- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] net/mlx5: Check device memory pointer before usage
by Fanhua Li 05 Sep '25

05 Sep '25

From: Stav Aviram <saviram(a)nvidia.com> mainline inclusion from mainline-v6.17-rc1 commit 70f238c902b8c0461ae6fbb8d1a0bbddc4350eea category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC9M CVE: CVE-2025-38645 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Add a NULL check before accessing device memory to prevent a crash if dev->dm allocation in mlx5_init_once() fails. Fixes: c9b9dcb430b3 ("net/mlx5: Move device memory management to mlx5_core") Signed-off-by: Stav Aviram <saviram(a)nvidia.com> Link: https://patch.msgid.link/c88711327f4d74d5cebc730dc629607e989ca187.175137003… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/hw/mlx5/dm.c drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c drivers/net/ethernet/mellanox/mlx5/core/main.c drivers/infiniband/hw/mlx5/main.c [Fanhua Li: avoid NULL pointer deref when dev->dm is not initialized] Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 3 +++ drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c | 4 ++-- drivers/net/ethernet/mellanox/mlx5/core/main.c | 3 --- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index 982be8a8bba8..6baab01526d1 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -2384,6 +2384,9 @@ static int handle_alloc_dm_memic(struct ib_ucontext *ctx, dm->size = roundup(attr->length, MLX5_MEMIC_BASE_SIZE); + if (!dm_db) + return -EOPNOTSUPP; + err = mlx5_cmd_alloc_memic(dm_db, &dm->dev_addr, dm->size, attr->alignment); if (err) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c index 3d5e57ff558c..15ee84a2a470 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c @@ -25,7 +25,7 @@ struct mlx5_dm *mlx5_dm_create(struct mlx5_core_dev *dev) dm = kzalloc(sizeof(*dm), GFP_KERNEL); if (!dm) - return ERR_PTR(-ENOMEM); + return NULL; spin_lock_init(&dm->lock); @@ -61,7 +61,7 @@ struct mlx5_dm *mlx5_dm_create(struct mlx5_core_dev *dev) err_steering: kfree(dm); - return ERR_PTR(-ENOMEM); + return NULL; } void mlx5_dm_cleanup(struct mlx5_core_dev *dev) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c index d4712fbc7856..392dfba3d281 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/main.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c @@ -884,9 +884,6 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) } dev->dm = mlx5_dm_create(dev); - if (IS_ERR(dev->dm)) - mlx5_core_warn(dev, "Failed to init device memory %ld\n", PTR_ERR(dev->dm)); - dev->tracer = mlx5_fw_tracer_create(dev); dev->hv_vhca = mlx5_hv_vhca_create(dev); dev->rsc_dump = mlx5_rsc_dump_create(dev); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-38305
by Chen Ridong 05 Sep '25

05 Sep '25

CVE-2025-38305 Jeongjun Park (1): ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() Vladimir Oltean (1): ptp: fix breakage after ptp_vclock_in_use() rework drivers/ptp/ptp_private.h | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] x86/smp: ignore reboot IPI when stopping_cpu contains value
by Lin Yujun 05 Sep '25

05 Sep '25

From: Yipeng Zou <zouyipeng(a)huawei.com> hulk inclusion category: bugfix bugzilla: 190750 CVE: NA ------------------------ Recently, A issue has been reported that CPU hang in x86 VM. The CPU halted during Kdump likely due to IPI issues when one CPU was rebooting and another was in Kdump: CPU0 CPU2 ======================== ====================== reboot Panic machine shutdown Kdump machine shutdown stop other cpus kdump_nmi_shootdown_cpus ... ... local_irq_disable local_irq_disable send_IPIs(REBOOT) [critical regions] [critical regions] 1) send_IPIs(REBOOT) wait timeout 2) send_IPIs(NMI); Halt,NMI context 3) lapic_shutdown [IPI is pending] ... second kernel start 4) init_bsp_APIC [IPI is pending] ... local irq enable Halt, IPI context In simple terms, when the Kdump jump to the second kernel, the IPI that was pending in the first kernel remains and is responded to by the second kernel. As the reboot IPI can only be sent after acquiring @stopping_cpu by storing the CPU number, this case can be detected when @stopping_cpu contains the bootup value -1. Just return and ignore it. Fixes: 9c7af565c58e (“centos 8.1: import linux-4.18.0-147.5.1.el8_1”) Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- arch/x86/kernel/smp.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c index b2b87b91f336..07ccda0ad531 100644 --- a/arch/x86/kernel/smp.c +++ b/arch/x86/kernel/smp.c @@ -176,6 +176,29 @@ static int smp_stop_nmi_callback(unsigned int val, struct pt_regs *regs) asmlinkage __visible void smp_reboot_interrupt(void) { ipi_entering_ack_irq(); + + /* + * Handle the case where a reboot IPI is stale in the IRR. This + * happens when: + * + * a CPU crashes with interrupts disabled before handling the + * reboot IPI and jumps into a crash kernel. The reboot IPI + * vector is kept set in the APIC IRR across the APIC soft + * disabled phase and as there is no way to clear a pending IRR + * bit, it is delivered to the crash kernel immediately when + * interrupts are enabled. + * + * As the reboot IPI can only be sent after acquiring @stopping_cpu + * by storing the CPU number, this case can be detected when + * @stopping_cpu contains the bootup value -1. Just return and + * ignore it. + */ + if (atomic_read(&stopping_cpu) == -1) { + pr_info("Ignoring stale reboot IPI\n"); + irq_exit(); + return; + } + cpu_emergency_vmxoff(); stop_this_cpu(NULL); irq_exit(); -- 2.34.1

2 1

[openeuler:OLK-6.6 2853/2853] drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c:751:23: error: use of undeclared identifier 'IEEE_8021QAZ_MAX_TCS'
by kernel test robot 05 Sep '25

05 Sep '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4eddc7e6b3a11653b493da4617c18cdc2e6e6777 commit: 6460d9d3c42d1357c8292d7be5c26cb7b84e84d7 [2853/2853] yt6801: Add Motorcomm yt6801 PCIe driver config: loongarch-randconfig-001-20250905 (https://download.01.org/0day-ci/archive/20250905/202509050145.rJ98GKyh-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250905/202509050145.rJ98GKyh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509050145.rJ98GKyh-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c:751:23: error: use of undeclared identifier 'IEEE_8021QAZ_MAX_TCS' 751 | min_t(unsigned int, IEEE_8021QAZ_MAX_TCS, priv->rx_q_count); | ^ drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c:752:8: error: use of undeclared identifier 'IEEE_8021QAZ_MAX_TCS' 752 | ppq = IEEE_8021QAZ_MAX_TCS / prio_queues; | ^ drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c:753:14: error: use of undeclared identifier 'IEEE_8021QAZ_MAX_TCS' 753 | ppq_extra = IEEE_8021QAZ_MAX_TCS % prio_queues; | ^ drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c:1715:35: warning: variable 'mac_hfr2' set but not used [-Wunused-but-set-variable] 1715 | unsigned int mac_hfr0, mac_hfr1, mac_hfr2, mac_hfr3; | ^ 1 warning and 3 errors generated. vim +/IEEE_8021QAZ_MAX_TCS +751 drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c 742 743 static void fxgmac_config_queue_mapping(struct fxgmac_pdata *priv) 744 { 745 unsigned int ppq, ppq_extra, prio_queues; 746 unsigned int __maybe_unused prio; 747 unsigned int reg, val, mask; 748 749 /* Map the 8 VLAN priority values to available MTL Rx queues */ 750 prio_queues = > 751 min_t(unsigned int, IEEE_8021QAZ_MAX_TCS, priv->rx_q_count); 752 ppq = IEEE_8021QAZ_MAX_TCS / prio_queues; 753 ppq_extra = IEEE_8021QAZ_MAX_TCS % prio_queues; 754 755 reg = MAC_RQC2R; 756 for (u32 i = 0, prio = 0; i < prio_queues;) { 757 val = 0; 758 mask = 0; 759 for (u32 j = 0; j < ppq; j++) { 760 mask |= (1 << prio); 761 prio++; 762 } 763 764 if (i < ppq_extra) { 765 mask |= (1 << prio); 766 prio++; 767 } 768 769 val |= (mask << ((i++ % MAC_RQC2_Q_PER_REG) << 3)); 770 771 if ((i % MAC_RQC2_Q_PER_REG) && i != prio_queues) 772 continue; 773 774 fxgmac_io_wr(priv, reg, val); 775 reg += MAC_RQC2_INC; 776 } 777 778 /* Configure one to one, MTL Rx queue to DMA Rx channel mapping 779 * ie Q0 <--> CH0, Q1 <--> CH1 ... Q7 <--> CH7 780 */ 781 val = fxgmac_io_rd(priv, MTL_RQDCM0R); 782 val |= (MTL_RQDCM0R_Q0MDMACH | MTL_RQDCM0R_Q1MDMACH | 783 MTL_RQDCM0R_Q2MDMACH | MTL_RQDCM0R_Q3MDMACH); 784 fxgmac_io_wr(priv, MTL_RQDCM0R, val); 785 786 val = fxgmac_io_rd(priv, MTL_RQDCM0R + MTL_RQDCM_INC); 787 val |= (MTL_RQDCM1R_Q4MDMACH | MTL_RQDCM1R_Q5MDMACH | 788 MTL_RQDCM1R_Q6MDMACH | MTL_RQDCM1R_Q7MDMACH); 789 fxgmac_io_wr(priv, MTL_RQDCM0R + MTL_RQDCM_INC, val); 790 } 791 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] x86/smp: ignore reboot IPI when stopping_cpu contains value
by Lin Yujun 04 Sep '25

04 Sep '25

From: Yipeng Zou <zouyipeng(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: 190750 CVE: NA ------------------------ Recently, A issue has been reported that CPU hang in x86 VM. The CPU halted during Kdump likely due to IPI issues when one CPU was rebooting and another was in Kdump: CPU0 CPU2 ======================== ====================== reboot Panic machine shutdown Kdump machine shutdown stop other cpus kdump_nmi_shootdown_cpus ... ... local_irq_disable local_irq_disable send_IPIs(REBOOT) [critical regions] [critical regions] 1) send_IPIs(REBOOT) wait timeout 2) send_IPIs(NMI); Halt,NMI context 3) lapic_shutdown [IPI is pending] ... second kernel start 4) init_bsp_APIC [IPI is pending] ... local irq enable Halt, IPI context In simple terms, when the Kdump jump to the second kernel, the IPI that was pending in the first kernel remains and is responded to by the second kernel. As the reboot IPI can only be sent after acquiring @stopping_cpu by storing the CPU number, this case can be detected when @stopping_cpu contains the bootup value -1. Just return and ignore it. Fixes: 9c7af565c58e (“centos 8.1: import linux-4.18.0-147.5.1.el8_1”) Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- arch/x86/kernel/smp.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c index b2b87b91f336..07ccda0ad531 100644 --- a/arch/x86/kernel/smp.c +++ b/arch/x86/kernel/smp.c @@ -176,6 +176,29 @@ static int smp_stop_nmi_callback(unsigned int val, struct pt_regs *regs) asmlinkage __visible void smp_reboot_interrupt(void) { ipi_entering_ack_irq(); + + /* + * Handle the case where a reboot IPI is stale in the IRR. This + * happens when: + * + * a CPU crashes with interrupts disabled before handling the + * reboot IPI and jumps into a crash kernel. The reboot IPI + * vector is kept set in the APIC IRR across the APIC soft + * disabled phase and as there is no way to clear a pending IRR + * bit, it is delivered to the crash kernel immediately when + * interrupts are enabled. + * + * As the reboot IPI can only be sent after acquiring @stopping_cpu + * by storing the CPU number, this case can be detected when + * @stopping_cpu contains the bootup value -1. Just return and + * ignore it. + */ + if (atomic_read(&stopping_cpu) == -1) { + pr_info("Ignoring stale reboot IPI\n"); + irq_exit(); + return; + } + cpu_emergency_vmxoff(); stop_this_cpu(NULL); irq_exit(); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] x86/smp: ignore reboot IPI when stopping_cpu contains value
by Lin Yujun 04 Sep '25

04 Sep '25

From: Yipeng Zou <zouyipeng(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: NA ------------------------ Recently, A issue has been reported that CPU hang in x86 VM. The CPU halted during Kdump likely due to IPI issues when one CPU was rebooting and another was in Kdump: CPU0 CPU2 ======================== ====================== reboot Panic machine shutdown Kdump machine shutdown stop other cpus kdump_nmi_shootdown_cpus ... ... local_irq_disable local_irq_disable send_IPIs(REBOOT) [critical regions] [critical regions] 1) send_IPIs(REBOOT) wait timeout 2) send_IPIs(NMI); Halt,NMI context 3) lapic_shutdown [IPI is pending] ... second kernel start 4) init_bsp_APIC [IPI is pending] ... local irq enable Halt, IPI context In simple terms, when the Kdump jump to the second kernel, the IPI that was pending in the first kernel remains and is responded to by the second kernel. As the reboot IPI can only be sent after acquiring @stopping_cpu by storing the CPU number, this case can be detected when @stopping_cpu contains the bootup value -1. Just return and ignore it. Fixes: 9c7af565c58e (“centos 8.1: import linux-4.18.0-147.5.1.el8_1”) Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- arch/x86/kernel/smp.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c index b2b87b91f336..07ccda0ad531 100644 --- a/arch/x86/kernel/smp.c +++ b/arch/x86/kernel/smp.c @@ -176,6 +176,29 @@ static int smp_stop_nmi_callback(unsigned int val, struct pt_regs *regs) asmlinkage __visible void smp_reboot_interrupt(void) { ipi_entering_ack_irq(); + + /* + * Handle the case where a reboot IPI is stale in the IRR. This + * happens when: + * + * a CPU crashes with interrupts disabled before handling the + * reboot IPI and jumps into a crash kernel. The reboot IPI + * vector is kept set in the APIC IRR across the APIC soft + * disabled phase and as there is no way to clear a pending IRR + * bit, it is delivered to the crash kernel immediately when + * interrupts are enabled. + * + * As the reboot IPI can only be sent after acquiring @stopping_cpu + * by storing the CPU number, this case can be detected when + * @stopping_cpu contains the bootup value -1. Just return and + * ignore it. + */ + if (atomic_read(&stopping_cpu) == -1) { + pr_info("Ignoring stale reboot IPI\n"); + irq_exit(); + return; + } + cpu_emergency_vmxoff(); stop_this_cpu(NULL); irq_exit(); -- 2.34.1

2 1

[openeuler:OLK-6.6 2846/2846] block/blk-io-hierarchy/iodump.c:188:17: error: no member named 'bi_blkg' in 'struct bio'
by kernel test robot 04 Sep '25

04 Sep '25

Hi Yu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 34aca7dce8183a6832361f564e5d70abce03e657 commit: 1bf8f90fb90c600d9f372e6be4ef251cc8905f04 [2846/2846] block-io-hierarchy: core hierarchy stats and iodump implementation config: arm64-randconfig-r121-20250904 (https://download.01.org/0day-ci/archive/20250904/202509041845.IkUFt5vT-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce: (https://download.01.org/0day-ci/archive/20250904/202509041845.IkUFt5vT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509041845.IkUFt5vT-lkp@intel.com/ All errors (new ones prefixed by >>): >> block/blk-io-hierarchy/iodump.c:188:17: error: no member named 'bi_blkg' in 'struct bio' blkg_path(bio->bi_blkg, path, PATH_LEN); ~~~ ^ 1 error generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +188 block/blk-io-hierarchy/iodump.c 179 180 static void __hierarchy_show_bio(struct seq_file *m, struct bio *bio, 181 enum stage_group stage, u64 duration) 182 { 183 char rwbs[RWB_LEN]; 184 char path[PATH_LEN] = {0}; 185 struct task_struct *task = get_pid_task(bio->pid, PIDTYPE_PID); 186 187 blk_fill_rwbs(rwbs, bio->bi_opf); > 188 blkg_path(bio->bi_blkg, path, PATH_LEN); 189 190 seq_printf(m, "%s-%d %s stage %s bio %s %llu + %u cgroup %s started %llu ns ago\n", 191 task ? task->comm : "null", task ? task->pid : 0, 192 bio->bi_bdev->bd_disk->disk_name, 193 hierarchy_stage_name(stage), rwbs, bio->bi_iter.bi_sector, 194 bio_sectors(bio), path, duration); 195 196 if (task) 197 put_task_struct(task); 198 } 199 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 00/44] Cross-Generation Live Migration
by Jinqian Yang 04 Sep '25

04 Sep '25

Part1: Make CPU ID registers writable by userspace ----------------------------------------------------------------- Patch#1 KVM: arm64: Allow userspace to get the writable masks for feature ID registers Patch#2 KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS Patch#3 KVM: arm64: Use guest ID register values for the sake of emulation Patch#4 KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version Patch#5 KVM: arm64: Reject attempts to set invalid debug arch version Patch#6 KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 Patch#7 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 Patch#8 KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 Patch#9 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Patch#10 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 Patch#11 KVM: arm64: Document vCPU feature selection UAPIs Patch#12 KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace Patch#13 KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Patch#14 KVM: arm64: Rename is_id_reg() to imply VM scope Patch#15 KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs() Patch#16 KVM: arm64: Only reset vCPU-scoped feature ID regs once Patch#17 KVM: arm64: Use read-only helper for reading VM ID registers Patch#18 KVM: arm64: Add helper for writing ID regs Patch#19 KVM: arm64: Treat CTR_EL0 as a VM feature ID register Patch#20 KVM: arm64: rename functions for invariant sys regs Patch#21 KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace Patch#22 KVM: arm64: show writable masks for feature registers Patch#23 KVM: arm64: Make HCX writable from userspace Patch#24 KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Patch#25 arm64: Add support for HIP09 Spectre-BHB mitigation Patch#26 arm64: add cnp verification on Hisilicon erratum 162100125 Patch#27 KVM: arm64: use KABI_EXTEND to revert struct kvm kabi change Patch#28 KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden Patch#29 KVM: arm64: Sanitise ID_AA64MMFR3_EL1 Patch#30 KVM: arm64: Expose S1PIE to guests Patch#31 KVM: arm64: Expose Spec_FPACC to guests Patch#32 KVM: arm64: Select default PMU in KVM_ARM_VCPU_INIT handler Patch#33 KVM: arm64: Make AA64PFR1_EL1.NMI writeable Part2: Writable MIDR/REVIDR (and associated baggage) ----------------------------------------------------------------- Patch#34 KVM: arm64: Set HCR_EL2.TID1 unconditionally Patch#35 KVM: arm64: Maintain per-VM copy of implementation ID regs Patch#36 KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value Patch#37 KVM: arm64: Allow userspace to change the implementation ID registers Part3: Errata management for VM Live migration ----------------------------------------------------------------- Patch#38 arm64: Modify _midr_range() functions to read MIDR/REVIDR internally Patch#39 KVM: arm64: Specify hypercall ABI for retrieving target implementations Patch#40 KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 Patch#41 arm64: Make _midr_in_range_list() an exported function Patch#42 smccc/kvm_guest: Enable errata based on implementation CPUs Patch#43 smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Patch#44 smccc: kvm_guest: Fix kernel builds for 32 bit arm James Morse (1): KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Jing Zhang (5): KVM: arm64: Allow userspace to get the writable masks for feature ID registers KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS KVM: arm64: Use guest ID register values for the sake of emulation KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Jinqian Yang (2): KVM: arm64: Expose Spec_FPACC to guests KVM: arm64: Make AA64PFR1_EL1.NMI writeable KVM: arm64: Make HCX writable from userspace arm64: Add support for HIP09 Spectre-BHB mitigation arm64: add cnp verification on Hisilicon erratum 162100125 KVM: arm64: use KABI_EXTEND to revert struct kvm kabi change Joey Gouly (1): KVM: arm64: Sanitise ID_AA64MMFR3_EL1 Marc Zyngier (1): KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden Mark Brown (1): KVM: arm64: Expose S1PIE to guests Oliver Upton (14): KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version KVM: arm64: Reject attempts to set invalid debug arch version KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 KVM: arm64: Document vCPU feature selection UAPIs KVM: arm64: Rename is_id_reg() to imply VM scope KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs() KVM: arm64: Only reset vCPU-scoped feature ID regs once KVM: arm64: Use read-only helper for reading VM ID registers KVM: arm64: Add helper for writing ID regs KVM: arm64: Set HCR_EL2.TID1 unconditionally KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Reiji Watanabe (1): KVM: arm64: Select default PMU in KVM_ARM_VCPU_INIT handler Russell King (1): KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Sebastian Ott (5): KVM: arm64: Treat CTR_EL0 as a VM feature ID register KVM: arm64: rename functions for invariant sys regs KVM: arm64: show writable masks for feature registers KVM: arm64: Maintain per-VM copy of implementation ID regs KVM: arm64: Allow userspace to change the implementation ID registers Shameer Kolothum (8): KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace arm64: Modify _midr_range() functions to read MIDR/REVIDR internally KVM: arm64: Specify hypercall ABI for retrieving target implementations KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 arm64: Make _midr_in_range_list() an exported function smccc/kvm_guest: Enable errata based on implementation CPUs smccc: kvm_guest: Fix kernel builds for 32 bit arm Documentation/virt/kvm/api.rst | 70 +++ Documentation/virt/kvm/arm/index.rst | 1 + Documentation/virt/kvm/arm/vcpu-features.rst | 48 ++ arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cpufeature.h | 14 + arch/arm64/include/asm/cputype.h | 40 +- arch/arm64/include/asm/hypervisor.h | 1 + arch/arm64/include/asm/kvm_arm.h | 4 +- arch/arm64/include/asm/kvm_emulate.h | 3 +- arch/arm64/include/asm/kvm_host.h | 36 ++ arch/arm64/include/uapi/asm/kvm.h | 44 ++ arch/arm64/kernel/cpu_errata.c | 88 ++- arch/arm64/kernel/cpufeature.c | 12 +- arch/arm64/kernel/image-vars.h | 4 +- arch/arm64/kernel/proton-pack.c | 21 +- arch/arm64/kvm/arm.c | 43 +- arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 30 +- arch/arm64/kvm/hyp/nvhe/sysreg-sr.c | 4 +- arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 2 +- arch/arm64/kvm/hypercalls.c | 13 + arch/arm64/kvm/pmu-emul.c | 18 +- arch/arm64/kvm/sys_regs.c | 589 +++++++++++++------ arch/arm64/kvm/vgic/vgic-v3.c | 2 +- drivers/clocksource/arm_arch_timer.c | 2 +- drivers/firmware/smccc/kvm_guest.c | 66 +++ drivers/perf/arm_pmuv3.c | 2 +- include/kvm/arm_pmu.h | 6 + include/linux/arm-smccc.h | 16 + include/uapi/linux/kvm.h | 5 + 29 files changed, 931 insertions(+), 255 deletions(-) create mode 100644 Documentation/virt/kvm/arm/vcpu-features.rst -- 2.33.0

2 45

[PATCH OLK-5.10] memcg: introduce memcg early oom feature
by zhaoxuedong 04 Sep '25

04 Sep '25

meituan inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICTXDJ CVE: NA -------------------------------- Introduce memcg early oom feature to trigger OOM killer earlier; this feature is disabled by default. Signed-off-by: Zhao Xuedong <zhaoxuedong(a)meituan.com> --- mm/Kconfig | 14 ++++++++++ mm/vmscan.c | 73 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 87 insertions(+) diff --git a/mm/Kconfig b/mm/Kconfig index cc43f5124cb3..89bcb73b6a5b 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -521,6 +521,20 @@ config MEMCG_SWAP_QOS memcg swap control include memory force swapin, swapfile control and swap limit. +config MEMCG_EARLY_OOM + bool "Enable aggressive memcg OOM killing under memory pressure" + depends on MEMCG + depends on X86 || ARM64 + default n + help + MEMCG_EARLY_OOM makes memory cgroups trigger OOM killer earlier + and more aggressively when under memory pressure, rather than + attempting to reclaim very small amounts of file pages through + prolonged reclaim attempts. + + Say "y" if you prefer fast OOM kills over prolonged reclaim + attempts. + config ETMEM_SCAN tristate "module: etmem page scan for etmem support" depends on ETMEM diff --git a/mm/vmscan.c b/mm/vmscan.c index e82d7995b548..622122473f06 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -2470,11 +2470,62 @@ static bool inactive_is_low(struct lruvec *lruvec, enum lru_list inactive_lru) return inactive * inactive_ratio < active; } +#ifdef CONFIG_MEMCG_EARLY_OOM +/* Check if swap usage is over the limit for cgroupv1. */ +static bool is_swap_over_limit(struct mem_cgroup *memcg) +{ + unsigned long mem_limit = READ_ONCE(memcg->memory.max); + unsigned long memsw_limit = READ_ONCE(memcg->memsw.max); + + if (memsw_limit <= mem_limit) + return false; + + return (page_counter_read(&memcg->memsw) - + page_counter_read(&memcg->memory)) > + (memsw_limit - mem_limit); +} + +/* + * Check if file cache is too small to reclaim and anonymous pages are reclaimable. + * Returns true if: + * 1. File cache (+ free space) is below the minimum threshold (pages_min), AND + * 2. Anonymous pages are allowed to be deactivated, AND + * 3. Anonymous pages are abundant relative to reclaim priority + */ +static bool memcg_should_skip_file_reclaim(struct mem_cgroup *memcg, + struct scan_control *sc, + struct lruvec *lruvec) +{ + unsigned long file, anon, free; + unsigned long mem_limit, memsw_usage, mem_high; + unsigned long pages_min; + + if (!cgroup_reclaim(sc)) + return false; + + file = lruvec_lru_size(lruvec, LRU_INACTIVE_FILE, sc->reclaim_idx) + + lruvec_lru_size(lruvec, LRU_ACTIVE_FILE, sc->reclaim_idx); + mem_limit = READ_ONCE(memcg->memory.max); + memsw_usage = page_counter_read(&memcg->memsw); + mem_high = READ_ONCE(memcg->memory.high); + anon = lruvec_lru_size(lruvec, LRU_INACTIVE_ANON, sc->reclaim_idx); + free = mem_limit > memsw_usage ? mem_limit - memsw_usage : 0; + pages_min = mem_limit > mem_high ? (mem_limit - mem_high) >> 2 : 0; + + return (file + free <= pages_min) && + !(sc->may_deactivate & DEACTIVATE_ANON) && + (anon >> sc->priority); +} +#endif + enum scan_balance { SCAN_EQUAL, SCAN_FRACT, SCAN_ANON, SCAN_FILE, +#ifdef CONFIG_MEMCG_EARLY_OOM + SCAN_NONE, +#endif }; /* @@ -2498,6 +2549,20 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc, unsigned long ap, fp; enum lru_list lru; +#ifdef CONFIG_MEMCG_EARLY_OOM + /* + * if both file and anon pages are deemed non-reclaimable, + * we deliberately stop reclaiming early to trigger OOM killer + * faster. + */ + if (cgroup_reclaim(sc) && + is_swap_over_limit(memcg) && + memcg_should_skip_file_reclaim(memcg, sc, lruvec)) { + scan_balance = SCAN_NONE; + goto out; + } +#endif + if (sc->not_file) { scan_balance = SCAN_ANON; goto out; @@ -2543,7 +2608,12 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc, /* * If the system is almost out of file pages, force-scan anon. */ +#ifdef CONFIG_MEMCG_EARLY_OOM + if (sc->file_is_tiny || + memcg_should_skip_file_reclaim(memcg, sc, lruvec)) { +#else if (sc->file_is_tiny) { +#endif scan_balance = SCAN_ANON; goto out; } @@ -2687,6 +2757,9 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc, if ((scan_balance == SCAN_FILE) != file) scan = 0; break; + case SCAN_NONE: + scan = 0; + break; default: /* Look ma, no brain */ BUG(); -- 2.33.0

3 2

[PATCH openEuler-1.0-LTS] x86/smp: ignore reboot IPI when stopping_cpu contains value
by Lin Yujun 04 Sep '25

04 Sep '25

From: Yipeng Zou <zouyipeng(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: NA CVE: NA ------------------------ Recently, A issue has been reported that CPU hang in x86 VM. The CPU halted during Kdump likely due to IPI issues when one CPU was rebooting and another was in Kdump: CPU0 CPU2 ======================== ====================== reboot Panic machine shutdown Kdump machine shutdown stop other cpus kdump_nmi_shootdown_cpus ... ... local_irq_disable local_irq_disable send_IPIs(REBOOT) [critical regions] [critical regions] 1) send_IPIs(REBOOT) wait timeout 2) send_IPIs(NMI); Halt,NMI context 3) lapic_shutdown [IPI is pending] ... second kernel start 4) init_bsp_APIC [IPI is pending] ... local irq enable Halt, IPI context In simple terms, when the Kdump jump to the second kernel, the IPI that was pending in the first kernel remains and is responded to by the second kernel. As the reboot IPI can only be sent after acquiring @stopping_cpu by storing the CPU number, this case can be detected when @stopping_cpu contains the bootup value -1. Just return and ignore it. Fixes: 9c7af565c58e (“centos 8.1: import linux-4.18.0-147.5.1.el8_1”) Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- arch/x86/kernel/smp.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c index b2b87b91f336..07ccda0ad531 100644 --- a/arch/x86/kernel/smp.c +++ b/arch/x86/kernel/smp.c @@ -176,6 +176,29 @@ static int smp_stop_nmi_callback(unsigned int val, struct pt_regs *regs) asmlinkage __visible void smp_reboot_interrupt(void) { ipi_entering_ack_irq(); + + /* + * Handle the case where a reboot IPI is stale in the IRR. This + * happens when: + * + * a CPU crashes with interrupts disabled before handling the + * reboot IPI and jumps into a crash kernel. The reboot IPI + * vector is kept set in the APIC IRR across the APIC soft + * disabled phase and as there is no way to clear a pending IRR + * bit, it is delivered to the crash kernel immediately when + * interrupts are enabled. + * + * As the reboot IPI can only be sent after acquiring @stopping_cpu + * by storing the CPU number, this case can be detected when + * @stopping_cpu contains the bootup value -1. Just return and + * ignore it. + */ + if (atomic_read(&stopping_cpu) == -1) { + pr_info("Ignoring stale reboot IPI\n"); + irq_exit(); + return; + } + cpu_emergency_vmxoff(); stop_this_cpu(NULL); irq_exit(); -- 2.34.1

2 1