- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] KVM: nVMX: Set LDTR to its architecturally defined value on nested VM-Exit
by 任敏敏(联通集团联通数字科技有限公司本部) 10 Apr '23

10 Apr '23

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v5.15 commit afc8de0118be84f4058b9977d481aeb3e0758dbb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6SN2F CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit afc8de0118be84f4058b9977d481aeb3e0758dbb upstream Set L1's LDTR on VM-Exit per the Intel SDM: The host-state area does not contain a selector field for LDTR. LDTR is established as follows on all VM exits: the selector is cleared to 0000H, the segment is marked unusable and is otherwise undefined (although the base address is always canonical). This is likely a benign bug since the LDTR is unusable, as it means the L1 VMM is conditioned to reload its LDTR in order to function properly on bare metal. Fixes: 4704d0befb07 ("KVM: nVMX: Exiting from L2 to L1") Reviewed-by: Reiji Watanabe <reijiw(a)google.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-Id: <20210713163324.627647-3-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: rminmin <renmm6(a)chinaunicom.cn> --- arch/x86/kvm/vmx/nested.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index 9003b14d72ca..05284589c14d 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -4326,6 +4326,10 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu, }; vmx_set_segment(vcpu, &seg, VCPU_SREG_TR); + memset(&seg, 0, sizeof(seg)); + seg.unusable = 1; + vmx_set_segment(vcpu, &seg, VCPU_SREG_LDTR); + kvm_set_dr(vcpu, 7, 0x400); vmcs_write64(GUEST_IA32_DEBUGCTL, 0); -- 2.33.0 Èç¹ûÄúŽíÎóœÓÊÕÁËžÃÓÊŒþ£¬ÇëÍš¹ýµç×ÓÓÊŒþÁ¢ŒŽÍšÖªÎÒÃÇ¡£Çë»ØžŽÓÊŒþµœ hqs-spmc@chinaunicom.cn£¬ŒŽ¿ÉÒÔÍË¶©ŽËÓÊŒþ¡£ÎÒÃÇœ«Á¢ŒŽœ«ÄúµÄÐÅÏ¢ŽÓÎÒÃÇµÄ·¢ËÍÄ¿ÂŒÖÐÉŸ³ý¡£ If you have received this email in error please notify us immediately by e-mail. Please reply to hqs-spmc(a)chinaunicom.cn ,you can unsubscribe from this mail. We will immediately remove your information from send catalogue of our.

1 0

[PATCH 0/2] support dynamic affinity
by Hui Tang 08 Apr '23

08 Apr '23

test report: [root@localhost at]# bash -x dyn_affinity_interface.sh + ret=0 ++ cat /proc/sys/kernel/sched_util_low_pct + default_sched_util_low_pct=85 + read_default_val /proc/sys/kernel/sched_util_low_pct 85 + local interface=/proc/sys/kernel/sched_util_low_pct + local expect_val=85 + echo 'TINFO: test /proc/sys/kernel/sched_util_low_pct default value is 85' TINFO: test /proc/sys/kernel/sched_util_low_pct default value is 85 + '[' '!' -f /proc/sys/kernel/sched_util_low_pct ']' ++ cat /proc/sys/kernel/sched_util_low_pct + '[' 85 '!=' 85 ']' + '[' 0 -ne 0 ']' + echo 'TPASS: dyn_affinity_interface test success' TPASS: dyn_affinity_interface test success + write_some_val /proc/sys/kernel/sched_util_low_pct -1 1 + write_some_val /proc/sys/kernel/sched_util_low_pct 101 1 + write_some_val /proc/sys/kernel/sched_util_low_pct abc 1 + write_some_val /proc/sys/kernel/sched_util_low_pct 100 0 + local interface=/proc/sys/kernel/sched_util_low_pct + local write_val=100 + local expect_ret=0 + echo 'TINFO: write 100 to /proc/sys/kernel/sched_util_low_pct, expect ret: 0' TINFO: write 100 to /proc/sys/kernel/sched_util_low_pct, expect ret: 0 + echo 100 + '[' 0 -ne 0 ']' + echo 'TPASS: write 100 to /proc/sys/kernel/sched_util_low_pct success' TPASS: write 100 to /proc/sys/kernel/sched_util_low_pct success + write_some_val /proc/sys/kernel/sched_util_low_pct 0 0 + local interface=/proc/sys/kernel/sched_util_low_pct + local write_val=0 + local expect_ret=0 + echo 'TINFO: write 0 to /proc/sys/kernel/sched_util_low_pct, expect ret: 0' TINFO: write 0 to /proc/sys/kernel/sched_util_low_pct, expect ret: 0 + echo 0 + '[' 0 -ne 0 ']' + echo 'TPASS: write 0 to /proc/sys/kernel/sched_util_low_pct success' TPASS: write 0 to /proc/sys/kernel/sched_util_low_pct success + cleanup + echo 85 + exit 0 [root@localhost at]# [root@localhost at]# bash -x dyn_affinity_low_load.sh + TEST_CPUSET_PATH=/sys/fs/cgroup/cpuset/cloud + TEST_CPU_PATH=/sys/fs/cgroup/cpu/cloud + ret=0 ++ seq 1 1 + for i in $(seq 1 1) + setup + '[' -d /sys/fs/cgroup/cpuset/cloud ']' + mkdir -p /sys/fs/cgroup/cpuset/cloud /sys/fs/cgroup/cpu/cloud + echo 0 + echo 0-7 + echo 1 + do_test + echo 4166 + echo 4166 + local pid=0 ++ seq 1 3 + for i in $(seq 1 3) + pid=4170 + echo 4170 + echo 4170 + for i in $(seq 1 3) + pid=4171 + echo 4171 + echo 4171 + ./cpu_load_not_while + for i in $(seq 1 3) + pid=4172 + ./cpu_load_not_while + echo 4172 + ./cpu_load_not_while + echo 4172 + echo 4166 + echo 4166 + sleep 0.1 ++ seq 1 100 + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ egrep 1 -w ++ grep load ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ wc -l ++ egrep 1 -w + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ egrep 1 -w ++ wc -l ++ grep load + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + '[' 0 -eq 0 ']' + ps -o psr,comm,pid + grep cpu_load 1 cpu_load_not_wh 4170 1 cpu_load_not_wh 4171 1 cpu_load_not_wh 4172 + echo 'TPASS: test success' TPASS: test success + cleanup + killall cpu_load_not_while + sleep 0.1 + rmdir /sys/fs/cgroup/cpuset/cloud /sys/fs/cgroup/cpu/cloud + exit 0 [root@localhost at]# bash -x dyn_affinity_high_load.sh + TEST_CPUSET_PATH=/sys/fs/cgroup/cpuset/cloud + TEST_CPU_PATH=/sys/fs/cgroup/cpu/cloud + ret=0 ++ seq 1 1 + for i in $(seq 1 1) + setup + '[' -d /sys/fs/cgroup/cpuset/cloud ']' + mkdir -p /sys/fs/cgroup/cpuset/cloud /sys/fs/cgroup/cpu/cloud + echo 0 + echo 0-7 + echo 1 + do_test + echo 4121 + echo 4121 + local pid=0 ++ seq 1 30 + for i in $(seq 1 30) + pid=4125 + echo 4125 + echo 4125 + for i in $(seq 1 30) + pid=4126 + echo 4126 + ./cpu_load_not_while + echo 4126 + for i in $(seq 1 30) + pid=4127 + echo 4127 + ./cpu_load_not_while + ./cpu_load_not_while + echo 4127 + for i in $(seq 1 30) + pid=4128 + ./cpu_load_not_while + echo 4128 + echo 4128 + for i in $(seq 1 30) + pid=4129 + echo 4129 + echo 4129 + for i in $(seq 1 30) + ./cpu_load_not_while + pid=4130 + echo 4130 + ./cpu_load_not_while + echo 4130 + for i in $(seq 1 30) + pid=4131 + ./cpu_load_not_while + echo 4131 + echo 4131 + for i in $(seq 1 30) + pid=4132 + echo 4132 + echo 4132 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4133 + ./cpu_load_not_while + echo 4133 + echo 4133 + for i in $(seq 1 30) + pid=4134 + ./cpu_load_not_while + echo 4134 + echo 4134 + for i in $(seq 1 30) + pid=4135 + ./cpu_load_not_while + echo 4135 + echo 4135 + for i in $(seq 1 30) + pid=4136 + ./cpu_load_not_while + echo 4136 + echo 4136 + for i in $(seq 1 30) + pid=4137 + ./cpu_load_not_while + echo 4137 + echo 4137 + for i in $(seq 1 30) + pid=4138 + echo 4138 + ./cpu_load_not_while + echo 4138 + for i in $(seq 1 30) + pid=4139 + ./cpu_load_not_while + echo 4139 + echo 4139 + for i in $(seq 1 30) + pid=4140 + ./cpu_load_not_while + echo 4140 + echo 4140 + for i in $(seq 1 30) + pid=4141 + echo 4141 + ./cpu_load_not_while + echo 4141 + for i in $(seq 1 30) + pid=4142 + echo 4142 + ./cpu_load_not_while + echo 4142 + for i in $(seq 1 30) + pid=4143 + echo 4143 + ./cpu_load_not_while + echo 4143 + for i in $(seq 1 30) + pid=4144 + ./cpu_load_not_while + echo 4144 + echo 4144 + for i in $(seq 1 30) + pid=4145 + ./cpu_load_not_while + echo 4145 + echo 4145 + for i in $(seq 1 30) + pid=4146 + echo 4146 + echo 4146 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4147 + echo 4147 + echo 4147 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4148 + echo 4148 + echo 4148 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4149 + echo 4149 + echo 4149 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4150 + echo 4150 + echo 4150 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4151 + echo 4151 + echo 4151 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4152 + echo 4152 + ./cpu_load_not_while + echo 4152 + for i in $(seq 1 30) + pid=4153 + ./cpu_load_not_while + echo 4153 + echo 4153 + for i in $(seq 1 30) + pid=4154 + ./cpu_load_not_while + echo 4154 + echo 4154 + echo 4121 + echo 4121 + sleep 0.1 ++ seq 1 100 + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=19 + '[' 19 -ne 30 ']' + ps -o psr,comm,pid + grep cpu_load 1 cpu_load_not_wh 4125 6 cpu_load_not_wh 4126 1 cpu_load_not_wh 4127 1 cpu_load_not_wh 4128 1 cpu_load_not_wh 4129 1 cpu_load_not_wh 4130 1 cpu_load_not_wh 4131 1 cpu_load_not_wh 4132 1 cpu_load_not_wh 4133 1 cpu_load_not_wh 4134 7 cpu_load_not_wh 4135 1 cpu_load_not_wh 4136 1 cpu_load_not_wh 4137 4 cpu_load_not_wh 4138 1 cpu_load_not_wh 4139 1 cpu_load_not_wh 4140 1 cpu_load_not_wh 4141 5 cpu_load_not_wh 4142 1 cpu_load_not_wh 4143 1 cpu_load_not_wh 4144 1 cpu_load_not_wh 4145 1 cpu_load_not_wh 4146 1 cpu_load_not_wh 4147 3 cpu_load_not_wh 4148 5 cpu_load_not_wh 4149 1 cpu_load_not_wh 4150 1 cpu_load_not_wh 4151 1 cpu_load_not_wh 4152 5 cpu_load_not_wh 4153 6 cpu_load_not_wh 4154 + echo 'TPASS: test success' TPASS: test success + exit tanghui (2): sched: Add statistics for scheduler dynamic affinity config: enable CONFIG_QOS_SCHED_DYNAMIC_AFFINITY by default arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/sched.h | 6 ++++++ kernel/sched/debug.c | 4 ++++ kernel/sched/fair.c | 11 +++++++++-- 5 files changed, 21 insertions(+), 2 deletions(-) -- 2.17.1

1 2

[PATCH openEuler-1.0-LTS] bpf: add missing header file include
by Yongqiang Liu 08 Apr '23

08 Apr '23

From: Linus Torvalds <torvalds(a)linux-foundation.org> stable inclusion from stable-v4.19.274 commit c7603df97635954165fb599e64e197efc353979b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TIG1 CVE: NA -------------------------------- commit f3dd0c53370e70c0f9b7e931bbec12916f3bb8cc upstream. Commit 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()") built fine on x86-64 and arm64, and that's the extent of my local build testing. It turns out those got the <linux/nospec.h> include incidentally through other header files (<linux/kvm_host.h> in particular), but that was not true of other architectures, resulting in build errors kernel/bpf/core.c: In function ‘___bpf_prog_run’: kernel/bpf/core.c:1913:3: error: implicit declaration of function ‘barrier_nospec’ so just make sure to explicitly include the proper <linux/nospec.h> header file to make everybody see it. Fixes: 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()") Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Viresh Kumar <viresh.kumar(a)linaro.org> Reported-by: Huacai Chen <chenhuacai(a)loongson.cn> Tested-by: Geert Uytterhoeven <geert(a)linux-m68k.org> Tested-by: Dave Hansen <dave.hansen(a)linux.intel.com> Acked-by: Alexei Starovoitov <alexei.starovoitov(a)gmail.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/bpf/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index abf30609e0d9..56a60d483c8d 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -32,6 +32,7 @@ #include <linux/kallsyms.h> #include <linux/rcupdate.h> #include <linux/perf_event.h> +#include <linux/nospec.h> #include <asm/barrier.h> #include <asm/unaligned.h> -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 00/19] linux-4.19.y inclusion
by Yongqiang Liu 07 Apr '23

07 Apr '23

*** BLURB HERE *** Armin Wolf (1): ACPI: battery: Fix missing NUL-termination with large strings Baokun Li (1): ext4: fail ext4_iget if special inode unallocated Breno Leitao (1): x86/bugs: Reset speculation control settings on init Daniil Tatianin (1): ACPICA: nsrepair: handle cases without a return value correctly Dave Hansen (1): uaccess: Add speculation barrier to copy_from_user() Herbert Xu (2): crypto: seqiv - Handle EBUSY correctly crypto: rsa-pkcs1pad - Use akcipher_request_complete Jann Horn (1): timers: Prevent union confusion from unexpected restart_syscall() Jason A. Donenfeld (1): random: always mix cycle counter in add_latent_entropy() Johan Hovold (3): irqdomain: Fix association race irqdomain: Fix disassociation race irqdomain: Drop bogus fwspec-mapping error handling Nikita Zhandarovich (1): x86/mm: Fix use of uninitialized buffer in sme_enable() Thomas Gleixner (1): alarmtimer: Prevent starvation by small intervals and SIG_IGN Vishal Verma (1): ACPI: NFIT: fix a potential deadlock during NFIT teardown Yang Jihong (2): x86/kprobes: Fix __recover_optprobed_insn check optimizing logic x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range Zhen Lei (1): genirq: Fix the return type of kstat_cpu_irqs_sum() Zhihao Cheng (1): ext4: zero i_disksize when initializing the bootloader inode arch/x86/include/asm/msr-index.h | 4 ++++ arch/x86/kernel/cpu/bugs.c | 10 ++++++++- arch/x86/kernel/kprobes/opt.c | 6 +++--- arch/x86/mm/mem_encrypt_identity.c | 3 ++- crypto/rsa-pkcs1pad.c | 34 +++++++++++++----------------- crypto/seqiv.c | 2 +- drivers/acpi/acpica/nsrepair.c | 12 ++++++----- drivers/acpi/battery.c | 2 +- drivers/acpi/nfit/core.c | 2 +- fs/ext4/inode.c | 18 +++++++--------- fs/ext4/ioctl.c | 1 + include/linux/kernel_stat.h | 2 +- include/linux/kprobes.h | 2 ++ include/linux/nospec.h | 4 ++++ include/linux/random.h | 6 +++--- kernel/bpf/core.c | 2 -- kernel/irq/irqdomain.c | 31 +++++++++++++++++---------- kernel/kprobes.c | 6 +++--- kernel/time/alarmtimer.c | 33 +++++++++++++++++++++++++---- kernel/time/hrtimer.c | 2 ++ kernel/time/posix-stubs.c | 2 ++ kernel/time/posix-timers.c | 2 ++ lib/usercopy.c | 7 ++++++ 23 files changed, 127 insertions(+), 66 deletions(-) -- 2.25.1

1 19

[PATCH openEuler-1.0-LTS 01/19] alarmtimer: Prevent starvation by small intervals and SIG_IGN
by Yongqiang Liu 07 Apr '23

07 Apr '23

From: Thomas Gleixner <tglx(a)linutronix.de> stable inclusion from stable-v4.19.274 commit d6a300076d11a6e27b4d4f7fd986ec66ee97a3e1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TIG1 CVE: NA -------------------------------- commit d125d1349abeb46945dc5e98f7824bf688266f13 upstream. syzbot reported a RCU stall which is caused by setting up an alarmtimer with a very small interval and ignoring the signal. The reproducer arms the alarm timer with a relative expiry of 8ns and an interval of 9ns. Not a problem per se, but that's an issue when the signal is ignored because then the timer is immediately rearmed because there is no way to delay that rearming to the signal delivery path. See posix_timer_fn() and commit 58229a189942 ("posix-timers: Prevent softirq starvation by small intervals and SIG_IGN") for details. The reproducer does not set SIG_IGN explicitely, but it sets up the timers signal with SIGCONT. That has the same effect as explicitely setting SIG_IGN for a signal as SIGCONT is ignored if there is no handler set and the task is not ptraced. The log clearly shows that: [pid 5102] --- SIGCONT {si_signo=SIGCONT, si_code=SI_TIMER, si_timerid=0, si_overrun=316014, si_int=0, si_ptr=NULL} --- It works because the tasks are traced and therefore the signal is queued so the tracer can see it, which delays the restart of the timer to the signal delivery path. But then the tracer is killed: [pid 5087] kill(-5102, SIGKILL <unfinished ...> ... ./strace-static-x86_64: Process 5107 detached and after it's gone the stall can be observed: syzkaller login: [ 79.439102][ C0] hrtimer: interrupt took 68471 ns [ 184.460538][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: ... [ 184.658237][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 184.664574][ C1] Sending NMI from CPU 1 to CPUs 0: [ 184.669821][ C0] NMI backtrace for cpu 0 [ 184.669831][ C0] CPU: 0 PID: 5108 Comm: syz-executor192 Not tainted 6.2.0-rc6-next-20230203-syzkaller #0 ... [ 184.670036][ C0] Call Trace: [ 184.670041][ C0] <IRQ> [ 184.670045][ C0] alarmtimer_fired+0x327/0x670 posix_timer_fn() prevents that by checking whether the interval for timers which have the signal ignored is smaller than a jiffie and artifically delay it by shifting the next expiry out by a jiffie. That's accurate vs. the overrun accounting, but slightly inaccurate vs. timer_gettimer(2). The comment in that function says what needs to be done and there was a fix available for the regular userspace induced SIG_IGN mechanism, but that did not work due to the implicit ignore for SIGCONT and similar signals. This needs to be worked on, but for now the only available workaround is to do exactly what posix_timer_fn() does: Increase the interval of self-rearming timers, which have their signal ignored, to at least a jiffie. Interestingly this has been fixed before via commit ff86bf0c65f1 ("alarmtimer: Rate limit periodic intervals") already, but that fix got lost in a later rework. Reported-by: syzbot+b9564ba6e8e00694511b(a)syzkaller.appspotmail.com Fixes: f2c45807d399 ("alarmtimer: Switch over to generic set/get/rearm routine") Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Acked-by: John Stultz <jstultz(a)google.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/87k00q1no2.ffs@tglx Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/time/alarmtimer.c | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c index 6a2ba39889bd..56af8a97cf2d 100644 --- a/kernel/time/alarmtimer.c +++ b/kernel/time/alarmtimer.c @@ -476,11 +476,35 @@ u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval) } EXPORT_SYMBOL_GPL(alarm_forward); -u64 alarm_forward_now(struct alarm *alarm, ktime_t interval) +static u64 __alarm_forward_now(struct alarm *alarm, ktime_t interval, bool throttle) { struct alarm_base *base = &alarm_bases[alarm->type]; + ktime_t now = base->gettime(); + + if (IS_ENABLED(CONFIG_HIGH_RES_TIMERS) && throttle) { + /* + * Same issue as with posix_timer_fn(). Timers which are + * periodic but the signal is ignored can starve the system + * with a very small interval. The real fix which was + * promised in the context of posix_timer_fn() never + * materialized, but someone should really work on it. + * + * To prevent DOS fake @now to be 1 jiffie out which keeps + * the overrun accounting correct but creates an + * inconsistency vs. timer_gettime(2). + */ + ktime_t kj = NSEC_PER_SEC / HZ; + + if (interval < kj) + now = ktime_add(now, kj); + } + + return alarm_forward(alarm, now, interval); +} - return alarm_forward(alarm, base->gettime(), interval); +u64 alarm_forward_now(struct alarm *alarm, ktime_t interval) +{ + return __alarm_forward_now(alarm, interval, false); } EXPORT_SYMBOL_GPL(alarm_forward_now); @@ -554,9 +578,10 @@ static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm, if (posix_timer_event(ptr, si_private) && ptr->it_interval) { /* * Handle ignored signals and rearm the timer. This will go - * away once we handle ignored signals proper. + * away once we handle ignored signals proper. Ensure that + * small intervals cannot starve the system. */ - ptr->it_overrun += alarm_forward_now(alarm, ptr->it_interval); + ptr->it_overrun += __alarm_forward_now(alarm, ptr->it_interval, true); ++ptr->it_requeue_pending; ptr->it_active = 1; result = ALARMTIMER_RESTART; -- 2.25.1

1 18

[PATCH openEuler-1.0-LTS 1/7] Revert "cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()"
by Yongqiang Liu 07 Apr '23

07 Apr '23

From: Cai Xinchen <caixinchen1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TI3Y CVE: NA -------------------------------- This reverts commit c2d8355618485dd9108ee9077799a227771af307. Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/cgroup/cgroup-internal.h | 2 -- kernel/cgroup/cgroup-v1.c | 4 ++-- kernel/cgroup/cgroup.c | 4 ++-- 3 files changed, 4 insertions(+), 6 deletions(-) diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h index edb45e2f7f54..2e65e4c4d6e7 100644 --- a/kernel/cgroup/cgroup-internal.h +++ b/kernel/cgroup/cgroup-internal.h @@ -226,8 +226,6 @@ int cgroup_migrate(struct task_struct *leader, bool threadgroup, int cgroup_attach_task(struct cgroup *dst_cgrp, struct task_struct *leader, bool threadgroup); -void cgroup_attach_lock(void); -void cgroup_attach_unlock(void); struct task_struct *cgroup_procs_write_start(char *buf, bool threadgroup) __acquires(&cgroup_threadgroup_rwsem); void cgroup_procs_write_finish(struct task_struct *task) diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c index 8bd36f2143eb..c4cc6c1ddacd 100644 --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -55,7 +55,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) int retval = 0; mutex_lock(&cgroup_mutex); - cgroup_attach_lock(); + percpu_down_write(&cgroup_threadgroup_rwsem); for_each_root(root) { struct cgroup *from_cgrp; @@ -70,7 +70,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) if (retval) break; } - cgroup_attach_unlock(); + percpu_up_write(&cgroup_threadgroup_rwsem); mutex_unlock(&cgroup_mutex); return retval; diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 4a4d8a3f06ab..6487df9a6be0 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -2236,7 +2236,7 @@ EXPORT_SYMBOL_GPL(task_cgroup_path); * write-locking cgroup_threadgroup_rwsem. This allows ->attach() to assume that * CPU hotplug is disabled on entry. */ -void cgroup_attach_lock(void) +static void cgroup_attach_lock(void) { cpus_read_lock(); percpu_down_write(&cgroup_threadgroup_rwsem); @@ -2246,7 +2246,7 @@ void cgroup_attach_lock(void) * cgroup_attach_unlock - Undo cgroup_attach_lock() * @lock_threadgroup: whether to up_write cgroup_threadgroup_rwsem */ -void cgroup_attach_unlock(void) +static void cgroup_attach_unlock(void) { percpu_up_write(&cgroup_threadgroup_rwsem); cpus_read_unlock(); -- 2.25.1

1 6

[PATCH openEuler-22.03-LTS] net/smc: align the connect behaviour with TCP
by Litao Jiao 07 Apr '23

07 Apr '23

mainline inclusion from mainline-v5.19.rc1 commit 3aba103006bcc4a7472b7c9506b3bc065ffb7992 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TK1U CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Connect with O_NONBLOCK will not be completed immediately and returns -EINPROGRESS. It is possible to use selector/poll for completion by selecting the socket for writing. After select indicates writability, a second connect function call will return 0 to indicate connected successfully as TCP does, but smc returns -EISCONN. Use socket state for smc to indicate connect state, which can help smc aligning the connect behaviour with TCP. Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Acked-by: Karsten Graul <kgraul(a)linux.ibm.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Litao Jiao <jiaolitao(a)sangfor.com.cn> --- net/smc/af_smc.c | 51 ++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 47 insertions(+), 4 deletions(-) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 5d7710dd9514..8f73da1ee7b4 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -1097,9 +1097,29 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr, goto out_err; lock_sock(sk); + switch (sock->state) { + default: + rc = -EINVAL; + goto out; + case SS_CONNECTED: + rc = sk->sk_state == SMC_ACTIVE ? -EISCONN : -EINVAL; + goto out; + case SS_CONNECTING: + if (sk->sk_state == SMC_ACTIVE) + goto connected; + break; + case SS_UNCONNECTED: + sock->state = SS_CONNECTING; + break; + } + switch (sk->sk_state) { default: goto out; + case SMC_CLOSED: + rc = sock_error(sk) ? : -ECONNABORTED; + sock->state = SS_UNCONNECTED; + goto out; case SMC_ACTIVE: rc = -EISCONN; goto out; @@ -1118,21 +1138,26 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr, if (rc && rc != -EINPROGRESS) goto out; - if (smc->use_fallback) + if (smc->use_fallback) { + sock->state = rc ? SS_CONNECTING : SS_CONNECTED; goto out; + } sock_hold(&smc->sk); /* sock put in passive closing */ + if (flags & O_NONBLOCK) { if (queue_work(smc_hs_wq, &smc->connect_work)) smc->connect_nonblock = 1; rc = -EINPROGRESS; + goto out; } else { rc = __smc_connect(smc); if (rc < 0) goto out; - else - rc = 0; /* success cases including fallback */ } +connected: + rc = 0; + sock->state = SS_CONNECTED; out: release_sock(sk); out_err: @@ -1234,6 +1259,7 @@ struct sock *smc_accept_dequeue(struct sock *parent, } if (new_sock) { sock_graft(new_sk, new_sock); + new_sock->state = SS_CONNECTED; if (isk->use_fallback) { smc_sk(new_sk)->clcsock->file = new_sock->file; isk->clcsock->file->private_data = isk->clcsock; @@ -1865,7 +1891,7 @@ static int smc_listen(struct socket *sock, int backlog) rc = -EINVAL; if ((sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) || - smc->connect_nonblock) + smc->connect_nonblock || sock->state != SS_UNCONNECTED) goto out; rc = 0; @@ -2135,6 +2161,17 @@ static int smc_shutdown(struct socket *sock, int how) lock_sock(sk); + if (sock->state == SS_CONNECTING) { + if (sk->sk_state == SMC_ACTIVE) + sock->state = SS_CONNECTED; + else if (sk->sk_state == SMC_PEERCLOSEWAIT1 || + sk->sk_state == SMC_PEERCLOSEWAIT2 || + sk->sk_state == SMC_APPCLOSEWAIT1 || + sk->sk_state == SMC_APPCLOSEWAIT2 || + sk->sk_state == SMC_APPFINCLOSEWAIT) + sock->state = SS_DISCONNECTING; + } + rc = -ENOTCONN; if ((sk->sk_state != SMC_ACTIVE) && (sk->sk_state != SMC_PEERCLOSEWAIT1) && @@ -2148,6 +2185,7 @@ static int smc_shutdown(struct socket *sock, int how) sk->sk_shutdown = smc->clcsock->sk->sk_shutdown; if (sk->sk_shutdown == SHUTDOWN_MASK) { sk->sk_state = SMC_CLOSED; + sk->sk_socket->state = SS_UNCONNECTED; sock_put(sk); } goto out; @@ -2173,6 +2211,10 @@ static int smc_shutdown(struct socket *sock, int how) /* map sock_shutdown_cmd constants to sk_shutdown value range */ sk->sk_shutdown |= how + 1; + if (sk->sk_state == SMC_CLOSED) + sock->state = SS_UNCONNECTED; + else + sock->state = SS_DISCONNECTING; out: release_sock(sk); return rc ? rc : rc1; @@ -2464,6 +2506,7 @@ static int smc_create(struct net *net, struct socket *sock, int protocol, rc = -ENOBUFS; sock->ops = &smc_sock_ops; + sock->state = SS_UNCONNECTED; sk = smc_sock_alloc(net, sock, protocol); if (!sk) goto out; -- 2.18.0.windows.1

1 0

[PATCH openEuler-1.0-LTS 01/13] mm: mem_reliable: Initialize reliable_nr_page when mm_init()
by Yongqiang Liu 07 Apr '23

07 Apr '23

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6RKHX CVE: NA -------------------------------- After the fork operation, it is erroneous for the child process to have a reliable page size twice that of its parent process. Upon examining the mm_struct structure, it was discovered that reliable_nr_page should be initialized to 0, similar to how RSS is initialized during mm_init(). This particular problem that arises during forking is merely one such example. To resolve this issue, it is recommended to set reliable_nr_page to 0 during the mm_init() operation. Fixes: 094eaabb3fe8 ("proc: Count reliable memory usage of reliable tasks") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/linux/mem_reliable.h | 8 ++++++++ kernel/fork.c | 1 + 2 files changed, 9 insertions(+) diff --git a/include/linux/mem_reliable.h b/include/linux/mem_reliable.h index 6d57c36fb676..aa3fe77c8a72 100644 --- a/include/linux/mem_reliable.h +++ b/include/linux/mem_reliable.h @@ -123,6 +123,13 @@ static inline bool mem_reliable_shmem_limit_check(void) shmem_reliable_nr_page; } +static inline void reliable_clear_page_counter(struct mm_struct *mm) +{ + if (!mem_reliable_is_enabled()) + return; + + atomic_long_set(&mm->reliable_nr_page, 0); +} #else #define reliable_enabled 0 #define reliable_allow_fb_enabled() false @@ -171,6 +178,7 @@ static inline void reliable_lru_add_batch(int zid, enum lru_list lru, int val) {} static inline bool mem_reliable_counter_initialized(void) { return false; } +static inline void reliable_clear_page_counter(struct mm_struct *mm) {} #endif #endif diff --git a/kernel/fork.c b/kernel/fork.c index b5453a26655e..c256525d4ce5 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1007,6 +1007,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, atomic_long_set(&mm->locked_vm, 0); mm->pinned_vm = 0; memset(&mm->rss_stat, 0, sizeof(mm->rss_stat)); + reliable_clear_page_counter(mm); spin_lock_init(&mm->page_table_lock); spin_lock_init(&mm->arg_lock); mm_init_cpumask(mm); -- 2.25.1

1 12

[PATCH openEuler-1.0-LTS 1/5] loop: Add parm check in loop_control_ioctl
by Yongqiang Liu 07 Apr '23

07 Apr '23

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188586, https://gitee.com/openeuler/kernel/issues/I6TFPJ CVE: NA ---------------------------------------- We found that in loop_control_ioctl, the kernel panic can be easily caused: 1. syscall(__NR_ioctl, r[1], 0x4c80, 0x80000200000ul); Create a loop device 0x80000200000ul. In fact, in the code, it is used as the first_minor number, and the first_minor number is 0. So the created loop device number is 7:0. 2. syscall(__NR_ioctl, r[2], 0x4c80, 0ul); Create a loop device 0x0ul. Since the 7:0 device has been created in 1, add_disk will fail because the major and first_minor numbers are consistent. 3. syscall(__NR_ioctl, r[5], 0x4c81, 0ul); Delete the device that failed to create, the kernel panics. Panic like below: BUG: KASAN: null-ptr-deref in device_del+0xb3/0x840 drivers/base/core.c:3107 Call Trace: kill_device drivers/base/core.c:3079 [inline] device_del+0xb3/0x840 drivers/base/core.c:3107 del_gendisk+0x463/0x5f0 block/genhd.c:971 loop_remove drivers/block/loop.c:2190 [inline] loop_control_ioctl drivers/block/loop.c:2289 [inline] The stack like below: Create loop device: loop_control_ioctl loop_add add_disk device_add_disk bdi_register bdi_register_va device_create device_create_groups_vargs device_add kfree(dev->p); dev->p = NULL; Remove loop device: loop_control_ioctl loop_remove del_gendisk device_del kill_device if (dev->p->dead) // p is null Fix it by adding a check for parm. Fixes: 770fe30a46a1 ("loop: add management interface for on-demand device allocation") Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/block/loop.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 108a4ff27bcd..826633aa328c 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1972,6 +1972,17 @@ static int loop_add(struct loop_device **l, int i) struct gendisk *disk; int err; + /* + * i << part_shift is actually used as the first_minor. + * So here should avoid i << part_shift overflow. + * And, MKDEV() expect that the max bits of + * first_minor is 20. + */ + if (i > 0 && i > MINORMASK >> part_shift) { + err = -EINVAL; + goto out; + } + err = -ENOMEM; lo = kzalloc(sizeof(*lo), GFP_KERNEL); if (!lo) @@ -1985,7 +1996,8 @@ static int loop_add(struct loop_device **l, int i) if (err == -ENOSPC) err = -EEXIST; } else { - err = idr_alloc(&loop_index_idr, lo, 0, 0, GFP_KERNEL); + err = idr_alloc(&loop_index_idr, lo, 0, + (MINORMASK >> part_shift) + 1, GFP_KERNEL); } if (err < 0) goto out_free_dev; -- 2.25.1

1 4

[PATCH openEuler-1.0-LTS] block/wbt: enable wbt after switching cfq to other schedulers
by Zhang Changzhong 07 Apr '23

07 Apr '23

From: Li Lingfeng <lilingfeng3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6LH5K CVE: NA -------------------------------- Commit 80061216078b ("block/wbt: fix negative inflight counter when remove scsi device") move wbt_enable_default() from elv_unregister_queue() to bfq_exit_queue(). As the result of it, wbt can't be enabled when we switch cfq to other schedulers. Fixes: 80061216078b ("block/wbt: fix negative inflight counter when remove scsi device") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- block/cfq-iosched.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c index 88bae55..130854a 100644 --- a/block/cfq-iosched.c +++ b/block/cfq-iosched.c @@ -4563,6 +4563,7 @@ static void cfq_exit_queue(struct elevator_queue *e) kfree(cfqd->root_group); #endif kfree(cfqd); + wbt_enable_default(q); } static int cfq_init_queue(struct request_queue *q, struct elevator_type *e) -- 2.9.5

1 0

[PATCH openEuler-1.0-LTS] Fix double fget() in vhost_net_set_backend()
by Yongqiang Liu 06 Apr '23

06 Apr '23

From: Al Viro <viro(a)zeniv.linux.org.uk> stable inclusion from stable-v4.19.245 commit 6ca70982c646cc32e458150ee7f2530a24369b8c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6T1EY CVE: CVE-2023-1838 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fb4554c2232e44d595920f4d5c66cf8f7d13f9bc upstream. Descriptor table is a shared resource; two fget() on the same descriptor may return different struct file references. get_tap_ptr_ring() is called after we'd found (and pinned) the socket we'll be using and it tries to find the private tun/tap data structures associated with it. Redoing the lookup by the same file descriptor we'd used to get the socket is racy - we need to same struct file. Thanks to Jason for spotting a braino in the original variant of patch - I'd missed the use of fd == -1 for disabling backend, and in that case we can end up with sock == NULL and sock != oldsock. Cc: stable(a)kernel.org Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Jason Wang <jasowang(a)redhat.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/vhost/net.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index 1d99f5c443ee..4b9151474a24 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -1211,13 +1211,9 @@ static struct socket *get_raw_socket(int fd) return ERR_PTR(r); } -static struct ptr_ring *get_tap_ptr_ring(int fd) +static struct ptr_ring *get_tap_ptr_ring(struct file *file) { struct ptr_ring *ring; - struct file *file = fget(fd); - - if (!file) - return NULL; ring = tun_get_tx_ring(file); if (!IS_ERR(ring)) goto out; @@ -1226,7 +1222,6 @@ static struct ptr_ring *get_tap_ptr_ring(int fd) goto out; ring = NULL; out: - fput(file); return ring; } @@ -1313,8 +1308,12 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd) r = vhost_net_enable_vq(n, vq); if (r) goto err_used; - if (index == VHOST_NET_VQ_RX) - nvq->rx_ring = get_tap_ptr_ring(fd); + if (index == VHOST_NET_VQ_RX) { + if (sock) + nvq->rx_ring = get_tap_ptr_ring(sock->file); + else + nvq->rx_ring = NULL; + } oldubufs = nvq->ubufs; nvq->ubufs = ubufs; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/4] btrfs: fix race between quota disable and quota assign ioctls
by Yongqiang Liu 06 Apr '23

06 Apr '23

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.2-rc8 commit 2f1a6be12ab6c8470d5776e68644726c94257c54 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6PQCT CVE: CVE-2023-1611 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The quota assign ioctl can currently run in parallel with a quota disable ioctl call. The assign ioctl uses the quota root, while the disable ioctl frees that root, and therefore we can have a use-after-free triggered in the assign ioctl, leading to a trace like the following when KASAN is enabled: [672.723][T736] BUG: KASAN: slab-use-after-free in btrfs_search_slot+0x2962/0x2db0 [672.723][T736] Read of size 8 at addr ffff888022ec0208 by task btrfs_search_sl/27736 [672.724][T736] [672.725][T736] CPU: 1 PID: 27736 Comm: btrfs_search_sl Not tainted 6.3.0-rc3 #37 [672.723][T736] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [672.727][T736] Call Trace: [672.728][T736] <TASK> [672.728][T736] dump_stack_lvl+0xd9/0x150 [672.725][T736] print_report+0xc1/0x5e0 [672.720][T736] ? __virt_addr_valid+0x61/0x2e0 [672.727][T736] ? __phys_addr+0xc9/0x150 [672.725][T736] ? btrfs_search_slot+0x2962/0x2db0 [672.722][T736] kasan_report+0xc0/0xf0 [672.729][T736] ? btrfs_search_slot+0x2962/0x2db0 [672.724][T736] btrfs_search_slot+0x2962/0x2db0 [672.723][T736] ? fs_reclaim_acquire+0xba/0x160 [672.722][T736] ? split_leaf+0x13d0/0x13d0 [672.726][T736] ? rcu_is_watching+0x12/0xb0 [672.723][T736] ? kmem_cache_alloc+0x338/0x3c0 [672.722][T736] update_qgroup_status_item+0xf7/0x320 [672.724][T736] ? add_qgroup_rb+0x3d0/0x3d0 [672.739][T736] ? do_raw_spin_lock+0x12d/0x2b0 [672.730][T736] ? spin_bug+0x1d0/0x1d0 [672.737][T736] btrfs_run_qgroups+0x5de/0x840 [672.730][T736] ? btrfs_qgroup_rescan_worker+0xa70/0xa70 [672.738][T736] ? __del_qgroup_relation+0x4ba/0xe00 [672.738][T736] btrfs_ioctl+0x3d58/0x5d80 [672.735][T736] ? tomoyo_path_number_perm+0x16a/0x550 [672.737][T736] ? tomoyo_execute_permission+0x4a0/0x4a0 [672.731][T736] ? btrfs_ioctl_get_supported_features+0x50/0x50 [672.737][T736] ? __sanitizer_cov_trace_switch+0x54/0x90 [672.734][T736] ? do_vfs_ioctl+0x132/0x1660 [672.730][T736] ? vfs_fileattr_set+0xc40/0xc40 [672.730][T736] ? _raw_spin_unlock_irq+0x2e/0x50 [672.732][T736] ? sigprocmask+0xf2/0x340 [672.737][T736] ? __fget_files+0x26a/0x480 [672.732][T736] ? bpf_lsm_file_ioctl+0x9/0x10 [672.738][T736] ? btrfs_ioctl_get_supported_features+0x50/0x50 [672.736][T736] __x64_sys_ioctl+0x198/0x210 [672.736][T736] do_syscall_64+0x39/0xb0 [672.731][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.739][T736] RIP: 0033:0x4556ad [672.742][T736] </TASK> [672.743][T736] [672.748][T736] Allocated by task 27677: [672.743][T736] kasan_save_stack+0x22/0x40 [672.741][T736] kasan_set_track+0x25/0x30 [672.741][T736] __kasan_kmalloc+0xa4/0xb0 [672.749][T736] btrfs_alloc_root+0x48/0x90 [672.746][T736] btrfs_create_tree+0x146/0xa20 [672.744][T736] btrfs_quota_enable+0x461/0x1d20 [672.743][T736] btrfs_ioctl+0x4a1c/0x5d80 [672.747][T736] __x64_sys_ioctl+0x198/0x210 [672.749][T736] do_syscall_64+0x39/0xb0 [672.744][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.756][T736] [672.757][T736] Freed by task 27677: [672.759][T736] kasan_save_stack+0x22/0x40 [672.759][T736] kasan_set_track+0x25/0x30 [672.756][T736] kasan_save_free_info+0x2e/0x50 [672.751][T736] ____kasan_slab_free+0x162/0x1c0 [672.758][T736] slab_free_freelist_hook+0x89/0x1c0 [672.752][T736] __kmem_cache_free+0xaf/0x2e0 [672.752][T736] btrfs_put_root+0x1ff/0x2b0 [672.759][T736] btrfs_quota_disable+0x80a/0xbc0 [672.752][T736] btrfs_ioctl+0x3e5f/0x5d80 [672.756][T736] __x64_sys_ioctl+0x198/0x210 [672.753][T736] do_syscall_64+0x39/0xb0 [672.765][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.769][T736] [672.768][T736] The buggy address belongs to the object at ffff888022ec0000 [672.768][T736] which belongs to the cache kmalloc-4k of size 4096 [672.769][T736] The buggy address is located 520 bytes inside of [672.769][T736] freed 4096-byte region [ffff888022ec0000, ffff888022ec1000) [672.760][T736] [672.764][T736] The buggy address belongs to the physical page: [672.761][T736] page:ffffea00008bb000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22ec0 [672.766][T736] head:ffffea00008bb000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [672.779][T736] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [672.770][T736] raw: 00fff00000010200 ffff888012842140 ffffea000054ba00 dead000000000002 [672.770][T736] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [672.771][T736] page dumped because: kasan: bad access detected [672.778][T736] page_owner tracks the page as allocated [672.777][T736] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 88 [672.779][T736] get_page_from_freelist+0x119c/0x2d50 [672.779][T736] __alloc_pages+0x1cb/0x4a0 [672.776][T736] alloc_pages+0x1aa/0x270 [672.773][T736] allocate_slab+0x260/0x390 [672.771][T736] ___slab_alloc+0xa9a/0x13e0 [672.778][T736] __slab_alloc.constprop.0+0x56/0xb0 [672.771][T736] __kmem_cache_alloc_node+0x136/0x320 [672.789][T736] __kmalloc+0x4e/0x1a0 [672.783][T736] tomoyo_realpath_from_path+0xc3/0x600 [672.781][T736] tomoyo_path_perm+0x22f/0x420 [672.782][T736] tomoyo_path_unlink+0x92/0xd0 [672.780][T736] security_path_unlink+0xdb/0x150 [672.788][T736] do_unlinkat+0x377/0x680 [672.788][T736] __x64_sys_unlink+0xca/0x110 [672.789][T736] do_syscall_64+0x39/0xb0 [672.783][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.784][T736] page last free stack trace: [672.787][T736] free_pcp_prepare+0x4e5/0x920 [672.787][T736] free_unref_page+0x1d/0x4e0 [672.784][T736] __unfreeze_partials+0x17c/0x1a0 [672.797][T736] qlist_free_all+0x6a/0x180 [672.796][T736] kasan_quarantine_reduce+0x189/0x1d0 [672.797][T736] __kasan_slab_alloc+0x64/0x90 [672.793][T736] kmem_cache_alloc+0x17c/0x3c0 [672.799][T736] getname_flags.part.0+0x50/0x4e0 [672.799][T736] getname_flags+0x9e/0xe0 [672.792][T736] vfs_fstatat+0x77/0xb0 [672.791][T736] __do_sys_newlstat+0x84/0x100 [672.798][T736] do_syscall_64+0x39/0xb0 [672.796][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.790][T736] [672.791][T736] Memory state around the buggy address: [672.799][T736] ffff888022ec0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.805][T736] ffff888022ec0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.802][T736] >ffff888022ec0200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.809][T736] ^ [672.809][T736] ffff888022ec0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.809][T736] ffff888022ec0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fix this by having the qgroup assign ioctl take the qgroup ioctl mutex before calling btrfs_run_qgroups(), which is what all qgroup ioctls should call. Reported-by: butt3rflyh4ck <butterflyhuangxx(a)gmail.com> Link: https://lore.kernel.org/linux-btrfs/CAFcO6XN3VD8ogmHwqRk4kbiwtpUSNySu2VAxN8… CC: stable(a)vger.kernel.org # 5.10+ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/qgroup.c Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/btrfs/ioctl.c | 2 ++ fs/btrfs/qgroup.c | 11 ++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index a5ae02bf3652..00424d3f3464 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -5240,7 +5240,9 @@ static long btrfs_ioctl_qgroup_assign(struct file *file, void __user *arg) } /* update qgroup status and info */ + mutex_lock(&fs_info->qgroup_ioctl_lock); err = btrfs_run_qgroups(trans); + mutex_unlock(&fs_info->qgroup_ioctl_lock); if (err < 0) btrfs_handle_fs_error(fs_info, err, "failed to update qgroup status and info"); diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c index 7916f711daf5..8e58c58f73a3 100644 --- a/fs/btrfs/qgroup.c +++ b/fs/btrfs/qgroup.c @@ -2196,7 +2196,8 @@ int btrfs_qgroup_account_extents(struct btrfs_trans_handle *trans) } /* - * called from commit_transaction. Writes all changed qgroups to disk. + * Writes all changed qgroups to disk. + * Called by the transaction commit path and the qgroup assign ioctl. */ int btrfs_run_qgroups(struct btrfs_trans_handle *trans) { @@ -2204,6 +2205,14 @@ int btrfs_run_qgroups(struct btrfs_trans_handle *trans) struct btrfs_root *quota_root = fs_info->quota_root; int ret = 0; + /* + * In case we are called from the qgroup assign ioctl, assert that we + * are holding the qgroup_ioctl_lock, otherwise we can race with a quota + * disable operation (ioctl) and access a freed quota root. + */ + if (trans->transaction->state != TRANS_STATE_COMMIT_DOING) + lockdep_assert_held(&fs_info->qgroup_ioctl_lock); + if (!quota_root) return ret; -- 2.25.1

1 3

Kernel sig 4.7 14:00-15:30 例会议题情况//答复: openEuler Kernel SIG双周例会
by liaotao (C) 06 Apr '23

06 Apr '23

当前例会议题：议题一：进展update --- 张伽琳 & 郑增凯议题二：openEuler-22.03-LTS-SP2需求评审 ---张伽琳欢迎大家继续申报~ -----原始约会----- 发件人: openEuler conference <public(a)openeuler.org> 发送时间: 2023年4月7日 9:30 收件人: dev@openeuler.org,kernel-discuss@openeuler.org,kernel@openeuler.org 主题: openEuler Kernel SIG双周例会时间: 2023年4月7日星期五 14:00-15:30(UTC+08:00) 北京，重庆，香港特别行政区，乌鲁木齐。地点: 您好！ Kernel SIG 邀请您参加 2023-04-07 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1.进展update 2.议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/88353599877?pwd=aFZtMjJwUHl1UmNTZFV4eUJQM2xVdz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-04-07 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1.进展update 2.议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/88353599877?pwd=aFZtMjJwUHl1UmNTZFV4eUJQM2xVdz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS 1/4] ext4: fix race between writepages and remount
by Yongqiang Liu 04 Apr '23

04 Apr '23

From: Baokun Li <libaokun1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188500, https://gitee.com/openeuler/kernel/issues/I6RJ0V CVE: NA -------------------------------- We got a WARNING in ext4_add_complete_io: ================================================================== WARNING: at fs/ext4/page-io.c:231 ext4_put_io_end_defer+0x182/0x250 CPU: 10 PID: 77 Comm: ksoftirqd/10 Tainted: 6.3.0-rc2 #85 RIP: 0010:ext4_put_io_end_defer+0x182/0x250 [ext4] [...] Call Trace: <TASK> ext4_end_bio+0xa8/0x240 [ext4] bio_endio+0x195/0x310 blk_update_request+0x184/0x770 scsi_end_request+0x2f/0x240 scsi_io_completion+0x75/0x450 scsi_finish_command+0xef/0x160 scsi_complete+0xa3/0x180 blk_complete_reqs+0x60/0x80 blk_done_softirq+0x25/0x40 __do_softirq+0x119/0x4c8 run_ksoftirqd+0x42/0x70 smpboot_thread_fn+0x136/0x3c0 kthread+0x140/0x1a0 ret_from_fork+0x2c/0x50 ================================================================== Above issue may happen as follows: cpu1 cpu2 ----------------------------|---------------------------- mount -o dioread_lock ext4_writepages ext4_do_writepages *if (ext4_should_dioread_nolock(inode))* // rsv_blocks is not assigned here mount -o remount,dioread_nolock ext4_journal_start_with_reserve __ext4_journal_start __ext4_journal_start_sb jbd2__journal_start *if (rsv_blocks)* // h_rsv_handle is not initialized here mpage_map_and_submit_extent mpage_map_one_extent dioread_nolock = ext4_should_dioread_nolock(inode) if (dioread_nolock && (map->m_flags & EXT4_MAP_UNWRITTEN)) mpd->io_submit.io_end->handle = handle->h_rsv_handle ext4_set_io_unwritten_flag io_end->flag |= EXT4_IO_END_UNWRITTEN // now io_end->handle is NULL but has EXT4_IO_END_UNWRITTEN flag scsi_finish_command scsi_io_completion scsi_io_completion_action scsi_end_request blk_update_request req_bio_endio bio_endio bio->bi_end_io > ext4_end_bio ext4_put_io_end_defer ext4_add_complete_io // trigger WARN_ON(!io_end->handle && sbi->s_journal); The immediate cause of this problem is that ext4_should_dioread_nolock() function returns inconsistent values in the ext4_do_writepages() and mpage_map_one_extent(). There are four conditions in this function that can be changed at mount time to cause this problem. These four conditions can be divided into two categories: (1) journal_data and EXT4_EXTENTS_FL, which can be changed by ioctl (2) DELALLOC and DIOREAD_NOLOCK, which can be changed by remount The two in the first category have been fixed by commit c8585c6fcaf2 ("ext4: fix races between changing inode journal mode and ext4_writepages") and commit cb85f4d23f79 ("ext4: fix race between writepages and enabling EXT4_EXTENTS_FL") respectively. Two cases in the other category have not yet been fixed, and the above issue is caused by this situation. We refer to the fix for the first category, when applying options during remount, we grab s_writepages_rwsem to avoid racing with writepages ops to trigger this problem. Fixes: 6b523df4fb5a ("ext4: use transaction reservation for extent conversion in ext4_end_io") Cc: stable(a)vger.kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/ext4.h | 3 ++- fs/ext4/super.c | 13 +++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index 4c88e75180a2..6df919b154b4 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -1530,7 +1530,8 @@ struct ext4_sb_info { /* * Barrier between writepages ops and changing any inode's JOURNAL_DATA - * or EXTENTS flag. + * or EXTENTS flag or between writepages ops and changing DIOREAD_NOLOCK + * mount option on remount. */ struct percpu_rw_semaphore s_writepages_rwsem; struct dax_device *s_daxdev; diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 8029a6f6471c..df07222f1cc5 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5605,10 +5605,20 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) vfs_flags = SB_LAZYTIME | SB_I_VERSION; sb->s_flags = (sb->s_flags & ~vfs_flags) | (*flags & vfs_flags); + /* + * Changing the DIOREAD_NOLOCK mount option may cause two calls to + * ext4_should_dioread_nolock() to return inconsistent values, + * triggering WARN_ON in ext4_add_complete_io(). we grab here + * s_writepages_rwsem to avoid race between writepages ops and + * remount. + */ + percpu_down_write(&sbi->s_writepages_rwsem); if (!parse_options(data, sb, NULL, &journal_ioprio, 1)) { err = -EINVAL; + percpu_up_write(&sbi->s_writepages_rwsem); goto restore_opts; } + percpu_up_write(&sbi->s_writepages_rwsem); if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^ test_opt(sb, JOURNAL_CHECKSUM)) { @@ -5833,6 +5843,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) return 0; restore_opts: + percpu_down_write(&sbi->s_writepages_rwsem); sb->s_flags = old_sb_flags; sbi->s_mount_opt = old_opts.s_mount_opt; sbi->s_mount_opt2 = old_opts.s_mount_opt2; @@ -5841,6 +5852,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) sbi->s_commit_interval = old_opts.s_commit_interval; sbi->s_min_batch_time = old_opts.s_min_batch_time; sbi->s_max_batch_time = old_opts.s_max_batch_time; + percpu_up_write(&sbi->s_writepages_rwsem); + if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks) ext4_release_system_zone(sb); #ifdef CONFIG_QUOTA -- 2.25.1

1 6

[PATCH openEuler-5.10-LTS 01/15] scsi: scsi_dh_alua: fix memleak for 'qdata' in alua_activate()
by Jialin Zhang 04 Apr '23

04 Apr '23

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6NBAZ CVE: NA -------------------------------- If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not freed, which will cause following memleak: unreferenced object 0xffff88810b2c6980 (size 32): comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$............. backtrace: [<0000000098f3a26d>] alua_activate+0xb0/0x320 [<000000003b529641>] scsi_dh_activate+0xb2/0x140 [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath] [<000000007adc9ace>] process_one_work+0x3c5/0x730 [<00000000c457a985>] worker_thread+0x93/0x650 [<00000000cb80e628>] kthread+0x1ba/0x210 [<00000000a1e61077>] ret_from_fork+0x22/0x30 Fix the problem by freeing 'qdata' in error path. Fixes: 625fe857e4fa ("scsi: scsi_dh_alua: Check scsi_device_get() return value") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/scsi/device_handler/scsi_dh_alua.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c index fe8a5e5c0df8..bf0b3178f84d 100644 --- a/drivers/scsi/device_handler/scsi_dh_alua.c +++ b/drivers/scsi/device_handler/scsi_dh_alua.c @@ -1036,10 +1036,12 @@ static int alua_activate(struct scsi_device *sdev, rcu_read_unlock(); mutex_unlock(&h->init_mutex); - if (alua_rtpg_queue(pg, sdev, qdata, true)) + if (alua_rtpg_queue(pg, sdev, qdata, true)) { fn = NULL; - else + } else { + kfree(qdata); err = SCSI_DH_DEV_OFFLINED; + } kref_put(&pg->kref, release_port_group); out: if (fn) -- 2.25.1

1 14

[PATCH openEuler-5.10-LTS-SP1 01/16] scsi: scsi_dh_alua: fix memleak for 'qdata' in alua_activate()
by Jialin Zhang 04 Apr '23

04 Apr '23

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6NBAZ CVE: NA -------------------------------- If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not freed, which will cause following memleak: unreferenced object 0xffff88810b2c6980 (size 32): comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$............. backtrace: [<0000000098f3a26d>] alua_activate+0xb0/0x320 [<000000003b529641>] scsi_dh_activate+0xb2/0x140 [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath] [<000000007adc9ace>] process_one_work+0x3c5/0x730 [<00000000c457a985>] worker_thread+0x93/0x650 [<00000000cb80e628>] kthread+0x1ba/0x210 [<00000000a1e61077>] ret_from_fork+0x22/0x30 Fix the problem by freeing 'qdata' in error path. Fixes: 625fe857e4fa ("scsi: scsi_dh_alua: Check scsi_device_get() return value") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/scsi/device_handler/scsi_dh_alua.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c index fe8a5e5c0df8..bf0b3178f84d 100644 --- a/drivers/scsi/device_handler/scsi_dh_alua.c +++ b/drivers/scsi/device_handler/scsi_dh_alua.c @@ -1036,10 +1036,12 @@ static int alua_activate(struct scsi_device *sdev, rcu_read_unlock(); mutex_unlock(&h->init_mutex); - if (alua_rtpg_queue(pg, sdev, qdata, true)) + if (alua_rtpg_queue(pg, sdev, qdata, true)) { fn = NULL; - else + } else { + kfree(qdata); err = SCSI_DH_DEV_OFFLINED; + } kref_put(&pg->kref, release_port_group); out: if (fn) -- 2.25.1

1 15

openEuler Kernel SIG双周例会
by openEuler conference 04 Apr '23

04 Apr '23

您好！ Kernel SIG 邀请您参加 2023-04-07 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1.进展update 2.议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/88353599877?pwd=aFZtMjJwUHl1UmNTZFV4eUJQM2xVdz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-04-07 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1.进展update 2.议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/88353599877?pwd=aFZtMjJwUHl1UmNTZFV4eUJQM2xVdz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS 1/4] ext4: fix race between writepages and remount
by Yongqiang Liu 03 Apr '23

03 Apr '23

From: Baokun Li <libaokun1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188500, https://gitee.com/openeuler/kernel/issues/I6RJ0V CVE: NA -------------------------------- We got a WARNING in ext4_add_complete_io: ================================================================== WARNING: at fs/ext4/page-io.c:231 ext4_put_io_end_defer+0x182/0x250 CPU: 10 PID: 77 Comm: ksoftirqd/10 Tainted: 6.3.0-rc2 #85 RIP: 0010:ext4_put_io_end_defer+0x182/0x250 [ext4] [...] Call Trace: <TASK> ext4_end_bio+0xa8/0x240 [ext4] bio_endio+0x195/0x310 blk_update_request+0x184/0x770 scsi_end_request+0x2f/0x240 scsi_io_completion+0x75/0x450 scsi_finish_command+0xef/0x160 scsi_complete+0xa3/0x180 blk_complete_reqs+0x60/0x80 blk_done_softirq+0x25/0x40 __do_softirq+0x119/0x4c8 run_ksoftirqd+0x42/0x70 smpboot_thread_fn+0x136/0x3c0 kthread+0x140/0x1a0 ret_from_fork+0x2c/0x50 ================================================================== Above issue may happen as follows: cpu1 cpu2 ----------------------------|---------------------------- mount -o dioread_lock ext4_writepages ext4_do_writepages *if (ext4_should_dioread_nolock(inode))* // rsv_blocks is not assigned here mount -o remount,dioread_nolock ext4_journal_start_with_reserve __ext4_journal_start __ext4_journal_start_sb jbd2__journal_start *if (rsv_blocks)* // h_rsv_handle is not initialized here mpage_map_and_submit_extent mpage_map_one_extent dioread_nolock = ext4_should_dioread_nolock(inode) if (dioread_nolock && (map->m_flags & EXT4_MAP_UNWRITTEN)) mpd->io_submit.io_end->handle = handle->h_rsv_handle ext4_set_io_unwritten_flag io_end->flag |= EXT4_IO_END_UNWRITTEN // now io_end->handle is NULL but has EXT4_IO_END_UNWRITTEN flag scsi_finish_command scsi_io_completion scsi_io_completion_action scsi_end_request blk_update_request req_bio_endio bio_endio bio->bi_end_io > ext4_end_bio ext4_put_io_end_defer ext4_add_complete_io // trigger WARN_ON(!io_end->handle && sbi->s_journal); The immediate cause of this problem is that ext4_should_dioread_nolock() function returns inconsistent values in the ext4_do_writepages() and mpage_map_one_extent(). There are four conditions in this function that can be changed at mount time to cause this problem. These four conditions can be divided into two categories: (1) journal_data and EXT4_EXTENTS_FL, which can be changed by ioctl (2) DELALLOC and DIOREAD_NOLOCK, which can be changed by remount The two in the first category have been fixed by commit c8585c6fcaf2 ("ext4: fix races between changing inode journal mode and ext4_writepages") and commit cb85f4d23f79 ("ext4: fix race between writepages and enabling EXT4_EXTENTS_FL") respectively. Two cases in the other category have not yet been fixed, and the above issue is caused by this situation. We refer to the fix for the first category, when applying options during remount, we grab s_writepages_rwsem to avoid racing with writepages ops to trigger this problem. Fixes: 6b523df4fb5a ("ext4: use transaction reservation for extent conversion in ext4_end_io") Cc: stable(a)vger.kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/ext4.h | 3 ++- fs/ext4/super.c | 13 +++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index 4c88e75180a2..6df919b154b4 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -1530,7 +1530,8 @@ struct ext4_sb_info { /* * Barrier between writepages ops and changing any inode's JOURNAL_DATA - * or EXTENTS flag. + * or EXTENTS flag or between writepages ops and changing DIOREAD_NOLOCK + * mount option on remount. */ struct percpu_rw_semaphore s_writepages_rwsem; struct dax_device *s_daxdev; diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 8029a6f6471c..df07222f1cc5 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5605,10 +5605,20 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) vfs_flags = SB_LAZYTIME | SB_I_VERSION; sb->s_flags = (sb->s_flags & ~vfs_flags) | (*flags & vfs_flags); + /* + * Changing the DIOREAD_NOLOCK mount option may cause two calls to + * ext4_should_dioread_nolock() to return inconsistent values, + * triggering WARN_ON in ext4_add_complete_io(). we grab here + * s_writepages_rwsem to avoid race between writepages ops and + * remount. + */ + percpu_down_write(&sbi->s_writepages_rwsem); if (!parse_options(data, sb, NULL, &journal_ioprio, 1)) { err = -EINVAL; + percpu_up_write(&sbi->s_writepages_rwsem); goto restore_opts; } + percpu_up_write(&sbi->s_writepages_rwsem); if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^ test_opt(sb, JOURNAL_CHECKSUM)) { @@ -5833,6 +5843,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) return 0; restore_opts: + percpu_down_write(&sbi->s_writepages_rwsem); sb->s_flags = old_sb_flags; sbi->s_mount_opt = old_opts.s_mount_opt; sbi->s_mount_opt2 = old_opts.s_mount_opt2; @@ -5841,6 +5852,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) sbi->s_commit_interval = old_opts.s_commit_interval; sbi->s_min_batch_time = old_opts.s_min_batch_time; sbi->s_max_batch_time = old_opts.s_max_batch_time; + percpu_up_write(&sbi->s_writepages_rwsem); + if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks) ext4_release_system_zone(sb); #ifdef CONFIG_QUOTA -- 2.25.1

1 3

[PATCH] ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
by Hui Tang 31 Mar '23

31 Mar '23

From: Clement Lecigne <clecigne(a)google.com> stable inclusion from stable-v5.10.162 commit df02234e6b87d2a9a82acd3198e44bdeff8488c6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6AOWP CVE: CVE-2023-0266 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Note: this is a fix that works around the bug equivalently as the two upstream commits: 1fa4445f9adf ("ALSA: control - introduce snd_ctl_notify_one() helper") 56b88b50565c ("ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF") but in a simpler way to fit with older stable trees -- tiwai ] Add missing locking in ctl_elem_read_user/ctl_elem_write_user which can be easily triggered and turned into an use-after-free. Example code paths with SNDRV_CTL_IOCTL_ELEM_READ: 64-bits: snd_ctl_ioctl snd_ctl_elem_read_user [takes controls_rwsem] snd_ctl_elem_read [lock properly held, all good] [drops controls_rwsem] 32-bits (compat): snd_ctl_ioctl_compat snd_ctl_elem_write_read_compat ctl_elem_write_read snd_ctl_elem_read [missing lock, not good] CVE-2023-0266 was assigned for this issue. Signed-off-by: Clement Lecigne <clecigne(a)google.com> Cc: stable(a)kernel.org # 5.12 and older Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Reviewed-by: Jaroslav Kysela <perex(a)perex.cz> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- sound/core/control_compat.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index 507fd5210c1c..f5e51f5e3437 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -316,7 +316,9 @@ static int ctl_elem_read_user(struct snd_card *card, err = snd_power_wait(card, SNDRV_CTL_POWER_D0); if (err < 0) goto error; + down_read(&card->controls_rwsem); err = snd_ctl_elem_read(card, data); + up_read(&card->controls_rwsem); if (err < 0) goto error; err = copy_ctl_value_to_user(userdata, valuep, data, type, count); @@ -344,7 +346,9 @@ static int ctl_elem_write_user(struct snd_ctl_file *file, err = snd_power_wait(card, SNDRV_CTL_POWER_D0); if (err < 0) goto error; + down_write(&card->controls_rwsem); err = snd_ctl_elem_write(card, file, data); + up_write(&card->controls_rwsem); if (err < 0) goto error; err = copy_ctl_value_to_user(userdata, valuep, data, type, count); -- 2.17.1

1 0

[PATCH openEuler-1.0-LTS] ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
by Zhang Changzhong 31 Mar '23

31 Mar '23

From: Clement Lecigne <clecigne(a)google.com> stable inclusion from stable-v5.10.162 commit df02234e6b87d2a9a82acd3198e44bdeff8488c6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6AOWP CVE: CVE-2023-0266 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Note: this is a fix that works around the bug equivalently as the two upstream commits: 1fa4445f9adf ("ALSA: control - introduce snd_ctl_notify_one() helper") 56b88b50565c ("ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF") but in a simpler way to fit with older stable trees -- tiwai ] Add missing locking in ctl_elem_read_user/ctl_elem_write_user which can be easily triggered and turned into an use-after-free. Example code paths with SNDRV_CTL_IOCTL_ELEM_READ: 64-bits: snd_ctl_ioctl snd_ctl_elem_read_user [takes controls_rwsem] snd_ctl_elem_read [lock properly held, all good] [drops controls_rwsem] 32-bits (compat): snd_ctl_ioctl_compat snd_ctl_elem_write_read_compat ctl_elem_write_read snd_ctl_elem_read [missing lock, not good] CVE-2023-0266 was assigned for this issue. Signed-off-by: Clement Lecigne <clecigne(a)google.com> Cc: stable(a)kernel.org # 5.12 and older Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Reviewed-by: Jaroslav Kysela <perex(a)perex.cz> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: songping yu <yusongping(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- sound/core/control_compat.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index 507fd52..f5e51f5 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -316,7 +316,9 @@ static int ctl_elem_read_user(struct snd_card *card, err = snd_power_wait(card, SNDRV_CTL_POWER_D0); if (err < 0) goto error; + down_read(&card->controls_rwsem); err = snd_ctl_elem_read(card, data); + up_read(&card->controls_rwsem); if (err < 0) goto error; err = copy_ctl_value_to_user(userdata, valuep, data, type, count); @@ -344,7 +346,9 @@ static int ctl_elem_write_user(struct snd_ctl_file *file, err = snd_power_wait(card, SNDRV_CTL_POWER_D0); if (err < 0) goto error; + down_write(&card->controls_rwsem); err = snd_ctl_elem_write(card, file, data); + up_write(&card->controls_rwsem); if (err < 0) goto error; err = copy_ctl_value_to_user(userdata, valuep, data, type, count); -- 2.9.5

1 0

【重要】openEuler-22.03-LTS-SP2需求收集
by zhangjialin (F) 30 Mar '23

30 Mar '23

openEuler-22.03-LTS-SP2需求收集截止日期：2023年4月7日星期五 openEuler-22.03-LTS-SP2需求合入截止日期：2023年5月19日星期五目前是需求收集阶段，如果您有合入openEuler-22.03-LTS-SP2的需求，请您尽快向openEuler社区提交需求issue 需求issue提交链接：https://gitee.com/openeuler/kernel/issues，issue类型选择需求，issue标题以[… 我们将在2023年4月7日kernel sig双周例会上集中讨论，采纳的需求将纳入里程碑规划

1 0

[PATCH openEuler-1.0-LTS 1/4] RDMA/core: Don't infoleak GRH fields
by Yongqiang Liu 30 Mar '23

30 Mar '23

From: Leon Romanovsky <leonro(a)nvidia.com> stable inclusion from stable-v4.19.225 commit 153843e270459b08529f80a0a0d8258d91597594 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6Q364 CVE: CVE-2021-3923 -------------------------------- commit b35a0f4dd544eaa6162b6d2f13a2557a121ae5fd upstream. If dst->is_global field is not set, the GRH fields are not cleared and the following infoleak is reported. ===================================================== BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 instrument_copy_to_user include/linux/instrumented.h:121 [inline] _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:209 [inline] ucma_init_qp_attr+0x8c7/0xb10 drivers/infiniband/core/ucma.c:1242 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732 vfs_write+0x8ce/0x2030 fs/read_write.c:588 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline] __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Local variable resp created at: ucma_init_qp_attr+0xa4/0xb10 drivers/infiniband/core/ucma.c:1214 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732 Bytes 40-59 of 144 are uninitialized Memory access of size 144 starts at ffff888167523b00 Data copied to user address 0000000020000100 CPU: 1 PID: 25910 Comm: syz-executor.1 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ===================================================== Fixes: 4ba66093bdc6 ("IB/core: Check for global flag when using ah_attr") Link: https://lore.kernel.org/r/0e9dd51f93410b7b2f4f5562f52befc878b71afa.16412988… Reported-by: syzbot+6d532fa8f9463da290bc(a)syzkaller.appspotmail.com Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/infiniband/core/uverbs_marshall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c index b8d715c68ca4..11a080646916 100644 --- a/drivers/infiniband/core/uverbs_marshall.c +++ b/drivers/infiniband/core/uverbs_marshall.c @@ -66,7 +66,7 @@ void ib_copy_ah_attr_to_user(struct ib_device *device, struct rdma_ah_attr *src = ah_attr; struct rdma_ah_attr conv_ah; - memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved)); + memset(&dst->grh, 0, sizeof(dst->grh)); if ((ah_attr->type == RDMA_AH_ATTR_TYPE_OPA) && (rdma_ah_get_dlid(ah_attr) > be16_to_cpu(IB_LID_PERMISSIVE)) && -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 1/2] RDMA/core: Don't infoleak GRH fields
by Yongqiang Liu 30 Mar '23

30 Mar '23

From: Leon Romanovsky <leonro(a)nvidia.com> stable inclusion from stable-v4.19.225 commit 153843e270459b08529f80a0a0d8258d91597594 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6Q364 CVE: CVE-2021-3923 -------------------------------- commit b35a0f4dd544eaa6162b6d2f13a2557a121ae5fd upstream. If dst->is_global field is not set, the GRH fields are not cleared and the following infoleak is reported. ===================================================== BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 instrument_copy_to_user include/linux/instrumented.h:121 [inline] _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:209 [inline] ucma_init_qp_attr+0x8c7/0xb10 drivers/infiniband/core/ucma.c:1242 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732 vfs_write+0x8ce/0x2030 fs/read_write.c:588 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline] __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Local variable resp created at: ucma_init_qp_attr+0xa4/0xb10 drivers/infiniband/core/ucma.c:1214 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732 Bytes 40-59 of 144 are uninitialized Memory access of size 144 starts at ffff888167523b00 Data copied to user address 0000000020000100 CPU: 1 PID: 25910 Comm: syz-executor.1 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ===================================================== Fixes: 4ba66093bdc6 ("IB/core: Check for global flag when using ah_attr") Link: https://lore.kernel.org/r/0e9dd51f93410b7b2f4f5562f52befc878b71afa.16412988… Reported-by: syzbot+6d532fa8f9463da290bc(a)syzkaller.appspotmail.com Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/infiniband/core/uverbs_marshall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c index b8d715c68ca4..11a080646916 100644 --- a/drivers/infiniband/core/uverbs_marshall.c +++ b/drivers/infiniband/core/uverbs_marshall.c @@ -66,7 +66,7 @@ void ib_copy_ah_attr_to_user(struct ib_device *device, struct rdma_ah_attr *src = ah_attr; struct rdma_ah_attr conv_ah; - memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved)); + memset(&dst->grh, 0, sizeof(dst->grh)); if ((ah_attr->type == RDMA_AH_ATTR_TYPE_OPA) && (rdma_ah_get_dlid(ah_attr) > be16_to_cpu(IB_LID_PERMISSIVE)) && -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/3] cgroup/cpuset: Change cpuset_rwsem and hotplug lock order
by Yongqiang Liu 29 Mar '23

29 Mar '23

From: Juri Lelli <juri.lelli(a)redhat.com> mainline inclusion from mainline-v5.4-rc1 commit d74b27d63a8bebe2fe634944e4ebdc7b10db7a39 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6L46J CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cpuset_rwsem is going to be acquired from sched_setscheduler() with a following patch. There are however paths (e.g., spawn_ksoftirqd) in which sched_scheduler() is eventually called while holding hotplug lock; this creates a dependecy between hotplug lock (to be always acquired first) and cpuset_rwsem (to be always acquired after hotplug lock). Fix paths which currently take the two locks in the wrong order (after a following patch is applied). Tested-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Signed-off-by: Juri Lelli <juri.lelli(a)redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: bristot(a)redhat.com Cc: claudio(a)evidence.eu.com Cc: lizefan(a)huawei.com Cc: longman(a)redhat.com Cc: luca.abeni(a)santannapisa.it Cc: mathieu.poirier(a)linaro.org Cc: rostedt(a)goodmis.org Cc: tj(a)kernel.org Cc: tommaso.cucinotta(a)santannapisa.it Link: https://lkml.kernel.org/r/20190719140000.31694-7-juri.lelli@redhat.com Signed-off-by: Ingo Molnar <mingo(a)kernel.org> conflicts: kernel/cgroup/cpuset.c Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/linux/cpuset.h | 8 ++++---- kernel/cgroup/cpuset.c | 24 +++++++++++++++++------- 2 files changed, 21 insertions(+), 11 deletions(-) diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h index 934633a05d20..7f1478c26a33 100644 --- a/include/linux/cpuset.h +++ b/include/linux/cpuset.h @@ -40,14 +40,14 @@ static inline bool cpusets_enabled(void) static inline void cpuset_inc(void) { - static_branch_inc(&cpusets_pre_enable_key); - static_branch_inc(&cpusets_enabled_key); + static_branch_inc_cpuslocked(&cpusets_pre_enable_key); + static_branch_inc_cpuslocked(&cpusets_enabled_key); } static inline void cpuset_dec(void) { - static_branch_dec(&cpusets_enabled_key); - static_branch_dec(&cpusets_pre_enable_key); + static_branch_dec_cpuslocked(&cpusets_enabled_key); + static_branch_dec_cpuslocked(&cpusets_pre_enable_key); } extern int cpuset_init(void); diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 55bfbc4cdb16..def36c3fc524 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -914,8 +914,8 @@ static void rebuild_sched_domains_locked(void) cpumask_var_t *doms; int ndoms; + lockdep_assert_cpus_held(); lockdep_assert_held(&cpuset_mutex); - get_online_cpus(); /* * We have raced with CPU hotplug. Don't do anything to avoid @@ -923,15 +923,13 @@ static void rebuild_sched_domains_locked(void) * Anyways, hotplug work item will rebuild sched domains. */ if (!cpumask_equal(top_cpuset.effective_cpus, cpu_active_mask)) - goto out; + return; /* Generate domain masks and attrs */ ndoms = generate_sched_domains(&doms, &attr); /* Have scheduler rebuild the domains */ partition_sched_domains(ndoms, doms, attr); -out: - put_online_cpus(); } #else /* !CONFIG_SMP */ static void rebuild_sched_domains_locked(void) @@ -941,9 +939,11 @@ static void rebuild_sched_domains_locked(void) void rebuild_sched_domains(void) { + get_online_cpus(); mutex_lock(&cpuset_mutex); rebuild_sched_domains_locked(); mutex_unlock(&cpuset_mutex); + put_online_cpus(); } /** @@ -1612,13 +1612,13 @@ static void cpuset_attach(struct cgroup_taskset *tset) cgroup_taskset_first(tset, &css); cs = css_cs(css); - mutex_lock(&cpuset_mutex); - /* * It should hold cpus lock because a cpu offline event can * cause set_cpus_allowed_ptr() failed. */ get_online_cpus(); + mutex_lock(&cpuset_mutex); + /* prepare for attach */ if (cs == &top_cpuset) cpumask_copy(cpus_attach, cpu_possible_mask); @@ -1644,7 +1644,6 @@ static void cpuset_attach(struct cgroup_taskset *tset) cpuset_change_task_nodemask(task, &cpuset_attach_nodemask_to); cpuset_update_task_spread_flag(cs, task); } - put_online_cpus(); /* * Change mm for all threadgroup leaders. This is expensive and may @@ -1680,6 +1679,7 @@ static void cpuset_attach(struct cgroup_taskset *tset) wake_up(&cpuset_attach_wq); mutex_unlock(&cpuset_mutex); + put_online_cpus(); } /* The various types of files and directories in a cpuset file system */ @@ -1711,6 +1711,7 @@ static int cpuset_write_u64(struct cgroup_subsys_state *css, struct cftype *cft, cpuset_filetype_t type = cft->private; int retval = 0; + get_online_cpus(); mutex_lock(&cpuset_mutex); if (!is_cpuset_online(cs)) { retval = -ENODEV; @@ -1748,6 +1749,7 @@ static int cpuset_write_u64(struct cgroup_subsys_state *css, struct cftype *cft, } out_unlock: mutex_unlock(&cpuset_mutex); + put_online_cpus(); return retval; } @@ -1758,6 +1760,7 @@ static int cpuset_write_s64(struct cgroup_subsys_state *css, struct cftype *cft, cpuset_filetype_t type = cft->private; int retval = -ENODEV; + get_online_cpus(); mutex_lock(&cpuset_mutex); if (!is_cpuset_online(cs)) goto out_unlock; @@ -1772,6 +1775,7 @@ static int cpuset_write_s64(struct cgroup_subsys_state *css, struct cftype *cft, } out_unlock: mutex_unlock(&cpuset_mutex); + put_online_cpus(); return retval; } @@ -1810,6 +1814,7 @@ static ssize_t cpuset_write_resmask(struct kernfs_open_file *of, kernfs_break_active_protection(of->kn); flush_work(&cpuset_hotplug_work); + get_online_cpus(); mutex_lock(&cpuset_mutex); if (!is_cpuset_online(cs)) goto out_unlock; @@ -1840,6 +1845,7 @@ static ssize_t cpuset_write_resmask(struct kernfs_open_file *of, free_trial_cpuset(trialcs); out_unlock: mutex_unlock(&cpuset_mutex); + put_online_cpus(); kernfs_unbreak_active_protection(of->kn); css_put(&cs->css); flush_workqueue(cpuset_migrate_mm_wq); @@ -2108,6 +2114,7 @@ static int cpuset_css_online(struct cgroup_subsys_state *css) if (!parent) return 0; + get_online_cpus(); mutex_lock(&cpuset_mutex); set_bit(CS_ONLINE, &cs->flags); @@ -2161,6 +2168,7 @@ static int cpuset_css_online(struct cgroup_subsys_state *css) spin_unlock_irq(&callback_lock); out_unlock: mutex_unlock(&cpuset_mutex); + put_online_cpus(); return 0; } @@ -2174,6 +2182,7 @@ static void cpuset_css_offline(struct cgroup_subsys_state *css) { struct cpuset *cs = css_cs(css); + get_online_cpus(); mutex_lock(&cpuset_mutex); if (is_sched_load_balance(cs)) @@ -2183,6 +2192,7 @@ static void cpuset_css_offline(struct cgroup_subsys_state *css) clear_bit(CS_ONLINE, &cs->flags); mutex_unlock(&cpuset_mutex); + put_online_cpus(); } static void cpuset_css_free(struct cgroup_subsys_state *css) -- 2.25.1

1 2

[PATCH openEuler-5.10-LTS-SP1 01/36] bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
by Jialin Zhang 29 Mar '23

29 Mar '23

From: Liu Jian <liujian56(a)huawei.com> mainline inclusion from mainline-v6.3-rc2 commit d900f3d20cc3169ce42ec72acc850e662a4d4db2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I65HYE CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- When the buffer length of the recvmsg system call is 0, we got the flollowing soft lockup problem: watchdog: BUG: soft lockup - CPU#3 stuck for 27s! [a.out:6149] CPU: 3 PID: 6149 Comm: a.out Kdump: loaded Not tainted 6.2.0+ #30 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:remove_wait_queue+0xb/0xc0 Code: 5e 41 5f c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 57 <41> 56 41 55 41 54 55 48 89 fd 53 48 89 f3 4c 8d 6b 18 4c 8d 73 20 RSP: 0018:ffff88811b5978b8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff88811a7d3780 RCX: ffffffffb7a4d768 RDX: dffffc0000000000 RSI: ffff88811b597908 RDI: ffff888115408040 RBP: 1ffff110236b2f1b R08: 0000000000000000 R09: ffff88811a7d37e7 R10: ffffed10234fa6fc R11: 0000000000000001 R12: ffff88811179b800 R13: 0000000000000001 R14: ffff88811a7d38a8 R15: ffff88811a7d37e0 FS: 00007f6fb5398740(0000) GS:ffff888237180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000000 CR3: 000000010b6ba002 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tcp_msg_wait_data+0x279/0x2f0 tcp_bpf_recvmsg_parser+0x3c6/0x490 inet_recvmsg+0x280/0x290 sock_recvmsg+0xfc/0x120 ____sys_recvmsg+0x160/0x3d0 ___sys_recvmsg+0xf0/0x180 __sys_recvmsg+0xea/0x1a0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc The logic in tcp_bpf_recvmsg_parser is as follows: msg_bytes_ready: copied = sk_msg_recvmsg(sk, psock, msg, len, flags); if (!copied) { wait data; goto msg_bytes_ready; } In this case, "copied" always is 0, the infinite loop occurs. According to the Linux system call man page, 0 should be returned in this case. Therefore, in tcp_bpf_recvmsg_parser(), if the length is 0, directly return. Also modify several other functions with the same problem. Fixes: 1f5be6b3b063 ("udp: Implement udp_bpf_recvmsg() for sockmap") Fixes: 9825d866ce0d ("af_unix: Implement unix_dgram_bpf_recvmsg()") Fixes: c5d2177a72a1 ("bpf, sockmap: Fix race in ingress receive verdict with redirect to self") Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: John Fastabend <john.fastabend(a)gmail.com> Cc: Jakub Sitnicki <jakub(a)cloudflare.com> Link: https://lore.kernel.org/bpf/20230303080946.1146638-1-liujian56@huawei.com (cherry picked from commit d900f3d20cc3169ce42ec72acc850e662a4d4db2) Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: net/ipv4/udp_bpf.c net/unix/unix_bpf.c net/ipv4/tcp_bpf.c Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- net/ipv4/tcp_bpf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 1a8f129fb309..89bbb8ee1634 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -275,6 +275,9 @@ static int tcp_bpf_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, if (unlikely(flags & MSG_ERRQUEUE)) return inet_recv_error(sk, msg, len, addr_len); + if (!len) + return 0; + psock = sk_psock_get(sk); if (unlikely(!psock)) return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len); -- 2.25.1

1 35

[PATCH openEuler-5.10-LTS 01/36] bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
by Jialin Zhang 29 Mar '23

29 Mar '23

From: Liu Jian <liujian56(a)huawei.com> mainline inclusion from mainline-v6.3-rc2 commit d900f3d20cc3169ce42ec72acc850e662a4d4db2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I65HYE CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- When the buffer length of the recvmsg system call is 0, we got the flollowing soft lockup problem: watchdog: BUG: soft lockup - CPU#3 stuck for 27s! [a.out:6149] CPU: 3 PID: 6149 Comm: a.out Kdump: loaded Not tainted 6.2.0+ #30 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:remove_wait_queue+0xb/0xc0 Code: 5e 41 5f c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 57 <41> 56 41 55 41 54 55 48 89 fd 53 48 89 f3 4c 8d 6b 18 4c 8d 73 20 RSP: 0018:ffff88811b5978b8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff88811a7d3780 RCX: ffffffffb7a4d768 RDX: dffffc0000000000 RSI: ffff88811b597908 RDI: ffff888115408040 RBP: 1ffff110236b2f1b R08: 0000000000000000 R09: ffff88811a7d37e7 R10: ffffed10234fa6fc R11: 0000000000000001 R12: ffff88811179b800 R13: 0000000000000001 R14: ffff88811a7d38a8 R15: ffff88811a7d37e0 FS: 00007f6fb5398740(0000) GS:ffff888237180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000000 CR3: 000000010b6ba002 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tcp_msg_wait_data+0x279/0x2f0 tcp_bpf_recvmsg_parser+0x3c6/0x490 inet_recvmsg+0x280/0x290 sock_recvmsg+0xfc/0x120 ____sys_recvmsg+0x160/0x3d0 ___sys_recvmsg+0xf0/0x180 __sys_recvmsg+0xea/0x1a0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc The logic in tcp_bpf_recvmsg_parser is as follows: msg_bytes_ready: copied = sk_msg_recvmsg(sk, psock, msg, len, flags); if (!copied) { wait data; goto msg_bytes_ready; } In this case, "copied" always is 0, the infinite loop occurs. According to the Linux system call man page, 0 should be returned in this case. Therefore, in tcp_bpf_recvmsg_parser(), if the length is 0, directly return. Also modify several other functions with the same problem. Fixes: 1f5be6b3b063 ("udp: Implement udp_bpf_recvmsg() for sockmap") Fixes: 9825d866ce0d ("af_unix: Implement unix_dgram_bpf_recvmsg()") Fixes: c5d2177a72a1 ("bpf, sockmap: Fix race in ingress receive verdict with redirect to self") Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: John Fastabend <john.fastabend(a)gmail.com> Cc: Jakub Sitnicki <jakub(a)cloudflare.com> Link: https://lore.kernel.org/bpf/20230303080946.1146638-1-liujian56@huawei.com (cherry picked from commit d900f3d20cc3169ce42ec72acc850e662a4d4db2) Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: net/ipv4/udp_bpf.c net/unix/unix_bpf.c net/ipv4/tcp_bpf.c Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- net/ipv4/tcp_bpf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index eaf2308c355a..ddb1730cdf9b 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -273,6 +273,9 @@ static int tcp_bpf_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, if (unlikely(flags & MSG_ERRQUEUE)) return inet_recv_error(sk, msg, len, addr_len); + if (!len) + return 0; + psock = sk_psock_get(sk); if (unlikely(!psock)) return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len); -- 2.25.1

1 35

[PATCH openEuler-22.03-LTS-SP1 00/39] ascend features send to
by Zhang Zekun 29 Mar '23

29 Mar '23

Push some of ascend features to openEuler Bixuan Cui (1): open modules for sig Chen Jun (4): mm/sharepool: Fix a double free problem caused by init_local_group mm/sharepool: use delete_spg_node to replace some repetitive code mm/sharepool: extract group_add_task mm/sharepool: check permission of task to operate spg_node->proc_node Fang Lijun (2): enable fdm in panic HZ 12 Jian Zhang (5): drivers: add RAS support for multiple die cpu bugfix for RAS acpi map add SDMA support for 1980B using mm's pasid rather than a random value when using SDMA kernel/sdei: enable SDEI for nmi Lijun Fang (1): modify ascend910 ARCH_NR_GPIOS Wang Wensheng (11): char/sdma: Add driver framework for sdma char/sdma: Implement probe function for sdma device char/sdma: Implement sdma_memcpy for kernel-space usage char/sdma: Export the sdma features to userspace via ioctl char/sdma: Add support for ACPI char/sdma: Support multiple sdma devices char/sdma: Add deffer probe feature char/sdma: Add discrete memcpy interface for userspace char/sdma: Pin pages when copying user memory memcg/ascend: Support not account pages of cdm for memcg mm/cdm: Extend cdm-nodes to support more nodes than 64 Xiang Rui (1): Add kernel securec support for 1980. Xingang Wang (1): ascend_mpam: Add dts driver to traverse accelerators Xu Qiang (1): Fix kernel boot failed in fpga. Yuan Can (4): driver/iommu: Introduce IOMMU_SVA_FEAT_SVSP feature driver/svm: save svsp_mm in mm and release it in __mmput Add bootdot support for ascend 310B Set bootdot base to 10 Zhang Jian (2): drivers: apci parse apei table drivers: acpi register irq Zhou Guanghui (5): Modify memblock number driver/svm: support SVSP feature, interface definition driver/svm: reserve address range for svsp efi: when kaslr is enabled, restrict the random address range. mm/hugetlb: support disable clear hugepage chenjunwei (1): ascend310B_defconfig .../admin-guide/kernel-parameters.txt | 1 + arch/arm64/Kconfig | 30 + arch/arm64/configs/ascend310B_defconfig | 7040 +++++++++++++++++ arch/arm64/kernel/acpi.c | 5 + arch/arm64/kernel/sdei.c | 11 - arch/arm64/mm/init.c | 5 + arch/arm64/mm/numa.c | 39 +- certs/Makefile | 3 +- drivers/Kconfig | 3 + drivers/Makefile | 2 + drivers/acpi/Kconfig | 11 + drivers/acpi/Makefile | 1 + drivers/acpi/apei/ghes.c | 47 +- drivers/acpi/apei/hest.c | 35 + drivers/acpi/dt_apei.c | 201 + drivers/bootdot/Kconfig | 7 + drivers/bootdot/Makefile | 2 + drivers/bootdot/bootdot.c | 447 ++ drivers/char/Kconfig | 6 + drivers/char/Makefile | 1 + drivers/char/sdma.c | 1088 +++ .../firmware/efi/libstub/efi-stub-helper.c | 3 + drivers/firmware/efi/libstub/efistub.h | 1 + drivers/firmware/efi/libstub/randomalloc.c | 11 + drivers/gpio/gpiolib.c | 45 +- drivers/hisi/Kconfig | 16 + drivers/hisi/Makefile | 1 + drivers/hisi/securec/Kconfig | 1 + drivers/hisi/securec/Makefile | 1 + drivers/hisi/securec/src | 1 + drivers/iommu/Kconfig | 7 + drivers/iommu/Makefile | 1 + .../iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 35 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 16 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 8 + drivers/iommu/ascend_mpam.c | 286 + drivers/irqchip/irq-gic-v3-its.c | 13 +- fs/hugetlbfs/inode.c | 12 +- include/acpi/apei.h | 7 + include/acpi/dt_apei.h | 31 + include/asm-generic/gpio.h | 13 + include/linux/ascend_smmu.h | 38 + include/linux/bootdot.h | 40 + include/linux/hisi_sdma.h | 42 + include/linux/init.h | 1 + include/linux/iommu.h | 1 + include/linux/kernel.h | 6 + include/linux/mm_types.h | 4 + include/linux/mman.h | 46 + include/linux/securec.h | 1 + include/linux/securectype.h | 1 + include/uapi/asm-generic/mman-common.h | 1 + kernel/Kconfig.hz | 6 + kernel/fork.c | 13 + kernel/panic.c | 31 + mm/hugetlb.c | 2 + mm/memblock.c | 2 +- mm/memcontrol.c | 8 + mm/mmap.c | 32 +- mm/share_pool.c | 105 +- 60 files changed, 9806 insertions(+), 68 deletions(-) create mode 100644 arch/arm64/configs/ascend310B_defconfig create mode 100644 drivers/acpi/dt_apei.c create mode 100644 drivers/bootdot/Kconfig create mode 100644 drivers/bootdot/Makefile create mode 100644 drivers/bootdot/bootdot.c create mode 100644 drivers/char/sdma.c create mode 100644 drivers/hisi/Kconfig create mode 100644 drivers/hisi/Makefile create mode 100644 drivers/hisi/securec/Kconfig create mode 100644 drivers/hisi/securec/Makefile create mode 120000 drivers/hisi/securec/src create mode 100644 drivers/iommu/ascend_mpam.c create mode 100644 include/acpi/dt_apei.h create mode 100644 include/linux/bootdot.h create mode 100644 include/linux/hisi_sdma.h create mode 120000 include/linux/securec.h create mode 120000 include/linux/securectype.h -- 2.17.1

1 39

[PATCH openEuler-1.0-LTS 0/3] CVE-2023-1281
by Zhang Changzhong 28 Mar '23

28 Mar '23

Paul E. McKenney (1): rcu: Upgrade rcu_swap_protected() to rcu_replace_pointer() Pedro Tammela (2): net/sched: tcindex: update imperfect hash filters respecting rcu net/sched: tcindex: search key must be 16 bits include/linux/rcupdate.h | 18 ++++++++++++++++++ net/sched/cls_tcindex.c | 34 ++++++++++++++++++++++++++++++---- 2 files changed, 48 insertions(+), 4 deletions(-) -- 2.9.5

1 3

[PATCH OLK-5.10 v2 00/14] test patchwork->PR function v2
by Jialin Zhang 27 Mar '23

27 Mar '23

Send 14 patches to test patchwork->PR function Baisong Zhong (1): media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() Chen Zhongjin (1): ftrace: Fix invalid address access in lookup_rec() when index is 0 Darrick J. Wong (1): ext4: fix another off-by-one fsmap error on 1k block filesystems David Hildenbrand (2): mm: optimize do_wp_page() for exclusive pages in the swapcache mm: optimize do_wp_page() for fresh pages in local LRU pagevecs Kuniyuki Iwashima (1): seccomp: Move copy_seccomp() to no failure path. Luke D. Jones (1): HID: asus: Remove check for same LED brightness on set Nicholas Piggin (1): mm/vmalloc: huge vmalloc backing pages should be split rather than compound Pietro Borrello (2): HID: asus: use spinlock to protect concurrent accesses HID: asus: use spinlock to safely schedule workers Xin Long (2): tipc: set con sock in tipc_conn_alloc tipc: add an extra conn_get in tipc_conn_alloc Zheng Yejian (1): livepatch/core: Fix hungtask against cpu hotplug on x86 Zhihao Cheng (1): jbd2: fix data missing when reusing bh which is ready to be checkpointed drivers/hid/hid-asus.c | 38 ++++++++++++++++++----- drivers/media/usb/dvb-usb/az6027.c | 4 +++ fs/ext4/fsmap.c | 2 ++ fs/jbd2/transaction.c | 50 +++++++++++++++++------------- kernel/fork.c | 17 ++++++---- kernel/livepatch/core.c | 36 ++++++++++++++------- kernel/trace/ftrace.c | 3 +- mm/memory.c | 28 +++++++++++++---- mm/vmalloc.c | 22 ++++++++++--- net/tipc/topsrv.c | 20 ++++++------ 10 files changed, 154 insertions(+), 66 deletions(-) -- 2.25.1

1 14

[PATCH openEuler-1.0-LTS 00/35] CVE-2022-29901
by Yongqiang Liu 25 Mar '23

25 Mar '23

CVE-2022-29901 Alexandre Chartre (2): x86/bugs: Report AMD retbleed vulnerability x86/bugs: Add AMD retbleed= boot parameter Andrew Cooper (1): x86/cpu/amd: Enumerate BTC_NO Daniel Sneddon (1): x86/speculation: Add RSB VM Exit protections Ingo Molnar (1): x86/cpufeature: Fix various quality problems in the <asm/cpu_device_hd.h> header Josh Poimboeuf (8): x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n x86/speculation: Fix firmware entry SPEC_CTRL handling x86/speculation: Fix SPEC_CTRL write on SMT state change x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit x86/speculation: Remove x86_spec_ctrl_mask KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS KVM: VMX: Fix IBRS handling after vmexit x86/speculation: Fill RSB on vmexit for IBRS Kan Liang (1): x86/cpufeature: Add facility to check for min microcode revisions Mark Gross (1): x86/cpu: Add a steppings field to struct x86_cpu_id Nathan Chancellor (1): x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current Pawan Gupta (4): x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS x86/bugs: Add Cannon lake to RETBleed affected CPU list x86/speculation: Disable RRSBA behavior x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts Peter Zijlstra (11): x86/nospec: Fix i386 RSB stuffing x86/cpufeatures: Move RETPOLINE flags to word 11 x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value x86/entry: Remove skip_r11rcx x86/entry: Add kernel IBRS implementation x86/bugs: Optimize SPEC_CTRL MSR writes x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() x86/bugs: Report Intel retbleed vulnerability intel_idle: Disable IBRS during long idle x86/speculation: Change FILL_RETURN_BUFFER to work with objtool x86/common: Stamp out the stepping madness Suleiman Souhlal (2): Revert "x86/speculation: Add RSB VM Exit protections" Revert "x86/cpu: Add a steppings field to struct x86_cpu_id" Thomas Gleixner (2): x86/devicetable: Move x86 specific macro out of generic code x86/cpu: Add consistent CPU match macros .../admin-guide/kernel-parameters.txt | 13 + arch/x86/entry/calling.h | 68 +++- arch/x86/entry/entry_32.S | 2 - arch/x86/entry/entry_64.S | 34 +- arch/x86/entry/entry_64_compat.S | 11 +- arch/x86/include/asm/cpu_device_id.h | 168 +++++++- arch/x86/include/asm/cpufeatures.h | 18 +- arch/x86/include/asm/intel-family.h | 6 + arch/x86/include/asm/msr-index.h | 10 + arch/x86/include/asm/nospec-branch.h | 67 ++-- arch/x86/kernel/cpu/amd.c | 21 +- arch/x86/kernel/cpu/bugs.c | 368 ++++++++++++++---- arch/x86/kernel/cpu/common.c | 72 ++-- arch/x86/kernel/cpu/match.c | 44 ++- arch/x86/kernel/cpu/scattered.c | 1 + arch/x86/kernel/process.c | 2 +- arch/x86/kvm/svm.c | 1 + arch/x86/kvm/vmx.c | 53 ++- arch/x86/kvm/x86.c | 2 +- drivers/base/cpu.c | 8 + drivers/cpufreq/acpi-cpufreq.c | 1 + drivers/cpufreq/amd_freq_sensitivity.c | 1 + drivers/idle/intel_idle.c | 43 +- include/linux/cpu.h | 2 + include/linux/kvm_host.h | 2 +- include/linux/mod_devicetable.h | 4 +- tools/arch/x86/include/asm/cpufeatures.h | 2 +- 27 files changed, 832 insertions(+), 192 deletions(-) -- 2.25.1

1 35

[PATCH openEuler-1.0-LTS 1/2] ext4: commit super block if fs record error when journal record without error
by Yongqiang Liu 25 Mar '23

25 Mar '23

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v6.3-rc2 commit eee00237fa5ec8f704f7323b54e48cc34e2d9168 category: bugfix bugzilla: 188471,https://gitee.com/openeuler/kernel/issues/I6MR1V CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Now, 'es->s_state' maybe covered by recover journal. And journal errno maybe not recorded in journal sb as IO error. ext4_update_super() only update error information when 'sbi->s_add_error_count' large than zero. Then 'EXT4_ERROR_FS' flag maybe lost. To solve above issue just recover 'es->s_state' error flag after journal replay like error info. Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20230307061703.245965-2-yebin@huaweicloud.com Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/super.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 594fc6dd0e9f..31a4725da745 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5161,6 +5161,7 @@ static int ext4_load_journal(struct super_block *sb, err = jbd2_journal_wipe(journal, !really_read_only); if (!err) { char *save = kmalloc(EXT4_S_ERR_LEN, GFP_KERNEL); + if (save) memcpy(save, ((char *) es) + EXT4_S_ERR_START, EXT4_S_ERR_LEN); @@ -5169,6 +5170,14 @@ static int ext4_load_journal(struct super_block *sb, memcpy(((char *) es) + EXT4_S_ERR_START, save, EXT4_S_ERR_LEN); kfree(save); + es->s_state |= cpu_to_le16(EXT4_SB(sb)->s_mount_state & + EXT4_ERROR_FS); + /* Write out restored error information to the superblock */ + if (!bdev_read_only(sb->s_bdev)) { + int err2; + err2 = ext4_commit_super(sb); + err = err ? : err2; + } } if (err) { -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 01/10] scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list
by Yongqiang Liu 25 Mar '23

25 Mar '23

From: Xingui Yang <yangxingui(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6J1SI CVE: NA ---------------------------- When the IO complete and free slot in function slot_complete_v3_hw(), it is possible that sas_dev.list is being traversed elsewhere, and it may trigger a null pointer exception, such as follows: ==>cq thread ==>scsi_eh_6 ==>scsi_error_handler() ==>sas_eh_handle_sas_errors() ==>sas_scsi_find_task() ==>lldd_abort_task() ==>slot_complete_v3_hw() ==>hisi_sas_abort_task() ==>hisi_sas_slot_task_free() ==>dereg_device_v3_hw() ==>list_del_init() ==>list_for_each_entry_safe() [ 7165.434918] sas: Enter sas_scsi_recover_host busy: 32 failed: 32 [ 7165.434926] sas: trying to find task 0x00000000769b5ba5 [ 7165.434927] sas: sas_scsi_find_task: aborting task 0x00000000769b5ba5 [ 7165.434940] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(00000000769b5ba5) aborted [ 7165.434964] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(00000000c9f7aa07) ignored [ 7165.434965] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(00000000e2a1cf01) ignored [ 7165.434968] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 7165.434972] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(0000000022d52d93) ignored [ 7165.434975] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(0000000066a7516c) ignored [ 7165.434976] Mem abort info: [ 7165.434982] ESR = 0x96000004 [ 7165.434991] Exception class = DABT (current EL), IL = 32 bits [ 7165.434992] SET = 0, FnV = 0 [ 7165.434993] EA = 0, S1PTW = 0 [ 7165.434994] Data abort info: [ 7165.434994] ISV = 0, ISS = 0x00000004 [ 7165.434995] CM = 0, WnR = 0 [ 7165.434997] user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000f29543f2 [ 7165.434998] [0000000000000000] pgd=0000000000000000 [ 7165.435003] Internal error: Oops: 96000004 [#1] SMP [ 7165.439863] Process scsi_eh_6 (pid: 4109, stack limit = 0x00000000c43818d5) [ 7165.468862] pstate: 00c00009 (nzcv daif +PAN +UAO) [ 7165.473637] pc : dereg_device_v3_hw+0x68/0xa8 [hisi_sas_v3_hw] [ 7165.479443] lr : dereg_device_v3_hw+0x2c/0xa8 [hisi_sas_v3_hw] [ 7165.485247] sp : ffff00001d623bc0 [ 7165.488546] x29: ffff00001d623bc0 x28: ffffa027d03b9508 [ 7165.493835] x27: ffff80278ed50af0 x26: ffffa027dd31e0a8 [ 7165.499123] x25: ffffa027d9b27f88 x24: ffffa027d9b209f8 [ 7165.504411] x23: ffffa027c45b0d60 x22: ffff80278ec07c00 [ 7165.509700] x21: 0000000000000008 x20: ffffa027d9b209f8 [ 7165.514988] x19: ffffa027d9b27f88 x18: ffffffffffffffff [ 7165.520276] x17: 0000000000000000 x16: 0000000000000000 [ 7165.525564] x15: ffff0000091d9708 x14: ffff0000093b7dc8 [ 7165.530852] x13: ffff0000093b7a23 x12: 6e7265746e692067 [ 7165.536140] x11: 0000000000000000 x10: 0000000000000bb0 [ 7165.541429] x9 : ffff00001d6238f0 x8 : ffffa027d877af00 [ 7165.546718] x7 : ffffa027d6329600 x6 : ffff7e809f58ca00 [ 7165.552006] x5 : 0000000000001f8a x4 : 000000000000088e [ 7165.557295] x3 : ffffa027d9b27fa8 x2 : 0000000000000000 [ 7165.562583] x1 : 0000000000000000 x0 : 000000003000188e [ 7165.567872] Call trace: [ 7165.570309] dereg_device_v3_hw+0x68/0xa8 [hisi_sas_v3_hw] [ 7165.575775] hisi_sas_abort_task+0x248/0x358 [hisi_sas_main] [ 7165.581415] sas_eh_handle_sas_errors+0x258/0x8e0 [libsas] [ 7165.586876] sas_scsi_recover_host+0x134/0x458 [libsas] [ 7165.592082] scsi_error_handler+0xb4/0x488 [ 7165.596163] kthread+0x134/0x138 [ 7165.599380] ret_from_fork+0x10/0x18 [ 7165.602940] Code: d5033e9f b9000040 aa0103e2 eb03003f (f9400021) [ 7165.609004] kernel fault(0x1) notification starting on CPU 75 [ 7165.700728] ---[ end trace fc042cbbea224efc ]--- [ 7165.705326] Kernel panic - not syncing: Fatal exception So grab sas_dev lock when traversing the members of sas_dev.list in dereg_device_v3_hw() and hisi_sas_release_tasks() to avoid concurrency of adding and deleting member, which may cause an exception. And when hisi_sas_release_tasks() call hisi_sas_do_release_task() to free slot, the lock cannot be grabbed again in hisi_sas_slot_task_free(), then a bool parameter need_lock is added. Signed-off-by: Xingui Yang <yangxingui(a)huawei.com> Reviewed-by: kang fenglong <kangfenglong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas.h | 3 ++- drivers/scsi/hisi_sas/hisi_sas_main.c | 26 +++++++++++++++++--------- drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 5 ++++- 5 files changed, 25 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h index 533408277156..2880e4e22a73 100644 --- a/drivers/scsi/hisi_sas/hisi_sas.h +++ b/drivers/scsi/hisi_sas/hisi_sas.h @@ -601,7 +601,8 @@ extern void hisi_sas_phy_enable(struct hisi_hba *hisi_hba, int phy_no, extern void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy); extern void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, - struct hisi_sas_slot *slot); + struct hisi_sas_slot *slot, + bool need_lock); extern void hisi_sas_init_mem(struct hisi_hba *hisi_hba); extern void hisi_sas_rst_work_handler(struct work_struct *work); extern void hisi_sas_sync_rst_work_handler(struct work_struct *work); diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index e6ccaedcd8b9..b00bf3b0f418 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -229,7 +229,7 @@ static void hisi_sas_slot_index_init(struct hisi_hba *hisi_hba) } void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, - struct hisi_sas_slot *slot) + struct hisi_sas_slot *slot, bool need_lock) { unsigned long flags; int device_id = slot->device_id; @@ -260,9 +260,13 @@ void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, struct sas_task *task, } } - spin_lock_irqsave(&sas_dev->lock, flags); - list_del_init(&slot->entry); - spin_unlock_irqrestore(&sas_dev->lock, flags); + if (need_lock) { + spin_lock_irqsave(&sas_dev->lock, flags); + list_del_init(&slot->entry); + spin_unlock_irqrestore(&sas_dev->lock, flags); + } else { + list_del_init(&slot->entry); + } memset(slot, 0, offsetof(struct hisi_sas_slot, buf)); @@ -989,7 +993,7 @@ static void hisi_sas_port_notify_formed(struct asd_sas_phy *sas_phy) } static void hisi_sas_do_release_task(struct hisi_hba *hisi_hba, struct sas_task *task, - struct hisi_sas_slot *slot) + struct hisi_sas_slot *slot, bool need_lock) { if (task) { unsigned long flags; @@ -1011,7 +1015,7 @@ static void hisi_sas_do_release_task(struct hisi_hba *hisi_hba, struct sas_task task->task_done(task); } - hisi_sas_slot_task_free(hisi_hba, task, slot); + hisi_sas_slot_task_free(hisi_hba, task, slot, need_lock); } static void hisi_sas_release_task(struct hisi_hba *hisi_hba, @@ -1019,9 +1023,13 @@ static void hisi_sas_release_task(struct hisi_hba *hisi_hba, { struct hisi_sas_slot *slot, *slot2; struct hisi_sas_device *sas_dev = device->lldd_dev; + unsigned long flags; + spin_lock_irqsave(&sas_dev->lock, flags); list_for_each_entry_safe(slot, slot2, &sas_dev->list, entry) - hisi_sas_do_release_task(hisi_hba, slot->task, slot); + hisi_sas_do_release_task(hisi_hba, slot->task, slot, false); + + spin_unlock_irqrestore(&sas_dev->lock, flags); } void hisi_sas_release_tasks(struct hisi_hba *hisi_hba) @@ -1701,7 +1709,7 @@ static int hisi_sas_abort_task(struct sas_task *task) */ if (rc == TMF_RESP_FUNC_COMPLETE && rc2 != TMF_RESP_FUNC_SUCC) { if (task->lldd_task) - hisi_sas_do_release_task(hisi_hba, task, slot); + hisi_sas_do_release_task(hisi_hba, task, slot, true); } } else if (task->task_proto & SAS_PROTOCOL_SATA || task->task_proto & SAS_PROTOCOL_STP) { @@ -1722,7 +1730,7 @@ static int hisi_sas_abort_task(struct sas_task *task) */ if ((sas_dev->dev_status == HISI_SAS_DEV_NCQ_ERR) && qc && qc->scsicmd) { - hisi_sas_do_release_task(hisi_hba, task, slot); + hisi_sas_do_release_task(hisi_hba, task, slot, true); rc = TMF_RESP_FUNC_COMPLETE; } else { rc = hisi_sas_softreset_ata_disk(device); diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c index 452665c641a6..6485e2b6456c 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c @@ -1320,7 +1320,7 @@ static int slot_complete_v1_hw(struct hisi_hba *hisi_hba, } out: - hisi_sas_slot_task_free(hisi_hba, task, slot); + hisi_sas_slot_task_free(hisi_hba, task, slot, true); sts = ts->stat; if (task->task_done) diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c index 46d274582684..2df70c4873f5 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c @@ -2480,7 +2480,7 @@ slot_complete_v2_hw(struct hisi_hba *hisi_hba, struct hisi_sas_slot *slot) } task->task_state_flags |= SAS_TASK_STATE_DONE; spin_unlock_irqrestore(&task->task_state_lock, flags); - hisi_sas_slot_task_free(hisi_hba, task, slot); + hisi_sas_slot_task_free(hisi_hba, task, slot, true); if (!is_internal && (task->task_proto != SAS_PROTOCOL_SMP)) { spin_lock_irqsave(&device->done_lock, flags); diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index 77f451040c4c..de88dead4b72 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -914,9 +914,11 @@ static void dereg_device_v3_hw(struct hisi_hba *hisi_hba, struct hisi_sas_slot *slot, *slot2; struct hisi_sas_device *sas_dev = device->lldd_dev; u32 cfg_abt_set_query_iptt; + unsigned long flags; cfg_abt_set_query_iptt = hisi_sas_read32(hisi_hba, CFG_ABT_SET_QUERY_IPTT); + spin_lock_irqsave(&sas_dev->lock, flags); list_for_each_entry_safe(slot, slot2, &sas_dev->list, entry) { cfg_abt_set_query_iptt &= ~CFG_SET_ABORTED_IPTT_MSK; cfg_abt_set_query_iptt |= (1 << CFG_SET_ABORTED_EN_OFF) | @@ -924,6 +926,7 @@ static void dereg_device_v3_hw(struct hisi_hba *hisi_hba, hisi_sas_write32(hisi_hba, CFG_ABT_SET_QUERY_IPTT, cfg_abt_set_query_iptt); } + spin_unlock_irqrestore(&sas_dev->lock, flags); cfg_abt_set_query_iptt &= ~(1 << CFG_SET_ABORTED_EN_OFF); hisi_sas_write32(hisi_hba, CFG_ABT_SET_QUERY_IPTT, cfg_abt_set_query_iptt); @@ -2558,7 +2561,7 @@ slot_complete_v3_hw(struct hisi_hba *hisi_hba, struct hisi_sas_slot *slot) } task->task_state_flags |= SAS_TASK_STATE_DONE; spin_unlock_irqrestore(&task->task_state_lock, flags); - hisi_sas_slot_task_free(hisi_hba, task, slot); + hisi_sas_slot_task_free(hisi_hba, task, slot, true); if (!is_internal && (task->task_proto != SAS_PROTOCOL_SMP)) { spin_lock_irqsave(&device->done_lock, flags); -- 2.25.1

1 9

[PATCH openEuler-1.0-LTS 1/6] net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
by Yongqiang Liu 25 Mar '23

25 Mar '23

From: Hangyu Hua <hbh25y(a)gmail.com> mainline inclusion from mainline-v6.3-rc2 commit 49c47cc21b5b7a3d8deb18fc57b0aa2ab1286962 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6NIUR CVE: CVE-2023-28466 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ctx->crypto_send.info is not protected by lock_sock in do_tls_getsockopt_conf(). A race condition between do_tls_getsockopt_conf() and error paths of do_tls_setsockopt_conf() may lead to a use-after-free or null-deref. More discussion: https://lore.kernel.org/all/Y/ht6gQL+u6fj3dG@hog/ Fixes: 3c4d7559159b ("tls: kernel TLS support") Signed-off-by: Hangyu Hua <hbh25y(a)gmail.com> Link: https://lore.kernel.org/r/20230228023344.9623-1-hbh25y@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: net/tls/tls_main.c Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/tls/tls_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c index 3cf4916c541b..19646ef9f6f6 100644 --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c @@ -364,13 +364,11 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval, rc = -EINVAL; goto out; } - lock_sock(sk); memcpy(crypto_info_aes_gcm_128->iv, ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, TLS_CIPHER_AES_GCM_128_IV_SIZE); memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->tx.rec_seq, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); - release_sock(sk); if (copy_to_user(optval, crypto_info_aes_gcm_128, sizeof(*crypto_info_aes_gcm_128))) @@ -390,6 +388,8 @@ static int do_tls_getsockopt(struct sock *sk, int optname, { int rc = 0; + lock_sock(sk); + switch (optname) { case TLS_TX: rc = do_tls_getsockopt_tx(sk, optval, optlen); @@ -398,6 +398,9 @@ static int do_tls_getsockopt(struct sock *sk, int optname, rc = -ENOPROTOOPT; break; } + + release_sock(sk); + return rc; } -- 2.25.1

1 5

[PATCH openEuler-1.0-LTS] wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
by Yongqiang Liu 23 Mar '23

23 Mar '23

From: Jisoo Jang <jisoo.jang(a)yonsei.ac.kr> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6NCVX CVE: CVE-2023-1380 Reference: https://patchwork.kernel.org/project/linux-wireless/patch/20230309104457.22… -------------------------------- Fix a slab-out-of-bounds read that occurs in kmemdup() called from brcmf_get_assoc_ies(). The bug could occur when assoc_info->req_len, data from a URB provided by a USB device, is bigger than the size of buffer which is defined as WL_EXTRA_BUF_MAX. Add the size check for req_len/resp_len of assoc_info. Found by a modified version of syzkaller. [ 46.592467][ T7] ================================================================== [ 46.594687][ T7] BUG: KASAN: slab-out-of-bounds in kmemdup+0x3e/0x50 [ 46.596572][ T7] Read of size 3014656 at addr ffff888019442000 by task kworker/0:1/7 [ 46.598575][ T7] [ 46.599157][ T7] CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G O 5.14.0+ #145 [ 46.601333][ T7] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 46.604360][ T7] Workqueue: events brcmf_fweh_event_worker [ 46.605943][ T7] Call Trace: [ 46.606584][ T7] dump_stack_lvl+0x8e/0xd1 [ 46.607446][ T7] print_address_description.constprop.0.cold+0x93/0x334 [ 46.608610][ T7] ? kmemdup+0x3e/0x50 [ 46.609341][ T7] kasan_report.cold+0x79/0xd5 [ 46.610151][ T7] ? kmemdup+0x3e/0x50 [ 46.610796][ T7] kasan_check_range+0x14e/0x1b0 [ 46.611691][ T7] memcpy+0x20/0x60 [ 46.612323][ T7] kmemdup+0x3e/0x50 [ 46.612987][ T7] brcmf_get_assoc_ies+0x967/0xf60 [ 46.613904][ T7] ? brcmf_notify_vif_event+0x3d0/0x3d0 [ 46.614831][ T7] ? lock_chain_count+0x20/0x20 [ 46.615683][ T7] ? mark_lock.part.0+0xfc/0x2770 [ 46.616552][ T7] ? lock_chain_count+0x20/0x20 [ 46.617409][ T7] ? mark_lock.part.0+0xfc/0x2770 [ 46.618244][ T7] ? lock_chain_count+0x20/0x20 [ 46.619024][ T7] brcmf_bss_connect_done.constprop.0+0x241/0x2e0 [ 46.620019][ T7] ? brcmf_parse_configure_security.isra.0+0x2a0/0x2a0 [ 46.620818][ T7] ? __lock_acquire+0x181f/0x5790 [ 46.621462][ T7] brcmf_notify_connect_status+0x448/0x1950 [ 46.622134][ T7] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 46.622736][ T7] ? brcmf_cfg80211_join_ibss+0x7b0/0x7b0 [ 46.623390][ T7] ? find_held_lock+0x2d/0x110 [ 46.623962][ T7] ? brcmf_fweh_event_worker+0x19f/0xc60 [ 46.624603][ T7] ? mark_held_locks+0x9f/0xe0 [ 46.625145][ T7] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 46.625871][ T7] ? brcmf_cfg80211_join_ibss+0x7b0/0x7b0 [ 46.626545][ T7] brcmf_fweh_call_event_handler.isra.0+0x90/0x100 [ 46.627338][ T7] brcmf_fweh_event_worker+0x557/0xc60 [ 46.627962][ T7] ? brcmf_fweh_call_event_handler.isra.0+0x100/0x100 [ 46.628736][ T7] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 46.629396][ T7] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 46.629970][ T7] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 46.630649][ T7] process_one_work+0x92b/0x1460 [ 46.631205][ T7] ? pwq_dec_nr_in_flight+0x330/0x330 [ 46.631821][ T7] ? rwlock_bug.part.0+0x90/0x90 [ 46.632347][ T7] worker_thread+0x95/0xe00 [ 46.632832][ T7] ? __kthread_parkme+0x115/0x1e0 [ 46.633393][ T7] ? process_one_work+0x1460/0x1460 [ 46.633957][ T7] kthread+0x3a1/0x480 [ 46.634369][ T7] ? set_kthread_struct+0x120/0x120 [ 46.634933][ T7] ret_from_fork+0x1f/0x30 [ 46.635431][ T7] [ 46.635687][ T7] Allocated by task 7: [ 46.636151][ T7] kasan_save_stack+0x1b/0x40 [ 46.636628][ T7] __kasan_kmalloc+0x7c/0x90 [ 46.637108][ T7] kmem_cache_alloc_trace+0x19e/0x330 [ 46.637696][ T7] brcmf_cfg80211_attach+0x4a0/0x4040 [ 46.638275][ T7] brcmf_attach+0x389/0xd40 [ 46.638739][ T7] brcmf_usb_probe+0x12de/0x1690 [ 46.639279][ T7] usb_probe_interface+0x2aa/0x760 [ 46.639820][ T7] really_probe+0x205/0xb70 [ 46.640342][ T7] __driver_probe_device+0x311/0x4b0 [ 46.640876][ T7] driver_probe_device+0x4e/0x150 [ 46.641445][ T7] __device_attach_driver+0x1cc/0x2a0 [ 46.642000][ T7] bus_for_each_drv+0x156/0x1d0 [ 46.642543][ T7] __device_attach+0x23f/0x3a0 [ 46.643065][ T7] bus_probe_device+0x1da/0x290 [ 46.643644][ T7] device_add+0xb7b/0x1eb0 [ 46.644130][ T7] usb_set_configuration+0xf59/0x16f0 [ 46.644720][ T7] usb_generic_driver_probe+0x82/0xa0 [ 46.645295][ T7] usb_probe_device+0xbb/0x250 [ 46.645786][ T7] really_probe+0x205/0xb70 [ 46.646258][ T7] __driver_probe_device+0x311/0x4b0 [ 46.646804][ T7] driver_probe_device+0x4e/0x150 [ 46.647387][ T7] __device_attach_driver+0x1cc/0x2a0 [ 46.647926][ T7] bus_for_each_drv+0x156/0x1d0 [ 46.648454][ T7] __device_attach+0x23f/0x3a0 [ 46.648939][ T7] bus_probe_device+0x1da/0x290 [ 46.649478][ T7] device_add+0xb7b/0x1eb0 [ 46.649936][ T7] usb_new_device.cold+0x49c/0x1029 [ 46.650526][ T7] hub_event+0x1c98/0x3950 [ 46.650975][ T7] process_one_work+0x92b/0x1460 [ 46.651535][ T7] worker_thread+0x95/0xe00 [ 46.651991][ T7] kthread+0x3a1/0x480 [ 46.652413][ T7] ret_from_fork+0x1f/0x30 [ 46.652885][ T7] [ 46.653131][ T7] The buggy address belongs to the object at ffff888019442000 [ 46.653131][ T7] which belongs to the cache kmalloc-2k of size 2048 [ 46.654669][ T7] The buggy address is located 0 bytes inside of [ 46.654669][ T7] 2048-byte region [ffff888019442000, ffff888019442800) [ 46.656137][ T7] The buggy address belongs to the page: [ 46.656720][ T7] page:ffffea0000651000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x19440 [ 46.657792][ T7] head:ffffea0000651000 order:3 compound_mapcount:0 compound_pincount:0 [ 46.658673][ T7] flags: 0x100000000010200(slab|head|node=0|zone=1) [ 46.659422][ T7] raw: 0100000000010200 0000000000000000 dead000000000122 ffff888100042000 [ 46.660363][ T7] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 46.661236][ T7] page dumped because: kasan: bad access detected [ 46.661956][ T7] page_owner tracks the page as allocated [ 46.662588][ T7] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 7, ts 31136961085, free_ts 0 [ 46.664271][ T7] prep_new_page+0x1aa/0x240 [ 46.664763][ T7] get_page_from_freelist+0x159a/0x27c0 [ 46.665340][ T7] __alloc_pages+0x2da/0x6a0 [ 46.665847][ T7] alloc_pages+0xec/0x1e0 [ 46.666308][ T7] allocate_slab+0x380/0x4e0 [ 46.666770][ T7] ___slab_alloc+0x5bc/0x940 [ 46.667264][ T7] __slab_alloc+0x6d/0x80 [ 46.667712][ T7] kmem_cache_alloc_trace+0x30a/0x330 [ 46.668299][ T7] brcmf_usbdev_qinit.constprop.0+0x50/0x470 [ 46.668885][ T7] brcmf_usb_probe+0xc97/0x1690 [ 46.669438][ T7] usb_probe_interface+0x2aa/0x760 [ 46.669988][ T7] really_probe+0x205/0xb70 [ 46.670487][ T7] __driver_probe_device+0x311/0x4b0 [ 46.671031][ T7] driver_probe_device+0x4e/0x150 [ 46.671604][ T7] __device_attach_driver+0x1cc/0x2a0 [ 46.672192][ T7] bus_for_each_drv+0x156/0x1d0 [ 46.672739][ T7] page_owner free stack trace missing [ 46.673335][ T7] [ 46.673620][ T7] Memory state around the buggy address: [ 46.674213][ T7] ffff888019442700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 46.675083][ T7] ffff888019442780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 46.675994][ T7] >ffff888019442800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.676875][ T7] ^ [ 46.677323][ T7] ffff888019442880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.678190][ T7] ffff888019442900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.679052][ T7] ================================================================== [ 46.679945][ T7] Disabling lock debugging due to kernel taint [ 46.680725][ T7] Kernel panic - not syncing: Reviewed-by: Arend van Spriel <arend.vanspriel(a)broadcom.com> Signed-off-by: Jisoo Jang <jisoo.jang(a)yonsei.ac.kr> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20230309104457.22628-1-jisoo.jang@yonsei.ac.kr Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index bbdc6000afb9..4e1bd049dd06 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -5356,6 +5356,11 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg, (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf; req_len = le32_to_cpu(assoc_info->req_len); resp_len = le32_to_cpu(assoc_info->resp_len); + if (req_len > WL_EXTRA_BUF_MAX || resp_len > WL_EXTRA_BUF_MAX) { + brcmf_err("invalid lengths in assoc info: req %u resp %u\n", + req_len, resp_len); + return -EINVAL; + } if (req_len) { err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies", cfg->extra_buf, -- 2.25.1

1 0

[RFC PATCH openEuler-1.0-LTS v2] sched: memqos: add memqos for dynamic affinity
by Wang ShaoBo 23 Mar '23

23 Mar '23

Add debug memband interface to dynamic affinity, this would be useful for those threads sensitive to memory bandwidth. Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> v2: Fix update thread's mpamid failed. --- arch/arm64/include/asm/mpam.h | 2 + arch/arm64/include/asm/mpam_sched.h | 2 + arch/arm64/kernel/mpam/mpam_device.c | 58 ++- arch/arm64/kernel/mpam/mpam_resctrl.c | 37 ++ arch/arm64/kernel/process.c | 2 +- include/linux/memqos.h | 142 +++++++ include/linux/sched.h | 15 +- include/linux/sysctl.h | 2 + kernel/cgroup/cpuset.c | 1 + kernel/exit.c | 3 + kernel/fork.c | 4 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 52 ++- kernel/sched/fair.c | 14 +- kernel/sched/memqos/Makefile | 6 + kernel/sched/memqos/memqos.c | 297 +++++++++++++++ kernel/sched/memqos/phase_feature_sysctl.c | 183 +++++++++ kernel/sched/memqos/phase_memband.c | 179 +++++++++ kernel/sched/memqos/phase_perf.c | 412 +++++++++++++++++++++ kernel/sched/memqos/phase_sim_knn.c | 92 +++++ kernel/sysctl.c | 7 + mm/mempolicy.c | 10 +- 22 files changed, 1500 insertions(+), 21 deletions(-) create mode 100644 include/linux/memqos.h create mode 100644 kernel/sched/memqos/Makefile create mode 100644 kernel/sched/memqos/memqos.c create mode 100644 kernel/sched/memqos/phase_feature_sysctl.c create mode 100644 kernel/sched/memqos/phase_memband.c create mode 100644 kernel/sched/memqos/phase_perf.c create mode 100644 kernel/sched/memqos/phase_sim_knn.c diff --git a/arch/arm64/include/asm/mpam.h b/arch/arm64/include/asm/mpam.h index 6338eab817e75..269a91d8ca907 100644 --- a/arch/arm64/include/asm/mpam.h +++ b/arch/arm64/include/asm/mpam.h @@ -4,6 +4,8 @@ #ifdef CONFIG_MPAM extern int mpam_rmid_to_partid_pmg(int rmid, int *partid, int *pmg); + +void mpam_component_config_mbwu_mon(int partid, int pmg, int monitor, int *result, int nr); #endif #endif /* _ASM_ARM64_MPAM_H */ diff --git a/arch/arm64/include/asm/mpam_sched.h b/arch/arm64/include/asm/mpam_sched.h index 08ed349b6efa1..32d08cf654b31 100644 --- a/arch/arm64/include/asm/mpam_sched.h +++ b/arch/arm64/include/asm/mpam_sched.h @@ -40,6 +40,8 @@ static inline void mpam_sched_in(void) __mpam_sched_in(); } +void __mpam_sched_in_v2(struct task_struct *tsk); + #else static inline void mpam_sched_in(void) {} diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index 6455c69f132fd..48de3982a0b9a 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -84,14 +84,14 @@ void mpam_class_list_lock_held(void) static inline u32 mpam_read_reg(struct mpam_device *dev, u16 reg) { WARN_ON_ONCE(reg > SZ_MPAM_DEVICE); - assert_spin_locked(&dev->lock); + //assert_spin_locked(&dev->lock); /* * If we touch a device that isn't accessible from this CPU we may get * an external-abort. */ - WARN_ON_ONCE(preemptible()); - WARN_ON_ONCE(!cpumask_test_cpu(smp_processor_id(), &dev->fw_affinity)); + //WARN_ON_ONCE(preemptible()); + //WARN_ON_ONCE(!cpumask_test_cpu(smp_processor_id(), &dev->fw_affinity)); return readl_relaxed(dev->mapped_hwpage + reg); } @@ -99,14 +99,14 @@ static inline u32 mpam_read_reg(struct mpam_device *dev, u16 reg) static inline void mpam_write_reg(struct mpam_device *dev, u16 reg, u32 val) { WARN_ON_ONCE(reg > SZ_MPAM_DEVICE); - assert_spin_locked(&dev->lock); + //assert_spin_locked(&dev->lock); /* * If we touch a device that isn't accessible from this CPU we may get * an external-abort. If we're lucky, we corrupt another mpam:component. */ - WARN_ON_ONCE(preemptible()); - WARN_ON_ONCE(!cpumask_test_cpu(smp_processor_id(), &dev->fw_affinity)); + //WARN_ON_ONCE(preemptible()); + //WARN_ON_ONCE(!cpumask_test_cpu(smp_processor_id(), &dev->fw_affinity)); writel_relaxed(val, dev->mapped_hwpage + reg); } @@ -1208,6 +1208,7 @@ static u32 mpam_device_read_mbwu_mon(struct mpam_device *dev, { u16 mon; u32 clt, flt, cur_clt, cur_flt; + u32 total = 0; mon = args->mon; @@ -1249,7 +1250,12 @@ static u32 mpam_device_read_mbwu_mon(struct mpam_device *dev, wmb(); } - return mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + return total / 5; } static int mpam_device_frob_mon(struct mpam_device *dev, @@ -1470,6 +1476,44 @@ static void mpam_component_device_sync(void *__ctx) cpumask_set_cpu(smp_processor_id(), &ctx->updated_on); } +static DEFINE_SPINLOCK(mpam_tmp_lock); + +void mpam_component_config_mbwu_mon(int partid, int pmg, int monitor, int *result, int nr) +{ + struct mpam_class *class; + struct mpam_component *comp; + struct mpam_device *dev; + struct sync_args args; + int i = 0; + + args.pmg = pmg; + args.mon = monitor; + args.closid.reqpartid = partid; + args.match_pmg = 1; + + spin_lock(&mpam_tmp_lock); + list_for_each_entry(class, &mpam_classes, classes_list) { + if (class->type != MPAM_CLASS_MEMORY) + continue; + + list_for_each_entry(comp, &class->components, class_list) { + if (i >= nr) { + pr_err_once("error, i > result nr"); + break; + } + result[i] = 0; + list_for_each_entry(dev, &comp->devices, comp_list) { + result[i] += mpam_device_read_mbwu_mon(dev, &args); + } + i++; + } + break; + } + spin_unlock(&mpam_tmp_lock); + +} +EXPORT_SYMBOL(mpam_component_config_mbwu_mon); + /** * in some cases/platforms the MSC register access is only possible with * the associated CPUs. And need to check if those CPUS are online before diff --git a/arch/arm64/kernel/mpam/mpam_resctrl.c b/arch/arm64/kernel/mpam/mpam_resctrl.c index 60d3d8706a38b..26258f7508ac4 100644 --- a/arch/arm64/kernel/mpam/mpam_resctrl.c +++ b/arch/arm64/kernel/mpam/mpam_resctrl.c @@ -2226,6 +2226,43 @@ int mpam_resctrl_init(void) return resctrl_group_init(); } + +void __mpam_sched_in_v2(struct task_struct *tsk) +{ + struct intel_pqr_state *state = this_cpu_ptr(&pqr_state); + u64 rmid = state->default_rmid; + u64 closid = state->default_closid; + + /* + * If this task has a closid/rmid assigned, use it. + * Else use the closid/rmid assigned to this cpu. + */ + if (tsk->closid) + closid = tsk->closid; + + if (tsk->rmid) + rmid = tsk->rmid; + + if (closid != state->cur_closid || rmid != state->cur_rmid) { + u64 reg; + + /* set in EL0 */ + reg = mpam_read_sysreg_s(SYS_MPAM0_EL1, "SYS_MPAM0_EL1"); + reg = PARTID_SET(reg, closid); + reg = PMG_SET(reg, rmid); + mpam_write_sysreg_s(reg, SYS_MPAM0_EL1, "SYS_MPAM0_EL1"); + + /* set in EL1 */ + reg = mpam_read_sysreg_s(SYS_MPAM1_EL1, "SYS_MPAM1_EL1"); + reg = PARTID_SET(reg, closid); + reg = PMG_SET(reg, rmid); + mpam_write_sysreg_s(reg, SYS_MPAM1_EL1, "SYS_MPAM1_EL1"); + + state->cur_rmid = rmid; + state->cur_closid = closid; + } +} + /* * __intel_rdt_sched_in() - Writes the task's CLOSid/RMID to IA32_PQR_MSR * diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c index e5be78915632c..7896bb74ecc49 100644 --- a/arch/arm64/kernel/process.c +++ b/arch/arm64/kernel/process.c @@ -531,7 +531,7 @@ __notrace_funcgraph struct task_struct *__switch_to(struct task_struct *prev, /* the actual thread switch */ last = cpu_switch_to(prev, next); - mpam_sched_in(); + //mpam_sched_in(); return last; } diff --git a/include/linux/memqos.h b/include/linux/memqos.h new file mode 100644 index 0000000000000..814e9935590d3 --- /dev/null +++ b/include/linux/memqos.h @@ -0,0 +1,142 @@ +#ifndef _MEMQOS_H +#define _MEMQOS_H + +#include <linux/vmstat.h> +#include <linux/rbtree.h> +//#include <linux/sched.h> + +struct task_struct; + +struct memqos_domain { + int dom_id; + int total_memband_div_10; + int total_out_memband_div_10; + + //record 10 timers + int memband_ringpos; + int memband_div_10_history[4][10]; +}; + +struct memqos_mpam_profile { + int partid; + int pmg; + int monitor; + + struct task_struct *tsk; + int used; +}; + +struct memqos_wait_profile { + struct memqos_mpam_profile *profile; + struct list_head wait_list; +}; + +struct memqos_class { + struct list_head turbo_list; + struct list_head tasks_list; +}; + +#include <linux/topology.h> +//embed in task_struct + +struct task_memqos { + int ipc_ringpos; + int ipcx10; + int ipcx10_total[4]; + int ipcx10_history[10]; + + int memband_div_10; + int memband_ringpos; + int memband_div_10_total[4]; + int memband_div_10_history[4][10]; + + u32 sample_times; + int account_ready; + int numa_score[4]; + int turbo; + + struct memqos_wait_profile mpam_profile; + + struct list_head turbo_list; + struct list_head task_list; + + struct cpumask *advise_mem_node_mask; + int preferred_nid; + + int class_id; + + int corrupt; +}; + +#define PHASE_PEVENT_NUM 10 + +struct phase_event_pcount { + u64 data[PHASE_PEVENT_NUM]; +}; + +struct phase_event_count { + struct phase_event_pcount pcount; +}; + +void phase_update_mpam_label(struct task_struct *tsk); + +void phase_release_mpam_label(struct task_struct *tsk); + +static inline void memqos_update_mpam_label(struct task_struct *tsk) +{ + phase_update_mpam_label(tsk); +} + +static inline void memqos_release_mpam_label(struct task_struct *tsk) +{ + phase_release_mpam_label(tsk); +} + +void phase_destroy_waitqueue(struct task_struct *tsk); + +void phase_get_memband(struct memqos_mpam_profile *pm, int *result, int nr); + +DECLARE_STATIC_KEY_FALSE(sched_phase); +DECLARE_STATIC_KEY_FALSE(sched_phase_printk); + +int phase_perf_create(void); + +void phase_perf_release(void); + +void memqos_account_task(struct task_struct *p, int cpu); + +void memqos_drop_class(struct task_struct *p); + +void phase_account_task(struct task_struct *p, int cpu); + +static inline void memqos_task_collect_data(struct task_struct *p, int cpu) +{ + phase_account_task(p, cpu); +} + +static inline void memqos_task_account(struct task_struct *p, int cpu) +{ + memqos_account_task(p, cpu); +} + +static inline void memqos_task_exit(struct task_struct *p) +{ + + memqos_drop_class(p); + phase_destroy_waitqueue(p); +} + +void memqos_select_nicest_cpus(struct task_struct *p); + +void memqos_exclude_low_level_task_single(struct task_struct *p); + +int knn_get_tag(int ipcx10, int memband_div_10); + +void memqos_init_class(struct task_struct *p); + +void phase_trace_printk(struct task_struct *p); +static inline void memqos_trace_printk(struct task_struct *p) +{ + phase_trace_printk(p); +} +#endif diff --git a/include/linux/sched.h b/include/linux/sched.h index 928186f161000..c5b74cd0c5830 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -29,6 +29,7 @@ #include <linux/task_io_accounting.h> #include <linux/rseq.h> #include <linux/thread_bits.h> +#include <linux/memqos.h> /* task_struct member predeclarations (sorted alphabetically): */ struct audit_context; @@ -1268,7 +1269,7 @@ struct task_struct { #if !defined(__GENKSYMS__) #if defined(CONFIG_QOS_SCHED_DYNAMIC_AFFINITY) cpumask_t *prefer_cpus; - const cpumask_t *select_cpus; + cpumask_t *select_cpus; #else KABI_RESERVE(6) KABI_RESERVE(7) @@ -1279,6 +1280,10 @@ struct task_struct { #endif KABI_RESERVE(8) +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + struct task_memqos sched_memqos; +#endif + /* CPU-specific state of this task: */ struct thread_struct thread; @@ -1998,6 +2003,14 @@ int set_prefer_cpus_ptr(struct task_struct *p, const struct cpumask *new_mask); int sched_prefer_cpus_fork(struct task_struct *p, struct task_struct *orig); void sched_prefer_cpus_free(struct task_struct *p); +static inline bool prefer_cpus_valid(struct task_struct *p) +{ + return p->prefer_cpus && + !cpumask_empty(p->prefer_cpus) && + !cpumask_equal(p->prefer_cpus, &p->cpus_allowed) && + cpumask_subset(p->prefer_cpus, &p->cpus_allowed); +} +void sched_memqos_task_collect_data_range(int start_cpu, int end_cpu); #endif #endif diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h index b769ecfcc3bd4..73bce39107cb3 100644 --- a/include/linux/sysctl.h +++ b/include/linux/sysctl.h @@ -230,6 +230,8 @@ static inline void setup_sysctl_set(struct ctl_table_set *p, #endif /* CONFIG_SYSCTL */ +extern struct ctl_table phase_table[]; + int sysctl_max_threads(struct ctl_table *table, int write, void __user *buffer, size_t *lenp, loff_t *ppos); diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 55bfbc4cdb16c..d94a9065a5605 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -106,6 +106,7 @@ struct cpuset { nodemask_t mems_allowed; #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY cpumask_var_t prefer_cpus; + int mem_turbo; #endif /* effective CPUs and Memory Nodes allow to tasks */ diff --git a/kernel/exit.c b/kernel/exit.c index 2a32d32bdc03d..b731c19618176 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -699,6 +699,8 @@ static void check_stack_usage(void) static inline void check_stack_usage(void) {} #endif +#include <linux/memqos.h> + void __noreturn do_exit(long code) { struct task_struct *tsk = current; @@ -806,6 +808,7 @@ void __noreturn do_exit(long code) * because of cgroup mode, must be called before cgroup_exit() */ perf_event_exit_task(tsk); + memqos_task_exit(tsk); sched_autogroup_exit_task(tsk); cgroup_exit(tsk); diff --git a/kernel/fork.c b/kernel/fork.c index b5453a26655e2..0a762b92dc814 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -841,6 +841,8 @@ void set_task_stack_end_magic(struct task_struct *tsk) *stackend = STACK_END_MAGIC; /* for overflow detection */ } + +#include <linux/memqos.h> static struct task_struct *dup_task_struct(struct task_struct *orig, int node) { struct task_struct *tsk; @@ -923,6 +925,8 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) kcov_task_init(tsk); + memqos_init_class(tsk); + #ifdef CONFIG_FAULT_INJECTION tsk->fail_nth = 0; #endif diff --git a/kernel/sched/Makefile b/kernel/sched/Makefile index 7fe183404c383..471380d6686e3 100644 --- a/kernel/sched/Makefile +++ b/kernel/sched/Makefile @@ -29,3 +29,4 @@ obj-$(CONFIG_CPU_FREQ) += cpufreq.o obj-$(CONFIG_CPU_FREQ_GOV_SCHEDUTIL) += cpufreq_schedutil.o obj-$(CONFIG_MEMBARRIER) += membarrier.o obj-$(CONFIG_CPU_ISOLATION) += isolation.o +obj-$(CONFIG_QOS_SCHED_DYNAMIC_AFFINITY) += memqos/ diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 970616070da86..15c7e1e3408cb 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -2787,6 +2787,8 @@ asmlinkage __visible void schedule_tail(struct task_struct *prev) calculate_sigpending(); } +#include <linux/memqos.h> + /* * context_switch - switch to the new MM and the new thread's register state. */ @@ -2794,6 +2796,8 @@ static __always_inline struct rq * context_switch(struct rq *rq, struct task_struct *prev, struct task_struct *next, struct rq_flags *rf) { + struct rq *ret; + prepare_task_switch(rq, prev, next); /* @@ -2837,6 +2841,18 @@ context_switch(struct rq *rq, struct task_struct *prev, } } + //account and release + memqos_task_account(prev, smp_processor_id()); + + if (prefer_cpus_valid(prev)) + memqos_trace_printk(prev); + + memqos_release_mpam_label(prev); + + //label new task's mpamid + if (prefer_cpus_valid(next)) + memqos_update_mpam_label(next); + rq->clock_update_flags &= ~(RQCF_ACT_SKIP|RQCF_REQ_SKIP); prepare_lock_switch(rq, next, rf); @@ -2845,7 +2861,9 @@ context_switch(struct rq *rq, struct task_struct *prev, switch_to(prev, next, prev); barrier(); - return finish_task_switch(prev); + ret = finish_task_switch(prev); + + return ret; } /* @@ -3051,6 +3069,20 @@ unsigned long long task_sched_runtime(struct task_struct *p) return ns; } +void sched_memqos_task_collect_data_range(int start_cpu, int end_cpu) +{ + int cpu; + struct task_struct *curr; + struct rq *rq_curr; + + for (cpu = start_cpu; cpu <= end_cpu; cpu++) { + rq_curr = cpu_rq(cpu); + curr = rq_curr->curr; + if (curr && prefer_cpus_valid(curr)) + memqos_task_collect_data(curr, cpu); + } +} + /* * This function gets called by the timer code, with HZ frequency. * We call it with interrupts disabled. @@ -3058,8 +3090,12 @@ unsigned long long task_sched_runtime(struct task_struct *p) void scheduler_tick(void) { int cpu = smp_processor_id(); + //memqos clooect next cpu's memband and perf + //int cpu_memqos = (cpu + 1) % nr_cpu_ids; struct rq *rq = cpu_rq(cpu); + //struct rq *rq_next = cpu_rq(cpu_memqos); struct task_struct *curr = rq->curr; + //struct task_struct *curr_memqos = rq_next->curr; struct rq_flags rf; sched_clock_tick(); @@ -3075,6 +3111,10 @@ void scheduler_tick(void) perf_event_task_tick(); + //only monitor task enabled dynamic affinity + //if (curr_memqos && prefer_cpus_valid(curr_memqos)) + // memqos_task_collect_data(curr_memqos, cpu_memqos); + #ifdef CONFIG_SMP rq->idle_balance = idle_cpu(cpu); trigger_load_balance(rq); @@ -3524,6 +3564,16 @@ static void __sched notrace __schedule(bool preempt) /* Also unlocks the rq: */ rq = context_switch(rq, prev, next, &rf); } else { + memqos_task_account(prev, smp_processor_id()); + + if (prefer_cpus_valid(prev)) + memqos_trace_printk(prev); + + memqos_release_mpam_label(prev); + //relabel this task's mpamid + if (prefer_cpus_valid(prev)) + memqos_update_mpam_label(prev); + rq->clock_update_flags &= ~(RQCF_ACT_SKIP|RQCF_REQ_SKIP); rq_unlock_irq(rq, &rf); } diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index af55a26d11fcb..12e9675495d2c 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -6675,6 +6675,7 @@ static int wake_cap(struct task_struct *p, int cpu, int prev_cpu) } #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY +#include <linux/memqos.h> /* * Low utilization threshold for CPU * @@ -6749,14 +6750,6 @@ static inline int cpu_vutil_of(int cpu) return cputime->vutil; } -static inline bool prefer_cpus_valid(struct task_struct *p) -{ - return p->prefer_cpus && - !cpumask_empty(p->prefer_cpus) && - !cpumask_equal(p->prefer_cpus, &p->cpus_allowed) && - cpumask_subset(p->prefer_cpus, &p->cpus_allowed); -} - /* * set_task_select_cpus: select the cpu range for task * @p: the task whose available cpu range will to set @@ -6828,8 +6821,13 @@ static void set_task_select_cpus(struct task_struct *p, int *idlest_cpu, if (util_avg_sum < sysctl_sched_util_low_pct * cpumask_weight(p->prefer_cpus)) { p->select_cpus = p->prefer_cpus; + memqos_select_nicest_cpus(p); if (sd_flag & SD_BALANCE_WAKE) schedstat_inc(p->se.dyn_affi_stats->nr_wakeups_preferred_cpus); + } else { + //select trubo task + //select low class task + memqos_exclude_low_level_task_single(p); } } #endif diff --git a/kernel/sched/memqos/Makefile b/kernel/sched/memqos/Makefile new file mode 100644 index 0000000000000..ed8f42649a8a7 --- /dev/null +++ b/kernel/sched/memqos/Makefile @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: GPL-2.0 +# These files are disabled because they produce non-interesting flaky coverage +# that is not a function of syscall inputs. E.g. involuntary context switches. +KCOV_INSTRUMENT := n + +obj-y := memqos.o phase_feature_sysctl.o phase_memband.o phase_perf.o phase_sim_knn.o diff --git a/kernel/sched/memqos/memqos.c b/kernel/sched/memqos/memqos.c new file mode 100644 index 0000000000000..29fc6af1f02c1 --- /dev/null +++ b/kernel/sched/memqos/memqos.c @@ -0,0 +1,297 @@ +#include <linux/memqos.h> +#include <linux/cpumask.h> +#include <linux/sched.h> + +static void memqos_set_task_classid(struct task_struct *p) +{ + int class_id; + int memband_div_10 = p->sched_memqos.memband_div_10; + int ipcx10 = p->sched_memqos.ipcx10; + + class_id = knn_get_tag((u64)ipcx10, (u64)memband_div_10); + p->sched_memqos.class_id = class_id; +} + +//static memqos_domain mq_domains[] = { +// {.dom_id = 0, .total_memband = 0, .total_out_memband = 0,}, +// {.dom_id = 1, .total_memband = 0, .total_out_memband = 0,}, +// {.dom_id = 2, .total_memband = 0, .total_out_memband = 0,}, +// {.dom_id = 3, .total_memband = 0, .total_out_memband = 0,}, +//}; + +static DEFINE_PER_CPU(struct memqos_class, memqos_classes[8]); +//static DEFINE_PER_CPU(spinlock_t, memqos_class_lock); +static DEFINE_SPINLOCK(memqos_class_lock); + +static int memqos_class_online(unsigned int cpu) +{ + int class_id = 0; + struct memqos_class *class; + + for (class_id = 0; class_id < 8; class_id++) { + class = &per_cpu(memqos_classes, cpu)[class_id]; + INIT_LIST_HEAD(&class->tasks_list); + INIT_LIST_HEAD(&class->turbo_list); + } + return 0; +} + +static int memqos_class_offline(unsigned int cpu) +{ + return 0; +} + +#include <linux/cpu.h> +#include <linux/cacheinfo.h> + +static void memqos_init(void) +{ + int cpuhp_state = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, + "memqos:online", memqos_class_online, + memqos_class_offline); + if (cpuhp_state <= 0) { + pr_err("Failed to register 'dyn' cpuhp callbacks"); + return; + } +} +late_initcall(memqos_init); + +static void memqos_insert_to_class(struct task_struct *p, int cpu) +{ + unsigned long flag; + int class_id = p->sched_memqos.class_id; + struct memqos_class *class; + struct task_memqos *memqos; + + if (class_id >= 8) + return; + + memqos = &p->sched_memqos; + + class = &per_cpu(memqos_classes, cpu)[class_id]; + + spin_lock_irqsave(&memqos_class_lock, flag); + if (p->sched_memqos.corrupt) { + spin_unlock_irqrestore(&memqos_class_lock, flag); + return; + } + + list_move_tail(&p->sched_memqos.task_list, &class->tasks_list); + if (memqos->turbo) + list_move_tail(&p->sched_memqos.turbo_list, &class->turbo_list); + spin_unlock_irqrestore(&memqos_class_lock, flag); +} + +static void memqos_drop_class_without_lock(struct task_struct *p) +{ + list_del_init(&p->sched_memqos.task_list); + list_del_init(&p->sched_memqos.turbo_list); +} + +static void memqos_score(struct task_struct *p) +{ + int total_n1 = p->sched_memqos.memband_div_10_total[0]; + int total_n2 = p->sched_memqos.memband_div_10_total[1]; + int total_n3 = p->sched_memqos.memband_div_10_total[2]; + int total_n4 = p->sched_memqos.memband_div_10_total[3]; + + p->sched_memqos.numa_score[0] = (total_n1 - (total_n2 + total_n3 + total_n4)) * 10 / total_n1; + p->sched_memqos.numa_score[1] = (total_n2 - (total_n1 + total_n3 + total_n4)) * 10 / total_n2; + p->sched_memqos.numa_score[2] = (total_n3 - (total_n1 + total_n2 + total_n4)) * 10 / total_n3; + p->sched_memqos.numa_score[3] = (total_n4 - (total_n1 + total_n2 + total_n3)) * 10 / total_n4; + + //over x% percent + if (p->sched_memqos.numa_score[0] > 0) + p->sched_memqos.turbo = 1; + else if (p->sched_memqos.numa_score[1] > 0) + p->sched_memqos.turbo = 2; + else if (p->sched_memqos.numa_score[2] > 0) + p->sched_memqos.turbo = 3; + else if (p->sched_memqos.numa_score[3] > 0) + p->sched_memqos.turbo = 4; + else + p->sched_memqos.turbo = 0; +} + +void memqos_account_task(struct task_struct *p, int cpu) +{ + if (!p->sched_memqos.account_ready || + p->sched_memqos.corrupt) + return; + memqos_set_task_classid(p); + memqos_insert_to_class(p, cpu); + memqos_score(p); + p->sched_memqos.account_ready = 0; +} + +void memqos_init_class(struct task_struct *p) +{ + memset(&p->sched_memqos, 0, sizeof(struct task_memqos)); + spin_lock(&memqos_class_lock); + INIT_LIST_HEAD(&p->sched_memqos.task_list); + INIT_LIST_HEAD(&p->sched_memqos.turbo_list); + INIT_LIST_HEAD(&p->sched_memqos.mpam_profile.wait_list); + spin_unlock(&memqos_class_lock); + + p->closid = 0; + p->rmid = 0; +} + +//destroy ? +void memqos_drop_class(struct task_struct *p) +{ + spin_lock(&memqos_class_lock); + memqos_drop_class_without_lock(p); + p->sched_memqos.corrupt = 1; + spin_unlock(&memqos_class_lock); +} + +void memqos_select_nicest_cpus(struct task_struct *p) +{ + int i = 0; + int max_score = -10000; + int select_node = 0; + struct task_memqos *memqos = &p->sched_memqos; + + if (!memqos->turbo) { + for (i = 0; i < 4; i++) { + if (!cpumask_intersects(cpumask_of_node(i), p->select_cpus)) + continue; + + if (memqos->numa_score[i] > max_score) { + select_node = i; + max_score = memqos->numa_score[i]; + } + } + + cpumask_and(p->select_cpus, p->select_cpus, cpumask_of_node(select_node)); + //p->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + p->sched_memqos.preferred_nid = memqos->turbo; + return; + } + + select_node = memqos->turbo - 1; + if (cpumask_intersects(cpumask_of_node(select_node), p->select_cpus)) { + cpumask_and(p->select_cpus, p->select_cpus, cpumask_of_node(select_node)); + //p->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + p->sched_memqos.preferred_nid = memqos->turbo; + } + + //if turbo another cpus, wait... + return; +} + +void memqos_exclude_low_level_task_single(struct task_struct *p) +{ + int i, j, cpu; + int find = 0; + int select_node = 0; + const struct cpumask *cpumask; + struct cpumask cpumask_med; + struct memqos_class *class; + struct task_memqos *memqos = &p->sched_memqos;; + struct task_struct *tsk = NULL; + int max_score = -100000; + + if (memqos->turbo) { + select_node = memqos->turbo - 1; + cpumask = cpumask_of_node(select_node); + if (!cpumask_intersects(cpumask, p->prefer_cpus) && + (cpumask_intersects(&p->cpus_allowed, cpumask))) { + cpumask_and(p->select_cpus, &p->cpus_allowed, cpumask); + //go out! + spin_lock(&memqos_class_lock); + memqos_drop_class_without_lock(p); + spin_unlock(&memqos_class_lock); + //p->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + p->sched_memqos.preferred_nid = memqos->turbo; + return; + } else if (cpumask_intersects(p->prefer_cpus, cpumask)) { + cpumask_and(p->select_cpus, p->prefer_cpus, cpumask); + //p->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + p->sched_memqos.preferred_nid = memqos->turbo; + } + } + + //select turbo one + for (cpu = 0; cpu < nr_cpu_ids; cpu++) { + if (!cpumask_test_cpu(cpu, p->prefer_cpus)) + continue; + + spin_lock(&memqos_class_lock); + for (i = 7; i >= 0; i--) { + class = &per_cpu(memqos_classes, cpu)[i]; + list_for_each_entry(memqos, &class->turbo_list, turbo_list) { + if (!memqos->turbo) + continue; + select_node = memqos->turbo - 1; + cpumask = cpumask_of_node(select_node); + if (!cpumask_intersects(cpumask, p->prefer_cpus)) { + tsk = container_of(memqos, struct task_struct, sched_memqos); + if (!cpumask_intersects(cpumask, &tsk->cpus_allowed)) + continue; + cpumask_and(tsk->select_cpus, &tsk->cpus_allowed, cpumask); + //mem prefered + //tsk->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + tsk->sched_memqos.preferred_nid = memqos->turbo; + find = 1; + break; + } + } + if (find) { + memqos_drop_class_without_lock(tsk); + spin_unlock(&memqos_class_lock); + return; + } + } + spin_unlock(&memqos_class_lock); + } + + find = 0; + + //if not, select lower class's tsk + for (cpu = 0; cpu < nr_cpu_ids; cpu++) { + if (!cpumask_test_cpu(cpu, p->prefer_cpus)) + continue; + + spin_lock(&memqos_class_lock); + //only find below class tsk + for (i = 0; i < memqos->class_id; i++) { + class = &per_cpu(memqos_classes, cpu)[i]; + list_for_each_entry(memqos, &class->tasks_list, task_list) { + if (memqos->turbo) + continue; + + tsk = container_of(memqos, struct task_struct, sched_memqos); + for (j = 0; j < 4; j++) { + if (!cpumask_intersects(cpumask_of_node(i), &tsk->cpus_allowed)) + continue; + if (memqos->numa_score[j] > max_score) { + select_node = j; + max_score = memqos->numa_score[j]; + } + find = 1; + } + if (!find) + continue; + + cpumask_and(&cpumask_med, cpumask_of_node(select_node), &tsk->cpus_allowed); + cpumask_andnot(&cpumask_med, &cpumask_med, p->prefer_cpus); + if (cpumask_empty(&cpumask_med)) + continue; + cpumask_copy(tsk->select_cpus, &cpumask_med); + //mem prefered + //tsk->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + tsk->sched_memqos.preferred_nid = memqos->turbo; + memqos_drop_class_without_lock(tsk); + spin_unlock(&memqos_class_lock); + return; + } + } + spin_unlock(&memqos_class_lock); + } + + //do not care, this task may out + return; +} + diff --git a/kernel/sched/memqos/phase_feature_sysctl.c b/kernel/sched/memqos/phase_feature_sysctl.c new file mode 100644 index 0000000000000..9106a90868a3d --- /dev/null +++ b/kernel/sched/memqos/phase_feature_sysctl.c @@ -0,0 +1,183 @@ +#include <linux/sched.h> +#include <linux/sysctl.h> +#include <linux/capability.h> +#include <linux/cpumask.h> +#include <linux/topology.h> +#include <linux/sched/task.h> + +#include <linux/memqos.h> + +#ifdef CONFIG_PROC_SYSCTL + +//setup timer for counting +#include <linux/sched.h> +#include <linux/timer.h> +#include <asm/ioctl.h> + +//at least 2 cpu +static enum hrtimer_restart timer_fn_twin_a(struct hrtimer *timer_data) +{ + sched_memqos_task_collect_data_range(0, nr_cpu_ids / 2 - 1); + hrtimer_forward_now(timer_data, 1 * NSEC_PER_MSEC); + return HRTIMER_RESTART; +} + +static enum hrtimer_restart timer_fn_twin_b(struct hrtimer *timer_data) +{ + sched_memqos_task_collect_data_range(nr_cpu_ids / 2, nr_cpu_ids - 1); + hrtimer_forward_now(timer_data, 1 * NSEC_PER_MSEC); + return HRTIMER_RESTART; +} + +static struct hrtimer timer_twin_a; +static struct hrtimer timer_twin_b; + +static void memqos_timer_init_func_a(void *info) { + hrtimer_init(&timer_twin_a, CLOCK_MONOTONIC, HRTIMER_MODE_ABS); + timer_twin_a.function = timer_fn_twin_a; + hrtimer_start(&timer_twin_a, ktime_add_ns(ktime_get(), 10000000), HRTIMER_MODE_ABS); +} + +static void memqos_timer_init_func_b(void *info) { + hrtimer_init(&timer_twin_b, CLOCK_MONOTONIC, HRTIMER_MODE_ABS); + timer_twin_b.function = timer_fn_twin_b; + hrtimer_start(&timer_twin_b, ktime_add_ns(ktime_get(), 10000000), HRTIMER_MODE_ABS); +} + +static void memqos_timer_init_a(void) +{ + smp_call_function_single(0, memqos_timer_init_func_b, NULL, 0); +} + +static void memqos_timer_init_b(void) +{ + smp_call_function_single(nr_cpu_ids / 2, memqos_timer_init_func_a, NULL, 0); +} + +static void memqos_timer_twin_init(void) { + memqos_timer_init_a(); + memqos_timer_init_b(); +} + +static void memqos_timer_twin_exit(void) { + hrtimer_cancel(&timer_twin_a); + hrtimer_cancel(&timer_twin_b); +} + +DEFINE_STATIC_KEY_FALSE(sched_phase); +DEFINE_STATIC_KEY_FALSE(sched_phase_printk); + +static int set_phase_state(bool enabled) +{ + int err; + int state = static_branch_likely(&sched_phase); + + if (enabled == state) { + pr_warn("phase has already %s\n", state ? "enabled" : "disabled"); + return 0; + } + + if (enabled) { + err = phase_perf_create(); + if (err) { + pr_err("phase enable failed\n"); + return err; + } + static_branch_enable(&sched_phase); + pr_info("phase enabled\n"); + memqos_timer_twin_init(); + } else { + static_branch_disable(&sched_phase); + phase_perf_release(); + pr_info("phase disabled\n"); + memqos_timer_twin_exit(); + } + + return 0; +} + +/* + * the other procfs files of phase cannot be modified if sched_phase is already enabled + */ +static int phase_proc_state(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) +{ + struct ctl_table t; + int err; + int state = static_branch_likely(&sched_phase); + + if (write && !capable(CAP_SYS_ADMIN)) + return -EPERM; + + t = *table; + t.data = &state; + err = proc_dointvec_minmax(&t, write, buffer, lenp, ppos); + if (err < 0) + return err; + if (write) + err = set_phase_state(state); + + return err; +} + +static int set_phase_state_printk(bool enabled) +{ + if (enabled) { + static_branch_enable(&sched_phase_printk); + } else { + static_branch_disable(&sched_phase_printk); + } + + return 0; +} + +/* + * the other procfs files of phase cannot be modified if sched_phase is already enabled + */ +static int phase_proc_state_printk(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) +{ + struct ctl_table t; + int err; + int state = static_branch_likely(&sched_phase); + + if (write && !capable(CAP_SYS_ADMIN)) + return -EPERM; + + t = *table; + t.data = &state; + err = proc_dointvec_minmax(&t, write, buffer, lenp, ppos); + if (err < 0) + return err; + if (write) + err = set_phase_state_printk(state); + + return err; +} + + +static int __maybe_unused zero; +static int __maybe_unused one = 1; + +struct ctl_table phase_table[] = { + { + .procname = "enabled", + .data = NULL, + .maxlen = sizeof(unsigned int), + .mode = 0644, + .proc_handler = phase_proc_state, + .extra1 = &zero, + .extra2 = &one, + }, + { + .procname = "trace_enabled", + .data = NULL, + .maxlen = sizeof(unsigned int), + .mode = 0644, + .proc_handler = phase_proc_state_printk, + .extra1 = &zero, + .extra2 = &one, + }, + { } +}; +#endif /* CONFIG_PROC_SYSCTL */ diff --git a/kernel/sched/memqos/phase_memband.c b/kernel/sched/memqos/phase_memband.c new file mode 100644 index 0000000000000..df8b2811f6ab7 --- /dev/null +++ b/kernel/sched/memqos/phase_memband.c @@ -0,0 +1,179 @@ +#include <linux/types.h> +#include <linux/cpu.h> +#include <linux/memqos.h> + +#include <asm/cpu.h> +#include <asm/cputype.h> +#include <asm/cpufeature.h> +#include <asm/mpam_sched.h> + +static const int nr_partid = 15; +static const int nr_monitor = 4; + +static LIST_HEAD(phase_mpam_waitqueue); + +//mpam_profile_res[0] not used +struct memqos_mpam_profile mpam_profile_res[16] = { + { .partid = 0, .monitor = 0, .used = 1}, + { .partid = 1, .monitor = 0,}, + { .partid = 2, .monitor = 1,}, + { .partid = 3, .monitor = 2,}, + { .partid = 4, .monitor = 3,}, + { .partid = 5, .monitor = 0,}, + { .partid = 6, .monitor = 1,}, + { .partid = 7, .monitor = 2,}, + { .partid = 8, .monitor = 3,}, + { .partid = 9, .monitor = 0,}, + { .partid = 10, .monitor = 1,}, + { .partid = 11, .monitor = 2,}, + { .partid = 12, .monitor = 3,}, + { .partid = 13, .monitor = 0,}, + { .partid = 14, .monitor = 1,}, + { .partid = 15, .monitor = 2,}, +}; + +static DEFINE_SPINLOCK(phase_partid_lock); + +void phase_update_mpam_label(struct task_struct *tsk) +{ + int i = 0; + //unsigned long flag; + + WARN_ON_ONCE(tsk->closid); + + if (tsk->sched_memqos.corrupt) { + phase_release_mpam_label(tsk); + return; + } + + spin_lock(&phase_partid_lock); + if (tsk->sched_memqos.mpam_profile.profile != &mpam_profile_res[0] && + tsk->sched_memqos.mpam_profile.profile != NULL) { + tsk->closid = tsk->sched_memqos.mpam_profile.profile->partid; + tsk->sched_memqos.mpam_profile.profile->tsk = tsk; + //tsk->sched_memqos.mpam_profile.profile->used = 1; + tsk->rmid = 0; + spin_unlock(&phase_partid_lock); + //if (static_branch_unlikely(&sched_phase_printk)) { + // trace_printk("task pid:%d get partid%d succeed\n", tsk->pid, tsk->closid); + //} + __mpam_sched_in_v2(tsk); + return; + } + + //is in profile queue, wait... + if (tsk->sched_memqos.mpam_profile.profile == &mpam_profile_res[0]) { + spin_unlock(&phase_partid_lock); + return; + } + + for (i = 1; i < 16; i++) { + if (mpam_profile_res[i].used) { + if (static_branch_unlikely(&sched_phase_printk)) { + //if (mpam_profile_res[i].tsk) + // trace_printk("i%d want get partid, butpartid:%d get by pid:%d closid:%d\n", + //tsk->pid, i, mpam_profile_res[i].tsk->pid, mpam_profile_res[i].tsk->closid); + //else + // trace_printk("i%d want get partid, butpartid:%d get by pid:%d(NULL)\n", + //tsk->pid, i, tsk->pid); + } + + continue; + } + + tsk->sched_memqos.mpam_profile.profile = NULL; + break; + } + + if (i == 16) { + list_move_tail(&tsk->sched_memqos.mpam_profile.wait_list, &phase_mpam_waitqueue); + tsk->sched_memqos.mpam_profile.profile = &mpam_profile_res[0]; + spin_unlock(&phase_partid_lock); + //if (static_branch_unlikely(&sched_phase_printk)) { + // trace_printk("task pid:%d no partid found, go to list\n", tsk->pid); + //} + //wait... + return; + } + + mpam_profile_res[i].used = 1; + tsk->closid = mpam_profile_res[i].partid; + mpam_profile_res[i].tsk = tsk; + tsk->sched_memqos.mpam_profile.profile = &mpam_profile_res[i]; + tsk->rmid = 0; + spin_unlock(&phase_partid_lock); + //if (static_branch_unlikely(&sched_phase_printk)) { + //trace_printk("task pid:%d get partid%d succeed\n", tsk->pid, i); + //} + + __mpam_sched_in_v2(tsk); +} + +static void phase_release_mpam_label_without_lock(struct task_struct *tsk) +{ + int closid; + struct memqos_wait_profile *next; + + //assert locked + + if (tsk->sched_memqos.mpam_profile.profile && + tsk->sched_memqos.mpam_profile.profile->partid) { + closid = tsk->sched_memqos.mpam_profile.profile->partid; + } else if (tsk->closid == 0) { + return; + } else { + closid = tsk->closid; + } + + tsk->closid = 0; + tsk->sched_memqos.mpam_profile.profile = NULL; + mpam_profile_res[closid].used = 0; + mpam_profile_res[closid].tsk = NULL; + + //if (static_branch_unlikely(&sched_phase_printk)) { + // trace_printk("task pid:%d release partid%d, list empty:%d\n", tsk->pid, closid, list_empty(&phase_mpam_waitqueue)); + //} + + next = list_first_entry_or_null(&phase_mpam_waitqueue, struct memqos_wait_profile, wait_list); + if (next) { + list_del_init(&next->wait_list); + mpam_profile_res[closid].used = 1; + next->profile = &mpam_profile_res[closid]; + } + + return; +} + +//task shutdown +void phase_destroy_waitqueue(struct task_struct *tsk) +{ + spin_lock(&phase_partid_lock); + + //if (tsk->sched_memqos.mpam_profile.profile == &mpam_profile_res[0]) { + list_del_init(&tsk->sched_memqos.mpam_profile.wait_list); + //} else { + phase_release_mpam_label_without_lock(tsk); + //} + spin_unlock(&phase_partid_lock); +} + +void phase_release_mpam_label(struct task_struct *tsk) +{ + spin_lock(&phase_partid_lock); + phase_release_mpam_label_without_lock(tsk); + spin_unlock(&phase_partid_lock); +} + +#include <asm/mpam.h> +void phase_get_memband(struct memqos_mpam_profile *pm, int *result, int nr) +{ + if (pm == &mpam_profile_res[0] || pm == NULL) { + result[0] = 0; + result[1] = 0; + result[2] = 0; + result[3] = 0; + return; + } + + mpam_component_config_mbwu_mon(pm->partid, pm->pmg, pm->monitor, result, nr); +} diff --git a/kernel/sched/memqos/phase_perf.c b/kernel/sched/memqos/phase_perf.c new file mode 100644 index 0000000000000..7b7f37e46f76c --- /dev/null +++ b/kernel/sched/memqos/phase_perf.c @@ -0,0 +1,412 @@ +#include <linux/kernel.h> +#include <linux/perf_event.h> +#include <linux/percpu-defs.h> +#include <linux/slab.h> +#include <linux/stop_machine.h> +#include <linux/memqos.h> +#include <linux/sched.h> + +#define PHASE_FEVENT_NUM 3 + +int *phase_perf_pevents = NULL; + +static DEFINE_PER_CPU(__typeof__(struct perf_event *)[PHASE_PEVENT_NUM], cpu_phase_perf_events); + +/****************************************** + * Helpers for phase perf event + *****************************************/ +static inline struct perf_event *perf_event_of_cpu(int cpu, int index) +{ + return per_cpu(cpu_phase_perf_events, cpu)[index]; +} + +static inline struct perf_event **perf_events_of_cpu(int cpu) +{ + return per_cpu(cpu_phase_perf_events, cpu); +} + +static inline u64 perf_event_local_pmu_read(struct perf_event *event) +{ + return 0; + if (event->state == PERF_EVENT_STATE_ACTIVE) + event->pmu->read(event); + return local64_read(&event->count); +} + +/****************************************** + * Helpers for cpu counters + *****************************************/ +static inline u64 read_cpu_counter(int cpu, int index) +{ + struct perf_event *event = perf_event_of_cpu(cpu, index); + + if (!event || !event->pmu) + return 0; + + return perf_event_local_pmu_read(event); +} + +static struct perf_event_attr *alloc_attr(int event_id) +{ + struct perf_event_attr *attr; + + attr = kzalloc(sizeof(struct perf_event_attr), GFP_KERNEL); + if (!attr) + return ERR_PTR(-ENOMEM); + + attr->type = PERF_TYPE_RAW; + attr->config = event_id; + attr->size = sizeof(struct perf_event_attr); + attr->pinned = 1; + attr->disabled = 1; + //attr->exclude_hv; + //attr->exclude_idle; + //attr->exclude_kernel; + + return attr; +} + +static int create_cpu_counter(int cpu, int event_id, int index) +{ + struct perf_event_attr *attr = NULL; + struct perf_event **events = perf_events_of_cpu(cpu); + struct perf_event *event = NULL; + + return 0; + attr = alloc_attr(event_id); + if (IS_ERR(attr)) + return PTR_ERR(attr); + + event = perf_event_create_kernel_counter(attr, cpu, NULL, NULL, NULL); + if (IS_ERR(event)) { + pr_err("unable to create perf event (cpu:%i-type:%d-pinned:%d-config:0x%llx) : %ld", + cpu, attr->type, attr->pinned, attr->config, PTR_ERR(event)); + kfree(attr); + return PTR_ERR(event); + } else { + events[index] = event; + perf_event_enable(events[index]); + if (event->hw.idx == -1) { + pr_err("pinned event unable to get onto hardware, perf event (cpu:%i-type:%d-config:0x%llx)", + cpu, attr->type, attr->config); + kfree(attr); + return -EINVAL; + } + pr_info("create perf_event (cpu:%i-idx:%d-type:%d-pinned:%d-exclude_hv:%d" + "-exclude_idle:%d-exclude_kernel:%d-config:0x%llx-addr:%px)", + event->cpu, event->hw.idx, + event->attr.type, event->attr.pinned, event->attr.exclude_hv, + event->attr.exclude_idle, event->attr.exclude_kernel, + event->attr.config, event); + } + + kfree(attr); + return 0; +} + +static int release_cpu_counter(int cpu, int event_id, int index) +{ + struct perf_event **events = perf_events_of_cpu(cpu); + struct perf_event *event = NULL; + + return 0; + event = events[index]; + + if (!event) + return 0; + + pr_info("release perf_event (cpu:%i-idx:%d-type:%d-pinned:%d-exclude_hv:%d" + "-exclude_idle:%d-exclude_kernel:%d-config:0x%llx)", + event->cpu, event->hw.idx, + event->attr.type, event->attr.pinned, event->attr.exclude_hv, + event->attr.exclude_idle, event->attr.exclude_kernel, + event->attr.config); + + perf_event_release_kernel(event); + events[index] = NULL; + + return 0; +} + +enum { + CYCLES_INDEX = 0, + INST_RETIRED_INDEX, + PHASE_EVENT_FINAL_TERMINATOR +}; + +#define CYCLES 0x0011 +#define INST_RETIRED 0x0008 + +static int pevents[PHASE_PEVENT_NUM] = { + CYCLES, + INST_RETIRED, + PHASE_EVENT_FINAL_TERMINATOR, +}; + +#define for_each_phase_pevents(index, events) \ + for (index = 0; events != NULL && index < PHASE_PEVENT_NUM && \ + events[index] != PHASE_EVENT_FINAL_TERMINATOR; index++) + + +/****************************************** + * Helpers for phase perf + *****************************************/ +static int do_pevents(int (*fn)(int, int, int), int cpu) +{ + int index; + int err; + + for_each_phase_pevents(index, phase_perf_pevents) { + err = fn(cpu, phase_perf_pevents[index], index); + if (err) + return err; + } + + return 0; +} + +static int __phase_perf_create(void *args) +{ + int err; + int cpu = raw_smp_processor_id(); + + /* create pinned events */ + pr_info("create pinned events\n"); + err = do_pevents(create_cpu_counter, cpu); + if (err) { + pr_err("create pinned events failed\n"); + do_pevents(release_cpu_counter, cpu); + return err; + } + + pr_info("[%d] phase class event create success\n", cpu); + return 0; +} + +static int do_phase_perf_create(int *pevents, const struct cpumask *cpus) +{ + phase_perf_pevents = pevents; + return stop_machine(__phase_perf_create, NULL, cpus); +} + +static int __do_phase_perf_release(void *args) +{ + int cpu = raw_smp_processor_id(); + + /* release pinned events */ + pr_info("release pinned events\n"); + do_pevents(release_cpu_counter, cpu); + + pr_info("[%d] phase class event release success\n", cpu); + return 0; +} + +static void do_phase_perf_release(const struct cpumask *cpus) +{ + stop_machine(__do_phase_perf_release, NULL, cpus); + phase_perf_pevents = NULL; +} + +int phase_perf_create(void) +{ + return do_phase_perf_create(pevents, cpu_possible_mask); +} + +void phase_perf_release(void) +{ + do_phase_perf_release(cpu_possible_mask); +} + +DECLARE_STATIC_KEY_FALSE(sched_phase); +DECLARE_STATIC_KEY_FALSE(sched_phase_printk); + +#define PHASE_EVENT_OVERFLOW (~0ULL) + +static inline u64 phase_event_count_sub(u64 curr, u64 prev) +{ + if (curr < prev) { /* ovewrflow */ + u64 tmp = PHASE_EVENT_OVERFLOW - prev; + return curr + tmp; + } else { + return curr - prev; + } +} + +static inline void phase_calc_delta(struct task_struct *p, + struct phase_event_count *prev, + struct phase_event_count *curr, + struct phase_event_count *delta) +{ + int *pevents = phase_perf_pevents; + int index; + + for_each_phase_pevents(index, pevents) { + delta->pcount.data[index] = phase_event_count_sub(curr->pcount.data[index], prev->pcount.data[index]); + } +} + +static inline u64 phase_data_of_pevent(struct phase_event_pcount *counter, int event_id) +{ + int index; + int *events = phase_perf_pevents; + + for_each_phase_pevents(index, events) { + if (event_id == events[index]) + return counter->data[index]; + } + + return 0; +} + +static int cal_ring_history_average(int *history, int nr, int s_pos, int c_nr) +{ + int average = 0; + int start = ((s_pos - c_nr) + nr) % nr; + + if (start < 0) + return 0; + + for (;start != s_pos;) { + if (history[start] == 0) { + c_nr--; + if (c_nr == 0) + return 0; + continue; + } + average += history[start]; + start = (start + 1) % nr; + } + + return start / c_nr; +} + +static void __phase_cal_ipcx10(struct task_struct *p, struct phase_event_count *delta) +{ + u64 ins; + u64 cycles; + //invalid zero + int ipcx10 = 0; + + ins = phase_data_of_pevent(&delta->pcount, INST_RETIRED_INDEX); + cycles = phase_data_of_pevent(&delta->pcount, CYCLES_INDEX); + + if (cycles) + ipcx10 = (ins * 10) / cycles; + + //if (static_branch_unlikely(&sched_phase_printk)) { + // trace_printk("ins:%lld cycles:%lld\n", ins, cycles); + //} + + p->sched_memqos.ipcx10_history[p->sched_memqos.ipc_ringpos] = ipcx10; + p->sched_memqos.ipc_ringpos = (p->sched_memqos.ipc_ringpos + 1) % 10; + cal_ring_history_average(p->sched_memqos.ipcx10_history, 10, p->sched_memqos.ipc_ringpos, 5); +} + +static void __phase_cal_memband_div_10(struct task_struct *p) +{ + int pos; + int result[4]; + + pos = p->sched_memqos.memband_ringpos; + + phase_get_memband(p->sched_memqos.mpam_profile.profile, result, 4); + + //if (static_branch_unlikely(&sched_phase_printk)) { + // trace_printk("memband:%d %d %d %d profile:%llx\n", result[0], result[1], result[2], result[3], p->sched_memqos.mpam_profile.profile); + //} + + p->sched_memqos.memband_div_10_total[0] = p->sched_memqos.memband_div_10_total[0] - p->sched_memqos.memband_div_10_history[0][pos]; + p->sched_memqos.memband_div_10_total[0] = p->sched_memqos.memband_div_10_total[0] + result[0] / 10; + p->sched_memqos.memband_div_10_history[0][p->sched_memqos.memband_ringpos] = result[0] / 10; + + p->sched_memqos.memband_div_10_total[1] = p->sched_memqos.memband_div_10_total[1] - p->sched_memqos.memband_div_10_history[1][pos]; + p->sched_memqos.memband_div_10_total[1] = p->sched_memqos.memband_div_10_total[1] + result[1] / 10; + p->sched_memqos.memband_div_10_history[1][p->sched_memqos.memband_ringpos] = result[1] / 10; + + p->sched_memqos.memband_div_10_total[2] = p->sched_memqos.memband_div_10_total[2] - p->sched_memqos.memband_div_10_history[2][pos]; + p->sched_memqos.memband_div_10_total[2] = p->sched_memqos.memband_div_10_total[2] + result[2] / 10; + p->sched_memqos.memband_div_10_history[2][p->sched_memqos.memband_ringpos] = result[2] / 10; + + p->sched_memqos.memband_div_10_total[3] = p->sched_memqos.memband_div_10_total[3] - p->sched_memqos.memband_div_10_history[3][pos]; + p->sched_memqos.memband_div_10_total[3] = p->sched_memqos.memband_div_10_total[3] + result[3] / 10; + p->sched_memqos.memband_div_10_history[3][p->sched_memqos.memband_ringpos] = result[3] / 10; + + p->sched_memqos.memband_ringpos = (pos + 1) % 10; + + cal_ring_history_average(p->sched_memqos.memband_div_10_history[0], 10, pos, 5); + cal_ring_history_average(p->sched_memqos.memband_div_10_history[1], 10, pos, 5); + cal_ring_history_average(p->sched_memqos.memband_div_10_history[2], 10, pos, 5); + cal_ring_history_average(p->sched_memqos.memband_div_10_history[3], 10, pos, 5); +} + +static DEFINE_PER_CPU(struct phase_event_count, prev_phase_event_count); +static DEFINE_PER_CPU(struct phase_event_count, curr_phase_event_count); + +static void phase_perf_read_events(int cpu, u64 *pdata) +{ + int index; + + for_each_phase_pevents(index, phase_perf_pevents) { + pdata[index] = read_cpu_counter(cpu, index); + } +} + +static inline struct phase_event_count *phase_read_prev(unsigned int cpu) +{ + return &per_cpu(prev_phase_event_count, cpu); +} + +static inline struct phase_event_count *phase_read_curr(unsigned int cpu) +{ + struct phase_event_count *curr = &per_cpu(curr_phase_event_count, cpu); + + phase_perf_read_events(cpu, curr->pcount.data); + + return curr; +} + +void phase_account_task(struct task_struct *p, int cpu) +{ + struct phase_event_count delta; + struct phase_event_count *prev, *curr; + + if (!static_branch_likely(&sched_phase)) + return; + + //if (!sched_core_enabled(cpu_rq(cpu))) + // return; + + /* update phase_event_count */ + prev = phase_read_prev(cpu); + curr = phase_read_curr(cpu); + phase_calc_delta(p, prev, curr, &delta); + *prev = *curr; + + /* calculate phase */ + __phase_cal_ipcx10(p, &delta); + __phase_cal_memband_div_10(p); + p->sched_memqos.sample_times++; + if ((p->sched_memqos.sample_times % 3) == 0) + p->sched_memqos.account_ready = 1; +} + + +void phase_trace_printk(struct task_struct *p) +{ + if (!static_branch_unlikely(&sched_phase_printk)) + return; + + trace_printk("p->comm:%s(%d) ipcpos:%d ipcx10:%d membandpos:%d memband_div_10:%d numa_score[0]:%d numa_score[1]:%d numa_score[2]:%d numa_score[3]:%d turbo:%d prefered_nid:%d classid:%d partid:%d\n", + p->comm, p->pid, p->sched_memqos.ipc_ringpos,\ + p->sched_memqos.ipcx10, \ + p->sched_memqos.memband_ringpos,\ + p->sched_memqos.memband_div_10, \ + p->sched_memqos.numa_score[0], \ + p->sched_memqos.numa_score[1], \ + p->sched_memqos.numa_score[2], \ + p->sched_memqos.numa_score[3], \ + p->sched_memqos.turbo, \ + p->sched_memqos.preferred_nid, \ + p->sched_memqos.class_id, \ + p->closid); +} diff --git a/kernel/sched/memqos/phase_sim_knn.c b/kernel/sched/memqos/phase_sim_knn.c new file mode 100644 index 0000000000000..b80bb6b9ae0a3 --- /dev/null +++ b/kernel/sched/memqos/phase_sim_knn.c @@ -0,0 +1,92 @@ +#include <linux/types.h> + +#define DATA_ROW 20 +void QuickSort(u64 arr[DATA_ROW][2], int L, int R) { + int i = L; + int j = R; + int kk = (L + R) / 2; + u64 pivot = arr[kk][0]; + + while (i <= j) { + while (pivot > arr[i][0]) { + i++; + } + while (pivot < arr[j][0]) { + j--; + } + if (i <= j) { + u64 temp = arr[i][0]; + + arr[i][0] = arr[j][0]; + arr[j][0] = temp; + i++; j--; + } + } + if (L < j) { + QuickSort(arr, L, j); + } + if (i < R) { + QuickSort(arr, i, R); + } +} + +u64 euclidean_distance(u64 *row1, u64 *row2, int col) { + u64 distance = 0; + int i; + + for (i = 0; i < col - 1; i++) { + distance += ((row1[i] - row2[i]) * (row1[i] - row2[i])); + } + return distance; +} + +#define num_neighbors 6 +#define MAX_TAG 8 + +int get_neighbors_tag(u64 train_data[DATA_ROW][3], int train_row, int col, u64 *test_row) { + int i; + u64 neighbors[MAX_TAG] = {0}; + int max_tag = 0; + u64 distances[DATA_ROW][2]; + + for (i = 0; i < train_row; i++) { + distances[i][0] = euclidean_distance(train_data[i], test_row, col); + distances[i][1] = train_data[i][col - 1]; + } + QuickSort(distances, 0, train_row - 1); + for (i = 0; i < num_neighbors; i++) { + neighbors[distances[i][1]]++; + if (neighbors[distances[i][1]] > neighbors[max_tag]) + max_tag = distances[i][1]; + } + return max_tag; +} + +static u64 train_data[DATA_ROW][3] = { + {0, 1, 0}, + {0, 9, 0}, + {0, 20, 1}, + {0, 30, 1}, + {0, 40, 2}, + {0, 50, 3}, + {0, 60, 3}, + {0, 70, 3}, + {0, 80, 4}, + {0, 90, 4}, + {0, 100, 4}, + {0, 110, 5}, + {0, 120, 5}, + {0, 130, 6}, + {0, 140, 6}, + {0, 150, 7}, +}; + +int knn_get_tag(int ipcx10, int memband_div_10) +{ + u64 test_data[2]; + + test_data[0] = ipcx10; + test_data[1] = memband_div_10; + + return get_neighbors_tag(train_data, DATA_ROW, 3, test_data); +} diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 685f9881b8e23..0d2764c4449ce 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -465,6 +465,13 @@ static struct ctl_table kern_table[] = { .extra2 = &one, }, #endif /* CONFIG_NUMA_BALANCING */ +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + { + .procname = "phase", + .mode = 0555, + .child = phase_table, + }, +#endif #endif /* CONFIG_SCHED_DEBUG */ { .procname = "sched_rt_period_us", diff --git a/mm/mempolicy.c b/mm/mempolicy.c index 4cac46d56f387..d748c291e7047 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -2164,12 +2164,15 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma, { struct mempolicy *pol; struct page *page; - int preferred_nid; + int preferred_nid = -1; nodemask_t *nmask; + if (current->sched_memqos.preferred_nid) + preferred_nid = current->sched_memqos.preferred_nid - 1; + pol = get_vma_policy(vma, addr); - if (pol->mode == MPOL_INTERLEAVE) { + if (pol->mode == MPOL_INTERLEAVE && preferred_nid != -1) { unsigned nid; nid = interleave_nid(pol, vma, addr, PAGE_SHIFT + order); @@ -2233,7 +2236,8 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma, } nmask = policy_nodemask(gfp, pol); - preferred_nid = policy_node(gfp, pol, node); + if (preferred_nid == -1) + preferred_nid = policy_node(gfp, pol, node); page = __alloc_pages_nodemask(gfp, order, preferred_nid, nmask); mark_vma_cdm(nmask, page, vma); mpol_cond_put(pol); -- 2.25.1

1 0

[OLK-5.10] RDMA/hns: Add new command to support query vf caps
by Chengchang Tang 23 Mar '23

23 Mar '23

From: Yixing Liu <liuyixing1(a)huawei.com> mainline inclusion form mainline-master category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I6K9B6 CVE: NA Reference: https://patchwork.kernel.org/project/linux-rdma/cover/20230304091555.224129… --------------------------------------------------------------- The current resource query for vf caps is driven by the driver, which is unreasonable. This patch adds a new command HNS_ROCE_OPC_QUERY_PF_CAPS_NUM to support obtaining vf caps information from firmware. Signed-off-by: Yixing Liu <liuyixing1(a)huawei.com> Signed-off-by: Haoyue Xu <xuhaoyue1(a)hisilicon.com> Reviewed-by: Yangyang Li <liyangyang20(a)huawei.com> --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 203 +++++++-------------- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 33 +--- 2 files changed, 64 insertions(+), 172 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index c9826a010f38..cba78f0eac14 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -2157,102 +2157,6 @@ static int hns_roce_v2_set_bt(struct hns_roce_dev *hr_dev) return hns_roce_cmq_send(hr_dev, &desc, 1); } -/* Use default caps when hns_roce_query_pf_caps() failed or init VF profile */ -static void set_default_caps(struct hns_roce_dev *hr_dev) -{ - struct hns_roce_caps *caps = &hr_dev->caps; - - caps->num_qps = HNS_ROCE_V2_MAX_QP_NUM; - caps->max_wqes = HNS_ROCE_V2_MAX_WQE_NUM; - caps->num_cqs = HNS_ROCE_V2_MAX_CQ_NUM; - caps->num_srqs = HNS_ROCE_V2_MAX_SRQ_NUM; - caps->min_cqes = HNS_ROCE_MIN_CQE_NUM; - caps->max_cqes = HNS_ROCE_V2_MAX_CQE_NUM; - caps->max_sq_sg = HNS_ROCE_V2_MAX_SQ_SGE_NUM; - caps->max_extend_sg = HNS_ROCE_V2_MAX_EXTEND_SGE_NUM; - caps->max_rq_sg = HNS_ROCE_V2_MAX_RQ_SGE_NUM; - - caps->num_uars = HNS_ROCE_V2_UAR_NUM; - caps->phy_num_uars = HNS_ROCE_V2_PHY_UAR_NUM; - caps->num_aeq_vectors = HNS_ROCE_V2_AEQE_VEC_NUM; - caps->num_other_vectors = HNS_ROCE_V2_ABNORMAL_VEC_NUM; - caps->num_comp_vectors = 0; - - caps->num_mtpts = HNS_ROCE_V2_MAX_MTPT_NUM; - caps->num_pds = HNS_ROCE_V2_MAX_PD_NUM; - caps->num_qpc_timer = HNS_ROCE_V2_MAX_QPC_TIMER_NUM; - caps->cqc_timer_bt_num = HNS_ROCE_V2_MAX_CQC_TIMER_BT_NUM; - - caps->max_qp_init_rdma = HNS_ROCE_V2_MAX_QP_INIT_RDMA; - caps->max_qp_dest_rdma = HNS_ROCE_V2_MAX_QP_DEST_RDMA; - caps->max_sq_desc_sz = HNS_ROCE_V2_MAX_SQ_DESC_SZ; - caps->max_rq_desc_sz = HNS_ROCE_V2_MAX_RQ_DESC_SZ; - caps->max_srq_desc_sz = HNS_ROCE_V2_MAX_SRQ_DESC_SZ; - caps->irrl_entry_sz = HNS_ROCE_V2_IRRL_ENTRY_SZ; - caps->trrl_entry_sz = HNS_ROCE_V2_EXT_ATOMIC_TRRL_ENTRY_SZ; - caps->cqc_entry_sz = HNS_ROCE_V2_CQC_ENTRY_SZ; - caps->srqc_entry_sz = HNS_ROCE_V2_SRQC_ENTRY_SZ; - caps->mtpt_entry_sz = HNS_ROCE_V2_MTPT_ENTRY_SZ; - caps->idx_entry_sz = HNS_ROCE_V2_IDX_ENTRY_SZ; - caps->page_size_cap = HNS_ROCE_V2_PAGE_SIZE_SUPPORTED; - caps->reserved_lkey = 0; - caps->reserved_pds = 0; - caps->reserved_mrws = 1; - caps->reserved_uars = 0; - caps->reserved_cqs = 0; - caps->reserved_srqs = 0; - caps->reserved_qps = HNS_ROCE_V2_RSV_QPS; - - caps->qpc_hop_num = HNS_ROCE_CONTEXT_HOP_NUM; - caps->srqc_hop_num = HNS_ROCE_CONTEXT_HOP_NUM; - caps->cqc_hop_num = HNS_ROCE_CONTEXT_HOP_NUM; - caps->mpt_hop_num = HNS_ROCE_CONTEXT_HOP_NUM; - caps->sccc_hop_num = HNS_ROCE_SCCC_HOP_NUM; - - caps->mtt_hop_num = HNS_ROCE_MTT_HOP_NUM; - caps->wqe_sq_hop_num = HNS_ROCE_SQWQE_HOP_NUM; - caps->wqe_sge_hop_num = HNS_ROCE_EXT_SGE_HOP_NUM; - caps->wqe_rq_hop_num = HNS_ROCE_RQWQE_HOP_NUM; - caps->cqe_hop_num = HNS_ROCE_CQE_HOP_NUM; - caps->srqwqe_hop_num = HNS_ROCE_SRQWQE_HOP_NUM; - caps->idx_hop_num = HNS_ROCE_IDX_HOP_NUM; - caps->chunk_sz = HNS_ROCE_V2_TABLE_CHUNK_SIZE; - - caps->flags = HNS_ROCE_CAP_FLAG_REREG_MR | - HNS_ROCE_CAP_FLAG_ROCE_V1_V2 | - HNS_ROCE_CAP_FLAG_CQ_RECORD_DB | - HNS_ROCE_CAP_FLAG_QP_RECORD_DB; - - caps->pkey_table_len[0] = 1; - caps->ceqe_depth = HNS_ROCE_V2_COMP_EQE_NUM; - caps->aeqe_depth = HNS_ROCE_V2_ASYNC_EQE_NUM; - caps->local_ca_ack_delay = 0; - caps->max_mtu = IB_MTU_4096; - - caps->max_srq_wrs = HNS_ROCE_V2_MAX_SRQ_WR; - caps->max_srq_sges = HNS_ROCE_V2_MAX_SRQ_SGE; - - caps->flags |= HNS_ROCE_CAP_FLAG_ATOMIC | HNS_ROCE_CAP_FLAG_MW | - HNS_ROCE_CAP_FLAG_SRQ | HNS_ROCE_CAP_FLAG_FRMR | - HNS_ROCE_CAP_FLAG_QP_FLOW_CTRL | HNS_ROCE_CAP_FLAG_XRC; - - caps->gid_table_len[0] = HNS_ROCE_V2_GID_INDEX_NUM; - - if (hr_dev->pci_dev->revision >= PCI_REVISION_ID_HIP09) { - caps->flags |= HNS_ROCE_CAP_FLAG_STASH | - HNS_ROCE_CAP_FLAG_DIRECT_WQE | - HNS_ROCE_CAP_FLAG_DCA_MODE; - caps->max_sq_inline = HNS_ROCE_V3_MAX_SQ_INLINE; - } else { - caps->max_sq_inline = HNS_ROCE_V2_MAX_SQ_INLINE; - - /* The following configuration are only valid for HIP08 */ - caps->qpc_sz = HNS_ROCE_V2_QPC_SZ; - caps->sccc_sz = HNS_ROCE_V2_SCCC_SZ; - caps->cqe_sz = HNS_ROCE_V2_CQE_SIZE; - } -} - static void calc_pg_sz(u32 obj_num, u32 obj_size, u32 hop_num, u32 ctx_bt_num, u32 *buf_page_size, u32 *bt_page_size, u32 hem_type) { @@ -2395,7 +2299,8 @@ static void apply_func_caps(struct hns_roce_dev *hr_dev) if (!caps->num_comp_vectors) caps->num_comp_vectors = min_t(u32, caps->eqc_bt_num - 1, - (u32)priv->handle->rinfo.num_vectors - 2); + (u32)priv->handle->rinfo.num_vectors - + (HNS_ROCE_V2_AEQE_VEC_NUM + HNS_ROCE_V2_ABNORMAL_VEC_NUM)); if (hr_dev->pci_dev->revision >= PCI_REVISION_ID_HIP09) { caps->eqe_hop_num = HNS_ROCE_V3_EQE_HOP_NUM; @@ -2437,7 +2342,7 @@ static void apply_func_caps(struct hns_roce_dev *hr_dev) set_hem_page_size(hr_dev); } -static int hns_roce_query_pf_caps(struct hns_roce_dev *hr_dev) +static int hns_roce_query_caps(struct hns_roce_dev *hr_dev) { struct hns_roce_cmq_desc desc[HNS_ROCE_QUERY_PF_CAPS_CMD_NUM]; struct hns_roce_caps *caps = &hr_dev->caps; @@ -2446,15 +2351,17 @@ static int hns_roce_query_pf_caps(struct hns_roce_dev *hr_dev) struct hns_roce_query_pf_caps_c *resp_c; struct hns_roce_query_pf_caps_d *resp_d; struct hns_roce_query_pf_caps_e *resp_e; + enum hns_roce_opcode_type cmd; int ctx_hop_num; int pbl_hop_num; int ret; int i; + cmd = hr_dev->is_vf ? HNS_ROCE_OPC_QUERY_VF_CAPS_NUM : + HNS_ROCE_OPC_QUERY_PF_CAPS_NUM; + for (i = 0; i < HNS_ROCE_QUERY_PF_CAPS_CMD_NUM; i++) { - hns_roce_cmq_setup_basic_desc(&desc[i], - HNS_ROCE_OPC_QUERY_PF_CAPS_NUM, - true); + hns_roce_cmq_setup_basic_desc(&desc[i], cmd, true); if (i < (HNS_ROCE_QUERY_PF_CAPS_CMD_NUM - 1)) desc[i].flag |= cpu_to_le16(HNS_ROCE_CMD_FLAG_NEXT); else @@ -2471,38 +2378,38 @@ static int hns_roce_query_pf_caps(struct hns_roce_dev *hr_dev) resp_d = (struct hns_roce_query_pf_caps_d *)desc[3].data; resp_e = (struct hns_roce_query_pf_caps_e *)desc[4].data; - caps->local_ca_ack_delay = resp_a->local_ca_ack_delay; - caps->max_sq_sg = le16_to_cpu(resp_a->max_sq_sg); - caps->max_sq_inline = le16_to_cpu(resp_a->max_sq_inline); - caps->max_rq_sg = le16_to_cpu(resp_a->max_rq_sg); + caps->local_ca_ack_delay = resp_a->local_ca_ack_delay; + caps->max_sq_sg = le16_to_cpu(resp_a->max_sq_sg); + caps->max_sq_inline = le16_to_cpu(resp_a->max_sq_inline); + caps->max_rq_sg = le16_to_cpu(resp_a->max_rq_sg); caps->max_rq_sg = roundup_pow_of_two(caps->max_rq_sg); - caps->max_extend_sg = le32_to_cpu(resp_a->max_extend_sg); - caps->num_qpc_timer = le16_to_cpu(resp_a->num_qpc_timer); - caps->max_srq_sges = le16_to_cpu(resp_a->max_srq_sges); + caps->max_extend_sg = le32_to_cpu(resp_a->max_extend_sg); + caps->num_qpc_timer = le16_to_cpu(resp_a->num_qpc_timer); + caps->max_srq_sges = le16_to_cpu(resp_a->max_srq_sges); caps->max_srq_sges = roundup_pow_of_two(caps->max_srq_sges); - caps->num_aeq_vectors = resp_a->num_aeq_vectors; - caps->num_other_vectors = resp_a->num_other_vectors; - caps->max_sq_desc_sz = resp_a->max_sq_desc_sz; - caps->max_rq_desc_sz = resp_a->max_rq_desc_sz; - caps->max_srq_desc_sz = resp_a->max_srq_desc_sz; - caps->cqe_sz = resp_a->cqe_sz; - - caps->mtpt_entry_sz = resp_b->mtpt_entry_sz; - caps->irrl_entry_sz = resp_b->irrl_entry_sz; - caps->trrl_entry_sz = resp_b->trrl_entry_sz; - caps->cqc_entry_sz = resp_b->cqc_entry_sz; - caps->srqc_entry_sz = resp_b->srqc_entry_sz; - caps->idx_entry_sz = resp_b->idx_entry_sz; - caps->sccc_sz = resp_b->sccc_sz; - caps->max_mtu = resp_b->max_mtu; - caps->qpc_sz = le16_to_cpu(resp_b->qpc_sz); - caps->min_cqes = resp_b->min_cqes; - caps->min_wqes = resp_b->min_wqes; - caps->page_size_cap = le32_to_cpu(resp_b->page_size_cap); - caps->pkey_table_len[0] = resp_b->pkey_table_len; - caps->phy_num_uars = resp_b->phy_num_uars; - ctx_hop_num = resp_b->ctx_hop_num; - pbl_hop_num = resp_b->pbl_hop_num; + caps->num_aeq_vectors = resp_a->num_aeq_vectors; + caps->num_other_vectors = resp_a->num_other_vectors; + caps->max_sq_desc_sz = resp_a->max_sq_desc_sz; + caps->max_rq_desc_sz = resp_a->max_rq_desc_sz; + caps->max_srq_desc_sz = resp_a->max_srq_desc_sz; + caps->cqe_sz = resp_a->cqe_sz; + + caps->mtpt_entry_sz = resp_b->mtpt_entry_sz; + caps->irrl_entry_sz = resp_b->irrl_entry_sz; + caps->trrl_entry_sz = resp_b->trrl_entry_sz; + caps->cqc_entry_sz = resp_b->cqc_entry_sz; + caps->srqc_entry_sz = resp_b->srqc_entry_sz; + caps->idx_entry_sz = resp_b->idx_entry_sz; + caps->sccc_sz = resp_b->sccc_sz; + caps->max_mtu = resp_b->max_mtu; + caps->qpc_sz = le16_to_cpu(resp_b->qpc_sz); + caps->min_cqes = resp_b->min_cqes; + caps->min_wqes = resp_b->min_wqes; + caps->page_size_cap = le32_to_cpu(resp_b->page_size_cap); + caps->pkey_table_len[0] = resp_b->pkey_table_len; + caps->phy_num_uars = resp_b->phy_num_uars; + ctx_hop_num = resp_b->ctx_hop_num; + pbl_hop_num = resp_b->pbl_hop_num; caps->num_pds = 1 << hr_reg_read(resp_c, PF_CAPS_C_NUM_PDS); @@ -2525,8 +2432,6 @@ static int hns_roce_query_pf_caps(struct hns_roce_dev *hr_dev) caps->ceqe_depth = 1 << hr_reg_read(resp_d, PF_CAPS_D_CEQ_DEPTH); caps->num_comp_vectors = hr_reg_read(resp_d, PF_CAPS_D_NUM_CEQS); caps->aeqe_depth = 1 << hr_reg_read(resp_d, PF_CAPS_D_AEQ_DEPTH); - caps->default_aeq_arm_st = hr_reg_read(resp_d, PF_CAPS_D_AEQ_ARM_ST); - caps->default_ceq_arm_st = hr_reg_read(resp_d, PF_CAPS_D_CEQ_ARM_ST); caps->reserved_pds = hr_reg_read(resp_d, PF_CAPS_D_RSV_PDS); caps->num_uars = 1 << hr_reg_read(resp_d, PF_CAPS_D_NUM_UARS); caps->reserved_qps = hr_reg_read(resp_d, PF_CAPS_D_RSV_QPS); @@ -2537,10 +2442,6 @@ static int hns_roce_query_pf_caps(struct hns_roce_dev *hr_dev) caps->reserved_cqs = hr_reg_read(resp_e, PF_CAPS_E_RSV_CQS); caps->reserved_srqs = hr_reg_read(resp_e, PF_CAPS_E_RSV_SRQS); caps->reserved_lkey = hr_reg_read(resp_e, PF_CAPS_E_RSV_LKEYS); - caps->default_ceq_max_cnt = le16_to_cpu(resp_e->ceq_max_cnt); - caps->default_ceq_period = le16_to_cpu(resp_e->ceq_period); - caps->default_aeq_max_cnt = le16_to_cpu(resp_e->aeq_max_cnt); - caps->default_aeq_period = le16_to_cpu(resp_e->aeq_period); caps->qpc_hop_num = ctx_hop_num; caps->sccc_hop_num = ctx_hop_num; @@ -2557,6 +2458,20 @@ static int hns_roce_query_pf_caps(struct hns_roce_dev *hr_dev) if (!(caps->page_size_cap & PAGE_SIZE)) caps->page_size_cap = HNS_ROCE_V2_PAGE_SIZE_SUPPORTED; + + if (!hr_dev->is_vf) { + caps->cqe_sz = resp_a->cqe_sz; + caps->qpc_sz = le16_to_cpu(resp_b->qpc_sz); + caps->default_aeq_arm_st = + hr_reg_read(resp_d, PF_CAPS_D_AEQ_ARM_ST); + caps->default_ceq_arm_st = + hr_reg_read(resp_d, PF_CAPS_D_CEQ_ARM_ST); + caps->default_ceq_max_cnt = le16_to_cpu(resp_e->ceq_max_cnt); + caps->default_ceq_period = le16_to_cpu(resp_e->ceq_period); + caps->default_aeq_max_cnt = le16_to_cpu(resp_e->aeq_max_cnt); + caps->default_aeq_period = le16_to_cpu(resp_e->aeq_period); + } + return 0; } @@ -2626,7 +2541,11 @@ static int hns_roce_v2_vf_profile(struct hns_roce_dev *hr_dev) hr_dev->func_num = 1; - set_default_caps(hr_dev); + ret = hns_roce_query_caps(hr_dev); + if (ret) { + dev_err(dev, "failed to query VF caps, ret = %d.\n", ret); + return ret; + } ret = hns_roce_query_vf_resource(hr_dev); if (ret) { @@ -2666,9 +2585,11 @@ static int hns_roce_v2_pf_profile(struct hns_roce_dev *hr_dev) return ret; } - ret = hns_roce_query_pf_caps(hr_dev); - if (ret) - set_default_caps(hr_dev); + ret = hns_roce_query_caps(hr_dev); + if (ret) { + dev_err(dev, "failed to query PF caps, ret = %d.\n", ret); + return ret; + } ret = hns_roce_query_pf_resource(hr_dev); if (ret) { diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index 90401577865e..e5f3a4639bf3 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -35,46 +35,16 @@ #include <linux/bitops.h> -#define HNS_ROCE_V2_MAX_QP_NUM 0x1000 -#define HNS_ROCE_V2_MAX_QPC_TIMER_NUM 0x200 -#define HNS_ROCE_V2_MAX_WQE_NUM 0x8000 -#define HNS_ROCE_V2_MAX_SRQ_WR 0x8000 -#define HNS_ROCE_V2_MAX_SRQ_SGE 64 -#define HNS_ROCE_V2_MAX_CQ_NUM 0x100000 -#define HNS_ROCE_V2_MAX_CQC_TIMER_BT_NUM 0x100 -#define HNS_ROCE_V2_MAX_SRQ_NUM 0x100000 -#define HNS_ROCE_V2_MAX_CQE_NUM 0x400000 -#define HNS_ROCE_V2_MAX_RQ_SGE_NUM 64 -#define HNS_ROCE_V2_MAX_SQ_SGE_NUM 64 -#define HNS_ROCE_V2_MAX_EXTEND_SGE_NUM 0x200000 -#define HNS_ROCE_V2_MAX_SQ_INLINE 0x20 -#define HNS_ROCE_V3_MAX_SQ_INLINE 0x400 #define HNS_ROCE_V2_MAX_RC_INL_INN_SZ 32 -#define HNS_ROCE_V2_UAR_NUM 256 -#define HNS_ROCE_V2_PHY_UAR_NUM 1 +#define HNS_ROCE_V2_MTT_ENTRY_SZ 64 #define HNS_ROCE_V2_AEQE_VEC_NUM 1 #define HNS_ROCE_V2_ABNORMAL_VEC_NUM 1 -#define HNS_ROCE_V2_MAX_MTPT_NUM 0x100000 #define HNS_ROCE_V2_MAX_MTT_SEGS 0x1000000 #define HNS_ROCE_V2_MAX_SRQWQE_SEGS 0x1000000 #define HNS_ROCE_V2_MAX_IDX_SEGS 0x1000000 -#define HNS_ROCE_V2_MAX_PD_NUM 0x1000000 #define HNS_ROCE_V2_MAX_XRCD_NUM 0x1000000 #define HNS_ROCE_V2_RSV_XRCD_NUM 0 -#define HNS_ROCE_V2_MAX_QP_INIT_RDMA 128 -#define HNS_ROCE_V2_MAX_QP_DEST_RDMA 128 -#define HNS_ROCE_V2_MAX_SQ_DESC_SZ 64 -#define HNS_ROCE_V2_MAX_RQ_DESC_SZ 16 -#define HNS_ROCE_V2_MAX_SRQ_DESC_SZ 64 -#define HNS_ROCE_V2_IRRL_ENTRY_SZ 64 -#define HNS_ROCE_V2_EXT_ATOMIC_TRRL_ENTRY_SZ 100 -#define HNS_ROCE_V2_CQC_ENTRY_SZ 64 -#define HNS_ROCE_V2_SRQC_ENTRY_SZ 64 -#define HNS_ROCE_V2_MTPT_ENTRY_SZ 64 -#define HNS_ROCE_V2_MTT_ENTRY_SZ 64 -#define HNS_ROCE_V2_IDX_ENTRY_SZ 4 -#define HNS_ROCE_V2_SCCC_SZ 32 #define HNS_ROCE_V3_SCCC_SZ 64 #define HNS_ROCE_V3_GMV_ENTRY_SZ 32 @@ -242,6 +212,7 @@ enum hns_roce_opcode_type { HNS_ROCE_OPC_QUERY_FUNC_INFO = 0x8407, HNS_ROCE_OPC_QUERY_PF_CAPS_NUM = 0x8408, HNS_ROCE_OPC_CFG_ENTRY_SIZE = 0x8409, + HNS_ROCE_OPC_QUERY_VF_CAPS_NUM = 0x8410, HNS_ROCE_OPC_CFG_SGID_TB = 0x8500, HNS_ROCE_OPC_CFG_SMAC_TB = 0x8501, HNS_ROCE_OPC_POST_MB = 0x8504, -- 2.30.0

1 0

[RFC PATCH openEuler-1.0-LTS] sched: memqos: add memqos for dynamic affinity
by Wang ShaoBo 22 Mar '23

22 Mar '23

Add debug memband interface to dynamic affinity, this would be useful for those threads sensitive to memory bandwidth. Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- arch/arm64/include/asm/mpam.h | 2 + arch/arm64/include/asm/mpam_sched.h | 2 + arch/arm64/kernel/mpam/mpam_device.c | 58 ++- arch/arm64/kernel/mpam/mpam_resctrl.c | 65 ++++ include/linux/memqos.h | 142 +++++++ include/linux/sched.h | 14 +- include/linux/sysctl.h | 2 + kernel/cgroup/cpuset.c | 1 + kernel/exit.c | 3 + kernel/fork.c | 4 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 29 +- kernel/sched/fair.c | 14 +- kernel/sched/memqos/Makefile | 6 + kernel/sched/memqos/memqos.c | 297 +++++++++++++++ kernel/sched/memqos/phase_feature_sysctl.c | 126 +++++++ kernel/sched/memqos/phase_memband.c | 145 ++++++++ kernel/sched/memqos/phase_perf.c | 409 +++++++++++++++++++++ kernel/sched/memqos/phase_sim_knn.c | 92 +++++ kernel/sysctl.c | 7 + mm/mempolicy.c | 10 +- 21 files changed, 1409 insertions(+), 20 deletions(-) create mode 100644 include/linux/memqos.h create mode 100644 kernel/sched/memqos/Makefile create mode 100644 kernel/sched/memqos/memqos.c create mode 100644 kernel/sched/memqos/phase_feature_sysctl.c create mode 100644 kernel/sched/memqos/phase_memband.c create mode 100644 kernel/sched/memqos/phase_perf.c create mode 100644 kernel/sched/memqos/phase_sim_knn.c diff --git a/arch/arm64/include/asm/mpam.h b/arch/arm64/include/asm/mpam.h index 6338eab817e75..269a91d8ca907 100644 --- a/arch/arm64/include/asm/mpam.h +++ b/arch/arm64/include/asm/mpam.h @@ -4,6 +4,8 @@ #ifdef CONFIG_MPAM extern int mpam_rmid_to_partid_pmg(int rmid, int *partid, int *pmg); + +void mpam_component_config_mbwu_mon(int partid, int pmg, int monitor, int *result, int nr); #endif #endif /* _ASM_ARM64_MPAM_H */ diff --git a/arch/arm64/include/asm/mpam_sched.h b/arch/arm64/include/asm/mpam_sched.h index 08ed349b6efa1..32d08cf654b31 100644 --- a/arch/arm64/include/asm/mpam_sched.h +++ b/arch/arm64/include/asm/mpam_sched.h @@ -40,6 +40,8 @@ static inline void mpam_sched_in(void) __mpam_sched_in(); } +void __mpam_sched_in_v2(struct task_struct *tsk); + #else static inline void mpam_sched_in(void) {} diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index 6455c69f132fd..48de3982a0b9a 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -84,14 +84,14 @@ void mpam_class_list_lock_held(void) static inline u32 mpam_read_reg(struct mpam_device *dev, u16 reg) { WARN_ON_ONCE(reg > SZ_MPAM_DEVICE); - assert_spin_locked(&dev->lock); + //assert_spin_locked(&dev->lock); /* * If we touch a device that isn't accessible from this CPU we may get * an external-abort. */ - WARN_ON_ONCE(preemptible()); - WARN_ON_ONCE(!cpumask_test_cpu(smp_processor_id(), &dev->fw_affinity)); + //WARN_ON_ONCE(preemptible()); + //WARN_ON_ONCE(!cpumask_test_cpu(smp_processor_id(), &dev->fw_affinity)); return readl_relaxed(dev->mapped_hwpage + reg); } @@ -99,14 +99,14 @@ static inline u32 mpam_read_reg(struct mpam_device *dev, u16 reg) static inline void mpam_write_reg(struct mpam_device *dev, u16 reg, u32 val) { WARN_ON_ONCE(reg > SZ_MPAM_DEVICE); - assert_spin_locked(&dev->lock); + //assert_spin_locked(&dev->lock); /* * If we touch a device that isn't accessible from this CPU we may get * an external-abort. If we're lucky, we corrupt another mpam:component. */ - WARN_ON_ONCE(preemptible()); - WARN_ON_ONCE(!cpumask_test_cpu(smp_processor_id(), &dev->fw_affinity)); + //WARN_ON_ONCE(preemptible()); + //WARN_ON_ONCE(!cpumask_test_cpu(smp_processor_id(), &dev->fw_affinity)); writel_relaxed(val, dev->mapped_hwpage + reg); } @@ -1208,6 +1208,7 @@ static u32 mpam_device_read_mbwu_mon(struct mpam_device *dev, { u16 mon; u32 clt, flt, cur_clt, cur_flt; + u32 total = 0; mon = args->mon; @@ -1249,7 +1250,12 @@ static u32 mpam_device_read_mbwu_mon(struct mpam_device *dev, wmb(); } - return mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + total += mpam_read_reg(dev, MSMON_MBWU); + return total / 5; } static int mpam_device_frob_mon(struct mpam_device *dev, @@ -1470,6 +1476,44 @@ static void mpam_component_device_sync(void *__ctx) cpumask_set_cpu(smp_processor_id(), &ctx->updated_on); } +static DEFINE_SPINLOCK(mpam_tmp_lock); + +void mpam_component_config_mbwu_mon(int partid, int pmg, int monitor, int *result, int nr) +{ + struct mpam_class *class; + struct mpam_component *comp; + struct mpam_device *dev; + struct sync_args args; + int i = 0; + + args.pmg = pmg; + args.mon = monitor; + args.closid.reqpartid = partid; + args.match_pmg = 1; + + spin_lock(&mpam_tmp_lock); + list_for_each_entry(class, &mpam_classes, classes_list) { + if (class->type != MPAM_CLASS_MEMORY) + continue; + + list_for_each_entry(comp, &class->components, class_list) { + if (i >= nr) { + pr_err_once("error, i > result nr"); + break; + } + result[i] = 0; + list_for_each_entry(dev, &comp->devices, comp_list) { + result[i] += mpam_device_read_mbwu_mon(dev, &args); + } + i++; + } + break; + } + spin_unlock(&mpam_tmp_lock); + +} +EXPORT_SYMBOL(mpam_component_config_mbwu_mon); + /** * in some cases/platforms the MSC register access is only possible with * the associated CPUs. And need to check if those CPUS are online before diff --git a/arch/arm64/kernel/mpam/mpam_resctrl.c b/arch/arm64/kernel/mpam/mpam_resctrl.c index 60d3d8706a38b..f4d87964616f2 100644 --- a/arch/arm64/kernel/mpam/mpam_resctrl.c +++ b/arch/arm64/kernel/mpam/mpam_resctrl.c @@ -2226,6 +2226,71 @@ int mpam_resctrl_init(void) return resctrl_group_init(); } + +void __mpam_sched_in_v2(struct task_struct *tsk) +{ + struct intel_pqr_state *state = this_cpu_ptr(&pqr_state); + u64 partid_d, partid_i; + u64 rmid = state->default_rmid; + u64 closid = state->default_closid; + u64 reqpartid = 0; + u64 pmg = 0; + + /* + * If this task has a closid/rmid assigned, use it. + * Else use the closid/rmid assigned to this cpu. + */ + if (static_branch_likely(&resctrl_alloc_enable_key)) { + if (tsk->closid) + closid = tsk->closid; + } + + if (static_branch_likely(&resctrl_mon_enable_key)) { + if (tsk->rmid) + rmid = tsk->rmid; + } + + if (closid != state->cur_closid || rmid != state->cur_rmid) { + u64 reg; + + resctrl_navie_rmid_partid_pmg(rmid, (int *)&reqpartid, (int *)&pmg); + + if (resctrl_cdp_enabled) { + resctrl_cdp_mpamid_map_val(reqpartid, CDP_DATA, partid_d); + resctrl_cdp_mpamid_map_val(reqpartid, CDP_CODE, partid_i); + + /* set in EL0 */ + reg = mpam_read_sysreg_s(SYS_MPAM0_EL1, "SYS_MPAM0_EL1"); + reg = PARTID_D_SET(reg, partid_d); + reg = PARTID_I_SET(reg, partid_i); + reg = PMG_SET(reg, pmg); + mpam_write_sysreg_s(reg, SYS_MPAM0_EL1, "SYS_MPAM0_EL1"); + + /* set in EL1 */ + reg = mpam_read_sysreg_s(SYS_MPAM1_EL1, "SYS_MPAM1_EL1"); + reg = PARTID_D_SET(reg, partid_d); + reg = PARTID_I_SET(reg, partid_i); + reg = PMG_SET(reg, pmg); + mpam_write_sysreg_s(reg, SYS_MPAM1_EL1, "SYS_MPAM1_EL1"); + } else { + /* set in EL0 */ + reg = mpam_read_sysreg_s(SYS_MPAM0_EL1, "SYS_MPAM0_EL1"); + reg = PARTID_SET(reg, reqpartid); + reg = PMG_SET(reg, pmg); + mpam_write_sysreg_s(reg, SYS_MPAM0_EL1, "SYS_MPAM0_EL1"); + + /* set in EL1 */ + reg = mpam_read_sysreg_s(SYS_MPAM1_EL1, "SYS_MPAM1_EL1"); + reg = PARTID_SET(reg, reqpartid); + reg = PMG_SET(reg, pmg); + mpam_write_sysreg_s(reg, SYS_MPAM1_EL1, "SYS_MPAM1_EL1"); + } + + state->cur_rmid = rmid; + state->cur_closid = closid; + } +} + /* * __intel_rdt_sched_in() - Writes the task's CLOSid/RMID to IA32_PQR_MSR * diff --git a/include/linux/memqos.h b/include/linux/memqos.h new file mode 100644 index 0000000000000..814e9935590d3 --- /dev/null +++ b/include/linux/memqos.h @@ -0,0 +1,142 @@ +#ifndef _MEMQOS_H +#define _MEMQOS_H + +#include <linux/vmstat.h> +#include <linux/rbtree.h> +//#include <linux/sched.h> + +struct task_struct; + +struct memqos_domain { + int dom_id; + int total_memband_div_10; + int total_out_memband_div_10; + + //record 10 timers + int memband_ringpos; + int memband_div_10_history[4][10]; +}; + +struct memqos_mpam_profile { + int partid; + int pmg; + int monitor; + + struct task_struct *tsk; + int used; +}; + +struct memqos_wait_profile { + struct memqos_mpam_profile *profile; + struct list_head wait_list; +}; + +struct memqos_class { + struct list_head turbo_list; + struct list_head tasks_list; +}; + +#include <linux/topology.h> +//embed in task_struct + +struct task_memqos { + int ipc_ringpos; + int ipcx10; + int ipcx10_total[4]; + int ipcx10_history[10]; + + int memband_div_10; + int memband_ringpos; + int memband_div_10_total[4]; + int memband_div_10_history[4][10]; + + u32 sample_times; + int account_ready; + int numa_score[4]; + int turbo; + + struct memqos_wait_profile mpam_profile; + + struct list_head turbo_list; + struct list_head task_list; + + struct cpumask *advise_mem_node_mask; + int preferred_nid; + + int class_id; + + int corrupt; +}; + +#define PHASE_PEVENT_NUM 10 + +struct phase_event_pcount { + u64 data[PHASE_PEVENT_NUM]; +}; + +struct phase_event_count { + struct phase_event_pcount pcount; +}; + +void phase_update_mpam_label(struct task_struct *tsk); + +void phase_release_mpam_label(struct task_struct *tsk); + +static inline void memqos_update_mpam_label(struct task_struct *tsk) +{ + phase_update_mpam_label(tsk); +} + +static inline void memqos_release_mpam_label(struct task_struct *tsk) +{ + phase_release_mpam_label(tsk); +} + +void phase_destroy_waitqueue(struct task_struct *tsk); + +void phase_get_memband(struct memqos_mpam_profile *pm, int *result, int nr); + +DECLARE_STATIC_KEY_FALSE(sched_phase); +DECLARE_STATIC_KEY_FALSE(sched_phase_printk); + +int phase_perf_create(void); + +void phase_perf_release(void); + +void memqos_account_task(struct task_struct *p, int cpu); + +void memqos_drop_class(struct task_struct *p); + +void phase_account_task(struct task_struct *p, int cpu); + +static inline void memqos_task_collect_data(struct task_struct *p, int cpu) +{ + phase_account_task(p, cpu); +} + +static inline void memqos_task_account(struct task_struct *p, int cpu) +{ + memqos_account_task(p, cpu); +} + +static inline void memqos_task_exit(struct task_struct *p) +{ + + memqos_drop_class(p); + phase_destroy_waitqueue(p); +} + +void memqos_select_nicest_cpus(struct task_struct *p); + +void memqos_exclude_low_level_task_single(struct task_struct *p); + +int knn_get_tag(int ipcx10, int memband_div_10); + +void memqos_init_class(struct task_struct *p); + +void phase_trace_printk(struct task_struct *p); +static inline void memqos_trace_printk(struct task_struct *p) +{ + phase_trace_printk(p); +} +#endif diff --git a/include/linux/sched.h b/include/linux/sched.h index 928186f161000..5f710dc5bc03b 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -29,6 +29,7 @@ #include <linux/task_io_accounting.h> #include <linux/rseq.h> #include <linux/thread_bits.h> +#include <linux/memqos.h> /* task_struct member predeclarations (sorted alphabetically): */ struct audit_context; @@ -1268,7 +1269,7 @@ struct task_struct { #if !defined(__GENKSYMS__) #if defined(CONFIG_QOS_SCHED_DYNAMIC_AFFINITY) cpumask_t *prefer_cpus; - const cpumask_t *select_cpus; + cpumask_t *select_cpus; #else KABI_RESERVE(6) KABI_RESERVE(7) @@ -1279,6 +1280,10 @@ struct task_struct { #endif KABI_RESERVE(8) +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + struct task_memqos sched_memqos; +#endif + /* CPU-specific state of this task: */ struct thread_struct thread; @@ -1998,6 +2003,13 @@ int set_prefer_cpus_ptr(struct task_struct *p, const struct cpumask *new_mask); int sched_prefer_cpus_fork(struct task_struct *p, struct task_struct *orig); void sched_prefer_cpus_free(struct task_struct *p); +static inline bool prefer_cpus_valid(struct task_struct *p) +{ + return p->prefer_cpus && + !cpumask_empty(p->prefer_cpus) && + !cpumask_equal(p->prefer_cpus, &p->cpus_allowed) && + cpumask_subset(p->prefer_cpus, &p->cpus_allowed); +} #endif #endif diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h index b769ecfcc3bd4..73bce39107cb3 100644 --- a/include/linux/sysctl.h +++ b/include/linux/sysctl.h @@ -230,6 +230,8 @@ static inline void setup_sysctl_set(struct ctl_table_set *p, #endif /* CONFIG_SYSCTL */ +extern struct ctl_table phase_table[]; + int sysctl_max_threads(struct ctl_table *table, int write, void __user *buffer, size_t *lenp, loff_t *ppos); diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 55bfbc4cdb16c..d94a9065a5605 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -106,6 +106,7 @@ struct cpuset { nodemask_t mems_allowed; #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY cpumask_var_t prefer_cpus; + int mem_turbo; #endif /* effective CPUs and Memory Nodes allow to tasks */ diff --git a/kernel/exit.c b/kernel/exit.c index 2a32d32bdc03d..b731c19618176 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -699,6 +699,8 @@ static void check_stack_usage(void) static inline void check_stack_usage(void) {} #endif +#include <linux/memqos.h> + void __noreturn do_exit(long code) { struct task_struct *tsk = current; @@ -806,6 +808,7 @@ void __noreturn do_exit(long code) * because of cgroup mode, must be called before cgroup_exit() */ perf_event_exit_task(tsk); + memqos_task_exit(tsk); sched_autogroup_exit_task(tsk); cgroup_exit(tsk); diff --git a/kernel/fork.c b/kernel/fork.c index b5453a26655e2..0a762b92dc814 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -841,6 +841,8 @@ void set_task_stack_end_magic(struct task_struct *tsk) *stackend = STACK_END_MAGIC; /* for overflow detection */ } + +#include <linux/memqos.h> static struct task_struct *dup_task_struct(struct task_struct *orig, int node) { struct task_struct *tsk; @@ -923,6 +925,8 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) kcov_task_init(tsk); + memqos_init_class(tsk); + #ifdef CONFIG_FAULT_INJECTION tsk->fail_nth = 0; #endif diff --git a/kernel/sched/Makefile b/kernel/sched/Makefile index 7fe183404c383..471380d6686e3 100644 --- a/kernel/sched/Makefile +++ b/kernel/sched/Makefile @@ -29,3 +29,4 @@ obj-$(CONFIG_CPU_FREQ) += cpufreq.o obj-$(CONFIG_CPU_FREQ_GOV_SCHEDUTIL) += cpufreq_schedutil.o obj-$(CONFIG_MEMBARRIER) += membarrier.o obj-$(CONFIG_CPU_ISOLATION) += isolation.o +obj-$(CONFIG_QOS_SCHED_DYNAMIC_AFFINITY) += memqos/ diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 970616070da86..1171025aaa440 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -2787,6 +2787,8 @@ asmlinkage __visible void schedule_tail(struct task_struct *prev) calculate_sigpending(); } +#include <linux/memqos.h> + /* * context_switch - switch to the new MM and the new thread's register state. */ @@ -2794,6 +2796,8 @@ static __always_inline struct rq * context_switch(struct rq *rq, struct task_struct *prev, struct task_struct *next, struct rq_flags *rf) { + struct rq *ret; + prepare_task_switch(rq, prev, next); /* @@ -2837,6 +2841,18 @@ context_switch(struct rq *rq, struct task_struct *prev, } } + //account and release + memqos_task_account(prev, smp_processor_id()); + + if (prefer_cpus_valid(prev)) + memqos_trace_printk(prev); + + memqos_release_mpam_label(prev); + + //label new task's mpamid + if (prefer_cpus_valid(next)) + memqos_update_mpam_label(next); + rq->clock_update_flags &= ~(RQCF_ACT_SKIP|RQCF_REQ_SKIP); prepare_lock_switch(rq, next, rf); @@ -2845,7 +2861,9 @@ context_switch(struct rq *rq, struct task_struct *prev, switch_to(prev, next, prev); barrier(); - return finish_task_switch(prev); + ret = finish_task_switch(prev); + + return ret; } /* @@ -3058,8 +3076,12 @@ unsigned long long task_sched_runtime(struct task_struct *p) void scheduler_tick(void) { int cpu = smp_processor_id(); + //memqos clooect next cpu's memband and perf + int cpu_memqos = (cpu + 1) % nr_cpu_ids; struct rq *rq = cpu_rq(cpu); + struct rq *rq_next = cpu_rq(cpu_memqos); struct task_struct *curr = rq->curr; + struct task_struct *curr_memqos = rq_next->curr; struct rq_flags rf; sched_clock_tick(); @@ -3075,6 +3097,10 @@ void scheduler_tick(void) perf_event_task_tick(); + //only monitor task enabled dynamic affinity + if (curr_memqos && prefer_cpus_valid(curr_memqos)) + memqos_task_collect_data(curr_memqos, cpu_memqos); + #ifdef CONFIG_SMP rq->idle_balance = idle_cpu(cpu); trigger_load_balance(rq); @@ -3524,6 +3550,7 @@ static void __sched notrace __schedule(bool preempt) /* Also unlocks the rq: */ rq = context_switch(rq, prev, next, &rf); } else { + memqos_task_account(prev, smp_processor_id()); rq->clock_update_flags &= ~(RQCF_ACT_SKIP|RQCF_REQ_SKIP); rq_unlock_irq(rq, &rf); } diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index af55a26d11fcb..12e9675495d2c 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -6675,6 +6675,7 @@ static int wake_cap(struct task_struct *p, int cpu, int prev_cpu) } #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY +#include <linux/memqos.h> /* * Low utilization threshold for CPU * @@ -6749,14 +6750,6 @@ static inline int cpu_vutil_of(int cpu) return cputime->vutil; } -static inline bool prefer_cpus_valid(struct task_struct *p) -{ - return p->prefer_cpus && - !cpumask_empty(p->prefer_cpus) && - !cpumask_equal(p->prefer_cpus, &p->cpus_allowed) && - cpumask_subset(p->prefer_cpus, &p->cpus_allowed); -} - /* * set_task_select_cpus: select the cpu range for task * @p: the task whose available cpu range will to set @@ -6828,8 +6821,13 @@ static void set_task_select_cpus(struct task_struct *p, int *idlest_cpu, if (util_avg_sum < sysctl_sched_util_low_pct * cpumask_weight(p->prefer_cpus)) { p->select_cpus = p->prefer_cpus; + memqos_select_nicest_cpus(p); if (sd_flag & SD_BALANCE_WAKE) schedstat_inc(p->se.dyn_affi_stats->nr_wakeups_preferred_cpus); + } else { + //select trubo task + //select low class task + memqos_exclude_low_level_task_single(p); } } #endif diff --git a/kernel/sched/memqos/Makefile b/kernel/sched/memqos/Makefile new file mode 100644 index 0000000000000..ed8f42649a8a7 --- /dev/null +++ b/kernel/sched/memqos/Makefile @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: GPL-2.0 +# These files are disabled because they produce non-interesting flaky coverage +# that is not a function of syscall inputs. E.g. involuntary context switches. +KCOV_INSTRUMENT := n + +obj-y := memqos.o phase_feature_sysctl.o phase_memband.o phase_perf.o phase_sim_knn.o diff --git a/kernel/sched/memqos/memqos.c b/kernel/sched/memqos/memqos.c new file mode 100644 index 0000000000000..ddf8785439aa6 --- /dev/null +++ b/kernel/sched/memqos/memqos.c @@ -0,0 +1,297 @@ +#include <linux/memqos.h> +#include <linux/cpumask.h> +#include <linux/sched.h> + +static void memqos_set_task_classid(struct task_struct *p) +{ + int class_id; + int memband_div_10 = p->sched_memqos.memband_div_10; + int ipcx10 = p->sched_memqos.ipcx10; + + class_id = knn_get_tag((u64)ipcx10, (u64)memband_div_10); + p->sched_memqos.class_id = class_id; +} + +//static memqos_domain mq_domains[] = { +// {.dom_id = 0, .total_memband = 0, .total_out_memband = 0,}, +// {.dom_id = 1, .total_memband = 0, .total_out_memband = 0,}, +// {.dom_id = 2, .total_memband = 0, .total_out_memband = 0,}, +// {.dom_id = 3, .total_memband = 0, .total_out_memband = 0,}, +//}; + +static DEFINE_PER_CPU(struct memqos_class, memqos_classes[8]); +//static DEFINE_PER_CPU(spinlock_t, memqos_class_lock); +static DEFINE_SPINLOCK(memqos_class_lock); + +static int memqos_class_online(unsigned int cpu) +{ + int class_id = 0; + struct memqos_class *class; + + for (class_id = 0; class_id < 8; class_id++) { + class = &per_cpu(memqos_classes, cpu)[class_id]; + INIT_LIST_HEAD(&class->tasks_list); + INIT_LIST_HEAD(&class->turbo_list); + } + return 0; +} + +static int memqos_class_offline(unsigned int cpu) +{ + return 0; +} + +#include <linux/cpu.h> +#include <linux/cacheinfo.h> + +static void memqos_init(void) +{ + int cpuhp_state = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, + "memqos:online", memqos_class_online, + memqos_class_offline); + if (cpuhp_state <= 0) { + pr_err("Failed to register 'dyn' cpuhp callbacks"); + return; + } +} +late_initcall(memqos_init); + +static void memqos_insert_to_class(struct task_struct *p, int cpu) +{ + unsigned long flag; + int class_id = p->sched_memqos.class_id; + struct memqos_class *class; + struct task_memqos *memqos; + + if (class_id >= 8) + return; + + memqos = &p->sched_memqos; + + class = &per_cpu(memqos_classes, cpu)[class_id]; + + spin_lock_irqsave(&memqos_class_lock, flag); + if (p->sched_memqos.corrupt) { + spin_unlock_irqrestore(&memqos_class_lock, flag); + return; + } + + //pr_info("count:%d %d add (%llx) %llx %llx to list %llx!!!!!!!!!!!!!\n", count, p->pid, &p->sched_memqos.task_list, p->sched_memqos.task_list.next, p->sched_memqos.task_list.prev, &class->tasks_list); + list_move_tail(&p->sched_memqos.task_list, &class->tasks_list); + if (memqos->turbo) + list_move_tail(&p->sched_memqos.turbo_list, &class->turbo_list); + spin_unlock_irqrestore(&memqos_class_lock, flag); +} + +static void memqos_drop_class_without_lock(struct task_struct *p) +{ + //pr_info("%d drop (%llx) %llx %llx to list %llx!!!!!!!!!!!!!\n", p->pid, &p->sched_memqos.task_list, p->sched_memqos.task_list.next, p->sched_memqos.task_list.prev); + list_del_init(&p->sched_memqos.task_list); + list_del_init(&p->sched_memqos.turbo_list); +} + +static void memqos_score(struct task_struct *p) +{ + int total_n1 = p->sched_memqos.memband_div_10_total[0]; + int total_n2 = p->sched_memqos.memband_div_10_total[1]; + int total_n3 = p->sched_memqos.memband_div_10_total[2]; + int total_n4 = p->sched_memqos.memband_div_10_total[3]; + + p->sched_memqos.numa_score[0] = (total_n1 - (total_n2 + total_n3 + total_n4)) * 10 / total_n1; + p->sched_memqos.numa_score[1] = (total_n2 - (total_n1 + total_n3 + total_n4)) * 10 / total_n2; + p->sched_memqos.numa_score[2] = (total_n3 - (total_n1 + total_n2 + total_n4)) * 10 / total_n3; + p->sched_memqos.numa_score[3] = (total_n4 - (total_n1 + total_n2 + total_n3)) * 10 / total_n4; + + //over x% percent + if (p->sched_memqos.numa_score[0] > 0) + p->sched_memqos.turbo = 1; + else if (p->sched_memqos.numa_score[1] > 0) + p->sched_memqos.turbo = 2; + else if (p->sched_memqos.numa_score[2] > 0) + p->sched_memqos.turbo = 3; + else if (p->sched_memqos.numa_score[3] > 0) + p->sched_memqos.turbo = 4; + else + p->sched_memqos.turbo = 0; +} + +void memqos_account_task(struct task_struct *p, int cpu) +{ + if (!p->sched_memqos.account_ready || + p->sched_memqos.corrupt) + return; + memqos_set_task_classid(p); + memqos_insert_to_class(p, cpu); + memqos_score(p); + p->sched_memqos.account_ready = 0; +} + +void memqos_init_class(struct task_struct *p) +{ + memset(&p->sched_memqos, 0, sizeof(struct task_memqos)); + spin_lock(&memqos_class_lock); + INIT_LIST_HEAD(&p->sched_memqos.task_list); + INIT_LIST_HEAD(&p->sched_memqos.turbo_list); + INIT_LIST_HEAD(&p->sched_memqos.mpam_profile.wait_list); + spin_unlock(&memqos_class_lock); + + p->closid = 0; + p->rmid = 0; +} + +//destroy ? +void memqos_drop_class(struct task_struct *p) +{ + spin_lock(&memqos_class_lock); + memqos_drop_class_without_lock(p); + p->sched_memqos.corrupt = 1; + spin_unlock(&memqos_class_lock); +} + +void memqos_select_nicest_cpus(struct task_struct *p) +{ + int i = 0; + int max_score = -10000; + int select_node = 0; + struct task_memqos *memqos = &p->sched_memqos; + + if (!memqos->turbo) { + for (i = 0; i < 4; i++) { + if (!cpumask_intersects(cpumask_of_node(i), p->select_cpus)) + continue; + + if (memqos->numa_score[i] > max_score) { + select_node = i; + max_score = memqos->numa_score[i]; + } + } + + cpumask_and(p->select_cpus, p->select_cpus, cpumask_of_node(select_node)); + //p->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + p->sched_memqos.preferred_nid = memqos->turbo; + return; + } + + select_node = memqos->turbo - 1; + if (cpumask_intersects(cpumask_of_node(select_node), p->select_cpus)) { + cpumask_and(p->select_cpus, p->select_cpus, cpumask_of_node(select_node)); + //p->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + p->sched_memqos.preferred_nid = memqos->turbo; + } + + return; + + //if turbo another cpus, wait... +} + +void memqos_exclude_low_level_task_single(struct task_struct *p) +{ + int i, j, cpu; + int find = 0; + int select_node = 0; + const struct cpumask *cpumask; + struct cpumask *cpumask_med; + struct memqos_class *class; + struct task_memqos *memqos = &p->sched_memqos;; + struct task_struct *tsk = NULL; + int max_score = -100000; + + if (memqos->turbo) { + select_node = memqos->turbo - 1; + cpumask = cpumask_of_node(select_node); + if (!cpumask_intersects(cpumask, p->prefer_cpus) && + (cpumask_intersects(&p->cpus_allowed, cpumask))) { + cpumask_and(p->select_cpus, &p->cpus_allowed, cpumask); + memqos_drop_class(p); + //p->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + p->sched_memqos.preferred_nid = memqos->turbo; + return; + } else if (cpumask_intersects(p->prefer_cpus, cpumask)) { + cpumask_and(p->select_cpus, p->prefer_cpus, cpumask); + //p->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + p->sched_memqos.preferred_nid = memqos->turbo; + } + } + + //select turbo one + for (cpu = 0; cpu < nr_cpu_ids; i++) { + if (!cpumask_test_cpu(cpu, p->prefer_cpus)) + continue; + + spin_lock(&memqos_class_lock); + for (i = 7; i >= 0; i--) { + class = &per_cpu(memqos_classes, cpu)[i]; + list_for_each_entry(memqos, &class->turbo_list, turbo_list) { + if (!memqos->turbo) + continue; + select_node = memqos->turbo - 1; + cpumask = cpumask_of_node(select_node); + if (!cpumask_intersects(cpumask, p->prefer_cpus)) { + tsk = container_of(memqos, struct task_struct, sched_memqos); + if (!cpumask_intersects(cpumask, &tsk->cpus_allowed)) + continue; + cpumask_and(tsk->select_cpus, &tsk->cpus_allowed, cpumask); + //mem prefered + //tsk->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + tsk->sched_memqos.preferred_nid = memqos->turbo; + find = 1; + break; + } + } + if (find) { + memqos_drop_class_without_lock(tsk); + spin_unlock(&memqos_class_lock); + return; + } + } + spin_unlock(&memqos_class_lock); + } + + find = 0; + + //if not, select lower class's tsk + for (cpu = 0; cpu < nr_cpu_ids; i++) { + if (!cpumask_test_cpu(cpu, p->prefer_cpus)) + continue; + + spin_lock(&memqos_class_lock); + //only find below class tsk + for (i = 0; i < memqos->class_id; i++) { + class = &per_cpu(memqos_classes, cpu)[i]; + list_for_each_entry(memqos, &class->tasks_list, task_list) { + if (memqos->turbo) + continue; + + tsk = container_of(memqos, struct task_struct, sched_memqos); + for (j = 0; j < 4; j++) { + if (!cpumask_intersects(cpumask_of_node(i), &tsk->cpus_allowed)) + continue; + if (memqos->numa_score[j] > max_score) { + select_node = j; + max_score = memqos->numa_score[j]; + } + find = 1; + } + if (!find) + continue; + + cpumask_and(cpumask_med, cpumask_of_node(select_node), &tsk->cpus_allowed); + cpumask_andnot(cpumask_med, cpumask_med, p->prefer_cpus); + if (cpumask_empty(cpumask_med)) + continue; + cpumask_copy(tsk->select_cpus, cpumask_med); + //mem prefered + //tsk->sched_memqos.advise_mem_node_mask = cpumask_of_node(select_node); + tsk->sched_memqos.preferred_nid = memqos->turbo; + memqos_drop_class_without_lock(tsk); + spin_unlock(&memqos_class_lock); + return; + } + } + spin_unlock(&memqos_class_lock); + } + + //do not care, this task may out + return; +} + diff --git a/kernel/sched/memqos/phase_feature_sysctl.c b/kernel/sched/memqos/phase_feature_sysctl.c new file mode 100644 index 0000000000000..443ae03275605 --- /dev/null +++ b/kernel/sched/memqos/phase_feature_sysctl.c @@ -0,0 +1,126 @@ +#include <linux/sched.h> +#include <linux/sysctl.h> +#include <linux/capability.h> +#include <linux/cpumask.h> +#include <linux/topology.h> +#include <linux/sched/task.h> + +#include <linux/memqos.h> + +#ifdef CONFIG_PROC_SYSCTL + +DEFINE_STATIC_KEY_FALSE(sched_phase); +DEFINE_STATIC_KEY_FALSE(sched_phase_printk); + +static int set_phase_state(bool enabled) +{ + int err; + int state = static_branch_likely(&sched_phase); + + if (enabled == state) { + pr_warn("phase has already %s\n", state ? "enabled" : "disabled"); + return 0; + } + + if (enabled) { + err = phase_perf_create(); + if (err) { + pr_err("phase enable failed\n"); + return err; + } + static_branch_enable(&sched_phase); + pr_info("phase enabled\n"); + } else { + static_branch_disable(&sched_phase); + phase_perf_release(); + pr_info("phase disabled\n"); + } + + return 0; +} + +/* + * the other procfs files of phase cannot be modified if sched_phase is already enabled + */ +static int phase_proc_state(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) +{ + struct ctl_table t; + int err; + int state = static_branch_likely(&sched_phase); + + if (write && !capable(CAP_SYS_ADMIN)) + return -EPERM; + + t = *table; + t.data = &state; + err = proc_dointvec_minmax(&t, write, buffer, lenp, ppos); + if (err < 0) + return err; + if (write) + err = set_phase_state(state); + + return err; +} + +static int set_phase_state_printk(bool enabled) +{ + if (enabled) { + static_branch_enable(&sched_phase_printk); + } else { + static_branch_disable(&sched_phase_printk); + } + + return 0; +} + +/* + * the other procfs files of phase cannot be modified if sched_phase is already enabled + */ +static int phase_proc_state_printk(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) +{ + struct ctl_table t; + int err; + int state = static_branch_likely(&sched_phase); + + if (write && !capable(CAP_SYS_ADMIN)) + return -EPERM; + + t = *table; + t.data = &state; + err = proc_dointvec_minmax(&t, write, buffer, lenp, ppos); + if (err < 0) + return err; + if (write) + err = set_phase_state_printk(state); + + return err; +} + + +static int __maybe_unused zero; +static int __maybe_unused one = 1; + +struct ctl_table phase_table[] = { + { + .procname = "enabled", + .data = NULL, + .maxlen = sizeof(unsigned int), + .mode = 0644, + .proc_handler = phase_proc_state, + .extra1 = &zero, + .extra2 = &one, + }, + { + .procname = "trace_enabled", + .data = NULL, + .maxlen = sizeof(unsigned int), + .mode = 0644, + .proc_handler = phase_proc_state_printk, + .extra1 = &zero, + .extra2 = &one, + }, + { } +}; +#endif /* CONFIG_PROC_SYSCTL */ diff --git a/kernel/sched/memqos/phase_memband.c b/kernel/sched/memqos/phase_memband.c new file mode 100644 index 0000000000000..d83909c8eca45 --- /dev/null +++ b/kernel/sched/memqos/phase_memband.c @@ -0,0 +1,145 @@ +#include <linux/types.h> +#include <linux/cpu.h> +#include <linux/memqos.h> + +#include <asm/cpu.h> +#include <asm/cputype.h> +#include <asm/cpufeature.h> +#include <asm/mpam_sched.h> + +static const int nr_partid = 15; +static const int nr_monitor = 4; + +static LIST_HEAD(phase_mpam_waitqueue); + +//mpam_profile_res[0] not used +struct memqos_mpam_profile mpam_profile_res[16] = { + { .partid = 0, .monitor = 0, .used = 1}, + { .partid = 1, .monitor = 0,}, + { .partid = 2, .monitor = 1,}, + { .partid = 3, .monitor = 2,}, + { .partid = 4, .monitor = 3,}, + { .partid = 5, .monitor = 0,}, + { .partid = 6, .monitor = 1,}, + { .partid = 7, .monitor = 2,}, + { .partid = 8, .monitor = 3,}, + { .partid = 9, .monitor = 0,}, + { .partid = 10, .monitor = 1,}, + { .partid = 11, .monitor = 2,}, + { .partid = 12, .monitor = 3,}, + { .partid = 13, .monitor = 0,}, + { .partid = 14, .monitor = 1,}, + { .partid = 15, .monitor = 2,}, +}; + +static DEFINE_SPINLOCK(phase_partid_lock); + +void phase_update_mpam_label(struct task_struct *tsk) +{ + int i = 0; + //unsigned long flag; + + WARN_ON_ONCE(tsk->closid); + + if (tsk->sched_memqos.mpam_profile.profile != &mpam_profile_res[0] && + tsk->sched_memqos.mpam_profile.profile != NULL) { + tsk->closid = tsk->sched_memqos.mpam_profile.profile->partid; + tsk->rmid = 0; + mpam_profile_res[tsk->closid].tsk = tsk; + __mpam_sched_in_v2(tsk); + return; + } + + spin_lock(&phase_partid_lock); + //is in profile queue, wait... + if (tsk->sched_memqos.mpam_profile.profile == &mpam_profile_res[0]) { + spin_unlock(&phase_partid_lock); + return; + } + + for (i = 1; i < 16; i++) { + if (mpam_profile_res[i].used) { + continue; + } + + tsk->sched_memqos.mpam_profile.profile = NULL; + break; + } + + if (i == 16) { + list_move_tail(&tsk->sched_memqos.mpam_profile.wait_list, &phase_mpam_waitqueue); + tsk->sched_memqos.mpam_profile.profile = &mpam_profile_res[0]; + spin_unlock(&phase_partid_lock); + //wait... + return; + } + + mpam_profile_res[i].used = 1; + spin_unlock(&phase_partid_lock); + + tsk->closid = mpam_profile_res[i].partid; + mpam_profile_res[i].tsk = tsk; + tsk->sched_memqos.mpam_profile.profile = &mpam_profile_res[i]; + tsk->rmid = 0; + __mpam_sched_in_v2(tsk); +} + +static void phase_release_mpam_label_without_lock(struct task_struct *tsk) +{ + int closid; + struct memqos_wait_profile *next; + + //assert locked + + if (tsk->closid == 0) + return; + + closid = tsk->closid; + tsk->closid = 0; + tsk->sched_memqos.mpam_profile.profile = NULL; + mpam_profile_res[closid].used = 0; + mpam_profile_res[closid].tsk = NULL; + + next = list_first_entry_or_null(&phase_mpam_waitqueue, struct memqos_wait_profile, wait_list); + if (next) { + list_del_init(&next->wait_list); + next->profile = &mpam_profile_res[closid]; + mpam_profile_res[closid].used = 1; + } + + return; +} + +//task shutdown +void phase_destroy_waitqueue(struct task_struct *tsk) +{ + spin_lock(&phase_partid_lock); + + //if (tsk->sched_memqos.mpam_profile.profile == &mpam_profile_res[0]) { + list_del_init(&tsk->sched_memqos.mpam_profile.wait_list); + //} else { + phase_release_mpam_label_without_lock(tsk); + //} + spin_unlock(&phase_partid_lock); +} + +void phase_release_mpam_label(struct task_struct *tsk) +{ + spin_lock(&phase_partid_lock); + phase_release_mpam_label_without_lock(tsk); + spin_unlock(&phase_partid_lock); +} + +#include <asm/mpam.h> +void phase_get_memband(struct memqos_mpam_profile *pm, int *result, int nr) +{ + if (pm == &mpam_profile_res[0] || pm == NULL) { + result[0] = 0; + result[1] = 0; + result[2] = 0; + result[3] = 0; + return; + } + + mpam_component_config_mbwu_mon(pm->partid, pm->pmg, pm->monitor, result, nr); +} diff --git a/kernel/sched/memqos/phase_perf.c b/kernel/sched/memqos/phase_perf.c new file mode 100644 index 0000000000000..9b450a20e808f --- /dev/null +++ b/kernel/sched/memqos/phase_perf.c @@ -0,0 +1,409 @@ +#include <linux/kernel.h> +#include <linux/perf_event.h> +#include <linux/percpu-defs.h> +#include <linux/slab.h> +#include <linux/stop_machine.h> +#include <linux/memqos.h> +#include <linux/sched.h> + +#define PHASE_FEVENT_NUM 3 + +int *phase_perf_pevents = NULL; + +static DEFINE_PER_CPU(__typeof__(struct perf_event *)[PHASE_PEVENT_NUM], cpu_phase_perf_events); + +/****************************************** + * Helpers for phase perf event + *****************************************/ +static inline struct perf_event *perf_event_of_cpu(int cpu, int index) +{ + return per_cpu(cpu_phase_perf_events, cpu)[index]; +} + +static inline struct perf_event **perf_events_of_cpu(int cpu) +{ + return per_cpu(cpu_phase_perf_events, cpu); +} + +static inline u64 perf_event_local_pmu_read(struct perf_event *event) +{ + if (event->state == PERF_EVENT_STATE_ACTIVE) + event->pmu->read(event); + return local64_read(&event->count); +} + +/****************************************** + * Helpers for cpu counters + *****************************************/ +static inline u64 read_cpu_counter(int cpu, int index) +{ + struct perf_event *event = perf_event_of_cpu(cpu, index); + + if (!event || !event->pmu) + return 0; + + return perf_event_local_pmu_read(event); +} + +static struct perf_event_attr *alloc_attr(int event_id) +{ + struct perf_event_attr *attr; + + attr = kzalloc(sizeof(struct perf_event_attr), GFP_KERNEL); + if (!attr) + return ERR_PTR(-ENOMEM); + + attr->type = PERF_TYPE_RAW; + attr->config = event_id; + attr->size = sizeof(struct perf_event_attr); + attr->pinned = 1; + attr->disabled = 1; + //attr->exclude_hv; + //attr->exclude_idle; + //attr->exclude_kernel; + + return attr; +} + +static int create_cpu_counter(int cpu, int event_id, int index) +{ + struct perf_event_attr *attr = NULL; + struct perf_event **events = perf_events_of_cpu(cpu); + struct perf_event *event = NULL; + + attr = alloc_attr(event_id); + if (IS_ERR(attr)) + return PTR_ERR(attr); + + event = perf_event_create_kernel_counter(attr, cpu, NULL, NULL, NULL); + if (IS_ERR(event)) { + pr_err("unable to create perf event (cpu:%i-type:%d-pinned:%d-config:0x%llx) : %ld", + cpu, attr->type, attr->pinned, attr->config, PTR_ERR(event)); + kfree(attr); + return PTR_ERR(event); + } else { + events[index] = event; + perf_event_enable(events[index]); + if (event->hw.idx == -1) { + pr_err("pinned event unable to get onto hardware, perf event (cpu:%i-type:%d-config:0x%llx)", + cpu, attr->type, attr->config); + kfree(attr); + return -EINVAL; + } + pr_info("create perf_event (cpu:%i-idx:%d-type:%d-pinned:%d-exclude_hv:%d" + "-exclude_idle:%d-exclude_kernel:%d-config:0x%llx-addr:%px)", + event->cpu, event->hw.idx, + event->attr.type, event->attr.pinned, event->attr.exclude_hv, + event->attr.exclude_idle, event->attr.exclude_kernel, + event->attr.config, event); + } + + kfree(attr); + return 0; +} + +static int release_cpu_counter(int cpu, int event_id, int index) +{ + struct perf_event **events = perf_events_of_cpu(cpu); + struct perf_event *event = NULL; + + event = events[index]; + + if (!event) + return 0; + + pr_info("release perf_event (cpu:%i-idx:%d-type:%d-pinned:%d-exclude_hv:%d" + "-exclude_idle:%d-exclude_kernel:%d-config:0x%llx)", + event->cpu, event->hw.idx, + event->attr.type, event->attr.pinned, event->attr.exclude_hv, + event->attr.exclude_idle, event->attr.exclude_kernel, + event->attr.config); + + perf_event_release_kernel(event); + events[index] = NULL; + + return 0; +} + +enum { + CYCLES_INDEX = 0, + INST_RETIRED_INDEX, + PHASE_EVENT_FINAL_TERMINATOR +}; + +#define CYCLES 0x0011 +#define INST_RETIRED 0x0008 + +static int pevents[PHASE_PEVENT_NUM] = { + CYCLES, + INST_RETIRED, + PHASE_EVENT_FINAL_TERMINATOR, +}; + +#define for_each_phase_pevents(index, events) \ + for (index = 0; events != NULL && index < PHASE_PEVENT_NUM && \ + events[index] != PHASE_EVENT_FINAL_TERMINATOR; index++) + + +/****************************************** + * Helpers for phase perf + *****************************************/ +static int do_pevents(int (*fn)(int, int, int), int cpu) +{ + int index; + int err; + + for_each_phase_pevents(index, phase_perf_pevents) { + err = fn(cpu, phase_perf_pevents[index], index); + if (err) + return err; + } + + return 0; +} + +static int __phase_perf_create(void *args) +{ + int err; + int cpu = raw_smp_processor_id(); + + /* create pinned events */ + pr_info("create pinned events\n"); + err = do_pevents(create_cpu_counter, cpu); + if (err) { + pr_err("create pinned events failed\n"); + do_pevents(release_cpu_counter, cpu); + return err; + } + + pr_info("[%d] phase class event create success\n", cpu); + return 0; +} + +static int do_phase_perf_create(int *pevents, const struct cpumask *cpus) +{ + phase_perf_pevents = pevents; + return stop_machine(__phase_perf_create, NULL, cpus); +} + +static int __do_phase_perf_release(void *args) +{ + int cpu = raw_smp_processor_id(); + + /* release pinned events */ + pr_info("release pinned events\n"); + do_pevents(release_cpu_counter, cpu); + + pr_info("[%d] phase class event release success\n", cpu); + return 0; +} + +static void do_phase_perf_release(const struct cpumask *cpus) +{ + stop_machine(__do_phase_perf_release, NULL, cpus); + phase_perf_pevents = NULL; +} + +int phase_perf_create(void) +{ + return do_phase_perf_create(pevents, cpu_possible_mask); +} + +void phase_perf_release(void) +{ + do_phase_perf_release(cpu_possible_mask); +} + +DECLARE_STATIC_KEY_FALSE(sched_phase); +DECLARE_STATIC_KEY_FALSE(sched_phase_printk); + +#define PHASE_EVENT_OVERFLOW (~0ULL) + +static inline u64 phase_event_count_sub(u64 curr, u64 prev) +{ + if (curr < prev) { /* ovewrflow */ + u64 tmp = PHASE_EVENT_OVERFLOW - prev; + return curr + tmp; + } else { + return curr - prev; + } +} + +static inline void phase_calc_delta(struct task_struct *p, + struct phase_event_count *prev, + struct phase_event_count *curr, + struct phase_event_count *delta) +{ + int *pevents = phase_perf_pevents; + int index; + + for_each_phase_pevents(index, pevents) { + delta->pcount.data[index] = phase_event_count_sub(curr->pcount.data[index], prev->pcount.data[index]); + } +} + +static inline u64 phase_data_of_pevent(struct phase_event_pcount *counter, int event_id) +{ + int index; + int *events = phase_perf_pevents; + + for_each_phase_pevents(index, events) { + if (event_id == events[index]) + return counter->data[index]; + } + + return 0; +} + +static int cal_ring_history_average(int *history, int nr, int s_pos, int c_nr) +{ + int average = 0; + int start = ((s_pos - c_nr) + nr) % nr; + + if (start < 0) + return 0; + + for (;start != s_pos;) { + if (history[start] == 0) { + c_nr--; + if (c_nr == 0) + return 0; + continue; + } + average += history[start]; + start = (start + 1) % nr; + } + + return start / c_nr; +} + +static void __phase_cal_ipcx10(struct task_struct *p, struct phase_event_count *delta) +{ + u64 ins; + u64 cycles; + //invalid zero + int ipcx10 = 0; + + ins = phase_data_of_pevent(&delta->pcount, INST_RETIRED_INDEX); + cycles = phase_data_of_pevent(&delta->pcount, CYCLES_INDEX); + + if (cycles) + ipcx10 = (ins * 10) / cycles; + + if (static_branch_unlikely(&sched_phase_printk)) { + trace_printk("ins:%lld cycles:%lld\n", ins, cycles); + } + + p->sched_memqos.ipcx10_history[p->sched_memqos.ipc_ringpos] = ipcx10; + p->sched_memqos.ipc_ringpos = (p->sched_memqos.ipc_ringpos + 1) % 10; + cal_ring_history_average(p->sched_memqos.ipcx10_history, 10, p->sched_memqos.ipc_ringpos, 5); +} + +static void __phase_cal_memband_div_10(struct task_struct *p) +{ + int pos; + int result[4]; + + pos = p->sched_memqos.memband_ringpos; + + phase_get_memband(p->sched_memqos.mpam_profile.profile, result, 4); + + if (static_branch_unlikely(&sched_phase_printk)) { + trace_printk("memband:%d %d %d %d profile:%llx\n", result[0], result[1], result[2], result[3], p->sched_memqos.mpam_profile.profile); + } + + p->sched_memqos.memband_div_10_total[0] = p->sched_memqos.memband_div_10_total[0] - p->sched_memqos.memband_div_10_history[0][pos]; + p->sched_memqos.memband_div_10_total[0] = p->sched_memqos.memband_div_10_total[0] + result[0] / 10; + p->sched_memqos.memband_div_10_history[0][p->sched_memqos.memband_ringpos] = result[0] / 10; + + p->sched_memqos.memband_div_10_total[1] = p->sched_memqos.memband_div_10_total[1] - p->sched_memqos.memband_div_10_history[1][pos]; + p->sched_memqos.memband_div_10_total[1] = p->sched_memqos.memband_div_10_total[1] + result[1] / 10; + p->sched_memqos.memband_div_10_history[1][p->sched_memqos.memband_ringpos] = result[1] / 10; + + p->sched_memqos.memband_div_10_total[2] = p->sched_memqos.memband_div_10_total[2] - p->sched_memqos.memband_div_10_history[2][pos]; + p->sched_memqos.memband_div_10_total[2] = p->sched_memqos.memband_div_10_total[2] + result[2] / 10; + p->sched_memqos.memband_div_10_history[2][p->sched_memqos.memband_ringpos] = result[2] / 10; + + p->sched_memqos.memband_div_10_total[3] = p->sched_memqos.memband_div_10_total[3] - p->sched_memqos.memband_div_10_history[3][pos]; + p->sched_memqos.memband_div_10_total[3] = p->sched_memqos.memband_div_10_total[3] + result[3] / 10; + p->sched_memqos.memband_div_10_history[3][p->sched_memqos.memband_ringpos] = result[3] / 10; + + p->sched_memqos.memband_ringpos = (pos + 1) % 10; + + cal_ring_history_average(p->sched_memqos.memband_div_10_history[0], 10, pos, 5); + cal_ring_history_average(p->sched_memqos.memband_div_10_history[1], 10, pos, 5); + cal_ring_history_average(p->sched_memqos.memband_div_10_history[2], 10, pos, 5); + cal_ring_history_average(p->sched_memqos.memband_div_10_history[3], 10, pos, 5); +} + +static DEFINE_PER_CPU(struct phase_event_count, prev_phase_event_count); +static DEFINE_PER_CPU(struct phase_event_count, curr_phase_event_count); + +static void phase_perf_read_events(int cpu, u64 *pdata) +{ + int index; + + for_each_phase_pevents(index, phase_perf_pevents) { + pdata[index] = read_cpu_counter(cpu, index); + } +} + +static inline struct phase_event_count *phase_read_prev(unsigned int cpu) +{ + return &per_cpu(prev_phase_event_count, cpu); +} + +static inline struct phase_event_count *phase_read_curr(unsigned int cpu) +{ + struct phase_event_count *curr = &per_cpu(curr_phase_event_count, cpu); + + phase_perf_read_events(cpu, curr->pcount.data); + + return curr; +} + +void phase_account_task(struct task_struct *p, int cpu) +{ + struct phase_event_count delta; + struct phase_event_count *prev, *curr; + + if (!static_branch_likely(&sched_phase)) + return; + + //if (!sched_core_enabled(cpu_rq(cpu))) + // return; + + /* update phase_event_count */ + prev = phase_read_prev(cpu); + curr = phase_read_curr(cpu); + phase_calc_delta(p, prev, curr, &delta); + *prev = *curr; + + /* calculate phase */ + __phase_cal_ipcx10(p, &delta); + __phase_cal_memband_div_10(p); + p->sched_memqos.sample_times++; + if ((p->sched_memqos.sample_times % 3) == 0) + p->sched_memqos.account_ready = 1; +} + + +void phase_trace_printk(struct task_struct *p) +{ + if (!static_branch_unlikely(&sched_phase_printk)) + return; + + trace_printk("p->comm:%s(%d) ipcpos:%d ipcx10:%d membandpos:%d memband_div_10:%d numa_score[0]:%d numa_score[1]:%d numa_score[2]:%d numa_score[3]:%d turbo:%d prefered_nid:%d classid:%d partid:%d\n", + p->comm, p->pid, p->sched_memqos.ipc_ringpos,\ + p->sched_memqos.ipcx10, \ + p->sched_memqos.memband_ringpos,\ + p->sched_memqos.memband_div_10, \ + p->sched_memqos.numa_score[0], \ + p->sched_memqos.numa_score[1], \ + p->sched_memqos.numa_score[2], \ + p->sched_memqos.numa_score[3], \ + p->sched_memqos.turbo, \ + p->sched_memqos.preferred_nid, \ + p->sched_memqos.class_id, \ + p->closid); +} diff --git a/kernel/sched/memqos/phase_sim_knn.c b/kernel/sched/memqos/phase_sim_knn.c new file mode 100644 index 0000000000000..b80bb6b9ae0a3 --- /dev/null +++ b/kernel/sched/memqos/phase_sim_knn.c @@ -0,0 +1,92 @@ +#include <linux/types.h> + +#define DATA_ROW 20 +void QuickSort(u64 arr[DATA_ROW][2], int L, int R) { + int i = L; + int j = R; + int kk = (L + R) / 2; + u64 pivot = arr[kk][0]; + + while (i <= j) { + while (pivot > arr[i][0]) { + i++; + } + while (pivot < arr[j][0]) { + j--; + } + if (i <= j) { + u64 temp = arr[i][0]; + + arr[i][0] = arr[j][0]; + arr[j][0] = temp; + i++; j--; + } + } + if (L < j) { + QuickSort(arr, L, j); + } + if (i < R) { + QuickSort(arr, i, R); + } +} + +u64 euclidean_distance(u64 *row1, u64 *row2, int col) { + u64 distance = 0; + int i; + + for (i = 0; i < col - 1; i++) { + distance += ((row1[i] - row2[i]) * (row1[i] - row2[i])); + } + return distance; +} + +#define num_neighbors 6 +#define MAX_TAG 8 + +int get_neighbors_tag(u64 train_data[DATA_ROW][3], int train_row, int col, u64 *test_row) { + int i; + u64 neighbors[MAX_TAG] = {0}; + int max_tag = 0; + u64 distances[DATA_ROW][2]; + + for (i = 0; i < train_row; i++) { + distances[i][0] = euclidean_distance(train_data[i], test_row, col); + distances[i][1] = train_data[i][col - 1]; + } + QuickSort(distances, 0, train_row - 1); + for (i = 0; i < num_neighbors; i++) { + neighbors[distances[i][1]]++; + if (neighbors[distances[i][1]] > neighbors[max_tag]) + max_tag = distances[i][1]; + } + return max_tag; +} + +static u64 train_data[DATA_ROW][3] = { + {0, 1, 0}, + {0, 9, 0}, + {0, 20, 1}, + {0, 30, 1}, + {0, 40, 2}, + {0, 50, 3}, + {0, 60, 3}, + {0, 70, 3}, + {0, 80, 4}, + {0, 90, 4}, + {0, 100, 4}, + {0, 110, 5}, + {0, 120, 5}, + {0, 130, 6}, + {0, 140, 6}, + {0, 150, 7}, +}; + +int knn_get_tag(int ipcx10, int memband_div_10) +{ + u64 test_data[2]; + + test_data[0] = ipcx10; + test_data[1] = memband_div_10; + + return get_neighbors_tag(train_data, DATA_ROW, 3, test_data); +} diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 685f9881b8e23..0d2764c4449ce 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -465,6 +465,13 @@ static struct ctl_table kern_table[] = { .extra2 = &one, }, #endif /* CONFIG_NUMA_BALANCING */ +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + { + .procname = "phase", + .mode = 0555, + .child = phase_table, + }, +#endif #endif /* CONFIG_SCHED_DEBUG */ { .procname = "sched_rt_period_us", diff --git a/mm/mempolicy.c b/mm/mempolicy.c index 4cac46d56f387..d748c291e7047 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -2164,12 +2164,15 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma, { struct mempolicy *pol; struct page *page; - int preferred_nid; + int preferred_nid = -1; nodemask_t *nmask; + if (current->sched_memqos.preferred_nid) + preferred_nid = current->sched_memqos.preferred_nid - 1; + pol = get_vma_policy(vma, addr); - if (pol->mode == MPOL_INTERLEAVE) { + if (pol->mode == MPOL_INTERLEAVE && preferred_nid != -1) { unsigned nid; nid = interleave_nid(pol, vma, addr, PAGE_SHIFT + order); @@ -2233,7 +2236,8 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma, } nmask = policy_nodemask(gfp, pol); - preferred_nid = policy_node(gfp, pol, node); + if (preferred_nid == -1) + preferred_nid = policy_node(gfp, pol, node); page = __alloc_pages_nodemask(gfp, order, preferred_nid, nmask); mark_vma_cdm(nmask, page, vma); mpol_cond_put(pol); -- 2.25.1

1 0

[PATCH PR openEuler-22.03-LTS 00/16] test patchwork->PR function
by Jialin Zhang 22 Mar '23

22 Mar '23

Send 16 patches to test patchwork->PR function Baisong Zhong (1): media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() Chen Zhongjin (1): ftrace: Fix invalid address access in lookup_rec() when index is 0 Darrick J. Wong (1): ext4: fix another off-by-one fsmap error on 1k block filesystems David Hildenbrand (2): mm: optimize do_wp_page() for exclusive pages in the swapcache mm: optimize do_wp_page() for fresh pages in local LRU pagevecs Kuniyuki Iwashima (1): seccomp: Move copy_seccomp() to no failure path. Li Huafei (2): livepatch: Cleanup klp_mem_prepare() livepatch: Narrow the scope of the 'text_mutex' lock Luke D. Jones (1): HID: asus: Remove check for same LED brightness on set Nicholas Piggin (1): mm/vmalloc: huge vmalloc backing pages should be split rather than compound Pietro Borrello (2): HID: asus: use spinlock to protect concurrent accesses HID: asus: use spinlock to safely schedule workers Xin Long (2): tipc: set con sock in tipc_conn_alloc tipc: add an extra conn_get in tipc_conn_alloc Zheng Yejian (1): livepatch/core: Fix hungtask against cpu hotplug on x86 Zhihao Cheng (1): jbd2: fix data missing when reusing bh which is ready to be checkpointed arch/x86/kernel/livepatch.c | 11 +++++-- drivers/hid/hid-asus.c | 38 ++++++++++++++++++----- drivers/media/usb/dvb-usb/az6027.c | 4 +++ fs/ext4/fsmap.c | 2 ++ fs/jbd2/transaction.c | 50 +++++++++++++++++------------- kernel/fork.c | 17 ++++++---- kernel/livepatch/core.c | 49 ++++++++++++++++++++--------- kernel/trace/ftrace.c | 3 +- mm/memory.c | 28 +++++++++++++---- mm/vmalloc.c | 22 ++++++++++--- net/tipc/topsrv.c | 20 ++++++------ 11 files changed, 172 insertions(+), 72 deletions(-) -- 2.25.1

1 16

[PATCH openEuler-5.10-LTS-SP1 01/16] jbd2: fix data missing when reusing bh which is ready to be checkpointed
by Jialin Zhang 22 Mar '23

22 Mar '23

From: Zhihao Cheng <chengzhihao1(a)huawei.com> mainline inclusion from mainline-v6.3-rc1 commit e6b9bd7290d334451ce054e98e752abc055e0034 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6C5HV CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Following process will make data lost and could lead to a filesystem corrupted problem: 1. jh(bh) is inserted into T1->t_checkpoint_list, bh is dirty, and jh->b_transaction = NULL 2. T1 is added into journal->j_checkpoint_transactions. 3. Get bh prepare to write while doing checkpoing: PA PB do_get_write_access jbd2_log_do_checkpoint spin_lock(&jh->b_state_lock) if (buffer_dirty(bh)) clear_buffer_dirty(bh) // clear buffer dirty set_buffer_jbddirty(bh) transaction = journal->j_checkpoint_transactions jh = transaction->t_checkpoint_list if (!buffer_dirty(bh)) __jbd2_journal_remove_checkpoint(jh) // bh won't be flushed jbd2_cleanup_journal_tail __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved) 4. Aborting journal/Power-cut before writing latest bh on journal area. In this way we get a corrupted filesystem with bh's data lost. Fix it by moving the clearing of buffer_dirty bit just before the call to __jbd2_journal_file_buffer(), both bit clearing and jh->b_transaction assignment are under journal->j_list_lock locked, so that jbd2_log_do_checkpoint() will wait until jh's new transaction fininshed even bh is currently not dirty. And journal_shrink_one_cp_list() won't remove jh from checkpoint list if the buffer head is reused in do_get_write_access(). Fetch a reproducer in [Link]. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216898 Cc: <stable(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: zhanchengbin <zhanchengbin1(a)huawei.com> Suggested-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20230110015327.1181863-1-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/jbd2/transaction.c | 50 +++++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 21 deletions(-) diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c index cefee2dead54..8fa88c42fcb4 100644 --- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -984,36 +984,28 @@ do_get_write_access(handle_t *handle, struct journal_head *jh, * ie. locked but not dirty) or tune2fs (which may actually have * the buffer dirtied, ugh.) */ - if (buffer_dirty(bh)) { + if (buffer_dirty(bh) && jh->b_transaction) { + warn_dirty_buffer(bh); /* - * First question: is this buffer already part of the current - * transaction or the existing committing transaction? - */ - if (jh->b_transaction) { - J_ASSERT_JH(jh, - jh->b_transaction == transaction || - jh->b_transaction == - journal->j_committing_transaction); - if (jh->b_next_transaction) - J_ASSERT_JH(jh, jh->b_next_transaction == - transaction); - warn_dirty_buffer(bh); - } - /* - * In any case we need to clean the dirty flag and we must - * do it under the buffer lock to be sure we don't race - * with running write-out. + * We need to clean the dirty flag and we must do it under the + * buffer lock to be sure we don't race with running write-out. */ JBUFFER_TRACE(jh, "Journalling dirty buffer"); clear_buffer_dirty(bh); + /* + * The buffer is going to be added to BJ_Reserved list now and + * nothing guarantees jbd2_journal_dirty_metadata() will be + * ever called for it. So we need to set jbddirty bit here to + * make sure the buffer is dirtied and written out when the + * journaling machinery is done with it. + */ set_buffer_jbddirty(bh); } - unlock_buffer(bh); - error = -EROFS; if (is_handle_aborted(handle)) { spin_unlock(&jh->b_state_lock); + unlock_buffer(bh); goto out; } error = 0; @@ -1023,8 +1015,10 @@ do_get_write_access(handle_t *handle, struct journal_head *jh, * b_next_transaction points to it */ if (jh->b_transaction == transaction || - jh->b_next_transaction == transaction) + jh->b_next_transaction == transaction) { + unlock_buffer(bh); goto done; + } /* * this is the first time this transaction is touching this buffer, @@ -1048,10 +1042,24 @@ do_get_write_access(handle_t *handle, struct journal_head *jh, */ smp_wmb(); spin_lock(&journal->j_list_lock); + if (test_clear_buffer_dirty(bh)) { + /* + * Execute buffer dirty clearing and jh->b_transaction + * assignment under journal->j_list_lock locked to + * prevent bh being removed from checkpoint list if + * the buffer is in an intermediate state (not dirty + * and jh->b_transaction is NULL). + */ + JBUFFER_TRACE(jh, "Journalling dirty buffer"); + set_buffer_jbddirty(bh); + } __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved); spin_unlock(&journal->j_list_lock); + unlock_buffer(bh); goto done; } + unlock_buffer(bh); + /* * If there is already a copy-out version of this buffer, then we don't * need to make another one -- 2.25.1

1 15

[PATCH openEuler-5.10-LTS-SP1 01/14] jbd2: fix data missing when reusing bh which is ready to be checkpointed
by Jialin Zhang 22 Mar '23

22 Mar '23

From: Zhihao Cheng <chengzhihao1(a)huawei.com> mainline inclusion from mainline-v6.3-rc1 commit e6b9bd7290d334451ce054e98e752abc055e0034 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6C5HV CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Following process will make data lost and could lead to a filesystem corrupted problem: 1. jh(bh) is inserted into T1->t_checkpoint_list, bh is dirty, and jh->b_transaction = NULL 2. T1 is added into journal->j_checkpoint_transactions. 3. Get bh prepare to write while doing checkpoing: PA PB do_get_write_access jbd2_log_do_checkpoint spin_lock(&jh->b_state_lock) if (buffer_dirty(bh)) clear_buffer_dirty(bh) // clear buffer dirty set_buffer_jbddirty(bh) transaction = journal->j_checkpoint_transactions jh = transaction->t_checkpoint_list if (!buffer_dirty(bh)) __jbd2_journal_remove_checkpoint(jh) // bh won't be flushed jbd2_cleanup_journal_tail __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved) 4. Aborting journal/Power-cut before writing latest bh on journal area. In this way we get a corrupted filesystem with bh's data lost. Fix it by moving the clearing of buffer_dirty bit just before the call to __jbd2_journal_file_buffer(), both bit clearing and jh->b_transaction assignment are under journal->j_list_lock locked, so that jbd2_log_do_checkpoint() will wait until jh's new transaction fininshed even bh is currently not dirty. And journal_shrink_one_cp_list() won't remove jh from checkpoint list if the buffer head is reused in do_get_write_access(). Fetch a reproducer in [Link]. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216898 Cc: <stable(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: zhanchengbin <zhanchengbin1(a)huawei.com> Suggested-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20230110015327.1181863-1-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/jbd2/transaction.c | 50 +++++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 21 deletions(-) diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c index cefee2dead54..8fa88c42fcb4 100644 --- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -984,36 +984,28 @@ do_get_write_access(handle_t *handle, struct journal_head *jh, * ie. locked but not dirty) or tune2fs (which may actually have * the buffer dirtied, ugh.) */ - if (buffer_dirty(bh)) { + if (buffer_dirty(bh) && jh->b_transaction) { + warn_dirty_buffer(bh); /* - * First question: is this buffer already part of the current - * transaction or the existing committing transaction? - */ - if (jh->b_transaction) { - J_ASSERT_JH(jh, - jh->b_transaction == transaction || - jh->b_transaction == - journal->j_committing_transaction); - if (jh->b_next_transaction) - J_ASSERT_JH(jh, jh->b_next_transaction == - transaction); - warn_dirty_buffer(bh); - } - /* - * In any case we need to clean the dirty flag and we must - * do it under the buffer lock to be sure we don't race - * with running write-out. + * We need to clean the dirty flag and we must do it under the + * buffer lock to be sure we don't race with running write-out. */ JBUFFER_TRACE(jh, "Journalling dirty buffer"); clear_buffer_dirty(bh); + /* + * The buffer is going to be added to BJ_Reserved list now and + * nothing guarantees jbd2_journal_dirty_metadata() will be + * ever called for it. So we need to set jbddirty bit here to + * make sure the buffer is dirtied and written out when the + * journaling machinery is done with it. + */ set_buffer_jbddirty(bh); } - unlock_buffer(bh); - error = -EROFS; if (is_handle_aborted(handle)) { spin_unlock(&jh->b_state_lock); + unlock_buffer(bh); goto out; } error = 0; @@ -1023,8 +1015,10 @@ do_get_write_access(handle_t *handle, struct journal_head *jh, * b_next_transaction points to it */ if (jh->b_transaction == transaction || - jh->b_next_transaction == transaction) + jh->b_next_transaction == transaction) { + unlock_buffer(bh); goto done; + } /* * this is the first time this transaction is touching this buffer, @@ -1048,10 +1042,24 @@ do_get_write_access(handle_t *handle, struct journal_head *jh, */ smp_wmb(); spin_lock(&journal->j_list_lock); + if (test_clear_buffer_dirty(bh)) { + /* + * Execute buffer dirty clearing and jh->b_transaction + * assignment under journal->j_list_lock locked to + * prevent bh being removed from checkpoint list if + * the buffer is in an intermediate state (not dirty + * and jh->b_transaction is NULL). + */ + JBUFFER_TRACE(jh, "Journalling dirty buffer"); + set_buffer_jbddirty(bh); + } __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved); spin_unlock(&journal->j_list_lock); + unlock_buffer(bh); goto done; } + unlock_buffer(bh); + /* * If there is already a copy-out version of this buffer, then we don't * need to make another one -- 2.25.1

1 13

[PATCH openEuler-1.0-LTS] ext4: fix another off-by-one fsmap error on 1k block filesystems
by Yongqiang Liu 22 Mar '23

22 Mar '23

From: "Darrick J. Wong" <djwong(a)kernel.org> mainline inclusion from mainline-v6.3-rc2 commit c993799baf9c5861f8df91beb80e1611b12efcbd category: bugfix bugzilla: 188522,https://gitee.com/openeuler/kernel/issues/I6N7ZP CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Apparently syzbot figured out that issuing this FSMAP call: struct fsmap_head cmd = { .fmh_count = ...; .fmh_keys = { { .fmr_device = /* ext4 dev */, .fmr_physical = 0, }, { .fmr_device = /* ext4 dev */, .fmr_physical = 0, }, }, ... }; ret = ioctl(fd, FS_IOC_GETFSMAP, &cmd); Produces this crash if the underlying filesystem is a 1k-block ext4 filesystem: kernel BUG at fs/ext4/ext4.h:3331! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 3 PID: 3227965 Comm: xfs_io Tainted: G W O 6.2.0-rc8-achx Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4] RSP: 0018:ffffc90007c03998 EFLAGS: 00010246 RAX: ffff888004978000 RBX: ffffc90007c03a20 RCX: ffff888041618000 RDX: 0000000000000000 RSI: 00000000000005a4 RDI: ffffffffa0c99b11 RBP: ffff888012330000 R08: ffffffffa0c2b7d0 R09: 0000000000000400 R10: ffffc90007c03950 R11: 0000000000000000 R12: 0000000000000001 R13: 00000000ffffffff R14: 0000000000000c40 R15: ffff88802678c398 FS: 00007fdf2020c880(0000) GS:ffff88807e100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd318a5fe8 CR3: 000000007f80f001 CR4: 00000000001706e0 Call Trace: <TASK> ext4_mballoc_query_range+0x4b/0x210 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_getfsmap_datadev+0x713/0x890 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_getfsmap+0x2b7/0x330 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_ioc_getfsmap+0x153/0x2b0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] __ext4_ioctl+0x2a7/0x17e0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] __x64_sys_ioctl+0x82/0xa0 do_syscall_64+0x2b/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fdf20558aff RSP: 002b:00007ffd318a9e30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000000200c0 RCX: 00007fdf20558aff RDX: 00007fdf1feb2010 RSI: 00000000c0c0583b RDI: 0000000000000003 RBP: 00005625c0634be0 R08: 00005625c0634c40 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdf1feb2010 R13: 00005625be70d994 R14: 0000000000000800 R15: 0000000000000000 For GETFSMAP calls, the caller selects a physical block device by writing its block number into fsmap_head.fmh_keys[01].fmr_device. To query mappings for a subrange of the device, the starting byte of the range is written to fsmap_head.fmh_keys[0].fmr_physical and the last byte of the range goes in fsmap_head.fmh_keys[1].fmr_physical. IOWs, to query what mappings overlap with bytes 3-14 of /dev/sda, you'd set the inputs as follows: fmh_keys[0] = { .fmr_device = major(8, 0), .fmr_physical = 3}, fmh_keys[1] = { .fmr_device = major(8, 0), .fmr_physical = 14}, Which would return you whatever is mapped in the 12 bytes starting at physical offset 3. The crash is due to insufficient range validation of keys[1] in ext4_getfsmap_datadev. On 1k-block filesystems, block 0 is not part of the filesystem, which means that s_first_data_block is nonzero. ext4_get_group_no_and_offset subtracts this quantity from the blocknr argument before cracking it into a group number and a block number within a group. IOWs, block group 0 spans blocks 1-8192 (1-based) instead of 0-8191 (0-based) like what happens with larger blocksizes. The net result of this encoding is that blocknr < s_first_data_block is not a valid input to this function. The end_fsb variable is set from the keys that are copied from userspace, which means that in the above example, its value is zero. That leads to an underflow here: blocknr = blocknr - le32_to_cpu(es->s_first_data_block); The division then operates on -1: offset = do_div(blocknr, EXT4_BLOCKS_PER_GROUP(sb)) >> EXT4_SB(sb)->s_cluster_bits; Leaving an impossibly large group number (2^32-1) in blocknr. ext4_getfsmap_check_keys checked that keys[0].fmr_physical and keys[1].fmr_physical are in increasing order, but ext4_getfsmap_datadev adjusts keys[0].fmr_physical to be at least s_first_data_block. This implies that we have to check it again after the adjustment, which is the piece that I forgot. Reported-by: syzbot+6be2b977c89f79b6b153(a)syzkaller.appspotmail.com Fixes: 4a4956249dac ("ext4: fix off-by-one fsmap error on 1k block filesystems") Link: https://syzkaller.appspot.com/bug?id=79d5768e9bfe362911ac1a5057a36fc6b5c300… Cc: stable(a)vger.kernel.org Signed-off-by: Darrick J. Wong <djwong(a)kernel.org> Link: https://lore.kernel.org/r/Y+58NPTH7VNGgzdd@magnolia Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/fsmap.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c index 6f3f245f3a80..6b52ace1463c 100644 --- a/fs/ext4/fsmap.c +++ b/fs/ext4/fsmap.c @@ -486,6 +486,8 @@ static int ext4_getfsmap_datadev(struct super_block *sb, keys[0].fmr_physical = bofs; if (keys[1].fmr_physical >= eofs) keys[1].fmr_physical = eofs - 1; + if (keys[1].fmr_physical < keys[0].fmr_physical) + return 0; start_fsb = keys[0].fmr_physical; end_fsb = keys[1].fmr_physical; -- 2.25.1

1 0

openEuler Kernel SIG双周例会
by openEuler conference 22 Mar '23

22 Mar '23

您好！ Kernel SIG 邀请您参加 2023-03-24 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/85131900036?pwd=RFZVYlZFK3B1RVhpTHROOW82OTdLQT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-03-24 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/85131900036?pwd=RFZVYlZFK3B1RVhpTHROOW82OTdLQT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS 1/2] tipc: set con sock in tipc_conn_alloc
by Yongqiang Liu 21 Mar '23

21 Mar '23

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v4.19.268 commit 2c9c64a95d97727c9ada0d35abc90ee5fdbaeff7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6NCRH CVE: CVE-2023-1382 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0e5d56c64afcd6fd2d132ea972605b66f8a7d3c4 ] A crash was reported by Wei Chen: BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:tipc_conn_close+0x12/0x100 Call Trace: tipc_topsrv_exit_net+0x139/0x320 ops_exit_list.isra.9+0x49/0x80 cleanup_net+0x31a/0x540 process_one_work+0x3fa/0x9f0 worker_thread+0x42/0x5c0 It was caused by !con->sock in tipc_conn_close(). In tipc_topsrv_accept(), con is allocated in conn_idr then its sock is set: con = tipc_conn_alloc(); ... <----[1] con->sock = newsock; If tipc_conn_close() is called in anytime of [1], the null-pointer-def is triggered by con->sock->sk due to con->sock is not yet set. This patch fixes it by moving the con->sock setting to tipc_conn_alloc() under s->idr_lock. So that con->sock can never be NULL when getting the con from s->conn_idr. It will be also safer to move con->server and flag CF_CONNECTED setting under s->idr_lock, as they should all be set before tipc_conn_alloc() is called. Fixes: c5fa7b3cf3cb ("tipc: introduce new TIPC server infrastructure") Reported-by: Wei Chen <harperchen1110(a)gmail.com> Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Acked-by: Jon Maloy <jmaloy(a)redhat.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> conflict: net/tipc/topsrv.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/tipc/topsrv.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c index 1c4733153d74..89a1f127dfaf 100644 --- a/net/tipc/topsrv.c +++ b/net/tipc/topsrv.c @@ -184,7 +184,7 @@ static void tipc_conn_close(struct tipc_conn *con) conn_put(con); } -static struct tipc_conn *tipc_conn_alloc(struct tipc_topsrv *s) +static struct tipc_conn *tipc_conn_alloc(struct tipc_topsrv *s, struct socket *sock) { struct tipc_conn *con; int ret; @@ -210,10 +210,11 @@ static struct tipc_conn *tipc_conn_alloc(struct tipc_topsrv *s) } con->conid = ret; s->idr_in_use++; - spin_unlock_bh(&s->idr_lock); set_bit(CF_CONNECTED, &con->flags); con->server = s; + con->sock = sock; + spin_unlock_bh(&s->idr_lock); return con; } @@ -467,7 +468,7 @@ static void tipc_topsrv_accept(struct work_struct *work) ret = kernel_accept(lsock, &newsock, O_NONBLOCK); if (ret < 0) return; - con = tipc_conn_alloc(srv); + con = tipc_conn_alloc(srv, newsock); if (IS_ERR(con)) { ret = PTR_ERR(con); sock_release(newsock); @@ -479,7 +480,6 @@ static void tipc_topsrv_accept(struct work_struct *work) newsk->sk_data_ready = tipc_conn_data_ready; newsk->sk_write_space = tipc_conn_write_space; newsk->sk_user_data = con; - con->sock = newsock; write_unlock_bh(&newsk->sk_callback_lock); /* Wake up receive process in case of 'SYN+' message */ @@ -577,12 +577,11 @@ bool tipc_topsrv_kern_subscr(struct net *net, u32 port, u32 type, u32 lower, sub.filter = filter; *(u32 *)&sub.usr_handle = port; - con = tipc_conn_alloc(tipc_topsrv(net)); + con = tipc_conn_alloc(tipc_topsrv(net), NULL); if (IS_ERR(con)) return false; *conid = con->conid; - con->sock = NULL; rc = tipc_conn_rcv_sub(tipc_topsrv(net), con, &sub); if (rc >= 0) return true; -- 2.25.1

1 1

[PATCH PR openEuler-22.03-LTS-SP1] mm/vmalloc: huge vmalloc backing pages should be split rather than compound
by Jialin Zhang 21 Mar '23

21 Mar '23

From: Nicholas Piggin <npiggin(a)gmail.com> mainline inclusion from mainline-v5.18-rc4 commit 3b8000ae185cb068adbda5f966a3835053c85fd4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6LD0S CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Huge vmalloc higher-order backing pages were allocated with __GFP_COMP in order to allow the sub-pages to be refcounted by callers such as "remap_vmalloc_page [sic]" (remap_vmalloc_range). However a similar problem exists for other struct page fields callers use, for example fb_deferred_io_fault() takes a vmalloc'ed page and not only refcounts it but uses ->lru, ->mapping, ->index. This is not compatible with compound sub-pages, and can cause bad page state issues like BUG: Bad page state in process swapper/0 pfn:00743 page:(____ptrval____) refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x743 flags: 0x7ffff000000000(node=0|zone=0|lastcpupid=0x7ffff) raw: 007ffff000000000 c00c00000001d0c8 c00c00000001d0c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: corrupted mapping in tail page Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.18.0-rc3-00082-gfc6fff4a7ce1-dirty #2810 Call Trace: dump_stack_lvl+0x74/0xa8 (unreliable) bad_page+0x12c/0x170 free_tail_pages_check+0xe8/0x190 free_pcp_prepare+0x31c/0x4e0 free_unref_page+0x40/0x1b0 __vunmap+0x1d8/0x420 ... The correct approach is to use split high-order pages for the huge vmalloc backing. These allow callers to treat them in exactly the same way as individually-allocated order-0 pages. Link: https://lore.kernel.org/all/14444103-d51b-0fb3-ee63-c3f182f0b546@molgen.mpg… Signed-off-by: Nicholas Piggin <npiggin(a)gmail.com> Cc: Paul Menzel <pmenzel(a)molgen.mpg.de> Cc: Song Liu <songliubraving(a)fb.com> Cc: Rick Edgecombe <rick.p.edgecombe(a)intel.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> conflicts: mm/vmalloc.c Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- mm/vmalloc.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index e27cd716ca95..2ca2c1bc0db9 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -2641,14 +2641,17 @@ static void __vunmap(const void *addr, int deallocate_pages) vm_remove_mappings(area, deallocate_pages); if (deallocate_pages) { - unsigned int page_order = vm_area_page_order(area); int i; - for (i = 0; i < area->nr_pages; i += 1U << page_order) { + for (i = 0; i < area->nr_pages; i++) { struct page *page = area->pages[i]; BUG_ON(!page); - __free_pages(page, page_order); + /* + * High-order allocs for huge vmallocs are split, so + * can be freed as an array of order-0 allocations + */ + __free_pages(page, 0); } atomic_long_sub(area->nr_pages, &nr_vmalloc_pages); @@ -2930,8 +2933,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask, struct page *page; int p; - /* Compound pages required for remap_vmalloc_page */ - page = alloc_pages_node(node, gfp_mask | __GFP_COMP, page_order); + page = alloc_pages_node(node, gfp_mask, page_order); if (unlikely(!page)) { /* Successfully allocated i pages, free them in __vfree() */ area->nr_pages = i; @@ -2943,6 +2945,16 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask, goto fail; } + /* + * Higher order allocations must be able to be treated as + * indepdenent small pages by callers (as they can with + * small-page vmallocs). Some drivers do their own refcounting + * on vmalloc_to_page() pages, some use page->mapping, + * page->lru, etc. + */ + if (page_order) + split_page(page, page_order); + for (p = 0; p < (1U << page_order); p++) area->pages[i + p] = page + p; -- 2.25.1

1 0

[PATCH openEuler-23.03] Fix CVE-2023-23005, CVE-2023-0597 and CVE-2022-4269
by Jialin Zhang 18 Mar '23

18 Mar '23

Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- ...NULL-vs-IS_ERR-checking-in-memory_ti.patch | 50 +++++ ...-x86-mm-Randomize-per-cpu-entry-area.patch | 172 ++++++++++++++++++ ...ap-shadow-for-percpu-pages-on-demand.patch | 126 +++++++++++++ ...-physical-address-for-every-page-of-.patch | 50 +++++ ...KASAN-shadow-for-entire-per-CPU-rang.patch | 121 ++++++++++++ ...-local-CPU_ENTRY_AREA-variables-to-s.patch | 88 +++++++++ ...lpers-to-align-shadow-addresses-up-a.patch | 113 ++++++++++++ ...te-shadow-for-shared-chunk-of-the-CP.patch | 99 ++++++++++ ...rred-better-wording-on-protection-ag.patch | 97 ++++++++++ ...he-backlog-for-nested-calls-to-mirre.patch | 149 +++++++++++++++ kernel.spec | 27 ++- 11 files changed, 1090 insertions(+), 2 deletions(-) create mode 100644 0015-mm-demotion-fix-NULL-vs-IS_ERR-checking-in-memory_ti.patch create mode 100644 0016-x86-mm-Randomize-per-cpu-entry-area.patch create mode 100644 0017-x86-kasan-Map-shadow-for-percpu-pages-on-demand.patch create mode 100644 0018-x86-mm-Recompute-physical-address-for-every-page-of-.patch create mode 100644 0019-x86-mm-Populate-KASAN-shadow-for-entire-per-CPU-rang.patch create mode 100644 0020-x86-kasan-Rename-local-CPU_ENTRY_AREA-variables-to-s.patch create mode 100644 0021-x86-kasan-Add-helpers-to-align-shadow-addresses-up-a.patch create mode 100644 0022-x86-kasan-Populate-shadow-for-shared-chunk-of-the-CP.patch create mode 100644 0023-net-sched-act_mirred-better-wording-on-protection-ag.patch create mode 100644 0024-act_mirred-use-the-backlog-for-nested-calls-to-mirre.patch diff --git a/0015-mm-demotion-fix-NULL-vs-IS_ERR-checking-in-memory_ti.patch b/0015-mm-demotion-fix-NULL-vs-IS_ERR-checking-in-memory_ti.patch new file mode 100644 index 0000000..f598fc5 --- /dev/null +++ b/0015-mm-demotion-fix-NULL-vs-IS_ERR-checking-in-memory_ti.patch @@ -0,0 +1,50 @@ +From e11c121e73d4e98ed13259d6b19830f33ca60d76 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin <linmq006(a)gmail.com> +Date: Fri, 17 Mar 2023 10:05:08 +0800 +Subject: [PATCH 15/24] mm/demotion: fix NULL vs IS_ERR checking in + memory_tier_init + +mainline inclusion +from mainline-v6.2-rc1 +commit 4a625ceee8a0ab0273534cb6b432ce6b331db5ee +category: bugfix +bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6IXO8 +CVE: CVE-2023-23005 + +Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… + +-------------------------------- + +alloc_memory_type() returns error pointers on error instead of NULL. Use +IS_ERR() to check the return value to fix this. + +Link: https://lkml.kernel.org/r/20221110030751.1627266-1-linmq006@gmail.com +Fixes: 7b88bda3761b ("mm/demotion/dax/kmem: set node's abstract distance to MEMTIER_DEFAULT_DAX_ADISTANCE") +Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> +Reviewed-by: "Huang, Ying" <ying.huang(a)intel.com> +Cc: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> +Cc: Wei Xu <weixugc(a)google.com> +Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> +Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> +Reviewed-by: tong tiangen <tongtiangen(a)huawei.com> +Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> +--- + mm/memory-tiers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/memory-tiers.c b/mm/memory-tiers.c +index ba863f46759d..96022973c9ba 100644 +--- a/mm/memory-tiers.c ++++ b/mm/memory-tiers.c +@@ -645,7 +645,7 @@ static int __init memory_tier_init(void) + * than default DRAM tier. + */ + default_dram_type = alloc_memory_type(MEMTIER_ADISTANCE_DRAM); +- if (!default_dram_type) ++ if (IS_ERR(default_dram_type)) + panic("%s() failed to allocate default DRAM tier\n", __func__); + + /* +-- +2.25.1 + diff --git a/0016-x86-mm-Randomize-per-cpu-entry-area.patch b/0016-x86-mm-Randomize-per-cpu-entry-area.patch new file mode 100644 index 0000000..6f5dd2d --- /dev/null +++ b/0016-x86-mm-Randomize-per-cpu-entry-area.patch @@ -0,0 +1,172 @@ +From 0324d3cd1b57c06b0cf31b6db643ced5b29b0947 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <peterz(a)infradead.org> +Date: Fri, 17 Mar 2023 03:07:41 +0000 +Subject: [PATCH 16/24] x86/mm: Randomize per-cpu entry area + +mainline inclusion +from mainline-v6.2-rc1 +commit 97e3d26b5e5f371b3ee223d94dd123e6c442ba80 +category: bugfix +bugzilla: 188336 +CVE: CVE-2023-0597 + +Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… + +-------------------------------- + +Seth found that the CPU-entry-area; the piece of per-cpu data that is +mapped into the userspace page-tables for kPTI is not subject to any +randomization -- irrespective of kASLR settings. + +On x86_64 a whole P4D (512 GB) of virtual address space is reserved for +this structure, which is plenty large enough to randomize things a +little. + +As such, use a straight forward randomization scheme that avoids +duplicates to spread the existing CPUs over the available space. + + [ bp: Fix le build. ] + +Reported-by: Seth Jenkins <sethjenkins(a)google.com> +Reviewed-by: Kees Cook <keescook(a)chromium.org> +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com> +Signed-off-by: Borislav Petkov <bp(a)suse.de> +Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> +Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> +Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> +Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> +--- + arch/x86/include/asm/cpu_entry_area.h | 4 --- + arch/x86/include/asm/pgtable_areas.h | 8 ++++- + arch/x86/kernel/hw_breakpoint.c | 2 +- + arch/x86/mm/cpu_entry_area.c | 46 ++++++++++++++++++++++++--- + 4 files changed, 50 insertions(+), 10 deletions(-) + +diff --git a/arch/x86/include/asm/cpu_entry_area.h b/arch/x86/include/asm/cpu_entry_area.h +index 75efc4c6f076..462fc34f1317 100644 +--- a/arch/x86/include/asm/cpu_entry_area.h ++++ b/arch/x86/include/asm/cpu_entry_area.h +@@ -130,10 +130,6 @@ struct cpu_entry_area { + }; + + #define CPU_ENTRY_AREA_SIZE (sizeof(struct cpu_entry_area)) +-#define CPU_ENTRY_AREA_ARRAY_SIZE (CPU_ENTRY_AREA_SIZE * NR_CPUS) +- +-/* Total size includes the readonly IDT mapping page as well: */ +-#define CPU_ENTRY_AREA_TOTAL_SIZE (CPU_ENTRY_AREA_ARRAY_SIZE + PAGE_SIZE) + + DECLARE_PER_CPU(struct cpu_entry_area *, cpu_entry_area); + DECLARE_PER_CPU(struct cea_exception_stacks *, cea_exception_stacks); +diff --git a/arch/x86/include/asm/pgtable_areas.h b/arch/x86/include/asm/pgtable_areas.h +index d34cce1b995c..4f056fb88174 100644 +--- a/arch/x86/include/asm/pgtable_areas.h ++++ b/arch/x86/include/asm/pgtable_areas.h +@@ -11,6 +11,12 @@ + + #define CPU_ENTRY_AREA_RO_IDT_VADDR ((void *)CPU_ENTRY_AREA_RO_IDT) + +-#define CPU_ENTRY_AREA_MAP_SIZE (CPU_ENTRY_AREA_PER_CPU + CPU_ENTRY_AREA_ARRAY_SIZE - CPU_ENTRY_AREA_BASE) ++#ifdef CONFIG_X86_32 ++#define CPU_ENTRY_AREA_MAP_SIZE (CPU_ENTRY_AREA_PER_CPU + \ ++ (CPU_ENTRY_AREA_SIZE * NR_CPUS) - \ ++ CPU_ENTRY_AREA_BASE) ++#else ++#define CPU_ENTRY_AREA_MAP_SIZE P4D_SIZE ++#endif + + #endif /* _ASM_X86_PGTABLE_AREAS_H */ +diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c +index 668a4a6533d9..bbb0f737aab1 100644 +--- a/arch/x86/kernel/hw_breakpoint.c ++++ b/arch/x86/kernel/hw_breakpoint.c +@@ -266,7 +266,7 @@ static inline bool within_cpu_entry(unsigned long addr, unsigned long end) + + /* CPU entry erea is always used for CPU entry */ + if (within_area(addr, end, CPU_ENTRY_AREA_BASE, +- CPU_ENTRY_AREA_TOTAL_SIZE)) ++ CPU_ENTRY_AREA_MAP_SIZE)) + return true; + + /* +diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c +index 6c2f1b76a0b6..20844cf141fb 100644 +--- a/arch/x86/mm/cpu_entry_area.c ++++ b/arch/x86/mm/cpu_entry_area.c +@@ -15,16 +15,53 @@ static DEFINE_PER_CPU_PAGE_ALIGNED(struct entry_stack_page, entry_stack_storage) + #ifdef CONFIG_X86_64 + static DEFINE_PER_CPU_PAGE_ALIGNED(struct exception_stacks, exception_stacks); + DEFINE_PER_CPU(struct cea_exception_stacks*, cea_exception_stacks); +-#endif + +-#ifdef CONFIG_X86_32 ++static DEFINE_PER_CPU_READ_MOSTLY(unsigned long, _cea_offset); ++ ++static __always_inline unsigned int cea_offset(unsigned int cpu) ++{ ++ return per_cpu(_cea_offset, cpu); ++} ++ ++static __init void init_cea_offsets(void) ++{ ++ unsigned int max_cea; ++ unsigned int i, j; ++ ++ max_cea = (CPU_ENTRY_AREA_MAP_SIZE - PAGE_SIZE) / CPU_ENTRY_AREA_SIZE; ++ ++ /* O(sodding terrible) */ ++ for_each_possible_cpu(i) { ++ unsigned int cea; ++ ++again: ++ cea = prandom_u32_max(max_cea); ++ ++ for_each_possible_cpu(j) { ++ if (cea_offset(j) == cea) ++ goto again; ++ ++ if (i == j) ++ break; ++ } ++ ++ per_cpu(_cea_offset, i) = cea; ++ } ++} ++#else /* !X86_64 */ + DECLARE_PER_CPU_PAGE_ALIGNED(struct doublefault_stack, doublefault_stack); ++ ++static __always_inline unsigned int cea_offset(unsigned int cpu) ++{ ++ return cpu; ++} ++static inline void init_cea_offsets(void) { } + #endif + + /* Is called from entry code, so must be noinstr */ + noinstr struct cpu_entry_area *get_cpu_entry_area(int cpu) + { +- unsigned long va = CPU_ENTRY_AREA_PER_CPU + cpu * CPU_ENTRY_AREA_SIZE; ++ unsigned long va = CPU_ENTRY_AREA_PER_CPU + cea_offset(cpu) * CPU_ENTRY_AREA_SIZE; + BUILD_BUG_ON(sizeof(struct cpu_entry_area) % PAGE_SIZE != 0); + + return (struct cpu_entry_area *) va; +@@ -205,7 +242,6 @@ static __init void setup_cpu_entry_area_ptes(void) + + /* The +1 is for the readonly IDT: */ + BUILD_BUG_ON((CPU_ENTRY_AREA_PAGES+1)*PAGE_SIZE != CPU_ENTRY_AREA_MAP_SIZE); +- BUILD_BUG_ON(CPU_ENTRY_AREA_TOTAL_SIZE != CPU_ENTRY_AREA_MAP_SIZE); + BUG_ON(CPU_ENTRY_AREA_BASE & ~PMD_MASK); + + start = CPU_ENTRY_AREA_BASE; +@@ -221,6 +257,8 @@ void __init setup_cpu_entry_areas(void) + { + unsigned int cpu; + ++ init_cea_offsets(); ++ + setup_cpu_entry_area_ptes(); + + for_each_possible_cpu(cpu) +-- +2.25.1 + diff --git a/0017-x86-kasan-Map-shadow-for-percpu-pages-on-demand.patch b/0017-x86-kasan-Map-shadow-for-percpu-pages-on-demand.patch new file mode 100644 index 0000000..b9129b6 --- /dev/null +++ b/0017-x86-kasan-Map-shadow-for-percpu-pages-on-demand.patch @@ -0,0 +1,126 @@ +From 68992563c4b6b1776bd90dafe76caa88ff6dbfe8 Mon Sep 17 00:00:00 2001 +From: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> +Date: Fri, 17 Mar 2023 03:07:42 +0000 +Subject: [PATCH 17/24] x86/kasan: Map shadow for percpu pages on demand + +mainline inclusion +from mainline-v6.2-rc1 +commit 3f148f3318140035e87decc1214795ff0755757b +category: bugfix +bugzilla: 188336 +CVE: CVE-2023-0597 + +Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… + +-------------------------------- + +KASAN maps shadow for the entire CPU-entry-area: + [CPU_ENTRY_AREA_BASE, CPU_ENTRY_AREA_BASE + CPU_ENTRY_AREA_MAP_SIZE] + +This will explode once the per-cpu entry areas are randomized since it +will increase CPU_ENTRY_AREA_MAP_SIZE to 512 GB and KASAN fails to +allocate shadow for such big area. + +Fix this by allocating KASAN shadow only for really used cpu entry area +addresses mapped by cea_map_percpu_pages() + +Thanks to the 0day folks for finding and reporting this to be an issue. + +[ dhansen: tweak changelog since this will get committed before peterz's + actual cpu-entry-area randomization ] + +Signed-off-by: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> +Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com> +Tested-by: Yujie Liu <yujie.liu(a)intel.com> +Cc: kernel test robot <yujie.liu(a)intel.com> +Link: https://lore.kernel.org/r/202210241508.2e203c3d-yujie.liu@intel.com +Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> +Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> +Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> +Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> +--- + arch/x86/include/asm/kasan.h | 3 +++ + arch/x86/mm/cpu_entry_area.c | 8 +++++++- + arch/x86/mm/kasan_init_64.c | 15 ++++++++++++--- + 3 files changed, 22 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/include/asm/kasan.h b/arch/x86/include/asm/kasan.h +index 13e70da38bed..de75306b932e 100644 +--- a/arch/x86/include/asm/kasan.h ++++ b/arch/x86/include/asm/kasan.h +@@ -28,9 +28,12 @@ + #ifdef CONFIG_KASAN + void __init kasan_early_init(void); + void __init kasan_init(void); ++void __init kasan_populate_shadow_for_vaddr(void *va, size_t size, int nid); + #else + static inline void kasan_early_init(void) { } + static inline void kasan_init(void) { } ++static inline void kasan_populate_shadow_for_vaddr(void *va, size_t size, ++ int nid) { } + #endif + + #endif +diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c +index 20844cf141fb..dff9001e5e12 100644 +--- a/arch/x86/mm/cpu_entry_area.c ++++ b/arch/x86/mm/cpu_entry_area.c +@@ -9,6 +9,7 @@ + #include <asm/cpu_entry_area.h> + #include <asm/fixmap.h> + #include <asm/desc.h> ++#include <asm/kasan.h> + + static DEFINE_PER_CPU_PAGE_ALIGNED(struct entry_stack_page, entry_stack_storage); + +@@ -90,8 +91,13 @@ void cea_set_pte(void *cea_vaddr, phys_addr_t pa, pgprot_t flags) + static void __init + cea_map_percpu_pages(void *cea_vaddr, void *ptr, int pages, pgprot_t prot) + { ++ phys_addr_t pa = per_cpu_ptr_to_phys(ptr); ++ ++ kasan_populate_shadow_for_vaddr(cea_vaddr, pages * PAGE_SIZE, ++ early_pfn_to_nid(PFN_DOWN(pa))); ++ + for ( ; pages; pages--, cea_vaddr+= PAGE_SIZE, ptr += PAGE_SIZE) +- cea_set_pte(cea_vaddr, per_cpu_ptr_to_phys(ptr), prot); ++ cea_set_pte(cea_vaddr, pa, prot); + } + + static void __init percpu_setup_debug_store(unsigned int cpu) +diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c +index e7b9b464a82f..d1416926ad52 100644 +--- a/arch/x86/mm/kasan_init_64.c ++++ b/arch/x86/mm/kasan_init_64.c +@@ -316,6 +316,18 @@ void __init kasan_early_init(void) + kasan_map_early_shadow(init_top_pgt); + } + ++void __init kasan_populate_shadow_for_vaddr(void *va, size_t size, int nid) ++{ ++ unsigned long shadow_start, shadow_end; ++ ++ shadow_start = (unsigned long)kasan_mem_to_shadow(va); ++ shadow_start = round_down(shadow_start, PAGE_SIZE); ++ shadow_end = (unsigned long)kasan_mem_to_shadow(va + size); ++ shadow_end = round_up(shadow_end, PAGE_SIZE); ++ ++ kasan_populate_shadow(shadow_start, shadow_end, nid); ++} ++ + void __init kasan_init(void) + { + int i; +@@ -393,9 +405,6 @@ void __init kasan_init(void) + kasan_mem_to_shadow((void *)VMALLOC_END + 1), + shadow_cpu_entry_begin); + +- kasan_populate_shadow((unsigned long)shadow_cpu_entry_begin, +- (unsigned long)shadow_cpu_entry_end, 0); +- + kasan_populate_early_shadow(shadow_cpu_entry_end, + kasan_mem_to_shadow((void *)__START_KERNEL_map)); + +-- +2.25.1 + diff --git a/0018-x86-mm-Recompute-physical-address-for-every-page-of-.patch b/0018-x86-mm-Recompute-physical-address-for-every-page-of-.patch new file mode 100644 index 0000000..2696052 --- /dev/null +++ b/0018-x86-mm-Recompute-physical-address-for-every-page-of-.patch @@ -0,0 +1,50 @@ +From 12867b242d6e431f6f947e53abd1094cd0075b55 Mon Sep 17 00:00:00 2001 +From: Sean Christopherson <seanjc(a)google.com> +Date: Fri, 17 Mar 2023 03:07:43 +0000 +Subject: [PATCH 18/24] x86/mm: Recompute physical address for every page of + per-CPU CEA mapping + +mainline inclusion +from mainline-v6.2-rc1 +commit 80d72a8f76e8f3f0b5a70b8c7022578e17bde8e7 +category: bugfix +bugzilla: 188336 +CVE: CVE-2023-0597 + +Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… + +-------------------------------- + +Recompute the physical address for each per-CPU page in the CPU entry +area, a recent commit inadvertantly modified cea_map_percpu_pages() such +that every PTE is mapped to the physical address of the first page. + +Fixes: 9fd429c28073 ("x86/kasan: Map shadow for percpu pages on demand") +Signed-off-by: Sean Christopherson <seanjc(a)google.com> +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Reviewed-by: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> +Link: https://lkml.kernel.org/r/20221110203504.1985010-2-seanjc@google.com +Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> +Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> +Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> +Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> +--- + arch/x86/mm/cpu_entry_area.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c +index dff9001e5e12..d831aae94b41 100644 +--- a/arch/x86/mm/cpu_entry_area.c ++++ b/arch/x86/mm/cpu_entry_area.c +@@ -97,7 +97,7 @@ cea_map_percpu_pages(void *cea_vaddr, void *ptr, int pages, pgprot_t prot) + early_pfn_to_nid(PFN_DOWN(pa))); + + for ( ; pages; pages--, cea_vaddr+= PAGE_SIZE, ptr += PAGE_SIZE) +- cea_set_pte(cea_vaddr, pa, prot); ++ cea_set_pte(cea_vaddr, per_cpu_ptr_to_phys(ptr), prot); + } + + static void __init percpu_setup_debug_store(unsigned int cpu) +-- +2.25.1 + diff --git a/0019-x86-mm-Populate-KASAN-shadow-for-entire-per-CPU-rang.patch b/0019-x86-mm-Populate-KASAN-shadow-for-entire-per-CPU-rang.patch new file mode 100644 index 0000000..8fa96dd --- /dev/null +++ b/0019-x86-mm-Populate-KASAN-shadow-for-entire-per-CPU-rang.patch @@ -0,0 +1,121 @@ +From 91bb861cfc95653af4223af2e00b9e637c501d5a Mon Sep 17 00:00:00 2001 +From: Sean Christopherson <seanjc(a)google.com> +Date: Fri, 17 Mar 2023 03:07:44 +0000 +Subject: [PATCH 19/24] x86/mm: Populate KASAN shadow for entire per-CPU range + of CPU entry area + +mainline inclusion +from mainline-v6.2-rc1 +commit 97650148a15e0b30099d6175ffe278b9f55ec66a +category: bugfix +bugzilla: 188336 +CVE: CVE-2023-0597 + +Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… + +-------------------------------- + +Populate a KASAN shadow for the entire possible per-CPU range of the CPU +entry area instead of requiring that each individual chunk map a shadow. +Mapping shadows individually is error prone, e.g. the per-CPU GDT mapping +was left behind, which can lead to not-present page faults during KASAN +validation if the kernel performs a software lookup into the GDT. The DS +buffer is also likely affected. + +The motivation for mapping the per-CPU areas on-demand was to avoid +mapping the entire 512GiB range that's reserved for the CPU entry area, +shaving a few bytes by not creating shadows for potentially unused memory +was not a goal. + +The bug is most easily reproduced by doing a sigreturn with a garbage +CS in the sigcontext, e.g. + + int main(void) + { + struct sigcontext regs; + + syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); + syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); + syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); + + memset(&regs, 0, sizeof(regs)); + regs.cs = 0x1d0; + syscall(__NR_rt_sigreturn); + return 0; + } + +to coerce the kernel into doing a GDT lookup to compute CS.base when +reading the instruction bytes on the subsequent #GP to determine whether +or not the #GP is something the kernel should handle, e.g. to fixup UMIP +violations or to emulate CLI/STI for IOPL=3 applications. + + BUG: unable to handle page fault for address: fffffbc8379ace00 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 16c03a067 P4D 16c03a067 PUD 15b990067 PMD 15b98f067 PTE 0 + Oops: 0000 [#1] PREEMPT SMP KASAN + CPU: 3 PID: 851 Comm: r2 Not tainted 6.1.0-rc3-next-20221103+ #432 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 + RIP: 0010:kasan_check_range+0xdf/0x190 + Call Trace: + <TASK> + get_desc+0xb0/0x1d0 + insn_get_seg_base+0x104/0x270 + insn_fetch_from_user+0x66/0x80 + fixup_umip_exception+0xb1/0x530 + exc_general_protection+0x181/0x210 + asm_exc_general_protection+0x22/0x30 + RIP: 0003:0x0 + Code: Unable to access opcode bytes at 0xffffffffffffffd6. + RSP: 0003:0000000000000000 EFLAGS: 00000202 + RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000000001d0 + RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 + RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 + R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 + R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + </TASK> + +Fixes: 9fd429c28073 ("x86/kasan: Map shadow for percpu pages on demand") +Reported-by: syzbot+ffb4f000dc2872c93f62(a)syzkaller.appspotmail.com +Suggested-by: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> +Signed-off-by: Sean Christopherson <seanjc(a)google.com> +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Reviewed-by: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> +Link: https://lkml.kernel.org/r/20221110203504.1985010-3-seanjc@google.com +Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> +Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> +Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> +Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> +--- + arch/x86/mm/cpu_entry_area.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c +index d831aae94b41..7c855dffcdc2 100644 +--- a/arch/x86/mm/cpu_entry_area.c ++++ b/arch/x86/mm/cpu_entry_area.c +@@ -91,11 +91,6 @@ void cea_set_pte(void *cea_vaddr, phys_addr_t pa, pgprot_t flags) + static void __init + cea_map_percpu_pages(void *cea_vaddr, void *ptr, int pages, pgprot_t prot) + { +- phys_addr_t pa = per_cpu_ptr_to_phys(ptr); +- +- kasan_populate_shadow_for_vaddr(cea_vaddr, pages * PAGE_SIZE, +- early_pfn_to_nid(PFN_DOWN(pa))); +- + for ( ; pages; pages--, cea_vaddr+= PAGE_SIZE, ptr += PAGE_SIZE) + cea_set_pte(cea_vaddr, per_cpu_ptr_to_phys(ptr), prot); + } +@@ -195,6 +190,9 @@ static void __init setup_cpu_entry_area(unsigned int cpu) + pgprot_t tss_prot = PAGE_KERNEL; + #endif + ++ kasan_populate_shadow_for_vaddr(cea, CPU_ENTRY_AREA_SIZE, ++ early_cpu_to_node(cpu)); ++ + cea_set_pte(&cea->gdt, get_cpu_gdt_paddr(cpu), gdt_prot); + + cea_map_percpu_pages(&cea->entry_stack_page, +-- +2.25.1 + diff --git a/0020-x86-kasan-Rename-local-CPU_ENTRY_AREA-variables-to-s.patch b/0020-x86-kasan-Rename-local-CPU_ENTRY_AREA-variables-to-s.patch new file mode 100644 index 0000000..e4f9f63 --- /dev/null +++ b/0020-x86-kasan-Rename-local-CPU_ENTRY_AREA-variables-to-s.patch @@ -0,0 +1,88 @@ +From 0560fceb4d3c76133f1a89decbf1c3334afdbd00 Mon Sep 17 00:00:00 2001 +From: Sean Christopherson <seanjc(a)google.com> +Date: Fri, 17 Mar 2023 03:07:45 +0000 +Subject: [PATCH 20/24] x86/kasan: Rename local CPU_ENTRY_AREA variables to + shorten names + +mainline inclusion +from mainline-v6.2-rc1 +commit 7077d2ccb94dafd00b29cc2d601c9f6891648f5b +category: bugfix +bugzilla: 188336 +CVE: CVE-2023-0597 + +Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… + +-------------------------------- + +Rename the CPU entry area variables in kasan_init() to shorten their +names, a future fix will reference the beginning of the per-CPU portion +of the CPU entry area, and shadow_cpu_entry_per_cpu_begin is a bit much. + +No functional change intended. + +Signed-off-by: Sean Christopherson <seanjc(a)google.com> +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Reviewed-by: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> +Link: https://lkml.kernel.org/r/20221110203504.1985010-4-seanjc@google.com +Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> +Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> +Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> +Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> +--- + arch/x86/mm/kasan_init_64.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c +index d1416926ad52..ad7872ae10ed 100644 +--- a/arch/x86/mm/kasan_init_64.c ++++ b/arch/x86/mm/kasan_init_64.c +@@ -331,7 +331,7 @@ void __init kasan_populate_shadow_for_vaddr(void *va, size_t size, int nid) + void __init kasan_init(void) + { + int i; +- void *shadow_cpu_entry_begin, *shadow_cpu_entry_end; ++ void *shadow_cea_begin, *shadow_cea_end; + + memcpy(early_top_pgt, init_top_pgt, sizeof(early_top_pgt)); + +@@ -372,16 +372,16 @@ void __init kasan_init(void) + map_range(&pfn_mapped[i]); + } + +- shadow_cpu_entry_begin = (void *)CPU_ENTRY_AREA_BASE; +- shadow_cpu_entry_begin = kasan_mem_to_shadow(shadow_cpu_entry_begin); +- shadow_cpu_entry_begin = (void *)round_down( +- (unsigned long)shadow_cpu_entry_begin, PAGE_SIZE); ++ shadow_cea_begin = (void *)CPU_ENTRY_AREA_BASE; ++ shadow_cea_begin = kasan_mem_to_shadow(shadow_cea_begin); ++ shadow_cea_begin = (void *)round_down( ++ (unsigned long)shadow_cea_begin, PAGE_SIZE); + +- shadow_cpu_entry_end = (void *)(CPU_ENTRY_AREA_BASE + ++ shadow_cea_end = (void *)(CPU_ENTRY_AREA_BASE + + CPU_ENTRY_AREA_MAP_SIZE); +- shadow_cpu_entry_end = kasan_mem_to_shadow(shadow_cpu_entry_end); +- shadow_cpu_entry_end = (void *)round_up( +- (unsigned long)shadow_cpu_entry_end, PAGE_SIZE); ++ shadow_cea_end = kasan_mem_to_shadow(shadow_cea_end); ++ shadow_cea_end = (void *)round_up( ++ (unsigned long)shadow_cea_end, PAGE_SIZE); + + kasan_populate_early_shadow( + kasan_mem_to_shadow((void *)PAGE_OFFSET + MAXMEM), +@@ -403,9 +403,9 @@ void __init kasan_init(void) + + kasan_populate_early_shadow( + kasan_mem_to_shadow((void *)VMALLOC_END + 1), +- shadow_cpu_entry_begin); ++ shadow_cea_begin); + +- kasan_populate_early_shadow(shadow_cpu_entry_end, ++ kasan_populate_early_shadow(shadow_cea_end, + kasan_mem_to_shadow((void *)__START_KERNEL_map)); + + kasan_populate_shadow((unsigned long)kasan_mem_to_shadow(_stext), +-- +2.25.1 + diff --git a/0021-x86-kasan-Add-helpers-to-align-shadow-addresses-up-a.patch b/0021-x86-kasan-Add-helpers-to-align-shadow-addresses-up-a.patch new file mode 100644 index 0000000..5f3f362 --- /dev/null +++ b/0021-x86-kasan-Add-helpers-to-align-shadow-addresses-up-a.patch @@ -0,0 +1,113 @@ +From ec4ebad1a3ed5a1ff3301de4df9a12ebf81b09c1 Mon Sep 17 00:00:00 2001 +From: Sean Christopherson <seanjc(a)google.com> +Date: Fri, 17 Mar 2023 03:07:46 +0000 +Subject: [PATCH 21/24] x86/kasan: Add helpers to align shadow addresses up and + down + +mainline inclusion +from mainline-v6.2-rc1 +commit bde258d97409f2a45243cb393a55ea9ecfc7aba5 +category: bugfix +bugzilla: 188336 +CVE: CVE-2023-0597 + +Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… + +-------------------------------- + +Add helpers to dedup code for aligning shadow address up/down to page +boundaries when translating an address to its shadow. + +No functional change intended. + +Signed-off-by: Sean Christopherson <seanjc(a)google.com> +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Reviewed-by: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> +Link: https://lkml.kernel.org/r/20221110203504.1985010-5-seanjc@google.com +Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> +Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> +Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> +Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> +--- + arch/x86/mm/kasan_init_64.c | 40 ++++++++++++++++++++----------------- + 1 file changed, 22 insertions(+), 18 deletions(-) + +diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c +index ad7872ae10ed..afc5e129ca7b 100644 +--- a/arch/x86/mm/kasan_init_64.c ++++ b/arch/x86/mm/kasan_init_64.c +@@ -316,22 +316,33 @@ void __init kasan_early_init(void) + kasan_map_early_shadow(init_top_pgt); + } + ++static unsigned long kasan_mem_to_shadow_align_down(unsigned long va) ++{ ++ unsigned long shadow = (unsigned long)kasan_mem_to_shadow((void *)va); ++ ++ return round_down(shadow, PAGE_SIZE); ++} ++ ++static unsigned long kasan_mem_to_shadow_align_up(unsigned long va) ++{ ++ unsigned long shadow = (unsigned long)kasan_mem_to_shadow((void *)va); ++ ++ return round_up(shadow, PAGE_SIZE); ++} ++ + void __init kasan_populate_shadow_for_vaddr(void *va, size_t size, int nid) + { + unsigned long shadow_start, shadow_end; + +- shadow_start = (unsigned long)kasan_mem_to_shadow(va); +- shadow_start = round_down(shadow_start, PAGE_SIZE); +- shadow_end = (unsigned long)kasan_mem_to_shadow(va + size); +- shadow_end = round_up(shadow_end, PAGE_SIZE); +- ++ shadow_start = kasan_mem_to_shadow_align_down((unsigned long)va); ++ shadow_end = kasan_mem_to_shadow_align_up((unsigned long)va + size); + kasan_populate_shadow(shadow_start, shadow_end, nid); + } + + void __init kasan_init(void) + { ++ unsigned long shadow_cea_begin, shadow_cea_end; + int i; +- void *shadow_cea_begin, *shadow_cea_end; + + memcpy(early_top_pgt, init_top_pgt, sizeof(early_top_pgt)); + +@@ -372,16 +383,9 @@ void __init kasan_init(void) + map_range(&pfn_mapped[i]); + } + +- shadow_cea_begin = (void *)CPU_ENTRY_AREA_BASE; +- shadow_cea_begin = kasan_mem_to_shadow(shadow_cea_begin); +- shadow_cea_begin = (void *)round_down( +- (unsigned long)shadow_cea_begin, PAGE_SIZE); +- +- shadow_cea_end = (void *)(CPU_ENTRY_AREA_BASE + +- CPU_ENTRY_AREA_MAP_SIZE); +- shadow_cea_end = kasan_mem_to_shadow(shadow_cea_end); +- shadow_cea_end = (void *)round_up( +- (unsigned long)shadow_cea_end, PAGE_SIZE); ++ shadow_cea_begin = kasan_mem_to_shadow_align_down(CPU_ENTRY_AREA_BASE); ++ shadow_cea_end = kasan_mem_to_shadow_align_up(CPU_ENTRY_AREA_BASE + ++ CPU_ENTRY_AREA_MAP_SIZE); + + kasan_populate_early_shadow( + kasan_mem_to_shadow((void *)PAGE_OFFSET + MAXMEM), +@@ -403,9 +407,9 @@ void __init kasan_init(void) + + kasan_populate_early_shadow( + kasan_mem_to_shadow((void *)VMALLOC_END + 1), +- shadow_cea_begin); ++ (void *)shadow_cea_begin); + +- kasan_populate_early_shadow(shadow_cea_end, ++ kasan_populate_early_shadow((void *)shadow_cea_end, + kasan_mem_to_shadow((void *)__START_KERNEL_map)); + + kasan_populate_shadow((unsigned long)kasan_mem_to_shadow(_stext), +-- +2.25.1 + diff --git a/0022-x86-kasan-Populate-shadow-for-shared-chunk-of-the-CP.patch b/0022-x86-kasan-Populate-shadow-for-shared-chunk-of-the-CP.patch new file mode 100644 index 0000000..d6f9b77 --- /dev/null +++ b/0022-x86-kasan-Populate-shadow-for-shared-chunk-of-the-CP.patch @@ -0,0 +1,99 @@ +From 885cbab14224aca9bcf6df23a432a84e55b55dd5 Mon Sep 17 00:00:00 2001 +From: Sean Christopherson <seanjc(a)google.com> +Date: Fri, 17 Mar 2023 03:07:47 +0000 +Subject: [PATCH 22/24] x86/kasan: Populate shadow for shared chunk of the CPU + entry area + +mainline inclusion +from mainline-v6.2-rc1 +commit 1cfaac2400c73378e78182a706be0f3ac8b93cd7 +category: bugfix +bugzilla: 188336 +CVE: CVE-2023-0597 + +Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… + +-------------------------------- + +Popuplate the shadow for the shared portion of the CPU entry area, i.e. +the read-only IDT mapping, during KASAN initialization. A recent change +modified KASAN to map the per-CPU areas on-demand, but forgot to keep a +shadow for the common area that is shared amongst all CPUs. + +Map the common area in KASAN init instead of letting idt_map_in_cea() do +the dirty work so that it Just Works in the unlikely event more shared +data is shoved into the CPU entry area. + +The bug manifests as a not-present #PF when software attempts to lookup +an IDT entry, e.g. when KVM is handling IRQs on Intel CPUs (KVM performs +direct CALL to the IRQ handler to avoid the overhead of INTn): + + BUG: unable to handle page fault for address: fffffbc0000001d8 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 16c03a067 P4D 16c03a067 PUD 0 + Oops: 0000 [#1] PREEMPT SMP KASAN + CPU: 5 PID: 901 Comm: repro Tainted: G W 6.1.0-rc3+ #410 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 + RIP: 0010:kasan_check_range+0xdf/0x190 + vmx_handle_exit_irqoff+0x152/0x290 [kvm_intel] + vcpu_run+0x1d89/0x2bd0 [kvm] + kvm_arch_vcpu_ioctl_run+0x3ce/0xa70 [kvm] + kvm_vcpu_ioctl+0x349/0x900 [kvm] + __x64_sys_ioctl+0xb8/0xf0 + do_syscall_64+0x2b/0x50 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Fixes: 9fd429c28073 ("x86/kasan: Map shadow for percpu pages on demand") +Reported-by: syzbot+8cdd16fd5a6c0565e227(a)syzkaller.appspotmail.com +Signed-off-by: Sean Christopherson <seanjc(a)google.com> +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Link: https://lkml.kernel.org/r/20221110203504.1985010-6-seanjc@google.com +Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> +Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> +Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> +Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> +--- + arch/x86/mm/kasan_init_64.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c +index afc5e129ca7b..0302491d799d 100644 +--- a/arch/x86/mm/kasan_init_64.c ++++ b/arch/x86/mm/kasan_init_64.c +@@ -341,7 +341,7 @@ void __init kasan_populate_shadow_for_vaddr(void *va, size_t size, int nid) + + void __init kasan_init(void) + { +- unsigned long shadow_cea_begin, shadow_cea_end; ++ unsigned long shadow_cea_begin, shadow_cea_per_cpu_begin, shadow_cea_end; + int i; + + memcpy(early_top_pgt, init_top_pgt, sizeof(early_top_pgt)); +@@ -384,6 +384,7 @@ void __init kasan_init(void) + } + + shadow_cea_begin = kasan_mem_to_shadow_align_down(CPU_ENTRY_AREA_BASE); ++ shadow_cea_per_cpu_begin = kasan_mem_to_shadow_align_up(CPU_ENTRY_AREA_PER_CPU); + shadow_cea_end = kasan_mem_to_shadow_align_up(CPU_ENTRY_AREA_BASE + + CPU_ENTRY_AREA_MAP_SIZE); + +@@ -409,6 +410,15 @@ void __init kasan_init(void) + kasan_mem_to_shadow((void *)VMALLOC_END + 1), + (void *)shadow_cea_begin); + ++ /* ++ * Populate the shadow for the shared portion of the CPU entry area. ++ * Shadows for the per-CPU areas are mapped on-demand, as each CPU's ++ * area is randomly placed somewhere in the 512GiB range and mapping ++ * the entire 512GiB range is prohibitively expensive. ++ */ ++ kasan_populate_shadow(shadow_cea_begin, ++ shadow_cea_per_cpu_begin, 0); ++ + kasan_populate_early_shadow((void *)shadow_cea_end, + kasan_mem_to_shadow((void *)__START_KERNEL_map)); + +-- +2.25.1 + diff --git a/0023-net-sched-act_mirred-better-wording-on-protection-ag.patch b/0023-net-sched-act_mirred-better-wording-on-protection-ag.patch new file mode 100644 index 0000000..8065822 --- /dev/null +++ b/0023-net-sched-act_mirred-better-wording-on-protection-ag.patch @@ -0,0 +1,97 @@ +From 1420d4aeb4cecca648b494e6d875c222da1d9309 Mon Sep 17 00:00:00 2001 +From: Davide Caratti <dcaratti(a)redhat.com> +Date: Sat, 18 Mar 2023 16:46:22 +0800 +Subject: [PATCH 23/24] net/sched: act_mirred: better wording on protection + against excessive stack growth + +mainline inclusion +from mainline-v6.3-rc1 +commit 78dcdffe0418ac8f3f057f26fe71ccf4d8ed851f +category: bugfix +bugzilla: https://gitee.com/src-openeuler/kernel/issues/I64END +CVE: CVE-2022-4269 + +Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… + +-------------------------------- + +with commit e2ca070f89ec ("net: sched: protect against stack overflow in +TC act_mirred"), act_mirred protected itself against excessive stack growth +using per_cpu counter of nested calls to tcf_mirred_act(), and capping it +to MIRRED_RECURSION_LIMIT. However, such protection does not detect +recursion/loops in case the packet is enqueued to the backlog (for example, +when the mirred target device has RPS or skb timestamping enabled). Change +the wording from "recursion" to "nesting" to make it more clear to readers. + +CC: Jamal Hadi Salim <jhs(a)mojatatu.com> +Signed-off-by: Davide Caratti <dcaratti(a)redhat.com> +Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> +Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> +Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> +Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> +Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> +Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> +--- + net/sched/act_mirred.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index b8ad6ae282c0..ded6ee054be1 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -28,8 +28,8 @@ + static LIST_HEAD(mirred_list); + static DEFINE_SPINLOCK(mirred_list_lock); + +-#define MIRRED_RECURSION_LIMIT 4 +-static DEFINE_PER_CPU(unsigned int, mirred_rec_level); ++#define MIRRED_NEST_LIMIT 4 ++static DEFINE_PER_CPU(unsigned int, mirred_nest_level); + + static bool tcf_mirred_is_act_redirect(int action) + { +@@ -224,7 +224,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + struct sk_buff *skb2 = skb; + bool m_mac_header_xmit; + struct net_device *dev; +- unsigned int rec_level; ++ unsigned int nest_level; + int retval, err = 0; + bool use_reinsert; + bool want_ingress; +@@ -235,11 +235,11 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + int mac_len; + bool at_nh; + +- rec_level = __this_cpu_inc_return(mirred_rec_level); +- if (unlikely(rec_level > MIRRED_RECURSION_LIMIT)) { ++ nest_level = __this_cpu_inc_return(mirred_nest_level); ++ if (unlikely(nest_level > MIRRED_NEST_LIMIT)) { + net_warn_ratelimited("Packet exceeded mirred recursion limit on dev %s\n", + netdev_name(skb->dev)); +- __this_cpu_dec(mirred_rec_level); ++ __this_cpu_dec(mirred_nest_level); + return TC_ACT_SHOT; + } + +@@ -308,7 +308,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + err = tcf_mirred_forward(want_ingress, skb); + if (err) + tcf_action_inc_overlimit_qstats(&m->common); +- __this_cpu_dec(mirred_rec_level); ++ __this_cpu_dec(mirred_nest_level); + return TC_ACT_CONSUMED; + } + } +@@ -320,7 +320,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + if (tcf_mirred_is_act_redirect(m_eaction)) + retval = TC_ACT_SHOT; + } +- __this_cpu_dec(mirred_rec_level); ++ __this_cpu_dec(mirred_nest_level); + + return retval; + } +-- +2.25.1 + diff --git a/0024-act_mirred-use-the-backlog-for-nested-calls-to-mirre.patch b/0024-act_mirred-use-the-backlog-for-nested-calls-to-mirre.patch new file mode 100644 index 0000000..edfc0ba --- /dev/null +++ b/0024-act_mirred-use-the-backlog-for-nested-calls-to-mirre.patch @@ -0,0 +1,149 @@ +From a6bb3989ccb7d3493c20e709179904733c6db856 Mon Sep 17 00:00:00 2001 +From: Davide Caratti <dcaratti(a)redhat.com> +Date: Sat, 18 Mar 2023 16:46:40 +0800 +Subject: [PATCH 24/24] act_mirred: use the backlog for nested calls to mirred + ingress + +mainline inclusion +from mainline-v6.3-rc1 +commit ca22da2fbd693b54dc8e3b7b54ccc9f7e9ba3640 +category: bugfix +bugzilla: https://gitee.com/src-openeuler/kernel/issues/I64END +CVE: CVE-2022-4269 + +Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… + +-------------------------------- + +William reports kernel soft-lockups on some OVS topologies when TC mirred +egress->ingress action is hit by local TCP traffic [1]. +The same can also be reproduced with SCTP (thanks Xin for verifying), when +client and server reach themselves through mirred egress to ingress, and +one of the two peers sends a "heartbeat" packet (from within a timer). + +Enqueueing to backlog proved to fix this soft lockup; however, as Cong +noticed [2], we should preserve - when possible - the current mirred +behavior that counts as "overlimits" any eventual packet drop subsequent to +the mirred forwarding action [3]. A compromise solution might use the +backlog only when tcf_mirred_act() has a nest level greater than one: +change tcf_mirred_forward() accordingly. + +Also, add a kselftest that can reproduce the lockup and verifies TC mirred +ability to account for further packet drops after TC mirred egress->ingress +(when the nest level is 1). + + [1] https://lore.kernel.org/netdev/33dc43f587ec1388ba456b4915c75f02a8aae226.166… + [2] https://lore.kernel.org/netdev/Y0w%2FWWY60gqrtGLp@pop-os.localdomain/ + [3] such behavior is not guaranteed: for example, if RPS or skb RX + timestamping is enabled on the mirred target device, the kernel + can defer receiving the skb and return NET_RX_SUCCESS inside + tcf_mirred_forward(). + +Reported-by: William Zhao <wizhao(a)redhat.com> +CC: Xin Long <lucien.xin(a)gmail.com> +Signed-off-by: Davide Caratti <dcaratti(a)redhat.com> +Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> +Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> +Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> +Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> +Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> +Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> +--- + net/sched/act_mirred.c | 7 +++ + .../selftests/net/forwarding/tc_actions.sh | 49 ++++++++++++++++++- + 2 files changed, 55 insertions(+), 1 deletion(-) + +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index ded6ee054be1..baeae5e5c8f0 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -205,12 +205,19 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla, + return err; + } + ++static bool is_mirred_nested(void) ++{ ++ return unlikely(__this_cpu_read(mirred_nest_level) > 1); ++} ++ + static int tcf_mirred_forward(bool want_ingress, struct sk_buff *skb) + { + int err; + + if (!want_ingress) + err = tcf_dev_queue_xmit(skb, dev_queue_xmit); ++ else if (is_mirred_nested()) ++ err = netif_rx(skb); + else + err = netif_receive_skb(skb); + +diff --git a/tools/testing/selftests/net/forwarding/tc_actions.sh b/tools/testing/selftests/net/forwarding/tc_actions.sh +index 1e0a62f638fe..919c0dd9fe4b 100755 +--- a/tools/testing/selftests/net/forwarding/tc_actions.sh ++++ b/tools/testing/selftests/net/forwarding/tc_actions.sh +@@ -3,7 +3,8 @@ + + ALL_TESTS="gact_drop_and_ok_test mirred_egress_redirect_test \ + mirred_egress_mirror_test matchall_mirred_egress_mirror_test \ +- gact_trap_test mirred_egress_to_ingress_test" ++ gact_trap_test mirred_egress_to_ingress_test \ ++ mirred_egress_to_ingress_tcp_test" + NUM_NETIFS=4 + source tc_common.sh + source lib.sh +@@ -198,6 +199,52 @@ mirred_egress_to_ingress_test() + log_test "mirred_egress_to_ingress ($tcflags)" + } + ++mirred_egress_to_ingress_tcp_test() ++{ ++ local tmpfile=$(mktemp) tmpfile1=$(mktemp) ++ ++ RET=0 ++ dd conv=sparse status=none if=/dev/zero bs=1M count=2 of=$tmpfile ++ tc filter add dev $h1 protocol ip pref 100 handle 100 egress flower \ ++ $tcflags ip_proto tcp src_ip 192.0.2.1 dst_ip 192.0.2.2 \ ++ action ct commit nat src addr 192.0.2.2 pipe \ ++ action ct clear pipe \ ++ action ct commit nat dst addr 192.0.2.1 pipe \ ++ action ct clear pipe \ ++ action skbedit ptype host pipe \ ++ action mirred ingress redirect dev $h1 ++ tc filter add dev $h1 protocol ip pref 101 handle 101 egress flower \ ++ $tcflags ip_proto icmp \ ++ action mirred ingress redirect dev $h1 ++ tc filter add dev $h1 protocol ip pref 102 handle 102 ingress flower \ ++ ip_proto icmp \ ++ action drop ++ ++ ip vrf exec v$h1 nc --recv-only -w10 -l -p 12345 -o $tmpfile1 & ++ local rpid=$! ++ ip vrf exec v$h1 nc -w1 --send-only 192.0.2.2 12345 <$tmpfile ++ wait -n $rpid ++ cmp -s $tmpfile $tmpfile1 ++ check_err $? "server output check failed" ++ ++ $MZ $h1 -c 10 -p 64 -a $h1mac -b $h1mac -A 192.0.2.1 -B 192.0.2.1 \ ++ -t icmp "ping,id=42,seq=5" -q ++ tc_check_packets "dev $h1 egress" 101 10 ++ check_err $? "didn't mirred redirect ICMP" ++ tc_check_packets "dev $h1 ingress" 102 10 ++ check_err $? "didn't drop mirred ICMP" ++ local overlimits=$(tc_rule_stats_get ${h1} 101 egress .overlimits) ++ test ${overlimits} = 10 ++ check_err $? "wrong overlimits, expected 10 got ${overlimits}" ++ ++ tc filter del dev $h1 egress protocol ip pref 100 handle 100 flower ++ tc filter del dev $h1 egress protocol ip pref 101 handle 101 flower ++ tc filter del dev $h1 ingress protocol ip pref 102 handle 102 flower ++ ++ rm -f $tmpfile $tmpfile1 ++ log_test "mirred_egress_to_ingress_tcp ($tcflags)" ++} ++ + setup_prepare() + { + h1=${NETIFS[p1]} +-- +2.25.1 + diff --git a/kernel.spec b/kernel.spec index 0eb5b16..f4bc7a4 100644 --- a/kernel.spec +++ b/kernel.spec @@ -10,9 +10,9 @@ %global upstream_version 6.1 %global upstream_sublevel 19 -%global devel_release 6 +%global devel_release 7 %global maintenance_release .0.0 -%global pkg_release .16 +%global pkg_release .17 %define with_debuginfo 0 # Do not recompute the build-id of vmlinux in find-debuginfo.sh @@ -84,6 +84,16 @@ Patch0011: 0011-bpf-Two-helper-functions-are-introduced-to-parse-use.patch Patch0012: 0012-net-bpf-Add-a-writeable_tracepoint-to-inet_stream_co.patch Patch0013: 0013-nfs-client-multipath.patch Patch0014: 0014-nfs-client-multipath-config.patch +Patch0015: 0015-mm-demotion-fix-NULL-vs-IS_ERR-checking-in-memory_ti.patch +Patch0016: 0016-x86-mm-Randomize-per-cpu-entry-area.patch +Patch0017: 0017-x86-kasan-Map-shadow-for-percpu-pages-on-demand.patch +Patch0018: 0018-x86-mm-Recompute-physical-address-for-every-page-of-.patch +Patch0019: 0019-x86-mm-Populate-KASAN-shadow-for-entire-per-CPU-rang.patch +Patch0020: 0020-x86-kasan-Rename-local-CPU_ENTRY_AREA-variables-to-s.patch +Patch0021: 0021-x86-kasan-Add-helpers-to-align-shadow-addresses-up-a.patch +Patch0022: 0022-x86-kasan-Populate-shadow-for-shared-chunk-of-the-CP.patch +Patch0023: 0023-net-sched-act_mirred-better-wording-on-protection-ag.patch +Patch0024: 0024-act_mirred-use-the-backlog-for-nested-calls-to-mirre.patch #BuildRequires: @@ -323,6 +333,16 @@ Applypatches series.conf %{_builddir}/kernel-%{version}/linux-%{KernelVer} %patch0012 -p1 %patch0013 -p1 %patch0014 -p1 +%patch0015 -p1 +%patch0016 -p1 +%patch0017 -p1 +%patch0018 -p1 +%patch0019 -p1 +%patch0020 -p1 +%patch0021 -p1 +%patch0022 -p1 +%patch0023 -p1 +%patch0024 -p1 touch .scmversion find . $ -name "*.orig" -o -name "*~" $ -exec rm -f {} \; >/dev/null @@ -905,6 +925,9 @@ fi %endif %changelog +* Fri Mar 18 2023 Jialin Zhang <zhangjialin11(a)huawei.com> - 6.1.19-7.0.0.17 +- Fix CVE-2023-23005, CVE-2023-0597 and CVE-2022-4269 + * Fri Mar 17 2023 Zheng Zengkai <zhengzengkai(a)huawei.com> - 6.1.19-6.0.0.16 - Fix kernel rpm build failure that libperf-jvmti.so is missing -- 2.25.1

1 0

[PATCH PR openEuler-22.03-LTS-SP1] mm/vmalloc: huge vmalloc backing pages should be split rather than compound
by Jialin Zhang 17 Mar '23

17 Mar '23

From: Nicholas Piggin <npiggin(a)gmail.com> mainline inclusion from mainline-v5.18-rc4 commit 3b8000ae185cb068adbda5f966a3835053c85fd4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6LD0S CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Huge vmalloc higher-order backing pages were allocated with __GFP_COMP in order to allow the sub-pages to be refcounted by callers such as "remap_vmalloc_page [sic]" (remap_vmalloc_range). However a similar problem exists for other struct page fields callers use, for example fb_deferred_io_fault() takes a vmalloc'ed page and not only refcounts it but uses ->lru, ->mapping, ->index. This is not compatible with compound sub-pages, and can cause bad page state issues like BUG: Bad page state in process swapper/0 pfn:00743 page:(____ptrval____) refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x743 flags: 0x7ffff000000000(node=0|zone=0|lastcpupid=0x7ffff) raw: 007ffff000000000 c00c00000001d0c8 c00c00000001d0c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: corrupted mapping in tail page Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.18.0-rc3-00082-gfc6fff4a7ce1-dirty #2810 Call Trace: dump_stack_lvl+0x74/0xa8 (unreliable) bad_page+0x12c/0x170 free_tail_pages_check+0xe8/0x190 free_pcp_prepare+0x31c/0x4e0 free_unref_page+0x40/0x1b0 __vunmap+0x1d8/0x420 ... The correct approach is to use split high-order pages for the huge vmalloc backing. These allow callers to treat them in exactly the same way as individually-allocated order-0 pages. Link: https://lore.kernel.org/all/14444103-d51b-0fb3-ee63-c3f182f0b546@molgen.mpg… Signed-off-by: Nicholas Piggin <npiggin(a)gmail.com> Cc: Paul Menzel <pmenzel(a)molgen.mpg.de> Cc: Song Liu <songliubraving(a)fb.com> Cc: Rick Edgecombe <rick.p.edgecombe(a)intel.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> conflicts: mm/vmalloc.c Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- mm/vmalloc.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index e27cd716ca95..2ca2c1bc0db9 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -2641,14 +2641,17 @@ static void __vunmap(const void *addr, int deallocate_pages) vm_remove_mappings(area, deallocate_pages); if (deallocate_pages) { - unsigned int page_order = vm_area_page_order(area); int i; - for (i = 0; i < area->nr_pages; i += 1U << page_order) { + for (i = 0; i < area->nr_pages; i++) { struct page *page = area->pages[i]; BUG_ON(!page); - __free_pages(page, page_order); + /* + * High-order allocs for huge vmallocs are split, so + * can be freed as an array of order-0 allocations + */ + __free_pages(page, 0); } atomic_long_sub(area->nr_pages, &nr_vmalloc_pages); @@ -2930,8 +2933,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask, struct page *page; int p; - /* Compound pages required for remap_vmalloc_page */ - page = alloc_pages_node(node, gfp_mask | __GFP_COMP, page_order); + page = alloc_pages_node(node, gfp_mask, page_order); if (unlikely(!page)) { /* Successfully allocated i pages, free them in __vfree() */ area->nr_pages = i; @@ -2943,6 +2945,16 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask, goto fail; } + /* + * Higher order allocations must be able to be treated as + * indepdenent small pages by callers (as they can with + * small-page vmallocs). Some drivers do their own refcounting + * on vmalloc_to_page() pages, some use page->mapping, + * page->lru, etc. + */ + if (page_order) + split_page(page, page_order); + for (p = 0; p < (1U << page_order); p++) area->pages[i + p] = page + p; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 01/10] media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
by Yongqiang Liu 17 Mar '23

17 Mar '23

From: Baisong Zhong <zhongbaisong(a)huawei.com> mainline inclusion from mainline-v6.2-rc1 commit 0ed554fd769a19ea8464bb83e9ac201002ef74ad category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6NCQH CVE: CVE-2023-28328 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Wei Chen reports a kernel bug as blew: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] ... Call Trace: <TASK> __i2c_transfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109 i2c_transfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170 i2cdev_ioctl_rdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297 i2cdev_ioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd834a8bded In az6027_i2c_xfer(), if msg[i].addr is 0x99, a null-ptr-deref will caused when accessing msg[i].buf. For msg[i].len is 0 and msg[i].buf is null. Fix this by checking msg[i].len in az6027_i2c_xfer(). Link: https://lore.kernel.org/lkml/CAO4mrfcPHB5aQJO=mpqV+p8mPLNg-Fok0gw8gZ=zemAfM… Link: https://lore.kernel.org/linux-media/20221120065918.2160782-1-zhongbaisong@h… Fixes: 76f9a820c867 ("V4L/DVB: AZ6027: Initial import of the driver") Reported-by: Wei Chen <harperchen1110(a)gmail.com> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/media/usb/dvb-usb/az6027.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c index 6321b8e30261..555c8ac44881 100644 --- a/drivers/media/usb/dvb-usb/az6027.c +++ b/drivers/media/usb/dvb-usb/az6027.c @@ -977,6 +977,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n if (msg[i].addr == 0x99) { req = 0xBE; index = 0; + if (msg[i].len < 1) { + i = -EOPNOTSUPP; + break; + } value = msg[i].buf[0] & 0x00ff; length = 1; az6027_usb_out_op(d, req, value, index, data, length); -- 2.25.1

1 9

[PATCH OLK-5.10] Revert "scsi: hisi_sas: Disable SATA disk phy for severe I_T nexus reset failure"
by Yihang Li 17 Mar '23

17 Mar '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6NX2M CVE: NA ---------------------------------------------------------------------- This fix commit c723ada86707c6afe524b51126c301d689c64d8e. In that commit, if the softreset fails upon certain conditions, just disable the PHY associated with the disk. The user needs to restore the PHY. SATA disks do not support simultaneous connection of multiple hosts. Therefore, when multiple controllers are connected to a SATA disk at the same time, the controller which is connected later failed to issue an ATA softreset to the SATA disk. As a result, the PHY associated with the disk is disabled and cannot be automatically recovered. Now that, we will not focus on the execution result of softreset. No matter whether the execution is successful or not, we will directly carry out I_T_nexus_reset. Signed-off-by: Yihang Li <liyihang9(a)huawei.com> Signed-off-by: xiabing <xiabing12(a)h-partners.com> --- drivers/scsi/hisi_sas/hisi_sas_main.c | 29 +++++---------------------- 1 file changed, 5 insertions(+), 24 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index b8249a055fbb..0f5578e52558 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -1895,33 +1895,14 @@ static int hisi_sas_I_T_nexus_reset(struct domain_device *device) } hisi_sas_dereg_device(hisi_hba, device); - rc = hisi_sas_debug_I_T_nexus_reset(device); - if (rc == TMF_RESP_FUNC_COMPLETE && dev_is_sata(device)) { - struct sas_phy *local_phy; - + if (dev_is_sata(device)) { rc = hisi_sas_softreset_ata_disk(device); - switch (rc) { - case -ECOMM: - rc = -ENODEV; - break; - case TMF_RESP_FUNC_FAILED: - case -EMSGSIZE: - case -EIO: - local_phy = sas_get_local_phy(device); - rc = sas_phy_enable(local_phy, 0); - if (!rc) { - local_phy->enabled = 0; - dev_err(dev, "Disabled local phy of ATA disk %016llx due to softreset fail (%d)\n", - SAS_ADDR(device->sas_addr), rc); - rc = -ENODEV; - } - sas_put_local_phy(local_phy); - break; - default: - break; - } + if (rc == TMF_RESP_FUNC_FAILED) + dev_err(dev, "ata disk %016llx reset (%d)\n", + SAS_ADDR(device->sas_addr), rc); } + rc = hisi_sas_debug_I_T_nexus_reset(device); if ((rc == TMF_RESP_FUNC_COMPLETE) || (rc == -ENODEV)) hisi_sas_release_task(hisi_hba, device); -- 2.30.0

1 0

[PATCH openEuler-1.0-LTS 1/8] fs/proc: task_mmu.c: don't read mapcount for migration entry
by Yongqiang Liu 17 Mar '23

17 Mar '23

From: Yang Shi <shy828301(a)gmail.com> stable inclusion from stable-v5.10.102 commit db3f3636e4aed2cba3e4e7897a053323f7a62249 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6EVUJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 24d7275ce2791829953ed4e72f68277ceb2571c6 upstream. The syzbot reported the below BUG: kernel BUG at include/linux/page-flags.h:785! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 4392 Comm: syz-executor560 Not tainted 5.16.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:PageDoubleMap include/linux/page-flags.h:785 [inline] RIP: 0010:__page_mapcount+0x2d2/0x350 mm/util.c:744 Call Trace: page_mapcount include/linux/mm.h:837 [inline] smaps_account+0x470/0xb10 fs/proc/task_mmu.c:466 smaps_pte_entry fs/proc/task_mmu.c:538 [inline] smaps_pte_range+0x611/0x1250 fs/proc/task_mmu.c:601 walk_pmd_range mm/pagewalk.c:128 [inline] walk_pud_range mm/pagewalk.c:205 [inline] walk_p4d_range mm/pagewalk.c:240 [inline] walk_pgd_range mm/pagewalk.c:277 [inline] __walk_page_range+0xe23/0x1ea0 mm/pagewalk.c:379 walk_page_vma+0x277/0x350 mm/pagewalk.c:530 smap_gather_stats.part.0+0x148/0x260 fs/proc/task_mmu.c:768 smap_gather_stats fs/proc/task_mmu.c:741 [inline] show_smap+0xc6/0x440 fs/proc/task_mmu.c:822 seq_read_iter+0xbb0/0x1240 fs/seq_file.c:272 seq_read+0x3e0/0x5b0 fs/seq_file.c:162 vfs_read+0x1b5/0x600 fs/read_write.c:479 ksys_read+0x12d/0x250 fs/read_write.c:619 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The reproducer was trying to read /proc/$PID/smaps when calling MADV_FREE at the mean time. MADV_FREE may split THPs if it is called for partial THP. It may trigger the below race: CPU A CPU B ----- ----- smaps walk: MADV_FREE: page_mapcount() PageCompound() split_huge_page() page = compound_head(page) PageDoubleMap(page) When calling PageDoubleMap() this page is not a tail page of THP anymore so the BUG is triggered. This could be fixed by elevated refcount of the page before calling mapcount, but that would prevent it from counting migration entries, and it seems overkilling because the race just could happen when PMD is split so all PTE entries of tail pages are actually migration entries, and smaps_account() does treat migration entries as mapcount == 1 as Kirill pointed out. Add a new parameter for smaps_account() to tell this entry is migration entry then skip calling page_mapcount(). Don't skip getting mapcount for device private entries since they do track references with mapcount. Pagemap also has the similar issue although it was not reported. Fixed it as well. [shy828301(a)gmail.com: v4] Link: https://lkml.kernel.org/r/20220203182641.824731-1-shy828301@gmail.com [nathan(a)kernel.org: avoid unused variable warning in pagemap_pmd_range()] Link: https://lkml.kernel.org/r/20220207171049.1102239-1-nathan@kernel.org Link: https://lkml.kernel.org/r/20220120202805.3369-1-shy828301@gmail.com Fixes: e9b61f19858a ("thp: reintroduce split_huge_page()") Signed-off-by: Yang Shi <shy828301(a)gmail.com> Signed-off-by: Nathan Chancellor <nathan(a)kernel.org> Reported-by: syzbot+1f52b3a18d5633fa7f82(a)syzkaller.appspotmail.com Acked-by: David Hildenbrand <david(a)redhat.com> Cc: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com> Cc: Jann Horn <jannh(a)google.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflicts: fs/proc/task_mmu.c Signed-off-by: Zhang Peng <zhangpeng362(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/proc/task_mmu.c | 37 +++++++++++++++++++++++++++---------- 1 file changed, 27 insertions(+), 10 deletions(-) diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 93815b2b8440..0175fd7b3598 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -429,7 +429,8 @@ struct mem_size_stats { }; static void smaps_account(struct mem_size_stats *mss, struct page *page, - bool compound, bool young, bool dirty, bool locked) + bool compound, bool young, bool dirty, bool locked, + bool migration) { int i, nr = compound ? 1 << compound_order(page) : 1; unsigned long size = nr * PAGE_SIZE; @@ -449,8 +450,15 @@ static void smaps_account(struct mem_size_stats *mss, struct page *page, * page_count(page) == 1 guarantees the page is mapped exactly once. * If any subpage of the compound page mapped with PTE it would elevate * page_count(). + * + * The page_mapcount() is called to get a snapshot of the mapcount. + * Without holding the page lock this snapshot can be slightly wrong as + * we cannot always read the mapcount atomically. It is not safe to + * call page_mapcount() even with PTL held if the page is not mapped, + * especially for migration entries. Treat regular migration entries + * as mapcount == 1. */ - if (page_count(page) == 1) { + if ((page_count(page) == 1) || migration) { if (dirty || PageDirty(page)) mss->private_dirty += size; else @@ -505,6 +513,7 @@ static void smaps_pte_entry(pte_t *pte, unsigned long addr, struct vm_area_struct *vma = walk->vma; bool locked = !!(vma->vm_flags & VM_LOCKED); struct page *page = NULL; + bool migration = false; if (pte_present(*pte)) { page = vm_normal_page(vma, addr, *pte); @@ -524,9 +533,10 @@ static void smaps_pte_entry(pte_t *pte, unsigned long addr, } else { mss->swap_pss += (u64)PAGE_SIZE << PSS_SHIFT; } - } else if (is_migration_entry(swpent)) + } else if (is_migration_entry(swpent)) { + migration = true; page = migration_entry_to_page(swpent); - else if (is_device_private_entry(swpent)) + } else if (is_device_private_entry(swpent)) page = device_private_entry_to_page(swpent); } else if (unlikely(IS_ENABLED(CONFIG_SHMEM) && mss->check_shmem_swap && pte_none(*pte))) { @@ -546,7 +556,8 @@ static void smaps_pte_entry(pte_t *pte, unsigned long addr, if (!page) return; - smaps_account(mss, page, false, pte_young(*pte), pte_dirty(*pte), locked); + smaps_account(mss, page, false, pte_young(*pte), pte_dirty(*pte), + locked, migration); } #ifdef CONFIG_TRANSPARENT_HUGEPAGE @@ -570,7 +581,8 @@ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr, /* pass */; else VM_BUG_ON_PAGE(1, page); - smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd), locked); + smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd), + locked, false); } #else static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr, @@ -1285,6 +1297,7 @@ static pagemap_entry_t pte_to_pagemap_entry(struct pagemapread *pm, { u64 frame = 0, flags = 0; struct page *page = NULL; + bool migration = false; if (pte_present(pte)) { if (pm->show_pfn) @@ -1302,8 +1315,10 @@ static pagemap_entry_t pte_to_pagemap_entry(struct pagemapread *pm, frame = swp_type(entry) | (swp_offset(entry) << MAX_SWAPFILES_SHIFT); flags |= PM_SWAP; - if (is_migration_entry(entry)) + if (is_migration_entry(entry)) { + migration = true; page = migration_entry_to_page(entry); + } if (is_device_private_entry(entry)) page = device_private_entry_to_page(entry); @@ -1311,7 +1326,7 @@ static pagemap_entry_t pte_to_pagemap_entry(struct pagemapread *pm, if (page && !PageAnon(page)) flags |= PM_FILE; - if (page && page_mapcount(page) == 1) + if (page && !migration && page_mapcount(page) == 1) flags |= PM_MMAP_EXCLUSIVE; if (vma->vm_flags & VM_SOFTDIRTY) flags |= PM_SOFT_DIRTY; @@ -1327,8 +1342,9 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, spinlock_t *ptl; pte_t *pte, *orig_pte; int err = 0; - #ifdef CONFIG_TRANSPARENT_HUGEPAGE + bool migration = false; + ptl = pmd_trans_huge_lock(pmdp, vma); if (ptl) { u64 flags = 0, frame = 0; @@ -1363,11 +1379,12 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, if (pmd_swp_soft_dirty(pmd)) flags |= PM_SOFT_DIRTY; VM_BUG_ON(!is_pmd_migration_entry(pmd)); + migration = is_migration_entry(entry); page = migration_entry_to_page(entry); } #endif - if (page && page_mapcount(page) == 1) + if (page && !migration && page_mapcount(page) == 1) flags |= PM_MMAP_EXCLUSIVE; for (; addr != end; addr += PAGE_SIZE) { -- 2.25.1

2 9

[PATCH OLK-5.10 0/8] SAS-related bugfix
by Yihang Li 16 Mar '23

16 Mar '23

From: xiabing <xiabing12(a)h-partners.com> 1. In the NCQ scenario, if multiple I/Os are delivered and one of the I/Os is faulty, a group of slow disks will always occur. 2. During I/O running, a null pointer exception occurs during the pressure test when a disk is removed. 3. When the length of the DMA Setup frame returned by the disk is abnormal, a group of slow disks are triggered. John Garry (2): scsi: libsas: Add sas_ata_device_link_abort() scsi: libsas: Update SATA dev FIS in sas_ata_task_done() Xingui Yang (6): scsi: hisi_sas: Move slot variable definition in hisi_sas_abort_task() scsi: hisi_sas: Add SATA_DISK_ERR bit handling for v3 hw scsi: hisi_sas: Use abort task set to reset SAS disks when discovered scsi: libsas: Grab the ATA port lock in sas_ata_device_link_abort() {topost} scsi: hisi_sas: Handle NCQ error when IPTT is valid {topost} scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list drivers/scsi/hisi_sas/hisi_sas.h | 4 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 52 ++++++++++++++++------- drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 8 +++- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 8 +++- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 58 ++++++++++++++++++++++++-- drivers/scsi/libsas/sas_ata.c | 22 +++++++++- include/scsi/sas_ata.h | 6 +++ 7 files changed, 132 insertions(+), 26 deletions(-) -- 2.30.0

1 8

订阅
by 乄語 16 Mar '23

16 Mar '23

subscribe

1 0

[PATCH OLK-5.10 0/8] SAS-related bugfix
by Yihang Li 16 Mar '23

16 Mar '23

From: xiabing <xiabing12(a)h-partners.com> 1. In the NCQ scenario, if multiple I/Os are delivered and one of the I/Os is faulty, a group of slow disks will always occur. 2. During I/O running, a null pointer exception occurs during the pressure test when a disk is removed. 3. When the length of the DMA Setup frame returned by the disk is abnormal, a group of slow disks are triggered. John Garry (2): scsi: libsas: Add sas_ata_device_link_abort() scsi: libsas: Update SATA dev FIS in sas_ata_task_done() Xingui Yang (6): scsi: hisi_sas: Move slot variable definition in hisi_sas_abort_task() scsi: hisi_sas: Add SATA_DISK_ERR bit handling for v3 hw scsi: hisi_sas: Use abort task set to reset SAS disks when discovered scsi: libsas: Grab the ATA port lock in sas_ata_device_link_abort() {topost} scsi: hisi_sas: Handle NCQ error when IPTT is valid {topost} scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list drivers/scsi/hisi_sas/hisi_sas.h | 4 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 52 ++++++++++++++++------- drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 8 +++- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 8 +++- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 58 ++++++++++++++++++++++++-- drivers/scsi/libsas/sas_ata.c | 22 +++++++++- include/scsi/sas_ata.h | 6 +++ 7 files changed, 132 insertions(+), 26 deletions(-) -- 2.30.0

1 8

[PATCH PR openEuler-22.03-LTS-SP1] mm/vmalloc: huge vmalloc backing pages should be split rather than compound
by Jialin Zhang 16 Mar '23

16 Mar '23

From: Nicholas Piggin <npiggin(a)gmail.com> mainline inclusion from mainline-v5.18-rc4 commit 3b8000ae185cb068adbda5f966a3835053c85fd4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6LD0S CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Huge vmalloc higher-order backing pages were allocated with __GFP_COMP in order to allow the sub-pages to be refcounted by callers such as "remap_vmalloc_page [sic]" (remap_vmalloc_range). However a similar problem exists for other struct page fields callers use, for example fb_deferred_io_fault() takes a vmalloc'ed page and not only refcounts it but uses ->lru, ->mapping, ->index. This is not compatible with compound sub-pages, and can cause bad page state issues like BUG: Bad page state in process swapper/0 pfn:00743 page:(____ptrval____) refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x743 flags: 0x7ffff000000000(node=0|zone=0|lastcpupid=0x7ffff) raw: 007ffff000000000 c00c00000001d0c8 c00c00000001d0c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: corrupted mapping in tail page Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.18.0-rc3-00082-gfc6fff4a7ce1-dirty #2810 Call Trace: dump_stack_lvl+0x74/0xa8 (unreliable) bad_page+0x12c/0x170 free_tail_pages_check+0xe8/0x190 free_pcp_prepare+0x31c/0x4e0 free_unref_page+0x40/0x1b0 __vunmap+0x1d8/0x420 ... The correct approach is to use split high-order pages for the huge vmalloc backing. These allow callers to treat them in exactly the same way as individually-allocated order-0 pages. Link: https://lore.kernel.org/all/14444103-d51b-0fb3-ee63-c3f182f0b546@molgen.mpg… Signed-off-by: Nicholas Piggin <npiggin(a)gmail.com> Cc: Paul Menzel <pmenzel(a)molgen.mpg.de> Cc: Song Liu <songliubraving(a)fb.com> Cc: Rick Edgecombe <rick.p.edgecombe(a)intel.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> conflicts: mm/vmalloc.c Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- mm/vmalloc.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index e27cd716ca95..2ca2c1bc0db9 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -2641,14 +2641,17 @@ static void __vunmap(const void *addr, int deallocate_pages) vm_remove_mappings(area, deallocate_pages); if (deallocate_pages) { - unsigned int page_order = vm_area_page_order(area); int i; - for (i = 0; i < area->nr_pages; i += 1U << page_order) { + for (i = 0; i < area->nr_pages; i++) { struct page *page = area->pages[i]; BUG_ON(!page); - __free_pages(page, page_order); + /* + * High-order allocs for huge vmallocs are split, so + * can be freed as an array of order-0 allocations + */ + __free_pages(page, 0); } atomic_long_sub(area->nr_pages, &nr_vmalloc_pages); @@ -2930,8 +2933,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask, struct page *page; int p; - /* Compound pages required for remap_vmalloc_page */ - page = alloc_pages_node(node, gfp_mask | __GFP_COMP, page_order); + page = alloc_pages_node(node, gfp_mask, page_order); if (unlikely(!page)) { /* Successfully allocated i pages, free them in __vfree() */ area->nr_pages = i; @@ -2943,6 +2945,16 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask, goto fail; } + /* + * Higher order allocations must be able to be treated as + * indepdenent small pages by callers (as they can with + * small-page vmallocs). Some drivers do their own refcounting + * on vmalloc_to_page() pages, some use page->mapping, + * page->lru, etc. + */ + if (page_order) + split_page(page, page_order); + for (p = 0; p < (1U << page_order); p++) area->pages[i + p] = page + p; -- 2.25.1

1 0

[PATCH PR OLK-5.10] mm/vmalloc: huge vmalloc backing pages should be split rather than compound
by Jialin Zhang 16 Mar '23

16 Mar '23

From: Nicholas Piggin <npiggin(a)gmail.com> mainline inclusion from mainline-v5.18-rc4 commit 3b8000ae185cb068adbda5f966a3835053c85fd4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6LD0S CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Huge vmalloc higher-order backing pages were allocated with __GFP_COMP in order to allow the sub-pages to be refcounted by callers such as "remap_vmalloc_page [sic]" (remap_vmalloc_range). However a similar problem exists for other struct page fields callers use, for example fb_deferred_io_fault() takes a vmalloc'ed page and not only refcounts it but uses ->lru, ->mapping, ->index. This is not compatible with compound sub-pages, and can cause bad page state issues like BUG: Bad page state in process swapper/0 pfn:00743 page:(____ptrval____) refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x743 flags: 0x7ffff000000000(node=0|zone=0|lastcpupid=0x7ffff) raw: 007ffff000000000 c00c00000001d0c8 c00c00000001d0c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: corrupted mapping in tail page Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.18.0-rc3-00082-gfc6fff4a7ce1-dirty #2810 Call Trace: dump_stack_lvl+0x74/0xa8 (unreliable) bad_page+0x12c/0x170 free_tail_pages_check+0xe8/0x190 free_pcp_prepare+0x31c/0x4e0 free_unref_page+0x40/0x1b0 __vunmap+0x1d8/0x420 ... The correct approach is to use split high-order pages for the huge vmalloc backing. These allow callers to treat them in exactly the same way as individually-allocated order-0 pages. Link: https://lore.kernel.org/all/14444103-d51b-0fb3-ee63-c3f182f0b546@molgen.mpg… Signed-off-by: Nicholas Piggin <npiggin(a)gmail.com> Cc: Paul Menzel <pmenzel(a)molgen.mpg.de> Cc: Song Liu <songliubraving(a)fb.com> Cc: Rick Edgecombe <rick.p.edgecombe(a)intel.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> conflicts: mm/vmalloc.c Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- mm/vmalloc.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index e27cd716ca95..2ca2c1bc0db9 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -2641,14 +2641,17 @@ static void __vunmap(const void *addr, int deallocate_pages) vm_remove_mappings(area, deallocate_pages); if (deallocate_pages) { - unsigned int page_order = vm_area_page_order(area); int i; - for (i = 0; i < area->nr_pages; i += 1U << page_order) { + for (i = 0; i < area->nr_pages; i++) { struct page *page = area->pages[i]; BUG_ON(!page); - __free_pages(page, page_order); + /* + * High-order allocs for huge vmallocs are split, so + * can be freed as an array of order-0 allocations + */ + __free_pages(page, 0); } atomic_long_sub(area->nr_pages, &nr_vmalloc_pages); @@ -2930,8 +2933,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask, struct page *page; int p; - /* Compound pages required for remap_vmalloc_page */ - page = alloc_pages_node(node, gfp_mask | __GFP_COMP, page_order); + page = alloc_pages_node(node, gfp_mask, page_order); if (unlikely(!page)) { /* Successfully allocated i pages, free them in __vfree() */ area->nr_pages = i; @@ -2943,6 +2945,16 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask, goto fail; } + /* + * Higher order allocations must be able to be treated as + * indepdenent small pages by callers (as they can with + * small-page vmallocs). Some drivers do their own refcounting + * on vmalloc_to_page() pages, some use page->mapping, + * page->lru, etc. + */ + if (page_order) + split_page(page, page_order); + for (p = 0; p < (1U << page_order); p++) area->pages[i + p] = page + p; -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 01/13] ext4: fix incorrect options show of original mount_opt and extend mount_opt2
by Jialin Zhang 15 Mar '23

15 Mar '23

From: Zhang Yi <yi.zhang(a)huawei.com> maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6D5XF Reference: https://lore.kernel.org/linux-ext4/20230130111138.76tp6pij3yhh4brh@quack3/T… -------------------------------- Current _ext4_show_options() do not distinguish MOPT_2 flag, so it mixed extend sbi->s_mount_opt2 options with sbi->s_mount_opt, it could lead to show incorrect options, e.g. show fc_debug_force if we mount with errors=continue mode and miss it if we set. $ mkfs.ext4 /dev/pmem0 $ mount -o errors=remount-ro /dev/pmem0 /mnt $ cat /proc/fs/ext4/pmem0/options | grep fc_debug_force #empty $ mount -o remount,errors=continue /mnt $ cat /proc/fs/ext4/pmem0/options | grep fc_debug_force fc_debug_force $ mount -o remount,errors=remount-ro,fc_debug_force /mnt $ cat /proc/fs/ext4/pmem0/options | grep fc_debug_force #empty Fixes: 995a3ed67fc8 ("ext4: add fast_commit feature and handling for extended mount options") Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Conflict: fs/ext4/super.c Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/ext4/ext4.h | 1 + fs/ext4/super.c | 28 +++++++++++++++++++++------- 2 files changed, 22 insertions(+), 7 deletions(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index c470a5fb2f20..7e5abaa31fea 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -1459,6 +1459,7 @@ struct ext4_sb_info { unsigned int s_mount_opt2; unsigned long s_mount_flags; unsigned int s_def_mount_opt; + unsigned int s_def_mount_opt2; ext4_fsblk_t s_sb_block; atomic64_t s_resv_clusters; kuid_t s_resuid; diff --git a/fs/ext4/super.c b/fs/ext4/super.c index dd3b72ba67e8..da8bd8031119 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -2585,7 +2585,7 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb, { struct ext4_sb_info *sbi = EXT4_SB(sb); struct ext4_super_block *es = sbi->s_es; - int def_errors, def_mount_opt = sbi->s_def_mount_opt; + int def_errors; const struct mount_opts *m; char sep = nodefs ? '\n' : ','; @@ -2597,15 +2597,28 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb, for (m = ext4_mount_opts; m->token != Opt_err; m++) { int want_set = m->flags & MOPT_SET; + int opt_2 = m->flags & MOPT_2; + unsigned int mount_opt, def_mount_opt; + if (((m->flags & (MOPT_SET|MOPT_CLEAR)) == 0) || (m->flags & MOPT_CLEAR_ERR) || m->flags & MOPT_SKIP) continue; - if (!nodefs && !(m->mount_opt & (sbi->s_mount_opt ^ def_mount_opt))) - continue; /* skip if same as the default */ + + if (opt_2) { + mount_opt = sbi->s_mount_opt2; + def_mount_opt = sbi->s_def_mount_opt2; + } else { + mount_opt = sbi->s_mount_opt; + def_mount_opt = sbi->s_def_mount_opt; + } + /* skip if same as the default */ + if (!nodefs && !(m->mount_opt & (mount_opt ^ def_mount_opt))) + continue; + /* select Opt_noFoo vs Opt_Foo */ if ((want_set && - (sbi->s_mount_opt & m->mount_opt) != m->mount_opt) || - (!want_set && (sbi->s_mount_opt & m->mount_opt))) - continue; /* select Opt_noFoo vs Opt_Foo */ + (mount_opt & m->mount_opt) != m->mount_opt) || + (!want_set && (mount_opt & m->mount_opt))) + continue; SEQ_OPTS_PRINT("%s", token2str(m->token)); } @@ -2635,7 +2648,7 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb, if (nodefs || sbi->s_stripe) SEQ_OPTS_PRINT("stripe=%lu", sbi->s_stripe); if (nodefs || EXT4_MOUNT_DATA_FLAGS & - (sbi->s_mount_opt ^ def_mount_opt)) { + (sbi->s_mount_opt ^ sbi->s_def_mount_opt)) { if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) SEQ_OPTS_PUTS("data=journal"); else if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA) @@ -4340,6 +4353,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) kfree(s_mount_opts); } sbi->s_def_mount_opt = sbi->s_mount_opt; + sbi->s_def_mount_opt2 = sbi->s_mount_opt2; if (!parse_options((char *) data, sb, &journal_devnum, &journal_ioprio, 0)) goto failed_mount; -- 2.25.1

1 12

[PATCH openEuler-5.10-LTS-SP1 01/13] ext4: fix incorrect options show of original mount_opt and extend mount_opt2
by Jialin Zhang 15 Mar '23

15 Mar '23

From: Zhang Yi <yi.zhang(a)huawei.com> maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6D5XF Reference: https://lore.kernel.org/linux-ext4/20230130111138.76tp6pij3yhh4brh@quack3/T… -------------------------------- Current _ext4_show_options() do not distinguish MOPT_2 flag, so it mixed extend sbi->s_mount_opt2 options with sbi->s_mount_opt, it could lead to show incorrect options, e.g. show fc_debug_force if we mount with errors=continue mode and miss it if we set. $ mkfs.ext4 /dev/pmem0 $ mount -o errors=remount-ro /dev/pmem0 /mnt $ cat /proc/fs/ext4/pmem0/options | grep fc_debug_force #empty $ mount -o remount,errors=continue /mnt $ cat /proc/fs/ext4/pmem0/options | grep fc_debug_force fc_debug_force $ mount -o remount,errors=remount-ro,fc_debug_force /mnt $ cat /proc/fs/ext4/pmem0/options | grep fc_debug_force #empty Fixes: 995a3ed67fc8 ("ext4: add fast_commit feature and handling for extended mount options") Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Conflict: fs/ext4/super.c Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/ext4/ext4.h | 1 + fs/ext4/super.c | 28 +++++++++++++++++++++------- 2 files changed, 22 insertions(+), 7 deletions(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index 8245b94d8fc6..f1d36671bc2b 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -1462,6 +1462,7 @@ struct ext4_sb_info { unsigned int s_mount_opt2; unsigned long s_mount_flags; unsigned int s_def_mount_opt; + unsigned int s_def_mount_opt2; ext4_fsblk_t s_sb_block; atomic64_t s_resv_clusters; kuid_t s_resuid; diff --git a/fs/ext4/super.c b/fs/ext4/super.c index c94ea845ea57..4fd680507948 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -2586,7 +2586,7 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb, { struct ext4_sb_info *sbi = EXT4_SB(sb); struct ext4_super_block *es = sbi->s_es; - int def_errors, def_mount_opt = sbi->s_def_mount_opt; + int def_errors; const struct mount_opts *m; char sep = nodefs ? '\n' : ','; @@ -2598,15 +2598,28 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb, for (m = ext4_mount_opts; m->token != Opt_err; m++) { int want_set = m->flags & MOPT_SET; + int opt_2 = m->flags & MOPT_2; + unsigned int mount_opt, def_mount_opt; + if (((m->flags & (MOPT_SET|MOPT_CLEAR)) == 0) || (m->flags & MOPT_CLEAR_ERR) || m->flags & MOPT_SKIP) continue; - if (!nodefs && !(m->mount_opt & (sbi->s_mount_opt ^ def_mount_opt))) - continue; /* skip if same as the default */ + + if (opt_2) { + mount_opt = sbi->s_mount_opt2; + def_mount_opt = sbi->s_def_mount_opt2; + } else { + mount_opt = sbi->s_mount_opt; + def_mount_opt = sbi->s_def_mount_opt; + } + /* skip if same as the default */ + if (!nodefs && !(m->mount_opt & (mount_opt ^ def_mount_opt))) + continue; + /* select Opt_noFoo vs Opt_Foo */ if ((want_set && - (sbi->s_mount_opt & m->mount_opt) != m->mount_opt) || - (!want_set && (sbi->s_mount_opt & m->mount_opt))) - continue; /* select Opt_noFoo vs Opt_Foo */ + (mount_opt & m->mount_opt) != m->mount_opt) || + (!want_set && (mount_opt & m->mount_opt))) + continue; SEQ_OPTS_PRINT("%s", token2str(m->token)); } @@ -2636,7 +2649,7 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb, if (nodefs || sbi->s_stripe) SEQ_OPTS_PRINT("stripe=%lu", sbi->s_stripe); if (nodefs || EXT4_MOUNT_DATA_FLAGS & - (sbi->s_mount_opt ^ def_mount_opt)) { + (sbi->s_mount_opt ^ sbi->s_def_mount_opt)) { if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) SEQ_OPTS_PUTS("data=journal"); else if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA) @@ -4341,6 +4354,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) kfree(s_mount_opts); } sbi->s_def_mount_opt = sbi->s_mount_opt; + sbi->s_def_mount_opt2 = sbi->s_mount_opt2; if (!parse_options((char *) data, sb, &journal_devnum, &journal_ioprio, 0)) goto failed_mount; -- 2.25.1

1 12

[RFC PATCH openEuler-1.0-LTS v2] sched: optimise the way to get util
by Wang ShaoBo 15 Mar '23

15 Mar '23

From: tanghui <tanghui20(a)huawei.com> optimise the way to get util. Signed-off-by: tanghui <tanghui20(a)huawei.com> Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> v2: refresh low_pct change way through sysctl. --- fs/proc/stat.c | 4 ++ include/linux/sched/cputime.h | 3 ++ include/linux/sched/sysctl.h | 2 + kernel/sched/fair.c | 83 +++++++++++++++++++++++++++++++++++ kernel/sched/sched.h | 1 + kernel/sysctl.c | 9 ++++ 6 files changed, 102 insertions(+) diff --git a/fs/proc/stat.c b/fs/proc/stat.c index 7e832b24847dd..3fe60a77b0b4d 100644 --- a/fs/proc/stat.c +++ b/fs/proc/stat.c @@ -63,7 +63,11 @@ u64 get_idle_time(int cpu) return idle; } +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY +u64 get_iowait_time(int cpu) +#else static u64 get_iowait_time(int cpu) +#endif { u64 iowait, iowait_usecs = -1ULL; diff --git a/include/linux/sched/cputime.h b/include/linux/sched/cputime.h index 6b1793606fc95..4a092e006f5b2 100644 --- a/include/linux/sched/cputime.h +++ b/include/linux/sched/cputime.h @@ -189,6 +189,9 @@ task_sched_runtime(struct task_struct *task); extern int use_sched_idle_time; extern int sched_idle_time_adjust(int cpu, u64 *utime, u64 *stime); extern unsigned long long sched_get_idle_time(int cpu); +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY +extern u64 get_iowait_time(int cpu); +#endif #ifdef CONFIG_PROC_FS extern u64 get_idle_time(int cpu); diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h index 04eb5b127867b..8223a1fce176c 100644 --- a/include/linux/sched/sysctl.h +++ b/include/linux/sched/sysctl.h @@ -31,6 +31,8 @@ extern unsigned int sysctl_sched_latency; extern unsigned int sysctl_sched_min_granularity; extern unsigned int sysctl_sched_wakeup_granularity; extern unsigned int sysctl_sched_child_runs_first; +extern int sysctl_sched_util_update_interval; +extern unsigned long sysctl_sched_util_update_interval_max; #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY extern int sysctl_sched_util_low_pct; diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index ad6a7923c9edb..af55a26d11fcb 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -6682,6 +6682,73 @@ static int wake_cap(struct task_struct *p, int cpu, int prev_cpu) */ int sysctl_sched_util_low_pct = 85; +struct cpu_timeinfo { + u64 systime; + u64 idletime; + unsigned long next_update; + int vutil; +}; + +/* + * The time interval to update CPU utilization + * (default 1ms, max 10min) + */ +int sysctl_sched_util_update_interval = 1; +unsigned long sysctl_sched_util_update_interval_max = 600000; + +static DEFINE_PER_CPU(struct cpu_timeinfo, qos_cputime); + +static inline u64 cpu_systime(int cpu) +{ + u64 user, nice, system, idle, iowait, irq, softirq, steal; + + user = kcpustat_cpu(cpu).cpustat[CPUTIME_USER]; + system = kcpustat_cpu(cpu).cpustat[CPUTIME_SYSTEM]; + iowait = get_iowait_time(cpu); + irq = kcpustat_cpu(cpu).cpustat[CPUTIME_IRQ]; + softirq = kcpustat_cpu(cpu).cpustat[CPUTIME_SOFTIRQ]; + nice = kcpustat_cpu(cpu).cpustat[CPUTIME_NICE]; + steal = kcpustat_cpu(cpu).cpustat[CPUTIME_STEAL]; + idle = get_idle_time(cpu); + + return user + system + iowait + irq + softirq + nice + idle + steal; +} + +static inline u64 cpu_idletime(int cpu) +{ + return get_idle_time(cpu) + get_iowait_time(cpu); +} + +static inline void update_cpu_vutil(void) +{ + struct cpu_timeinfo *cputime = per_cpu_ptr(&qos_cputime, smp_processor_id()); + u64 delta_systime, delta_idle, systime, idletime; + int cpu = smp_processor_id(); + unsigned long interval; + + if (time_after(jiffies, cputime->next_update)) { + interval = msecs_to_jiffies(sysctl_sched_util_update_interval); + cputime->next_update = jiffies + interval; + systime = cpu_systime(cpu); + idletime = cpu_idletime(cpu); + delta_systime = systime - cputime->systime; + delta_idle = idletime - cputime->idletime; + if (!delta_systime) + return; + + cputime->systime = systime; + cputime->idletime = idletime; + cputime->vutil = (delta_systime - delta_idle) * 100 / delta_systime; + } +} + +static inline int cpu_vutil_of(int cpu) +{ + struct cpu_timeinfo *cputime = per_cpu_ptr(&qos_cputime, cpu); + + return cputime->vutil; +} + static inline bool prefer_cpus_valid(struct task_struct *p) { return p->prefer_cpus && @@ -6741,17 +6808,29 @@ static void set_task_select_cpus(struct task_struct *p, int *idlest_cpu, return; } +#if 0 util_avg_sum += tg->se[cpu]->avg.util_avg; tg_capacity += capacity_of(cpu); +#endif + util_avg_sum += cpu_vutil_of(cpu); } rcu_read_unlock(); +#if 0 if (tg_capacity > cpumask_weight(p->prefer_cpus) && util_avg_sum * 100 <= tg_capacity * sysctl_sched_util_low_pct) { p->select_cpus = p->prefer_cpus; if (sd_flag & SD_BALANCE_WAKE) schedstat_inc(p->se.dyn_affi_stats->nr_wakeups_preferred_cpus); } +#endif + + if (util_avg_sum < sysctl_sched_util_low_pct * + cpumask_weight(p->prefer_cpus)) { + p->select_cpus = p->prefer_cpus; + if (sd_flag & SD_BALANCE_WAKE) + schedstat_inc(p->se.dyn_affi_stats->nr_wakeups_preferred_cpus); + } } #endif @@ -10610,6 +10689,10 @@ static void task_tick_fair(struct rq *rq, struct task_struct *curr, int queued) if (static_branch_unlikely(&sched_numa_balancing)) task_tick_numa(rq, curr); + +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + update_cpu_vutil(); +#endif } /* diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index ae30681530938..045fbb3871bbe 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -2354,3 +2354,4 @@ static inline void membarrier_switch_mm(struct rq *rq, { } #endif + diff --git a/kernel/sysctl.c b/kernel/sysctl.c index ad62ea156afd9..685f9881b8e23 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -352,6 +352,15 @@ static struct ctl_table kern_table[] = { .mode = 0644, .proc_handler = proc_dointvec, }, + { + .procname = "sched_util_update_interval_ms", + .data = &sysctl_sched_util_update_interval, + .maxlen = sizeof(sysctl_sched_util_update_interval), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = &one, + .extra2 = &sysctl_sched_util_update_interval_max, + }, #ifdef CONFIG_SCHED_DEBUG { .procname = "sched_min_granularity_ns", -- 2.25.1

1 0

[PATCH] sched: optimise the way to get util
by Wang ShaoBo 15 Mar '23

15 Mar '23

From: tanghui <tanghui20(a)huawei.com> sched: optimise the way to get util, which only canbe used when CONFIG_QOS_SCHED_DYNAMIC_AFFINITY is set. Signed-off-by: tanghui <tanghui20(a)huawei.com> --- fs/proc/stat.c | 4 ++ include/linux/sched/cputime.h | 3 ++ include/linux/sched/sysctl.h | 2 + kernel/sched/fair.c | 97 ++++++++++++++++++++++++++++++----- kernel/sched/sched.h | 1 + kernel/sysctl.c | 9 ++++ 6 files changed, 104 insertions(+), 12 deletions(-) diff --git a/fs/proc/stat.c b/fs/proc/stat.c index c83a10e895f4..2eaba2b78f47 100644 --- a/fs/proc/stat.c +++ b/fs/proc/stat.c @@ -63,7 +63,11 @@ u64 get_idle_time(int cpu) return idle; } +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY +u64 get_iowait_time(int cpu) +#else static u64 get_iowait_time(int cpu) +#endif { u64 iowait, iowait_usecs = -1ULL; diff --git a/include/linux/sched/cputime.h b/include/linux/sched/cputime.h index 1ebbeec02051..f6244d48f357 100644 --- a/include/linux/sched/cputime.h +++ b/include/linux/sched/cputime.h @@ -190,5 +190,8 @@ extern int use_sched_idle_time; extern int sched_idle_time_adjust(int cpu, u64 *utime, u64 *stime); extern unsigned long long sched_get_idle_time(int cpu); extern u64 get_idle_time(int cpu); +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY +extern u64 get_iowait_time(int cpu); +#endif #endif /* _LINUX_SCHED_CPUTIME_H */ diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h index f5031a607df8..386ef53017ca 100644 --- a/include/linux/sched/sysctl.h +++ b/include/linux/sched/sysctl.h @@ -28,6 +28,8 @@ extern unsigned int sysctl_sched_child_runs_first; extern int sysctl_sched_util_low_pct; extern int sysctl_sched_util_higher_pct; extern int sysctl_sched_load_higher_pct; +extern int sysctl_sched_util_update_interval; +extern unsigned long sysctl_sched_util_update_interval_max; #endif enum sched_tunable_scaling { diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 5344a68a463e..3217e3998fdf 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -6458,6 +6458,15 @@ static int wake_cap(struct task_struct *p, int cpu, int prev_cpu) } #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY +#define UTIL_PCT_HIGH 85 + +struct cpu_timeinfo { + u64 systime; + u64 idletime; + unsigned long next_update; + int vutil; +}; + /* * Light load threshold for CPU: just use cpu Utilization to measure * @@ -6484,15 +6493,75 @@ int sysctl_sched_util_higher_pct = 100; */ int sysctl_sched_load_higher_pct = 10; +/* + * The time interval to update CPU utilization + * (default 1ms, max 10min) + */ +int sysctl_sched_util_update_interval = 1; +unsigned long sysctl_sched_util_update_interval_max = 600000; + +static DEFINE_PER_CPU(struct cpu_timeinfo, qos_cputime); + +static inline u64 cpu_systime(int cpu) +{ + u64 user, nice, system, idle, iowait, irq, softirq, steal; + + user = kcpustat_cpu(cpu).cpustat[CPUTIME_USER]; + system = kcpustat_cpu(cpu).cpustat[CPUTIME_SYSTEM]; + iowait = get_iowait_time(cpu); + irq = kcpustat_cpu(cpu).cpustat[CPUTIME_IRQ]; + softirq = kcpustat_cpu(cpu).cpustat[CPUTIME_SOFTIRQ]; + nice = kcpustat_cpu(cpu).cpustat[CPUTIME_NICE]; + steal = kcpustat_cpu(cpu).cpustat[CPUTIME_STEAL]; + idle = get_idle_time(cpu); + + return user + system + iowait + irq + softirq + nice + idle + steal; +} + +static inline u64 cpu_idletime(int cpu) +{ + return get_idle_time(cpu) + get_iowait_time(cpu); +} + +static inline void update_cpu_vutil(void) +{ + struct cpu_timeinfo *cputime = per_cpu_ptr(&qos_cputime, smp_processor_id()); + u64 delta_systime, delta_idle, systime, idletime; + int cpu = smp_processor_id(); + unsigned long interval; + + if (time_after(jiffies, cputime->next_update)) { + interval = msecs_to_jiffies(sysctl_sched_util_update_interval); + cputime->next_update = jiffies + interval; + systime = cpu_systime(cpu); + idletime = cpu_idletime(cpu); + delta_systime = systime - cputime->systime; + delta_idle = idletime - cputime->idletime; + if (!delta_systime) + return; + + cputime->systime = systime; + cputime->idletime = idletime; + cputime->vutil = (delta_systime - delta_idle) * 100 / delta_systime; + } +} + +static inline int cpu_vutil_of(int cpu) +{ + struct cpu_timeinfo *cputime = per_cpu_ptr(&qos_cputime, cpu); + + return cputime->vutil; +} + static inline bool prefer_cpu_util_low(int cpu) { unsigned long capacity = capacity_of(cpu); - unsigned long util = cpu_util(cpu); + unsigned long util_pct = cpu_vutil_of(cpu); - if (util >= capacity || capacity <= 1) + if (util_pct >= 100 || capacity <= 1) return sysctl_sched_util_low_pct == 100; - return util * 100 <= capacity * sysctl_sched_util_low_pct; + return util_pct <= sysctl_sched_util_low_pct; } /* @@ -6504,8 +6573,8 @@ static inline int compare_cpu_util(int preferred_cpu, int external_cpu) { unsigned long capacity_cpux = capacity_of(preferred_cpu); unsigned long capacity_cpuy = capacity_of(external_cpu); - unsigned long cpu_util_x = cpu_util(preferred_cpu); - unsigned long cpu_util_y = cpu_util(external_cpu); + unsigned long cpu_util_x = cpu_vutil_of(preferred_cpu); + unsigned long cpu_util_y = cpu_vutil_of(external_cpu); int ratio; /* @@ -6519,7 +6588,7 @@ static inline int compare_cpu_util(int preferred_cpu, int external_cpu) if (capacity_cpux <= 1) return 1; - if (cpu_util_x >= capacity_cpux && available_idle_cpu(external_cpu)) + if (cpu_util_x >= UTIL_PCT_HIGH && available_idle_cpu(external_cpu)) return 1; if (!cpu_util_x) @@ -6529,12 +6598,12 @@ static inline int compare_cpu_util(int preferred_cpu, int external_cpu) * The lower the CPU utilization, the larger the ratio of * CPU utilization gap. */ - ratio = cpu_util_x >= capacity_cpux ? 1 : capacity_cpux / cpu_util_x; + ratio = cpu_util_x >= 100 ? 0 : 100 / cpu_util_x; if (ratio > 10) ratio = 10; - return (sysctl_sched_util_higher_pct * ratio + 100) * cpu_util_y * - capacity_cpux < 100 * cpu_util_x * capacity_cpuy; + return (sysctl_sched_util_higher_pct * ratio + 100) * + cpu_util_y * capacity_cpux < 100 * cpu_util_x * capacity_cpuy; } static inline bool prefer_cpus_valid(struct task_struct *p) @@ -6549,7 +6618,7 @@ static inline bool prefer_cpus_valid(struct task_struct *p) * @p: the task whose available cpu range will to set * @idlest_cpu: the cpu which is the idlest in prefer cpus * - * x: the cpu of min util_avg from preferred set + * x: the cpu of min util from preferred set * y: the cpu from allowed set but exclude preferred set * * If x's utilization is low, select preferred cpu range for task @@ -6578,7 +6647,7 @@ static void set_task_select_cpus(struct task_struct *p, int *idlest_cpu, goto cpus_allowed; cpu = cpumask_first(p->se.prefer_cpus); - min_util = cpu_util(cpu); + min_util = cpu_vutil_of(cpu); for_each_cpu(i, p->se.prefer_cpus) { if (prefer_cpu_util_low(i) || available_idle_cpu(i)) { cpu = i; @@ -6589,7 +6658,7 @@ static void set_task_select_cpus(struct task_struct *p, int *idlest_cpu, if (capacity_of(i) <= 1) continue; - c_util = cpu_util(i); + c_util = cpu_vutil_of(i); if (min_util * capacity_of(i) > c_util * capacity_of(cpu)) { min_util = c_util; cpu = i; @@ -10278,6 +10347,10 @@ static void task_tick_fair(struct rq *rq, struct task_struct *curr, int queued) if (static_branch_unlikely(&sched_numa_balancing)) task_tick_numa(rq, curr); + +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + update_cpu_vutil(); +#endif } /* diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 55216a03d327..4de9c966da01 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -2348,3 +2348,4 @@ static inline void membarrier_switch_mm(struct rq *rq, { } #endif + diff --git a/kernel/sysctl.c b/kernel/sysctl.c index b309aa206697..d52e003f3f56 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1274,6 +1274,15 @@ static struct ctl_table kern_table[] = { .extra1 = &zero, .extra2 = &one_hundred, }, + { + .procname = "sched_util_update_interval_ms", + .data = &sysctl_sched_util_update_interval, + .maxlen = sizeof(sysctl_sched_util_update_interval), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = &one, + .extra2 = &sysctl_sched_util_update_interval_max, + }, #endif #endif { } -- 2.23.0

1 0

[PATCH openEuler-1.0-LTS 1/2] scsi: fix use-after-free problem in scsi_remove_target
by Yongqiang Liu 13 Mar '23

13 Mar '23

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188355, https://gitee.com/openeuler/kernel/issues/I6E4JF CVE: NA ---------------------------------------- A use-after-free problem like below: BUG: KASAN: use-after-free in scsi_target_reap+0x6c/0x70 Workqueue: scsi_wq_1 __iscsi_unbind_session [scsi_transport_iscsi] Call trace: dump_backtrace+0x0/0x320 show_stack+0x24/0x30 dump_stack+0xdc/0x128 print_address_description+0x68/0x278 kasan_report+0x1e4/0x308 __asan_report_load4_noabort+0x30/0x40 scsi_target_reap+0x6c/0x70 scsi_remove_target+0x430/0x640 __iscsi_unbind_session+0x164/0x268 [scsi_transport_iscsi] process_one_work+0x67c/0x1350 worker_thread+0x370/0xf90 kthread+0x2a4/0x320 ret_from_fork+0x10/0x18 The problem is caused by a concurrency scenario: T0: delete target // echo 1 > /sys/devices/platform/host1/session1/target1:0:0/1:0:0:1/delete T1: logout // iscsiadm -m node --logout T0 T1 sdev_store_delete scsi_remove_device device_remove_file __scsi_remove_device __iscsi_unbind_session scsi_remove_target spin_lock_irqsave list_for_each_entry scsi_target_reap // starget->reap_ref 1 -> 0 kref_get(&starget->reap_ref); // warn use-after-free. spin_unlock_irqrestore scsi_target_reap_ref_release scsi_target_destroy ... // delete starget scsi_target_reap // UAF When T0 reduces the reference count to 0, but has not been released, T1 can still enter list_for_each_entry, and then kref_get reports UAF. Fix it by using kref_get_unless_zero() to check for a reference count of 0. Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/scsi/scsi_sysfs.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c index 4030e1fa57e5..453f5a6fb96b 100644 --- a/drivers/scsi/scsi_sysfs.c +++ b/drivers/scsi/scsi_sysfs.c @@ -1500,7 +1500,16 @@ void scsi_remove_target(struct device *dev) starget->state == STARGET_CREATED_REMOVE) continue; if (starget->dev.parent == dev || &starget->dev == dev) { - kref_get(&starget->reap_ref); + /* + * If the reference count is already zero, skip + * this target. Calling kref_get_unless_zero() if + * the reference count is zero is safe because + * scsi_target_destroy() will wait until the host + * lock has been released before freeing starget. + */ + if (!kref_get_unless_zero(&starget->reap_ref)) + continue; + if (starget->state == STARGET_CREATED) starget->state = STARGET_CREATED_REMOVE; else -- 2.25.1

1 1

[OLK-5.10 v1] RDMA/hns: Support congestion control algorithm parameter configuration
by Chengchang Tang 13 Mar '23

13 Mar '23

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I6J5O7 --------------------------------------------------------------- hns roce support 4 congestion control algorithms. Each algorihm involves multiple parameters. This patch add port sysfs directory for each algorithm, which allows users to modify the parameters of these algorithms. Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Reviewed-by: Yangyang Li <liyangyang20(a)huawei.com> --- drivers/infiniband/hw/hns/Makefile | 2 +- drivers/infiniband/hw/hns/hns_roce_device.h | 42 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 77 ++++ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 132 ++++++ drivers/infiniband/hw/hns/hns_roce_main.c | 2 + drivers/infiniband/hw/hns/hns_roce_sysfs.c | 445 ++++++++++++++++++++ 6 files changed, 695 insertions(+), 5 deletions(-) create mode 100644 drivers/infiniband/hw/hns/hns_roce_sysfs.c diff --git a/drivers/infiniband/hw/hns/Makefile b/drivers/infiniband/hw/hns/Makefile index 77d8e41ffe7b..09f95fedd15d 100644 --- a/drivers/infiniband/hw/hns/Makefile +++ b/drivers/infiniband/hw/hns/Makefile @@ -10,7 +10,7 @@ ccflags-y += -I $(srctree)/drivers/net/ethernet/hisilicon/hns3/hns3_common hns-roce-objs := hns_roce_main.o hns_roce_cmd.o hns_roce_pd.o \ hns_roce_ah.o hns_roce_hem.o hns_roce_mr.o hns_roce_qp.o \ hns_roce_cq.o hns_roce_alloc.o hns_roce_db.o hns_roce_srq.o hns_roce_restrack.o \ - hns_roce_bond.o hns_roce_dca.o hns_roce_debugfs.o + hns_roce_bond.o hns_roce_dca.o hns_roce_debugfs.o hns_roce_sysfs.o ifdef CONFIG_INFINIBAND_HNS_HIP08 hns-roce-hw-v2-objs := hns_roce_hw_v2.o $(hns-roce-objs) diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h index 869d952b32b2..9d5580040e6b 100644 --- a/drivers/infiniband/hw/hns/hns_roce_device.h +++ b/drivers/infiniband/hw/hns/hns_roce_device.h @@ -767,11 +767,19 @@ struct hns_roce_eq_table { struct hns_roce_eq *eq; }; +enum hns_roce_scc_algo { + HNS_ROCE_SCC_ALGO_DCQCN = 0, + HNS_ROCE_SCC_ALGO_LDCP, + HNS_ROCE_SCC_ALGO_HC3, + HNS_ROCE_SCC_ALGO_DIP, + HNS_ROCE_SCC_ALGO_TOTAL, +}; + enum cong_type { - CONG_TYPE_DCQCN, - CONG_TYPE_LDCP, - CONG_TYPE_HC3, - CONG_TYPE_DIP, + CONG_TYPE_DCQCN = 1 << HNS_ROCE_SCC_ALGO_DCQCN, + CONG_TYPE_LDCP = 1 << HNS_ROCE_SCC_ALGO_LDCP, + CONG_TYPE_HC3 = 1 << HNS_ROCE_SCC_ALGO_HC3, + CONG_TYPE_DIP = 1 << HNS_ROCE_SCC_ALGO_DIP, }; struct hns_roce_caps { @@ -1016,6 +1024,28 @@ struct hns_roce_hw { int (*bond_init)(struct hns_roce_dev *hr_dev); bool (*bond_is_active)(struct hns_roce_dev *hr_dev); struct net_device *(*get_bond_netdev)(struct hns_roce_dev *hr_dev); + int (*config_scc_param)(struct hns_roce_dev *hr_dev, u8 port_num, + enum hns_roce_scc_algo algo); + int (*query_scc_param)(struct hns_roce_dev *hr_dev, u8 port_num, + enum hns_roce_scc_algo alog); +}; + +#define HNS_ROCE_SCC_PARAM_SIZE 4 +struct hns_roce_scc_param { + __le32 param[HNS_ROCE_SCC_PARAM_SIZE]; + u32 lifespan; + unsigned long timestamp; + enum hns_roce_scc_algo algo_type; + struct delayed_work scc_cfg_dwork; + struct hns_roce_dev *hr_dev; + u8 port_num; +}; + +struct hns_roce_port { + struct hns_roce_dev *hr_dev; + u8 port_num; + struct kobject kobj; + struct hns_roce_scc_param *scc_param; }; struct hns_roce_dev { @@ -1094,6 +1124,7 @@ struct hns_roce_dev { struct delayed_work bond_work; struct hns_roce_bond_group *bond_grp; struct netdev_lag_lower_state_info slave_state; + struct hns_roce_port port_data[HNS_ROCE_MAX_PORTS]; atomic64_t *dfx_cnt; }; @@ -1379,4 +1410,7 @@ struct hns_user_mmap_entry * hns_roce_user_mmap_entry_insert(struct ib_ucontext *ucontext, u64 address, size_t length, enum hns_roce_mmap_type mmap_type); +int hns_roce_create_port_files(struct ib_device *ibdev, u8 port_num, + struct kobject *kobj); +void hns_roce_unregister_sysfs(struct hns_roce_dev *hr_dev); #endif /* _HNS_ROCE_DEVICE_H */ diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index a76a57c7e36a..c9826a010f38 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -7146,6 +7146,81 @@ static void hns_roce_v2_cleanup_eq_table(struct hns_roce_dev *hr_dev) kfree(eq_table->eq); } +static enum hns_roce_opcode_type scc_opcode[] = { + HNS_ROCE_OPC_CFG_DCQCN_PARAM, + HNS_ROCE_OPC_CFG_LDCP_PARAM, + HNS_ROCE_OPC_CFG_HC3_PARAM, + HNS_ROCE_OPC_CFG_DIP_PARAM, +}; + +static int hns_roce_v2_config_scc_param(struct hns_roce_dev *hr_dev, + u8 port_num, + enum hns_roce_scc_algo algo) +{ + struct hns_roce_scc_param *scc_param; + struct hns_roce_cmq_desc desc; + struct hns_roce_port *pdata; + int ret; + + if (port_num > hr_dev->caps.num_ports) { + ibdev_err_ratelimited(&hr_dev->ib_dev, + "invalid port num %u.\n", port_num); + return -ENODEV; + } + + if (algo >= HNS_ROCE_SCC_ALGO_TOTAL) { + ibdev_err_ratelimited(&hr_dev->ib_dev, "invalid SCC algo.\n"); + return -EINVAL; + } + + hns_roce_cmq_setup_basic_desc(&desc, scc_opcode[algo], false); + pdata = &hr_dev->port_data[port_num - 1]; + scc_param = &pdata->scc_param[algo]; + memcpy(&desc.data, scc_param, sizeof(scc_param->param)); + + ret = hns_roce_cmq_send(hr_dev, &desc, 1); + if (ret) + ibdev_err_ratelimited(&hr_dev->ib_dev, + "failed to configure scc param, opcode: 0x%x, ret = %d.\n", + le16_to_cpu(desc.opcode), ret); + return ret; +} + +static int hns_roce_v2_query_scc_param(struct hns_roce_dev *hr_dev, + u8 port_num, enum hns_roce_scc_algo algo) +{ + struct hns_roce_scc_param *scc_param; + struct hns_roce_cmq_desc desc; + struct hns_roce_port *pdata; + int ret; + + if (port_num > hr_dev->caps.num_ports) { + ibdev_err_ratelimited(&hr_dev->ib_dev, + "invalid port num %u.\n", port_num); + return -ENODEV; + } + + if (algo >= HNS_ROCE_SCC_ALGO_TOTAL) { + ibdev_err_ratelimited(&hr_dev->ib_dev, "invalid SCC algo.\n"); + return -EINVAL; + } + + hns_roce_cmq_setup_basic_desc(&desc, scc_opcode[algo], true); + ret = hns_roce_cmq_send(hr_dev, &desc, 1); + if (ret) { + ibdev_err_ratelimited(&hr_dev->ib_dev, + "failed to query scc param, opcode: 0x%x, ret = %d.\n", + le16_to_cpu(desc.opcode), ret); + return ret; + } + + pdata = &hr_dev->port_data[port_num - 1]; + scc_param = &pdata->scc_param[algo]; + memcpy(scc_param, &desc.data, sizeof(scc_param->param)); + + return 0; +} + static const struct ib_device_ops hns_roce_v2_dev_ops = { .destroy_qp = hns_roce_v2_destroy_qp, .modify_cq = hns_roce_v2_modify_cq, @@ -7198,6 +7273,8 @@ static const struct hns_roce_hw hns_roce_hw_v2 = { .bond_is_active = hns_roce_bond_is_active, .get_bond_netdev = hns_roce_get_bond_netdev, .query_hw_counter = hns_roce_hw_v2_query_counter, + .config_scc_param = hns_roce_v2_config_scc_param, + .query_scc_param = hns_roce_v2_query_scc_param, }; static const struct pci_device_id hns_roce_hw_v2_pci_tbl[] = { diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index 7d5c304a8342..90401577865e 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -227,6 +227,10 @@ enum { enum hns_roce_opcode_type { HNS_QUERY_FW_VER = 0x0001, HNS_QUERY_MAC_TYPE = 0x0389, + HNS_ROCE_OPC_CFG_DCQCN_PARAM = 0x1A80, + HNS_ROCE_OPC_CFG_LDCP_PARAM = 0x1A81, + HNS_ROCE_OPC_CFG_HC3_PARAM = 0x1A82, + HNS_ROCE_OPC_CFG_DIP_PARAM = 0x1A83, HNS_ROCE_OPC_QUERY_HW_VER = 0x8000, HNS_ROCE_OPC_CFG_GLOBAL_PARAM = 0x8001, HNS_ROCE_OPC_ALLOC_PF_RES = 0x8004, @@ -1468,6 +1472,134 @@ struct hns_roce_wqe_atomic_seg { __le64 cmp_data; }; +#define HNS_ROCE_DCQCN_AI_OFS 0 +#define HNS_ROCE_DCQCN_AI_SZ sizeof(u16) +#define HNS_ROCE_DCQCN_AI_MAX ((u16)(~0U)) +#define HNS_ROCE_DCQCN_F_OFS (HNS_ROCE_DCQCN_AI_OFS + HNS_ROCE_DCQCN_AI_SZ) +#define HNS_ROCE_DCQCN_F_SZ sizeof(u8) +#define HNS_ROCE_DCQCN_F_MAX ((u8)(~0U)) +#define HNS_ROCE_DCQCN_TKP_OFS (HNS_ROCE_DCQCN_F_OFS + HNS_ROCE_DCQCN_F_SZ) +#define HNS_ROCE_DCQCN_TKP_SZ sizeof(u8) +#define HNS_ROCE_DCQCN_TKP_MAX 15 +#define HNS_ROCE_DCQCN_TMP_OFS (HNS_ROCE_DCQCN_TKP_OFS + HNS_ROCE_DCQCN_TKP_SZ) +#define HNS_ROCE_DCQCN_TMP_SZ sizeof(u16) +#define HNS_ROCE_DCQCN_TMP_MAX 15 +#define HNS_ROCE_DCQCN_ALP_OFS (HNS_ROCE_DCQCN_TMP_OFS + HNS_ROCE_DCQCN_TMP_SZ) +#define HNS_ROCE_DCQCN_ALP_SZ sizeof(u16) +#define HNS_ROCE_DCQCN_ALP_MAX ((u16)(~0U)) +#define HNS_ROCE_DCQCN_MAX_SPEED_OFS (HNS_ROCE_DCQCN_ALP_OFS + \ + HNS_ROCE_DCQCN_ALP_SZ) +#define HNS_ROCE_DCQCN_MAX_SPEED_SZ sizeof(u32) +#define HNS_ROCE_DCQCN_MAX_SPEED_MAX ((u32)(~0U)) +#define HNS_ROCE_DCQCN_G_OFS (HNS_ROCE_DCQCN_MAX_SPEED_OFS + \ + HNS_ROCE_DCQCN_MAX_SPEED_SZ) +#define HNS_ROCE_DCQCN_G_SZ sizeof(u8) +#define HNS_ROCE_DCQCN_G_MAX 15 +#define HNS_ROCE_DCQCN_AL_OFS (HNS_ROCE_DCQCN_G_OFS + HNS_ROCE_DCQCN_G_SZ) +#define HNS_ROCE_DCQCN_AL_SZ sizeof(u8) +#define HNS_ROCE_DCQCN_AL_MAX ((u8)(~0U)) +#define HNS_ROCE_DCQCN_CNP_TIME_OFS (HNS_ROCE_DCQCN_AL_OFS + \ + HNS_ROCE_DCQCN_AL_SZ) +#define HNS_ROCE_DCQCN_CNP_TIME_SZ sizeof(u8) +#define HNS_ROCE_DCQCN_CNP_TIME_MAX ((u8)(~0U)) +#define HNS_ROCE_DCQCN_ASHIFT_OFS (HNS_ROCE_DCQCN_CNP_TIME_OFS + \ + HNS_ROCE_DCQCN_CNP_TIME_SZ) +#define HNS_ROCE_DCQCN_ASHIFT_SZ sizeof(u8) +#define HNS_ROCE_DCQCN_ASHIFT_MAX 15 +#define HNS_ROCE_DCQCN_LIFESPAN_OFS (HNS_ROCE_DCQCN_ASHIFT_OFS + \ + HNS_ROCE_DCQCN_ASHIFT_SZ) +#define HNS_ROCE_DCQCN_LIFESPAN_SZ sizeof(u32) +#define HNS_ROCE_DCQCN_LIFESPAN_MAX 1000 + +#define HNS_ROCE_LDCP_CWD0_OFS 0 +#define HNS_ROCE_LDCP_CWD0_SZ sizeof(u32) +#define HNS_ROCE_LDCP_CWD0_MAX ((u32)(~0U)) +#define HNS_ROCE_LDCP_ALPHA_OFS (HNS_ROCE_LDCP_CWD0_OFS + HNS_ROCE_LDCP_CWD0_SZ) +#define HNS_ROCE_LDCP_ALPHA_SZ sizeof(u8) +#define HNS_ROCE_LDCP_ALPHA_MAX ((u8)(~0U)) +#define HNS_ROCE_LDCP_GAMMA_OFS (HNS_ROCE_LDCP_ALPHA_OFS + \ + HNS_ROCE_LDCP_ALPHA_SZ) +#define HNS_ROCE_LDCP_GAMMA_SZ sizeof(u8) +#define HNS_ROCE_LDCP_GAMMA_MAX ((u8)(~0U)) +#define HNS_ROCE_LDCP_BETA_OFS (HNS_ROCE_LDCP_GAMMA_OFS + \ + HNS_ROCE_LDCP_GAMMA_SZ) +#define HNS_ROCE_LDCP_BETA_SZ sizeof(u8) +#define HNS_ROCE_LDCP_BETA_MAX ((u8)(~0U)) +#define HNS_ROCE_LDCP_ETA_OFS (HNS_ROCE_LDCP_BETA_OFS + HNS_ROCE_LDCP_BETA_SZ) +#define HNS_ROCE_LDCP_ETA_SZ sizeof(u8) +#define HNS_ROCE_LDCP_ETA_MAX ((u8)(~0U)) +#define HNS_ROCE_LDCP_LIFESPAN_OFS (4 * sizeof(u32)) +#define HNS_ROCE_LDCP_LIFESPAN_SZ sizeof(u32) +#define HNS_ROCE_LDCP_LIFESPAN_MAX 1000 + +#define HNS_ROCE_HC3_INITIAL_WINDOW_OFS 0 +#define HNS_ROCE_HC3_INITIAL_WINDOW_SZ sizeof(u32) +#define HNS_ROCE_HC3_INITIAL_WINDOW_MAX ((u32)(~0U)) +#define HNS_ROCE_HC3_BANDWIDTH_OFS (HNS_ROCE_HC3_INITIAL_WINDOW_OFS + \ + HNS_ROCE_HC3_INITIAL_WINDOW_SZ) +#define HNS_ROCE_HC3_BANDWIDTH_SZ sizeof(u32) +#define HNS_ROCE_HC3_BANDWIDTH_MAX ((u32)(~0U)) +#define HNS_ROCE_HC3_QLEN_SHIFT_OFS (HNS_ROCE_HC3_BANDWIDTH_OFS + \ + HNS_ROCE_HC3_BANDWIDTH_SZ) +#define HNS_ROCE_HC3_QLEN_SHIFT_SZ sizeof(u8) +#define HNS_ROCE_HC3_QLEN_SHIFT_MAX ((u8)(~0U)) +#define HNS_ROCE_HC3_PORT_USAGE_SHIFT_OFS (HNS_ROCE_HC3_QLEN_SHIFT_OFS + \ + HNS_ROCE_HC3_QLEN_SHIFT_SZ) +#define HNS_ROCE_HC3_PORT_USAGE_SHIFT_SZ sizeof(u8) +#define HNS_ROCE_HC3_PORT_USAGE_SHIFT_MAX ((u8)(~0U)) +#define HNS_ROCE_HC3_OVER_PERIOD_OFS (HNS_ROCE_HC3_PORT_USAGE_SHIFT_OFS + \ + HNS_ROCE_HC3_PORT_USAGE_SHIFT_SZ) +#define HNS_ROCE_HC3_OVER_PERIOD_SZ sizeof(u8) +#define HNS_ROCE_HC3_OVER_PERIOD_MAX ((u8)(~0U)) +#define HNS_ROCE_HC3_MAX_STAGE_OFS (HNS_ROCE_HC3_OVER_PERIOD_OFS + \ + HNS_ROCE_HC3_OVER_PERIOD_SZ) +#define HNS_ROCE_HC3_MAX_STAGE_SZ sizeof(u8) +#define HNS_ROCE_HC3_MAX_STAGE_MAX ((u8)(~0U)) +#define HNS_ROCE_HC3_GAMMA_SHIFT_OFS (HNS_ROCE_HC3_MAX_STAGE_OFS + \ + HNS_ROCE_HC3_MAX_STAGE_SZ) +#define HNS_ROCE_HC3_GAMMA_SHIFT_SZ sizeof(u8) +#define HNS_ROCE_HC3_GAMMA_SHIFT_MAX 15 +#define HNS_ROCE_HC3_LIFESPAN_OFS (4 * sizeof(u32)) +#define HNS_ROCE_HC3_LIFESPAN_SZ sizeof(u32) +#define HNS_ROCE_HC3_LIFESPAN_MAX 1000 + +#define HNS_ROCE_DIP_AI_OFS 0 +#define HNS_ROCE_DIP_AI_SZ sizeof(u16) +#define HNS_ROCE_DIP_AI_MAX ((u16)(~0U)) +#define HNS_ROCE_DIP_F_OFS (HNS_ROCE_DIP_AI_OFS + HNS_ROCE_DIP_AI_SZ) +#define HNS_ROCE_DIP_F_SZ sizeof(u8) +#define HNS_ROCE_DIP_F_MAX ((u8)(~0U)) +#define HNS_ROCE_DIP_TKP_OFS (HNS_ROCE_DIP_F_OFS + HNS_ROCE_DIP_F_SZ) +#define HNS_ROCE_DIP_TKP_SZ sizeof(u8) +#define HNS_ROCE_DIP_TKP_MAX 15 +#define HNS_ROCE_DIP_TMP_OFS (HNS_ROCE_DIP_TKP_OFS + HNS_ROCE_DIP_TKP_SZ) +#define HNS_ROCE_DIP_TMP_SZ sizeof(u16) +#define HNS_ROCE_DIP_TMP_MAX 15 +#define HNS_ROCE_DIP_ALP_OFS (HNS_ROCE_DIP_TMP_OFS + HNS_ROCE_DIP_TMP_SZ) +#define HNS_ROCE_DIP_ALP_SZ sizeof(u16) +#define HNS_ROCE_DIP_ALP_MAX ((u16)(~0U)) +#define HNS_ROCE_DIP_MAX_SPEED_OFS (HNS_ROCE_DIP_ALP_OFS + HNS_ROCE_DIP_ALP_SZ) +#define HNS_ROCE_DIP_MAX_SPEED_SZ sizeof(u32) +#define HNS_ROCE_DIP_MAX_SPEED_MAX ((u32)(~0U)) +#define HNS_ROCE_DIP_G_OFS (HNS_ROCE_DIP_MAX_SPEED_OFS + \ + HNS_ROCE_DIP_MAX_SPEED_SZ) +#define HNS_ROCE_DIP_G_SZ sizeof(u8) +#define HNS_ROCE_DIP_G_MAX 15 +#define HNS_ROCE_DIP_AL_OFS (HNS_ROCE_DIP_G_OFS + HNS_ROCE_DIP_G_SZ) +#define HNS_ROCE_DIP_AL_SZ sizeof(u8) +#define HNS_ROCE_DIP_AL_MAX ((u8)(~0U)) +#define HNS_ROCE_DIP_CNP_TIME_OFS (HNS_ROCE_DIP_AL_OFS + HNS_ROCE_DIP_AL_SZ) +#define HNS_ROCE_DIP_CNP_TIME_SZ sizeof(u8) +#define HNS_ROCE_DIP_CNP_TIME_MAX ((u8)(~0U)) +#define HNS_ROCE_DIP_ASHIFT_OFS (HNS_ROCE_DIP_CNP_TIME_OFS + \ + HNS_ROCE_DIP_CNP_TIME_SZ) +#define HNS_ROCE_DIP_ASHIFT_SZ sizeof(u8) +#define HNS_ROCE_DIP_ASHIFT_MAX 15 +#define HNS_ROCE_DIP_LIFESPAN_OFS (HNS_ROCE_DIP_ASHIFT_OFS + \ + HNS_ROCE_DIP_ASHIFT_SZ) +#define HNS_ROCE_DIP_LIFESPAN_SZ sizeof(u32) +#define HNS_ROCE_DIP_LIFESPAN_MAX 1000 + struct hns_roce_sccc_clr { __le32 qpn; __le32 rsv[5]; diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index d98825154a82..4d1d2629d8f0 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -870,6 +870,7 @@ static const struct ib_device_ops hns_roce_dev_ops = { .reg_user_mr = hns_roce_reg_user_mr, .alloc_hw_stats = hns_roce_alloc_hw_port_stats, .get_hw_stats = hns_roce_get_hw_stats, + .init_port = hns_roce_create_port_files, INIT_RDMA_OBJ_SIZE(ib_ah, hns_roce_ah, ibah), INIT_RDMA_OBJ_SIZE(ib_cq, hns_roce_cq, ib_cq), @@ -1441,6 +1442,7 @@ int hns_roce_init(struct hns_roce_dev *hr_dev) void hns_roce_exit(struct hns_roce_dev *hr_dev) { + hns_roce_unregister_sysfs(hr_dev); hns_roce_unregister_device(hr_dev); hns_roce_unregister_debugfs(hr_dev); diff --git a/drivers/infiniband/hw/hns/hns_roce_sysfs.c b/drivers/infiniband/hw/hns/hns_roce_sysfs.c new file mode 100644 index 000000000000..507cc7147a2e --- /dev/null +++ b/drivers/infiniband/hw/hns/hns_roce_sysfs.c @@ -0,0 +1,445 @@ +// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB +/* + * Copyright (c) 2023 Hisilicon Limited. + */ + +#include "hnae3.h" +#include "hns_roce_device.h" +#include "hns_roce_hw_v2.h" + +struct hns_port_attribute { + struct attribute attr; + ssize_t (*show)(struct hns_roce_port *pdata, + struct hns_port_attribute *attr, char *buf); + ssize_t (*store)(struct hns_roce_port *pdata, + struct hns_port_attribute *attr, const char *buf, + size_t count); +}; + +static void scc_param_config_work(struct work_struct *work) +{ + struct hns_roce_scc_param *scc_param = container_of(work, + struct hns_roce_scc_param, scc_cfg_dwork.work); + struct hns_roce_dev *hr_dev = scc_param->hr_dev; + + hr_dev->hw->config_scc_param(hr_dev, scc_param->port_num, + scc_param->algo_type); +} + +static int alloc_scc_param(struct hns_roce_dev *hr_dev, + struct hns_roce_port *pdata) +{ + struct hns_roce_scc_param *scc_param; + int i; + + scc_param = kcalloc(HNS_ROCE_SCC_ALGO_TOTAL, sizeof(*scc_param), + GFP_KERNEL); + if (!scc_param) + return -ENOMEM; + + for (i = 0; i < HNS_ROCE_SCC_ALGO_TOTAL; i++) { + scc_param[i].algo_type = i; + scc_param[i].timestamp = jiffies; + scc_param[i].hr_dev = hr_dev; + scc_param[i].port_num = pdata->port_num; + INIT_DELAYED_WORK(&scc_param[i].scc_cfg_dwork, + scc_param_config_work); + } + + pdata->scc_param = scc_param; + return 0; +} + +struct hns_port_cc_attr { + struct hns_port_attribute port_attr; + enum hns_roce_scc_algo algo_type; + u32 offset; + u32 size; + u32 max; + u32 min; +}; + +static int scc_attr_check(struct hns_port_cc_attr *scc_attr) +{ + if (WARN_ON(scc_attr->size > sizeof(u32))) + return -EINVAL; + + if (WARN_ON(scc_attr->algo_type >= HNS_ROCE_SCC_ALGO_TOTAL)) + return -EINVAL; + return 0; +} + +static ssize_t scc_attr_show(struct hns_roce_port *pdata, + struct hns_port_attribute *attr, char *buf) +{ + struct hns_port_cc_attr *scc_attr = + container_of(attr, struct hns_port_cc_attr, port_attr); + struct hns_roce_scc_param *scc_param; + unsigned long exp_time; + __le32 val = 0; + int ret; + + ret = scc_attr_check(scc_attr); + if (ret) + return ret; + + scc_param = &pdata->scc_param[scc_attr->algo_type]; + + /* Only HW param need be queried */ + if (scc_attr->offset < offsetof(typeof(*scc_param), lifespan)) { + exp_time = scc_param->timestamp + + msecs_to_jiffies(scc_param->lifespan); + + if (time_is_before_eq_jiffies(exp_time)) { + scc_param->timestamp = jiffies; + pdata->hr_dev->hw->query_scc_param(pdata->hr_dev, + pdata->port_num, scc_attr->algo_type); + } + } + + memcpy(&val, (void *)scc_param + scc_attr->offset, scc_attr->size); + + return sysfs_emit(buf, "%u\n", le32_to_cpu(val)); +} + +static ssize_t scc_attr_store(struct hns_roce_port *pdata, + struct hns_port_attribute *attr, + const char *buf, size_t count) +{ + struct hns_port_cc_attr *scc_attr = + container_of(attr, struct hns_port_cc_attr, port_attr); + struct hns_roce_scc_param *scc_param; + unsigned long lifespan_jiffies; + unsigned long exp_time; + __le32 attr_val; + u32 val; + int ret; + + ret = scc_attr_check(scc_attr); + if (ret) + return ret; + + if (kstrtou32(buf, 0, &val)) + return -EINVAL; + + if (val > scc_attr->max || val < scc_attr->min) + return -EINVAL; + + attr_val = cpu_to_le32(val); + scc_param = &pdata->scc_param[scc_attr->algo_type]; + memcpy((void *)scc_param + scc_attr->offset, &attr_val, + scc_attr->size); + + /* lifespan is only used for driver */ + if (scc_attr->offset >= offsetof(typeof(*scc_param), lifespan)) + return count; + + lifespan_jiffies = msecs_to_jiffies(scc_param->lifespan); + exp_time = scc_param->timestamp + lifespan_jiffies; + + if (time_is_before_eq_jiffies(exp_time)) { + scc_param->timestamp = jiffies; + queue_delayed_work(pdata->hr_dev->irq_workq, + &scc_param->scc_cfg_dwork, lifespan_jiffies); + } + + return count; +} + +static umode_t scc_attr_is_visible(struct kobject *kobj, + struct attribute *attr, int i) +{ + struct hns_port_attribute *port_attr = + container_of(attr, struct hns_port_attribute, attr); + struct hns_port_cc_attr *scc_attr = + container_of(port_attr, struct hns_port_cc_attr, port_attr); + struct hns_roce_port *pdata = + container_of(kobj, struct hns_roce_port, kobj); + struct hns_roce_dev *hr_dev = pdata->hr_dev; + + if (hr_dev->is_vf || + !(hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_FLOW_CTRL)) + return 0; + + if (!(hr_dev->caps.cong_type & (1 << scc_attr->algo_type))) + return 0; + + return 0644; +} + +#define __HNS_SCC_ATTR(_name, _type, _offset, _size, _min, _max) { \ + .port_attr = __ATTR(_name, 0644, scc_attr_show, scc_attr_store), \ + .algo_type = _type, \ + .offset = _offset, \ + .size = _size, \ + .min = _min, \ + .max = _max, \ +} + +#define HNS_PORT_DCQCN_CC_ATTR_RW(_name, NAME) \ + struct hns_port_cc_attr hns_roce_port_attr_dcqcn_##_name = \ + __HNS_SCC_ATTR(_name, HNS_ROCE_SCC_ALGO_DCQCN, \ + HNS_ROCE_DCQCN_##NAME##_OFS, \ + HNS_ROCE_DCQCN_##NAME##_SZ, \ + 0, HNS_ROCE_DCQCN_##NAME##_MAX) + +HNS_PORT_DCQCN_CC_ATTR_RW(ai, AI); +HNS_PORT_DCQCN_CC_ATTR_RW(f, F); +HNS_PORT_DCQCN_CC_ATTR_RW(tkp, TKP); +HNS_PORT_DCQCN_CC_ATTR_RW(tmp, TMP); +HNS_PORT_DCQCN_CC_ATTR_RW(alp, ALP); +HNS_PORT_DCQCN_CC_ATTR_RW(max_speed, MAX_SPEED); +HNS_PORT_DCQCN_CC_ATTR_RW(g, G); +HNS_PORT_DCQCN_CC_ATTR_RW(al, AL); +HNS_PORT_DCQCN_CC_ATTR_RW(cnp_time, CNP_TIME); +HNS_PORT_DCQCN_CC_ATTR_RW(ashift, ASHIFT); +HNS_PORT_DCQCN_CC_ATTR_RW(lifespan, LIFESPAN); + +static struct attribute *dcqcn_param_attrs[] = { + &hns_roce_port_attr_dcqcn_ai.port_attr.attr, + &hns_roce_port_attr_dcqcn_f.port_attr.attr, + &hns_roce_port_attr_dcqcn_tkp.port_attr.attr, + &hns_roce_port_attr_dcqcn_tmp.port_attr.attr, + &hns_roce_port_attr_dcqcn_alp.port_attr.attr, + &hns_roce_port_attr_dcqcn_max_speed.port_attr.attr, + &hns_roce_port_attr_dcqcn_g.port_attr.attr, + &hns_roce_port_attr_dcqcn_al.port_attr.attr, + &hns_roce_port_attr_dcqcn_cnp_time.port_attr.attr, + &hns_roce_port_attr_dcqcn_ashift.port_attr.attr, + &hns_roce_port_attr_dcqcn_lifespan.port_attr.attr, + NULL, +}; + +static const struct attribute_group dcqcn_cc_param_group = { + .name = "dcqcn_cc_param", + .attrs = dcqcn_param_attrs, + .is_visible = scc_attr_is_visible, +}; + +#define HNS_PORT_LDCP_CC_ATTR_RW(_name, NAME) \ + struct hns_port_cc_attr hns_roce_port_attr_ldcp_##_name = \ + __HNS_SCC_ATTR(_name, HNS_ROCE_SCC_ALGO_LDCP, \ + HNS_ROCE_LDCP_##NAME##_OFS, \ + HNS_ROCE_LDCP_##NAME##_SZ, \ + 0, HNS_ROCE_LDCP_##NAME##_MAX) + +HNS_PORT_LDCP_CC_ATTR_RW(cwd0, CWD0); +HNS_PORT_LDCP_CC_ATTR_RW(alpha, ALPHA); +HNS_PORT_LDCP_CC_ATTR_RW(gamma, GAMMA); +HNS_PORT_LDCP_CC_ATTR_RW(beta, BETA); +HNS_PORT_LDCP_CC_ATTR_RW(eta, ETA); +HNS_PORT_LDCP_CC_ATTR_RW(lifespan, LIFESPAN); + +static struct attribute *ldcp_param_attrs[] = { + &hns_roce_port_attr_ldcp_cwd0.port_attr.attr, + &hns_roce_port_attr_ldcp_alpha.port_attr.attr, + &hns_roce_port_attr_ldcp_gamma.port_attr.attr, + &hns_roce_port_attr_ldcp_beta.port_attr.attr, + &hns_roce_port_attr_ldcp_eta.port_attr.attr, + &hns_roce_port_attr_ldcp_lifespan.port_attr.attr, + NULL, +}; + +static const struct attribute_group ldcp_cc_param_group = { + .name = "ldcp_cc_param", + .attrs = ldcp_param_attrs, + .is_visible = scc_attr_is_visible, +}; + +#define HNS_PORT_HC3_CC_ATTR_RW(_name, NAME) \ + struct hns_port_cc_attr hns_roce_port_attr_hc3_##_name = \ + __HNS_SCC_ATTR(_name, HNS_ROCE_SCC_ALGO_HC3, \ + HNS_ROCE_HC3_##NAME##_OFS, \ + HNS_ROCE_HC3_##NAME##_SZ, \ + 0, HNS_ROCE_HC3_##NAME##_MAX) + +HNS_PORT_HC3_CC_ATTR_RW(initial_window, INITIAL_WINDOW); +HNS_PORT_HC3_CC_ATTR_RW(bandwidth, BANDWIDTH); +HNS_PORT_HC3_CC_ATTR_RW(qlen_shift, QLEN_SHIFT); +HNS_PORT_HC3_CC_ATTR_RW(port_usage_shift, PORT_USAGE_SHIFT); +HNS_PORT_HC3_CC_ATTR_RW(over_period, OVER_PERIOD); +HNS_PORT_HC3_CC_ATTR_RW(max_stage, MAX_STAGE); +HNS_PORT_HC3_CC_ATTR_RW(gamma_shift, GAMMA_SHIFT); +HNS_PORT_HC3_CC_ATTR_RW(lifespan, LIFESPAN); + +static struct attribute *hc3_param_attrs[] = { + &hns_roce_port_attr_hc3_initial_window.port_attr.attr, + &hns_roce_port_attr_hc3_bandwidth.port_attr.attr, + &hns_roce_port_attr_hc3_qlen_shift.port_attr.attr, + &hns_roce_port_attr_hc3_port_usage_shift.port_attr.attr, + &hns_roce_port_attr_hc3_over_period.port_attr.attr, + &hns_roce_port_attr_hc3_max_stage.port_attr.attr, + &hns_roce_port_attr_hc3_gamma_shift.port_attr.attr, + &hns_roce_port_attr_hc3_lifespan.port_attr.attr, + NULL, +}; + +static const struct attribute_group hc3_cc_param_group = { + .name = "hc3_cc_param", + .attrs = hc3_param_attrs, + .is_visible = scc_attr_is_visible, +}; + +#define HNS_PORT_DIP_CC_ATTR_RW(_name, NAME) \ + struct hns_port_cc_attr hns_roce_port_attr_dip_##_name = \ + __HNS_SCC_ATTR(_name, HNS_ROCE_SCC_ALGO_DIP, \ + HNS_ROCE_DIP_##NAME##_OFS, \ + HNS_ROCE_DIP_##NAME##_SZ, \ + 0, HNS_ROCE_DIP_##NAME##_MAX) + +HNS_PORT_DIP_CC_ATTR_RW(ai, AI); +HNS_PORT_DIP_CC_ATTR_RW(f, F); +HNS_PORT_DIP_CC_ATTR_RW(tkp, TKP); +HNS_PORT_DIP_CC_ATTR_RW(tmp, TMP); +HNS_PORT_DIP_CC_ATTR_RW(alp, ALP); +HNS_PORT_DIP_CC_ATTR_RW(max_speed, MAX_SPEED); +HNS_PORT_DIP_CC_ATTR_RW(g, G); +HNS_PORT_DIP_CC_ATTR_RW(al, AL); +HNS_PORT_DIP_CC_ATTR_RW(cnp_time, CNP_TIME); +HNS_PORT_DIP_CC_ATTR_RW(ashift, ASHIFT); +HNS_PORT_DIP_CC_ATTR_RW(lifespan, LIFESPAN); + +static struct attribute *dip_param_attrs[] = { + &hns_roce_port_attr_dip_ai.port_attr.attr, + &hns_roce_port_attr_dip_f.port_attr.attr, + &hns_roce_port_attr_dip_tkp.port_attr.attr, + &hns_roce_port_attr_dip_tmp.port_attr.attr, + &hns_roce_port_attr_dip_alp.port_attr.attr, + &hns_roce_port_attr_dip_max_speed.port_attr.attr, + &hns_roce_port_attr_dip_g.port_attr.attr, + &hns_roce_port_attr_dip_al.port_attr.attr, + &hns_roce_port_attr_dip_cnp_time.port_attr.attr, + &hns_roce_port_attr_dip_ashift.port_attr.attr, + &hns_roce_port_attr_dip_lifespan.port_attr.attr, + NULL, +}; + +static const struct attribute_group dip_cc_param_group = { + .name = "dip_cc_param", + .attrs = dip_param_attrs, + .is_visible = scc_attr_is_visible, +}; + +const struct attribute_group *hns_attr_port_groups[] = { + &dcqcn_cc_param_group, + &ldcp_cc_param_group, + &hc3_cc_param_group, + &dip_cc_param_group, + NULL, +}; + +static ssize_t hns_roce_port_attr_show(struct kobject *kobj, + struct attribute *attr, char *buf) +{ + struct hns_port_attribute *port_attr = + container_of(attr, struct hns_port_attribute, attr); + struct hns_roce_port *p = + container_of(kobj, struct hns_roce_port, kobj); + + if (!port_attr->show) + return -EIO; + + return port_attr->show(p, port_attr, buf); +} + +static ssize_t hns_roce_port_attr_store(struct kobject *kobj, + struct attribute *attr, + const char *buf, size_t count) +{ + struct hns_port_attribute *port_attr = + container_of(attr, struct hns_port_attribute, attr); + struct hns_roce_port *p = + container_of(kobj, struct hns_roce_port, kobj); + + if (!port_attr->store) + return -EIO; + + return port_attr->store(p, port_attr, buf, count); +} + +static void hns_roce_port_release(struct kobject *kobj) +{ + struct hns_roce_port *pdata = + container_of(kobj, struct hns_roce_port, kobj); + + kfree(pdata->scc_param); +} + +static const struct sysfs_ops hns_roce_port_ops = { + .show = hns_roce_port_attr_show, + .store = hns_roce_port_attr_store, +}; + +static struct kobj_type hns_roce_port_ktype = { + .release = hns_roce_port_release, + .sysfs_ops = &hns_roce_port_ops, +}; + +int hns_roce_create_port_files(struct ib_device *ibdev, u8 port_num, + struct kobject *kobj) +{ + struct hns_roce_dev *hr_dev = to_hr_dev(ibdev); + struct hns_roce_port *pdata; + int ret; + + if (!port_num || port_num > hr_dev->caps.num_ports) { + ibdev_err(ibdev, "fail to create port sysfs for invalid port %u.\n", + port_num); + return -ENODEV; + } + + pdata = &hr_dev->port_data[port_num - 1]; + pdata->hr_dev = hr_dev; + pdata->port_num = port_num; + ret = kobject_init_and_add(&pdata->kobj, &hns_roce_port_ktype, + kobj, "cc_param"); + if (ret) { + ibdev_err(ibdev, "fail to create port(%u) sysfs, ret = %d.\n", + port_num, ret); + goto fail_kobj; + } + kobject_uevent(&pdata->kobj, KOBJ_ADD); + + ret = sysfs_create_groups(&pdata->kobj, hns_attr_port_groups); + if (ret) { + ibdev_err(ibdev, + "fail to create port(%u) cc param sysfs, ret = %d.\n", + port_num, ret); + goto fail_kobj; + } + + ret = alloc_scc_param(hr_dev, pdata); + if (ret) { + dev_err(hr_dev->dev, "alloc scc param failed, ret = %d!\n", + ret); + goto fail_group; + } + + return ret; + +fail_group: + sysfs_remove_groups(&pdata->kobj, hns_attr_port_groups); + +fail_kobj: + kobject_put(&pdata->kobj); + + return ret; +} + +static void hns_roce_unregister_port_sysfs(struct hns_roce_dev *hr_dev, + u8 port_num) +{ + struct hns_roce_port *pdata; + + pdata = &hr_dev->port_data[port_num]; + sysfs_remove_groups(&pdata->kobj, hns_attr_port_groups); + kobject_put(&pdata->kobj); +} + +void hns_roce_unregister_sysfs(struct hns_roce_dev *hr_dev) +{ + int i; + + for (i = 0; i < hr_dev->caps.num_ports; i++) + hns_roce_unregister_port_sysfs(hr_dev, i); +} -- 2.30.0

1 0

Kernel sig 3.10 14:00-15:30 例会议题情况//答复: openEuler Kernel SIG双周例会
by liaotao (C) 10 Mar '23

10 Mar '23

当前例会议题：议题一：进展update（10min） --- 张伽琳 & 郑增凯议题二：内核热升级使用及技术探讨和规划 --- 桑琰欢迎大家继续申报~ 上期遗留问题： 1、openEuler缺陷issue处理流程介绍 2、内核热升级下一步规划，需求讨论 -----原始约会----- 发件人: openEuler conference <public(a)openeuler.org> 发送时间: 2023年3月7日 15:49 收件人: dev@openeuler.org,kernel-discuss@openeuler.org,kernel@openeuler.org 主题: openEuler Kernel SIG双周例会时间: 2023年3月10日星期五 14:00-15:30(UTC+08:00) 北京，重庆，香港特别行政区，乌鲁木齐。地点: 您好！ Kernel SIG 邀请您参加 2023-03-10 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容：欢迎您参加 Kernel SIG 双周例会，当前议题： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/87191608489?pwd=eG96T0p2Y0NDRUdHOW9SYys5SElTQT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-03-10 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 欢迎您参加 Kernel SIG 双周例会，当前议题： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/87191608489?pwd=eG96T0p2Y0NDRUdHOW9SYys5SElTQT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-5.10-LTS-SP1] Revert "scsi: fix iscsi rescan fails to create block"
by Jialin Zhang 09 Mar '23

09 Mar '23

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188150, https://gitee.com/openeuler/kernel/issues/I643OL ---------------------------------------- This reverts commit 7f10ea522db56188ae46c5bbee7052a2b2797515. This commit has a soft lock problem: watchdog: BUG: soft lockup - CPU#22 stuck for 67s! [iscsid:16369] Call Trace: scsi_remove_target+0x548/0x7b0 ? sdev_store_delete+0x90/0x90 ? __mutex_lock_slowpath+0x10/0x10 ? device_remove_class_symlinks+0x1b0/0x1b0 __iscsi_unbind_session+0x16b/0x250 [scsi_transport_iscsi] iscsi_remove_session+0x1d3/0x2f0 [scsi_transport_iscsi] iscsi_session_remove+0x5c/0x80 [libiscsi] iscsi_sw_tcp_session_destroy+0xd3/0x160 [iscsi_tcp] iscsi_if_rx+0x2369/0x5060 [scsi_transport_iscsi] The reason is that if other threads hold the reference count of the kobject while waiting for the device to be released, it will keep waiting in a loop. Fixes: 7f10ea522db5 ("scsi: fix iscsi rescan fails to create block") Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/scsi/scsi_sysfs.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c index e7893835b99a..42db9c52208e 100644 --- a/drivers/scsi/scsi_sysfs.c +++ b/drivers/scsi/scsi_sysfs.c @@ -1503,13 +1503,6 @@ void scsi_remove_device(struct scsi_device *sdev) } EXPORT_SYMBOL(scsi_remove_device); -static int scsi_device_try_get(struct scsi_device *sdev) -{ - if (!kobject_get_unless_zero(&sdev->sdev_gendev.kobj)) - return -ENXIO; - return 0; -} - static void __scsi_remove_target(struct scsi_target *starget) { struct Scsi_Host *shost = dev_to_shost(starget->dev.parent); @@ -1528,7 +1521,9 @@ static void __scsi_remove_target(struct scsi_target *starget) if (sdev->channel != starget->channel || sdev->id != starget->id) continue; - if (scsi_device_try_get(sdev)) + if (sdev->sdev_state == SDEV_DEL || + sdev->sdev_state == SDEV_CANCEL || + !get_device(&sdev->sdev_gendev)) continue; spin_unlock_irqrestore(shost->host_lock, flags); scsi_remove_device(sdev); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/3] HID: asus: Remove check for same LED brightness on set
by Yongqiang Liu 09 Mar '23

09 Mar '23

From: "Luke D. Jones" <luke(a)ljones.dev> mainline inclusion from mainline-v5.14-rc4 commit 3fdcf7cdfc229346d028242e73562704ad644dd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6I7U9 CVE: CVE-2023-1079 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Remove the early return on LED brightness set so that any controller application, daemon, or desktop may set the same brightness at any stage. This is required because many ASUS ROG keyboards will default to max brightness on laptop resume if the LEDs were set to off before sleep. Signed-off-by: Luke D Jones <luke(a)ljones.dev> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Yuyao Lin <linyuyao1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/hid/hid-asus.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 800b2364e29e..9ae8e3d5edf1 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -318,9 +318,6 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev, { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); - if (led->brightness == brightness) - return; - led->brightness = brightness; schedule_work(&led->work); } -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS 01/16] netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state
by Yongqiang Liu 08 Mar '23

08 Mar '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v4.19.272 commit 01687e35df44dd09cc6943306db35d9efc507907 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6KOHU CVE: NA -------------------------------- [ Upstream commit e15d4cdf27cb0c1e977270270b2cea12e0955edd ] Consider: client -----> conntrack ---> Host client sends a SYN, but $Host is unreachable/silent. Client eventually gives up and the conntrack entry will time out. However, if the client is restarted with same addr/port pair, it may prevent the conntrack entry from timing out. This is noticeable when the existing conntrack entry has no NAT transformation or an outdated one and port reuse happens either on client or due to a NAT middlebox. This change prevents refresh of the timeout for SYN retransmits, so entry is going away after nf_conntrack_tcp_timeout_syn_sent seconds (default: 60). Entry will be re-created on next connection attempt, but then nat rules will be evaluated again. Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/netfilter/nf_conntrack_proto_tcp.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c index aab532b8c8c6..1600f35bfd49 100644 --- a/net/netfilter/nf_conntrack_proto_tcp.c +++ b/net/netfilter/nf_conntrack_proto_tcp.c @@ -1089,6 +1089,16 @@ static int tcp_packet(struct nf_conn *ct, nf_ct_kill_acct(ct, ctinfo, skb); return NF_ACCEPT; } + + if (index == TCP_SYN_SET && old_state == TCP_CONNTRACK_SYN_SENT) { + /* do not renew timeout on SYN retransmit. + * + * Else port reuse by client or NAT middlebox can keep + * entry alive indefinitely (including nat info). + */ + return NF_ACCEPT; + } + /* ESTABLISHED without SEEN_REPLY, i.e. mid-connection * pickup with loose=1. Avoid large ESTABLISHED timeout. */ -- 2.25.1

1 15

[PATCH openEuler-1.0-LTS 01/31] binder: use standard functions to allocate fds
by Yongqiang Liu 08 Mar '23

08 Mar '23

From: Todd Kjos <tkjos(a)android.com> mainline inclusion from mainline-v4.20-rc1 commit 44d8047f1d87adc2fd7eccc88533794f6d88c15e category: bugfix bugzilla: 188431, https://gitee.com/src-openeuler/kernel/issues/I6DKVG CVE: CVE-2023-20938 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Binder uses internal fs interfaces to allocate and install fds: __alloc_fd __fd_install __close_fd get_files_struct put_files_struct These were used to support the passing of fds between processes as part of a transaction. The actual allocation and installation of the fds in the target process was handled by the sending process so the standard functions, alloc_fd() and fd_install() which assume task==current couldn't be used. This patch refactors this mechanism so that the fds are allocated and installed by the target process allowing the standard functions to be used. The sender now creates a list of fd fixups that contains the struct *file and the address to fixup with the new fd once it is allocated. This list is processed by the target process when the transaction is dequeued. A new error case is introduced by this change. If an async transaction with file descriptors cannot allocate new fds in the target (probably due to out of file descriptors), the transaction is discarded with a log message. In the old implementation this would have been detected in the sender context and failed prior to sending. Signed-off-by: Todd Kjos <tkjos(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/android/binder.c Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/android/Kconfig | 2 +- drivers/android/binder.c | 391 ++++++++++++++++++++------------- drivers/android/binder_trace.h | 36 ++- 3 files changed, 262 insertions(+), 167 deletions(-) diff --git a/drivers/android/Kconfig b/drivers/android/Kconfig index 432e9ad77070..51e8250d113f 100644 --- a/drivers/android/Kconfig +++ b/drivers/android/Kconfig @@ -10,7 +10,7 @@ if ANDROID config ANDROID_BINDER_IPC bool "Android Binder IPC Driver" - depends on MMU + depends on MMU && !CPU_CACHE_VIVT default n ---help--- Binder is used in Android for both communication between processes, diff --git a/drivers/android/binder.c b/drivers/android/binder.c index c5a39b8ae886..8a72aacd7a39 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -71,6 +71,7 @@ #include <linux/security.h> #include <linux/spinlock.h> #include <linux/ratelimit.h> +#include <linux/syscalls.h> #include <uapi/linux/android/binder.h> @@ -457,9 +458,8 @@ struct binder_ref { }; enum binder_deferred_state { - BINDER_DEFERRED_PUT_FILES = 0x01, - BINDER_DEFERRED_FLUSH = 0x02, - BINDER_DEFERRED_RELEASE = 0x04, + BINDER_DEFERRED_FLUSH = 0x01, + BINDER_DEFERRED_RELEASE = 0x02, }; /** @@ -480,9 +480,6 @@ enum binder_deferred_state { * (invariant after initialized) * @tsk task_struct for group_leader of process * (invariant after initialized) - * @files files_struct for process - * (protected by @files_lock) - * @files_lock mutex to protect @files * @cred struct cred associated with the `struct file` * in binder_open() * (invariant after initialized) @@ -530,8 +527,6 @@ struct binder_proc { struct list_head waiting_threads; int pid; struct task_struct *tsk; - struct files_struct *files; - struct mutex files_lock; const struct cred *cred; struct hlist_node deferred_work_node; int deferred_work; @@ -615,6 +610,23 @@ struct binder_thread { bool is_dead; }; +/** + * struct binder_txn_fd_fixup - transaction fd fixup list element + * @fixup_entry: list entry + * @file: struct file to be associated with new fd + * @offset: offset in buffer data to this fixup + * + * List element for fd fixups in a transaction. Since file + * descriptors need to be allocated in the context of the + * target process, we pass each fd to be processed in this + * struct. + */ +struct binder_txn_fd_fixup { + struct list_head fixup_entry; + struct file *file; + size_t offset; +}; + struct binder_transaction { int debug_id; struct binder_work work; @@ -632,6 +644,7 @@ struct binder_transaction { long priority; long saved_priority; kuid_t sender_euid; + struct list_head fd_fixups; /** * @lock: protects @from, @to_proc, and @to_thread * @@ -905,66 +918,6 @@ static void binder_free_thread(struct binder_thread *thread); static void binder_free_proc(struct binder_proc *proc); static void binder_inc_node_tmpref_ilocked(struct binder_node *node); -static int task_get_unused_fd_flags(struct binder_proc *proc, int flags) -{ - unsigned long rlim_cur; - unsigned long irqs; - int ret; - - mutex_lock(&proc->files_lock); - if (proc->files == NULL) { - ret = -ESRCH; - goto err; - } - if (!lock_task_sighand(proc->tsk, &irqs)) { - ret = -EMFILE; - goto err; - } - rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE); - unlock_task_sighand(proc->tsk, &irqs); - - ret = __alloc_fd(proc->files, 0, rlim_cur, flags); -err: - mutex_unlock(&proc->files_lock); - return ret; -} - -/* - * copied from fd_install - */ -static void task_fd_install( - struct binder_proc *proc, unsigned int fd, struct file *file) -{ - mutex_lock(&proc->files_lock); - if (proc->files) - __fd_install(proc->files, fd, file); - mutex_unlock(&proc->files_lock); -} - -/* - * copied from sys_close - */ -static long task_close_fd(struct binder_proc *proc, unsigned int fd) -{ - int retval; - - mutex_lock(&proc->files_lock); - if (proc->files == NULL) { - retval = -ESRCH; - goto err; - } - retval = __close_fd(proc->files, fd); - /* can't restart close syscall because file table entry was cleared */ - if (unlikely(retval == -ERESTARTSYS || - retval == -ERESTARTNOINTR || - retval == -ERESTARTNOHAND || - retval == -ERESTART_RESTARTBLOCK)) - retval = -EINTR; -err: - mutex_unlock(&proc->files_lock); - return retval; -} - static bool binder_has_work_ilocked(struct binder_thread *thread, bool do_proc_work) { @@ -1948,6 +1901,27 @@ static struct binder_thread *binder_get_txn_from_and_acq_inner( return NULL; } +/** + * binder_free_txn_fixups() - free unprocessed fd fixups + * @t: binder transaction for t->from + * + * If the transaction is being torn down prior to being + * processed by the target process, free all of the + * fd fixups and fput the file structs. It is safe to + * call this function after the fixups have been + * processed -- in that case, the list will be empty. + */ +static void binder_free_txn_fixups(struct binder_transaction *t) +{ + struct binder_txn_fd_fixup *fixup, *tmp; + + list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) { + fput(fixup->file); + list_del(&fixup->fixup_entry); + kfree(fixup); + } +} + static void binder_free_transaction(struct binder_transaction *t) { struct binder_proc *target_proc = t->to_proc; @@ -1962,6 +1936,7 @@ static void binder_free_transaction(struct binder_transaction *t) * If the transaction has no target_proc, then * t->buffer->transaction has already been cleared. */ + binder_free_txn_fixups(t); kfree(t); binder_stats_deleted(BINDER_STAT_TRANSACTION); } @@ -2262,12 +2237,17 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, } break; case BINDER_TYPE_FD: { - struct binder_fd_object *fp = to_binder_fd_object(hdr); - - binder_debug(BINDER_DEBUG_TRANSACTION, - " fd %d\n", fp->fd); - if (failed_at) - task_close_fd(proc, fp->fd); + /* + * No need to close the file here since user-space + * closes it for for successfully delivered + * transactions. For transactions that weren't + * delivered, the new fd was never allocated so + * there is no need to close and the fput on the + * file is done when the transaction is torn + * down. + */ + WARN_ON(failed_at && + proc->tsk == current->group_leader); } break; case BINDER_TYPE_PTR: /* @@ -2283,6 +2263,15 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, size_t fd_index; binder_size_t fd_buf_size; + if (proc->tsk != current->group_leader) { + /* + * Nothing to do if running in sender context + * The fd fixups have not been applied so no + * fds need to be closed. + */ + continue; + } + fda = to_binder_fd_array_object(hdr); parent = binder_validate_ptr(buffer, fda->parent, off_start, @@ -2315,7 +2304,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, } fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset); for (fd_index = 0; fd_index < fda->num_fds; fd_index++) - task_close_fd(proc, fd_array[fd_index]); + ksys_close(fd_array[fd_index]); } break; default: pr_err("transaction release %d bad object type %x\n", @@ -2447,17 +2436,18 @@ static int binder_translate_handle(struct flat_binder_object *fp, return ret; } -static int binder_translate_fd(int fd, +static int binder_translate_fd(u32 *fdp, struct binder_transaction *t, struct binder_thread *thread, struct binder_transaction *in_reply_to) { struct binder_proc *proc = thread->proc; struct binder_proc *target_proc = t->to_proc; - int target_fd; + struct binder_txn_fd_fixup *fixup; struct file *file; - int ret; + int ret = 0; bool target_allows_fd; + int fd = *fdp; if (in_reply_to) target_allows_fd = !!(in_reply_to->flags & TF_ACCEPT_FDS); @@ -2485,19 +2475,24 @@ static int binder_translate_fd(int fd, goto err_security; } - target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC); - if (target_fd < 0) { + /* + * Add fixup record for this transaction. The allocation + * of the fd in the target needs to be done from a + * target thread. + */ + fixup = kzalloc(sizeof(*fixup), GFP_KERNEL); + if (!fixup) { ret = -ENOMEM; - goto err_get_unused_fd; + goto err_alloc; } - task_fd_install(target_proc, target_fd, file); - trace_binder_transaction_fd(t, fd, target_fd); - binder_debug(BINDER_DEBUG_TRANSACTION, " fd %d -> %d\n", - fd, target_fd); + fixup->file = file; + fixup->offset = (uintptr_t)fdp - (uintptr_t)t->buffer->data; + trace_binder_transaction_fd_send(t, fd, fixup->offset); + list_add_tail(&fixup->fixup_entry, &t->fd_fixups); - return target_fd; + return ret; -err_get_unused_fd: +err_alloc: err_security: fput(file); err_fget: @@ -2511,8 +2506,7 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda, struct binder_thread *thread, struct binder_transaction *in_reply_to) { - binder_size_t fdi, fd_buf_size, num_installed_fds; - int target_fd; + binder_size_t fdi, fd_buf_size; uintptr_t parent_buffer; u32 *fd_array; struct binder_proc *proc = thread->proc; @@ -2544,23 +2538,12 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda, return -EINVAL; } for (fdi = 0; fdi < fda->num_fds; fdi++) { - target_fd = binder_translate_fd(fd_array[fdi], t, thread, + int ret = binder_translate_fd(&fd_array[fdi], t, thread, in_reply_to); - if (target_fd < 0) - goto err_translate_fd_failed; - fd_array[fdi] = target_fd; + if (ret < 0) + return ret; } return 0; - -err_translate_fd_failed: - /* - * Failed to allocate fd or security error, free fds - * installed so far. - */ - num_installed_fds = fdi; - for (fdi = 0; fdi < num_installed_fds; fdi++) - task_close_fd(target_proc, fd_array[fdi]); - return target_fd; } static int binder_fixup_parent(struct binder_transaction *t, @@ -2935,6 +2918,7 @@ static void binder_transaction(struct binder_proc *proc, return_error_line = __LINE__; goto err_alloc_t_failed; } + INIT_LIST_HEAD(&t->fd_fixups); binder_stats_created(BINDER_STAT_TRANSACTION); spin_lock_init(&t->lock); @@ -3089,17 +3073,16 @@ static void binder_transaction(struct binder_proc *proc, case BINDER_TYPE_FD: { struct binder_fd_object *fp = to_binder_fd_object(hdr); - int target_fd = binder_translate_fd(fp->fd, t, thread, - in_reply_to); + int ret = binder_translate_fd(&fp->fd, t, thread, + in_reply_to); - if (target_fd < 0) { + if (ret < 0) { return_error = BR_FAILED_REPLY; - return_error_param = target_fd; + return_error_param = ret; return_error_line = __LINE__; goto err_translate_failed; } fp->pad_binder = 0; - fp->fd = target_fd; } break; case BINDER_TYPE_FDA: { struct binder_fd_array_object *fda = @@ -3256,6 +3239,7 @@ static void binder_transaction(struct binder_proc *proc, err_bad_offset: err_bad_parent: err_copy_data_failed: + binder_free_txn_fixups(t); trace_binder_transaction_failed_buffer_release(t->buffer); binder_transaction_buffer_release(target_proc, t->buffer, offp); if (target_node) @@ -3318,6 +3302,49 @@ static void binder_transaction(struct binder_proc *proc, } } +/** + * binder_free_buf() - free the specified buffer + * @proc: binder proc that owns buffer + * @buffer: buffer to be freed + * + * If buffer for an async transaction, enqueue the next async + * transaction from the node. + * + * Cleanup buffer and free it. + */ +void +binder_free_buf(struct binder_proc *proc, struct binder_buffer *buffer) +{ + binder_inner_proc_lock(proc); + if (buffer->transaction) { + buffer->transaction->buffer = NULL; + buffer->transaction = NULL; + } + binder_inner_proc_unlock(proc); + if (buffer->async_transaction && buffer->target_node) { + struct binder_node *buf_node; + struct binder_work *w; + + buf_node = buffer->target_node; + binder_node_inner_lock(buf_node); + BUG_ON(!buf_node->has_async_transaction); + BUG_ON(buf_node->proc != proc); + w = binder_dequeue_work_head_ilocked( + &buf_node->async_todo); + if (!w) { + buf_node->has_async_transaction = false; + } else { + binder_enqueue_work_ilocked( + w, &proc->todo); + binder_wakeup_proc_ilocked(proc); + } + binder_node_inner_unlock(buf_node); + } + trace_binder_transaction_buffer_release(buffer); + binder_transaction_buffer_release(proc, buffer, NULL); + binder_alloc_free_buf(&proc->alloc, buffer); +} + static int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread, binder_uintptr_t binder_buffer, size_t size, @@ -3508,35 +3535,7 @@ static int binder_thread_write(struct binder_proc *proc, proc->pid, thread->pid, (u64)data_ptr, buffer->debug_id, buffer->transaction ? "active" : "finished"); - - binder_inner_proc_lock(proc); - if (buffer->transaction) { - buffer->transaction->buffer = NULL; - buffer->transaction = NULL; - } - binder_inner_proc_unlock(proc); - if (buffer->async_transaction && buffer->target_node) { - struct binder_node *buf_node; - struct binder_work *w; - - buf_node = buffer->target_node; - binder_node_inner_lock(buf_node); - BUG_ON(!buf_node->has_async_transaction); - BUG_ON(buf_node->proc != proc); - w = binder_dequeue_work_head_ilocked( - &buf_node->async_todo); - if (!w) { - buf_node->has_async_transaction = false; - } else { - binder_enqueue_work_ilocked( - w, &proc->todo); - binder_wakeup_proc_ilocked(proc); - } - binder_node_inner_unlock(buf_node); - } - trace_binder_transaction_buffer_release(buffer); - binder_transaction_buffer_release(proc, buffer, NULL); - binder_alloc_free_buf(&proc->alloc, buffer); + binder_free_buf(proc, buffer); break; } @@ -3859,6 +3858,76 @@ static int binder_wait_for_work(struct binder_thread *thread, return ret; } +/** + * binder_apply_fd_fixups() - finish fd translation + * @t: binder transaction with list of fd fixups + * + * Now that we are in the context of the transaction target + * process, we can allocate and install fds. Process the + * list of fds to translate and fixup the buffer with the + * new fds. + * + * If we fail to allocate an fd, then free the resources by + * fput'ing files that have not been processed and ksys_close'ing + * any fds that have already been allocated. + */ +static int binder_apply_fd_fixups(struct binder_transaction *t) +{ + struct binder_txn_fd_fixup *fixup, *tmp; + int ret = 0; + + list_for_each_entry(fixup, &t->fd_fixups, fixup_entry) { + int fd = get_unused_fd_flags(O_CLOEXEC); + u32 *fdp; + + if (fd < 0) { + binder_debug(BINDER_DEBUG_TRANSACTION, + "failed fd fixup txn %d fd %d\n", + t->debug_id, fd); + ret = -ENOMEM; + break; + } + binder_debug(BINDER_DEBUG_TRANSACTION, + "fd fixup txn %d fd %d\n", + t->debug_id, fd); + trace_binder_transaction_fd_recv(t, fd, fixup->offset); + fd_install(fd, fixup->file); + fixup->file = NULL; + fdp = (u32 *)(t->buffer->data + fixup->offset); + /* + * This store can cause problems for CPUs with a + * VIVT cache (eg ARMv5) since the cache cannot + * detect virtual aliases to the same physical cacheline. + * To support VIVT, this address and the user-space VA + * would both need to be flushed. Since this kernel + * VA is not constructed via page_to_virt(), we can't + * use flush_dcache_page() on it, so we'd have to use + * an internal function. If devices with VIVT ever + * need to run Android, we'll either need to go back + * to patching the translated fd from the sender side + * (using the non-standard kernel functions), or rework + * how the kernel uses the buffer to use page_to_virt() + * addresses instead of allocating in our own vm area. + * + * For now, we disable compilation if CONFIG_CPU_CACHE_VIVT. + */ + *fdp = fd; + } + list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) { + if (fixup->file) { + fput(fixup->file); + } else if (ret) { + u32 *fdp = (u32 *)(t->buffer->data + fixup->offset); + + ksys_close(*fdp); + } + list_del(&fixup->fixup_entry); + kfree(fixup); + } + + return ret; +} + static int binder_thread_read(struct binder_proc *proc, struct binder_thread *thread, binder_uintptr_t binder_buffer, size_t size, @@ -4140,6 +4209,34 @@ static int binder_thread_read(struct binder_proc *proc, tr.sender_pid = 0; } + ret = binder_apply_fd_fixups(t); + if (ret) { + struct binder_buffer *buffer = t->buffer; + bool oneway = !!(t->flags & TF_ONE_WAY); + int tid = t->debug_id; + + if (t_from) + binder_thread_dec_tmpref(t_from); + buffer->transaction = NULL; + binder_cleanup_transaction(t, "fd fixups failed", + BR_FAILED_REPLY); + binder_free_buf(proc, buffer); + binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, + "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n", + proc->pid, thread->pid, + oneway ? "async " : + (cmd == BR_REPLY ? "reply " : ""), + tid, BR_FAILED_REPLY, ret, __LINE__); + if (cmd == BR_REPLY) { + cmd = BR_FAILED_REPLY; + if (put_user(cmd, (uint32_t __user *)ptr)) + return -EFAULT; + ptr += sizeof(uint32_t); + binder_stat_br(proc, thread, cmd); + break; + } + continue; + } tr.data_size = t->buffer->data_size; tr.offsets_size = t->buffer->offsets_size; tr.data.ptr.buffer = (binder_uintptr_t) @@ -4730,7 +4827,6 @@ static void binder_vma_close(struct vm_area_struct *vma) (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, (unsigned long)pgprot_val(vma->vm_page_prot)); binder_alloc_vma_close(&proc->alloc); - binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES); } static vm_fault_t binder_vm_fault(struct vm_fault *vmf) @@ -4776,9 +4872,6 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) ret = binder_alloc_mmap_handler(&proc->alloc, vma); if (ret) return ret; - mutex_lock(&proc->files_lock); - proc->files = get_files_struct(current); - mutex_unlock(&proc->files_lock); return 0; err_bad_arg: @@ -4802,7 +4895,6 @@ static int binder_open(struct inode *nodp, struct file *filp) spin_lock_init(&proc->outer_lock); get_task_struct(current->group_leader); proc->tsk = current->group_leader; - mutex_init(&proc->files_lock); proc->cred = get_cred(filp->f_cred); INIT_LIST_HEAD(&proc->todo); proc->default_priority = task_nice(current); @@ -4953,8 +5045,6 @@ static void binder_deferred_release(struct binder_proc *proc) struct rb_node *n; int threads, nodes, incoming_refs, outgoing_refs, active_transactions; - BUG_ON(proc->files); - mutex_lock(&binder_procs_lock); hlist_del(&proc->proc_node); mutex_unlock(&binder_procs_lock); @@ -5036,7 +5126,6 @@ static void binder_deferred_release(struct binder_proc *proc) static void binder_deferred_func(struct work_struct *work) { struct binder_proc *proc; - struct files_struct *files; int defer; @@ -5054,23 +5143,11 @@ static void binder_deferred_func(struct work_struct *work) } mutex_unlock(&binder_deferred_lock); - files = NULL; - if (defer & BINDER_DEFERRED_PUT_FILES) { - mutex_lock(&proc->files_lock); - files = proc->files; - if (files) - proc->files = NULL; - mutex_unlock(&proc->files_lock); - } - if (defer & BINDER_DEFERRED_FLUSH) binder_deferred_flush(proc); if (defer & BINDER_DEFERRED_RELEASE) binder_deferred_release(proc); /* frees proc */ - - if (files) - put_files_struct(files); } while (proc); } static DECLARE_WORK(binder_deferred_work, binder_deferred_func); diff --git a/drivers/android/binder_trace.h b/drivers/android/binder_trace.h index 588eb3ec3507..14de7ac57a34 100644 --- a/drivers/android/binder_trace.h +++ b/drivers/android/binder_trace.h @@ -223,22 +223,40 @@ TRACE_EVENT(binder_transaction_ref_to_ref, __entry->dest_ref_debug_id, __entry->dest_ref_desc) ); -TRACE_EVENT(binder_transaction_fd, - TP_PROTO(struct binder_transaction *t, int src_fd, int dest_fd), - TP_ARGS(t, src_fd, dest_fd), +TRACE_EVENT(binder_transaction_fd_send, + TP_PROTO(struct binder_transaction *t, int fd, size_t offset), + TP_ARGS(t, fd, offset), TP_STRUCT__entry( __field(int, debug_id) - __field(int, src_fd) - __field(int, dest_fd) + __field(int, fd) + __field(size_t, offset) + ), + TP_fast_assign( + __entry->debug_id = t->debug_id; + __entry->fd = fd; + __entry->offset = offset; + ), + TP_printk("transaction=%d src_fd=%d offset=%zu", + __entry->debug_id, __entry->fd, __entry->offset) +); + +TRACE_EVENT(binder_transaction_fd_recv, + TP_PROTO(struct binder_transaction *t, int fd, size_t offset), + TP_ARGS(t, fd, offset), + + TP_STRUCT__entry( + __field(int, debug_id) + __field(int, fd) + __field(size_t, offset) ), TP_fast_assign( __entry->debug_id = t->debug_id; - __entry->src_fd = src_fd; - __entry->dest_fd = dest_fd; + __entry->fd = fd; + __entry->offset = offset; ), - TP_printk("transaction=%d src_fd=%d ==> dest_fd=%d", - __entry->debug_id, __entry->src_fd, __entry->dest_fd) + TP_printk("transaction=%d dest_fd=%d offset=%zu", + __entry->debug_id, __entry->fd, __entry->offset) ); DECLARE_EVENT_CLASS(binder_buffer_class, -- 2.25.1

1 30

[PATCH openEuler-1.0-LTS 1/7] sctp: fail if no bound addresses can be used for a given scope
by Yongqiang Liu 08 Mar '23

08 Mar '23

From: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> stable inclusion from stable-v4.19.271 commit 26436553aabfd9b40e1daa537a099bf5bb13fb55 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6I7U3 CVE: CVE-2023-1074 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 458e279f861d3f61796894cd158b780765a1569f ] Currently, if you bind the socket to something like: servaddr.sin6_family = AF_INET6; servaddr.sin6_port = htons(0); servaddr.sin6_scope_id = 0; inet_pton(AF_INET6, "::1", &servaddr.sin6_addr); And then request a connect to: connaddr.sin6_family = AF_INET6; connaddr.sin6_port = htons(20000); connaddr.sin6_scope_id = if_nametoindex("lo"); inet_pton(AF_INET6, "fe88::1", &connaddr.sin6_addr); What the stack does is: - bind the socket - create a new asoc - to handle the connect - copy the addresses that can be used for the given scope - try to connect But the copy returns 0 addresses, and the effect is that it ends up trying to connect as if the socket wasn't bound, which is not the desired behavior. This unexpected behavior also allows KASLR leaks through SCTP diag interface. The fix here then is, if when trying to copy the addresses that can be used for the scope used in connect() it returns 0 addresses, bail out. This is what TCP does with a similar reproducer. Reported-by: Pietro Borrello <borrello(a)diag.uniroma1.it> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Reviewed-by: Xin Long <lucien.xin(a)gmail.com> Link: https://lore.kernel.org/r/9fcd182f1099f86c6661f3717f63712ddd1c676c.16744967… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/sctp/bind_addr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c index f8a283245672..d723942e5e65 100644 --- a/net/sctp/bind_addr.c +++ b/net/sctp/bind_addr.c @@ -88,6 +88,12 @@ int sctp_bind_addr_copy(struct net *net, struct sctp_bind_addr *dest, } } + /* If somehow no addresses were found that can be used with this + * scope, it's an error. + */ + if (list_empty(&dest->address_list)) + error = -ENETUNREACH; + out: if (error) sctp_bind_addr_clean(dest); -- 2.25.1

1 6

[PATCH openEuler-1.0-LTS] sctp: fail if no bound addresses can be used for a given scope
by Yongqiang Liu 08 Mar '23

08 Mar '23

From: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> stable inclusion from stable-v4.19.271 commit 26436553aabfd9b40e1daa537a099bf5bb13fb55 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6I7U3 CVE: CVE-2023-1074 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 458e279f861d3f61796894cd158b780765a1569f ] Currently, if you bind the socket to something like: servaddr.sin6_family = AF_INET6; servaddr.sin6_port = htons(0); servaddr.sin6_scope_id = 0; inet_pton(AF_INET6, "::1", &servaddr.sin6_addr); And then request a connect to: connaddr.sin6_family = AF_INET6; connaddr.sin6_port = htons(20000); connaddr.sin6_scope_id = if_nametoindex("lo"); inet_pton(AF_INET6, "fe88::1", &connaddr.sin6_addr); What the stack does is: - bind the socket - create a new asoc - to handle the connect - copy the addresses that can be used for the given scope - try to connect But the copy returns 0 addresses, and the effect is that it ends up trying to connect as if the socket wasn't bound, which is not the desired behavior. This unexpected behavior also allows KASLR leaks through SCTP diag interface. The fix here then is, if when trying to copy the addresses that can be used for the scope used in connect() it returns 0 addresses, bail out. This is what TCP does with a similar reproducer. Reported-by: Pietro Borrello <borrello(a)diag.uniroma1.it> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Reviewed-by: Xin Long <lucien.xin(a)gmail.com> Link: https://lore.kernel.org/r/9fcd182f1099f86c6661f3717f63712ddd1c676c.16744967… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/sctp/bind_addr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c index f8a283245672..d723942e5e65 100644 --- a/net/sctp/bind_addr.c +++ b/net/sctp/bind_addr.c @@ -88,6 +88,12 @@ int sctp_bind_addr_copy(struct net *net, struct sctp_bind_addr *dest, } } + /* If somehow no addresses were found that can be used with this + * scope, it's an error. + */ + if (list_empty(&dest->address_list)) + error = -ENETUNREACH; + out: if (error) sctp_bind_addr_clean(dest); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS-SP1 01/30] ovl: fix use inode directly in rcu-walk mode
by Zheng Zengkai 08 Mar '23

08 Mar '23

From: Chen Zhongjin <chenzhongjin(a)huawei.com> stable inclusion from stable-v5.10.163 commit 740c537f52c1f54aff9094744483d1515c7c8b7b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GCCV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 672e4268b2863d7e4978dfed29552b31c2f9bd4e upstream. ovl_dentry_revalidate_common() can be called in rcu-walk mode. As document said, "in rcu-walk mode, d_parent and d_inode should not be used without care". Check inode here to protect access under rcu-walk mode. Fixes: bccece1ead36 ("ovl: allow remote upper") Reported-and-tested-by: syzbot+a4055c78774bbf3498bb(a)syzkaller.appspotmail.com Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Cc: <stable(a)vger.kernel.org> # v5.7 Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/overlayfs/super.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index 45c596dfe3a3..e3cd5a00f880 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -138,11 +138,16 @@ static int ovl_dentry_revalidate_common(struct dentry *dentry, unsigned int flags, bool weak) { struct ovl_entry *oe = dentry->d_fsdata; + struct inode *inode = d_inode_rcu(dentry); struct dentry *upper; unsigned int i; int ret = 1; - upper = ovl_dentry_upper(dentry); + /* Careful in RCU mode */ + if (!inode) + return -ECHILD; + + upper = ovl_i_dentry_upper(inode); if (upper) ret = ovl_revalidate_real(upper, flags, weak); -- 2.25.1

1 29

[PATCH openEuler-5.10-LTS 01/30] ovl: fix use inode directly in rcu-walk mode
by Zheng Zengkai 08 Mar '23

08 Mar '23

From: Chen Zhongjin <chenzhongjin(a)huawei.com> stable inclusion from stable-v5.10.163 commit 740c537f52c1f54aff9094744483d1515c7c8b7b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GCCV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 672e4268b2863d7e4978dfed29552b31c2f9bd4e upstream. ovl_dentry_revalidate_common() can be called in rcu-walk mode. As document said, "in rcu-walk mode, d_parent and d_inode should not be used without care". Check inode here to protect access under rcu-walk mode. Fixes: bccece1ead36 ("ovl: allow remote upper") Reported-and-tested-by: syzbot+a4055c78774bbf3498bb(a)syzkaller.appspotmail.com Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Cc: <stable(a)vger.kernel.org> # v5.7 Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/overlayfs/super.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index 45c596dfe3a3..e3cd5a00f880 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -138,11 +138,16 @@ static int ovl_dentry_revalidate_common(struct dentry *dentry, unsigned int flags, bool weak) { struct ovl_entry *oe = dentry->d_fsdata; + struct inode *inode = d_inode_rcu(dentry); struct dentry *upper; unsigned int i; int ret = 1; - upper = ovl_dentry_upper(dentry); + /* Careful in RCU mode */ + if (!inode) + return -ECHILD; + + upper = ovl_i_dentry_upper(inode); if (upper) ret = ovl_revalidate_real(upper, flags, weak); -- 2.25.1

1 28

[PATCH openEuler-1.0-LTS 1/2] dhugetlb: use mutex lock in update_reserve_pages()
by Yongqiang Liu 07 Mar '23

07 Mar '23

From: Liu Shixin <liushixin2(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46904, https://gitee.com/openeuler/kernel/issues/I6KOXL CVE: NA -------------------------------- When memory is fragmented, update_reserve_pages() may call migrate_pages() to collect continuous memory. This function can sleep, so we should use mutex lock instead of spin lock. Fixes: 3eb69101b5e6 ("mm: Add two interface for dhugetlb") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> Reviewed-by: tong tiangen <tongtiangen(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/linux/hugetlb.h | 2 +- mm/hugetlb.c | 2 +- mm/memcontrol.c | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index d44eea25c0d6..dfd9a8c945e1 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -696,7 +696,7 @@ struct small_page_pool { struct dhugetlb_pool { int nid; spinlock_t lock; - spinlock_t reserved_lock; + struct mutex reserved_lock; atomic_t refcnt; struct mem_cgroup *attach_memcg; diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 9f974270c84d..a468d94bc16a 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3327,7 +3327,7 @@ struct dhugetlb_pool *hpool_alloc(unsigned long nid) return NULL; spin_lock_init(&hpool->lock); - spin_lock_init(&hpool->reserved_lock); + mutex_init(&hpool->reserved_lock); hpool->nid = nid; atomic_set(&hpool->refcnt, 1); INIT_LIST_HEAD(&hpool->dhugetlb_1G_freelists); diff --git a/mm/memcontrol.c b/mm/memcontrol.c index fd40fef49e45..886d6b0a4fce 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4950,9 +4950,9 @@ static int update_reserve_pages(struct kernfs_open_file *of, hpool = get_dhugetlb_pool_from_memcg(memcg); if (!hpool) return -EINVAL; - spin_lock(&hpool->reserved_lock); + mutex_lock(&hpool->reserved_lock); dhugetlb_reserve_hugepages(hpool, size, gigantic); - spin_unlock(&hpool->reserved_lock); + mutex_unlock(&hpool->reserved_lock); dhugetlb_pool_put(hpool); return 0; } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/2] ntfs: fix use-after-free in ntfs_ucsncmp()
by Yongqiang Liu 07 Mar '23

07 Mar '23

From: ChenXiaoSong <chenxiaosong2(a)huawei.com> stable inclusion from stable-v4.19.254 commit 6c0355ca7ac434d84d8b93336462b698573ca3b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6HWOS CVE: CVE-2023-26607 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 38c9c22a85aeed28d0831f230136e9cf6fa2ed44 upstream. Syzkaller reported use-after-free bug as follows: ================================================================== BUG: KASAN: use-after-free in ntfs_ucsncmp+0x123/0x130 Read of size 2 at addr ffff8880751acee8 by task a.out/879 CPU: 7 PID: 879 Comm: a.out Not tainted 5.19.0-rc4-next-20220630-00001-gcc5218c8bd2c-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x1c0/0x2b0 print_address_description.constprop.0.cold+0xd4/0x484 print_report.cold+0x55/0x232 kasan_report+0xbf/0xf0 ntfs_ucsncmp+0x123/0x130 ntfs_are_names_equal.cold+0x2b/0x41 ntfs_attr_find+0x43b/0xb90 ntfs_attr_lookup+0x16d/0x1e0 ntfs_read_locked_attr_inode+0x4aa/0x2360 ntfs_attr_iget+0x1af/0x220 ntfs_read_locked_inode+0x246c/0x5120 ntfs_iget+0x132/0x180 load_system_files+0x1cc6/0x3480 ntfs_fill_super+0xa66/0x1cf0 mount_bdev+0x38d/0x460 legacy_get_tree+0x10d/0x220 vfs_get_tree+0x93/0x300 do_new_mount+0x2da/0x6d0 path_mount+0x496/0x19d0 __x64_sys_mount+0x284/0x300 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f3f2118d9ea Code: 48 8b 0d a9 f4 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 76 f4 0b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffc269deac8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3f2118d9ea RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc269dec00 RBP: 00007ffc269dec80 R08: 00007ffc269deb00 R09: 00007ffc269dec44 R10: 0000000000000000 R11: 0000000000000202 R12: 000055f81ab1d220 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> The buggy address belongs to the physical page: page:0000000085430378 refcount:1 mapcount:1 mapping:0000000000000000 index:0x555c6a81d pfn:0x751ac memcg:ffff888101f7e180 anon flags: 0xfffffc00a0014(uptodate|lru|mappedtodisk|swapbacked|node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc00a0014 ffffea0001bf2988 ffffea0001de2448 ffff88801712e201 raw: 0000000555c6a81d 0000000000000000 0000000100000000 ffff888101f7e180 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880751acd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880751ace00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880751ace80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff8880751acf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880751acf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== The reason is that struct ATTR_RECORD->name_offset is 6485, end address of name string is out of bounds. Fix this by adding sanity check on end address of attribute name string. [akpm(a)linux-foundation.org: coding-style cleanups] [chenxiaosong2(a)huawei.com: cleanup suggested by Hawkins Jiawei] Link: https://lkml.kernel.org/r/20220709064511.3304299-1-chenxiaosong2@huawei.com Link: https://lkml.kernel.org/r/20220707105329.4020708-1-chenxiaosong2@huawei.com Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Signed-off-by: Hawkins Jiawei <yin31149(a)gmail.com> Cc: Anton Altaparmakov <anton(a)tuxera.com> Cc: ChenXiaoSong <chenxiaosong2(a)huawei.com> Cc: Yongqiang Liu <liuyongqiang13(a)huawei.com> Cc: Zhang Yi <yi.zhang(a)huawei.com> Cc: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ntfs/attrib.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c index 44a39a099b54..62b49197e5f6 100644 --- a/fs/ntfs/attrib.c +++ b/fs/ntfs/attrib.c @@ -606,8 +606,12 @@ static int ntfs_attr_find(const ATTR_TYPE type, const ntfschar *name, a = (ATTR_RECORD*)((u8*)ctx->attr + le32_to_cpu(ctx->attr->length)); for (;; a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))) { - if ((u8*)a < (u8*)ctx->mrec || (u8*)a > (u8*)ctx->mrec + - le32_to_cpu(ctx->mrec->bytes_allocated)) + u8 *mrec_end = (u8 *)ctx->mrec + + le32_to_cpu(ctx->mrec->bytes_allocated); + u8 *name_end = (u8 *)a + le16_to_cpu(a->name_offset) + + a->name_length * sizeof(ntfschar); + if ((u8*)a < (u8*)ctx->mrec || (u8*)a > mrec_end || + name_end > mrec_end) break; ctx->attr = a; if (unlikely(le32_to_cpu(a->type) > le32_to_cpu(type) || -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/4] tcp: Fix listen() regression in 5.15.88.
by Yongqiang Liu 07 Mar '23

07 Mar '23

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> stable inclusion from stable-v5.15.95 commit fdaf88531cfd17b2a710cceb3141ef6f9085ff40 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6H3MB CVE: CVE-2023-0461 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- When we backport dadd0dcaa67d ("net/ulp: prevent ULP without clone op from entering the LISTEN status"), we have accidentally backported a part of 7a7160edf1bf ("net: Return errno in sk->sk_prot->get_port().") and removed err = -EADDRINUSE in inet_csk_listen_start(). Thus, listen() no longer returns -EADDRINUSE even if ->get_port() failed as reported in [0]. We set -EADDRINUSE to err just before ->get_port() to fix the regression. [0]: https://lore.kernel.org/stable/EF8A45D0-768A-4CD5-9A8A-0FA6E610ABF7@winter.… Reported-by: Winter <winter(a)winter.cafe> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv4/inet_connection_sock.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index f1f3dc6a7d63..0d85871b5cda 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -941,6 +941,7 @@ int inet_csk_listen_start(struct sock *sk, int backlog) * It is OK, because this socket enters to hash table only * after validation is complete. */ + err = -EADDRINUSE; inet_sk_state_store(sk, TCP_LISTEN); if (!sk->sk_prot->get_port(sk, inet->inet_num)) { inet->inet_sport = htons(inet->inet_num); -- 2.25.1

1 3

openEuler Kernel SIG双周例会
by openEuler conference 07 Mar '23

07 Mar '23

您好！ Kernel SIG 邀请您参加 2023-03-10 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容：欢迎您参加 Kernel SIG 双周例会，当前议题： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/87191608489?pwd=eG96T0p2Y0NDRUdHOW9SYys5SElTQT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-03-10 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 欢迎您参加 Kernel SIG 双周例会，当前议题： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/87191608489?pwd=eG96T0p2Y0NDRUdHOW9SYys5SElTQT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[OLK-5.10] phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
by Wang Yufen 06 Mar '23

06 Mar '23

From: Miaoqian Lin <linmq006(a)gmail.com> mainline inclusion from mainline-v5.17-rc1 commit 045a31b95509c8f25f5f04ec5e0dec5cd09f2c5f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6IXQP CVE: CVE-2023-23000 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- callers of tegra_xusb_find_port_node() function only do NULL checking for the return value. return NULL instead of ERR_PTR(-ENOMEM) to keep consistent. Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Acked-by: Thierry Reding <treding(a)nvidia.com> Link: https://lore.kernel.org/r/20211213020507.1458-1-linmq006@gmail.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- drivers/phy/tegra/xusb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c index 181a1be..02da8c0 100644 --- a/drivers/phy/tegra/xusb.c +++ b/drivers/phy/tegra/xusb.c @@ -449,7 +449,7 @@ struct tegra_xusb_lane * name = kasprintf(GFP_KERNEL, "%s-%u", type, index); if (!name) { of_node_put(ports); - return ERR_PTR(-ENOMEM); + return NULL; } np = of_get_child_by_name(ports, name); kfree(name); -- 1.8.3.1

1 0

[openEuler-22.03-LTS] phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
by Wang Yufen 06 Mar '23

06 Mar '23

From: Miaoqian Lin <linmq006(a)gmail.com> mainline inclusion from mainline-v5.17-rc1 commit 045a31b95509c8f25f5f04ec5e0dec5cd09f2c5f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6IXQP CVE: CVE-2023-23000 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- callers of tegra_xusb_find_port_node() function only do NULL checking for the return value. return NULL instead of ERR_PTR(-ENOMEM) to keep consistent. Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Acked-by: Thierry Reding <treding(a)nvidia.com> Link: https://lore.kernel.org/r/20211213020507.1458-1-linmq006@gmail.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- drivers/phy/tegra/xusb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c index 181a1be..02da8c0 100644 --- a/drivers/phy/tegra/xusb.c +++ b/drivers/phy/tegra/xusb.c @@ -449,7 +449,7 @@ struct tegra_xusb_lane * name = kasprintf(GFP_KERNEL, "%s-%u", type, index); if (!name) { of_node_put(ports); - return ERR_PTR(-ENOMEM); + return NULL; } np = of_get_child_by_name(ports, name); kfree(name); -- 1.8.3.1

1 0

[openEuler-1.0-LTS] phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
by Wang Yufen 06 Mar '23

06 Mar '23

From: Miaoqian Lin <linmq006(a)gmail.com> mainline inclusion from mainline-v5.17-rc1 commit 045a31b95509c8f25f5f04ec5e0dec5cd09f2c5f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6IXQP CVE: CVE-2023-23000 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- callers of tegra_xusb_find_port_node() function only do NULL checking for the return value. return NULL instead of ERR_PTR(-ENOMEM) to keep consistent. Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Acked-by: Thierry Reding <treding(a)nvidia.com> Link: https://lore.kernel.org/r/20211213020507.1458-1-linmq006@gmail.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- drivers/phy/tegra/xusb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c index de1b4eb..9e8fa18 100644 --- a/drivers/phy/tegra/xusb.c +++ b/drivers/phy/tegra/xusb.c @@ -441,7 +441,7 @@ struct tegra_xusb_lane * name = kasprintf(GFP_KERNEL, "%s-%u", type, index); if (!name) { of_node_put(ports); - return ERR_PTR(-ENOMEM); + return NULL; } np = of_get_child_by_name(ports, name); kfree(name); -- 1.8.3.1

1 0

[PATCH openEuler-1.0-LTS 1/4] rds: rds_rm_zerocopy_callback() use list_first_entry()
by Yongqiang Liu 06 Mar '23

06 Mar '23

From: Pietro Borrello <borrello(a)diag.uniroma1.it> stable inclusion from stable-v4.19.273 commit 909d5eef5ce792bb76d7b5a9b7a6852b813d8cac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6I7UF CVE: CVE-2023-1078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit f753a68980cf4b59a80fe677619da2b1804f526d ] rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Use list_first_entry() to actually access the first element of the rs_zcookie_queue list. Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification") Reviewed-by: Willem de Bruijn <willemb(a)google.com> Signed-off-by: Pietro Borrello <borrello(a)diag.uniroma1.it> Link: https://lore.kernel.org/r/20230202-rds-zerocopy-v3-1-83b0df974f9a@diag.unir… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/rds/message.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/rds/message.c b/net/rds/message.c index 4b00b1152a5f..309b54cc62ae 100644 --- a/net/rds/message.c +++ b/net/rds/message.c @@ -104,9 +104,9 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs, spin_lock_irqsave(&q->lock, flags); head = &q->zcookie_head; if (!list_empty(head)) { - info = list_entry(head, struct rds_msg_zcopy_info, - rs_zcookie_next); - if (info && rds_zcookie_add(info, cookie)) { + info = list_first_entry(head, struct rds_msg_zcopy_info, + rs_zcookie_next); + if (rds_zcookie_add(info, cookie)) { spin_unlock_irqrestore(&q->lock, flags); kfree(rds_info_from_znotifier(znotif)); /* caller invokes rds_wake_sk_sleep() */ -- 2.25.1

1 3

[PATCH v7 OLK-5.10 0/8] Add support for hbm memory device and hbm cache
by Zhang Zekun 04 Mar '23

04 Mar '23

v7: - change there is a container(PNP0A06) has a memory device (PNP0C80) before create device attributes under container subsys v6: - get container device form container_subsys v5: - check the container have PNP0C80 before create attribute files v4: - prettify the code v3: - prettify the code - add a hisi_internal.h to hold common code v2: - remove the !adev judge in patch 9, as it will always be true. patch 1-3: Add support for iterate through the child devices in the acpi device. patch 4-9: Add support for hbm memory device and hbm cache support Rafael J. Wysocki (3): ACPI: bus: Introduce acpi_dev_for_each_child() ACPI: bus: Avoid non-ACPI device objects in walks over children ACPI: bus: Export acpi_dev_for_each_child() to modules Zhang Zekun (5): ACPI: OSL: Export the symbol of acpi_hotplug_schedule soc: hisilicon: hisi_hbmdev: Add power domain control methods ACPI: memhotplug: export the state of each hotplug device soc: hisilicon: hisi_hbmdev: Provide extra memory topology information soc: hbmcache: Add support for online and offline the hbm cache drivers/acpi/acpi_memhotplug.c | 6 + drivers/acpi/bus.c | 27 +++ drivers/acpi/internal.h | 1 - drivers/acpi/osl.c | 1 + drivers/base/container.c | 1 + drivers/soc/Kconfig | 1 + drivers/soc/Makefile | 1 + drivers/soc/hisilicon/Kconfig | 33 +++ drivers/soc/hisilicon/Makefile | 4 + drivers/soc/hisilicon/hisi_hbmcache.c | 147 +++++++++++++ drivers/soc/hisilicon/hisi_hbmdev.c | 301 ++++++++++++++++++++++++++ drivers/soc/hisilicon/hisi_internal.h | 31 +++ include/acpi/acpi_bus.h | 2 + include/linux/acpi.h | 1 + include/linux/memory_hotplug.h | 2 + 15 files changed, 558 insertions(+), 1 deletion(-) create mode 100644 drivers/soc/hisilicon/Kconfig create mode 100644 drivers/soc/hisilicon/Makefile create mode 100644 drivers/soc/hisilicon/hisi_hbmcache.c create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c create mode 100644 drivers/soc/hisilicon/hisi_internal.h -- 2.17.1

1 8

[PATCH v2 OLK-5.10 00/37] backport patches of share_pool and
by Zhang Zekun 04 Mar '23

04 Mar '23

v2: - remove patch "mm/sharepool: Add mg_sp_alloc_nodemask" Chen Jun (3): mm/sharepool: Fix a double free problem caused by init_local_group mm/sharepool: extract group_add_task mm/sharepool: use delete_spg_node to replace some repetitive code Guo Mengqi (1): mm: sharepool: add static modifier to find_spg_node_by_spg() Wang Wensheng (8): mm/sharepool: Fix NULL pointer dereference in mg_sp_group_del_task mm/sharepool: Reorganize create_spg() mm/sharepool: Simplify sp_make_share_k2u() mm/sharepool: Rename sp_group operations mm/sharepool: Simplify sp_unshare_uva() mm/sharepool: Fix null-pointer-deference in sp_free_area mm/sharepool: Modify error message in mg_sp_group_del_task mm/sharepool: Fix double delete list in sp_group_exit Xu Qiang (17): mm/sharepool: Refactoring proc file interface similar code mm/sharepool: Add helper for master_list mm/sharepool: Delete unused spg_id and hugepage_failures. mm/sharepool: Delete unused mm in sp_proc_stat. mm/sharepool: Move spa_num field to sp_group. mm/sharepool: Rename sp_spg_stat to sp_meminfo. mm/sharepool: Split meminfo_update into meminfo_inc_usage and meminfo_dec_usage. mm/sharepool: split meminfo_update_k2u into meminfo_inc_k2u and meminfo_dec_k2u. mm/sharepool: Delete redundant tgid in sp_proc_stat. mm/sharepool: Move comm from sp_proc_stat to sp_group_master. mm/sharepool: replace sp_proc_stat with sp_meminfo. mm/sharepool: Delete unused tgid and spg_id in spg_proc_stat. mm/sharepool: Replace spg_proc_stat with sp_meminfo. mm/sharepool: Add meminfo_alloc_sum_byKB and meminfo_alloc_sum. mm/sharepool: Add meminfo_k2u_size. mm/sharepool: Delete unused kthread_stat. mm/sharepool: Delete redundant size and alloc_size in sp_meminfo. Zhang Zekun (6): perf: hisi: Add configs for PMU isolation driver: Add CONFIG_ACPI_APEI_GHES_TS_CORE for code isolation ACPI / APEI: Add config to isolate Notify all ras err vmalloc: Add config for Extend for hugepages mapping iommu/arm-smmu-v3: Add config to Add support for suspend and resume hugetlbfs: Add config to isolate the code of share_pool Zhou Guanghui (2): mm/sharepool: Don't display sharepool statistics in the container mm: sharepool: Charge Buddy hugepage to memcg arch/arm64/Kconfig | 2 +- arch/arm64/configs/openeuler_defconfig | 6 + drivers/acpi/apei/Kconfig | 14 + drivers/acpi/apei/ghes.c | 10 +- drivers/iommu/Kconfig | 7 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 9 +- drivers/perf/hisilicon/Kconfig | 19 + drivers/perf/hisilicon/Makefile | 6 +- fs/hugetlbfs/inode.c | 21 +- include/acpi/ghes.h | 2 + include/linux/cper.h | 3 + include/linux/mm.h | 2 + include/linux/vmalloc.h | 7 + mm/Kconfig | 6 + mm/hugetlb.c | 2 + mm/share_pool.c | 1027 ++++++++----------- mm/share_pool_internal.h | 22 + mm/vmalloc.c | 16 + 18 files changed, 569 insertions(+), 612 deletions(-) create mode 100644 mm/share_pool_internal.h -- 2.17.1

1 37

Re: [PATCH v5 OLK-5.10 5/8] soc: hisilicon: hisi_hbmdev: Add power domain control methods
by zhangzekun (A) 03 Mar '23

03 Mar '23

在 2023/3/3 14:19, Kefeng Wang 写道: > > > On 2023/3/3 11:49, Zhang Zekun wrote: >> Offering: HULK >> hulk inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/kernel/issues/I67QNJ >> CVE: NA >> >> ------------------------------------------------------------------ >> >> Platform devices which supports power control are often required to be >> power off/on together with the devices in the same power domain. >> However, >> there isn't a generic driver that support the power control logic of >> these devices. >> >> ACPI container seems to be a good place to hold these control logic. Add >> platform devices in the same power domain in a ACPI container, we can >> easily get the locality information about these devices and can moniter >> the power of these devices in the same power domain together. >> >> This patch provide three userspace control interface to control the >> power >> of devices together in the container: >> - state: Echo online to state to power up the devices in the >> container and >> then online these devices which will be triggered by BIOS. Echo >> offline >> to the state to offline and eject the child devices in the container >> which are ejectable. >> - pxms: show the pxms of devices which are present in the container. >> >> In our scenario, we need to control the power of HBM memory devices >> which >> can be power consuming and will only be used in some specialized >> scenarios, >> such as HPC. HBM memory devices in a socket are in the same power >> domain, >> and should be power off/on together. We have come up with an idea >> that put >> these power control logic in a specialized driver, but ACPI container >> seems >> to be a more generic place to hold these control logic. >> >> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> >> --- >> v6: >> - get container dev form container_subsys >> >> v5: >> - check containers have PNP0C80 before create attibute >> files >> >> v4: >> - prettify the code >> >> v3: >> - move the common code to hisi_internal.h >> >> drivers/base/container.c | 1 + >> drivers/soc/Kconfig | 1 + >> drivers/soc/Makefile | 1 + >> drivers/soc/hisilicon/Kconfig | 19 +++ >> drivers/soc/hisilicon/Makefile | 3 + >> drivers/soc/hisilicon/hisi_hbmdev.c | 196 ++++++++++++++++++++++++++ >> drivers/soc/hisilicon/hisi_internal.h | 31 ++++ >> 7 files changed, 252 insertions(+) >> create mode 100644 drivers/soc/hisilicon/Kconfig >> create mode 100644 drivers/soc/hisilicon/Makefile >> create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c >> create mode 100644 drivers/soc/hisilicon/hisi_internal.h >> >> diff --git a/drivers/base/container.c b/drivers/base/container.c >> index 1ba42d2d3532..12e572d0c69b 100644 >> --- a/drivers/base/container.c >> +++ b/drivers/base/container.c >> @@ -30,6 +30,7 @@ struct bus_type container_subsys = { >> .online = trivial_online, >> .offline = container_offline, >> }; >> +EXPORT_SYMBOL_GPL(container_subsys); >> void __init container_dev_init(void) >> { >> diff --git a/drivers/soc/Kconfig b/drivers/soc/Kconfig >> index 425ab6f7e375..f7c59b063321 100644 >> --- a/drivers/soc/Kconfig >> +++ b/drivers/soc/Kconfig >> @@ -23,5 +23,6 @@ source "drivers/soc/versatile/Kconfig" >> source "drivers/soc/xilinx/Kconfig" >> source "drivers/soc/zte/Kconfig" >> source "drivers/soc/kendryte/Kconfig" >> +source "drivers/soc/hisilicon/Kconfig" >> endmenu >> diff --git a/drivers/soc/Makefile b/drivers/soc/Makefile >> index 36452bed86ef..68f186e00e44 100644 >> --- a/drivers/soc/Makefile >> +++ b/drivers/soc/Makefile >> @@ -29,3 +29,4 @@ obj-$(CONFIG_PLAT_VERSATILE) += versatile/ >> obj-y += xilinx/ >> obj-$(CONFIG_ARCH_ZX) += zte/ >> obj-$(CONFIG_SOC_KENDRYTE) += kendryte/ >> +obj-y += hisilicon/ >> diff --git a/drivers/soc/hisilicon/Kconfig >> b/drivers/soc/hisilicon/Kconfig >> new file mode 100644 >> index 000000000000..497787af004e >> --- /dev/null >> +++ b/drivers/soc/hisilicon/Kconfig >> @@ -0,0 +1,19 @@ >> +# SPDX-License-Identifier: GPL-2.0 >> +# >> +# Hisilicon SoC drivers >> +# >> +menu "Hisilicon SoC driver support" >> + >> +config HISI_HBMDEV >> + tristate "add extra support for hbm memory device" >> + depends on ACPI_HOTPLUG_MEMORY >> + select ACPI_CONTAINER >> + help >> + This driver add extra supports for memory devices. The driver >> + provides methods for userpace to control the power of memory >> + devices in a container. >> + >> + To compile this driver as a module, choose M here: >> + the module will be called hisi_hbmdev. >> + >> +endmenu >> diff --git a/drivers/soc/hisilicon/Makefile >> b/drivers/soc/hisilicon/Makefile >> new file mode 100644 >> index 000000000000..22e87acb1ab3 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/Makefile >> @@ -0,0 +1,3 @@ >> +# SPDX-License-Identifier: GPL-2.0 >> + >> +obj-$(CONFIG_HISI_HBMDEV) += hisi_hbmdev.o >> diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c >> b/drivers/soc/hisilicon/hisi_hbmdev.c >> new file mode 100644 >> index 000000000000..8485efc00684 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/hisi_hbmdev.c >> @@ -0,0 +1,196 @@ >> +// SPDX-License-Identifier: GPL-2.0 >> +/* >> + * Copyright (C) Huawei Technologies Co., Ltd. 2023. All rights >> reserved. >> + */ >> + >> +#include <linux/kobject.h> >> +#include <linux/module.h> >> +#include <linux/nodemask.h> >> +#include <linux/acpi.h> >> +#include <linux/container.h> >> + >> +#include "hisi_internal.h" >> + >> +#define ACPI_MEMORY_DEVICE_HID "PNP0C80" >> +#define ACPI_GENERIC_CONTAINER_DEVICE_HID "PNP0A06" >> + >> +struct memory_dev { >> + struct kobject *memdev_kobj; >> +}; >> + >> +static struct memory_dev *mdev; >> + >> +static int hbmdev_find(struct acpi_device *adev, void *arg) >> +{ >> + const char *hid = acpi_device_hid(adev); >> + bool *found = arg; >> + >> + if (!strcmp(hid, ACPI_MEMORY_DEVICE_HID)) { >> + *found = true; >> + return -1; >> + } >> + >> + return 0; >> +} >> + >> +static bool has_hbmdev(struct device *dev) >> +{ >> + struct acpi_device *adev = ACPI_COMPANION(dev); >> + const char *hid = acpi_device_hid(adev); >> + bool found = false; >> + >> + if (strcmp(hid, ACPI_GENERIC_CONTAINER_DEVICE_HID)) >> + return found; >> + >> + acpi_dev_for_each_child(adev, hbmdev_find, &found); >> + >> + return found; >> +} >> + >> +static int get_pxm(struct acpi_device *acpi_device, void *arg) >> +{ >> + acpi_handle handle = acpi_device->handle; >> + nodemask_t *mask = arg; >> + unsigned long long sta; >> + acpi_status status; >> + int nid; >> + >> + status = acpi_evaluate_integer(handle, "_STA", NULL, &sta); >> + if (ACPI_SUCCESS(status) && (sta & ACPI_STA_DEVICE_ENABLED)) { >> + nid = acpi_get_node(handle); >> + if (nid >= 0) >> + node_set(nid, *mask); >> + } >> + >> + return 0; >> +} >> + >> +static ssize_t pxms_show(struct device *dev, >> + struct device_attribute *attr, >> + char *buf) >> +{ >> + struct acpi_device *adev = ACPI_COMPANION(dev); >> + nodemask_t mask; >> + >> + nodes_clear(mask); >> + acpi_dev_for_each_child(adev, get_pxm, &mask); >> + >> + return sysfs_emit(buf, "%*pbl\n", >> + nodemask_pr_args(&mask)); >> +} >> +static DEVICE_ATTR_RO(pxms); >> + >> +static int memdev_power_on(struct acpi_device *adev) >> +{ >> + acpi_handle handle = adev->handle; >> + acpi_status status; >> + >> + status = acpi_evaluate_object(handle, "_ON", NULL, NULL); >> + if (ACPI_FAILURE(status)) { >> + acpi_handle_warn(handle, "Power on failed (0x%x)\n", status); >> + return -ENODEV; >> + } >> + >> + return 0; >> +} >> + >> +static int eject_device(struct acpi_device *acpi_device, void >> *not_used) >> +{ >> + acpi_object_type unused; >> + acpi_status status; >> + >> + status = acpi_get_type(acpi_device->handle, &unused); >> + if (ACPI_FAILURE(status) || !acpi_device->flags.ejectable) >> + return -ENODEV; >> + >> + get_device(&acpi_device->dev); >> + status = acpi_hotplug_schedule(acpi_device, >> ACPI_OST_EC_OSPM_EJECT); >> + if (ACPI_SUCCESS(status)) >> + return 0; >> + >> + put_device(&acpi_device->dev); >> + acpi_evaluate_ost(acpi_device->handle, ACPI_OST_EC_OSPM_EJECT, >> + ACPI_OST_SC_NON_SPECIFIC_FAILURE, NULL); >> + >> + return status == AE_NO_MEMORY ? -ENOMEM : -EAGAIN; >> +} >> + >> +static int memdev_power_off(struct acpi_device *adev) >> +{ >> + return acpi_dev_for_each_child(adev, eject_device, NULL); >> +} >> + >> +static ssize_t state_store(struct device *dev, struct >> device_attribute *attr, >> + const char *buf, size_t count) >> +{ >> + struct acpi_device *adev = ACPI_COMPANION(dev); >> + const int type = online_type_from_str(buf); >> + int ret = -EINVAL; >> + >> + switch (type) { >> + case STATE_ONLINE: >> + ret = memdev_power_on(adev); >> + break; >> + case STATE_OFFLINE: >> + ret = memdev_power_off(adev); >> + break; >> + default: >> + break; >> + } >> + >> + if (ret) >> + return ret; >> + >> + return count; >> +} >> +static DEVICE_ATTR_WO(state); >> + >> +static int container_add(struct device *dev, void *data) >> +{ >> + if (!has_hbmdev(dev)) >> + return 0; >> + >> + device_create_file(dev, &dev_attr_state); >> + device_create_file(dev, &dev_attr_pxms); >> + >> + return 0; >> +} >> + >> +static int container_remove(struct device *dev, void *data) >> +{ >> + if (!has_hbmdev(dev)) >> + return 0; >> + >> + device_remove_file(dev, &dev_attr_state); >> + device_remove_file(dev, &dev_attr_pxms); >> + >> + return 0; >> +} >> + >> +static int __init mdev_init(void) >> +{ >> + mdev = kzalloc(sizeof(struct memory_dev), GFP_KERNEL); >> + if (!mdev) >> + return -ENOMEM; >> + >> + mdev->memdev_kobj = kobject_create_and_add("hbm_memory", >> kernel_kobj); >> + if (!mdev->memdev_kobj) { >> + kfree(mdev); >> + return -ENOMEM; >> + } >> + >> + bus_for_each_dev(&container_subsys, NULL, NULL, container_add); >> + return 0; >> +} > > 这个还是没有解决是否加载的问题； > 1）通过遍历，你已经拿到了所有的container device， > 后面移除的时候就不需要再次遍历了；这里可以搞个链表； > 2）另外判断是否有hbm，搞个全局变量，如果有了，才继续执行后面的初始化，否则就直接返回了； > 按照这个思路这里可以改成这样： module_init 1. 首先判断所有容器中是否有hbm device，构建链表 2. 如果链表不为空那么执行模块的初始化，创建hbm_memory目录如果链表为空直接返回，释放链表 module_exit 释放链表中的资源，释放链表 >> +module_init(mdev_init); >> + >> +static void __exit mdev_exit(void) >> +{ >> + bus_for_each_dev(&container_subsys, NULL, NULL, container_remove); >> + kobject_put(mdev->memdev_kobj); >> + kfree(mdev); >> +} >> +module_exit(mdev_exit); >> + >> +MODULE_LICENSE("GPL v2"); >> +MODULE_AUTHOR("Zhang Zekun <zhangzekun11(a)huawei.com>"); >> diff --git a/drivers/soc/hisilicon/hisi_internal.h >> b/drivers/soc/hisilicon/hisi_internal.h >> new file mode 100644 >> index 000000000000..5345174f6b84 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/hisi_internal.h >> @@ -0,0 +1,31 @@ >> +/* SPDX-License-Identifier: GPL-2.0 */ >> +/* >> + * Copyright (C) Huawei Technologies Co., Ltd. 2023. All rights >> reserved. >> + */ >> + >> +#ifndef _HISI_INTERNAL_H >> +#define _HISI_INTERNAL_H >> + >> +enum { >> + STATE_ONLINE, >> + STATE_OFFLINE, >> +}; >> + >> +static const char *const online_type_to_str[] = { >> + [STATE_ONLINE] = "online", >> + [STATE_OFFLINE] = "offline", >> +}; >> + >> +static inline int online_type_from_str(const char *str) >> +{ >> + int i; >> + >> + for (i = 0; i < ARRAY_SIZE(online_type_to_str); i++) { >> + if (sysfs_streq(str, online_type_to_str[i])) >> + return i; >> + } >> + >> + return -EINVAL; >> +} >> + >> +#endif

1 0

[PATCH v5 OLK-5.10 0/8] Add support for hbm memory device and hbm cache
by Zhang Zekun 03 Mar '23

03 Mar '23

v6: - get container device form container_subsys v5: - check the container have PNP0C80 before create attribute files v4: - prettify the code v3: - prettify the code - add a hisi_internal.h to hold common code v2: - remove the !adev judge in patch 9, as it will always be true. patch 1-3: Add support for iterate through the child devices in the acpi device. patch 4-9: Add support for hbm memory device and hbm cache support Rafael J. Wysocki (3): ACPI: bus: Introduce acpi_dev_for_each_child() ACPI: bus: Avoid non-ACPI device objects in walks over children ACPI: bus: Export acpi_dev_for_each_child() to modules Zhang Zekun (5): ACPI: OSL: Export the symbol of acpi_hotplug_schedule soc: hisilicon: hisi_hbmdev: Add power domain control methods ACPI: memhotplug: export the state of each hotplug device soc: hisilicon: hisi_hbmdev: Provide extra memory topology information ACPI: hbmcache: Add support for online and offline the hbm cache drivers/acpi/acpi_memhotplug.c | 6 + drivers/acpi/bus.c | 27 +++ drivers/acpi/internal.h | 1 - drivers/acpi/osl.c | 1 + drivers/base/container.c | 1 + drivers/soc/Kconfig | 1 + drivers/soc/Makefile | 1 + drivers/soc/hisilicon/Kconfig | 33 ++++ drivers/soc/hisilicon/Makefile | 4 + drivers/soc/hisilicon/hisi_hbmcache.c | 147 +++++++++++++++ drivers/soc/hisilicon/hisi_hbmdev.c | 257 ++++++++++++++++++++++++++ drivers/soc/hisilicon/hisi_internal.h | 31 ++++ include/acpi/acpi_bus.h | 2 + include/linux/acpi.h | 1 + include/linux/memory_hotplug.h | 2 + 15 files changed, 514 insertions(+), 1 deletion(-) create mode 100644 drivers/soc/hisilicon/Kconfig create mode 100644 drivers/soc/hisilicon/Makefile create mode 100644 drivers/soc/hisilicon/hisi_hbmcache.c create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c create mode 100644 drivers/soc/hisilicon/hisi_internal.h -- 2.17.1

1 8

[PATCH v5 OLK-5.10 0/9] Add support for hbm memory device and hbm cache
by Zhang Zekun 02 Mar '23

02 Mar '23

v5: - check the container have PNP0C80 before create attribute files v4: - prettify the code v3: - prettify the code - add a hisi_internal.h to hold common code v2: - remove the !adev judge in patch 9, as it will always be true. patch 1-3: Add support for iterate through the child devices in the acpi device. patch 4-9: Add support for hbm memory device and hbm cache support Rafael J. Wysocki (3): ACPI: bus: Introduce acpi_dev_for_each_child() ACPI: bus: Avoid non-ACPI device objects in walks over children ACPI: bus: Export acpi_dev_for_each_child() to modules Zhang Zekun (6): ACPI: container: export the container list in the system ACPI: OSL: Export the symbol of acpi_hotplug_schedule soc: hisilicon: hisi_hbmdev: Add power domain control methods ACPI: memhotplug: export the state of each hotplug device soc: hisilicon: hisi_hbmdev: Provide extra memory topology information ACPI: hbmcache: Add support for online and offline the hbm cache drivers/acpi/acpi_memhotplug.c | 6 + drivers/acpi/bus.c | 27 +++ drivers/acpi/container.c | 51 ++++++ drivers/acpi/internal.h | 1 - drivers/acpi/osl.c | 1 + drivers/soc/Kconfig | 1 + drivers/soc/Makefile | 1 + drivers/soc/hisilicon/Kconfig | 33 ++++ drivers/soc/hisilicon/Makefile | 4 + drivers/soc/hisilicon/hisi_hbmcache.c | 147 ++++++++++++++++ drivers/soc/hisilicon/hisi_hbmdev.c | 245 ++++++++++++++++++++++++++ drivers/soc/hisilicon/hisi_internal.h | 33 ++++ include/acpi/acpi_bus.h | 2 + include/linux/acpi.h | 1 + include/linux/container.h | 8 + include/linux/memory_hotplug.h | 2 + 16 files changed, 562 insertions(+), 1 deletion(-) create mode 100644 drivers/soc/hisilicon/Kconfig create mode 100644 drivers/soc/hisilicon/Makefile create mode 100644 drivers/soc/hisilicon/hisi_hbmcache.c create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c create mode 100644 drivers/soc/hisilicon/hisi_internal.h -- 2.17.1

1 9

[PATCH v4 OLK-5.10 0/9] Add support for hbm memory device and
by Zhang Zekun 02 Mar '23

02 Mar '23

v4: - prettify the code v3: - prettify the code - add a hisi_internal.h to hold common code v2: - remove the !adev judge in patch 9, as it will always be true. patch 1-3: Add support for iterate through the child devices in the acpi device. patch 4-9: Add support for hbm memory device and hbm cache support Rafael J. Wysocki (3): ACPI: bus: Introduce acpi_dev_for_each_child() ACPI: bus: Avoid non-ACPI device objects in walks over children ACPI: bus: Export acpi_dev_for_each_child() to modules Zhang Zekun (6): ACPI: container: export the container list in the system ACPI: OSL: Export the symbol of acpi_hotplug_schedule soc: hisilicon: hisi_hbmdev: Add power domain control methods ACPI: memhotplug: export the state of each hotplug device soc: hisilicon: hisi_hbmdev: Provide extra memory topology information ACPI: hbmcache: Add support for online and offline the hbm cache drivers/acpi/acpi_memhotplug.c | 6 + drivers/acpi/bus.c | 27 ++++ drivers/acpi/container.c | 51 ++++++ drivers/acpi/internal.h | 1 - drivers/acpi/osl.c | 1 + drivers/soc/Kconfig | 1 + drivers/soc/Makefile | 1 + drivers/soc/hisilicon/Kconfig | 33 ++++ drivers/soc/hisilicon/Makefile | 4 + drivers/soc/hisilicon/hisi_hbmcache.c | 147 +++++++++++++++++ drivers/soc/hisilicon/hisi_hbmdev.c | 218 ++++++++++++++++++++++++++ drivers/soc/hisilicon/hisi_internal.h | 31 ++++ include/acpi/acpi_bus.h | 2 + include/linux/acpi.h | 1 + include/linux/container.h | 8 + include/linux/memory_hotplug.h | 2 + 16 files changed, 533 insertions(+), 1 deletion(-) create mode 100644 drivers/soc/hisilicon/Kconfig create mode 100644 drivers/soc/hisilicon/Makefile create mode 100644 drivers/soc/hisilicon/hisi_hbmcache.c create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c create mode 100644 drivers/soc/hisilicon/hisi_internal.h -- 2.17.1

1 9

Re: [PATCH v3 OLK-5.10 6/9] soc: hisilicon: hisi_hbmdev: Add power domain control methods
by zhangzekun (A) 02 Mar '23

02 Mar '23

在 2023/3/2 15:12, Kefeng Wang 写道: > > > On 2023/3/2 14:51, Zhang Zekun wrote: >> Offering: HULK >> hulk inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/kernel/issues/I67QNJ >> CVE: NA >> >> ------------------------------------------------------------------ >> >> Platform devices which supports power control are often required to be >> power off/on together with the devices in the same power domain. >> However, >> there isn't a generic driver that support the power control logic of >> these devices. >> >> ACPI container seems to be a good place to hold these control logic. Add >> platform devices in the same power domain in a ACPI container, we can >> easily get the locality information about these devices and can moniter >> the power of these devices in the same power domain together. >> >> This patch provide three userspace control interface to control the >> power >> of devices together in the container: >> - state: Echo online to state to power up the devices in the >> container and >> then online these devices which will be triggered by BIOS. Echo >> offline >> to the state to offline and eject the child devices in the container >> which are ejectable. >> - pxms: show the pxms of devices which are present in the container. >> >> In our scenario, we need to control the power of HBM memory devices >> which >> can be power consuming and will only be used in some specialized >> scenarios, >> such as HPC. HBM memory devices in a socket are in the same power >> domain, >> and should be power off/on together. We have come up with an idea >> that put >> these power control logic in a specialized driver, but ACPI container >> seems >> to be a more generic place to hold these control logic. >> >> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> >> --- >> v3: >> - move the common code to hisi_internal.h >> >> drivers/soc/Kconfig | 1 + >> drivers/soc/Makefile | 1 + >> drivers/soc/hisilicon/Kconfig | 19 +++ >> drivers/soc/hisilicon/Makefile | 3 + >> drivers/soc/hisilicon/hisi_hbmdev.c | 166 ++++++++++++++++++++++++++ >> drivers/soc/hisilicon/hisi_internal.h | 31 +++++ >> 6 files changed, 221 insertions(+) >> create mode 100644 drivers/soc/hisilicon/Kconfig >> create mode 100644 drivers/soc/hisilicon/Makefile >> create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c >> create mode 100644 drivers/soc/hisilicon/hisi_internal.h >> >> diff --git a/drivers/soc/Kconfig b/drivers/soc/Kconfig >> index 425ab6f7e375..f7c59b063321 100644 >> --- a/drivers/soc/Kconfig >> +++ b/drivers/soc/Kconfig >> @@ -23,5 +23,6 @@ source "drivers/soc/versatile/Kconfig" >> source "drivers/soc/xilinx/Kconfig" >> source "drivers/soc/zte/Kconfig" >> source "drivers/soc/kendryte/Kconfig" >> +source "drivers/soc/hisilicon/Kconfig" >> endmenu >> diff --git a/drivers/soc/Makefile b/drivers/soc/Makefile >> index 36452bed86ef..68f186e00e44 100644 >> --- a/drivers/soc/Makefile >> +++ b/drivers/soc/Makefile >> @@ -29,3 +29,4 @@ obj-$(CONFIG_PLAT_VERSATILE) += versatile/ >> obj-y += xilinx/ >> obj-$(CONFIG_ARCH_ZX) += zte/ >> obj-$(CONFIG_SOC_KENDRYTE) += kendryte/ >> +obj-y += hisilicon/ >> diff --git a/drivers/soc/hisilicon/Kconfig >> b/drivers/soc/hisilicon/Kconfig >> new file mode 100644 >> index 000000000000..497787af004e >> --- /dev/null >> +++ b/drivers/soc/hisilicon/Kconfig >> @@ -0,0 +1,19 @@ >> +# SPDX-License-Identifier: GPL-2.0 >> +# >> +# Hisilicon SoC drivers >> +# >> +menu "Hisilicon SoC driver support" >> + >> +config HISI_HBMDEV >> + tristate "add extra support for hbm memory device" >> + depends on ACPI_HOTPLUG_MEMORY >> + select ACPI_CONTAINER >> + help >> + This driver add extra supports for memory devices. The driver >> + provides methods for userpace to control the power of memory >> + devices in a container. >> + >> + To compile this driver as a module, choose M here: >> + the module will be called hisi_hbmdev. >> + >> +endmenu >> diff --git a/drivers/soc/hisilicon/Makefile >> b/drivers/soc/hisilicon/Makefile >> new file mode 100644 >> index 000000000000..22e87acb1ab3 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/Makefile >> @@ -0,0 +1,3 @@ >> +# SPDX-License-Identifier: GPL-2.0 >> + >> +obj-$(CONFIG_HISI_HBMDEV) += hisi_hbmdev.o >> diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c >> b/drivers/soc/hisilicon/hisi_hbmdev.c >> new file mode 100644 >> index 000000000000..82943cd35fa2 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/hisi_hbmdev.c >> @@ -0,0 +1,166 @@ >> +// SPDX-License-Identifier: GPL-2.0 >> +/* >> + * Copyright (C) Huawei Technologies Co., Ltd. 2023. All rights >> reserved. >> + */ >> + >> +#include <linux/kobject.h> >> +#include <linux/module.h> >> +#include <linux/nodemask.h> >> +#include <linux/acpi.h> >> +#include <linux/container.h> >> + >> +#include "hisi_internal.h" >> + >> +struct memory_dev { >> + struct kobject *memdev_kobj; >> +}; >> + >> +static struct memory_dev *mdev; >> + >> +static int get_pxm(struct acpi_device *acpi_device, void *arg) >> +{ >> + int nid; >> + unsigned long long sta; >> + acpi_handle handle; >> + nodemask_t *mask; >> + acpi_status status; >> + >> + mask = arg; >> + handle = acpi_device->handle; > > 按照倒金字塔， > acpi_handle handle = acpi_device->handle; > nodemask_t *mask = arg; > unsigned long long sta; > acpi_status status; > int nid; >> + >> + status = acpi_evaluate_integer(handle, "_STA", NULL, &sta); >> + if (ACPI_SUCCESS(status) && (sta & ACPI_STA_DEVICE_ENABLED)) { >> + nid = acpi_get_node(handle); >> + if (nid >= 0) >> + node_set(nid, *mask); >> + } >> + >> + return 0; >> +} >> + >> +static ssize_t pxms_show(struct device *dev, >> + struct device_attribute *attr, >> + char *buf) >> +{ >> + nodemask_t mask; >> + struct acpi_device *adev; >> + >> + adev = to_acpi_device(dev); > 同上 > >> + nodes_clear(mask); >> + acpi_dev_for_each_child(adev, get_pxm, &mask); >> + >> + return sysfs_emit(buf, "%*pbl\n", >> + nodemask_pr_args(&mask)); >> +} >> +static DEVICE_ATTR_RO(pxms); >> + >> +static int memdev_power_on(struct acpi_device *adev) >> +{ >> + acpi_status status; >> + acpi_handle handle; >> + >> + handle = adev->handle; > ... >> + status = acpi_evaluate_object(handle, "_ON", NULL, NULL); >> + if (ACPI_FAILURE(status)) { >> + acpi_handle_warn(handle, "Power on failed (0x%x)\n", status); >> + return -ENODEV; >> + } >> + >> + return 0; >> +} >> + >> +static int eject_device(struct acpi_device *acpi_device, void >> *not_used) >> +{ >> + acpi_object_type unused; >> + acpi_status status; >> + >> + status = acpi_get_type(acpi_device->handle, &unused); >> + if (ACPI_FAILURE(status) || !acpi_device->flags.ejectable) >> + return -ENODEV; >> + >> + get_device(&acpi_device->dev); >> + status = acpi_hotplug_schedule(acpi_device, >> ACPI_OST_EC_OSPM_EJECT); >> + if (ACPI_SUCCESS(status)) >> + return 0; >> + >> + put_device(&acpi_device->dev); >> + acpi_evaluate_ost(acpi_device->handle, ACPI_OST_EC_OSPM_EJECT, >> + ACPI_OST_SC_NON_SPECIFIC_FAILURE, NULL); >> + >> + return status == AE_NO_MEMORY ? -ENOMEM : -EAGAIN; >> +} >> + >> +static int memdev_power_off(struct acpi_device *adev) >> +{ >> + return acpi_dev_for_each_child(adev, eject_device, NULL); >> +} >> + >> +static ssize_t state_store(struct device *d, struct device_attribute >> *attr, >> + const char *buf, size_t count) >> +{ >> + int ret; >> + struct acpi_device *adev; >> + const int online_type = online_type_from_str(buf); >> + >> + if (online_type < 0) >> + return -EINVAL; >> + >> + adev = to_acpi_device(d); > > > const int online_type = online_type_from_str(buf); > struct acpi_device *adev = to_acpi_device(d); > int ret; > ... > > >> + switch (online_type) { >> + case STATE_ONLINE: >> + ret = memdev_power_on(adev); >> + if (!ret) >> + return count; >> + break; >> + case STATE_OFFLINE: >> + ret = memdev_power_off(adev); >> + if (!ret) >> + return count; >> + break; >> + default: >> + return -EINVAL; >> + } > 这个有点奇怪，hbm cache和mem的热插拔的函数不能搞成类似的逻辑吗这里改成这样吧 { struct acpi_device *adev = to_acpi_device(d); const int type = online_type_from_str(buf); int ret = -EINVAL; switch (type) { case STATE_ONLINE: ret = memdev_power_on(adev); break; case STATE_OFFLINE: ret = memdev_power_off(adev); break; default: break; } if (ret) return ret; return count; } >> + >> + return ret; >> +} >> +static DEVICE_ATTR_WO(state); >> + >> +static int __init mdev_init(void) >> +{ >> + struct cdev_node *cnode; >> + >> + mdev = kzalloc(sizeof(struct memory_dev), GFP_KERNEL); >> + if (!mdev) >> + return -ENOMEM; >> + >> + mdev->memdev_kobj = kobject_create_and_add("hbm_memory", >> kernel_kobj); >> + if (!mdev->memdev_kobj) { >> + kfree(mdev); >> + return -ENOMEM; >> + } >> + >> + list_for_each_entry(cnode, &cdev_list->clist, clist) { >> + device_create_file(cnode->dev, &dev_attr_state); >> + device_create_file(cnode->dev, &dev_attr_pxms); >> + } >> + >> + return 0; >> +} >> +module_init(mdev_init); >> + >> +static void __exit mdev_exit(void) >> +{ >> + struct cdev_node *cnode; >> + >> + list_for_each_entry(cnode, &cdev_list->clist, clist) { >> + device_remove_file(cnode->dev, &dev_attr_state); >> + device_remove_file(cnode->dev, &dev_attr_pxms); >> + } >> + >> + kobject_put(mdev->memdev_kobj); >> + kfree(mdev); >> +} >> +module_exit(mdev_exit); >> + >> +MODULE_LICENSE("GPL v2"); >> +MODULE_AUTHOR("Zhang Zekun <zhangzekun11(a)huawei.com>"); >> diff --git a/drivers/soc/hisilicon/hisi_internal.h >> b/drivers/soc/hisilicon/hisi_internal.h >> new file mode 100644 >> index 000000000000..f14596f58a05 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/hisi_internal.h >> @@ -0,0 +1,31 @@ >> +/* SPDX-License-Identifier: GPL-2.0 */ >> +/* >> + * Copyright (C) Huawei Technologies Co., Ltd. 2023. All rights >> reserved. >> + */ >> + >> +#ifndef _HISI_INTERNAL_H >> +#define _HISI_INTERNAL_H >> + >> +enum { >> + STATE_ONLINE, >> + STATE_OFFLINE, >> +}; >> + >> +static const char *const online_type_to_str[] = { >> + [STATE_ONLINE] = "online", >> + [STATE_OFFLINE] = "offline", >> +}; >> + >> +static int online_type_from_str(const char *str) > 不需要inline吗 >> +{ >> + int i; >> + >> + for (i = 0; i < ARRAY_SIZE(online_type_to_str); i++) { >> + if (sysfs_streq(str, online_type_to_str[i])) >> + return i; >> + } >> + >> + return -EINVAL; >> +} >> + >> +#endif

1 0

[PATCH v3 OLK-5.10 0/9] Add support for hbm memory device and
by Zhang Zekun 02 Mar '23

02 Mar '23

v3: - prettify the code - add a hisi_internal.h to hold common code v2: - remove the !adev judge in patch 9, as it will always be true. patch 1-3: Add support for iterate through the child devices in the acpi device. patch 4-9: Add support for hbm memory device and hbm cache support Rafael J. Wysocki (3): ACPI: bus: Introduce acpi_dev_for_each_child() ACPI: bus: Avoid non-ACPI device objects in walks over children ACPI: bus: Export acpi_dev_for_each_child() to modules Zhang Zekun (6): ACPI: container: export the container list in the system ACPI: OSL: Export the symbol of acpi_hotplug_schedule soc: hisilicon: hisi_hbmdev: Add power domain control methods ACPI: memhotplug: export the state of each hotplug device soc: hisilicon: hisi_hbmdev: Provide extra memory topology information ACPI: hbmcache: Add support for online and offline the hbm cache drivers/acpi/acpi_memhotplug.c | 6 + drivers/acpi/bus.c | 27 +++ drivers/acpi/container.c | 51 ++++++ drivers/acpi/internal.h | 1 - drivers/acpi/osl.c | 1 + drivers/soc/Kconfig | 1 + drivers/soc/Makefile | 1 + drivers/soc/hisilicon/Kconfig | 33 ++++ drivers/soc/hisilicon/Makefile | 4 + drivers/soc/hisilicon/hisi_hbmcache.c | 147 +++++++++++++++++ drivers/soc/hisilicon/hisi_hbmdev.c | 229 ++++++++++++++++++++++++++ drivers/soc/hisilicon/hisi_internal.h | 31 ++++ include/acpi/acpi_bus.h | 2 + include/linux/acpi.h | 1 + include/linux/container.h | 8 + include/linux/memory_hotplug.h | 2 + 16 files changed, 544 insertions(+), 1 deletion(-) create mode 100644 drivers/soc/hisilicon/Kconfig create mode 100644 drivers/soc/hisilicon/Makefile create mode 100644 drivers/soc/hisilicon/hisi_hbmcache.c create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c create mode 100644 drivers/soc/hisilicon/hisi_internal.h -- 2.17.1

1 9

[PATCH] Revert "scsi: fix iscsi rescan fails to create block"
by Zhong Jinghua 02 Mar '23

02 Mar '23

hulk inclusion category: bugfix bugzilla: 188150, https://gitee.com/openeuler/kernel/issues/I643OL ---------------------------------------- This reverts commit 7f10ea522db56188ae46c5bbee7052a2b2797515. This commit has a soft lock problem: watchdog: BUG: soft lockup - CPU#22 stuck for 67s! [iscsid:16369] Call Trace: scsi_remove_target+0x548/0x7b0 ? sdev_store_delete+0x90/0x90 ? __mutex_lock_slowpath+0x10/0x10 ? device_remove_class_symlinks+0x1b0/0x1b0 __iscsi_unbind_session+0x16b/0x250 [scsi_transport_iscsi] iscsi_remove_session+0x1d3/0x2f0 [scsi_transport_iscsi] iscsi_session_remove+0x5c/0x80 [libiscsi] iscsi_sw_tcp_session_destroy+0xd3/0x160 [iscsi_tcp] iscsi_if_rx+0x2369/0x5060 [scsi_transport_iscsi] The reason is that if other threads hold the reference count of the kobject while waiting for the device to be released, it will keep waiting in a loop. Fixes: 7f10ea522db5 ("scsi: fix iscsi rescan fails to create block") Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> --- drivers/scsi/scsi_sysfs.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c index 4468b92bf83b..6433476d3e67 100644 --- a/drivers/scsi/scsi_sysfs.c +++ b/drivers/scsi/scsi_sysfs.c @@ -1507,13 +1507,6 @@ void scsi_remove_device(struct scsi_device *sdev) } EXPORT_SYMBOL(scsi_remove_device); -static int scsi_device_try_get(struct scsi_device *sdev) -{ - if (!kobject_get_unless_zero(&sdev->sdev_gendev.kobj)) - return -ENXIO; - return 0; -} - static void __scsi_remove_target(struct scsi_target *starget) { struct Scsi_Host *shost = dev_to_shost(starget->dev.parent); @@ -1532,7 +1525,9 @@ static void __scsi_remove_target(struct scsi_target *starget) if (sdev->channel != starget->channel || sdev->id != starget->id) continue; - if (scsi_device_try_get(sdev)) + if (sdev->sdev_state == SDEV_DEL || + sdev->sdev_state == SDEV_CANCEL || + !get_device(&sdev->sdev_gendev)) continue; spin_unlock_irqrestore(shost->host_lock, flags); scsi_remove_device(sdev); -- 2.31.1

1 0

[OLK-5.10 0/2] Supports the feature of querying stats
by Chengchang Tang 01 Mar '23

01 Mar '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> 1.Support hns HW stats 2.Add dfx cnt stats Chengchang Tang (2): RDMA/hns: Support hns HW stats RDMA/hns: Add dfx cnt stats drivers/infiniband/hw/hns/hns_roce_ah.c | 8 +- drivers/infiniband/hw/hns/hns_roce_cmd.c | 17 ++- drivers/infiniband/hw/hns/hns_roce_cq.c | 17 ++- drivers/infiniband/hw/hns/hns_roce_device.h | 50 +++++++ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 59 ++++++++ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 1 + drivers/infiniband/hw/hns/hns_roce_main.c | 146 +++++++++++++++++++- drivers/infiniband/hw/hns/hns_roce_mr.c | 22 ++- drivers/infiniband/hw/hns/hns_roce_pd.c | 10 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 16 ++- drivers/infiniband/hw/hns/hns_roce_srq.c | 7 +- 11 files changed, 320 insertions(+), 33 deletions(-) -- 2.30.0

1 2

[PATCH openEuler-1.0-LTS 1/2] scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
by Yongqiang Liu 28 Feb '23

28 Feb '23

From: Mike Christie <michael.christie(a)oracle.com> mainline inclusion from mainline-v6.2-rc6~31 commit 6f1d64b13097e85abda0f91b5638000afc5f9a06 category: bugfix bugzilla: 188443, https://gitee.com/openeuler/kernel/issues/I6I8YD CVE: NA ---------------------------------------- Bug report and analysis from Ding Hui. During iSCSI session logout, if another task accesses the shost ipaddress attr, we can get a KASAN UAF report like this: [ 276.942144] BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x78/0xe0 [ 276.942535] Write of size 4 at addr ffff8881053b45b8 by task cat/4088 [ 276.943511] CPU: 2 PID: 4088 Comm: cat Tainted: G E 6.1.0-rc8+ #3 [ 276.943997] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 [ 276.944470] Call Trace: [ 276.944943] <TASK> [ 276.945397] dump_stack_lvl+0x34/0x48 [ 276.945887] print_address_description.constprop.0+0x86/0x1e7 [ 276.946421] print_report+0x36/0x4f [ 276.947358] kasan_report+0xad/0x130 [ 276.948234] kasan_check_range+0x35/0x1c0 [ 276.948674] _raw_spin_lock_bh+0x78/0xe0 [ 276.949989] iscsi_sw_tcp_host_get_param+0xad/0x2e0 [iscsi_tcp] [ 276.951765] show_host_param_ISCSI_HOST_PARAM_IPADDRESS+0xe9/0x130 [scsi_transport_iscsi] [ 276.952185] dev_attr_show+0x3f/0x80 [ 276.953005] sysfs_kf_seq_show+0x1fb/0x3e0 [ 276.953401] seq_read_iter+0x402/0x1020 [ 276.954260] vfs_read+0x532/0x7b0 [ 276.955113] ksys_read+0xed/0x1c0 [ 276.955952] do_syscall_64+0x38/0x90 [ 276.956347] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 276.956769] RIP: 0033:0x7f5d3a679222 [ 276.957161] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 32 c0 0b 00 e8 a5 fe 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 [ 276.958009] RSP: 002b:00007ffc864d16a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 276.958431] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5d3a679222 [ 276.958857] RDX: 0000000000020000 RSI: 00007f5d3a4fe000 RDI: 0000000000000003 [ 276.959281] RBP: 00007f5d3a4fe000 R08: 00000000ffffffff R09: 0000000000000000 [ 276.959682] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000020000 [ 276.960126] R13: 0000000000000003 R14: 0000000000000000 R15: 0000557a26dada58 [ 276.960536] </TASK> [ 276.961357] Allocated by task 2209: [ 276.961756] kasan_save_stack+0x1e/0x40 [ 276.962170] kasan_set_track+0x21/0x30 [ 276.962557] __kasan_kmalloc+0x7e/0x90 [ 276.962923] __kmalloc+0x5b/0x140 [ 276.963308] iscsi_alloc_session+0x28/0x840 [scsi_transport_iscsi] [ 276.963712] iscsi_session_setup+0xda/0xba0 [libiscsi] [ 276.964078] iscsi_sw_tcp_session_create+0x1fd/0x330 [iscsi_tcp] [ 276.964431] iscsi_if_create_session.isra.0+0x50/0x260 [scsi_transport_iscsi] [ 276.964793] iscsi_if_recv_msg+0xc5a/0x2660 [scsi_transport_iscsi] [ 276.965153] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi] [ 276.965546] netlink_unicast+0x4d5/0x7b0 [ 276.965905] netlink_sendmsg+0x78d/0xc30 [ 276.966236] sock_sendmsg+0xe5/0x120 [ 276.966576] ____sys_sendmsg+0x5fe/0x860 [ 276.966923] ___sys_sendmsg+0xe0/0x170 [ 276.967300] __sys_sendmsg+0xc8/0x170 [ 276.967666] do_syscall_64+0x38/0x90 [ 276.968028] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 276.968773] Freed by task 2209: [ 276.969111] kasan_save_stack+0x1e/0x40 [ 276.969449] kasan_set_track+0x21/0x30 [ 276.969789] kasan_save_free_info+0x2a/0x50 [ 276.970146] __kasan_slab_free+0x106/0x190 [ 276.970470] __kmem_cache_free+0x133/0x270 [ 276.970816] device_release+0x98/0x210 [ 276.971145] kobject_cleanup+0x101/0x360 [ 276.971462] iscsi_session_teardown+0x3fb/0x530 [libiscsi] [ 276.971775] iscsi_sw_tcp_session_destroy+0xd8/0x130 [iscsi_tcp] [ 276.972143] iscsi_if_recv_msg+0x1bf1/0x2660 [scsi_transport_iscsi] [ 276.972485] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi] [ 276.972808] netlink_unicast+0x4d5/0x7b0 [ 276.973201] netlink_sendmsg+0x78d/0xc30 [ 276.973544] sock_sendmsg+0xe5/0x120 [ 276.973864] ____sys_sendmsg+0x5fe/0x860 [ 276.974248] ___sys_sendmsg+0xe0/0x170 [ 276.974583] __sys_sendmsg+0xc8/0x170 [ 276.974891] do_syscall_64+0x38/0x90 [ 276.975216] entry_SYSCALL_64_after_hwframe+0x63/0xcd We can easily reproduce by two tasks: 1. while :; do iscsiadm -m node --login; iscsiadm -m node --logout; done 2. while :; do cat \ /sys/devices/platform/host*/iscsi_host/host*/ipaddress; done iscsid | cat --------------------------------+--------------------------------------- |- iscsi_sw_tcp_session_destroy | |- iscsi_session_teardown | |- device_release | |- iscsi_session_release ||- dev_attr_show |- kfree | |- show_host_param_ | ISCSI_HOST_PARAM_IPADDRESS | |- iscsi_sw_tcp_host_get_param | |- r/w tcp_sw_host->session (UAF) |- iscsi_host_remove | |- iscsi_host_free | Fix the above bug by splitting the session removal into 2 parts: 1. removal from iSCSI class which includes sysfs and removal from host tracking. 2. freeing of session. During iscsi_tcp host and session removal we can remove the session from sysfs then remove the host from sysfs. At this point we know userspace is not accessing the kernel via sysfs so we can free the session and host. Link: https://lore.kernel.org/r/20230117193937.21244-2-michael.christie@oracle.com Signed-off-by: Mike Christie <michael.christie(a)oracle.com> Reviewed-by: Lee Duncan <lduncan(a)suse.com> Acked-by: Ding Hui <dinghui(a)sangfor.com.cn> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/scsi/iscsi_tcp.c | 11 +++++++++-- drivers/scsi/libiscsi.c | 39 +++++++++++++++++++++++++++++++-------- include/scsi/libiscsi.h | 2 ++ 3 files changed, 42 insertions(+), 10 deletions(-) diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c index 241b1a310519..a5259fd39d6d 100644 --- a/drivers/scsi/iscsi_tcp.c +++ b/drivers/scsi/iscsi_tcp.c @@ -910,10 +910,17 @@ static void iscsi_sw_tcp_session_destroy(struct iscsi_cls_session *cls_session) if (WARN_ON_ONCE(session->leadconn)) return; + iscsi_session_remove(cls_session); + /* + * Our get_host_param needs to access the session, so remove the + * host from sysfs before freeing the session to make sure userspace + * is no longer accessing the callout. + */ + iscsi_host_remove(shost); + iscsi_tcp_r2tpool_free(cls_session->dd_data); - iscsi_session_teardown(cls_session); - iscsi_host_remove(shost); + iscsi_session_free(cls_session); iscsi_host_free(shost); } diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c index 9f625a4d53c0..72463874d7b4 100644 --- a/drivers/scsi/libiscsi.c +++ b/drivers/scsi/libiscsi.c @@ -3018,20 +3018,34 @@ iscsi_session_setup(struct iscsi_transport *iscsit, struct Scsi_Host *shost, } EXPORT_SYMBOL_GPL(iscsi_session_setup); +/* + * issi_session_remove - Remove session from iSCSI class. + */ +void iscsi_session_remove(struct iscsi_cls_session *cls_session) +{ + struct iscsi_session *session = cls_session->dd_data; + struct Scsi_Host *shost = session->host; + + iscsi_remove_session(cls_session); + /* + * host removal only has to wait for its children to be removed from + * sysfs, and iscsi_tcp needs to do iscsi_host_remove before freeing + * the session, so drop the session count here. + */ + iscsi_host_dec_session_cnt(shost); +} +EXPORT_SYMBOL_GPL(iscsi_session_remove); + /** - * iscsi_session_teardown - destroy session, host, and cls_session + * iscsi_session_free - Free iscsi session and it's resources * @cls_session: iscsi session */ -void iscsi_session_teardown(struct iscsi_cls_session *cls_session) +void iscsi_session_free(struct iscsi_cls_session *cls_session) { struct iscsi_session *session = cls_session->dd_data; struct module *owner = cls_session->transport->owner; - struct Scsi_Host *shost = session->host; iscsi_pool_free(&session->cmdpool); - - iscsi_remove_session(cls_session); - kfree(session->password); kfree(session->password_in); kfree(session->username); @@ -3047,10 +3061,19 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session) kfree(session->discovery_parent_type); iscsi_free_session(cls_session); - - iscsi_host_dec_session_cnt(shost); module_put(owner); } +EXPORT_SYMBOL_GPL(iscsi_session_free); + +/** + * iscsi_session_teardown - destroy session and cls_session + * @cls_session: iscsi session + */ +void iscsi_session_teardown(struct iscsi_cls_session *cls_session) +{ + iscsi_session_remove(cls_session); + iscsi_session_free(cls_session); +} EXPORT_SYMBOL_GPL(iscsi_session_teardown); /** diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h index 254e72b46d10..2a8d1de70290 100644 --- a/include/scsi/libiscsi.h +++ b/include/scsi/libiscsi.h @@ -425,6 +425,8 @@ extern int iscsi_host_get_max_scsi_cmds(struct Scsi_Host *shost, extern struct iscsi_cls_session * iscsi_session_setup(struct iscsi_transport *, struct Scsi_Host *shost, uint16_t, int, int, uint32_t, unsigned int); +void iscsi_session_remove(struct iscsi_cls_session *cls_session); +void iscsi_session_free(struct iscsi_cls_session *cls_session); extern void iscsi_session_teardown(struct iscsi_cls_session *); extern void iscsi_session_recovery_timedout(struct iscsi_cls_session *); extern int iscsi_set_param(struct iscsi_cls_conn *cls_conn, -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] pciehp: fix the problem that the slot is powered on again after being powered off
by jiazhenyuan＠uniontech.com 28 Feb '23

28 Feb '23

From: jiazhenyuan <jiazhenyuan(a)uniontech.com> mainline inclusion from mainline-4.19-lts commit 32a8cef274feacd00b748a4f13b84d60aa6d82ff category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6ICDL CVE: NA ---------------------------------------- The DISABLE_SLOT event is lost when the slot is powered off. Signed-off-by: jiazhenyuan <jiazhenyuan(a)uniontech.com> --- drivers/pci/hotplug/pciehp_ctrl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c index 2d549c97ac42..dd67dc540279 100644 --- a/drivers/pci/hotplug/pciehp_ctrl.c +++ b/drivers/pci/hotplug/pciehp_ctrl.c @@ -463,6 +463,7 @@ int pciehp_sysfs_disable_slot(struct slot *p_slot) mutex_unlock(&p_slot->lock); pci_config_pm_runtime_get(pdev); down_read(&ctrl->reset_lock); + atomic_or(DISABLE_SLOT, &ctrl->pending_events); pciehp_handle_disable_request(p_slot); up_read(&ctrl->reset_lock); pci_config_pm_runtime_put(pdev); -- 2.27.0

1 0

[PATCH openEuler-1.0-LTS] net: mpls: fix stale pointer if allocation fails during device rename
by Yongqiang Liu 28 Feb '23

28 Feb '23

From: Jakub Kicinski <kuba(a)kernel.org> stable inclusion from stable-v4.19.273 commit aa07c86e43ed8780d610ecfb2ce13da326729201 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6HZHU CVE: CVE-2023-26545 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fda6c89fe3d9aca073495a664e1d5aea28cd4377 upstream. lianhui reports that when MPLS fails to register the sysctl table under new location (during device rename) the old pointers won't get overwritten and may be freed again (double free). Handle this gracefully. The best option would be unregistering the MPLS from the device completely on failure, but unfortunately mpls_ifdown() can fail. So failing fully is also unreliable. Another option is to register the new table first then only remove old one if the new one succeeds. That requires more code, changes order of notifications and two tables may be visible at the same time. sysctl point is not used in the rest of the code - set to NULL on failures and skip unregister if already NULL. Reported-by: lianhui tang <bluetlh(a)gmail.com> Fixes: 0fae3bf018d9 ("mpls: handle device renames for per-device sysctls") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/mpls/af_mpls.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c index 7623d9aec636..c7fd387baa61 100644 --- a/net/mpls/af_mpls.c +++ b/net/mpls/af_mpls.c @@ -1375,6 +1375,7 @@ static int mpls_dev_sysctl_register(struct net_device *dev, free: kfree(table); out: + mdev->sysctl = NULL; return -ENOBUFS; } @@ -1384,6 +1385,9 @@ static void mpls_dev_sysctl_unregister(struct net_device *dev, struct net *net = dev_net(dev); struct ctl_table *table; + if (!mdev->sysctl) + return; + table = mdev->sysctl->ctl_table_arg; unregister_net_sysctl_table(mdev->sysctl); kfree(table); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS-SP1] net: mpls: fix stale pointer if allocation fails during device rename
by Jialin Zhang 28 Feb '23

28 Feb '23

From: Jakub Kicinski <kuba(a)kernel.org> stable inclusion from stable-v5.10.169 commit 7ff0fdba82298d1f456c685e24930da89703c0fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6HZHU CVE: CVE-2023-26545 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fda6c89fe3d9aca073495a664e1d5aea28cd4377 upstream. lianhui reports that when MPLS fails to register the sysctl table under new location (during device rename) the old pointers won't get overwritten and may be freed again (double free). Handle this gracefully. The best option would be unregistering the MPLS from the device completely on failure, but unfortunately mpls_ifdown() can fail. So failing fully is also unreliable. Another option is to register the new table first then only remove old one if the new one succeeds. That requires more code, changes order of notifications and two tables may be visible at the same time. sysctl point is not used in the rest of the code - set to NULL on failures and skip unregister if already NULL. Reported-by: lianhui tang <bluetlh(a)gmail.com> Fixes: 0fae3bf018d9 ("mpls: handle device renames for per-device sysctls") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- net/mpls/af_mpls.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c index 72398149e4d4..1dcbdab9319b 100644 --- a/net/mpls/af_mpls.c +++ b/net/mpls/af_mpls.c @@ -1427,6 +1427,7 @@ static int mpls_dev_sysctl_register(struct net_device *dev, free: kfree(table); out: + mdev->sysctl = NULL; return -ENOBUFS; } @@ -1436,6 +1437,9 @@ static void mpls_dev_sysctl_unregister(struct net_device *dev, struct net *net = dev_net(dev); struct ctl_table *table; + if (!mdev->sysctl) + return; + table = mdev->sysctl->ctl_table_arg; unregister_net_sysctl_table(mdev->sysctl); kfree(table); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 01/50] Revert "[Huawei] io_uring:drop identity before creating a private one"
by Jialin Zhang 28 Feb '23

28 Feb '23

From: Li Lingfeng <lilingfeng3(a)huawei.com> Offering: HULK hulk inclusion category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6BTWC ------------------------------- This reverts commit ab45921343c63dc9d461740e23003098697e0333. We need to apply patch 788d0824269bef (io_uring: import 5.15-stable io_uring) to move io_uring to separate directory and solve the problem of CVE-2023-0240. This patch fix a uaf problem of io_identity, and it can be reverted since io_identity is removed in patch 788d0824269bef. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/io_uring.c | 42 ------------------------------------------ 1 file changed, 42 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 4ace89ae4832..2397c2a1d919 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1364,47 +1364,6 @@ static bool io_identity_cow(struct io_kiocb *req) return true; } -static void io_drop_identity(struct io_kiocb *req) -{ - struct io_identity *id = req->work.identity; - - if (req->work.flags & IO_WQ_WORK_MM) { - mmdrop(id->mm); - req->work.flags &= ~IO_WQ_WORK_MM; - } -#ifdef CONFIG_BLK_CGROUP - if (req->work.flags & IO_WQ_WORK_BLKCG) { - css_put(id->blkcg_css); - req->work.flags &= ~IO_WQ_WORK_BLKCG; - } -#endif - if (req->work.flags & IO_WQ_WORK_CREDS) { - put_cred(id->creds); - req->work.flags &= ~IO_WQ_WORK_CREDS; - } - if (req->work.flags & IO_WQ_WORK_FILES) { - put_files_struct(req->work.identity->files); - put_nsproxy(req->work.identity->nsproxy); - req->work.flags &= ~IO_WQ_WORK_FILES; - } - if (req->work.flags & IO_WQ_WORK_CANCEL) - req->work.flags &= ~IO_WQ_WORK_CANCEL; - if (req->work.flags & IO_WQ_WORK_FS) { - struct fs_struct *fs = id->fs; - - spin_lock(&id->fs->lock); - if (--fs->users) - fs = NULL; - spin_unlock(&id->fs->lock); - - if (fs) - free_fs_struct(fs); - req->work.flags &= ~IO_WQ_WORK_FS; - } - if (req->work.flags & IO_WQ_WORK_FSIZE) - req->work.flags &= ~IO_WQ_WORK_FSIZE; -} - static bool io_grab_identity(struct io_kiocb *req) { const struct io_op_def *def = &io_op_defs[req->opcode]; @@ -1510,7 +1469,6 @@ static void io_prep_async_work(struct io_kiocb *req) if (io_grab_identity(req)) return; - io_drop_identity(req); if (!io_identity_cow(req)) return; -- 2.25.1

1 49

[PATCH openEuler-5.10-LTS-SP1 01/52] Revert "[Huawei] io_uring:drop identity before creating a private one"
by Jialin Zhang 28 Feb '23

28 Feb '23

From: Li Lingfeng <lilingfeng3(a)huawei.com> Offering: HULK hulk inclusion category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6BTWC ------------------------------- This reverts commit 6d9aaec1edb197ca7e05873c1930c418b7ecaa1e. We need to apply patch 788d0824269bef (io_uring: import 5.15-stable io_uring) to move io_uring to separate directory and solve the problem of CVE-2023-0240. This patch fix a uaf problem of io_identity, and it can be reverted since io_identity is removed in patch 788d0824269bef. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/io_uring.c | 42 ------------------------------------------ 1 file changed, 42 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 21adb7ff7b2e..adb8fcef738a 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1364,47 +1364,6 @@ static bool io_identity_cow(struct io_kiocb *req) return true; } -static void io_drop_identity(struct io_kiocb *req) -{ - struct io_identity *id = req->work.identity; - - if (req->work.flags & IO_WQ_WORK_MM) { - mmdrop(id->mm); - req->work.flags &= ~IO_WQ_WORK_MM; - } -#ifdef CONFIG_BLK_CGROUP - if (req->work.flags & IO_WQ_WORK_BLKCG) { - css_put(id->blkcg_css); - req->work.flags &= ~IO_WQ_WORK_BLKCG; - } -#endif - if (req->work.flags & IO_WQ_WORK_CREDS) { - put_cred(id->creds); - req->work.flags &= ~IO_WQ_WORK_CREDS; - } - if (req->work.flags & IO_WQ_WORK_FILES) { - put_files_struct(req->work.identity->files); - put_nsproxy(req->work.identity->nsproxy); - req->work.flags &= ~IO_WQ_WORK_FILES; - } - if (req->work.flags & IO_WQ_WORK_CANCEL) - req->work.flags &= ~IO_WQ_WORK_CANCEL; - if (req->work.flags & IO_WQ_WORK_FS) { - struct fs_struct *fs = id->fs; - - spin_lock(&id->fs->lock); - if (--fs->users) - fs = NULL; - spin_unlock(&id->fs->lock); - - if (fs) - free_fs_struct(fs); - req->work.flags &= ~IO_WQ_WORK_FS; - } - if (req->work.flags & IO_WQ_WORK_FSIZE) - req->work.flags &= ~IO_WQ_WORK_FSIZE; -} - static bool io_grab_identity(struct io_kiocb *req) { const struct io_op_def *def = &io_op_defs[req->opcode]; @@ -1510,7 +1469,6 @@ static void io_prep_async_work(struct io_kiocb *req) if (io_grab_identity(req)) return; - io_drop_identity(req); if (!io_identity_cow(req)) return; -- 2.25.1

1 51

[PATCH openEuler-1.0-LTS 1/3] selinux: further adjust init order for file_alloc_security hook
by Yongqiang Liu 27 Feb '23

27 Feb '23

From: "GONG, Ruiqi" <gongruiqi1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6DRJ1 CVE: NA ---------------------------------------- After backporting commit cfff75d8973a ("selinux: reorder hooks to make runtime disable less broken") to the 4.19 kernel of openEuler-1.0-LTS, another kernel panic was triggered by running the POC of the aforementioned commit: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 PGD 800000001840b067 P4D 800000001840b067 PUD 1840c067 PMD 0 Oops: 0002 [#1] SMP PTI CPU: 7 PID: 273 Comm: exe Tainted: G OE 4.19.90+ #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:selinux_file_open+0x49/0xf0 Code: 00 00 00 65 48 8b 04 25 28 00 00 00 48 89 44 24 20 31 c0 4c 89 e7 e8 a6 ec ff ff 49 8b 44 24 38 48 c7 c7 e0 a5 13 97 8b 40 1c <89> 45 08 e8 6f 80 ff ff ba 02 00 00 00 89 45 0c 8b 43 44 8b 73 40 RSP: 0018:ffffbb7300867ba0 EFLAGS: 00010246 RAX: 0000000000000003 RBX: ffff9dc301961400 RCX: 00000000000081ed RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff9713a5e0 RBP: 0000000000000000 R08: 0000000000000001 R09: ffff9dc301fedcb0 R10: 0000000000000007 R11: 7fffffffffffffff R12: ffff9dc30204fd70 R13: 0000000000000000 R14: ffff9dc301961410 R15: ffffbb7300867c70 FS: 0000000000d258c0(0000) GS:ffff9dc33e9c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 00000000022bc000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? generic_permission+0x10a/0x190 security_file_open+0x26/0x90 do_dentry_open+0xd9/0x380 do_last+0x197/0x8d0 path_openat+0x89/0x280 do_filp_open+0x91/0x100 do_open_execat+0x79/0x180 __do_execve_file.isra.0+0x6dd/0x8b0 __x64_sys_execve+0x35/0x40 do_syscall_64+0x63/0x250 ? async_page_fault+0x8/0x30 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x49a5db Code: 41 89 01 eb da 66 2e 0f 1f 84 00 00 00 00 00 f7 d8 64 41 89 01 eb d6 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 3b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe7b1cebd8 EFLAGS: 00000246 ORIG_RAX: 000000000000003b RAX: ffffffffffffffda RBX: 0000000000d27ee0 RCX: 000000000049a5db RDX: 0000000000d27f08 RSI: 0000000000d27ee0 RDI: 0000000000d27f48 RBP: 0000000000d27f48 R08: fefefefefefefeff R09: fefefeff666d686f R10: 0000000000d25b90 R11: 0000000000000246 R12: 0000000000d27f08 R13: 0000000000655894 R14: 0000000000d27f08 R15: 0000000000d26ed0 Modules linked in: e1000(OE) CR2: 0000000000000008 ---[ end trace e4eb884974c22e2d ]--- RIP: 0010:selinux_file_open+0x49/0xf0 Code: 00 00 00 65 48 8b 04 25 28 00 00 00 48 89 44 24 20 31 c0 4c 89 e7 e8 a6 ec ff ff 49 8b 44 24 38 48 c7 c7 e0 a5 13 97 8b 40 1c <89> 45 08 e8 6f 80 ff ff ba 02 00 00 00 89 45 0c 8b 43 44 8b 73 40 RSP: 0018:ffffbb7300867ba0 EFLAGS: 00010246 RAX: 0000000000000003 RBX: ffff9dc301961400 RCX: 00000000000081ed RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff9713a5e0 RBP: 0000000000000000 R08: 0000000000000001 R09: ffff9dc301fedcb0 R10: 0000000000000007 R11: 7fffffffffffffff R12: ffff9dc30204fd70 R13: 0000000000000000 R14: ffff9dc301961410 R15: ffffbb7300867c70 FS: 0000000000d258c0(0000) GS:ffff9dc33e9c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 00000000022bc000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x14400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception ]--- The problem was caused by selinux_file_open() accessing a file's fsec being NULL, which indicated that the file_alloc_security hook should be deleted later (at least after the file_open hook) when disabling SELinux at runtime. Here I put it into the "allocating" part. Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- security/selinux/hooks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index cd26c1199353..85ac12d6b2f4 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -7040,7 +7040,6 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr), LSM_HOOK_INIT(file_permission, selinux_file_permission), - LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security), LSM_HOOK_INIT(file_free_security, selinux_file_free_security), LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl), LSM_HOOK_INIT(mmap_file, selinux_mmap_file), @@ -7207,6 +7206,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security), LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security), LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security), + LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security), LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank), LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security), LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx), -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS 1/1] nbd: fix assignment error for first_minor in nbd_dev_add
by Yongqiang Liu 25 Feb '23

25 Feb '23

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188413, https://gitee.com/openeuler/kernel/issues/I6GWYG CVE: NA ---------------------------------------- A panic error is like below: nbd_genl_connect nbd_dev_add first_minor = index << part_shift; // index =-1 ... __device_add_disk blk_alloc_devt *devt = MKDEV(disk->major, disk->first_minor + part->partno); // part->partno = 0， first_minor = 11...110000 major is covered There, index < 0 will reassign an index, but here disk->first_minor is assigned -1 << part_shift. This causes to the creation of the device with the same major and minor device numbers each time the incoming index<0, and this will lead to creation of kobject failed: Warning: kobject_add_internal failed for 4095:1048544 with -EEXIST, don't try to register things with the same name in the same directory. Fix it by moving the first_minor assignment down to after getting the new index. Fixes: 01f7594e62e9 ("nbd: Fix use-after-free in blk_mq_free_rqs") Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/block/nbd.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 8dbbd676d275..551b2f7da8ef 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1706,7 +1706,6 @@ static int nbd_dev_add(int index) struct gendisk *disk; struct request_queue *q; int err = -ENOMEM; - int first_minor = index << part_shift; nbd = kzalloc(sizeof(struct nbd_device), GFP_KERNEL); if (!nbd) @@ -1770,7 +1769,7 @@ static int nbd_dev_add(int index) refcount_set(&nbd->refs, 1); INIT_LIST_HEAD(&nbd->list); disk->major = NBD_MAJOR; - disk->first_minor = first_minor; + disk->first_minor = index << part_shift; disk->fops = &nbd_fops; disk->private_data = nbd; sprintf(disk->disk_name, "nbd%d", index); -- 2.25.1

2 1

openEuler缺陷issue处理流程_修正
by zhangjialin (F) 23 Feb '23

23 Feb '23

1 0

openEuler缺陷issue处理流程图
by zhangjialin (F) 23 Feb '23

23 Feb '23

1 0

[PATCH openEuler-1.0-LTS 00/13] mainline bugfix backport
by Yongqiang Liu 23 Feb '23

23 Feb '23

*** BLURB HERE *** Andy Shevchenko (1): ipmi: use %*ph to print small buffer Dan Carpenter (1): evm: Fix a small race in init_desc() Eric Biggers (1): crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() Greg Kroah-Hartman (1): iommu: Properly export iommu_group_get_for_dev() Herbert Xu (2): crypto: algif_skcipher - EBUSY on aio should be an error crypto: algif_skcipher - Use chunksize instead of blocksize Lubomir Rintel (1): component: do not dereference opaque pointer in debugfs Nishka Dasgupta (2): of: unittest: Add of_node_put() before return of: resolver: Add of_node_put() before return and break Ondrej Mosnacek (1): selinux: reorder hooks to make runtime disable less broken Roberto Sassu (1): evm: Check also if *tfm is an error pointer in init_desc() Will Deacon (2): drivers/iommu: Export core IOMMU API symbols to permit modular drivers drivers/iommu: Allow IOMMU bus ops to be unregistered crypto/algif_skcipher.c | 4 +- crypto/rsa-pkcs1pad.c | 2 + drivers/base/component.c | 8 +-- drivers/char/ipmi/ipmi_msghandler.c | 27 ++------- drivers/iommu/iommu-sysfs.c | 5 ++ drivers/iommu/iommu.c | 12 ++++ drivers/of/resolver.c | 12 +++- drivers/of/unittest.c | 4 +- security/integrity/evm/evm_crypto.c | 45 +++++++------- security/selinux/hooks.c | 93 ++++++++++++++++++++--------- 10 files changed, 129 insertions(+), 83 deletions(-) -- 2.25.1

1 13

openEuler缺陷issue处理流程
by zhangjialin (F) 23 Feb '23

23 Feb '23

1 0

议题征集//答复: openEuler Kernel SIG双周例会
by liaotao (C) 23 Feb '23

23 Feb '23

当前例会议题：议题一：进展update（10min） -- 张伽琳 & 郑增凯议题二：openeuler 实时内核（PREEMPT_RT）规划讨论 --丁翔欢迎大家继续申报~ -----原始约会----- 发件人: openEuler conference <public(a)openeuler.org> 发送时间: 2023年2月21日 10:06 收件人: dev@openeuler.org,kernel-discuss@openeuler.org,kernel@openeuler.org 主题: openEuler Kernel SIG双周例会时间: 2023年2月24日星期五 14:00-15:30(UTC+08:00) 北京，重庆，香港特别行政区，乌鲁木齐。地点: 您好！ Kernel SIG 邀请您参加 2023-02-24 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容：欢迎您参加Kernel SIG双周例会，当前议题： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/82111503728?pwd=TWRGa2REc0V2ZmlGZ2ZreUF1OXA3dz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-02-24 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 欢迎您参加Kernel SIG双周例会，当前议题： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/82111503728?pwd=TWRGa2REc0V2ZmlGZ2ZreUF1OXA3dz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0