- Kernel - mailweb.openeuler.org

[PATCH openEuler-5.10 01/31] io_uring:drop identity before creating a private one
by Zheng Zengkai 17 Aug '22

17 Aug '22

From: Li Lingfeng <lilingfeng3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187387, https://gitee.com/openeuler/kernel/issues/I5KTEM CVE: NA -------------------------------- When we need to create a private copy of io_identity, we will get the use of current task's private structs, whitch means we should increase their reference counts. If we have grabed some other structs before, we should drop them and clear related flags. Otherwise, leak of old structs and uaf of new structs may occur. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/io_uring.c | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/fs/io_uring.c b/fs/io_uring.c index faa81d48c812..257e4af176e6 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1364,6 +1364,47 @@ static bool io_identity_cow(struct io_kiocb *req) return true; } +static void io_drop_identity(struct io_kiocb *req) +{ + struct io_identity *id = req->work.identity; + + if (req->work.flags & IO_WQ_WORK_MM) { + mmdrop(id->mm); + req->work.flags &= ~IO_WQ_WORK_MM; + } +#ifdef CONFIG_BLK_CGROUP + if (req->work.flags & IO_WQ_WORK_BLKCG) { + css_put(id->blkcg_css); + req->work.flags &= ~IO_WQ_WORK_BLKCG; + } +#endif + if (req->work.flags & IO_WQ_WORK_CREDS) { + put_cred(id->creds); + req->work.flags &= ~IO_WQ_WORK_CREDS; + } + if (req->work.flags & IO_WQ_WORK_FILES) { + put_files_struct(req->work.identity->files); + put_nsproxy(req->work.identity->nsproxy); + req->work.flags &= ~IO_WQ_WORK_FILES; + } + if (req->work.flags & IO_WQ_WORK_CANCEL) + req->work.flags &= ~IO_WQ_WORK_CANCEL; + if (req->work.flags & IO_WQ_WORK_FS) { + struct fs_struct *fs = id->fs; + + spin_lock(&id->fs->lock); + if (--fs->users) + fs = NULL; + spin_unlock(&id->fs->lock); + + if (fs) + free_fs_struct(fs); + req->work.flags &= ~IO_WQ_WORK_FS; + } + if (req->work.flags & IO_WQ_WORK_FSIZE) + req->work.flags &= ~IO_WQ_WORK_FSIZE; +} + static bool io_grab_identity(struct io_kiocb *req) { const struct io_op_def *def = &io_op_defs[req->opcode]; @@ -1469,6 +1510,7 @@ static void io_prep_async_work(struct io_kiocb *req) if (io_grab_identity(req)) return; + io_drop_identity(req); if (!io_identity_cow(req)) return; -- 2.20.1

1 30

CCSA-运营商行业操作系统规范内核SYSCALL学习交流
by 丁强 17 Aug '22

17 Aug '22

各位好，我是移动丁强，目前在中国通信标准化协会（CCSA）中牵头做操作系统相关的行业规范，目前涉及到kernel的SYSCALL特性部分，想和各位学习交流一下，方便的话可以加我微信详谈，我的手机13575459962（微信同号），感谢大家！丁强中国移动通信集团浙江有限公司云计算支撑中心 Mobile: 13575459962 E-mail: 13575459962(a)139.xn--com()-jt2hu4k dingqiang5(a)zj.chinamobile.com

1 0

[PATCH openEuler-5.10-LTS v2 00/82] Backport 5.10.118 LTS
by Zheng Zengkai 17 Aug '22

17 Aug '22

Backport 5.10.118 LTS patches from upstream. git cherry-pick v5.10.117..v5.10.118~1 -s Already merged(5): 911b36267855 floppy: use a statically allocated error counter 55c820c1b2b6 Revert "drm/i915/opregion: check port number bounds for SWSCI display power state" aca18bacdb71 ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() f3f2247ac31c Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE"" 3ee8e109c3c3 perf: Fix sys_perf_event_open() race against self Context conflict: 00d8b06a4ed4 rtc: mc146818-lib: Fix the AltCentury for AMD platforms Skiped(1): e2cfa7b0935c Revert "swiotlb: fix info leak with DMA_FROM_DEVICE" KABI changed(8): 633be494c3ca include/uapi/linux/xfrm.h: Fix XFRM_MSG_MAPPING ABI breakage 47f04f95edb1 xfrm: fix "disable_policy" flag use when arriving from different devices 0d2e9d8000ef xfrm: rework default policy structure 57c1bbe7098b xfrm: fix dflt policy check when there is no policy configured 9856c3a129dd xfrm: notify default policy on update 20fd28df4049 xfrm: make user policy API complete ab610ee1d1a1 net: xfrm: fix shift-out-of-bounce 5b7f84b1f9f4 xfrm: Add possibility to set the default to block if we have no policy Total patches: 96 - 5 - 1 - 8 = 82 Al Viro (1): Fix double fget() in vhost_net_set_backend() Alex Elder (1): net: ipa: record proper RX transaction count Andre Przywara (1): rtc: sun6i: Fix time overflow handling Andreas Gruenbacher (1): gfs2: Disable page faults during lockless buffered reads Andrew Lunn (1): net: bridge: Clear offload_fwd_mark when passing frame up bridge interface. Anton Eidelman (1): nvme-multipath: fix hang when disk goes live over reconnect Ard Biesheuvel (2): ARM: 9196/1: spectre-bhb: enable for Cortex-A15 ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 Catalin Marinas (1): arm64: mte: Ensure the cleared tags are visible before setting the PTE Christophe JAILLET (2): net: systemport: Fix an error handling path in bcm_sysport_probe() net/qla3xxx: Fix a test in ql_reset_work() Codrin Ciubotariu (1): clk: at91: generated: consider range when calculating best rate David Gow (1): um: Cleanup syscall_handler_t definition/cast, fix warning David Howells (1): afs: Fix afs_getattr() to refetch file status if callback break occurred Duoming Zhou (1): NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc Felix Fietkau (1): mac80211: fix rx reordering with non explicit / psmp ack policy Gleb Chesnokov (1): scsi: qla2xxx: Fix missed DMA unmap for aborted commands Grant Grundler (4): net: atlantic: fix "frag[0] not initialized" net: atlantic: reduce scope of is_rsc_complete net: atlantic: add check for MAX_SKB_FRAGS net: atlantic: verify hw_head_ lies within TX buffer ring Guo Xuenan (1): fs: fix an infinite loop in iomap_fiemap Haibo Chen (1): gpio: gpio-vf610: do not touch other bits when set the target bit Hangyu Hua (1): drm/dp/mst: fix a possible memory leak in fetch_monitor_name() Harini Katakam (1): net: macb: Increment rx bd head after allocating skb and buffer Hugo Villeneuve (1): rtc: pcf2127: fix bug when reading alarm registers Ilya Dryomov (1): libceph: fix potential use-after-free on linger ping and resends Jae Hyun Yoo (4): ARM: dts: aspeed-g6: remove FWQSPID group in pinctrl dtsi pinctrl: pinctrl-aspeed-g6: remove FWQSPID group in pinctrl ARM: dts: aspeed-g6: fix SPI1/SPI2 quad pin group dt-bindings: pinctrl: aspeed-g6: remove FWQSPID group Jakob Koschel (1): drbd: remove usage of list iterator variable after loop Jeff LaBundy (1): Input: add bounds checking to input_set_capability() Jens Axboe (1): io_uring: always grab file table for deferred statx Jessica Yu (2): module: treat exit sections the same as init sections when !CONFIG_MODULE_UNLOAD module: check for exit sections in layout_sections() instead of module_init_section() Jiasheng Jiang (1): net: af_key: add check for pfkey_broadcast in function pfkey_process Johannes Berg (1): nl80211: fix locking in nl80211_set_tx_bitrate_mask() Jérôme Pouiller (1): dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace Kai-Heng Feng (1): ALSA: hda/realtek: Enable headset mic on Lenovo P360 Kevin Mitchell (1): igb: skip phy status check where unavailable Kieran Frewen (1): nl80211: validate S1G channel width Krzysztof Kozlowski (1): riscv: dts: sifive: fu540-c000: align dma node name with dtschema Marek Vasut (1): Input: ili210x - fix reset timing Mario Limonciello (1): rtc: mc146818-lib: Fix the AltCentury for AMD platforms Maxim Mikityanskiy (1): net/mlx5e: Properly block LRO when XDP is enabled Michael S. Tsirkin (1): tools/virtio: compile with -pthread Monish Kumar R (1): nvme-pci: add quirks for Samsung X5 SSDs Nicolas Dichtel (1): selftests: add ping test with ping_group_range tuned Niklas Schnelle (1): s390/pci: improve zpci_dev reference counting Ondrej Mosnacek (2): selinux: fix bad cleanup on error in hashtab_duplicate() crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ Paolo Abeni (1): net/sched: act_pedit: sanitize shift argument before usage Paul Greenwalt (1): ice: fix possible under reporting of ethtool Tx and Rx statistics Peter Zijlstra (1): crypto: x86/chacha20 - Avoid spurious jumps to other functions Prakruthi Deepak Heragu (1): arm64: paravirt: Use RCU read locks to guard stolen_time Rafael J. Wysocki (1): PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold Ryusuke Konishi (2): nilfs2: fix lockdep warnings in page operations for btree nodes nilfs2: fix lockdep warnings during disk space reclamation Sasha Neftin (3): igc: Remove _I_PHY_ID checking igc: Remove phy->type checking igc: Update I226_K device ID Schspa Shi (1): usb: gadget: fix race when gadget driver register via ioctl Sean Christopherson (1): KVM: x86/mmu: Update number of zapped pages even if page list is stable Shreyas K K (1): arm64: Enable repeat tlbi workaround on KRYO4XX gold CPUs Takashi Iwai (2): ALSA: usb-audio: Restore Rane SL-1 quirk ALSA: wavefront: Proper check of get_user() error Thomas Richter (1): perf bench numa: Address compiler error on s390 Tzung-Bi Shih (1): platform/chrome: cros_ec_debugfs: detach log reader wq from devm Uwe Kleine-König (1): gpio: mvebu/pwm: Refuse requests with inverted polarity Vincent Bernat (1): net: evaluate net.ipvX.conf.all.disable_policy and disable_xfrm Vincent Whitchurch (1): rtc: fix use-after-free on device removal Werner Sembach (1): ALSA: hda/realtek: Add quirk for TongFang devices with pop noise Xiaoke Wang (1): MIPS: lantiq: check the return value of kzalloc() Yang Yingliang (3): ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one() net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe() i2c: mt7621: fix missing clk_disable_unprepare() on error in mtk_i2c_probe() Zheng Yongjun (2): Input: stmfts - fix reference leak in stmfts_input_open crypto: stm32 - fix reference leak in stm32_crc_remove Zhu Lingshan (1): vhost_vdpa: don't setup irq offloading when irq_num < 0 Zixuan Fu (2): net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() Documentation/arm64/silicon-errata.rst | 3 + .../pinctrl/aspeed,ast2600-pinctrl.yaml | 2 +- arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 9 +- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/mm/proc-v7-bugs.c | 1 + arch/arm64/kernel/cpu_errata.c | 2 + arch/arm64/kernel/mte.c | 3 + arch/arm64/kernel/paravirt.c | 29 +- arch/mips/lantiq/falcon/sysctrl.c | 2 + arch/mips/lantiq/xway/gptu.c | 2 + arch/mips/lantiq/xway/sysctrl.c | 46 ++- arch/riscv/boot/dts/sifive/fu540-c000.dtsi | 2 +- arch/s390/pci/pci.c | 1 + arch/s390/pci/pci_bus.h | 3 +- arch/s390/pci/pci_clp.c | 9 +- arch/s390/pci/pci_event.c | 7 +- arch/x86/crypto/chacha-avx512vl-x86_64.S | 4 +- arch/x86/kvm/mmu/mmu.c | 10 +- arch/x86/um/shared/sysdep/syscalls_64.h | 5 +- drivers/block/drbd/drbd_main.c | 7 +- drivers/clk/at91/clk-generated.c | 4 + drivers/crypto/qcom-rng.c | 1 + drivers/crypto/stm32/stm32-crc32.c | 4 +- drivers/gpio/gpio-mvebu.c | 3 + drivers/gpio/gpio-vf610.c | 8 +- drivers/gpu/drm/drm_dp_mst_topology.c | 1 + drivers/i2c/busses/i2c-mt7621.c | 10 +- drivers/input/input.c | 19 ++ drivers/input/touchscreen/ili210x.c | 4 +- drivers/input/touchscreen/stmfts.c | 8 +- .../net/ethernet/aquantia/atlantic/aq_ring.c | 20 +- .../aquantia/atlantic/hw_atl/hw_atl_b0.c | 7 + drivers/net/ethernet/broadcom/bcmsysport.c | 6 +- drivers/net/ethernet/cadence/macb_main.c | 2 +- drivers/net/ethernet/dec/tulip/tulip_core.c | 5 +- drivers/net/ethernet/intel/ice/ice_main.c | 7 +- drivers/net/ethernet/intel/igb/igb_main.c | 3 +- drivers/net/ethernet/intel/igc/igc_base.c | 10 +- drivers/net/ethernet/intel/igc/igc_hw.h | 1 + drivers/net/ethernet/intel/igc/igc_main.c | 18 +- drivers/net/ethernet/intel/igc/igc_phy.c | 6 +- .../net/ethernet/mellanox/mlx5/core/en_main.c | 7 + drivers/net/ethernet/qlogic/qla3xxx.c | 3 +- .../net/ethernet/stmicro/stmmac/stmmac_pci.c | 4 +- drivers/net/ipa/gsi.c | 6 +- drivers/net/vmxnet3/vmxnet3_drv.c | 6 + drivers/nvme/host/core.c | 1 + drivers/nvme/host/multipath.c | 25 +- drivers/nvme/host/nvme.h | 4 + drivers/nvme/host/pci.c | 5 +- drivers/pci/pci.c | 10 + drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 14 +- drivers/platform/chrome/cros_ec_debugfs.c | 12 +- drivers/rtc/class.c | 9 + drivers/rtc/rtc-mc146818-lib.c | 16 +- drivers/rtc/rtc-pcf2127.c | 3 +- drivers/rtc/rtc-sun6i.c | 14 +- drivers/scsi/qla2xxx/qla_target.c | 3 + drivers/usb/gadget/legacy/raw_gadget.c | 2 + drivers/vhost/net.c | 15 +- drivers/vhost/vdpa.c | 5 +- fs/afs/inode.c | 14 +- fs/gfs2/file.c | 4 +- fs/io_uring.c | 6 +- fs/ioctl.c | 2 +- fs/nilfs2/btnode.c | 23 +- fs/nilfs2/btnode.h | 1 + fs/nilfs2/btree.c | 27 +- fs/nilfs2/dat.c | 4 +- fs/nilfs2/gcinode.c | 7 +- fs/nilfs2/inode.c | 159 ++++++++- fs/nilfs2/mdt.c | 43 ++- fs/nilfs2/mdt.h | 6 +- fs/nilfs2/nilfs.h | 16 +- fs/nilfs2/page.c | 7 +- fs/nilfs2/segment.c | 9 +- fs/nilfs2/super.c | 5 +- include/linux/ceph/osd_client.h | 3 + include/linux/mc146818rtc.h | 2 + include/uapi/linux/dma-buf.h | 4 +- kernel/module.c | 18 +- net/bridge/br_input.c | 7 + net/ceph/osd_client.c | 302 +++++++----------- net/ipv4/route.c | 12 +- net/key/af_key.c | 6 +- net/mac80211/rx.c | 3 +- net/nfc/nci/data.c | 2 +- net/nfc/nci/hci.c | 4 +- net/sched/act_pedit.c | 4 + net/wireless/nl80211.c | 18 +- security/selinux/ss/hashtab.c | 3 +- sound/isa/wavefront/wavefront_synth.c | 3 +- sound/pci/hda/patch_realtek.c | 9 + sound/usb/quirks-table.h | 9 + tools/perf/bench/numa.c | 2 +- tools/testing/selftests/net/fcnal-test.sh | 12 + tools/virtio/Makefile | 3 +- 97 files changed, 786 insertions(+), 433 deletions(-) -- 2.20.1

1 82

[PATCH openEuler-5.10-LTS 00/66] Backport 5.10.117 LTS
by Zheng Zengkai 16 Aug '22

16 Aug '22

Backport 5.10.117 LTS patches from upstream. git cherry-pick v5.10.116..v5.10.117~1 -s Complicts: Already merged(2): e68b60ae29de1 SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() 29f077d07051 io_uring: always use original task when preparing req identity Context conflict: 7e849dbe604d cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp() Total patches: 68 - 2 = 66 Alexandra Winter (3): s390/ctcm: fix variable dereferenced before check s390/ctcm: fix potential memory leak s390/lcs: fix variable dereferenced before check Andreas Gruenbacher (1): gfs2: Fix filesystem block deallocation for short writes AngeloGioacchino Del Regno (2): serial: 8250_mtk: Fix UART_EFR register address serial: 8250_mtk: Fix register address for XON/XOFF character Camel Guo (1): hwmon: (tmp401) Add OF device ID table ChiYuan Huang (1): usb: typec: tcpci_mt6360: Update for BMC PHY setting Christophe JAILLET (1): drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name() Dan Aloni (1): nfs: fix broken handling of the softreval mount option Dan Vacura (1): usb: gadget: uvc: allow for application to cleanly shutdown Daniel Starke (1): tty: n_gsm: fix mux activation issues in gsm_config() Eric Dumazet (2): netlink: do not reset transport header in netlink_recvmsg() tcp: resalt the secret every 10 seconds Ethan Yang (1): USB: serial: qcserial: add support for Sierra Wireless EM7590 Florian Fainelli (2): net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down() Francesco Dolcini (1): net: phy: Fix race condition on link status change Guangguan Wang (1): net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending Guenter Roeck (1): iwlwifi: iwl-dbg: Use del_timer_sync() before freeing Gustavo A. R. Silva (1): SUNRPC: Fix fall-through warnings for Clang Jeff Layton (1): ceph: fix setting of xattrs on async created inodes Jesse Brandeburg (1): dim: initialize all struct fields Ji-Ze Hong (Peter Hong) (1): hwmon: (f71882fg) Fix negative temperature Jiapeng Chong (1): sfc: Use swap() instead of open coding it Joel Savitz (1): selftests: vm: Makefile: rename TARGETS to VMTARGETS Johannes Berg (1): mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection Lokesh Dhoundiyal (1): ipv4: drop dst in multicast routing path Manikanta Pubbisetty (1): mac80211: Reset MBSSID parameters upon connection Manuel Ullmann (1): net: atlantic: always deep reset on pm op, fixing up my null deref regression Mark Brown (3): ASoC: max98090: Reject invalid values in custom control put() ASoC: max98090: Generate notifications on changes for custom control ASoC: ops: Validate input values in snd_soc_put_volsw_range() Matthew Hagan (1): net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT Maxim Mikityanskiy (1): tls: Fix context leak on tls_device_down Miaoqian Lin (1): slimbus: qcom: Fix IRQ check in qcom_slim_probe Michael Tretter (1): usb: gadget: uvc: rename function to be more consistent Mike Rapoport (1): arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map Nicolas Dichtel (1): ping: fix address binding wrt vrf Paolo Abeni (1): net/sched: act_pedit: really ensure the skb is writable Randy Dunlap (1): hwmon: (ltq-cputemp) restrict it to SOC_XWAY Robin Murphy (1): drm/nouveau/tegra: Stop using iommu_present() Scott Chen (1): USB: serial: pl2303: add device id for HP LM930 Display Sergey Ryazanov (1): usb: cdc-wdm: fix reading stuck on device close Shravya Kumbham (1): net: emaclite: Don't advertise 1000BASE-T and do auto negotiation Sven Eckelmann (1): batman-adv: Don't skb_split skbuffs with frag_list Sven Schnelle (1): s390: disable -Warray-bounds Sven Schwermer (2): USB: serial: option: add Fibocom L610 modem USB: serial: option: add Fibocom MA510 modem Taehee Yoo (2): net: sfc: fix memory leak due to ptp channel net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe() Tariq Toukan (1): net: Fix features skip in for_each_netdev_feature() Thiébaud Weksteen (1): firmware_loader: use kernel credentials when reading firmware Trond Myklebust (3): SUNRPC: Clean up scheduling of autoclose SUNRPC: Prevent immediate close+reconnect SUNRPC: Don't call connect() more than once on a TCP socket Uwe Kleine-König (1): usb: typec: tcpci: Don't skip cleanup in .remove() on error Vladimir Oltean (4): net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in hardware when deleted net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0 net: mscc: ocelot: avoid corrupting hardware counters when moving VCAP filters Waiman Long (1): cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp() Xiaomeng Tong (1): i40e: i40e_main: fix a missing check on list iterator Yang Yingliang (2): ionic: fix missing pci_release_regions() on error in ionic_probe() tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe() Zack Rusin (1): drm/vmwgfx: Initialize drm_mode_fb_cmd2 arch/arm/include/asm/io.h | 3 ++ arch/arm/mm/ioremap.c | 8 ++++ arch/arm64/include/asm/io.h | 4 ++ arch/arm64/mm/ioremap.c | 9 ++++ arch/s390/Makefile | 10 +++++ drivers/base/firmware_loader/main.c | 17 +++++++ drivers/gpu/drm/nouveau/nouveau_backlight.c | 9 ++-- .../drm/nouveau/nvkm/engine/device/tegra.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/hwmon/Kconfig | 2 +- drivers/hwmon/f71882fg.c | 5 ++- drivers/hwmon/tmp401.c | 11 +++++ drivers/net/dsa/bcm_sf2.c | 3 ++ .../ethernet/aquantia/atlantic/aq_pci_func.c | 4 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 ++ drivers/net/ethernet/intel/i40e/i40e_main.c | 27 +++++------ drivers/net/ethernet/mscc/ocelot_flower.c | 5 ++- drivers/net/ethernet/mscc/ocelot_vcap.c | 9 +++- .../ethernet/pensando/ionic/ionic_bus_pci.c | 3 +- drivers/net/ethernet/sfc/ef10.c | 5 +++ drivers/net/ethernet/sfc/efx_channels.c | 21 +++++---- drivers/net/ethernet/sfc/ptp.c | 14 +++++- drivers/net/ethernet/sfc/ptp.h | 1 + drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 ------- drivers/net/phy/phy.c | 45 ++++++++++++++++--- drivers/net/phy/sfp.c | 12 ++++- .../net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 2 +- drivers/net/wireless/mac80211_hwsim.c | 3 ++ drivers/s390/net/ctcm_mpc.c | 6 +-- drivers/s390/net/ctcm_sysfs.c | 5 ++- drivers/s390/net/lcs.c | 7 +-- drivers/slimbus/qcom-ctrl.c | 4 +- drivers/tty/n_gsm.c | 12 +++-- drivers/tty/serial/8250/8250_mtk.c | 22 +++++---- drivers/tty/serial/digicolor-usart.c | 5 +-- drivers/usb/class/cdc-wdm.c | 1 + drivers/usb/gadget/function/f_uvc.c | 32 +++++++++++-- drivers/usb/gadget/function/uvc.h | 2 + drivers/usb/gadget/function/uvc_v4l2.c | 3 +- drivers/usb/serial/option.c | 4 ++ drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + drivers/usb/serial/qcserial.c | 2 + drivers/usb/typec/tcpm/tcpci.c | 2 +- drivers/usb/typec/tcpm/tcpci_mt6360.c | 26 +++++++++++ fs/ceph/file.c | 16 +++++-- fs/gfs2/bmap.c | 11 +++-- fs/nfs/fs_context.c | 2 +- include/linux/netdev_features.h | 4 +- include/linux/sunrpc/xprtsock.h | 1 + include/net/tc_act/tc_pedit.h | 1 + kernel/cgroup/cpuset.c | 7 ++- lib/dim/net_dim.c | 44 +++++++++--------- net/batman-adv/fragmentation.c | 11 +++++ net/core/secure_seq.c | 12 +++-- net/ipv4/ping.c | 15 ++++++- net/ipv4/route.c | 1 + net/mac80211/mlme.c | 6 +++ net/netlink/af_netlink.c | 1 - net/sched/act_pedit.c | 26 +++++++++-- net/smc/smc_rx.c | 4 +- net/sunrpc/rpc_pipe.c | 1 + net/sunrpc/xprt.c | 29 +++++++----- net/sunrpc/xprtsock.c | 21 +++++---- net/tls/tls_device.c | 3 ++ sound/soc/codecs/max98090.c | 5 ++- sound/soc/soc-ops.c | 18 +++++++- tools/testing/selftests/vm/Makefile | 10 ++--- 68 files changed, 468 insertions(+), 171 deletions(-) -- 2.20.1

1 66

[PATCH openEuler-5.10-LTS 01/22] drivers/perf: hisi: Add driver for HiSilicon PCIe PMU
by Zheng Zengkai 16 Aug '22

16 Aug '22

From: Qi Liu <liuqi115(a)huawei.com> mainline inclusion from mainline-v5.17-rc1 commit 8404b0fbc7fb category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5AZ87 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------------------------------------------------- PCIe PMU Root Complex Integrated End Point(RCiEP) device is supported to sample bandwidth, latency, buffer occupation etc. Each PMU RCiEP device monitors multiple Root Ports, and each RCiEP is registered as a PMU in /sys/bus/event_source/devices, so users can select target PMU, and use filter to do further sets. Filtering options contains: event - select the event. port - select target Root Ports. Information of Root Ports are shown under sysfs. bdf - select requester_id of target EP device. trig_len - set trigger condition for starting event statistics. trig_mode - set trigger mode. 0 means starting to statistic when bigger than trigger condition, and 1 means smaller. thr_len - set threshold for statistics. thr_mode - set threshold mode. 0 means count when bigger than threshold, and 1 means smaller. Acked-by: Krzysztof Wilczyński <kw(a)linux.com> Reviewed-by: John Garry <john.garry(a)huawei.com> Signed-off-by: Qi Liu <liuqi115(a)huawei.com> Reviewed-by: Shaokun Zhang <zhangshaokun(a)hisilicon.com> Link: https://lore.kernel.org/r/20211202080633.2919-3-liuqi115@huawei.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Wangming Shao <shaowangming(a)h-partners.com> Reviewed-by: Junhao He <hejunhao3(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- MAINTAINERS | 2 + drivers/perf/hisilicon/Kconfig | 9 + drivers/perf/hisilicon/Makefile | 2 + drivers/perf/hisilicon/hisi_pcie_pmu.c | 951 +++++++++++++++++++++++++ include/linux/cpuhotplug.h | 3 + 5 files changed, 967 insertions(+) create mode 100644 drivers/perf/hisilicon/hisi_pcie_pmu.c diff --git a/MAINTAINERS b/MAINTAINERS index 23a23bd94c00..d3d6cad63b94 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -7976,8 +7976,10 @@ F: Documentation/devicetree/bindings/misc/hisilicon-hikey-usb.yaml HISILICON PMU DRIVER M: Shaokun Zhang <zhangshaokun(a)hisilicon.com> +M: Qi Liu <liuqi115(a)huawei.com> S: Supported W: http://www.hisilicon.com +F: Documentation/admin-guide/perf/hisi-pcie-pmu.rst F: Documentation/admin-guide/perf/hisi-pmu.rst F: drivers/perf/hisilicon diff --git a/drivers/perf/hisilicon/Kconfig b/drivers/perf/hisilicon/Kconfig index c5d1b7019fff..5546218b5598 100644 --- a/drivers/perf/hisilicon/Kconfig +++ b/drivers/perf/hisilicon/Kconfig @@ -5,3 +5,12 @@ config HISI_PMU help Support for HiSilicon SoC L3 Cache performance monitor, Hydra Home Agent performance monitor and DDR Controller performance monitor. + +config HISI_PCIE_PMU + tristate "HiSilicon PCIE PERF PMU" + depends on PCI && ARM64 + help + Provide support for HiSilicon PCIe performance monitoring unit (PMU) + RCiEP devices. + Adds the PCIe PMU into perf events system for monitoring latency, + bandwidth etc. diff --git a/drivers/perf/hisilicon/Makefile b/drivers/perf/hisilicon/Makefile index 7643c9f93e36..506ed39e3266 100644 --- a/drivers/perf/hisilicon/Makefile +++ b/drivers/perf/hisilicon/Makefile @@ -2,3 +2,5 @@ obj-$(CONFIG_HISI_PMU) += hisi_uncore_pmu.o hisi_uncore_l3c_pmu.o \ hisi_uncore_hha_pmu.o hisi_uncore_ddrc_pmu.o hisi_uncore_sllc_pmu.o \ hisi_uncore_pa_pmu.o + +obj-$(CONFIG_HISI_PCIE_PMU) += hisi_pcie_pmu.o diff --git a/drivers/perf/hisilicon/hisi_pcie_pmu.c b/drivers/perf/hisilicon/hisi_pcie_pmu.c new file mode 100644 index 000000000000..2f18838754ec --- /dev/null +++ b/drivers/perf/hisilicon/hisi_pcie_pmu.c @@ -0,0 +1,951 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * This driver adds support for PCIe PMU RCiEP device. Related + * perf events are bandwidth, latency etc. + * + * Copyright (C) 2021 HiSilicon Limited + * Author: Qi Liu <liuqi115(a)huawei.com> + */ +#include <linux/bitfield.h> +#include <linux/bitmap.h> +#include <linux/bug.h> +#include <linux/device.h> +#include <linux/err.h> +#include <linux/interrupt.h> +#include <linux/irq.h> +#include <linux/kernel.h> +#include <linux/list.h> +#include <linux/module.h> +#include <linux/pci.h> +#include <linux/perf_event.h> + +#define DRV_NAME "hisi_pcie_pmu" +/* Define registers */ +#define HISI_PCIE_GLOBAL_CTRL 0x00 +#define HISI_PCIE_EVENT_CTRL 0x010 +#define HISI_PCIE_CNT 0x090 +#define HISI_PCIE_EXT_CNT 0x110 +#define HISI_PCIE_INT_STAT 0x150 +#define HISI_PCIE_INT_MASK 0x154 +#define HISI_PCIE_REG_BDF 0xfe0 +#define HISI_PCIE_REG_VERSION 0xfe4 +#define HISI_PCIE_REG_INFO 0xfe8 + +/* Define command in HISI_PCIE_GLOBAL_CTRL */ +#define HISI_PCIE_GLOBAL_EN 0x01 +#define HISI_PCIE_GLOBAL_NONE 0 + +/* Define command in HISI_PCIE_EVENT_CTRL */ +#define HISI_PCIE_EVENT_EN BIT_ULL(20) +#define HISI_PCIE_RESET_CNT BIT_ULL(22) +#define HISI_PCIE_INIT_SET BIT_ULL(34) +#define HISI_PCIE_THR_EN BIT_ULL(26) +#define HISI_PCIE_TARGET_EN BIT_ULL(32) +#define HISI_PCIE_TRIG_EN BIT_ULL(52) + +/* Define offsets in HISI_PCIE_EVENT_CTRL */ +#define HISI_PCIE_EVENT_M GENMASK_ULL(15, 0) +#define HISI_PCIE_THR_MODE_M GENMASK_ULL(27, 27) +#define HISI_PCIE_THR_M GENMASK_ULL(31, 28) +#define HISI_PCIE_TARGET_M GENMASK_ULL(52, 36) +#define HISI_PCIE_TRIG_MODE_M GENMASK_ULL(53, 53) +#define HISI_PCIE_TRIG_M GENMASK_ULL(59, 56) + +#define HISI_PCIE_MAX_COUNTERS 8 +#define HISI_PCIE_REG_STEP 8 +#define HISI_PCIE_THR_MAX_VAL 10 +#define HISI_PCIE_TRIG_MAX_VAL 10 +#define HISI_PCIE_MAX_PERIOD (GENMASK_ULL(63, 0)) +#define HISI_PCIE_INIT_VAL BIT_ULL(63) + +struct hisi_pcie_pmu { + struct perf_event *hw_events[HISI_PCIE_MAX_COUNTERS]; + struct hlist_node node; + struct pci_dev *pdev; + struct pmu pmu; + void __iomem *base; + int irq; + u32 identifier; + /* Minimum and maximum BDF of root ports monitored by PMU */ + u16 bdf_min; + u16 bdf_max; + int on_cpu; +}; + +struct hisi_pcie_reg_pair { + u16 lo; + u16 hi; +}; + +#define to_pcie_pmu(p) (container_of((p), struct hisi_pcie_pmu, pmu)) +#define GET_PCI_DEVFN(bdf) ((bdf) & 0xff) + +#define HISI_PCIE_PMU_FILTER_ATTR(_name, _config, _hi, _lo) \ + static u64 hisi_pcie_get_##_name(struct perf_event *event) \ + { \ + return FIELD_GET(GENMASK(_hi, _lo), event->attr._config); \ + } \ + +HISI_PCIE_PMU_FILTER_ATTR(event, config, 16, 0); +HISI_PCIE_PMU_FILTER_ATTR(thr_len, config1, 3, 0); +HISI_PCIE_PMU_FILTER_ATTR(thr_mode, config1, 4, 4); +HISI_PCIE_PMU_FILTER_ATTR(trig_len, config1, 8, 5); +HISI_PCIE_PMU_FILTER_ATTR(trig_mode, config1, 9, 9); +HISI_PCIE_PMU_FILTER_ATTR(port, config2, 15, 0); +HISI_PCIE_PMU_FILTER_ATTR(bdf, config2, 31, 16); + +static ssize_t hisi_pcie_format_sysfs_show(struct device *dev, struct device_attribute *attr, + char *buf) +{ + struct dev_ext_attribute *eattr; + + eattr = container_of(attr, struct dev_ext_attribute, attr); + + return sysfs_emit(buf, "%s\n", (char *)eattr->var); +} + +static ssize_t hisi_pcie_event_sysfs_show(struct device *dev, struct device_attribute *attr, + char *buf) +{ + struct perf_pmu_events_attr *pmu_attr = + container_of(attr, struct perf_pmu_events_attr, attr); + + return sysfs_emit(buf, "config=0x%llx\n", pmu_attr->id); +} + +#define HISI_PCIE_PMU_FORMAT_ATTR(_name, _format) \ + (&((struct dev_ext_attribute[]){ \ + { .attr = __ATTR(_name, 0444, hisi_pcie_format_sysfs_show, \ + NULL), \ + .var = (void *)_format } \ + })[0].attr.attr) + +#define HISI_PCIE_PMU_EVENT_ATTR(_name, _id) \ + (&((struct perf_pmu_events_attr[]) { \ + { .attr = __ATTR(_name, 0444, hisi_pcie_event_sysfs_show, NULL), \ + .id = _id, } \ + })[0].attr.attr) + +static ssize_t cpumask_show(struct device *dev, struct device_attribute *attr, char *buf) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(dev_get_drvdata(dev)); + + return cpumap_print_to_pagebuf(true, buf, cpumask_of(pcie_pmu->on_cpu)); +} +static DEVICE_ATTR_RO(cpumask); + +static ssize_t identifier_show(struct device *dev, struct device_attribute *attr, char *buf) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(dev_get_drvdata(dev)); + + return sysfs_emit(buf, "%#x\n", pcie_pmu->identifier); +} +static DEVICE_ATTR_RO(identifier); + +static ssize_t bus_show(struct device *dev, struct device_attribute *attr, char *buf) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(dev_get_drvdata(dev)); + + return sysfs_emit(buf, "%#04x\n", PCI_BUS_NUM(pcie_pmu->bdf_min)); +} +static DEVICE_ATTR_RO(bus); + +static struct hisi_pcie_reg_pair +hisi_pcie_parse_reg_value(struct hisi_pcie_pmu *pcie_pmu, u32 reg_off) +{ + u32 val = readl_relaxed(pcie_pmu->base + reg_off); + struct hisi_pcie_reg_pair regs = { + .lo = val, + .hi = val >> 16, + }; + + return regs; +} + +/* + * Hardware counter and ext_counter work together for bandwidth, latency, bus + * utilization and buffer occupancy events. For example, RX memory write latency + * events(index = 0x0010), counter counts total delay cycles and ext_counter + * counts RX memory write PCIe packets number. + * + * As we don't want PMU driver to process these two data, "delay cycles" can + * be treated as an independent event(index = 0x0010), "RX memory write packets + * number" as another(index = 0x10010). BIT 16 is used to distinguish and 0-15 + * bits are "real" event index, which can be used to set HISI_PCIE_EVENT_CTRL. + */ +#define EXT_COUNTER_IS_USED(idx) ((idx) & BIT(16)) + +static u32 hisi_pcie_get_real_event(struct perf_event *event) +{ + return hisi_pcie_get_event(event) & GENMASK(15, 0); +} + +static u32 hisi_pcie_pmu_get_offset(u32 offset, u32 idx) +{ + return offset + HISI_PCIE_REG_STEP * idx; +} + +static u32 hisi_pcie_pmu_readl(struct hisi_pcie_pmu *pcie_pmu, u32 reg_offset, + u32 idx) +{ + u32 offset = hisi_pcie_pmu_get_offset(reg_offset, idx); + + return readl_relaxed(pcie_pmu->base + offset); +} + +static void hisi_pcie_pmu_writel(struct hisi_pcie_pmu *pcie_pmu, u32 reg_offset, u32 idx, u32 val) +{ + u32 offset = hisi_pcie_pmu_get_offset(reg_offset, idx); + + writel_relaxed(val, pcie_pmu->base + offset); +} + +static u64 hisi_pcie_pmu_readq(struct hisi_pcie_pmu *pcie_pmu, u32 reg_offset, u32 idx) +{ + u32 offset = hisi_pcie_pmu_get_offset(reg_offset, idx); + + return readq_relaxed(pcie_pmu->base + offset); +} + +static void hisi_pcie_pmu_writeq(struct hisi_pcie_pmu *pcie_pmu, u32 reg_offset, u32 idx, u64 val) +{ + u32 offset = hisi_pcie_pmu_get_offset(reg_offset, idx); + + writeq_relaxed(val, pcie_pmu->base + offset); +} + +static void hisi_pcie_pmu_config_filter(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + u64 reg = HISI_PCIE_INIT_SET; + u64 port, trig_len, thr_len; + + /* Config HISI_PCIE_EVENT_CTRL according to event. */ + reg |= FIELD_PREP(HISI_PCIE_EVENT_M, hisi_pcie_get_real_event(event)); + + /* Config HISI_PCIE_EVENT_CTRL according to root port or EP device. */ + port = hisi_pcie_get_port(event); + if (port) + reg |= FIELD_PREP(HISI_PCIE_TARGET_M, port); + else + reg |= HISI_PCIE_TARGET_EN | + FIELD_PREP(HISI_PCIE_TARGET_M, hisi_pcie_get_bdf(event)); + + /* Config HISI_PCIE_EVENT_CTRL according to trigger condition. */ + trig_len = hisi_pcie_get_trig_len(event); + if (trig_len) { + reg |= FIELD_PREP(HISI_PCIE_TRIG_M, trig_len); + reg |= FIELD_PREP(HISI_PCIE_TRIG_MODE_M, hisi_pcie_get_trig_mode(event)); + reg |= HISI_PCIE_TRIG_EN; + } + + /* Config HISI_PCIE_EVENT_CTRL according to threshold condition. */ + thr_len = hisi_pcie_get_thr_len(event); + if (thr_len) { + reg |= FIELD_PREP(HISI_PCIE_THR_M, thr_len); + reg |= FIELD_PREP(HISI_PCIE_THR_MODE_M, hisi_pcie_get_thr_mode(event)); + reg |= HISI_PCIE_THR_EN; + } + + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, hwc->idx, reg); +} + +static void hisi_pcie_pmu_clear_filter(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, hwc->idx, HISI_PCIE_INIT_SET); +} + +static bool hisi_pcie_pmu_valid_requester_id(struct hisi_pcie_pmu *pcie_pmu, u32 bdf) +{ + struct pci_dev *root_port, *pdev; + u16 rp_bdf; + + pdev = pci_get_domain_bus_and_slot(pci_domain_nr(pcie_pmu->pdev->bus), PCI_BUS_NUM(bdf), + GET_PCI_DEVFN(bdf)); + if (!pdev) + return false; + + root_port = pcie_find_root_port(pdev); + if (!root_port) { + pci_dev_put(pdev); + return false; + } + + pci_dev_put(pdev); + rp_bdf = pci_dev_id(root_port); + return rp_bdf >= pcie_pmu->bdf_min && rp_bdf <= pcie_pmu->bdf_max; +} + +static bool hisi_pcie_pmu_valid_filter(struct perf_event *event, + struct hisi_pcie_pmu *pcie_pmu) +{ + u32 requester_id = hisi_pcie_get_bdf(event); + + if (hisi_pcie_get_thr_len(event) > HISI_PCIE_THR_MAX_VAL) + return false; + + if (hisi_pcie_get_trig_len(event) > HISI_PCIE_TRIG_MAX_VAL) + return false; + + if (requester_id) { + if (!hisi_pcie_pmu_valid_requester_id(pcie_pmu, requester_id)) + return false; + } + + return true; +} + +static bool hisi_pcie_pmu_cmp_event(struct perf_event *target, + struct perf_event *event) +{ + return hisi_pcie_get_real_event(target) == hisi_pcie_get_real_event(event); +} + +static bool hisi_pcie_pmu_validate_event_group(struct perf_event *event) +{ + struct perf_event *sibling, *leader = event->group_leader; + struct perf_event *event_group[HISI_PCIE_MAX_COUNTERS]; + int counters = 1; + int num; + + event_group[0] = leader; + if (!is_software_event(leader)) { + if (leader->pmu != event->pmu) + return false; + + if (leader != event && !hisi_pcie_pmu_cmp_event(leader, event)) + event_group[counters++] = event; + } + + for_each_sibling_event(sibling, event->group_leader) { + if (is_software_event(sibling)) + continue; + + if (sibling->pmu != event->pmu) + return false; + + for (num = 0; num < counters; num++) { + if (hisi_pcie_pmu_cmp_event(event_group[num], sibling)) + break; + } + + if (num == counters) + event_group[counters++] = sibling; + } + + return counters <= HISI_PCIE_MAX_COUNTERS; +} + +static int hisi_pcie_pmu_event_init(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + + event->cpu = pcie_pmu->on_cpu; + + if (EXT_COUNTER_IS_USED(hisi_pcie_get_event(event))) + hwc->event_base = HISI_PCIE_EXT_CNT; + else + hwc->event_base = HISI_PCIE_CNT; + + if (event->attr.type != event->pmu->type) + return -ENOENT; + + /* Sampling is not supported. */ + if (is_sampling_event(event) || event->attach_state & PERF_ATTACH_TASK) + return -EOPNOTSUPP; + + if (!hisi_pcie_pmu_valid_filter(event, pcie_pmu)) + return -EINVAL; + + if (!hisi_pcie_pmu_validate_event_group(event)) + return -EINVAL; + + return 0; +} + +static u64 hisi_pcie_pmu_read_counter(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + u32 idx = event->hw.idx; + + return hisi_pcie_pmu_readq(pcie_pmu, event->hw.event_base, idx); +} + +static int hisi_pcie_pmu_find_related_event(struct hisi_pcie_pmu *pcie_pmu, + struct perf_event *event) +{ + struct perf_event *sibling; + int idx; + + for (idx = 0; idx < HISI_PCIE_MAX_COUNTERS; idx++) { + sibling = pcie_pmu->hw_events[idx]; + if (!sibling) + continue; + + if (!hisi_pcie_pmu_cmp_event(sibling, event)) + continue; + + /* Related events must be used in group */ + if (sibling->group_leader == event->group_leader) + return idx; + else + return -EINVAL; + } + + return idx; +} + +static int hisi_pcie_pmu_get_event_idx(struct hisi_pcie_pmu *pcie_pmu) +{ + int idx; + + for (idx = 0; idx < HISI_PCIE_MAX_COUNTERS; idx++) { + if (!pcie_pmu->hw_events[idx]) + return idx; + } + + return -EINVAL; +} + +static void hisi_pcie_pmu_event_update(struct perf_event *event) +{ + struct hw_perf_event *hwc = &event->hw; + u64 new_cnt, prev_cnt, delta; + + do { + prev_cnt = local64_read(&hwc->prev_count); + new_cnt = hisi_pcie_pmu_read_counter(event); + } while (local64_cmpxchg(&hwc->prev_count, prev_cnt, + new_cnt) != prev_cnt); + + delta = (new_cnt - prev_cnt) & HISI_PCIE_MAX_PERIOD; + local64_add(delta, &event->count); +} + +static void hisi_pcie_pmu_read(struct perf_event *event) +{ + hisi_pcie_pmu_event_update(event); +} + +static void hisi_pcie_pmu_set_period(struct perf_event *event) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + int idx = hwc->idx; + + local64_set(&hwc->prev_count, HISI_PCIE_INIT_VAL); + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_CNT, idx, HISI_PCIE_INIT_VAL); + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EXT_CNT, idx, HISI_PCIE_INIT_VAL); +} + +static void hisi_pcie_pmu_enable_counter(struct hisi_pcie_pmu *pcie_pmu, struct hw_perf_event *hwc) +{ + u32 idx = hwc->idx; + u64 val; + + val = hisi_pcie_pmu_readq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx); + val |= HISI_PCIE_EVENT_EN; + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx, val); +} + +static void hisi_pcie_pmu_disable_counter(struct hisi_pcie_pmu *pcie_pmu, struct hw_perf_event *hwc) +{ + u32 idx = hwc->idx; + u64 val; + + val = hisi_pcie_pmu_readq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx); + val &= ~HISI_PCIE_EVENT_EN; + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx, val); +} + +static void hisi_pcie_pmu_enable_int(struct hisi_pcie_pmu *pcie_pmu, struct hw_perf_event *hwc) +{ + u32 idx = hwc->idx; + + hisi_pcie_pmu_writel(pcie_pmu, HISI_PCIE_INT_MASK, idx, 0); +} + +static void hisi_pcie_pmu_disable_int(struct hisi_pcie_pmu *pcie_pmu, struct hw_perf_event *hwc) +{ + u32 idx = hwc->idx; + + hisi_pcie_pmu_writel(pcie_pmu, HISI_PCIE_INT_MASK, idx, 1); +} + +static void hisi_pcie_pmu_reset_counter(struct hisi_pcie_pmu *pcie_pmu, int idx) +{ + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx, HISI_PCIE_RESET_CNT); + hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EVENT_CTRL, idx, HISI_PCIE_INIT_SET); +} + +static void hisi_pcie_pmu_start(struct perf_event *event, int flags) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + int idx = hwc->idx; + u64 prev_cnt; + + if (WARN_ON_ONCE(!(hwc->state & PERF_HES_STOPPED))) + return; + + WARN_ON_ONCE(!(hwc->state & PERF_HES_UPTODATE)); + hwc->state = 0; + + hisi_pcie_pmu_config_filter(event); + hisi_pcie_pmu_enable_counter(pcie_pmu, hwc); + hisi_pcie_pmu_enable_int(pcie_pmu, hwc); + hisi_pcie_pmu_set_period(event); + + if (flags & PERF_EF_RELOAD) { + prev_cnt = local64_read(&hwc->prev_count); + hisi_pcie_pmu_writeq(pcie_pmu, hwc->event_base, idx, prev_cnt); + } + + perf_event_update_userpage(event); +} + +static void hisi_pcie_pmu_stop(struct perf_event *event, int flags) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + + hisi_pcie_pmu_event_update(event); + hisi_pcie_pmu_disable_int(pcie_pmu, hwc); + hisi_pcie_pmu_disable_counter(pcie_pmu, hwc); + hisi_pcie_pmu_clear_filter(event); + WARN_ON_ONCE(hwc->state & PERF_HES_STOPPED); + hwc->state |= PERF_HES_STOPPED; + + if (hwc->state & PERF_HES_UPTODATE) + return; + + hwc->state |= PERF_HES_UPTODATE; +} + +static int hisi_pcie_pmu_add(struct perf_event *event, int flags) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + int idx; + + hwc->state = PERF_HES_STOPPED | PERF_HES_UPTODATE; + + /* Check all working events to find a related event. */ + idx = hisi_pcie_pmu_find_related_event(pcie_pmu, event); + if (idx < 0) + return idx; + + /* Current event shares an enabled counter with the related event */ + if (idx < HISI_PCIE_MAX_COUNTERS) { + hwc->idx = idx; + goto start_count; + } + + idx = hisi_pcie_pmu_get_event_idx(pcie_pmu); + if (idx < 0) + return idx; + + hwc->idx = idx; + pcie_pmu->hw_events[idx] = event; + /* Reset Counter to avoid previous statistic interference. */ + hisi_pcie_pmu_reset_counter(pcie_pmu, idx); + +start_count: + if (flags & PERF_EF_START) + hisi_pcie_pmu_start(event, PERF_EF_RELOAD); + + return 0; +} + +static void hisi_pcie_pmu_del(struct perf_event *event, int flags) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu); + struct hw_perf_event *hwc = &event->hw; + + hisi_pcie_pmu_stop(event, PERF_EF_UPDATE); + pcie_pmu->hw_events[hwc->idx] = NULL; + perf_event_update_userpage(event); +} + +static void hisi_pcie_pmu_enable(struct pmu *pmu) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(pmu); + int num; + + for (num = 0; num < HISI_PCIE_MAX_COUNTERS; num++) { + if (pcie_pmu->hw_events[num]) + break; + } + + if (num == HISI_PCIE_MAX_COUNTERS) + return; + + writel(HISI_PCIE_GLOBAL_EN, pcie_pmu->base + HISI_PCIE_GLOBAL_CTRL); +} + +static void hisi_pcie_pmu_disable(struct pmu *pmu) +{ + struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(pmu); + + writel(HISI_PCIE_GLOBAL_NONE, pcie_pmu->base + HISI_PCIE_GLOBAL_CTRL); +} + +static irqreturn_t hisi_pcie_pmu_irq(int irq, void *data) +{ + struct hisi_pcie_pmu *pcie_pmu = data; + irqreturn_t ret = IRQ_NONE; + struct perf_event *event; + u32 overflown; + int idx; + + for (idx = 0; idx < HISI_PCIE_MAX_COUNTERS; idx++) { + overflown = hisi_pcie_pmu_readl(pcie_pmu, HISI_PCIE_INT_STAT, idx); + if (!overflown) + continue; + + /* Clear status of interrupt. */ + hisi_pcie_pmu_writel(pcie_pmu, HISI_PCIE_INT_STAT, idx, 1); + event = pcie_pmu->hw_events[idx]; + if (!event) + continue; + + hisi_pcie_pmu_event_update(event); + hisi_pcie_pmu_set_period(event); + ret = IRQ_HANDLED; + } + + return ret; +} + +static int hisi_pcie_pmu_irq_register(struct pci_dev *pdev, struct hisi_pcie_pmu *pcie_pmu) +{ + int irq, ret; + + ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_MSI); + if (ret < 0) { + pci_err(pdev, "Failed to enable MSI vectors: %d\n", ret); + return ret; + } + + irq = pci_irq_vector(pdev, 0); + ret = request_irq(irq, hisi_pcie_pmu_irq, IRQF_NOBALANCING | IRQF_NO_THREAD, DRV_NAME, + pcie_pmu); + if (ret) { + pci_err(pdev, "Failed to register IRQ: %d\n", ret); + pci_free_irq_vectors(pdev); + return ret; + } + + pcie_pmu->irq = irq; + + return 0; +} + +static void hisi_pcie_pmu_irq_unregister(struct pci_dev *pdev, struct hisi_pcie_pmu *pcie_pmu) +{ + free_irq(pcie_pmu->irq, pcie_pmu); + pci_free_irq_vectors(pdev); +} + +static int hisi_pcie_pmu_online_cpu(unsigned int cpu, struct hlist_node *node) +{ + struct hisi_pcie_pmu *pcie_pmu = hlist_entry_safe(node, struct hisi_pcie_pmu, node); + + if (pcie_pmu->on_cpu == -1) { + pcie_pmu->on_cpu = cpu; + WARN_ON(irq_set_affinity(pcie_pmu->irq, cpumask_of(cpu))); + } + + return 0; +} + +static int hisi_pcie_pmu_offline_cpu(unsigned int cpu, struct hlist_node *node) +{ + struct hisi_pcie_pmu *pcie_pmu = hlist_entry_safe(node, struct hisi_pcie_pmu, node); + unsigned int target; + + /* Nothing to do if this CPU doesn't own the PMU */ + if (pcie_pmu->on_cpu != cpu) + return 0; + + pcie_pmu->on_cpu = -1; + /* Choose a new CPU from all online cpus. */ + target = cpumask_first(cpu_online_mask); + if (target >= nr_cpu_ids) { + pci_err(pcie_pmu->pdev, "There is no CPU to set\n"); + return 0; + } + + perf_pmu_migrate_context(&pcie_pmu->pmu, cpu, target); + /* Use this CPU for event counting */ + pcie_pmu->on_cpu = target; + WARN_ON(irq_set_affinity(pcie_pmu->irq, cpumask_of(target))); + + return 0; +} + +static struct attribute *hisi_pcie_pmu_events_attr[] = { + HISI_PCIE_PMU_EVENT_ATTR(rx_mwr_latency, 0x0010), + HISI_PCIE_PMU_EVENT_ATTR(rx_mwr_cnt, 0x10010), + HISI_PCIE_PMU_EVENT_ATTR(rx_mrd_latency, 0x0210), + HISI_PCIE_PMU_EVENT_ATTR(rx_mrd_cnt, 0x10210), + HISI_PCIE_PMU_EVENT_ATTR(tx_mrd_latency, 0x0011), + HISI_PCIE_PMU_EVENT_ATTR(tx_mrd_cnt, 0x10011), + HISI_PCIE_PMU_EVENT_ATTR(rx_mrd_flux, 0x1005), + HISI_PCIE_PMU_EVENT_ATTR(rx_mrd_time, 0x11005), + HISI_PCIE_PMU_EVENT_ATTR(tx_mrd_flux, 0x2004), + HISI_PCIE_PMU_EVENT_ATTR(tx_mrd_time, 0x12004), + NULL +}; + +static struct attribute_group hisi_pcie_pmu_events_group = { + .name = "events", + .attrs = hisi_pcie_pmu_events_attr, +}; + +static struct attribute *hisi_pcie_pmu_format_attr[] = { + HISI_PCIE_PMU_FORMAT_ATTR(event, "config:0-16"), + HISI_PCIE_PMU_FORMAT_ATTR(thr_len, "config1:0-3"), + HISI_PCIE_PMU_FORMAT_ATTR(thr_mode, "config1:4"), + HISI_PCIE_PMU_FORMAT_ATTR(trig_len, "config1:5-8"), + HISI_PCIE_PMU_FORMAT_ATTR(trig_mode, "config1:9"), + HISI_PCIE_PMU_FORMAT_ATTR(port, "config2:0-15"), + HISI_PCIE_PMU_FORMAT_ATTR(bdf, "config2:16-31"), + NULL +}; + +static const struct attribute_group hisi_pcie_pmu_format_group = { + .name = "format", + .attrs = hisi_pcie_pmu_format_attr, +}; + +static struct attribute *hisi_pcie_pmu_bus_attrs[] = { + &dev_attr_bus.attr, + NULL +}; + +static const struct attribute_group hisi_pcie_pmu_bus_attr_group = { + .attrs = hisi_pcie_pmu_bus_attrs, +}; + +static struct attribute *hisi_pcie_pmu_cpumask_attrs[] = { + &dev_attr_cpumask.attr, + NULL +}; + +static const struct attribute_group hisi_pcie_pmu_cpumask_attr_group = { + .attrs = hisi_pcie_pmu_cpumask_attrs, +}; + +static struct attribute *hisi_pcie_pmu_identifier_attrs[] = { + &dev_attr_identifier.attr, + NULL +}; + +static const struct attribute_group hisi_pcie_pmu_identifier_attr_group = { + .attrs = hisi_pcie_pmu_identifier_attrs, +}; + +static const struct attribute_group *hisi_pcie_pmu_attr_groups[] = { + &hisi_pcie_pmu_events_group, + &hisi_pcie_pmu_format_group, + &hisi_pcie_pmu_bus_attr_group, + &hisi_pcie_pmu_cpumask_attr_group, + &hisi_pcie_pmu_identifier_attr_group, + NULL +}; + +static int hisi_pcie_alloc_pmu(struct pci_dev *pdev, struct hisi_pcie_pmu *pcie_pmu) +{ + struct hisi_pcie_reg_pair regs; + u16 sicl_id, core_id; + char *name; + + regs = hisi_pcie_parse_reg_value(pcie_pmu, HISI_PCIE_REG_BDF); + pcie_pmu->bdf_min = regs.lo; + pcie_pmu->bdf_max = regs.hi; + + regs = hisi_pcie_parse_reg_value(pcie_pmu, HISI_PCIE_REG_INFO); + sicl_id = regs.hi; + core_id = regs.lo; + + name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "hisi_pcie%u_core%u", sicl_id, core_id); + if (!name) + return -ENOMEM; + + pcie_pmu->pdev = pdev; + pcie_pmu->on_cpu = -1; + pcie_pmu->identifier = readl(pcie_pmu->base + HISI_PCIE_REG_VERSION); + pcie_pmu->pmu = (struct pmu) { + .name = name, + .module = THIS_MODULE, + .event_init = hisi_pcie_pmu_event_init, + .pmu_enable = hisi_pcie_pmu_enable, + .pmu_disable = hisi_pcie_pmu_disable, + .add = hisi_pcie_pmu_add, + .del = hisi_pcie_pmu_del, + .start = hisi_pcie_pmu_start, + .stop = hisi_pcie_pmu_stop, + .read = hisi_pcie_pmu_read, + .task_ctx_nr = perf_invalid_context, + .attr_groups = hisi_pcie_pmu_attr_groups, + .capabilities = PERF_PMU_CAP_NO_EXCLUDE, + }; + + return 0; +} + +static int hisi_pcie_init_pmu(struct pci_dev *pdev, struct hisi_pcie_pmu *pcie_pmu) +{ + int ret; + + pcie_pmu->base = pci_ioremap_bar(pdev, 2); + if (!pcie_pmu->base) { + pci_err(pdev, "Ioremap failed for pcie_pmu resource\n"); + return -ENOMEM; + } + + ret = hisi_pcie_alloc_pmu(pdev, pcie_pmu); + if (ret) + goto err_iounmap; + + ret = hisi_pcie_pmu_irq_register(pdev, pcie_pmu); + if (ret) + goto err_iounmap; + + ret = cpuhp_state_add_instance(CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, &pcie_pmu->node); + if (ret) { + pci_err(pdev, "Failed to register hotplug: %d\n", ret); + goto err_irq_unregister; + } + + ret = perf_pmu_register(&pcie_pmu->pmu, pcie_pmu->pmu.name, -1); + if (ret) { + pci_err(pdev, "Failed to register PCIe PMU: %d\n", ret); + goto err_hotplug_unregister; + } + + return ret; + +err_hotplug_unregister: + cpuhp_state_remove_instance_nocalls( + CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, &pcie_pmu->node); + +err_irq_unregister: + hisi_pcie_pmu_irq_unregister(pdev, pcie_pmu); + +err_iounmap: + iounmap(pcie_pmu->base); + + return ret; +} + +static void hisi_pcie_uninit_pmu(struct pci_dev *pdev) +{ + struct hisi_pcie_pmu *pcie_pmu = pci_get_drvdata(pdev); + + perf_pmu_unregister(&pcie_pmu->pmu); + cpuhp_state_remove_instance_nocalls( + CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, &pcie_pmu->node); + hisi_pcie_pmu_irq_unregister(pdev, pcie_pmu); + iounmap(pcie_pmu->base); +} + +static int hisi_pcie_init_dev(struct pci_dev *pdev) +{ + int ret; + + ret = pcim_enable_device(pdev); + if (ret) { + pci_err(pdev, "Failed to enable PCI device: %d\n", ret); + return ret; + } + + ret = pcim_iomap_regions(pdev, BIT(2), DRV_NAME); + if (ret < 0) { + pci_err(pdev, "Failed to request PCI mem regions: %d\n", ret); + return ret; + } + + pci_set_master(pdev); + + return 0; +} + +static int hisi_pcie_pmu_probe(struct pci_dev *pdev, const struct pci_device_id *id) +{ + struct hisi_pcie_pmu *pcie_pmu; + int ret; + + pcie_pmu = devm_kzalloc(&pdev->dev, sizeof(*pcie_pmu), GFP_KERNEL); + if (!pcie_pmu) + return -ENOMEM; + + ret = hisi_pcie_init_dev(pdev); + if (ret) + return ret; + + ret = hisi_pcie_init_pmu(pdev, pcie_pmu); + if (ret) + return ret; + + pci_set_drvdata(pdev, pcie_pmu); + + return ret; +} + +static void hisi_pcie_pmu_remove(struct pci_dev *pdev) +{ + hisi_pcie_uninit_pmu(pdev); + pci_set_drvdata(pdev, NULL); +} + +static const struct pci_device_id hisi_pcie_pmu_ids[] = { + { PCI_DEVICE(PCI_VENDOR_ID_HUAWEI, 0xa12d) }, + { 0, } +}; +MODULE_DEVICE_TABLE(pci, hisi_pcie_pmu_ids); + +static struct pci_driver hisi_pcie_pmu_driver = { + .name = DRV_NAME, + .id_table = hisi_pcie_pmu_ids, + .probe = hisi_pcie_pmu_probe, + .remove = hisi_pcie_pmu_remove, +}; + +static int __init hisi_pcie_module_init(void) +{ + int ret; + + ret = cpuhp_setup_state_multi(CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, + "AP_PERF_ARM_HISI_PCIE_PMU_ONLINE", + hisi_pcie_pmu_online_cpu, + hisi_pcie_pmu_offline_cpu); + if (ret) { + pr_err("Failed to setup PCIe PMU hotplug: %d\n", ret); + return ret; + } + + ret = pci_register_driver(&hisi_pcie_pmu_driver); + if (ret) + cpuhp_remove_multi_state(CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE); + + return ret; +} +module_init(hisi_pcie_module_init); + +static void __exit hisi_pcie_module_exit(void) +{ + pci_unregister_driver(&hisi_pcie_pmu_driver); + cpuhp_remove_multi_state(CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE); +} +module_exit(hisi_pcie_module_exit); + +MODULE_DESCRIPTION("HiSilicon PCIe PMU driver"); +MODULE_LICENSE("GPL v2"); +MODULE_AUTHOR("Qi Liu <liuqi115(a)huawei.com>"); diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h index b98b9eb7d5f8..24e7be132046 100644 --- a/include/linux/cpuhotplug.h +++ b/include/linux/cpuhotplug.h @@ -178,6 +178,9 @@ enum cpuhp_state { CPUHP_AP_PERF_ARM_HISI_L3_ONLINE, CPUHP_AP_PERF_ARM_HISI_PA_ONLINE, CPUHP_AP_PERF_ARM_HISI_SLLC_ONLINE, + #ifndef __GENKSYMS__ + CPUHP_AP_PERF_ARM_HISI_PCIE_PMU_ONLINE, + #endif CPUHP_AP_PERF_ARM_L2X0_ONLINE, CPUHP_AP_PERF_ARM_QCOM_L2_ONLINE, CPUHP_AP_PERF_ARM_QCOM_L3_ONLINE, -- 2.20.1

1 21

[PATCH openEuler-1.0-LTS] blk-mq: fix null pointer dereference in blk_mq_queue_tag_busy_ite
by Yongqiang Liu 16 Aug '22

16 Aug '22

From: Li Nan <linan122(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187489, https://gitee.com/openeuler/kernel/issues/I5MKPP CVE: NA -------------------------------- The q->tag_set can be NULL in blk_mq_queue_tag_busy_ite() while queue has not been initialized: CPU0 CPU1 dm_mq_init_request_queue md->tag_set = kzalloc_node blk_mq_init_allocated_queue q->mq_ops = set->ops; diskstats_show part_get_stat_info if(q->mq_ops) blk_mq_in_flight_with_stat blk_mq_queue_tag_busy_ite if (blk_mq_is_shared_tags(q->tag_set->flags)) //q->tag_set is null here q->tag_set = set blk_register_queue blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q) There is same bug when cat /sys/block/[device]/inflight. Fix it by checking the flag 'QUEUE_FLAG_REGISTERED'. Althrough this may cause some io not to be counted temporarily, it doesn't hurt in real user case. Signed-off-by: Li Nan <linan122(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- block/blk-mq-tag.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c index bee92ab06a5e..c24802fe6ab2 100644 --- a/block/blk-mq-tag.c +++ b/block/blk-mq-tag.c @@ -374,6 +374,13 @@ void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_iter_fn *fn, struct blk_mq_hw_ctx *hctx; int i; + /* + * For dm, it can run here after register_disk, but the queue has not + * been initialized yet. Check QUEUE_FLAG_REGISTERED prevent null point + * access. + */ + if (!test_bit(QUEUE_FLAG_REGISTERED, &q->queue_flags)) + return; /* * __blk_mq_update_nr_hw_queues will update the nr_hw_queues and * queue_hw_ctx after freeze the queue, so we use q_usage_counter -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] arm64: Avoid premature usercopy failure for __arch_copy_to_user_generic_read
by Yongqiang Liu 16 Aug '22

16 Aug '22

From: Tong Tiangen <tongtiangen(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5MJU8 CVE: NA --------------------------------- Commit 1b1b4dede457 ("arm64: Avoid premature usercopy failure") fixes an usercopy failure issues, it introduced a variable srcin and used it in fixup routine, but the variable is not initialized in __arch_copy_to_user_generic_read(), this will cause an illegal pointer issue in fixup. Fixes: 1b1b4dede457 ("arm64: Avoid premature usercopy failure") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Tested-by: yongqiang Liu <liuyongqiang13(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/arm64/lib/copy_to_user.S | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S index 84b7a16e82b5..6214e4972141 100644 --- a/arch/arm64/lib/copy_to_user.S +++ b/arch/arm64/lib/copy_to_user.S @@ -77,6 +77,7 @@ ENDPROC(__arch_copy_to_user) ENTRY(__arch_copy_to_user_generic_read) uaccess_enable_not_uao x3, x4, x5 add end, x0, x2 + mov srcin, x1 #include "copy_template_generic_read.S" uaccess_disable_not_uao x3, x4 -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] net_sched: cls_route: remove from list when handle is 0
by Yongqiang Liu 16 Aug '22

16 Aug '22

From: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> mainline inclusion from mainline-v6.0-rc1 commit 9ad36309e2719a884f946678e0296be10f0bb4c1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5LJLR CVE: CVE-2022-2588 -------------------------------- When a route filter is replaced and the old filter has a 0 handle, the old one won't be removed from the hashtable, while it will still be freed. The test was there since before commit 1109c00547fc ("net: sched: RCU cls_route"), when a new filter was not allocated when there was an old one. The old filter was reused and the reinserting would only be necessary if an old filter was replaced. That was still wrong for the same case where the old handle was 0. Remove the old filter from the list independently from its handle value. This fixes CVE-2022-2588, also reported as ZDI-CAN-17440. Reported-by: Zhenpeng Lin <zplin(a)u.northwestern.edu> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> Reviewed-by: Kamal Mostafa <kamal(a)canonical.com> Cc: <stable(a)vger.kernel.org> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://lore.kernel.org/r/20220809170518.164662-1-cascardo@canonical.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Xu Jia <xujia39(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/sched/cls_route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c index 0a0a22a0666d..c13903441ac1 100644 --- a/net/sched/cls_route.c +++ b/net/sched/cls_route.c @@ -528,7 +528,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, rcu_assign_pointer(f->next, f1); rcu_assign_pointer(*fp, f); - if (fold && fold->handle && f->handle != fold->handle) { + if (fold) { th = to_hash(fold->handle); h = from_hash(fold->handle >> 16); b = rtnl_dereference(head->table[th]); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] Revert "x86/unwind/orc: Change REG_SP_INDIRECT"
by Yongqiang Liu 15 Aug '22

15 Aug '22

From: Yipeng Zou <zouyipeng(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5MC71 CVE: NA --------------------------------- This reverts commit 657a6bec17a04e9223a099608084ab5adc2582df. This patch was backport from mainline and intend to fix REG_SP_INDIRECT type in orc unwinder.The patch was fix an objtools problem on mainline, which The upstream commit havn't been merged in hulk-4.19,and it led to parse the sp value form orc data was wrong. So we need revert this patch. Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/x86/kernel/unwind_orc.c | 5 +---- tools/objtool/orc_dump.c | 2 +- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c index 3ff76f88e220..6c5d3b22ac61 100644 --- a/arch/x86/kernel/unwind_orc.c +++ b/arch/x86/kernel/unwind_orc.c @@ -450,7 +450,7 @@ bool unwind_next_frame(struct unwind_state *state) break; case ORC_REG_SP_INDIRECT: - sp = state->sp; + sp = state->sp + orc->sp_offset; indirect = true; break; @@ -500,9 +500,6 @@ bool unwind_next_frame(struct unwind_state *state) if (indirect) { if (!deref_stack_reg(state, sp, &sp)) goto err; - - if (orc->sp_reg == ORC_REG_SP_INDIRECT) - sp += orc->sp_offset; } /* Find IP, SP and possibly regs: */ diff --git a/tools/objtool/orc_dump.c b/tools/objtool/orc_dump.c index ba28830aace2..faa444270ee3 100644 --- a/tools/objtool/orc_dump.c +++ b/tools/objtool/orc_dump.c @@ -64,7 +64,7 @@ static void print_reg(unsigned int reg, int offset) if (reg == ORC_REG_BP_INDIRECT) printf("(bp%+d)", offset); else if (reg == ORC_REG_SP_INDIRECT) - printf("(sp)%+d", offset); + printf("(sp%+d)", offset); else if (reg == ORC_REG_UNDEFINED) printf("(und)"); else -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/3] scsi: iscsi: Add helper functions to manage iscsi_cls_conn
by Yongqiang Liu 15 Aug '22

15 Aug '22

From: Wenchao Hao <haowenchao(a)huawei.com> mainline inclusion from mainline-v5.18-rc1 commit ad515cada7dac3cdf5e1ad77a0ed696f5f34e0ab category: bugfix bugzilla: 187381, https://gitee.com/openeuler/kernel/issues/I5LBFL CVE: NA -------------------------------- - iscsi_alloc_conn(): Allocate and initialize iscsi_cls_conn - iscsi_add_conn(): Expose iscsi_cls_conn to userspace via sysfs - iscsi_remove_conn(): Remove iscsi_cls_conn from sysfs Link: https://lore.kernel.org/r/20220310015759.3296841-2-haowenchao@huawei.com Reviewed-by: Mike Christie <michael.christie(a)oracle.com> Signed-off-by: Wenchao Hao <haowenchao(a)huawei.com> Signed-off-by: Wu Bo <wubo40(a)huawei.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflict: drivers/scsi/scsi_transport_iscsi.c Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/scsi/scsi_transport_iscsi.c | 89 +++++++++++++++++++++++++++++ include/scsi/scsi_transport_iscsi.h | 4 ++ 2 files changed, 93 insertions(+) diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c index bd699906828f..eba74ac58735 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -2201,6 +2201,95 @@ void iscsi_free_session(struct iscsi_cls_session *session) } EXPORT_SYMBOL_GPL(iscsi_free_session); +/** + * iscsi_alloc_conn - alloc iscsi class connection + * @session: iscsi cls session + * @dd_size: private driver data size + * @cid: connection id + */ +struct iscsi_cls_conn * +iscsi_alloc_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid) +{ + struct iscsi_transport *transport = session->transport; + struct iscsi_cls_conn *conn; + + conn = kzalloc(sizeof(*conn) + dd_size, GFP_KERNEL); + if (!conn) + return NULL; + if (dd_size) + conn->dd_data = &conn[1]; + + mutex_init(&conn->ep_mutex); + INIT_LIST_HEAD(&conn->conn_list); + conn->transport = transport; + conn->cid = cid; + + /* this is released in the dev's release function */ + if (!get_device(&session->dev)) + goto free_conn; + + dev_set_name(&conn->dev, "connection%d:%u", session->sid, cid); + device_initialize(&conn->dev); + conn->dev.parent = &session->dev; + conn->dev.release = iscsi_conn_release; + + return conn; + +free_conn: + kfree(conn); + return NULL; +} +EXPORT_SYMBOL_GPL(iscsi_alloc_conn); + +/** + * iscsi_add_conn - add iscsi class connection + * @conn: iscsi cls connection + * + * This will expose iscsi_cls_conn to sysfs so make sure the related + * resources for sysfs attributes are initialized before calling this. + */ +int iscsi_add_conn(struct iscsi_cls_conn *conn) +{ + int err; + unsigned long flags; + struct iscsi_cls_session *session = iscsi_dev_to_session(conn->dev.parent); + + err = device_add(&conn->dev); + if (err) { + iscsi_cls_session_printk(KERN_ERR, session, + "could not register connection's dev\n"); + return err; + } + transport_register_device(&conn->dev); + + spin_lock_irqsave(&connlock, flags); + list_add(&conn->conn_list, &connlist); + spin_unlock_irqrestore(&connlock, flags); + + return 0; +} +EXPORT_SYMBOL_GPL(iscsi_add_conn); + +/** + * iscsi_remove_conn - remove iscsi class connection from sysfs + * @conn: iscsi cls connection + * + * Remove iscsi_cls_conn from sysfs, and wait for previous + * read/write of iscsi_cls_conn's attributes in sysfs to finish. + */ +void iscsi_remove_conn(struct iscsi_cls_conn *conn) +{ + unsigned long flags; + + spin_lock_irqsave(&connlock, flags); + list_del(&conn->conn_list); + spin_unlock_irqrestore(&connlock, flags); + + transport_unregister_device(&conn->dev); + device_del(&conn->dev); +} +EXPORT_SYMBOL_GPL(iscsi_remove_conn); + /** * iscsi_create_conn - create iscsi class connection * @session: iscsi cls session diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h index 848ba2822a21..105458b20cd8 100644 --- a/include/scsi/scsi_transport_iscsi.h +++ b/include/scsi/scsi_transport_iscsi.h @@ -446,6 +446,10 @@ extern struct iscsi_cls_session *iscsi_create_session(struct Scsi_Host *shost, unsigned int target_id); extern void iscsi_remove_session(struct iscsi_cls_session *session); extern void iscsi_free_session(struct iscsi_cls_session *session); +extern struct iscsi_cls_conn *iscsi_alloc_conn(struct iscsi_cls_session *sess, + int dd_size, uint32_t cid); +extern int iscsi_add_conn(struct iscsi_cls_conn *conn); +extern void iscsi_remove_conn(struct iscsi_cls_conn *conn); extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess, int dd_size, uint32_t cid); extern void iscsi_put_conn(struct iscsi_cls_conn *conn); -- 2.25.1

1 2