ? "huge page" : "normal page",
+ i + 1);
+ }
+ sharepool_print();
+ mem_show();
+ }
+ return 0;
+}
+
+// 申请完停下手动cat下
+static int testcase1(void)
+{
+ char pid_str[SIZE];
+
+ alloc_large_repeat(false, 1);
+ pr_info("process %d suspended, cat /proc/%d/sp_group, then kill",
+ getpid(), getpid());
+
+ sprintf(pid_str, "/proc/%d/sp_group", getpid());
+ cat_attr(pid_str);
+ sleep(1);
+
+ return 0;
+}
+
+static int testcase2(void)
+{
+ char pid_str[SIZE];
+
+ alloc_large_repeat(true, 1);
+ pr_info("process %d suspended, cat /proc/%d/sp_group, then kill",
+ getpid(), getpid());
+
+ sprintf(pid_str, "/proc/%d/sp_group", getpid());
+ cat_attr(pid_str);
+ sleep(1);
+
+ return 0;
+}
+
+static int testcase3(void)
+{
+ int ret = 0;
+ char pid_str[SIZE];
+ sprintf(pid_str, "/proc/%d/sp_group", getpid());
+
+ pr_info("process %d no connection with sharepool, cat /proc/%d/sp_group ...",
+ getpid(), getpid());
+ cat_attr(pid_str);
+ sleep(1);
+
+ ret = alloc_large_repeat(true, 1);
+
+ pr_info("process %d now alloc sharepool memory, cat /proc/%d/sp_group ...",
+ getpid(), getpid());
+ cat_attr(pid_str);
+ sleep(1);
+
+ return ret;
+}
+
+static int testcase4(void)
+{
+ char pid_str[SIZE];
+
+ for (int i = 0; i < 100; i++) {
+ sprintf(pid_str, "/proc/%d/sp_group", i);
+ cat_attr(pid_str);
+ }
+
+ sleep(1);
+ return 0;
+}
+
+
+/* testcase1: 申请共享组内存，flag为0。预期申请成功。
+ * testcase2: 申请共享组内存，flag为HP，size不对齐。预期申请到对齐大页大小size的内存。
+*/
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "单进程申请1G普通页，重复1次，然后退出。观察维测结构打印是否正常")
+ TESTCASE_CHILD(testcase2, "单进程申请1G大页，重复1次，然后退出。观察维测结构打印是否正常")
+ TESTCASE_CHILD(testcase3, "单进程未与sharepool产生关联，直接cat，然后再加组申请内存，再cat")
+ TESTCASE_CHILD(testcase4, "cat /proc/1~100/sp_group, 不死锁即可")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/scenario_test/test_vmalloc_cgroup.c b/tools/testing/sharepool/testcase/scenario_test/test_vmalloc_cgroup.c
new file mode 100644
index 000000000000..c8e5748cdebe
--- /dev/null
+++ b/tools/testing/sharepool/testcase/scenario_test/test_vmalloc_cgroup.c
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 11 07:12:29 2020
+ */
+
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 执行流程：sp_alloc直至触发OOM
+ */
+
+#define PROC_NUM 20
+#define PROT (PROT_READ | PROT_WRITE)
+#define HP_SIZE (2 * 1024 * 1024UL)
+
+static int test(bool ishuge)
+{
+ int ret = 0;
+ unsigned long kaddr;
+ unsigned long size = 10UL * PMD_SIZE;
+
+ kaddr = wrap_vmalloc(size, ishuge);
+ if (!kaddr) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ KAREA_ACCESS_SET('A', kaddr, size, out);
+ return ret;
+out:
+ return -1;
+}
+
+static int testcase1(void) { return test(false); }
+static int testcase2(void) { return test(true); }
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "vmalloc 20M小页内存，不释放，退出")
+ TESTCASE_CHILD(testcase1, "vmalloc 20M大页内存，不释放，退出")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/stress_test/Makefile b/tools/testing/sharepool/testcase/stress_test/Makefile
new file mode 100644
index 000000000000..30c6456130d9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/stress_test/Makefile
@@ -0,0 +1,15 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ mkdir -p $(TOOL_BIN_DIR)/stress_test
+ cp $(testcases) $(TOOL_BIN_DIR)/stress_test
+ cp stress_test.sh $(TOOL_BIN_DIR)
+
+clean:
+ rm -rf $(testcases)
diff --git a/tools/testing/sharepool/testcase/stress_test/sp_ro_fault_injection.sh b/tools/testing/sharepool/testcase/stress_test/sp_ro_fault_injection.sh
new file mode 100644
index 000000000000..2bc729f09fd0
--- /dev/null
+++ b/tools/testing/sharepool/testcase/stress_test/sp_ro_fault_injection.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# fault injection test for SP_RO read only area
+
+fn_fail_page_alloc()
+{
+ echo Y > /sys/kernel/debug/fail_page_alloc/task-filter
+ echo 10 > /sys/kernel/debug/fail_page_alloc/probability
+ echo 1 > /sys/kernel/debug/fail_page_alloc/interval
+ printf %#x -1 > /sys/kernel/debug/fail_page_alloc/times
+ echo 0 > /sys/kernel/debug/fail_page_alloc/space
+ echo 2 > /sys/kernel/debug/fail_page_alloc/verbose
+ bash -c "echo 1 > /proc/self/make-it-fail && exec $*"
+}
+
+fn_page_alloc_fault()
+{
+ fn_fail_page_alloc ./api_test/ro_test
+}
+
+fn_page_alloc_fault
diff --git a/tools/testing/sharepool/testcase/stress_test/stress_test.sh b/tools/testing/sharepool/testcase/stress_test/stress_test.sh
new file mode 100755
index 000000000000..fd83c8d51015
--- /dev/null
+++ b/tools/testing/sharepool/testcase/stress_test/stress_test.sh
@@ -0,0 +1,47 @@
+#!/bin/sh
+
+set -x
+
+echo 'test_u2k_add_and_kill -g 2999 -p 1023 -n 10000
+ test_alloc_add_and_kill -g 2999 -p 1023 -n 10000
+ test_concurrent_debug -g 2999 -p 1023 -n 10000
+ test_mult_u2k -n 5000 -s 1000 -r 500
+ test_alloc_free_two_process -g 2999 -p 1023 -n 100 -s 10000
+ test_statistics_stress
+ test_mult_proc_interface' | while read line
+do
+ let flag=0
+ ./stress_test/$line
+ if [ $? -ne 0 ] ;then
+ echo "testcase stress_test/$line failed"
+ let flag=1
+ fi
+
+ sleep 3
+
+ #打印spa_stat
+ ret=`cat /proc/sharepool/spa_stat | wc -l`
+ if [ $ret -ge 15 ] ;then
+ cat /proc/sharepool/spa_stat
+ echo spa_stat not clean
+ let flag=1
+ fi
+ #打印proc_stat
+ ret=`cat /proc/sharepool/proc_stat | wc -l`
+ if [ $ret -ge 15 ] ;then
+ cat /proc/sharepool/proc_stat
+ echo proc_stat not clean
+ let flag=1
+ fi
+
+ cat /proc/sharepool/proc_overview
+ #如果泄漏 -->exit
+ if [ $flag -eq 1 ] ;then
+ exit 1
+ fi
+ echo "testcase stress_test/$line success"
+
+ cat /proc/meminfo
+ free -m
+
+done
diff --git a/tools/testing/sharepool/testcase/stress_test/test_alloc_add_and_kill.c b/tools/testing/sharepool/testcase/stress_test/test_alloc_add_and_kill.c
new file mode 100644
index 000000000000..7278815bd328
--- /dev/null
+++ b/tools/testing/sharepool/testcase/stress_test/test_alloc_add_and_kill.c
@@ -0,0 +1,347 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 11 07:12:29 2020
+ */
+
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 执行流程：
+ * grandchild:
+ * 连续申请100次内存，然后释放掉，循环做
+ * child:
+ * 不断的kill或者创建grandchild进程
+ * 参数：
+ * -n 杀死或者创建grandchild进程次数
+ * -p 每组进程数
+ * -g sharepool组的数量
+ * -s grandchild进程每次申请内存的大小
+ */
+
+#define NR_GROUP 3000
+#define MAX_PROC_PER_GRP 1024
+#define NR_HOLD_AREAS 100
+
+static sem_t *child_sync[NR_GROUP];
+static sem_t *grandchild_sync[NR_GROUP];
+
+static int group_num = 2;
+static int process_per_group = 3;
+static int kill_num = 1000;
+static size_t alloc_size = 4 * PAGE_SIZE;
+
+static int grandchild_process(int grandchild_id)
+{
+#define pr_local_info(fmt, args...) printf("[grandchild%d, pid:%d] " fmt "\n", grandchild_id, getpid(), ##args)
+ int ret;
+
+ /* 等待父进程加组 */
+ do {
+ ret = sem_wait(child_sync[grandchild_id / MAX_PROC_PER_GRP]);
+ } while ((ret != 0) && errno == EINTR);
+
+ //pr_local_info("start!!");
+
+ int group_id = ioctl_find_first_group(dev_fd, getpid());
+ sem_post(grandchild_sync[grandchild_id / MAX_PROC_PER_GRP]);
+ if (group_id < 0) {
+ pr_local_info("ioctl_find_group_by_pid failed, %d", group_id);
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_infos[NR_HOLD_AREAS] = {0};
+ for (int i = 0; i < NR_HOLD_AREAS; i++) {
+ alloc_infos[i].flag = 0;
+ alloc_infos[i].spg_id = group_id;
+ alloc_infos[i].size = alloc_size;
+ }
+
+ int top = 0;
+ int count = 0;
+ while (1) {
+ struct sp_alloc_info *info = alloc_infos + top++;
+ ret = ioctl_alloc(dev_fd, info);
+ if (ret < 0) {
+ pr_local_info("ioctl alloc failed\n");
+ return -1;
+ } else {
+ if (IS_ERR_VALUE(info->addr)) {
+ pr_local_info("sp_alloc return err is %ld\n", info->addr);
+ return -1;
+ }
+ }
+
+ memset((void *)info->addr, 'z', info->size);
+
+ if (top == NR_HOLD_AREAS) {
+ top = 0;
+ for (int i = 0; i < NR_HOLD_AREAS; i++) {
+ ret = ioctl_free(dev_fd, &alloc_infos[i]);
+ if (ret < 0) {
+ pr_local_info("sp_free failed, %d", ret);
+ return ret;
+ }
+ }
+ pr_info("grandchild process id:%d finished %dth alloc-free-100times-run.", grandchild_id, ++count);
+ }
+ }
+
+ //pr_local_info("exit!!");
+ return 0;
+#undef pr_local_info
+}
+
+static int child_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[child%d , pid:%d] " fmt "\n", arg, getpid(), ##args)
+ //pr_local_info("start!!");
+
+ int ret, status = 0;
+ int group_id = arg + 100;
+ pid_t childs[MAX_PROC_PER_GRP] = {0};
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0)
+ return -1;
+
+ for (int i = 0; i < process_per_group; i++) {
+ int grandchild_id = arg * MAX_PROC_PER_GRP + i;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(grandchild_id);
+ exit(ret);
+ } else {
+ //pr_local_info("fork grandchild%d, pid: %d", grandchild_id, pid);
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", grandchild_id, group_id);
+ goto out;
+ } else {
+ //pr_local_info("add grandchild%d to group %d successfully", grandchild_id, group_id);
+ }
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[arg]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandchild_sync[arg]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+
+ pr_local_info("%dth sp group %d, create %d processes and add group success!!", arg, group_id, process_per_group);
+
+ unsigned int seed = time(NULL);
+ srand(seed);
+ pr_local_info("rand seed: %u\n", seed);
+ /* 随机杀死或者创建进程 */
+ for (int i = 0; i < kill_num; i++) {
+ sleep(1);
+ pr_info("group %d %dth interruption, %d times left.", group_id, i + 1, kill_num - i - 1);
+ int idx = rand() % process_per_group;
+
+ if (childs[idx] > 0) {
+ kill(childs[idx], SIGKILL);
+ waitpid(childs[idx], NULL, 0);
+ childs[idx] = 0;
+ } else {
+ int grandchild_id = arg * MAX_PROC_PER_GRP + idx;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(grandchild_id);
+ exit(ret);
+ } else {
+ pr_local_info("fork grandchild%d, pid: %d", grandchild_id, pid);
+ childs[idx] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", grandchild_id, group_id);
+ goto out;
+ } else
+ pr_local_info("add grandchild%d to group %d successfully", grandchild_id, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[arg]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandchild_sync[arg]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+ }
+
+out:
+ for (int i = 0; i < process_per_group; i++) {
+ if (!childs[i])
+ continue;
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], &status, 0);
+ if (!WIFSIGNALED(status)) {
+ pr_local_info("grandchild%d test failed", arg * MAX_PROC_PER_GRP + i);
+ ret = -1;
+ }
+ }
+
+ pr_local_info("exit!!");
+
+ return ret;
+#undef pr_local_info
+}
+
+static void print_help()
+{
+ printf("Usage:\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "p:g:n:s:")) != -1) {
+ switch (opt) {
+ case 'p': // 每组进程数
+ process_per_group = atoi(optarg);
+ if (process_per_group > MAX_PROC_PER_GRP || process_per_group <= 0) {
+ printf("process number invalid\n");
+ return -1;
+ }
+ break;
+ case 'g': // group 数量
+ group_num = atoi(optarg);
+ if (group_num > NR_GROUP || group_num <= 0) {
+ printf("group number invalid\n");
+ return -1;
+ }
+ break;
+ case 'n': // 杀死或者创建子进程次数
+ kill_num = atoi(optarg);
+ if (kill_num > 100000 || kill_num <= 0) {
+ printf("kill number invalid\n");
+ return -1;
+ }
+ break;
+ case 's':
+ alloc_size = atol(optarg);
+ if (alloc_size <= 0) {
+ printf("alloc size invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ printf("unsupported options: '%c'\n", opt);
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+#define pr_local_info(fmt, args...) printf("[parent , pid:%d] " fmt "\n", getpid(), ##args)
+
+ int ret = 0;
+ int status = 0;
+ pid_t childs[NR_GROUP];
+
+ pr_local_info("group: %d, process_per_group: %d", group_num, process_per_group);
+
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_grandchild_sync%d", i);
+ grandchild_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (grandchild_sync[i] == SEM_FAILED) {
+ pr_local_info("grandchild sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_child_sync%d", i);
+ child_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (child_sync[i] == SEM_FAILED) {
+ pr_local_info("child sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed, error %d", pid);
+ exit(-1);
+ } else if (pid == 0) {
+ ret = child_process(i);
+ exit(ret);
+ } else {
+ childs[i] = pid;
+
+ pr_local_info("fork child%d, pid: %d", i, pid);
+ }
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ waitpid(childs[i], &status, 0);
+ status = (char)WEXITSTATUS(status);
+ if (status) {
+ pr_local_info("child%d test failed, %d", i, status);
+ ret = status;
+ }
+ }
+
+ pr_local_info("exit!!");
+
+ return ret;
+#undef pr_local_info
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "连续申请100次内存，然后释放掉，循环; 同时不断杀死进程/创建新进程加组")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/stress_test/test_alloc_free_two_process.c b/tools/testing/sharepool/testcase/stress_test/test_alloc_free_two_process.c
new file mode 100644
index 000000000000..63621dbf5b7d
--- /dev/null
+++ b/tools/testing/sharepool/testcase/stress_test/test_alloc_free_two_process.c
@@ -0,0 +1,303 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 11 07:12:29 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 两个组，每组两个进程，同时多次申请释放内存
+ *
+ * 用信号量进行同步，进程创建完成后先睡眠
+ */
+
+#define NR_GROUP 3000
+#define MAX_PROC_PER_GRP 1024
+
+static int group_num = 2;
+static int process_per_group = 3;
+static int alloc_num = 1000;
+static size_t alloc_size = 4 * PAGE_SIZE;
+
+static int grandchild_process(int arg, sem_t *child_sync, sem_t *grandchild_sync)
+{
+#define pr_local_info(fmt, args...) printf("[grandchild%d, pid:%d] " fmt "\n", arg, getpid(), ##args)
+ int ret;
+
+ struct sp_alloc_info *alloc_infos = malloc(sizeof(*alloc_infos) * alloc_num);
+ if (!alloc_infos) {
+ pr_local_info("malloc failed");
+ return -1;
+ }
+
+ /* 等待父进程加组 */
+ do {
+ ret = sem_wait(child_sync);
+ } while ((ret != 0) && errno == EINTR);
+
+ sleep(1); // it seems sem_wait doesn't work as expected
+ pr_local_info("start!!, ret is %d, errno is %d", ret, errno);
+
+ int group_id = ioctl_find_first_group(dev_fd, getpid());
+ if (group_id < 0) {
+ pr_local_info("ioctl_find_group_by_pid failed, %d", group_id);
+ goto error_out;
+ }
+
+ for (int i = 0; i < alloc_num; i++) {
+ (alloc_infos + i)->flag = 0,
+ (alloc_infos + i)->spg_id = group_id,
+ (alloc_infos + i)->size = alloc_size,
+ /* sp_alloc */
+ ret = ioctl_alloc(dev_fd, alloc_infos + i);
+ if (ret < 0) {
+ pr_local_info("ioctl alloc failed\n");
+ goto error_out;
+ } else {
+ if (IS_ERR_VALUE(alloc_infos[i].addr)) {
+ pr_local_info("sp_alloc return err is %ld\n", alloc_infos[i].addr);
+ goto error_out;
+ }
+ }
+
+ memset((void *)alloc_infos[i].addr, 'z', alloc_infos[i].size);
+ }
+
+ sem_post(grandchild_sync);
+ do {
+ ret = sem_wait(child_sync);
+ } while (ret < 0 && errno == EINTR);
+
+ for (int i = 0; i < alloc_num; i++) {
+ ret = ioctl_free(dev_fd, alloc_infos + i);
+ if (ret < 0) {
+ pr_local_info("ioctl free failed, errno: %d", errno);
+ goto error_out;
+ }
+ }
+ sem_post(grandchild_sync);
+ free(alloc_infos);
+ pr_local_info("exit!!");
+ return 0;
+
+error_out:
+ sem_post(grandchild_sync);
+ free(alloc_infos);
+ return -1;
+#undef pr_local_info
+}
+
+static int child_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[child%d , pid:%d] " fmt "\n", arg, getpid(), ##args)
+ pr_local_info("start!!");
+
+ int ret, status = 0;
+ int group_id = arg + 100;
+ pid_t childs[MAX_PROC_PER_GRP] = {0};
+ sem_t *child_sync[MAX_PROC_PER_GRP] = {0};
+ sem_t *grandchild_sync[MAX_PROC_PER_GRP] = {0};
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0)
+ return -1;
+
+ // create syncs for grandchilds
+ for (int i = 0; i < process_per_group; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_grandchild_sync%d", i);
+ grandchild_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (grandchild_sync[i] == SEM_FAILED) {
+ pr_local_info("grandchild sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ // create syncs for childs
+ for (int i = 0; i < process_per_group; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_child_sync%d", i);
+ child_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (child_sync[i] == SEM_FAILED) {
+ pr_local_info("child sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ // 创建子进程并将之加组
+ for (int i = 0; i < process_per_group; i++) {
+ int num = arg * MAX_PROC_PER_GRP + i;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(num, child_sync[i], grandchild_sync[i]);
+ exit(ret);
+ } else {
+ pr_local_info("fork grandchild%d, pid: %d", num, pid);
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", num, group_id);
+ goto error_out;
+ } else
+ pr_local_info("add grandchild%d to group %d successfully", num, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[i]);
+ }
+ }
+
+ for (int i = 0; i < process_per_group; i++)
+ do {
+ ret = sem_wait(grandchild_sync[i]);
+ } while (ret < 0 && errno == EINTR);
+
+ for (int i = 0; i < process_per_group; i++)
+ sem_post(child_sync[i]);
+ pr_local_info("grandchild-processes start to do sp_free");
+
+ for (int i = 0; i < process_per_group && childs[i] > 0; i++) {
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_local_info("grandchild%d test failed, %d", arg * MAX_PROC_PER_GRP + i, status);
+ ret = -1;
+ }
+ }
+ pr_local_info("exit!!");
+ return ret;
+
+error_out:
+ for (int i = 0; i < process_per_group && childs[i] > 0; i++) {
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], NULL, 0);
+ };
+ pr_local_info("exit!!");
+ return -1;
+#undef pr_local_info
+}
+
+static void print_help()
+{
+ printf("Usage:\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "p:g:n:s:")) != -1) {
+ switch (opt) {
+ case 'p': // 每组进程数
+ process_per_group = atoi(optarg);
+ if (process_per_group > MAX_PROC_PER_GRP || process_per_group <= 0) {
+ printf("process number invalid\n");
+ return -1;
+ }
+ break;
+ case 'g': // group 数量
+ group_num = atoi(optarg);
+ if (group_num > NR_GROUP || group_num <= 0) {
+ printf("group number invalid\n");
+ return -1;
+ }
+ break;
+ case 'n': // 内存申请次数
+ alloc_num = atoi(optarg);
+ if (alloc_num > 100000 || alloc_num <= 0) {
+ printf("alloc number invalid\n");
+ return -1;
+ }
+ break;
+ case 's':
+ alloc_size = atol(optarg);
+ if (alloc_size <= 0) {
+ printf("alloc size invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+#define pr_local_info(fmt, args...) printf("[parent , pid:%d] " fmt "\n", getpid(), ##args)
+
+ int ret = 0;
+ int status = 0;
+ pid_t childs[NR_GROUP];
+
+ pr_local_info("group: %d, process_per_group: %d", group_num, process_per_group);
+
+ for (int i = 0; i < group_num; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed, error %d", pid);
+ exit(-1);
+ } else if (pid == 0) {
+ ret = child_process(i);
+ exit(ret);
+ } else {
+ childs[i] = pid;
+
+ pr_local_info("fork child%d, pid: %d", i, pid);
+ }
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_local_info("child%d test failed, %d", i, status);
+ ret = -1;
+ }
+ }
+
+ pr_local_info("exit!!");
+
+ return ret;
+#undef pr_local_info
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "两个组每组两个进程，同时申请释放内存，简单验证")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/stress_test/test_concurrent_debug.c b/tools/testing/sharepool/testcase/stress_test/test_concurrent_debug.c
new file mode 100644
index 000000000000..6de3001e5632
--- /dev/null
+++ b/tools/testing/sharepool/testcase/stress_test/test_concurrent_debug.c
@@ -0,0 +1,359 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 11 07:12:29 2020
+ */
+
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 执行流程：
+ * grandchild:
+ * 连续申请100次内存，然后释放掉，循环
+ * child:
+ * 不断的kill或者创建grandchild进程
+ * 参数：
+ * -n 杀死或者创建grandchild进程次数
+ * -p 每组进程数
+ * -g sharepool组的数量
+ * -s grandchild进程每次申请内存的大小
+ */
+
+#define NR_GROUP 3000
+#define MAX_PROC_PER_GRP 1024
+#define NR_HOLD_AREAS 100
+
+static sem_t *child_sync[NR_GROUP];
+static sem_t *grandchild_sync[NR_GROUP];
+
+static int group_num = 2;
+static int process_per_group = 3;
+static int kill_num = 100;
+static size_t alloc_size = 4 * PAGE_SIZE;
+
+static int grandchild_process(int grandchild_id)
+{
+#define pr_local_info(fmt, args...) printf("[grandchild%d, pid:%d] " fmt "\n", grandchild_id, getpid(), ##args)
+ int ret;
+
+ /* 等待父进程加组 */
+ do {
+ ret = sem_wait(child_sync[grandchild_id / MAX_PROC_PER_GRP]);
+ } while ((ret != 0) && errno == EINTR);
+
+ //pr_local_info("start!!");
+
+ int group_id = ioctl_find_first_group(dev_fd, getpid());
+ sem_post(grandchild_sync[grandchild_id / MAX_PROC_PER_GRP]);
+ if (group_id < 0) {
+ pr_local_info("ioctl_find_group_by_pid failed, %d", group_id);
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_infos[NR_HOLD_AREAS] = {0};
+ for (int i = 0; i < NR_HOLD_AREAS; i++) {
+ alloc_infos[i].flag = 0;
+ alloc_infos[i].spg_id = group_id;
+ alloc_infos[i].size = alloc_size;
+ }
+
+ int top = 0;
+ int count = 0;
+ while (1) {
+ struct sp_alloc_info *info = alloc_infos + top++;
+ ret = ioctl_alloc(dev_fd, info);
+ if (ret < 0) {
+ pr_local_info("ioctl alloc failed\n");
+ return -1;
+ } else {
+ if (IS_ERR_VALUE(info->addr)) {
+ pr_local_info("sp_alloc return err is %ld\n", info->addr);
+ return -1;
+ }
+ }
+
+ memset((void *)info->addr, 'z', info->size);
+
+ if (top == NR_HOLD_AREAS) {
+ top = 0;
+ for (int i = 0; i < NR_HOLD_AREAS; i++) {
+ ret = ioctl_free(dev_fd, &alloc_infos[i]);
+ if (ret < 0) {
+ pr_local_info("sp_free failed, %d", ret);
+ return ret;
+ }
+ }
+ pr_info("grandchild process id:%d finished %dth alloc-free-100times-run.", grandchild_id, ++count);
+ }
+ }
+
+ //pr_local_info("exit!!");
+ return 0;
+#undef pr_local_info
+}
+
+static int child_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[child%d , pid:%d] " fmt "\n", arg, getpid(), ##args)
+ //pr_local_info("start!!");
+
+ int ret, status = 0;
+ int group_id = arg + 100;
+ pid_t childs[MAX_PROC_PER_GRP] = {0};
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0)
+ return -1;
+
+ for (int i = 0; i < process_per_group; i++) {
+ int grandchild_id = arg * MAX_PROC_PER_GRP + i;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(grandchild_id);
+ exit(ret);
+ } else {
+ //pr_local_info("fork grandchild%d, pid: %d", grandchild_id, pid);
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", grandchild_id, group_id);
+ goto out;
+ } else {
+ //pr_local_info("add grandchild%d to group %d successfully", grandchild_id, group_id);
+ }
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[arg]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandchild_sync[arg]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+
+ pr_local_info("%dth sp group %d, create %d processes and add group success!!", arg, group_id, process_per_group);
+
+ unsigned int seed = time(NULL);
+ srand(seed);
+ pr_local_info("rand seed: %u\n", seed);
+ /* 随机杀死或者创建进程 */
+ for (int i = 0; i < kill_num; i++) {
+ sleep(1);
+ pr_info("group %d %dth interruption, %d times left.", group_id, i + 1, kill_num - i - 1);
+ int idx = rand() % process_per_group;
+
+ if (childs[idx] > 0) {
+ kill(childs[idx], SIGKILL);
+ waitpid(childs[idx], NULL, 0);
+ childs[idx] = 0;
+ } else {
+ int grandchild_id = arg * MAX_PROC_PER_GRP + idx;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(grandchild_id);
+ exit(ret);
+ } else {
+ pr_local_info("fork grandchild%d, pid: %d", grandchild_id, pid);
+ childs[idx] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", grandchild_id, group_id);
+ goto out;
+ } else
+ pr_local_info("add grandchild%d to group %d successfully", grandchild_id, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[arg]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandchild_sync[arg]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+ }
+
+out:
+ for (int i = 0; i < process_per_group; i++) {
+ if (!childs[i])
+ continue;
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], &status, 0);
+ if (!WIFSIGNALED(status)) {
+ pr_local_info("grandchild%d test failed", arg * MAX_PROC_PER_GRP + i);
+ ret = -1;
+ }
+ }
+
+ pr_local_info("exit!!");
+
+ return ret;
+#undef pr_local_info
+}
+
+static void print_help()
+{
+ printf("Usage:\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "p:g:n:s:")) != -1) {
+ switch (opt) {
+ case 'p': // 每组进程数
+ process_per_group = atoi(optarg);
+ if (process_per_group > MAX_PROC_PER_GRP || process_per_group <= 0) {
+ printf("process number invalid\n");
+ return -1;
+ }
+ break;
+ case 'g': // group 数量
+ group_num = atoi(optarg);
+ if (group_num > NR_GROUP || group_num <= 0) {
+ printf("group number invalid\n");
+ return -1;
+ }
+ break;
+ case 'n': // 杀死或者创建子进程次数
+ kill_num = atoi(optarg);
+ if (kill_num > 100000 || kill_num <= 0) {
+ printf("kill number invalid\n");
+ return -1;
+ }
+ break;
+ case 's':
+ alloc_size = atol(optarg);
+ if (alloc_size <= 0) {
+ printf("alloc size invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ printf("unsupported options: '%c'\n", opt);
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+#define pr_local_info(fmt, args...) printf("[parent , pid:%d] " fmt "\n", getpid(), ##args)
+
+ int ret = 0;
+ int status = 0;
+ pid_t childs[NR_GROUP];
+ pid_t pid;
+
+ pr_local_info("group: %d, process_per_group: %d", group_num, process_per_group);
+
+ pid = fork();
+ if (pid == 0) {
+ while(1) {
+ usleep(200);
+ sharepool_log("sharepool_log");
+ }
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_grandchild_sync%d", i);
+ grandchild_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (grandchild_sync[i] == SEM_FAILED) {
+ pr_local_info("grandchild sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_child_sync%d", i);
+ child_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (child_sync[i] == SEM_FAILED) {
+ pr_local_info("child sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed, error %d", pid);
+ exit(-1);
+ } else if (pid == 0) {
+ ret = child_process(i);
+ exit(ret);
+ } else {
+ childs[i] = pid;
+
+ pr_local_info("fork child%d, pid: %d", i, pid);
+ }
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ waitpid(childs[i], &status, 0);
+ status = (char)WEXITSTATUS(status);
+ if (status) {
+ pr_local_info("child%d test failed, %d", i, status);
+ ret = status;
+ }
+ }
+
+ kill(pid, SIGKILL);
+ waitpid(pid, &status, 0);
+
+ pr_local_info("exit!!");
+
+ return ret;
+#undef pr_local_info
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "持续申请->释放内存，同时循环打印维测")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/stress_test/test_mult_u2k.c b/tools/testing/sharepool/testcase/stress_test/test_mult_u2k.c
new file mode 100644
index 000000000000..04a5a3e5c6e0
--- /dev/null
+++ b/tools/testing/sharepool/testcase/stress_test/test_mult_u2k.c
@@ -0,0 +1,514 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Tue Nov 24 15:40:31 2020
+ */
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <pthread.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+#define MAX_ALLOC 100000
+#define MAX_SHARE 1000
+#define MAX_READ 100000
+
+static int alloc_num = 20;
+static int share_num = 20;
+static int read_num = 20;
+
+struct __thread_info {
+ struct sp_make_share_info *u2k_info;
+ struct karea_access_info *karea_info;
+};
+
+/*
+ * 用户态进程A加组后分配并写内存N，反复调用u2k（share_num次）共享到内核，内核模块通过每个kva反复读同一块内存（read_num次）N成功。
+ * 进程A停止共享N后，内核模块读N失败。进程A释放内存N。
+ */
+static void *grandchild1(void *arg)
+{
+ struct karea_access_info *karea_info = (struct karea_access_info*)arg;
+ int ret = 0;
+ for (int j = 0; j < read_num; j++) {
+ ret = ioctl_karea_access(dev_fd, karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ pthread_exit((void*)ret);
+ }
+ pr_info("thread read u2k area %dth time success", j);
+ }
+ pr_info("thread read u2k area %d times success", read_num);
+ pthread_exit((void*)ret);
+}
+
+static int child1(struct sp_alloc_info *alloc_info)
+{
+ int ret;
+ int group_id = alloc_info->spg_id;
+ pr_info("want to add group_id: %d", group_id);
+
+ // add group()
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return ret;
+ }
+ pr_info("now added into group_id: %d", alloc_info->spg_id);
+
+ // alloc()
+ ret = ioctl_alloc(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ pr_info("alloc %0lx memory success", alloc_info->size);
+
+ // write
+ memset((void *)alloc_info->addr, 'o', alloc_info->size);
+ pr_info("memset success");
+
+ // u2k
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info->addr,
+ .size = alloc_info->size,
+ .pid = getpid(),
+ };
+
+ struct karea_access_info *karea_info = (struct karea_access_info*)malloc(share_num * sizeof(struct karea_access_info));
+
+ for (int i = 0; i < share_num; i++) { // 同一段用户态内存可以向内核共享很多次
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ }
+ karea_info[i].mod = KAREA_CHECK;
+ karea_info[i].value = 'o';
+ karea_info[i].addr = u2k_info.addr;
+ karea_info[i].size = u2k_info.size;
+ }
+ pr_info("u2k share %d times success", share_num);
+
+ //内核反复读（太慢了！取消了。）
+ //for (int j = 0; j < read_num; j++) {
+ for (int i = 0; i < share_num; i++) {
+ ret = ioctl_karea_access(dev_fd, &karea_info[i]);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+ pr_info("kernel read %dth %0lx area success", i, alloc_info->size);
+ }
+ //}
+ //pr_info("kernel read %d times success", read_num);
+
+ //内核并发读 100个线程
+ pthread_t childs[MAX_SHARE] = {0};
+ int status = 0;
+ for (int i = 0; i < share_num; i++) {
+ ret = pthread_create(&childs[i], NULL, grandchild1, (void *)&karea_info[i]);
+ if (ret != 0) {
+ pr_info("pthread_create failed, errno: %d", errno);
+ exit(-1);
+ }
+ }
+ pr_info("create %d threads success", share_num);
+
+ void *child_ret;
+ for (int i = 0; i < share_num; i++) {
+ pthread_join(childs[i], &child_ret);
+ if ((int)child_ret != 0) {
+ pr_info("grandchild1 %d test failed, %d", i, (int)child_ret);
+ return (int)child_ret;
+ }
+ }
+ pr_info("exit %d threads success", share_num);
+
+ for (int i = 0; i < share_num; i++) {
+ u2k_info.addr = karea_info[i].addr;
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+ }
+ pr_info("unshare u2k area %d times success", share_num);
+
+ /*
+ * unshare之后再访问内存会导致内核挂掉，在手工测试的时候执行
+ */
+#if 0
+ pr_info("recheck karea");
+ ret = ioctl_karea_access(dev_fd, &karea_info[0]);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+#endif
+
+ ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ return ret;
+ }
+ free(karea_info);
+ return ret;
+}
+
+/*
+ * 用户态进程A加组后分配并写alloc_num个内存，调用u2k共享到内核，内核模块通过每个kva分别读多个内存成功（每个kva读read_num次）。
+ * 进程A停止共享后，内核模块读N失败。进程A释放内存N。
+ */
+static void* grandchild2(void *arg)
+{
+ int ret = 0;
+ struct __thread_info* thread2_info = (struct __thread_info*)arg;
+ ret = ioctl_u2k(dev_fd, thread2_info->u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ pthread_exit((void*)ret);
+ }
+ thread2_info->karea_info->mod = KAREA_CHECK;
+ thread2_info->karea_info->value = 'p';
+ thread2_info->karea_info->addr = thread2_info->u2k_info->addr;
+ thread2_info->karea_info->size = thread2_info->u2k_info->size;
+ pthread_exit((void*)ret);
+}
+
+static int child2(struct sp_alloc_info *alloc_info)
+{
+ int ret;
+ int group_id = alloc_info->spg_id;
+
+ // add group
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return ret;
+ }
+
+ // alloc N块内存
+ struct sp_alloc_info *all_alloc_info = (struct sp_alloc_info*)malloc(alloc_num * sizeof(struct sp_alloc_info));
+ for (int i = 0; i < alloc_num; i++) {
+ all_alloc_info[i].flag = alloc_info->flag;
+ all_alloc_info[i].spg_id = alloc_info->spg_id;
+ all_alloc_info[i].size = alloc_info->size;
+ ret = ioctl_alloc(dev_fd, &all_alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ memset((void *)all_alloc_info[i].addr, 'p', all_alloc_info[i].size);
+ }
+
+ struct sp_make_share_info *all_u2k_info = (struct sp_make_share_info*)malloc(alloc_num * sizeof(struct sp_make_share_info));
+
+ struct karea_access_info *karea_info = (struct karea_access_info*)malloc(alloc_num * sizeof(struct karea_access_info));
+
+ // 并发调用u2k
+ // 创建100个线程，分别对一块alloc内存调用u2k，并存储返回地址
+ pthread_t childs[MAX_ALLOC] = {0};
+ struct __thread_info thread2_info[MAX_ALLOC];
+ int status = 0;
+ for (int i = 0; i < alloc_num; i++) {
+ all_u2k_info[i].uva = all_alloc_info[i].addr;
+ all_u2k_info[i].size = all_alloc_info[i].size;
+ all_u2k_info[i].pid = getpid();
+ thread2_info[i].u2k_info = &all_u2k_info[i];
+ thread2_info[i].karea_info = &karea_info[i];
+ ret = pthread_create(&childs[i], NULL, grandchild2, (void *)&thread2_info[i]);
+ if (ret != 0) {
+ pr_info("pthread_create failed, errno: %d", errno);
+ exit(-1);
+ }
+ }
+
+ // 结束所有线程
+ void *child_ret;
+ for (int i = 0; i < alloc_num; i++) {
+ pthread_join(childs[i], &child_ret);
+ if ((int)child_ret != 0) {
+ pr_info("grandchild2 %d test failed, %d", i, (int)child_ret);
+ return (int)child_ret;
+ }
+ }
+
+ // 内核读内存
+ for (int j = 0; j < read_num; j++) {
+ for (int i = 0; i < alloc_num; i++) {
+ ret = ioctl_karea_access(dev_fd, &karea_info[i]);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+ }
+ }
+
+ // unshare所有内存
+ for (int i = 0; i < alloc_num; i++) {
+ ret = ioctl_unshare(dev_fd, &all_u2k_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+ }
+
+ /*
+ * unshare之后再访问内存会导致内核挂掉，在手工测试的时候执行
+ */
+#if 0
+ pr_info("recheck karea");
+ ret = ioctl_karea_access(dev_fd, &karea_info[0]);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+#endif
+
+ // free所有内存
+ for (int i = 0; i < alloc_num; i++) {
+ ret = ioctl_free(dev_fd, &all_alloc_info[i]);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ return ret;
+ }
+ }
+ free(all_alloc_info);
+ free(all_u2k_info);
+ free(karea_info);
+ return ret;
+}
+
+/*
+ * 用户态进程A加组后分配并写内存N，反复share_num次（调用u2k共享到内核， 内核模块读内存N成功，用户态调用unshare）。
+ * 进程A最后一次停止共享后，内核模块读N失败。进程A释放内存N。
+ */
+static int child3(struct sp_alloc_info *alloc_info)
+{
+ int ret;
+ int group_id = alloc_info->spg_id;
+
+ // add group
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return ret;
+ }
+
+ // alloc
+ ret = ioctl_alloc(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ memset((void *)alloc_info->addr, 'q', alloc_info->size);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info->addr,
+ .size = alloc_info->size,
+ .pid = getpid(),
+ };
+
+ // 反复调用u2k-内核读-unshare
+ for (int i = 0; i < share_num; i++) {
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ }
+ struct karea_access_info karea_info = {
+ .mod = KAREA_CHECK,
+ .value = 'q',
+ .addr = u2k_info.addr,
+ .size = u2k_info.size,
+ };
+
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+ }
+
+ /*
+ * unshare之后再访问内存会导致内核挂掉，在手工测试的时候执行
+ */
+#if 0
+ pr_info("recheck karea");
+ ret = ioctl_karea_access(dev_fd, &karea_info[0]);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+#endif
+
+ ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ return ret;
+ }
+ return ret;
+}
+
+static void print_help()
+{
+ printf("Usage:./test_multi_u2k -n alloc_num -s share_num -r read_num\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "n:s:r:")) != -1) {
+ switch (opt) {
+ case 'n': // 内存申请次数
+ alloc_num = atoi(optarg);
+ if (alloc_num > MAX_ALLOC || alloc_num <= 0) {
+ printf("alloc number invalid\n");
+ return -1;
+ }
+ break;
+ case 's': // u2k共享次数
+ share_num = atoi(optarg);
+ if (share_num > MAX_SHARE || share_num <= 0) {
+ printf("share number invalid\n");
+ return -1;
+ }
+ break;
+ case 'r': // 内核读内存次数
+ read_num = atoi(optarg);
+ if (read_num > MAX_READ || read_num <= 0) {
+ printf("read number invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+#define PROC_NUM 4
+static struct sp_alloc_info alloc_infos[] = {
+ {
+ .flag = 0,
+ .spg_id = 10,
+ .size = 100 * PAGE_SIZE, //400K
+ },
+ {
+ .flag = SP_HUGEPAGE,
+ .spg_id = 12,
+ .size = 10 * PMD_SIZE, // 20M
+ },
+ {
+ .flag = SP_DVPP,
+ .spg_id = 19,
+ .size = 100000, // 约100K
+ },
+ {
+ .flag = SP_DVPP | SP_HUGEPAGE,
+ .spg_id = 19,
+ .size = 10000000, // 约1M
+ },
+};
+
+int (*child_funcs[])(struct sp_alloc_info *) = {
+ child1,
+ child2,
+ child3,
+};
+
+static int testcase(int child_idx)
+{
+ int ret = 0;
+ pid_t procs[PROC_NUM];
+
+ for (int i = 0; i < sizeof(alloc_infos) / sizeof(alloc_infos[0]); i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork error");
+ ret = -1;
+ goto error_out;
+ } else if (pid == 0) {
+ exit(child_funcs[child_idx](alloc_infos + i));
+ } else {
+ procs[i] = pid;
+ }
+ }
+
+ for (int i = 0; i < sizeof(alloc_infos) / sizeof(alloc_infos[0]); i++) {
+ int status = 0;
+ waitpid(procs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("testcase failed!!, func: %d, alloc info: %d", child_idx, i);
+ ret = -1;
+ } else {
+ pr_info("testcase success!!, func: %d, alloc info: %d", child_idx, i);
+ }
+ }
+
+ return 0;
+error_out:
+ return -1;
+}
+
+static int testcase1(void) { return testcase(0); }
+static int testcase2(void) { return testcase(1); }
+static int testcase3(void) { return testcase(2); }
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "用户态反复调用u2k共享到内核，内核模块通过每个kva反复读同一块内存")
+ TESTCASE_CHILD(testcase2, "创建100个线程，分别对一块alloc内存调用u2k，并存储返回地址；内核读内存")
+ TESTCASE_CHILD(testcase3, "用户态u2k-内核读-unshare，重复循环")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/stress_test/test_sharepool_enhancement_stress_cases.c b/tools/testing/sharepool/testcase/stress_test/test_sharepool_enhancement_stress_cases.c
new file mode 100644
index 000000000000..6e34d2fc8044
--- /dev/null
+++ b/tools/testing/sharepool/testcase/stress_test/test_sharepool_enhancement_stress_cases.c
@@ -0,0 +1,692 @@
+#include "sharepool_lib.h"
+#include "sem_use.h"
+#include <stdlib.h>
+#include <errno.h>
+#include <assert.h>
+#include <pthread.h>
+#include <sys/types.h>
+
+#define PROC_NUM 8
+#define THREAD_NUM 5
+#define GROUP_NUM 16
+#define ALLOC_TYPE 4
+#define REPEAT_TIMES 2
+#define ALLOC_SIZE PAGE_SIZE
+#define PROT (PROT_READ | PROT_WRITE)
+
+static int group_ids[GROUP_NUM];
+static int default_id = 1;
+static int semid;
+
+static int add_multi_group();
+static int check_multi_group();
+static int delete_multi_group();
+static int process();
+void *thread_and_process_helper(int group_id);
+void *del_group_thread(void *arg);
+void *del_proc_from_group(void *arg);
+
+
+// 共享组进程压力测试，大量进程加组退组
+static int testcase1(void)
+{
+ int group_num = 10;
+ int temp_group_id = 1;
+ int proc_num = 10;
+ int prints_num = 3;
+
+ int ret = 0;
+
+ int childs[proc_num];
+ int prints[prints_num];
+
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, temp_group_id);
+ if (ret < 0) {
+ pr_info("parent %d add into group failed. errno: %d", getpid(), ret);
+ return -1;
+ }
+
+ // 构造进程加组退组
+ for (int i = 0; i < proc_num; i++) {
+ int pid = fork();
+ if (pid == 0) {
+ while (1) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, temp_group_id);
+ if (ret < 0)
+ pr_info("child %d add into group failed. errno: %d", getpid(), ret);
+ ret = wrap_del_from_group(getpid(), temp_group_id);
+ if (ret < 0)
+ pr_info("child %d del from group failed. errno: %d", getpid(), ret);
+ }
+ } else {
+ childs[i] = pid;
+ }
+ }
+
+ // 持续打印维测接口
+ for(int i = 0; i < prints_num; i++){
+ int pid = fork();
+ if (pid == 0) {
+ while (1) {
+ sharepool_print();
+ usleep(10000);
+ }
+ } else {
+ prints[i] = pid;
+ }
+ }
+
+ sleep(10);
+
+ // 测试结束清理进程
+ for (int i = 0; i < PROC_NUM; i++) {
+ kill(childs[i], SIGKILL);
+ int status;
+ waitpid(childs[i], &status, 0);
+ }
+ for (int i = 0; i < prints_num; i++) {
+ kill(prints[i], SIGKILL);
+ int status;
+ waitpid(prints[i], &status, 0);
+ }
+
+ return 0;
+}
+
+// 共享组上限压力测试
+static int testcase2(void)
+{
+ int ret = 0;
+
+ int default_id = 1;
+ int group_id = 2;
+
+ int prints_num = 3;
+ int prints[prints_num];
+
+ // 持续打印维测接口
+ for(int i = 0; i < prints_num; i++){
+ int pid = fork();
+ if (pid == 0) {
+ while (1) {
+ sharepool_print();
+ usleep(10000);
+ }
+ } else {
+ prints[i] = pid;
+ }
+ }
+
+ // 创建默认共享组
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("parent %d add into group failed. errno: %d", getpid(), ret);
+ return -1;
+ }
+
+ // 持续创建共享组
+ int group_create_pid = fork();
+ if (group_create_pid == 0){
+ while(group_id > 0){
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, group_id);
+ if (ret < 0)
+ pr_info("group %d creation failed. errno: %d", group_id, ret);
+ group_id++;
+ }
+ }
+
+ // 持续创建进程加入默认共享组
+ int process_create_pid = fork();
+ if (process_create_pid == 0){
+ while (1){
+ int temp_pid = fork();
+ if (temp_pid == 0){
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("child %d add into group failed. errno: %d", getpid(), ret);
+ }
+ for (int i=0; i<3; i++){
+ sleep(1);
+ }
+ }
+ }
+ }
+
+ sleep(10);
+
+ int status;
+ kill(group_create_pid, SIGKILL);
+ waitpid(group_create_pid, &status, 0);
+ kill(process_create_pid, SIGKILL);
+ waitpid(process_create_pid, &status, 0);
+
+ for (int i = 0; i < prints_num; i++) {
+ kill(prints[i], SIGKILL);
+ waitpid(prints[i], &status, 0);
+ }
+
+ return 0;
+}
+
+// 共享组内存申请释放压力测试
+static int testcase3(void)
+{
+ int default_id = 1;
+ int ret = 0;
+ int proc_num = 1000;
+ int childs[proc_num];
+
+ int page_size = 4096;
+
+ int prints_num = 3;
+ int prints[prints_num];
+
+ // 持续打印维测接口
+ for(int i = 0; i < prints_num; i++){
+ int pid = fork();
+ if (pid == 0) {
+ while (1) {
+ sharepool_print();
+ usleep(10000);
+ }
+ } else {
+ prints[i] = pid;
+ }
+ }
+
+ // 创建子进程申请和释放4K内存
+ for(int i=0; i<proc_num; i++){
+ int pid = fork();
+ if (pid == 0){
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+ while(1){
+ void *addr;
+ addr = wrap_sp_alloc(default_id, page_size, 0);
+ if (addr == (void *)-1) {
+ pr_info("process %d alloc failed.", getpid());
+ } else {
+ pr_info("process %d alloc success.", getpid());
+ }
+ ret = wrap_sp_free(addr);
+ if (ret < 0) {
+ pr_info("process %d free failed.", getpid());
+ } else {
+ pr_info("process %d free success.", getpid());
+ }
+ }
+ }
+ else{
+ childs[i] = pid;
+ }
+ }
+
+ sleep(10);
+
+ int status;
+
+ for (int i = 0; i < proc_num; i++) {
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], &status, 0);
+ }
+ for (int i = 0; i < prints_num; i++) {
+ kill(prints[i], SIGKILL);
+ waitpid(prints[i], &status, 0);
+ }
+
+}
+
+// 共享组内存大规格申请释放压力测试
+static int testcase4(void)
+{
+ int default_id = 1;
+ int ret = 0;
+ int proc_num = 50;
+ int childs[proc_num];
+
+ int page_size = 1073741824;
+
+ int prints_num = 3;
+ int prints[prints_num];
+
+ // print sharepool maintenance interface
+ for(int i = 0; i < prints_num; i++){
+ int pid = fork();
+ if (pid == 0) {
+ while (1) {
+ sharepool_print();
+ usleep(10000);
+ }
+ } else {
+ prints[i] = pid;
+ }
+ }
+
+ // apply and release memory
+ for(int i=0; i<proc_num; i++){
+ int pid = fork();
+ if (pid == 0){
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, default_id);
+ if (ret < 0) {
+ pr_info("process %d add group %d failed.", getpid(), default_id);
+ } else {
+ pr_info("process %d add group %d success.", getpid(), default_id);
+ }
+ while(1){
+ void *addr;
+ addr = wrap_sp_alloc(default_id, page_size, 0);
+ if (addr == (void *)-1) {
+ pr_info("process %d alloc failed.", getpid());
+ } else {
+ pr_info("process %d alloc success.", getpid());
+ }
+ ret = wrap_sp_free(addr);
+ if (ret < 0) {
+ pr_info("process %d free failed.", getpid());
+ } else {
+ pr_info("process %d free success.", getpid());
+ }
+ }
+ }
+ else{
+ childs[i] = pid;
+ }
+ }
+
+ sleep(10);
+
+ int status;
+
+ for (int i = 0; i < proc_num; i++) {
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], &status, 0);
+ }
+ for (int i = 0; i < prints_num; i++) {
+ kill(prints[i], SIGKILL);
+ waitpid(prints[i], &status, 0);
+ }
+
+}
+
+
+// 维测接口打印压力测试
+static int testcase5(void)
+{
+ int ret = 0;
+
+ int default_id = 1;
+ int group_id = 2;
+
+ int prints_num = 3;
+ int prints[prints_num];
+
+ // 持续打印维测接口
+ for(int i = 0; i < prints_num; i++){
+ int pid = fork();
+ if (pid == 0) {
+ while (1) {
+ sharepool_print();
+ usleep(10000);
+ }
+ } else {
+ prints[i] = pid;
+ }
+ }
+
+ sleep(10);
+
+ int status;
+
+ for (int i = 0; i < prints_num; i++) {
+ kill(prints[i], SIGKILL);
+ waitpid(prints[i], &status, 0);
+ }
+
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ //TESTCASE_CHILD(testcase1, "共享组进程压力测试，大量进程加组退组")
+ //TESTCASE_CHILD(testcase2, "共享组上限压力测试")
+ //TESTCASE_CHILD(testcase3, "共享组内存申请释放压力测试")
+ //TESTCASE_CHILD(testcase4, "共享组内存大规格申请释放压力测试")
+ //TESTCASE_CHILD(testcase5, "维测接口打印压力测试")
+};
+
+static int add_multi_group()
+{
+ int ret;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ };
+ for (int i = 0; i < GROUP_NUM; i++) {
+ group_ids[i] = i + 1;
+ ag_info.spg_id = group_ids[i];
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("proc%d add group%d failed", getpid(), group_ids[i]);
+ return -1;
+ }
+ }
+
+ return ret;
+}
+
+static int check_multi_group()
+{
+ int ret;
+ // query groups
+ int spg_ids[GROUP_NUM];
+ int group_num = GROUP_NUM;
+ struct sp_group_id_by_pid_info find_group_info = {
+ .num = &group_num,
+ .spg_ids = spg_ids,
+ .pid = getpid(),
+ };
+ ret = ioctl_find_group_by_pid(dev_fd, &find_group_info);
+ if (ret < 0) {
+ pr_info("find group id by pid failed");
+ return ret;
+ } else
+ for (int i = 0; i < GROUP_NUM; i++)
+ if (spg_ids[i] != group_ids[i]) {
+ pr_info("group id %d not consistent", i);
+ ret = -1;
+ }
+ return ret;
+}
+
+static int delete_multi_group()
+{
+ int ret = 0;
+ int fail = 0, suc = 0;
+ // delete from all groups
+ for (int i = 0; i < GROUP_NUM; i++) {
+ ret = wrap_del_from_group(getpid(), group_ids[i]);
+ if (ret < 0) {
+ //pr_info("process %d delete from group %d failed, errno: %d", getpid(), group_ids[i], errno);
+ fail++;
+ }
+ else {
+ pr_info("process %d delete from group %d success", getpid(), group_ids[i]);
+ suc++;
+ }
+ }
+
+ return fail;
+}
+
+static int process()
+{
+ int ret = 0;
+ for (int j = 0; j < REPEAT_TIMES; j++) {
+ for (int i = 0; i < GROUP_NUM; i++) {
+ ret = thread_and_process_helper(group_ids[i]);
+ if (ret < 0) {
+ pr_info("thread_and_process_helper failed");
+ return -1;
+ }
+ }
+ }
+
+ return ret;
+}
+
+static int try_del_from_group(int group_id)
+{
+ int ret = wrap_del_from_group(getpid(), group_id);
+ return -errno;
+}
+
+void *thread_and_process_helper(int group_id)
+{
+ int ret = 0, i;
+ pid_t pid;
+ bool judge_ret = true;
+ struct sp_alloc_info alloc_info[ALLOC_TYPE] = {0};
+ struct sp_make_share_info u2k_info[ALLOC_TYPE] = {0}, k2u_info = {0}, k2u_huge_info = {0};
+ struct vmalloc_info vmalloc_info = {0}, vmalloc_huge_info = {0};
+ char *addr;
+
+ /* check sp group */
+ pid = getpid();
+
+ // 大页
+ alloc_info[0].flag = SP_HUGEPAGE;
+ alloc_info[0].spg_id = group_id;
+ alloc_info[0].size = 2 * PMD_SIZE;
+
+ // 大页 DVPP
+ alloc_info[1].flag = SP_DVPP | SP_HUGEPAGE;
+ alloc_info[1].spg_id = group_id;
+ alloc_info[1].size = 2 * PMD_SIZE;
+
+ // 普通页 DVPP
+ alloc_info[2].flag = SP_DVPP;
+ alloc_info[2].spg_id = group_id;
+ alloc_info[2].size = 4 * PAGE_SIZE;
+
+ // 普通页
+ alloc_info[3].flag = 0;
+ alloc_info[3].spg_id = group_id;
+ alloc_info[3].size = 4 * PAGE_SIZE;
+
+ /* alloc & u2k */
+ for (i = 0; i < ALLOC_TYPE; i++) {
+ /* sp_alloc */
+ ret = ioctl_alloc(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed at %dth alloc.\n", i);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(alloc_info[i].addr)) {
+ pr_info("sp_alloc return err is %ld\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("sp_alloc return addr %lx\n", alloc_info[i].addr);
+ }
+ }
+
+ /* check sp_alloc addr */
+ judge_ret = ioctl_judge_addr(dev_fd, alloc_info[i].addr);
+ if (judge_ret != true) {
+ pr_info("expect a valid share pool addr %lx\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("addr %lx is a valid share pool addr\n", alloc_info[i].addr);
+ }
+
+ /* prepare for u2k */
+ addr = (char *)alloc_info[i].addr;
+ if (alloc_info[i].flag & SP_HUGEPAGE) {
+ addr[0] = 'd';
+ addr[PMD_SIZE - 1] = 'c';
+ addr[PMD_SIZE] = 'b';
+ addr[PMD_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_hugepage_checker = true;
+ } else {
+ addr[0] = 'd';
+ addr[PAGE_SIZE - 1] = 'c';
+ addr[PAGE_SIZE] = 'b';
+ addr[PAGE_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_checker = true;
+ }
+
+ u2k_info[i].uva = alloc_info[i].addr;
+ u2k_info[i].size = alloc_info[i].size;
+ u2k_info[i].pid = pid;
+
+ /* u2k */
+ ret = ioctl_u2k(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl u2k failed\n");
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(u2k_info[i].addr)) {
+ pr_info("u2k return err is %ld.\n", u2k_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("u2k return addr %lx, check memory content succ.\n",
+ // u2k_info[i].addr);
+ }
+ }
+ }
+ assert(try_del_from_group(group_id) == -EINVAL);
+
+ /* prepare for vmalloc */
+ vmalloc_info.size = 3 * PAGE_SIZE;
+ vmalloc_huge_info.size = 3 * PMD_SIZE;
+
+ /* vmalloc */
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vmalloc_hugepage(dev_fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vmalloc huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* prepare for k2u */
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+ k2u_info.sp_flags = 0;
+ k2u_info.pid = pid;
+ k2u_info.spg_id = group_id;
+
+ k2u_huge_info.kva = vmalloc_huge_info.addr;
+ k2u_huge_info.size = vmalloc_huge_info.size;
+ k2u_huge_info.sp_flags = SP_DVPP;
+ k2u_huge_info.pid = pid;
+ k2u_huge_info.spg_id = group_id;
+
+ /* k2u */
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_info.addr)) {
+ pr_info("k2u return err is %ld.\n",
+ k2u_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u return addr %lx\n", k2u_info.addr);
+ }
+ }
+
+ ret = ioctl_k2u(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u hugepage error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_huge_info.addr)) {
+ pr_info("k2u hugepage return err is %ld.\n",
+ k2u_huge_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u hugepage return addr %lx\n", k2u_huge_info.addr);
+ }
+ }
+ assert(try_del_from_group(group_id) == -EINVAL);
+
+ /* check k2u memory content */
+ addr = (char *)k2u_info.addr;
+ if (addr[0] != 'a' || addr[PAGE_SIZE - 1] != 'b' ||
+ addr[PAGE_SIZE] != 'c' || addr[2 * PAGE_SIZE - 1] != 'd') {
+ pr_info("check vmalloc memory failed\n");
+ goto error;
+ } else {
+ //pr_info("check vmalloc memory succeess\n");
+ }
+
+ addr = (char *)k2u_huge_info.addr;
+ if (addr[0] != 'a' || addr[PMD_SIZE - 1] != 'b' ||
+ addr[PMD_SIZE] != 'c' || addr[2 * PMD_SIZE - 1] != 'd') {
+ pr_info("check vmalloc_hugepage memory failed: %c %c %c %c\n",
+ addr[0], addr[PMD_SIZE - 1], addr[PMD_SIZE], addr[2 * PMD_SIZE - 1]);
+ goto error;
+ } else {
+ //pr_info("check vmalloc_hugepage memory succeess\n");
+ }
+
+ /* unshare uva */
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("sp unshare uva error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_unshare(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("sp unshare hugepage uva error: %d\n", ret);
+ goto error;
+ }
+
+ /* kvfree */
+ ioctl_vfree(dev_fd, &vmalloc_info);
+ ioctl_vfree(dev_fd, &vmalloc_huge_info);
+ assert(try_del_from_group(group_id) == -EINVAL);
+
+ /* unshare kva & sp_free*/
+ for (i = 0; i < ALLOC_TYPE; i++) {
+ /* unshare kva */
+ ret = ioctl_unshare(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("sp_unshare kva return error: %d\n", ret);
+ goto error;
+ }
+
+ /* sp_free */
+ ret = ioctl_free(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("sp_free return error: %d\n", ret);
+ goto error;
+ }
+ }
+
+ return 0;
+
+error:
+ return -1;
+}
+
+void *del_group_thread(void *arg)
+{
+ int ret = 0;
+ int i = (int)arg;
+
+ sem_inc_by_one(semid);
+ sem_check_zero(semid);
+
+ pr_info("thread %d now tries to exit from group %d", getpid() + i + 1, default_id);
+ ret = wrap_del_from_group(getpid() + i + 1, default_id);
+ if (ret < 0)
+ pthread_exit((void *)-1);
+ pthread_exit((void *)0);
+}
+
+void *del_proc_from_group(void *arg)
+{
+ sem_dec_by_one(semid);
+ pthread_exit((void *)(wrap_del_from_group((int)arg, default_id)));
+}
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
+
diff --git a/tools/testing/sharepool/testcase/stress_test/test_u2k_add_and_kill.c b/tools/testing/sharepool/testcase/stress_test/test_u2k_add_and_kill.c
new file mode 100644
index 000000000000..198c93afde76
--- /dev/null
+++ b/tools/testing/sharepool/testcase/stress_test/test_u2k_add_and_kill.c
@@ -0,0 +1,358 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Nov 27 13:45:03 2020
+ */
+
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * group_num个组，每组process_pre_group个进程，所有grandchild进程死循环执行：（sp_alloc -> u2k -> 内核读内存 -> unshare -> sp_free）
+ * child进程拉起所有grandchild后，反复kill_num次：kill或者创建grandchild进程，保证总数不超过process_pre_group
+ */
+
+#define MAX_GROUP 3000
+#define MAX_PROC_PER_GRP 1024
+#define MAX_KILL 100000
+
+static sem_t *child_sync[MAX_GROUP];
+static sem_t *grandchild_sync[MAX_GROUP];
+
+static int group_num = 100;
+static int process_per_group = 100;
+static int kill_num = 100;
+static size_t alloc_size = 4 * PAGE_SIZE;
+
+static int grandchild_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[grandchild%d, pid:%d] " fmt "\n", arg, getpid(), ##args)
+ int ret;
+
+ /* 等待父进程加组 */
+ do {
+ ret = sem_wait(child_sync[arg / MAX_PROC_PER_GRP]);
+ } while ((ret != 0) && errno == EINTR);
+
+ //pr_local_info("start!!");
+
+ int group_id = ioctl_find_first_group(dev_fd, getpid());
+ sem_post(grandchild_sync[arg / MAX_PROC_PER_GRP]);
+ if (group_id < 0) {
+ pr_local_info("ioctl_find_group_by_pid failed, %d", group_id);
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .spg_id = group_id,
+ .size = alloc_size,
+ };
+
+ while (1) {
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_local_info("ioctl alloc failed\n");
+ return ret;
+ } else {
+ if (IS_ERR_VALUE(alloc_info.addr)) {
+ pr_local_info("sp_alloc return err is %ld\n", alloc_info.addr);
+ return -1;
+ }
+ }
+ memset((void *)alloc_info.addr, 'r', alloc_info.size);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_local_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ }
+ struct karea_access_info karea_info = {
+ .mod = KAREA_CHECK,
+ .value = 'r',
+ .addr = u2k_info.addr,
+ .size = u2k_info.size,
+ };
+
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_local_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_local_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_local_info("free area failed, errno: %d", errno);
+ return ret;
+ }
+ }
+
+ //pr_local_info("exit!!");
+ return 0;
+#undef pr_local_info
+}
+
+static int child_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[child%d , pid:%d] " fmt "\n", arg, getpid(), ##args)
+ //pr_local_info("start!!");
+
+ int ret, status = 0;
+ int group_id = arg + 100;
+ pid_t childs[MAX_PROC_PER_GRP] = {0};
+
+ // add group
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0)
+ return -1;
+
+ // 轮流创建该组的所有子进程
+ for (int i = 0; i < process_per_group; i++) {
+ int num = arg * MAX_PROC_PER_GRP + i;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(num);
+ exit(ret);
+ } else {
+ pr_local_info("fork grandchild%d, pid: %d", num, pid);
+ childs[i] = pid;
+
+ // 将子进程加组
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", num, group_id);
+ goto out;
+ } else
+ //pr_local_info("add grandchild%d to group %d successfully", num, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[arg]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandchild_sync[arg]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+
+ unsigned int seed = time(NULL);
+ srand(seed);
+ pr_local_info("rand seed: %u\n", seed);
+
+ /* 随机杀死或者创建进程 */
+ for (int i = 0; i < kill_num; i++) {
+ printf("kill/create %dth time.\n", i);
+ int idx = rand() % process_per_group;
+
+ if (childs[idx] > 0) {
+ // 杀死这个位置上的进程
+ kill(childs[idx], SIGKILL);
+ waitpid(childs[idx], NULL, 0);
+ printf("We killed %dth process %d!\n", idx, childs[idx]);
+ childs[idx] = 0;
+ } else {
+ printf("We are going to create a new process.\n");
+ // 该进程已经被杀死了，创建一个新进程填补该位置
+ int num = arg * MAX_PROC_PER_GRP + idx;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(num);
+ exit(ret);
+ } else {
+ pr_local_info("fork grandchild%d, pid: %d", num, pid);
+ childs[idx] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", num, group_id);
+ goto out;
+ } else
+ pr_local_info("add grandchild%d to group %d successfully", num, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[arg]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandchild_sync[arg]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+ }
+
+out:
+ for (int i = 0; i < process_per_group; i++) {
+ if (!childs[i])
+ continue;
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], &status, 0);
+ if (!WIFSIGNALED(status)) {
+ pr_local_info("grandchild%d test failed", arg * MAX_PROC_PER_GRP + i);
+ ret = -1;
+ }
+ }
+
+ //pr_local_info("exit!!");
+ return ret;
+#undef pr_local_info
+}
+
+static void print_help()
+{
+ printf("Usage:./test_multi_u2k2 -g group_num -p proc_num -n kill_num -s alloc_size\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "p:g:n:s:")) != -1) {
+ switch (opt) {
+ case 'p': // 每组进程数
+ process_per_group = atoi(optarg);
+ if (process_per_group > MAX_PROC_PER_GRP || process_per_group <= 0) {
+ printf("process number invalid\n");
+ return -1;
+ }
+ break;
+ case 'g': // group 数量
+ group_num = atoi(optarg);
+ if (group_num > MAX_GROUP || group_num <= 0) {
+ printf("group number invalid\n");
+ return -1;
+ }
+ break;
+ case 'n': // 杀死或者创建子进程次数
+ kill_num = atoi(optarg);
+ if (kill_num > MAX_KILL || kill_num <= 0) {
+ printf("kill number invalid\n");
+ return -1;
+ }
+ break;
+ case 's':
+ alloc_size = atol(optarg);
+ if (alloc_size <= 0) {
+ printf("alloc size invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ printf("unsupported options: '%c'\n", opt);
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+
+ int ret = 0;
+ int status = 0;
+ pid_t childs[MAX_GROUP];
+
+ // 创建组同步锁 grandchild
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_grandchild_sync%d", i);
+ grandchild_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (grandchild_sync[i] == SEM_FAILED) {
+ pr_info("grandchild sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ // 创建组同步锁 child
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_child_sync%d", i);
+ child_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (child_sync[i] == SEM_FAILED) {
+ pr_info("child sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ // 创建组对应的子进程
+ for (int i = 0; i < group_num; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed, error %d", pid);
+ exit(-1);
+ } else if (pid == 0) {
+ ret = child_process(i);
+ exit(ret);
+ } else {
+ childs[i] = pid;
+ pr_info("fork child%d, pid: %d", i, pid);
+ }
+ }
+
+ // 结束组对应的子进程
+ for (int i = 0; i < group_num; i++) {
+ waitpid(childs[i], &status, 0);
+ status = (char)WEXITSTATUS(status);
+ if (status) {
+ pr_info("child%d test failed, %d", i, status);
+ ret = status;
+ }
+ }
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "循环sp_alloc -> u2k -> 内核读内存 -> unshare -> sp_free 同时杀掉进程/创建新进程加组")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/test_all/Makefile b/tools/testing/sharepool/testcase/test_all/Makefile
new file mode 100644
index 000000000000..05243de93e4a
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_all/Makefile
@@ -0,0 +1,8 @@
+test_all: test_all.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+install: test_all
+ cp $^ $(TOOL_BIN_DIR)
+
+clean:
+ rm -rf test_all
diff --git a/tools/testing/sharepool/testcase/test_all/test_all.c b/tools/testing/sharepool/testcase/test_all/test_all.c
new file mode 100644
index 000000000000..3e0698f9b1f6
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_all/test_all.c
@@ -0,0 +1,285 @@
+/*
+ * compile: gcc test_all.c sharepool_lib.so -o test_all -lpthread
+ */
+
+#include <sys/types.h>
+#include <unistd.h>
+#include <pthread.h>
+#include <stdio.h>
+
+#include "sharepool_lib.h"
+
+#define GROUP_ID 1
+#define TIMES 4
+int fd;
+void *thread(void *arg)
+{
+ int ret, group_id, i;
+ pid_t pid;
+ unsigned long invalid_addr = 0x30000;
+ bool judge_ret = true;
+ struct sp_alloc_info alloc_info[TIMES] = {0};
+ struct sp_make_share_info u2k_info[TIMES] = {0}, k2u_info = {0}, k2u_huge_info = {0};
+ struct vmalloc_info vmalloc_info = {0}, vmalloc_huge_info = {0};
+ char *addr;
+
+ printf("enter thread, pid is %d, thread id is %lu\n\n", getpid(), pthread_self());
+
+ /* check sp group */
+ pid = getpid();
+ group_id = ioctl_find_first_group(fd, pid);
+ if (group_id != GROUP_ID) {
+ printf("query group id is %d, but expected group id is %d\n",
+ group_id, GROUP_ID);
+ goto error;
+ }
+
+ /* check invalid share pool addr */
+ judge_ret = ioctl_judge_addr(fd, invalid_addr);
+ if (judge_ret != false) {
+ printf("expect an invalid share pool addr\n");
+ goto error;
+ }
+
+ alloc_info[0].flag = SP_HUGEPAGE;
+ alloc_info[0].spg_id = GROUP_ID;
+ alloc_info[0].size = 2 * PMD_SIZE;
+
+ alloc_info[1].flag = SP_DVPP | SP_HUGEPAGE;
+ alloc_info[1].spg_id = GROUP_ID;
+ alloc_info[1].size = 2 * PMD_SIZE;
+
+ alloc_info[2].flag = SP_DVPP;
+ alloc_info[2].spg_id = GROUP_ID;
+ alloc_info[2].size = 4 * PAGE_SIZE;
+
+ alloc_info[3].flag = 0;
+ alloc_info[3].spg_id = GROUP_ID;
+ alloc_info[3].size = 4 * PAGE_SIZE;
+
+ for (i = 0; i < TIMES; i++) {
+ /* sp_alloc */
+ ret = ioctl_alloc(fd, &alloc_info[i]);
+ if (ret < 0) {
+ printf("ioctl alloc failed\n");
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(alloc_info[i].addr)) {
+ printf("sp_alloc return err is %ld\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ printf("sp_alloc return addr %lx\n", alloc_info[i].addr);
+ }
+ }
+
+ /* check sp_alloc addr */
+ judge_ret = ioctl_judge_addr(fd, alloc_info[i].addr);
+ if (judge_ret != true) {
+ printf("expect a valid share pool addr %lx\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ printf("addr %lx is a valid share pool addr\n", alloc_info[i].addr);
+ }
+
+ /* prepare for u2k */
+ addr = (char *)alloc_info[i].addr;
+ if (alloc_info[i].flag & SP_HUGEPAGE) {
+ addr[0] = 'd';
+ addr[PMD_SIZE - 1] = 'c';
+ addr[PMD_SIZE] = 'b';
+ addr[PMD_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_hugepage_checker = true;
+ } else {
+ addr[0] = 'd';
+ addr[PAGE_SIZE - 1] = 'c';
+ addr[PAGE_SIZE] = 'b';
+ addr[PAGE_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_checker = true;
+ }
+
+ u2k_info[i].uva = alloc_info[i].addr;
+ u2k_info[i].size = alloc_info[i].size;
+ u2k_info[i].pid = pid;
+
+ /* u2k */
+ ret = ioctl_u2k(fd, &u2k_info[i]);
+ if (ret < 0) {
+ printf("ioctl u2k failed\n");
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(u2k_info[i].addr)) {
+ printf("u2k return err is %ld.\n", u2k_info[i].addr);
+ goto error;
+ } else {
+ printf("u2k return addr %lx, check memory content succ.\n",
+ u2k_info[i].addr);
+ }
+ }
+ printf("\n");
+ }
+
+ /* prepare for vmalloc */
+ vmalloc_info.size = 3 * PAGE_SIZE;
+ vmalloc_huge_info.size = 3 * PMD_SIZE;
+
+ /* vmalloc */
+ ret = ioctl_vmalloc(fd, &vmalloc_info);
+ if (ret < 0) {
+ printf("vmalloc small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vmalloc_hugepage(fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ printf("vmalloc huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* prepare for k2u */
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+ k2u_info.sp_flags = 0;
+ k2u_info.pid = pid;
+ k2u_info.spg_id = SPG_ID_DEFAULT;
+
+ k2u_huge_info.kva = vmalloc_huge_info.addr;
+ k2u_huge_info.size = vmalloc_huge_info.size;
+ k2u_huge_info.sp_flags = SP_DVPP;
+ k2u_huge_info.pid = pid;
+ k2u_huge_info.spg_id = SPG_ID_DEFAULT;
+
+ /* k2u */
+ ret = ioctl_k2u(fd, &k2u_info);
+ if (ret < 0) {
+ printf("ioctl k2u error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_info.addr)) {
+ printf("k2u return err is %ld.\n",
+ k2u_info.addr);
+ goto error;
+ } else {
+ printf("k2u return addr %lx\n", k2u_info.addr);
+ }
+ }
+
+ ret = ioctl_k2u(fd, &k2u_huge_info);
+ if (ret < 0) {
+ printf("ioctl k2u hugepage error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_huge_info.addr)) {
+ printf("k2u hugepage return err is %ld.\n",
+ k2u_huge_info.addr);
+ goto error;
+ } else {
+ printf("k2u hugepage return addr %lx\n", k2u_huge_info.addr);
+ }
+ }
+
+ /* check k2u memory content */
+ addr = (char *)k2u_info.addr;
+ if (addr[0] != 'a' || addr[PAGE_SIZE - 1] != 'b' ||
+ addr[PAGE_SIZE] != 'c' || addr[2 * PAGE_SIZE - 1] != 'd') {
+ printf("check vmalloc memory failed\n");
+ goto error;
+ } else {
+ printf("check vmalloc memory succeess\n");
+ }
+
+ addr = (char *)k2u_huge_info.addr;
+ if (addr[0] != 'a' || addr[PMD_SIZE - 1] != 'b' ||
+ addr[PMD_SIZE] != 'c' || addr[2 * PMD_SIZE - 1] != 'd') {
+ printf("check vmalloc_hugepage memory failed: %c %c %c %c\n",
+ addr[0], addr[PMD_SIZE - 1], addr[PMD_SIZE], addr[2 * PMD_SIZE - 1]);
+ goto error;
+ } else {
+ printf("check vmalloc_hugepage memory succeess\n");
+ }
+
+ /* unshare uva */
+ ret = ioctl_unshare(fd, &k2u_info);
+ if (ret < 0) {
+ printf("sp unshare uva error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_unshare(fd, &k2u_huge_info);
+ if (ret < 0) {
+ printf("sp unshare hugepage uva error: %d\n", ret);
+ goto error;
+ }
+
+ /* kvfree */
+ ret = ioctl_vfree(fd, &vmalloc_info);
+ if (ret < 0) {
+ printf("vfree small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vfree(fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ printf("vfree huge page error: %d\n", ret);
+ goto error;
+ }
+
+ for (i = 0; i < TIMES; i++) {
+ /* unshare kva */
+ ret = ioctl_unshare(fd, &u2k_info[i]);
+ if (ret < 0) {
+ printf("sp_unshare kva return error: %d\n", ret);
+ goto error;
+ }
+
+ /* sp_free */
+ ret = ioctl_free(fd, &alloc_info[i]);
+ if (ret < 0) {
+ printf("sp_free return error: %d\n", ret);
+ goto error;
+ }
+ }
+
+ printf("\nfinish running thread\n");
+ pthread_exit((void *)0);
+
+error:
+ pthread_exit((void *)1);
+}
+
+int main(void) {
+ int ret = 0;
+ struct sp_add_group_info ag_info = {0};
+ pthread_t tid;
+ void *tret;
+
+ fd = open_device();
+ if (fd < 0) {
+ return -1;
+ }
+
+ pid_t pid = getpid();
+ ag_info.pid = pid;
+ ag_info.prot = PROT_READ | PROT_WRITE;
+ ag_info.spg_id = GROUP_ID;
+ ret = ioctl_add_group(fd, &ag_info);
+ if (ret < 0) {
+ close_device(fd);
+ return -1;
+ }
+ printf("ioctl add group pid is %d, spg_id is %d\n", pid, ag_info.spg_id);
+
+ ret = pthread_create(&tid, NULL, thread, NULL);
+ if (ret != 0)
+ printf("%s: create thread error\n", __func__);
+
+ ret = pthread_join(tid, &tret);
+ if (ret != 0)
+ printf("%s: can't join thread\n", __func__);
+
+ close_device(fd);
+
+ if ((long)tret != 0) {
+ printf("testcase execution failed\n");
+ return -1;
+ }
+ printf("testcase execution is successful\n");
+ return 0;
+}
+
diff --git a/tools/testing/sharepool/testcase/test_mult_process/Makefile b/tools/testing/sharepool/testcase/test_mult_process/Makefile
new file mode 100644
index 000000000000..9a20b0d1fa32
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/Makefile
@@ -0,0 +1,16 @@
+MODULEDIR:=mult_add_group_test mult_k2u_test mult_u2k_test mult_debug_test stress_test
+
+all:tooldir
+
+tooldir:
+ for n in $(MODULEDIR); do $(MAKE) -C $$n; done
+install:
+ mkdir -p $(TOOL_BIN_DIR)/test_mult_process
+ cp test_proc_interface.sh $(TOOL_BIN_DIR)
+ cp test_proc_interface.sh $(TOOL_BIN_DIR)/test_mult_process
+ cp test_mult_process.sh $(TOOL_BIN_DIR)
+ for n in $(MODULEDIR); do $(MAKE) -C $$n install; done
+clean:
+ for n in $(MODULEDIR); do $(MAKE) -C $$n clean; done
+
+
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/Makefile b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/Makefile
new file mode 100644
index 000000000000..9a2b520d1b5f
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/test_mult_process
+
+clean:
+ rm -rf $(testcases)
\ No newline at end of file
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_add_multi_cases.c b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_add_multi_cases.c
new file mode 100644
index 000000000000..67398c8ac927
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_add_multi_cases.c
@@ -0,0 +1,255 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 25 08:21:16 2020
+ */
+
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include <sys/types.h>
+#include <sys/ipc.h>
+#include <sys/sem.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * add_tasks_to_different_group 1000个子进程并发加入不同组，再并发退出 --- 测试多进程并发加组
+ * add_tasks_to_auto_group 1000个子进程并发加入不同组（组id自动分配），再并发退出 --- 测试auto
+ * add_tasks_and_kill 100个子进程加入同一个组，同时循环查询组信息，再依次杀掉子进程 --- 测试组信息查询接口
+ * addgroup_and_querygroup 创建子进程，查询组信息，同时父进程加随机组，然后子进程退出；循环10000次。
+ */
+
+/*
+ * 多进程并发加入不同的指定组（每个组里只有1个进程），然后并发退出。
+ * （后台进程一直反复调用sp_group_id_by_pid查询所有pid）
+ */
+#define TEST_ADDTASK_SEM_KEY 9834
+
+static int add_tasks_to_group_child(int semid, int group_id)
+{
+ int ret;
+
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = -1,
+ .sem_flg = 0,
+ };
+ semop(semid, &sembuf, 1);
+
+ struct sp_add_group_info ag_info= {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("add group %d failed, errno: %d", group_id, errno);
+ ret = -1;
+ goto out;
+ }
+
+ if (group_id == SPG_ID_AUTO) {
+ if (ag_info.spg_id < SPG_ID_AUTO_MIN || ag_info.spg_id > SPG_ID_AUTO_MAX) {
+ pr_info("invalid spg_id returned: %d", ag_info.spg_id);
+ ret = -1;
+ goto out;
+ }
+ }
+
+out:
+ // 通知本进程加组完成
+ semop(semid, &sembuf, 1);
+ // 等待所有子进程加组完成
+ sembuf.sem_op = 0;
+ semop(semid, &sembuf, 1);
+
+ return ret;
+}
+
+#define NR_CHILD 1000
+static int add_tasks_to_group(int group_id)
+{
+ int i;
+ pid_t childs[NR_CHILD] = {0};
+ int semid = semget(TEST_ADDTASK_SEM_KEY, 1, IPC_CREAT | IPC_EXCL | 0644);
+ if (semid < 0) {
+ pr_info("open systemV semaphore failed, errno: %d", errno);
+ return -1;
+ }
+
+ int ret = semctl(semid, 0, SETVAL, 0);
+ if (ret < 0) {
+ pr_info("sem setval failed, %s", strerror(errno));
+ goto error_out;
+ }
+
+ for (i = 0; i < NR_CHILD; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ for (i--; i >= 0; i--) {
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], NULL, 0);
+ }
+ ret = -1;
+ goto error_out;
+ } else if (pid == 0) {
+ exit(add_tasks_to_group_child(semid, group_id == SPG_ID_AUTO ? group_id : i + 2));
+ }
+
+ childs[i] = pid;
+ }
+
+ // 通知子进程开始加组
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = NR_CHILD * 2,
+ .sem_flg = 0,
+ };
+ semop(semid, &sembuf, 1);
+
+ // 等待子进程加组完成
+ sembuf.sem_op = 0;
+ semop(semid, &sembuf, 1);
+
+ int status;
+ for (int i = 0; i < NR_CHILD; i++) {
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child(pid:%d) exit unexpected", childs[i]);
+ ret = -1;
+ }
+ }
+
+error_out:
+ if (semctl(semid, 0, IPC_RMID) < 0)
+ pr_info("sem setval failed, %s", strerror(errno));
+ return ret;
+}
+
+/*
+ * 多进程并发加入不同的指定组（每个组里只有1个进程），然后并发退出。
+ * （后台进程一直反复调用sp_group_id_by_pid查询所有pid）
+ */
+static int add_tasks_to_different_group(void)
+{
+ return add_tasks_to_group(0);
+}
+
+/*
+ * 多进程并发加入不同的指定组（每个组里只有1个进程），然后并发退出。
+ * （后台进程一直反复调用sp_group_id_by_pid查询所有pid）
+ */
+static int add_tasks_to_auto_group(void)
+{
+ return add_tasks_to_group(SPG_ID_AUTO);
+}
+
+/*
+ * 多进程逐个加入同一个组，按进组顺序将这些进程杀掉。
+ */
+#define ADD_TASKS_AND_KILL_CHILD_NUM 100
+static int add_tasks_and_kill(void)
+{
+ int group_id = 234, ret = 0, i;
+ pid_t childs[ADD_TASKS_AND_KILL_CHILD_NUM] = {0};
+
+ struct sp_add_group_info ag_info = {
+ .spg_id = group_id,
+ .prot = PROT_READ | PROT_WRITE,
+ };
+
+ for (i = 0; i < ADD_TASKS_AND_KILL_CHILD_NUM; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ ret = -1;
+ goto out;
+ } else if (pid == 0) {
+ while (1) {
+ ioctl_find_first_group(dev_fd, getpid());
+ }
+ }
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("add task(pid:%d) to group(id:%d) failed, errno: %d", pid, group_id, errno);
+ ret = -1;
+ goto out;
+ }
+ childs[i] = pid;
+ }
+
+out:
+ for (i--; i >= 0; i--) {
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], NULL, 0);
+ }
+
+ return ret;
+}
+
+/*
+ * 并发执行加组和查询组操作
+ */
+static int addgroup_and_querygroup(void)
+{
+ int ret = 0;
+
+ srand((unsigned int)time(NULL));
+ for (int i = 1; !ret && i < 10000; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ ret = ioctl_find_first_group(dev_fd, getpid());
+ exit(ret);
+ }
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = rand() % (SPG_ID_AUTO_MIN - 1) + 1,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d, pid: %d, spg_id: %d",
+ errno, pid, ag_info.spg_id);
+ }
+ waitpid(pid, NULL, 0);
+ }
+
+ // 加组失败可能是用户进程退出导致的，失败不做判据，本用例充当压测用例，无异常即可
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(add_tasks_to_different_group, "多进程并发加入不同的指定组（每个组里只有1个进程），然后并发退出。")
+ TESTCASE_CHILD(add_tasks_to_auto_group, "多进程并发加入随机组（SPG_ID_AUTO），然后退出。")
+ TESTCASE_CHILD(add_tasks_and_kill, "多进程逐个加入同一个组，按进组顺序将这些进程杀掉。")
+ TESTCASE_CHILD(addgroup_and_querygroup, "对同一个进程（pid）同时进行加组和查询组的操作")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_alloc_add_and_kill.c b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_alloc_add_and_kill.c
new file mode 100644
index 000000000000..3cc88b6542bc
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_alloc_add_and_kill.c
@@ -0,0 +1,347 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 11 07:12:29 2020
+ */
+
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 执行流程：
+ * grandchild:
+ * 连续申请100次内存，然后释放掉，循环做
+ * child:
+ * 不断的kill或者创建grandchild进程
+ * 参数：
+ * -n 杀死或者创建grandchild进程次数
+ * -p 每组进程数
+ * -g sharepool组的数量
+ * -s grandchild进程每次申请内存的大小
+ */
+
+#define NR_GROUP 100
+#define MAX_PROC_PER_GRP 100
+#define NR_HOLD_AREAS 100
+
+static sem_t *child_sync[NR_GROUP];
+static sem_t *grandchild_sync[NR_GROUP];
+
+static int group_num = 2;
+static int process_per_group = 3;
+static int kill_num = 1000;
+static size_t alloc_size = 4 * PAGE_SIZE;
+
+static int grandchild_process(int grandchild_id)
+{
+#define pr_local_info(fmt, args...) printf("[grandchild%d, pid:%d] " fmt "\n", grandchild_id, getpid(), ##args)
+ int ret;
+
+ /* 等待父进程加组 */
+ do {
+ ret = sem_wait(child_sync[grandchild_id / MAX_PROC_PER_GRP]);
+ } while ((ret != 0) && errno == EINTR);
+
+ //pr_local_info("start!!");
+
+ int group_id = ioctl_find_first_group(dev_fd, getpid());
+ sem_post(grandchild_sync[grandchild_id / MAX_PROC_PER_GRP]);
+ if (group_id < 0) {
+ pr_local_info("ioctl_find_group_by_pid failed, %d", group_id);
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_infos[NR_HOLD_AREAS] = {0};
+ for (int i = 0; i < NR_HOLD_AREAS; i++) {
+ alloc_infos[i].flag = 0;
+ alloc_infos[i].spg_id = group_id;
+ alloc_infos[i].size = alloc_size;
+ }
+
+ int top = 0;
+ int count = 0;
+ while (1) {
+ struct sp_alloc_info *info = alloc_infos + top++;
+ ret = ioctl_alloc(dev_fd, info);
+ if (ret < 0) {
+ pr_local_info("ioctl alloc failed\n");
+ return -1;
+ } else {
+ if (IS_ERR_VALUE(info->addr)) {
+ pr_local_info("sp_alloc return err is %ld\n", info->addr);
+ return -1;
+ }
+ }
+
+ memset((void *)info->addr, 'z', info->size);
+
+ if (top == NR_HOLD_AREAS) {
+ top = 0;
+ for (int i = 0; i < NR_HOLD_AREAS; i++) {
+ ret = ioctl_free(dev_fd, &alloc_infos[i]);
+ if (ret < 0) {
+ pr_local_info("sp_free failed, %d", ret);
+ return ret;
+ }
+ }
+ pr_info("grandchild process id:%d finished %dth alloc-free-100times-run.", grandchild_id, ++count);
+ }
+ }
+
+ //pr_local_info("exit!!");
+ return 0;
+#undef pr_local_info
+}
+
+static int child_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[child%d , pid:%d] " fmt "\n", arg, getpid(), ##args)
+ //pr_local_info("start!!");
+
+ int ret, status = 0;
+ int group_id = arg + 100;
+ pid_t childs[MAX_PROC_PER_GRP] = {0};
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0)
+ return -1;
+
+ for (int i = 0; i < process_per_group; i++) {
+ int grandchild_id = arg * MAX_PROC_PER_GRP + i;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(grandchild_id);
+ exit(ret);
+ } else {
+ //pr_local_info("fork grandchild%d, pid: %d", grandchild_id, pid);
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", grandchild_id, group_id);
+ goto out;
+ } else {
+ //pr_local_info("add grandchild%d to group %d successfully", grandchild_id, group_id);
+ }
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[arg]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandchild_sync[arg]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+
+ pr_local_info("%dth sp group %d, create %d processes and add group success!!", arg, group_id, process_per_group);
+
+ unsigned int seed = time(NULL);
+ srand(seed);
+ pr_local_info("rand seed: %u\n", seed);
+ /* 随机杀死或者创建进程 */
+ for (int i = 0; i < kill_num; i++) {
+ sleep(1);
+ pr_info("group %d %dth interruption, %d times left.", group_id, i + 1, kill_num - i - 1);
+ int idx = rand() % process_per_group;
+
+ if (childs[idx] > 0) {
+ kill(childs[idx], SIGKILL);
+ waitpid(childs[idx], NULL, 0);
+ childs[idx] = 0;
+ } else {
+ int grandchild_id = arg * MAX_PROC_PER_GRP + idx;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(grandchild_id);
+ exit(ret);
+ } else {
+ pr_local_info("fork grandchild%d, pid: %d", grandchild_id, pid);
+ childs[idx] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", grandchild_id, group_id);
+ goto out;
+ } else
+ pr_local_info("add grandchild%d to group %d successfully", grandchild_id, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[arg]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandchild_sync[arg]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+ }
+
+out:
+ for (int i = 0; i < process_per_group; i++) {
+ if (!childs[i])
+ continue;
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], &status, 0);
+ if (!WIFSIGNALED(status)) {
+ pr_local_info("grandchild%d test failed", arg * MAX_PROC_PER_GRP + i);
+ ret = -1;
+ }
+ }
+
+ pr_local_info("exit!!");
+
+ return ret;
+#undef pr_local_info
+}
+
+static void print_help()
+{
+ printf("Usage:\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "p:g:n:s:")) != -1) {
+ switch (opt) {
+ case 'p': // 每组进程数
+ process_per_group = atoi(optarg);
+ if (process_per_group > MAX_PROC_PER_GRP || process_per_group <= 0) {
+ printf("process number invalid\n");
+ return -1;
+ }
+ break;
+ case 'g': // group 数量
+ group_num = atoi(optarg);
+ if (group_num > NR_GROUP || group_num <= 0) {
+ printf("group number invalid\n");
+ return -1;
+ }
+ break;
+ case 'n': // 杀死或者创建子进程次数
+ kill_num = atoi(optarg);
+ if (kill_num > 100000 || kill_num <= 0) {
+ printf("kill number invalid\n");
+ return -1;
+ }
+ break;
+ case 's':
+ alloc_size = atol(optarg);
+ if (alloc_size <= 0) {
+ printf("alloc size invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ printf("unsupported options: '%c'\n", opt);
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+#define pr_local_info(fmt, args...) printf("[parent , pid:%d] " fmt "\n", getpid(), ##args)
+
+ int ret = 0;
+ int status = 0;
+ pid_t childs[NR_GROUP];
+
+ pr_local_info("group: %d, process_per_group: %d", group_num, process_per_group);
+
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_grandchild_sync%d", i);
+ grandchild_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (grandchild_sync[i] == SEM_FAILED) {
+ pr_local_info("grandchild sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_child_sync%d", i);
+ child_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (child_sync[i] == SEM_FAILED) {
+ pr_local_info("child sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed, error %d", pid);
+ exit(-1);
+ } else if (pid == 0) {
+ ret = child_process(i);
+ exit(ret);
+ } else {
+ childs[i] = pid;
+
+ pr_local_info("fork child%d, pid: %d", i, pid);
+ }
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ waitpid(childs[i], &status, 0);
+ status = (char)WEXITSTATUS(status);
+ if (status) {
+ pr_local_info("child%d test failed, %d", i, status);
+ ret = status;
+ }
+ }
+
+ pr_local_info("exit!!");
+
+ return ret;
+#undef pr_local_info
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "连续申请100次内存，然后释放掉，循环; 同时不断杀死进程/创建新进程加组")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_max_group_per_process.c b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_max_group_per_process.c
new file mode 100644
index 000000000000..7218651368ee
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_max_group_per_process.c
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Tue Jun 08 06:47:40 2021
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <signal.h>
+#include <unistd.h>
+#include <stdlib.h> // for exit
+#include <sys/mman.h>
+#include <pthread.h>
+
+#include "sharepool_lib.h"
+
+#define PROCESS_NR 15
+#define THERAD_NUM 20
+#define MAX_GROUP_PER_PROCESS 3000
+/*
+ * 测试步骤：多进程多线程并发加组，组ID为AUTO
+ * 预期结果，所有线程加组成功次数为2999
+ */
+static void *test2_thread(void *arg)
+{
+ int i, ret = 0;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ,
+ };
+
+ for (i = 0; i < MAX_GROUP_PER_PROCESS - 1; i++) {
+ ag_info.spg_id = SPG_ID_AUTO;
+ TEST_CHECK(ioctl_add_group(dev_fd, &ag_info), out);
+ }
+
+out:
+ pr_info("thread%d: returned, %d groups has been added successfully", (int)arg, i);
+ return (void *)i;
+}
+
+static int testcase_route(int idx)
+{
+ int i, ret = 0, sum = 0;
+ void *val;
+ pthread_t th[THERAD_NUM];
+
+ for (i = 0; i < ARRAY_SIZE(th); i++)
+ TEST_CHECK(pthread_create(th + i, NULL, test2_thread, (void *)(i + idx * THERAD_NUM)), out);
+
+ for (i = 0; i < ARRAY_SIZE(th); i++) {
+ TEST_CHECK(pthread_join(th[i], &val), out);
+ sum += (int)val;
+ }
+
+ if (sum != MAX_GROUP_PER_PROCESS - 1) {
+ pr_info("MAX_GROUP_PER_PROCESS check failed, %d", sum);
+ return -1;
+ }
+
+out:
+ return ret;
+}
+
+static int testcase1(void)
+{
+ int ret = 0, i;
+ pid_t pid[PROCESS_NR];
+
+ for (i = 0; i < ARRAY_SIZE(pid); i++)
+ FORK_CHILD_ARGS(pid[i], testcase_route(i));
+
+ for (i = 0; i < ARRAY_SIZE(pid); i++)
+ WAIT_CHILD_STATUS(pid[i], out);
+
+out:
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE(testcase1, "同进程多线程并发加组，预期所有线程加组成功次数为2999")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_mult_alloc_and_add_group.c b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_mult_alloc_and_add_group.c
new file mode 100644
index 000000000000..201278e884eb
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_mult_alloc_and_add_group.c
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Feb 5 09:53:12 2021
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <pthread.h>
+
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include "sharepool_lib.h"
+
+
+#define GROUP_ID 1
+#define REPEAT_TIMES 20
+#define PROC_NUM_1 20
+#define PROC_NUM_2 60
+#define PROT (PROT_READ | PROT_WRITE)
+
+static int testcase1_add_group(int i)
+{
+ if (wrap_add_group(getpid(), PROT, GROUP_ID) < 0)
+ return -1;
+
+ pr_info("%dth process%d add group success.", i, getpid());
+
+ return 0;
+}
+
+static int testcase1_idle(int i)
+{
+ if (wrap_add_group(getpid(), PROT, GROUP_ID) < 0)
+ return -1;
+
+ pr_info("%dth process%d add group success. start idling...",
+ i, getpid());
+
+ while(1) {
+
+ }
+ return 0;
+}
+
+static int testcase1_alloc_free(int idx)
+{
+ unsigned long addr[REPEAT_TIMES];
+ void *ret_addr;
+ int count = 0;
+ int ret = 0;
+
+ if (wrap_add_group(getpid(), PROT, GROUP_ID) < 0)
+ return -1;
+ pr_info("alloc-child %d add group success.", idx);
+
+ while (1) {
+ for (int i = 0; i < REPEAT_TIMES; i++) {
+ ret_addr = wrap_sp_alloc(GROUP_ID, PMD_SIZE, 0);
+ if ((unsigned long)ret_addr == -1) {
+ pr_info("alloc failed!!!");
+ return -1;
+ }
+ addr[i] = (unsigned long)ret_addr;
+ }
+ pr_info("alloc-child %d alloc %dth time finished. start to free..",
+ idx, count);
+ sleep(3);
+
+ for (int i = 0; i < REPEAT_TIMES; i++) {
+ ret = wrap_sp_free(addr[i]);
+ if (ret < 0) {
+ pr_info("free failed!!! errno: %d", ret);
+ return ret;
+ }
+ }
+ pr_info("alloc-child %d free %dth time finished. start to alloc..",
+ idx, count);
+ count++;
+ }
+
+ return 0;
+}
+
+/*
+ * 多进程加组后不停alloc，同时让新进程加组，看会不会冲突mmap
+ */
+static int testcase1(void)
+{
+ int i;
+ int ret = 0;
+ pid_t child_idle[PROC_NUM_1];
+ pid_t child[PROC_NUM_2];
+ pid_t pid;
+
+ sleep(1);
+
+ for (i = 0; i < PROC_NUM_1; i++) {
+ FORK_CHILD_ARGS(child_idle[i], testcase1_idle(i));
+ }
+
+ pid = fork();
+ if (pid == 0)
+ exit(testcase1_alloc_free(0));
+
+ for (i = 0; i < PROC_NUM_2; i++) {
+ sleep(1);
+ FORK_CHILD_ARGS(child[i], testcase1_add_group(i));
+ }
+
+ for (i = 0; i < PROC_NUM_2; i++)
+ WAIT_CHILD_STATUS(child[i], out);
+out:
+ for (i = 0; i < PROC_NUM_1; i++)
+ KILL_CHILD(child_idle[i]);
+ KILL_CHILD(pid);
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "多进程加组后不停alloc，同时让新进程加组，预期正常")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_mult_process_thread_exit.c b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_mult_process_thread_exit.c
new file mode 100644
index 000000000000..d8e531139f0c
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_mult_process_thread_exit.c
@@ -0,0 +1,498 @@
+#include <stdlib.h>
+#include <pthread.h>
+#include <stdbool.h>
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+#define THREAD_NUM 50
+#define GROUP_NUM 50
+#define GROUP_BASE_ID 1
+
+static pthread_mutex_t mutex;
+static int add_success, add_fail;
+static int group_ids[GROUP_NUM];
+static int semid;
+
+static int query_group(int *group_num)
+{
+ int ret;
+ // query groups
+ int spg_ids[GROUP_NUM];
+ *group_num = GROUP_NUM;
+ struct sp_group_id_by_pid_info find_group_info = {
+ .num = group_num,
+ .spg_ids = spg_ids,
+ .pid = getpid(),
+ };
+ ret = ioctl_find_group_by_pid(dev_fd, &find_group_info);
+ if (ret < 0) {
+ pr_info("find group id by pid failed");
+ return ret;
+ } else {
+ return 0;
+ }
+}
+
+#define TIMES 4
+void *thread_and_process_helper(int group_id)
+{
+ int ret, i;
+ pid_t pid;
+ bool judge_ret = true;
+ struct sp_alloc_info alloc_info[TIMES] = {0};
+ struct sp_make_share_info u2k_info[TIMES] = {0}, k2u_info = {0}, k2u_huge_info = {0};
+ struct vmalloc_info vmalloc_info = {0}, vmalloc_huge_info = {0};
+ char *addr;
+
+ /* check sp group */
+ pid = getpid();
+
+ // 大页
+ alloc_info[0].flag = SP_HUGEPAGE;
+ alloc_info[0].spg_id = group_id;
+ alloc_info[0].size = 2 * PMD_SIZE;
+
+ // 大页 DVPP
+ alloc_info[1].flag = SP_DVPP | SP_HUGEPAGE;
+ alloc_info[1].spg_id = group_id;
+ alloc_info[1].size = 2 * PMD_SIZE;
+
+ // 普通页 DVPP
+ alloc_info[2].flag = SP_DVPP;
+ alloc_info[2].spg_id = group_id;
+ alloc_info[2].size = 4 * PAGE_SIZE;
+
+ // 普通页
+ alloc_info[3].flag = 0;
+ alloc_info[3].spg_id = group_id;
+ alloc_info[3].size = 4 * PAGE_SIZE;
+
+ /* alloc & u2k */
+ for (i = 0; i < TIMES; i++) {
+ /* sp_alloc */
+ ret = ioctl_alloc(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed at %dth alloc.\n", i);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(alloc_info[i].addr)) {
+ pr_info("sp_alloc return err is %ld\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("sp_alloc return addr %lx\n", alloc_info[i].addr);
+ }
+ }
+
+ /* check sp_alloc addr */
+ judge_ret = ioctl_judge_addr(dev_fd, alloc_info[i].addr);
+ if (judge_ret != true) {
+ pr_info("expect a valid share pool addr %lx\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("addr %lx is a valid share pool addr\n", alloc_info[i].addr);
+ }
+
+ /* prepare for u2k */
+ addr = (char *)alloc_info[i].addr;
+ if (alloc_info[i].flag & SP_HUGEPAGE) {
+ addr[0] = 'd';
+ addr[PMD_SIZE - 1] = 'c';
+ addr[PMD_SIZE] = 'b';
+ addr[PMD_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_hugepage_checker = true;
+ } else {
+ addr[0] = 'd';
+ addr[PAGE_SIZE - 1] = 'c';
+ addr[PAGE_SIZE] = 'b';
+ addr[PAGE_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_checker = true;
+ }
+
+ u2k_info[i].uva = alloc_info[i].addr;
+ u2k_info[i].size = alloc_info[i].size;
+ u2k_info[i].pid = pid;
+
+ /* u2k */
+ ret = ioctl_u2k(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl u2k failed\n");
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(u2k_info[i].addr)) {
+ pr_info("u2k return err is %ld.\n", u2k_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("u2k return addr %lx, check memory content succ.\n",
+ // u2k_info[i].addr);
+ }
+ }
+ //pr_info("\n");
+ }
+
+ /* prepare for vmalloc */
+ vmalloc_info.size = 3 * PAGE_SIZE;
+ vmalloc_huge_info.size = 3 * PMD_SIZE;
+
+ /* vmalloc */
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vmalloc_hugepage(dev_fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vmalloc huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* prepare for k2u */
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+ k2u_info.sp_flags = 0;
+ k2u_info.pid = pid;
+ k2u_info.spg_id = group_id;
+
+ k2u_huge_info.kva = vmalloc_huge_info.addr;
+ k2u_huge_info.size = vmalloc_huge_info.size;
+ k2u_huge_info.sp_flags = SP_DVPP;
+ k2u_huge_info.pid = pid;
+ k2u_huge_info.spg_id = group_id;
+
+ /* k2u */
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_info.addr)) {
+ pr_info("k2u return err is %ld.\n",
+ k2u_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u return addr %lx\n", k2u_info.addr);
+ }
+ }
+
+ ret = ioctl_k2u(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u hugepage error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_huge_info.addr)) {
+ pr_info("k2u hugepage return err is %ld.\n",
+ k2u_huge_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u hugepage return addr %lx\n", k2u_huge_info.addr);
+ }
+ }
+
+ /* check k2u memory content */
+ addr = (char *)k2u_info.addr;
+ if (addr[0] != 'a' || addr[PAGE_SIZE - 1] != 'b' ||
+ addr[PAGE_SIZE] != 'c' || addr[2 * PAGE_SIZE - 1] != 'd') {
+ pr_info("check vmalloc memory failed\n");
+ goto error;
+ } else {
+ //pr_info("check vmalloc memory succeess\n");
+ }
+
+ addr = (char *)k2u_huge_info.addr;
+ if (addr[0] != 'a' || addr[PMD_SIZE - 1] != 'b' ||
+ addr[PMD_SIZE] != 'c' || addr[2 * PMD_SIZE - 1] != 'd') {
+ pr_info("check vmalloc_hugepage memory failed: %c %c %c %c\n",
+ addr[0], addr[PMD_SIZE - 1], addr[PMD_SIZE], addr[2 * PMD_SIZE - 1]);
+ goto error;
+ } else {
+ //pr_info("check vmalloc_hugepage memory succeess\n");
+ }
+
+ /* unshare uva */
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("sp unshare uva error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_unshare(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("sp unshare hugepage uva error: %d\n", ret);
+ goto error;
+ }
+
+ /* kvfree */
+ ret = ioctl_vfree(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vfree small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vfree(dev_fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vfree huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* unshare kva & sp_free*/
+ for (i = 0; i < TIMES; i++) {
+ /* unshare kva */
+ ret = ioctl_unshare(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("sp_unshare kva return error: %d\n", ret);
+ goto error;
+ }
+
+ /* sp_free */
+ ret = ioctl_free(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("sp_free return error: %d\n", ret);
+ goto error;
+ }
+ }
+
+ //close_device(dev_fd);
+ return 0;
+
+error:
+ //close_device(dev_fd);
+ return -1;
+}
+
+void *thread_query_and_work(void *arg)
+{
+ int ret = 0;
+ int group_num = 0, j = 0;
+
+ while(group_num < GROUP_NUM && j++ < 10) {
+ // query group
+ ret = query_group(&group_num);
+ if (ret < 0) {
+ pr_info("query_group failed.");
+ continue;
+ }
+ for (int i = 0; i < group_num; i++) {
+ ret = thread_and_process_helper(group_ids[i]);
+ if (ret != 0) {
+ pr_info("\nthread %lu finish running with error, spg_id: %d\n", pthread_self(), group_ids[i]);
+ pthread_exit((void *)1);
+ }
+ }
+ }
+
+ pthread_exit((void *)0);
+}
+
+void *thread_add_group(void *arg)
+{
+ int ret = 0;
+ for(int i = 1; i <= GROUP_NUM; i++)
+ {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, i + 1);
+ if (pthread_mutex_lock(&mutex) != 0) {
+ pr_info("get pthread mutex failed.");
+ }
+ if (ret < 0)
+ add_fail++;
+ else
+ add_success++;
+ pthread_mutex_unlock(&mutex);
+ }
+ pthread_exit((void *)0);
+}
+
+static int process_routine(void)
+{
+ int ret = 0;
+ // threads for alloc and u2k k2u
+ pthread_t tid1[THREAD_NUM];
+ bool loop[THREAD_NUM];
+ for (int i = 0; i < THREAD_NUM; i++) {
+ loop[i] = false;
+ ret = pthread_create(tid1 + i, NULL, thread_query_and_work, (void *) (loop + i));
+ if (ret < 0) {
+ pr_info("thread create failed.");
+ return -1;
+ }
+ }
+ // N threads for add M groups, N*M attempts, only M attempts shall success
+ pthread_t tid2[THREAD_NUM];
+ for (int j = 0; j < 1; j++) {
+ ret = pthread_create(tid2 + j, NULL, thread_add_group, NULL);
+ if (ret < 0) {
+ pr_info("thread create failed.");
+ return -1;
+ }
+ }
+
+ // wait for add_group threads to return
+ for (int j = 0; j < 1; j++) {
+ void *tret;
+ ret = pthread_join(tid2[j], &tret);
+ if (ret < 0) {
+ pr_info("thread join failed.");
+ ret = -1;
+ }
+ if ((long)tret != 0) {
+ pr_info("thread %d failed.", j);
+ ret = -1;
+ } else {
+ pr_info("add group thread %d return success!!", j);
+ }
+ }
+
+ // wait for work threads to return
+ for (int i = 0; i < THREAD_NUM; i++) {
+ void *tret;
+ ret = pthread_join(tid1[i], &tret);
+ if (ret < 0) {
+ pr_info("thread join failed.");
+ ret = -1;
+ }
+ if ((long)tret != 0) {
+ pr_info("thread %d failed.", i);
+ ret = -1;
+ } else {
+ pr_info("work thread %d return success!!", i);
+ }
+ }
+
+ return ret;
+}
+
+#define PROCESS_NUM 20
+/* testcase1: 多进程加多组，例行调用所有API后，再并发退出*/
+static int testcase1(void)
+{
+ int ret = 0;
+
+ const int semid = sem_create(1234, "concurrent");
+ // fork child processes, they should not copy parent's group
+ int childs[PROCESS_NUM];
+ for (int k = 0; k < PROCESS_NUM; k++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed.");
+ return -1;
+ } else if (pid == 0) {
+ ret = process_routine();
+ sem_inc_by_one(semid);
+ sem_check_zero(semid);
+ exit(ret);
+ }
+ childs[k] = pid;
+ }
+
+ // wait until all processes finished add group thread and work thread
+ sem_dec_by_val(semid, PROCESS_NUM);
+
+ for (int k = 0; k < PROCESS_NUM; k++) {
+ int status;
+ ret = waitpid(childs[k], &status, 0);
+ if (ret < 0) {
+ pr_info("waitpid failed");
+ ret = -1;
+ }
+ if (status != 0) {
+ pr_info("child process %d pid %d exit unexpected", k, childs[k]);
+ ret = -1;
+ }
+ childs[k] = 0;
+ }
+
+ // 检查/proc/sharepool/proc_stat 应该只有一个spg
+
+ sem_close(semid);
+ return 0;
+}
+
+void *thread_exit(void *arg)
+{
+ sem_check_zero(semid);
+ pthread_exit((void *)0);
+}
+
+/* testcase2: 多进程加多组，例行调用所有API后，让多线程并发退出*/
+static int testcase2(void)
+{
+ int ret;
+
+ semid = sem_create(1234, "concurrent");
+ // fork child processes, they should not copy parent's group
+ int childs[PROCESS_NUM];
+ for (int k = 0; k < PROCESS_NUM; k++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed.");
+ return -1;
+ } else if (pid == 0) {
+
+ ret = process_routine(); // add group and work
+
+ // 线程并发退出
+ pthread_t tid[THREAD_NUM];
+ for (int j = 0; j < THREAD_NUM; j++) {
+ ret = pthread_create(tid + j, NULL, thread_exit, NULL);
+ if (ret < 0) {
+ pr_info("thread create failed.");
+ return -1;
+ }
+ }
+ sem_inc_by_one(semid);
+ for (int j = 0; j < THREAD_NUM; j++) {
+ void *tret;
+ ret = pthread_join(tid[j], &tret);
+ if (ret < 0) {
+ pr_info("exit thread join failed.");
+ ret = -1;
+ }
+ if ((long)tret != 0) {
+ pr_info("exit thread %d failed.", j);
+ ret = -1;
+ } else {
+ pr_info("exit thread %d return success!!", j);
+ }
+ }
+
+ exit(ret);
+ }
+ childs[k] = pid;
+ }
+
+ // wait until all processes finished add group thread and work thread
+ sleep(5);
+ sem_dec_by_val(semid, PROCESS_NUM);
+
+ for (int k = 0; k < PROCESS_NUM; k++) {
+ int status;
+ ret = waitpid(childs[k], &status, 0);
+ if (ret < 0) {
+ pr_info("waitpid failed");
+ ret = -1;
+ }
+ if (status != 0) {
+ pr_info("child process %d pid %d exit unexpected", k, childs[k]);
+ ret = -1;
+ }
+ childs[k] = 0;
+ }
+
+ // 检查/proc/sharepool/proc_stat 应该只有一个spg
+
+ sem_close(semid);
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "多进程执行完routine后，并发退出")
+ TESTCASE_CHILD(testcase2, "多线程执行完routine后，并发退出")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_mult_thread_add_group.c b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_mult_thread_add_group.c
new file mode 100644
index 000000000000..7660978f7e08
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_mult_thread_add_group.c
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Feb 5 09:53:12 2021
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <pthread.h>
+
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include "sharepool_lib.h"
+
+
+#define GROUP_ID 1
+#define REPEAT_TIMES 5
+#define THREAD_NUM 20
+
+/*
+ * testcase1: 创建5个子进程，每个子进程创建20个线程加组。预计每个子进程只有一个线程可以加组成功。
+ *
+ */
+
+static void *thread_add_group(void *arg)
+{
+ int ret = 0;
+ pid_t pid = getpid();
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = GROUP_ID,
+ };
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret == 0)
+ return 0;
+ else if (ret < 0 && errno == EEXIST) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ ret = 1;
+ } else {
+ ret = -1;
+ }
+
+ return (void *)ret;
+}
+
+static int child_process(void)
+{
+ int i;
+ int group_id;
+ int ret = 0;
+ void *tret;
+ pthread_t tid[THREAD_NUM];
+ int failure = 0, success = 0;
+
+ for (i = 0; i < THREAD_NUM; i++) {
+ ret = pthread_create(tid + i, NULL, thread_add_group, NULL);
+ if (ret != 0) {
+ pr_info("create thread %d error\n", i);
+ return -1;
+ }
+ }
+
+ for (i = 0; i < THREAD_NUM; i++) {
+ ret = pthread_join(tid[i], &tret);
+ if (ret != 0) {
+ pr_info("can't join thread %d\n", i);
+ return -1;
+ }
+ if ((long)tret == 0) {
+ success++;
+ } else if ((long)tret == 1){
+ failure++;
+ } else {
+ pr_info("testcase execution failed, thread %d exited unexpectedly\n", i);
+ return -1;
+ }
+ }
+
+ pid_t pid = getpid();
+ group_id = ioctl_find_first_group(dev_fd, pid);
+ if (group_id != GROUP_ID) {
+ printf("query group id is %d, but expected group id is %d\n",
+ group_id, GROUP_ID);
+ return -1;
+ }
+
+ if (success != 1 || success + failure != THREAD_NUM) {
+ pr_info("testcase failed, success %d times, fail %d times",
+ success, failure);
+ return -1;
+ }
+
+ return 0;
+}
+
+/*join a group and then exit the group*/
+static int child_process_multi_add_exit(void)
+{
+ int ret = 0;
+ int cnt = 0;
+ while(cnt < 600)
+ {
+ pid_t pid = getpid();
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = GROUP_ID,
+ };
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+
+ sleep(1);
+
+ struct sp_del_from_group_info info = {
+ .pid = pid,
+ .spg_id = GROUP_ID,
+ };
+
+ ret = ioctl_del_from_group(dev_fd, &info);
+ if (ret < 0) {
+ pr_info("ioctl_del_group failed, errno: %d", errno);
+ }
+
+ cnt++;
+ }
+ return 0;
+}
+
+/*
+ * 单进程创建一批线程并发尝试加入同一个共享组，除其中一个线程加入成功之外，
+ * 其它应返回-EEXIST
+ */
+static int testcase1(void)
+{
+ int i;
+ int ret = 0;
+ pid_t pid;
+
+ for (i = 0; i < REPEAT_TIMES; i++) {
+ pid = fork();
+
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(child_process());
+ }
+
+ int status;
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("thread add group test, time %d failed", i + 1);
+ ret = -1;
+ break;
+ } else {
+ pr_info("thread add group test, time %d success", i + 1);
+ }
+ }
+
+ return ret;
+}
+
+static int testcase2(void)
+{
+ int i;
+ int ret = 0;
+ pid_t pid = getpid();
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = GROUP_ID,
+ };
+
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ }
+
+ for (i = 0; i < 999; i++) {
+ pid = fork();
+
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+
+ exit(child_process_multi_add_exit());
+ }
+ }
+
+ int status;
+ wait(&status);
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "同一进程内多线程并发加入同个共享组，预期只有1个成功")
+ TESTCASE_CHILD(testcase2, "同一进程内多线程并发加入同个共享组,退出同个共享组，同时查询/proc_show接口")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_u2k_add_and_kill.c b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_u2k_add_and_kill.c
new file mode 100644
index 000000000000..dd42e674f402
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_add_group_test/test_u2k_add_and_kill.c
@@ -0,0 +1,358 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Nov 27 13:45:03 2020
+ */
+
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * group_num个组，每组process_pre_group个进程，所有grandchild进程死循环执行：（sp_alloc -> u2k -> 内核读内存 -> unshare -> sp_free）
+ * child进程拉起所有grandchild后，反复kill_num次：kill或者创建grandchild进程，保证总数不超过process_pre_group
+ */
+
+#define MAX_GROUP 500
+#define MAX_PROC_PER_GRP 500
+#define MAX_KILL 100000
+
+static sem_t *child_sync[MAX_GROUP];
+static sem_t *grandchild_sync[MAX_GROUP];
+
+static int group_num = 100;
+static int process_per_group = 100;
+static int kill_num = 100;
+static size_t alloc_size = 4 * PAGE_SIZE;
+
+static int grandchild_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[grandchild%d, pid:%d] " fmt "\n", arg, getpid(), ##args)
+ int ret;
+
+ /* 等待父进程加组 */
+ do {
+ ret = sem_wait(child_sync[arg / MAX_PROC_PER_GRP]);
+ } while ((ret != 0) && errno == EINTR);
+
+ //pr_local_info("start!!");
+
+ int group_id = ioctl_find_first_group(dev_fd, getpid());
+ sem_post(grandchild_sync[arg / MAX_PROC_PER_GRP]);
+ if (group_id < 0) {
+ pr_local_info("ioctl_find_group_by_pid failed, %d", group_id);
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .spg_id = group_id,
+ .size = alloc_size,
+ };
+
+ while (1) {
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_local_info("ioctl alloc failed\n");
+ return ret;
+ } else {
+ if (IS_ERR_VALUE(alloc_info.addr)) {
+ pr_local_info("sp_alloc return err is %ld\n", alloc_info.addr);
+ return -1;
+ }
+ }
+ memset((void *)alloc_info.addr, 'r', alloc_info.size);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_local_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ }
+ struct karea_access_info karea_info = {
+ .mod = KAREA_CHECK,
+ .value = 'r',
+ .addr = u2k_info.addr,
+ .size = u2k_info.size,
+ };
+
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_local_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_local_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_local_info("free area failed, errno: %d", errno);
+ return ret;
+ }
+ }
+
+ //pr_local_info("exit!!");
+ return 0;
+#undef pr_local_info
+}
+
+static int child_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[child%d , pid:%d] " fmt "\n", arg, getpid(), ##args)
+ //pr_local_info("start!!");
+
+ int ret, status = 0;
+ int group_id = arg + 100;
+ pid_t childs[MAX_PROC_PER_GRP] = {0};
+
+ // add group
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0)
+ return -1;
+
+ // 轮流创建该组的所有子进程
+ for (int i = 0; i < process_per_group; i++) {
+ int num = arg * MAX_PROC_PER_GRP + i;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(num);
+ exit(ret);
+ } else {
+ pr_local_info("fork grandchild%d, pid: %d", num, pid);
+ childs[i] = pid;
+
+ // 将子进程加组
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", num, group_id);
+ goto out;
+ } else
+ //pr_local_info("add grandchild%d to group %d successfully", num, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[arg]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandchild_sync[arg]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+
+ unsigned int seed = time(NULL);
+ srand(seed);
+ pr_local_info("rand seed: %u\n", seed);
+
+ /* 随机杀死或者创建进程 */
+ for (int i = 0; i < kill_num; i++) {
+ printf("kill/create %dth time.\n", i);
+ int idx = rand() % process_per_group;
+
+ if (childs[idx] > 0) {
+ // 杀死这个位置上的进程
+ kill(childs[idx], SIGKILL);
+ waitpid(childs[idx], NULL, 0);
+ printf("We killed %dth process %d!\n", idx, childs[idx]);
+ childs[idx] = 0;
+ } else {
+ printf("We are going to create a new process.\n");
+ // 该进程已经被杀死了，创建一个新进程填补该位置
+ int num = arg * MAX_PROC_PER_GRP + idx;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(num);
+ exit(ret);
+ } else {
+ pr_local_info("fork grandchild%d, pid: %d", num, pid);
+ childs[idx] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", num, group_id);
+ goto out;
+ } else
+ pr_local_info("add grandchild%d to group %d successfully", num, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[arg]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandchild_sync[arg]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+ }
+
+out:
+ for (int i = 0; i < process_per_group; i++) {
+ if (!childs[i])
+ continue;
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], &status, 0);
+ if (!WIFSIGNALED(status)) {
+ pr_local_info("grandchild%d test failed", arg * MAX_PROC_PER_GRP + i);
+ ret = -1;
+ }
+ }
+
+ //pr_local_info("exit!!");
+ return ret;
+#undef pr_local_info
+}
+
+static void print_help()
+{
+ printf("Usage:./test_multi_u2k2 -g group_num -p proc_num -n kill_num -s alloc_size\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "p:g:n:s:")) != -1) {
+ switch (opt) {
+ case 'p': // 每组进程数
+ process_per_group = atoi(optarg);
+ if (process_per_group > MAX_PROC_PER_GRP || process_per_group <= 0) {
+ printf("process number invalid\n");
+ return -1;
+ }
+ break;
+ case 'g': // group 数量
+ group_num = atoi(optarg);
+ if (group_num > MAX_GROUP || group_num <= 0) {
+ printf("group number invalid\n");
+ return -1;
+ }
+ break;
+ case 'n': // 杀死或者创建子进程次数
+ kill_num = atoi(optarg);
+ if (kill_num > MAX_KILL || kill_num <= 0) {
+ printf("kill number invalid\n");
+ return -1;
+ }
+ break;
+ case 's':
+ alloc_size = atol(optarg);
+ if (alloc_size <= 0) {
+ printf("alloc size invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ printf("unsupported options: '%c'\n", opt);
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+
+ int ret = 0;
+ int status = 0;
+ pid_t childs[MAX_GROUP];
+
+ // 创建组同步锁 grandchild
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_grandchild_sync%d", i);
+ grandchild_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (grandchild_sync[i] == SEM_FAILED) {
+ pr_info("grandchild sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ // 创建组同步锁 child
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_child_sync%d", i);
+ child_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (child_sync[i] == SEM_FAILED) {
+ pr_info("child sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ // 创建组对应的子进程
+ for (int i = 0; i < group_num; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed, error %d", pid);
+ exit(-1);
+ } else if (pid == 0) {
+ ret = child_process(i);
+ exit(ret);
+ } else {
+ childs[i] = pid;
+ pr_info("fork child%d, pid: %d", i, pid);
+ }
+ }
+
+ // 结束组对应的子进程
+ for (int i = 0; i < group_num; i++) {
+ waitpid(childs[i], &status, 0);
+ status = (char)WEXITSTATUS(status);
+ if (status) {
+ pr_info("child%d test failed, %d", i, status);
+ ret = status;
+ }
+ }
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "循环sp_alloc -> u2k -> 内核读内存 -> unshare -> sp_free 同时杀掉进程/创建新进程加组")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/Makefile b/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/Makefile
new file mode 100644
index 000000000000..9a2b520d1b5f
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/test_mult_process
+
+clean:
+ rm -rf $(testcases)
\ No newline at end of file
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_add_group_and_print.c b/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_add_group_and_print.c
new file mode 100644
index 000000000000..3a070bc514ec
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_add_group_and_print.c
@@ -0,0 +1,182 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 11 07:12:29 2020
+ */
+
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 执行流程：
+ * child0&child1: 不断地cat /proc/sharepool/proc_stat和spa_stat，预期返回成功
+ * child1&child2: 不断地创建新进程加组，预期返回成功，且无死锁
+ * proc_work: 新进程加组后执行所有功能
+ */
+
+#define PROC_ADD_GROUP 200
+#define PROT_ADD_GROUP (PROT_READ | PROT_WRITE)
+
+int proc_work(void)
+{
+ while(1) {
+
+ }
+}
+
+int start_printer(void)
+{
+ while(1) {
+ pr_info("printer working.");
+ usleep(1000);
+ sharepool_log("sharepool_log");
+ // sharepool_print();
+ }
+ return 0;
+}
+
+int start_creator(int spg_id)
+{
+ int ret = 0;
+ int i = 0;
+ int pid = 0;
+ pid_t child[PROC_ADD_GROUP];
+ memset(child, 0, sizeof(pid_t) * PROC_ADD_GROUP);
+
+ // 加组
+ TEST_CHECK(wrap_add_group(getpid(), PROT_ADD_GROUP, spg_id), out);
+
+ // 拉起子进程加组
+ for (i = 0; i < PROC_ADD_GROUP;) {
+ FORK_CHILD_ARGS(pid, proc_work());
+ child[i++] = pid;
+ TEST_CHECK(wrap_add_group(pid, PROT_ADD_GROUP, spg_id), out);
+ pr_info("%d th group: process %d add success", spg_id, i);
+ }
+out:
+ for (int j = 0; j < i; j++)
+ KILL_CHILD(child[j]);
+
+ pr_info("%s exiting. ret: %d", __FUNCTION__, ret);
+ return ret < 0 ? ret : 0;
+}
+
+static int testcase1(void)
+{
+ int ret = 0;
+ int pid;
+ int status;
+ pid_t child[4];
+
+ // 拉起打印进程
+ for (int i = 0; i < 2; i++) {
+ FORK_CHILD_ARGS(pid, start_printer());
+ child[i] = pid;
+ }
+
+ // 拉起加组进程
+ for (int i = 2; i < 4; i++) {
+ pr_info("creating process");
+ FORK_CHILD_ARGS(pid, start_creator(i)); // use i as spg_id
+ child[i] = pid;
+ }
+
+ // 回收进程
+ for (int i = 2; i < 4; i++)
+ WAIT_CHILD_STATUS(child[i], out);
+ pr_info("creators finished.");
+out:
+ for (int i = 0; i < 2; i++) {
+ kill(child[i], SIGKILL);
+ waitpid(child[i], &status, 0);
+ }
+ pr_info("printers killed.");
+
+ return ret;
+}
+#define GROUP_NUM 1000
+int start_group_creators(int use_auto)
+{
+ int ret;
+ int id = 1;
+
+ if (use_auto % 2 == 0) {
+ while (id <= GROUP_NUM) {
+ TEST_CHECK(wrap_add_group(getpid(), PROT_ADD_GROUP, id), out);
+ pr_info("create group %d success\n", ret);
+ id++;
+ }
+ } else {
+ while (id <= GROUP_NUM) {
+ TEST_CHECK(wrap_add_group(getpid(), PROT_ADD_GROUP, SPG_ID_AUTO), out);
+ pr_info("create group %d success\n", ret);
+ id++;
+ }
+ }
+
+out:
+ return ret < 0? ret : 0;
+}
+
+static int testcase2(void)
+{
+ int ret = 0;
+ int pid;
+ int status;
+ pid_t child[4];
+
+ // 拉起打印进程
+ for (int i = 0; i < 2; i++) {
+ FORK_CHILD_ARGS(pid, start_printer());
+ child[i] = pid;
+ }
+
+ // 拉起创建组进程
+ for (int i = 2; i < 4; i++) {
+ pr_info("creating add group process");
+ FORK_CHILD_ARGS(pid, start_group_creators(i)); // even: auto id, odd: use id
+ child[i] = pid;
+ }
+
+ // 回收进程
+ for (int i = 2; i < 4; i++)
+ WAIT_CHILD_STATUS(child[i], out);
+ pr_info("group creators finished.");
+
+out:
+ for (int i = 0; i < 2; i++) {
+ kill(child[i], SIGKILL);
+ waitpid(child[i], &status, 0);
+ }
+ pr_info("printers killed.");
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "加组与维测打印并发（指定组ID）")
+ TESTCASE_CHILD(testcase2, "加组与维测打印并发（auto ID）")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_concurrent_debug.c b/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_concurrent_debug.c
new file mode 100644
index 000000000000..09cbe67d19cd
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_concurrent_debug.c
@@ -0,0 +1,359 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 11 07:12:29 2020
+ */
+
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 执行流程：
+ * grandchild:
+ * 连续申请100次内存，然后释放掉，循环
+ * child:
+ * 不断的kill或者创建grandchild进程
+ * 参数：
+ * -n 杀死或者创建grandchild进程次数
+ * -p 每组进程数
+ * -g sharepool组的数量
+ * -s grandchild进程每次申请内存的大小
+ */
+
+#define NR_GROUP 100
+#define MAX_PROC_PER_GRP 100
+#define NR_HOLD_AREAS 100
+
+static sem_t *child_sync[NR_GROUP];
+static sem_t *grandchild_sync[NR_GROUP];
+
+static int group_num = 2;
+static int process_per_group = 3;
+static int kill_num = 100;
+static size_t alloc_size = 4 * PAGE_SIZE;
+
+static int grandchild_process(int grandchild_id)
+{
+#define pr_local_info(fmt, args...) printf("[grandchild%d, pid:%d] " fmt "\n", grandchild_id, getpid(), ##args)
+ int ret;
+
+ /* 等待父进程加组 */
+ do {
+ ret = sem_wait(child_sync[grandchild_id / MAX_PROC_PER_GRP]);
+ } while ((ret != 0) && errno == EINTR);
+
+ //pr_local_info("start!!");
+
+ int group_id = ioctl_find_first_group(dev_fd, getpid());
+ sem_post(grandchild_sync[grandchild_id / MAX_PROC_PER_GRP]);
+ if (group_id < 0) {
+ pr_local_info("ioctl_find_group_by_pid failed, %d", group_id);
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_infos[NR_HOLD_AREAS] = {0};
+ for (int i = 0; i < NR_HOLD_AREAS; i++) {
+ alloc_infos[i].flag = 0;
+ alloc_infos[i].spg_id = group_id;
+ alloc_infos[i].size = alloc_size;
+ }
+
+ int top = 0;
+ int count = 0;
+ while (1) {
+ struct sp_alloc_info *info = alloc_infos + top++;
+ ret = ioctl_alloc(dev_fd, info);
+ if (ret < 0) {
+ pr_local_info("ioctl alloc failed\n");
+ return -1;
+ } else {
+ if (IS_ERR_VALUE(info->addr)) {
+ pr_local_info("sp_alloc return err is %ld\n", info->addr);
+ return -1;
+ }
+ }
+
+ memset((void *)info->addr, 'z', info->size);
+
+ if (top == NR_HOLD_AREAS) {
+ top = 0;
+ for (int i = 0; i < NR_HOLD_AREAS; i++) {
+ ret = ioctl_free(dev_fd, &alloc_infos[i]);
+ if (ret < 0) {
+ pr_local_info("sp_free failed, %d", ret);
+ return ret;
+ }
+ }
+ pr_info("grandchild process id:%d finished %dth alloc-free-100times-run.", grandchild_id, ++count);
+ }
+ }
+
+ //pr_local_info("exit!!");
+ return 0;
+#undef pr_local_info
+}
+
+static int child_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[child%d , pid:%d] " fmt "\n", arg, getpid(), ##args)
+ //pr_local_info("start!!");
+
+ int ret, status = 0;
+ int group_id = arg + 100;
+ pid_t childs[MAX_PROC_PER_GRP] = {0};
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0)
+ return -1;
+
+ for (int i = 0; i < process_per_group; i++) {
+ int grandchild_id = arg * MAX_PROC_PER_GRP + i;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(grandchild_id);
+ exit(ret);
+ } else {
+ //pr_local_info("fork grandchild%d, pid: %d", grandchild_id, pid);
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", grandchild_id, group_id);
+ goto out;
+ } else {
+ //pr_local_info("add grandchild%d to group %d successfully", grandchild_id, group_id);
+ }
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[arg]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandchild_sync[arg]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+
+ pr_local_info("%dth sp group %d, create %d processes and add group success!!", arg, group_id, process_per_group);
+
+ unsigned int seed = time(NULL);
+ srand(seed);
+ pr_local_info("rand seed: %u\n", seed);
+ /* 随机杀死或者创建进程 */
+ for (int i = 0; i < kill_num; i++) {
+ sleep(1);
+ pr_info("group %d %dth interruption, %d times left.", group_id, i + 1, kill_num - i - 1);
+ int idx = rand() % process_per_group;
+
+ if (childs[idx] > 0) {
+ kill(childs[idx], SIGKILL);
+ waitpid(childs[idx], NULL, 0);
+ childs[idx] = 0;
+ } else {
+ int grandchild_id = arg * MAX_PROC_PER_GRP + idx;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(grandchild_id);
+ exit(ret);
+ } else {
+ pr_local_info("fork grandchild%d, pid: %d", grandchild_id, pid);
+ childs[idx] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", grandchild_id, group_id);
+ goto out;
+ } else
+ pr_local_info("add grandchild%d to group %d successfully", grandchild_id, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[arg]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandchild_sync[arg]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+ }
+
+out:
+ for (int i = 0; i < process_per_group; i++) {
+ if (!childs[i])
+ continue;
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], &status, 0);
+ if (!WIFSIGNALED(status)) {
+ pr_local_info("grandchild%d test failed", arg * MAX_PROC_PER_GRP + i);
+ ret = -1;
+ }
+ }
+
+ pr_local_info("exit!!");
+
+ return ret;
+#undef pr_local_info
+}
+
+static void print_help()
+{
+ printf("Usage:\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "p:g:n:s:")) != -1) {
+ switch (opt) {
+ case 'p': // 每组进程数
+ process_per_group = atoi(optarg);
+ if (process_per_group > MAX_PROC_PER_GRP || process_per_group <= 0) {
+ printf("process number invalid\n");
+ return -1;
+ }
+ break;
+ case 'g': // group 数量
+ group_num = atoi(optarg);
+ if (group_num > NR_GROUP || group_num <= 0) {
+ printf("group number invalid\n");
+ return -1;
+ }
+ break;
+ case 'n': // 杀死或者创建子进程次数
+ kill_num = atoi(optarg);
+ if (kill_num > 100000 || kill_num <= 0) {
+ printf("kill number invalid\n");
+ return -1;
+ }
+ break;
+ case 's':
+ alloc_size = atol(optarg);
+ if (alloc_size <= 0) {
+ printf("alloc size invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ printf("unsupported options: '%c'\n", opt);
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+#define pr_local_info(fmt, args...) printf("[parent , pid:%d] " fmt "\n", getpid(), ##args)
+
+ int ret = 0;
+ int status = 0;
+ pid_t childs[NR_GROUP];
+ pid_t pid;
+
+ pr_local_info("group: %d, process_per_group: %d", group_num, process_per_group);
+
+ pid = fork();
+ if (pid == 0) {
+ while(1) {
+ usleep(200);
+ sharepool_log("sharepool_log");
+ }
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_grandchild_sync%d", i);
+ grandchild_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (grandchild_sync[i] == SEM_FAILED) {
+ pr_local_info("grandchild sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_child_sync%d", i);
+ child_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (child_sync[i] == SEM_FAILED) {
+ pr_local_info("child sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed, error %d", pid);
+ exit(-1);
+ } else if (pid == 0) {
+ ret = child_process(i);
+ exit(ret);
+ } else {
+ childs[i] = pid;
+
+ pr_local_info("fork child%d, pid: %d", i, pid);
+ }
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ waitpid(childs[i], &status, 0);
+ status = (char)WEXITSTATUS(status);
+ if (status) {
+ pr_local_info("child%d test failed, %d", i, status);
+ ret = status;
+ }
+ }
+
+ kill(pid, SIGKILL);
+ waitpid(pid, &status, 0);
+
+ pr_local_info("exit!!");
+
+ return ret;
+#undef pr_local_info
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "持续申请->释放内存，同时循环打印维测")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_debug_loop.c b/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_debug_loop.c
new file mode 100644
index 000000000000..0c4368244bf9
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_debug_loop.c
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 11 07:12:29 2020
+ */
+
+#include <time.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+static int testcase1(void)
+{
+ while(1) {
+ usleep(100);
+ sharepool_print();
+ }
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "维测打印（无限循环，不要单独运行）")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_proc_interface_process.c b/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_proc_interface_process.c
new file mode 100644
index 000000000000..fa10c06f1577
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_proc_interface_process.c
@@ -0,0 +1,636 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Sun Jan 31 14:42:01 2021
+ */
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+
+#include "sharepool_lib.h"
+
+
+#define GROUP_ID 1
+#define TIMES 4
+
+#define REPEAT_TIMES 10
+#define THREAD_NUM 30
+#define PROCESS_NUM 30
+
+void *thread_k2u_task(void *arg)
+{
+ int fd, ret;
+ pid_t pid = getpid();
+ struct vmalloc_info vmalloc_info = {0}, vmalloc_huge_info = {0};
+ struct sp_make_share_info k2u_info = {0}, k2u_huge_info = {0};
+ char *addr;
+
+ //pr_info("enter thread, pid is %d, thread id is %lu\n\n", pid, pthread_self());
+
+ fd = open_device();
+ if (fd < 0) {
+ pr_info("open fd error\n");
+ return NULL;
+ }
+
+ /* prepare for vmalloc */
+ vmalloc_info.size = 3 * PAGE_SIZE;
+ vmalloc_huge_info.size = 3 * PMD_SIZE;
+
+ /* vmalloc */
+ ret = ioctl_vmalloc(fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vmalloc_hugepage(fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vmalloc huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* prepare for k2u */
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+ k2u_info.sp_flags = SP_DVPP;
+ k2u_info.pid = pid;
+ k2u_info.spg_id = SPG_ID_DEFAULT;
+
+ k2u_huge_info.kva = vmalloc_huge_info.addr;
+ k2u_huge_info.size = vmalloc_huge_info.size;
+ k2u_huge_info.sp_flags = 0;
+ k2u_huge_info.pid = pid;
+ k2u_huge_info.spg_id = SPG_ID_DEFAULT;
+
+ /* k2u */
+ ret = ioctl_k2u(fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_info.addr)) {
+ pr_info("k2u return err is %ld.\n",
+ k2u_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u return addr %lx\n", k2u_info.addr);
+ }
+ }
+
+ ret = ioctl_k2u(fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u hugepage error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_huge_info.addr)) {
+ pr_info("k2u hugepage return err is %ld.\n",
+ k2u_huge_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u hugepage return addr %lx\n", k2u_huge_info.addr);
+ }
+ }
+
+ /* check k2u memory content */
+ addr = (char *)k2u_info.addr;
+ if (addr[0] != 'a' || addr[PAGE_SIZE - 1] != 'b' ||
+ addr[PAGE_SIZE] != 'c' || addr[2 * PAGE_SIZE - 1] != 'd') {
+ pr_info("check vmalloc memory failed\n");
+ goto error;
+ } else {
+ //pr_info("check vmalloc memory succeess\n");
+ }
+
+ addr = (char *)k2u_huge_info.addr;
+ if (addr[0] != 'a' || addr[PMD_SIZE - 1] != 'b' ||
+ addr[PMD_SIZE] != 'c' || addr[2 * PMD_SIZE - 1] != 'd') {
+ pr_info("check vmalloc_hugepage memory failed: %c %c %c %c\n",
+ addr[0], addr[PMD_SIZE - 1], addr[PMD_SIZE], addr[2 * PMD_SIZE - 1]);
+ goto error;
+ } else {
+ //pr_info("check vmalloc_hugepage memory succeess\n");
+ }
+
+ /* unshare uva */
+ ret = ioctl_unshare(fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("sp unshare uva error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_unshare(fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("sp unshare hugepage uva error: %d\n", ret);
+ goto error;
+ }
+
+ /* kvfree */
+ ret = ioctl_vfree(fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vfree small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vfree(fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vfree huge page error: %d\n", ret);
+ goto error;
+ }
+
+ //pr_info("\nfinish running thread %lu\n", pthread_self());
+ close_device(fd);
+ pthread_exit((void *)0);
+
+error:
+ close_device(fd);
+ pthread_exit((void *)1);
+}
+
+/*
+ * alloc - u2k - vmalloc - k2u - unshare - vfree - unshare - free
+ * 对大页/大页dvpp/小页/小页dvpp都测一下
+ */
+void *thread_and_process_helper(void)
+{
+ int fd, ret, group_id, i;
+ pid_t pid;
+ bool judge_ret = true;
+ struct sp_alloc_info alloc_info[TIMES] = {0};
+ struct sp_make_share_info u2k_info[TIMES] = {0}, k2u_info = {0}, k2u_huge_info = {0};
+ struct vmalloc_info vmalloc_info = {0}, vmalloc_huge_info = {0};
+ char *addr;
+
+ fd = open_device();
+ if (fd < 0) {
+ pr_info("open fd error\n");
+ return NULL;
+ }
+
+ /* check sp group */
+ pid = getpid();
+ group_id = ioctl_find_first_group(fd, pid);
+ if (group_id != GROUP_ID) {
+ pr_info("query group id is %d, but expected group id is %d\n",
+ group_id, GROUP_ID);
+ goto error;
+ }
+
+ // 大页
+ alloc_info[0].flag = SP_HUGEPAGE;
+ alloc_info[0].spg_id = GROUP_ID;
+ alloc_info[0].size = 2 * PMD_SIZE;
+
+ // 大页 DVPP
+ alloc_info[1].flag = SP_DVPP | SP_HUGEPAGE;
+ alloc_info[1].spg_id = GROUP_ID;
+ alloc_info[1].size = 2 * PMD_SIZE;
+
+ // 普通页 DVPP
+ alloc_info[2].flag = SP_DVPP;
+ alloc_info[2].spg_id = GROUP_ID;
+ alloc_info[2].size = 4 * PAGE_SIZE;
+
+ // 普通页
+ alloc_info[3].flag = 0;
+ alloc_info[3].spg_id = GROUP_ID;
+ alloc_info[3].size = 4 * PAGE_SIZE;
+
+ for (i = 0; i < TIMES; i++) {
+ /* sp_alloc */
+ ret = ioctl_alloc(fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed at %dth alloc.\n", i);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(alloc_info[i].addr)) {
+ pr_info("sp_alloc return err is %ld\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("sp_alloc return addr %lx\n", alloc_info[i].addr);
+ }
+ }
+
+ /* check sp_alloc addr */
+ judge_ret = ioctl_judge_addr(fd, alloc_info[i].addr);
+ if (judge_ret != true) {
+ pr_info("expect a valid share pool addr %lx\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("addr %lx is a valid share pool addr\n", alloc_info[i].addr);
+ }
+
+ /* prepare for u2k */
+ addr = (char *)alloc_info[i].addr;
+ if (alloc_info[i].flag & SP_HUGEPAGE) {
+ addr[0] = 'd';
+ addr[PMD_SIZE - 1] = 'c';
+ addr[PMD_SIZE] = 'b';
+ addr[PMD_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_hugepage_checker = true;
+ } else {
+ addr[0] = 'd';
+ addr[PAGE_SIZE - 1] = 'c';
+ addr[PAGE_SIZE] = 'b';
+ addr[PAGE_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_checker = true;
+ }
+
+ u2k_info[i].uva = alloc_info[i].addr;
+ u2k_info[i].size = alloc_info[i].size;
+ u2k_info[i].pid = pid;
+
+ /* u2k */
+ ret = ioctl_u2k(fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl u2k failed\n");
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(u2k_info[i].addr)) {
+ pr_info("u2k return err is %ld.\n", u2k_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("u2k return addr %lx, check memory content succ.\n",
+ // u2k_info[i].addr);
+ }
+ }
+ //pr_info("\n");
+ }
+
+ /* prepare for vmalloc */
+ vmalloc_info.size = 3 * PAGE_SIZE;
+ vmalloc_huge_info.size = 3 * PMD_SIZE;
+
+ /* vmalloc */
+ ret = ioctl_vmalloc(fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vmalloc_hugepage(fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vmalloc huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* prepare for k2u */
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+ k2u_info.sp_flags = 0;
+ k2u_info.pid = pid;
+ k2u_info.spg_id = SPG_ID_DEFAULT;
+
+ k2u_huge_info.kva = vmalloc_huge_info.addr;
+ k2u_huge_info.size = vmalloc_huge_info.size;
+ k2u_huge_info.sp_flags = SP_DVPP;
+ k2u_huge_info.pid = pid;
+ k2u_huge_info.spg_id = SPG_ID_DEFAULT;
+
+ /* k2u */
+ ret = ioctl_k2u(fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_info.addr)) {
+ pr_info("k2u return err is %ld.\n",
+ k2u_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u return addr %lx\n", k2u_info.addr);
+ }
+ }
+
+ ret = ioctl_k2u(fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u hugepage error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_huge_info.addr)) {
+ pr_info("k2u hugepage return err is %ld.\n",
+ k2u_huge_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u hugepage return addr %lx\n", k2u_huge_info.addr);
+ }
+ }
+
+ /* check k2u memory content */
+ addr = (char *)k2u_info.addr;
+ if (addr[0] != 'a' || addr[PAGE_SIZE - 1] != 'b' ||
+ addr[PAGE_SIZE] != 'c' || addr[2 * PAGE_SIZE - 1] != 'd') {
+ pr_info("check vmalloc memory failed\n");
+ goto error;
+ } else {
+ //pr_info("check vmalloc memory succeess\n");
+ }
+
+ addr = (char *)k2u_huge_info.addr;
+ if (addr[0] != 'a' || addr[PMD_SIZE - 1] != 'b' ||
+ addr[PMD_SIZE] != 'c' || addr[2 * PMD_SIZE - 1] != 'd') {
+ pr_info("check vmalloc_hugepage memory failed: %c %c %c %c\n",
+ addr[0], addr[PMD_SIZE - 1], addr[PMD_SIZE], addr[2 * PMD_SIZE - 1]);
+ goto error;
+ } else {
+ //pr_info("check vmalloc_hugepage memory succeess\n");
+ }
+
+ /* unshare uva */
+ ret = ioctl_unshare(fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("sp unshare uva error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_unshare(fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("sp unshare hugepage uva error: %d\n", ret);
+ goto error;
+ }
+
+ /* kvfree */
+ ret = ioctl_vfree(fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vfree small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vfree(fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vfree huge page error: %d\n", ret);
+ goto error;
+ }
+
+ for (i = 0; i < TIMES; i++) {
+ /* unshare kva */
+ ret = ioctl_unshare(fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("sp_unshare kva return error: %d\n", ret);
+ goto error;
+ }
+
+ /* sp_free */
+ ret = ioctl_free(fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("sp_free return error: %d\n", ret);
+ goto error;
+ }
+ }
+
+ close_device(fd);
+ return 0;
+
+error:
+ close_device(fd);
+ return -1;
+}
+
+void *thread(void *arg)
+{
+ int ret;
+ //pr_info("enter thread, pid is %d, thread id is %lu\n\n", getpid(), pthread_self());
+
+ ret = thread_and_process_helper();
+ if (ret == 0) {
+ //pr_info("\nfinish running thread %lu\n", pthread_self());
+ pthread_exit((void *)0);
+ } else {
+ pr_info("\nthread %lu finish running with error\n", pthread_self());
+ pthread_exit((void *)1);
+ }
+}
+
+static int child_process()
+{
+ int fd, ret;
+ struct sp_add_group_info ag_info = {0};
+ pid_t pid = getpid();
+
+ //pr_info("enter process %d\n\n", pid);
+
+ fd = open_device();
+ if (fd < 0) {
+ return -1;
+ }
+
+ ag_info.pid = pid;
+ ag_info.spg_id = GROUP_ID;
+ ag_info.prot = PROT_READ | PROT_WRITE;
+ ret = ioctl_add_group(fd, &ag_info);
+ if (ret < 0) {
+ close_device(fd);
+ return -1;
+ }
+
+ //pr_info("ioctl add group pid is %d, spg_id is %d\n", pid, ag_info.spg_id);
+ ret = thread_and_process_helper();
+
+ close_device(fd);
+ if (ret == 0) {
+ //pr_info("\nfinish running process %d\n", pid);
+ return 0;
+ } else {
+ pr_info("\nprocess %d finish running with error\n", pid);
+ return -1;
+ }
+ return 0;
+}
+
+static int testcase1(void) {
+ int fd;
+ int ret = 0;
+ int status = 0;
+ int sleep_interval = 3;
+ int i, j, k;
+ struct sp_add_group_info ag_info = {0};
+ pthread_t tid[THREAD_NUM];
+ void *tret;
+ pid_t pid_child;
+ pid_t childs[PROCESS_NUM];
+
+ // 创建15个线程，执行单k2task任务。重复创建5次。
+ pr_info("\nmain process begins thread_k2u_task test\n");
+ for (i = 0; i < REPEAT_TIMES; i++) {
+ pr_info("thread k2task %dth test, %d times in total.", i + 1, REPEAT_TIMES);
+ for (j = 0; j < THREAD_NUM; j++) {
+ ret = pthread_create(tid + j, NULL, thread_k2u_task, NULL);
+ if (ret != 0) {
+ pr_info("create thread %d error\n", j);
+ goto finish;
+ }
+ }
+ for (j = 0; j < THREAD_NUM; j++) {
+ ret = pthread_join(tid[j], &tret);
+ if (ret != 0) {
+ pr_info("can't join thread %d\n", j);
+ }
+ if ((long)tret != 0) {
+ pr_info("testcase execution failed, thread %d exited unexpectedly\n", j);
+ ret = -1;
+ }
+ }
+ sleep(sleep_interval);
+ }
+ if (ret) {
+ goto finish;
+ }
+ pr_info("\nthread_k2task test success!!\n");
+ sleep(3);
+
+ fd = open_device();
+ if (fd < 0) {
+ pr_info("open fd error\n");
+ return NULL;
+ }
+
+ // add group
+ pid_t pid = getpid();
+ ag_info.pid = pid;
+ ag_info.spg_id = GROUP_ID;
+ ag_info.prot = PROT_READ | PROT_WRITE;
+ ret = ioctl_add_group(fd, &ag_info);
+ if (ret < 0) {
+ pr_info("add group failed, errno: %d", ret);
+ close_device(fd);
+ return -1;
+ }
+ pr_info("\nioctl add group pid is %d, spg_id is %d\n", pid, ag_info.spg_id);
+
+ // 创建15个线程，执行u2k+k2u混合任务。重复创建5次。
+ pr_info("\nmain process begins thread test\n");
+ for (i = 0; i < REPEAT_TIMES; i++) {
+ pr_info("thread u2k+k2u %dth test, %d times in total.", i + 1, REPEAT_TIMES);
+ for (j = 0; j < THREAD_NUM; j++) {
+ ret = pthread_create(tid + j, NULL, thread, NULL);
+ if (ret != 0) {
+ pr_info("create thread error\n");
+ ret = -1;
+ goto finish;
+ }
+ }
+
+ for (j = 0; j < THREAD_NUM; j++) {
+ ret = pthread_join(tid[j], &tret);
+ if (ret != 0) {
+ pr_info("can't join thread %d\n", j);
+ }
+ if ((long)tret != 0) {
+ pr_info("testcase execution failed, thread %d exited unexpectedly\n", j);
+ }
+ }
+
+ sleep(sleep_interval);
+ }
+ if (ret) {
+ goto finish;
+ }
+ pr_info("\nthread u2k+k2u test success!!\n");
+ sleep(3);
+
+ // 创建15个进程，执行u2k+k2u混合任务。重复创建5次。
+ pr_info("\nmain process begins process test\n");
+ for (i = 0; i < REPEAT_TIMES; i++) {
+ pr_info("process u2k+k2u %dth test, %d times in total.", i + 1, REPEAT_TIMES);
+ for (j = 0; j < PROCESS_NUM; j++) {
+ pid_t pid_child = fork();
+ if (pid_child < 0) {
+ pr_info("fork failed, error %d", pid_child);
+ exit(-1);
+ } else if (pid_child == 0) {
+ ret = child_process();
+ exit(ret);
+ } else {
+ childs[j] = pid_child;
+ pr_info("fork child%d, pid: %d", j, pid_child);
+ }
+ }
+
+ for (int j = 0; j < PROCESS_NUM; j++) {
+ waitpid(childs[j], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d test failed, %d", j, status);
+ ret = -1;
+ }
+ }
+
+ sleep(sleep_interval);
+ }
+ if (ret) {
+ goto finish;
+ }
+ pr_info("\nprocess u2k+k2u test success!!\n");
+ sleep(3);
+
+ // 创建15个进程和15个线程，执行u2k+k2u混合任务。重复创建5次。
+ pr_info("\nmain process begins process and thread mix test\n");
+ for (i = 0; i < REPEAT_TIMES; i++) {
+ pr_info("process+thread u2k+k2u %dth test, %d times in total.", i + 1, REPEAT_TIMES);
+ for (j = 0; j < THREAD_NUM; j++) {
+ ret = pthread_create(tid + j, NULL, thread, NULL);
+ if (ret != 0) {
+ pr_info("create thread error\n");
+ ret = -1;
+ goto finish;
+ }
+ }
+
+ for (k = 0; k < PROCESS_NUM; k++) {
+ pid_t pid_child = fork();
+ if (pid_child < 0) {
+ pr_info("fork failed, error %d", pid_child);
+ exit(-1);
+ } else if (pid_child == 0) {
+ ret = child_process();
+ exit(ret);
+ } else {
+ childs[k] = pid_child;
+ pr_info("fork child%d, pid: %d", k, pid_child);
+ }
+ }
+
+ for (j = 0; j < THREAD_NUM; j++) {
+ ret = pthread_join(tid[j], &tret);
+ if (ret != 0) {
+ pr_info("can't join thread %d\n", j);
+ }
+ if ((long)tret != 0) {
+ pr_info("testcase execution failed, thread %d exited unexpectedly\n", j);
+ ret = -1;
+ }
+ }
+
+ for (int k = 0; k < PROCESS_NUM; k++) {
+ waitpid(childs[k], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d test failed, %d", k, status);
+ ret = -1;
+ }
+ }
+
+ sleep(sleep_interval);
+ }
+ pr_info("\nprocess+thread u2k+k2u test success!!\n");
+ sleep(3);
+
+finish:
+ if (!ret) {
+ pr_info("testcase execution is successful\n");
+ } else {
+ pr_info("testcase execution failed\n");
+ }
+ return 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "多进程/多线程循环执行alloc - u2k - vmalloc - k2u - unshare - vfree - unshare - free（大页/小页/dvpp）")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_statistics_stress.c b/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_statistics_stress.c
new file mode 100644
index 000000000000..00da4ca55ac0
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_debug_test/test_statistics_stress.c
@@ -0,0 +1,302 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Nov 20 01:38:40 2020
+ */
+
+#include <errno.h>
+#include <fcntl.h> /* For O_* constants */
+#include <semaphore.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h> /* For mode constants */
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+static int semid;
+#define PROC_NUM 1023
+#define GROUP_NUM 2999
+
+// 进程加入2999个共享组，申请dvpp内存，查看spa_stat，预期成功
+static int testcase1(void)
+{
+ int ret = 0, i, spg_id;
+ struct sp_alloc_info alloc_info[GROUP_NUM + 1];
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ };
+
+ // 再加入2999个共享组并申请内存
+ for (i = 0; i < GROUP_NUM + 1; i++) {
+ alloc_info[i].flag = SP_DVPP | SP_HUGEPAGE,
+ alloc_info[i].size = 4,
+ alloc_info[i].spg_id = i;
+ /* 1、用户态进程A加组 */
+ if (i != 0) {
+ ag_info.spg_id = i;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group, ret: %d, errno: %d", ret, errno);
+ return -1;
+ }
+ }
+ /* 2、申请DVPP共享内存 */
+ ret = ioctl_alloc(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return -1;
+ }
+ }
+
+ pr_info("Alloc DVPP memory finished.\n");
+
+ // 打印/proc/sharepool/spa_stat
+ cat_attr("/proc/sharepool/spa_stat");
+ sleep(6);
+
+ // 释放所有申请的内存
+ for (i = 0; i < GROUP_NUM + 1; i++) {
+ ret = ioctl_free(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("free group failed, errno: %d", errno);
+ return -1;
+ }
+ }
+ pr_info("Free DVPP memory finished.\n");
+
+ // 再次打印/proc/sharepool/spa_stat
+ cat_attr("/proc/sharepool/spa_stat");
+ sleep(3);
+
+ return 0;
+}
+
+static int addgroup(int index)
+{
+ int ret = 0;
+ unsigned long addr;
+ unsigned long size = 4096;
+
+ for (int i = 1; i < GROUP_NUM + 1; i++) {
+ /* 1、用户态进程A加组 */
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, i);
+ if (ret < 0) {
+ pr_info("process %d failed add group %d, ret: %d, errno: %d",
+ getpid(), i, ret, errno);
+ sem_inc_by_one(semid);
+ return -1;
+ }
+ }
+ pr_info("process %d add %d groups succecss", index, GROUP_NUM);
+ sem_inc_by_one(semid);
+ while (1) {
+
+ }
+
+ return 0;
+}
+
+
+//#define PROC_NUM 1023
+//#define GROUP_NUM 2999
+
+/* N个进程加入2999个组，申请dvpp内存，打印proc_stat，预期成功
+ * N不要取太大 导致速度慢 */
+static int testcase2(void)
+{
+ int ret = 0, spg_id = 1;
+ struct sp_alloc_info alloc_info[GROUP_NUM];
+ pid_t child[PROC_NUM];
+ unsigned long size = 4096;
+ int proc_num = 1000;
+
+ semid = sem_create(2345, "wait all child add group finish");
+ // N-1个子进程加组
+ for (int i = 0; i < proc_num - 1; i++)
+ FORK_CHILD_ARGS(child[i], addgroup(i));
+ sem_dec_by_val(semid, proc_num - 1);
+ pr_info("add child proc to all groups finished.\n");
+
+ // 测试进程加组后申请
+ for (int i = 1; i < GROUP_NUM + 1; i++) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, i);
+ if (ret < 0)
+ goto out;
+ }
+ ret = 0;
+ pr_info("add main proc to all groups finished.\n");
+
+ for (int i = 1; i < GROUP_NUM + 1; i++) {
+ wrap_sp_alloc(i, size, SP_DVPP);
+ }
+ pr_info("main proc alloc in all groups success");
+
+ // 等一下让所有进程都映射到内存
+ pr_info("Let groups map memory to all childs...");
+ sleep(5);
+
+ // 打印/proc/sharepool/proc_stat
+ cat_attr("/proc/sharepool/proc_stat");
+
+ for (int i = 0; i < proc_num; i++)
+ KILL_CHILD(child[i]);
+
+ sleep(5);
+ // 再次打印/proc/sharepool/proc_stat
+ cat_attr("/proc/sharepool/proc_stat");
+
+out:
+ sem_close(semid);
+ return ret;
+}
+
+/* 1023个进程加入1个共享组，申请dvpp内存，打印proc_overview，预期成功 */
+static int testcase3(void)
+{
+ int ret, spg_id = 1;
+ unsigned long addr;
+ pid_t child[PROC_NUM];
+ pid_t pid;
+ unsigned long size = 4096;
+
+ semid = sem_create(1234, "1023childs");
+
+ // N个子进程
+ for (int i = 0; i < PROC_NUM; i++) {
+ pid = fork();
+ if (pid == 0) {
+ /* 子进程加组 */
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, spg_id);
+ if (ret < 0) {
+ pr_info("child %d add group failed!", i);
+ sem_inc_by_one(semid);
+ exit(-1);
+ }
+ /* 子进程申请内存 */
+ if (i == 0) {
+ addr = (unsigned long)wrap_sp_alloc(spg_id, size, SP_DVPP);
+ if (addr == -1) {
+ pr_info("child %d alloc dvpp memory failed!", i);
+ sem_inc_by_one(semid);
+ exit(-1);
+ }
+ }
+ sem_inc_by_one(semid);
+ pr_info("child %d created success!", i + 1);
+ /* 子进程idle */
+ while (1) {
+
+ }
+ exit(0);
+ }
+ child[i] = pid;
+ }
+
+ /* 等待所有N个子进程加组 */
+ sem_dec_by_val(semid, PROC_NUM);
+ sleep(8);
+ /* 打印统计信息，预期看到N个进程，且每个进程显示SP_RES是size */
+ cat_attr("/proc/sharepool/proc_overview");
+
+ /* 杀掉子进程 */
+ for (int i = 0; i < PROC_NUM; i++) {
+ KILL_CHILD(child[i]);
+ pr_info("child %d killed", i + 1);
+ }
+ pr_info("All child process killed.\n");
+
+ // 再次打印/proc/sharepool/proc_overview，预期啥也没有
+ cat_attr("/proc/sharepool/proc_overview");
+ sleep(5);
+
+ sem_close(semid);
+ return 0;
+}
+
+// 进程加入2999个共享组，申请dvpp内存，查看spa_stat，预期成功
+static int testcase4(void)
+{
+ int ret = 0, i, spg_id;
+ char attr[SIZE];
+ char cpid[SIZE];
+ struct sp_alloc_info alloc_info[GROUP_NUM + 1];
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ };
+
+ // 再加入2999个共享组并申请内存
+ for (i = 0; i < GROUP_NUM + 1; i++) {
+ alloc_info[i].flag = SP_DVPP | SP_HUGEPAGE,
+ alloc_info[i].size = 4,
+ alloc_info[i].spg_id = i;
+ /* 1、用户态进程A加组 */
+ if (i != 0) {
+ ag_info.spg_id = i;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("failed add group, ret: %d, errno: %d", ret, errno);
+ return -1;
+ }
+ }
+ /* 2、申请DVPP共享内存 */
+ ret = ioctl_alloc(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return -1;
+ }
+ }
+
+ pr_info("Alloc DVPP memory finished.\n");
+ sleep(6);
+
+ // 打印/proc/sharepool/spa_stat
+ strcat(attr, "/proc/");
+ sprintf(cpid, "%d", getpid());
+ strcat(attr, cpid);
+ strcat(attr, "/sp_group");
+ pr_info("attribute is %s", attr);
+ cat_attr(attr);
+
+ // 释放所有申请的内存
+ for (i = 0; i < GROUP_NUM + 1; i++) {
+ ret = ioctl_free(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("free group failed, errno: %d", errno);
+ return -1;
+ }
+ }
+ pr_info("Free DVPP memory finished.\n");
+ sleep(3);
+
+ // 再次打印/proc/sharepool/spa_stat
+ cat_attr(attr);
+
+ return 0;
+}
+
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "同一进程加入2999个共享组并申请dvpp共享内存，cat /proc/sharepool/spa_stat查看内存申请，预期打印正常。")
+ TESTCASE_CHILD(testcase2, "多个进程加入2999个共享组并申请dvpp共享内存，cat /proc/sharepool/proc_stat查看内存申请，预期打印可能出现softlockup，等待一会儿后打印完成。")
+ TESTCASE_CHILD(testcase3, "1023个进程加入同个共享组并申请dvpp共享内存，cat /proc/sharepool/proc_overview查看内存申请，预期打印正常。")
+ TESTCASE_CHILD(testcase4, "同一进程加入2999个共享组并申请dvpp共享内存，cat /proc/进程号/sp_group查看内存申请，预期打印正常。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/Makefile b/tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/Makefile
new file mode 100644
index 000000000000..9a2b520d1b5f
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/test_mult_process
+
+clean:
+ rm -rf $(testcases)
\ No newline at end of file
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/test_mult_k2u.c b/tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/test_mult_k2u.c
new file mode 100644
index 000000000000..1d7ff1116631
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/test_mult_k2u.c
@@ -0,0 +1,855 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Nov 30 02:09:42 2020
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <pthread.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/shm.h>
+#include <sys/sem.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include "sem_use.h"
+
+#include "sharepool_lib.h"
+
+
+
+/*
+ * 内核分配共享内存后，调用k2u共享到同一个用户态进程，进程中多线程通过uva并发读。
+ */
+#define TEST1_THREAD_NUM 100
+#define TEST1_K2U_NUM 100
+static struct sp_make_share_info testcase1_k2u_info[TEST1_K2U_NUM];
+
+static void *testcase1_thread(void *arg)
+{
+ for (int i = 0; i < TEST1_K2U_NUM; i++) {
+ char *buf = (char *)testcase1_k2u_info[i].addr;
+ for (int j = 0; j < testcase1_k2u_info[i].size; j++)
+ if (buf[j] != 'm') {
+ pr_info("area check failed, i:%d, j:%d, buf[j]:%d", i, j, buf[j]);
+ return (void *)-1;
+ }
+ }
+
+ return NULL;
+}
+
+static int testcase1(void)
+{
+ int ret, i, j;
+ void *thread_ret = NULL;
+ pthread_t threads[TEST1_THREAD_NUM];
+
+ struct vmalloc_info ka_info = {
+ .size = 3 * PAGE_SIZE,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("ioctl_vmalloc failed");
+ return -1;
+ };
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'm',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ goto out_free;
+ }
+
+ for (i = 0; i < TEST1_K2U_NUM; i++) {
+ testcase1_k2u_info[i].kva = ka_info.addr,
+ testcase1_k2u_info[i].size = ka_info.size,
+ testcase1_k2u_info[i].spg_id = SPG_ID_DEFAULT,
+ testcase1_k2u_info[i].sp_flags = 0,
+ testcase1_k2u_info[i].pid = getpid(),
+
+ ret = ioctl_k2u(dev_fd, testcase1_k2u_info + i);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ goto out_unshare;
+ }
+ }
+
+ for (j = 0; j < TEST1_THREAD_NUM; j++) {
+ ret = pthread_create(threads + j, NULL, testcase1_thread, NULL);
+ if (ret < 0) {
+ pr_info("pthread create failed");
+ goto out_pthread_join;
+ }
+ }
+
+out_pthread_join:
+ for (j--; j >= 0; j--) {
+ pthread_join(threads[j], &thread_ret);
+ if (thread_ret != NULL) {
+ pr_info("child thread%d exited unexpected", j + 1);
+ ret = -1;
+ }
+ }
+out_unshare:
+ for (i--; i >= 0; i--)
+ if (ioctl_unshare(dev_fd, testcase1_k2u_info + i) < 0) {
+ pr_info("ioctl_unshare failed");
+ ret = -1;
+ }
+out_free:
+ ioctl_vfree(dev_fd, &ka_info);
+
+ return ret < 0 ? -1 : 0;
+}
+
+/*
+ * 内核分配共享内存后，调用k2u共享到一个共享组（该组有大量进程），该共享组所有进程通过uva并发读写。
+ */
+#define TEST2_CHILD_NUM 100
+#define TEST2_SEM_KEY 98224
+#define TEST2_SHM_KEY 98229
+#define TEST2_K2U_NUM 100
+
+static int testcase2_shmid;
+static int testcase2_semid;
+
+static int testcase2_child(int idx)
+{
+ int ret = 0;
+
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = -1,
+ .sem_flg = 0,
+ };
+ semop(testcase2_semid, &sembuf, 1);
+
+ struct sp_make_share_info *k2u_info = shmat(testcase2_shmid, NULL, 0);
+ if (k2u_info == (void *)-1) {
+ pr_info("child%d, shmat failed, errno: %d", idx, errno);
+ ret = -1;
+ goto out;
+ }
+
+ for (int i = 0; i < TEST2_K2U_NUM; i++) {
+ char *buf = (char *)k2u_info[i].addr;
+ for (int j = 0; j < k2u_info[i].size; j++) {
+ if (buf[j] != 'e') {
+ pr_info("child%d, area check failed, i:%d, j:%d, buf[j]:%d", idx, i, j, buf[j]);
+ ret = -1;
+ goto out;
+ }
+ }
+ }
+
+out:
+ semop(testcase2_semid, &sembuf, 1);
+
+ return ret;
+}
+
+static pid_t fork_and_add_group(int idx, int group_id, int (*child)(int))
+{
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(child(idx));
+ }
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+ return -1;
+ } else
+ return pid;
+}
+
+static int testcase2(void)
+{
+ int group_id = 20;
+ int ret, i, j, status;
+ pid_t child[TEST2_CHILD_NUM];
+
+ struct vmalloc_info ka_info = {
+ .size = 3 * PAGE_SIZE,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("ioctl_vmalloc failed");
+ return -1;
+ };
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ goto out_free;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'e',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ goto out_free;
+ }
+
+ testcase2_semid = semget(TEST2_SEM_KEY, 1, IPC_CREAT | 0644);
+ if (testcase2_semid < 0) {
+ pr_info("open systemV semaphore failed, errno: %s", strerror(errno));
+ ret = -1;
+ goto out_free;
+ }
+
+ ret = semctl(testcase2_semid, 0, SETVAL, 0);
+ if (ret < 0) {
+ pr_info("sem setval failed, %s", strerror(errno));
+ goto sem_remove;
+ }
+
+ testcase2_shmid = shmget(TEST2_SHM_KEY, sizeof(struct sp_make_share_info) * TEST2_K2U_NUM,
+ IPC_CREAT | 0666);
+ if (testcase2_shmid < 0) {
+ pr_info("shmget failed, errno: %s", strerror(errno));
+ ret = -1;
+ goto sem_remove;
+ }
+
+ struct sp_make_share_info *k2u_info = shmat(testcase2_shmid, NULL, 0);
+ if (k2u_info == (void *)-1) {
+ pr_info("shmat failed, errno: %d", errno);
+ ret = -1;
+ goto shm_remove;
+ }
+
+ for (i = 0; i < TEST2_CHILD_NUM; i++) {
+ child[i] = fork_and_add_group(i, group_id, testcase2_child);
+ if (child[i] < 0) {
+ pr_info("fork child failed");
+ ret = -1;
+ goto kill_child;
+ }
+ }
+
+ for (j = 0; j < TEST2_K2U_NUM; j++) {
+ k2u_info[j].kva = ka_info.addr,
+ k2u_info[j].size = ka_info.size,
+ k2u_info[j].spg_id = group_id,
+ k2u_info[j].sp_flags = 0,
+ k2u_info[j].pid = getpid(),
+
+ ret = ioctl_k2u(dev_fd, k2u_info + j);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ goto out_unshare;
+ }
+ }
+
+ // 通知子进程开始读取内存
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = TEST2_CHILD_NUM * 2,
+ .sem_flg = 0,
+ };
+ semop(testcase2_semid, &sembuf, 1);
+
+ // 等待子进程读内存完成
+ sembuf.sem_op = 0;
+ semop(testcase2_semid, &sembuf, 1);
+
+out_unshare:
+ for (j--; j >= 0; j--)
+ if (ioctl_unshare(dev_fd, k2u_info + j) < 0) {
+ pr_info("ioctl_unshare failed");
+ ret = -1;
+ }
+kill_child:
+ for (i--; i >= 0; i--) {
+ kill(child[i], SIGKILL);
+ waitpid(child[i], &status, 0);
+ if (!ret) {
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d exited unexpected", i);
+ ret = -1;
+ }
+ }
+ }
+shm_remove:
+ if (shmctl(testcase2_shmid, IPC_RMID, NULL) < 0)
+ pr_info("shm remove failed, %s", strerror(errno));
+sem_remove:
+ if (semctl(testcase2_semid, 0, IPC_RMID) < 0)
+ pr_info("sem remove failed, %s", strerror(errno));
+out_free:
+ ioctl_vfree(dev_fd, &ka_info);
+
+ return ret < 0 ? -1 : 0;
+}
+
+/*
+ * 内核并发分配多个共享内存并调用k2u将内存都共享到同一个用户态进程，
+ * 该进程通过多个uva分别读写。（观察是否有内存泄漏）
+ */
+#define TEST3_THREAD_NUM 100
+#define TEST3_K2U_NUM 80
+static struct sp_make_share_info testcase3_k2u_info[TEST3_THREAD_NUM][TEST3_K2U_NUM];
+static struct vmalloc_info testcase3_ka_info[TEST3_THREAD_NUM];
+
+#define TEST3_SEM_KEY 88224
+static int testcase3_semid;
+
+static void *testcase3_thread(void *arg)
+{
+ int ret, i;
+ int idx = (int)arg;
+
+ sem_dec_by_one(testcase3_semid);
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = idx,
+ .addr = testcase3_ka_info[idx].addr,
+ .size = testcase3_ka_info[idx].size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ goto out;
+ }
+
+ for (i = 0; i < TEST3_K2U_NUM; i++) {
+ testcase3_k2u_info[idx][i].kva = testcase3_ka_info[idx].addr;
+ testcase3_k2u_info[idx][i].size = testcase3_ka_info[idx].size;
+ testcase3_k2u_info[idx][i].spg_id = SPG_ID_DEFAULT;
+ testcase3_k2u_info[idx][i].sp_flags = 0;
+ testcase3_k2u_info[idx][i].pid = getpid();
+
+ ret = ioctl_k2u(dev_fd, testcase3_k2u_info[idx] + i);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ goto out_unshare;
+ }
+ }
+
+ return NULL;
+
+out_unshare:
+ for (i--; i >= 0; i--)
+ if (ioctl_unshare(dev_fd, testcase3_k2u_info[idx] + i) < 0) {
+ pr_info("ioctl_unshare failed");
+ ret = -1;
+ }
+out:
+ return (void *)-1;
+}
+
+int tc3_vmalloc(void)
+{
+ int ret = 0;
+ int i = 0;
+
+ memset(testcase3_ka_info, 0, sizeof(struct vmalloc_info) * TEST3_THREAD_NUM);
+
+ for (i = 0; i < TEST3_THREAD_NUM; i++) {
+ testcase3_ka_info[i].size = 3 * PAGE_SIZE;
+ if (ioctl_vmalloc(dev_fd, testcase3_ka_info + i) < 0)
+ goto vfree;
+ }
+ return 0;
+
+vfree:
+ for (i--; i >= 0; i--)
+ ioctl_vfree(dev_fd, testcase3_ka_info + i);
+ return -1;
+}
+
+static int testcase3(void)
+{
+ int ret, thread_idx;
+ void *thread_ret = NULL;
+ pthread_t threads[TEST3_THREAD_NUM];
+
+ /* 创建sem */
+ testcase3_semid = sem_create(TEST3_SEM_KEY, "key");
+
+ /* 主进程vmalloc */
+ if (tc3_vmalloc()) {
+ pr_info("ioctl_vmalloc failed");
+ goto out_remove_sem;
+ }
+
+ /* 子进程kick start */
+ for (thread_idx = 0; thread_idx < TEST3_THREAD_NUM; thread_idx++) {
+ ret = pthread_create(threads + thread_idx, NULL, testcase3_thread, (void *)thread_idx);
+ if (ret < 0) {
+ pr_info("pthread create failed");
+ goto out_pthread_join;
+ }
+ }
+ sem_inc_by_val(testcase3_semid, TEST3_THREAD_NUM);
+
+ /* 等待子进程退出 */
+out_pthread_join:
+ for (thread_idx--; thread_idx >= 0; thread_idx--) {
+ if (ret < 0) {
+ pthread_kill(threads[thread_idx], SIGKILL);
+ pthread_join(threads[thread_idx], NULL);
+ } else {
+ pthread_join(threads[thread_idx], &thread_ret);
+ if (thread_ret != NULL) {
+ pr_info("child thread%d exited unexpected", thread_idx + 1);
+ ret = -1;
+ }
+ }
+ }
+
+ /* 主进程进行k2u的值校验和unshare */
+ for (int i = 0; i < TEST3_THREAD_NUM; i++) {
+ for (int k = 0; k < TEST3_K2U_NUM; k++) {
+ char *buf = (char *)testcase3_k2u_info[i][k].addr;
+ for (int j = 0; j < testcase3_k2u_info[i][k].size; j++)
+ if (!ret && buf[j] != i) {
+ pr_info("area check failed, i:%d, j:%d, buf[j]:%d", i, j, buf[j]);
+ ret = -1;
+ }
+ if (ioctl_unshare(dev_fd, testcase3_k2u_info[i] + k) < 0) {
+ pr_info("ioctl_unshare failed, i:%d, k:%d, addr:0x%lx",
+ i, k, testcase3_k2u_info[i][k].addr);
+ ret = -1;
+ }
+ }
+ }
+
+ /* 主进程vfree */
+ for (int i = 0; i < TEST3_THREAD_NUM; i++)
+ ioctl_vfree(dev_fd, testcase3_ka_info + i);
+
+out_remove_sem:
+ if (sem_close(testcase3_semid) < 0)
+ pr_info("sem setval failed, %s", strerror(errno));
+
+ return ret < 0 ? -1 : 0;
+}
+
+/*
+ * 多组多进程，并发调用k2u到group，进程读内存，退出
+ * 每组多进程，每进程申请多次vmalloc内存，每次申请的内存做多次k2u映射
+ * 同一组的进程通过所有的映射内存进行读操作，
+ * 然后owner进程执行写操作，其他所有进程和内核执行读操作（check成功）
+ *
+ * 同一组内的进程通过systemV共享内存共享数据，通过systemV信号量同步
+ */
+#define MAX_PROC_NUM 100
+#define GROUP_NUM 2
+#define PROC_NUM 10 //不能超过100
+#define ALLOC_NUM 11
+#define K2U_NUM 12
+#define TEST4_SHM_KEY_BASE 10240
+#define TEST4_SEM_KEY_BASE 10840
+
+static int shmids[GROUP_NUM];
+static int semids[GROUP_NUM];
+
+struct testcase4_shmbuf {
+ struct vmalloc_info ka_infos[PROC_NUM][ALLOC_NUM]; //ka_infos[10][11]
+ struct sp_make_share_info
+ k2u_infos[PROC_NUM][ALLOC_NUM][K2U_NUM]; // k2u_infos[10][11][12]
+};
+
+static void testcase4_vfree_and_unshare(struct vmalloc_info *ka_infos,
+ struct sp_make_share_info (*k2u_infos)[K2U_NUM], int group_idx, int proc_idx)
+{
+ for (int i = 0; i < ALLOC_NUM && ka_infos[i].addr; i++) {
+ for (int j = 0; j < K2U_NUM && k2u_infos[i][j].addr; j++) {
+ if (ioctl_unshare(dev_fd, k2u_infos[i] + j))
+ pr_info("ioctl unshare failed, errno: %d", errno);
+ k2u_infos[i][j].addr = 0;
+ }
+ if (ioctl_vfree(dev_fd, ka_infos + i))
+ pr_info("ioctl vfree failed, errno: %d", errno);
+ ka_infos[i].addr = 0;
+ }
+}
+
+static void testcase4_vfree_and_unshare_all(struct testcase4_shmbuf *shmbuf)
+{
+ pr_info("this is %s", __FUNCTION__);
+ for (int i = 0; i < PROC_NUM; i++)
+ testcase4_vfree_and_unshare(shmbuf->ka_infos[i], shmbuf->k2u_infos[i], -1, -1);
+}
+
+static int testcase4_check_memory(struct sp_make_share_info
+ k2u_infos[ALLOC_NUM][K2U_NUM],
+ char offset, int group_idx, int proc_idx)
+{
+ for (int j = 0; j < ALLOC_NUM; j++) {
+ char expect = offset + j;
+ for (int k = 0; k < K2U_NUM; k++) {
+ char *buf = (char *)k2u_infos[j][k].addr;
+ for (int l = 0; l < k2u_infos[j][k].size; l++)
+ if (buf[l] != expect) {
+ pr_info("memory check failed");
+ return -1;
+ }
+ }
+ }
+ return 0;
+}
+
+static int testcase4_check_memory_all(struct sp_make_share_info
+ (*k2u_infos)[ALLOC_NUM][K2U_NUM],
+ char offset)
+{
+
+ for (int i = 0; i < PROC_NUM; i++) {
+ for (int j = 0; j < ALLOC_NUM; j++) {
+ char expect = offset + j;
+ for (int k = 0; k < K2U_NUM; k++) {
+ char *buf = (char *)k2u_infos[i][j][k].addr;
+ for (int l = 0; l < k2u_infos[i][j][k].size; l++)
+ if (buf[l] != expect) {
+ pr_info("memory check failed");
+ return -1;
+ }
+ }
+ }
+ }
+
+ return 0;
+}
+
+static void testcase4_set_memory(struct sp_make_share_info
+ (*k2u_infos)[ALLOC_NUM][K2U_NUM])
+{
+ for (int i = 0; i < PROC_NUM; i++)
+ for (int j = 0; j < ALLOC_NUM; j++) {
+ char *buf = (char *)k2u_infos[i][j][0].addr;
+ for (int l = 0; l < k2u_infos[i][j][0].size; l++)
+ buf[l]++;
+ }
+}
+
+#if 0
+#define ERRPR(fun, name, idx) \
+do { \
+ int ret = fun; \
+ if (ret < 0) \
+ pr_info(#fun "failed: %s", strerror(errno)); \
+ else \
+ pr_info(name "%d, " #fun "success", idx); \
+} while (0)
+#else
+#define ERRPR(fun, name, idx) fun
+#endif
+
+static int testcase4_grandchild(int idx)
+{
+
+ int ret, i, j;
+ int proc_idx = idx % MAX_PROC_NUM; // 0, 1, 2, ..., 9
+ int group_idx = idx / MAX_PROC_NUM - 1; // 0/1/2/3
+ int group_id = (group_idx + 1) * MAX_PROC_NUM; // 100/200/300/400
+ int semid = semids[group_idx];
+ int shmid = shmids[group_idx];
+
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = -1,
+ .sem_flg = 0,
+ };
+ ERRPR(semop(semid, &sembuf, 1), "grandchild", idx);
+
+ struct testcase4_shmbuf *shmbuf = shmat(shmid, NULL, 0);
+ if (shmbuf == (void *)-1) {
+ pr_info("grandchild%d, shmat failed, errno: %d", idx, errno);
+ ret = -1;
+ goto error_out;
+ }
+
+ // 申请内存，k2group
+ struct vmalloc_info *ka_info = shmbuf->ka_infos[proc_idx];
+ struct sp_make_share_info (*k2u_info)[K2U_NUM] = shmbuf->k2u_infos[proc_idx];
+ for (i = 0; i < ALLOC_NUM; i++) {
+ ka_info[i].size = 3 * PAGE_SIZE;
+ ret = ioctl_vmalloc(dev_fd, ka_info + i);
+ if (ret < 0) {
+ pr_info("ioctl_vmalloc failed");
+ ret = -1;
+ goto out_unshare;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = i + 'A',
+ .addr = ka_info[i].addr,
+ .size = ka_info[i].size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ goto out_unshare;
+ }
+
+ for (j = 0; j < K2U_NUM; j++) {
+ k2u_info[i][j].kva = ka_info[i].addr;
+ k2u_info[i][j].size = ka_info[i].size;
+ k2u_info[i][j].spg_id = group_id;
+ k2u_info[i][j].sp_flags = 0;
+ k2u_info[i][j].pid = getppid();
+
+ ret = ioctl_k2u(dev_fd, k2u_info[i] + j);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ goto out_unshare;
+ }
+ }
+ }
+
+ // 信号量减一，通知vmalloc和k2u完成
+ ERRPR(semop(semid, &sembuf, 1), "grandchild", idx);
+ // 等待信号量变为0（所有子进程k2u完成）
+ sembuf.sem_op = 0;
+ ERRPR(semop(semid, &sembuf, 1), "grandchild", idx);
+ // 所有子进程和父进程开始读内存，进行check
+ ret = testcase4_check_memory(shmbuf->k2u_infos[proc_idx], 'A', group_idx, proc_idx);
+ // 本进程check完，通知父进程，信号量减一
+ sembuf.sem_op = -1;
+ ERRPR(semop(semid, &sembuf, 1), "grandchild", idx);
+ // 等待信号量为0（所有进程check完毕）
+ sembuf.sem_op = 0;
+ ERRPR(semop(semid, &sembuf, 1), "grandchild", idx);
+ // 等待父进程写内存完毕
+ sembuf.sem_op = -1;
+ ERRPR(semop(semid, &sembuf, 1), "grandchild", idx);
+ // 所有子进程check内存
+ if (!ret)
+ ret = testcase4_check_memory(shmbuf->k2u_infos[proc_idx], 'A' + 1, group_idx, proc_idx);
+ if (ret < 0)
+ pr_info("child %d grandchild %d check_memory('A' + 1) failed", group_idx, proc_idx);
+ else
+ pr_info("child %d grandchild %d check_memory('A' + 1) success", group_idx, proc_idx);
+ // 通知父进程子进程check内存完毕
+ ERRPR(semop(semid, &sembuf, 1), "grandchild", idx);
+ testcase4_vfree_and_unshare(ka_info, k2u_info, group_idx, proc_idx);
+ return ret;
+
+out_unshare:
+ testcase4_vfree_and_unshare(ka_info, k2u_info, group_idx, proc_idx);
+error_out:
+ kill(getppid(), SIGKILL);
+ return -1;
+}
+
+static int testcase4_child(int idx)
+{
+ int ret, child_num, status;
+ //int group_id = (idx + 1) * 100; // spg_id = 100, 200, 300, 400
+ int group_id = (idx + 1) * MAX_PROC_NUM;
+ int semid = semids[idx];
+ int shmid = shmids[idx];
+ pid_t child[PROC_NUM]; // 10
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct testcase4_shmbuf *shmbuf = shmat(shmid, NULL, 0);
+ if (shmbuf == (void *)-1) {
+ pr_info("grandchild%d, shmat failed, errno: %d", idx, errno);
+ return -1;
+ }
+ memset(shmbuf, 0, sizeof(*shmbuf));
+
+ // 创建子进程并加组
+ for (child_num = 0; child_num < PROC_NUM; child_num++) {
+ child[child_num] = fork_and_add_group(group_id + child_num, group_id, testcase4_grandchild);
+ if (child[child_num] < 0) {
+ ret = -1;
+ goto kill_child;
+ }
+ }
+
+ // 通知子进程开始调用vmalloc，并且进行k2group
+ struct sembuf sembuf = {
+ .sem_num = 0,
+ .sem_op = PROC_NUM * 2,
+ .sem_flg = 0,
+ };
+ ERRPR(semop(semid, &sembuf, 1), "child", idx);
+ // 等待子进程完成
+ sembuf.sem_op = 0;
+ ERRPR(semop(semid, &sembuf, 1), "child", idx);
+ // 所有子进程和父进程开始读内存，进行check
+ ret = testcase4_check_memory_all(shmbuf->k2u_infos, 'A');
+ if (ret < 0)
+ goto unshare;
+ // 等待所有子进程读内存完成
+ sleep(1);
+ sembuf.sem_op = PROC_NUM;
+ ERRPR(semop(semid, &sembuf, 1), "child", idx);
+ sembuf.sem_op = 0;
+ ERRPR(semop(semid, &sembuf, 1), "child", idx);
+ // 写内存
+ testcase4_set_memory(shmbuf->k2u_infos);
+ // 通知子进程写内存完毕
+ sleep(1);
+ sembuf.sem_op = PROC_NUM * 2;
+ ERRPR(semop(semid, &sembuf, 1), "child", idx);
+ // 等待子进程读完
+ sembuf.sem_op = 0;
+ ERRPR(semop(semid, &sembuf, 1), "child", idx);
+
+ // 等待子进程退出
+ for (int i = 0; i < PROC_NUM; i++) {
+ int status;
+ waitpid(child[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d exited unexpected", i);
+ ret = -1;
+ }
+ child[i] = 0;
+ }
+
+ return 0;
+
+unshare:
+ testcase4_vfree_and_unshare_all(shmbuf);
+kill_child:
+ for (child_num--; child_num >= 0; child_num--) {
+ if (ret < 0) {
+ kill(child[child_num], SIGKILL);
+ waitpid(child[child_num], NULL, 0);
+ } else {
+ waitpid(child[child_num], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("grandchild%d exited unexpected", group_id + child_num);
+ ret = -1;
+ }
+ }
+ }
+
+ return ret < 0 ? -1 : 0;
+}
+
+static int testcase4(void)
+{
+ int ret = 0;
+
+ // init semaphores and shared memory areas
+ for (int i = 0; i < GROUP_NUM; shmids[i] = semids[i] = -1, i++);
+ for (int i = 0; i < GROUP_NUM; i++) {
+ semids[i] = semget(TEST4_SEM_KEY_BASE + i, 1, IPC_CREAT | 0644);
+ if (semids[i] < 0) {
+ pr_info("open systemV semaphore failed, errno: %s", strerror(errno));
+ ret = -1;
+ goto sem_remove;
+ }
+
+ ret = semctl(semids[i], 0, SETVAL, 0);
+ if (ret < 0) {
+ pr_info("sem setval failed, %s", strerror(errno));
+ ret = -1;
+ goto sem_remove;
+ }
+ }
+
+ for (int i = 0; i < GROUP_NUM; i++) {
+ shmids[i] = shmget(TEST4_SHM_KEY_BASE + i, sizeof(struct testcase4_shmbuf), IPC_CREAT | 0666);
+ if (shmids[i] < 0) {
+ pr_info("shmget failed, errno: %s", strerror(errno));
+ ret = -1;
+ goto shm_remove;
+ }
+ }
+
+ pid_t child[GROUP_NUM] = {0};
+ for (int i = 0; i < GROUP_NUM; i++) {
+ int group_id = i + 20;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("testcase4, group%d fork failed", group_id);
+ continue;
+ } else if (pid == 0) {
+ exit(testcase4_child(i));
+ }
+ child[i] = pid;
+ }
+
+ for (int i = 0; i < GROUP_NUM; i++) {
+ if (!child[i])
+ continue;
+
+ int status = 0;
+ waitpid(child[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("testcase4, child%d, exited unexpected", i);
+ ret = -1;
+ } else
+ pr_info("testcase4, child%d success!!", i);
+ }
+
+shm_remove:
+ for (int i = 0; semids[i] >= 0 && i < GROUP_NUM; i++)
+ if (shmctl(shmids[i], IPC_RMID, NULL) < 0)
+ pr_info("shm remove failed, %s", strerror(errno));
+sem_remove:
+ for (int i = 0; semids[i] >= 0 && i < GROUP_NUM; i++)
+ if (semctl(semids[i], 0, IPC_RMID) < 0)
+ pr_info("sem remove failed, %s", strerror(errno));
+
+ return ret;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "内核分配共享内存后，反复调用k2u共享到同一个用户态进程，该进程通过多个uva并发读写。")
+ TESTCASE_CHILD(testcase2, "内核分配共享内存后，反复调用k2u共享到一个共享组（该组有大量进程），该共享组所有进程通过uva并发读写。")
+ TESTCASE_CHILD(testcase3, "内核并发分配多个共享内存并调用k2u将内存都共享到同一个用户态进程， 该进程通过多个uva分别读写。")
+ TESTCASE_CHILD(testcase4, "内核并发分配多个共享内存并调用k2u将内存都共享到同一个共享组， 该共享组所有进程通过多个uva分别读写。")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/test_mult_pass_through.c b/tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/test_mult_pass_through.c
new file mode 100644
index 000000000000..775fc130c92d
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/test_mult_pass_through.c
@@ -0,0 +1,405 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Description:
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Feb 26 15:49:35 2021
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <pthread.h>
+#include <fcntl.h> /* For O_* constants */
+#include <semaphore.h>
+
+#include <sys/wait.h>
+#include <sys/types.h>
+#include <sys/ipc.h>
+#include <sys/sem.h>
+#include <sys/stat.h> /* For mode constants */
+
+#include "sem_use.h"
+#include "sharepool_lib.h"
+
+#define pr_info(fmt, args...) \
+ printf("[file:%s, func:%s, line:%d] " fmt "\n", __FILE__, __func__, __LINE__, ##args)
+
+#define REPEAT_TIMES 10
+#define TEST1_THREAD_NUM 20
+#define TEST2_ALLOC_TIMES 10
+#define TEST2_PROCESS_NUM 20
+#define TEST4_PROCESS_NUM 10
+#define TEST4_THREAD_NUM 10
+#define TEST4_RUN_TIME 200
+
+static int dev_fd;
+
+static void *testcase1_thread(void *arg)
+{
+ struct sp_alloc_info alloc_info = {0};
+ int ret;
+
+ alloc_info.flag = 0;
+ alloc_info.spg_id = SPG_ID_DEFAULT;
+ alloc_info.size = 4 * PAGE_SIZE;
+
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed, errno: %d", errno);
+ goto error;
+ }
+
+ pthread_exit((void *)0);
+
+error:
+ pthread_exit((void *)1);
+}
+
+/* 多线程未加组，一起做sp_alloc */
+static int testcase1(void)
+{
+ int ret, i, j;
+ void *thread_ret = NULL;
+ pthread_t threads[TEST1_THREAD_NUM];
+
+ int semid = sem_create(0xbcd996, "hello");
+ if (semid < 0) {
+ pr_info("open systemV semaphore failed, errno: %s", strerror(errno));
+ goto test1_out;
+ }
+
+ for (i = 0; i < REPEAT_TIMES; i++) {
+ pr_info("%s start times %d", __func__, i);
+ for (j = 0; j < TEST1_THREAD_NUM; j++) {
+ ret = pthread_create(threads + j, NULL, testcase1_thread, NULL);
+ if (ret < 0) {
+ pr_info("pthread create failed");
+ goto out_pthread_join;
+ }
+ }
+
+out_pthread_join:
+ for (j--; j >= 0; j--) {
+ pthread_join(threads[j], &thread_ret);
+ if (thread_ret != NULL) {
+ pr_info("child thread%d exited unexpected", j + 1);
+ ret = -1;
+ goto test1_out;
+ }
+ }
+ }
+
+ sem_close(semid);
+test1_out:
+ return ret < 0 ? -1 : 0;
+}
+
+static int semid_tc2;
+
+static pid_t fork_process(int idx, int (*child)(int))
+{
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(child(idx));
+ }
+
+ return pid;
+}
+
+static int testcase2_child(int idx)
+{
+ int i;
+ int ret = 0;
+ struct sp_alloc_info alloc_info[TEST2_ALLOC_TIMES] = {0};
+
+ sem_dec_by_one(semid_tc2);
+
+ for (i = 0; i < TEST2_ALLOC_TIMES; i++) {
+ if (idx % 2 == 0) {
+ alloc_info[i].flag = 2;
+ } else {
+ alloc_info[i].flag = 2 | SP_DVPP;
+ }
+ alloc_info[i].spg_id = SPG_ID_DEFAULT;
+ alloc_info[i].size = (idx + 1) * PAGE_SIZE;
+ }
+
+ for (i = 0; i < TEST2_ALLOC_TIMES; i++) {
+ ret = ioctl_alloc(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed, errno: %d", errno);
+ goto out;
+ }
+ pr_info("child %d alloc success %d time.", idx, i);
+ }
+
+ for (i = 0; i < TEST2_ALLOC_TIMES; i++) {
+ ret = ioctl_free(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl free failed, errno: %d", errno);
+ goto out;
+ }
+ pr_info("child %d free success %d time.", idx, i);
+ }
+
+out:
+ return ret;
+}
+
+/* 多进程未加组，一起做sp_alloc */
+static int testcase2(void)
+{
+ int ret = 0;
+ int i, status;
+ pid_t child[TEST2_PROCESS_NUM] = {0};
+
+ semid_tc2 = sem_create(0x1234abc, "testcase2");
+ if (semid_tc2 < 0) {
+ pr_info("open systemV semaphore failed, errno: %s", strerror(errno));
+ return -1;
+ }
+
+ for (i = 0; i < TEST2_PROCESS_NUM; i++) {
+ child[i] = fork_process(i, testcase2_child);
+ if (child[i] < 0) {
+ pr_info("fork child failed");
+ ret = -1;
+ goto kill_child;
+ }
+ }
+
+ sem_inc_by_val(semid_tc2, TEST2_PROCESS_NUM);
+
+kill_child:
+ for (i--; i >= 0; i--) {
+ waitpid(child[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d exited unexpected", i);
+ ret = -1;
+ }
+ }
+
+test2_out:
+ return ret < 0 ? -1 : 0;
+}
+
+/* 父进程直调申请内存，子进程故意释放，预期无权限失败 */
+static int testcase3(void)
+{
+ int ret = 0;
+ int status;
+ pid_t pid;
+
+ struct sp_alloc_info alloc_info = {
+ .flag = SP_HUGEPAGE_ONLY,
+ .spg_id = SPG_ID_DEFAULT,
+ .size = PMD_SIZE,
+ };
+
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed");
+ goto error;
+ }
+
+ pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ goto error;
+ } else if (pid == 0) {
+ /* sp_free deliberately */
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret < 0 && errno == EINVAL) {
+ pr_info("sp_free return EINVAL as expected");
+ } else if (ret < 0) {
+ pr_info("sp_free return %d unexpectedly", errno);
+ exit(1);
+ } else {
+ pr_info("sp_free return success unexpectly");
+ exit(1);
+ }
+ exit(0);
+ }
+
+ waitpid(pid, &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child process failed, ret is %d", status);
+ goto error;
+ }
+
+ return 0;
+
+error:
+ return -1;
+}
+
+static void *testcase4_thread(void *arg)
+{
+ struct sp_alloc_info alloc_info = {0};
+ int ret;
+ int idx = arg;
+
+ struct vmalloc_info ka_info = {
+ .size = PAGE_SIZE,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("vmalloc failed, errno: %d", errno);
+ return -1;
+ }
+
+ struct karea_access_info karea_info = {
+ .mod = KAREA_SET,
+ .value = 'b',
+ .addr = ka_info.addr,
+ .size = ka_info.size,
+ };
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea set failed, errno %d", errno);
+ goto error;
+ }
+
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+
+ alloc_info.spg_id = SPG_ID_DEFAULT;
+ if (idx % 2 == 0) {
+ alloc_info.flag = SP_DVPP;
+ alloc_info.size = (idx + 1) * PAGE_SIZE;
+ } else {
+ alloc_info.flag = SP_HUGEPAGE_ONLY;
+ alloc_info.size = (idx + 1) * PMD_SIZE;
+ }
+
+ for (int i = 0; i < TEST4_RUN_TIME; i++) {
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed, errno: %d", errno);
+ goto error;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl free failed, errno: %d", errno);
+ goto error;
+ }
+
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ goto error;
+ }
+
+ char *buf = (char *)k2u_info.addr;
+ for (int j = 0; j < k2u_info.size; j++) {
+ if (buf[j] != 'b') {
+ pr_info("check k2u context failed");
+ goto error;
+ }
+ }
+
+ if (ioctl_unshare(dev_fd, &k2u_info)) {
+ pr_info("unshare memory failed, errno: %d", errno);
+ goto error;
+ }
+ }
+
+ ioctl_vfree(dev_fd, &ka_info);
+ pthread_exit((void *)0);
+
+error:
+ ioctl_vfree(dev_fd, &ka_info);
+ pthread_exit((void *)1);
+}
+
+static int testcase4_child(int idx)
+{
+ int i, ret;
+ void *thread_ret = NULL;
+ pthread_t threads[TEST4_THREAD_NUM];
+
+ for (i = 0; i < TEST4_THREAD_NUM; i++) {
+ ret = pthread_create(threads + i, NULL, testcase4_thread, idx);
+ if (ret < 0) {
+ pr_info("pthread create failed");
+ goto out_pthread_join;
+ }
+ }
+
+out_pthread_join:
+ for (i--; i >= 0; i--) {
+ pthread_join(threads[i], &thread_ret);
+ if (thread_ret != NULL) {
+ pr_info("child thread%d exited unexpected", i + 1);
+ ret = -1;
+ }
+ }
+
+ return ret;
+}
+
+/*
+ * 多进程，每个进程多线程，直调申请内存与k2u to task混跑
+ */
+static int testcase4(void)
+{
+ int ret = 0;
+ int i, status;
+ pid_t child[TEST4_PROCESS_NUM] = {0};
+
+ for (i = 0; i < TEST4_PROCESS_NUM; i++) {
+ child[i] = fork_process(i, testcase4_child);
+ if (child[i] < 0) {
+ pr_info("fork child failed");
+ ret = -1;
+ goto kill_child;
+ }
+ }
+
+kill_child:
+ for (i--; i >= 0; i--) {
+ if (ret != 0) {
+ kill(child[i], SIGKILL);
+ }
+ waitpid(child[i], &status, 0);
+ if (!ret) {
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d exited unexpected", i);
+ ret = -1;
+ goto test2_out;
+ }
+ }
+ }
+
+test2_out:
+ return ret != 0 ? -1 : 0;
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "多线程未加组，并发申请直调内存")
+ TESTCASE_CHILD(testcase2, "多进程未加组，并发申请直调内存")
+ TESTCASE_CHILD(testcase3, "父进程直调申请内存，子进程故意释放，预期无权限失败")
+ TESTCASE_CHILD(testcase4, "多进程，每个进程多线程，直调申请内存与k2u to task混跑")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/test_mult_thread_k2u.c b/tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/test_mult_thread_k2u.c
new file mode 100644
index 000000000000..01b569509ce8
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_k2u_test/test_mult_thread_k2u.c
@@ -0,0 +1,197 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Mon Dec 14 07:53:12 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <pthread.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/shm.h>
+#include <sys/sem.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include "sharepool_lib.h"
+#include "sem_use.h"
+
+
+/*
+ * 同一组，多进程，多线程，每线程执行流程:
+ * vmalloc->k2u->读写操作->unshare->vfree
+ */
+#define PROCESS_PER_GROUP 2
+#define THREAD_PER_PROCESS 128
+
+static int testcase_semid = -1;
+
+/* 线程：vmalloc -> k2u + 用户态写入 + unshare 100次 -> vfree */
+static void *testcase_thread_routing(void *arg)
+{
+ int ret = 0;
+ struct vmalloc_info ka_info = {
+ .size = PMD_SIZE * 2,
+ };
+ ret = ioctl_vmalloc(dev_fd, &ka_info);
+ if (ret < 0) {
+ pr_info("ioctl_vmalloc failed");
+ return (void *)-1;
+ };
+
+ for (int i = 0; i < 100; i++) {
+ struct sp_make_share_info k2u_info = {
+ .kva = ka_info.addr,
+ .size = ka_info.size,
+ .spg_id = SPG_ID_DEFAULT,
+ .sp_flags = 0,
+ .pid = getpid(),
+ };
+
+ // 进程未加组则k2task，否则k2spg
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl_k2u failed, errno: %d", errno);
+ ret = -1;
+ goto out;
+ }
+ memset((void *)k2u_info.addr, 'a', k2u_info.size);
+ ioctl_unshare(dev_fd, &k2u_info);
+ }
+
+out:
+ ioctl_vfree(dev_fd, &ka_info);
+
+ return (void *)ret;
+}
+
+static int testcase_child_process(int idx)
+{
+ int ret = 0;
+ pthread_t threads[THREAD_PER_PROCESS] = {0};
+
+ if (testcase_semid == -1) {
+ pr_info("unexpect semid");
+ return -1;
+ }
+
+ sem_dec_by_one(testcase_semid);
+
+ for (int i = 0; i < THREAD_PER_PROCESS; i++) {
+ ret = pthread_create(threads + i, NULL, testcase_thread_routing, NULL);
+ if (ret < 0) {
+ pr_info("pthread create failed");
+ ret = -1;
+ goto out;
+ }
+ }
+
+ pr_info("child%d create %d threads success", idx, THREAD_PER_PROCESS);
+
+out:
+ for (int i = 0; i < THREAD_PER_PROCESS; i++)
+ if (threads[i])
+ pthread_join(threads[i], NULL);
+
+ return ret;
+}
+
+static pid_t fork_and_add_group(int idx, int group_id, int (*child)(int))
+{
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ return -1;
+ } else if (pid == 0) {
+ exit(child(idx));
+ }
+
+ // 不加组
+ if (group_id == SPG_ID_DEFAULT)
+ return pid;
+
+ struct sp_add_group_info ag_info = {
+ .pid = pid,
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ int ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ kill(pid, SIGKILL);
+ waitpid(pid, NULL, 0);
+ return -1;
+ } else
+ return pid;
+}
+
+#define TEST_SEM_KEY 0xffabc
+static int testcase_routing(int group_id, int (*child_process)(int))
+{
+ int ret = 0, status;
+ pid_t child[PROCESS_PER_GROUP] = {0};
+
+ testcase_semid = sem_create(9612, "test_mult_thread_k2u");
+ if (testcase_semid < 0) {
+ pr_info("open systemV semaphore failed, errno: %s", strerror(errno));
+ return -1;
+ }
+
+ for (int i = 0; i < PROCESS_PER_GROUP; i++) {
+ pid_t pid = fork_and_add_group(i, group_id, child_process);
+ if (pid < 0)
+ goto out;
+ child[i] = pid;
+ }
+
+ sem_inc_by_val(testcase_semid, PROCESS_PER_GROUP);
+
+ for (int i = 0; i < PROCESS_PER_GROUP; i++) {
+ waitpid(child[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("childprocess%d exit unexpected", i);
+ ret = -1;
+ goto out;
+ }
+ child[i] = 0;
+ }
+ goto sem_remove;
+
+out:
+ for (int i = 0; i < PROCESS_PER_GROUP; i++)
+ if (child[i]) {
+ kill(child[i], SIGKILL);
+ waitpid(child[i], NULL, 0);
+ }
+
+sem_remove:
+ if (sem_close(testcase_semid) < 0)
+ pr_info("sem remove failed, %s", strerror(errno));
+
+ return ret;
+}
+
+static int testcase1(void) { return testcase_routing(10, testcase_child_process); }
+static int testcase2(void) { return testcase_routing(SPG_ID_DEFAULT, testcase_child_process); }
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "多线程vmalloc->k2spg->memset->unshare->vfree")
+ TESTCASE_CHILD(testcase2, "多线程vmalloc->k2task->memset->unshare->vfree")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/Makefile b/tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/Makefile
new file mode 100644
index 000000000000..9a2b520d1b5f
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/test_mult_process
+
+clean:
+ rm -rf $(testcases)
\ No newline at end of file
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/test_mult_u2k.c b/tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/test_mult_u2k.c
new file mode 100644
index 000000000000..04a5a3e5c6e0
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/test_mult_u2k.c
@@ -0,0 +1,514 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Tue Nov 24 15:40:31 2020
+ */
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <pthread.h>
+
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+
+#define MAX_ALLOC 100000
+#define MAX_SHARE 1000
+#define MAX_READ 100000
+
+static int alloc_num = 20;
+static int share_num = 20;
+static int read_num = 20;
+
+struct __thread_info {
+ struct sp_make_share_info *u2k_info;
+ struct karea_access_info *karea_info;
+};
+
+/*
+ * 用户态进程A加组后分配并写内存N，反复调用u2k（share_num次）共享到内核，内核模块通过每个kva反复读同一块内存（read_num次）N成功。
+ * 进程A停止共享N后，内核模块读N失败。进程A释放内存N。
+ */
+static void *grandchild1(void *arg)
+{
+ struct karea_access_info *karea_info = (struct karea_access_info*)arg;
+ int ret = 0;
+ for (int j = 0; j < read_num; j++) {
+ ret = ioctl_karea_access(dev_fd, karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ pthread_exit((void*)ret);
+ }
+ pr_info("thread read u2k area %dth time success", j);
+ }
+ pr_info("thread read u2k area %d times success", read_num);
+ pthread_exit((void*)ret);
+}
+
+static int child1(struct sp_alloc_info *alloc_info)
+{
+ int ret;
+ int group_id = alloc_info->spg_id;
+ pr_info("want to add group_id: %d", group_id);
+
+ // add group()
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return ret;
+ }
+ pr_info("now added into group_id: %d", alloc_info->spg_id);
+
+ // alloc()
+ ret = ioctl_alloc(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ pr_info("alloc %0lx memory success", alloc_info->size);
+
+ // write
+ memset((void *)alloc_info->addr, 'o', alloc_info->size);
+ pr_info("memset success");
+
+ // u2k
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info->addr,
+ .size = alloc_info->size,
+ .pid = getpid(),
+ };
+
+ struct karea_access_info *karea_info = (struct karea_access_info*)malloc(share_num * sizeof(struct karea_access_info));
+
+ for (int i = 0; i < share_num; i++) { // 同一段用户态内存可以向内核共享很多次
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ }
+ karea_info[i].mod = KAREA_CHECK;
+ karea_info[i].value = 'o';
+ karea_info[i].addr = u2k_info.addr;
+ karea_info[i].size = u2k_info.size;
+ }
+ pr_info("u2k share %d times success", share_num);
+
+ //内核反复读（太慢了！取消了。）
+ //for (int j = 0; j < read_num; j++) {
+ for (int i = 0; i < share_num; i++) {
+ ret = ioctl_karea_access(dev_fd, &karea_info[i]);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+ pr_info("kernel read %dth %0lx area success", i, alloc_info->size);
+ }
+ //}
+ //pr_info("kernel read %d times success", read_num);
+
+ //内核并发读 100个线程
+ pthread_t childs[MAX_SHARE] = {0};
+ int status = 0;
+ for (int i = 0; i < share_num; i++) {
+ ret = pthread_create(&childs[i], NULL, grandchild1, (void *)&karea_info[i]);
+ if (ret != 0) {
+ pr_info("pthread_create failed, errno: %d", errno);
+ exit(-1);
+ }
+ }
+ pr_info("create %d threads success", share_num);
+
+ void *child_ret;
+ for (int i = 0; i < share_num; i++) {
+ pthread_join(childs[i], &child_ret);
+ if ((int)child_ret != 0) {
+ pr_info("grandchild1 %d test failed, %d", i, (int)child_ret);
+ return (int)child_ret;
+ }
+ }
+ pr_info("exit %d threads success", share_num);
+
+ for (int i = 0; i < share_num; i++) {
+ u2k_info.addr = karea_info[i].addr;
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+ }
+ pr_info("unshare u2k area %d times success", share_num);
+
+ /*
+ * unshare之后再访问内存会导致内核挂掉，在手工测试的时候执行
+ */
+#if 0
+ pr_info("recheck karea");
+ ret = ioctl_karea_access(dev_fd, &karea_info[0]);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+#endif
+
+ ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ return ret;
+ }
+ free(karea_info);
+ return ret;
+}
+
+/*
+ * 用户态进程A加组后分配并写alloc_num个内存，调用u2k共享到内核，内核模块通过每个kva分别读多个内存成功（每个kva读read_num次）。
+ * 进程A停止共享后，内核模块读N失败。进程A释放内存N。
+ */
+static void* grandchild2(void *arg)
+{
+ int ret = 0;
+ struct __thread_info* thread2_info = (struct __thread_info*)arg;
+ ret = ioctl_u2k(dev_fd, thread2_info->u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ pthread_exit((void*)ret);
+ }
+ thread2_info->karea_info->mod = KAREA_CHECK;
+ thread2_info->karea_info->value = 'p';
+ thread2_info->karea_info->addr = thread2_info->u2k_info->addr;
+ thread2_info->karea_info->size = thread2_info->u2k_info->size;
+ pthread_exit((void*)ret);
+}
+
+static int child2(struct sp_alloc_info *alloc_info)
+{
+ int ret;
+ int group_id = alloc_info->spg_id;
+
+ // add group
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return ret;
+ }
+
+ // alloc N块内存
+ struct sp_alloc_info *all_alloc_info = (struct sp_alloc_info*)malloc(alloc_num * sizeof(struct sp_alloc_info));
+ for (int i = 0; i < alloc_num; i++) {
+ all_alloc_info[i].flag = alloc_info->flag;
+ all_alloc_info[i].spg_id = alloc_info->spg_id;
+ all_alloc_info[i].size = alloc_info->size;
+ ret = ioctl_alloc(dev_fd, &all_alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ memset((void *)all_alloc_info[i].addr, 'p', all_alloc_info[i].size);
+ }
+
+ struct sp_make_share_info *all_u2k_info = (struct sp_make_share_info*)malloc(alloc_num * sizeof(struct sp_make_share_info));
+
+ struct karea_access_info *karea_info = (struct karea_access_info*)malloc(alloc_num * sizeof(struct karea_access_info));
+
+ // 并发调用u2k
+ // 创建100个线程，分别对一块alloc内存调用u2k，并存储返回地址
+ pthread_t childs[MAX_ALLOC] = {0};
+ struct __thread_info thread2_info[MAX_ALLOC];
+ int status = 0;
+ for (int i = 0; i < alloc_num; i++) {
+ all_u2k_info[i].uva = all_alloc_info[i].addr;
+ all_u2k_info[i].size = all_alloc_info[i].size;
+ all_u2k_info[i].pid = getpid();
+ thread2_info[i].u2k_info = &all_u2k_info[i];
+ thread2_info[i].karea_info = &karea_info[i];
+ ret = pthread_create(&childs[i], NULL, grandchild2, (void *)&thread2_info[i]);
+ if (ret != 0) {
+ pr_info("pthread_create failed, errno: %d", errno);
+ exit(-1);
+ }
+ }
+
+ // 结束所有线程
+ void *child_ret;
+ for (int i = 0; i < alloc_num; i++) {
+ pthread_join(childs[i], &child_ret);
+ if ((int)child_ret != 0) {
+ pr_info("grandchild2 %d test failed, %d", i, (int)child_ret);
+ return (int)child_ret;
+ }
+ }
+
+ // 内核读内存
+ for (int j = 0; j < read_num; j++) {
+ for (int i = 0; i < alloc_num; i++) {
+ ret = ioctl_karea_access(dev_fd, &karea_info[i]);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+ }
+ }
+
+ // unshare所有内存
+ for (int i = 0; i < alloc_num; i++) {
+ ret = ioctl_unshare(dev_fd, &all_u2k_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+ }
+
+ /*
+ * unshare之后再访问内存会导致内核挂掉，在手工测试的时候执行
+ */
+#if 0
+ pr_info("recheck karea");
+ ret = ioctl_karea_access(dev_fd, &karea_info[0]);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+#endif
+
+ // free所有内存
+ for (int i = 0; i < alloc_num; i++) {
+ ret = ioctl_free(dev_fd, &all_alloc_info[i]);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ return ret;
+ }
+ }
+ free(all_alloc_info);
+ free(all_u2k_info);
+ free(karea_info);
+ return ret;
+}
+
+/*
+ * 用户态进程A加组后分配并写内存N，反复share_num次（调用u2k共享到内核， 内核模块读内存N成功，用户态调用unshare）。
+ * 进程A最后一次停止共享后，内核模块读N失败。进程A释放内存N。
+ */
+static int child3(struct sp_alloc_info *alloc_info)
+{
+ int ret;
+ int group_id = alloc_info->spg_id;
+
+ // add group
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("ioctl_add_group failed, errno: %d", errno);
+ return ret;
+ }
+
+ // alloc
+ ret = ioctl_alloc(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("ioctl_alloc failed, errno: %d", errno);
+ return ret;
+ }
+ memset((void *)alloc_info->addr, 'q', alloc_info->size);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info->addr,
+ .size = alloc_info->size,
+ .pid = getpid(),
+ };
+
+ // 反复调用u2k-内核读-unshare
+ for (int i = 0; i < share_num; i++) {
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ }
+ struct karea_access_info karea_info = {
+ .mod = KAREA_CHECK,
+ .value = 'q',
+ .addr = u2k_info.addr,
+ .size = u2k_info.size,
+ };
+
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+ }
+
+ /*
+ * unshare之后再访问内存会导致内核挂掉，在手工测试的时候执行
+ */
+#if 0
+ pr_info("recheck karea");
+ ret = ioctl_karea_access(dev_fd, &karea_info[0]);
+ if (ret < 0) {
+ pr_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+#endif
+
+ ret = ioctl_free(dev_fd, alloc_info);
+ if (ret < 0) {
+ pr_info("free area failed, errno: %d", errno);
+ return ret;
+ }
+ return ret;
+}
+
+static void print_help()
+{
+ printf("Usage:./test_multi_u2k -n alloc_num -s share_num -r read_num\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "n:s:r:")) != -1) {
+ switch (opt) {
+ case 'n': // 内存申请次数
+ alloc_num = atoi(optarg);
+ if (alloc_num > MAX_ALLOC || alloc_num <= 0) {
+ printf("alloc number invalid\n");
+ return -1;
+ }
+ break;
+ case 's': // u2k共享次数
+ share_num = atoi(optarg);
+ if (share_num > MAX_SHARE || share_num <= 0) {
+ printf("share number invalid\n");
+ return -1;
+ }
+ break;
+ case 'r': // 内核读内存次数
+ read_num = atoi(optarg);
+ if (read_num > MAX_READ || read_num <= 0) {
+ printf("read number invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+#define PROC_NUM 4
+static struct sp_alloc_info alloc_infos[] = {
+ {
+ .flag = 0,
+ .spg_id = 10,
+ .size = 100 * PAGE_SIZE, //400K
+ },
+ {
+ .flag = SP_HUGEPAGE,
+ .spg_id = 12,
+ .size = 10 * PMD_SIZE, // 20M
+ },
+ {
+ .flag = SP_DVPP,
+ .spg_id = 19,
+ .size = 100000, // 约100K
+ },
+ {
+ .flag = SP_DVPP | SP_HUGEPAGE,
+ .spg_id = 19,
+ .size = 10000000, // 约1M
+ },
+};
+
+int (*child_funcs[])(struct sp_alloc_info *) = {
+ child1,
+ child2,
+ child3,
+};
+
+static int testcase(int child_idx)
+{
+ int ret = 0;
+ pid_t procs[PROC_NUM];
+
+ for (int i = 0; i < sizeof(alloc_infos) / sizeof(alloc_infos[0]); i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_info("fork error");
+ ret = -1;
+ goto error_out;
+ } else if (pid == 0) {
+ exit(child_funcs[child_idx](alloc_infos + i));
+ } else {
+ procs[i] = pid;
+ }
+ }
+
+ for (int i = 0; i < sizeof(alloc_infos) / sizeof(alloc_infos[0]); i++) {
+ int status = 0;
+ waitpid(procs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("testcase failed!!, func: %d, alloc info: %d", child_idx, i);
+ ret = -1;
+ } else {
+ pr_info("testcase success!!, func: %d, alloc info: %d", child_idx, i);
+ }
+ }
+
+ return 0;
+error_out:
+ return -1;
+}
+
+static int testcase1(void) { return testcase(0); }
+static int testcase2(void) { return testcase(1); }
+static int testcase3(void) { return testcase(2); }
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "用户态反复调用u2k共享到内核，内核模块通过每个kva反复读同一块内存")
+ TESTCASE_CHILD(testcase2, "创建100个线程，分别对一块alloc内存调用u2k，并存储返回地址；内核读内存")
+ TESTCASE_CHILD(testcase3, "用户态u2k-内核读-unshare，重复循环")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/test_mult_u2k3.c b/tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/test_mult_u2k3.c
new file mode 100644
index 000000000000..0e4b5728df30
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/test_mult_u2k3.c
@@ -0,0 +1,314 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Nov 27 13:45:03 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * group_num个组，每组process_pre_group个进程，所有进程并发执行：多次（sp_alloc -> u2k -> 内核读内存 -> unshare -> sp_free）
+ * 用信号量进行同步，进程创建完成后先睡眠
+ */
+
+#define MAX_GROUP 500
+#define MAX_PROC_PER_GRP 500
+#define MAX_ALLOC 100000
+
+static sem_t *child_sync[MAX_GROUP];
+static sem_t *grandchild_sync[MAX_GROUP];
+
+static int group_num = 2;
+static int process_pre_group = 100;
+static int alloc_num = 100;
+static size_t alloc_size = 4 * PAGE_SIZE;
+
+static int grandchild_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[grandchild%d, pid:%d] " fmt "\n", arg, getpid(), ##args)
+ int ret;
+
+ /* 等待父进程加组 */
+ do {
+ ret = sem_wait(child_sync[arg / MAX_PROC_PER_GRP]);
+ } while ((ret != 0) && errno == EINTR);
+
+ pr_local_info("start!!");
+
+ int group_id = ioctl_find_first_group(dev_fd, getpid());
+ sem_post(grandchild_sync[arg / MAX_PROC_PER_GRP]);
+ if (group_id < 0) {
+ pr_local_info("ioctl_find_group_by_pid failed, %d", group_id);
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .spg_id = group_id,
+ .size = alloc_size,
+ };
+
+ for (int i = 0; i < alloc_num; i++) {
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_local_info("ioctl alloc failed\n");
+ return ret;
+ } else {
+ if (IS_ERR_VALUE(alloc_info.addr)) {
+ pr_local_info("sp_alloc return err is %ld\n", alloc_info.addr);
+ return -1;
+ }
+ }
+ memset((void *)alloc_info.addr, 'r', alloc_info.size);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_local_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ }
+ struct karea_access_info karea_info = {
+ .mod = KAREA_CHECK,
+ .value = 'r',
+ .addr = u2k_info.addr,
+ .size = u2k_info.size,
+ };
+
+ ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_local_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_local_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_local_info("free area failed, errno: %d", errno);
+ return ret;
+ }
+ }
+
+ printf("child %d grandchild %d exit!!\n", arg / MAX_PROC_PER_GRP, getpid());
+ return 0;
+#undef pr_local_info
+}
+
+static int child_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[child%d , pid:%d] " fmt "\n", arg, getpid(), ##args)
+ pr_local_info("start!!");
+
+ int ret, status = 0;
+ int group_id = arg + 100;
+ pid_t childs[MAX_PROC_PER_GRP] = {0};
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0)
+ return -1;
+
+ for (int i = 0; i < process_pre_group; i++) {
+ int num = arg * MAX_PROC_PER_GRP + i;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(num);
+ exit(ret);
+ } else {
+ pr_local_info("fork grandchild%d, pid: %d", num, pid);
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ /* 加组有时候产生-17错误. 尝试retry，有时可以成功，有时还是会一直卡在这里。
+ do {
+ pr_local_info("add grandchild%d to group %d failed, retry", num, group_id);
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ } while (ret < 0);
+ */
+ pr_local_info("add grandchild%d to group %d failed", num, group_id);
+ kill(childs[i], SIGKILL);
+ childs[i] = 0;
+ goto out;
+ } else
+ pr_local_info("add grandchild%d to group %d successfully", num, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[arg]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandchild_sync[arg]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+
+out:
+ for (int i = 0; i < process_pre_group && childs[i] > 0; i++) {
+ waitpid(childs[i], &status, 0);
+ if (status) {
+ pr_local_info("grandchild%d test failed, %d", arg * MAX_PROC_PER_GRP + i, status);
+ ret = status;
+ }
+ }
+
+ printf("child %d exit!!\n", arg);
+ return ret;
+#undef pr_local_info
+}
+
+static void print_help()
+{
+ printf("Usage:./test_multi_u2k3 -g group_num -p proc_num -n alloc&share_num -s alloc_size\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "p:g:n:s:")) != -1) {
+ switch (opt) {
+ case 'p': // 每组进程数
+ process_pre_group = atoi(optarg);
+ if (process_pre_group > MAX_PROC_PER_GRP || process_pre_group <= 0) {
+ printf("process number invalid\n");
+ return -1;
+ }
+ break;
+ case 'g': // group 数量
+ group_num = atoi(optarg);
+ if (group_num > MAX_GROUP || group_num <= 0) {
+ printf("group number invalid\n");
+ return -1;
+ }
+ break;
+ case 'n': // 内存申请次数
+ alloc_num = atoi(optarg);
+ if (alloc_num > MAX_ALLOC || alloc_num <= 0) {
+ printf("alloc number invalid\n");
+ return -1;
+ }
+ break;
+ case 's': // 内存申请大小
+ alloc_size = atol(optarg);
+ if (alloc_size <= 0) {
+ printf("alloc size invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ printf("unsupported options: '%c'\n", opt);
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+#define pr_local_info(fmt, args...) printf("[parent , pid:%d] " fmt "\n", getpid(), ##args)
+
+ int ret = 0;
+ int status = 0;
+ pid_t childs[MAX_GROUP];
+
+ pr_local_info("group: %d, process_pre_group: %d", group_num, process_pre_group);
+
+ dev_fd = open_device();
+ if (dev_fd < 0)
+ return -1;
+
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_grandchild_sync%d", i);
+ grandchild_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (grandchild_sync[i] == SEM_FAILED) {
+ pr_local_info("grandchild sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_child_sync%d", i);
+ child_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (child_sync[i] == SEM_FAILED) {
+ pr_local_info("child sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed, error %d", pid);
+ exit(-1);
+ } else if (pid == 0) {
+ ret = child_process(i);
+ exit(ret);
+ } else {
+ childs[i] = pid;
+ pr_local_info("fork child%d, pid: %d", i, pid);
+ }
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ waitpid(childs[i], &status, 0);
+ if (status) {
+ pr_local_info("child%d test failed, %d", i, status);
+ ret = status;
+ }
+ }
+
+ pr_local_info("exit!!");
+ return ret;
+#undef pr_local_info
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "进程并发执行sp_alloc -> u2k -> 内核读内存 -> unshare -> sp_free(循环)")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/test_mult_u2k4.c b/tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/test_mult_u2k4.c
new file mode 100644
index 000000000000..c856fd3a3caa
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/mult_u2k_test/test_mult_u2k4.c
@@ -0,0 +1,310 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Fri Nov 27 13:45:03 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * group_num个组，每组process_pre_group个进程，所有进程并发执行：多次（sp_alloc -> u2k -> 内核读内存 -> unshare -> sp_free）
+ * 用信号量进行同步，进程创建完成后先睡眠
+ */
+
+#define MAX_GROUP 500
+#define MAX_PROC_PER_GRP 500
+#define MAX_ALLOC 100000
+
+static sem_t *child_sync[MAX_GROUP];
+static sem_t *grandchild_sync[MAX_GROUP];
+
+static int group_num = 2;
+static int process_pre_group = 100;
+static int alloc_num = 100;
+static size_t alloc_size = 4 * PAGE_SIZE;
+
+static int grandchild_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[grandchild%d, pid:%d] " fmt "\n", arg, getpid(), ##args)
+ int ret;
+
+ /* 等待父进程加组 */
+ do {
+ ret = sem_wait(child_sync[arg / MAX_PROC_PER_GRP]);
+ } while ((ret != 0) && errno == EINTR);
+
+ pr_local_info("start!!");
+
+ int group_id = ioctl_find_first_group(dev_fd, getpid());
+ sem_post(grandchild_sync[arg / MAX_PROC_PER_GRP]);
+ if (group_id < 0) {
+ pr_local_info("ioctl_find_group_by_pid failed, %d", group_id);
+ return -1;
+ }
+
+ struct sp_alloc_info alloc_info = {
+ .flag = 0,
+ .spg_id = group_id,
+ .size = alloc_size,
+ };
+
+ for (int i = 0; i < alloc_num; i++) {
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_local_info("ioctl alloc failed\n");
+ return ret;
+ } else {
+ if (IS_ERR_VALUE(alloc_info.addr)) {
+ pr_local_info("sp_alloc return err is %ld\n", alloc_info.addr);
+ return -1;
+ }
+ }
+ memset((void *)alloc_info.addr, 'r', alloc_info.size);
+
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_info.addr,
+ .size = alloc_info.size,
+ .pid = getpid(),
+ };
+
+ //ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_local_info("ioctl_u2k failed, errno: %d", errno);
+ return ret;
+ }
+ struct karea_access_info karea_info = {
+ .mod = KAREA_CHECK,
+ .value = 'r',
+ .addr = u2k_info.addr,
+ .size = u2k_info.size,
+ };
+
+ //ret = ioctl_karea_access(dev_fd, &karea_info);
+ if (ret < 0) {
+ pr_local_info("karea check failed, errno %d", errno);
+ return ret;
+ }
+
+ //ret = ioctl_unshare(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_local_info("ioctl_unshare failed, errno: %d", errno);
+ return ret;
+ }
+
+ ret = ioctl_free(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_local_info("free area failed, errno: %d", errno);
+ return ret;
+ }
+ }
+
+ printf("child %d grandchild %d exit!!\n", arg / MAX_PROC_PER_GRP, getpid());
+ return 0;
+#undef pr_local_info
+}
+
+static int child_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[child%d , pid:%d] " fmt "\n", arg, getpid(), ##args)
+ pr_local_info("start!!");
+
+ int ret, status = 0;
+ int group_id = arg + 100;
+ pid_t childs[MAX_PROC_PER_GRP] = {0};
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0)
+ return -1;
+
+ for (int i = 0; i < process_pre_group; i++) {
+ int num = arg * MAX_PROC_PER_GRP + i;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(num);
+ exit(ret);
+ } else {
+ pr_local_info("fork grandchild%d, pid: %d", num, pid);
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ /* 加组有时候产生-17错误. 尝试retry，有时可以成功，有时还是会一直卡在这里。
+ do {
+ pr_local_info("add grandchild%d to group %d failed, retry", num, group_id);
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ } while (ret < 0);
+ */
+ pr_local_info("add grandchild%d to group %d failed", num, group_id);
+ kill(childs[i], SIGKILL);
+ childs[i] = 0;
+ goto out;
+ } else
+ pr_local_info("add grandchild%d to group %d successfully", num, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[arg]);
+
+ /* 等待子进程获取到加组信息 */
+ do {
+ ret = sem_wait(grandchild_sync[arg]);
+ } while ((ret != 0) && errno == EINTR);
+ }
+ }
+
+out:
+ for (int i = 0; i < process_pre_group && childs[i] > 0; i++) {
+ waitpid(childs[i], &status, 0);
+ if (status) {
+ pr_local_info("grandchild%d test failed, %d", arg * MAX_PROC_PER_GRP + i, status);
+ ret = status;
+ }
+ }
+
+ printf("child %d exit!!\n", arg);
+ return ret;
+#undef pr_local_info
+}
+
+static void print_help()
+{
+ printf("Usage:./test_multi_u2k3 -g group_num -p proc_num -n alloc&share_num -s alloc_size\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "p:g:n:s:")) != -1) {
+ switch (opt) {
+ case 'p': // 每组进程数
+ process_pre_group = atoi(optarg);
+ if (process_pre_group > MAX_PROC_PER_GRP || process_pre_group <= 0) {
+ printf("process number invalid\n");
+ return -1;
+ }
+ break;
+ case 'g': // group 数量
+ group_num = atoi(optarg);
+ if (group_num > MAX_GROUP || group_num <= 0) {
+ printf("group number invalid\n");
+ return -1;
+ }
+ break;
+ case 'n': // 内存申请次数
+ alloc_num = atoi(optarg);
+ if (alloc_num > MAX_ALLOC || alloc_num <= 0) {
+ printf("alloc number invalid\n");
+ return -1;
+ }
+ break;
+ case 's': // 内存申请大小
+ alloc_size = atol(optarg);
+ if (alloc_size <= 0) {
+ printf("alloc size invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ printf("unsupported options: '%c'\n", opt);
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+#define pr_local_info(fmt, args...) printf("[parent , pid:%d] " fmt "\n", getpid(), ##args)
+
+ int ret = 0;
+ int status = 0;
+ pid_t childs[MAX_GROUP];
+
+ pr_local_info("group: %d, process_pre_group: %d", group_num, process_pre_group);
+
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_grandchild_sync%d", i);
+ grandchild_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (grandchild_sync[i] == SEM_FAILED) {
+ pr_local_info("grandchild sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_child_sync%d", i);
+ child_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (child_sync[i] == SEM_FAILED) {
+ pr_local_info("child sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed, error %d", pid);
+ exit(-1);
+ } else if (pid == 0) {
+ ret = child_process(i);
+ exit(ret);
+ } else {
+ childs[i] = pid;
+ pr_local_info("fork child%d, pid: %d", i, pid);
+ }
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ waitpid(childs[i], &status, 0);
+ if (status) {
+ pr_local_info("child%d test failed, %d", i, status);
+ ret = status;
+ }
+ }
+
+ pr_local_info("exit!!");
+ return ret;
+#undef pr_local_info
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "进程并发执行：多次（sp_alloc -> u2k -> 内核读内存 -> unshare -> sp_free）")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/stress_test/Makefile b/tools/testing/sharepool/testcase/test_mult_process/stress_test/Makefile
new file mode 100644
index 000000000000..9a2b520d1b5f
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/stress_test/Makefile
@@ -0,0 +1,13 @@
+test%: test%.c
+ $(CC) $^ -o $@ $(sharepool_lib_ccflags) -lpthread
+
+src:=$(wildcard *.c)
+testcases:=$(patsubst %.c,%,$(src))
+
+default: $(testcases)
+
+install: $(testcases)
+ cp $(testcases) $(TOOL_BIN_DIR)/test_mult_process
+
+clean:
+ rm -rf $(testcases)
\ No newline at end of file
diff --git a/tools/testing/sharepool/testcase/test_mult_process/stress_test/test_alloc_free_two_process.c b/tools/testing/sharepool/testcase/test_mult_process/stress_test/test_alloc_free_two_process.c
new file mode 100644
index 000000000000..263821bee137
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/stress_test/test_alloc_free_two_process.c
@@ -0,0 +1,303 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Wed Nov 11 07:12:29 2020
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+
+#include <fcntl.h> /* For O_* constants */
+#include <sys/stat.h> /* For mode constants */
+#include <semaphore.h>
+
+#include "sharepool_lib.h"
+
+/*
+ * 两个组，每组两个进程，同时多次申请释放内存
+ *
+ * 用信号量进行同步，进程创建完成后先睡眠
+ */
+
+#define NR_GROUP 100
+#define MAX_PROC_PER_GRP 100
+
+static int group_num = 2;
+static int process_per_group = 3;
+static int alloc_num = 1000;
+static size_t alloc_size = 4 * PAGE_SIZE;
+
+static int grandchild_process(int arg, sem_t *child_sync, sem_t *grandchild_sync)
+{
+#define pr_local_info(fmt, args...) printf("[grandchild%d, pid:%d] " fmt "\n", arg, getpid(), ##args)
+ int ret;
+
+ struct sp_alloc_info *alloc_infos = malloc(sizeof(*alloc_infos) * alloc_num);
+ if (!alloc_infos) {
+ pr_local_info("malloc failed");
+ return -1;
+ }
+
+ /* 等待父进程加组 */
+ do {
+ ret = sem_wait(child_sync);
+ } while ((ret != 0) && errno == EINTR);
+
+ sleep(1); // it seems sem_wait doesn't work as expected
+ pr_local_info("start!!, ret is %d, errno is %d", ret, errno);
+
+ int group_id = ioctl_find_first_group(dev_fd, getpid());
+ if (group_id < 0) {
+ pr_local_info("ioctl_find_group_by_pid failed, %d", group_id);
+ goto error_out;
+ }
+
+ for (int i = 0; i < alloc_num; i++) {
+ (alloc_infos + i)->flag = 0,
+ (alloc_infos + i)->spg_id = group_id,
+ (alloc_infos + i)->size = alloc_size,
+ /* sp_alloc */
+ ret = ioctl_alloc(dev_fd, alloc_infos + i);
+ if (ret < 0) {
+ pr_local_info("ioctl alloc failed\n");
+ goto error_out;
+ } else {
+ if (IS_ERR_VALUE(alloc_infos[i].addr)) {
+ pr_local_info("sp_alloc return err is %ld\n", alloc_infos[i].addr);
+ goto error_out;
+ }
+ }
+
+ memset((void *)alloc_infos[i].addr, 'z', alloc_infos[i].size);
+ }
+
+ sem_post(grandchild_sync);
+ do {
+ ret = sem_wait(child_sync);
+ } while (ret < 0 && errno == EINTR);
+
+ for (int i = 0; i < alloc_num; i++) {
+ ret = ioctl_free(dev_fd, alloc_infos + i);
+ if (ret < 0) {
+ pr_local_info("ioctl free failed, errno: %d", errno);
+ goto error_out;
+ }
+ }
+ sem_post(grandchild_sync);
+ free(alloc_infos);
+ pr_local_info("exit!!");
+ return 0;
+
+error_out:
+ sem_post(grandchild_sync);
+ free(alloc_infos);
+ return -1;
+#undef pr_local_info
+}
+
+static int child_process(int arg)
+{
+#define pr_local_info(fmt, args...) printf("[child%d , pid:%d] " fmt "\n", arg, getpid(), ##args)
+ pr_local_info("start!!");
+
+ int ret, status = 0;
+ int group_id = arg + 100;
+ pid_t childs[MAX_PROC_PER_GRP] = {0};
+ sem_t *child_sync[MAX_PROC_PER_GRP] = {0};
+ sem_t *grandchild_sync[MAX_PROC_PER_GRP] = {0};
+
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ .spg_id = group_id,
+ };
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0)
+ return -1;
+
+ // create syncs for grandchilds
+ for (int i = 0; i < process_per_group; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_grandchild_sync%d", i);
+ grandchild_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (grandchild_sync[i] == SEM_FAILED) {
+ pr_local_info("grandchild sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ // create syncs for childs
+ for (int i = 0; i < process_per_group; i++) {
+ char buf[100];
+ sprintf(buf, "/sharepool_child_sync%d", i);
+ child_sync[i] = sem_open(buf, O_CREAT, O_RDWR, 0);
+ if (child_sync[i] == SEM_FAILED) {
+ pr_local_info("child sem_open failed");
+ return -1;
+ }
+ sem_unlink(buf);
+ }
+
+ // 创建子进程并将之加组
+ for (int i = 0; i < process_per_group; i++) {
+ int num = arg * MAX_PROC_PER_GRP + i;
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed\n");
+ exit(-1);
+ } else if(pid == 0) {
+ ret = grandchild_process(num, child_sync[i], grandchild_sync[i]);
+ exit(ret);
+ } else {
+ pr_local_info("fork grandchild%d, pid: %d", num, pid);
+ childs[i] = pid;
+
+ ag_info.pid = pid;
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_local_info("add grandchild%d to group %d failed", num, group_id);
+ goto error_out;
+ } else
+ pr_local_info("add grandchild%d to group %d successfully", num, group_id);
+
+ /* 通知子进程加组成功 */
+ sem_post(child_sync[i]);
+ }
+ }
+
+ for (int i = 0; i < process_per_group; i++)
+ do {
+ ret = sem_wait(grandchild_sync[i]);
+ } while (ret < 0 && errno == EINTR);
+
+ for (int i = 0; i < process_per_group; i++)
+ sem_post(child_sync[i]);
+ pr_local_info("grandchild-processes start to do sp_free");
+
+ for (int i = 0; i < process_per_group && childs[i] > 0; i++) {
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_local_info("grandchild%d test failed, %d", arg * MAX_PROC_PER_GRP + i, status);
+ ret = -1;
+ }
+ }
+ pr_local_info("exit!!");
+ return ret;
+
+error_out:
+ for (int i = 0; i < process_per_group && childs[i] > 0; i++) {
+ kill(childs[i], SIGKILL);
+ waitpid(childs[i], NULL, 0);
+ };
+ pr_local_info("exit!!");
+ return -1;
+#undef pr_local_info
+}
+
+static void print_help()
+{
+ printf("Usage:\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "p:g:n:s:")) != -1) {
+ switch (opt) {
+ case 'p': // 每组进程数
+ process_per_group = atoi(optarg);
+ if (process_per_group > MAX_PROC_PER_GRP || process_per_group <= 0) {
+ printf("process number invalid\n");
+ return -1;
+ }
+ break;
+ case 'g': // group 数量
+ group_num = atoi(optarg);
+ if (group_num > NR_GROUP || group_num <= 0) {
+ printf("group number invalid\n");
+ return -1;
+ }
+ break;
+ case 'n': // 内存申请次数
+ alloc_num = atoi(optarg);
+ if (alloc_num > 100000 || alloc_num <= 0) {
+ printf("alloc number invalid\n");
+ return -1;
+ }
+ break;
+ case 's':
+ alloc_size = atol(optarg);
+ if (alloc_size <= 0) {
+ printf("alloc size invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int testcase1(void)
+{
+#define pr_local_info(fmt, args...) printf("[parent , pid:%d] " fmt "\n", getpid(), ##args)
+
+ int ret = 0;
+ int status = 0;
+ pid_t childs[NR_GROUP];
+
+ pr_local_info("group: %d, process_per_group: %d", group_num, process_per_group);
+
+ for (int i = 0; i < group_num; i++) {
+ pid_t pid = fork();
+ if (pid < 0) {
+ pr_local_info("fork failed, error %d", pid);
+ exit(-1);
+ } else if (pid == 0) {
+ ret = child_process(i);
+ exit(ret);
+ } else {
+ childs[i] = pid;
+
+ pr_local_info("fork child%d, pid: %d", i, pid);
+ }
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ waitpid(childs[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_local_info("child%d test failed, %d", i, status);
+ ret = -1;
+ }
+ }
+
+ pr_local_info("exit!!");
+
+ return ret;
+#undef pr_local_info
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "两个组每组两个进程，同时申请释放内存，简单验证")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_args_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/stress_test/test_fuzz.c b/tools/testing/sharepool/testcase/test_mult_process/stress_test/test_fuzz.c
new file mode 100644
index 000000000000..88606c608217
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/stress_test/test_fuzz.c
@@ -0,0 +1,543 @@
+#include "sharepool_lib.h"
+#include <unistd.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <time.h>
+#include <sys/queue.h>
+
+#define MAX_GROUP_NUM 1000
+#define MAX_PROC_NUM 128
+#define MAX_KILL_TIME 1000
+#define FUNCTION_NUM 7 // alloc, free, u2k, unshare, group query, k2u, proc_stat
+
+#define SLEEP_TIME 1 // not used
+#define USLEEP_TIME 2000
+
+#define ALLOC_SIZE PAGE_SIZE
+#define ALLOC_MULTIPLE 10 // alloc size range from 1~10 pages
+#define VMALLOC_SIZE (2 * PAGE_SIZE)
+
+int child[MAX_PROC_NUM];
+int group_ids[MAX_GROUP_NUM];
+
+// use a LIST to keep all alloc areas
+struct alloc_area {
+ unsigned long addr;
+ unsigned long size;
+ LIST_ENTRY(alloc_area) entries;
+ int spg_id;
+};
+struct alloc_list {
+ struct alloc_area *lh_first;
+};
+
+// use a LIST to keep all u2k/k2u areas
+enum sp_share_flag {
+ U2K = 0,
+ K2U = 1
+};
+struct sp_share_area {
+ unsigned long addr;
+ unsigned long size;
+ enum sp_share_flag flag;
+ LIST_ENTRY(sp_share_area) entries;
+};
+struct u2k_list {
+ struct sp_share_area *lh_first;
+};
+struct k2u_list {
+ struct sp_share_area *lh_first;
+};
+
+// use a LIST to keep all vmalloc areas
+struct vmalloc_area {
+ unsigned long addr;
+ unsigned long size;
+ LIST_ENTRY(vmalloc_area) entries;
+};
+struct vmalloc_list {
+ struct vmalloc_area *lh_first;
+};
+
+typedef struct list_arg_ {
+ void *list_head;
+ int *list_length; // we keep the list size manually
+} list_arg;
+
+static int spalloc(list_arg alloc_arg);
+static int spfree(list_arg alloc_arg);
+static int spu2k(list_arg alloc_arg, list_arg u2k_arg);
+static int spunshare(list_arg u2k_arg, list_arg k2u_arg, list_arg vmalloc_arg);
+static int spquery();
+static int spk2u(list_arg k2u_arg, list_arg vmalloc_arg);
+static int spreadproc();
+
+static int random_num(int mod_num);
+static int add_multi_group();
+static int check_multi_group();
+static int parse_opt(int argc, char *argv[]);
+
+static int group_num = 64;
+static int process_per_group = 32;
+static int kill_time = 1000;
+
+int fuzz()
+{
+ int ret = 0;
+ int alloc_list_length = 0, u2k_list_length = 0, vmalloc_list_length = 0, k2u_list_length = 0;
+
+ // initialize lists
+ struct alloc_list alloc_list = LIST_HEAD_INITIALIZER(alloc_list);
+ LIST_INIT(&alloc_list);
+ struct u2k_list u2k_list = LIST_HEAD_INITIALIZER(u2k_list);
+ LIST_INIT(&u2k_list);
+ struct vmalloc_list vmalloc_list = LIST_HEAD_INITIALIZER(vmalloc_list);
+ LIST_INIT(&vmalloc_list);
+ struct k2u_list k2u_list = LIST_HEAD_INITIALIZER(k2u_list);
+ LIST_INIT(&k2u_list);
+
+ list_arg alloc_arg = {
+ .list_head = &alloc_list,
+ .list_length = &alloc_list_length,
+ };
+ list_arg u2k_arg = {
+ .list_head = &u2k_list,
+ .list_length = &u2k_list_length,
+ };
+ list_arg k2u_arg = {
+ .list_head = &k2u_list,
+ .list_length = &k2u_list_length,
+ };
+ list_arg vmalloc_arg = {
+ .list_head = &vmalloc_list,
+ .list_length = &vmalloc_list_length,
+ };
+
+ int repeat_time = 0;
+ // begin to fuzz
+ while (repeat_time++ <= kill_time) {
+ switch(random_num(FUNCTION_NUM)) {
+ case 0:
+ ret = spalloc(alloc_arg);
+ break;
+ case 1:
+ ret = spfree(alloc_arg);
+ break;
+ case 2:
+ ret = spu2k(alloc_arg, u2k_arg);
+ break;
+ case 3:
+ ret = spunshare(u2k_arg, k2u_arg, vmalloc_arg);
+ break;
+ case 4:
+ ret = spquery();
+ break;
+ case 5:
+ ret = spk2u(k2u_arg, vmalloc_arg);
+ break;
+ case 6:
+ ret = spreadproc();
+ break;
+ default:
+ break;
+ }
+ if (ret < 0) {
+ pr_info("test process %d failed.", getpid());
+ return ret;
+ }
+ //sleep(SLEEP_TIME);
+ usleep(USLEEP_TIME);
+ }
+
+ return 0;
+}
+
+int main(int argc, char *argv[])
+{
+ int ret;
+ dev_fd = open_device();
+ if (dev_fd < 0)
+ return -1;
+
+ // get opt args
+ ret = parse_opt(argc, argv);
+ if (ret)
+ return -1;
+ else
+ pr_info("\ngroup: %d, process_per_group: %d, kill time: %d\n", group_num, process_per_group, kill_time);
+
+ // create groups
+ for (int i = 0; i < group_num; i++) {
+ ret = wrap_add_group(getpid(), PROT_READ | PROT_WRITE, i + 1);
+ if (ret < 0) {
+ pr_info("main process add group %d failed.", i + 1);
+ return -1;
+ } else {
+ pr_info("main process add group %d success.", ret);
+ group_ids[i] = ret;
+ }
+ }
+
+ // start test processes
+ for (int i = 0; i < process_per_group; i++) {
+ int pid = fork();
+ if (pid < 0) {
+ pr_info("fork failed");
+ } else if (pid == 0) {
+ // change the seed
+ srand((unsigned)time(NULL) % getpid());
+ // child add groups
+ if (add_multi_group() < 0) {
+ pr_info("child process add all groups failed.");
+ exit(-1);
+ }
+ if (check_multi_group() < 0) {
+ pr_info("child process check all groups failed.");
+ exit(-1);
+ }
+ exit(fuzz());
+ } else {
+ pr_info("fork child %d success.", pid);
+ child[i] = pid;
+ }
+ }
+
+ ret = 0;
+ // waitpid
+ for (int i = 0; i < process_per_group; i++) {
+ int status;
+ waitpid(child[i], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d test failed, %d", i, status);
+ ret = -1;
+ } else {
+ pr_info("child%d test success.", i);
+ }
+ }
+
+ close_device(dev_fd);
+ return ret;
+}
+
+static int spalloc(list_arg alloc_arg)
+{
+ int ret;
+ struct alloc_list *list_head = (struct alloc_list *)(alloc_arg.list_head);
+
+ struct sp_alloc_info alloc_info = {
+ .size = ALLOC_SIZE * (random_num(ALLOC_MULTIPLE) + 1),
+ .flag = 0,
+ .spg_id = group_ids[random_num(group_num)],
+ };
+
+ ret = ioctl_alloc(dev_fd, &alloc_info);
+ if (ret < 0) {
+ pr_info("test process %d alloc in group %d failed, errno: %d.",
+ getpid(), alloc_info.spg_id, errno);
+ return -1;
+ }
+
+ // alloc areas are kept in a list
+ pr_info("test process %d alloc in group %d success.", getpid(), alloc_info.spg_id);
+ struct alloc_area *a1 = malloc(sizeof(struct alloc_area));
+ a1->addr = alloc_info.addr;
+ a1->size = alloc_info.size;
+ a1->spg_id = alloc_info.spg_id;
+ LIST_INSERT_HEAD(list_head, a1, entries);
+ ++*alloc_arg.list_length;
+
+ return 0;
+}
+
+static int spfree(list_arg alloc_arg)
+{
+ int ret = 0;
+ struct alloc_list *list_head = (struct alloc_list *)alloc_arg.list_head;
+
+ // return if no alloc areas left
+ if (*alloc_arg.list_length == 0)
+ return 0;
+
+ // free a random one
+ int free_index = random_num(*alloc_arg.list_length);
+ int index = 0;
+ struct alloc_area *alloc_area;
+ LIST_FOREACH(alloc_area, list_head, entries) {
+ if (index++ == free_index) {
+ ret = wrap_sp_free(alloc_area->addr);
+ if (ret < 0) {
+ pr_info("test process %d free %lx failed, %d areas left.",
+ getpid(), alloc_area->addr, *alloc_arg.list_length);
+ return -1;
+ } else {
+ pr_info("test process %d free %lx success, %d areas left.",
+ getpid(), alloc_area->addr, --*alloc_arg.list_length);
+ LIST_REMOVE(alloc_area, entries);
+ }
+ break;
+ }
+ }
+
+ if (--index != free_index)
+ pr_info("index error");
+
+ return 0;
+}
+
+static int spu2k(list_arg alloc_arg, list_arg u2k_arg)
+{
+ int ret;
+ struct alloc_list *alloc_list_head = (struct alloc_list *)alloc_arg.list_head;
+ struct u2k_list *u2k_list_head = (struct u2k_list *)u2k_arg.list_head;
+
+ // return if no alloc areas left
+ if (*alloc_arg.list_length == 0)
+ return 0;
+
+ // u2k a random one
+ int u2k_index = random_num(*alloc_arg.list_length);
+ int index = 0;
+ struct alloc_area *alloc_area;
+ LIST_FOREACH(alloc_area, alloc_list_head, entries) {
+ if (index++ == u2k_index) {
+ struct sp_make_share_info u2k_info = {
+ .uva = alloc_area->addr,
+ .size = alloc_area->size,
+ .pid = getpid(),
+ .spg_id = alloc_area->spg_id,
+ };
+ ret = ioctl_u2k(dev_fd, &u2k_info);
+ if (ret < 0) {
+ pr_info("u2k failed.");
+ return -1;
+ }
+
+ pr_info("test process %d u2k in group %d success.", getpid(), u2k_info.spg_id);
+ struct sp_share_area *u1 = malloc(sizeof(struct sp_share_area));
+ u1->addr = u2k_info.addr;
+ u1->size = u2k_info.size;
+ u1->flag = U2K;
+ LIST_INSERT_HEAD(u2k_list_head, u1, entries);
+ (*u2k_arg.list_length)++;
+
+ break;
+ }
+ }
+
+ if (--index != u2k_index)
+ pr_info("index error");
+
+ return 0;
+}
+
+static int spunshare(list_arg u2k_arg, list_arg k2u_arg, list_arg vmalloc_arg)
+{
+ int ret = 0;
+ struct u2k_list *u2k_list_head = (struct u2k_list*)u2k_arg.list_head;
+ struct k2u_list *k2u_list_head = (struct k2u_list*)k2u_arg.list_head;
+ struct vmalloc_list *vmalloc_list_head = (struct vmalloc_list*)vmalloc_arg.list_head;
+
+ // unshare a random u2k area
+ if (*u2k_arg.list_length == 0)
+ goto k2u_unshare;
+ int u2k_unshare_index = random_num(*u2k_arg.list_length);
+ int index = 0;
+ struct sp_share_area *u2k_area;
+ LIST_FOREACH(u2k_area, u2k_list_head, entries) {
+ if (index++ == u2k_unshare_index) {
+ ret = wrap_unshare(u2k_area->addr, u2k_area->size);
+ if (ret < 0) {
+ pr_info("test process %d unshare uva %lx failed, %d areas left.",
+ getpid(), u2k_area->addr, *u2k_arg.list_length);
+ return -1;
+ } else {
+ pr_info("test process %d unshare uva %lx success, %d areas left.",
+ getpid(), u2k_area->addr, --*u2k_arg.list_length);
+ LIST_REMOVE(u2k_area, entries);
+ }
+ break;
+ }
+ }
+
+k2u_unshare:
+ if (*k2u_arg.list_length == 0)
+ return 0;
+
+ // unshare a random k2u area
+ int k2u_unshare_index = random_num(*k2u_arg.list_length);
+ index = 0;
+ struct sp_share_area *k2u_area;
+ LIST_FOREACH(k2u_area, k2u_list_head, entries) {
+ if (index++ == k2u_unshare_index) {
+ ret = wrap_unshare(k2u_area->addr, k2u_area->size);
+ if (ret < 0) {
+ pr_info("test process %d unshare kva %lx failed, %d areas left.",
+ getpid(), k2u_area->addr, *k2u_arg.list_length);
+ return -1;
+ } else {
+ pr_info("test process %d unshare kva %lx success, %d areas left.",
+ getpid(), k2u_area->addr, --*k2u_arg.list_length);
+ LIST_REMOVE(k2u_area, entries);
+ }
+ break;
+ }
+ }
+
+ // vfree the vmalloc area
+ int vfree_index = k2u_unshare_index;
+ index = 0;
+ struct vmalloc_area *vmalloc_area;
+ LIST_FOREACH(vmalloc_area, vmalloc_list_head, entries) {
+ if (index++ == vfree_index) {
+ wrap_vfree(vmalloc_area->addr);
+ pr_info("test process %d vfreed %lx, %d areas left.",
+ getpid(), vmalloc_area->addr, --*vmalloc_arg.list_length);
+ LIST_REMOVE(vmalloc_area, entries);
+ break;
+ }
+ }
+
+ return 0;
+}
+
+static int spquery()
+{
+ return check_multi_group();
+}
+
+static int spk2u(list_arg k2u_arg, list_arg vmalloc_arg)
+{
+ int ret = 0;
+ struct vmalloc_list *vmalloc_list_head = (struct vmalloc_list*)vmalloc_arg.list_head;
+ struct k2u_list *k2u_list_head = (struct k2u_list*)k2u_arg.list_head;
+
+ // vmalloc
+ struct vmalloc_info vmalloc_info = {
+ .size = VMALLOC_SIZE,
+ };
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ struct vmalloc_area *v1 = malloc(sizeof(struct vmalloc_area));
+ v1->addr = vmalloc_info.addr;
+ v1->size = vmalloc_info.size;
+ LIST_INSERT_HEAD(vmalloc_list_head, v1, entries);
+ (*vmalloc_arg.list_length)++;
+
+ // k2u to random group
+ struct sp_make_share_info k2u_info = {
+ .kva = vmalloc_info.addr,
+ .size = vmalloc_info.size,
+ .pid = getpid(),
+ .spg_id = random_num(group_num + 1), // 1~MAX_GROUP_NUM :k2spg 0:k2task
+ };
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("test process %d k2u failed, errno: %d", getpid(), errno);
+ return -1;
+ }
+ pr_info("test process %d k2u in group %d success.", getpid(), k2u_info.spg_id);
+ struct sp_share_area *k1 = malloc(sizeof(struct sp_share_area));
+ k1->addr = k2u_info.addr;
+ k1->size = k2u_info.size;
+ k1->flag = K2U;
+ LIST_INSERT_HEAD(k2u_list_head, k1, entries);
+ (*k2u_arg.list_length)++;
+
+ return 0;
+}
+
+static int spreadproc()
+{
+ return sharepool_log("-----test proc_stat & spa_stat-------");
+}
+
+static int add_multi_group()
+{
+ int ret;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ };
+ for (int i = 0; i < group_num; i++) {
+ ag_info.spg_id = group_ids[i];
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("proc%d add group%d failed", getpid(), group_ids[i]);
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int check_multi_group()
+{
+ int ret;
+ // query groups
+ int spg_ids[MAX_GROUP_NUM];
+ int expect_group_num = MAX_GROUP_NUM;
+ struct sp_group_id_by_pid_info find_group_info = {
+ .num = &expect_group_num,
+ .spg_ids = spg_ids,
+ .pid = getpid(),
+ };
+ ret = ioctl_find_group_by_pid(dev_fd, &find_group_info);
+ if (ret < 0) {
+ pr_info("find group id by pid failed");
+ return ret;
+ } else {
+ for (int i = 0; i < expect_group_num; i++)
+ if (spg_ids[i] != group_ids[i]) {
+ pr_info("group id %d not consistent", i);
+ ret = -1;
+ }
+ pr_info("test process %d add all groups success.", getpid());
+ }
+
+ return ret;
+}
+
+static int random_num(int mod_num)
+{
+ return (int)(mod_num * rand() / (RAND_MAX + 1.0));
+}
+
+static void print_help()
+{
+ printf("Usage:\n");
+}
+
+static int parse_opt(int argc, char *argv[])
+{
+ int opt;
+
+ while ((opt = getopt(argc, argv, "p:g:n:")) != -1) {
+ switch (opt) {
+ case 'p': // 每组进程数
+ process_per_group = atoi(optarg);
+ if (process_per_group > MAX_PROC_NUM || process_per_group <= 0) {
+ printf("process number invalid\n");
+ return -1;
+ }
+ break;
+ case 'g': // group 数量
+ group_num = atoi(optarg);
+ if (group_num > MAX_GROUP_NUM || group_num <= 0) {
+ printf("group number invalid\n");
+ return -1;
+ }
+ break;
+ case 'n': // 循环次数
+ kill_time = atoi(optarg);
+ if (kill_time > MAX_KILL_TIME || kill_time <= 0) {
+ printf("alloc number invalid\n");
+ return -1;
+ }
+ break;
+ default:
+ print_help();
+ return -1;
+ }
+ }
+
+ return 0;
+}
\ No newline at end of file
diff --git a/tools/testing/sharepool/testcase/test_mult_process/stress_test/test_mult_proc_interface.c b/tools/testing/sharepool/testcase/test_mult_process/stress_test/test_mult_proc_interface.c
new file mode 100644
index 000000000000..d5966dc1f737
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/stress_test/test_mult_proc_interface.c
@@ -0,0 +1,701 @@
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2021. All rights reserved.
+ * Author: Huawei OS Kernel Lab
+ * Create: Sun Jan 31 14:42:01 2021
+ */
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+
+#include "sharepool_lib.h"
+
+//#define GROUP_ID 1
+#define TIMES 4
+
+#define REPEAT_TIMES 5
+#define THREAD_NUM 15
+#define PROCESS_NUM 15
+
+#define GROUP_NUM 10
+static int group_ids[GROUP_NUM];
+
+void *thread_k2u_task(void *arg)
+{
+ int ret;
+ pid_t pid = getpid();
+ struct vmalloc_info vmalloc_info = {0}, vmalloc_huge_info = {0};
+ struct sp_make_share_info k2u_info = {0}, k2u_huge_info = {0};
+ char *addr;
+
+ /* prepare for vmalloc */
+ vmalloc_info.size = 3 * PAGE_SIZE;
+ vmalloc_huge_info.size = 3 * PMD_SIZE;
+
+ /* vmalloc */
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vmalloc_hugepage(dev_fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vmalloc huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* prepare for k2u */
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+ k2u_info.sp_flags = SP_DVPP;
+ k2u_info.pid = pid;
+ k2u_info.spg_id = SPG_ID_DEFAULT;
+
+ k2u_huge_info.kva = vmalloc_huge_info.addr;
+ k2u_huge_info.size = vmalloc_huge_info.size;
+ k2u_huge_info.sp_flags = 0;
+ k2u_huge_info.pid = pid;
+ k2u_huge_info.spg_id = SPG_ID_DEFAULT;
+
+ /* k2u */
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_info.addr)) {
+ pr_info("k2u return err is %ld.\n",
+ k2u_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u return addr %lx\n", k2u_info.addr);
+ }
+ }
+
+ ret = ioctl_k2u(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u hugepage error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_huge_info.addr)) {
+ pr_info("k2u hugepage return err is %ld.\n",
+ k2u_huge_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u hugepage return addr %lx\n", k2u_huge_info.addr);
+ }
+ }
+
+ /* check k2u memory content */
+ addr = (char *)k2u_info.addr;
+ if (addr[0] != 'a' || addr[PAGE_SIZE - 1] != 'b' ||
+ addr[PAGE_SIZE] != 'c' || addr[2 * PAGE_SIZE - 1] != 'd') {
+ pr_info("check vmalloc memory failed\n");
+ goto error;
+ } else {
+ //pr_info("check vmalloc memory succeess\n");
+ }
+
+ addr = (char *)k2u_huge_info.addr;
+ if (addr[0] != 'a' || addr[PMD_SIZE - 1] != 'b' ||
+ addr[PMD_SIZE] != 'c' || addr[2 * PMD_SIZE - 1] != 'd') {
+ pr_info("check vmalloc_hugepage memory failed: %c %c %c %c\n",
+ addr[0], addr[PMD_SIZE - 1], addr[PMD_SIZE], addr[2 * PMD_SIZE - 1]);
+ goto error;
+ } else {
+ //pr_info("check vmalloc_hugepage memory succeess\n");
+ }
+
+ /* unshare uva */
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("sp unshare uva error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_unshare(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("sp unshare hugepage uva error: %d\n", ret);
+ goto error;
+ }
+
+ /* kvfree */
+ ret = ioctl_vfree(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vfree small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vfree(dev_fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vfree huge page error: %d\n", ret);
+ goto error;
+ }
+
+ //pr_info("\nfinish running thread %lu\n", pthread_self());
+ pthread_exit((void *)0);
+
+error:
+ pthread_exit((void *)1);
+}
+
+/*
+ * alloc - u2k - vmalloc - k2u - unshare - vfree - unshare - free
+ * 对大页/大页dvpp/小页/小页dvpp都测一下
+ * 多组：对每一组都测一下（query 进程所在的group）
+ */
+void *thread_and_process_helper(int group_id)
+{
+ int ret, i;
+ pid_t pid;
+ bool judge_ret = true;
+ struct sp_alloc_info alloc_info[TIMES] = {0};
+ struct sp_make_share_info u2k_info[TIMES] = {0}, k2u_info = {0}, k2u_huge_info = {0};
+ struct vmalloc_info vmalloc_info = {0}, vmalloc_huge_info = {0};
+ char *addr;
+
+ /* check sp group */
+ pid = getpid();
+
+ // 大页
+ alloc_info[0].flag = SP_HUGEPAGE;
+ alloc_info[0].spg_id = group_id;
+ alloc_info[0].size = 2 * PMD_SIZE;
+
+ // 大页 DVPP
+ alloc_info[1].flag = SP_DVPP | SP_HUGEPAGE;
+ alloc_info[1].spg_id = group_id;
+ alloc_info[1].size = 2 * PMD_SIZE;
+
+ // 普通页 DVPP
+ alloc_info[2].flag = SP_DVPP;
+ alloc_info[2].spg_id = group_id;
+ alloc_info[2].size = 4 * PAGE_SIZE;
+
+ // 普通页
+ alloc_info[3].flag = 0;
+ alloc_info[3].spg_id = group_id;
+ alloc_info[3].size = 4 * PAGE_SIZE;
+
+ /* alloc & u2k */
+ for (i = 0; i < TIMES; i++) {
+ /* sp_alloc */
+ ret = ioctl_alloc(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl alloc failed at %dth alloc.\n", i);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(alloc_info[i].addr)) {
+ pr_info("sp_alloc return err is %ld\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("sp_alloc return addr %lx\n", alloc_info[i].addr);
+ }
+ }
+
+ /* check sp_alloc addr */
+ judge_ret = ioctl_judge_addr(dev_fd, alloc_info[i].addr);
+ if (judge_ret != true) {
+ pr_info("expect a valid share pool addr %lx\n", alloc_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("addr %lx is a valid share pool addr\n", alloc_info[i].addr);
+ }
+
+ /* prepare for u2k */
+ addr = (char *)alloc_info[i].addr;
+ if (alloc_info[i].flag & SP_HUGEPAGE) {
+ addr[0] = 'd';
+ addr[PMD_SIZE - 1] = 'c';
+ addr[PMD_SIZE] = 'b';
+ addr[PMD_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_hugepage_checker = true;
+ } else {
+ addr[0] = 'd';
+ addr[PAGE_SIZE - 1] = 'c';
+ addr[PAGE_SIZE] = 'b';
+ addr[PAGE_SIZE * 2 - 1] = 'a';
+ u2k_info[i].u2k_checker = true;
+ }
+
+ u2k_info[i].uva = alloc_info[i].addr;
+ u2k_info[i].size = alloc_info[i].size;
+ u2k_info[i].pid = pid;
+
+ /* u2k */
+ ret = ioctl_u2k(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("ioctl u2k failed\n");
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(u2k_info[i].addr)) {
+ pr_info("u2k return err is %ld.\n", u2k_info[i].addr);
+ goto error;
+ } else {
+ //pr_info("u2k return addr %lx, check memory content succ.\n",
+ // u2k_info[i].addr);
+ }
+ }
+ //pr_info("\n");
+ }
+
+ /* prepare for vmalloc */
+ vmalloc_info.size = 3 * PAGE_SIZE;
+ vmalloc_huge_info.size = 3 * PMD_SIZE;
+
+ /* vmalloc */
+ ret = ioctl_vmalloc(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vmalloc small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vmalloc_hugepage(dev_fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vmalloc huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* prepare for k2u */
+ k2u_info.kva = vmalloc_info.addr;
+ k2u_info.size = vmalloc_info.size;
+ k2u_info.sp_flags = 0;
+ k2u_info.pid = pid;
+ k2u_info.spg_id = group_id;
+
+ k2u_huge_info.kva = vmalloc_huge_info.addr;
+ k2u_huge_info.size = vmalloc_huge_info.size;
+ k2u_huge_info.sp_flags = SP_DVPP;
+ k2u_huge_info.pid = pid;
+ k2u_huge_info.spg_id = group_id;
+
+ /* k2u */
+ ret = ioctl_k2u(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_info.addr)) {
+ pr_info("k2u return err is %ld.\n",
+ k2u_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u return addr %lx\n", k2u_info.addr);
+ }
+ }
+
+ ret = ioctl_k2u(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("ioctl k2u hugepage error: %d\n", ret);
+ goto error;
+ } else {
+ if (IS_ERR_VALUE(k2u_huge_info.addr)) {
+ pr_info("k2u hugepage return err is %ld.\n",
+ k2u_huge_info.addr);
+ goto error;
+ } else {
+ //pr_info("k2u hugepage return addr %lx\n", k2u_huge_info.addr);
+ }
+ }
+
+ /* check k2u memory content */
+ addr = (char *)k2u_info.addr;
+ if (addr[0] != 'a' || addr[PAGE_SIZE - 1] != 'b' ||
+ addr[PAGE_SIZE] != 'c' || addr[2 * PAGE_SIZE - 1] != 'd') {
+ pr_info("check vmalloc memory failed\n");
+ goto error;
+ } else {
+ //pr_info("check vmalloc memory succeess\n");
+ }
+
+ addr = (char *)k2u_huge_info.addr;
+ if (addr[0] != 'a' || addr[PMD_SIZE - 1] != 'b' ||
+ addr[PMD_SIZE] != 'c' || addr[2 * PMD_SIZE - 1] != 'd') {
+ pr_info("check vmalloc_hugepage memory failed: %c %c %c %c\n",
+ addr[0], addr[PMD_SIZE - 1], addr[PMD_SIZE], addr[2 * PMD_SIZE - 1]);
+ goto error;
+ } else {
+ //pr_info("check vmalloc_hugepage memory succeess\n");
+ }
+
+ /* unshare uva */
+ ret = ioctl_unshare(dev_fd, &k2u_info);
+ if (ret < 0) {
+ pr_info("sp unshare uva error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_unshare(dev_fd, &k2u_huge_info);
+ if (ret < 0) {
+ pr_info("sp unshare hugepage uva error: %d\n", ret);
+ goto error;
+ }
+
+ /* kvfree */
+ ret = ioctl_vfree(dev_fd, &vmalloc_info);
+ if (ret < 0) {
+ pr_info("vfree small page error: %d\n", ret);
+ goto error;
+ }
+ ret = ioctl_vfree(dev_fd, &vmalloc_huge_info);
+ if (ret < 0) {
+ pr_info("vfree huge page error: %d\n", ret);
+ goto error;
+ }
+
+ /* unshare kva & sp_free*/
+ for (i = 0; i < TIMES; i++) {
+ /* unshare kva */
+ ret = ioctl_unshare(dev_fd, &u2k_info[i]);
+ if (ret < 0) {
+ pr_info("sp_unshare kva return error: %d\n", ret);
+ goto error;
+ }
+
+ /* sp_free */
+ ret = ioctl_free(dev_fd, &alloc_info[i]);
+ if (ret < 0) {
+ pr_info("sp_free return error: %d\n", ret);
+ goto error;
+ }
+ }
+
+ //close_device(dev_fd);
+ return 0;
+
+error:
+ //close_device(dev_fd);
+ return -1;
+}
+
+/* for each spg, do the helper test routine */
+void *thread(void *arg)
+{
+ int ret;
+ for (int i = 0; i < GROUP_NUM; i++) {
+ ret = thread_and_process_helper(group_ids[i]);
+ if (ret != 0) {
+ pr_info("\nthread %lu finish running with error, spg_id: %d\n", pthread_self(), group_ids[i]);
+ pthread_exit((void *)1);
+ }
+ }
+ //pr_info("\nthread %lu finish running all groups succes", pthread_self());
+ pthread_exit((void *)0);
+}
+
+static int process()
+{
+ int ret;
+ int spg_ids[GROUP_NUM];
+ int group_num = GROUP_NUM;
+ struct sp_group_id_by_pid_info find_group_info = {
+ .num = &group_num,
+ .spg_ids = spg_ids,
+ .pid = getpid(),
+ };
+
+ ret = ioctl_find_group_by_pid(dev_fd, &find_group_info);
+ if (ret < 0) {
+ pr_info("find group id by pid failed");
+ return ret;
+ }
+
+ for (int i = 0; i < group_num; i++) {
+ ret = thread_and_process_helper(group_ids[i]);
+ if (ret < 0) {
+ pr_info("thread_and_process_helper failed");
+ return -1;
+ }
+ }
+
+ return ret;
+}
+
+static int add_multi_group_auto()
+{
+ int ret;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ };
+ for (int i = 0; i < GROUP_NUM; i++) {
+ group_ids[i] = SPG_ID_AUTO;
+ ag_info.spg_id = group_ids[i];
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("proc%d add group%d failed", getpid(), group_ids[i]);
+ return -1;
+ }
+ }
+
+ return ret;
+}
+
+static int add_multi_group()
+{
+ int ret;
+ struct sp_add_group_info ag_info = {
+ .pid = getpid(),
+ .prot = PROT_READ | PROT_WRITE,
+ };
+ for (int i = 0; i < GROUP_NUM; i++) {
+ group_ids[i] = i + 1;
+ ag_info.spg_id = group_ids[i];
+ ret = ioctl_add_group(dev_fd, &ag_info);
+ if (ret < 0) {
+ pr_info("proc%d add group%d failed", getpid(), group_ids[i]);
+ return -1;
+ }
+ }
+
+ return ret;
+}
+
+static int check_multi_group()
+{
+ int ret;
+ // query groups
+ int spg_ids[GROUP_NUM];
+ int group_num = GROUP_NUM;
+ struct sp_group_id_by_pid_info find_group_info = {
+ .num = &group_num,
+ .spg_ids = spg_ids,
+ .pid = getpid(),
+ };
+ ret = ioctl_find_group_by_pid(dev_fd, &find_group_info);
+ if (ret < 0) {
+ pr_info("find group id by pid failed");
+ return ret;
+ } else
+ for (int i = 0; i < GROUP_NUM; i++)
+ if (spg_ids[i] != group_ids[i]) {
+ pr_info("group id %d not consistent", i);
+ ret = -1;
+ }
+ return ret;
+}
+
+/* 创建15个线程，执行单k2task任务。重复创建5次。*/
+static int testcase1(void)
+{
+ int ret = 0;
+ pthread_t tid[THREAD_NUM];
+
+ // add groups
+ if (add_multi_group())
+ return -1;
+
+ //query groups
+ if (check_multi_group())
+ return -1;
+ pr_info("%s add to all groups success.", __FUNCTION__);
+
+ // 创建15个线程，执行单k2task任务。重复创建5次。
+ pr_info("\n --- thread k2task multi group test --- ");
+ for (int i = 0; i < REPEAT_TIMES; i++) {
+
+ pr_info("thread k2task %dth test, %d times left.", i + 1, REPEAT_TIMES - i - 1);
+
+ for (int j = 0; j < THREAD_NUM; j++) {
+ ret = pthread_create(tid + j, NULL, thread_k2u_task, NULL);
+ if (ret != 0) {
+ pr_info("create thread error\n");
+ return -1;
+ }
+ }
+
+ for (int j = 0; j < THREAD_NUM; j++) {
+ void *tret;
+ if (pthread_join(tid[j], &tret) != 0) {
+ pr_info("can't join thread %d\n", j);
+ ret = -1;
+ }
+ if ((long)tret != 0) {
+ pr_info("testcase execution failed, thread %d exited unexpectedly\n", j);
+ ret = -1;
+ }
+ }
+
+ sleep(3);
+ }
+
+ return ret;
+}
+
+/* 创建15个线程，执行u2k+k2u混合任务。重复创建5次。*/
+static int testcase2(void)
+{
+ int ret = 0;
+
+ // add groups
+ if (add_multi_group())
+ return -1;
+
+ //query groups
+ if (check_multi_group())
+ return -1;
+ pr_info("%s add to all groups success.", __FUNCTION__);
+
+ // 创建15个线程，执行u2k+k2u混合任务。重复创建5次。
+ pthread_t tid[THREAD_NUM];
+ void *tret;
+ pr_info("\n --- thread u2k+k2u multi group test --- \n");
+ for (int i = 0; i < REPEAT_TIMES; i++) {
+ pr_info("thread u2k+k2u %dth test, %d times left.", i + 1, REPEAT_TIMES - i - 1);
+ for (int j = 0; j < THREAD_NUM; j++) {
+ ret = pthread_create(tid + j, NULL, thread, NULL);
+ if (ret != 0) {
+ pr_info("create thread error\n");
+ return -1;
+ }
+ }
+ for (int j = 0; j < THREAD_NUM; j++) {
+ ret = pthread_join(tid[j], &tret);
+ if (ret != 0) {
+ pr_info("can't join thread %d\n", j);
+ }
+ if ((long)tret != 0) {
+ pr_info("testcase execution failed, thread %d exited unexpectedly\n", j);
+ }
+ }
+ sleep(3);
+ }
+ return ret;
+}
+
+/* 创建15个进程，加入所有组，并执行u2k+k2u混合任务。重复创建5次。*/
+static int testcase3(void)
+{
+ int ret = 0;
+ pid_t childs[PROCESS_NUM];
+
+ // 创建15个进程，加入所有组，并执行u2k+k2u混合任务。重复创建5次。
+ pr_info("\n --- process u2k+k2u multi group test ---\n");
+ for (int i = 0; i < REPEAT_TIMES; i++) {
+ pr_info("process u2k+k2u %dth test, %d times left.", i + 1, REPEAT_TIMES - i - 1);
+ for (int j = 0; j < PROCESS_NUM; j++) {
+ pid_t pid_child = fork();
+ if (pid_child < 0) {
+ pr_info("fork failed, error %d", pid_child);
+ exit(-1);
+ } else if (pid_child == 0) {
+ if (add_multi_group())
+ pr_info("add group failed");
+ pr_info("%s add %dth child to all groups success, %d left",
+ __FUNCTION__, j + 1, PROCESS_NUM - j - 1);
+ exit(process());
+ } else {
+ childs[j] = pid_child;
+ pr_info("fork child%d, pid: %d", j, pid_child);
+ }
+ }
+
+ for (int j = 0; j < PROCESS_NUM; j++) {
+ int status;
+ waitpid(childs[j], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d test failed, %d", j, status);
+ ret = -1;
+ }
+ }
+ sleep(1);
+ }
+
+ return ret;
+}
+
+/* 创建15个进程和15个线程，执行u2k+k2u混合任务。重复创建5次。*/
+static int testcase4(void)
+{
+ pr_info("\n --- process and thread u2k_k2u mix multi group test --- \n");
+
+ int ret = 0;
+
+ // add groups
+ if (add_multi_group())
+ return -1;
+
+ //query groups
+ if (check_multi_group())
+ return -1;
+ pr_info("%s add to all groups success.", __FUNCTION__);
+
+ // 创建15个进程和15个线程，执行u2k+k2u混合任务。重复创建5次。
+ for (int i = 0; i < REPEAT_TIMES; i++) {
+
+ pr_info("process+thread u2k+k2u %dth test, %d times left.", i + 1, REPEAT_TIMES - i - 1);
+
+ pthread_t tid[THREAD_NUM];
+ for (int j = 0; j < THREAD_NUM; j++) {
+ ret = pthread_create(tid + j, NULL, thread, NULL);
+ if (ret != 0) {
+ pr_info("create thread error\n");
+ return -1;
+ }
+ }
+
+ pid_t childs[PROCESS_NUM];
+ for (int k = 0; k < PROCESS_NUM; k++) {
+ pid_t pid_child = fork();
+ if (pid_child < 0) {
+ pr_info("fork failed, error %d", pid_child);
+ exit(-1);
+ } else if (pid_child == 0) {
+ // add groups
+ if (add_multi_group())
+ return -1;
+ //query groups
+ if (check_multi_group())
+ return -1;
+ pr_info("%s add %dth child to all groups success, %d left",
+ __FUNCTION__, k + 1, PROCESS_NUM - k - 1);
+ exit(process());
+ } else {
+ childs[k] = pid_child;
+ //pr_info("fork child%d, pid: %d", k, pid_child);
+ }
+ }
+
+ for (int j = 0; j < THREAD_NUM; j++) {
+ void *tret;
+ ret = pthread_join(tid[j], &tret);
+ if (ret != 0) {
+ pr_info("can't join thread %d\n", j);
+ }
+ if ((long)tret != 0) {
+ pr_info("testcase execution failed, thread %d exited unexpectedly\n", j);
+ ret = -1;
+ }
+ }
+
+ for (int k = 0; k < PROCESS_NUM; k++) {
+ int status;
+ waitpid(childs[k], &status, 0);
+ if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ pr_info("child%d test failed, %d", k, status);
+ ret = -1;
+ }
+ }
+
+ sleep(3);
+ }
+ pr_info("\n --- process and thread u2k_k2u mix multi group test success!! --- \n");
+ sleep(3);
+}
+
+static struct testcase_s testcases[] = {
+ TESTCASE_CHILD(testcase1, "创建15个线程，执行单k2task任务。重复创建5次。")
+ TESTCASE_CHILD(testcase2, "创建15个线程，执行u2k+k2u混合任务。重复创建5次。")
+ TESTCASE_CHILD(testcase3, "创建15个进程，加入所有组，并执行u2k+k2u混合任务。重复创建5次。")
+ TESTCASE_CHILD(testcase4, "创建15个进程和15个线程，执行u2k+k2u混合任务。重复创建5次")
+};
+
+struct test_group test_group = {
+ .testcases = testcases,
+};
+
+static int get_filename()
+{
+ extract_filename(test_group.name, __FILE__);
+ return 0;
+}
+
+#include "default_main.c"
diff --git a/tools/testing/sharepool/testcase/test_mult_process/test_mult_process.sh b/tools/testing/sharepool/testcase/test_mult_process/test_mult_process.sh
new file mode 100755
index 000000000000..06af521aadb2
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/test_mult_process.sh
@@ -0,0 +1,53 @@
+#!/bin/sh
+
+set -x
+
+echo 'test_u2k_add_and_kill -g 10 -p 20
+ test_alloc_add_and_kill -n 200
+ test_add_multi_cases
+ test_max_group_per_process
+ test_mult_alloc_and_add_group
+ test_mult_process_thread_exit
+ test_mult_thread_add_group
+ test_add_group_and_print
+ test_concurrent_debug -p 10 -g 5 -n 100
+ test_proc_interface_process
+ test_mult_k2u
+ test_mult_pass_through
+ test_mult_thread_k2u
+ test_mult_u2k -n 50
+ test_mult_u2k3
+ test_mult_u2k4
+ test_alloc_free_two_process -p 10 -g 5 -n 100 -s 1000
+ test_fuzz
+ test_mult_proc_interface' | while read line
+do
+ let flag=0
+ ./test_mult_process/$line
+ if [ $? -ne 0 ] ;then
+ echo "testcase test_mult_process/$line failed"
+ let flag=1
+ fi
+ sleep 3
+ #打印spa_stat
+ ret=`cat /proc/sharepool/spa_stat | wc -l`
+ if [ $ret -ge 15 ] ;then
+ cat /proc/sharepool/spa_stat
+ echo spa_stat not clean
+ let flag=1
+ fi
+ #打印proc_stat
+ ret=`cat /proc/sharepool/proc_stat | wc -l`
+ if [ $ret -ge 15 ] ;then
+ cat /proc/sharepool/proc_stat
+ echo proc_stat not clean
+ let flag=1
+ fi
+ #如果泄漏 -->exit
+ if [ $flag -eq 1 ] ;then
+ exit 1
+ fi
+ echo "testcase test_mult_process/$line success"
+ cat /proc/meminfo
+ free -m
+done
diff --git a/tools/testing/sharepool/testcase/test_mult_process/test_proc_interface.sh b/tools/testing/sharepool/testcase/test_mult_process/test_proc_interface.sh
new file mode 100755
index 000000000000..03040d13dd87
--- /dev/null
+++ b/tools/testing/sharepool/testcase/test_mult_process/test_proc_interface.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set -x
+
+./test_mult_process/test_proc_interface_process &
+
+for i in $(seq 1 5) # 5 processes read
+do {
+ for j in $(seq 1 40) # duration: 40x2 = 80 seconds
+ do
+ cat /proc/sharepool/proc_stat
+ cat /proc/sharepool/spa_stat
+ cat /proc/sharepool/proc_overview
+ sleep 2
+ done
+} &
+done
+wait
+
--
2.43.0
2
1
[PATCH OLK-6.6] wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
by Yi Yang 09 Apr '26
by Yi Yang 09 Apr '26
09 Apr '26
From: Felix Fietkau <nbd(a)nbd.name>
mainline inclusion
from mainline-v7.0-rc5
commit d5ad6ab61cbd89afdb60881f6274f74328af3ee9
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14084
CVE: CVE-2026-23444
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
ieee80211_tx_prepare_skb() has three error paths, but only two of them
free the skb. The first error path (ieee80211_tx_prepare() returning
TX_DROP) does not free it, while invoke_tx_handlers() failure and the
fragmentation check both do.
Add kfree_skb() to the first error path so all three are consistent,
and remove the now-redundant frees in callers (ath9k, mt76,
mac80211_hwsim) to avoid double-free.
Document the skb ownership guarantee in the function's kdoc.
Signed-off-by: Felix Fietkau <nbd(a)nbd.name>
Link: https://patch.msgid.link/20260314065455.2462900-1-nbd@nbd.name
Fixes: 06be6b149f7e ("mac80211: add ieee80211_tx_prepare_skb() helper function")
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
Conflicts:
include/net/mac80211.h
[Commit 0e9824e0d59b2 ("wifi: mac80211: Add missing return value
documentation") was not merged. Context conflicts.]
Signed-off-by: Yi Yang <yiyang13(a)huawei.com>
---
drivers/net/wireless/ath/ath9k/channel.c | 6 ++----
drivers/net/wireless/virtual/mac80211_hwsim.c | 1 -
include/net/mac80211.h | 4 ++++
net/mac80211/tx.c | 4 +++-
4 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/channel.c b/drivers/net/wireless/ath/ath9k/channel.c
index 571062f2e82a..ba8ec5112afe 100644
--- a/drivers/net/wireless/ath/ath9k/channel.c
+++ b/drivers/net/wireless/ath/ath9k/channel.c
@@ -1011,7 +1011,7 @@ static void ath_scan_send_probe(struct ath_softc *sc,
skb_set_queue_mapping(skb, IEEE80211_AC_VO);
if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, NULL))
- goto error;
+ return;
txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
if (ath_tx_start(sc->hw, skb, &txctl))
@@ -1124,10 +1124,8 @@ ath_chanctx_send_vif_ps_frame(struct ath_softc *sc, struct ath_vif *avp,
skb->priority = 7;
skb_set_queue_mapping(skb, IEEE80211_AC_VO);
- if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta)) {
- dev_kfree_skb_any(skb);
+ if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta))
return false;
- }
break;
default:
return false;
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index 1214e7dcc812..bf12ff0ab06a 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -2892,7 +2892,6 @@ static void hw_scan_work(struct work_struct *work)
hwsim->tmp_chan->band,
NULL)) {
rcu_read_unlock();
- kfree_skb(probe);
continue;
}
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index adaa1b2323d2..85d785060e76 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -7032,6 +7032,10 @@ void ieee80211_report_wowlan_wakeup(struct ieee80211_vif *vif,
* @band: the band to transmit on
* @sta: optional pointer to get the station to send the frame to
*
+ * Return: %true if the skb was prepared, %false otherwise.
+ * On failure, the skb is freed by this function; callers must not
+ * free it again.
+ *
* Note: must be called under RCU lock
*/
bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 7eddcb6f9645..2a708132320c 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1911,8 +1911,10 @@ bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
struct ieee80211_tx_data tx;
struct sk_buff *skb2;
- if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP)
+ if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP) {
+ kfree_skb(skb);
return false;
+ }
info->band = band;
info->control.vif = vif;
--
2.25.1
2
1
[PATCH openEuler-1.0-LTS] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
by Chen Jinghuang 09 Apr '26
by Chen Jinghuang 09 Apr '26
09 Apr '26
From: Jens Axboe <axboe(a)kernel.dk>
mainline inclusion
from mainline-v7.0-rc2
commit bfbc0b5b32a8f28ce284add619bf226716a59bc0
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13873
CVE: CVE-2026-23253
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the
DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which
reinitializes the waitqueue list head to empty.
Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the
same DVR device share it), this orphans any existing waitqueue entries
from io_uring poll or epoll, leaving them with stale prev/next pointers
while the list head is reset to {self, self}.
The waitqueue and spinlock in dvr_buffer are already properly
initialized once in dvb_dmxdev_init(). The open path only needs to
reset the buffer data pointer, size, and read/write positions.
Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct
assignment of data/size and a call to dvb_ringbuffer_reset(), which
properly resets pread, pwrite, and error with correct memory ordering
without touching the waitqueue or spinlock.
Cc: stable(a)vger.kernel.org
Fixes: 34731df288a5f ("V4L/DVB (3501): Dmxdev: use dvb_ringbuffer")
Reported-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com
Tested-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/698a26d3.050a0220.3b3015.007d.GAE@google.com/
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
Conflicts:
drivers/media/dvb-core/dmxdev.c
[context conflict]
Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com>
---
drivers/media/dvb-core/dmxdev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index 12b7f698f562..c32adebd0e16 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -178,7 +178,9 @@ static int dvb_dvr_open(struct inode *inode, struct file *file)
mutex_unlock(&dmxdev->mutex);
return -ENOMEM;
}
- dvb_ringbuffer_init(&dmxdev->dvr_buffer, mem, DVR_BUFFER_SIZE);
+ dmxdev->dvr_buffer.data = mem;
+ dmxdev->dvr_buffer.size = DVR_BUFFER_SIZE;
+ dvb_ringbuffer_reset(&dmxdev->dvr_buffer);
if (dmxdev->may_do_mmap)
dvb_vb2_init(&dmxdev->dvr_vb2_ctx, "dvr",
file->f_flags & O_NONBLOCK);
--
2.34.1
2
1
08 Apr '26
From: John Johansen <john.johansen(a)canonical.com>
mainline inclusion
from mainline-v7.0-rc4
commit 8e135b8aee5a06c52a4347a5a6d51223c6f36ba3
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14042
CVE: CVE-2026-23411
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
AppArmor was putting the reference to i_private data on its end after
removing the original entry from the file system. However the inode
can aand does live beyond that point and it is possible that some of
the fs call back functions will be invoked after the reference has
been put, which results in a race between freeing the data and
accessing it through the fs.
While the rawdata/loaddata is the most likely candidate to fail the
race, as it has the fewest references. If properly crafted it might be
possible to trigger a race for the other types stored in i_private.
Fix this by moving the put of i_private referenced data to the correct
place which is during inode eviction.
Fixes: c961ee5f21b20 ("apparmor: convert from securityfs to apparmorfs for policy ns files")
Reported-by: Qualys Security Advisory <qsa(a)qualys.com>
Reviewed-by: Georgia Garcia <georgia.garcia(a)canonical.com>
Reviewed-by: Maxime Bélair <maxime.belair(a)canonical.com>
Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com>
Signed-off-by: John Johansen <john.johansen(a)canonical.com>
Conflicts:
security/apparmor/apparmorfs.c
[Commit 92de220a7f33 ("update policy capable checks to use a label")
and commit 482e8050aab4 ("apparmor: don't create raw_sha1 symlink if
sha1 hashing is disabled") was not merged. Context conflicts.]
security/apparmor/include/label.h
[Commit 88fec3526e84 ("apparmor: make sure unix socket labeling is
correctly updated.") was not merged. Context conflicts.]
security/apparmor/label.c
[Commit 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for
non-scalar types") was not merged. Context conflicts.]
Signed-off-by: Yi Yang <yiyang13(a)huawei.com>
---
security/apparmor/apparmorfs.c | 194 +++++++++++++---------
security/apparmor/include/label.h | 16 +-
security/apparmor/include/lib.h | 12 ++
security/apparmor/include/policy.h | 8 +-
security/apparmor/include/policy_unpack.h | 6 +-
security/apparmor/label.c | 12 +-
security/apparmor/policy_unpack.c | 6 +-
7 files changed, 153 insertions(+), 101 deletions(-)
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index e034d3346f82..500a2b46ec50 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -32,6 +32,7 @@
#include "include/crypto.h"
#include "include/ipc.h"
#include "include/label.h"
+#include "include/lib.h"
#include "include/policy.h"
#include "include/policy_ns.h"
#include "include/resource.h"
@@ -61,6 +62,7 @@
* securityfs and apparmorfs filesystems.
*/
+#define IREF_POISON 101
/*
* support fns
@@ -150,6 +152,71 @@ static int aafs_show_path(struct seq_file *seq, struct dentry *dentry)
return 0;
}
+static struct aa_ns *get_ns_common_ref(struct aa_common_ref *ref)
+{
+ if (ref) {
+ struct aa_label *reflabel = container_of(ref, struct aa_label,
+ count);
+ return aa_get_ns(labels_ns(reflabel));
+ }
+
+ return NULL;
+}
+
+static struct aa_proxy *get_proxy_common_ref(struct aa_common_ref *ref)
+{
+ if (ref)
+ return aa_get_proxy(container_of(ref, struct aa_proxy, count));
+
+ return NULL;
+}
+
+static struct aa_loaddata *get_loaddata_common_ref(struct aa_common_ref *ref)
+{
+ if (ref)
+ return aa_get_i_loaddata(container_of(ref, struct aa_loaddata,
+ count));
+ return NULL;
+}
+
+static void aa_put_common_ref(struct aa_common_ref *ref)
+{
+ if (!ref)
+ return;
+
+ switch (ref->reftype) {
+ case REF_RAWDATA:
+ aa_put_i_loaddata(container_of(ref, struct aa_loaddata,
+ count));
+ break;
+ case REF_PROXY:
+ aa_put_proxy(container_of(ref, struct aa_proxy,
+ count));
+ break;
+ case REF_NS:
+ /* ns count is held on its unconfined label */
+ aa_put_ns(labels_ns(container_of(ref, struct aa_label, count)));
+ break;
+ default:
+ AA_BUG(true, "unknown refcount type");
+ break;
+ }
+}
+
+static void aa_get_common_ref(struct aa_common_ref *ref)
+{
+ kref_get(&ref->count);
+}
+
+static void aafs_evict(struct inode *inode)
+{
+ struct aa_common_ref *ref = inode->i_private;
+
+ clear_inode(inode);
+ aa_put_common_ref(ref);
+ inode->i_private = (void *) IREF_POISON;
+}
+
static void aafs_free_inode(struct inode *inode)
{
if (S_ISLNK(inode->i_mode))
@@ -159,6 +226,7 @@ static void aafs_free_inode(struct inode *inode)
static const struct super_operations aafs_super_ops = {
.statfs = simple_statfs,
+ .evict_inode = aafs_evict,
.free_inode = aafs_free_inode,
.show_path = aafs_show_path,
};
@@ -259,7 +327,8 @@ static int __aafs_setup_d_inode(struct inode *dir, struct dentry *dentry,
* aafs_remove(). Will return ERR_PTR on failure.
*/
static struct dentry *aafs_create(const char *name, umode_t mode,
- struct dentry *parent, void *data, void *link,
+ struct dentry *parent,
+ struct aa_common_ref *data, void *link,
const struct file_operations *fops,
const struct inode_operations *iops)
{
@@ -296,6 +365,9 @@ static struct dentry *aafs_create(const char *name, umode_t mode,
goto fail_dentry;
inode_unlock(dir);
+ if (data)
+ aa_get_common_ref(data);
+
return dentry;
fail_dentry:
@@ -320,7 +392,8 @@ static struct dentry *aafs_create(const char *name, umode_t mode,
* see aafs_create
*/
static struct dentry *aafs_create_file(const char *name, umode_t mode,
- struct dentry *parent, void *data,
+ struct dentry *parent,
+ struct aa_common_ref *data,
const struct file_operations *fops)
{
return aafs_create(name, mode, parent, data, NULL, fops, NULL);
@@ -445,7 +518,7 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size,
static ssize_t profile_load(struct file *f, const char __user *buf, size_t size,
loff_t *pos)
{
- struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
+ struct aa_ns *ns = get_ns_common_ref(f->f_inode->i_private);
int error = policy_update(AA_MAY_LOAD_POLICY, buf, size, pos, ns,
f->f_cred);
@@ -463,7 +536,7 @@ static const struct file_operations aa_fs_profile_load = {
static ssize_t profile_replace(struct file *f, const char __user *buf,
size_t size, loff_t *pos)
{
- struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
+ struct aa_ns *ns = get_ns_common_ref(f->f_inode->i_private);
int error = policy_update(AA_MAY_LOAD_POLICY | AA_MAY_REPLACE_POLICY,
buf, size, pos, ns, f->f_cred);
aa_put_ns(ns);
@@ -483,7 +556,7 @@ static ssize_t profile_remove(struct file *f, const char __user *buf,
struct aa_loaddata *data;
struct aa_label *label;
ssize_t error;
- struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
+ struct aa_ns *ns = get_ns_common_ref(f->f_inode->i_private);
label = begin_current_label_crit_section();
/* high level check about policy management - fine grained in
@@ -573,7 +646,7 @@ static int ns_revision_open(struct inode *inode, struct file *file)
if (!rev)
return -ENOMEM;
- rev->ns = aa_get_ns(inode->i_private);
+ rev->ns = get_ns_common_ref(inode->i_private);
if (!rev->ns)
rev->ns = aa_get_current_ns();
file->private_data = rev;
@@ -1051,7 +1124,7 @@ static const struct file_operations seq_profile_ ##NAME ##_fops = { \
static int seq_profile_open(struct inode *inode, struct file *file,
int (*show)(struct seq_file *, void *))
{
- struct aa_proxy *proxy = aa_get_proxy(inode->i_private);
+ struct aa_proxy *proxy = get_proxy_common_ref(inode->i_private);
int error = single_open(file, show, proxy);
if (error) {
@@ -1229,7 +1302,7 @@ static const struct file_operations seq_rawdata_ ##NAME ##_fops = { \
static int seq_rawdata_open(struct inode *inode, struct file *file,
int (*show)(struct seq_file *, void *))
{
- struct aa_loaddata *data = aa_get_i_loaddata(inode->i_private);
+ struct aa_loaddata *data = get_loaddata_common_ref(inode->i_private);
int error;
if (!data)
@@ -1369,7 +1442,7 @@ static int rawdata_open(struct inode *inode, struct file *file)
if (!policy_view_capable(NULL))
return -EACCES;
- loaddata = aa_get_i_loaddata(inode->i_private);
+ loaddata = get_loaddata_common_ref(inode->i_private);
if (!loaddata)
return -ENOENT;
@@ -1414,7 +1487,6 @@ static void remove_rawdata_dents(struct aa_loaddata *rawdata)
if (!IS_ERR_OR_NULL(rawdata->dents[i])) {
aafs_remove(rawdata->dents[i]);
rawdata->dents[i] = NULL;
- aa_put_i_loaddata(rawdata);
}
}
}
@@ -1453,45 +1525,41 @@ int __aa_fs_create_rawdata(struct aa_ns *ns, struct aa_loaddata *rawdata)
if (IS_ERR(dir))
/* ->name freed when rawdata freed */
return PTR_ERR(dir);
- aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_DIR] = dir;
- dent = aafs_create_file("abi", S_IFREG | 0444, dir, rawdata,
+ dent = aafs_create_file("abi", S_IFREG | 0444, dir, &rawdata->count,
&seq_rawdata_abi_fops);
if (IS_ERR(dent))
goto fail;
- aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_ABI] = dent;
- dent = aafs_create_file("revision", S_IFREG | 0444, dir, rawdata,
- &seq_rawdata_revision_fops);
+ dent = aafs_create_file("revision", S_IFREG | 0444, dir,
+ &rawdata->count,
+ &seq_rawdata_revision_fops);
if (IS_ERR(dent))
goto fail;
- aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_REVISION] = dent;
if (aa_g_hash_policy) {
dent = aafs_create_file("sha1", S_IFREG | 0444, dir,
- rawdata, &seq_rawdata_hash_fops);
+ &rawdata->count,
+ &seq_rawdata_hash_fops);
if (IS_ERR(dent))
goto fail;
- aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_HASH] = dent;
}
dent = aafs_create_file("compressed_size", S_IFREG | 0444, dir,
- rawdata,
+ &rawdata->count,
&seq_rawdata_compressed_size_fops);
if (IS_ERR(dent))
goto fail;
- aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_COMPRESSED_SIZE] = dent;
- dent = aafs_create_file("raw_data", S_IFREG | 0444,
- dir, rawdata, &rawdata_fops);
+ dent = aafs_create_file("raw_data", S_IFREG | 0444, dir,
+ &rawdata->count, &rawdata_fops);
if (IS_ERR(dent))
goto fail;
- aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_DATA] = dent;
d_inode(dent)->i_size = rawdata->size;
@@ -1502,7 +1570,6 @@ int __aa_fs_create_rawdata(struct aa_ns *ns, struct aa_loaddata *rawdata)
fail:
remove_rawdata_dents(rawdata);
- aa_put_i_loaddata(rawdata);
return PTR_ERR(dent);
}
@@ -1524,13 +1591,10 @@ void __aafs_profile_rmdir(struct aa_profile *profile)
__aafs_profile_rmdir(child);
for (i = AAFS_PROF_SIZEOF - 1; i >= 0; --i) {
- struct aa_proxy *proxy;
if (!profile->dents[i])
continue;
- proxy = d_inode(profile->dents[i])->i_private;
aafs_remove(profile->dents[i]);
- aa_put_proxy(proxy);
profile->dents[i] = NULL;
}
}
@@ -1560,14 +1624,7 @@ static struct dentry *create_profile_file(struct dentry *dir, const char *name,
struct aa_profile *profile,
const struct file_operations *fops)
{
- struct aa_proxy *proxy = aa_get_proxy(profile->label.proxy);
- struct dentry *dent;
-
- dent = aafs_create_file(name, S_IFREG | 0444, dir, proxy, fops);
- if (IS_ERR(dent))
- aa_put_proxy(proxy);
-
- return dent;
+ return aafs_create_file(name, S_IFREG | 0444, dir, &profile->label.proxy->count, fops);
}
static int profile_depth(struct aa_profile *profile)
@@ -1617,7 +1674,8 @@ static const char *rawdata_get_link_base(struct dentry *dentry,
struct delayed_call *done,
const char *name)
{
- struct aa_proxy *proxy = inode->i_private;
+ struct aa_common_ref *ref = inode->i_private;
+ struct aa_proxy *proxy = container_of(ref, struct aa_proxy, count);
struct aa_label *label;
struct aa_profile *profile;
char *target;
@@ -1748,27 +1806,24 @@ int __aafs_profile_mkdir(struct aa_profile *profile, struct dentry *parent)
if (profile->rawdata) {
dent = aafs_create("raw_sha1", S_IFLNK | 0444, dir,
- profile->label.proxy, NULL, NULL,
- &rawdata_link_sha1_iops);
+ &profile->label.proxy->count, NULL,
+ NULL, &rawdata_link_sha1_iops);
if (IS_ERR(dent))
goto fail;
- aa_get_proxy(profile->label.proxy);
profile->dents[AAFS_PROF_RAW_HASH] = dent;
dent = aafs_create("raw_abi", S_IFLNK | 0444, dir,
- profile->label.proxy, NULL, NULL,
+ &profile->label.proxy->count, NULL, NULL,
&rawdata_link_abi_iops);
if (IS_ERR(dent))
goto fail;
- aa_get_proxy(profile->label.proxy);
profile->dents[AAFS_PROF_RAW_ABI] = dent;
dent = aafs_create("raw_data", S_IFLNK | 0444, dir,
- profile->label.proxy, NULL, NULL,
+ &profile->label.proxy->count, NULL, NULL,
&rawdata_link_data_iops);
if (IS_ERR(dent))
goto fail;
- aa_get_proxy(profile->label.proxy);
profile->dents[AAFS_PROF_RAW_DATA] = dent;
}
@@ -1803,7 +1858,7 @@ static int ns_mkdir_op(struct inode *dir, struct dentry *dentry, umode_t mode)
if (error)
return error;
- parent = aa_get_ns(dir->i_private);
+ parent = get_ns_common_ref(dir->i_private);
AA_BUG(d_inode(ns_subns_dir(parent)) != dir);
/* we have to unlock and then relock to get locking order right
@@ -1853,7 +1908,7 @@ static int ns_rmdir_op(struct inode *dir, struct dentry *dentry)
if (error)
return error;
- parent = aa_get_ns(dir->i_private);
+ parent = get_ns_common_ref(dir->i_private);
/* rmdir calls the generic securityfs functions to remove files
* from the apparmor dir. It is up to the apparmor ns locking
* to avoid races.
@@ -1923,27 +1978,6 @@ void __aafs_ns_rmdir(struct aa_ns *ns)
__aa_fs_list_remove_rawdata(ns);
- if (ns_subns_dir(ns)) {
- sub = d_inode(ns_subns_dir(ns))->i_private;
- aa_put_ns(sub);
- }
- if (ns_subload(ns)) {
- sub = d_inode(ns_subload(ns))->i_private;
- aa_put_ns(sub);
- }
- if (ns_subreplace(ns)) {
- sub = d_inode(ns_subreplace(ns))->i_private;
- aa_put_ns(sub);
- }
- if (ns_subremove(ns)) {
- sub = d_inode(ns_subremove(ns))->i_private;
- aa_put_ns(sub);
- }
- if (ns_subrevision(ns)) {
- sub = d_inode(ns_subrevision(ns))->i_private;
- aa_put_ns(sub);
- }
-
for (i = AAFS_NS_SIZEOF - 1; i >= 0; --i) {
aafs_remove(ns->dents[i]);
ns->dents[i] = NULL;
@@ -1968,40 +2002,40 @@ static int __aafs_ns_mkdir_entries(struct aa_ns *ns, struct dentry *dir)
return PTR_ERR(dent);
ns_subdata_dir(ns) = dent;
- dent = aafs_create_file("revision", 0444, dir, ns,
+ dent = aafs_create_file("revision", 0444, dir,
+ &ns->unconfined->label.count,
&aa_fs_ns_revision_fops);
if (IS_ERR(dent))
return PTR_ERR(dent);
- aa_get_ns(ns);
ns_subrevision(ns) = dent;
- dent = aafs_create_file(".load", 0640, dir, ns,
- &aa_fs_profile_load);
+ dent = aafs_create_file(".load", 0640, dir,
+ &ns->unconfined->label.count,
+ &aa_fs_profile_load);
if (IS_ERR(dent))
return PTR_ERR(dent);
- aa_get_ns(ns);
ns_subload(ns) = dent;
- dent = aafs_create_file(".replace", 0640, dir, ns,
- &aa_fs_profile_replace);
+ dent = aafs_create_file(".replace", 0640, dir,
+ &ns->unconfined->label.count,
+ &aa_fs_profile_replace);
if (IS_ERR(dent))
return PTR_ERR(dent);
- aa_get_ns(ns);
ns_subreplace(ns) = dent;
- dent = aafs_create_file(".remove", 0640, dir, ns,
- &aa_fs_profile_remove);
+ dent = aafs_create_file(".remove", 0640, dir,
+ &ns->unconfined->label.count,
+ &aa_fs_profile_remove);
if (IS_ERR(dent))
return PTR_ERR(dent);
- aa_get_ns(ns);
ns_subremove(ns) = dent;
/* use create_dentry so we can supply private data */
- dent = aafs_create("namespaces", S_IFDIR | 0755, dir, ns, NULL, NULL,
- &ns_dir_inode_operations);
+ dent = aafs_create("namespaces", S_IFDIR | 0755, dir,
+ &ns->unconfined->label.count,
+ NULL, NULL, &ns_dir_inode_operations);
if (IS_ERR(dent))
return PTR_ERR(dent);
- aa_get_ns(ns);
ns_subns_dir(ns) = dent;
return 0;
diff --git a/security/apparmor/include/label.h b/security/apparmor/include/label.h
index 1e90384b1523..55986388dfae 100644
--- a/security/apparmor/include/label.h
+++ b/security/apparmor/include/label.h
@@ -103,7 +103,7 @@ enum label_flags {
struct aa_label;
struct aa_proxy {
- struct kref count;
+ struct aa_common_ref count;
struct aa_label __rcu *label;
};
@@ -123,7 +123,7 @@ struct label_it {
* @ent: set of profiles for label, actual size determined by @size
*/
struct aa_label {
- struct kref count;
+ struct aa_common_ref count;
struct rb_node node;
struct rcu_head rcu;
struct aa_proxy *proxy;
@@ -373,7 +373,7 @@ int aa_label_match(struct aa_profile *profile, struct aa_label *label,
*/
static inline struct aa_label *__aa_get_label(struct aa_label *l)
{
- if (l && kref_get_unless_zero(&l->count))
+ if (l && kref_get_unless_zero(&l->count.count))
return l;
return NULL;
@@ -382,7 +382,7 @@ static inline struct aa_label *__aa_get_label(struct aa_label *l)
static inline struct aa_label *aa_get_label(struct aa_label *l)
{
if (l)
- kref_get(&(l->count));
+ kref_get(&(l->count.count));
return l;
}
@@ -402,7 +402,7 @@ static inline struct aa_label *aa_get_label_rcu(struct aa_label __rcu **l)
rcu_read_lock();
do {
c = rcu_dereference(*l);
- } while (c && !kref_get_unless_zero(&c->count));
+ } while (c && !kref_get_unless_zero(&c->count.count));
rcu_read_unlock();
return c;
@@ -442,7 +442,7 @@ static inline struct aa_label *aa_get_newest_label(struct aa_label *l)
static inline void aa_put_label(struct aa_label *l)
{
if (l)
- kref_put(&l->count, aa_label_kref);
+ kref_put(&l->count.count, aa_label_kref);
}
@@ -452,7 +452,7 @@ void aa_proxy_kref(struct kref *kref);
static inline struct aa_proxy *aa_get_proxy(struct aa_proxy *proxy)
{
if (proxy)
- kref_get(&(proxy->count));
+ kref_get(&(proxy->count.count));
return proxy;
}
@@ -460,7 +460,7 @@ static inline struct aa_proxy *aa_get_proxy(struct aa_proxy *proxy)
static inline void aa_put_proxy(struct aa_proxy *proxy)
{
if (proxy)
- kref_put(&proxy->count, aa_proxy_kref);
+ kref_put(&proxy->count.count, aa_proxy_kref);
}
void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new);
diff --git a/security/apparmor/include/lib.h b/security/apparmor/include/lib.h
index ac5054899f6f..624178827fd2 100644
--- a/security/apparmor/include/lib.h
+++ b/security/apparmor/include/lib.h
@@ -60,6 +60,18 @@ void aa_info_message(const char *str);
/* Security blob offsets */
extern struct lsm_blob_sizes apparmor_blob_sizes;
+enum reftype {
+ REF_NS,
+ REF_PROXY,
+ REF_RAWDATA,
+};
+
+/* common reference count used by data the shows up in aafs */
+struct aa_common_ref {
+ struct kref count;
+ enum reftype reftype;
+};
+
/**
* aa_strneq - compare null terminated @str to a non null terminated substring
* @str: a null terminated string
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index f6682a31df23..ea91591659b5 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -243,7 +243,7 @@ static inline unsigned int PROFILE_MEDIATES_AF(struct aa_profile *profile,
static inline struct aa_profile *aa_get_profile(struct aa_profile *p)
{
if (p)
- kref_get(&(p->label.count));
+ kref_get(&(p->label.count.count));
return p;
}
@@ -257,7 +257,7 @@ static inline struct aa_profile *aa_get_profile(struct aa_profile *p)
*/
static inline struct aa_profile *aa_get_profile_not0(struct aa_profile *p)
{
- if (p && kref_get_unless_zero(&p->label.count))
+ if (p && kref_get_unless_zero(&p->label.count.count))
return p;
return NULL;
@@ -277,7 +277,7 @@ static inline struct aa_profile *aa_get_profile_rcu(struct aa_profile __rcu **p)
rcu_read_lock();
do {
c = rcu_dereference(*p);
- } while (c && !kref_get_unless_zero(&c->label.count));
+ } while (c && !kref_get_unless_zero(&c->label.count.count));
rcu_read_unlock();
return c;
@@ -290,7 +290,7 @@ static inline struct aa_profile *aa_get_profile_rcu(struct aa_profile __rcu **p)
static inline void aa_put_profile(struct aa_profile *p)
{
if (p)
- kref_put(&p->label.count, aa_label_kref);
+ kref_put(&p->label.count.count, aa_label_kref);
}
static inline int AUDIT_MODE(struct aa_profile *profile)
diff --git a/security/apparmor/include/policy_unpack.h b/security/apparmor/include/policy_unpack.h
index ff122fd156de..05baab73b578 100644
--- a/security/apparmor/include/policy_unpack.h
+++ b/security/apparmor/include/policy_unpack.h
@@ -67,7 +67,7 @@ enum {
* fs entries and drops the associated @count ref.
*/
struct aa_loaddata {
- struct kref count;
+ struct aa_common_ref count;
struct kref pcount;
struct list_head list;
struct work_struct work;
@@ -102,7 +102,7 @@ aa_get_i_loaddata(struct aa_loaddata *data)
{
if (data)
- kref_get(&(data->count));
+ kref_get(&(data->count.count));
return data;
}
@@ -129,7 +129,7 @@ struct aa_loaddata *aa_loaddata_alloc(size_t size);
static inline void aa_put_i_loaddata(struct aa_loaddata *data)
{
if (data)
- kref_put(&data->count, aa_loaddata_kref);
+ kref_put(&data->count.count, aa_loaddata_kref);
}
static inline void aa_put_profile_loaddata(struct aa_loaddata *data)
diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index 66bc4704f804..7cae71daa0f9 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -52,7 +52,8 @@ static void free_proxy(struct aa_proxy *proxy)
void aa_proxy_kref(struct kref *kref)
{
- struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
+ struct aa_proxy *proxy = container_of(kref, struct aa_proxy,
+ count.count);
free_proxy(proxy);
}
@@ -63,7 +64,8 @@ struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
new = kzalloc(sizeof(struct aa_proxy), gfp);
if (new) {
- kref_init(&new->count);
+ kref_init(&new->count.count);
+ new->count.reftype = REF_PROXY;
rcu_assign_pointer(new->label, aa_get_label(label));
}
return new;
@@ -366,7 +368,8 @@ static void label_free_rcu(struct rcu_head *head)
void aa_label_kref(struct kref *kref)
{
- struct aa_label *label = container_of(kref, struct aa_label, count);
+ struct aa_label *label = container_of(kref, struct aa_label,
+ count.count);
struct aa_ns *ns = labels_ns(label);
if (!ns) {
@@ -403,7 +406,8 @@ bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
label->size = size; /* doesn't include null */
label->vec[size] = NULL; /* null terminate */
- kref_init(&label->count);
+ kref_init(&label->count.count);
+ label->count.reftype = REF_NS; /* for aafs purposes */
RB_CLEAR_NODE(&label->node);
return true;
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 33f5eabd47f1..33fac6489077 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -157,7 +157,8 @@ static void do_loaddata_free(struct aa_loaddata *d)
void aa_loaddata_kref(struct kref *kref)
{
- struct aa_loaddata *d = container_of(kref, struct aa_loaddata, count);
+ struct aa_loaddata *d = container_of(kref, struct aa_loaddata,
+ count.count);
do_loaddata_free(d);
}
@@ -204,7 +205,8 @@ struct aa_loaddata *aa_loaddata_alloc(size_t size)
kfree(d);
return ERR_PTR(-ENOMEM);
}
- kref_init(&d->count);
+ kref_init(&d->count.count);
+ d->count.reftype = REF_RAWDATA;
kref_init(&d->pcount);
INIT_LIST_HEAD(&d->list);
--
2.25.1
2
1
08 Apr '26
Reuse SUBSYS for xcu and freezer to preserve KABI
Liu Kai (5):
xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI
xSched/cgroup: make xcu.stat invisible at root cgroup
cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16
xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86
defconfig
xSched: update xSched manual for xcu cmdline enable option
Documentation/scheduler/xsched.md | 6 +-
arch/arm64/configs/openeuler_defconfig | 3 +-
arch/x86/configs/openeuler_defconfig | 3 +-
include/linux/cgroup_subsys.h | 8 +-
include/linux/freezer.h | 24 ++++
kernel/cgroup/cgroup.c | 2 +-
kernel/cgroup/legacy_freezer.c | 33 ++++-
kernel/xsched/cgroup.c | 187 +++++++++++++++++++++++--
8 files changed, 238 insertions(+), 28 deletions(-)
--
2.34.1
2
6
From: John Johansen <john.johansen(a)canonical.com>
mainline inclusion
from mainline-v7.0-rc4
commit a0b7091c4de45a7325c8780e6934a894f92ac86b
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14041
CVE: CVE-2026-23410
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
There is a race condition that leads to a use-after-free situation:
because the rawdata inodes are not refcounted, an attacker can start
open()ing one of the rawdata files, and at the same time remove the
last reference to this rawdata (by removing the corresponding profile,
for example), which frees its struct aa_loaddata; as a result, when
seq_rawdata_open() is reached, i_private is a dangling pointer and
freed memory is accessed.
The rawdata inodes weren't refcounted to avoid a circular refcount and
were supposed to be held by the profile rawdata reference. However
during profile removal there is a window where the vfs and profile
destruction race, resulting in the use after free.
Fix this by moving to a double refcount scheme. Where the profile
refcount on rawdata is used to break the circular dependency. Allowing
for freeing of the rawdata once all inode references to the rawdata
are put.
Fixes: 5d5182cae401 ("apparmor: move to per loaddata files, instead of replicating in profiles")
Reported-by: Qualys Security Advisory <qsa(a)qualys.com>
Reviewed-by: Georgia Garcia <georgia.garcia(a)canonical.com>
Reviewed-by: Maxime Bélair <maxime.belair(a)canonical.com>
Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com>
Tested-by: Salvatore Bonaccorso <carnil(a)debian.org>
Signed-off-by: John Johansen <john.johansen(a)canonical.com>
Conflicts:
security/apparmor/apparmorfs.c
[Commit d61c57fde819 ("apparmor: make export of raw binary profile to
userspace optional") was not merged. Context conflicts.]
security/apparmor/include/policy_unpack.h
[Commit b11e51dd7094 ("apparmor: test: make static symbols visible during i
kunit testing") was not merged. Context conflicts.]
security/apparmor/policy.c
[Commit d61c57fde819 ("apparmor: make export of raw binary profile to
userspace optional") was not merged. Context conflicts.]
Signed-off-by: Yi Yang <yiyang13(a)huawei.com>
---
security/apparmor/apparmorfs.c | 35 +++++++-----
security/apparmor/include/policy_unpack.h | 70 ++++++++++++++---------
security/apparmor/policy.c | 12 ++--
security/apparmor/policy_unpack.c | 32 ++++++++---
4 files changed, 92 insertions(+), 57 deletions(-)
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 0900fd07def7..e034d3346f82 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -77,7 +77,7 @@ static void rawdata_f_data_free(struct rawdata_f_data *private)
if (!private)
return;
- aa_put_loaddata(private->loaddata);
+ aa_put_i_loaddata(private->loaddata);
kvfree(private);
}
@@ -401,7 +401,8 @@ static struct aa_loaddata *aa_simple_write_to_buffer(const char __user *userbuf,
data->size = copy_size;
if (copy_from_user(data->data, userbuf, copy_size)) {
- aa_put_loaddata(data);
+ /* trigger free - don't need to put pcount */
+ aa_put_i_loaddata(data);
return ERR_PTR(-EFAULT);
}
@@ -429,7 +430,10 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size,
error = PTR_ERR(data);
if (!IS_ERR(data)) {
error = aa_replace_profiles(ns, label, mask, data);
- aa_put_loaddata(data);
+ /* put pcount, which will put count and free if no
+ * profiles referencing it.
+ */
+ aa_put_profile_loaddata(data);
}
end_section:
end_current_label_crit_section(label);
@@ -500,7 +504,7 @@ static ssize_t profile_remove(struct file *f, const char __user *buf,
if (!IS_ERR(data)) {
data->data[size] = 0;
error = aa_remove_profiles(ns, label, data->data, size);
- aa_put_loaddata(data);
+ aa_put_profile_loaddata(data);
}
out:
end_current_label_crit_section(label);
@@ -1225,18 +1229,17 @@ static const struct file_operations seq_rawdata_ ##NAME ##_fops = { \
static int seq_rawdata_open(struct inode *inode, struct file *file,
int (*show)(struct seq_file *, void *))
{
- struct aa_loaddata *data = __aa_get_loaddata(inode->i_private);
+ struct aa_loaddata *data = aa_get_i_loaddata(inode->i_private);
int error;
if (!data)
- /* lost race this ent is being reaped */
return -ENOENT;
error = single_open(file, show, data);
if (error) {
AA_BUG(file->private_data &&
((struct seq_file *)file->private_data)->private);
- aa_put_loaddata(data);
+ aa_put_i_loaddata(data);
}
return error;
@@ -1247,7 +1250,7 @@ static int seq_rawdata_release(struct inode *inode, struct file *file)
struct seq_file *seq = (struct seq_file *) file->private_data;
if (seq)
- aa_put_loaddata(seq->private);
+ aa_put_i_loaddata(seq->private);
return single_release(inode, file);
}
@@ -1366,9 +1369,8 @@ static int rawdata_open(struct inode *inode, struct file *file)
if (!policy_view_capable(NULL))
return -EACCES;
- loaddata = __aa_get_loaddata(inode->i_private);
+ loaddata = aa_get_i_loaddata(inode->i_private);
if (!loaddata)
- /* lost race: this entry is being reaped */
return -ENOENT;
private = rawdata_f_data_alloc(loaddata->size);
@@ -1393,7 +1395,7 @@ static int rawdata_open(struct inode *inode, struct file *file)
return error;
fail_private_alloc:
- aa_put_loaddata(loaddata);
+ aa_put_i_loaddata(loaddata);
return error;
}
@@ -1410,9 +1412,9 @@ static void remove_rawdata_dents(struct aa_loaddata *rawdata)
for (i = 0; i < AAFS_LOADDATA_NDENTS; i++) {
if (!IS_ERR_OR_NULL(rawdata->dents[i])) {
- /* no refcounts on i_private */
aafs_remove(rawdata->dents[i]);
rawdata->dents[i] = NULL;
+ aa_put_i_loaddata(rawdata);
}
}
}
@@ -1451,18 +1453,21 @@ int __aa_fs_create_rawdata(struct aa_ns *ns, struct aa_loaddata *rawdata)
if (IS_ERR(dir))
/* ->name freed when rawdata freed */
return PTR_ERR(dir);
+ aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_DIR] = dir;
dent = aafs_create_file("abi", S_IFREG | 0444, dir, rawdata,
&seq_rawdata_abi_fops);
if (IS_ERR(dent))
goto fail;
+ aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_ABI] = dent;
dent = aafs_create_file("revision", S_IFREG | 0444, dir, rawdata,
&seq_rawdata_revision_fops);
if (IS_ERR(dent))
goto fail;
+ aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_REVISION] = dent;
if (aa_g_hash_policy) {
@@ -1470,6 +1475,7 @@ int __aa_fs_create_rawdata(struct aa_ns *ns, struct aa_loaddata *rawdata)
rawdata, &seq_rawdata_hash_fops);
if (IS_ERR(dent))
goto fail;
+ aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_HASH] = dent;
}
@@ -1478,24 +1484,25 @@ int __aa_fs_create_rawdata(struct aa_ns *ns, struct aa_loaddata *rawdata)
&seq_rawdata_compressed_size_fops);
if (IS_ERR(dent))
goto fail;
+ aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_COMPRESSED_SIZE] = dent;
dent = aafs_create_file("raw_data", S_IFREG | 0444,
dir, rawdata, &rawdata_fops);
if (IS_ERR(dent))
goto fail;
+ aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_DATA] = dent;
d_inode(dent)->i_size = rawdata->size;
rawdata->ns = aa_get_ns(ns);
list_add(&rawdata->list, &ns->rawdata_list);
- /* no refcount on inode rawdata */
return 0;
fail:
remove_rawdata_dents(rawdata);
-
+ aa_put_i_loaddata(rawdata);
return PTR_ERR(dent);
}
diff --git a/security/apparmor/include/policy_unpack.h b/security/apparmor/include/policy_unpack.h
index e0e1ca7ebc38..ff122fd156de 100644
--- a/security/apparmor/include/policy_unpack.h
+++ b/security/apparmor/include/policy_unpack.h
@@ -46,17 +46,29 @@ enum {
AAFS_LOADDATA_NDENTS /* count of entries */
};
-/*
- * struct aa_loaddata - buffer of policy raw_data set
+/* struct aa_loaddata - buffer of policy raw_data set
+ * @count: inode/filesystem refcount - use aa_get_i_loaddata()
+ * @pcount: profile refcount - use aa_get_profile_loaddata()
+ * @list: list the loaddata is on
+ * @work: used to do a delayed cleanup
+ * @dents: refs to dents created in aafs
+ * @ns: the namespace this loaddata was loaded into
+ * @name:
+ * @size: the size of the data that was loaded
+ * @compressed_size: the size of the data when it is compressed
+ * @revision: unique revision count that this data was loaded as
+ * @abi: the abi number the loaddata uses
+ * @hash: a hash of the loaddata, used to help dedup data
*
- * there is no loaddata ref for being on ns list, nor a ref from
- * d_inode(@dentry) when grab a ref from these, @ns->lock must be held
- * && __aa_get_loaddata() needs to be used, and the return value
- * checked, if NULL the loaddata is already being reaped and should be
- * considered dead.
+ * There is no loaddata ref for being on ns->rawdata_list, so
+ * @ns->lock must be held when walking the list. Dentries and
+ * inode opens hold refs on @count; profiles hold refs on @pcount.
+ * When the last @pcount drops, do_ploaddata_rmfs() removes the
+ * fs entries and drops the associated @count ref.
*/
struct aa_loaddata {
struct kref count;
+ struct kref pcount;
struct list_head list;
struct work_struct work;
struct dentry *dents[AAFS_LOADDATA_NDENTS];
@@ -78,50 +90,52 @@ struct aa_loaddata {
int aa_unpack(struct aa_loaddata *udata, struct list_head *lh, const char **ns);
/**
- * __aa_get_loaddata - get a reference count to uncounted data reference
+ * aa_get_loaddata - get a reference count from a counted data reference
* @data: reference to get a count on
*
- * Returns: pointer to reference OR NULL if race is lost and reference is
- * being repeated.
- * Requires: @data->ns->lock held, and the return code MUST be checked
- *
- * Use only from inode->i_private and @data->list found references
+ * Returns: pointer to reference
+ * Requires: @data to have a valid reference count on it. It is a bug
+ * if the race to reap can be encountered when it is used.
*/
static inline struct aa_loaddata *
-__aa_get_loaddata(struct aa_loaddata *data)
+aa_get_i_loaddata(struct aa_loaddata *data)
{
- if (data && kref_get_unless_zero(&(data->count)))
- return data;
- return NULL;
+ if (data)
+ kref_get(&(data->count));
+ return data;
}
/**
- * aa_get_loaddata - get a reference count from a counted data reference
+ * aa_get_profile_loaddata - get a profile reference count on loaddata
* @data: reference to get a count on
*
- * Returns: point to reference
- * Requires: @data to have a valid reference count on it. It is a bug
- * if the race to reap can be encountered when it is used.
+ * Returns: pointer to reference
+ * Requires: @data to have a valid reference count on it.
*/
static inline struct aa_loaddata *
-aa_get_loaddata(struct aa_loaddata *data)
+aa_get_profile_loaddata(struct aa_loaddata *data)
{
- struct aa_loaddata *tmp = __aa_get_loaddata(data);
-
- AA_BUG(data && !tmp);
-
- return tmp;
+ if (data)
+ kref_get(&(data->pcount));
+ return data;
}
void __aa_loaddata_update(struct aa_loaddata *data, long revision);
bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r);
void aa_loaddata_kref(struct kref *kref);
+void aa_ploaddata_kref(struct kref *kref);
struct aa_loaddata *aa_loaddata_alloc(size_t size);
-static inline void aa_put_loaddata(struct aa_loaddata *data)
+static inline void aa_put_i_loaddata(struct aa_loaddata *data)
{
if (data)
kref_put(&data->count, aa_loaddata_kref);
}
+static inline void aa_put_profile_loaddata(struct aa_loaddata *data)
+{
+ if (data)
+ kref_put(&data->pcount, aa_ploaddata_kref);
+}
+
#endif /* __POLICY_INTERFACE_H */
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index e5f501f89803..3175094aa42b 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -241,7 +241,7 @@ void aa_free_profile(struct aa_profile *profile)
}
kfree_sensitive(profile->hash);
- aa_put_loaddata(profile->rawdata);
+ aa_put_profile_loaddata(profile->rawdata);
aa_label_destroy(&profile->label);
kfree_sensitive(profile);
@@ -899,7 +899,7 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
LIST_HEAD(lh);
op = mask & AA_MAY_REPLACE_POLICY ? OP_PROF_REPL : OP_PROF_LOAD;
- aa_get_loaddata(udata);
+ aa_get_profile_loaddata(udata);
/* released below */
error = aa_unpack(udata, &lh, &ns_name);
if (error)
@@ -949,10 +949,10 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
if (aa_rawdata_eq(rawdata_ent, udata)) {
struct aa_loaddata *tmp;
- tmp = __aa_get_loaddata(rawdata_ent);
+ tmp = aa_get_profile_loaddata(rawdata_ent);
/* check we didn't fail the race */
if (tmp) {
- aa_put_loaddata(udata);
+ aa_put_profile_loaddata(udata);
udata = tmp;
break;
}
@@ -962,7 +962,7 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
list_for_each_entry(ent, &lh, list) {
struct aa_policy *policy;
- ent->new->rawdata = aa_get_loaddata(udata);
+ ent->new->rawdata = aa_get_profile_loaddata(udata);
error = __lookup_replace(ns, ent->new->base.hname,
!(mask & AA_MAY_REPLACE_POLICY),
&ent->old, &info);
@@ -1076,7 +1076,7 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
out:
aa_put_ns(ns);
- aa_put_loaddata(udata);
+ aa_put_profile_loaddata(udata);
kfree(ns_name);
if (error)
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 6c2a536173b5..33f5eabd47f1 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -147,34 +147,47 @@ bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r)
return memcmp(l->data, r->data, r->compressed_size ?: r->size) == 0;
}
+static void do_loaddata_free(struct aa_loaddata *d)
+{
+ kfree_sensitive(d->hash);
+ kfree_sensitive(d->name);
+ kvfree(d->data);
+ kfree_sensitive(d);
+}
+
+void aa_loaddata_kref(struct kref *kref)
+{
+ struct aa_loaddata *d = container_of(kref, struct aa_loaddata, count);
+
+ do_loaddata_free(d);
+}
+
/*
* need to take the ns mutex lock which is NOT safe most places that
* put_loaddata is called, so we have to delay freeing it
*/
-static void do_loaddata_free(struct work_struct *work)
+static void do_ploaddata_rmfs(struct work_struct *work)
{
struct aa_loaddata *d = container_of(work, struct aa_loaddata, work);
struct aa_ns *ns = aa_get_ns(d->ns);
if (ns) {
mutex_lock_nested(&ns->lock, ns->level);
+ /* remove fs ref to loaddata */
__aa_fs_remove_rawdata(d);
mutex_unlock(&ns->lock);
aa_put_ns(ns);
}
-
- kfree_sensitive(d->hash);
- kfree_sensitive(d->name);
- kvfree(d->data);
- kfree_sensitive(d);
+ /* called by dropping last pcount, so drop its associated icount */
+ aa_put_i_loaddata(d);
}
-void aa_loaddata_kref(struct kref *kref)
+void aa_ploaddata_kref(struct kref *kref)
{
- struct aa_loaddata *d = container_of(kref, struct aa_loaddata, count);
+ struct aa_loaddata *d = container_of(kref, struct aa_loaddata, pcount);
if (d) {
- INIT_WORK(&d->work, do_loaddata_free);
+ INIT_WORK(&d->work, do_ploaddata_rmfs);
schedule_work(&d->work);
}
}
@@ -192,6 +205,7 @@ struct aa_loaddata *aa_loaddata_alloc(size_t size)
return ERR_PTR(-ENOMEM);
}
kref_init(&d->count);
+ kref_init(&d->pcount);
INIT_LIST_HEAD(&d->list);
return d;
--
2.25.1
2
1
[PATCH OLK-5.10] PM: runtime: Fix a race condition related to device removal
by Lin Ruifeng 08 Apr '26
by Lin Ruifeng 08 Apr '26
08 Apr '26
From: Bart Van Assche <bvanassche(a)acm.org>
stable inclusion
from stable-v6.6.130
commit 39f2d86f2ddde8d1beda05732f30c7cd945e0b5a
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14092
CVE: CVE-2026-23452
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 29ab768277617452d88c0607c9299cdc63b6e9ff ]
The following code in pm_runtime_work() may dereference the dev->parent
pointer after the parent device has been freed:
/* Maybe the parent is now able to suspend. */
if (parent && !parent->power.ignore_children) {
spin_unlock(&dev->power.lock);
spin_lock(&parent->power.lock);
rpm_idle(parent, RPM_ASYNC);
spin_unlock(&parent->power.lock);
spin_lock(&dev->power.lock);
}
Fix this by inserting a flush_work() call in pm_runtime_remove().
Without this patch blktest block/001 triggers the following complaint
sporadically:
BUG: KASAN: slab-use-after-free in lock_acquire+0x70/0x160
Read of size 1 at addr ffff88812bef7198 by task kworker/u553:1/3081
Workqueue: pm pm_runtime_work
Call Trace:
<TASK>
dump_stack_lvl+0x61/0x80
print_address_description.constprop.0+0x8b/0x310
print_report+0xfd/0x1d7
kasan_report+0xd8/0x1d0
__kasan_check_byte+0x42/0x60
lock_acquire.part.0+0x38/0x230
lock_acquire+0x70/0x160
_raw_spin_lock+0x36/0x50
rpm_suspend+0xc6a/0xfe0
rpm_idle+0x578/0x770
pm_runtime_work+0xee/0x120
process_one_work+0xde3/0x1410
worker_thread+0x5eb/0xfe0
kthread+0x37b/0x480
ret_from_fork+0x6cb/0x920
ret_from_fork_asm+0x11/0x20
</TASK>
Allocated by task 4314:
kasan_save_stack+0x2a/0x50
kasan_save_track+0x18/0x40
kasan_save_alloc_info+0x3d/0x50
__kasan_kmalloc+0xa0/0xb0
__kmalloc_noprof+0x311/0x990
scsi_alloc_target+0x122/0xb60 [scsi_mod]
__scsi_scan_target+0x101/0x460 [scsi_mod]
scsi_scan_channel+0x179/0x1c0 [scsi_mod]
scsi_scan_host_selected+0x259/0x2d0 [scsi_mod]
store_scan+0x2d2/0x390 [scsi_mod]
dev_attr_store+0x43/0x80
sysfs_kf_write+0xde/0x140
kernfs_fop_write_iter+0x3ef/0x670
vfs_write+0x506/0x1470
ksys_write+0xfd/0x230
__x64_sys_write+0x76/0xc0
x64_sys_call+0x213/0x1810
do_syscall_64+0xee/0xfc0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Freed by task 4314:
kasan_save_stack+0x2a/0x50
kasan_save_track+0x18/0x40
kasan_save_free_info+0x3f/0x50
__kasan_slab_free+0x67/0x80
kfree+0x225/0x6c0
scsi_target_dev_release+0x3d/0x60 [scsi_mod]
device_release+0xa3/0x220
kobject_cleanup+0x105/0x3a0
kobject_put+0x72/0xd0
put_device+0x17/0x20
scsi_device_dev_release+0xacf/0x12c0 [scsi_mod]
device_release+0xa3/0x220
kobject_cleanup+0x105/0x3a0
kobject_put+0x72/0xd0
put_device+0x17/0x20
scsi_device_put+0x7f/0xc0 [scsi_mod]
sdev_store_delete+0xa5/0x120 [scsi_mod]
dev_attr_store+0x43/0x80
sysfs_kf_write+0xde/0x140
kernfs_fop_write_iter+0x3ef/0x670
vfs_write+0x506/0x1470
ksys_write+0xfd/0x230
__x64_sys_write+0x76/0xc0
x64_sys_call+0x213/0x1810
Reported-by: Ming Lei <ming.lei(a)redhat.com>
Closes: https://lore.kernel.org/all/ZxdNvLNI8QaOfD2d@fedora/
Reported-by: syzbot+6c905ab800f20cf4086c(a)syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68c13942.050a0220.2ff435.000b.GAE@google.com/
Fixes: 5e928f77a09a ("PM: Introduce core framework for run-time PM of I/O devices (rev. 17)")
Signed-off-by: Bart Van Assche <bvanassche(a)acm.org>
Link: https://patch.msgid.link/20260312182720.2776083-1-bvanassche@acm.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com>
---
drivers/base/power/runtime.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index f5c9e6629f0c..a174ca364680 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -1725,6 +1725,7 @@ void pm_runtime_reinit(struct device *dev)
void pm_runtime_remove(struct device *dev)
{
__pm_runtime_disable(dev, false);
+ flush_work(&dev->power.work);
pm_runtime_reinit(dev);
}
--
2.43.0
2
1
[PATCH OLK-6.6] PM: runtime: Fix a race condition related to device removal
by Lin Ruifeng 08 Apr '26
by Lin Ruifeng 08 Apr '26
08 Apr '26
From: Bart Van Assche <bvanassche(a)acm.org>
stable inclusion
from stable-v6.6.130
commit 39f2d86f2ddde8d1beda05732f30c7cd945e0b5a
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14092
CVE: CVE-2026-23452
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 29ab768277617452d88c0607c9299cdc63b6e9ff ]
The following code in pm_runtime_work() may dereference the dev->parent
pointer after the parent device has been freed:
/* Maybe the parent is now able to suspend. */
if (parent && !parent->power.ignore_children) {
spin_unlock(&dev->power.lock);
spin_lock(&parent->power.lock);
rpm_idle(parent, RPM_ASYNC);
spin_unlock(&parent->power.lock);
spin_lock(&dev->power.lock);
}
Fix this by inserting a flush_work() call in pm_runtime_remove().
Without this patch blktest block/001 triggers the following complaint
sporadically:
BUG: KASAN: slab-use-after-free in lock_acquire+0x70/0x160
Read of size 1 at addr ffff88812bef7198 by task kworker/u553:1/3081
Workqueue: pm pm_runtime_work
Call Trace:
<TASK>
dump_stack_lvl+0x61/0x80
print_address_description.constprop.0+0x8b/0x310
print_report+0xfd/0x1d7
kasan_report+0xd8/0x1d0
__kasan_check_byte+0x42/0x60
lock_acquire.part.0+0x38/0x230
lock_acquire+0x70/0x160
_raw_spin_lock+0x36/0x50
rpm_suspend+0xc6a/0xfe0
rpm_idle+0x578/0x770
pm_runtime_work+0xee/0x120
process_one_work+0xde3/0x1410
worker_thread+0x5eb/0xfe0
kthread+0x37b/0x480
ret_from_fork+0x6cb/0x920
ret_from_fork_asm+0x11/0x20
</TASK>
Allocated by task 4314:
kasan_save_stack+0x2a/0x50
kasan_save_track+0x18/0x40
kasan_save_alloc_info+0x3d/0x50
__kasan_kmalloc+0xa0/0xb0
__kmalloc_noprof+0x311/0x990
scsi_alloc_target+0x122/0xb60 [scsi_mod]
__scsi_scan_target+0x101/0x460 [scsi_mod]
scsi_scan_channel+0x179/0x1c0 [scsi_mod]
scsi_scan_host_selected+0x259/0x2d0 [scsi_mod]
store_scan+0x2d2/0x390 [scsi_mod]
dev_attr_store+0x43/0x80
sysfs_kf_write+0xde/0x140
kernfs_fop_write_iter+0x3ef/0x670
vfs_write+0x506/0x1470
ksys_write+0xfd/0x230
__x64_sys_write+0x76/0xc0
x64_sys_call+0x213/0x1810
do_syscall_64+0xee/0xfc0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Freed by task 4314:
kasan_save_stack+0x2a/0x50
kasan_save_track+0x18/0x40
kasan_save_free_info+0x3f/0x50
__kasan_slab_free+0x67/0x80
kfree+0x225/0x6c0
scsi_target_dev_release+0x3d/0x60 [scsi_mod]
device_release+0xa3/0x220
kobject_cleanup+0x105/0x3a0
kobject_put+0x72/0xd0
put_device+0x17/0x20
scsi_device_dev_release+0xacf/0x12c0 [scsi_mod]
device_release+0xa3/0x220
kobject_cleanup+0x105/0x3a0
kobject_put+0x72/0xd0
put_device+0x17/0x20
scsi_device_put+0x7f/0xc0 [scsi_mod]
sdev_store_delete+0xa5/0x120 [scsi_mod]
dev_attr_store+0x43/0x80
sysfs_kf_write+0xde/0x140
kernfs_fop_write_iter+0x3ef/0x670
vfs_write+0x506/0x1470
ksys_write+0xfd/0x230
__x64_sys_write+0x76/0xc0
x64_sys_call+0x213/0x1810
Reported-by: Ming Lei <ming.lei(a)redhat.com>
Closes: https://lore.kernel.org/all/ZxdNvLNI8QaOfD2d@fedora/
Reported-by: syzbot+6c905ab800f20cf4086c(a)syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68c13942.050a0220.2ff435.000b.GAE@google.com/
Fixes: 5e928f77a09a ("PM: Introduce core framework for run-time PM of I/O devices (rev. 17)")
Signed-off-by: Bart Van Assche <bvanassche(a)acm.org>
Link: https://patch.msgid.link/20260312182720.2776083-1-bvanassche@acm.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com>
---
drivers/base/power/runtime.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index b28fb11cd6db..2766bdc9158a 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -1854,6 +1854,7 @@ void pm_runtime_reinit(struct device *dev)
void pm_runtime_remove(struct device *dev)
{
__pm_runtime_disable(dev, false);
+ flush_work(&dev->power.work);
pm_runtime_reinit(dev);
}
--
2.43.0
2
1
[PATCH OLK-6.6] spi: fix use-after-free on controller registration failure
by Lin Ruifeng 08 Apr '26
by Lin Ruifeng 08 Apr '26
08 Apr '26
From: Johan Hovold <johan(a)kernel.org>
stable inclusion
from stable-v6.6.130
commit 6bbd385b30c7fb6c7ee0669e9ada91490938c051
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14115
CVE: CVE-2026-31389
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 8634e05b08ead636e926022f4a98416e13440df9 upstream.
Make sure to deregister from driver core also in the unlikely event that
per-cpu statistics allocation fails during controller registration to
avoid use-after-free (of driver resources) and unclocked register
accesses.
Fixes: 6598b91b5ac3 ("spi: spi.c: Convert statistics to per-cpu u64_stats_t")
Cc: stable(a)vger.kernel.org # 6.0
Cc: David Jander <david(a)protonic.nl>
Signed-off-by: Johan Hovold <johan(a)kernel.org>
Link: https://patch.msgid.link/20260312151817.32100-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com>
---
drivers/spi/spi.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index cd6edfa92101..66f694457a8b 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -3209,10 +3209,8 @@ int spi_register_controller(struct spi_controller *ctlr)
dev_info(dev, "controller is unqueued, this is deprecated\n");
} else if (ctlr->transfer_one || ctlr->transfer_one_message) {
status = spi_controller_initialize_queue(ctlr);
- if (status) {
- device_del(&ctlr->dev);
- goto free_bus_id;
- }
+ if (status)
+ goto del_ctrl;
}
/* Add statistics */
ctlr->pcpu_statistics = spi_alloc_pcpu_stats(dev);
@@ -3235,6 +3233,8 @@ int spi_register_controller(struct spi_controller *ctlr)
destroy_queue:
spi_destroy_queue(ctlr);
+del_ctrl:
+ device_del(&ctlr->dev);
free_bus_id:
mutex_lock(&board_lock);
idr_remove(&spi_master_idr, ctlr->bus_num);
--
2.43.0
2
1
Kuniyuki Iwashima (2):
tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
net/ipv4/tcp.c | 5 +++++
net/ipv4/tcp_input.c | 1 -
2 files changed, 5 insertions(+), 1 deletion(-)
--
2.9.5
2
3
[PATCH OLK-6.6] icmp: fix NULL pointer dereference in icmp_tag_validation()
by Zhang Changzhong 08 Apr '26
by Zhang Changzhong 08 Apr '26
08 Apr '26
From: Weiming Shi <bestswngs(a)gmail.com>
mainline inclusion
from mainline-v7.0-rc5
commit 614aefe56af8e13331e50220c936fc0689cf5675
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14029
CVE: CVE-2026-23398
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
icmp_tag_validation() unconditionally dereferences the result of
rcu_dereference(inet_protos[proto]) without checking for NULL.
The inet_protos[] array is sparse -- only about 15 of 256 protocol
numbers have registered handlers. When ip_no_pmtu_disc is set to 3
(hardened PMTU mode) and the kernel receives an ICMP Fragmentation
Needed error with a quoted inner IP header containing an unregistered
protocol number, the NULL dereference causes a kernel panic in
softirq context.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143)
Call Trace:
<IRQ>
icmp_rcv (net/ipv4/icmp.c:1527)
ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
ip_local_deliver_finish (net/ipv4/ip_input.c:242)
ip_local_deliver (net/ipv4/ip_input.c:262)
ip_rcv (net/ipv4/ip_input.c:573)
__netif_receive_skb_one_core (net/core/dev.c:6164)
process_backlog (net/core/dev.c:6628)
handle_softirqs (kernel/softirq.c:561)
</IRQ>
Add a NULL check before accessing icmp_strict_tag_validation. If the
protocol has no registered handler, return false since it cannot
perform strict tag validation.
Fixes: 8ed1dc44d3e9 ("ipv4: introduce hardened ip_no_pmtu_disc mode")
Reported-by: Xiang Mei <xmei5(a)asu.edu>
Signed-off-by: Weiming Shi <bestswngs(a)gmail.com>
Link: https://patch.msgid.link/20260318130558.1050247-4-bestswngs@gmail.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Conflicts:
net/ipv4/icmp.c
[context conflicts]
Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com>
---
net/ipv4/icmp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index aed99f8..ca4e926 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -855,10 +855,12 @@ static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
static bool icmp_tag_validation(int proto)
{
+ const struct net_protocol *ipprot;
bool ok;
rcu_read_lock();
- ok = rcu_dereference(inet_protos[proto])->icmp_strict_tag_validation;
+ ipprot = rcu_dereference(inet_protos[proto]);
+ ok = ipprot ? ipprot->icmp_strict_tag_validation : false;
rcu_read_unlock();
return ok;
}
--
2.9.5
2
1
From: Alexei Starovoitov <ast(a)kernel.org>
mainline inclusion
from mainline-v7.0-rc7
commit a8502a79e832b861e99218cbd2d8f4312d62e225
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/8900
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
In case rold->reg->range == BEYOND_PKT_END && rcur->reg->range == N
regsafe() may return true which may lead to current state with
valid packet range not being explored. Fix the bug.
Fixes: 6d94e741a8ff ("bpf: Support for pointers beyond pkt_end.")
Signed-off-by: Alexei Starovoitov <ast(a)kernel.org>
Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org>
Reviewed-by: Daniel Borkmann <daniel(a)iogearbox.net>
Reviewed-by: Amery Hung <ameryhung(a)gmail.com>
Acked-by: Eduard Zingerman <eddyz87(a)gmail.com>
Link: https://lore.kernel.org/bpf/20260331204228.26726-1-alexei.starovoitov@gmail…
Signed-off-by: Pu Lehui <pulehui(a)huawei.com>
---
kernel/bpf/verifier.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 9ff0704cef3d..e63d63ac8a36 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -16307,8 +16307,13 @@ static bool regsafe(struct bpf_verifier_env *env, struct bpf_reg_state *rold,
* since someone could have accessed through (ptr - k), or
* even done ptr -= k in a register, to get a safe access.
*/
- if (rold->range > rcur->range)
+ if (rold->range < 0 || rcur->range < 0) {
+ /* special case for [BEYOND|AT]_PKT_END */
+ if (rold->range != rcur->range)
+ return false;
+ } else if (rold->range > rcur->range) {
return false;
+ }
/* If the offsets don't match, we can't trust our alignment;
* nor can we be sure that we won't fall out of range.
*/
--
2.34.1
2
1
[PATCH OLK-6.6 v7 0/2] kvm: arm64: Transition from CPU Type to MIDR Register for Virtualization Feature Detection
by liqiqi 08 Apr '26
by liqiqi 08 Apr '26
08 Apr '26
Currently, there are two methods for determining whether a chip supports
specific virtualization features:
1. Reading the chip's CPU type from BIOS
2. Reading the value of the MIDR register
The issue with the first method is that each time a new chip is introduced,
the new CPU type must be defined, which leads to poor code portability and
maintainability.
Therefore, the second method has been adopted to replace the first. This
approach eliminates the dependency on CPU type by using the MIDR register.
liqiqi (2):
kvm: arm64: Add MIDR definitions and use MIDR to determine whether
features are supported
kvm: arm64: Remove cpu_type definition and it's related interfaces
arch/arm64/include/asm/cache.h | 2 +-
arch/arm64/include/asm/cputype.h | 8 +-
arch/arm64/kernel/cpu_errata.c | 4 +-
arch/arm64/kernel/cpufeature.c | 2 +-
arch/arm64/kernel/proton-pack.c | 4 +-
arch/arm64/kvm/arm.c | 1 -
arch/arm64/kvm/hisilicon/hisi_virt.c | 110 +++--------------------
arch/arm64/kvm/hisilicon/hisi_virt.h | 12 ---
drivers/perf/hisilicon/hisi_uncore_pmu.c | 2 +-
tools/arch/arm64/include/asm/cputype.h | 4 +-
10 files changed, 25 insertions(+), 124 deletions(-)
--
2.43.0
2
3
Fix CVE-2026-23378
Eric Dumazet (1):
net/sched: act_ife: avoid possible NULL deref
Jamal Hadi Salim (1):
net/sched: act_ife: Fix metalist update behavior
include/net/tc_act/tc_ife.h | 4 +-
net/sched/act_ife.c | 99 ++++++++++++++++++-------------------
2 files changed, 49 insertions(+), 54 deletions(-)
--
2.25.1
2
3
07 Apr '26
From: Ariel Silver <arielsilver77(a)gmail.com>
stable inclusion
from stable-v6.6.130
commit 1a6da3dbb9985d00743073a1cc1f96e59f5abc30
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14132
CVE: CVE-2026-31405
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 24d87712727a5017ad142d63940589a36cd25647 upstream.
The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables
in handle_one_ule_extension() are declared with 255 elements (valid
indices 0-254), but the index htype is derived from network-controlled
data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When
htype equals 255, an out-of-bounds read occurs on the function pointer
table, and the OOB value may be called as a function pointer.
Add a bounds check on htype against the array size before either table
is accessed. Out-of-range values now cause the SNDU to be discarded.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Ariel Silver <arielsilver77(a)gmail.com>
Signed-off-by: Ariel Silver <arielsilver77(a)gmail.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Liu Kai <liukai284(a)huawei.com>
---
drivers/media/dvb-core/dvb_net.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c
index 8bb8dd34c223..a2159b2bc176 100644
--- a/drivers/media/dvb-core/dvb_net.c
+++ b/drivers/media/dvb-core/dvb_net.c
@@ -228,6 +228,9 @@ static int handle_one_ule_extension( struct dvb_net_priv *p )
unsigned char hlen = (p->ule_sndu_type & 0x0700) >> 8;
unsigned char htype = p->ule_sndu_type & 0x00FF;
+ if (htype >= ARRAY_SIZE(ule_mandatory_ext_handlers))
+ return -1;
+
/* Discriminate mandatory and optional extension headers. */
if (hlen == 0) {
/* Mandatory extension header */
--
2.34.1
2
1
07 Apr '26
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/8882
--------------------------------
wake_wide() uses sd_llc_size as the spreading threshold to detect wide
waker/wakee relationships and to disable wake_affine() for those cases.
On SMT systems, sd_llc_size counts logical CPUs rather than physical
cores. This inflates the wake_wide() threshold, allowing wake_affine()
to pack more tasks into one LLC domain than the actual compute capacity
of its physical cores can sustain. The resulting SMT interference may
cost more than the cache-locality benefit wake_affine() intends to gain.
Scale the factor by the SMT width of the current CPU so that it
approximates the number of independent physical cores in the LLC domain,
making wake_wide() more likely to kick in before SMT interference
becomes significant. On non-SMT systems the SMT width is 1 and behaviour
is unchanged.
Fixes: 63b0e9edceec ("sched/fair: Beef up wake_wide()")
Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com>
---
kernel/sched/fair.c | 5 +++++
kernel/sched/features.h | 2 ++
2 files changed, 7 insertions(+)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index ad30bb800961..4100998e18cd 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -7850,6 +7850,11 @@ static int wake_wide(struct task_struct *p)
unsigned int slave = p->wakee_flips;
int factor = __this_cpu_read(sd_llc_size);
+ /* Scale factor to physical-core count to account for SMT interference. */
+ if (sched_feat(WA_SMT))
+ factor = DIV_ROUND_UP(factor,
+ cpumask_weight(cpu_smt_mask(smp_processor_id())));
+
if (master < slave)
swap(master, slave);
if (slave < factor || master < slave * factor)
diff --git a/kernel/sched/features.h b/kernel/sched/features.h
index 24a0c853a8a0..c9ad8e72ecd0 100644
--- a/kernel/sched/features.h
+++ b/kernel/sched/features.h
@@ -128,3 +128,5 @@ SCHED_FEAT(SOFT_DOMAIN, false)
#ifdef CONFIG_SCHED_SOFT_QUOTA
SCHED_FEAT(SOFT_QUOTA, false)
#endif
+
+SCHED_FEAT(WA_SMT, false)
--
2.18.0
2
1
Fix riscv check-build warning.
Björn Töpel (1):
riscv: Replace function-like macro by static inline function
Tengda Wu (1):
Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks"
arch/riscv/include/asm/cacheflush.h | 15 ++++++++++-----
arch/riscv/kernel/stacktrace.c | 16 ----------------
2 files changed, 10 insertions(+), 21 deletions(-)
--
2.34.1
2
3
[PATCH OLK-5.10 0/3] Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue
by Zhang Yuwei 07 Apr '26
by Zhang Yuwei 07 Apr '26
07 Apr '26
Patch 1: Restrict the privcmd driver in unprivileged domU
to only allow hypercalls targeting a specific domain obtained
from Xenstore, preventing secure boot bypass.
Patch 2: Unregister the xenstore notifier on module exit
to clean up resources added by patch 1.
Patch 3: Add an unrestricted boot parameter to optionally allow
all hypercalls when secure boot is not active, guarded by a new
lockdown reason.
GuoHan Zhao (1):
xen/privcmd: unregister xenstore notifier on module exit
Juergen Gross (2):
xen/privcmd: restrict usage in unprivileged domU
xen/privcmd: add boot control for restricted usage in domU
drivers/xen/privcmd.c | 78 +++++++++++++++++++++++++++++++++++++---
include/linux/security.h | 1 +
security/security.c | 1 +
3 files changed, 75 insertions(+), 5 deletions(-)
--
2.22.0
2
4
[PATCH OLK-6.6 0/3] Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue
by Zhang Yuwei 07 Apr '26
by Zhang Yuwei 07 Apr '26
07 Apr '26
Patch 1: Restrict the privcmd driver in unprivileged domU
to only allow hypercalls targeting a specific domain obtained
from Xenstore, preventing secure boot bypass.
Patch 2: Unregister the xenstore notifier on module exit
to clean up resources added by patch 1.
Patch 3: Add an unrestricted boot parameter to optionally allow
all hypercalls when secure boot is not active, guarded by a new
lockdown reason.
GuoHan Zhao (1):
xen/privcmd: unregister xenstore notifier on module exit
Juergen Gross (2):
xen/privcmd: restrict usage in unprivileged domU
xen/privcmd: add boot control for restricted usage in domU
drivers/xen/privcmd.c | 78 +++++++++++++++++++++++++++++++++++++---
include/linux/security.h | 1 +
security/security.c | 1 +
3 files changed, 75 insertions(+), 5 deletions(-)
--
2.22.0
2
4
[PATCH OLK-6.6] apparmor: replace recursive profile removal with iterative approach
by Cui GaoSheng 07 Apr '26
by Cui GaoSheng 07 Apr '26
07 Apr '26
From: Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com>
stable inclusion
from stable-v6.6.130
commit 33959a491e9fd557abfa5fce5ae4637d400915d3
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14038
CVE: CVE-2026-23404
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit ab09264660f9de5d05d1ef4e225aa447c63a8747 upstream.
The profile removal code uses recursion when removing nested profiles,
which can lead to kernel stack exhaustion and system crashes.
Reproducer:
$ pf='a'; for ((i=0; i<1024; i++)); do
echo -e "profile $pf { \n }" | apparmor_parser -K -a;
pf="$pf//x";
done
$ echo -n a > /sys/kernel/security/apparmor/.remove
Replace the recursive __aa_profile_list_release() approach with an
iterative approach in __remove_profile(). The function repeatedly
finds and removes leaf profiles until the entire subtree is removed,
maintaining the same removal semantic without recursion.
Fixes: c88d4c7b049e ("AppArmor: core policy routines")
Reported-by: Qualys Security Advisory <qsa(a)qualys.com>
Tested-by: Salvatore Bonaccorso <carnil(a)debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia(a)canonical.com>
Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com>
Signed-off-by: John Johansen <john.johansen(a)canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com>
---
security/apparmor/policy.c | 30 +++++++++++++++++++++++++++---
1 file changed, 27 insertions(+), 3 deletions(-)
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 83693b8d18d4..2cbe89e135fb 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -147,19 +147,43 @@ static void __list_remove_profile(struct aa_profile *profile)
}
/**
- * __remove_profile - remove old profile, and children
- * @profile: profile to be replaced (NOT NULL)
+ * __remove_profile - remove profile, and children
+ * @profile: profile to be removed (NOT NULL)
*
* Requires: namespace list lock be held, or list not be shared
*/
static void __remove_profile(struct aa_profile *profile)
{
+ struct aa_profile *curr, *to_remove;
+
AA_BUG(!profile);
AA_BUG(!profile->ns);
AA_BUG(!mutex_is_locked(&profile->ns->lock));
/* release any children lists first */
- __aa_profile_list_release(&profile->base.profiles);
+ if (!list_empty(&profile->base.profiles)) {
+ curr = list_first_entry(&profile->base.profiles, struct aa_profile, base.list);
+
+ while (curr != profile) {
+
+ while (!list_empty(&curr->base.profiles))
+ curr = list_first_entry(&curr->base.profiles,
+ struct aa_profile, base.list);
+
+ to_remove = curr;
+ if (!list_is_last(&to_remove->base.list,
+ &aa_deref_parent(curr)->base.profiles))
+ curr = list_next_entry(to_remove, base.list);
+ else
+ curr = aa_deref_parent(curr);
+
+ /* released by free_profile */
+ aa_label_remove(&to_remove->label);
+ __aafs_profile_rmdir(to_remove);
+ __list_remove_profile(to_remove);
+ }
+ }
+
/* released by free_profile */
aa_label_remove(&profile->label);
__aafs_profile_rmdir(profile);
--
2.34.1
2
1
[PATCH OLK-6.6] apparmor: fix: limit the number of levels of policy namespaces
by Cui GaoSheng 07 Apr '26
by Cui GaoSheng 07 Apr '26
07 Apr '26
From: John Johansen <john.johansen(a)canonical.com>
stable inclusion
from stable-v6.6.130
commit 3f8699b3ee0c04b4b9bc27b82cd89a40e81e1d2e
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14047
CVE: CVE-2026-23405
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 306039414932c80f8420695a24d4fe10c84ccfb2 upstream.
Currently the number of policy namespaces is not bounded relying on
the user namespace limit. However policy namespaces aren't strictly
tied to user namespaces and it is possible to create them and nest
them arbitrarily deep which can be used to exhaust system resource.
Hard cap policy namespaces to the same depth as user namespaces.
Fixes: c88d4c7b049e8 ("AppArmor: core policy routines")
Reported-by: Qualys Security Advisory <qsa(a)qualys.com>
Reviewed-by: Ryan Lee <ryan.lee(a)canonical.com>
Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com>
Signed-off-by: John Johansen <john.johansen(a)canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com>
---
security/apparmor/include/policy_ns.h | 2 ++
security/apparmor/policy_ns.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/security/apparmor/include/policy_ns.h b/security/apparmor/include/policy_ns.h
index 33d665516fc1..dabb69bc87e0 100644
--- a/security/apparmor/include/policy_ns.h
+++ b/security/apparmor/include/policy_ns.h
@@ -18,6 +18,8 @@
#include "label.h"
#include "policy.h"
+/* Match max depth of user namespaces */
+#define MAX_NS_DEPTH 32
/* struct aa_ns_acct - accounting of profiles in namespace
* @max_size: maximum space allowed for all profiles in namespace
diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c
index fd5b7afbcb48..c56ef36baef4 100644
--- a/security/apparmor/policy_ns.c
+++ b/security/apparmor/policy_ns.c
@@ -260,6 +260,8 @@ static struct aa_ns *__aa_create_ns(struct aa_ns *parent, const char *name,
AA_BUG(!name);
AA_BUG(!mutex_is_locked(&parent->lock));
+ if (parent->level > MAX_NS_DEPTH)
+ return ERR_PTR(-ENOSPC);
ns = alloc_ns(parent->base.hname, name);
if (!ns)
return ERR_PTR(-ENOMEM);
--
2.34.1
2
1
[PATCH OLK-5.10] apparmor: fix: limit the number of levels of policy namespaces
by Cui GaoSheng 07 Apr '26
by Cui GaoSheng 07 Apr '26
07 Apr '26
From: John Johansen <john.johansen(a)canonical.com>
stable inclusion
from stable-v6.6.130
commit 3f8699b3ee0c04b4b9bc27b82cd89a40e81e1d2e
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14047
CVE: CVE-2026-23405
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 306039414932c80f8420695a24d4fe10c84ccfb2 upstream.
Currently the number of policy namespaces is not bounded relying on
the user namespace limit. However policy namespaces aren't strictly
tied to user namespaces and it is possible to create them and nest
them arbitrarily deep which can be used to exhaust system resource.
Hard cap policy namespaces to the same depth as user namespaces.
Fixes: c88d4c7b049e8 ("AppArmor: core policy routines")
Reported-by: Qualys Security Advisory <qsa(a)qualys.com>
Reviewed-by: Ryan Lee <ryan.lee(a)canonical.com>
Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com>
Signed-off-by: John Johansen <john.johansen(a)canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com>
---
security/apparmor/include/policy_ns.h | 2 ++
security/apparmor/policy_ns.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/security/apparmor/include/policy_ns.h b/security/apparmor/include/policy_ns.h
index 3df6f804922d..e5704947e86e 100644
--- a/security/apparmor/include/policy_ns.h
+++ b/security/apparmor/include/policy_ns.h
@@ -18,6 +18,8 @@
#include "label.h"
#include "policy.h"
+/* Match max depth of user namespaces */
+#define MAX_NS_DEPTH 32
/* struct aa_ns_acct - accounting of profiles in namespace
* @max_size: maximum space allowed for all profiles in namespace
diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c
index 53d24cf63893..5d342ef078e9 100644
--- a/security/apparmor/policy_ns.c
+++ b/security/apparmor/policy_ns.c
@@ -249,6 +249,8 @@ static struct aa_ns *__aa_create_ns(struct aa_ns *parent, const char *name,
AA_BUG(!name);
AA_BUG(!mutex_is_locked(&parent->lock));
+ if (parent->level > MAX_NS_DEPTH)
+ return ERR_PTR(-ENOSPC);
ns = alloc_ns(parent->base.hname, name);
if (!ns)
return ERR_PTR(-ENOMEM);
--
2.34.1
2
1
[PATCH OLK-5.10] apparmor: replace recursive profile removal with iterative approach
by Cui GaoSheng 07 Apr '26
by Cui GaoSheng 07 Apr '26
07 Apr '26
From: Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com>
stable inclusion
from stable-v6.6.130
commit 33959a491e9fd557abfa5fce5ae4637d400915d3
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14038
CVE: CVE-2026-23404
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit ab09264660f9de5d05d1ef4e225aa447c63a8747 upstream.
The profile removal code uses recursion when removing nested profiles,
which can lead to kernel stack exhaustion and system crashes.
Reproducer:
$ pf='a'; for ((i=0; i<1024; i++)); do
echo -e "profile $pf { \n }" | apparmor_parser -K -a;
pf="$pf//x";
done
$ echo -n a > /sys/kernel/security/apparmor/.remove
Replace the recursive __aa_profile_list_release() approach with an
iterative approach in __remove_profile(). The function repeatedly
finds and removes leaf profiles until the entire subtree is removed,
maintaining the same removal semantic without recursion.
Fixes: c88d4c7b049e ("AppArmor: core policy routines")
Reported-by: Qualys Security Advisory <qsa(a)qualys.com>
Tested-by: Salvatore Bonaccorso <carnil(a)debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia(a)canonical.com>
Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com>
Signed-off-by: John Johansen <john.johansen(a)canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com>
---
security/apparmor/policy.c | 30 +++++++++++++++++++++++++++---
1 file changed, 27 insertions(+), 3 deletions(-)
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index e5f501f89803..57be581980b3 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -146,19 +146,43 @@ static void __list_remove_profile(struct aa_profile *profile)
}
/**
- * __remove_profile - remove old profile, and children
- * @profile: profile to be replaced (NOT NULL)
+ * __remove_profile - remove profile, and children
+ * @profile: profile to be removed (NOT NULL)
*
* Requires: namespace list lock be held, or list not be shared
*/
static void __remove_profile(struct aa_profile *profile)
{
+ struct aa_profile *curr, *to_remove;
+
AA_BUG(!profile);
AA_BUG(!profile->ns);
AA_BUG(!mutex_is_locked(&profile->ns->lock));
/* release any children lists first */
- __aa_profile_list_release(&profile->base.profiles);
+ if (!list_empty(&profile->base.profiles)) {
+ curr = list_first_entry(&profile->base.profiles, struct aa_profile, base.list);
+
+ while (curr != profile) {
+
+ while (!list_empty(&curr->base.profiles))
+ curr = list_first_entry(&curr->base.profiles,
+ struct aa_profile, base.list);
+
+ to_remove = curr;
+ if (!list_is_last(&to_remove->base.list,
+ &aa_deref_parent(curr)->base.profiles))
+ curr = list_next_entry(to_remove, base.list);
+ else
+ curr = aa_deref_parent(curr);
+
+ /* released by free_profile */
+ aa_label_remove(&to_remove->label);
+ __aafs_profile_rmdir(to_remove);
+ __list_remove_profile(to_remove);
+ }
+ }
+
/* released by free_profile */
aa_label_remove(&profile->label);
__aafs_profile_rmdir(profile);
--
2.34.1
2
1
[PATCH OLK-6.6 v6 0/2] kvm: arm64: Transition from CPU Type to MIDR Register for Virtualization Feature Detection
by liqiqi 07 Apr '26
by liqiqi 07 Apr '26
07 Apr '26
Currently, there are two methods for determining whether a chip supports
specific virtualization features:
1. Reading the chip's CPU type from BIOS
2. Reading the value of the MIDR register
The issue with the first method is that each time a new chip is introduced,
the new CPU type must be defined, which leads to poor code portability and
maintainability.
Therefore, the second method has been adopted to replace the first. This
approach eliminates the dependency on CPU type by using the MIDR register.
liqiqi (2):
kvm: arm64: Add MIDR definitions and use MIDR to determine whether
features are supported
kvm: arm64: Remove cpu_type definition and it's related interfaces
arch/arm64/include/asm/cache.h | 2 +-
arch/arm64/include/asm/cputype.h | 8 +-
arch/arm64/kernel/cpu_errata.c | 4 +-
arch/arm64/kernel/cpufeature.c | 2 +-
arch/arm64/kernel/proton-pack.c | 4 +-
arch/arm64/kvm/arm.c | 1 -
arch/arm64/kvm/hisilicon/hisi_virt.c | 110 +++--------------------
arch/arm64/kvm/hisilicon/hisi_virt.h | 12 ---
drivers/perf/hisilicon/hisi_uncore_pmu.c | 2 +-
tools/arch/arm64/include/asm/cputype.h | 4 +-
10 files changed, 25 insertions(+), 124 deletions(-)
--
2.43.0
2
3
[PATCH OLK-6.6] nf_tables: nft_dynset: fix possible stateful expression memleak in error path
by Dong Chenchen 07 Apr '26
by Dong Chenchen 07 Apr '26
07 Apr '26
From: Pablo Neira Ayuso <pablo(a)netfilter.org>
mainline inclusion
from mainline-v7.0-rc3
commit 0548a13b5a145b16e4da0628b5936baf35f51b43
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14034
CVE: CVE-2026-23399
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
If cloning the second stateful expression in the element via GFP_ATOMIC
fails, then the first stateful expression remains in place without being
released.
unreferenced object (percpu) 0x607b97e9cab8 (size 16):
comm "softirq", pid 0, jiffies 4294931867
hex dump (first 16 bytes on cpu 3):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
backtrace (crc 0):
pcpu_alloc_noprof+0x453/0xd80
nft_counter_clone+0x9c/0x190 [nf_tables]
nft_expr_clone+0x8f/0x1b0 [nf_tables]
nft_dynset_new+0x2cb/0x5f0 [nf_tables]
nft_rhash_update+0x236/0x11c0 [nf_tables]
nft_dynset_eval+0x11f/0x670 [nf_tables]
nft_do_chain+0x253/0x1700 [nf_tables]
nft_do_chain_ipv4+0x18d/0x270 [nf_tables]
nf_hook_slow+0xaa/0x1e0
ip_local_deliver+0x209/0x330
Fixes: 563125a73ac3 ("netfilter: nftables: generalize set extension to support for several expressions")
Reported-by: Gurpreet Shergill <giki.shergill(a)proton.me>
Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org>
Signed-off-by: Florian Westphal <fw(a)strlen.de>
Conflicts:
include/net/netfilter/nf_tables.h
net/netfilter/nft_dynset.c
[commit 9dad402b89e8 is not backport]
Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com>
---
include/net/netfilter/nf_tables.h | 2 ++
net/netfilter/nf_tables_api.c | 4 ++--
net/netfilter/nft_dynset.c | 10 +++++++++-
3 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index e1c4d903f39b..0f890ff1769b 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -859,6 +859,8 @@ void *nft_set_elem_init(const struct nft_set *set,
u64 timeout, u64 expiration, gfp_t gfp);
int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
struct nft_expr *expr_array[]);
+void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
+ struct nft_set_elem_expr *elem_expr);
void nft_set_elem_destroy(const struct nft_set *set, void *elem,
bool destroy_expr);
void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 98d3156179ee..9d5f7bafa4d6 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6471,8 +6471,8 @@ static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
}
}
-static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
- struct nft_set_elem_expr *elem_expr)
+void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
+ struct nft_set_elem_expr *elem_expr)
{
struct nft_expr *expr;
u32 size;
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index a81bd69b059b..8ea45d61ed88 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -30,18 +30,26 @@ static int nft_dynset_expr_setup(const struct nft_dynset *priv,
const struct nft_set_ext *ext)
{
struct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext);
+ struct nft_ctx ctx = {
+ .net = read_pnet(&priv->set->net),
+ .family = priv->set->table->family,
+ };
struct nft_expr *expr;
int i;
for (i = 0; i < priv->num_exprs; i++) {
expr = nft_setelem_expr_at(elem_expr, elem_expr->size);
if (nft_expr_clone(expr, priv->expr_array[i], GFP_ATOMIC) < 0)
- return -1;
+ goto err_out;
elem_expr->size += priv->expr_array[i]->ops->size;
}
return 0;
+err_out:
+ nft_set_elem_expr_destroy(&ctx, elem_expr);
+
+ return -1;
}
static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr,
--
2.25.1
2
1
Fix CVE-2026-23343
Larysa Zaremba (2):
xdp: use modulo operation to calculate XDP frag tailroom
xdp: produce a warning when calculated tailroom is negative
net/core/filter.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--
2.25.1
2
3
07 Apr '26
From: Juergen Gross <jgross(a)suse.com>
mainline inclusion
from mainline-v7.0-rc6
commit 453b8fb68f3641fea970db88b7d9a153ed2a37e8
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14027
CVE: CVE-2026-31788
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
The Xen privcmd driver allows to issue arbitrary hypercalls from
user space processes. This is normally no problem, as access is
usually limited to root and the hypervisor will deny any hypercalls
affecting other domains.
In case the guest is booted using secure boot, however, the privcmd
driver would be enabling a root user process to modify e.g. kernel
memory contents, thus breaking the secure boot feature.
The only known case where an unprivileged domU is really needing to
use the privcmd driver is the case when it is acting as the device
model for another guest. In this case all hypercalls issued via the
privcmd driver will target that other guest.
Fortunately the privcmd driver can already be locked down to allow
only hypercalls targeting a specific domain, but this mode can be
activated from user land only today.
The target domain can be obtained from Xenstore, so when not running
in dom0 restrict the privcmd driver to that target domain from the
beginning, resolving the potential problem of breaking secure boot.
This is XSA-482
Reported-by: Teddy Astie <teddy.astie(a)vates.tech>
Fixes: 1c5de1939c20 ("xen: add privcmd driver")
Signed-off-by: Juergen Gross <jgross(a)suse.com>
Conflicts:
drivers/xen/privcmd.c
[commit bf4afc53b77ae not merged]
Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com>
it push" to publish your local commits)
---
drivers/xen/privcmd.c | 62 +++++++++++++++++++++++++++++++++++++++----
1 file changed, 57 insertions(+), 5 deletions(-)
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 28537a1a0e0b..cb50038c0c9c 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -10,6 +10,7 @@
#define pr_fmt(fmt) "xen:" KBUILD_MODNAME ": " fmt
#include <linux/kernel.h>
+#include <linux/kstrtox.h>
#include <linux/module.h>
#include <linux/sched.h>
#include <linux/slab.h>
@@ -24,7 +25,8 @@
#include <linux/seq_file.h>
#include <linux/miscdevice.h>
#include <linux/moduleparam.h>
-
+#include <linux/notifier.h>
+#include <linux/wait.h>
#include <asm/xen/hypervisor.h>
#include <asm/xen/hypercall.h>
@@ -37,7 +39,7 @@
#include <xen/page.h>
#include <xen/xen-ops.h>
#include <xen/balloon.h>
-
+#include <xen/xenbus.h>
#include "privcmd.h"
MODULE_LICENSE("GPL");
@@ -59,6 +61,11 @@ struct privcmd_data {
domid_t domid;
};
+/* DOMID_INVALID implies no restriction */
+static domid_t target_domain = DOMID_INVALID;
+static bool restrict_wait;
+static DECLARE_WAIT_QUEUE_HEAD(restrict_wait_wq);
+
static int privcmd_vma_range_is_mapped(
struct vm_area_struct *vma,
unsigned long addr,
@@ -878,13 +885,16 @@ static long privcmd_ioctl(struct file *file,
static int privcmd_open(struct inode *ino, struct file *file)
{
- struct privcmd_data *data = kzalloc(sizeof(*data), GFP_KERNEL);
+ struct privcmd_data *data;
+ if (wait_event_interruptible(restrict_wait_wq, !restrict_wait) < 0)
+ return -EINTR;
+
+ data = kzalloc(sizeof(*data), GFP_KERNEL);
if (!data)
return -ENOMEM;
- /* DOMID_INVALID implies no restriction */
- data->domid = DOMID_INVALID;
+ data->domid = target_domain;
file->private_data = data;
return 0;
@@ -977,6 +987,45 @@ static struct miscdevice privcmd_dev = {
.fops = &xen_privcmd_fops,
};
+static int init_restrict(struct notifier_block *notifier,
+ unsigned long event,
+ void *data)
+{
+ char *target;
+ unsigned int domid;
+
+ /* Default to an guaranteed unused domain-id. */
+ target_domain = DOMID_IDLE;
+
+ target = xenbus_read(XBT_NIL, "target", "", NULL);
+ if (IS_ERR(target) || kstrtouint(target, 10, &domid)) {
+ pr_err("No target domain found, blocking all hypercalls\n");
+ goto out;
+ }
+
+ target_domain = domid;
+
+ out:
+ if (!IS_ERR(target))
+ kfree(target);
+
+ restrict_wait = false;
+ wake_up_all(&restrict_wait_wq);
+
+ return NOTIFY_DONE;
+}
+
+static struct notifier_block xenstore_notifier = {
+ .notifier_call = init_restrict,
+};
+
+static void __init restrict_driver(void)
+{
+ restrict_wait = true;
+
+ register_xenstore_notifier(&xenstore_notifier);
+}
+
static int __init privcmd_init(void)
{
int err;
@@ -984,6 +1033,9 @@ static int __init privcmd_init(void)
if (!xen_domain())
return -ENODEV;
+ if (!xen_initial_domain())
+ restrict_driver();
+
err = misc_register(&privcmd_dev);
if (err != 0) {
pr_err("Could not register Xen privcmd device\n");
--
2.22.0
2
3
07 Apr '26
From: Juergen Gross <jgross(a)suse.com>
mainline inclusion
from mainline-v7.0-rc6
commit 453b8fb68f3641fea970db88b7d9a153ed2a37e8
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14027
CVE: CVE-2026-31788
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
The Xen privcmd driver allows to issue arbitrary hypercalls from
user space processes. This is normally no problem, as access is
usually limited to root and the hypervisor will deny any hypercalls
affecting other domains.
In case the guest is booted using secure boot, however, the privcmd
driver would be enabling a root user process to modify e.g. kernel
memory contents, thus breaking the secure boot feature.
The only known case where an unprivileged domU is really needing to
use the privcmd driver is the case when it is acting as the device
model for another guest. In this case all hypercalls issued via the
privcmd driver will target that other guest.
Fortunately the privcmd driver can already be locked down to allow
only hypercalls targeting a specific domain, but this mode can be
activated from user land only today.
The target domain can be obtained from Xenstore, so when not running
in dom0 restrict the privcmd driver to that target domain from the
beginning, resolving the potential problem of breaking secure boot.
This is XSA-482
Reported-by: Teddy Astie <teddy.astie(a)vates.tech>
Fixes: 1c5de1939c20 ("xen: add privcmd driver")
Signed-off-by: Juergen Gross <jgross(a)suse.com>
Conflicts:
drivers/xen/privcmd.c
[commit bf4afc53b77ae not merged]
Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com>
---
drivers/xen/privcmd.c | 62 +++++++++++++++++++++++++++++++++++++++----
1 file changed, 57 insertions(+), 5 deletions(-)
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 61aaded483e1..3c97710fc094 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -12,6 +12,7 @@
#include <linux/eventfd.h>
#include <linux/file.h>
#include <linux/kernel.h>
+#include <linux/kstrtox.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/poll.h>
@@ -30,7 +31,8 @@
#include <linux/seq_file.h>
#include <linux/miscdevice.h>
#include <linux/moduleparam.h>
-
+#include <linux/notifier.h>
+#include <linux/wait.h>
#include <asm/xen/hypervisor.h>
#include <asm/xen/hypercall.h>
@@ -43,7 +45,7 @@
#include <xen/page.h>
#include <xen/xen-ops.h>
#include <xen/balloon.h>
-
+#include <xen/xenbus.h>
#include "privcmd.h"
MODULE_LICENSE("GPL");
@@ -65,6 +67,11 @@ struct privcmd_data {
domid_t domid;
};
+/* DOMID_INVALID implies no restriction */
+static domid_t target_domain = DOMID_INVALID;
+static bool restrict_wait;
+static DECLARE_WAIT_QUEUE_HEAD(restrict_wait_wq);
+
static int privcmd_vma_range_is_mapped(
struct vm_area_struct *vma,
unsigned long addr,
@@ -1156,13 +1163,16 @@ static long privcmd_ioctl(struct file *file,
static int privcmd_open(struct inode *ino, struct file *file)
{
- struct privcmd_data *data = kzalloc(sizeof(*data), GFP_KERNEL);
+ struct privcmd_data *data;
+ if (wait_event_interruptible(restrict_wait_wq, !restrict_wait) < 0)
+ return -EINTR;
+
+ data = kzalloc(sizeof(*data), GFP_KERNEL);
if (!data)
return -ENOMEM;
- /* DOMID_INVALID implies no restriction */
- data->domid = DOMID_INVALID;
+ data->domid = target_domain;
file->private_data = data;
return 0;
@@ -1255,6 +1265,45 @@ static struct miscdevice privcmd_dev = {
.fops = &xen_privcmd_fops,
};
+static int init_restrict(struct notifier_block *notifier,
+ unsigned long event,
+ void *data)
+{
+ char *target;
+ unsigned int domid;
+
+ /* Default to an guaranteed unused domain-id. */
+ target_domain = DOMID_IDLE;
+
+ target = xenbus_read(XBT_NIL, "target", "", NULL);
+ if (IS_ERR(target) || kstrtouint(target, 10, &domid)) {
+ pr_err("No target domain found, blocking all hypercalls\n");
+ goto out;
+ }
+
+ target_domain = domid;
+
+ out:
+ if (!IS_ERR(target))
+ kfree(target);
+
+ restrict_wait = false;
+ wake_up_all(&restrict_wait_wq);
+
+ return NOTIFY_DONE;
+}
+
+static struct notifier_block xenstore_notifier = {
+ .notifier_call = init_restrict,
+};
+
+static void __init restrict_driver(void)
+{
+ restrict_wait = true;
+
+ register_xenstore_notifier(&xenstore_notifier);
+}
+
static int __init privcmd_init(void)
{
int err;
@@ -1262,6 +1311,9 @@ static int __init privcmd_init(void)
if (!xen_domain())
return -ENODEV;
+ if (!xen_initial_domain())
+ restrict_driver();
+
err = misc_register(&privcmd_dev);
if (err != 0) {
pr_err("Could not register Xen privcmd device\n");
--
2.22.0
2
3
07 Apr '26
hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/8882
--------------------------------
wake_wide() uses sd_llc_size as the spreading threshold to detect wide
waker/wakee relationships and to disable wake_affine() for those cases.
On SMT systems, sd_llc_size counts logical CPUs rather than physical
cores. This inflates the wake_wide() threshold, allowing wake_affine()
to pack more tasks into one LLC domain than the actual compute capacity
of its physical cores can sustain. The resulting SMT interference may
cost more than the cache-locality benefit wake_affine() intends to gain.
Scale the factor by the SMT width of the current CPU so that it
approximates the number of independent physical cores in the LLC domain,
making wake_wide() more likely to kick in before SMT interference
becomes significant. On non-SMT systems the SMT width is 1 and behaviour
is unchanged.
Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com>
---
kernel/sched/fair.c | 5 +++++
kernel/sched/features.h | 2 ++
2 files changed, 7 insertions(+)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index ad30bb800961..4100998e18cd 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -7850,6 +7850,11 @@ static int wake_wide(struct task_struct *p)
unsigned int slave = p->wakee_flips;
int factor = __this_cpu_read(sd_llc_size);
+ /* Scale factor to physical-core count to account for SMT interference. */
+ if (sched_feat(WA_SMT))
+ factor = DIV_ROUND_UP(factor,
+ cpumask_weight(cpu_smt_mask(smp_processor_id())));
+
if (master < slave)
swap(master, slave);
if (slave < factor || master < slave * factor)
diff --git a/kernel/sched/features.h b/kernel/sched/features.h
index 24a0c853a8a0..c9ad8e72ecd0 100644
--- a/kernel/sched/features.h
+++ b/kernel/sched/features.h
@@ -128,3 +128,5 @@ SCHED_FEAT(SOFT_DOMAIN, false)
#ifdef CONFIG_SCHED_SOFT_QUOTA
SCHED_FEAT(SOFT_QUOTA, false)
#endif
+
+SCHED_FEAT(WA_SMT, false)
--
2.18.0
2
1
07 Apr '26
hulk inclusion
category: perfermance
bugzilla: https://atomgit.com/openeuler/kernel/issues/8882
--------------------------------
wake_wide() uses sd_llc_size as the spreading threshold to detect wide
waker/wakee relationships and to disable wake_affine() for those cases.
On SMT systems, sd_llc_size counts logical CPUs rather than physical
cores. This inflates the wake_wide() threshold, allowing wake_affine()
to pack more tasks into one LLC domain than the actual compute capacity
of its physical cores can sustain. The resulting SMT interference may
cost more than the cache-locality benefit wake_affine() intends to gain.
Scale the factor by the SMT width of the current CPU so that it
approximates the number of independent physical cores in the LLC domain,
making wake_wide() more likely to kick in before SMT interference
becomes significant. On non-SMT systems the SMT width is 1 and behaviour
is unchanged.
Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com>
---
kernel/sched/fair.c | 5 +++++
kernel/sched/features.h | 2 ++
2 files changed, 7 insertions(+)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index ad30bb800961..4100998e18cd 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -7850,6 +7850,11 @@ static int wake_wide(struct task_struct *p)
unsigned int slave = p->wakee_flips;
int factor = __this_cpu_read(sd_llc_size);
+ /* Scale factor to physical-core count to account for SMT interference. */
+ if (sched_feat(WA_SMT))
+ factor = DIV_ROUND_UP(factor,
+ cpumask_weight(cpu_smt_mask(smp_processor_id())));
+
if (master < slave)
swap(master, slave);
if (slave < factor || master < slave * factor)
diff --git a/kernel/sched/features.h b/kernel/sched/features.h
index 24a0c853a8a0..c9ad8e72ecd0 100644
--- a/kernel/sched/features.h
+++ b/kernel/sched/features.h
@@ -128,3 +128,5 @@ SCHED_FEAT(SOFT_DOMAIN, false)
#ifdef CONFIG_SCHED_SOFT_QUOTA
SCHED_FEAT(SOFT_QUOTA, false)
#endif
+
+SCHED_FEAT(WA_SMT, false)
--
2.18.0
2
1
Fix rsicv check-build warning.
Björn Töpel (1):
riscv: Replace function-like macro by static inline function
Tengda Wu (1):
Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks"
arch/riscv/include/asm/cacheflush.h | 15 ++++++++++-----
arch/riscv/kernel/stacktrace.c | 16 ----------------
2 files changed, 10 insertions(+), 21 deletions(-)
--
2.34.1
2
3
From: Zilin Guan <zilin(a)seu.edu.cn>
mainline inclusion
from mainline-v7.0-rc3
commit fe868b499d16f55bbeea89992edb98043c9de416
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14020/
CVE: CVE-2026-23389
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
In ice_set_ringparam, tx_rings and xdp_rings are allocated before
rx_rings. If the allocation of rx_rings fails, the code jumps to
the done label leaking both tx_rings and xdp_rings. Furthermore, if
the setup of an individual Rx ring fails during the loop, the code jumps
to the free_tx label which releases tx_rings but leaks xdp_rings.
Fix this by introducing a free_xdp label and updating the error paths to
ensure both xdp_rings and tx_rings are properly freed if rx_rings
allocation or setup fails.
Compile tested only. Issue found using a prototype static analysis tool
and code review.
Fixes: fcea6f3da546 ("ice: Add stats and ethtool support")
Fixes: efc2214b6047 ("ice: Add support for XDP")
Signed-off-by: Zilin Guan <zilin(a)seu.edu.cn>
Reviewed-by: Paul Menzel <pmenzel(a)molgen.mpg.de>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com>
Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com>
Conflicts:
drivers/net/ethernet/intel/ice/ice_ethtool.c
[Context conflicts due to different memory allocation function used]
Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com>
---
drivers/net/ethernet/intel/ice/ice_ethtool.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
index dd58b2372dc0..bab857a6dc18 100644
--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
@@ -2839,7 +2839,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring,
rx_rings = kcalloc(vsi->num_rxq, sizeof(*rx_rings), GFP_KERNEL);
if (!rx_rings) {
err = -ENOMEM;
- goto done;
+ goto free_xdp;
}
ice_for_each_rxq(vsi, i) {
@@ -2869,7 +2869,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring,
}
kfree(rx_rings);
err = -ENOMEM;
- goto free_tx;
+ goto free_xdp;
}
}
@@ -2920,6 +2920,13 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring,
}
goto done;
+free_xdp:
+ if (xdp_rings) {
+ ice_for_each_xdp_txq(vsi, i)
+ ice_free_tx_ring(&xdp_rings[i]);
+ kfree(xdp_rings);
+ }
+
free_tx:
/* error cleanup if the Rx allocations failed after getting Tx */
if (tx_rings) {
--
2.34.1
2
1
From: Zilin Guan <zilin(a)seu.edu.cn>
mainline inclusion
from mainline-v7.0-rc3
commit fe868b499d16f55bbeea89992edb98043c9de416
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14020/
CVE: CVE-2026-23389
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
In ice_set_ringparam, tx_rings and xdp_rings are allocated before
rx_rings. If the allocation of rx_rings fails, the code jumps to
the done label leaking both tx_rings and xdp_rings. Furthermore, if
the setup of an individual Rx ring fails during the loop, the code jumps
to the free_tx label which releases tx_rings but leaks xdp_rings.
Fix this by introducing a free_xdp label and updating the error paths to
ensure both xdp_rings and tx_rings are properly freed if rx_rings
allocation or setup fails.
Compile tested only. Issue found using a prototype static analysis tool
and code review.
Fixes: fcea6f3da546 ("ice: Add stats and ethtool support")
Fixes: efc2214b6047 ("ice: Add support for XDP")
Signed-off-by: Zilin Guan <zilin(a)seu.edu.cn>
Reviewed-by: Paul Menzel <pmenzel(a)molgen.mpg.de>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com>
Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com>
Conflicts:
drivers/net/ethernet/intel/ice/ice_ethtool.c
[ Context conflicts due to different memory allocation function used.
Also, ice_for_each_xdp_txq is introduced in unmmerged commit
2faf63b650bb ("ice: make use of ice_for_each_* macros"), use normal
for loops here instead. ]
Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com>
---
drivers/net/ethernet/intel/ice/ice_ethtool.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
index 9659668279dc..585ae5e92558 100644
--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
@@ -2865,7 +2865,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring,
rx_rings = kcalloc(vsi->num_rxq, sizeof(*rx_rings), GFP_KERNEL);
if (!rx_rings) {
err = -ENOMEM;
- goto done;
+ goto free_xdp;
}
ice_for_each_rxq(vsi, i) {
@@ -2894,7 +2894,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring,
}
kfree(rx_rings);
err = -ENOMEM;
- goto free_tx;
+ goto free_xdp;
}
}
@@ -2945,6 +2945,13 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring,
}
goto done;
+free_xdp:
+ if (xdp_rings) {
+ for (i = 0; i < vsi->num_xdp_txq; i++)
+ ice_free_tx_ring(&xdp_rings[i]);
+ kfree(xdp_rings);
+ }
+
free_tx:
/* error cleanup if the Rx allocations failed after getting Tx */
if (tx_rings) {
--
2.34.1
2
1
[PATCH OLK-6.6] pstore/ram: fix buffer overflow in persistent_ram_save_old()
by Pan Taixi 07 Apr '26
by Pan Taixi 07 Apr '26
07 Apr '26
From: Sai Ritvik Tanksalkar <stanksal(a)purdue.edu>
stable inclusion
from stable-v6.6.128
commit cff0ef043e16feb5a02307c8f9d0117a96c5587c
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/8792
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 5669645c052f235726a85f443769b6fc02f66762 ]
persistent_ram_save_old() can be called multiple times for the same
persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_get_next_prz
for PSTORE_TYPE_DMESG records).
Currently, the function only allocates prz->old_log when it is NULL,
but it unconditionally updates prz->old_log_size to the current buffer
size and then performs memcpy_fromio() using this new size. If the
buffer size has grown since the first allocation (which can happen
across different kernel boot cycles), this leads to:
1. A heap buffer overflow (OOB write) in the memcpy_fromio() calls
2. A subsequent OOB read when ramoops_pstore_read() accesses the buffer
using the incorrect (larger) old_log_size
The KASAN splat would look similar to:
BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x...
Read of size N at addr ... by task ...
The conditions are likely extremely hard to hit:
0. Crash with a ramoops write of less-than-record-max-size bytes.
1. Reboot: ramoops registers, pstore_get_records(0) reads old crash,
allocates old_log with size X
2. Crash handler registered, timer started (if pstore_update_ms >= 0)
3. Oops happens (non-fatal, system continues)
4. pstore_dump() writes oops via ramoops_pstore_write() size Y (>X)
5. pstore_new_entry = 1, pstore_timer_kick() called
6. System continues running (not a panic oops)
7. Timer fires after pstore_update_ms milliseconds
8. pstore_timefunc() → schedule_work() → pstore_dowork() → pstore_get_records(1)
9. ramoops_get_next_prz() → persistent_ram_save_old()
10. buffer_size() returns Y, but old_log is X bytes
11. Y > X: memcpy_fromio() overflows heap
Requirements:
- a prior crash record exists that did not fill the record size
(almost impossible since the crash handler writes as much as it
can possibly fit into the record, capped by max record size and
the kmsg buffer almost always exceeds the max record size)
- pstore_update_ms >= 0 (disabled by default)
- Non-fatal oops (system survives)
Free and reallocate the buffer when the new size differs from the
previously allocated size. This ensures old_log always has sufficient
space for the data being copied.
Fixes: 201e4aca5aa1 ("pstore/ram: Should update old dmesg buffer before reading")
Signed-off-by: Sai Ritvik Tanksalkar <stanksal(a)purdue.edu>
Link: https://patch.msgid.link/20260201132240.2948732-1-stanksal@purdue.edu
Signed-off-by: Kees Cook <kees(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Yuan can <yuancan(a)huawei.com>
Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com>
---
fs/pstore/ram_core.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
index f1848cdd6d34..c9eaacdec37e 100644
--- a/fs/pstore/ram_core.c
+++ b/fs/pstore/ram_core.c
@@ -298,6 +298,17 @@ void persistent_ram_save_old(struct persistent_ram_zone *prz)
if (!size)
return;
+ /*
+ * If the existing buffer is differently sized, free it so a new
+ * one is allocated. This can happen when persistent_ram_save_old()
+ * is called early in boot and later for a timer-triggered
+ * survivable crash when the crash dumps don't match in size
+ * (which would be extremely unlikely given kmsg buffers usually
+ * exceed prz buffer sizes).
+ */
+ if (prz->old_log && prz->old_log_size != size)
+ persistent_ram_free_old(prz);
+
if (!prz->old_log) {
persistent_ram_ecc_old(prz);
prz->old_log = kvzalloc(size, GFP_KERNEL);
--
2.34.1
2
1
[PATCH OLK-5.10] pstore/ram: fix buffer overflow in persistent_ram_save_old()
by Pan Taixi 07 Apr '26
by Pan Taixi 07 Apr '26
07 Apr '26
From: Sai Ritvik Tanksalkar <stanksal(a)purdue.edu>
stable inclusion
from stable-v5.10.252
commit 58bda5a1d1ee98254383ef34f76b2c35140513ea
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14048/
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 5669645c052f235726a85f443769b6fc02f66762 ]
persistent_ram_save_old() can be called multiple times for the same
persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_get_next_prz
for PSTORE_TYPE_DMESG records).
Currently, the function only allocates prz->old_log when it is NULL,
but it unconditionally updates prz->old_log_size to the current buffer
size and then performs memcpy_fromio() using this new size. If the
buffer size has grown since the first allocation (which can happen
across different kernel boot cycles), this leads to:
1. A heap buffer overflow (OOB write) in the memcpy_fromio() calls
2. A subsequent OOB read when ramoops_pstore_read() accesses the buffer
using the incorrect (larger) old_log_size
The KASAN splat would look similar to:
BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x...
Read of size N at addr ... by task ...
The conditions are likely extremely hard to hit:
0. Crash with a ramoops write of less-than-record-max-size bytes.
1. Reboot: ramoops registers, pstore_get_records(0) reads old crash,
allocates old_log with size X
2. Crash handler registered, timer started (if pstore_update_ms >= 0)
3. Oops happens (non-fatal, system continues)
4. pstore_dump() writes oops via ramoops_pstore_write() size Y (>X)
5. pstore_new_entry = 1, pstore_timer_kick() called
6. System continues running (not a panic oops)
7. Timer fires after pstore_update_ms milliseconds
8. pstore_timefunc() → schedule_work() → pstore_dowork() → pstore_get_records(1)
9. ramoops_get_next_prz() → persistent_ram_save_old()
10. buffer_size() returns Y, but old_log is X bytes
11. Y > X: memcpy_fromio() overflows heap
Requirements:
- a prior crash record exists that did not fill the record size
(almost impossible since the crash handler writes as much as it
can possibly fit into the record, capped by max record size and
the kmsg buffer almost always exceeds the max record size)
- pstore_update_ms >= 0 (disabled by default)
- Non-fatal oops (system survives)
Free and reallocate the buffer when the new size differs from the
previously allocated size. This ensures old_log always has sufficient
space for the data being copied.
Fixes: 201e4aca5aa1 ("pstore/ram: Should update old dmesg buffer before reading")
Signed-off-by: Sai Ritvik Tanksalkar <stanksal(a)purdue.edu>
Link: https://patch.msgid.link/20260201132240.2948732-1-stanksal@purdue.edu
Signed-off-by: Kees Cook <kees(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com>
Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com>
---
fs/pstore/ram_core.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
index 5ac9b1f155a8..97ec9041b9b9 100644
--- a/fs/pstore/ram_core.c
+++ b/fs/pstore/ram_core.c
@@ -298,6 +298,17 @@ void persistent_ram_save_old(struct persistent_ram_zone *prz)
if (!size)
return;
+ /*
+ * If the existing buffer is differently sized, free it so a new
+ * one is allocated. This can happen when persistent_ram_save_old()
+ * is called early in boot and later for a timer-triggered
+ * survivable crash when the crash dumps don't match in size
+ * (which would be extremely unlikely given kmsg buffers usually
+ * exceed prz buffer sizes).
+ */
+ if (prz->old_log && prz->old_log_size != size)
+ persistent_ram_free_old(prz);
+
if (!prz->old_log) {
persistent_ram_ecc_old(prz);
prz->old_log = kmalloc(size, GFP_KERNEL);
--
2.34.1
2
1
07 Apr '26
From: Oleg Nesterov <oleg(a)redhat.com>
stable inclusion
from stable-v6.6.130
commit 9c05cd8f42325a53474093f372f6c08a56ae18d1
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14049/
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit d55c571e4333fac71826e8db3b9753fadfbead6a ]
This script
#!/usr/bin/bash
echo 0 > /proc/sys/kernel/randomize_va_space
echo 'void main(void) {}' > TEST.c
# -fcf-protection to ensure that the 1st endbr32 insn can't be emulated
gcc -m32 -fcf-protection=branch TEST.c -o test
bpftrace -e 'uprobe:./test:main {}' -c ./test
"hangs", the probed ./test task enters an endless loop.
The problem is that with randomize_va_space == 0
get_unmapped_area(TASK_SIZE - PAGE_SIZE) called by xol_add_vma() can not
just return the "addr == TASK_SIZE - PAGE_SIZE" hint, this addr is used
by the stack vma.
arch_get_unmapped_area_topdown() doesn't take TIF_ADDR32 into account and
in_32bit_syscall() is false, this leads to info.high_limit > TASK_SIZE.
vm_unmapped_area() happily returns the high address > TASK_SIZE and then
get_unmapped_area() returns -ENOMEM after the "if (addr > TASK_SIZE - len)"
check.
handle_swbp() doesn't report this failure (probably it should) and silently
restarts the probed insn. Endless loop.
I think that the right fix should change the x86 get_unmapped_area() paths
to rely on TIF_ADDR32 rather than in_32bit_syscall(). Note also that if
CONFIG_X86_X32_ABI=y, in_x32_syscall() falsely returns true in this case
because ->orig_ax = -1.
But we need a simple fix for -stable, so this patch just sets TS_COMPAT if
the probed task is 32-bit to make in_ia32_syscall() true.
Fixes: 1b028f784e8c ("x86/mm: Introduce mmap_compat_base() for 32-bit mmap()")
Reported-by: Paulo Andrade <pandrade(a)redhat.com>
Signed-off-by: Oleg Nesterov <oleg(a)redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Link: https://lore.kernel.org/all/aV5uldEvV7pb4RA8@redhat.com/
Cc: stable(a)vger.kernel.org
Link: https://patch.msgid.link/aWO7Fdxn39piQnxu@redhat.com
Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com>
---
arch/x86/kernel/uprobes.c | 24 ++++++++++++++++++++++++
include/linux/uprobes.h | 1 +
kernel/events/uprobes.c | 10 +++++++---
3 files changed, 32 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index 6402fb3089d2..aac2a2c5c6c5 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -1102,3 +1102,27 @@ bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx,
else
return regs->sp <= ret->stack;
}
+
+#ifdef CONFIG_IA32_EMULATION
+unsigned long arch_uprobe_get_xol_area(void)
+{
+ struct thread_info *ti = current_thread_info();
+ unsigned long vaddr;
+
+ /*
+ * HACK: we are not in a syscall, but x86 get_unmapped_area() paths
+ * ignore TIF_ADDR32 and rely on in_32bit_syscall() to calculate
+ * vm_unmapped_area_info.high_limit.
+ *
+ * The #ifdef above doesn't cover the CONFIG_X86_X32_ABI=y case,
+ * but in this case in_32bit_syscall() -> in_x32_syscall() always
+ * (falsely) returns true because ->orig_ax == -1.
+ */
+ if (test_thread_flag(TIF_ADDR32))
+ ti->status |= TS_COMPAT;
+ vaddr = get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, PAGE_SIZE, 0, 0);
+ ti->status &= ~TS_COMPAT;
+
+ return vaddr;
+}
+#endif
diff --git a/include/linux/uprobes.h b/include/linux/uprobes.h
index b0c15a04adcc..7c63f47a497d 100644
--- a/include/linux/uprobes.h
+++ b/include/linux/uprobes.h
@@ -147,6 +147,7 @@ extern bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check c
extern bool arch_uprobe_ignore(struct arch_uprobe *aup, struct pt_regs *regs);
extern void arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
void *src, unsigned long len);
+extern unsigned long arch_uprobe_get_xol_area(void);
#else /* !CONFIG_UPROBES */
struct uprobes_state {
};
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 9d2d68d171e9..8f73ab934c38 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1478,6 +1478,12 @@ void uprobe_munmap(struct vm_area_struct *vma, unsigned long start, unsigned lon
set_bit(MMF_RECALC_UPROBES, &vma->vm_mm->flags);
}
+unsigned long __weak arch_uprobe_get_xol_area(void)
+{
+ /* Try to map as high as possible, this is only a hint. */
+ return get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, PAGE_SIZE, 0, 0);
+}
+
/* Slot allocation for XOL */
static int xol_add_vma(struct mm_struct *mm, struct xol_area *area)
{
@@ -1493,9 +1499,7 @@ static int xol_add_vma(struct mm_struct *mm, struct xol_area *area)
}
if (!area->vaddr) {
- /* Try to map as high as possible, this is only a hint. */
- area->vaddr = get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE,
- PAGE_SIZE, 0, 0);
+ area->vaddr = arch_uprobe_get_xol_area();
if (IS_ERR_VALUE(area->vaddr)) {
ret = area->vaddr;
goto fail;
--
2.34.1
2
1
07 Apr '26
From: Oleg Nesterov <oleg(a)redhat.com>
mainline inclusion
from mainline-v7.0-rc1
commit d55c571e4333fac71826e8db3b9753fadfbead6a
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14049/
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
This script
#!/usr/bin/bash
echo 0 > /proc/sys/kernel/randomize_va_space
echo 'void main(void) {}' > TEST.c
# -fcf-protection to ensure that the 1st endbr32 insn can't be emulated
gcc -m32 -fcf-protection=branch TEST.c -o test
bpftrace -e 'uprobe:./test:main {}' -c ./test
"hangs", the probed ./test task enters an endless loop.
The problem is that with randomize_va_space == 0
get_unmapped_area(TASK_SIZE - PAGE_SIZE) called by xol_add_vma() can not
just return the "addr == TASK_SIZE - PAGE_SIZE" hint, this addr is used
by the stack vma.
arch_get_unmapped_area_topdown() doesn't take TIF_ADDR32 into account and
in_32bit_syscall() is false, this leads to info.high_limit > TASK_SIZE.
vm_unmapped_area() happily returns the high address > TASK_SIZE and then
get_unmapped_area() returns -ENOMEM after the "if (addr > TASK_SIZE - len)"
check.
handle_swbp() doesn't report this failure (probably it should) and silently
restarts the probed insn. Endless loop.
I think that the right fix should change the x86 get_unmapped_area() paths
to rely on TIF_ADDR32 rather than in_32bit_syscall(). Note also that if
CONFIG_X86_X32_ABI=y, in_x32_syscall() falsely returns true in this case
because ->orig_ax = -1.
But we need a simple fix for -stable, so this patch just sets TS_COMPAT if
the probed task is 32-bit to make in_ia32_syscall() true.
Fixes: 1b028f784e8c ("x86/mm: Introduce mmap_compat_base() for 32-bit mmap()")
Reported-by: Paulo Andrade <pandrade(a)redhat.com>
Signed-off-by: Oleg Nesterov <oleg(a)redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Link: https://lore.kernel.org/all/aV5uldEvV7pb4RA8@redhat.com/
Cc: stable(a)vger.kernel.org
Link: https://patch.msgid.link/aWO7Fdxn39piQnxu@redhat.com
Conflicts:
arch/x86/kernel/uprobes.c
include/linux/uprobes.h
kernel/events/uprobes.c
[Context conflicts only]
Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com>
---
arch/x86/kernel/uprobes.c | 24 ++++++++++++++++++++++++
include/linux/uprobes.h | 1 +
kernel/events/uprobes.c | 10 +++++++---
3 files changed, 32 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index 9f948b2d26f6..099ca674e3de 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -1095,3 +1095,27 @@ bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx,
else
return regs->sp <= ret->stack;
}
+
+#ifdef CONFIG_IA32_EMULATION
+unsigned long arch_uprobe_get_xol_area(void)
+{
+ struct thread_info *ti = current_thread_info();
+ unsigned long vaddr;
+
+ /*
+ * HACK: we are not in a syscall, but x86 get_unmapped_area() paths
+ * ignore TIF_ADDR32 and rely on in_32bit_syscall() to calculate
+ * vm_unmapped_area_info.high_limit.
+ *
+ * The #ifdef above doesn't cover the CONFIG_X86_X32_ABI=y case,
+ * but in this case in_32bit_syscall() -> in_x32_syscall() always
+ * (falsely) returns true because ->orig_ax == -1.
+ */
+ if (test_thread_flag(TIF_ADDR32))
+ ti->status |= TS_COMPAT;
+ vaddr = get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, PAGE_SIZE, 0, 0);
+ ti->status &= ~TS_COMPAT;
+
+ return vaddr;
+}
+#endif
diff --git a/include/linux/uprobes.h b/include/linux/uprobes.h
index 2c693d6eb9cb..568c211b617e 100644
--- a/include/linux/uprobes.h
+++ b/include/linux/uprobes.h
@@ -144,6 +144,7 @@ extern bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check c
extern bool arch_uprobe_ignore(struct arch_uprobe *aup, struct pt_regs *regs);
extern void arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
void *src, unsigned long len);
+extern unsigned long arch_uprobe_get_xol_area(void);
#else /* !CONFIG_UPROBES */
struct uprobes_state {
};
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index e51dbb0e8a56..fe518be0615f 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1443,6 +1443,12 @@ void uprobe_munmap(struct vm_area_struct *vma, unsigned long start, unsigned lon
set_bit(MMF_RECALC_UPROBES, &vma->vm_mm->flags);
}
+unsigned long __weak arch_uprobe_get_xol_area(void)
+{
+ /* Try to map as high as possible, this is only a hint. */
+ return get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, PAGE_SIZE, 0, 0);
+}
+
/* Slot allocation for XOL */
static int xol_add_vma(struct mm_struct *mm, struct xol_area *area)
{
@@ -1458,9 +1464,7 @@ static int xol_add_vma(struct mm_struct *mm, struct xol_area *area)
}
if (!area->vaddr) {
- /* Try to map as high as possible, this is only a hint. */
- area->vaddr = get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE,
- PAGE_SIZE, 0, 0);
+ area->vaddr = arch_uprobe_get_xol_area();
if (IS_ERR_VALUE(area->vaddr)) {
ret = area->vaddr;
goto fail;
--
2.34.1
2
1
Fix riscv compiling error.
Björn Töpel (1):
riscv: Replace function-like macro by static inline function
Tengda Wu (1):
Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks"
arch/riscv/include/asm/cacheflush.h | 15 ++++++++++-----
arch/riscv/kernel/stacktrace.c | 19 ++-----------------
2 files changed, 12 insertions(+), 22 deletions(-)
--
2.34.1
2
3
yt6801 inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/7229
--------------------------------------------------------------------
fix the link info is not update on os installation.
Fixes: b9f5c0893d16 ("net: yt6801: add link info for yt6801")
Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com>
---
.../net/ethernet/motorcomm/yt6801/yt6801_main.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c
index 01eed3ace..3fcb6f853 100644
--- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c
+++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c
@@ -27,6 +27,18 @@
const struct net_device_ops *fxgmac_get_netdev_ops(void);
static void fxgmac_napi_enable(struct fxgmac_pdata *priv);
+const struct ethtool_ops *fxgmac_get_ethtool_ops(void);
+
+static const struct ethtool_ops fxgmac_ethtool_ops = {
+ .get_link = ethtool_op_get_link,
+ .get_link_ksettings = phy_ethtool_get_link_ksettings,
+ .set_link_ksettings = phy_ethtool_set_link_ksettings
+};
+
+const struct ethtool_ops *fxgmac_get_ethtool_ops(void)
+{
+ return &fxgmac_ethtool_ops;
+}
#define PHY_WR_CONFIG(reg_offset) (0x8000205 + ((reg_offset) * 0x10000))
static int fxgmac_phy_write_reg(struct fxgmac_pdata *priv, u32 reg_id, u32 data)
@@ -1898,7 +1910,9 @@ static int fxgmac_init(struct fxgmac_pdata *priv, bool save_private_reg)
ndev->max_mtu =
FXGMAC_JUMBO_PACKET_MTU + (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN);
+
ndev->netdev_ops = fxgmac_get_netdev_ops();/* Set device operations */
+ ndev->ethtool_ops = fxgmac_get_ethtool_ops();/* Set device operations */
/* Set device features */
if (priv->hw_feat.tso) {
--
2.34.1
2
1
[PATCH OLK-6.6] riscv: Replace function-like macro by static inline function
by Tengda Wu 07 Apr '26
by Tengda Wu 07 Apr '26
07 Apr '26
From: Björn Töpel <bjorn(a)rivosinc.com>
stable inclusion
from stable-v6.6.133
commit 0b1ac9743f3d9cfced2ac3cb9f274c0675bd4189
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/8883
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 121f34341d396b666d8a90b24768b40e08ca0d61 upstream.
The flush_icache_range() function is implemented as a "function-like
macro with unused parameters", which can result in "unused variables"
warnings.
Replace the macro with a static inline function, as advised by
Documentation/process/coding-style.rst.
Fixes: 08f051eda33b ("RISC-V: Flush I$ when making a dirty page executable")
Signed-off-by: Björn Töpel <bjorn(a)rivosinc.com>
Link: https://lore.kernel.org/r/20250419111402.1660267-1-bjorn@kernel.org
Signed-off-by: Palmer Dabbelt <palmer(a)rivosinc.com>
Signed-off-by: Ron Economos <re(a)w6rz.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Tengda Wu <wutengda2(a)huawei.com>
---
arch/riscv/include/asm/cacheflush.h | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/arch/riscv/include/asm/cacheflush.h b/arch/riscv/include/asm/cacheflush.h
index 3f65acd0ef75..2b7f5da96c50 100644
--- a/arch/riscv/include/asm/cacheflush.h
+++ b/arch/riscv/include/asm/cacheflush.h
@@ -34,11 +34,6 @@ static inline void flush_dcache_page(struct page *page)
flush_dcache_folio(page_folio(page));
}
-/*
- * RISC-V doesn't have an instruction to flush parts of the instruction cache,
- * so instead we just flush the whole thing.
- */
-#define flush_icache_range(start, end) flush_icache_all()
#define flush_icache_user_page(vma, pg, addr, len) \
flush_icache_mm(vma->vm_mm, 0)
@@ -59,6 +54,16 @@ void flush_icache_mm(struct mm_struct *mm, bool local);
#endif /* CONFIG_SMP */
+/*
+ * RISC-V doesn't have an instruction to flush parts of the instruction cache,
+ * so instead we just flush the whole thing.
+ */
+#define flush_icache_range flush_icache_range
+static inline void flush_icache_range(unsigned long start, unsigned long end)
+{
+ flush_icache_all();
+}
+
extern unsigned int riscv_cbom_block_size;
extern unsigned int riscv_cboz_block_size;
void riscv_init_cbo_blocksizes(void);
--
2.34.1
2
1
[PATCH OLK-6.6 v5 0/2] kvm: arm64: Transition from CPU Type to MIDR Register for Virtualization Feature Detection
by liqiqi 07 Apr '26
by liqiqi 07 Apr '26
07 Apr '26
Currently, there are two methods for determining whether a chip supports
specific virtualization features:
1. Reading the chip's CPU type from BIOS
2. Reading the value of the MIDR register
The issue with the first method is that each time a new chip is introduced,
the new CPU type must be defined, which leads to poor code portability and
maintainability.
Therefore, the second method has been adopted to replace the first. This
approach eliminates the dependency on CPU type by using the MIDR register.
liqiqi (2):
kvm: arm64: Add MIDR definitions and use MIDR to determine whether
features are supported
kvm: arm64: Remove cpu_type definition and it's related interfaces
arch/arm64/include/asm/cache.h | 2 +-
arch/arm64/include/asm/cputype.h | 8 +-
arch/arm64/kernel/cpu_errata.c | 4 +-
arch/arm64/kernel/cpufeature.c | 2 +-
arch/arm64/kernel/proton-pack.c | 4 +-
arch/arm64/kvm/arm.c | 1 -
arch/arm64/kvm/hisilicon/hisi_virt.c | 110 +++--------------------
arch/arm64/kvm/hisilicon/hisi_virt.h | 12 ---
drivers/perf/hisilicon/hisi_uncore_pmu.c | 2 +-
tools/arch/arm64/include/asm/cputype.h | 4 +-
10 files changed, 25 insertions(+), 124 deletions(-)
--
2.43.0
2
3
[PATCH OLK-5.10] apparmor: fix unprivileged local user can do privileged policy management
by Yi Yang 07 Apr '26
by Yi Yang 07 Apr '26
07 Apr '26
From: John Johansen <john.johansen(a)canonical.com>
mainline inclusion
from mainline-v7.0-rc4
commit 6601e13e82841879406bf9f369032656f441a425
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13879
CVE: CVE-2026-23268
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
An unprivileged local user can load, replace, and remove profiles by
opening the apparmorfs interfaces, via a confused deputy attack, by
passing the opened fd to a privileged process, and getting the
privileged process to write to the interface.
This does require a privileged target that can be manipulated to do
the write for the unprivileged process, but once such access is
achieved full policy management is possible and all the possible
implications that implies: removing confinement, DoS of system or
target applications by denying all execution, by-passing the
unprivileged user namespace restriction, to exploiting kernel bugs for
a local privilege escalation.
The policy management interface can not have its permissions simply
changed from 0666 to 0600 because non-root processes need to be able
to load policy to different policy namespaces.
Instead ensure the task writing the interface has privileges that
are a subset of the task that opened the interface. This is already
done via policy for confined processes, but unconfined can delegate
access to the opened fd, by-passing the usual policy check.
Fixes: b7fd2c0340eac ("apparmor: add per policy ns .load, .replace, .remove interface files")
Reported-by: Qualys Security Advisory <qsa(a)qualys.com>
Tested-by: Salvatore Bonaccorso <carnil(a)debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia(a)canonical.com>
Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com>
Signed-off-by: John Johansen <john.johansen(a)canonical.com>
Conflicts:
security/apparmor/apparmorfs.c
security/apparmor/include/policy.h
security/apparmor/policy.c
[Commit 90c436a64a6e ("apparmor: pass cred through to audit info.") was
not merged. The aa_may_manage_policy function is different.]
Signed-off-by: Yi Yang <yiyang13(a)huawei.com>
---
security/apparmor/apparmorfs.c | 19 +++++++++------
security/apparmor/include/policy.h | 2 +-
security/apparmor/policy.c | 37 ++++++++++++++++++++++++++++--
3 files changed, 48 insertions(+), 10 deletions(-)
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 06eac2266565..0900fd07def7 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -409,7 +409,8 @@ static struct aa_loaddata *aa_simple_write_to_buffer(const char __user *userbuf,
}
static ssize_t policy_update(u32 mask, const char __user *buf, size_t size,
- loff_t *pos, struct aa_ns *ns)
+ loff_t *pos, struct aa_ns *ns,
+ const struct cred *ocred)
{
struct aa_loaddata *data;
struct aa_label *label;
@@ -420,7 +421,7 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size,
/* high level check about policy management - fine grained in
* below after unpack
*/
- error = aa_may_manage_policy(label, ns, mask);
+ error = aa_may_manage_policy(label, ns, ocred, mask);
if (error)
goto end_section;
@@ -441,7 +442,8 @@ static ssize_t profile_load(struct file *f, const char __user *buf, size_t size,
loff_t *pos)
{
struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
- int error = policy_update(AA_MAY_LOAD_POLICY, buf, size, pos, ns);
+ int error = policy_update(AA_MAY_LOAD_POLICY, buf, size, pos, ns,
+ f->f_cred);
aa_put_ns(ns);
@@ -459,7 +461,7 @@ static ssize_t profile_replace(struct file *f, const char __user *buf,
{
struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
int error = policy_update(AA_MAY_LOAD_POLICY | AA_MAY_REPLACE_POLICY,
- buf, size, pos, ns);
+ buf, size, pos, ns, f->f_cred);
aa_put_ns(ns);
return error;
@@ -483,7 +485,8 @@ static ssize_t profile_remove(struct file *f, const char __user *buf,
/* high level check about policy management - fine grained in
* below after unpack
*/
- error = aa_may_manage_policy(label, ns, AA_MAY_REMOVE_POLICY);
+ error = aa_may_manage_policy(label, ns, f->f_cred,
+ AA_MAY_REMOVE_POLICY);
if (error)
goto out;
@@ -1787,7 +1790,8 @@ static int ns_mkdir_op(struct inode *dir, struct dentry *dentry, umode_t mode)
int error;
label = begin_current_label_crit_section();
- error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY);
+ error = aa_may_manage_policy(label, NULL, NULL,
+ AA_MAY_LOAD_POLICY);
end_current_label_crit_section(label);
if (error)
return error;
@@ -1836,7 +1840,8 @@ static int ns_rmdir_op(struct inode *dir, struct dentry *dentry)
int error;
label = begin_current_label_crit_section();
- error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY);
+ error = aa_may_manage_policy(label, NULL, NULL,
+ AA_MAY_LOAD_POLICY);
end_current_label_crit_section(label);
if (error)
return error;
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index b5aa4231af68..f6682a31df23 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -304,6 +304,6 @@ static inline int AUDIT_MODE(struct aa_profile *profile)
bool policy_view_capable(struct aa_ns *ns);
bool policy_admin_capable(struct aa_ns *ns);
int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns,
- u32 mask);
+ const struct cred *ocred, u32 mask);
#endif /* __AA_POLICY_H */
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index fcf22577f606..e5f501f89803 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -671,14 +671,42 @@ bool policy_admin_capable(struct aa_ns *ns)
return policy_view_capable(ns) && capable && !aa_g_lock_policy;
}
+static bool is_subset_of_obj_privilege(const struct cred *cred,
+ struct aa_label *label,
+ const struct cred *ocred)
+{
+ if (cred == ocred)
+ return true;
+
+ if (!aa_label_is_subset(label, cred_label(ocred)))
+ return false;
+ /* don't allow crossing userns for now */
+ if (cred->user_ns != ocred->user_ns)
+ return false;
+ if (!cap_issubset(cred->cap_inheritable, ocred->cap_inheritable))
+ return false;
+ if (!cap_issubset(cred->cap_permitted, ocred->cap_permitted))
+ return false;
+ if (!cap_issubset(cred->cap_effective, ocred->cap_effective))
+ return false;
+ if (!cap_issubset(cred->cap_bset, ocred->cap_bset))
+ return false;
+ if (!cap_issubset(cred->cap_ambient, ocred->cap_ambient))
+ return false;
+ return true;
+}
+
/**
* aa_may_manage_policy - can the current task manage policy
* @label: label to check if it can manage policy
- * @op: the policy manipulation operation being done
+ * @ns: namespace being managed by @label (may be NULL if @label's ns)
+ * @ocred: object cred if request is coming from an open object
+ * @mask: contains the policy manipulation operation being done
*
* Returns: 0 if the task is allowed to manipulate policy else error
*/
-int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns, u32 mask)
+int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns,
+ const struct cred *ocred, u32 mask)
{
const char *op;
@@ -694,6 +722,11 @@ int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns, u32 mask)
return audit_policy(label, op, NULL, NULL, "policy_locked",
-EACCES);
+ if (ocred && !is_subset_of_obj_privilege(current_cred(), label, ocred))
+ return audit_policy(label, op, NULL, NULL,
+ "not privileged for target profile",
+ -EACCES);
+
if (!policy_admin_capable(ns))
return audit_policy(label, op, NULL, NULL, "not policy admin",
-EACCES);
--
2.25.1
2
1
From: Eric Biggers <ebiggers(a)kernel.org>
mainline inclusion
from mainline-v7.0-rc2
commit c5794709bc9105935dbedef8b9cf9c06f2b559fa
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13917
CVE: CVE-2026-23364
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
To prevent timing attacks, MAC comparisons need to be constant-time.
Replace the memcmp() with the correct function, crypto_memneq().
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable(a)vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers(a)kernel.org>
Acked-by: Namjae Jeon <linkinjeon(a)kernel.org>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
Conflicts:
fs/smb/server/Kconfig
fs/smb/server/auth.c
fs/smb/server/smb2pdu.c
[Commit 38c8a9a52082 ("smb: move client and server files to common
directory fs/smb") move client and server files to common directory
fs/smb;
commit 7033b937e21b ("crypto: lib - create utils module and move
__crypto_memneq into it") change the config of memneq.c.]
Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com>
---
fs/ksmbd/Kconfig | 1 +
fs/ksmbd/auth.c | 4 +++-
fs/ksmbd/smb2pdu.c | 5 +++--
3 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/fs/ksmbd/Kconfig b/fs/ksmbd/Kconfig
index e1fe17747ed6..832c6a0dd327 100644
--- a/fs/ksmbd/Kconfig
+++ b/fs/ksmbd/Kconfig
@@ -11,6 +11,7 @@ config SMB_SERVER
select CRYPTO_ECB
select CRYPTO_LIB_DES
select CRYPTO_SHA256
+ select LIB_MEMNEQ
select CRYPTO_CMAC
select CRYPTO_SHA512
select CRYPTO_AEAD2
diff --git a/fs/ksmbd/auth.c b/fs/ksmbd/auth.c
index c5916064b85e..fb4a6f9e4e98 100644
--- a/fs/ksmbd/auth.c
+++ b/fs/ksmbd/auth.c
@@ -13,6 +13,7 @@
#include <linux/xattr.h>
#include <crypto/hash.h>
#include <crypto/aead.h>
+#include <crypto/algapi.h>
#include <linux/random.h>
#include <linux/scatterlist.h>
@@ -280,7 +281,8 @@ int ksmbd_auth_ntlmv2(struct ksmbd_conn *conn, struct ksmbd_session *sess,
goto out;
}
- if (memcmp(ntlmv2->ntlmv2_hash, ntlmv2_rsp, CIFS_HMAC_MD5_HASH_SIZE) != 0)
+ if (crypto_memneq(ntlmv2->ntlmv2_hash, ntlmv2_rsp,
+ CIFS_HMAC_MD5_HASH_SIZE))
rc = -EINVAL;
out:
if (ctx)
diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
index 1588867b4e71..d75de3035327 100644
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -4,6 +4,7 @@
* Copyright (C) 2018 Samsung Electronics Co., Ltd.
*/
+#include <crypto/algapi.h>
#include <linux/inetdevice.h>
#include <net/addrconf.h>
#include <linux/syscalls.h>
@@ -8344,7 +8345,7 @@ int smb2_check_sign_req(struct ksmbd_work *work)
signature))
return 0;
- if (memcmp(signature, signature_req, SMB2_SIGNATURE_SIZE)) {
+ if (crypto_memneq(signature, signature_req, SMB2_SIGNATURE_SIZE)) {
pr_err("bad smb2 signature\n");
return 0;
}
@@ -8456,7 +8457,7 @@ int smb3_check_sign_req(struct ksmbd_work *work)
if (ksmbd_sign_smb3_pdu(conn, signing_key, iov, 1, signature))
return 0;
- if (memcmp(signature, signature_req, SMB2_SIGNATURE_SIZE)) {
+ if (crypto_memneq(signature, signature_req, SMB2_SIGNATURE_SIZE)) {
pr_err("bad smb2 signature\n");
return 0;
}
--
2.52.0
2
1
*** fix CVE-2026-23208 ***
Edward Adam Davis (1):
ALSA: usb-audio: Prevent excessive number of frames
Takashi Iwai (1):
ALSA: usb-audio: Use the right limit for PCM OOB check
sound/usb/pcm.c | 3 +++
1 file changed, 3 insertions(+)
--
2.43.0
2
3
yt6801 inclusion
category: bugfix
bugzilla: https://atomgit.com/openeuler/kernel/issues/7229
--------------------------------------------------------------------
fix the link info is not update on os installation.
Fixes: b9f5c0893d16 ("net: yt6801: add link info for yt6801")
Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com>
---
.../ethernet/motorcomm/yt6801/yt6801_main.c | 91 +++++++++++++++++++
1 file changed, 91 insertions(+)
diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c
index 01eed3ace..83b5ab258 100644
--- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c
+++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c
@@ -27,6 +27,95 @@
const struct net_device_ops *fxgmac_get_netdev_ops(void);
static void fxgmac_napi_enable(struct fxgmac_pdata *priv);
+const struct ethtool_ops *fxgmac_get_ethtool_ops(void);
+
+#define MII_SPEC_STATUS 0x11 /* PHY specific status */
+#define FXGMAC_EPHY_LINK_STATUS BIT(10)
+#define PHY_MII_SPEC_DUPLEX BIT(13)
+
+static int fxgmac_get_link_ksettings(struct net_device *netdev,
+ struct ethtool_link_ksettings *cmd)
+{
+ struct fxgmac_pdata *pdata = netdev_priv(netdev);
+ struct phy_device *phydev = netdev->phydev;
+ u32 duplex, regval, link_status;
+ u32 adv = 0xFFFFFFFF;
+
+ ethtool_link_ksettings_zero_link_mode(cmd, supported);
+ ethtool_link_ksettings_zero_link_mode(cmd, advertising);
+
+ /* set the supported link speeds */
+ ethtool_link_ksettings_add_link_mode(cmd, supported, 1000baseT_Full);
+ ethtool_link_ksettings_add_link_mode(cmd, supported, 100baseT_Full);
+ ethtool_link_ksettings_add_link_mode(cmd, supported, 100baseT_Half);
+ ethtool_link_ksettings_add_link_mode(cmd, supported, 10baseT_Full);
+ ethtool_link_ksettings_add_link_mode(cmd, supported, 10baseT_Half);
+
+ /* Indicate pause support */
+ ethtool_link_ksettings_add_link_mode(cmd, supported, Pause);
+ ethtool_link_ksettings_add_link_mode(cmd, supported, Asym_Pause);
+
+ adv = phy_read(phydev, MII_ADVERTISE);
+
+ if (field_get(ADVERTISE_PAUSE_CAP, adv))
+ ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause);
+
+ if (field_get(ADVERTISE_PAUSE_ASYM, adv))
+ ethtool_link_ksettings_add_link_mode(cmd, advertising, Asym_Pause);
+
+ ethtool_link_ksettings_add_link_mode(cmd, supported, MII);
+ cmd->base.port = PORT_MII;
+
+ ethtool_link_ksettings_add_link_mode(cmd, supported, Autoneg);
+ regval = phy_read(phydev, MII_BMCR);
+
+ regval = field_get(BMCR_ANENABLE, regval);
+ if (regval) {
+ ethtool_link_ksettings_add_link_mode(cmd, advertising, Autoneg);
+
+ adv = phy_read(phydev, MII_ADVERTISE);
+
+ if (adv & ADVERTISE_10HALF)
+ ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half);
+ if (adv & ADVERTISE_10FULL)
+ ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full);
+ if (adv & ADVERTISE_100HALF)
+ ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half);
+ if (adv & ADVERTISE_100FULL)
+ ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full);
+
+ adv = phy_read(phydev, MII_CTRL1000);
+
+ if (adv & ADVERTISE_1000FULL)
+ ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full);
+ }
+
+ cmd->base.autoneg = 1;
+
+ regval = phy_read(phydev, MII_SPEC_STATUS);
+
+ link_status = field_get(FXGMAC_EPHY_LINK_STATUS, regval);
+ if (link_status) {
+ duplex = field_get(PHY_MII_SPEC_DUPLEX, regval);
+ cmd->base.duplex = duplex;
+ cmd->base.speed = pdata->mac_speed;
+ } else {
+ cmd->base.duplex = DUPLEX_UNKNOWN;
+ cmd->base.speed = SPEED_UNKNOWN;
+ }
+
+ return 0;
+}
+
+static const struct ethtool_ops fxgmac_ethtool_ops = {
+ .get_link = ethtool_op_get_link,
+ .get_link_ksettings = fxgmac_get_link_ksettings,
+};
+
+const struct ethtool_ops *fxgmac_get_ethtool_ops(void)
+{
+ return &fxgmac_ethtool_ops;
+}
#define PHY_WR_CONFIG(reg_offset) (0x8000205 + ((reg_offset) * 0x10000))
static int fxgmac_phy_write_reg(struct fxgmac_pdata *priv, u32 reg_id, u32 data)
@@ -1898,7 +1987,9 @@ static int fxgmac_init(struct fxgmac_pdata *priv, bool save_private_reg)
ndev->max_mtu =
FXGMAC_JUMBO_PACKET_MTU + (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN);
+
ndev->netdev_ops = fxgmac_get_netdev_ops();/* Set device operations */
+ ndev->ethtool_ops = fxgmac_get_ethtool_ops();/* Set device operations */
/* Set device features */
if (priv->hw_feat.tso) {
--
2.34.1
2
1
Aboorva Devarajan (2):
sched_ext: Documentation: Remove mentions of scx_bpf_switch_all
sched: Pass correct scheduling policy to __setscheduler_class
Alan Maguire (16):
kbuild,bpf: Switch to using --btf_features for pahole v1.26 and later
kbuild, bpf: Use test-ge check for v1.25-only pahole
libbpf: Add btf__distill_base() creating split BTF with distilled base
BTF
selftests/bpf: Test distilled base, split BTF generation
libbpf: Split BTF relocation
selftests/bpf: Extend distilled BTF tests to cover BTF relocation
resolve_btfids: Handle presence of .BTF.base section
libbpf: BTF relocation followup fixing naming, loop logic
module, bpf: Store BTF base pointer in struct module
libbpf: Split field iter code into its own file kernel
libbpf,bpf: Share BTF relocate-related code with kernel
kbuild,bpf: Add module-specific pahole flags for distilled base BTF
selftests/bpf: Add kfunc_call test for simple dtor in bpf_testmod
bpf: fix build when CONFIG_DEBUG_INFO_BTF[_MODULES] is undefined
libbpf: Fix error handling in btf__distill_base()
libbpf: Fix license for btf_relocate.c
Alexander Lobakin (1):
bitops: make BYTES_TO_BITS() treewide-available
Alexei Starovoitov (2):
s390/bpf: Fix indirect trampoline generation
bpf: Introduce "volatile compare" macros
Andrea Righi (33):
sched_ext: fix typo in set_weight() description
sched_ext: add CONFIG_DEBUG_INFO_BTF dependency
sched_ext: Provide a sysfs enable_seq counter
sched_ext: improve WAKE_SYNC behavior for default idle CPU selection
sched_ext: Clarify ops.select_cpu() for single-CPU tasks
sched_ext: Introduce LLC awareness to the default idle selection
policy
sched_ext: Introduce NUMA awareness to the default idle selection
policy
sched_ext: Do not enable LLC/NUMA optimizations when domains overlap
sched_ext: Fix incorrect use of bitwise AND
MAINTAINERS: add self as reviewer for sched_ext
sched_ext: idle: Refresh idle masks during idle-to-idle transitions
sched_ext: Use the NUMA scheduling domain for NUMA optimizations
sched_ext: idle: use assign_cpu() to update the idle cpumask
sched_ext: idle: clarify comments
sched_ext: idle: introduce check_builtin_idle_enabled() helper
sched_ext: idle: small CPU iteration refactoring
sched_ext: update scx_bpf_dsq_insert() doc for SCX_DSQ_LOCAL_ON
sched_ext: Include remaining task time slice in error state dump
sched_ext: Include task weight in the error state dump
selftests/sched_ext: Fix enum resolution
tools/sched_ext: Add helper to check task migration state
sched_ext: selftests/dsp_local_on: Fix selftest on UP systems
sched_ext: Fix lock imbalance in dispatch_to_local_dsq()
selftests/sched_ext: Fix exit selftest hang on UP
sched_ext: Move built-in idle CPU selection policy to a separate file
sched_ext: Track currently locked rq
sched_ext: Make scx_locked_rq() inline
sched_ext: Fix missing rq lock in scx_bpf_cpuperf_set()
sched/ext: Fix invalid task state transitions on class switch
sched_ext: Make scx_kf_allowed_if_unlocked() available outside ext.c
sched_ext: Remove duplicate BTF_ID_FLAGS definitions
sched_ext: Fix rq lock state in hotplug ops
sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()
Andrii Nakryiko (14):
bpf: Emit global subprog name in verifier logs
bpf: Validate global subprogs lazily
selftests/bpf: Add lazy global subprog validation tests
libbpf: Add btf__new_split() API that was declared but not implemented
bpf: move sleepable flag from bpf_prog_aux to bpf_prog
libbpf: Add BTF field iterator
libbpf: Make use of BTF field iterator in BPF linker code
libbpf: Make use of BTF field iterator in BTF handling code
bpftool: Use BTF field iterator in btfgen
libbpf: Remove callback-based type/string BTF field visitor helpers
bpf: extract iterator argument type and name validation logic
bpf: allow passing struct bpf_iter_<type> as kfunc arguments
selftests/bpf: test passing iterator to a kfunc
selftests/bpf: validate eliminated global subprog is not freplaceable
Arnaldo Carvalho de Melo (1):
tools include UAPI: Sync linux/sched.h copy with the kernel sources
Atul Kumar Pant (1):
sched_ext: Fixes typos in comments
Benjamin Tissoires (1):
bpf: introduce in_sleepable() helper
Bitao Hu (4):
genirq: Convert kstat_irqs to a struct
genirq: Provide a snapshot mechanism for interrupt statistics
watchdog/softlockup: Low-overhead detection of interrupt storm
watchdog/softlockup: Report the most frequent interrupts
Björn Töpel (1):
selftests: sched_ext: Add sched_ext as proper selftest target
Breno Leitao (3):
rhashtable: Fix potential deadlock by moving schedule_work outside
lock
sched_ext: Use kvzalloc for large exit_dump allocation
sched/ext: Prevent update_locked_rq() calls with NULL rq
Changwoo Min (12):
sched_ext: Clarify sched_ext_ops table for userland scheduler
sched_ext: add a missing rcu_read_lock/unlock pair at
scx_select_cpu_dfl()
MAINTAINERS: add me as reviewer for sched_ext
sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass()
sched_ext: Relocate scx_enabled() related code
sched_ext: Implement scx_bpf_now()
sched_ext: Add scx_bpf_now() for BPF scheduler
sched_ext: Add time helpers for BPF schedulers
sched_ext: Replace bpf_ktime_get_ns() to scx_bpf_now()
sched_ext: Use time helpers in BPF schedulers
sched_ext: Fix incorrect time delta calculation in time_delta()
sched_ext: Add scx_bpf_events() and scx_read_event() for BPF
schedulers
Cheng-Yang Chou (1):
sched_ext: Always use SMP versions in kernel/sched/ext.c
Christian Brauner (1):
file: add take_fd() cleanup helper
Christian Loehle (1):
sched/fair: Remove stale FREQUENCY_UTIL comment
Christophe Leroy (2):
bpf: Remove arch_unprotect_bpf_trampoline()
bpf: Check return from set_memory_rox()
Chuyi Zhou (15):
cgroup: Prepare for using css_task_iter_*() in BPF
bpf: Introduce css_task open-coded iterator kfuncs
bpf: Introduce task open coded iterator kfuncs
bpf: Introduce css open-coded iterator kfuncs
bpf: teach the verifier to enforce css_iter and task_iter in RCU CS
bpf: Let bpf_iter_task_new accept null task ptr
selftests/bpf: rename bpf_iter_task.c to bpf_iter_tasks.c
selftests/bpf: Add tests for open-coded task and css iter
bpf: Relax allowlist for css_task iter
selftests/bpf: Add tests for css_task iter combining with cgroup iter
selftests/bpf: Add test for using css_task iter in sleepable progs
bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg
selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly
sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h.
sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx
Colin Ian King (1):
sched_ext: Fix spelling mistake: "intead" -> "instead"
Daniel Xu (3):
bpf: btf: Support flags for BTF_SET8 sets
bpf: btf: Add BTF_KFUNCS_START/END macro pair
bpf: treewide: Annotate BPF kfuncs in BTF
Dave Marchevsky (6):
bpf: Don't explicitly emit BTF for struct btf_iter_num
selftests/bpf: Rename bpf_iter_task_vma.c to bpf_iter_task_vmas.c
bpf: Introduce task_vma open-coded iterator kfuncs
selftests/bpf: Add tests for open-coded task_vma iter
bpf: Add __bpf_kfunc_{start,end}_defs macros
bpf: Add __bpf_hook_{start,end} macros
David Vernet (15):
bpf: Add ability to pin bpf timer to calling CPU
selftests/bpf: Test pinning bpf timer to a core
sched_ext: Implement runnable task stall watchdog
sched_ext: Print sched_ext info when dumping stack
sched_ext: Implement SCX_KICK_WAIT
sched_ext: Implement sched_ext_ops.cpu_acquire/release()
sched_ext: Add selftests
bpf: Load vmlinux btf for any struct_ops map
sched_ext: Make scx_bpf_cpuperf_set() @cpu arg signed
scx: Allow calling sleepable kfuncs from BPF_PROG_TYPE_SYSCALL
scx/selftests: Verify we can call create_dsq from prog_run
sched_ext: Remove unnecessary cpu_relax()
scx: Fix exit selftest to use custom DSQ
scx: Fix raciness in scx_ops_bypass()
scx: Fix maximal BPF selftest prog
Dawei Li (1):
genirq: Deduplicate interrupt descriptor initialization
Devaansh Kumar (1):
sched_ext: selftests: Fix grammar in tests description
Devaansh-Kumar (1):
sched_ext: Documentation: Update instructions for running example
schedulers
Eduard Zingerman (2):
libbpf: Make btf_parse_elf process .BTF.base transparently
selftests/bpf: Check if distilled base inherits source endianness
Geliang Tang (1):
bpf, btf: Check btf for register_bpf_struct_ops
Henry Huang (2):
sched_ext: initialize kit->cursor.flags
sched_ext: keep running prev when prev->scx.slice != 0
Herbert Xu (1):
rhashtable: Fix rhashtable_try_insert test
Honglei Wang (3):
sched_ext: use correct function name in pick_task_scx() warning
message
sched_ext: Add __weak to fix the build errors
sched_ext: switch class when preempted by higher priority scheduler
Hongyan Xia (1):
sched/ext: Add BPF function to fetch rq
Hou Tao (7):
bpf: Free dynamically allocated bits in bpf_iter_bits_destroy()
bpf: Add bpf_mem_alloc_check_size() helper
bpf: Check the validity of nr_words in bpf_iter_bits_new()
bpf: Use __u64 to save the bits in bits iterator
selftests/bpf: Add three test cases for bits_iter
selftests/bpf: Use -4095 as the bad address for bits iterator
selftests/bpf: Export map_update_retriable()
Ihor Solodrai (2):
selftests/sched_ext: add order-only dependency of runner.o on BPFOBJ
selftests/sched_ext: fix build after renames in sched_ext API
Ilpo Järvinen (1):
<linux/cleanup.h>: Allow the passing of both iomem and non-iomem
pointers to no_free_ptr()
Ingo Molnar (3):
sched/syscalls: Split out kernel/sched/syscalls.c from
kernel/sched/core.c
sched/fair: Rename check_preempt_wakeup() to
check_preempt_wakeup_fair()
sched/fair: Rename check_preempt_curr() to wakeup_preempt()
Jake Hillion (2):
sched_ext: create_dsq: Return -EEXIST on duplicate request
sched_ext: Drop kfuncs marked for removal in 6.15
Jiapeng Chong (1):
sched_ext: Fixes incorrect type in bpf_scx_init()
Jiayuan Chen (1):
selftests/bpf: Fixes for test_maps test
Kui-Feng Lee (29):
bpf: refactory struct_ops type initialization to a function.
bpf: get type information with BTF_ID_LIST
bpf, net: introduce bpf_struct_ops_desc.
bpf: add struct_ops_tab to btf.
bpf: make struct_ops_map support btfs other than btf_vmlinux.
bpf: pass btf object id in bpf_map_info.
bpf: lookup struct_ops types from a given module BTF.
bpf: pass attached BTF to the bpf_struct_ops subsystem
bpf: hold module refcnt in bpf_struct_ops map creation and prog
verification.
bpf: validate value_type
bpf, net: switch to dynamic registration
libbpf: Find correct module BTFs for struct_ops maps and progs.
bpf: export btf_ctx_access to modules.
selftests/bpf: test case for register_bpf_struct_ops().
bpf: Fix error checks against bpf_get_btf_vmlinux().
bpf: Remove an unnecessary check.
selftests/bpf: Suppress warning message of an unused variable.
bpf: add btf pointer to struct bpf_ctx_arg_aux.
bpf: Move __kfunc_param_match_suffix() to btf.c.
bpf: Create argument information for nullable arguments.
selftests/bpf: Test PTR_MAYBE_NULL arguments of struct_ops operators.
libbpf: Set btf_value_type_id of struct bpf_map for struct_ops.
libbpf: Convert st_ops->data to shadow type.
bpftool: Generated shadow variables for struct_ops maps.
bpftool: Add an example for struct_ops map and shadow type.
selftests/bpf: Test if shadow types work correctly.
bpf, net: validate struct_ops when updating value.
bpf: struct_ops supports more than one page for trampolines.
selftests/bpf: Test struct_ops maps with a large number of struct_ops
program.
Kumar Kartikeya Dwivedi (4):
bpf: Allow calling static subprogs while holding a bpf_spin_lock
selftests/bpf: Add test for static subprog call in lock cs
bpf: Transfer RCU lock state between subprog calls
selftests/bpf: Add tests for RCU lock transfer between subprogs
Liang Jie (1):
sched_ext: Use sizeof_field for key_len in dsq_hash_params
Luo Gengkun (7):
bpf: Fix kabi-breakage for bpf_func_info_aux
bpf: Fix kabi-breakage for bpf_tramp_image
bpf: Fix kabi for bpf_attr
bpf_verifier: Fix kabi for bpf_verifier_env
bpf: Fix kabi for bpf_ctx_arg_aux
bpf: Fix kabi for bpf_prog_aux and bpf_prog
selftests/bpf: modify test_loader that didn't support running
bpf_prog_type_syscall programs
Manu Bretelle (1):
sched_ext: define missing cfi stubs for sched_ext
Martin KaFai Lau (5):
libbpf: Ensure undefined bpf_attr field stays 0
bpf: Remove unnecessary err < 0 check in
bpf_struct_ops_map_update_elem
bpf: Fix a crash when btf_parse_base() returns an error pointer
bpf: Reject struct_ops registration that uses module ptr and the
module btf_id is missing
bpf: Use kallsyms to find the function name of a struct_ops's stub
function
Masahiro Yamada (1):
kbuild: avoid too many execution of scripts/pahole-flags.sh
Matthieu Baerts (1):
bpf: fix compilation error without CGROUPS
Peter Zijlstra (26):
cfi: Flip headers
x86/cfi,bpf: Fix BPF JIT call
x86/cfi,bpf: Fix bpf_callback_t CFI
x86/cfi,bpf: Fix bpf_struct_ops CFI
cfi: Add CFI_NOSEAL()
bpf: Fix dtor CFI
cleanup: Make no_free_ptr() __must_check
sched: Simplify set_user_nice()
sched: Simplify syscalls
sched: Simplify sched_{set,get}affinity()
sched: Simplify yield_to()
sched: Simplify sched_rr_get_interval()
sched: Simplify sched_move_task()
sched: Misc cleanups
sched/deadline: Move bandwidth accounting into {en,de}queue_dl_entity
sched: Allow sched_class::dequeue_task() to fail
sched: Unify runtime accounting across classes
sched: Use set_next_task(.first) where required
sched/fair: Cleanup pick_task_fair() vs throttle
sched/fair: Cleanup pick_task_fair()'s curr
sched/fair: Unify pick_{,next_}_task_fair()
sched: Fixup set_next_task() implementations
sched: Split up put_prev_task_balance()
sched: Rework pick_next_task()
sched: Combine the last put_prev_task() and the first set_next_task()
sched: Add put_prev_task(.next)
Pu Lehui (8):
riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops
bpf: Fix kabi breakage in struct module
riscv, bpf: Fix out-of-bounds issue when preparing trampoline image
selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill
test
libbpf: Fix return zero when elf_begin failed
libbpf: Fix incorrect traversal end type ID when marking
BTF_IS_EMBEDDED
selftests/bpf: Add distilled BTF test about marking BTF_IS_EMBEDDED
selftests/bpf: Add file_read_pattern to gitignore
Randy Dunlap (1):
sched_ext: fix kernel-doc warnings
Shizhao Chen (1):
sched_ext: Add option -l in selftest runner to list all available
tests
Song Liu (8):
bpf: Charge modmem for struct_ops trampoline
bpf: Let bpf_prog_pack_free handle any pointer
bpf: Adjust argument names of arch_prepare_bpf_trampoline()
bpf: Add helpers for trampoline image management
bpf, x86: Adjust arch_prepare_bpf_trampoline return value
bpf: Add arch_bpf_trampoline_size()
bpf: Use arch_bpf_trampoline_size
x86, bpf: Use bpf_prog_pack for bpf trampoline
T.J. Mercier (1):
bpf, docs: Fix broken link to renamed bpf_iter_task_vmas.c
Tejun Heo (152):
sched: Restructure sched_class order sanity checks in sched_init()
sched: Allow sched_cgroup_fork() to fail and introduce
sched_cancel_fork()
sched: Add sched_class->reweight_task()
sched: Add sched_class->switching_to() and expose
check_class_changing/changed()
sched: Factor out cgroup weight conversion functions
sched: Factor out update_other_load_avgs() from
__update_blocked_others()
sched: Add normal_policy()
sched_ext: Add boilerplate for extensible scheduler class
sched_ext: Implement BPF extensible scheduler class
sched_ext: Add scx_simple and scx_example_qmap example schedulers
sched_ext: Add sysrq-S which disables the BPF scheduler
sched_ext: Allow BPF schedulers to disallow specific tasks from
joining SCHED_EXT
sched_ext: Print debug dump after an error exit
tools/sched_ext: Add scx_show_state.py
sched_ext: Implement scx_bpf_kick_cpu() and task preemption support
sched_ext: Add a central scheduler which makes all scheduling
decisions on one CPU
sched_ext: Make watchdog handle ops.dispatch() looping stall
sched_ext: Add task state tracking operations
sched_ext: Implement tickless support
sched_ext: Track tasks that are subjects of the in-flight SCX
operation
sched_ext: Implement sched_ext_ops.cpu_online/offline()
sched_ext: Bypass BPF scheduler while PM events are in progress
sched_ext: Implement core-sched support
sched_ext: Add vtime-ordered priority queue to dispatch_q's
sched_ext: Documentation: scheduler: Document extensible scheduler
class
sched, sched_ext: Replace scx_next_task_picked() with
sched_class->switch_class()
cpufreq_schedutil: Refactor sugov_cpu_is_busy()
sched_ext: Add cpuperf support
sched_ext: Drop tools_clean target from the top-level Makefile
sched_ext: Swap argument positions in kcalloc() call to avoid compiler
warning
sched, sched_ext: Simplify dl_prio() case handling in sched_fork()
sched_ext: Account for idle policy when setting p->scx.weight in
scx_ops_enable_task()
sched_ext: Disallow loading BPF scheduler if isolcpus= domain
isolation is in effect
sched_ext: Minor cleanups in kernel/sched/ext.h
sched, sched_ext: Open code for_balance_class_range()
sched, sched_ext: Move some declarations from kernel/sched/ext.h to
sched.h
sched_ext: Take out ->priq and ->flags from scx_dsq_node
sched_ext: Implement DSQ iterator
sched_ext/scx_qmap: Add an example usage of DSQ iterator
sched_ext: Reimplement scx_bpf_reenqueue_local()
sched_ext: Make scx_bpf_reenqueue_local() skip tasks that are being
migrated
sched: Move struct balance_callback definition upward
sched_ext: Unpin and repin rq lock from balance_scx()
sched_ext: s/SCX_RQ_BALANCING/SCX_RQ_IN_BALANCE/ and add
SCX_RQ_IN_WAKEUP
sched_ext: Allow SCX_DSQ_LOCAL_ON for direct dispatches
sched_ext/scx_qmap: Pick idle CPU for direct dispatch on !wakeup
enqueues
sched_ext: Build fix on !CONFIG_STACKTRACE[_SUPPORT]
sched_ext: Allow p->scx.disallow only while loading
sched_ext: Simplify scx_can_stop_tick() invocation in
sched_can_stop_tick()
sched_ext: Add scx_enabled() test to @start_class promotion in
put_prev_task_balance()
sched_ext: Use update_curr_common() in update_curr_scx()
sched_ext: Simplify UP support by enabling sched_class->balance() in
UP
sched_ext: Improve comment on idle_sched_class exception in
scx_task_iter_next_locked()
sched_ext: Make task_can_run_on_remote_rq() use common
task_allowed_on_cpu()
sched_ext: Fix unsafe list iteration in process_ddsp_deferred_locals()
sched_ext: Make scx_rq_online() also test cpu_active() in addition to
SCX_RQ_ONLINE
sched_ext: Improve logging around enable/disable
sched_ext: Don't use double locking to migrate tasks across CPUs
scx_central: Fix smatch checker warning
sched_ext: Add missing cfi stub for ops.tick
sched_ext: Use task_can_run_on_remote_rq() test in
dispatch_to_local_dsq()
sched_ext: Use sched_clock_cpu() instead of rq_clock_task() in
touch_core_sched()
sched_ext: Don't call put_prev_task_scx() before picking the next task
sched_ext: Replace SCX_TASK_BAL_KEEP with SCX_RQ_BAL_KEEP
sched_ext: Unify regular and core-sched pick task paths
sched_ext: Relocate functions in kernel/sched/ext.c
sched_ext: Remove switch_class_scx()
sched_ext: Remove sched_class->switch_class()
sched_ext: TASK_DEAD tasks must be switched out of SCX on ops_disable
sched_ext: TASK_DEAD tasks must be switched into SCX on ops_enable
sched: Expose css_tg()
sched: Make cpu_shares_read_u64() use tg_weight()
sched: Introduce CONFIG_GROUP_SCHED_WEIGHT
sched_ext: Add cgroup support
sched_ext: Add a cgroup scheduler which uses flattened hierarchy
sched_ext: Temporarily work around pick_task_scx() being called
without balance_scx()
sched_ext: Add missing static to scx_has_op[]
sched_ext: Add missing static to scx_dump_data
sched_ext: Rename scx_kfunc_set_sleepable to unlocked and relocate
sched_ext: Refactor consume_remote_task()
sched_ext: Make find_dsq_for_dispatch() handle SCX_DSQ_LOCAL_ON
sched_ext: Fix processs_ddsp_deferred_locals() by unifying DTL_INVALID
handling
sched_ext: Restructure dispatch_to_local_dsq()
sched_ext: Reorder args for consume_local/remote_task()
sched_ext: Move sanity check and dsq_mod_nr() into
task_unlink_from_dsq()
sched_ext: Move consume_local_task() upward
sched_ext: Replace consume_local_task() with
move_local_task_to_local_dsq()
sched_ext: Compact struct bpf_iter_scx_dsq_kern
sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq()
scx_qmap: Implement highpri boosting
sched_ext: Synchronize bypass state changes with rq lock
sched_ext: Don't trigger ops.quiescent/runnable() on migrations
sched_ext: Fix build when !CONFIG_STACKTRACE
sched_ext: Build fix for !CONFIG_SMP
sched_ext: Add __COMPAT helpers for features added during v6.12 devel
cycle
tools/sched_ext: Receive misc updates from SCX repo
scx_flatcg: Use a user DSQ for fallback instead of SCX_DSQ_GLOBAL
sched_ext: Allow only user DSQs for scx_bpf_consume(),
scx_bpf_dsq_nr_queued() and bpf_iter_scx_dsq_new()
sched_ext: Relocate find_user_dsq()
sched_ext: Split the global DSQ per NUMA node
sched_ext: Use shorter slice while bypassing
sched_ext: Relocate check_hotplug_seq() call in scx_ops_enable()
sched_ext: Remove SCX_OPS_PREPPING
sched_ext: Initialize in bypass mode
sched_ext: Fix SCX_TASK_INIT -> SCX_TASK_READY transitions in
scx_ops_enable()
sched_ext: Enable scx_ops_init_task() separately
sched_ext: Add scx_cgroup_enabled to gate cgroup operations and fix
scx_tg_online()
sched_ext: Decouple locks in scx_ops_disable_workfn()
sched_ext: Decouple locks in scx_ops_enable()
sched_ext: Improve error reporting during loading
sched_ext: scx_cgroup_exit() may be called without successful
scx_cgroup_init()
sched/core: Make select_task_rq() take the pointer to wake_flags
instead of value
sched/core: Add ENQUEUE_RQ_SELECTED to indicate whether
->select_task_rq() was called
sched_ext, scx_qmap: Add and use SCX_ENQ_CPU_SELECTED
Revert "sched_ext: Use shorter slice while bypassing"
sched_ext: Start schedulers with consistent p->scx.slice values
sched_ext: Move scx_buildin_idle_enabled check to
scx_bpf_select_cpu_dfl()
sched_ext: bypass mode shouldn't depend on ops.select_cpu()
sched_ext: Move scx_tasks_lock handling into scx_task_iter helpers
sched_ext: Don't hold scx_tasks_lock for too long
sched_ext: Make cast_mask() inline
sched_ext: Fix enq_last_no_enq_fails selftest
sched_ext: Add a missing newline at the end of an error message
sched_ext: Update scx_show_state.py to match scx_ops_bypass_depth's
new type
sched_ext: Handle cases where pick_task_scx() is called without
preceding balance_scx()
sched_ext: ops.cpu_acquire() should be called with SCX_KF_REST
sched_ext: Factor out move_task_between_dsqs() from
scx_dispatch_from_dsq()
sched_ext: Rename CFI stubs to names that are recognized by BPF
sched_ext: Replace set_arg_maybe_null() with __nullable CFI stub tags
sched_ext: Avoid live-locking bypass mode switching
sched_ext: Enable the ops breather and eject BPF scheduler on
softlockup
sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked
context
sched_ext: Rename scx_bpf_dispatch[_vtime]() to
scx_bpf_dsq_insert[_vtime]()
sched_ext: Rename scx_bpf_consume() to scx_bpf_dsq_move_to_local()
sched_ext: Rename scx_bpf_dispatch[_vtime]_from_dsq*() ->
scx_bpf_dsq_move[_vtime]*()
sched_ext: Fix invalid irq restore in scx_ops_bypass()
sched_ext: Fix dsq_local_on selftest
tools/sched_ext: Receive updates from SCX repo
sched_ext: selftests/dsp_local_on: Fix sporadic failures
sched_ext: Fix incorrect autogroup migration detection
sched_ext: Implement auto local dispatching of migration disabled
tasks
sched_ext: Fix migration disabled handling in targeted dispatches
sched_ext: Fix incorrect assumption about migration disabled tasks in
task_can_run_on_remote_rq()
sched_ext: Fix pick_task_scx() picking non-queued tasks when it's
called without balance()
sched_ext: Implement SCX_OPS_ALLOW_QUEUED_WAKEUP
sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator
sched_ext: Make scx_group_set_weight() always update tg->scx.weight
sched_ext, sched/core: Don't call scx_group_set_weight() prematurely
from sched_create_group()
sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU
sched_ext: Don't kick CPUs running higher classes
sched_ext: Use SCX_TASK_READY test instead of tryget_task_struct()
during class switch
tools/sched_ext: Sync with scx repo
Thomas Gleixner (1):
sched/ext: Remove sched_fork() hack
Thorsten Blum (1):
sched_ext: Use str_enabled_disabled() helper in
update_selcpu_topology()
Tianchen Ding (1):
sched_ext: Use btf_ids to resolve task_struct
Tony Ambardar (1):
libbpf: Ensure new BTF objects inherit input endianness
Vincent Guittot (2):
sched/cpufreq: Rework schedutil governor performance estimation
sched/fair: Fix sched_can_stop_tick() for fair tasks
Vishal Chourasia (2):
sched_ext: Add __weak markers to BPF helper function decalarations
sched_ext: Fix function pointer type mismatches in BPF selftests
Wenyu Huang (1):
sched/doc: Update documentation after renames and synchronize Chinese
version
Yafang Shao (2):
bpf: Add bits iterator
selftests/bpf: Add selftest for bits iter
Yipeng Zou (1):
sched_ext: Allow dequeue_task_scx to fail
Yiwei Lin (1):
sched/fair: Remove unused 'curr' argument from pick_next_entity()
Yu Liao (2):
sched: Put task_group::idle under CONFIG_GROUP_SCHED_WEIGHT
sched: Add dummy version of sched_group_set_idle()
Yury Norov (1):
cpumask: introduce assign_cpu() macro
Zhang Qiao (3):
sched_ext: Remove redundant p->nr_cpus_allowed checker
sched/ext: Fix unmatch trailing comment of CONFIG_EXT_GROUP_SCHED
sched/ext: Use tg_cgroup() to elieminate duplicate code
Zhao Mengmeng (1):
sched_ext: Replace scx_next_task_picked() with switch_class() in
comment
Zicheng Qu (18):
sched: Fix kabi for reweight_task in struct sched_class
Revert "sched/deadline: Fix missing ENQUEUE_REPLENISH during PI
de-boosting"
sched/syscalls: Fix kabi for EXPORT_SYMBOL moved from core.c to
syscalls.c
sched: Fix kabi for switching_to in struct sched_class
sched/fair: Fix kabi for check_preempt_curr and wakeup_preempt in
struct sched_class
sched: Fix kabi for dequeue_task in struct sched_class
sched_ext: Fix kabi for scx in struct task_struct
sched_ext: Fix kabi for switch_class in struct sched_class
sched: Fix kabi for exec_max in struct sched_statistics
sched_ext: Fix kabi for balance in struct sched_class
sched_ext: Fix kabi for header in kernel/sched/sched.h
sched: Fix kabi pick_task in struct sched_class
sched: Fix kabi for put_prev_task in struct sched_class
sched_ext: Fix kabi for scx_flags and scx_weight in struct task_group
sched: Fix kabi for int idle in struct task_group
sched: Add __setscheduler_class() for sched_ext
genirq: Fix kabi for kstat_irqs in struct irq_desc
sched_ext: Enable and disable sched_ext configs
Zqiang (1):
sched_ext: Fix unsafe locking in the scx_dump_state()
guanjing (1):
sched_ext: fix application of sizeof to pointer
Documentation/bpf/bpf_iterators.rst | 2 +-
Documentation/bpf/kfuncs.rst | 14 +-
Documentation/scheduler/index.rst | 1 +
Documentation/scheduler/sched-design-CFS.rst | 8 +-
Documentation/scheduler/sched-ext.rst | 325 +
.../zh_CN/scheduler/sched-design-CFS.rst | 8 +-
MAINTAINERS | 16 +-
Makefile | 4 +-
arch/arm64/configs/openeuler_defconfig | 3 +
arch/arm64/kernel/bpf-rvi.c | 4 +-
arch/arm64/net/bpf_jit_comp.c | 55 +-
arch/mips/dec/setup.c | 2 +-
arch/parisc/kernel/smp.c | 2 +-
arch/powerpc/kvm/book3s_hv_rm_xics.c | 2 +-
arch/riscv/include/asm/cfi.h | 3 +-
arch/riscv/kernel/cfi.c | 2 +-
arch/riscv/net/bpf_jit_comp64.c | 48 +-
arch/s390/net/bpf_jit_comp.c | 59 +-
arch/x86/configs/openeuler_defconfig | 2 +
arch/x86/include/asm/cfi.h | 126 +-
arch/x86/kernel/alternative.c | 87 +-
arch/x86/kernel/cfi.c | 4 +-
arch/x86/net/bpf_jit_comp.c | 261 +-
block/blk-cgroup.c | 4 +-
drivers/hid/bpf/hid_bpf_dispatch.c | 12 +-
drivers/tty/sysrq.c | 1 +
fs/proc/stat.c | 4 +-
include/asm-generic/Kbuild | 1 +
include/asm-generic/cfi.h | 5 +
include/asm-generic/vmlinux.lds.h | 1 +
include/linux/bitops.h | 2 +
include/linux/bpf.h | 130 +-
include/linux/bpf_mem_alloc.h | 3 +
include/linux/bpf_verifier.h | 21 +-
include/linux/btf.h | 105 +
include/linux/btf_ids.h | 21 +-
include/linux/cfi.h | 12 +
include/linux/cgroup.h | 14 +-
include/linux/cleanup.h | 42 +-
include/linux/cpumask.h | 41 +-
include/linux/energy_model.h | 1 -
include/linux/file.h | 20 +
include/linux/filter.h | 2 +-
include/linux/irqdesc.h | 17 +-
include/linux/kernel_stat.h | 8 +
include/linux/module.h | 8 +-
include/linux/sched.h | 8 +-
include/linux/sched/ext.h | 216 +
include/linux/sched/task.h | 8 +-
include/trace/events/sched_ext.h | 32 +
include/uapi/linux/bpf.h | 16 +-
include/uapi/linux/sched.h | 1 +
init/Kconfig | 10 +
init/init_task.c | 12 +
kernel/Kconfig.preempt | 27 +-
kernel/bpf-rvi/common_kfuncs.c | 4 +-
kernel/bpf/Makefile | 8 +-
kernel/bpf/bpf_iter.c | 12 +-
kernel/bpf/bpf_struct_ops.c | 745 +-
kernel/bpf/bpf_struct_ops_types.h | 12 -
kernel/bpf/btf.c | 431 +-
kernel/bpf/cgroup_iter.c | 65 +-
kernel/bpf/core.c | 76 +-
kernel/bpf/cpumask.c | 18 +-
kernel/bpf/dispatcher.c | 7 +-
kernel/bpf/helpers.c | 202 +-
kernel/bpf/map_iter.c | 10 +-
kernel/bpf/memalloc.c | 14 +-
kernel/bpf/syscall.c | 12 +-
kernel/bpf/task_iter.c | 242 +-
kernel/bpf/trampoline.c | 99 +-
kernel/bpf/verifier.c | 317 +-
kernel/cgroup/cgroup.c | 18 +-
kernel/cgroup/cpuset.c | 4 +-
kernel/cgroup/rstat.c | 13 +-
kernel/events/core.c | 2 +-
kernel/fork.c | 17 +-
kernel/irq/Kconfig | 4 +
kernel/irq/internals.h | 2 +-
kernel/irq/irqdesc.c | 144 +-
kernel/irq/proc.c | 5 +-
kernel/module/main.c | 5 +-
kernel/sched/autogroup.c | 4 +-
kernel/sched/bpf_sched.c | 8 +-
kernel/sched/build_policy.c | 13 +
kernel/sched/core.c | 2522 +-----
kernel/sched/cpuacct.c | 4 +-
kernel/sched/cpufreq_schedutil.c | 83 +-
kernel/sched/deadline.c | 175 +-
kernel/sched/debug.c | 3 +
kernel/sched/ext.c | 7155 +++++++++++++++++
kernel/sched/ext.h | 119 +
kernel/sched/ext_idle.c | 755 ++
kernel/sched/ext_idle.h | 39 +
kernel/sched/fair.c | 306 +-
kernel/sched/idle.c | 31 +-
kernel/sched/rt.c | 40 +-
kernel/sched/sched.h | 473 +-
kernel/sched/stop_task.c | 35 +-
kernel/sched/syscalls.c | 1713 ++++
kernel/trace/bpf_trace.c | 12 +-
kernel/trace/trace_probe.c | 2 -
kernel/watchdog.c | 223 +-
lib/Kconfig.debug | 14 +
lib/dump_stack.c | 1 +
lib/rhashtable.c | 12 +-
net/bpf/bpf_dummy_struct_ops.c | 72 +-
net/bpf/test_run.c | 30 +-
net/core/filter.c | 33 +-
net/core/xdp.c | 10 +-
net/ipv4/bpf_tcp_ca.c | 93 +-
net/ipv4/fou_bpf.c | 10 +-
net/ipv4/tcp_bbr.c | 4 +-
net/ipv4/tcp_cong.c | 6 +-
net/ipv4/tcp_cubic.c | 4 +-
net/ipv4/tcp_dctcp.c | 4 +-
net/netfilter/nf_conntrack_bpf.c | 10 +-
net/netfilter/nf_nat_bpf.c | 10 +-
net/socket.c | 8 +-
net/xfrm/xfrm_interface_bpf.c | 10 +-
scripts/Makefile.btf | 33 +
scripts/Makefile.modfinal | 2 +-
scripts/gdb/linux/interrupts.py | 6 +-
scripts/pahole-flags.sh | 30 -
tools/Makefile | 10 +-
.../bpf/bpftool/Documentation/bpftool-gen.rst | 58 +-
tools/bpf/bpftool/gen.c | 253 +-
tools/bpf/resolve_btfids/main.c | 8 +
tools/include/linux/bitops.h | 2 +
tools/include/uapi/linux/bpf.h | 14 +-
tools/include/uapi/linux/sched.h | 1 +
tools/lib/bpf/Build | 2 +-
tools/lib/bpf/bpf.c | 4 +-
tools/lib/bpf/bpf.h | 4 +-
tools/lib/bpf/btf.c | 704 +-
tools/lib/bpf/btf.h | 36 +
tools/lib/bpf/btf_iter.c | 177 +
tools/lib/bpf/btf_relocate.c | 519 ++
tools/lib/bpf/libbpf.c | 97 +-
tools/lib/bpf/libbpf.map | 4 +-
tools/lib/bpf/libbpf_internal.h | 29 +-
tools/lib/bpf/libbpf_probes.c | 1 +
tools/lib/bpf/linker.c | 58 +-
tools/perf/util/probe-finder.c | 4 +-
tools/sched_ext/.gitignore | 2 +
tools/sched_ext/Makefile | 246 +
tools/sched_ext/README.md | 270 +
.../sched_ext/include/bpf-compat/gnu/stubs.h | 11 +
tools/sched_ext/include/scx/common.bpf.h | 647 ++
tools/sched_ext/include/scx/common.h | 81 +
tools/sched_ext/include/scx/compat.bpf.h | 143 +
tools/sched_ext/include/scx/compat.h | 187 +
.../sched_ext/include/scx/enums.autogen.bpf.h | 105 +
tools/sched_ext/include/scx/enums.autogen.h | 41 +
tools/sched_ext/include/scx/enums.bpf.h | 12 +
tools/sched_ext/include/scx/enums.h | 27 +
tools/sched_ext/include/scx/user_exit_info.h | 118 +
tools/sched_ext/scx_central.bpf.c | 356 +
tools/sched_ext/scx_central.c | 145 +
tools/sched_ext/scx_flatcg.bpf.c | 954 +++
tools/sched_ext/scx_flatcg.c | 234 +
tools/sched_ext/scx_flatcg.h | 51 +
tools/sched_ext/scx_qmap.bpf.c | 827 ++
tools/sched_ext/scx_qmap.c | 155 +
tools/sched_ext/scx_show_state.py | 42 +
tools/sched_ext/scx_simple.bpf.c | 151 +
tools/sched_ext/scx_simple.c | 107 +
tools/testing/selftests/Makefile | 9 +-
tools/testing/selftests/bpf/.gitignore | 1 +
.../testing/selftests/bpf/bpf_experimental.h | 96 +
.../selftests/bpf/bpf_testmod/bpf_testmod.c | 160 +-
.../selftests/bpf/bpf_testmod/bpf_testmod.h | 61 +
.../bpf/bpf_testmod/bpf_testmod_kfunc.h | 9 +
.../selftests/bpf/prog_tests/bpf_iter.c | 44 +-
.../selftests/bpf/prog_tests/btf_distill.c | 692 ++
.../selftests/bpf/prog_tests/cgroup_iter.c | 33 +
.../bpf/prog_tests/global_func_dead_code.c | 60 +
.../testing/selftests/bpf/prog_tests/iters.c | 209 +
.../selftests/bpf/prog_tests/kfunc_call.c | 1 +
.../selftests/bpf/prog_tests/rcu_read_lock.c | 6 +
.../selftests/bpf/prog_tests/spin_lock.c | 2 +
.../prog_tests/test_struct_ops_maybe_null.c | 46 +
.../bpf/prog_tests/test_struct_ops_module.c | 86 +
.../prog_tests/test_struct_ops_multi_pages.c | 30 +
.../testing/selftests/bpf/prog_tests/timer.c | 4 +
.../selftests/bpf/prog_tests/verifier.c | 4 +
...f_iter_task_vma.c => bpf_iter_task_vmas.c} | 0
.../{bpf_iter_task.c => bpf_iter_tasks.c} | 0
.../bpf/progs/freplace_dead_global_func.c | 11 +
tools/testing/selftests/bpf/progs/iters_css.c | 72 +
.../selftests/bpf/progs/iters_css_task.c | 102 +
.../testing/selftests/bpf/progs/iters_task.c | 41 +
.../selftests/bpf/progs/iters_task_failure.c | 105 +
.../selftests/bpf/progs/iters_task_vma.c | 43 +
.../selftests/bpf/progs/iters_testmod_seq.c | 50 +
.../selftests/bpf/progs/kfunc_call_test.c | 37 +
.../selftests/bpf/progs/rcu_read_lock.c | 120 +
.../bpf/progs/struct_ops_maybe_null.c | 29 +
.../bpf/progs/struct_ops_maybe_null_fail.c | 24 +
.../selftests/bpf/progs/struct_ops_module.c | 37 +
.../bpf/progs/struct_ops_multi_pages.c | 102 +
.../selftests/bpf/progs/test_global_func12.c | 4 +-
.../selftests/bpf/progs/test_spin_lock.c | 65 +
.../selftests/bpf/progs/test_spin_lock_fail.c | 44 +
tools/testing/selftests/bpf/progs/timer.c | 63 +-
.../selftests/bpf/progs/verifier_bits_iter.c | 232 +
.../bpf/progs/verifier_global_subprogs.c | 101 +
.../selftests/bpf/progs/verifier_spin_lock.c | 2 +-
.../bpf/progs/verifier_subprog_precision.c | 4 +-
tools/testing/selftests/bpf/test_loader.c | 10 +-
tools/testing/selftests/bpf/test_maps.c | 18 +-
tools/testing/selftests/bpf/test_maps.h | 5 +
tools/testing/selftests/sched_ext/.gitignore | 6 +
tools/testing/selftests/sched_ext/Makefile | 211 +
tools/testing/selftests/sched_ext/config | 9 +
.../selftests/sched_ext/create_dsq.bpf.c | 58 +
.../testing/selftests/sched_ext/create_dsq.c | 57 +
.../sched_ext/ddsp_bogus_dsq_fail.bpf.c | 42 +
.../selftests/sched_ext/ddsp_bogus_dsq_fail.c | 60 +
.../sched_ext/ddsp_vtimelocal_fail.bpf.c | 39 +
.../sched_ext/ddsp_vtimelocal_fail.c | 59 +
.../selftests/sched_ext/dsp_local_on.bpf.c | 68 +
.../selftests/sched_ext/dsp_local_on.c | 60 +
.../sched_ext/enq_last_no_enq_fails.bpf.c | 29 +
.../sched_ext/enq_last_no_enq_fails.c | 64 +
.../sched_ext/enq_select_cpu_fails.bpf.c | 43 +
.../sched_ext/enq_select_cpu_fails.c | 61 +
tools/testing/selftests/sched_ext/exit.bpf.c | 86 +
tools/testing/selftests/sched_ext/exit.c | 64 +
tools/testing/selftests/sched_ext/exit_test.h | 20 +
.../testing/selftests/sched_ext/hotplug.bpf.c | 61 +
tools/testing/selftests/sched_ext/hotplug.c | 170 +
.../selftests/sched_ext/hotplug_test.h | 15 +
.../sched_ext/init_enable_count.bpf.c | 53 +
.../selftests/sched_ext/init_enable_count.c | 157 +
.../testing/selftests/sched_ext/maximal.bpf.c | 166 +
tools/testing/selftests/sched_ext/maximal.c | 54 +
.../selftests/sched_ext/maybe_null.bpf.c | 36 +
.../testing/selftests/sched_ext/maybe_null.c | 49 +
.../sched_ext/maybe_null_fail_dsp.bpf.c | 25 +
.../sched_ext/maybe_null_fail_yld.bpf.c | 28 +
.../testing/selftests/sched_ext/minimal.bpf.c | 21 +
tools/testing/selftests/sched_ext/minimal.c | 58 +
.../selftests/sched_ext/prog_run.bpf.c | 33 +
tools/testing/selftests/sched_ext/prog_run.c | 78 +
.../testing/selftests/sched_ext/reload_loop.c | 74 +
tools/testing/selftests/sched_ext/runner.c | 212 +
tools/testing/selftests/sched_ext/scx_test.h | 131 +
.../selftests/sched_ext/select_cpu_dfl.bpf.c | 40 +
.../selftests/sched_ext/select_cpu_dfl.c | 75 +
.../sched_ext/select_cpu_dfl_nodispatch.bpf.c | 89 +
.../sched_ext/select_cpu_dfl_nodispatch.c | 75 +
.../sched_ext/select_cpu_dispatch.bpf.c | 41 +
.../selftests/sched_ext/select_cpu_dispatch.c | 73 +
.../select_cpu_dispatch_bad_dsq.bpf.c | 37 +
.../sched_ext/select_cpu_dispatch_bad_dsq.c | 59 +
.../select_cpu_dispatch_dbl_dsp.bpf.c | 38 +
.../sched_ext/select_cpu_dispatch_dbl_dsp.c | 59 +
.../sched_ext/select_cpu_vtime.bpf.c | 92 +
.../selftests/sched_ext/select_cpu_vtime.c | 62 +
.../selftests/sched_ext/test_example.c | 49 +
tools/testing/selftests/sched_ext/util.c | 71 +
tools/testing/selftests/sched_ext/util.h | 13 +
263 files changed, 27732 insertions(+), 3817 deletions(-)
create mode 100644 Documentation/scheduler/sched-ext.rst
create mode 100644 include/asm-generic/cfi.h
create mode 100644 include/linux/sched/ext.h
create mode 100644 include/trace/events/sched_ext.h
delete mode 100644 kernel/bpf/bpf_struct_ops_types.h
create mode 100644 kernel/sched/ext.c
create mode 100644 kernel/sched/ext.h
create mode 100644 kernel/sched/ext_idle.c
create mode 100644 kernel/sched/ext_idle.h
create mode 100644 kernel/sched/syscalls.c
create mode 100644 scripts/Makefile.btf
delete mode 100755 scripts/pahole-flags.sh
create mode 100644 tools/lib/bpf/btf_iter.c
create mode 100644 tools/lib/bpf/btf_relocate.c
create mode 100644 tools/sched_ext/.gitignore
create mode 100644 tools/sched_ext/Makefile
create mode 100644 tools/sched_ext/README.md
create mode 100644 tools/sched_ext/include/bpf-compat/gnu/stubs.h
create mode 100644 tools/sched_ext/include/scx/common.bpf.h
create mode 100644 tools/sched_ext/include/scx/common.h
create mode 100644 tools/sched_ext/include/scx/compat.bpf.h
create mode 100644 tools/sched_ext/include/scx/compat.h
create mode 100644 tools/sched_ext/include/scx/enums.autogen.bpf.h
create mode 100644 tools/sched_ext/include/scx/enums.autogen.h
create mode 100644 tools/sched_ext/include/scx/enums.bpf.h
create mode 100644 tools/sched_ext/include/scx/enums.h
create mode 100644 tools/sched_ext/include/scx/user_exit_info.h
create mode 100644 tools/sched_ext/scx_central.bpf.c
create mode 100644 tools/sched_ext/scx_central.c
create mode 100644 tools/sched_ext/scx_flatcg.bpf.c
create mode 100644 tools/sched_ext/scx_flatcg.c
create mode 100644 tools/sched_ext/scx_flatcg.h
create mode 100644 tools/sched_ext/scx_qmap.bpf.c
create mode 100644 tools/sched_ext/scx_qmap.c
create mode 100644 tools/sched_ext/scx_show_state.py
create mode 100644 tools/sched_ext/scx_simple.bpf.c
create mode 100644 tools/sched_ext/scx_simple.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_distill.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_maybe_null.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_module.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_pages.c
rename tools/testing/selftests/bpf/progs/{bpf_iter_task_vma.c => bpf_iter_task_vmas.c} (100%)
rename tools/testing/selftests/bpf/progs/{bpf_iter_task.c => bpf_iter_tasks.c} (100%)
create mode 100644 tools/testing/selftests/bpf/progs/freplace_dead_global_func.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_css.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_css_task.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task_failure.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task_vma.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null_fail.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_module.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_multi_pages.c
create mode 100644 tools/testing/selftests/bpf/progs/verifier_bits_iter.c
create mode 100644 tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
create mode 100644 tools/testing/selftests/sched_ext/.gitignore
create mode 100644 tools/testing/selftests/sched_ext/Makefile
create mode 100644 tools/testing/selftests/sched_ext/config
create mode 100644 tools/testing/selftests/sched_ext/create_dsq.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/create_dsq.c
create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.c
create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.c
create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.c
create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.c
create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.c
create mode 100644 tools/testing/selftests/sched_ext/exit.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/exit.c
create mode 100644 tools/testing/selftests/sched_ext/exit_test.h
create mode 100644 tools/testing/selftests/sched_ext/hotplug.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/hotplug.c
create mode 100644 tools/testing/selftests/sched_ext/hotplug_test.h
create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.c
create mode 100644 tools/testing/selftests/sched_ext/maximal.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/maximal.c
create mode 100644 tools/testing/selftests/sched_ext/maybe_null.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/maybe_null.c
create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_dsp.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_yld.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/minimal.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/minimal.c
create mode 100644 tools/testing/selftests/sched_ext/prog_run.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/prog_run.c
create mode 100644 tools/testing/selftests/sched_ext/reload_loop.c
create mode 100644 tools/testing/selftests/sched_ext/runner.c
create mode 100644 tools/testing/selftests/sched_ext/scx_test.h
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.c
create mode 100644 tools/testing/selftests/sched_ext/test_example.c
create mode 100644 tools/testing/selftests/sched_ext/util.c
create mode 100644 tools/testing/selftests/sched_ext/util.h
--
2.34.1
2
453
Junxiao Bi (2):
scsi: core: Fix refcount leak for tagset_refcnt
scsi: core: Fix error handling for scsi_alloc_sdev()
drivers/scsi/scsi_scan.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--
2.52.0
2
6
Aboorva Devarajan (2):
sched_ext: Documentation: Remove mentions of scx_bpf_switch_all
sched: Pass correct scheduling policy to __setscheduler_class
Alan Maguire (16):
kbuild,bpf: Switch to using --btf_features for pahole v1.26 and later
kbuild, bpf: Use test-ge check for v1.25-only pahole
libbpf: Add btf__distill_base() creating split BTF with distilled base
BTF
selftests/bpf: Test distilled base, split BTF generation
libbpf: Split BTF relocation
selftests/bpf: Extend distilled BTF tests to cover BTF relocation
resolve_btfids: Handle presence of .BTF.base section
libbpf: BTF relocation followup fixing naming, loop logic
module, bpf: Store BTF base pointer in struct module
libbpf: Split field iter code into its own file kernel
libbpf,bpf: Share BTF relocate-related code with kernel
kbuild,bpf: Add module-specific pahole flags for distilled base BTF
selftests/bpf: Add kfunc_call test for simple dtor in bpf_testmod
bpf: fix build when CONFIG_DEBUG_INFO_BTF[_MODULES] is undefined
libbpf: Fix error handling in btf__distill_base()
libbpf: Fix license for btf_relocate.c
Alexander Lobakin (1):
bitops: make BYTES_TO_BITS() treewide-available
Alexei Starovoitov (2):
s390/bpf: Fix indirect trampoline generation
bpf: Introduce "volatile compare" macros
Andrea Righi (33):
sched_ext: fix typo in set_weight() description
sched_ext: add CONFIG_DEBUG_INFO_BTF dependency
sched_ext: Provide a sysfs enable_seq counter
sched_ext: improve WAKE_SYNC behavior for default idle CPU selection
sched_ext: Clarify ops.select_cpu() for single-CPU tasks
sched_ext: Introduce LLC awareness to the default idle selection
policy
sched_ext: Introduce NUMA awareness to the default idle selection
policy
sched_ext: Do not enable LLC/NUMA optimizations when domains overlap
sched_ext: Fix incorrect use of bitwise AND
MAINTAINERS: add self as reviewer for sched_ext
sched_ext: idle: Refresh idle masks during idle-to-idle transitions
sched_ext: Use the NUMA scheduling domain for NUMA optimizations
sched_ext: idle: use assign_cpu() to update the idle cpumask
sched_ext: idle: clarify comments
sched_ext: idle: introduce check_builtin_idle_enabled() helper
sched_ext: idle: small CPU iteration refactoring
sched_ext: update scx_bpf_dsq_insert() doc for SCX_DSQ_LOCAL_ON
sched_ext: Include remaining task time slice in error state dump
sched_ext: Include task weight in the error state dump
selftests/sched_ext: Fix enum resolution
tools/sched_ext: Add helper to check task migration state
sched_ext: selftests/dsp_local_on: Fix selftest on UP systems
sched_ext: Fix lock imbalance in dispatch_to_local_dsq()
selftests/sched_ext: Fix exit selftest hang on UP
sched_ext: Move built-in idle CPU selection policy to a separate file
sched_ext: Track currently locked rq
sched_ext: Make scx_locked_rq() inline
sched_ext: Fix missing rq lock in scx_bpf_cpuperf_set()
sched/ext: Fix invalid task state transitions on class switch
sched_ext: Make scx_kf_allowed_if_unlocked() available outside ext.c
sched_ext: Remove duplicate BTF_ID_FLAGS definitions
sched_ext: Fix rq lock state in hotplug ops
sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()
Andrii Nakryiko (14):
bpf: Emit global subprog name in verifier logs
bpf: Validate global subprogs lazily
selftests/bpf: Add lazy global subprog validation tests
libbpf: Add btf__new_split() API that was declared but not implemented
bpf: move sleepable flag from bpf_prog_aux to bpf_prog
libbpf: Add BTF field iterator
libbpf: Make use of BTF field iterator in BPF linker code
libbpf: Make use of BTF field iterator in BTF handling code
bpftool: Use BTF field iterator in btfgen
libbpf: Remove callback-based type/string BTF field visitor helpers
bpf: extract iterator argument type and name validation logic
bpf: allow passing struct bpf_iter_<type> as kfunc arguments
selftests/bpf: test passing iterator to a kfunc
selftests/bpf: validate eliminated global subprog is not freplaceable
Arnaldo Carvalho de Melo (1):
tools include UAPI: Sync linux/sched.h copy with the kernel sources
Atul Kumar Pant (1):
sched_ext: Fixes typos in comments
Benjamin Tissoires (1):
bpf: introduce in_sleepable() helper
Bitao Hu (4):
genirq: Convert kstat_irqs to a struct
genirq: Provide a snapshot mechanism for interrupt statistics
watchdog/softlockup: Low-overhead detection of interrupt storm
watchdog/softlockup: Report the most frequent interrupts
Björn Töpel (1):
selftests: sched_ext: Add sched_ext as proper selftest target
Breno Leitao (3):
rhashtable: Fix potential deadlock by moving schedule_work outside
lock
sched_ext: Use kvzalloc for large exit_dump allocation
sched/ext: Prevent update_locked_rq() calls with NULL rq
Changwoo Min (12):
sched_ext: Clarify sched_ext_ops table for userland scheduler
sched_ext: add a missing rcu_read_lock/unlock pair at
scx_select_cpu_dfl()
MAINTAINERS: add me as reviewer for sched_ext
sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass()
sched_ext: Relocate scx_enabled() related code
sched_ext: Implement scx_bpf_now()
sched_ext: Add scx_bpf_now() for BPF scheduler
sched_ext: Add time helpers for BPF schedulers
sched_ext: Replace bpf_ktime_get_ns() to scx_bpf_now()
sched_ext: Use time helpers in BPF schedulers
sched_ext: Fix incorrect time delta calculation in time_delta()
sched_ext: Add scx_bpf_events() and scx_read_event() for BPF
schedulers
Cheng-Yang Chou (1):
sched_ext: Always use SMP versions in kernel/sched/ext.c
Christian Brauner (1):
file: add take_fd() cleanup helper
Christian Loehle (1):
sched/fair: Remove stale FREQUENCY_UTIL comment
Christophe Leroy (2):
bpf: Remove arch_unprotect_bpf_trampoline()
bpf: Check return from set_memory_rox()
Chuyi Zhou (15):
cgroup: Prepare for using css_task_iter_*() in BPF
bpf: Introduce css_task open-coded iterator kfuncs
bpf: Introduce task open coded iterator kfuncs
bpf: Introduce css open-coded iterator kfuncs
bpf: teach the verifier to enforce css_iter and task_iter in RCU CS
bpf: Let bpf_iter_task_new accept null task ptr
selftests/bpf: rename bpf_iter_task.c to bpf_iter_tasks.c
selftests/bpf: Add tests for open-coded task and css iter
bpf: Relax allowlist for css_task iter
selftests/bpf: Add tests for css_task iter combining with cgroup iter
selftests/bpf: Add test for using css_task iter in sleepable progs
bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg
selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly
sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h.
sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx
Colin Ian King (1):
sched_ext: Fix spelling mistake: "intead" -> "instead"
Daniel Xu (3):
bpf: btf: Support flags for BTF_SET8 sets
bpf: btf: Add BTF_KFUNCS_START/END macro pair
bpf: treewide: Annotate BPF kfuncs in BTF
Dave Marchevsky (6):
bpf: Don't explicitly emit BTF for struct btf_iter_num
selftests/bpf: Rename bpf_iter_task_vma.c to bpf_iter_task_vmas.c
bpf: Introduce task_vma open-coded iterator kfuncs
selftests/bpf: Add tests for open-coded task_vma iter
bpf: Add __bpf_kfunc_{start,end}_defs macros
bpf: Add __bpf_hook_{start,end} macros
David Vernet (15):
bpf: Add ability to pin bpf timer to calling CPU
selftests/bpf: Test pinning bpf timer to a core
sched_ext: Implement runnable task stall watchdog
sched_ext: Print sched_ext info when dumping stack
sched_ext: Implement SCX_KICK_WAIT
sched_ext: Implement sched_ext_ops.cpu_acquire/release()
sched_ext: Add selftests
bpf: Load vmlinux btf for any struct_ops map
sched_ext: Make scx_bpf_cpuperf_set() @cpu arg signed
scx: Allow calling sleepable kfuncs from BPF_PROG_TYPE_SYSCALL
scx/selftests: Verify we can call create_dsq from prog_run
sched_ext: Remove unnecessary cpu_relax()
scx: Fix exit selftest to use custom DSQ
scx: Fix raciness in scx_ops_bypass()
scx: Fix maximal BPF selftest prog
Dawei Li (1):
genirq: Deduplicate interrupt descriptor initialization
Devaansh Kumar (1):
sched_ext: selftests: Fix grammar in tests description
Devaansh-Kumar (1):
sched_ext: Documentation: Update instructions for running example
schedulers
Eduard Zingerman (2):
libbpf: Make btf_parse_elf process .BTF.base transparently
selftests/bpf: Check if distilled base inherits source endianness
Geliang Tang (1):
bpf, btf: Check btf for register_bpf_struct_ops
Henry Huang (2):
sched_ext: initialize kit->cursor.flags
sched_ext: keep running prev when prev->scx.slice != 0
Herbert Xu (1):
rhashtable: Fix rhashtable_try_insert test
Honglei Wang (3):
sched_ext: use correct function name in pick_task_scx() warning
message
sched_ext: Add __weak to fix the build errors
sched_ext: switch class when preempted by higher priority scheduler
Hongyan Xia (1):
sched/ext: Add BPF function to fetch rq
Hou Tao (7):
bpf: Free dynamically allocated bits in bpf_iter_bits_destroy()
bpf: Add bpf_mem_alloc_check_size() helper
bpf: Check the validity of nr_words in bpf_iter_bits_new()
bpf: Use __u64 to save the bits in bits iterator
selftests/bpf: Add three test cases for bits_iter
selftests/bpf: Use -4095 as the bad address for bits iterator
selftests/bpf: Export map_update_retriable()
Ihor Solodrai (2):
selftests/sched_ext: add order-only dependency of runner.o on BPFOBJ
selftests/sched_ext: fix build after renames in sched_ext API
Ilpo Järvinen (1):
<linux/cleanup.h>: Allow the passing of both iomem and non-iomem
pointers to no_free_ptr()
Ingo Molnar (3):
sched/syscalls: Split out kernel/sched/syscalls.c from
kernel/sched/core.c
sched/fair: Rename check_preempt_wakeup() to
check_preempt_wakeup_fair()
sched/fair: Rename check_preempt_curr() to wakeup_preempt()
Jake Hillion (2):
sched_ext: create_dsq: Return -EEXIST on duplicate request
sched_ext: Drop kfuncs marked for removal in 6.15
Jiapeng Chong (1):
sched_ext: Fixes incorrect type in bpf_scx_init()
Jiayuan Chen (1):
selftests/bpf: Fixes for test_maps test
Kui-Feng Lee (29):
bpf: refactory struct_ops type initialization to a function.
bpf: get type information with BTF_ID_LIST
bpf, net: introduce bpf_struct_ops_desc.
bpf: add struct_ops_tab to btf.
bpf: make struct_ops_map support btfs other than btf_vmlinux.
bpf: pass btf object id in bpf_map_info.
bpf: lookup struct_ops types from a given module BTF.
bpf: pass attached BTF to the bpf_struct_ops subsystem
bpf: hold module refcnt in bpf_struct_ops map creation and prog
verification.
bpf: validate value_type
bpf, net: switch to dynamic registration
libbpf: Find correct module BTFs for struct_ops maps and progs.
bpf: export btf_ctx_access to modules.
selftests/bpf: test case for register_bpf_struct_ops().
bpf: Fix error checks against bpf_get_btf_vmlinux().
bpf: Remove an unnecessary check.
selftests/bpf: Suppress warning message of an unused variable.
bpf: add btf pointer to struct bpf_ctx_arg_aux.
bpf: Move __kfunc_param_match_suffix() to btf.c.
bpf: Create argument information for nullable arguments.
selftests/bpf: Test PTR_MAYBE_NULL arguments of struct_ops operators.
libbpf: Set btf_value_type_id of struct bpf_map for struct_ops.
libbpf: Convert st_ops->data to shadow type.
bpftool: Generated shadow variables for struct_ops maps.
bpftool: Add an example for struct_ops map and shadow type.
selftests/bpf: Test if shadow types work correctly.
bpf, net: validate struct_ops when updating value.
bpf: struct_ops supports more than one page for trampolines.
selftests/bpf: Test struct_ops maps with a large number of struct_ops
program.
Kumar Kartikeya Dwivedi (4):
bpf: Allow calling static subprogs while holding a bpf_spin_lock
selftests/bpf: Add test for static subprog call in lock cs
bpf: Transfer RCU lock state between subprog calls
selftests/bpf: Add tests for RCU lock transfer between subprogs
Liang Jie (1):
sched_ext: Use sizeof_field for key_len in dsq_hash_params
Luo Gengkun (7):
bpf: Fix kabi-breakage for bpf_func_info_aux
bpf: Fix kabi-breakage for bpf_tramp_image
bpf: Fix kabi for bpf_attr
bpf_verifier: Fix kabi for bpf_verifier_env
bpf: Fix kabi for bpf_ctx_arg_aux
bpf: Fix kabi for bpf_prog_aux and bpf_prog
selftests/bpf: modify test_loader that didn't support running
bpf_prog_type_syscall programs
Manu Bretelle (1):
sched_ext: define missing cfi stubs for sched_ext
Martin KaFai Lau (5):
libbpf: Ensure undefined bpf_attr field stays 0
bpf: Remove unnecessary err < 0 check in
bpf_struct_ops_map_update_elem
bpf: Fix a crash when btf_parse_base() returns an error pointer
bpf: Reject struct_ops registration that uses module ptr and the
module btf_id is missing
bpf: Use kallsyms to find the function name of a struct_ops's stub
function
Masahiro Yamada (1):
kbuild: avoid too many execution of scripts/pahole-flags.sh
Matthieu Baerts (1):
bpf: fix compilation error without CGROUPS
Peter Zijlstra (26):
cfi: Flip headers
x86/cfi,bpf: Fix BPF JIT call
x86/cfi,bpf: Fix bpf_callback_t CFI
x86/cfi,bpf: Fix bpf_struct_ops CFI
cfi: Add CFI_NOSEAL()
bpf: Fix dtor CFI
cleanup: Make no_free_ptr() __must_check
sched: Simplify set_user_nice()
sched: Simplify syscalls
sched: Simplify sched_{set,get}affinity()
sched: Simplify yield_to()
sched: Simplify sched_rr_get_interval()
sched: Simplify sched_move_task()
sched: Misc cleanups
sched/deadline: Move bandwidth accounting into {en,de}queue_dl_entity
sched: Allow sched_class::dequeue_task() to fail
sched: Unify runtime accounting across classes
sched: Use set_next_task(.first) where required
sched/fair: Cleanup pick_task_fair() vs throttle
sched/fair: Cleanup pick_task_fair()'s curr
sched/fair: Unify pick_{,next_}_task_fair()
sched: Fixup set_next_task() implementations
sched: Split up put_prev_task_balance()
sched: Rework pick_next_task()
sched: Combine the last put_prev_task() and the first set_next_task()
sched: Add put_prev_task(.next)
Pu Lehui (8):
riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops
bpf: Fix kabi breakage in struct module
riscv, bpf: Fix out-of-bounds issue when preparing trampoline image
selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill
test
libbpf: Fix return zero when elf_begin failed
libbpf: Fix incorrect traversal end type ID when marking
BTF_IS_EMBEDDED
selftests/bpf: Add distilled BTF test about marking BTF_IS_EMBEDDED
selftests/bpf: Add file_read_pattern to gitignore
Randy Dunlap (1):
sched_ext: fix kernel-doc warnings
Shizhao Chen (1):
sched_ext: Add option -l in selftest runner to list all available
tests
Song Liu (8):
bpf: Charge modmem for struct_ops trampoline
bpf: Let bpf_prog_pack_free handle any pointer
bpf: Adjust argument names of arch_prepare_bpf_trampoline()
bpf: Add helpers for trampoline image management
bpf, x86: Adjust arch_prepare_bpf_trampoline return value
bpf: Add arch_bpf_trampoline_size()
bpf: Use arch_bpf_trampoline_size
x86, bpf: Use bpf_prog_pack for bpf trampoline
T.J. Mercier (1):
bpf, docs: Fix broken link to renamed bpf_iter_task_vmas.c
Tejun Heo (152):
sched: Restructure sched_class order sanity checks in sched_init()
sched: Allow sched_cgroup_fork() to fail and introduce
sched_cancel_fork()
sched: Add sched_class->reweight_task()
sched: Add sched_class->switching_to() and expose
check_class_changing/changed()
sched: Factor out cgroup weight conversion functions
sched: Factor out update_other_load_avgs() from
__update_blocked_others()
sched: Add normal_policy()
sched_ext: Add boilerplate for extensible scheduler class
sched_ext: Implement BPF extensible scheduler class
sched_ext: Add scx_simple and scx_example_qmap example schedulers
sched_ext: Add sysrq-S which disables the BPF scheduler
sched_ext: Allow BPF schedulers to disallow specific tasks from
joining SCHED_EXT
sched_ext: Print debug dump after an error exit
tools/sched_ext: Add scx_show_state.py
sched_ext: Implement scx_bpf_kick_cpu() and task preemption support
sched_ext: Add a central scheduler which makes all scheduling
decisions on one CPU
sched_ext: Make watchdog handle ops.dispatch() looping stall
sched_ext: Add task state tracking operations
sched_ext: Implement tickless support
sched_ext: Track tasks that are subjects of the in-flight SCX
operation
sched_ext: Implement sched_ext_ops.cpu_online/offline()
sched_ext: Bypass BPF scheduler while PM events are in progress
sched_ext: Implement core-sched support
sched_ext: Add vtime-ordered priority queue to dispatch_q's
sched_ext: Documentation: scheduler: Document extensible scheduler
class
sched, sched_ext: Replace scx_next_task_picked() with
sched_class->switch_class()
cpufreq_schedutil: Refactor sugov_cpu_is_busy()
sched_ext: Add cpuperf support
sched_ext: Drop tools_clean target from the top-level Makefile
sched_ext: Swap argument positions in kcalloc() call to avoid compiler
warning
sched, sched_ext: Simplify dl_prio() case handling in sched_fork()
sched_ext: Account for idle policy when setting p->scx.weight in
scx_ops_enable_task()
sched_ext: Disallow loading BPF scheduler if isolcpus= domain
isolation is in effect
sched_ext: Minor cleanups in kernel/sched/ext.h
sched, sched_ext: Open code for_balance_class_range()
sched, sched_ext: Move some declarations from kernel/sched/ext.h to
sched.h
sched_ext: Take out ->priq and ->flags from scx_dsq_node
sched_ext: Implement DSQ iterator
sched_ext/scx_qmap: Add an example usage of DSQ iterator
sched_ext: Reimplement scx_bpf_reenqueue_local()
sched_ext: Make scx_bpf_reenqueue_local() skip tasks that are being
migrated
sched: Move struct balance_callback definition upward
sched_ext: Unpin and repin rq lock from balance_scx()
sched_ext: s/SCX_RQ_BALANCING/SCX_RQ_IN_BALANCE/ and add
SCX_RQ_IN_WAKEUP
sched_ext: Allow SCX_DSQ_LOCAL_ON for direct dispatches
sched_ext/scx_qmap: Pick idle CPU for direct dispatch on !wakeup
enqueues
sched_ext: Build fix on !CONFIG_STACKTRACE[_SUPPORT]
sched_ext: Allow p->scx.disallow only while loading
sched_ext: Simplify scx_can_stop_tick() invocation in
sched_can_stop_tick()
sched_ext: Add scx_enabled() test to @start_class promotion in
put_prev_task_balance()
sched_ext: Use update_curr_common() in update_curr_scx()
sched_ext: Simplify UP support by enabling sched_class->balance() in
UP
sched_ext: Improve comment on idle_sched_class exception in
scx_task_iter_next_locked()
sched_ext: Make task_can_run_on_remote_rq() use common
task_allowed_on_cpu()
sched_ext: Fix unsafe list iteration in process_ddsp_deferred_locals()
sched_ext: Make scx_rq_online() also test cpu_active() in addition to
SCX_RQ_ONLINE
sched_ext: Improve logging around enable/disable
sched_ext: Don't use double locking to migrate tasks across CPUs
scx_central: Fix smatch checker warning
sched_ext: Add missing cfi stub for ops.tick
sched_ext: Use task_can_run_on_remote_rq() test in
dispatch_to_local_dsq()
sched_ext: Use sched_clock_cpu() instead of rq_clock_task() in
touch_core_sched()
sched_ext: Don't call put_prev_task_scx() before picking the next task
sched_ext: Replace SCX_TASK_BAL_KEEP with SCX_RQ_BAL_KEEP
sched_ext: Unify regular and core-sched pick task paths
sched_ext: Relocate functions in kernel/sched/ext.c
sched_ext: Remove switch_class_scx()
sched_ext: Remove sched_class->switch_class()
sched_ext: TASK_DEAD tasks must be switched out of SCX on ops_disable
sched_ext: TASK_DEAD tasks must be switched into SCX on ops_enable
sched: Expose css_tg()
sched: Make cpu_shares_read_u64() use tg_weight()
sched: Introduce CONFIG_GROUP_SCHED_WEIGHT
sched_ext: Add cgroup support
sched_ext: Add a cgroup scheduler which uses flattened hierarchy
sched_ext: Temporarily work around pick_task_scx() being called
without balance_scx()
sched_ext: Add missing static to scx_has_op[]
sched_ext: Add missing static to scx_dump_data
sched_ext: Rename scx_kfunc_set_sleepable to unlocked and relocate
sched_ext: Refactor consume_remote_task()
sched_ext: Make find_dsq_for_dispatch() handle SCX_DSQ_LOCAL_ON
sched_ext: Fix processs_ddsp_deferred_locals() by unifying DTL_INVALID
handling
sched_ext: Restructure dispatch_to_local_dsq()
sched_ext: Reorder args for consume_local/remote_task()
sched_ext: Move sanity check and dsq_mod_nr() into
task_unlink_from_dsq()
sched_ext: Move consume_local_task() upward
sched_ext: Replace consume_local_task() with
move_local_task_to_local_dsq()
sched_ext: Compact struct bpf_iter_scx_dsq_kern
sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq()
scx_qmap: Implement highpri boosting
sched_ext: Synchronize bypass state changes with rq lock
sched_ext: Don't trigger ops.quiescent/runnable() on migrations
sched_ext: Fix build when !CONFIG_STACKTRACE
sched_ext: Build fix for !CONFIG_SMP
sched_ext: Add __COMPAT helpers for features added during v6.12 devel
cycle
tools/sched_ext: Receive misc updates from SCX repo
scx_flatcg: Use a user DSQ for fallback instead of SCX_DSQ_GLOBAL
sched_ext: Allow only user DSQs for scx_bpf_consume(),
scx_bpf_dsq_nr_queued() and bpf_iter_scx_dsq_new()
sched_ext: Relocate find_user_dsq()
sched_ext: Split the global DSQ per NUMA node
sched_ext: Use shorter slice while bypassing
sched_ext: Relocate check_hotplug_seq() call in scx_ops_enable()
sched_ext: Remove SCX_OPS_PREPPING
sched_ext: Initialize in bypass mode
sched_ext: Fix SCX_TASK_INIT -> SCX_TASK_READY transitions in
scx_ops_enable()
sched_ext: Enable scx_ops_init_task() separately
sched_ext: Add scx_cgroup_enabled to gate cgroup operations and fix
scx_tg_online()
sched_ext: Decouple locks in scx_ops_disable_workfn()
sched_ext: Decouple locks in scx_ops_enable()
sched_ext: Improve error reporting during loading
sched_ext: scx_cgroup_exit() may be called without successful
scx_cgroup_init()
sched/core: Make select_task_rq() take the pointer to wake_flags
instead of value
sched/core: Add ENQUEUE_RQ_SELECTED to indicate whether
->select_task_rq() was called
sched_ext, scx_qmap: Add and use SCX_ENQ_CPU_SELECTED
Revert "sched_ext: Use shorter slice while bypassing"
sched_ext: Start schedulers with consistent p->scx.slice values
sched_ext: Move scx_buildin_idle_enabled check to
scx_bpf_select_cpu_dfl()
sched_ext: bypass mode shouldn't depend on ops.select_cpu()
sched_ext: Move scx_tasks_lock handling into scx_task_iter helpers
sched_ext: Don't hold scx_tasks_lock for too long
sched_ext: Make cast_mask() inline
sched_ext: Fix enq_last_no_enq_fails selftest
sched_ext: Add a missing newline at the end of an error message
sched_ext: Update scx_show_state.py to match scx_ops_bypass_depth's
new type
sched_ext: Handle cases where pick_task_scx() is called without
preceding balance_scx()
sched_ext: ops.cpu_acquire() should be called with SCX_KF_REST
sched_ext: Factor out move_task_between_dsqs() from
scx_dispatch_from_dsq()
sched_ext: Rename CFI stubs to names that are recognized by BPF
sched_ext: Replace set_arg_maybe_null() with __nullable CFI stub tags
sched_ext: Avoid live-locking bypass mode switching
sched_ext: Enable the ops breather and eject BPF scheduler on
softlockup
sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked
context
sched_ext: Rename scx_bpf_dispatch[_vtime]() to
scx_bpf_dsq_insert[_vtime]()
sched_ext: Rename scx_bpf_consume() to scx_bpf_dsq_move_to_local()
sched_ext: Rename scx_bpf_dispatch[_vtime]_from_dsq*() ->
scx_bpf_dsq_move[_vtime]*()
sched_ext: Fix invalid irq restore in scx_ops_bypass()
sched_ext: Fix dsq_local_on selftest
tools/sched_ext: Receive updates from SCX repo
sched_ext: selftests/dsp_local_on: Fix sporadic failures
sched_ext: Fix incorrect autogroup migration detection
sched_ext: Implement auto local dispatching of migration disabled
tasks
sched_ext: Fix migration disabled handling in targeted dispatches
sched_ext: Fix incorrect assumption about migration disabled tasks in
task_can_run_on_remote_rq()
sched_ext: Fix pick_task_scx() picking non-queued tasks when it's
called without balance()
sched_ext: Implement SCX_OPS_ALLOW_QUEUED_WAKEUP
sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator
sched_ext: Make scx_group_set_weight() always update tg->scx.weight
sched_ext, sched/core: Don't call scx_group_set_weight() prematurely
from sched_create_group()
sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU
sched_ext: Don't kick CPUs running higher classes
sched_ext: Use SCX_TASK_READY test instead of tryget_task_struct()
during class switch
tools/sched_ext: Sync with scx repo
Thomas Gleixner (1):
sched/ext: Remove sched_fork() hack
Thorsten Blum (1):
sched_ext: Use str_enabled_disabled() helper in
update_selcpu_topology()
Tianchen Ding (1):
sched_ext: Use btf_ids to resolve task_struct
Tony Ambardar (1):
libbpf: Ensure new BTF objects inherit input endianness
Vincent Guittot (2):
sched/cpufreq: Rework schedutil governor performance estimation
sched/fair: Fix sched_can_stop_tick() for fair tasks
Vishal Chourasia (2):
sched_ext: Add __weak markers to BPF helper function decalarations
sched_ext: Fix function pointer type mismatches in BPF selftests
Wenyu Huang (1):
sched/doc: Update documentation after renames and synchronize Chinese
version
Yafang Shao (2):
bpf: Add bits iterator
selftests/bpf: Add selftest for bits iter
Yipeng Zou (1):
sched_ext: Allow dequeue_task_scx to fail
Yiwei Lin (1):
sched/fair: Remove unused 'curr' argument from pick_next_entity()
Yu Liao (2):
sched: Put task_group::idle under CONFIG_GROUP_SCHED_WEIGHT
sched: Add dummy version of sched_group_set_idle()
Yury Norov (1):
cpumask: introduce assign_cpu() macro
Zhang Qiao (3):
sched_ext: Remove redundant p->nr_cpus_allowed checker
sched/ext: Fix unmatch trailing comment of CONFIG_EXT_GROUP_SCHED
sched/ext: Use tg_cgroup() to elieminate duplicate code
Zhao Mengmeng (1):
sched_ext: Replace scx_next_task_picked() with switch_class() in
comment
Zicheng Qu (17):
sched: Fix kabi for reweight_task in struct sched_class
sched/syscalls: Fix kabi for EXPORT_SYMBOL moved from core.c to
syscalls.c
sched: Fix kabi for switching_to in struct sched_class
sched/fair: Fix kabi for check_preempt_curr and wakeup_preempt in
struct sched_class
sched: Fix kabi for dequeue_task in struct sched_class
sched_ext: Fix kabi for scx in struct task_struct
sched_ext: Fix kabi for switch_class in struct sched_class
sched: Fix kabi for exec_max in struct sched_statistics
sched_ext: Fix kabi for balance in struct sched_class
sched_ext: Fix kabi for header in kernel/sched/sched.h
sched: Fix kabi pick_task in struct sched_class
sched: Fix kabi for put_prev_task in struct sched_class
sched_ext: Fix kabi for scx_flags and scx_weight in struct task_group
sched: Fix kabi for int idle in struct task_group
sched: Add __setscheduler_class() for sched_ext
genirq: Fix kabi for kstat_irqs in struct irq_desc
sched_ext: Enable and disable sched_ext configs
Zqiang (1):
sched_ext: Fix unsafe locking in the scx_dump_state()
guanjing (1):
sched_ext: fix application of sizeof to pointer
Documentation/bpf/bpf_iterators.rst | 2 +-
Documentation/bpf/kfuncs.rst | 14 +-
Documentation/scheduler/index.rst | 1 +
Documentation/scheduler/sched-design-CFS.rst | 8 +-
Documentation/scheduler/sched-ext.rst | 325 +
.../zh_CN/scheduler/sched-design-CFS.rst | 8 +-
MAINTAINERS | 16 +-
Makefile | 4 +-
arch/arm64/configs/openeuler_defconfig | 3 +
arch/arm64/kernel/bpf-rvi.c | 4 +-
arch/arm64/net/bpf_jit_comp.c | 55 +-
arch/mips/dec/setup.c | 2 +-
arch/parisc/kernel/smp.c | 2 +-
arch/powerpc/kvm/book3s_hv_rm_xics.c | 2 +-
arch/riscv/include/asm/cfi.h | 3 +-
arch/riscv/kernel/cfi.c | 2 +-
arch/riscv/net/bpf_jit_comp64.c | 48 +-
arch/s390/net/bpf_jit_comp.c | 59 +-
arch/x86/configs/openeuler_defconfig | 2 +
arch/x86/include/asm/cfi.h | 126 +-
arch/x86/kernel/alternative.c | 87 +-
arch/x86/kernel/cfi.c | 4 +-
arch/x86/net/bpf_jit_comp.c | 261 +-
block/blk-cgroup.c | 4 +-
drivers/hid/bpf/hid_bpf_dispatch.c | 12 +-
drivers/tty/sysrq.c | 1 +
fs/proc/stat.c | 4 +-
include/asm-generic/Kbuild | 1 +
include/asm-generic/cfi.h | 5 +
include/asm-generic/vmlinux.lds.h | 1 +
include/linux/bitops.h | 2 +
include/linux/bpf.h | 130 +-
include/linux/bpf_mem_alloc.h | 3 +
include/linux/bpf_verifier.h | 21 +-
include/linux/btf.h | 105 +
include/linux/btf_ids.h | 21 +-
include/linux/cfi.h | 12 +
include/linux/cgroup.h | 14 +-
include/linux/cleanup.h | 42 +-
include/linux/cpumask.h | 41 +-
include/linux/energy_model.h | 1 -
include/linux/file.h | 20 +
include/linux/filter.h | 2 +-
include/linux/irqdesc.h | 17 +-
include/linux/kernel_stat.h | 8 +
include/linux/module.h | 8 +-
include/linux/sched.h | 8 +-
include/linux/sched/ext.h | 216 +
include/linux/sched/task.h | 8 +-
include/trace/events/sched_ext.h | 32 +
include/uapi/linux/bpf.h | 16 +-
include/uapi/linux/sched.h | 1 +
init/Kconfig | 10 +
init/init_task.c | 12 +
kernel/Kconfig.preempt | 27 +-
kernel/bpf-rvi/common_kfuncs.c | 4 +-
kernel/bpf/Makefile | 8 +-
kernel/bpf/bpf_iter.c | 12 +-
kernel/bpf/bpf_struct_ops.c | 745 +-
kernel/bpf/bpf_struct_ops_types.h | 12 -
kernel/bpf/btf.c | 431 +-
kernel/bpf/cgroup_iter.c | 65 +-
kernel/bpf/core.c | 76 +-
kernel/bpf/cpumask.c | 18 +-
kernel/bpf/dispatcher.c | 7 +-
kernel/bpf/helpers.c | 202 +-
kernel/bpf/map_iter.c | 10 +-
kernel/bpf/memalloc.c | 14 +-
kernel/bpf/syscall.c | 12 +-
kernel/bpf/task_iter.c | 242 +-
kernel/bpf/trampoline.c | 99 +-
kernel/bpf/verifier.c | 317 +-
kernel/cgroup/cgroup.c | 18 +-
kernel/cgroup/cpuset.c | 4 +-
kernel/cgroup/rstat.c | 13 +-
kernel/events/core.c | 2 +-
kernel/fork.c | 17 +-
kernel/irq/Kconfig | 4 +
kernel/irq/internals.h | 2 +-
kernel/irq/irqdesc.c | 144 +-
kernel/irq/proc.c | 5 +-
kernel/module/main.c | 5 +-
kernel/sched/autogroup.c | 4 +-
kernel/sched/bpf_sched.c | 8 +-
kernel/sched/build_policy.c | 13 +
kernel/sched/core.c | 2492 +-----
kernel/sched/cpuacct.c | 4 +-
kernel/sched/cpufreq_schedutil.c | 83 +-
kernel/sched/deadline.c | 175 +-
kernel/sched/debug.c | 3 +
kernel/sched/ext.c | 7155 +++++++++++++++++
kernel/sched/ext.h | 119 +
kernel/sched/ext_idle.c | 755 ++
kernel/sched/ext_idle.h | 39 +
kernel/sched/fair.c | 306 +-
kernel/sched/idle.c | 31 +-
kernel/sched/rt.c | 40 +-
kernel/sched/sched.h | 473 +-
kernel/sched/stop_task.c | 35 +-
kernel/sched/syscalls.c | 1713 ++++
kernel/trace/bpf_trace.c | 12 +-
kernel/trace/trace_probe.c | 2 -
kernel/watchdog.c | 223 +-
lib/Kconfig.debug | 14 +
lib/dump_stack.c | 1 +
lib/rhashtable.c | 12 +-
net/bpf/bpf_dummy_struct_ops.c | 72 +-
net/bpf/test_run.c | 30 +-
net/core/filter.c | 33 +-
net/core/xdp.c | 10 +-
net/ipv4/bpf_tcp_ca.c | 93 +-
net/ipv4/fou_bpf.c | 10 +-
net/ipv4/tcp_bbr.c | 4 +-
net/ipv4/tcp_cong.c | 6 +-
net/ipv4/tcp_cubic.c | 4 +-
net/ipv4/tcp_dctcp.c | 4 +-
net/netfilter/nf_conntrack_bpf.c | 10 +-
net/netfilter/nf_nat_bpf.c | 10 +-
net/socket.c | 8 +-
net/xfrm/xfrm_interface_bpf.c | 10 +-
scripts/Makefile.btf | 33 +
scripts/Makefile.modfinal | 2 +-
scripts/gdb/linux/interrupts.py | 6 +-
scripts/pahole-flags.sh | 30 -
tools/Makefile | 10 +-
.../bpf/bpftool/Documentation/bpftool-gen.rst | 58 +-
tools/bpf/bpftool/gen.c | 253 +-
tools/bpf/resolve_btfids/main.c | 8 +
tools/include/linux/bitops.h | 2 +
tools/include/uapi/linux/bpf.h | 14 +-
tools/include/uapi/linux/sched.h | 1 +
tools/lib/bpf/Build | 2 +-
tools/lib/bpf/bpf.c | 4 +-
tools/lib/bpf/bpf.h | 4 +-
tools/lib/bpf/btf.c | 704 +-
tools/lib/bpf/btf.h | 36 +
tools/lib/bpf/btf_iter.c | 177 +
tools/lib/bpf/btf_relocate.c | 519 ++
tools/lib/bpf/libbpf.c | 97 +-
tools/lib/bpf/libbpf.map | 4 +-
tools/lib/bpf/libbpf_internal.h | 29 +-
tools/lib/bpf/libbpf_probes.c | 1 +
tools/lib/bpf/linker.c | 58 +-
tools/perf/util/probe-finder.c | 4 +-
tools/sched_ext/.gitignore | 2 +
tools/sched_ext/Makefile | 246 +
tools/sched_ext/README.md | 270 +
.../sched_ext/include/bpf-compat/gnu/stubs.h | 11 +
tools/sched_ext/include/scx/common.bpf.h | 647 ++
tools/sched_ext/include/scx/common.h | 81 +
tools/sched_ext/include/scx/compat.bpf.h | 143 +
tools/sched_ext/include/scx/compat.h | 187 +
.../sched_ext/include/scx/enums.autogen.bpf.h | 105 +
tools/sched_ext/include/scx/enums.autogen.h | 41 +
tools/sched_ext/include/scx/enums.bpf.h | 12 +
tools/sched_ext/include/scx/enums.h | 27 +
tools/sched_ext/include/scx/user_exit_info.h | 118 +
tools/sched_ext/scx_central.bpf.c | 356 +
tools/sched_ext/scx_central.c | 145 +
tools/sched_ext/scx_flatcg.bpf.c | 954 +++
tools/sched_ext/scx_flatcg.c | 234 +
tools/sched_ext/scx_flatcg.h | 51 +
tools/sched_ext/scx_qmap.bpf.c | 827 ++
tools/sched_ext/scx_qmap.c | 155 +
tools/sched_ext/scx_show_state.py | 42 +
tools/sched_ext/scx_simple.bpf.c | 151 +
tools/sched_ext/scx_simple.c | 107 +
tools/testing/selftests/Makefile | 9 +-
tools/testing/selftests/bpf/.gitignore | 1 +
.../testing/selftests/bpf/bpf_experimental.h | 96 +
.../selftests/bpf/bpf_testmod/bpf_testmod.c | 160 +-
.../selftests/bpf/bpf_testmod/bpf_testmod.h | 61 +
.../bpf/bpf_testmod/bpf_testmod_kfunc.h | 9 +
.../selftests/bpf/prog_tests/bpf_iter.c | 44 +-
.../selftests/bpf/prog_tests/btf_distill.c | 692 ++
.../selftests/bpf/prog_tests/cgroup_iter.c | 33 +
.../bpf/prog_tests/global_func_dead_code.c | 60 +
.../testing/selftests/bpf/prog_tests/iters.c | 209 +
.../selftests/bpf/prog_tests/kfunc_call.c | 1 +
.../selftests/bpf/prog_tests/rcu_read_lock.c | 6 +
.../selftests/bpf/prog_tests/spin_lock.c | 2 +
.../prog_tests/test_struct_ops_maybe_null.c | 46 +
.../bpf/prog_tests/test_struct_ops_module.c | 86 +
.../prog_tests/test_struct_ops_multi_pages.c | 30 +
.../testing/selftests/bpf/prog_tests/timer.c | 4 +
.../selftests/bpf/prog_tests/verifier.c | 4 +
...f_iter_task_vma.c => bpf_iter_task_vmas.c} | 0
.../{bpf_iter_task.c => bpf_iter_tasks.c} | 0
.../bpf/progs/freplace_dead_global_func.c | 11 +
tools/testing/selftests/bpf/progs/iters_css.c | 72 +
.../selftests/bpf/progs/iters_css_task.c | 102 +
.../testing/selftests/bpf/progs/iters_task.c | 41 +
.../selftests/bpf/progs/iters_task_failure.c | 105 +
.../selftests/bpf/progs/iters_task_vma.c | 43 +
.../selftests/bpf/progs/iters_testmod_seq.c | 50 +
.../selftests/bpf/progs/kfunc_call_test.c | 37 +
.../selftests/bpf/progs/rcu_read_lock.c | 120 +
.../bpf/progs/struct_ops_maybe_null.c | 29 +
.../bpf/progs/struct_ops_maybe_null_fail.c | 24 +
.../selftests/bpf/progs/struct_ops_module.c | 37 +
.../bpf/progs/struct_ops_multi_pages.c | 102 +
.../selftests/bpf/progs/test_global_func12.c | 4 +-
.../selftests/bpf/progs/test_spin_lock.c | 65 +
.../selftests/bpf/progs/test_spin_lock_fail.c | 44 +
tools/testing/selftests/bpf/progs/timer.c | 63 +-
.../selftests/bpf/progs/verifier_bits_iter.c | 232 +
.../bpf/progs/verifier_global_subprogs.c | 101 +
.../selftests/bpf/progs/verifier_spin_lock.c | 2 +-
.../bpf/progs/verifier_subprog_precision.c | 4 +-
tools/testing/selftests/bpf/test_loader.c | 10 +-
tools/testing/selftests/bpf/test_maps.c | 18 +-
tools/testing/selftests/bpf/test_maps.h | 5 +
tools/testing/selftests/sched_ext/.gitignore | 6 +
tools/testing/selftests/sched_ext/Makefile | 211 +
tools/testing/selftests/sched_ext/config | 9 +
.../selftests/sched_ext/create_dsq.bpf.c | 58 +
.../testing/selftests/sched_ext/create_dsq.c | 57 +
.../sched_ext/ddsp_bogus_dsq_fail.bpf.c | 42 +
.../selftests/sched_ext/ddsp_bogus_dsq_fail.c | 60 +
.../sched_ext/ddsp_vtimelocal_fail.bpf.c | 39 +
.../sched_ext/ddsp_vtimelocal_fail.c | 59 +
.../selftests/sched_ext/dsp_local_on.bpf.c | 68 +
.../selftests/sched_ext/dsp_local_on.c | 60 +
.../sched_ext/enq_last_no_enq_fails.bpf.c | 29 +
.../sched_ext/enq_last_no_enq_fails.c | 64 +
.../sched_ext/enq_select_cpu_fails.bpf.c | 43 +
.../sched_ext/enq_select_cpu_fails.c | 61 +
tools/testing/selftests/sched_ext/exit.bpf.c | 86 +
tools/testing/selftests/sched_ext/exit.c | 64 +
tools/testing/selftests/sched_ext/exit_test.h | 20 +
.../testing/selftests/sched_ext/hotplug.bpf.c | 61 +
tools/testing/selftests/sched_ext/hotplug.c | 170 +
.../selftests/sched_ext/hotplug_test.h | 15 +
.../sched_ext/init_enable_count.bpf.c | 53 +
.../selftests/sched_ext/init_enable_count.c | 157 +
.../testing/selftests/sched_ext/maximal.bpf.c | 166 +
tools/testing/selftests/sched_ext/maximal.c | 54 +
.../selftests/sched_ext/maybe_null.bpf.c | 36 +
.../testing/selftests/sched_ext/maybe_null.c | 49 +
.../sched_ext/maybe_null_fail_dsp.bpf.c | 25 +
.../sched_ext/maybe_null_fail_yld.bpf.c | 28 +
.../testing/selftests/sched_ext/minimal.bpf.c | 21 +
tools/testing/selftests/sched_ext/minimal.c | 58 +
.../selftests/sched_ext/prog_run.bpf.c | 33 +
tools/testing/selftests/sched_ext/prog_run.c | 78 +
.../testing/selftests/sched_ext/reload_loop.c | 74 +
tools/testing/selftests/sched_ext/runner.c | 212 +
tools/testing/selftests/sched_ext/scx_test.h | 131 +
.../selftests/sched_ext/select_cpu_dfl.bpf.c | 40 +
.../selftests/sched_ext/select_cpu_dfl.c | 75 +
.../sched_ext/select_cpu_dfl_nodispatch.bpf.c | 89 +
.../sched_ext/select_cpu_dfl_nodispatch.c | 75 +
.../sched_ext/select_cpu_dispatch.bpf.c | 41 +
.../selftests/sched_ext/select_cpu_dispatch.c | 73 +
.../select_cpu_dispatch_bad_dsq.bpf.c | 37 +
.../sched_ext/select_cpu_dispatch_bad_dsq.c | 59 +
.../select_cpu_dispatch_dbl_dsp.bpf.c | 38 +
.../sched_ext/select_cpu_dispatch_dbl_dsp.c | 59 +
.../sched_ext/select_cpu_vtime.bpf.c | 92 +
.../selftests/sched_ext/select_cpu_vtime.c | 62 +
.../selftests/sched_ext/test_example.c | 49 +
tools/testing/selftests/sched_ext/util.c | 71 +
tools/testing/selftests/sched_ext/util.h | 13 +
263 files changed, 27732 insertions(+), 3787 deletions(-)
create mode 100644 Documentation/scheduler/sched-ext.rst
create mode 100644 include/asm-generic/cfi.h
create mode 100644 include/linux/sched/ext.h
create mode 100644 include/trace/events/sched_ext.h
delete mode 100644 kernel/bpf/bpf_struct_ops_types.h
create mode 100644 kernel/sched/ext.c
create mode 100644 kernel/sched/ext.h
create mode 100644 kernel/sched/ext_idle.c
create mode 100644 kernel/sched/ext_idle.h
create mode 100644 kernel/sched/syscalls.c
create mode 100644 scripts/Makefile.btf
delete mode 100755 scripts/pahole-flags.sh
create mode 100644 tools/lib/bpf/btf_iter.c
create mode 100644 tools/lib/bpf/btf_relocate.c
create mode 100644 tools/sched_ext/.gitignore
create mode 100644 tools/sched_ext/Makefile
create mode 100644 tools/sched_ext/README.md
create mode 100644 tools/sched_ext/include/bpf-compat/gnu/stubs.h
create mode 100644 tools/sched_ext/include/scx/common.bpf.h
create mode 100644 tools/sched_ext/include/scx/common.h
create mode 100644 tools/sched_ext/include/scx/compat.bpf.h
create mode 100644 tools/sched_ext/include/scx/compat.h
create mode 100644 tools/sched_ext/include/scx/enums.autogen.bpf.h
create mode 100644 tools/sched_ext/include/scx/enums.autogen.h
create mode 100644 tools/sched_ext/include/scx/enums.bpf.h
create mode 100644 tools/sched_ext/include/scx/enums.h
create mode 100644 tools/sched_ext/include/scx/user_exit_info.h
create mode 100644 tools/sched_ext/scx_central.bpf.c
create mode 100644 tools/sched_ext/scx_central.c
create mode 100644 tools/sched_ext/scx_flatcg.bpf.c
create mode 100644 tools/sched_ext/scx_flatcg.c
create mode 100644 tools/sched_ext/scx_flatcg.h
create mode 100644 tools/sched_ext/scx_qmap.bpf.c
create mode 100644 tools/sched_ext/scx_qmap.c
create mode 100644 tools/sched_ext/scx_show_state.py
create mode 100644 tools/sched_ext/scx_simple.bpf.c
create mode 100644 tools/sched_ext/scx_simple.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_distill.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_maybe_null.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_module.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_pages.c
rename tools/testing/selftests/bpf/progs/{bpf_iter_task_vma.c => bpf_iter_task_vmas.c} (100%)
rename tools/testing/selftests/bpf/progs/{bpf_iter_task.c => bpf_iter_tasks.c} (100%)
create mode 100644 tools/testing/selftests/bpf/progs/freplace_dead_global_func.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_css.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_css_task.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task_failure.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task_vma.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null_fail.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_module.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_multi_pages.c
create mode 100644 tools/testing/selftests/bpf/progs/verifier_bits_iter.c
create mode 100644 tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
create mode 100644 tools/testing/selftests/sched_ext/.gitignore
create mode 100644 tools/testing/selftests/sched_ext/Makefile
create mode 100644 tools/testing/selftests/sched_ext/config
create mode 100644 tools/testing/selftests/sched_ext/create_dsq.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/create_dsq.c
create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.c
create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.c
create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.c
create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.c
create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.c
create mode 100644 tools/testing/selftests/sched_ext/exit.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/exit.c
create mode 100644 tools/testing/selftests/sched_ext/exit_test.h
create mode 100644 tools/testing/selftests/sched_ext/hotplug.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/hotplug.c
create mode 100644 tools/testing/selftests/sched_ext/hotplug_test.h
create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.c
create mode 100644 tools/testing/selftests/sched_ext/maximal.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/maximal.c
create mode 100644 tools/testing/selftests/sched_ext/maybe_null.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/maybe_null.c
create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_dsp.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_yld.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/minimal.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/minimal.c
create mode 100644 tools/testing/selftests/sched_ext/prog_run.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/prog_run.c
create mode 100644 tools/testing/selftests/sched_ext/reload_loop.c
create mode 100644 tools/testing/selftests/sched_ext/runner.c
create mode 100644 tools/testing/selftests/sched_ext/scx_test.h
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.c
create mode 100644 tools/testing/selftests/sched_ext/test_example.c
create mode 100644 tools/testing/selftests/sched_ext/util.c
create mode 100644 tools/testing/selftests/sched_ext/util.h
--
2.34.1
2
452
03 Apr '26
From: Daniel Hodges <git(a)danielhodges.dev>
stable inclusion
from stable-v6.6.130
commit 3c5c818c78b03a1725f3dcd566865c77b48dd3a6
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13984
CVE: CVE-2026-23281
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0 ]
The lbs_free_adapter() function uses timer_delete() (non-synchronous)
for both command_timer and tx_lockup_timer before the structure is
freed. This is incorrect because timer_delete() does not wait for
any running timer callback to complete.
If a timer callback is executing when lbs_free_adapter() is called,
the callback will access freed memory since lbs_cfg_free() frees the
containing structure immediately after lbs_free_adapter() returns.
Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler)
access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields,
which would all be use-after-free violations.
Use timer_delete_sync() instead to ensure any running timer callback
has completed before returning.
This bug was introduced in commit 8f641d93c38a ("libertas: detect TX
lockups and reset hardware") where del_timer() was used instead of
del_timer_sync() in the cleanup path. The command_timer has had the
same issue since the driver was first written.
Fixes: 8f641d93c38a ("libertas: detect TX lockups and reset hardware")
Fixes: 954ee164f4f4 ("[PATCH] libertas: reorganize and simplify init sequence")
Cc: stable(a)vger.kernel.org
Signed-off-by: Daniel Hodges <git(a)danielhodges.dev>
Link: https://patch.msgid.link/20260206195356.15647-1-git@danielhodges.dev
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
[ del_timer() => timer_delete_sync() ]
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com>
---
drivers/net/wireless/marvell/libertas/main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c
index 78e8b5aecec0e..91b9501c6d8cb 100644
--- a/drivers/net/wireless/marvell/libertas/main.c
+++ b/drivers/net/wireless/marvell/libertas/main.c
@@ -881,8 +881,8 @@ static void lbs_free_adapter(struct lbs_private *priv)
{
lbs_free_cmd_buffer(priv);
kfifo_free(&priv->event_fifo);
- del_timer(&priv->command_timer);
- del_timer(&priv->tx_lockup_timer);
+ timer_delete_sync(&priv->command_timer);
+ timer_delete_sync(&priv->tx_lockup_timer);
del_timer(&priv->auto_deepsleep_timer);
}
--
2.43.0
2
1
[PATCH OLK-6.6 0/2] ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression
by Li Xiasong 03 Apr '26
by Li Xiasong 03 Apr '26
03 Apr '26
This patchset contains a backport of the upstream change that introduced
the issue, followed by the fix.
Patch 1 is a backport of upstream commit f478b8239d65 ("net: tunnel:
make skb_vlan_inet_prepare() return drop reasons") which changed the
return value semantics of skb_vlan_inet_prepare().
Patch 2 adapts the return value handling in __ip6_tnl_rcv() to match
the new semantics, fixing the regression.
Including the upstream change as patch 1 ensures that applying both
patches together does not introduce the issue that would occur if only
patch 1 were merged.
Li Xiasong (1):
ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change
Menglong Dong (1):
net: tunnel: make skb_vlan_inet_prepare() return drop reasons
drivers/net/bareudp.c | 4 ++--
drivers/net/geneve.c | 4 ++--
include/net/ip_tunnels.h | 13 ++++++++-----
net/ipv6/ip6_tunnel.c | 2 +-
4 files changed, 13 insertions(+), 10 deletions(-)
--
2.34.1
2
3
[PATCH OLK-6.6] can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
by Wupeng Ma 03 Apr '26
by Wupeng Ma 03 Apr '26
03 Apr '26
From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
stable inclusion
from stable-v6.6.130
commit f6e90c113c92e83fc0963d5e60e16b0e8a268981
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13957
CVE: CVE-2026-23324
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 5eaad4f768266f1f17e01232ffe2ef009f8129b7 upstream.
When submitting an urb, that is using the anchor pattern, it needs to be
anchored before submitting it otherwise it could be leaked if
usb_kill_anchored_urbs() is called. This logic is correctly done
elsewhere in the driver, except in the read bulk callback so do that
here also.
Cc: Vincent Mailhol <mailhol(a)kernel.org>
Cc: Marc Kleine-Budde <mkl(a)pengutronix.de>
Cc: stable(a)kernel.org
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Reviewed-by: Vincent Mailhol <mailhol(a)kernel.org>
Tested-by: Vincent Mailhol <mailhol(a)kernel.org>
Link: https://patch.msgid.link/2026022320-poser-stiffly-9d84@gregkh
Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces")
Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com>
---
drivers/net/can/usb/etas_es58x/es58x_core.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c
index bb49a2c0a9a5c..3edf06106f9d3 100644
--- a/drivers/net/can/usb/etas_es58x/es58x_core.c
+++ b/drivers/net/can/usb/etas_es58x/es58x_core.c
@@ -1461,12 +1461,18 @@ static void es58x_read_bulk_callback(struct urb *urb)
}
resubmit_urb:
+ usb_anchor_urb(urb, &es58x_dev->rx_urbs);
ret = usb_submit_urb(urb, GFP_ATOMIC);
+ if (!ret)
+ return;
+
+ usb_unanchor_urb(urb);
+
if (ret == -ENODEV) {
for (i = 0; i < es58x_dev->num_can_ch; i++)
if (es58x_dev->netdev[i])
netif_device_detach(es58x_dev->netdev[i]);
- } else if (ret)
+ } else
dev_err_ratelimited(dev,
"Failed resubmitting read bulk urb: %pe\n",
ERR_PTR(ret));
--
2.43.0
2
1
Aboorva Devarajan (2):
sched_ext: Documentation: Remove mentions of scx_bpf_switch_all
sched: Pass correct scheduling policy to __setscheduler_class
Alan Maguire (16):
kbuild,bpf: Switch to using --btf_features for pahole v1.26 and later
kbuild, bpf: Use test-ge check for v1.25-only pahole
libbpf: Add btf__distill_base() creating split BTF with distilled base
BTF
selftests/bpf: Test distilled base, split BTF generation
libbpf: Split BTF relocation
selftests/bpf: Extend distilled BTF tests to cover BTF relocation
resolve_btfids: Handle presence of .BTF.base section
libbpf: BTF relocation followup fixing naming, loop logic
module, bpf: Store BTF base pointer in struct module
libbpf: Split field iter code into its own file kernel
libbpf,bpf: Share BTF relocate-related code with kernel
kbuild,bpf: Add module-specific pahole flags for distilled base BTF
selftests/bpf: Add kfunc_call test for simple dtor in bpf_testmod
bpf: fix build when CONFIG_DEBUG_INFO_BTF[_MODULES] is undefined
libbpf: Fix error handling in btf__distill_base()
libbpf: Fix license for btf_relocate.c
Alexander Lobakin (1):
bitops: make BYTES_TO_BITS() treewide-available
Alexei Starovoitov (2):
s390/bpf: Fix indirect trampoline generation
bpf: Introduce "volatile compare" macros
Andrea Righi (33):
sched_ext: fix typo in set_weight() description
sched_ext: add CONFIG_DEBUG_INFO_BTF dependency
sched_ext: Provide a sysfs enable_seq counter
sched_ext: improve WAKE_SYNC behavior for default idle CPU selection
sched_ext: Clarify ops.select_cpu() for single-CPU tasks
sched_ext: Introduce LLC awareness to the default idle selection
policy
sched_ext: Introduce NUMA awareness to the default idle selection
policy
sched_ext: Do not enable LLC/NUMA optimizations when domains overlap
sched_ext: Fix incorrect use of bitwise AND
MAINTAINERS: add self as reviewer for sched_ext
sched_ext: idle: Refresh idle masks during idle-to-idle transitions
sched_ext: Use the NUMA scheduling domain for NUMA optimizations
sched_ext: idle: use assign_cpu() to update the idle cpumask
sched_ext: idle: clarify comments
sched_ext: idle: introduce check_builtin_idle_enabled() helper
sched_ext: idle: small CPU iteration refactoring
sched_ext: update scx_bpf_dsq_insert() doc for SCX_DSQ_LOCAL_ON
sched_ext: Include remaining task time slice in error state dump
sched_ext: Include task weight in the error state dump
selftests/sched_ext: Fix enum resolution
tools/sched_ext: Add helper to check task migration state
sched_ext: selftests/dsp_local_on: Fix selftest on UP systems
sched_ext: Fix lock imbalance in dispatch_to_local_dsq()
selftests/sched_ext: Fix exit selftest hang on UP
sched_ext: Move built-in idle CPU selection policy to a separate file
sched_ext: Track currently locked rq
sched_ext: Make scx_locked_rq() inline
sched_ext: Fix missing rq lock in scx_bpf_cpuperf_set()
sched/ext: Fix invalid task state transitions on class switch
sched_ext: Make scx_kf_allowed_if_unlocked() available outside ext.c
sched_ext: Remove duplicate BTF_ID_FLAGS definitions
sched_ext: Fix rq lock state in hotplug ops
sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()
Andrii Nakryiko (14):
bpf: Emit global subprog name in verifier logs
bpf: Validate global subprogs lazily
selftests/bpf: Add lazy global subprog validation tests
libbpf: Add btf__new_split() API that was declared but not implemented
bpf: move sleepable flag from bpf_prog_aux to bpf_prog
libbpf: Add BTF field iterator
libbpf: Make use of BTF field iterator in BPF linker code
libbpf: Make use of BTF field iterator in BTF handling code
bpftool: Use BTF field iterator in btfgen
libbpf: Remove callback-based type/string BTF field visitor helpers
bpf: extract iterator argument type and name validation logic
bpf: allow passing struct bpf_iter_<type> as kfunc arguments
selftests/bpf: test passing iterator to a kfunc
selftests/bpf: validate eliminated global subprog is not freplaceable
Arnaldo Carvalho de Melo (1):
tools include UAPI: Sync linux/sched.h copy with the kernel sources
Atul Kumar Pant (1):
sched_ext: Fixes typos in comments
Benjamin Tissoires (1):
bpf: introduce in_sleepable() helper
Bitao Hu (4):
genirq: Convert kstat_irqs to a struct
genirq: Provide a snapshot mechanism for interrupt statistics
watchdog/softlockup: Low-overhead detection of interrupt storm
watchdog/softlockup: Report the most frequent interrupts
Björn Töpel (1):
selftests: sched_ext: Add sched_ext as proper selftest target
Breno Leitao (3):
rhashtable: Fix potential deadlock by moving schedule_work outside
lock
sched_ext: Use kvzalloc for large exit_dump allocation
sched/ext: Prevent update_locked_rq() calls with NULL rq
Changwoo Min (12):
sched_ext: Clarify sched_ext_ops table for userland scheduler
sched_ext: add a missing rcu_read_lock/unlock pair at
scx_select_cpu_dfl()
MAINTAINERS: add me as reviewer for sched_ext
sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass()
sched_ext: Relocate scx_enabled() related code
sched_ext: Implement scx_bpf_now()
sched_ext: Add scx_bpf_now() for BPF scheduler
sched_ext: Add time helpers for BPF schedulers
sched_ext: Replace bpf_ktime_get_ns() to scx_bpf_now()
sched_ext: Use time helpers in BPF schedulers
sched_ext: Fix incorrect time delta calculation in time_delta()
sched_ext: Add scx_bpf_events() and scx_read_event() for BPF
schedulers
Cheng-Yang Chou (1):
sched_ext: Always use SMP versions in kernel/sched/ext.c
Christian Brauner (1):
file: add take_fd() cleanup helper
Christian Loehle (1):
sched/fair: Remove stale FREQUENCY_UTIL comment
Christophe Leroy (2):
bpf: Remove arch_unprotect_bpf_trampoline()
bpf: Check return from set_memory_rox()
Chuyi Zhou (15):
cgroup: Prepare for using css_task_iter_*() in BPF
bpf: Introduce css_task open-coded iterator kfuncs
bpf: Introduce task open coded iterator kfuncs
bpf: Introduce css open-coded iterator kfuncs
bpf: teach the verifier to enforce css_iter and task_iter in RCU CS
bpf: Let bpf_iter_task_new accept null task ptr
selftests/bpf: rename bpf_iter_task.c to bpf_iter_tasks.c
selftests/bpf: Add tests for open-coded task and css iter
bpf: Relax allowlist for css_task iter
selftests/bpf: Add tests for css_task iter combining with cgroup iter
selftests/bpf: Add test for using css_task iter in sleepable progs
bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg
selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly
sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h.
sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx
Colin Ian King (1):
sched_ext: Fix spelling mistake: "intead" -> "instead"
Daniel Xu (3):
bpf: btf: Support flags for BTF_SET8 sets
bpf: btf: Add BTF_KFUNCS_START/END macro pair
bpf: treewide: Annotate BPF kfuncs in BTF
Dave Marchevsky (6):
bpf: Don't explicitly emit BTF for struct btf_iter_num
selftests/bpf: Rename bpf_iter_task_vma.c to bpf_iter_task_vmas.c
bpf: Introduce task_vma open-coded iterator kfuncs
selftests/bpf: Add tests for open-coded task_vma iter
bpf: Add __bpf_kfunc_{start,end}_defs macros
bpf: Add __bpf_hook_{start,end} macros
David Vernet (15):
bpf: Add ability to pin bpf timer to calling CPU
selftests/bpf: Test pinning bpf timer to a core
sched_ext: Implement runnable task stall watchdog
sched_ext: Print sched_ext info when dumping stack
sched_ext: Implement SCX_KICK_WAIT
sched_ext: Implement sched_ext_ops.cpu_acquire/release()
sched_ext: Add selftests
bpf: Load vmlinux btf for any struct_ops map
sched_ext: Make scx_bpf_cpuperf_set() @cpu arg signed
scx: Allow calling sleepable kfuncs from BPF_PROG_TYPE_SYSCALL
scx/selftests: Verify we can call create_dsq from prog_run
sched_ext: Remove unnecessary cpu_relax()
scx: Fix exit selftest to use custom DSQ
scx: Fix raciness in scx_ops_bypass()
scx: Fix maximal BPF selftest prog
Dawei Li (1):
genirq: Deduplicate interrupt descriptor initialization
Devaansh Kumar (1):
sched_ext: selftests: Fix grammar in tests description
Devaansh-Kumar (1):
sched_ext: Documentation: Update instructions for running example
schedulers
Eduard Zingerman (2):
libbpf: Make btf_parse_elf process .BTF.base transparently
selftests/bpf: Check if distilled base inherits source endianness
Geliang Tang (1):
bpf, btf: Check btf for register_bpf_struct_ops
Henry Huang (2):
sched_ext: initialize kit->cursor.flags
sched_ext: keep running prev when prev->scx.slice != 0
Herbert Xu (1):
rhashtable: Fix rhashtable_try_insert test
Honglei Wang (3):
sched_ext: use correct function name in pick_task_scx() warning
message
sched_ext: Add __weak to fix the build errors
sched_ext: switch class when preempted by higher priority scheduler
Hongyan Xia (1):
sched/ext: Add BPF function to fetch rq
Hou Tao (7):
bpf: Free dynamically allocated bits in bpf_iter_bits_destroy()
bpf: Add bpf_mem_alloc_check_size() helper
bpf: Check the validity of nr_words in bpf_iter_bits_new()
bpf: Use __u64 to save the bits in bits iterator
selftests/bpf: Add three test cases for bits_iter
selftests/bpf: Use -4095 as the bad address for bits iterator
selftests/bpf: Export map_update_retriable()
Ihor Solodrai (2):
selftests/sched_ext: add order-only dependency of runner.o on BPFOBJ
selftests/sched_ext: fix build after renames in sched_ext API
Ilpo Järvinen (1):
<linux/cleanup.h>: Allow the passing of both iomem and non-iomem
pointers to no_free_ptr()
Ingo Molnar (3):
sched/syscalls: Split out kernel/sched/syscalls.c from
kernel/sched/core.c
sched/fair: Rename check_preempt_wakeup() to
check_preempt_wakeup_fair()
sched/fair: Rename check_preempt_curr() to wakeup_preempt()
Jake Hillion (2):
sched_ext: create_dsq: Return -EEXIST on duplicate request
sched_ext: Drop kfuncs marked for removal in 6.15
Jiapeng Chong (1):
sched_ext: Fixes incorrect type in bpf_scx_init()
Jiayuan Chen (1):
selftests/bpf: Fixes for test_maps test
Kui-Feng Lee (29):
bpf: refactory struct_ops type initialization to a function.
bpf: get type information with BTF_ID_LIST
bpf, net: introduce bpf_struct_ops_desc.
bpf: add struct_ops_tab to btf.
bpf: make struct_ops_map support btfs other than btf_vmlinux.
bpf: pass btf object id in bpf_map_info.
bpf: lookup struct_ops types from a given module BTF.
bpf: pass attached BTF to the bpf_struct_ops subsystem
bpf: hold module refcnt in bpf_struct_ops map creation and prog
verification.
bpf: validate value_type
bpf, net: switch to dynamic registration
libbpf: Find correct module BTFs for struct_ops maps and progs.
bpf: export btf_ctx_access to modules.
selftests/bpf: test case for register_bpf_struct_ops().
bpf: Fix error checks against bpf_get_btf_vmlinux().
bpf: Remove an unnecessary check.
selftests/bpf: Suppress warning message of an unused variable.
bpf: add btf pointer to struct bpf_ctx_arg_aux.
bpf: Move __kfunc_param_match_suffix() to btf.c.
bpf: Create argument information for nullable arguments.
selftests/bpf: Test PTR_MAYBE_NULL arguments of struct_ops operators.
libbpf: Set btf_value_type_id of struct bpf_map for struct_ops.
libbpf: Convert st_ops->data to shadow type.
bpftool: Generated shadow variables for struct_ops maps.
bpftool: Add an example for struct_ops map and shadow type.
selftests/bpf: Test if shadow types work correctly.
bpf, net: validate struct_ops when updating value.
bpf: struct_ops supports more than one page for trampolines.
selftests/bpf: Test struct_ops maps with a large number of struct_ops
program.
Kumar Kartikeya Dwivedi (4):
bpf: Allow calling static subprogs while holding a bpf_spin_lock
selftests/bpf: Add test for static subprog call in lock cs
bpf: Transfer RCU lock state between subprog calls
selftests/bpf: Add tests for RCU lock transfer between subprogs
Liang Jie (1):
sched_ext: Use sizeof_field for key_len in dsq_hash_params
Luo Gengkun (7):
bpf: Fix kabi-breakage for bpf_func_info_aux
bpf: Fix kabi-breakage for bpf_tramp_image
bpf: Fix kabi for bpf_attr
bpf_verifier: Fix kabi for bpf_verifier_env
bpf: Fix kabi for bpf_ctx_arg_aux
bpf: Fix kabi for bpf_prog_aux and bpf_prog
selftests/bpf: modify test_loader that didn't support running
bpf_prog_type_syscall programs
Manu Bretelle (1):
sched_ext: define missing cfi stubs for sched_ext
Martin KaFai Lau (5):
libbpf: Ensure undefined bpf_attr field stays 0
bpf: Remove unnecessary err < 0 check in
bpf_struct_ops_map_update_elem
bpf: Fix a crash when btf_parse_base() returns an error pointer
bpf: Reject struct_ops registration that uses module ptr and the
module btf_id is missing
bpf: Use kallsyms to find the function name of a struct_ops's stub
function
Masahiro Yamada (1):
kbuild: avoid too many execution of scripts/pahole-flags.sh
Matthieu Baerts (1):
bpf: fix compilation error without CGROUPS
Peter Zijlstra (26):
cfi: Flip headers
x86/cfi,bpf: Fix BPF JIT call
x86/cfi,bpf: Fix bpf_callback_t CFI
x86/cfi,bpf: Fix bpf_struct_ops CFI
cfi: Add CFI_NOSEAL()
bpf: Fix dtor CFI
cleanup: Make no_free_ptr() __must_check
sched: Simplify set_user_nice()
sched: Simplify syscalls
sched: Simplify sched_{set,get}affinity()
sched: Simplify yield_to()
sched: Simplify sched_rr_get_interval()
sched: Simplify sched_move_task()
sched: Misc cleanups
sched/deadline: Move bandwidth accounting into {en,de}queue_dl_entity
sched: Allow sched_class::dequeue_task() to fail
sched: Unify runtime accounting across classes
sched: Use set_next_task(.first) where required
sched/fair: Cleanup pick_task_fair() vs throttle
sched/fair: Cleanup pick_task_fair()'s curr
sched/fair: Unify pick_{,next_}_task_fair()
sched: Fixup set_next_task() implementations
sched: Split up put_prev_task_balance()
sched: Rework pick_next_task()
sched: Combine the last put_prev_task() and the first set_next_task()
sched: Add put_prev_task(.next)
Pu Lehui (8):
riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops
bpf: Fix kabi breakage in struct module
riscv, bpf: Fix out-of-bounds issue when preparing trampoline image
selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill
test
libbpf: Fix return zero when elf_begin failed
libbpf: Fix incorrect traversal end type ID when marking
BTF_IS_EMBEDDED
selftests/bpf: Add distilled BTF test about marking BTF_IS_EMBEDDED
selftests/bpf: Add file_read_pattern to gitignore
Randy Dunlap (1):
sched_ext: fix kernel-doc warnings
Shizhao Chen (1):
sched_ext: Add option -l in selftest runner to list all available
tests
Song Liu (8):
bpf: Charge modmem for struct_ops trampoline
bpf: Let bpf_prog_pack_free handle any pointer
bpf: Adjust argument names of arch_prepare_bpf_trampoline()
bpf: Add helpers for trampoline image management
bpf, x86: Adjust arch_prepare_bpf_trampoline return value
bpf: Add arch_bpf_trampoline_size()
bpf: Use arch_bpf_trampoline_size
x86, bpf: Use bpf_prog_pack for bpf trampoline
T.J. Mercier (1):
bpf, docs: Fix broken link to renamed bpf_iter_task_vmas.c
Tejun Heo (152):
sched: Restructure sched_class order sanity checks in sched_init()
sched: Allow sched_cgroup_fork() to fail and introduce
sched_cancel_fork()
sched: Add sched_class->reweight_task()
sched: Add sched_class->switching_to() and expose
check_class_changing/changed()
sched: Factor out cgroup weight conversion functions
sched: Factor out update_other_load_avgs() from
__update_blocked_others()
sched: Add normal_policy()
sched_ext: Add boilerplate for extensible scheduler class
sched_ext: Implement BPF extensible scheduler class
sched_ext: Add scx_simple and scx_example_qmap example schedulers
sched_ext: Add sysrq-S which disables the BPF scheduler
sched_ext: Allow BPF schedulers to disallow specific tasks from
joining SCHED_EXT
sched_ext: Print debug dump after an error exit
tools/sched_ext: Add scx_show_state.py
sched_ext: Implement scx_bpf_kick_cpu() and task preemption support
sched_ext: Add a central scheduler which makes all scheduling
decisions on one CPU
sched_ext: Make watchdog handle ops.dispatch() looping stall
sched_ext: Add task state tracking operations
sched_ext: Implement tickless support
sched_ext: Track tasks that are subjects of the in-flight SCX
operation
sched_ext: Implement sched_ext_ops.cpu_online/offline()
sched_ext: Bypass BPF scheduler while PM events are in progress
sched_ext: Implement core-sched support
sched_ext: Add vtime-ordered priority queue to dispatch_q's
sched_ext: Documentation: scheduler: Document extensible scheduler
class
sched, sched_ext: Replace scx_next_task_picked() with
sched_class->switch_class()
cpufreq_schedutil: Refactor sugov_cpu_is_busy()
sched_ext: Add cpuperf support
sched_ext: Drop tools_clean target from the top-level Makefile
sched_ext: Swap argument positions in kcalloc() call to avoid compiler
warning
sched, sched_ext: Simplify dl_prio() case handling in sched_fork()
sched_ext: Account for idle policy when setting p->scx.weight in
scx_ops_enable_task()
sched_ext: Disallow loading BPF scheduler if isolcpus= domain
isolation is in effect
sched_ext: Minor cleanups in kernel/sched/ext.h
sched, sched_ext: Open code for_balance_class_range()
sched, sched_ext: Move some declarations from kernel/sched/ext.h to
sched.h
sched_ext: Take out ->priq and ->flags from scx_dsq_node
sched_ext: Implement DSQ iterator
sched_ext/scx_qmap: Add an example usage of DSQ iterator
sched_ext: Reimplement scx_bpf_reenqueue_local()
sched_ext: Make scx_bpf_reenqueue_local() skip tasks that are being
migrated
sched: Move struct balance_callback definition upward
sched_ext: Unpin and repin rq lock from balance_scx()
sched_ext: s/SCX_RQ_BALANCING/SCX_RQ_IN_BALANCE/ and add
SCX_RQ_IN_WAKEUP
sched_ext: Allow SCX_DSQ_LOCAL_ON for direct dispatches
sched_ext/scx_qmap: Pick idle CPU for direct dispatch on !wakeup
enqueues
sched_ext: Build fix on !CONFIG_STACKTRACE[_SUPPORT]
sched_ext: Allow p->scx.disallow only while loading
sched_ext: Simplify scx_can_stop_tick() invocation in
sched_can_stop_tick()
sched_ext: Add scx_enabled() test to @start_class promotion in
put_prev_task_balance()
sched_ext: Use update_curr_common() in update_curr_scx()
sched_ext: Simplify UP support by enabling sched_class->balance() in
UP
sched_ext: Improve comment on idle_sched_class exception in
scx_task_iter_next_locked()
sched_ext: Make task_can_run_on_remote_rq() use common
task_allowed_on_cpu()
sched_ext: Fix unsafe list iteration in process_ddsp_deferred_locals()
sched_ext: Make scx_rq_online() also test cpu_active() in addition to
SCX_RQ_ONLINE
sched_ext: Improve logging around enable/disable
sched_ext: Don't use double locking to migrate tasks across CPUs
scx_central: Fix smatch checker warning
sched_ext: Add missing cfi stub for ops.tick
sched_ext: Use task_can_run_on_remote_rq() test in
dispatch_to_local_dsq()
sched_ext: Use sched_clock_cpu() instead of rq_clock_task() in
touch_core_sched()
sched_ext: Don't call put_prev_task_scx() before picking the next task
sched_ext: Replace SCX_TASK_BAL_KEEP with SCX_RQ_BAL_KEEP
sched_ext: Unify regular and core-sched pick task paths
sched_ext: Relocate functions in kernel/sched/ext.c
sched_ext: Remove switch_class_scx()
sched_ext: Remove sched_class->switch_class()
sched_ext: TASK_DEAD tasks must be switched out of SCX on ops_disable
sched_ext: TASK_DEAD tasks must be switched into SCX on ops_enable
sched: Expose css_tg()
sched: Make cpu_shares_read_u64() use tg_weight()
sched: Introduce CONFIG_GROUP_SCHED_WEIGHT
sched_ext: Add cgroup support
sched_ext: Add a cgroup scheduler which uses flattened hierarchy
sched_ext: Temporarily work around pick_task_scx() being called
without balance_scx()
sched_ext: Add missing static to scx_has_op[]
sched_ext: Add missing static to scx_dump_data
sched_ext: Rename scx_kfunc_set_sleepable to unlocked and relocate
sched_ext: Refactor consume_remote_task()
sched_ext: Make find_dsq_for_dispatch() handle SCX_DSQ_LOCAL_ON
sched_ext: Fix processs_ddsp_deferred_locals() by unifying DTL_INVALID
handling
sched_ext: Restructure dispatch_to_local_dsq()
sched_ext: Reorder args for consume_local/remote_task()
sched_ext: Move sanity check and dsq_mod_nr() into
task_unlink_from_dsq()
sched_ext: Move consume_local_task() upward
sched_ext: Replace consume_local_task() with
move_local_task_to_local_dsq()
sched_ext: Compact struct bpf_iter_scx_dsq_kern
sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq()
scx_qmap: Implement highpri boosting
sched_ext: Synchronize bypass state changes with rq lock
sched_ext: Don't trigger ops.quiescent/runnable() on migrations
sched_ext: Fix build when !CONFIG_STACKTRACE
sched_ext: Build fix for !CONFIG_SMP
sched_ext: Add __COMPAT helpers for features added during v6.12 devel
cycle
tools/sched_ext: Receive misc updates from SCX repo
scx_flatcg: Use a user DSQ for fallback instead of SCX_DSQ_GLOBAL
sched_ext: Allow only user DSQs for scx_bpf_consume(),
scx_bpf_dsq_nr_queued() and bpf_iter_scx_dsq_new()
sched_ext: Relocate find_user_dsq()
sched_ext: Split the global DSQ per NUMA node
sched_ext: Use shorter slice while bypassing
sched_ext: Relocate check_hotplug_seq() call in scx_ops_enable()
sched_ext: Remove SCX_OPS_PREPPING
sched_ext: Initialize in bypass mode
sched_ext: Fix SCX_TASK_INIT -> SCX_TASK_READY transitions in
scx_ops_enable()
sched_ext: Enable scx_ops_init_task() separately
sched_ext: Add scx_cgroup_enabled to gate cgroup operations and fix
scx_tg_online()
sched_ext: Decouple locks in scx_ops_disable_workfn()
sched_ext: Decouple locks in scx_ops_enable()
sched_ext: Improve error reporting during loading
sched_ext: scx_cgroup_exit() may be called without successful
scx_cgroup_init()
sched/core: Make select_task_rq() take the pointer to wake_flags
instead of value
sched/core: Add ENQUEUE_RQ_SELECTED to indicate whether
->select_task_rq() was called
sched_ext, scx_qmap: Add and use SCX_ENQ_CPU_SELECTED
Revert "sched_ext: Use shorter slice while bypassing"
sched_ext: Start schedulers with consistent p->scx.slice values
sched_ext: Move scx_buildin_idle_enabled check to
scx_bpf_select_cpu_dfl()
sched_ext: bypass mode shouldn't depend on ops.select_cpu()
sched_ext: Move scx_tasks_lock handling into scx_task_iter helpers
sched_ext: Don't hold scx_tasks_lock for too long
sched_ext: Make cast_mask() inline
sched_ext: Fix enq_last_no_enq_fails selftest
sched_ext: Add a missing newline at the end of an error message
sched_ext: Update scx_show_state.py to match scx_ops_bypass_depth's
new type
sched_ext: Handle cases where pick_task_scx() is called without
preceding balance_scx()
sched_ext: ops.cpu_acquire() should be called with SCX_KF_REST
sched_ext: Factor out move_task_between_dsqs() from
scx_dispatch_from_dsq()
sched_ext: Rename CFI stubs to names that are recognized by BPF
sched_ext: Replace set_arg_maybe_null() with __nullable CFI stub tags
sched_ext: Avoid live-locking bypass mode switching
sched_ext: Enable the ops breather and eject BPF scheduler on
softlockup
sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked
context
sched_ext: Rename scx_bpf_dispatch[_vtime]() to
scx_bpf_dsq_insert[_vtime]()
sched_ext: Rename scx_bpf_consume() to scx_bpf_dsq_move_to_local()
sched_ext: Rename scx_bpf_dispatch[_vtime]_from_dsq*() ->
scx_bpf_dsq_move[_vtime]*()
sched_ext: Fix invalid irq restore in scx_ops_bypass()
sched_ext: Fix dsq_local_on selftest
tools/sched_ext: Receive updates from SCX repo
sched_ext: selftests/dsp_local_on: Fix sporadic failures
sched_ext: Fix incorrect autogroup migration detection
sched_ext: Implement auto local dispatching of migration disabled
tasks
sched_ext: Fix migration disabled handling in targeted dispatches
sched_ext: Fix incorrect assumption about migration disabled tasks in
task_can_run_on_remote_rq()
sched_ext: Fix pick_task_scx() picking non-queued tasks when it's
called without balance()
sched_ext: Implement SCX_OPS_ALLOW_QUEUED_WAKEUP
sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator
sched_ext: Make scx_group_set_weight() always update tg->scx.weight
sched_ext, sched/core: Don't call scx_group_set_weight() prematurely
from sched_create_group()
sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU
sched_ext: Don't kick CPUs running higher classes
sched_ext: Use SCX_TASK_READY test instead of tryget_task_struct()
during class switch
tools/sched_ext: Sync with scx repo
Thomas Gleixner (1):
sched/ext: Remove sched_fork() hack
Thorsten Blum (1):
sched_ext: Use str_enabled_disabled() helper in
update_selcpu_topology()
Tianchen Ding (1):
sched_ext: Use btf_ids to resolve task_struct
Tony Ambardar (1):
libbpf: Ensure new BTF objects inherit input endianness
Vincent Guittot (2):
sched/cpufreq: Rework schedutil governor performance estimation
sched/fair: Fix sched_can_stop_tick() for fair tasks
Vishal Chourasia (2):
sched_ext: Add __weak markers to BPF helper function decalarations
sched_ext: Fix function pointer type mismatches in BPF selftests
Wenyu Huang (1):
sched/doc: Update documentation after renames and synchronize Chinese
version
Yafang Shao (2):
bpf: Add bits iterator
selftests/bpf: Add selftest for bits iter
Yipeng Zou (1):
sched_ext: Allow dequeue_task_scx to fail
Yiwei Lin (1):
sched/fair: Remove unused 'curr' argument from pick_next_entity()
Yu Liao (2):
sched: Put task_group::idle under CONFIG_GROUP_SCHED_WEIGHT
sched: Add dummy version of sched_group_set_idle()
Yury Norov (1):
cpumask: introduce assign_cpu() macro
Zhang Qiao (3):
sched_ext: Remove redundant p->nr_cpus_allowed checker
sched/ext: Fix unmatch trailing comment of CONFIG_EXT_GROUP_SCHED
sched/ext: Use tg_cgroup() to elieminate duplicate code
Zhao Mengmeng (1):
sched_ext: Replace scx_next_task_picked() with switch_class() in
comment
Zicheng Qu (17):
sched: Fix kabi for reweight_task in struct sched_class
sched/syscalls: Fix kabi for EXPORT_SYMBOL moved from core.c to
syscalls.c
sched: Fix kabi for switching_to in struct sched_class
sched/fair: Fix kabi for check_preempt_curr and wakeup_preempt in
struct sched_class
sched: Fix kabi for dequeue_task in struct sched_class
sched_ext: Fix kabi for scx in struct task_struct
sched_ext: Fix kabi for switch_class in struct sched_class
sched: Fix kabi for exec_max in struct sched_statistics
sched_ext: Fix kabi for balance in struct sched_class
sched_ext: Fix kabi for header in kernel/sched/sched.h
sched: Fix kabi pick_task in struct sched_class
sched: Fix kabi for put_prev_task in struct sched_class
sched_ext: Fix kabi for scx_flags and scx_weight in struct task_group
sched: Fix kabi for int idle in struct task_group
sched: Add __setscheduler_class() for sched_ext
genirq: Fix kabi for kstat_irqs in struct irq_desc
sched_ext: Enable and disable sched_ext configs
Zqiang (1):
sched_ext: Fix unsafe locking in the scx_dump_state()
guanjing (1):
sched_ext: fix application of sizeof to pointer
Documentation/bpf/bpf_iterators.rst | 2 +-
Documentation/bpf/kfuncs.rst | 14 +-
Documentation/scheduler/index.rst | 1 +
Documentation/scheduler/sched-design-CFS.rst | 8 +-
Documentation/scheduler/sched-ext.rst | 325 +
.../zh_CN/scheduler/sched-design-CFS.rst | 8 +-
MAINTAINERS | 16 +-
Makefile | 4 +-
arch/arm64/configs/openeuler_defconfig | 3 +
arch/arm64/kernel/bpf-rvi.c | 4 +-
arch/arm64/net/bpf_jit_comp.c | 55 +-
arch/mips/dec/setup.c | 2 +-
arch/parisc/kernel/smp.c | 2 +-
arch/powerpc/kvm/book3s_hv_rm_xics.c | 2 +-
arch/riscv/include/asm/cfi.h | 3 +-
arch/riscv/kernel/cfi.c | 2 +-
arch/riscv/net/bpf_jit_comp64.c | 48 +-
arch/s390/net/bpf_jit_comp.c | 59 +-
arch/x86/configs/openeuler_defconfig | 2 +
arch/x86/include/asm/cfi.h | 126 +-
arch/x86/kernel/alternative.c | 87 +-
arch/x86/kernel/cfi.c | 4 +-
arch/x86/net/bpf_jit_comp.c | 261 +-
block/blk-cgroup.c | 4 +-
drivers/hid/bpf/hid_bpf_dispatch.c | 12 +-
drivers/tty/sysrq.c | 1 +
fs/proc/stat.c | 4 +-
include/asm-generic/Kbuild | 1 +
include/asm-generic/cfi.h | 5 +
include/asm-generic/vmlinux.lds.h | 1 +
include/linux/bitops.h | 2 +
include/linux/bpf.h | 130 +-
include/linux/bpf_mem_alloc.h | 3 +
include/linux/bpf_verifier.h | 21 +-
include/linux/btf.h | 105 +
include/linux/btf_ids.h | 21 +-
include/linux/cfi.h | 12 +
include/linux/cgroup.h | 14 +-
include/linux/cleanup.h | 42 +-
include/linux/cpumask.h | 41 +-
include/linux/energy_model.h | 1 -
include/linux/file.h | 20 +
include/linux/filter.h | 2 +-
include/linux/irqdesc.h | 17 +-
include/linux/kernel_stat.h | 8 +
include/linux/module.h | 8 +-
include/linux/sched.h | 8 +-
include/linux/sched/ext.h | 216 +
include/linux/sched/task.h | 8 +-
include/trace/events/sched_ext.h | 32 +
include/uapi/linux/bpf.h | 16 +-
include/uapi/linux/sched.h | 1 +
init/Kconfig | 10 +
init/init_task.c | 12 +
kernel/Kconfig.preempt | 27 +-
kernel/bpf-rvi/common_kfuncs.c | 4 +-
kernel/bpf/Makefile | 8 +-
kernel/bpf/bpf_iter.c | 12 +-
kernel/bpf/bpf_struct_ops.c | 745 +-
kernel/bpf/bpf_struct_ops_types.h | 12 -
kernel/bpf/btf.c | 431 +-
kernel/bpf/cgroup_iter.c | 65 +-
kernel/bpf/core.c | 76 +-
kernel/bpf/cpumask.c | 18 +-
kernel/bpf/dispatcher.c | 7 +-
kernel/bpf/helpers.c | 202 +-
kernel/bpf/map_iter.c | 10 +-
kernel/bpf/memalloc.c | 14 +-
kernel/bpf/syscall.c | 12 +-
kernel/bpf/task_iter.c | 242 +-
kernel/bpf/trampoline.c | 99 +-
kernel/bpf/verifier.c | 317 +-
kernel/cgroup/cgroup.c | 18 +-
kernel/cgroup/cpuset.c | 4 +-
kernel/cgroup/rstat.c | 13 +-
kernel/events/core.c | 2 +-
kernel/fork.c | 17 +-
kernel/irq/Kconfig | 4 +
kernel/irq/internals.h | 2 +-
kernel/irq/irqdesc.c | 144 +-
kernel/irq/proc.c | 5 +-
kernel/module/main.c | 5 +-
kernel/sched/autogroup.c | 4 +-
kernel/sched/bpf_sched.c | 8 +-
kernel/sched/build_policy.c | 13 +
kernel/sched/core.c | 2492 +-----
kernel/sched/cpuacct.c | 4 +-
kernel/sched/cpufreq_schedutil.c | 83 +-
kernel/sched/deadline.c | 175 +-
kernel/sched/debug.c | 3 +
kernel/sched/ext.c | 7155 +++++++++++++++++
kernel/sched/ext.h | 119 +
kernel/sched/ext_idle.c | 755 ++
kernel/sched/ext_idle.h | 39 +
kernel/sched/fair.c | 306 +-
kernel/sched/idle.c | 31 +-
kernel/sched/rt.c | 40 +-
kernel/sched/sched.h | 473 +-
kernel/sched/stop_task.c | 35 +-
kernel/sched/syscalls.c | 1713 ++++
kernel/trace/bpf_trace.c | 12 +-
kernel/trace/trace_probe.c | 2 -
kernel/watchdog.c | 223 +-
lib/Kconfig.debug | 14 +
lib/dump_stack.c | 1 +
lib/rhashtable.c | 12 +-
net/bpf/bpf_dummy_struct_ops.c | 72 +-
net/bpf/test_run.c | 30 +-
net/core/filter.c | 33 +-
net/core/xdp.c | 10 +-
net/ipv4/bpf_tcp_ca.c | 93 +-
net/ipv4/fou_bpf.c | 10 +-
net/ipv4/tcp_bbr.c | 4 +-
net/ipv4/tcp_cong.c | 6 +-
net/ipv4/tcp_cubic.c | 4 +-
net/ipv4/tcp_dctcp.c | 4 +-
net/netfilter/nf_conntrack_bpf.c | 10 +-
net/netfilter/nf_nat_bpf.c | 10 +-
net/socket.c | 8 +-
net/xfrm/xfrm_interface_bpf.c | 10 +-
scripts/Makefile.btf | 33 +
scripts/Makefile.modfinal | 2 +-
scripts/gdb/linux/interrupts.py | 6 +-
scripts/pahole-flags.sh | 30 -
tools/Makefile | 10 +-
.../bpf/bpftool/Documentation/bpftool-gen.rst | 58 +-
tools/bpf/bpftool/gen.c | 253 +-
tools/bpf/resolve_btfids/main.c | 8 +
tools/include/linux/bitops.h | 2 +
tools/include/uapi/linux/bpf.h | 14 +-
tools/include/uapi/linux/sched.h | 1 +
tools/lib/bpf/Build | 2 +-
tools/lib/bpf/bpf.c | 4 +-
tools/lib/bpf/bpf.h | 4 +-
tools/lib/bpf/btf.c | 704 +-
tools/lib/bpf/btf.h | 36 +
tools/lib/bpf/btf_iter.c | 177 +
tools/lib/bpf/btf_relocate.c | 519 ++
tools/lib/bpf/libbpf.c | 97 +-
tools/lib/bpf/libbpf.map | 4 +-
tools/lib/bpf/libbpf_internal.h | 29 +-
tools/lib/bpf/libbpf_probes.c | 1 +
tools/lib/bpf/linker.c | 58 +-
tools/perf/util/probe-finder.c | 4 +-
tools/sched_ext/.gitignore | 2 +
tools/sched_ext/Makefile | 246 +
tools/sched_ext/README.md | 270 +
.../sched_ext/include/bpf-compat/gnu/stubs.h | 11 +
tools/sched_ext/include/scx/common.bpf.h | 647 ++
tools/sched_ext/include/scx/common.h | 81 +
tools/sched_ext/include/scx/compat.bpf.h | 143 +
tools/sched_ext/include/scx/compat.h | 187 +
.../sched_ext/include/scx/enums.autogen.bpf.h | 105 +
tools/sched_ext/include/scx/enums.autogen.h | 41 +
tools/sched_ext/include/scx/enums.bpf.h | 12 +
tools/sched_ext/include/scx/enums.h | 27 +
tools/sched_ext/include/scx/user_exit_info.h | 118 +
tools/sched_ext/scx_central.bpf.c | 356 +
tools/sched_ext/scx_central.c | 145 +
tools/sched_ext/scx_flatcg.bpf.c | 954 +++
tools/sched_ext/scx_flatcg.c | 234 +
tools/sched_ext/scx_flatcg.h | 51 +
tools/sched_ext/scx_qmap.bpf.c | 827 ++
tools/sched_ext/scx_qmap.c | 155 +
tools/sched_ext/scx_show_state.py | 42 +
tools/sched_ext/scx_simple.bpf.c | 151 +
tools/sched_ext/scx_simple.c | 107 +
tools/testing/selftests/Makefile | 9 +-
tools/testing/selftests/bpf/.gitignore | 1 +
.../testing/selftests/bpf/bpf_experimental.h | 96 +
.../selftests/bpf/bpf_testmod/bpf_testmod.c | 160 +-
.../selftests/bpf/bpf_testmod/bpf_testmod.h | 61 +
.../bpf/bpf_testmod/bpf_testmod_kfunc.h | 9 +
.../selftests/bpf/prog_tests/bpf_iter.c | 44 +-
.../selftests/bpf/prog_tests/btf_distill.c | 692 ++
.../selftests/bpf/prog_tests/cgroup_iter.c | 33 +
.../bpf/prog_tests/global_func_dead_code.c | 60 +
.../testing/selftests/bpf/prog_tests/iters.c | 209 +
.../selftests/bpf/prog_tests/kfunc_call.c | 1 +
.../selftests/bpf/prog_tests/rcu_read_lock.c | 6 +
.../selftests/bpf/prog_tests/spin_lock.c | 2 +
.../prog_tests/test_struct_ops_maybe_null.c | 46 +
.../bpf/prog_tests/test_struct_ops_module.c | 86 +
.../prog_tests/test_struct_ops_multi_pages.c | 30 +
.../testing/selftests/bpf/prog_tests/timer.c | 4 +
.../selftests/bpf/prog_tests/verifier.c | 4 +
...f_iter_task_vma.c => bpf_iter_task_vmas.c} | 0
.../{bpf_iter_task.c => bpf_iter_tasks.c} | 0
.../bpf/progs/freplace_dead_global_func.c | 11 +
tools/testing/selftests/bpf/progs/iters_css.c | 72 +
.../selftests/bpf/progs/iters_css_task.c | 102 +
.../testing/selftests/bpf/progs/iters_task.c | 41 +
.../selftests/bpf/progs/iters_task_failure.c | 105 +
.../selftests/bpf/progs/iters_task_vma.c | 43 +
.../selftests/bpf/progs/iters_testmod_seq.c | 50 +
.../selftests/bpf/progs/kfunc_call_test.c | 37 +
.../selftests/bpf/progs/rcu_read_lock.c | 120 +
.../bpf/progs/struct_ops_maybe_null.c | 29 +
.../bpf/progs/struct_ops_maybe_null_fail.c | 24 +
.../selftests/bpf/progs/struct_ops_module.c | 37 +
.../bpf/progs/struct_ops_multi_pages.c | 102 +
.../selftests/bpf/progs/test_global_func12.c | 4 +-
.../selftests/bpf/progs/test_spin_lock.c | 65 +
.../selftests/bpf/progs/test_spin_lock_fail.c | 44 +
tools/testing/selftests/bpf/progs/timer.c | 63 +-
.../selftests/bpf/progs/verifier_bits_iter.c | 232 +
.../bpf/progs/verifier_global_subprogs.c | 101 +
.../selftests/bpf/progs/verifier_spin_lock.c | 2 +-
.../bpf/progs/verifier_subprog_precision.c | 4 +-
tools/testing/selftests/bpf/test_loader.c | 10 +-
tools/testing/selftests/bpf/test_maps.c | 18 +-
tools/testing/selftests/bpf/test_maps.h | 5 +
tools/testing/selftests/sched_ext/.gitignore | 6 +
tools/testing/selftests/sched_ext/Makefile | 211 +
tools/testing/selftests/sched_ext/config | 9 +
.../selftests/sched_ext/create_dsq.bpf.c | 58 +
.../testing/selftests/sched_ext/create_dsq.c | 57 +
.../sched_ext/ddsp_bogus_dsq_fail.bpf.c | 42 +
.../selftests/sched_ext/ddsp_bogus_dsq_fail.c | 60 +
.../sched_ext/ddsp_vtimelocal_fail.bpf.c | 39 +
.../sched_ext/ddsp_vtimelocal_fail.c | 59 +
.../selftests/sched_ext/dsp_local_on.bpf.c | 68 +
.../selftests/sched_ext/dsp_local_on.c | 60 +
.../sched_ext/enq_last_no_enq_fails.bpf.c | 29 +
.../sched_ext/enq_last_no_enq_fails.c | 64 +
.../sched_ext/enq_select_cpu_fails.bpf.c | 43 +
.../sched_ext/enq_select_cpu_fails.c | 61 +
tools/testing/selftests/sched_ext/exit.bpf.c | 86 +
tools/testing/selftests/sched_ext/exit.c | 64 +
tools/testing/selftests/sched_ext/exit_test.h | 20 +
.../testing/selftests/sched_ext/hotplug.bpf.c | 61 +
tools/testing/selftests/sched_ext/hotplug.c | 170 +
.../selftests/sched_ext/hotplug_test.h | 15 +
.../sched_ext/init_enable_count.bpf.c | 53 +
.../selftests/sched_ext/init_enable_count.c | 157 +
.../testing/selftests/sched_ext/maximal.bpf.c | 166 +
tools/testing/selftests/sched_ext/maximal.c | 54 +
.../selftests/sched_ext/maybe_null.bpf.c | 36 +
.../testing/selftests/sched_ext/maybe_null.c | 49 +
.../sched_ext/maybe_null_fail_dsp.bpf.c | 25 +
.../sched_ext/maybe_null_fail_yld.bpf.c | 28 +
.../testing/selftests/sched_ext/minimal.bpf.c | 21 +
tools/testing/selftests/sched_ext/minimal.c | 58 +
.../selftests/sched_ext/prog_run.bpf.c | 33 +
tools/testing/selftests/sched_ext/prog_run.c | 78 +
.../testing/selftests/sched_ext/reload_loop.c | 74 +
tools/testing/selftests/sched_ext/runner.c | 212 +
tools/testing/selftests/sched_ext/scx_test.h | 131 +
.../selftests/sched_ext/select_cpu_dfl.bpf.c | 40 +
.../selftests/sched_ext/select_cpu_dfl.c | 75 +
.../sched_ext/select_cpu_dfl_nodispatch.bpf.c | 89 +
.../sched_ext/select_cpu_dfl_nodispatch.c | 75 +
.../sched_ext/select_cpu_dispatch.bpf.c | 41 +
.../selftests/sched_ext/select_cpu_dispatch.c | 73 +
.../select_cpu_dispatch_bad_dsq.bpf.c | 37 +
.../sched_ext/select_cpu_dispatch_bad_dsq.c | 59 +
.../select_cpu_dispatch_dbl_dsp.bpf.c | 38 +
.../sched_ext/select_cpu_dispatch_dbl_dsp.c | 59 +
.../sched_ext/select_cpu_vtime.bpf.c | 92 +
.../selftests/sched_ext/select_cpu_vtime.c | 62 +
.../selftests/sched_ext/test_example.c | 49 +
tools/testing/selftests/sched_ext/util.c | 71 +
tools/testing/selftests/sched_ext/util.h | 13 +
263 files changed, 27732 insertions(+), 3787 deletions(-)
create mode 100644 Documentation/scheduler/sched-ext.rst
create mode 100644 include/asm-generic/cfi.h
create mode 100644 include/linux/sched/ext.h
create mode 100644 include/trace/events/sched_ext.h
delete mode 100644 kernel/bpf/bpf_struct_ops_types.h
create mode 100644 kernel/sched/ext.c
create mode 100644 kernel/sched/ext.h
create mode 100644 kernel/sched/ext_idle.c
create mode 100644 kernel/sched/ext_idle.h
create mode 100644 kernel/sched/syscalls.c
create mode 100644 scripts/Makefile.btf
delete mode 100755 scripts/pahole-flags.sh
create mode 100644 tools/lib/bpf/btf_iter.c
create mode 100644 tools/lib/bpf/btf_relocate.c
create mode 100644 tools/sched_ext/.gitignore
create mode 100644 tools/sched_ext/Makefile
create mode 100644 tools/sched_ext/README.md
create mode 100644 tools/sched_ext/include/bpf-compat/gnu/stubs.h
create mode 100644 tools/sched_ext/include/scx/common.bpf.h
create mode 100644 tools/sched_ext/include/scx/common.h
create mode 100644 tools/sched_ext/include/scx/compat.bpf.h
create mode 100644 tools/sched_ext/include/scx/compat.h
create mode 100644 tools/sched_ext/include/scx/enums.autogen.bpf.h
create mode 100644 tools/sched_ext/include/scx/enums.autogen.h
create mode 100644 tools/sched_ext/include/scx/enums.bpf.h
create mode 100644 tools/sched_ext/include/scx/enums.h
create mode 100644 tools/sched_ext/include/scx/user_exit_info.h
create mode 100644 tools/sched_ext/scx_central.bpf.c
create mode 100644 tools/sched_ext/scx_central.c
create mode 100644 tools/sched_ext/scx_flatcg.bpf.c
create mode 100644 tools/sched_ext/scx_flatcg.c
create mode 100644 tools/sched_ext/scx_flatcg.h
create mode 100644 tools/sched_ext/scx_qmap.bpf.c
create mode 100644 tools/sched_ext/scx_qmap.c
create mode 100644 tools/sched_ext/scx_show_state.py
create mode 100644 tools/sched_ext/scx_simple.bpf.c
create mode 100644 tools/sched_ext/scx_simple.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_distill.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_maybe_null.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_module.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_pages.c
rename tools/testing/selftests/bpf/progs/{bpf_iter_task_vma.c => bpf_iter_task_vmas.c} (100%)
rename tools/testing/selftests/bpf/progs/{bpf_iter_task.c => bpf_iter_tasks.c} (100%)
create mode 100644 tools/testing/selftests/bpf/progs/freplace_dead_global_func.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_css.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_css_task.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task_failure.c
create mode 100644 tools/testing/selftests/bpf/progs/iters_task_vma.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null_fail.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_module.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_multi_pages.c
create mode 100644 tools/testing/selftests/bpf/progs/verifier_bits_iter.c
create mode 100644 tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
create mode 100644 tools/testing/selftests/sched_ext/.gitignore
create mode 100644 tools/testing/selftests/sched_ext/Makefile
create mode 100644 tools/testing/selftests/sched_ext/config
create mode 100644 tools/testing/selftests/sched_ext/create_dsq.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/create_dsq.c
create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.c
create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.c
create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.c
create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.c
create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.c
create mode 100644 tools/testing/selftests/sched_ext/exit.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/exit.c
create mode 100644 tools/testing/selftests/sched_ext/exit_test.h
create mode 100644 tools/testing/selftests/sched_ext/hotplug.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/hotplug.c
create mode 100644 tools/testing/selftests/sched_ext/hotplug_test.h
create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.c
create mode 100644 tools/testing/selftests/sched_ext/maximal.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/maximal.c
create mode 100644 tools/testing/selftests/sched_ext/maybe_null.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/maybe_null.c
create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_dsp.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_yld.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/minimal.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/minimal.c
create mode 100644 tools/testing/selftests/sched_ext/prog_run.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/prog_run.c
create mode 100644 tools/testing/selftests/sched_ext/reload_loop.c
create mode 100644 tools/testing/selftests/sched_ext/runner.c
create mode 100644 tools/testing/selftests/sched_ext/scx_test.h
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.bpf.c
create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.c
create mode 100644 tools/testing/selftests/sched_ext/test_example.c
create mode 100644 tools/testing/selftests/sched_ext/util.c
create mode 100644 tools/testing/selftests/sched_ext/util.h
--
2.34.1
1
294
From: Chaitanya Kulkarni <ckulkarnilinux(a)gmail.com>
stable inclusion
from stable-v6.6.124
commit 7c54d3f5ebbc5982daaa004260242dc07ac943ea
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13892
CVE: CVE-2026-23261
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit d1877cc7270302081a315a81a0ee8331f19f95c8 ]
nvme_fabrics creates an NVMe/FC controller in following path:
nvmf_dev_write()
-> nvmf_create_ctrl()
-> nvme_fc_create_ctrl()
-> nvme_fc_init_ctrl()
nvme_fc_init_ctrl() allocates the admin blk-mq resources right after
nvme_add_ctrl() succeeds. If any of the subsequent steps fail (changing
the controller state, scheduling connect work, etc.), we jump to the
fail_ctrl path, which tears down the controller references but never
frees the admin queue/tag set. The leaked blk-mq allocations match the
kmemleak report seen during blktests nvme/fc.
Check ctrl->ctrl.admin_tagset in the fail_ctrl path and call
nvme_remove_admin_tag_set() when it is set so that all admin queue
allocations are reclaimed whenever controller setup aborts.
Reported-by: Yi Zhang <yi.zhang(a)redhat.com>
Reviewed-by: Justin Tee <justin.tee(a)broadcom.com>
Signed-off-by: Chaitanya Kulkarni <ckulkarnilinux(a)gmail.com>
Signed-off-by: Keith Busch <kbusch(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com>
---
drivers/nvme/host/fc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index db339f72ce62..745b3babb849 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -3546,6 +3546,8 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
ctrl->ctrl.opts = NULL;
+ if (ctrl->ctrl.admin_tagset)
+ nvme_remove_admin_tag_set(&ctrl->ctrl);
/* initiate nvme ctrl ref counting teardown */
nvme_uninit_ctrl(&ctrl->ctrl);
--
2.39.2
2
1
03 Apr '26
From: Daniel Hodges <git(a)danielhodges.dev>
stable inclusion
from stable-v6.6.130
commit 3c5c818c78b03a1725f3dcd566865c77b48dd3a6
category: bugfix
bugzilla: 13984
CVE: CVE-2026-23281
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0 ]
The lbs_free_adapter() function uses timer_delete() (non-synchronous)
for both command_timer and tx_lockup_timer before the structure is
freed. This is incorrect because timer_delete() does not wait for
any running timer callback to complete.
If a timer callback is executing when lbs_free_adapter() is called,
the callback will access freed memory since lbs_cfg_free() frees the
containing structure immediately after lbs_free_adapter() returns.
Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler)
access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields,
which would all be use-after-free violations.
Use timer_delete_sync() instead to ensure any running timer callback
has completed before returning.
This bug was introduced in commit 8f641d93c38a ("libertas: detect TX
lockups and reset hardware") where del_timer() was used instead of
del_timer_sync() in the cleanup path. The command_timer has had the
same issue since the driver was first written.
Fixes: 8f641d93c38a ("libertas: detect TX lockups and reset hardware")
Fixes: 954ee164f4f4 ("[PATCH] libertas: reorganize and simplify init sequence")
Cc: stable(a)vger.kernel.org
Signed-off-by: Daniel Hodges <git(a)danielhodges.dev>
Link: https://patch.msgid.link/20260206195356.15647-1-git@danielhodges.dev
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
[ del_timer() => timer_delete_sync() ]
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com>
---
drivers/net/wireless/marvell/libertas/main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c
index 78e8b5aecec0e..91b9501c6d8cb 100644
--- a/drivers/net/wireless/marvell/libertas/main.c
+++ b/drivers/net/wireless/marvell/libertas/main.c
@@ -881,8 +881,8 @@ static void lbs_free_adapter(struct lbs_private *priv)
{
lbs_free_cmd_buffer(priv);
kfifo_free(&priv->event_fifo);
- del_timer(&priv->command_timer);
- del_timer(&priv->tx_lockup_timer);
+ timer_delete_sync(&priv->command_timer);
+ timer_delete_sync(&priv->tx_lockup_timer);
del_timer(&priv->auto_deepsleep_timer);
}
--
2.43.0
2
1
[PATCH OLK-6.6] can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
by Wupeng Ma 03 Apr '26
by Wupeng Ma 03 Apr '26
03 Apr '26
From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
stable inclusion
from stable-v6.6.130
commit f6e90c113c92e83fc0963d5e60e16b0e8a268981
category: bugfix
bugzilla: 13957
CVE: CVE-2026-23324
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 5eaad4f768266f1f17e01232ffe2ef009f8129b7 upstream.
When submitting an urb, that is using the anchor pattern, it needs to be
anchored before submitting it otherwise it could be leaked if
usb_kill_anchored_urbs() is called. This logic is correctly done
elsewhere in the driver, except in the read bulk callback so do that
here also.
Cc: Vincent Mailhol <mailhol(a)kernel.org>
Cc: Marc Kleine-Budde <mkl(a)pengutronix.de>
Cc: stable(a)kernel.org
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Reviewed-by: Vincent Mailhol <mailhol(a)kernel.org>
Tested-by: Vincent Mailhol <mailhol(a)kernel.org>
Link: https://patch.msgid.link/2026022320-poser-stiffly-9d84@gregkh
Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces")
Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com>
---
drivers/net/can/usb/etas_es58x/es58x_core.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c
index bb49a2c0a9a5c..3edf06106f9d3 100644
--- a/drivers/net/can/usb/etas_es58x/es58x_core.c
+++ b/drivers/net/can/usb/etas_es58x/es58x_core.c
@@ -1461,12 +1461,18 @@ static void es58x_read_bulk_callback(struct urb *urb)
}
resubmit_urb:
+ usb_anchor_urb(urb, &es58x_dev->rx_urbs);
ret = usb_submit_urb(urb, GFP_ATOMIC);
+ if (!ret)
+ return;
+
+ usb_unanchor_urb(urb);
+
if (ret == -ENODEV) {
for (i = 0; i < es58x_dev->num_can_ch; i++)
if (es58x_dev->netdev[i])
netif_device_detach(es58x_dev->netdev[i]);
- } else if (ret)
+ } else
dev_err_ratelimited(dev,
"Failed resubmitting read bulk urb: %pe\n",
ERR_PTR(ret));
--
2.43.0
2
1
您好！
Kernel 邀请您参加 2026-04-03 14:00 召开的WeLink会议(自动录制)
会议主题：openEuler Kernel SIG双周例会
会议发起人： LiaoTao_Wave
会议内容：
1. 进展update
2. 议题征集中（新增议题可直接填写至会议看板）
会议链接：https://meeting.huaweicloud.com:36443/#/j/981797149
会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings
更多资讯尽在：https://www.openeuler.org/zh/
Hello!
Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-04-03 14:00
The subject of the conference is openEuler Kernel SIG双周例会
The sponsor of the conference is LiaoTao_Wave
Summary:
1. 进展update
2. 议题征集中（新增议题可直接填写至会议看板）
You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/981797149
Add topics at https://etherpad.openeuler.org/p/Kernel-meetings
More information: https://www.openeuler.org/en/
1
0