October 2021 - Kernel - mailweb.openeuler.org

[PATCH kernel-4.19 1/3] net: hns3: use ae_dev->ops->reset_event to do reset.
by Yang Yingliang 25 Oct '21

25 Oct '21

From: Yonglong Liu <liuyonglong(a)huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA ---------------------------- IT products want to know whether a reset is happened, so need to use ae_dev->ops->reset_event to notify them. Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> Reviewed-by: li yongxin <liyongxin1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 98a1d3d2870a9..8507eb60450fe 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -3933,6 +3933,7 @@ static void hclge_set_def_reset_request(struct hnae3_ae_dev *ae_dev, static void hclge_reset_timer(struct timer_list *t) { struct hclge_dev *hdev = from_timer(hdev, t, reset_timer); + struct hnae3_ae_dev *ae_dev = pci_get_drvdata(hdev->pdev); /* if default_reset_request has no value, it means that this reset * request has already be handled, so just return here @@ -3942,7 +3943,9 @@ static void hclge_reset_timer(struct timer_list *t) dev_info(&hdev->pdev->dev, "triggering reset in reset timer\n"); - hclge_reset_event(hdev->pdev, NULL); + + if (ae_dev->ops->reset_event) + ae_dev->ops->reset_event(hdev->pdev, NULL); } static bool hclge_reset_end(struct hnae3_handle *handle, bool done) -- 2.25.1

1 2

[PATCH kernel-4.19] media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
by Yang Yingliang 25 Oct '21

25 Oct '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> mainline inclusion from mainline-v5.16 commit 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e category: bugfix bugzilla: NA CVE: CVE-2021-42739 ------------------------------------------------- The bounds checking in avc_ca_pmt() is not strict enough. It should be checking "read_pos + 4" because it's reading 5 bytes. If the "es_info_length" is non-zero then it reads a 6th byte so there needs to be an additional check for that. I also added checks for the "write_pos". I don't think these are required because "read_pos" and "write_pos" are tied together so checking one ought to be enough. But they make the code easier to understand for me. The check on write_pos is: if (write_pos + 4 >= sizeof(c->operand) - 4) { The first "+ 4" is because we're writing 5 bytes and the last " - 4" is to leave space for the CRC. The other problem is that "length" can be invalid. It comes from "data_length" in fdtv_ca_pmt(). Cc: stable(a)vger.kernel.org Reported-by: Luo Likang <luolikang(a)nsfocus.com> Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/media/firewire/firedtv-avc.c | 14 +++++++++++--- drivers/media/firewire/firedtv-ci.c | 2 ++ 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/media/firewire/firedtv-avc.c b/drivers/media/firewire/firedtv-avc.c index 3ef5df1648d77..8c31cf90c5907 100644 --- a/drivers/media/firewire/firedtv-avc.c +++ b/drivers/media/firewire/firedtv-avc.c @@ -1169,7 +1169,11 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length) read_pos += program_info_length; write_pos += program_info_length; } - while (read_pos < length) { + while (read_pos + 4 < length) { + if (write_pos + 4 >= sizeof(c->operand) - 4) { + ret = -EINVAL; + goto out; + } c->operand[write_pos++] = msg[read_pos++]; c->operand[write_pos++] = msg[read_pos++]; c->operand[write_pos++] = msg[read_pos++]; @@ -1181,13 +1185,17 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length) c->operand[write_pos++] = es_info_length >> 8; c->operand[write_pos++] = es_info_length & 0xff; if (es_info_length > 0) { + if (read_pos >= length) { + ret = -EINVAL; + goto out; + } pmt_cmd_id = msg[read_pos++]; if (pmt_cmd_id != 1 && pmt_cmd_id != 4) dev_err(fdtv->device, "invalid pmt_cmd_id %d at stream level\n", pmt_cmd_id); - if (es_info_length > sizeof(c->operand) - 4 - - write_pos) { + if (es_info_length > sizeof(c->operand) - 4 - write_pos || + es_info_length > length - read_pos) { ret = -EINVAL; goto out; } diff --git a/drivers/media/firewire/firedtv-ci.c b/drivers/media/firewire/firedtv-ci.c index 8dc5a7495abee..14f779812d250 100644 --- a/drivers/media/firewire/firedtv-ci.c +++ b/drivers/media/firewire/firedtv-ci.c @@ -138,6 +138,8 @@ static int fdtv_ca_pmt(struct firedtv *fdtv, void *arg) } else { data_length = msg->msg[3]; } + if (data_length > sizeof(msg->msg) - data_pos) + return -EINVAL; return avc_ca_pmt(fdtv, &msg->msg[data_pos], data_length); } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] GPIO : support ascend gpio driver
by Yang Yingliang 25 Oct '21

25 Oct '21

From: wuhuaye <wuhuaye(a)huawei.com> ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4DLVR CVE: NA ------------------------------------------------- Hi everyone， This patch add some special gpio register configuration. It is necessary to configure some gpio register when gpio-dwapb function is enable in Ascend platform. Signed-off-by: wuhuaye <wuhuaye(a)huawei.com> Reviewed-by: Ding Tianhong <dingtianhong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/mm/init.c | 17 ++++++++++ drivers/gpio/gpio-dwapb.c | 66 ++++++++++++++++++++++++++++++++++++++- 2 files changed, 82 insertions(+), 1 deletion(-) diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c index 5449ae2d26bee..55fc6a0206796 100644 --- a/arch/arm64/mm/init.c +++ b/arch/arm64/mm/init.c @@ -941,6 +941,12 @@ __setup("keepinitrd", keepinitrd_setup); void ascend_enable_all_features(void) { +#ifdef CONFIG_GPIO_DWAPB + extern bool enable_ascend_gpio_dwapb; + + enable_ascend_gpio_dwapb = true; +#endif + if (IS_ENABLED(CONFIG_ASCEND_DVPP_MMAP)) enable_mmap_dvpp = 1; @@ -974,6 +980,17 @@ static int __init ascend_enable_setup(char *__unused) } early_param("ascend_enable_all", ascend_enable_setup); + +static int __init ascend_mini_enable_setup(char *s) +{ +#ifdef CONFIG_GPIO_DWAPB + extern bool enable_ascend_mini_gpio_dwapb; + + enable_ascend_mini_gpio_dwapb = true; +#endif + return 1; +} +__setup("ascend_mini_enable", ascend_mini_enable_setup); #endif diff --git a/drivers/gpio/gpio-dwapb.c b/drivers/gpio/gpio-dwapb.c index 044888fd96a1f..2cdbb4a11075f 100644 --- a/drivers/gpio/gpio-dwapb.c +++ b/drivers/gpio/gpio-dwapb.c @@ -50,6 +50,9 @@ #define GPIO_EXT_PORTB 0x54 #define GPIO_EXT_PORTC 0x58 #define GPIO_EXT_PORTD 0x5c +#define GPIO_INTCOMB_MASK 0xffc +#define GPIO_INT_MASK_REG 0x3804 +#define MEM_PERI_SUBCTRL_IOBASE 0x1 #define DWAPB_MAX_PORTS 4 #define GPIO_EXT_PORT_STRIDE 0x04 /* register stride 32 bits */ @@ -64,6 +67,8 @@ #define GPIO_INTSTATUS_V2 0x3c #define GPIO_PORTA_EOI_V2 0x40 +bool enable_ascend_mini_gpio_dwapb; +bool enable_ascend_gpio_dwapb; struct dwapb_gpio; #ifdef CONFIG_PM_SLEEP @@ -77,10 +82,11 @@ struct dwapb_context { u32 int_type; u32 int_pol; u32 int_deb; + u32 int_comb_mask; u32 wake_en; }; #endif - +static void __iomem *peri_subctrl_base_addr; struct dwapb_gpio_port { struct gpio_chip gc; bool is_registered; @@ -232,6 +238,11 @@ static void dwapb_irq_enable(struct irq_data *d) val = dwapb_read(gpio, GPIO_INTEN); val |= BIT(d->hwirq); dwapb_write(gpio, GPIO_INTEN, val); + if (enable_ascend_gpio_dwapb) { + val = dwapb_read(gpio, GPIO_INTMASK); + val &= ~BIT(d->hwirq); + dwapb_write(gpio, GPIO_INTMASK, val); + } spin_unlock_irqrestore(&gc->bgpio_lock, flags); } @@ -244,6 +255,11 @@ static void dwapb_irq_disable(struct irq_data *d) u32 val; spin_lock_irqsave(&gc->bgpio_lock, flags); + if (enable_ascend_gpio_dwapb) { + val = dwapb_read(gpio, GPIO_INTMASK); + val |= BIT(d->hwirq); + dwapb_write(gpio, GPIO_INTMASK, val); + } val = dwapb_read(gpio, GPIO_INTEN); val &= ~BIT(d->hwirq); dwapb_write(gpio, GPIO_INTEN, val); @@ -393,6 +409,7 @@ static void dwapb_configure_irqs(struct dwapb_gpio *gpio, unsigned int hwirq, ngpio = gc->ngpio; struct irq_chip_type *ct; int err, i; + u32 val; gpio->domain = irq_domain_create_linear(fwnode, ngpio, &irq_generic_chip_ops, gpio); @@ -470,6 +487,12 @@ static void dwapb_configure_irqs(struct dwapb_gpio *gpio, irq_create_mapping(gpio->domain, hwirq); port->gc.to_irq = dwapb_gpio_to_irq; + + if (enable_ascend_gpio_dwapb) { + val = dwapb_read(gpio, GPIO_INTCOMB_MASK); + val |= BIT(0); + dwapb_write(gpio, GPIO_INTCOMB_MASK, val); + } } static void dwapb_irq_teardown(struct dwapb_gpio *gpio) @@ -478,6 +501,7 @@ static void dwapb_irq_teardown(struct dwapb_gpio *gpio) struct gpio_chip *gc = &port->gc; unsigned int ngpio = gc->ngpio; irq_hw_number_t hwirq; + u32 val; if (!gpio->domain) return; @@ -487,6 +511,12 @@ static void dwapb_irq_teardown(struct dwapb_gpio *gpio) irq_domain_remove(gpio->domain); gpio->domain = NULL; + + if (enable_ascend_gpio_dwapb) { + val = dwapb_read(gpio, GPIO_INTCOMB_MASK); + val &= ~BIT(0); + dwapb_write(gpio, GPIO_INTCOMB_MASK, val); + } } static int dwapb_gpio_add_port(struct dwapb_gpio *gpio, @@ -660,6 +690,22 @@ static int dwapb_gpio_probe(struct platform_device *pdev) int err; struct device *dev = &pdev->dev; struct dwapb_platform_data *pdata = dev_get_platdata(dev); + struct device_node *np = dev->of_node; + unsigned int value; + + if (enable_ascend_mini_gpio_dwapb && enable_ascend_gpio_dwapb) { + peri_subctrl_base_addr = of_iomap(np, MEM_PERI_SUBCTRL_IOBASE); + if (!peri_subctrl_base_addr) { + dev_err(&pdev->dev, "sysctrl iomap not find!\n"); + } else { + dev_dbg(&pdev->dev, "sysctrl iomap find!\n"); + value = readl(peri_subctrl_base_addr + + GPIO_INT_MASK_REG); + value &= ~1UL; + writel(value, peri_subctrl_base_addr + + GPIO_INT_MASK_REG); + } + } if (!pdata) { pdata = dwapb_gpio_get_pdata(dev); @@ -742,6 +788,10 @@ static int dwapb_gpio_remove(struct platform_device *pdev) reset_control_assert(gpio->rst); clk_disable_unprepare(gpio->clk); + if ((peri_subctrl_base_addr != NULL) && enable_ascend_mini_gpio_dwapb && + enable_ascend_gpio_dwapb) + iounmap(peri_subctrl_base_addr); + return 0; } @@ -778,6 +828,9 @@ static int dwapb_gpio_suspend(struct device *dev) ctx->int_pol = dwapb_read(gpio, GPIO_INT_POLARITY); ctx->int_type = dwapb_read(gpio, GPIO_INTTYPE_LEVEL); ctx->int_deb = dwapb_read(gpio, GPIO_PORTA_DEBOUNCE); + if (enable_ascend_gpio_dwapb) + ctx->int_comb_mask = + dwapb_read(gpio, GPIO_INTCOMB_MASK); /* Mask out interrupts */ dwapb_write(gpio, GPIO_INTMASK, @@ -798,6 +851,7 @@ static int dwapb_gpio_resume(struct device *dev) struct gpio_chip *gc = &gpio->ports[0].gc; unsigned long flags; int i; + unsigned int value; if (!IS_ERR(gpio->clk)) clk_prepare_enable(gpio->clk); @@ -826,6 +880,9 @@ static int dwapb_gpio_resume(struct device *dev) dwapb_write(gpio, GPIO_PORTA_DEBOUNCE, ctx->int_deb); dwapb_write(gpio, GPIO_INTEN, ctx->int_en); dwapb_write(gpio, GPIO_INTMASK, ctx->int_mask); + if (enable_ascend_gpio_dwapb) + dwapb_write(gpio, + GPIO_INTCOMB_MASK, ctx->int_comb_mask); /* Clear out spurious interrupts */ dwapb_write(gpio, GPIO_PORTA_EOI, 0xffffffff); @@ -833,6 +890,13 @@ static int dwapb_gpio_resume(struct device *dev) } spin_unlock_irqrestore(&gc->bgpio_lock, flags); + if ((peri_subctrl_base_addr != NULL) && enable_ascend_mini_gpio_dwapb && + enable_ascend_gpio_dwapb) { + value = readl(peri_subctrl_base_addr + GPIO_INT_MASK_REG); + value &= ~1UL; + writel(value, peri_subctrl_base_addr + GPIO_INT_MASK_REG); + } + return 0; } #endif -- 2.25.1

1 0

[PATCH kernel-4.19] GPIO : support ascend gpio driver
by Yang Yingliang 25 Oct '21

25 Oct '21

From: wuhuaye <wuhuaye(a)huawei.com> ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4DLVR CVE: NA ------------------------------------------------- Hi everyone， This patch add some special gpio register configuration. It is necessary to configure some gpio register when gpio-dwapb function is enable in Ascend platform. Signed-off-by: wuhuaye <wuhuaye(a)huawei.com> Reviewed-by: Ding Tianhong <dingtianhong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/mm/init.c | 17 ++++++++++ drivers/gpio/gpio-dwapb.c | 66 ++++++++++++++++++++++++++++++++++++++- 2 files changed, 82 insertions(+), 1 deletion(-) diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c index 2399a257eaf33..8cdf92626c2c6 100644 --- a/arch/arm64/mm/init.c +++ b/arch/arm64/mm/init.c @@ -944,6 +944,12 @@ __setup("keepinitrd", keepinitrd_setup); void ascend_enable_all_features(void) { +#ifdef CONFIG_GPIO_DWAPB + extern bool enable_ascend_gpio_dwapb; + + enable_ascend_gpio_dwapb = true; +#endif + if (IS_ENABLED(CONFIG_ASCEND_DVPP_MMAP)) enable_mmap_dvpp = 1; @@ -981,6 +987,17 @@ static int __init ascend_enable_setup(char *__unused) } early_param("ascend_enable_all", ascend_enable_setup); + +static int __init ascend_mini_enable_setup(char *s) +{ +#ifdef CONFIG_GPIO_DWAPB + extern bool enable_ascend_mini_gpio_dwapb; + + enable_ascend_mini_gpio_dwapb = true; +#endif + return 1; +} +__setup("ascend_mini_enable", ascend_mini_enable_setup); #endif diff --git a/drivers/gpio/gpio-dwapb.c b/drivers/gpio/gpio-dwapb.c index 2a56efced7988..4c332f0ed8524 100644 --- a/drivers/gpio/gpio-dwapb.c +++ b/drivers/gpio/gpio-dwapb.c @@ -50,6 +50,9 @@ #define GPIO_EXT_PORTB 0x54 #define GPIO_EXT_PORTC 0x58 #define GPIO_EXT_PORTD 0x5c +#define GPIO_INTCOMB_MASK 0xffc +#define GPIO_INT_MASK_REG 0x3804 +#define MEM_PERI_SUBCTRL_IOBASE 0x1 #define DWAPB_DRIVER_NAME "gpio-dwapb" #define DWAPB_MAX_PORTS 4 @@ -66,6 +69,8 @@ #define GPIO_INTSTATUS_V2 0x3c #define GPIO_PORTA_EOI_V2 0x40 +bool enable_ascend_mini_gpio_dwapb; +bool enable_ascend_gpio_dwapb; struct dwapb_gpio; #ifdef CONFIG_PM_SLEEP @@ -79,10 +84,11 @@ struct dwapb_context { u32 int_type; u32 int_pol; u32 int_deb; + u32 int_comb_mask; u32 wake_en; }; #endif - +static void __iomem *peri_subctrl_base_addr; struct dwapb_gpio_port { struct gpio_chip gc; bool is_registered; @@ -234,6 +240,11 @@ static void dwapb_irq_enable(struct irq_data *d) val = dwapb_read(gpio, GPIO_INTEN); val |= BIT(d->hwirq); dwapb_write(gpio, GPIO_INTEN, val); + if (enable_ascend_gpio_dwapb) { + val = dwapb_read(gpio, GPIO_INTMASK); + val &= ~BIT(d->hwirq); + dwapb_write(gpio, GPIO_INTMASK, val); + } spin_unlock_irqrestore(&gc->bgpio_lock, flags); } @@ -246,6 +257,11 @@ static void dwapb_irq_disable(struct irq_data *d) u32 val; spin_lock_irqsave(&gc->bgpio_lock, flags); + if (enable_ascend_gpio_dwapb) { + val = dwapb_read(gpio, GPIO_INTMASK); + val |= BIT(d->hwirq); + dwapb_write(gpio, GPIO_INTMASK, val); + } val = dwapb_read(gpio, GPIO_INTEN); val &= ~BIT(d->hwirq); dwapb_write(gpio, GPIO_INTEN, val); @@ -395,6 +411,7 @@ static void dwapb_configure_irqs(struct dwapb_gpio *gpio, unsigned int hwirq, ngpio = gc->ngpio; struct irq_chip_type *ct; int err, i; + u32 val; gpio->domain = irq_domain_create_linear(fwnode, ngpio, &irq_generic_chip_ops, gpio); @@ -472,6 +489,12 @@ static void dwapb_configure_irqs(struct dwapb_gpio *gpio, irq_create_mapping(gpio->domain, hwirq); port->gc.to_irq = dwapb_gpio_to_irq; + + if (enable_ascend_gpio_dwapb) { + val = dwapb_read(gpio, GPIO_INTCOMB_MASK); + val |= BIT(0); + dwapb_write(gpio, GPIO_INTCOMB_MASK, val); + } } static void dwapb_irq_teardown(struct dwapb_gpio *gpio) @@ -480,6 +503,7 @@ static void dwapb_irq_teardown(struct dwapb_gpio *gpio) struct gpio_chip *gc = &port->gc; unsigned int ngpio = gc->ngpio; irq_hw_number_t hwirq; + u32 val; if (!gpio->domain) return; @@ -489,6 +513,12 @@ static void dwapb_irq_teardown(struct dwapb_gpio *gpio) irq_domain_remove(gpio->domain); gpio->domain = NULL; + + if (enable_ascend_gpio_dwapb) { + val = dwapb_read(gpio, GPIO_INTCOMB_MASK); + val &= ~BIT(0); + dwapb_write(gpio, GPIO_INTCOMB_MASK, val); + } } static int dwapb_gpio_add_port(struct dwapb_gpio *gpio, @@ -669,6 +699,22 @@ static int dwapb_gpio_probe(struct platform_device *pdev) int err; struct device *dev = &pdev->dev; struct dwapb_platform_data *pdata = dev_get_platdata(dev); + struct device_node *np = dev->of_node; + unsigned int value; + + if (enable_ascend_mini_gpio_dwapb && enable_ascend_gpio_dwapb) { + peri_subctrl_base_addr = of_iomap(np, MEM_PERI_SUBCTRL_IOBASE); + if (!peri_subctrl_base_addr) { + dev_err(&pdev->dev, "sysctrl iomap not find!\n"); + } else { + dev_dbg(&pdev->dev, "sysctrl iomap find!\n"); + value = readl(peri_subctrl_base_addr + + GPIO_INT_MASK_REG); + value &= ~1UL; + writel(value, peri_subctrl_base_addr + + GPIO_INT_MASK_REG); + } + } if (!pdata) { pdata = dwapb_gpio_get_pdata(dev); @@ -751,6 +797,10 @@ static int dwapb_gpio_remove(struct platform_device *pdev) reset_control_assert(gpio->rst); clk_disable_unprepare(gpio->clk); + if ((peri_subctrl_base_addr != NULL) && enable_ascend_mini_gpio_dwapb && + enable_ascend_gpio_dwapb) + iounmap(peri_subctrl_base_addr); + return 0; } @@ -787,6 +837,9 @@ static int dwapb_gpio_suspend(struct device *dev) ctx->int_pol = dwapb_read(gpio, GPIO_INT_POLARITY); ctx->int_type = dwapb_read(gpio, GPIO_INTTYPE_LEVEL); ctx->int_deb = dwapb_read(gpio, GPIO_PORTA_DEBOUNCE); + if (enable_ascend_gpio_dwapb) + ctx->int_comb_mask = + dwapb_read(gpio, GPIO_INTCOMB_MASK); /* Mask out interrupts */ dwapb_write(gpio, GPIO_INTMASK, @@ -807,6 +860,7 @@ static int dwapb_gpio_resume(struct device *dev) struct gpio_chip *gc = &gpio->ports[0].gc; unsigned long flags; int i; + unsigned int value; if (!IS_ERR(gpio->clk)) clk_prepare_enable(gpio->clk); @@ -835,6 +889,9 @@ static int dwapb_gpio_resume(struct device *dev) dwapb_write(gpio, GPIO_PORTA_DEBOUNCE, ctx->int_deb); dwapb_write(gpio, GPIO_INTEN, ctx->int_en); dwapb_write(gpio, GPIO_INTMASK, ctx->int_mask); + if (enable_ascend_gpio_dwapb) + dwapb_write(gpio, + GPIO_INTCOMB_MASK, ctx->int_comb_mask); /* Clear out spurious interrupts */ dwapb_write(gpio, GPIO_PORTA_EOI, 0xffffffff); @@ -842,6 +899,13 @@ static int dwapb_gpio_resume(struct device *dev) } spin_unlock_irqrestore(&gc->bgpio_lock, flags); + if ((peri_subctrl_base_addr != NULL) && enable_ascend_mini_gpio_dwapb && + enable_ascend_gpio_dwapb) { + value = readl(peri_subctrl_base_addr + GPIO_INT_MASK_REG); + value &= ~1UL; + writel(value, peri_subctrl_base_addr + GPIO_INT_MASK_REG); + } + return 0; } #endif -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/9] iommu/arm-smmu-v3: Add support to configure mpam in STE/CD context
by Yang Yingliang 25 Oct '21

25 Oct '21

From: Xingang Wang <wangxingang5(a)huawei.com> ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49RB2 CVE: NA ------------------------------------------------- To support limiting qos of device, the partid and pmg need to be set into the SMMU STE/CD context. This introduce support of SMMU mpam feature and add interface to set mpam configuration in STE/CD. Signed-off-by: Xingang Wang <wangxingang5(a)huawei.com> Signed-off-by: Rui Zhu <zhurui3(a)huawei.com> Reviewed-by: Yingtai Xie <xieyingtai(a)huawei.com> Reviewed-by: Zhen Lei <thunder.leizhen(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/arm-smmu-v3-context.c | 25 +++++ drivers/iommu/arm-smmu-v3.c | 151 ++++++++++++++++++++++++++++ include/linux/ascend_smmu.h | 9 ++ 3 files changed, 185 insertions(+) create mode 100644 include/linux/ascend_smmu.h diff --git a/drivers/iommu/arm-smmu-v3-context.c b/drivers/iommu/arm-smmu-v3-context.c index 2351de86d31f1..b30a93e076608 100644 --- a/drivers/iommu/arm-smmu-v3-context.c +++ b/drivers/iommu/arm-smmu-v3-context.c @@ -66,6 +66,9 @@ #define CTXDESC_CD_1_TTB0_MASK GENMASK_ULL(51, 4) +#define CTXDESC_CD_5_PARTID_MASK GENMASK_ULL(47, 32) +#define CTXDESC_CD_5_PMG_MASK GENMASK_ULL(55, 48) + /* Convert between AArch64 (CPU) TCR format and SMMU CD format */ #define ARM_SMMU_TCR2CD(tcr, fld) FIELD_PREP(CTXDESC_CD_0_TCR_##fld, \ FIELD_GET(ARM64_TCR_##fld, tcr)) @@ -563,6 +566,28 @@ static int arm_smmu_set_cd(struct iommu_pasid_table_ops *ops, int pasid, return arm_smmu_write_ctx_desc(tbl, pasid, cd); } +int arm_smmu_set_cd_mpam(struct iommu_pasid_table_ops *ops, + int ssid, int partid, int pmg) +{ + struct arm_smmu_cd_tables *tbl = pasid_ops_to_tables(ops); + u64 val; + __le64 *cdptr = arm_smmu_get_cd_ptr(tbl, ssid); + + if (!cdptr) + return -ENOMEM; + + val = le64_to_cpu(cdptr[5]); + val &= ~CTXDESC_CD_5_PARTID_MASK; + val |= FIELD_PREP(CTXDESC_CD_5_PARTID_MASK, partid); + val &= ~CTXDESC_CD_5_PMG_MASK; + val |= FIELD_PREP(CTXDESC_CD_5_PMG_MASK, pmg); + WRITE_ONCE(cdptr[5], cpu_to_le64(val)); + + iommu_pasid_flush(&tbl->pasid, ssid, true); + + return 0; +} + static void arm_smmu_clear_cd(struct iommu_pasid_table_ops *ops, int pasid, struct iommu_pasid_entry *entry) { diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c index 6731b47558f4d..c282fc129222f 100644 --- a/drivers/iommu/arm-smmu-v3.c +++ b/drivers/iommu/arm-smmu-v3.c @@ -88,6 +88,10 @@ #define IDR1_SSIDSIZE GENMASK(10, 6) #define IDR1_SIDSIZE GENMASK(5, 0) +#define ARM_SMMU_IDR3 0xc +#define IDR3_MPAM (1 << 7) +#define ARM_SMMU_IDR3_CFG 0x140C + #define ARM_SMMU_IDR5 0x14 #define IDR5_STALL_MAX GENMASK(31, 16) #define IDR5_GRAN64K (1 << 6) @@ -186,6 +190,10 @@ #define ARM_SMMU_PRIQ_IRQ_CFG1 0xd8 #define ARM_SMMU_PRIQ_IRQ_CFG2 0xdc +#define ARM_SMMU_MPAMIDR 0x130 +#define MPAMIDR_PMG_MAX GENMASK(23, 16) +#define MPAMIDR_PARTID_MAX GENMASK(15, 0) + /* Common MSI config fields */ #define MSI_CFG0_ADDR_MASK GENMASK_ULL(51, 2) #define MSI_CFG2_SH GENMASK(5, 4) @@ -250,6 +258,7 @@ #define STRTAB_STE_1_S1COR GENMASK_ULL(5, 4) #define STRTAB_STE_1_S1CSH GENMASK_ULL(7, 6) +#define STRTAB_STE_1_S1MPAM (1UL << 26) #define STRTAB_STE_1_S1STALLD (1UL << 27) #define STRTAB_STE_1_EATS GENMASK_ULL(29, 28) @@ -273,6 +282,11 @@ #define STRTAB_STE_3_S2TTB_MASK GENMASK_ULL(51, 4) +#define STRTAB_STE_4_PARTID_MASK GENMASK_ULL(31, 16) + +#define STRTAB_STE_5_MPAM_NS (1UL << 8) +#define STRTAB_STE_5_PMG_MASK GENMASK_ULL(7, 0) + /* Command queue */ #define CMDQ_ENT_SZ_SHIFT 4 #define CMDQ_ENT_DWORDS ((1 << CMDQ_ENT_SZ_SHIFT) >> 3) @@ -634,6 +648,7 @@ struct arm_smmu_device { #define ARM_SMMU_FEAT_SVA (1 << 17) #define ARM_SMMU_FEAT_HA (1 << 18) #define ARM_SMMU_FEAT_HD (1 << 19) +#define ARM_SMMU_FEAT_MPAM (1 << 20) u32 features; #define ARM_SMMU_OPT_SKIP_PREFETCH (1 << 0) @@ -672,6 +687,9 @@ struct arm_smmu_device { struct mutex streams_mutex; struct iopf_queue *iopf_queue; + + unsigned int mpam_partid_max; + unsigned int mpam_pmg_max; }; struct arm_smmu_stream { @@ -3977,6 +3995,25 @@ static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu) if (smmu->sid_bits <= STRTAB_SPLIT) smmu->features &= ~ARM_SMMU_FEAT_2_LVL_STRTAB; + /* IDR3 */ + reg = readl_relaxed(smmu->base + ARM_SMMU_IDR3); + + if (!(reg & IDR3_MPAM)) { + reg |= FIELD_PREP(IDR3_MPAM, 1); + writel(reg, smmu->base + ARM_SMMU_IDR3_CFG); + reg = readl_relaxed(smmu->base + ARM_SMMU_IDR3); + if (!(reg & IDR3_MPAM)) + dev_warn(smmu->dev, "enable smmu mpam failed\n"); + } + + if (reg & IDR3_MPAM) { + reg = readl_relaxed(smmu->base + ARM_SMMU_MPAMIDR); + smmu->mpam_partid_max = FIELD_GET(MPAMIDR_PARTID_MAX, reg); + smmu->mpam_pmg_max = FIELD_GET(MPAMIDR_PMG_MAX, reg); + if (smmu->mpam_partid_max || smmu->mpam_pmg_max) + smmu->features |= ARM_SMMU_FEAT_MPAM; + } + /* IDR5 */ reg = readl_relaxed(smmu->base + ARM_SMMU_IDR5); @@ -4124,6 +4161,120 @@ static unsigned long arm_smmu_resource_size(struct arm_smmu_device *smmu) return SZ_128K; } +static int arm_smmu_set_ste_mpam(struct arm_smmu_device *smmu, + int sid, int partid, int pmg, int s1mpam) +{ + u64 val; + __le64 *ste; + + if (!arm_smmu_sid_in_range(smmu, sid)) + return -ERANGE; + + /* get ste ptr */ + ste = arm_smmu_get_step_for_sid(smmu, sid); + + /* write s1mpam to ste */ + val = le64_to_cpu(ste[1]); + val &= ~STRTAB_STE_1_S1MPAM; + val |= FIELD_PREP(STRTAB_STE_1_S1MPAM, s1mpam); + WRITE_ONCE(ste[1], cpu_to_le64(val)); + + val = le64_to_cpu(ste[4]); + val &= ~STRTAB_STE_4_PARTID_MASK; + val |= FIELD_PREP(STRTAB_STE_4_PARTID_MASK, partid); + WRITE_ONCE(ste[4], cpu_to_le64(val)); + + val = le64_to_cpu(ste[5]); + val &= ~STRTAB_STE_5_PMG_MASK; + val |= FIELD_PREP(STRTAB_STE_5_PMG_MASK, pmg); + WRITE_ONCE(ste[5], cpu_to_le64(val)); + + arm_smmu_sync_ste_for_sid(smmu, sid); + + return 0; +} + +int arm_smmu_set_cd_mpam(struct iommu_pasid_table_ops *ops, + int ssid, int partid, int pmg); + +static int arm_smmu_set_mpam(struct arm_smmu_device *smmu, + int sid, int ssid, int partid, int pmg, int s1mpam) +{ + struct arm_smmu_master_data *master = arm_smmu_find_master(smmu, sid); + struct arm_smmu_s1_cfg *cfg = master ? master->ste.s1_cfg : NULL; + struct arm_smmu_domain *domain = master ? master->domain : NULL; + int ret; + + struct arm_smmu_cmdq_ent prefetch_cmd = { + .opcode = CMDQ_OP_PREFETCH_CFG, + .prefetch = { + .sid = sid, + }, + }; + + if (!(smmu->features & ARM_SMMU_FEAT_MPAM)) + return -ENODEV; + + if (WARN_ON(!domain)) + return -EINVAL; + + if (WARN_ON(!cfg)) + return -EINVAL; + + if (WARN_ON(ssid >= (1 << master->ssid_bits))) + return -E2BIG; + + if (partid > smmu->mpam_partid_max || pmg > smmu->mpam_pmg_max) { + dev_err(smmu->dev, + "mpam rmid out of range: partid[0, %d] pmg[0, %d]\n", + smmu->mpam_partid_max, smmu->mpam_pmg_max); + return -ERANGE; + } + + ret = arm_smmu_set_ste_mpam(smmu, sid, partid, pmg, s1mpam); + if (ret < 0) { + dev_err(smmu->dev, "set ste mpam configuration error %d\n", + ret); + return ret; + } + + /* do not modify cd table which owned by guest */ + if (domain->stage == ARM_SMMU_DOMAIN_NESTED) { + dev_err(smmu->dev, + "mpam: smmu cd is owned by guest, not modified\n"); + return 0; + } + + ret = arm_smmu_set_cd_mpam(cfg->ops, ssid, partid, pmg); + if (s1mpam && ret < 0) { + dev_err(smmu->dev, "set cd mpam configuration error %d\n", + ret); + return ret; + } + + /* It's likely that we'll want to use the new STE soon */ + if (!(smmu->options & ARM_SMMU_OPT_SKIP_PREFETCH)) + arm_smmu_cmdq_issue_cmd(smmu, &prefetch_cmd); + + dev_info(smmu->dev, "partid %d, pmg %d\n", partid, pmg); + + return 0; +} + +/** + * arm_smmu_set_dev_mpam() - Set mpam configuration to SMMU STE/CD + */ +int arm_smmu_set_dev_mpam(struct device *dev, int ssid, int partid, int pmg, + int s1mpam) +{ + struct arm_smmu_master_data *master = dev->iommu_fwspec->iommu_priv; + struct arm_smmu_device *smmu = master->domain->smmu; + int sid = master->streams->id; + + return arm_smmu_set_mpam(smmu, sid, ssid, partid, pmg, s1mpam); +} +EXPORT_SYMBOL(arm_smmu_set_dev_mpam); + static int arm_smmu_device_probe(struct platform_device *pdev) { int irq, ret; diff --git a/include/linux/ascend_smmu.h b/include/linux/ascend_smmu.h new file mode 100644 index 0000000000000..bd0edd25057e1 --- /dev/null +++ b/include/linux/ascend_smmu.h @@ -0,0 +1,9 @@ +#ifndef __LINUX_ASCEND_SMMU_H +#define __LINUX_ASCEND_SMMU_H + +#include <linux/device.h> + +extern int arm_smmu_set_dev_mpam(struct device *dev, int ssid, int partid, + int pmg, int s1mpam); + +#endif /* __LINUX_ASCEND_SMMU_H */ -- 2.25.1

1 8

[PATCH kernel-4.19 1/9] iommu/arm-smmu-v3: Add support to configure mpam in STE/CD context
by Yang Yingliang 25 Oct '21

25 Oct '21

From: Xingang Wang <wangxingang5(a)huawei.com> ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49RB2 CVE: NA ------------------------------------------------- To support limiting qos of device, the partid and pmg need to be set into the SMMU STE/CD context. This introduce support of SMMU mpam feature and add interface to set mpam configuration in STE/CD. Signed-off-by: Xingang Wang <wangxingang5(a)huawei.com> Signed-off-by: Rui Zhu <zhurui3(a)huawei.com> Reviewed-by: Yingtai Xie <xieyingtai(a)huawei.com> Reviewed-by: Zhen Lei <thunder.leizhen(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/arm-smmu-v3-context.c | 25 +++++ drivers/iommu/arm-smmu-v3.c | 151 ++++++++++++++++++++++++++++ include/linux/ascend_smmu.h | 9 ++ 3 files changed, 185 insertions(+) create mode 100644 include/linux/ascend_smmu.h diff --git a/drivers/iommu/arm-smmu-v3-context.c b/drivers/iommu/arm-smmu-v3-context.c index 2351de86d31f1..b30a93e076608 100644 --- a/drivers/iommu/arm-smmu-v3-context.c +++ b/drivers/iommu/arm-smmu-v3-context.c @@ -66,6 +66,9 @@ #define CTXDESC_CD_1_TTB0_MASK GENMASK_ULL(51, 4) +#define CTXDESC_CD_5_PARTID_MASK GENMASK_ULL(47, 32) +#define CTXDESC_CD_5_PMG_MASK GENMASK_ULL(55, 48) + /* Convert between AArch64 (CPU) TCR format and SMMU CD format */ #define ARM_SMMU_TCR2CD(tcr, fld) FIELD_PREP(CTXDESC_CD_0_TCR_##fld, \ FIELD_GET(ARM64_TCR_##fld, tcr)) @@ -563,6 +566,28 @@ static int arm_smmu_set_cd(struct iommu_pasid_table_ops *ops, int pasid, return arm_smmu_write_ctx_desc(tbl, pasid, cd); } +int arm_smmu_set_cd_mpam(struct iommu_pasid_table_ops *ops, + int ssid, int partid, int pmg) +{ + struct arm_smmu_cd_tables *tbl = pasid_ops_to_tables(ops); + u64 val; + __le64 *cdptr = arm_smmu_get_cd_ptr(tbl, ssid); + + if (!cdptr) + return -ENOMEM; + + val = le64_to_cpu(cdptr[5]); + val &= ~CTXDESC_CD_5_PARTID_MASK; + val |= FIELD_PREP(CTXDESC_CD_5_PARTID_MASK, partid); + val &= ~CTXDESC_CD_5_PMG_MASK; + val |= FIELD_PREP(CTXDESC_CD_5_PMG_MASK, pmg); + WRITE_ONCE(cdptr[5], cpu_to_le64(val)); + + iommu_pasid_flush(&tbl->pasid, ssid, true); + + return 0; +} + static void arm_smmu_clear_cd(struct iommu_pasid_table_ops *ops, int pasid, struct iommu_pasid_entry *entry) { diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c index 8b5083c3e0a16..6634d596f7efc 100644 --- a/drivers/iommu/arm-smmu-v3.c +++ b/drivers/iommu/arm-smmu-v3.c @@ -88,6 +88,10 @@ #define IDR1_SSIDSIZE GENMASK(10, 6) #define IDR1_SIDSIZE GENMASK(5, 0) +#define ARM_SMMU_IDR3 0xc +#define IDR3_MPAM (1 << 7) +#define ARM_SMMU_IDR3_CFG 0x140C + #define ARM_SMMU_IDR5 0x14 #define IDR5_STALL_MAX GENMASK(31, 16) #define IDR5_GRAN64K (1 << 6) @@ -186,6 +190,10 @@ #define ARM_SMMU_PRIQ_IRQ_CFG1 0xd8 #define ARM_SMMU_PRIQ_IRQ_CFG2 0xdc +#define ARM_SMMU_MPAMIDR 0x130 +#define MPAMIDR_PMG_MAX GENMASK(23, 16) +#define MPAMIDR_PARTID_MAX GENMASK(15, 0) + /* Common MSI config fields */ #define MSI_CFG0_ADDR_MASK GENMASK_ULL(51, 2) #define MSI_CFG2_SH GENMASK(5, 4) @@ -250,6 +258,7 @@ #define STRTAB_STE_1_S1COR GENMASK_ULL(5, 4) #define STRTAB_STE_1_S1CSH GENMASK_ULL(7, 6) +#define STRTAB_STE_1_S1MPAM (1UL << 26) #define STRTAB_STE_1_S1STALLD (1UL << 27) #define STRTAB_STE_1_EATS GENMASK_ULL(29, 28) @@ -273,6 +282,11 @@ #define STRTAB_STE_3_S2TTB_MASK GENMASK_ULL(51, 4) +#define STRTAB_STE_4_PARTID_MASK GENMASK_ULL(31, 16) + +#define STRTAB_STE_5_MPAM_NS (1UL << 8) +#define STRTAB_STE_5_PMG_MASK GENMASK_ULL(7, 0) + /* Command queue */ #define CMDQ_ENT_SZ_SHIFT 4 #define CMDQ_ENT_DWORDS ((1 << CMDQ_ENT_SZ_SHIFT) >> 3) @@ -634,6 +648,7 @@ struct arm_smmu_device { #define ARM_SMMU_FEAT_SVA (1 << 17) #define ARM_SMMU_FEAT_HA (1 << 18) #define ARM_SMMU_FEAT_HD (1 << 19) +#define ARM_SMMU_FEAT_MPAM (1 << 20) u32 features; #define ARM_SMMU_OPT_SKIP_PREFETCH (1 << 0) @@ -672,6 +687,9 @@ struct arm_smmu_device { struct mutex streams_mutex; struct iopf_queue *iopf_queue; + + unsigned int mpam_partid_max; + unsigned int mpam_pmg_max; }; struct arm_smmu_stream { @@ -3980,6 +3998,25 @@ static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu) if (smmu->sid_bits <= STRTAB_SPLIT) smmu->features &= ~ARM_SMMU_FEAT_2_LVL_STRTAB; + /* IDR3 */ + reg = readl_relaxed(smmu->base + ARM_SMMU_IDR3); + + if (!(reg & IDR3_MPAM)) { + reg |= FIELD_PREP(IDR3_MPAM, 1); + writel(reg, smmu->base + ARM_SMMU_IDR3_CFG); + reg = readl_relaxed(smmu->base + ARM_SMMU_IDR3); + if (!(reg & IDR3_MPAM)) + dev_warn(smmu->dev, "enable smmu mpam failed\n"); + } + + if (reg & IDR3_MPAM) { + reg = readl_relaxed(smmu->base + ARM_SMMU_MPAMIDR); + smmu->mpam_partid_max = FIELD_GET(MPAMIDR_PARTID_MAX, reg); + smmu->mpam_pmg_max = FIELD_GET(MPAMIDR_PMG_MAX, reg); + if (smmu->mpam_partid_max || smmu->mpam_pmg_max) + smmu->features |= ARM_SMMU_FEAT_MPAM; + } + /* IDR5 */ reg = readl_relaxed(smmu->base + ARM_SMMU_IDR5); @@ -4127,6 +4164,120 @@ static unsigned long arm_smmu_resource_size(struct arm_smmu_device *smmu) return SZ_128K; } +static int arm_smmu_set_ste_mpam(struct arm_smmu_device *smmu, + int sid, int partid, int pmg, int s1mpam) +{ + u64 val; + __le64 *ste; + + if (!arm_smmu_sid_in_range(smmu, sid)) + return -ERANGE; + + /* get ste ptr */ + ste = arm_smmu_get_step_for_sid(smmu, sid); + + /* write s1mpam to ste */ + val = le64_to_cpu(ste[1]); + val &= ~STRTAB_STE_1_S1MPAM; + val |= FIELD_PREP(STRTAB_STE_1_S1MPAM, s1mpam); + WRITE_ONCE(ste[1], cpu_to_le64(val)); + + val = le64_to_cpu(ste[4]); + val &= ~STRTAB_STE_4_PARTID_MASK; + val |= FIELD_PREP(STRTAB_STE_4_PARTID_MASK, partid); + WRITE_ONCE(ste[4], cpu_to_le64(val)); + + val = le64_to_cpu(ste[5]); + val &= ~STRTAB_STE_5_PMG_MASK; + val |= FIELD_PREP(STRTAB_STE_5_PMG_MASK, pmg); + WRITE_ONCE(ste[5], cpu_to_le64(val)); + + arm_smmu_sync_ste_for_sid(smmu, sid); + + return 0; +} + +int arm_smmu_set_cd_mpam(struct iommu_pasid_table_ops *ops, + int ssid, int partid, int pmg); + +static int arm_smmu_set_mpam(struct arm_smmu_device *smmu, + int sid, int ssid, int partid, int pmg, int s1mpam) +{ + struct arm_smmu_master_data *master = arm_smmu_find_master(smmu, sid); + struct arm_smmu_s1_cfg *cfg = master ? master->ste.s1_cfg : NULL; + struct arm_smmu_domain *domain = master ? master->domain : NULL; + int ret; + + struct arm_smmu_cmdq_ent prefetch_cmd = { + .opcode = CMDQ_OP_PREFETCH_CFG, + .prefetch = { + .sid = sid, + }, + }; + + if (!(smmu->features & ARM_SMMU_FEAT_MPAM)) + return -ENODEV; + + if (WARN_ON(!domain)) + return -EINVAL; + + if (WARN_ON(!cfg)) + return -EINVAL; + + if (WARN_ON(ssid >= (1 << master->ssid_bits))) + return -E2BIG; + + if (partid > smmu->mpam_partid_max || pmg > smmu->mpam_pmg_max) { + dev_err(smmu->dev, + "mpam rmid out of range: partid[0, %d] pmg[0, %d]\n", + smmu->mpam_partid_max, smmu->mpam_pmg_max); + return -ERANGE; + } + + ret = arm_smmu_set_ste_mpam(smmu, sid, partid, pmg, s1mpam); + if (ret < 0) { + dev_err(smmu->dev, "set ste mpam configuration error %d\n", + ret); + return ret; + } + + /* do not modify cd table which owned by guest */ + if (domain->stage == ARM_SMMU_DOMAIN_NESTED) { + dev_err(smmu->dev, + "mpam: smmu cd is owned by guest, not modified\n"); + return 0; + } + + ret = arm_smmu_set_cd_mpam(cfg->ops, ssid, partid, pmg); + if (s1mpam && ret < 0) { + dev_err(smmu->dev, "set cd mpam configuration error %d\n", + ret); + return ret; + } + + /* It's likely that we'll want to use the new STE soon */ + if (!(smmu->options & ARM_SMMU_OPT_SKIP_PREFETCH)) + arm_smmu_cmdq_issue_cmd(smmu, &prefetch_cmd); + + dev_info(smmu->dev, "partid %d, pmg %d\n", partid, pmg); + + return 0; +} + +/** + * arm_smmu_set_dev_mpam() - Set mpam configuration to SMMU STE/CD + */ +int arm_smmu_set_dev_mpam(struct device *dev, int ssid, int partid, int pmg, + int s1mpam) +{ + struct arm_smmu_master_data *master = dev->iommu_fwspec->iommu_priv; + struct arm_smmu_device *smmu = master->domain->smmu; + int sid = master->streams->id; + + return arm_smmu_set_mpam(smmu, sid, ssid, partid, pmg, s1mpam); +} +EXPORT_SYMBOL(arm_smmu_set_dev_mpam); + static int arm_smmu_device_probe(struct platform_device *pdev) { int irq, ret; diff --git a/include/linux/ascend_smmu.h b/include/linux/ascend_smmu.h new file mode 100644 index 0000000000000..bd0edd25057e1 --- /dev/null +++ b/include/linux/ascend_smmu.h @@ -0,0 +1,9 @@ +#ifndef __LINUX_ASCEND_SMMU_H +#define __LINUX_ASCEND_SMMU_H + +#include <linux/device.h> + +extern int arm_smmu_set_dev_mpam(struct device *dev, int ssid, int partid, + int pmg, int s1mpam); + +#endif /* __LINUX_ASCEND_SMMU_H */ -- 2.25.1

1 8

[PATCH openEuler-1.0-LTS 0/6] Fix the problem that the number of tcp timeout retransmissions is lost
by jiazhenyuan 25 Oct '21

25 Oct '21

From: Jiazhenyuan <jiazhenyuan(a)uniontech.com> issue: https://gitee.com/openeuler/kernel/issues/I4AFRJ?from=project-issue jiazhenyuan (6): tcp: switch tcp and sch_fq to new earliest departure time net_sched: sch_fq: ensure maxrate fq parameter applies to EDT flows From 9efdda4e3abed13f0903b7b6e4d4c2102019440a Mon Sep 17 00:00:00 2001 From: Eric Dumazet <edumazet(a)google.com> Date: Sat, 24 Nov 2018 09:12:24 -0800 Subject: [PATCH] tcp: address problems caused by EDT misshaps From 7ae189759cc48cf8b54beebff566e9fd2d4e7d7c Mon Sep 17 00:00:00 2001 From: Yuchung Cheng <ycheng(a)google.com> Date: Wed, 16 Jan 2019 15:05:30 -0800 Subject: [PATCH] tcp: always set retrans_stamp on recovery From 01a523b071618abbc634d1958229fe3bd2dfa5fa Mon Sep 17 00:00:00 2001 From: Yuchung Cheng <ycheng(a)google.com> Date: Wed, 16 Jan 2019 15:05:32 -0800 Subject: [PATCH] tcp: create a helper to model exponential backoff From 3256a2d6ab1f71f9a1bd2d7f6f18eb8108c48d17 Mon Sep 17 00:00:00 2001 From: Eric Dumazet <edumazet(a)google.com> Date: Mon, 30 Sep 2019 15:44:44 -0700 Subject: [PATCH] tcp: adjust rto_base in retransmits_timed_out() net/ipv4/tcp_bbr.c | 7 +++-- net/ipv4/tcp_input.c | 17 +++++++----- net/ipv4/tcp_output.c | 29 ++++++++++++++------ net/ipv4/tcp_timer.c | 64 ++++++++++++++++++++----------------------- net/sched/sch_fq.c | 46 ++++++++++++++++++------------- 5 files changed, 92 insertions(+), 71 deletions(-) -- 2.27.0

2 7

[PATCH openEuler-1.0-LTS] nvme-rdma: destroy cm id before destroy qp to avoid use after free
by Yang Yingliang 25 Oct '21

25 Oct '21

From: Ruozhu Li <liruozhu(a)huawei.com> mainline inclusion from mainline-v5.15-rc2 commit 9817d763dbe15327b9b3ff4404fa6f27f927e744 category: bugfix bugzilla: NA CVE: NA Link: https://gitee.com/openeuler/kernel/issues/I1WGZE We got a panic when host received a rej cm event soon after a connect error cm event. When host get connect error cm event, it will destroy qp immediately. But cm_id is still valid then.Another cm event rise here, try to access the qp which was destroyed.Then we got a kernel panic blow: [87816.777089] [20473] ib_cm:cm_rep_handler:2343: cm_rep_handler: Stale connection. local_comm_id -154357094, remote_comm_id -1133609861 [87816.777223] [20473] ib_cm:cm_init_qp_rtr_attr:4162: cm_init_qp_rtr_attr: local_id -1150387077, cm_id_priv->id.state: 13 [87816.777225] [20473] rdma_cm:cma_rep_recv:1871: RDMA CM: CONNECT_ERROR: failed to handle reply. status -22 [87816.777395] [20473] ib_cm:ib_send_cm_rej:2781: ib_send_cm_rej: local_id -1150387077, cm_id->state: 13 [87816.777398] [20473] nvme_rdma:nvme_rdma_cm_handler:1718: nvme nvme278: connect error (6): status -22 id 00000000c3809aff [87816.801155] [20473] nvme_rdma:nvme_rdma_cm_handler:1742: nvme nvme278: CM error event 6 [87816.801160] [20473] rdma_cm:cma_ib_handler:1947: RDMA CM: REJECTED: consumer defined [87816.801163] nvme nvme278: rdma connection establishment failed (-104) [87816.801168] BUG: unable to handle kernel NULL pointer dereference at 0000000000000370 [87816.801201] RIP: 0010:_ib_modify_qp+0x6e/0x3a0 [ib_core] [87816.801215] Call Trace: [87816.801223] cma_modify_qp_err+0x52/0x80 [rdma_cm] [87816.801228] ? __dynamic_pr_debug+0x8a/0xb0 [87816.801232] cma_ib_handler+0x25a/0x2f0 [rdma_cm] [87816.801235] cm_process_work+0x60/0xe0 [ib_cm] [87816.801238] cm_work_handler+0x13b/0x1b97 [ib_cm] [87816.801243] ? __switch_to_asm+0x35/0x70 [87816.801244] ? __switch_to_asm+0x41/0x70 [87816.801246] ? __switch_to_asm+0x35/0x70 [87816.801248] ? __switch_to_asm+0x41/0x70 [87816.801252] ? __switch_to+0x8c/0x480 [87816.801254] ? __switch_to_asm+0x41/0x70 [87816.801256] ? __switch_to_asm+0x35/0x70 [87816.801259] process_one_work+0x1a7/0x3b0 [87816.801263] worker_thread+0x30/0x390 [87816.801266] ? create_worker+0x1a0/0x1a0 [87816.801268] kthread+0x112/0x130 [87816.801270] ? kthread_flush_work_fn+0x10/0x10 [87816.801272] ret_from_fork+0x35/0x40 ------------------------------------------------- We should always destroy cm_id before destroy qp to avoid to get cma event after qp was destroyed, which may lead to use after free. In RDMA connection establishment error flow, don't destroy qp in cm event handler.Just report cm_error to upper level, qp will be destroy in nvme_rdma_alloc_queue() after destroy cm id. Signed-off-by: Ruozhu Li <liruozhu(a)huawei.com> Reviewed-by: Max Gurtovoy <mgurtovoy(a)nvidia.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Conflicts: drivers/nvme/host/rdma.c [lrz: adjust context] Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/nvme/host/rdma.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index b8e0d637ddcfc..049edb9ed1858 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -575,8 +575,8 @@ static void nvme_rdma_free_queue(struct nvme_rdma_queue *queue) if (!test_and_clear_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags)) return; - nvme_rdma_destroy_queue_ib(queue); rdma_destroy_id(queue->cm_id); + nvme_rdma_destroy_queue_ib(queue); mutex_destroy(&queue->queue_lock); } @@ -1509,14 +1509,10 @@ static int nvme_rdma_conn_established(struct nvme_rdma_queue *queue) for (i = 0; i < queue->queue_size; i++) { ret = nvme_rdma_post_recv(queue, &queue->rsp_ring[i]); if (ret) - goto out_destroy_queue_ib; + return ret; } return 0; - -out_destroy_queue_ib: - nvme_rdma_destroy_queue_ib(queue); - return ret; } static int nvme_rdma_conn_rejected(struct nvme_rdma_queue *queue, @@ -1608,14 +1604,10 @@ static int nvme_rdma_route_resolved(struct nvme_rdma_queue *queue) if (ret) { dev_err(ctrl->ctrl.device, "rdma_connect failed (%d).\n", ret); - goto out_destroy_queue_ib; + return ret; } return 0; - -out_destroy_queue_ib: - nvme_rdma_destroy_queue_ib(queue); - return ret; } static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id, @@ -1646,8 +1638,6 @@ static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id, case RDMA_CM_EVENT_ROUTE_ERROR: case RDMA_CM_EVENT_CONNECT_ERROR: case RDMA_CM_EVENT_UNREACHABLE: - nvme_rdma_destroy_queue_ib(queue); - /* fall through */ case RDMA_CM_EVENT_ADDR_ERROR: dev_dbg(queue->ctrl->ctrl.device, "CM error event %d\n", ev->event); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] arm64: Errata: fix kabi changed by cpu_errata
by Yang Yingliang 25 Oct '21

25 Oct '21

From: Weilong Chen <chenweilong(a)huawei.com> ascend inclusion category: feature bugzilla: 46922 CVE: NA ------------------------------------- Patch "cache: Workaround HiSilicon Taishan DC CVAU" breaks the kabi symbols: cpu_hwcaps cpu_hwcap_keys Fix by using CONFIG_HISILICON_ERRATUM_1980005 to protect it. Signed-off-by: Weilong Chen <chenweilong(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/include/asm/cpucaps.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h index d6c863d2cf984..69515f9077e34 100644 --- a/arch/arm64/include/asm/cpucaps.h +++ b/arch/arm64/include/asm/cpucaps.h @@ -56,8 +56,12 @@ #define ARM64_WORKAROUND_1463225 35 #define ARM64_HAS_CRC32 36 #define ARM64_SSBS 37 +#ifdef CONFIG_HISILICON_ERRATUM_1980005 #define ARM64_WORKAROUND_HISILICON_1980005 38 #define ARM64_NCAPS 39 +#else +#define ARM64_NCAPS 38 +#endif #endif /* __ASM_CPUCAPS_H */ -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 01/45] af_unix: fix garbage collect vs MSG_PEEK
by Yang Yingliang 25 Oct '21

25 Oct '21

From: Miklos Szeredi <mszeredi(a)redhat.com> stable inclusion from linux-4.19.200 commit 1dabafa9f61118b1377fde424d9a94bf8dbf2813 -------------------------------- commit cbcf01128d0a92e131bd09f1688fe032480b65ca upstream. unix_gc() assumes that candidate sockets can never gain an external reference (i.e. be installed into an fd) while the unix_gc_lock is held. Except for MSG_PEEK this is guaranteed by modifying inflight count under the unix_gc_lock. MSG_PEEK does not touch any variable protected by unix_gc_lock (file count is not), yet it needs to be serialized with garbage collection. Do this by locking/unlocking unix_gc_lock: 1) increment file count 2) lock/unlock barrier to make sure incremented file count is visible to garbage collection 3) install file into fd This is a lock barrier (unlike smp_mb()) that ensures that garbage collection is run completely before or completely after the barrier. Cc: <stable(a)vger.kernel.org> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/unix/af_unix.c | 51 ++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 49 insertions(+), 2 deletions(-) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 337c4797ab167..98c253afa0db2 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -1517,6 +1517,53 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer) return err; } +static void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb) +{ + scm->fp = scm_fp_dup(UNIXCB(skb).fp); + + /* + * Garbage collection of unix sockets starts by selecting a set of + * candidate sockets which have reference only from being in flight + * (total_refs == inflight_refs). This condition is checked once during + * the candidate collection phase, and candidates are marked as such, so + * that non-candidates can later be ignored. While inflight_refs is + * protected by unix_gc_lock, total_refs (file count) is not, hence this + * is an instantaneous decision. + * + * Once a candidate, however, the socket must not be reinstalled into a + * file descriptor while the garbage collection is in progress. + * + * If the above conditions are met, then the directed graph of + * candidates (*) does not change while unix_gc_lock is held. + * + * Any operations that changes the file count through file descriptors + * (dup, close, sendmsg) does not change the graph since candidates are + * not installed in fds. + * + * Dequeing a candidate via recvmsg would install it into an fd, but + * that takes unix_gc_lock to decrement the inflight count, so it's + * serialized with garbage collection. + * + * MSG_PEEK is special in that it does not change the inflight count, + * yet does install the socket into an fd. The following lock/unlock + * pair is to ensure serialization with garbage collection. It must be + * done between incrementing the file count and installing the file into + * an fd. + * + * If garbage collection starts after the barrier provided by the + * lock/unlock, then it will see the elevated refcount and not mark this + * as a candidate. If a garbage collection is already in progress + * before the file count was incremented, then the lock/unlock pair will + * ensure that garbage collection is finished before progressing to + * installing the fd. + * + * (*) A -> B where B is on the queue of A or B is on the queue of C + * which is on the queue of listening socket A. + */ + spin_lock(&unix_gc_lock); + spin_unlock(&unix_gc_lock); +} + static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds) { int err = 0; @@ -2142,7 +2189,7 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg, sk_peek_offset_fwd(sk, size); if (UNIXCB(skb).fp) - scm.fp = scm_fp_dup(UNIXCB(skb).fp); + unix_peek_fds(&scm, skb); } err = (flags & MSG_TRUNC) ? skb->len - skip : size; @@ -2383,7 +2430,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, /* It is questionable, see note in unix_dgram_recvmsg. */ if (UNIXCB(skb).fp) - scm.fp = scm_fp_dup(UNIXCB(skb).fp); + unix_peek_fds(&scm, skb); sk_peek_offset_fwd(sk, chunk); -- 2.25.1

1 44