- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/8] xsched: XCU Partition
by Zicheng Qu 19 Nov '25

19 Nov '25

Alekseev Dmitry (2): xsched: Add XCU control group implementation and its backend in xsched CFS xsched: Add support for CFS quota for cgroups Konstantin Meskhidze (6): xsched: Add base vstream support xcu: Add base NPU driver support xsched: Introduce vstream management xsched: Add basic scheduler core support xsched: Add xsched RT class xsched: Add xsched CFS class arch/arm/tools/syscall.tbl | 2 +- arch/arm64/configs/openeuler_defconfig | 1 + arch/powerpc/kernel/syscalls/syscall.tbl | 2 +- arch/x86/configs/openeuler_defconfig | 1 + arch/x86/entry/syscalls/syscall_32.tbl | 2 +- arch/x86/entry/syscalls/syscall_64.tbl | 2 +- drivers/Makefile | 1 + drivers/xcu/Makefile | 2 + drivers/xcu/xcu_group.c | 380 +++++++++ include/linux/cgroup_subsys.h | 4 + include/linux/syscalls.h | 2 + include/linux/vstream.h | 91 ++ include/linux/xcu_group.h | 96 +++ include/linux/xsched.h | 514 ++++++++++++ include/uapi/asm-generic/unistd.h | 5 +- include/uapi/linux/xcu_vstream.h | 77 ++ init/Kconfig | 1 + kernel/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/xsched/Kconfig | 85 ++ kernel/xsched/Makefile | 9 + kernel/xsched/cfs.c | 237 ++++++ kernel/xsched/cfs_quota.c | 98 +++ kernel/xsched/cgroup.c | 775 ++++++++++++++++++ kernel/xsched/core.c | 526 ++++++++++++ kernel/xsched/rt.c | 281 +++++++ kernel/xsched/vstream.c | 674 +++++++++++++++ .../arch/powerpc/entry/syscalls/syscall.tbl | 2 +- .../arch/x86/entry/syscalls/syscall_64.tbl | 2 +- 29 files changed, 3866 insertions(+), 9 deletions(-) create mode 100644 drivers/xcu/Makefile create mode 100644 drivers/xcu/xcu_group.c create mode 100644 include/linux/vstream.h create mode 100644 include/linux/xcu_group.h create mode 100644 include/linux/xsched.h create mode 100644 include/uapi/linux/xcu_vstream.h create mode 100644 kernel/xsched/Kconfig create mode 100644 kernel/xsched/Makefile create mode 100644 kernel/xsched/cfs.c create mode 100644 kernel/xsched/cfs_quota.c create mode 100644 kernel/xsched/cgroup.c create mode 100644 kernel/xsched/core.c create mode 100644 kernel/xsched/rt.c create mode 100644 kernel/xsched/vstream.c -- 2.34.1

2 9

[PATCH OLK-6.6] mm: hugetlb: avoid soft lockup when mprotect to large memory area
by Tong Tiangen 19 Nov '25

19 Nov '25

From: Yang Shi <yang(a)os.amperecomputing.com> stable inclusion from stable-v6.6.112 commit 964598e6f70a1be9fe675280bf16b4f96b0a6809 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B8J CVE: CVE-2025-40153 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f52ce0ea90c83a28904c7cc203a70e6434adfecb upstream. When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed: watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916] CPU: 98 PID: 126916 Comm: t2_new_sysv Kdump: loaded Not tainted 6.17-rc7 Hardware name: GIGACOMPUTING R2A3-T40-AAV1/Jefferson CIO, BIOS 5.4.4.1 07/15/2025 pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mte_clear_page_tags+0x14/0x24 lr : mte_sync_tags+0x1c0/0x240 sp : ffff80003150bb80 x29: ffff80003150bb80 x28: ffff00739e9705a8 x27: 0000ffd2d6a00000 x26: 0000ff8e4bc00000 x25: 00e80046cde00f45 x24: 0000000000022458 x23: 0000000000000000 x22: 0000000000000004 x21: 000000011b380000 x20: ffff000000000000 x19: 000000011b379f40 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc875e0aa5e2c x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffc01ce7a5c00 x4 : 00000000046cde00 x3 : fffffc0000000000 x2 : 0000000000000004 x1 : 0000000000000040 x0 : ffff0046cde7c000 Call trace: mte_clear_page_tags+0x14/0x24 set_huge_pte_at+0x25c/0x280 hugetlb_change_protection+0x220/0x430 change_protection+0x5c/0x8c mprotect_fixup+0x10c/0x294 do_mprotect_pkey.constprop.0+0x2e0/0x3d4 __arm64_sys_mprotect+0x24/0x44 invoke_syscall+0x50/0x160 el0_svc_common+0x48/0x144 do_el0_svc+0x30/0xe0 el0_svc+0x30/0xf0 el0t_64_sync_handler+0xc4/0x148 el0t_64_sync+0x1a4/0x1a8 Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size. Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too. So add cond_resched() for hugetlb to avoid soft lockup. Link: https://lkml.kernel.org/r/20250929202402.1663290-1-yang@os.amperecomputing.… Fixes: 8f860591ffb2 ("[PATCH] Enable mprotect on huge pages") Signed-off-by: Yang Shi <yang(a)os.amperecomputing.com> Tested-by: Carl Worth <carl(a)os.amperecomputing.com> Reviewed-by: Christoph Lameter (Ampere) <cl(a)gentwo.org> Reviewed-by: Catalin Marinas <catalin.marinas(a)arm.com> Acked-by: David Hildenbrand <david(a)redhat.com> Acked-by: Oscar Salvador <osalvador(a)suse.de> Reviewed-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Reviewed-by: Dev Jain <dev.jain(a)arm.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Will Deacon <will(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- mm/hugetlb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index ead99b38472a..5234ee0615bb 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -7144,6 +7144,8 @@ long hugetlb_change_protection(struct vm_area_struct *vma, psize); } spin_unlock(ptl); + + cond_resched(); } /* * Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare -- 2.25.1

2 1

[PATCH OLK-6.6 0/3] Fix some bugs.
by Jinjie Ruan 19 Nov '25

19 Nov '25

Fix some bugs. Jinjie Ruan (3): xcall2.0: Fix module unload issue by fixing refcount xcall2.0: Fix the semantic changes and concurrency issues in xcall_enable xcall2.0: Fix stack-out-of-bounds bug in xcall_write() arch/arm64/kernel/xcall/core.c | 8 ++++++++ fs/proc/proc_xcall.c | 25 ++++++++++++++++++++----- include/linux/xcall.h | 2 ++ kernel/fork.c | 3 ++- 4 files changed, 32 insertions(+), 6 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] arch_numa: make node_reclaim_distance_setup static
by Wupeng Ma 19 Nov '25

19 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID4GC1 -------------------------------- Since node_reclaim_distance_setup is not used by others, make it static. Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202511151421.e3kZPnSA-lkp@intel.com/ Fixes: 5e5d40e65cb5 ("arch_numa: Make node reclaim distance adjustment always available") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/base/arch_numa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/base/arch_numa.c b/drivers/base/arch_numa.c index f1a86af00d25d..a280af59a821c 100644 --- a/drivers/base/arch_numa.c +++ b/drivers/base/arch_numa.c @@ -191,7 +191,7 @@ void __init setup_per_cpu_areas(void) #endif #define DISTANCE_MAX (1 << DISTANCE_BITS) -int __init node_reclaim_distance_setup(char *str) +static int __init node_reclaim_distance_setup(char *str) { int val; -- 2.43.0

2 1

[PATCH OLK-5.10] mm: proc: use per_vma mmap_lock for vma traversal.
by Qi Xi 19 Nov '25

19 Nov '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ID6KMQ -------------------------------- The current method of reading /proc/pid/numa_maps uses a global mmap_lock, which can block high-priority writers and therefore lead to low performance. The mmap_lock is held during vma traversal, acquired in m_start() and released in m_stop(). Now introduces a more fine-grained mmap_lock that next() releases and reacquires the lock between vma iterations. The fine-grained lock avoids priority inversion and improves concurrency. However, the output is non-atomic for the entire address space. Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- fs/proc/task_mmu.c | 113 +++++++++++++++++++++++++++++++++++++-- include/linux/pagewalk.h | 2 + mm/pagewalk.c | 27 ++++++++++ 3 files changed, 138 insertions(+), 4 deletions(-) diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 7b41f7c290ce..4370eb895e76 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -182,6 +182,102 @@ static void *m_next(struct seq_file *m, void *v, loff_t *ppos) return next; } +static void *numa_maps_next(struct seq_file *m, void *v, loff_t *ppos) +{ + struct proc_maps_private *priv = m->private; + struct vm_area_struct *next = NULL; + struct vm_area_struct *vma = v; + struct mm_struct *mm = priv->mm; + unsigned long last_vma_end; + unsigned long last_vma_start; + int ret; + + if (!mm) + goto out; + + if (vma == priv->tail_vma) + goto out; + + if (vma->vm_next) + next = vma->vm_next; + else + next = priv->tail_vma; + + last_vma_end = vma->vm_end; + last_vma_start = vma->vm_start; + if (mmap_lock_is_contended(mm)) { + mmap_read_unlock(mm); + ret = mmap_read_lock_killable(mm); + if (ret) { + mmput(mm); + put_task_struct(priv->task); + priv->task = NULL; + return ERR_PTR(ret); + } + + /* + * After dropping the lock, there are four cases to + * consider. See the following example for explanation. + * + * +------+------+-----------+ + * | VMA1 | VMA2 | VMA3 | + * +------+------+-----------+ + * | | | | + * 4k 8k 16k 400k + * + * Suppose we drop the lock after reading VMA2 due to + * contention, then we get: + * + * last_vma_end = 16k + * + * 1) VMA2 is freed, but VMA3 exists: + * + * find_vma(mm, 16k - 1) will return VMA3. + * In this case, just continue from VMA3. + * + * 2) VMA2 still exists: + * + * find_vma(mm, 16k - 1) will return VMA2. + * Iterate the loop like the original one. + * + * 3) No more VMAs can be found: + * + * find_vma(mm, 16k - 1) will return NULL. + * No more things to do, just break. + * + * 4) (last_vma_end - 1) is the middle of a vma (VMA'): + * + * find_vma(mm, 16k - 1) will return VMA' whose range + * contains last_vma_end. + * Iterate VMA' from last_vma_end. + */ + next = find_vma(mm, last_vma_end - 1); + + /* Case 3 above */ + if (!next) + goto out; + + /* Case 1 above */ + if (next->vm_start >= last_vma_end) + goto out; + + /* Case 4 above */ + if (next->vm_end > last_vma_end) { + *ppos = last_vma_end; + return next; + } + + /* Case 2 above */ + if (next->vm_next) + next = next->vm_next; + else + next = priv->tail_vma; + } +out: + *ppos = next ? next->vm_start : -1UL; + return next; +} + static void m_stop(struct seq_file *m, void *v) { struct proc_maps_private *priv = m->private; @@ -2260,6 +2356,7 @@ static int show_numa_map(struct seq_file *m, void *v) struct mempolicy *pol; char buffer[64]; int nid; + unsigned long start_addr; if (!mm) return 0; @@ -2267,7 +2364,15 @@ static int show_numa_map(struct seq_file *m, void *v) /* Ensure we start with an empty set of numa_maps statistics. */ memset(md, 0, sizeof(*md)); - pol = __get_vma_policy(vma, vma->vm_start); + start_addr = max_t(unsigned long, vma->vm_start, m->index); + if (start_addr >= vma->vm_end) { + VM_WARN_ONCE(1, + "invalid range: start_addr=%p vma=[%p-%p]\n", + (void *)start_addr, (void *)vma->vm_start, (void *)vma->vm_end); + return 0; + } + + pol = __get_vma_policy(vma, start_addr); if (pol) { mpol_to_str(buffer, sizeof(buffer), pol); mpol_cond_put(pol); @@ -2275,7 +2380,7 @@ static int show_numa_map(struct seq_file *m, void *v) mpol_to_str(buffer, sizeof(buffer), proc_priv->task_mempolicy); } - seq_printf(m, "%08lx %s", vma->vm_start, buffer); + seq_printf(m, "%08lx %s", start_addr, buffer); if (file) { seq_puts(m, " file="); @@ -2290,7 +2395,7 @@ static int show_numa_map(struct seq_file *m, void *v) seq_puts(m, " huge"); /* mmap_lock is held by m_start */ - walk_page_vma(vma, &show_numa_ops, md); + walk_page_vma_range(vma, start_addr, &show_numa_ops, md); if (!md->pages) goto out; @@ -2328,7 +2433,7 @@ static int show_numa_map(struct seq_file *m, void *v) static const struct seq_operations proc_pid_numa_maps_op = { .start = m_start, - .next = m_next, + .next = numa_maps_next, .stop = m_stop, .show = show_numa_map, }; diff --git a/include/linux/pagewalk.h b/include/linux/pagewalk.h index b1cb6b753abb..9b8e2586cfc2 100644 --- a/include/linux/pagewalk.h +++ b/include/linux/pagewalk.h @@ -101,6 +101,8 @@ int walk_page_range_novma(struct mm_struct *mm, unsigned long start, void *private); int walk_page_vma(struct vm_area_struct *vma, const struct mm_walk_ops *ops, void *private); +int walk_page_vma_range(struct vm_area_struct *vma, unsigned long start_addr, + const struct mm_walk_ops *ops, void *private); int walk_page_mapping(struct address_space *mapping, pgoff_t first_index, pgoff_t nr, const struct mm_walk_ops *ops, void *private); diff --git a/mm/pagewalk.c b/mm/pagewalk.c index 6a4212cf00ba..12032258d1ec 100644 --- a/mm/pagewalk.c +++ b/mm/pagewalk.c @@ -485,6 +485,33 @@ int walk_page_vma(struct vm_area_struct *vma, const struct mm_walk_ops *ops, return __walk_page_range(vma->vm_start, vma->vm_end, &walk); } +int walk_page_vma_range(struct vm_area_struct *vma, unsigned long start_addr, + const struct mm_walk_ops *ops, void *private) +{ + struct mm_walk walk = { + .ops = ops, + .mm = vma->vm_mm, + .vma = vma, + .private = private, + }; + int err; + + if (!walk.mm) + return -EINVAL; + + if (start_addr < vma->vm_start || start_addr >= vma->vm_end) + return -EINVAL; + + mmap_assert_locked(walk.mm); + + err = walk_page_test(start_addr, vma->vm_end, &walk); + if (err > 0) + return 0; + if (err < 0) + return err; + return __walk_page_range(start_addr, vma->vm_end, &walk); +} + /** * walk_page_mapping - walk all memory areas mapped into a struct address_space. * @mapping: Pointer to the struct address_space -- 2.33.0

2 1

[PATCH OLK-5.10] mm: proc: use per_vma mmap_lock for vma traversal.
by Qi Xi 19 Nov '25

19 Nov '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ID6KMQ -------------------------------- The current method of reading /proc/pid/numa_maps uses a global mmap_lock, which can block high-priority writers and therefore lead to low performance. The mmap_lock is held during vma traversal, acquired in m_start() and released in m_stop(). Now introduces a more fine-grained mmap_lock that next() releases and reacquires the lock between vma iterations. The fine-grained lock avoids priority inversion and improves concurrency. However, the output is non-atomic for the entire address space. Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- fs/proc/task_mmu.c | 113 +++++++++++++++++++++++++++++++++++++-- include/linux/pagewalk.h | 2 + mm/pagewalk.c | 27 ++++++++++ 3 files changed, 138 insertions(+), 4 deletions(-) diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 7b41f7c290ce..4370eb895e76 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -182,6 +182,102 @@ static void *m_next(struct seq_file *m, void *v, loff_t *ppos) return next; } +static void *numa_maps_next(struct seq_file *m, void *v, loff_t *ppos) +{ + struct proc_maps_private *priv = m->private; + struct vm_area_struct *next = NULL; + struct vm_area_struct *vma = v; + struct mm_struct *mm = priv->mm; + unsigned long last_vma_end; + unsigned long last_vma_start; + int ret; + + if (!mm) + goto out; + + if (vma == priv->tail_vma) + goto out; + + if (vma->vm_next) + next = vma->vm_next; + else + next = priv->tail_vma; + + last_vma_end = vma->vm_end; + last_vma_start = vma->vm_start; + if (mmap_lock_is_contended(mm)) { + mmap_read_unlock(mm); + ret = mmap_read_lock_killable(mm); + if (ret) { + mmput(mm); + put_task_struct(priv->task); + priv->task = NULL; + return ERR_PTR(ret); + } + + /* + * After dropping the lock, there are four cases to + * consider. See the following example for explanation. + * + * +------+------+-----------+ + * | VMA1 | VMA2 | VMA3 | + * +------+------+-----------+ + * | | | | + * 4k 8k 16k 400k + * + * Suppose we drop the lock after reading VMA2 due to + * contention, then we get: + * + * last_vma_end = 16k + * + * 1) VMA2 is freed, but VMA3 exists: + * + * find_vma(mm, 16k - 1) will return VMA3. + * In this case, just continue from VMA3. + * + * 2) VMA2 still exists: + * + * find_vma(mm, 16k - 1) will return VMA2. + * Iterate the loop like the original one. + * + * 3) No more VMAs can be found: + * + * find_vma(mm, 16k - 1) will return NULL. + * No more things to do, just break. + * + * 4) (last_vma_end - 1) is the middle of a vma (VMA'): + * + * find_vma(mm, 16k - 1) will return VMA' whose range + * contains last_vma_end. + * Iterate VMA' from last_vma_end. + */ + next = find_vma(mm, last_vma_end - 1); + + /* Case 3 above */ + if (!next) + goto out; + + /* Case 1 above */ + if (next->vm_start >= last_vma_end) + goto out; + + /* Case 4 above */ + if (next->vm_end > last_vma_end) { + *ppos = last_vma_end; + return next; + } + + /* Case 2 above */ + if (next->vm_next) + next = next->vm_next; + else + next = priv->tail_vma; + } +out: + *ppos = next ? next->vm_start : -1UL; + return next; +} + static void m_stop(struct seq_file *m, void *v) { struct proc_maps_private *priv = m->private; @@ -2260,6 +2356,7 @@ static int show_numa_map(struct seq_file *m, void *v) struct mempolicy *pol; char buffer[64]; int nid; + unsigned long start_addr; if (!mm) return 0; @@ -2267,7 +2364,15 @@ static int show_numa_map(struct seq_file *m, void *v) /* Ensure we start with an empty set of numa_maps statistics. */ memset(md, 0, sizeof(*md)); - pol = __get_vma_policy(vma, vma->vm_start); + start_addr = max_t(unsigned long, vma->vm_start, m->index); + if (start_addr >= vma->vm_end) { + VM_WARN_ONCE(1, + "invalid range: start_addr=%p vma=[%p-%p]\n", + (void *)start_addr, (void *)vma->vm_start, (void *)vma->vm_end); + return 0; + } + + pol = __get_vma_policy(vma, start_addr); if (pol) { mpol_to_str(buffer, sizeof(buffer), pol); mpol_cond_put(pol); @@ -2275,7 +2380,7 @@ static int show_numa_map(struct seq_file *m, void *v) mpol_to_str(buffer, sizeof(buffer), proc_priv->task_mempolicy); } - seq_printf(m, "%08lx %s", vma->vm_start, buffer); + seq_printf(m, "%08lx %s", start_addr, buffer); if (file) { seq_puts(m, " file="); @@ -2290,7 +2395,7 @@ static int show_numa_map(struct seq_file *m, void *v) seq_puts(m, " huge"); /* mmap_lock is held by m_start */ - walk_page_vma(vma, &show_numa_ops, md); + walk_page_vma_range(vma, start_addr, &show_numa_ops, md); if (!md->pages) goto out; @@ -2328,7 +2433,7 @@ static int show_numa_map(struct seq_file *m, void *v) static const struct seq_operations proc_pid_numa_maps_op = { .start = m_start, - .next = m_next, + .next = numa_maps_next, .stop = m_stop, .show = show_numa_map, }; diff --git a/include/linux/pagewalk.h b/include/linux/pagewalk.h index b1cb6b753abb..9b8e2586cfc2 100644 --- a/include/linux/pagewalk.h +++ b/include/linux/pagewalk.h @@ -101,6 +101,8 @@ int walk_page_range_novma(struct mm_struct *mm, unsigned long start, void *private); int walk_page_vma(struct vm_area_struct *vma, const struct mm_walk_ops *ops, void *private); +int walk_page_vma_range(struct vm_area_struct *vma, unsigned long start_addr, + const struct mm_walk_ops *ops, void *private); int walk_page_mapping(struct address_space *mapping, pgoff_t first_index, pgoff_t nr, const struct mm_walk_ops *ops, void *private); diff --git a/mm/pagewalk.c b/mm/pagewalk.c index 6a4212cf00ba..12032258d1ec 100644 --- a/mm/pagewalk.c +++ b/mm/pagewalk.c @@ -485,6 +485,33 @@ int walk_page_vma(struct vm_area_struct *vma, const struct mm_walk_ops *ops, return __walk_page_range(vma->vm_start, vma->vm_end, &walk); } +int walk_page_vma_range(struct vm_area_struct *vma, unsigned long start_addr, + const struct mm_walk_ops *ops, void *private) +{ + struct mm_walk walk = { + .ops = ops, + .mm = vma->vm_mm, + .vma = vma, + .private = private, + }; + int err; + + if (!walk.mm) + return -EINVAL; + + if (start_addr < vma->vm_start || start_addr >= vma->vm_end) + return -EINVAL; + + mmap_assert_locked(walk.mm); + + err = walk_page_test(start_addr, vma->vm_end, &walk); + if (err > 0) + return 0; + if (err < 0) + return err; + return __walk_page_range(start_addr, vma->vm_end, &walk); +} + /** * walk_page_mapping - walk all memory areas mapped into a struct address_space. * @mapping: Pointer to the struct address_space -- 2.33.0

2 1

[PATCH OLK-6.6 0/8] xsched: XCU Partition
by Zicheng Qu 19 Nov '25

19 Nov '25

Alekseev Dmitry (2): xsched: Add XCU control group implementation and its backend in xsched CFS xsched: Add support for CFS quota for cgroups Konstantin Meskhidze (6): xsched: Add base vstream support xcu: Add base NPU driver support xsched: Introduce vstream management xsched: Add basic scheduler core support xsched: Add xsched RT class xsched: Add xsched CFS class arch/arm/tools/syscall.tbl | 2 +- arch/arm64/configs/openeuler_defconfig | 2 + arch/powerpc/kernel/syscalls/syscall.tbl | 2 +- arch/x86/configs/openeuler_defconfig | 2 + arch/x86/entry/syscalls/syscall_32.tbl | 2 +- arch/x86/entry/syscalls/syscall_64.tbl | 2 +- drivers/Makefile | 1 + drivers/xcu/Makefile | 2 + drivers/xcu/xcu_group.c | 380 +++++++++ include/linux/cgroup_subsys.h | 4 + include/linux/syscalls.h | 2 + include/linux/vstream.h | 91 ++ include/linux/xcu_group.h | 96 +++ include/linux/xsched.h | 514 ++++++++++++ include/uapi/asm-generic/unistd.h | 5 +- include/uapi/linux/xcu_vstream.h | 77 ++ init/Kconfig | 1 + kernel/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/xsched/Kconfig | 85 ++ kernel/xsched/Makefile | 9 + kernel/xsched/cfs.c | 237 ++++++ kernel/xsched/cfs_quota.c | 98 +++ kernel/xsched/cgroup.c | 775 ++++++++++++++++++ kernel/xsched/core.c | 526 ++++++++++++ kernel/xsched/rt.c | 281 +++++++ kernel/xsched/vstream.c | 674 +++++++++++++++ .../arch/powerpc/entry/syscalls/syscall.tbl | 2 +- .../arch/x86/entry/syscalls/syscall_64.tbl | 2 +- 29 files changed, 3868 insertions(+), 9 deletions(-) create mode 100644 drivers/xcu/Makefile create mode 100644 drivers/xcu/xcu_group.c create mode 100644 include/linux/vstream.h create mode 100644 include/linux/xcu_group.h create mode 100644 include/linux/xsched.h create mode 100644 include/uapi/linux/xcu_vstream.h create mode 100644 kernel/xsched/Kconfig create mode 100644 kernel/xsched/Makefile create mode 100644 kernel/xsched/cfs.c create mode 100644 kernel/xsched/cfs_quota.c create mode 100644 kernel/xsched/cgroup.c create mode 100644 kernel/xsched/core.c create mode 100644 kernel/xsched/rt.c create mode 100644 kernel/xsched/vstream.c -- 2.34.1

2 9

[PATCH OLK-6.6] blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
by Zheng Qixing 19 Nov '25

19 Nov '25

From: Li Nan <linan122(a)huawei.com> mainline inclusion from mainline-v6.18-rc1 commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B4D CVE: CVE-2025-40125 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ In __blk_mq_update_nr_hw_queues() the return value of blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx fails, later changing the number of hw_queues or removing disk will trigger the following warning: kernfs: can not remove 'nr_tags', no directory WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 Call Trace: remove_files.isra.1+0x38/0xb0 sysfs_remove_group+0x4d/0x100 sysfs_remove_groups+0x31/0x60 __kobject_del+0x23/0xf0 kobject_del+0x17/0x40 blk_mq_unregister_hctx+0x5d/0x80 blk_mq_sysfs_unregister_hctxs+0x94/0xd0 blk_mq_update_nr_hw_queues+0x124/0x760 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_submit_queues_store+0x92/0x120 [null_blk] kobjct_del() was called unconditionally even if sysfs creation failed. Fix it by checkig the kobject creation statusbefore deleting it. Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues") Signed-off-by: Li Nan <linan122(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-mq-sysfs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c index 156e9bb07abf..2fb234ab467b 100644 --- a/block/blk-mq-sysfs.c +++ b/block/blk-mq-sysfs.c @@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx) return; hctx_for_each_ctx(hctx, ctx, i) - kobject_del(&ctx->kobj); + if (ctx->kobj.state_in_sysfs) + kobject_del(&ctx->kobj); - kobject_del(&hctx->kobj); + if (hctx->kobj.state_in_sysfs) + kobject_del(&hctx->kobj); } static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
by Zheng Qixing 19 Nov '25

19 Nov '25

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v4.19.276 commit a156a262c543fa5ff30bcb2fc6ad1a95cb4ab57a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID43SW CVE: CVE-2023-7324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit db95d4df71cb55506425b6e4a5f8d68e3a765b63 upstream. Sanitize possible addl_desc_ptr out-of-bounds accesses in ses_enclosure_data_process(). Link: https://lore.kernel.org/r/20230202162451.15346-3-thenzl@redhat.com Cc: stable(a)vger.kernel.org Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/scsi/ses.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/ses.c | 35 ++++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-) diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c index 6ef1e12a2fce..b42c0bb8caa9 100644 --- a/drivers/scsi/ses.c +++ b/drivers/scsi/ses.c @@ -435,8 +435,8 @@ int ses_match_host(struct enclosure_device *edev, void *data) } #endif /* 0 */ -static void ses_process_descriptor(struct enclosure_component *ecomp, - unsigned char *desc) +static int ses_process_descriptor(struct enclosure_component *ecomp, + unsigned char *desc, int max_desc_len) { int eip = desc[0] & 0x10; int invalid = desc[0] & 0x80; @@ -447,22 +447,32 @@ static void ses_process_descriptor(struct enclosure_component *ecomp, unsigned char *d; if (invalid) - return; + return 0; switch (proto) { case SCSI_PROTOCOL_FCP: if (eip) { + if (max_desc_len <= 7) + return 1; d = desc + 4; slot = d[3]; } break; case SCSI_PROTOCOL_SAS: + if (eip) { + if (max_desc_len <= 27) + return 1; d = desc + 4; slot = d[3]; d = desc + 8; - } else + } else { + if (max_desc_len <= 23) + return 1; d = desc + 4; + } + + /* only take the phy0 addr */ addr = (u64)d[12] << 56 | (u64)d[13] << 48 | @@ -479,6 +489,8 @@ static void ses_process_descriptor(struct enclosure_component *ecomp, } ecomp->slot = slot; scomp->addr = addr; + + return 0; } struct efd { @@ -548,7 +560,7 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, /* skip past overall descriptor */ desc_ptr += len + 4; } - if (ses_dev->page10) + if (ses_dev->page10 && ses_dev->page10_len > 9) addl_desc_ptr = ses_dev->page10 + 8; type_ptr = ses_dev->page1_types; components = 0; @@ -556,6 +568,7 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, for (j = 0; j < type_ptr[1]; j++) { char *name = NULL; struct enclosure_component *ecomp; + int max_desc_len; if (desc_ptr) { if (desc_ptr + 3 >= buf + page7_len) { @@ -588,10 +601,14 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, ecomp = ERR_PTR(-EINVAL); if (!IS_ERR(ecomp)) { - if (addl_desc_ptr) - ses_process_descriptor( - ecomp, - addl_desc_ptr); + if (addl_desc_ptr) { + max_desc_len = ses_dev->page10_len - + (addl_desc_ptr - ses_dev->page10); + if (ses_process_descriptor(ecomp, + addl_desc_ptr, + max_desc_len)) + addl_desc_ptr = NULL; + } if (create) enclosure_component_register( ecomp); -- 2.39.2

2 1

[PATCH OLK-6.6 0/8] xsched: XCU Partition
by Zicheng Qu 19 Nov '25

19 Nov '25

Alekseev Dmitry (2): xsched: Add XCU control group implementation and its backend in xsched CFS xsched: Add support for CFS quota for cgroups Konstantin Meskhidze (6): xsched: Add base vstream support xcu: Add base NPU driver support xsched: Introduce vstream management xsched: Add basic scheduler core support xsched: Add xsched RT class xsched: Add xsched CFS class arch/arm/tools/syscall.tbl | 2 +- arch/arm64/configs/openeuler_defconfig | 1 + arch/powerpc/kernel/syscalls/syscall.tbl | 2 +- arch/x86/configs/openeuler_defconfig | 1 + arch/x86/entry/syscalls/syscall_32.tbl | 2 +- arch/x86/entry/syscalls/syscall_64.tbl | 2 +- drivers/Makefile | 1 + drivers/xcu/Makefile | 2 + drivers/xcu/xcu_group.c | 380 +++++++++ include/linux/cgroup_subsys.h | 4 + include/linux/syscalls.h | 2 + include/linux/vstream.h | 91 ++ include/linux/xcu_group.h | 96 +++ include/linux/xsched.h | 514 ++++++++++++ include/uapi/asm-generic/unistd.h | 5 +- include/uapi/linux/xcu_vstream.h | 77 ++ init/Kconfig | 1 + kernel/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/xsched/Kconfig | 85 ++ kernel/xsched/Makefile | 9 + kernel/xsched/cfs.c | 237 ++++++ kernel/xsched/cfs_quota.c | 98 +++ kernel/xsched/cgroup.c | 775 ++++++++++++++++++ kernel/xsched/core.c | 526 ++++++++++++ kernel/xsched/rt.c | 281 +++++++ kernel/xsched/vstream.c | 674 +++++++++++++++ .../arch/powerpc/entry/syscalls/syscall.tbl | 2 +- .../arch/x86/entry/syscalls/syscall_64.tbl | 2 +- 29 files changed, 3866 insertions(+), 9 deletions(-) create mode 100644 drivers/xcu/Makefile create mode 100644 drivers/xcu/xcu_group.c create mode 100644 include/linux/vstream.h create mode 100644 include/linux/xcu_group.h create mode 100644 include/linux/xsched.h create mode 100644 include/uapi/linux/xcu_vstream.h create mode 100644 kernel/xsched/Kconfig create mode 100644 kernel/xsched/Makefile create mode 100644 kernel/xsched/cfs.c create mode 100644 kernel/xsched/cfs_quota.c create mode 100644 kernel/xsched/cgroup.c create mode 100644 kernel/xsched/core.c create mode 100644 kernel/xsched/rt.c create mode 100644 kernel/xsched/vstream.c -- 2.34.1

2 9