- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] mm: Backport two patch
by Liu Shixin 01 Mar '25

01 Mar '25

Anshuman Khandual (2): arm64/mm: Re-organize arch_make_huge_pte() arm64/mm: Drop setting PTE_TYPE_PAGE in pte_mkcont() arch/arm64/include/asm/pgtable.h | 8 +------- arch/arm64/mm/hugetlbpage.c | 21 ++++++++++++++++----- 2 files changed, 17 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] nfsd: clear acl_access/acl_default after releasing them
by Li Lingfeng 01 Mar '25

01 Mar '25

stable inclusion from stable-v6.6.79 commit 55d947315fb5f67a35e4e1d3e01bb886b9c6decf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC30 CVE: CVE-2025-21796 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7faf14a7b0366f153284db0ad3347c457ea70136 upstream. If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a pointer pointing to the released posix_acl, which will trigger a WARNING in nfs3svc_release_getacl like this: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 26 PID: 3199 at lib/refcount.c:28 refcount_warn_saturate+0xb5/0x170 Modules linked in: CPU: 26 UID: 0 PID: 3199 Comm: nfsd Not tainted 6.12.0-rc6-00079-g04ae226af01f-dirty #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcount_warn_saturate+0xb5/0x170 Code: cc cc 0f b6 1d b3 20 a5 03 80 fb 01 0f 87 65 48 d8 00 83 e3 01 75 e4 48 c7 c7 c0 3b 9b 85 c6 05 97 20 a5 03 01 e8 fb 3e 30 ff <0f> 0b eb cd 0f b6 1d 8a3 RSP: 0018:ffffc90008637cd8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff83904fde RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88871ed36380 RBP: ffff888158beeb40 R08: 0000000000000001 R09: fffff520010c6f56 R10: ffffc90008637ab7 R11: 0000000000000001 R12: 0000000000000001 R13: ffff888140e77400 R14: ffff888140e77408 R15: ffffffff858b42c0 FS: 0000000000000000(0000) GS:ffff88871ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000562384d32158 CR3: 000000055cc6a000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? refcount_warn_saturate+0xb5/0x170 ? __warn+0xa5/0x140 ? refcount_warn_saturate+0xb5/0x170 ? report_bug+0x1b1/0x1e0 ? handle_bug+0x53/0xa0 ? exc_invalid_op+0x17/0x40 ? asm_exc_invalid_op+0x1a/0x20 ? tick_nohz_tick_stopped+0x1e/0x40 ? refcount_warn_saturate+0xb5/0x170 ? refcount_warn_saturate+0xb5/0x170 nfs3svc_release_getacl+0xc9/0xe0 svc_process_common+0x5db/0xb60 ? __pfx_svc_process_common+0x10/0x10 ? __rcu_read_unlock+0x69/0xa0 ? __pfx_nfsd_dispatch+0x10/0x10 ? svc_xprt_received+0xa1/0x120 ? xdr_init_decode+0x11d/0x190 svc_process+0x2a7/0x330 svc_handle_xprt+0x69d/0x940 svc_recv+0x180/0x2d0 nfsd+0x168/0x200 ? __pfx_nfsd+0x10/0x10 kthread+0x1a2/0x1e0 ? kthread+0xf4/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ... Clear acl_access/acl_default after posix_acl_release is called to prevent UAF from being triggered. Fixes: a257cdd0e217 ("[PATCH] NFSD: Add server support for NFSv3 ACLs.") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20241107014705.2509463-1-lilingfeng@huaweicloud… Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Rick Macklem <rmacklem(a)uoguelph.ca> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs2acl.c | 2 ++ fs/nfsd/nfs3acl.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c index 12b2b9bc07bf..f1f32ad4f42c 100644 --- a/fs/nfsd/nfs2acl.c +++ b/fs/nfsd/nfs2acl.c @@ -84,6 +84,8 @@ static __be32 nfsacld_proc_getacl(struct svc_rqst *rqstp) fail: posix_acl_release(resp->acl_access); posix_acl_release(resp->acl_default); + resp->acl_access = NULL; + resp->acl_default = NULL; goto out; } diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c index 73adca47d373..d7af28f44504 100644 --- a/fs/nfsd/nfs3acl.c +++ b/fs/nfsd/nfs3acl.c @@ -76,6 +76,8 @@ static __be32 nfsd3_proc_getacl(struct svc_rqst *rqstp) fail: posix_acl_release(resp->acl_access); posix_acl_release(resp->acl_default); + resp->acl_access = NULL; + resp->acl_default = NULL; goto out; } -- 2.31.1

2 1

[PATCH OLK-6.6] NFSD: fix hang in nfsd4_shutdown_callback
by Li Lingfeng 01 Mar '25

01 Mar '25

From: Dai Ngo <dai.ngo(a)oracle.com> mainline inclusion from mainline-v6.14-rc3 commit 036ac2778f7b28885814c6fbc07e156ad1624d03 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4R CVE: CVE-2025-21795 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 036ac2778f7b28885814c6fbc07e156ad1624d03 upstream. If nfs4_client is in courtesy state then there is no point to send the callback. This causes nfsd4_shutdown_callback to hang since cl_cb_inflight is not 0. This hang lasts about 15 minutes until TCP notifies NFSD that the connection was dropped. This patch modifies nfsd4_run_cb_work to skip the RPC call if nfs4_client is in courtesy state. Signed-off-by: Dai Ngo <dai.ngo(a)oracle.com> Fixes: 66af25799940 ("NFSD: add courteous server support for thread with only delegation") Cc: stable(a)vger.kernel.org Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4callback.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c index 875ea311ca3c..d47173d98eef 100644 --- a/fs/nfsd/nfs4callback.c +++ b/fs/nfsd/nfs4callback.c @@ -1410,8 +1410,11 @@ nfsd4_run_cb_work(struct work_struct *work) nfsd4_process_cb_update(cb); clnt = clp->cl_cb_client; - if (!clnt) { - /* Callback channel broken, or client killed; give up: */ + if (!clnt || clp->cl_state == NFSD4_COURTESY) { + /* + * Callback channel broken, client killed or + * nfs4_client in courtesy state; give up. + */ nfsd41_destroy_cb(cb); return; } -- 2.31.1

2 1

[PATCH OLK-6.6] orangefs: fix a oob in orangefs_debug_write
by Yifan Qiao 01 Mar '25

01 Mar '25

From: Mike Marshall <hubcap(a)omnibond.com> mainline inclusion from mainline-v6.14-rc1 commit f7c848431632598ff9bce57a659db6af60d75b39 category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made this patch. Signed-off-by: Mike Marshall <hubcap(a)omnibond.com> Reported-by: syzbot+fc519d7875f2d9186c1f(a)syzkaller.appspotmail.com Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/orangefs/orangefs-debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c index 1b508f543384..fa41db088488 100644 --- a/fs/orangefs/orangefs-debugfs.c +++ b/fs/orangefs/orangefs-debugfs.c @@ -393,9 +393,9 @@ static ssize_t orangefs_debug_write(struct file *file, * Thwart users who try to jamb a ridiculous number * of bytes into the debug file... */ - if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) { + if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) { silly = count; - count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1; + count = ORANGEFS_MAX_DEBUG_STRING_LEN; } buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL); -- 2.39.2

2 1

[PATCH OLK-6.6] NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
by Li Lingfeng 01 Mar '25

01 Mar '25

From: Zichen Xie <zichenxie0106(a)gmail.com> stable inclusion from stable-v6.6.79 commit 19b3ca651b4b473878c73539febe477905041442 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5M CVE: CVE-2024-54456 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 49fd4e34751e90e6df009b70cd0659dc839e7ca8 ] name is char[64] where the size of clnt->cl_program->name remains unknown. Invoking strcat() directly will also lead to potential buffer overflow. Change them to strscpy() and strncat() to fix potential issues. Signed-off-by: Zichen Xie <zichenxie0106(a)gmail.com> Reviewed-by: Benjamin Coddington <bcodding(a)redhat.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/sysfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nfs/sysfs.c b/fs/nfs/sysfs.c index bf378ecd5d9f..7b59a40d40c0 100644 --- a/fs/nfs/sysfs.c +++ b/fs/nfs/sysfs.c @@ -280,9 +280,9 @@ void nfs_sysfs_link_rpc_client(struct nfs_server *server, char name[RPC_CLIENT_NAME_SIZE]; int ret; - strcpy(name, clnt->cl_program->name); - strcat(name, uniq ? uniq : ""); - strcat(name, "_client"); + strscpy(name, clnt->cl_program->name, sizeof(name)); + strncat(name, uniq ? uniq : "", sizeof(name) - strlen(name) - 1); + strncat(name, "_client", sizeof(name) - strlen(name) - 1); ret = sysfs_create_link_nowarn(&server->kobj, &clnt->cl_sysfs->kobject, name); -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] blk-iolatency: Fix inflight count imbalances and IO hangs on offline
by Tengda Wu 28 Feb '25

28 Feb '25

From: Tejun Heo <tj(a)kernel.org> stable inclusion from stable-v4.19.247 commit 515d077ee3085ae343b6bea7fd031f9906645f38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1WU CVE: CVE-2022-49394 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8a177a36da6c54c98b8685d4f914cb3637d53c0d upstream. iolatency needs to track the number of inflight IOs per cgroup. As this tracking can be expensive, it is disabled when no cgroup has iolatency configured for the device. To ensure that the inflight counters stay balanced, iolatency_set_limit() freezes the request_queue while manipulating the enabled counter, which ensures that no IO is in flight and thus all counters are zero. Unfortunately, iolatency_set_limit() isn't the only place where the enabled counter is manipulated. iolatency_pd_offline() can also dec the counter and trigger disabling. As this disabling happens without freezing the q, this can easily happen while some IOs are in flight and thus leak the counts. This can be easily demonstrated by turning on iolatency on an one empty cgroup while IOs are in flight in other cgroups and then removing the cgroup. Note that iolatency shouldn't have been enabled elsewhere in the system to ensure that removing the cgroup disables iolatency for the whole device. The following keeps flipping on and off iolatency on sda: echo +io > /sys/fs/cgroup/cgroup.subtree_control while true; do mkdir -p /sys/fs/cgroup/test echo '8:0 target=100000' > /sys/fs/cgroup/test/io.latency sleep 1 rmdir /sys/fs/cgroup/test sleep 1 done and there's concurrent fio generating direct rand reads: fio --name test --filename=/dev/sda --direct=1 --rw=randread \ --runtime=600 --time_based --iodepth=256 --numjobs=4 --bs=4k while monitoring with the following drgn script: while True: for css in css_for_each_descendant_pre(prog['blkcg_root'].css.address_of_()): for pos in hlist_for_each(container_of(css, 'struct blkcg', 'css').blkg_list): blkg = container_of(pos, 'struct blkcg_gq', 'blkcg_node') pd = blkg.pd[prog['blkcg_policy_iolatency'].plid] if pd.value_() == 0: continue iolat = container_of(pd, 'struct iolatency_grp', 'pd') inflight = iolat.rq_wait.inflight.counter.value_() if inflight: print(f'inflight={inflight} {disk_name(blkg.q.disk).decode("utf-8")} ' f'{cgroup_path(css.cgroup).decode("utf-8")}') time.sleep(1) The monitoring output looks like the following: inflight=1 sda /user.slice inflight=1 sda /user.slice ... inflight=14 sda /user.slice inflight=13 sda /user.slice inflight=17 sda /user.slice inflight=15 sda /user.slice inflight=18 sda /user.slice inflight=17 sda /user.slice inflight=20 sda /user.slice inflight=19 sda /user.slice <- fio stopped, inflight stuck at 19 inflight=19 sda /user.slice inflight=19 sda /user.slice If a cgroup with stuck inflight ends up getting throttled, the throttled IOs will never get issued as there's no completion event to wake it up leading to an indefinite hang. This patch fixes the bug by unifying enable handling into a work item which is automatically kicked off from iolatency_set_min_lat_nsec() which is called from both iolatency_set_limit() and iolatency_pd_offline() paths. Punting to a work item is necessary as iolatency_pd_offline() is called under spinlocks while freezing a request_queue requires a sleepable context. This also simplifies the code reducing LOC sans the comments and avoids the unnecessary freezes which were happening whenever a cgroup's latency target is newly set or cleared. Signed-off-by: Tejun Heo <tj(a)kernel.org> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: Liu Bo <bo.liu(a)linux.alibaba.com> Fixes: 8c772a9bfc7c ("blk-iolatency: fix IO hang due to negative inflight counter") Cc: stable(a)vger.kernel.org # v5.0+ Link: https://lore.kernel.org/r/Yn9ScX6Nx2qIiQQi@slm.duckdns.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: block/blk-iolatency.c [One line changed by commit f2fe4410dc00 in blkcg_iolatency_done_bio(), causing conflicts] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- block/blk-iolatency.c | 122 ++++++++++++++++++++++-------------------- 1 file changed, 64 insertions(+), 58 deletions(-) diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c index 6f81794eb6e6..3572ac28081a 100644 --- a/block/blk-iolatency.c +++ b/block/blk-iolatency.c @@ -85,7 +85,17 @@ struct iolatency_grp; struct blk_iolatency { struct rq_qos rqos; struct timer_list timer; - atomic_t enabled; + + /* + * ->enabled is the master enable switch gating the throttling logic and + * inflight tracking. The number of cgroups which have iolat enabled is + * tracked in ->enable_cnt, and ->enable is flipped on/off accordingly + * from ->enable_work with the request_queue frozen. For details, See + * blkiolatency_enable_work_fn(). + */ + bool enabled; + atomic_t enable_cnt; + struct work_struct enable_work; }; static inline struct blk_iolatency *BLKIOLATENCY(struct rq_qos *rqos) @@ -93,11 +103,6 @@ static inline struct blk_iolatency *BLKIOLATENCY(struct rq_qos *rqos) return container_of(rqos, struct blk_iolatency, rqos); } -static inline bool blk_iolatency_enabled(struct blk_iolatency *blkiolat) -{ - return atomic_read(&blkiolat->enabled) > 0; -} - struct child_latency_info { spinlock_t lock; @@ -402,7 +407,7 @@ static void blkcg_iolatency_throttle(struct rq_qos *rqos, struct bio *bio, struct request_queue *q = rqos->q; bool issue_as_root = bio_issue_as_root_blkg(bio); - if (!blk_iolatency_enabled(blkiolat)) + if (!blkiolat->enabled) return; rcu_read_lock(); @@ -559,7 +564,6 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio) u64 window_start; u64 now = blk_time_get_ns(); bool issue_as_root = bio_issue_as_root_blkg(bio); - bool enabled = false; int inflight = 0; blkg = bio->bi_blkg; @@ -570,8 +574,7 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio) if (!iolat) return; - enabled = blk_iolatency_enabled(iolat->blkiolat); - if (!enabled) + if (!iolat->blkiolat->enabled) return; while (blkg && blkg->parent) { @@ -609,6 +612,7 @@ static void blkcg_iolatency_exit(struct rq_qos *rqos) struct blk_iolatency *blkiolat = BLKIOLATENCY(rqos); del_timer_sync(&blkiolat->timer); + flush_work(&blkiolat->enable_work); blkcg_deactivate_policy(rqos->q, &blkcg_policy_iolatency); kfree(blkiolat); } @@ -680,6 +684,44 @@ static void blkiolatency_timer_fn(struct timer_list *t) rcu_read_unlock(); } +/** + * blkiolatency_enable_work_fn - Enable or disable iolatency on the device + * @work: enable_work of the blk_iolatency of interest + * + * iolatency needs to keep track of the number of in-flight IOs per cgroup. This + * is relatively expensive as it involves walking up the hierarchy twice for + * every IO. Thus, if iolatency is not enabled in any cgroup for the device, we + * want to disable the in-flight tracking. + * + * We have to make sure that the counting is balanced - we don't want to leak + * the in-flight counts by disabling accounting in the completion path while IOs + * are in flight. This is achieved by ensuring that no IO is in flight by + * freezing the queue while flipping ->enabled. As this requires a sleepable + * context, ->enabled flipping is punted to this work function. + */ +static void blkiolatency_enable_work_fn(struct work_struct *work) +{ + struct blk_iolatency *blkiolat = container_of(work, struct blk_iolatency, + enable_work); + bool enabled; + + /* + * There can only be one instance of this function running for @blkiolat + * and it's guaranteed to be executed at least once after the latest + * ->enabled_cnt modification. Acting on the latest ->enable_cnt is + * sufficient. + * + * Also, we know @blkiolat is safe to access as ->enable_work is flushed + * in blkcg_iolatency_exit(). + */ + enabled = atomic_read(&blkiolat->enable_cnt); + if (enabled != blkiolat->enabled) { + blk_mq_freeze_queue(blkiolat->rqos.q); + blkiolat->enabled = enabled; + blk_mq_unfreeze_queue(blkiolat->rqos.q); + } +} + int blk_iolatency_init(struct request_queue *q) { struct blk_iolatency *blkiolat; @@ -705,17 +747,15 @@ int blk_iolatency_init(struct request_queue *q) } timer_setup(&blkiolat->timer, blkiolatency_timer_fn, 0); + INIT_WORK(&blkiolat->enable_work, blkiolatency_enable_work_fn); return 0; } -/* - * return 1 for enabling iolatency, return -1 for disabling iolatency, otherwise - * return 0. - */ -static int iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val) +static void iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val) { struct iolatency_grp *iolat = blkg_to_lat(blkg); + struct blk_iolatency *blkiolat = iolat->blkiolat; u64 oldval = iolat->min_lat_nsec; iolat->min_lat_nsec = val; @@ -723,13 +763,15 @@ static int iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val) iolat->cur_win_nsec = min_t(u64, iolat->cur_win_nsec, BLKIOLATENCY_MAX_WIN_SIZE); - if (!oldval && val) - return 1; + if (!oldval && val) { + if (atomic_inc_return(&blkiolat->enable_cnt) == 1) + schedule_work(&blkiolat->enable_work); + } if (oldval && !val) { blkcg_clear_delay(blkg); - return -1; + if (atomic_dec_return(&blkiolat->enable_cnt) == 0) + schedule_work(&blkiolat->enable_work); } - return 0; } static void iolatency_clear_scaling(struct blkcg_gq *blkg) @@ -762,7 +804,6 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf, u64 lat_val = 0; u64 oldval; int ret; - int enable = 0; ret = blkg_conf_prep(blkcg, &blkcg_policy_iolatency, buf, &ctx); if (ret) @@ -798,41 +839,12 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf, blkg = ctx.blkg; oldval = iolat->min_lat_nsec; - enable = iolatency_set_min_lat_nsec(blkg, lat_val); - if (enable) { - if (!blk_get_queue(blkg->q)) { - ret = -ENODEV; - goto out; - } - - blkg_get(blkg); - } - - if (oldval != iolat->min_lat_nsec) { + iolatency_set_min_lat_nsec(blkg, lat_val); + if (oldval != iolat->min_lat_nsec) iolatency_clear_scaling(blkg); - } - ret = 0; out: blkg_conf_finish(&ctx); - if (ret == 0 && enable) { - struct iolatency_grp *tmp = blkg_to_lat(blkg); - struct blk_iolatency *blkiolat = tmp->blkiolat; - - blk_mq_freeze_queue(blkg->q); - - if (enable == 1) - atomic_inc(&blkiolat->enabled); - else if (enable == -1) - atomic_dec(&blkiolat->enabled); - else - WARN_ON_ONCE(1); - - blk_mq_unfreeze_queue(blkg->q); - - blkg_put(blkg); - blk_put_queue(blkg->q); - } return ret ?: nbytes; } @@ -932,14 +944,8 @@ static void iolatency_pd_offline(struct blkg_policy_data *pd) { struct iolatency_grp *iolat = pd_to_lat(pd); struct blkcg_gq *blkg = lat_to_blkg(iolat); - struct blk_iolatency *blkiolat = iolat->blkiolat; - int ret; - ret = iolatency_set_min_lat_nsec(blkg, 0); - if (ret == 1) - atomic_inc(&blkiolat->enabled); - if (ret == -1) - atomic_dec(&blkiolat->enabled); + iolatency_set_min_lat_nsec(blkg, 0); iolatency_clear_scaling(blkg); } -- 2.34.1

2 1

[PATCH openEuler-25.03] mm: introduce kernel cmdline option "kernel_replication="
by Nikita Panov 28 Feb '25

28 Feb '25

kunpeng inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBPRS0 ------------------------------------------------- The new cmdline option allows enabling/disabling kernel replication feature. By default, the replication feature is disabled. This allows to set CONFIG_KERNEL_REPLICATION=y by default, but enabling this feature is done via kernel cmdline. Signed-off-by: Nikita Panov <panov.nikita(a)huawei.com> --- .../admin-guide/kernel-parameters.txt | 7 ++ arch/arm64/configs/openeuler_defconfig | 2 +- arch/arm64/mm/pgd.c | 56 +++++++++---- include/linux/numa_kernel_replication.h | 28 ++++++- kernel/module/main.c | 11 ++- mm/numa_kernel_replication.c | 78 ++++++++++++++++++- mm/vmalloc.c | 6 +- 7 files changed, 163 insertions(+), 25 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 5bf51e171ee7..0f1f6143f53f 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -2534,6 +2534,13 @@ some extension. These two features are alternatives. Current only arm64 is supported. + kernel_replication= + [ARM64] + Format: [on|off] + If CONFIG_KERNEL_REPLICATION is set, it allows + enabling/disabling the kernel replication feature + via cmdline. Default value is off. + kgdbdbgp= [KGDB,HW] kgdb over EHCI usb debug port. Format: <Controller#>[,poll interval] The controller # is the number of the ehci usb debug diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 28de20ca2d71..0f3e72a3c2b6 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -1212,7 +1212,7 @@ CONFIG_ARM64_HAFT=y CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y -# CONFIG_KERNEL_REPLICATION is not set +CONFIG_KERNEL_REPLICATION=y CONFIG_IOMMU_MM_DATA=y # CONFIG_ASCEND_FEATURES is not set CONFIG_PAGE_CACHE_LIMIT=y diff --git a/arch/arm64/mm/pgd.c b/arch/arm64/mm/pgd.c index adf642eba4e7..8326bd693b29 100644 --- a/arch/arm64/mm/pgd.c +++ b/arch/arm64/mm/pgd.c @@ -18,6 +18,24 @@ static struct kmem_cache *pgd_cache __ro_after_init; +static pgd_t *pgd_alloc_orig(struct mm_struct *mm) +{ + gfp_t gfp = GFP_PGTABLE_USER; + + if (PGD_SIZE == PAGE_SIZE) + return (pgd_t *)__get_free_page(gfp); + else + return kmem_cache_alloc(pgd_cache, gfp); +} + +static void pgd_free_orig(struct mm_struct *mm, pgd_t *pgd) +{ + if (PGD_SIZE == PAGE_SIZE) + free_page((unsigned long)pgd); + else + kmem_cache_free(pgd_cache, pgd); +} + #ifdef CONFIG_KERNEL_REPLICATION pgd_t *page_pgd_alloc(struct mm_struct *mm) { @@ -37,11 +55,11 @@ pgd_t *page_pgd_alloc(struct mm_struct *mm) WARN_ON_ONCE(page_to_nid(page) != nid); - per_node_pgd(mm, nid) = (pgd_t *)page_address(page); + *per_node_pgd_ptr(mm, nid) = (pgd_t *)page_address(page); } for_each_online_node(nid) - per_node_pgd(mm, nid) = per_node_pgd(mm, numa_get_memory_node(nid)); + *per_node_pgd_ptr(mm, nid) = per_node_pgd(mm, numa_get_memory_node(nid)); mm->pgd = per_node_pgd(mm, numa_get_memory_node(0));/*!!!*/ @@ -53,7 +71,7 @@ pgd_t *page_pgd_alloc(struct mm_struct *mm) return NULL; } -pgd_t *pgd_alloc(struct mm_struct *mm) +static pgd_t *pgd_alloc_replica(struct mm_struct *mm) { pgd_t **pgd_numa = (pgd_t **)kmalloc(sizeof(pgd_t *) * MAX_NUMNODES, GFP_PGTABLE_KERNEL); @@ -81,34 +99,44 @@ static void page_pgd_free(struct mm_struct *mm, pgd_t *pgd) } for_each_online_node(nid) - per_node_pgd(mm, nid) = NULL; + *per_node_pgd_ptr(mm, nid) = NULL; } -void pgd_free(struct mm_struct *mm, pgd_t *pgd) +static void pgd_free_replica(struct mm_struct *mm, pgd_t *pgd) { page_pgd_free(mm, pgd); kfree(mm->pgd_numa); } -#else /* !CONFIG_KERNEL_REPLICATION */ pgd_t *pgd_alloc(struct mm_struct *mm) { - gfp_t gfp = GFP_PGTABLE_USER; - - if (PGD_SIZE == PAGE_SIZE) - return (pgd_t *)__get_free_page(gfp); + mm->pgd_numa = NULL; + if (is_text_replicated()) + return pgd_alloc_replica(mm); else - return kmem_cache_alloc(pgd_cache, gfp); + return pgd_alloc_orig(mm); + } void pgd_free(struct mm_struct *mm, pgd_t *pgd) { - if (PGD_SIZE == PAGE_SIZE) - free_page((unsigned long)pgd); + if (is_text_replicated()) + pgd_free_replica(mm, pgd); else - kmem_cache_free(pgd_cache, pgd); + pgd_free_orig(mm, pgd); +} + +#else /* !CONFIG_KERNEL_REPLICATION */ +pgd_t *pgd_alloc(struct mm_struct *mm) +{ + return pgd_alloc_orig(mm); +} + +void pgd_free(struct mm_struct *mm, pgd_t *pgd) +{ + pgd_free_orig(mm, pgd); } #endif /* CONFIG_KERNEL_REPLICATION */ diff --git a/include/linux/numa_kernel_replication.h b/include/linux/numa_kernel_replication.h index ee1ab0f111c7..37e7b56b5aa9 100644 --- a/include/linux/numa_kernel_replication.h +++ b/include/linux/numa_kernel_replication.h @@ -42,8 +42,31 @@ extern nodemask_t replica_nodes; nid != MAX_NUMNODES; \ nid = next_node(nid, replica_nodes)) -#define this_node_pgd(mm) ((mm)->pgd_numa[numa_node_id()]) -#define per_node_pgd(mm, nid) ((mm)->pgd_numa[nid]) +bool is_text_replicated(void); + +static inline pgd_t *this_node_pgd(struct mm_struct *mm) +{ + if (is_text_replicated()) + return mm->pgd_numa[numa_node_id()]; + else + return mm->pgd; +} + +static inline pgd_t *per_node_pgd(struct mm_struct *mm, int nid) +{ + if (is_text_replicated()) + return mm->pgd_numa[nid]; + else + return mm->pgd; +} + +static inline pgd_t **per_node_pgd_ptr(struct mm_struct *mm, int nid) +{ + if (is_text_replicated()) + return &mm->pgd_numa[nid]; + else + return &mm->pgd; +} static inline bool numa_addr_has_replica(const void *addr) { @@ -56,7 +79,6 @@ void __init numa_replicate_kernel_text(void); void numa_replicate_kernel_rodata(void); void numa_replication_fini(void); -bool is_text_replicated(void); propagation_level_t get_propagation_level(void); void numa_setup_pgd(void); void __init_or_module *numa_get_replica(void *vaddr, int nid); diff --git a/kernel/module/main.c b/kernel/module/main.c index 3aa696b127ca..c5448bc9589a 100644 --- a/kernel/module/main.c +++ b/kernel/module/main.c @@ -1217,6 +1217,9 @@ static void module_replicate_sections(struct module *mod) { int i; + if (!is_text_replicated()) + return; + for (i = 0; i < ARRAY_SIZE(sections_to_replicate); i++) module_replicate(mod->mem[sections_to_replicate[i]].base); } @@ -1228,9 +1231,11 @@ static void *module_memory_alloc(unsigned int size, enum mod_mem_type type) if (mod_mem_use_vmalloc(type)) return vzalloc(size); - for (i = 0; i < ARRAY_SIZE(sections_to_replicate); i++) { - if (type == sections_to_replicate[i]) - return module_alloc_replica(size); + if (is_text_replicated()) { + for (i = 0; i < ARRAY_SIZE(sections_to_replicate); i++) { + if (type == sections_to_replicate[i]) + return module_alloc_replica(size); + } } return module_alloc(size); } diff --git a/mm/numa_kernel_replication.c b/mm/numa_kernel_replication.c index c2d289b7b9df..17664a1300b8 100644 --- a/mm/numa_kernel_replication.c +++ b/mm/numa_kernel_replication.c @@ -65,6 +65,8 @@ static unsigned int master_node = INT_MAX; */ static int node_to_memory_node[MAX_NUMNODES]; +static bool kernel_replication_enabled; + static bool pgtables_extra; static DEFINE_SPINLOCK(debugfs_lock); @@ -254,6 +256,9 @@ static void dump_pgtables(struct mm_struct *mm, start = start & PAGE_MASK; end = (end & PAGE_MASK) - 1 + PAGE_SIZE; + if (!mm->pgd_numa) + return; + replication_log(data, "----PER-NUMA NODE KERNEL REPLICATION ENABLED----\n"); @@ -622,6 +627,18 @@ static void replicate_pgtables(void) } } +static void __init numa_replicate_kernel_text_disabled(void) +{ + int nid; + + init_mm.pgd_numa = (pgd_t **)kmalloc(sizeof(pgd_t *) * MAX_NUMNODES, GFP_PGTABLE_KERNEL); + BUG_ON(!init_mm.pgd_numa); + for_each_online_node(nid) { + init_mm.pgd_numa[nid] = init_mm.pgd; + } +} + + /* * Kernel text replication includes two steps: * 1. page tables replication for init_mm @@ -639,6 +656,11 @@ void __init numa_replicate_kernel_text(void) { int nid; + if (!kernel_replication_enabled) { + numa_replicate_kernel_text_disabled(); + return; + } + replicate_pgtables(); for_each_memory_node(nid) { @@ -667,6 +689,10 @@ void numa_replicate_kernel_rodata(void) { int nid; + if (!kernel_replication_enabled) { + return; + } + for_each_memory_node(nid) { if (nid == master_node) continue; @@ -678,7 +704,7 @@ void numa_replicate_kernel_rodata(void) void numa_setup_pgd(void) { - numa_load_replicated_pgd(init_mm.pgd_numa[numa_node_id()]); + numa_load_replicated_pgd(this_node_pgd(&init_mm)); } void __init_or_module *numa_get_replica(void *vaddr, int nid) @@ -693,8 +719,48 @@ void __init_or_module *numa_get_replica(void *vaddr, int nid) return node_desc[nid].text_vaddr + offset; } +static int __init setup_kernel_replication(char *str) +{ + int ret = 0; + + if (!str) + goto out; + if (!strcmp(str, "on")) { + kernel_replication_enabled = true; + pr_info("Kernel replication enabled via cmdline\n"); + ret = 1; + } else if (!strcmp(str, "off")) { + kernel_replication_enabled = false; + pr_info("Kernel replication disabled via cmdline\n"); + ret = 1; + } +out: + if (!ret) + pr_warn("kernel_replication= cannot parse, ignored\n"); + return ret; +} +__setup("kernel_replication=", setup_kernel_replication); + + nodemask_t __ro_after_init replica_nodes = { { [0] = 1UL } }; +/* + * Let us pretend, that we have only single node fore replicas. + * Do not replicate anything. + */ +static void __init numa_replication_init_disabled(void) +{ + int nid; + + __node_set(0, &replica_nodes); + for_each_online_node(nid) { + node_to_memory_node[nid] = 0; + } + + node_desc[0].text_vaddr = lm_alias((void *)KERNEL_TEXT_START); + node_desc[0].rodata_vaddr = lm_alias((void *)KERNEL_RODATA_START); +} + void __init numa_replication_init(void) { int nid; @@ -707,6 +773,16 @@ void __init numa_replication_init(void) #endif nodes_clear(replica_nodes); + if (kernel_replication_enabled) + pr_info("WARNING! WARNING! WARNING! Kernel replication enabled WARNING! WARNING! WARNING!\n"); + else + pr_info("Kernel replication disabled\n"); + + if (!kernel_replication_enabled) { + numa_replication_init_disabled(); + return; + } + for_each_node_state(nid, N_MEMORY) { __node_set(nid, &replica_nodes); } diff --git a/mm/vmalloc.c b/mm/vmalloc.c index a136e86e6480..b170cc1ef447 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -493,7 +493,7 @@ void vunmap_range_replicas(unsigned long addr, unsigned long end) flush_cache_vunmap(addr, end); for_each_memory_node(nid) - vunmap_range_noflush_pgd(init_mm.pgd_numa[nid], addr, end); + vunmap_range_noflush_pgd(per_node_pgd(&init_mm, nid), addr, end); flush_tlb_kernel_range(addr, end); } #endif /* CONFIG_KERNEL_REPLICATION && CONFIG_ARM64 */ @@ -2378,7 +2378,7 @@ static void free_unmap_vmap_area(struct vmap_area *va) * empty entries here, which is totally fine */ for_each_memory_node(node) - vunmap_range_noflush_pgd(init_mm.pgd_numa[node], + vunmap_range_noflush_pgd(per_node_pgd(&init_mm, node), va->va_start, va->va_end); } else { vunmap_range_noflush(va->va_start, va->va_end); @@ -4123,7 +4123,7 @@ int __vmalloc_node_replicate_range(const void *addr, gfp_t gfp_mask, for (i = 0; i < area->nr_pages; i++) list_add(&pages[i]->lru, &area->pages[i]->lru); - vunmap_range_noflush_pgd(init_mm.pgd_numa[node], + vunmap_range_noflush_pgd(per_node_pgd(&init_mm, node), area_start, area_end); /* -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] KVM: arm64: pvsched bugfix and module param
by Dongxu Sun 28 Feb '25

28 Feb '25

Yanan Wang (1): KVM:arm64:Add a module param to enable/disable pv_preempted dynamically Zhiqiang Ni (1): KVM: ARM: mark vCPU preempted if average guest steal time is considerable arch/arm64/include/asm/kvm_host.h | 6 ++++- arch/arm64/kvm/arm.c | 45 ++++++++++++++++++++++++++++--- arch/arm64/kvm/pvsched.c | 2 ++ arch/arm64/kvm/pvtime.c | 8 ++++++ include/trace/events/kvm.h | 24 +++++++++++++++++ 5 files changed, 80 insertions(+), 5 deletions(-) -- 2.33.0

2 3

[PATCH OLK-6.6 00/12] Add support for IPIv
by yangjinqian 28 Feb '25

28 Feb '25

Patch#1 Probe and configure IPIV capacity on HIP12 Patch#2 Allocate VM table and save vpeid in it Patch#3 Add support for ipiv direct mode Patch#4 Register ipiv exception interrupt Patch#5 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#6 Pre-allocate vpe id for direct mode Patch#7 Add interface KVM_CAP_ARM_IPIV_MODE Patch#8 Change ipiv irq type Patch#9 IPI performance benchmark Patch#10 Check GICD_CTLR_nASSGIreq when vpe schedule and deschedule Patch#11 Add a check before disabling ICC_SGI1R_EL1 trap Patch#12 use __GENKSYMS__ to revert the kabi change Xiang Chen (11): kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 kvm: hisi_virt: Allocate VM table and save vpeid in it kvm: hisi_virt: Add support for ipiv direct mode kvm: hisi_virt: Register ipiv exception interrupt irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Pre-allocate vpe id for direct mode kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Change ipiv irq type IPI performance benchmark irqchip: gicv3-its: Check GICD_CTLR_nASSGIreq when vpe schedule and deschedule irqchip: gicv3-its: Add a check before disabling ICC_SGI1R_EL1 trap yangjinqian (1): irqchip: gicv3-its: use __GENKSYMS__ to revert the kabi change .../admin-guide/kernel-parameters.txt | 8 + arch/Kconfig | 10 ++ arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/arm.c | 23 +++ arch/arm64/kvm/hisilicon/hisi_virt.c | 41 ++++- arch/arm64/kvm/hisilicon/hisi_virt.h | 9 + arch/arm64/kvm/sys_regs.c | 33 +++- arch/arm64/kvm/vgic/vgic-init.c | 84 +++++++++- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 + drivers/irqchip/irq-gic-v3-its.c | 121 +++++++++++++- drivers/irqchip/irq-gic-v3.c | 37 +++++ include/kvm/arm_vgic.h | 2 + include/linux/irqchip/arm-gic-v3.h | 23 +++ include/linux/irqchip/arm-gic-v4.h | 7 + include/uapi/linux/kvm.h | 2 + kernel/Makefile | 1 + kernel/ipi_benchmark.c | 155 ++++++++++++++++++ 17 files changed, 539 insertions(+), 20 deletions(-) create mode 100644 kernel/ipi_benchmark.c -- 2.33.0

2 13

[PATCH OLK-6.6 V2 00/24] Add support for heterogeneous live migration
by yangjinqian 28 Feb '25

28 Feb '25

Patch#1 Allow userspace to get the writable masks for feature ID registers Patch#2 Document KVM_ARM_GET_REG_WRITABLE_MASKS Patch#3 Use guest ID register values for the sake of emulation Patch#4 Advertise selected DebugVer in DBGDIDR.Version Patch#5 Reject attempts to set invalid debug arch version Patch#6 Bump up the default KVM sanitised debug version to v8p8 Patch#7 Allow userspace to change ID_AA64ISAR{0-2}_EL1 Patch#8 Allow userspace to change ID_AA64MMFR{0-2}_EL1 Patch#9 Allow userspace to change ID_AA64PFR0_EL1 Patch#10 Allow userspace to change ID_AA64ZFR0_EL1 Patch#11 Document vCPU feature selection UAPIs Patch#12 Make the exposed feature bits in AA64DFR0_EL1 writable from userspace Patch#13 Disable MPAM visibility by default and ignore VMM writes Patch#14 Use read-only helper for reading VM ID registers Patch#15 Add helper for writing ID regs Patch#16 Treat CTR_EL0 as a VM feature ID register Patch#17 Rename functions for invariant sys regs Patch#18 Make the L1Ip feature bits in CTR_EL0 writable from userspace Patch#19 Show writable masks for feature registers Patch#20 Make HCX writable from userspace Patch#21 Remove duplicated AA64MMFR1_EL1 XNX Patch#22 Add support for HIP09 Spectre-BHB mitigation Patch#23 add cnp verification on Hisilicon erratum 162100125 Patch#24 use __GENKSYMS__ to revert struct kvm kabi change James Morse (1): KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Jing Zhang (5): KVM: arm64: Allow userspace to get the writable masks for feature ID registers KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS KVM: arm64: Use guest ID register values for the sake of emulation KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Oliver Upton (8): KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version KVM: arm64: Reject attempts to set invalid debug arch version KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 KVM: arm64: Document vCPU feature selection UAPIs KVM: arm64: Use read-only helper for reading VM ID registers KVM: arm64: Add helper for writing ID regs Russell King (1): KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Sebastian Ott (3): KVM: arm64: Treat CTR_EL0 as a VM feature ID register KVM: arm64: rename functions for invariant sys regs KVM: arm64: show writable masks for feature registers Shameer Kolothum (2): KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace yangjinqian (4): KVM: arm64: Make HCX writable from userspace arm64: Add support for HIP09 Spectre-BHB mitigation arm64: add cnp verification on Hisilicon erratum 162100125 KVM: arm64: use __GENKSYMS__ to revert struct kvm kabi change Documentation/virt/kvm/api.rst | 52 ++++ Documentation/virt/kvm/arm/index.rst | 1 + Documentation/virt/kvm/arm/vcpu-features.rst | 48 +++ arch/arm64/include/asm/cpufeature.h | 14 + arch/arm64/include/asm/kvm_emulate.h | 3 +- arch/arm64/include/asm/kvm_host.h | 24 ++ arch/arm64/include/uapi/asm/kvm.h | 32 ++ arch/arm64/kernel/cpu_errata.c | 13 +- arch/arm64/kernel/proton-pack.c | 1 + arch/arm64/kvm/arm.c | 10 + arch/arm64/kvm/pmu-emul.c | 2 +- arch/arm64/kvm/sys_regs.c | 305 +++++++++++++++---- include/uapi/linux/kvm.h | 3 + 13 files changed, 448 insertions(+), 60 deletions(-) create mode 100644 Documentation/virt/kvm/arm/vcpu-features.rst -- 2.33.0

2 25