February 2022 - Kernel - mailweb.openeuler.org

[PATCH openEuler-5.10 01/90] ACPICA: Interpreter: fix memory leak by using existing buffer
by Zheng Zengkai 23 Feb '22

23 Feb '22

From: Erik Kaneda <erik.kaneda(a)intel.com> mainline inclusion from mainline-v5.11-rc1 commit 32cf1a12cad43358e47dac8014379c2f33dfbed4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4T7OX CVE: NA -------------------------------- ACPICA commit 52d1da5dcbd79a722b70f02a1a83f04088f51ff6 There was a memory leak that ocurred when a _CID object is defined as a package containing string objects. When _CID is checked for any possible repairs, it calls a helper function to repair _HID (because _CID basically contains multiple _HID entries). The _HID repair function assumes that string objects are standalone objects that are not contained inside of any packages. The _HID repair function replaces the string object with a brand new object and attempts to delete the old object by decrementing the reference count of the old object. Strings inside of packages have a reference count of 2 so the _HID repair function leaves this object in a dangling state and causes a memory leak. Instead of allocating a brand new object and removing the old object, use the existing object when repairing the _HID object. Link: https://github.com/acpica/acpica/commit/52d1da5d Signed-off-by: Erik Kaneda <erik.kaneda(a)intel.com> Signed-off-by: Bob Moore <robert.moore(a)intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Conflicts: drivers/acpi/acpica/nsrepair2.c [wangxiongfeng: fix conflicts caused by context mismatch] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/acpi/acpica/nsrepair2.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/drivers/acpi/acpica/nsrepair2.c b/drivers/acpi/acpica/nsrepair2.c index 125143c41bb8..fb4f8f6209bd 100644 --- a/drivers/acpi/acpica/nsrepair2.c +++ b/drivers/acpi/acpica/nsrepair2.c @@ -491,9 +491,8 @@ acpi_ns_repair_HID(struct acpi_evaluate_info *info, union acpi_operand_object **return_object_ptr) { union acpi_operand_object *return_object = *return_object_ptr; - union acpi_operand_object *new_string; - char *source; char *dest; + char *source; ACPI_FUNCTION_NAME(ns_repair_HID); @@ -514,13 +513,6 @@ acpi_ns_repair_HID(struct acpi_evaluate_info *info, return (AE_OK); } - /* It is simplest to always create a new string object */ - - new_string = acpi_ut_create_string_object(return_object->string.length); - if (!new_string) { - return (AE_NO_MEMORY); - } - /* * Remove a leading asterisk if present. For some unknown reason, there * are many machines in the field that contains IDs like this. @@ -530,7 +522,7 @@ acpi_ns_repair_HID(struct acpi_evaluate_info *info, source = return_object->string.pointer; if (*source == '*') { source++; - new_string->string.length--; + return_object->string.length--; ACPI_DEBUG_PRINT((ACPI_DB_REPAIR, "%s: Removed invalid leading asterisk\n", @@ -545,12 +537,11 @@ acpi_ns_repair_HID(struct acpi_evaluate_info *info, * "NNNN####" where N is an uppercase letter or decimal digit, and * # is a hex digit. */ - for (dest = new_string->string.pointer; *source; dest++, source++) { + for (dest = return_object->string.pointer; *source; dest++, source++) { *dest = (char)toupper((int)*source); } + return_object->string.pointer[return_object->string.length] = 0; - acpi_ut_remove_reference(return_object); - *return_object_ptr = new_string; return (AE_OK); } -- 2.20.1

2 91

Re: [PATCH OLK-5.10 v3 3/7] EHCI: Clear wakeup signal locked in S0 state when device plug in
by Zheng Zengkai 23 Feb '22

23 Feb '22

Loop Leo 在 2022/2/22 17:49, Jackie Liu 写道: > > > 在 2022/2/22 下午4:16, Zheng Zengkai 写道: >> From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> >> zhaoxin inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN >> CVE: NA >> >> ---------------------------------------------------------------- >> >> If we plug in a LS/FS device on USB2 port of EHCI, it will latch a wakeup >> signal in EHCI internal. This is a bug of EHCI for Some project of >> ZhaoXin. If enable EHCI runtime suspend and no device attach. >> PM core will let EHCI go to D3 to save power. However, once EHCI go to D3, >> it will release wakeup signal that latched on device connect to port >> during S0. Which will generate a SCI interrupt and bring EHCI to D0. >> But without device connect, EHCI will go to D3 again. >> So, there is suspend-resume loop and generate SCI interrupt Continuously. >> >> In order to fix this issues, we need to clear the wakeup signal latched >> in EHCI when EHCI suspend function is called. >> >> Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> >> --- >> drivers/pci/pci-driver.c | 6 +++++- >> drivers/usb/host/ehci-hcd.c | 21 +++++++++++++++++++++ >> drivers/usb/host/ehci-pci.c | 4 ++++ >> drivers/usb/host/ehci.h | 1 + >> 4 files changed, 31 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c >> index 8b587fc97f7b..c33d7e0a60b5 100644 >> --- a/drivers/pci/pci-driver.c >> +++ b/drivers/pci/pci-driver.c >> @@ -518,7 +518,11 @@ static int pci_restore_standard_config(struct pci_dev *pci_dev) >> } >> >> pci_restore_state(pci_dev); >> - pci_pme_restore(pci_dev); >> + if (!((pci_dev->vendor == PCI_VENDOR_ID_ZHAOXIN) && >> + (pci_dev->device == 0x3104) && >> + ((pci_dev->revision & 0xf0) == 0x90)) || > >> + !(pci_dev->class == PCI_CLASS_SERIAL_USB_EHCI)) > 上面这句话是不是改变了通用逻辑？增加了一个 pci_dev->class != > PCI_CLASS_SERIAL_USB_EHCI 才进行 restore？ > >> + pci_pme_restore(pci_dev); >> return 0; >> } >> >> diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c >> index 8aff19ff8e8f..586e2735d6e0 100644 >> --- a/drivers/usb/host/ehci-hcd.c >> +++ b/drivers/usb/host/ehci-hcd.c >> @@ -1142,6 +1142,27 @@ int ehci_suspend(struct usb_hcd *hcd, bool do_wakeup) >> return -EBUSY; >> } >> >> + /*clear wakeup signal locked in S0 state when device plug in*/ >> + if (ehci->zx_wakeup_clear == 1) { >> + u32 __iomem *reg = &ehci->regs->port_status[4]; >> + u32 t1 = ehci_readl(ehci, reg); >> + >> + t1 &= (u32)~0xf0000; >> + t1 |= PORT_TEST_FORCE; >> + ehci_writel(ehci, t1, reg); >> + t1 = ehci_readl(ehci, reg); >> + usleep_range(1000, 2000); >> + t1 &= (u32)~0xf0000; >> + ehci_writel(ehci, t1, reg); >> + usleep_range(1000, 2000); >> + t1 = ehci_readl(ehci, reg); >> + ehci_writel(ehci, t1 | PORT_CSC, reg); >> + udelay(500); >> + t1 = ehci_readl(ehci, &ehci->regs->status); >> + ehci_writel(ehci, t1 & STS_PCD, &ehci->regs->status); >> + ehci_readl(ehci, &ehci->regs->status); >> + } >> + >> return 0; >> } >> EXPORT_SYMBOL_GPL(ehci_suspend); >> diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c >> index e87cf3a00fa4..a5e27deda83a 100644 >> --- a/drivers/usb/host/ehci-pci.c >> +++ b/drivers/usb/host/ehci-pci.c >> @@ -222,6 +222,10 @@ static int ehci_pci_setup(struct usb_hcd *hcd) >> ehci->has_synopsys_hc_bug = 1; >> } >> break; >> + case PCI_VENDOR_ID_ZHAOXIN: >> + if (pdev->device == 0x3104 && (pdev->revision & 0xf0) == 0x90) >> + ehci->zx_wakeup_clear = 1; >> + break; >> } >> >> /* optional debug port, normally in the first BAR */ >> diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h >> index 59fd523c55f3..8da080a54668 100644 >> --- a/drivers/usb/host/ehci.h >> +++ b/drivers/usb/host/ehci.h >> @@ -219,6 +219,7 @@ struct ehci_hcd { /* one per controller */ >> unsigned need_oc_pp_cycle:1; /* MPC834X port power */ >> unsigned imx28_write_fix:1; /* For Freescale i.MX28 */ >> unsigned is_aspeed:1; >> + unsigned zx_wakeup_clear:1; >> >> /* required for usb32 quirk */ >> #define OHCI_CTRL_HCFS (3 << 6) >> >> >> Content-type: Text/plain >> >> No virus found >> Checked by Hillstone Network AntiVirus

2 1

Re: [PATCH OLK-5.10 v3 1/7] rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs
by Zheng Zengkai 23 Feb '22

23 Feb '22

Hi Jackie, Leo 在 2022/2/22 17:46, Jackie Liu 写道: > > > 在 2022/2/22 下午4:16, Zheng Zengkai 写道: >> From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> >> zhaoxin inclusion >> category: bugfix >> bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN >> CVE: NA >> >> ---------------------------------------------------------------- >> >> When the RTC divider is changed from reset to an operating time base, >> the first update cycle should be 500ms later. But on some Zhaoxin SOCs, >> this first update cycle is one second later. >> So set RTC time on these Zhaoxin SOCs will causing 500ms delay. >> Skip setup RTC divider on these SOCs in mc146818_set_time to fix it. >> >> Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> >> --- >> drivers/rtc/rtc-mc146818-lib.c | 16 ++++++++++++++++ >> 1 file changed, 16 insertions(+) >> >> diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c >> index 2ecd8752b088..96d9d0219394 100644 >> --- a/drivers/rtc/rtc-mc146818-lib.c >> +++ b/drivers/rtc/rtc-mc146818-lib.c >> @@ -171,8 +171,17 @@ int mc146818_set_time(struct rtc_time *time) >> >> save_control = CMOS_READ(RTC_CONTROL); >> CMOS_WRITE((save_control|RTC_SET), RTC_CONTROL); >> +#ifdef CONFIG_X86 >> + if (!((boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR || >> + boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN) && >> + (boot_cpu_data.x86 <= 7 && boot_cpu_data.x86_model <= 59))) { >> + save_freq_select = CMOS_READ(RTC_FREQ_SELECT); >> + CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); >> + } >> +#else >> save_freq_select = CMOS_READ(RTC_FREQ_SELECT); >> CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); >> +#endif >> >> #ifdef CONFIG_MACH_DECSTATION >> CMOS_WRITE(real_yrs, RTC_DEC_YEAR); >> @@ -190,7 +199,14 @@ int mc146818_set_time(struct rtc_time *time) >> #endif >> >> CMOS_WRITE(save_control, RTC_CONTROL); >> +#ifdef CONFIG_X86 >> + if (!((boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR || >> + boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN) && >> + (boot_cpu_data.x86 <= 7 && boot_cpu_data.x86_model <= 59))) > 在这里直接写个 #endif 后面的 else 和 endif 就不需要了 > >> + CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); >> +#else >> CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); >> +#endif 这里依据上次兆芯同事解释的代码逻辑： X86架构情况下，兆芯的相应平台不执行CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT), 即 commit message中Skip setup RTC divider on these SOCs in mc146818_set_time to fix it; 而其他架构(#else 分支)，仍然需要执行CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); @Jackie @ Leo，两位看下理解是否OK？ >> >> spin_unlock_irqrestore(&rtc_lock, flags); >> >> >> >> Content-type: Text/plain >> >> No virus found >> Checked by Hillstone Network AntiVirus

2 1

Re: [PATCH OLK-5.10 v3 3/7] EHCI: Clear wakeup signal locked in S0 state when device plug in
by Zheng Zengkai 23 Feb '22

23 Feb '22

Hi Jackie, 在 2022/2/22 17:49, Jackie Liu 写道: > > > 在 2022/2/22 下午4:16, Zheng Zengkai 写道: >> From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> >> zhaoxin inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN >> CVE: NA >> >> ---------------------------------------------------------------- >> >> If we plug in a LS/FS device on USB2 port of EHCI, it will latch a wakeup >> signal in EHCI internal. This is a bug of EHCI for Some project of >> ZhaoXin. If enable EHCI runtime suspend and no device attach. >> PM core will let EHCI go to D3 to save power. However, once EHCI go to D3, >> it will release wakeup signal that latched on device connect to port >> during S0. Which will generate a SCI interrupt and bring EHCI to D0. >> But without device connect, EHCI will go to D3 again. >> So, there is suspend-resume loop and generate SCI interrupt Continuously. >> >> In order to fix this issues, we need to clear the wakeup signal latched >> in EHCI when EHCI suspend function is called. >> >> Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> >> --- >> drivers/pci/pci-driver.c | 6 +++++- >> drivers/usb/host/ehci-hcd.c | 21 +++++++++++++++++++++ >> drivers/usb/host/ehci-pci.c | 4 ++++ >> drivers/usb/host/ehci.h | 1 + >> 4 files changed, 31 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c >> index 8b587fc97f7b..c33d7e0a60b5 100644 >> --- a/drivers/pci/pci-driver.c >> +++ b/drivers/pci/pci-driver.c >> @@ -518,7 +518,11 @@ static int pci_restore_standard_config(struct pci_dev *pci_dev) >> } >> >> pci_restore_state(pci_dev); >> - pci_pme_restore(pci_dev); >> + if (!((pci_dev->vendor == PCI_VENDOR_ID_ZHAOXIN) && >> + (pci_dev->device == 0x3104) && >> + ((pci_dev->revision & 0xf0) == 0x90)) || > >> + !(pci_dev->class == PCI_CLASS_SERIAL_USB_EHCI)) > 上面这句话是不是改变了通用逻辑？增加了一个 pci_dev->class != > PCI_CLASS_SERIAL_USB_EHCI 才进行 restore？ > >> + pci_pme_restore(pci_dev); 逻辑上应该是和！((pci_dev->vendor == PCI_VENDOR_ID_ZHAOXIN) && (pci_dev->device == 0x3104) && ((pci_dev->revision & 0xf0) == 0x90) && (pci_dev->class == PCI_CLASS_SERIAL_USB_EHCI)）等同的, 即只有zhaoxin的0x3104 devid的PCI_CLASS_SERIAL_USB_EHCI设备不做pci_pme_restore(pci_dev)操作 >> return 0; >> } >> >> diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c >> index 8aff19ff8e8f..586e2735d6e0 100644 >> --- a/drivers/usb/host/ehci-hcd.c >> +++ b/drivers/usb/host/ehci-hcd.c >> @@ -1142,6 +1142,27 @@ int ehci_suspend(struct usb_hcd *hcd, bool do_wakeup) >> return -EBUSY; >> } >> >> + /*clear wakeup signal locked in S0 state when device plug in*/ >> + if (ehci->zx_wakeup_clear == 1) { >> + u32 __iomem *reg = &ehci->regs->port_status[4]; >> + u32 t1 = ehci_readl(ehci, reg); >> + >> + t1 &= (u32)~0xf0000; >> + t1 |= PORT_TEST_FORCE; >> + ehci_writel(ehci, t1, reg); >> + t1 = ehci_readl(ehci, reg); >> + usleep_range(1000, 2000); >> + t1 &= (u32)~0xf0000; >> + ehci_writel(ehci, t1, reg); >> + usleep_range(1000, 2000); >> + t1 = ehci_readl(ehci, reg); >> + ehci_writel(ehci, t1 | PORT_CSC, reg); >> + udelay(500); >> + t1 = ehci_readl(ehci, &ehci->regs->status); >> + ehci_writel(ehci, t1 & STS_PCD, &ehci->regs->status); >> + ehci_readl(ehci, &ehci->regs->status); >> + } >> + >> return 0; >> } >> EXPORT_SYMBOL_GPL(ehci_suspend); >> diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c >> index e87cf3a00fa4..a5e27deda83a 100644 >> --- a/drivers/usb/host/ehci-pci.c >> +++ b/drivers/usb/host/ehci-pci.c >> @@ -222,6 +222,10 @@ static int ehci_pci_setup(struct usb_hcd *hcd) >> ehci->has_synopsys_hc_bug = 1; >> } >> break; >> + case PCI_VENDOR_ID_ZHAOXIN: >> + if (pdev->device == 0x3104 && (pdev->revision & 0xf0) == 0x90) >> + ehci->zx_wakeup_clear = 1; >> + break; >> } >> >> /* optional debug port, normally in the first BAR */ >> diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h >> index 59fd523c55f3..8da080a54668 100644 >> --- a/drivers/usb/host/ehci.h >> +++ b/drivers/usb/host/ehci.h >> @@ -219,6 +219,7 @@ struct ehci_hcd { /* one per controller */ >> unsigned need_oc_pp_cycle:1; /* MPC834X port power */ >> unsigned imx28_write_fix:1; /* For Freescale i.MX28 */ >> unsigned is_aspeed:1; >> + unsigned zx_wakeup_clear:1; >> >> /* required for usb32 quirk */ >> #define OHCI_CTRL_HCFS (3 << 6) >> >> >> Content-type: Text/plain >> >> No virus found >> Checked by Hillstone Network AntiVirus

1 0

[PATCH OLK-5.10,v4,0/3] Add support for kunpeng920 Ultrasoc System Memory Buffer driver
by Qi Liu 23 Feb '22

23 Feb '22

Add support for kunpeng920 Ultrasoc System Memory Buffer driver v3->4: Resend this patchset as openeuler maillist hasn't received patch[1/3] in v3 series. Qi Liu (3): coresight: etm4x: Modify core-commit to avoid HiSilicon ETM overflow drivers/coresight: Add Ultrasoc System Memory Buffer driver arm64: openeuler_defconfig: Enable config for ultrasoc driver arch/arm64/configs/openeuler_defconfig | 13 +- drivers/hwtracing/coresight/Kconfig | 20 + drivers/hwtracing/coresight/Makefile | 1 + .../coresight/coresight-etm4x-core.c | 98 +++ drivers/hwtracing/coresight/coresight-etm4x.h | 8 + drivers/hwtracing/coresight/ultrasoc-smb.c | 602 ++++++++++++++++++ drivers/hwtracing/coresight/ultrasoc-smb.h | 100 +++ 7 files changed, 841 insertions(+), 1 deletion(-) create mode 100644 drivers/hwtracing/coresight/ultrasoc-smb.c create mode 100644 drivers/hwtracing/coresight/ultrasoc-smb.h -- 2.33.0

1 3

[PATCH OLK-5.10 v2] uce: copy_from_user scenario support kernel recovery
by Tong Tiangen 22 Feb '22

22 Feb '22

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4PM10 CVE: NA -------------------------------- During kernel copy_from_user processing, the kernel triggers a RAS exception when reading pages. In this solution, we identify this scenario in the kernel do_sea processing process, send SIGBUS signals to the process that triggers copy_from_user and isolate memory pages, preventing kernel panic. At the same time, we use both cmdline(uce_kernel_recovery) and proc (/proc/sys/kernel/uce_kernel_recovery) to control this feature on/off. Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- v1->v2: 1. update commit msg. 2. change copy_from_user return value. 3. change copy_from_user proc control bit. arch/arm64/Kconfig | 9 ++ arch/arm64/include/asm/exception.h | 12 +++ arch/arm64/lib/copy_from_user.S | 5 + arch/arm64/mm/fault.c | 154 +++++++++++++++++++++++++++++ include/linux/kernel.h | 4 + kernel/sysctl.c | 11 +++ 6 files changed, 195 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index c0f6a275f798..5858cb9a3dac 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -2155,6 +2155,15 @@ config ARCH_HIBERNATION_HEADER config ARCH_SUSPEND_POSSIBLE def_bool y +config UCE_KERNEL_RECOVERY + bool "uce kernel recovery from special scenario" + def_bool n + help + With ARM v8.2 RAS Extension, SEA are usually triggered when memory errors + are consumed. In some cases, if the error address is in a user page there + is a chance to recover. Such as error occurs in COW and pagecache reading + scenario, we can isolate this page and killing process instead of die. + endmenu menu "CPU Power Management" diff --git a/arch/arm64/include/asm/exception.h b/arch/arm64/include/asm/exception.h index 0756191f44f6..bad92fe763fb 100644 --- a/arch/arm64/include/asm/exception.h +++ b/arch/arm64/include/asm/exception.h @@ -53,4 +53,16 @@ void do_cp15instr(unsigned int esr, struct pt_regs *regs); void do_el0_svc(struct pt_regs *regs); void do_el0_svc_compat(struct pt_regs *regs); void do_ptrauth_fault(struct pt_regs *regs, unsigned int esr); + +#ifdef CONFIG_UCE_KERNEL_RECOVERY +struct uce_kernel_recovery_info { + int (*fn)(void); + const char *name; + unsigned long addr; + unsigned long size; +}; + +extern int copy_from_user_sea_fallback(void); +#endif + #endif /* __ASM_EXCEPTION_H */ diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S index 2cf999e41d30..b03ea0faa118 100644 --- a/arch/arm64/lib/copy_from_user.S +++ b/arch/arm64/lib/copy_from_user.S @@ -60,6 +60,11 @@ SYM_FUNC_START(__arch_copy_from_user) #include "copy_template.S" mov x0, #0 // Nothing to copy ret + + .global copy_from_user_sea_fallback +copy_from_user_sea_fallback: + sub x0, end, dst // bytes not copied + ret SYM_FUNC_END(__arch_copy_from_user) EXPORT_SYMBOL(__arch_copy_from_user) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 3fc5aceb72eb..7f76e277daa3 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -634,6 +634,127 @@ static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs) return 1; /* "fault" */ } +#ifdef CONFIG_UCE_KERNEL_RECOVERY +int kernel_access_sea_recovery; + +#define UCE_KER_REC_NUM ARRAY_SIZE(reco_info) +static struct uce_kernel_recovery_info reco_info[] = { + {NULL, NULL, 0, 0}, + {NULL, NULL, 0, 0}, + {copy_from_user_sea_fallback, "__arch_copy_from_user", (unsigned long)__arch_copy_from_user, 0}, +}; + +static int __init kernel_access_sea_recovery_init(void) +{ + unsigned long addr, size, offset; + unsigned int i; + + for (i = 0; i < UCE_KER_REC_NUM; i++) { + addr = reco_info[i].addr; + if (!kallsyms_lookup_size_offset(addr, &size, &offset)) { + pr_info("UCE: symbol %s lookup addr fail.\n", + reco_info[i].name); + size = 0; + } + + reco_info[i].size = size; + } + + return 1; +} +fs_initcall(kernel_access_sea_recovery_init); + +static int __init enable_kernel_access_sea_recovery(char *str) +{ + int max = (1 << UCE_KER_REC_NUM) - 1; + int val; + + if (kstrtoint(str, 0, &val)) + return -EINVAL; + + if (val < 0 || val > max) { + pr_info("UCE: invalid uce_kernel_recovery value %d", val); + return -EINVAL; + } + + kernel_access_sea_recovery = val; + + return 1; +} +__setup("uce_kernel_recovery=", enable_kernel_access_sea_recovery); + +/* + * what is kernel recovery? + * If the process's private data is accessed in the kernel mode to trigger + * special sea fault, it can controlled by killing the process and isolating + * the failure pages instead of die. + */ +static int is_in_kernel_recovery(unsigned int esr, struct pt_regs *regs) +{ + /* + * target insn: ldp-pre, ldp-post, ldp-offset, + * ldr-64bit-pre/pose, ldr-32bit-pre/post, ldrb-pre/post, ldrh-pre/post + */ + u32 target_insn[] = {0xa8c, 0xa9c, 0xa94, 0xf84, 0x784, 0x384, 0xb84}; + void *pc = (void *)instruction_pointer(regs); + struct uce_kernel_recovery_info *info; + bool insn_match = false; + u32 insn; + int i; + + pr_emerg("UCE: %s-%d, kernel recovery: 0x%x, esr: 0x%08x -- %s, %pS\n", + current->comm, current->pid, kernel_access_sea_recovery, esr, + esr_get_class_string(esr), pc); + + if (aarch64_insn_read((void *)pc, &insn)) { + pr_emerg("UCE: insn read fail.\n"); + return -EFAULT; + } + + /* + * We process special ESR: + * EC : 0b100101 Data Abort taken without a change in Exception level. + * DFSC : 0b010000 Synchronous External abort, not on translation table + * walk or hardware update of translation table. + * eg: 0x96000610 + */ + if (ESR_ELx_EC(esr) != ESR_ELx_EC_DABT_CUR || + (esr & ESR_ELx_FSC) != ESR_ELx_FSC_EXTABT) { + pr_emerg("UCE: esr not match.\n"); + return -EINVAL; + } + + insn = (insn >> 20) & 0xffc; + for (i = 0; i < ARRAY_SIZE(target_insn); i++) { + if (insn == target_insn[i]) { + insn_match = true; + break; + } + } + + if (!insn_match) { + pr_emerg("UCE: insn 0x%x is not match.\n", insn); + return -EINVAL; + } + + for (i = 0; i < UCE_KER_REC_NUM; i++) { + if (!((kernel_access_sea_recovery >> i) & 0x1)) + continue; + + info = &reco_info[i]; + if (info->fn && regs->pc >= info->addr && + regs->pc < (info->addr + info->size)) { + pr_emerg("UCE: total match %s success.\n", info->name); + return i; + } + } + + pr_emerg("UCE: symbol is not match or switch if off, kernel recovery %d.\n", + kernel_access_sea_recovery); + return -EINVAL; +} +#endif + static int do_sea(unsigned long addr, unsigned int esr, struct pt_regs *regs) { const struct fault_info *inf; @@ -649,6 +770,39 @@ static int do_sea(unsigned long addr, unsigned int esr, struct pt_regs *regs) return 0; } +#ifdef CONFIG_UCE_KERNEL_RECOVERY + if (!user_mode(regs)) { + int idx; + + if (!current->mm || !kernel_access_sea_recovery) { + pr_emerg("UCE: kernel recovery %d, %s-%d is %s-thread.\n", + kernel_access_sea_recovery, + current->comm, current->pid, + (current->mm) ? "user" : "kernel"); + die("Uncorrected hardware memory error in kernel-access\n", + regs, esr); + } + + idx = is_in_kernel_recovery(esr, regs); + if (idx >= 0 && idx < UCE_KER_REC_NUM) { + current->thread.fault_address = 0; + current->thread.fault_code = esr; + regs->pc = (unsigned long)reco_info[idx].fn; + + if (esr & ESR_ELx_FnV) + siaddr = NULL; + else + siaddr = (void __user *)addr; + + arm64_force_sig_fault(inf->sig, inf->code, siaddr, + "Uncorrected hardware memory use with kernel recovery in kernel-access\n"); + } else { + die("Uncorrected hardware memory error (not match idx or sence switch is off) in kernel-access\n", + regs, esr); + } + } +#endif + if (esr & ESR_ELx_FnV) siaddr = NULL; else diff --git a/include/linux/kernel.h b/include/linux/kernel.h index 78a0907f0b04..b634fb1cce38 100644 --- a/include/linux/kernel.h +++ b/include/linux/kernel.h @@ -558,6 +558,10 @@ extern int sysctl_panic_on_stackoverflow; extern bool crash_kexec_post_notifiers; +#ifdef CONFIG_UCE_KERNEL_RECOVERY +extern int kernel_access_sea_recovery; +#endif + /* * panic_cpu is used for synchronizing panic() and crash_kexec() execution. It * holds a CPU number which is executing panic() currently. A value of diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 89ef0c1a1642..e38fff657683 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2711,6 +2711,17 @@ static struct ctl_table kern_table[] = { .extra1 = &one_hundred, .extra2 = &one_thousand, }, +#endif +#if defined(CONFIG_UCE_KERNEL_RECOVERY) + { + .procname = "uce_kernel_recovery", + .data = &kernel_access_sea_recovery, + .maxlen = sizeof(kernel_access_sea_recovery), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = &four, + .extra2 = &four, + }, #endif { } }; -- 2.18.0.huawei.25

2 1

[PATCH openEuler-5.10 12/90] x86/cpu/intel: Add a nosgx kernel parameter
by Zheng Zengkai 22 Feb '22

22 Feb '22

From: Jarkko Sakkinen <jarkko(a)kernel.org> mainline inclusion from mainline-v5.11-rc1 commit 38853a303982e3be3eccb1a1132399a5c5e2d806 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4SIGI CVE: NA -------------------------------- Add a kernel parameter to disable SGX kernel support and document it. [ bp: Massage. ] Intel-SIG: commit 38853a303982 x86/cpu/intel: Add a nosgx kernel parameter Backport for SGX Foundations support Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Borislav Petkov <bp(a)suse.de> Reviewed-by: Sean Christopherson <sean.j.christopherson(a)intel.com> Acked-by: Jethro Beekman <jethro(a)fortanix.com> Tested-by: Sean Christopherson <sean.j.christopherson(a)intel.com> Link: https://lkml.kernel.org/r/20201112220135.165028-9-jarkko@kernel.org Signed-off-by: Fan Du <fan.du(a)intel.com> #openEuler_contributor Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Bamvor Zhang <bamvor.zhang(a)suse.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- Documentation/admin-guide/kernel-parameters.txt | 2 ++ arch/x86/kernel/cpu/feat_ctl.c | 9 +++++++++ 2 files changed, 11 insertions(+) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index b73108a82f18..a4e5614bee12 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -3498,6 +3498,8 @@ nosep [BUGS=X86-32] Disables x86 SYSENTER/SYSEXIT support. + nosgx [X86-64,SGX] Disables Intel SGX kernel support. + nosmp [SMP] Tells an SMP kernel to act as a UP kernel, and disable the IO APIC. legacy for "maxcpus=0". diff --git a/arch/x86/kernel/cpu/feat_ctl.c b/arch/x86/kernel/cpu/feat_ctl.c index d38e97325018..3b1b01f2b248 100644 --- a/arch/x86/kernel/cpu/feat_ctl.c +++ b/arch/x86/kernel/cpu/feat_ctl.c @@ -99,6 +99,15 @@ static void clear_sgx_caps(void) setup_clear_cpu_cap(X86_FEATURE_SGX_LC); } +static int __init nosgx(char *str) +{ + clear_sgx_caps(); + + return 0; +} + +early_param("nosgx", nosgx); + void init_ia32_feat_ctl(struct cpuinfo_x86 *c) { bool tboot = tboot_enabled(); -- 2.20.1

1 1

[PATCH OLK-5.10 v2 0/5] net/spnic: spnic bugfix series
by Yanling Song 22 Feb '22

22 Feb '22

Fix 5 bugs: 1. Fix array bounds error in ethtool get_link_ksettings 2. Fix ethtool loopback command failure 3. Fix xor checksum error when sending a non 4B-aligned message to firmware 4. Fix an error when netdev failed to link up 5. Reduce the timeout of the channel between driver and firmware Yanling Song (5): net/spnic: Fix array bounds error in ethtool get_link_ksettings net/spnic: Fix ethtool loopback command failure net/spnic: Fix xor checksum error when sending a non 4B-aligned message to firmware net/spnic: Fix an error when netdev failed to link up net/spnic: Reduce the timeout of the channel between driver and firmware .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c | 2 +- .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.c | 10 ++-- .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c | 2 +- .../ramaxel/spnic/spnic_ethtool_stats.c | 4 +- .../ethernet/ramaxel/spnic/spnic_mag_cfg.c | 2 +- .../ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c | 49 ++++++++++++------- 6 files changed, 41 insertions(+), 28 deletions(-) -- 2.32.0

2 6

[PATCH OLK-5.10,v3,0/3] Add support for kunpeng920 Ultrasoc System Memory Buffer driver
by Qi Liu 22 Feb '22

22 Feb '22

Add support for kunpeng920 Ultrasoc System Memory Buffer driver Qi Liu (3): coresight: etm4x: Modify core-commit to avoid HiSilicon ETM overflow drivers/coresight: Add Ultrasoc System Memory Buffer driver arm64: openeuler_defconfig: Enable config for ultrasoc driver arch/arm64/configs/openeuler_defconfig | 13 +- drivers/hwtracing/coresight/Kconfig | 20 + drivers/hwtracing/coresight/Makefile | 1 + .../coresight/coresight-etm4x-core.c | 98 +++ drivers/hwtracing/coresight/coresight-etm4x.h | 8 + drivers/hwtracing/coresight/ultrasoc-smb.c | 602 ++++++++++++++++++ drivers/hwtracing/coresight/ultrasoc-smb.h | 100 +++ 7 files changed, 841 insertions(+), 1 deletion(-) create mode 100644 drivers/hwtracing/coresight/ultrasoc-smb.c create mode 100644 drivers/hwtracing/coresight/ultrasoc-smb.h -- 2.33.0

3 5

Re: [PATCH OLK-5.10 v3 1/7] rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs
by Zheng Zengkai 22 Feb '22

22 Feb '22

loop Leo 在 2022/2/22 17:46, Jackie Liu 写道: > > > 在 2022/2/22 下午4:16, Zheng Zengkai 写道: >> From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> >> zhaoxin inclusion >> category: bugfix >> bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN >> CVE: NA >> >> ---------------------------------------------------------------- >> >> When the RTC divider is changed from reset to an operating time base, >> the first update cycle should be 500ms later. But on some Zhaoxin SOCs, >> this first update cycle is one second later. >> So set RTC time on these Zhaoxin SOCs will causing 500ms delay. >> Skip setup RTC divider on these SOCs in mc146818_set_time to fix it. >> >> Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> >> --- >> drivers/rtc/rtc-mc146818-lib.c | 16 ++++++++++++++++ >> 1 file changed, 16 insertions(+) >> >> diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c >> index 2ecd8752b088..96d9d0219394 100644 >> --- a/drivers/rtc/rtc-mc146818-lib.c >> +++ b/drivers/rtc/rtc-mc146818-lib.c >> @@ -171,8 +171,17 @@ int mc146818_set_time(struct rtc_time *time) >> >> save_control = CMOS_READ(RTC_CONTROL); >> CMOS_WRITE((save_control|RTC_SET), RTC_CONTROL); >> +#ifdef CONFIG_X86 >> + if (!((boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR || >> + boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN) && >> + (boot_cpu_data.x86 <= 7 && boot_cpu_data.x86_model <= 59))) { >> + save_freq_select = CMOS_READ(RTC_FREQ_SELECT); >> + CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); >> + } >> +#else >> save_freq_select = CMOS_READ(RTC_FREQ_SELECT); >> CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); >> +#endif >> >> #ifdef CONFIG_MACH_DECSTATION >> CMOS_WRITE(real_yrs, RTC_DEC_YEAR); >> @@ -190,7 +199,14 @@ int mc146818_set_time(struct rtc_time *time) >> #endif >> >> CMOS_WRITE(save_control, RTC_CONTROL); >> +#ifdef CONFIG_X86 >> + if (!((boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR || >> + boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN) && >> + (boot_cpu_data.x86 <= 7 && boot_cpu_data.x86_model <= 59))) > 在这里直接写个 #endif 后面的 else 和 endif 就不需要了 > >> + CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); >> +#else >> CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); >> +#endif >> >> spin_unlock_irqrestore(&rtc_lock, flags); >> >> >> >> Content-type: Text/plain >> >> No virus found >> Checked by Hillstone Network AntiVirus

1 0