- Kernel - mailweb.openeuler.org

[PATCH openEuler-5.10-LTS 01/10] bpf: Don't redirect packets with invalid pkt_len
by Zheng Zengkai 26 Jul '22

26 Jul '22

From: Zhengchao Shao <shaozhengchao(a)huawei.com> mainline inclusion from mainline-v5.19-rc6 commit fd1894224407c484f652ad456e1ce423e89bb3eb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5HWKR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id… -------------------------------- Syzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any skbs, that is, the flow->head is null. The root cause, as the [2] says, is because that bpf_prog_test_run_skb() run a bpf prog which redirects empty skbs. So we should determine whether the length of the packet modified by bpf prog or others like bpf_prog_test is valid before forwarding it directly. LINK: [1] https://syzkaller.appspot.com/bug?id=0b84da80c2917757915afa89f7738a9d16ec96… LINK: [2] https://www.spinics.net/lists/netdev/msg777503.html Reported-by: syzbot+7a12909485b94426aceb(a)syzkaller.appspotmail.com Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Stanislav Fomichev <sdf(a)google.com> Link: https://lore.kernel.org/r/20220715115559.139691-1-shaozhengchao@huawei.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/skbuff.h | 8 ++++++++ net/bpf/test_run.c | 3 +++ net/core/dev.c | 1 + 3 files changed, 12 insertions(+) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index e5f61bdd42a8..6dae09f22c5a 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2251,6 +2251,14 @@ static inline void skb_set_tail_pointer(struct sk_buff *skb, const int offset) #endif /* NET_SKBUFF_DATA_USES_OFFSET */ +static inline void skb_assert_len(struct sk_buff *skb) +{ +#ifdef CONFIG_DEBUG_NET + if (WARN_ONCE(!skb->len, "%s\n", __func__)) + DO_ONCE_LITE(skb_dump, KERN_ERR, skb, false); +#endif /* CONFIG_DEBUG_NET */ +} + /* * Add data to an sk_buff */ diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index 99712d35e535..f266a9453c8e 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -398,6 +398,9 @@ static int convert___skb_to_skb(struct sk_buff *skb, struct __sk_buff *__skb) { struct qdisc_skb_cb *cb = (struct qdisc_skb_cb *)skb->cb; + if (!skb->len) + return -EINVAL; + if (!__skb) return 0; diff --git a/net/core/dev.c b/net/core/dev.c index 12089c484b30..8e4de36eede8 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -4094,6 +4094,7 @@ static int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev) bool again = false; skb_reset_mac_header(skb); + skb_assert_len(skb); if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_SCHED_TSTAMP)) __skb_tstamp_tx(skb, NULL, skb->sk, SCM_TSTAMP_SCHED); -- 2.20.1

1 9

[PATCH openEuler-5.10-LTS 00/81] Backport 5.10.113 LTS
by Zheng Zengkai 26 Jul '22

26 Jul '22

Backport 5.10.113 LTS patches from upstream. git cherry-pick v5.10.112..v5.10.113~1 -s Complicts: Already merged(-5): 43ce33a68e2b net/sched: cls_u32: fix netns refcount changes in u32_change() d29c78d3f9c5 dm: fix mempool NULL pointer race when completing IO a46b3d849864 ext4: fix symlink file size not match to file content 75ac724684b7 ext4: fix use-after-free in ext4_search_dir 572761645b88 jbd2: fix a potential race while discarding reserved buffers after an abort Context conflict(2): 49516e6ed914 ipv6: make ip6_rt_gc_expire an atomic_t 6b932920b96f mm, hugetlb: allow for "high" userspace addresses Implement changed(1, cherry-picked from mainline): ce33c845b030c tracing: Dump stacktrace trigger to the corresponding instance Defered(-1, kabi changed): ed5d4efb4df1 oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup kabi fixed(+1): ipv6: fix kabi for ip6_rt_gc_expire in struct netns_ipv6 Total patches: 86 - 5 - 1 + 1 = 81 Adrian Hunter (1): perf tools: Fix segfault accessing sample_id xyarray Alexey Kardashevskiy (1): KVM: PPC: Fix TCE handling for VFIO Alistair Popple (1): mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() Allen-KH Cheng (1): spi: spi-mtk-nor: initialize spi controller after resume Anshuman Khandual (1): arm64/mm: Remove [PUD|PMD]_TABLE_BIT from [pud|pmd]_bad() Athira Rajeev (1): powerpc/perf: Fix power9 event alternatives Bob Peterson (1): gfs2: assign rgrp glock before compute_bitstructs Borislav Petkov (3): ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant mt76: Fix undefined behavior due to shift overflowing the constant brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant Christoph Hellwig (2): nvme: add a quirk to disable namespace identifiers nvme-pci: disable namespace identifiers for Qemu controllers Christophe Leroy (1): mm, hugetlb: allow for "high" userspace addresses Daniel Bristot de Oliveira (1): tracing: Dump stacktrace trigger to the corresponding instance Darrick J. Wong (1): ext4: fix fallocate to use file_modified to update permissions consistently Dave Jiang (2): dmaengine: idxd: add RO check for wq max_batch_size write dmaengine: idxd: add RO check for wq max_transfer_size write Dave Stevenson (2): drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare David Ahern (1): l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu David Howells (2): rxrpc: Restore removed timer deletion cifs: Check the IOCB_DIRECT flag, not O_DIRECT Eric Dumazet (3): net/sched: cls_u32: fix possible leak in u32_init_knode() ipv6: make ip6_rt_gc_expire an atomic_t netlink: reset network and mac headers in netlink_dump() Guo Ren (1): xtensa: patch_text: Fixup last cpu should be master Hangbin Liu (1): net/packet: fix packet_sock xmit return value checking Hongbin Wang (1): vxlan: fix error return code in vxlan_fdb_append Ido Schimmel (1): selftests: mlxsw: vxlan_flooding: Prevent flooding of unwanted packets Jiapeng Chong (1): platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative Kai-Heng Feng (1): net: atlantic: Avoid out-of-bounds indexing Kees Cook (2): etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead ARM: vexpress/spc: Avoid negative array index when !SMP Kevin Hao (1): net: stmmac: Use readl_poll_timeout_atomic() in atomic state Khazhismel Kumykov (1): block/compat_ioctl: fix range check in BLKGETSIZE Lee Jones (1): staging: ion: Prevent incorrect reference counting behavour Leo Yan (1): perf report: Set PERF_SAMPLE_DATA_SRC bit for Arm SPE event Lv Ruyi (1): dpaa_eth: Fix missing of_node_put in dpaa_get_ts_info() Manuel Ullmann (1): net: atlantic: invert deep par in pm functions, preventing null derefs Marek Vasut (1): Revert "net: micrel: fix KS8851_MLL Kconfig" Mario Limonciello (1): gpio: Request interrupts after IRQ is initialized Mark Brown (1): ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek Max Filippov (1): xtensa: fix a7 clobbering in coprocessor context load/store Miaoqian Lin (3): ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component dmaengine: imx-sdma: Fix error checking in sdma_event_remap drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage Mike Christie (1): scsi: qedi: Fix failed disconnect handling Mikulas Patocka (1): stat: fix inconsistency between struct stat and struct compat_stat Muchun Song (1): arm64: mm: fix p?d_leaf() Oliver Hartkopp (1): can: isotp: stop timeout monitoring when no first frame was sent Paolo Valerio (1): openvswitch: fix OOB access in reserve_sfa_size() Peilin Ye (2): ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit() ip6_gre: Fix skb_under_panic in __gre6_xmit() Rob Herring (2): arm64: dts: imx: Fix imx8*-var-som touchscreen property sizes arm_pmu: Validate single/group leader events Sabrina Dubroca (1): esp: limit skb_page_frag_refill use to a single page Sameer Pujar (1): reset: tegra-bpmp: Restore Handle errors in BPMP response Sasha Neftin (3): igc: Fix infinite loop in release_swfw_sync igc: Fix BUG: scheduling while atomic e1000e: Fix possible overflow in LTR decoding Sergey Matyukevich (1): ARC: entry: fix syscall_trace_exit argument Shubhrajyoti Datta (1): EDAC/synopsys: Read the error count from the correct register Srinivas Kandagatla (1): ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use Tadeusz Struk (1): ext4: limit length to bitmap_maxbytes - blocksize in punch_hole Takashi Iwai (1): ALSA: usb-audio: Clear MIDI port active flag after draining Theodore Ts'o (2): ext4: fix overhead calculation to account for the reserved gdt blocks ext4: force overhead calculation if the s_overhead_cluster makes no sense Tim Crawford (1): ALSA: hda/realtek: Add quirk for Clevo NP70PNP Tomas Melin (1): net: macb: Restart tx only if queue pointer is lagging Tony Lu (1): net/smc: Fix sock leak when release after smc_shutdown() Tudor Ambarus (1): spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller Xiaoke Wang (1): drm/msm/mdp5: check the return of kzalloc() Xiaomeng Tong (2): dma: at_xdmac: fix a missing check on list iterator ASoC: soc-dapm: fix two incorrect uses of list iterator Xiongwei Song (1): mm: page_alloc: fix building error on -Werror=array-compare Xu Jia (1): ipv6: fix kabi for ip6_rt_gc_expire in struct netns_ipv6 Zheyu Ma (1): ata: pata_marvell: Check the 'bmdma_addr' beforing reading Zhipeng Xie (1): perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled kuyo chang (1): sched/pelt: Fix attach_entity_load_avg() corner case wangjianjian (C) (1): ext4, doc: fix incorrect h_reserved size zhangqilong (1): dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resources Documentation/filesystems/ext4/attributes.rst | 2 +- arch/arc/kernel/entry.S | 1 + arch/arm/mach-vexpress/spc.c | 2 +- .../boot/dts/freescale/imx8mm-var-som.dtsi | 8 +-- .../boot/dts/freescale/imx8mn-var-som.dtsi | 8 +-- arch/arm64/include/asm/pgtable.h | 9 ++- arch/powerpc/kvm/book3s_64_vio.c | 45 ++++++------ arch/powerpc/kvm/book3s_64_vio_hv.c | 44 ++++++------ arch/powerpc/perf/power9-pmu.c | 8 +-- arch/x86/include/asm/compat.h | 6 +- arch/xtensa/kernel/coprocessor.S | 4 +- arch/xtensa/kernel/jump_label.c | 2 +- block/ioctl.c | 2 +- drivers/ata/pata_marvell.c | 2 + drivers/dma/at_xdmac.c | 12 ++-- drivers/dma/idxd/sysfs.c | 6 ++ drivers/dma/imx-sdma.c | 4 +- drivers/dma/mediatek/mtk-uart-apdma.c | 9 ++- drivers/edac/synopsys_edac.c | 16 +++-- drivers/gpio/gpiolib.c | 4 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 3 + .../drm/panel/panel-raspberrypi-touchscreen.c | 13 +++- drivers/gpu/drm/vc4/vc4_dsi.c | 2 +- .../net/ethernet/aquantia/atlantic/aq_nic.c | 8 +-- .../ethernet/aquantia/atlantic/aq_pci_func.c | 8 +-- .../net/ethernet/aquantia/atlantic/aq_vec.c | 24 +++---- drivers/net/ethernet/cadence/macb_main.c | 8 +++ .../ethernet/freescale/dpaa/dpaa_ethtool.c | 8 ++- drivers/net/ethernet/intel/e1000e/ich8lan.c | 4 +- drivers/net/ethernet/intel/igc/igc_i225.c | 11 ++- drivers/net/ethernet/intel/igc/igc_phy.c | 4 +- drivers/net/ethernet/micrel/Kconfig | 1 - .../ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 4 +- drivers/net/vxlan.c | 4 +- .../broadcom/brcm80211/brcmfmac/sdio.c | 2 +- .../net/wireless/mediatek/mt76/mt76x2/pci.c | 2 +- drivers/nvme/host/core.c | 24 +++++-- drivers/nvme/host/nvme.h | 5 ++ drivers/nvme/host/pci.c | 5 +- drivers/perf/arm_pmu.c | 10 ++- drivers/platform/x86/samsung-laptop.c | 2 - drivers/reset/tegra/reset-bpmp.c | 9 ++- drivers/scsi/qedi/qedi_iscsi.c | 69 +++++++++---------- drivers/spi/atmel-quadspi.c | 3 + drivers/spi/spi-mtk-nor.c | 12 +++- drivers/staging/android/ion/ion.c | 3 + fs/cifs/cifsfs.c | 2 +- fs/ext4/ext4.h | 2 +- fs/ext4/extents.c | 32 +++++++-- fs/ext4/inode.c | 18 ++++- fs/ext4/super.c | 19 +++-- fs/gfs2/rgrp.c | 9 +-- fs/hugetlbfs/inode.c | 9 +-- fs/stat.c | 19 ++--- include/linux/etherdevice.h | 5 +- include/linux/sched/mm.h | 8 +++ include/net/esp.h | 2 - include/net/netns/ipv6.h | 4 +- kernel/events/core.c | 2 +- kernel/events/internal.h | 5 ++ kernel/events/ring_buffer.c | 5 -- kernel/sched/fair.c | 10 +-- kernel/trace/trace_events_trigger.c | 7 +- mm/mmap.c | 8 --- mm/mmu_notifier.c | 14 +++- mm/page_alloc.c | 2 +- net/can/isotp.c | 10 ++- net/ipv4/esp4.c | 5 +- net/ipv6/esp6.c | 5 +- net/ipv6/ip6_gre.c | 14 ++-- net/ipv6/route.c | 11 +-- net/l3mdev/l3mdev.c | 2 +- net/netlink/af_netlink.c | 7 ++ net/openvswitch/flow_netlink.c | 2 +- net/packet/af_packet.c | 13 ++-- net/rxrpc/net_ns.c | 2 + net/sched/cls_u32.c | 8 +-- net/smc/af_smc.c | 4 +- sound/pci/hda/patch_realtek.c | 1 + sound/soc/atmel/sam9g20_wm8731.c | 61 ---------------- sound/soc/codecs/msm8916-wcd-digital.c | 9 ++- sound/soc/codecs/wcd934x.c | 26 +------ sound/soc/soc-dapm.c | 6 +- sound/usb/midi.c | 1 + sound/usb/usbaudio.h | 2 +- tools/lib/perf/evlist.c | 3 +- tools/perf/builtin-report.c | 14 ++++ .../drivers/net/mlxsw/vxlan_flooding.sh | 17 +++++ 88 files changed, 485 insertions(+), 362 deletions(-) -- 2.20.1

1 81

[PATCH openEuler-1.0-LTS] perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()
by Yongqiang Liu 26 Jul '22

26 Jul '22

From: Yang Jihong <yangjihong1(a)huawei.com> mainline inclusion from mainline-v5.19-rc7 commit 68e3c69803dada336893640110cb87221bb01dcf category: bugfix bugzilla: 187299, https://gitee.com/src-openeuler/kernel/issues/I5ISXP CVE: NA -------------------------------- Yang Jihing reported a race between perf_event_set_output() and perf_mmap_close(): CPU1 CPU2 perf_mmap_close(e2) if (atomic_dec_and_test(&e2->rb->mmap_count)) // 1 - > 0 detach_rest = true ioctl(e1, IOC_SET_OUTPUT, e2) perf_event_set_output(e1, e2) ... list_for_each_entry_rcu(e, &e2->rb->event_list, rb_entry) ring_buffer_attach(e, NULL); // e1 isn't yet added and // therefore not detached ring_buffer_attach(e1, e2->rb) list_add_rcu(&e1->rb_entry, &e2->rb->event_list) After this; e1 is attached to an unmapped rb and a subsequent perf_mmap() will loop forever more: again: mutex_lock(&e->mmap_mutex); if (event->rb) { ... if (!atomic_inc_not_zero(&e->rb->mmap_count)) { ... mutex_unlock(&e->mmap_mutex); goto again; } } The loop in perf_mmap_close() holds e2->mmap_mutex, while the attach in perf_event_set_output() holds e1->mmap_mutex. As such there is no serialization to avoid this race. Change perf_event_set_output() to take both e1->mmap_mutex and e2->mmap_mutex to alleviate that problem. Additionally, have the loop in perf_mmap() detach the rb directly, this avoids having to wait for the concurrent perf_mmap_close() to get around to doing it to make progress. Fixes: 9bb5d40cd93c ("perf: Fix mmap() accounting hole") Reported-by: Yang Jihong <yangjihong1(a)huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Tested-by: Yang Jihong <yangjihong1(a)huawei.com> Link: https://lkml.kernel.org/r/YsQ3jm2GR38SW7uD@worktop.programming.kicks-ass.net Signed-off-by: Yang Jihong <yangjihong1(a)huawei.com> Reviewed-by: Kuohai Xu <xukuohai(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/events/core.c | 45 ++++++++++++++++++++++++++++++-------------- 1 file changed, 31 insertions(+), 14 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 98d12fc3976a..616cccf9c835 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -5727,10 +5727,10 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) if (!atomic_inc_not_zero(&event->rb->mmap_count)) { /* - * Raced against perf_mmap_close() through - * perf_event_set_output(). Try again, hope for better - * luck. + * Raced against perf_mmap_close(); remove the + * event and try again. */ + ring_buffer_attach(event, NULL); mutex_unlock(&event->mmap_mutex); goto again; } @@ -10453,14 +10453,25 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr, goto out; } +static void mutex_lock_double(struct mutex *a, struct mutex *b) +{ + if (b < a) + swap(a, b); + + mutex_lock(a); + mutex_lock_nested(b, SINGLE_DEPTH_NESTING); +} + static int perf_event_set_output(struct perf_event *event, struct perf_event *output_event) { struct ring_buffer *rb = NULL; int ret = -EINVAL; - if (!output_event) + if (!output_event) { + mutex_lock(&event->mmap_mutex); goto set; + } /* don't allow circular references */ if (event == output_event) @@ -10498,8 +10509,15 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) event->pmu != output_event->pmu) goto out; + /* + * Hold both mmap_mutex to serialize against perf_mmap_close(). Since + * output_event is already on rb->event_list, and the list iteration + * restarts after every removal, it is guaranteed this new event is + * observed *OR* if output_event is already removed, it's guaranteed we + * observe !rb->mmap_count. + */ + mutex_lock_double(&event->mmap_mutex, &output_event->mmap_mutex); set: - mutex_lock(&event->mmap_mutex); /* Can't redirect output if we've got an active mmap() */ if (atomic_read(&event->mmap_count)) goto unlock; @@ -10509,6 +10527,12 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) rb = ring_buffer_get(output_event); if (!rb) goto unlock; + + /* did we race against perf_mmap_close() */ + if (!atomic_read(&rb->mmap_count)) { + ring_buffer_put(rb); + goto unlock; + } } ring_buffer_attach(event, rb); @@ -10516,20 +10540,13 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) ret = 0; unlock: mutex_unlock(&event->mmap_mutex); + if (output_event) + mutex_unlock(&output_event->mmap_mutex); out: return ret; } -static void mutex_lock_double(struct mutex *a, struct mutex *b) -{ - if (b < a) - swap(a, b); - - mutex_lock(a); - mutex_lock_nested(b, SINGLE_DEPTH_NESTING); -} - static int perf_event_set_clock(struct perf_event *event, clockid_t clk_id) { bool nmi_safe = false; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] inotify: show inotify mask flags in proc fdinfo
by Laibin Qiu 25 Jul '22

25 Jul '22

From: Amir Goldstein <amir73il(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit a32e697cda27679a0327ae2cafdad8c7170f548f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5IGXM CVE: NA -------------------------------- The inotify mask flags IN_ONESHOT and IN_EXCL_UNLINK are not "internal to kernel" and should be exposed in procfs fdinfo so CRIU can restore them. Fixes: 6933599697c9 ("inotify: hide internal kernel bits from fdinfo") Link: https://lore.kernel.org/r/20220422120327.3459282-2-amir73il@gmail.com Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Li Nan <linan122(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- fs/notify/fdinfo.c | 11 ++--------- fs/notify/inotify/inotify.h | 12 ++++++++++++ fs/notify/inotify/inotify_user.c | 2 +- 3 files changed, 15 insertions(+), 10 deletions(-) diff --git a/fs/notify/fdinfo.c b/fs/notify/fdinfo.c index c4f18a8a8161..a67483ce2ee1 100644 --- a/fs/notify/fdinfo.c +++ b/fs/notify/fdinfo.c @@ -84,16 +84,9 @@ static void inotify_fdinfo(struct seq_file *m, struct fsnotify_mark *mark) inode_mark = container_of(mark, struct inotify_inode_mark, fsn_mark); inode = igrab(fsnotify_conn_inode(mark->connector)); if (inode) { - /* - * IN_ALL_EVENTS represents all of the mask bits - * that we expose to userspace. There is at - * least one bit (FS_EVENT_ON_CHILD) which is - * used only internally to the kernel. - */ - u32 mask = mark->mask & IN_ALL_EVENTS; - seq_printf(m, "inotify wd:%x ino:%lx sdev:%x mask:%x ignored_mask:%x ", + seq_printf(m, "inotify wd:%x ino:%lx sdev:%x mask:%x ignored_mask:0 ", inode_mark->wd, inode->i_ino, inode->i_sb->s_dev, - mask, mark->ignored_mask); + inotify_mark_user_mask(mark)); show_mark_fhandle(m, inode); seq_putc(m, '\n'); iput(inode); diff --git a/fs/notify/inotify/inotify.h b/fs/notify/inotify/inotify.h index 7e4578d35b61..5d94c00b1233 100644 --- a/fs/notify/inotify/inotify.h +++ b/fs/notify/inotify/inotify.h @@ -21,6 +21,18 @@ static inline struct inotify_event_info *INOTIFY_E(struct fsnotify_event *fse) return container_of(fse, struct inotify_event_info, fse); } +/* + * INOTIFY_USER_FLAGS represents all of the mask bits that we expose to + * userspace. There is at least one bit (FS_EVENT_ON_CHILD) which is + * used only internally to the kernel. + */ +#define INOTIFY_USER_MASK (IN_ALL_EVENTS | IN_ONESHOT | IN_EXCL_UNLINK) + +static inline __u32 inotify_mark_user_mask(struct fsnotify_mark *fsn_mark) +{ + return fsn_mark->mask & INOTIFY_USER_MASK; +} + extern void inotify_ignored_and_remove_idr(struct fsnotify_mark *fsn_mark, struct fsnotify_group *group); extern int inotify_handle_event(struct fsnotify_group *group, diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c index 73b47cb533f2..156faf3d1288 100644 --- a/fs/notify/inotify/inotify_user.c +++ b/fs/notify/inotify/inotify_user.c @@ -96,7 +96,7 @@ static inline __u32 inotify_arg_to_mask(u32 arg) mask = (FS_IN_IGNORED | FS_EVENT_ON_CHILD | FS_UNMOUNT); /* mask off the flags used to open the fd */ - mask |= (arg & (IN_ALL_EVENTS | IN_ONESHOT | IN_EXCL_UNLINK)); + mask |= (arg & INOTIFY_USER_MASK); return mask; } -- 2.25.1

1 0

openEuler 22.09 Alpha版本release公告
by chenyaqiang 25 Jul '22

25 Jul '22

Dear all， openEuler 22.09创新版本Alpha版本在经过社区各SIG组协作开发，CI/CD SIG规模构建，及QA SIG Alpha版本质量评估，满足alpha版本发布质量标准，现正式发布该alpha版本，社区各SIG组及所有爱好者均可以下载并试用alpha ，Alpha 版本包含 openEuler 22.09 版本的几乎全量组件（少量持续编译/构建失败包清单详见邮件正文编译构建章节），版本测试能力/策略由 openEuler QA SIG团队指导，社区各个SIG组自主开展组件自验证，社区一起协作支撑openEuler 22.09创新版本issue发现和定位修复，您发现和定位修复每一个issue不仅可以解决您使用openEuler创新版本的问题点，更可以支撑社区一起持续优化提升百万级openEuler用户的体验！ Alpha版本作为beta版本的前置自验证版本，经过社区联合协作自验证和issue修复后，下一个版本里程碑点（预计在2022/08/01）将会提供 Beta 版本。 openEuler 22.09版本release plan公示链接： https://gitee.com/openeuler/release-management/blob/master/openEuler-22.09/… openEuler 22.09 Alpha版本下载链接： http://121.36.84.172/dailybuild/openEuler-22.09/openeuler-2022-07-25-10-43-… openEuler 22.09 Alpha版本发布质量评估规范公示链接： https://gitee.com/openeuler/QA/blob/master/Test_Checklist/%E7%A4%BE%E5%8C%B… openEuler 22.09 Alpha版本自验证进展与质量结果同步方式：建议各sig组及社区用户均可以在QA-sig下以ISSUE方式同步自验证进展和自验证结果，您的自验证结果将是Alpha版本质量评估的充分信息依据；社区QA 版本测试提单规范 https://gitee.com/openeuler/QA/blob/839f952696f271f83c018ccf3218cf493b92d65… 社区QA 测试平台 radiates https://radiatest.openeuler.org<https://radiatest.openeuler.org/> openEuler 22.09 Alpha版本已知待修复单包构建失败问题清单：里程碑地址：https://e.gitee.com/open_euler/milestones/170898/issues/table 里程碑任务ID 任务标题任务状态关联仓库 Sig openEuler-22.09-Dailybuild I5HVUZ ima-evm-utils build problem in openEuler:22.09 待办的 ima-evm-utils Base-service openEuler-22.09-Dailybuild I5HVVF mysql5 build problem in openEuler:22.09 待办的 mysql5 DB openEuler-22.09-Dailybuild I5HZVX folks build problem in openEuler:22.09 待办的 folks GNOME openEuler-22.09-Dailybuild I5HZW3 subunit build problem in openEuler:22.09 待办的 subunit Programming-language openEuler-22.09-Dailybuild I5I1ZZ ceph build problem in openEuler:22.09 待办的 ceph sig-SDS openEuler-22.09-Dailybuild I5I6MO libgit2 build problem in openEuler:22.09 待办的 libgit2 Base-service openEuler-22.09-Dailybuild I5IH5G gpgme build problem in openEuler:22.09 待办的 gpgme Base-service openEuler-22.09-Dailybuild I5IH69 iotop build problem in openEuler:22.09 待办的 iotop Storage openEuler-22.09-Dailybuild I5IH6M libpwquality build problem in openEuler:22.09 待办的 libpwquality sig-security-facility openEuler-22.09-Dailybuild I5IH6T nftables build problem in openEuler:22.09 待办的 nftables Networking openEuler-22.09-Dailybuild I5ILK7 bamf build problem in openEuler:22.09:Epol 待办的 bamf sig-UKUI openEuler-22.09-Dailybuild I5ILK8 vdsm-jsonrpc-java build problem in openEuler:22.09:Epol 待办的 vdsm-jsonrpc-java oVirt openEuler-22.09-Dailybuild I5ILKA python-crypto build problem in openEuler:22.09 待办的 python-crypto Base-service openEuler-22.09-Dailybuild I5ILKE sssd build problem in openEuler:22.09 待办的 sssd Base-service openEuler-22.09-Dailybuild I5IQZF highlight build problem in openEuler:22.09:Epol 待办的 highlight oVirt openEuler 22.09 Alpha版本已知待修复单包安装失败软件包清单：安装校验项架构 jenkins任务地址 ISO二进制范围 x86_64 https://openeulerjenkins.osinfra.cn/job/openEuler-OS-build/job/check_rpm_in… Epol二进制范围 x86_64 https://openeulerjenkins.osinfra.cn/job/openEuler-OS-build/job/check_rpm_in… ISO二进制范围 aarch64 https://openeulerjenkins.osinfra.cn/job/openEuler-OS-build/job/check_rpm_in… Epol二进制范围 aarch64 https://openeulerjenkins.osinfra.cn/job/openEuler-OS-build/job/check_rpm_in… 二进制包名源码包名 Sig python3-jupyter python-jupyter #N/A python3-nni python-nni A-Tune setroubleshoot-plugins setroubleshoot-plugins Base-service backupninja backupninja Application blueman blueman sig-UKUI cinnamon cinnamon sig-cinnamon cinnamon-devel-doc cinnamon sig-cinnamon claws-mail-plugins claws-mail sig-UKUI claws-mail-plugins-bsfilter claws-mail sig-UKUI claws-mail-plugins-bogofilter claws-mail sig-UKUI cockpit-ovirt-dashboard cockpit-ovirt oVirt ovirt-hosted-engine-setup ovirt-hosted-engine-setup oVirt ovirt-host ovirt-host oVirt dde dde sig-DDE dde-control-center dde-control-center sig-DDE startdde startdde sig-DDE dde-daemon dde-daemon sig-DDE dde-session-ui dde-session-ui sig-DDE dde-desktop dde-file-manager sig-DDE dde-launcher dde-launcher sig-DDE dde-file-manager dde-file-manager sig-DDE libdde-file-manager dde-file-manager sig-DDE dde-disk-mount-plugin dde-file-manager sig-DDE dde-file-manager-devel dde-file-manager sig-DDE dde-launcher-devel dde-launcher sig-DDE deepin-compressor deepin-compressor sig-DDE deepin-font-manager deepin-font-manager sig-DDE libdeepin-font-manager deepin-font-manager sig-DDE deepin-screen-recorder deepin-screen-recorder sig-DDE kwin kwin sig-KDE kwin-common kwin sig-KDE kwin-devel kwin sig-KDE kwin-doc kwin sig-KDE kwin-wayland kwin sig-KDE kwin-x11 kwin sig-KDE lastpass-cli lastpass-cli Application openstack-dashboard openstack-dashboard #N/A python3-horizon openstack-dashboard #N/A ovirt-engine ovirt-engine oVirt ovirt-engine-setup-plugin-ovirt-engine ovirt-engine oVirt ovirt-provider-ovn ovirt-provider-ovn oVirt ovirt-engine-backend ovirt-engine oVirt ovirt-engine-dbscripts ovirt-engine oVirt ovirt-engine-dwh ovirt-engine-dwh oVirt ovirt-engine-dwh-grafana-integration-setup ovirt-engine-dwh oVirt ovirt-engine-dwh-setup ovirt-engine-dwh oVirt ovirt-engine-restapi ovirt-engine oVirt ovirt-engine-setup ovirt-engine oVirt ovirt-engine-setup-plugin-cinderlib ovirt-engine oVirt ovirt-engine-setup-plugin-imageio ovirt-engine oVirt ovirt-engine-setup-plugin-vmconsole-proxy-helper ovirt-engine oVirt ovirt-engine-tools ovirt-engine oVirt ovirt-engine-webadmin-portal ovirt-engine oVirt ovirt-engine-ui-extensions ovirt-engine-ui-extensions oVirt ovirt-engine-vmconsole-proxy-helper ovirt-engine oVirt ovirt-provider-ovn-driver ovirt-provider-ovn oVirt python3-graphviz python-graphviz sig-python-modules python3-ironic-ui python-ironic-ui sig-openstack python3-mitmproxy python-mitmproxy sig-python-modules python3-muranoclient python-muranoclient sig-openstack python3-neutron-tempest-plugin python-neutron-tempest-plugin sig-openstack python3-os-xenapi-tests python-os-xenapi sig-openstack python3-pep517 python-pep517 sig-python-modules python3-pip-api python-pip-api sig-openstack python3-requirementslib python-requirementslib sig-openstack python3-senlinclient python-senlinclient sig-openstack python3-trove-tempest-plugin python-trove-tempest-plugin sig-openstack ukui ukui-desktop-environment sig-UKUI ukui-desktop-environment ukui-desktop-environment sig-UKUI ukui-desktop-environment-core ukui-desktop-environment sig-UKUI kylin-music kylin-music sig-UKUI ------ BR 陈亚强（openEuler release management sig）

1 0

[PATCH openEuler-1.0-LTS] io_uring: always grab file table for deferred statx
by Yongqiang Liu 22 Jul '22

22 Jul '22

From: Jens Axboe <axboe(a)kernel.dk> stable inclusion from stable-v5.10.118 commit 3c48558be571e01f67e65edcf03193484eeb2b79 category: bugfix bugzilla: 187134, https://gitee.com/openeuler/kernel/issues/I5HEXY CVE: NA -------------------------------- Lee reports that there's a use-after-free of the process file table. There's an assumption that we don't need the file table for some variants of statx invocation, but that turns out to be false and we end up with not grabbing a reference for the request even if the deferred execution uses it. Get rid of the REQ_F_NO_FILE_TABLE optimization for statx, and always grab that reference. This issues doesn't exist upstream since the native workers got introduced with 5.12. Link: https://lore.kernel.org/io-uring/YoOJ%2FT4QRKC+fAZE@google.com/ Reported-by: Lee Jones <lee.jones(a)linaro.org> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/io_uring.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 7ae8ba98e73b..8a96b7df4112 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3836,12 +3836,8 @@ static int io_statx(struct io_kiocb *req, bool force_nonblock) struct io_statx *ctx = &req->statx; int ret; - if (force_nonblock) { - /* only need file table for an actual valid fd */ - if (ctx->dfd == -1 || ctx->dfd == AT_FDCWD) - req->flags |= REQ_F_NO_FILE_TABLE; + if (force_nonblock) return -EAGAIN; - } ret = do_statx(ctx->dfd, ctx->filename, ctx->flags, ctx->mask, ctx->buffer); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] bpf: Don't redirect packets with invalid pkt_len
by Yongqiang Liu 22 Jul '22

22 Jul '22

From: Zhengchao Shao <shaozhengchao(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5HWKR CVE: NA -------------------------------- Syzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any skbs, that is, the flow->head is null. The root cause, as the [2] says, is because that bpf_prog_test_run_skb() run a bpf prog which redirects empty skbs. So we should determine whether the length of the packet modified by bpf prog or others like bpf_prog_test is valid before forwarding it directly. LINK: [1] https://syzkaller.appspot.com/bug?id=0b84da80c2917757915afa89f7738a9d16ec96… LINK: [2] https://www.spinics.net/lists/netdev/msg777503.html Reported-by: syzbot+7a12909485b94426aceb(a)syzkaller.appspotmail.com Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Conflict: net/bpf/test_run.c Reviewed-by: Stanislav Fomichev <sdf(a)google.com> Link: https://lore.kernel.org/r/20220715115559.139691-1-shaozhengchao@huawei.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/linux/skbuff.h | 8 ++++++++ net/bpf/test_run.c | 6 ++++++ net/core/dev.c | 1 + 3 files changed, 15 insertions(+) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index e9f100bd73d9..dbdb03ac557f 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2077,6 +2077,14 @@ static inline void skb_set_tail_pointer(struct sk_buff *skb, const int offset) #endif /* NET_SKBUFF_DATA_USES_OFFSET */ +static inline void skb_assert_len(struct sk_buff *skb) +{ +#ifdef CONFIG_DEBUG_NET + if (WARN_ONCE(!skb->len, "%s\n", __func__)) + DO_ONCE_LITE(skb_dump, KERN_ERR, skb, false); +#endif /* CONFIG_DEBUG_NET */ +} + /* * Add data to an sk_buff */ diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index f4078830ea50..fba139c995aa 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -144,6 +144,12 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, __skb_push(skb, hh_len); if (is_direct_pkt_access) bpf_compute_data_pointers(skb); + + if (!skb->len) { + kfree_skb(skb); + return -EINVAL; + } + retval = bpf_test_run(prog, skb, repeat, &duration); if (!is_l2) { if (skb_headroom(skb) < hh_len) { diff --git a/net/core/dev.c b/net/core/dev.c index 5bc0e56216c9..078e8a231616 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3775,6 +3775,7 @@ static int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev) bool again = false; skb_reset_mac_header(skb); + skb_assert_len(skb); if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_SCHED_TSTAMP)) __skb_tstamp_tx(skb, NULL, skb->sk, SCM_TSTAMP_SCHED); -- 2.25.1

1 0

[PATCH openEuler-22.09 v2 0/8] bpf: sched: Introduce Schduler BPF
by Zheng Zengkai 22 Jul '22

22 Jul '22

This patchset aims to start a discussion about potential applications of BPF to the scheduler. It also aims to land some very basic BPF infrastructure necessary to add new BPF hooks to the scheduler, a minimal set of useful helpers, corresponding libbpf changes, etc. [Testing] kernel options: CONFIG_BPF_SCHED=y CONFIG_BPF_SYSCALL=y CONFIG_BPF_EVENTS=y Test passed with below step: 1.cd tools/testing/selftests/bpf & make 2.run cmd: ./test_progs -t test_sched 3.it will show like this: # ./test_progs -t test_sched #113/1 sched_tgidpid_mode:OK #113/2 sched_cgid_mode:OK #113 test_sched:OK Summary: 1/2 PASSED, 0 SKIPPED, 0 FAILED Chen Hui (1): sched: Move some definition to sched.h Ren Zhijie (1): bpf: sched: add selftests for BPF_PROG_TYPE_SCHED Roman Gushchin (6): bpf: sched: basic infrastructure for scheduler bpf bpf: sched: add convenient helpers to identify sched entities bpf: sched: introduce bpf_sched_enable() sched: cfs: add bpf hooks to control wakeup and tick preemption libbpf: add support for scheduler bpf programs bpftool: recognize scheduler programs include/linux/bpf_sched.h | 50 +++++ include/linux/bpf_types.h | 4 + include/linux/sched_hook_defs.h | 5 + include/uapi/linux/bpf.h | 25 +++ init/Kconfig | 10 + kernel/bpf/btf.c | 1 + kernel/bpf/syscall.c | 20 ++ kernel/bpf/trampoline.c | 1 + kernel/bpf/verifier.c | 11 +- kernel/sched/Makefile | 1 + kernel/sched/bpf_sched.c | 138 ++++++++++++ kernel/sched/fair.c | 79 +++---- kernel/sched/sched.h | 52 +++++ scripts/bpf_helpers_doc.py | 2 + tools/bpf/bpftool/common.c | 1 + tools/bpf/bpftool/prog.c | 1 + tools/include/uapi/linux/bpf.h | 25 +++ tools/lib/bpf/bpf.c | 3 +- tools/lib/bpf/libbpf.c | 33 ++- tools/lib/bpf/libbpf.h | 4 + tools/lib/bpf/libbpf.map | 3 + .../selftests/bpf/prog_tests/test_sched.c | 160 ++++++++++++++ tools/testing/selftests/bpf/progs/sched.c | 203 ++++++++++++++++++ 23 files changed, 780 insertions(+), 52 deletions(-) create mode 100644 include/linux/bpf_sched.h create mode 100644 include/linux/sched_hook_defs.h create mode 100644 kernel/sched/bpf_sched.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_sched.c create mode 100644 tools/testing/selftests/bpf/progs/sched.c -- 2.20.1

1 0

[PATCH openEuler-22.09 v2 1/8] bpf: sched: basic infrastructure for scheduler bpf
by Zheng Zengkai 22 Jul '22

22 Jul '22

From: Roman Gushchin <guro(a)fb.com> maillist inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5F6X6 CVE: NA Reference: https://lore.kernel.org/all/20210916162451.709260-1-guro@fb.com/ ------------------- This commit introduces basic definitions and infrastructure for scheduler bpf programs. It defines the BPF_PROG_TYPE_SCHED program type and the BPF_SCHED attachment type. The implementation is inspired by lsm bpf programs and is based on kretprobes. This will allow to add new hooks with a minimal changes to the kernel code and without any changes to libbpf/bpftool. It's very convenient as I anticipate a large number of private patches being used for a long time before (or if at all) reaching upstream. Sched programs are expected to return an int, which meaning will be context defined. This patch doesn't add any real scheduler hooks (only a stub), it will be done by following patches in the series. Scheduler bpf programs as now are very restricted in what they can do: only the bpf_printk() helper is available. The scheduler context can impose significant restrictions on what's safe and what's not. So let's extend their abilities on case by case basis when a need arise. Signed-off-by: Roman Gushchin <guro(a)fb.com> Signed-off-by: Chen Hui <judy.chenhui(a)huawei.com> Signed-off-by: Ren Zhijie <renzhijie2(a)huawei.com> --- include/linux/bpf_sched.h | 26 ++++++++++++++ include/linux/bpf_types.h | 4 +++ include/linux/sched_hook_defs.h | 2 ++ include/uapi/linux/bpf.h | 2 ++ init/Kconfig | 10 ++++++ kernel/bpf/btf.c | 1 + kernel/bpf/syscall.c | 9 +++++ kernel/bpf/trampoline.c | 1 + kernel/bpf/verifier.c | 11 +++++- kernel/sched/Makefile | 1 + kernel/sched/bpf_sched.c | 62 +++++++++++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 2 ++ 12 files changed, 130 insertions(+), 1 deletion(-) create mode 100644 include/linux/bpf_sched.h create mode 100644 include/linux/sched_hook_defs.h create mode 100644 kernel/sched/bpf_sched.c diff --git a/include/linux/bpf_sched.h b/include/linux/bpf_sched.h new file mode 100644 index 000000000000..874393e6a6aa --- /dev/null +++ b/include/linux/bpf_sched.h @@ -0,0 +1,26 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _LINUX_BPF_SCHED_H +#define _LINUX_BPF_SCHED_H + +#include <linux/bpf.h> + +#ifdef CONFIG_BPF_SCHED + +#define BPF_SCHED_HOOK(RET, DEFAULT, NAME, ...) \ + RET bpf_sched_##NAME(__VA_ARGS__); +#include <linux/sched_hook_defs.h> +#undef BPF_SCHED_HOOK + +int bpf_sched_verify_prog(struct bpf_verifier_log *vlog, + const struct bpf_prog *prog); + +#else /* !CONFIG_BPF_SCHED */ + +static inline int bpf_sched_verify_prog(struct bpf_verifier_log *vlog, + const struct bpf_prog *prog) +{ + return -EOPNOTSUPP; +} + +#endif /* CONFIG_BPF_SCHED */ +#endif /* _LINUX_BPF_SCHED_H */ diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h index a8137bb6dd3c..5732b485c539 100644 --- a/include/linux/bpf_types.h +++ b/include/linux/bpf_types.h @@ -77,6 +77,10 @@ BPF_PROG_TYPE(BPF_PROG_TYPE_LSM, lsm, void *, void *) #endif /* CONFIG_BPF_LSM */ #endif +#ifdef CONFIG_BPF_SCHED +BPF_PROG_TYPE(BPF_PROG_TYPE_SCHED, bpf_sched, + void *, void *) +#endif /* CONFIG_BPF_SCHED */ BPF_MAP_TYPE(BPF_MAP_TYPE_ARRAY, array_map_ops) BPF_MAP_TYPE(BPF_MAP_TYPE_PERCPU_ARRAY, percpu_array_map_ops) diff --git a/include/linux/sched_hook_defs.h b/include/linux/sched_hook_defs.h new file mode 100644 index 000000000000..14344004e335 --- /dev/null +++ b/include/linux/sched_hook_defs.h @@ -0,0 +1,2 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +BPF_SCHED_HOOK(int, 0, dummy, void) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 8fae845d80e2..4f8f3f2113a7 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -199,6 +199,7 @@ enum bpf_prog_type { BPF_PROG_TYPE_EXT, BPF_PROG_TYPE_LSM, BPF_PROG_TYPE_SK_LOOKUP, + BPF_PROG_TYPE_SCHED, }; enum bpf_attach_type { @@ -240,6 +241,7 @@ enum bpf_attach_type { BPF_XDP_CPUMAP, BPF_SK_LOOKUP, BPF_XDP, + BPF_SCHED, __MAX_BPF_ATTACH_TYPE }; diff --git a/init/Kconfig b/init/Kconfig index 27c5ed16fef1..c3fa3240d87d 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1749,6 +1749,16 @@ config BPF_LSM If you are unsure how to answer this question, answer N. +config BPF_SCHED + bool "SCHED Instrumentation with BPF" + depends on BPF_EVENTS + depends on BPF_SYSCALL + help + Enables instrumentation of the sched hooks with eBPF programs for + implementing dynamic scheduling Policies. + + If you are unsure how to answer this question, answer N. + config BPF_SYSCALL bool "Enable bpf() system call" select BPF diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index fba28f17e61a..9a0a9895ec62 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -4479,6 +4479,7 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, return true; t = btf_type_by_id(btf, t->type); break; + case BPF_SCHED: case BPF_MODIFY_RETURN: /* For now the BPF_MODIFY_RETURN can only be attached to * functions that return an int. diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 419dbc3d060e..ff65862ae5ce 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1997,6 +1997,7 @@ bpf_prog_load_check_attach(enum bpf_prog_type prog_type, case BPF_PROG_TYPE_LSM: case BPF_PROG_TYPE_STRUCT_OPS: case BPF_PROG_TYPE_EXT: + case BPF_PROG_TYPE_SCHED: break; default: return -EINVAL; @@ -2108,6 +2109,7 @@ static bool is_perfmon_prog_type(enum bpf_prog_type prog_type) case BPF_PROG_TYPE_LSM: case BPF_PROG_TYPE_STRUCT_OPS: /* has access to struct sock */ case BPF_PROG_TYPE_EXT: /* extends any prog */ + case BPF_PROG_TYPE_SCHED: return true; default: return false; @@ -2608,6 +2610,12 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog, goto out_put_prog; } break; + case BPF_PROG_TYPE_SCHED: + if (prog->expected_attach_type != BPF_SCHED) { + err = -EINVAL; + goto out_put_prog; + } + break; default: err = -EINVAL; goto out_put_prog; @@ -2838,6 +2846,7 @@ static int bpf_raw_tracepoint_open(const union bpf_attr *attr) case BPF_PROG_TYPE_TRACING: case BPF_PROG_TYPE_EXT: case BPF_PROG_TYPE_LSM: + case BPF_PROG_TYPE_SCHED: if (attr->raw_tracepoint.name) { /* The attach point for this category of programs * should be specified via btf_id during program load. diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c index 986dabc3d11f..cc6ba35a1d14 100644 --- a/kernel/bpf/trampoline.c +++ b/kernel/bpf/trampoline.c @@ -357,6 +357,7 @@ static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(struct bpf_prog *prog) switch (prog->expected_attach_type) { case BPF_TRACE_FENTRY: return BPF_TRAMP_FENTRY; + case BPF_SCHED: case BPF_MODIFY_RETURN: return BPF_TRAMP_MODIFY_RETURN; case BPF_TRACE_FEXIT: diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 6423f1714a2f..d26104b258ba 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -22,6 +22,7 @@ #include <linux/error-injection.h> #include <linux/bpf_lsm.h> #include <linux/btf_ids.h> +#include <linux/bpf_sched.h> #include "disasm.h" @@ -12178,6 +12179,7 @@ int bpf_check_attach_target(struct bpf_verifier_log *log, case BPF_LSM_MAC: case BPF_TRACE_FENTRY: case BPF_TRACE_FEXIT: + case BPF_SCHED: if (!btf_type_is_func(t)) { bpf_log(log, "attach_btf_id %u is not a function\n", btf_id); @@ -12283,7 +12285,8 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) if (prog->type != BPF_PROG_TYPE_TRACING && prog->type != BPF_PROG_TYPE_LSM && - prog->type != BPF_PROG_TYPE_EXT) + prog->type != BPF_PROG_TYPE_EXT && + prog->type != BPF_PROG_TYPE_SCHED) return 0; ret = bpf_check_attach_target(&env->log, prog, tgt_prog, btf_id, &tgt_info); @@ -12323,6 +12326,12 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) return ret; } + if (prog->type == BPF_PROG_TYPE_SCHED) { + ret = bpf_sched_verify_prog(&env->log, prog); + if (ret < 0) + return ret; + } + key = bpf_trampoline_compute_key(tgt_prog, btf_id); tr = bpf_trampoline_get(key, &tgt_info); if (!tr) diff --git a/kernel/sched/Makefile b/kernel/sched/Makefile index 5fc9c9b70862..8ae9e39eb83a 100644 --- a/kernel/sched/Makefile +++ b/kernel/sched/Makefile @@ -36,3 +36,4 @@ obj-$(CONFIG_CPU_FREQ_GOV_SCHEDUTIL) += cpufreq_schedutil.o obj-$(CONFIG_MEMBARRIER) += membarrier.o obj-$(CONFIG_CPU_ISOLATION) += isolation.o obj-$(CONFIG_PSI) += psi.o +obj-$(CONFIG_BPF_SCHED) += bpf_sched.o \ No newline at end of file diff --git a/kernel/sched/bpf_sched.c b/kernel/sched/bpf_sched.c new file mode 100644 index 000000000000..2f05c186cfd0 --- /dev/null +++ b/kernel/sched/bpf_sched.c @@ -0,0 +1,62 @@ +// SPDX-License-Identifier: GPL-2.0 +#include <linux/bpf.h> +#include <linux/cgroup.h> +#include <linux/bpf_verifier.h> +#include <linux/bpf_sched.h> +#include <linux/btf_ids.h> +#include "sched.h" + +/* + * For every hook declare a nop function where a BPF program can be attached. + */ +#define BPF_SCHED_HOOK(RET, DEFAULT, NAME, ...) \ +noinline RET bpf_sched_##NAME(__VA_ARGS__) \ +{ \ + return DEFAULT; \ +} + +#include <linux/sched_hook_defs.h> +#undef BPF_SCHED_HOOK + +#define BPF_SCHED_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_sched_##NAME) +BTF_SET_START(bpf_sched_hooks) +#include <linux/sched_hook_defs.h> +#undef BPF_SCHED_HOOK +BTF_SET_END(bpf_sched_hooks) + +int bpf_sched_verify_prog(struct bpf_verifier_log *vlog, + const struct bpf_prog *prog) +{ + if (!prog->gpl_compatible) { + bpf_log(vlog, + "sched programs must have a GPL compatible license\n"); + return -EINVAL; + } + + if (!btf_id_set_contains(&bpf_sched_hooks, prog->aux->attach_btf_id)) { + bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n", + prog->aux->attach_btf_id, prog->aux->attach_func_name); + return -EINVAL; + } + + return 0; +} + +static const struct bpf_func_proto * +bpf_sched_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) +{ + switch (func_id) { + case BPF_FUNC_trace_printk: + return bpf_get_trace_printk_proto(); + default: + return NULL; + } +} + +const struct bpf_prog_ops bpf_sched_prog_ops = { +}; + +const struct bpf_verifier_ops bpf_sched_verifier_ops = { + .get_func_proto = bpf_sched_func_proto, + .is_valid_access = btf_ctx_access, +}; diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index a44cb5155825..7d7c04f698ec 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -199,6 +199,7 @@ enum bpf_prog_type { BPF_PROG_TYPE_EXT, BPF_PROG_TYPE_LSM, BPF_PROG_TYPE_SK_LOOKUP, + BPF_PROG_TYPE_SCHED, }; enum bpf_attach_type { @@ -240,6 +241,7 @@ enum bpf_attach_type { BPF_XDP_CPUMAP, BPF_SK_LOOKUP, BPF_XDP, + BPF_SCHED, __MAX_BPF_ATTACH_TYPE }; -- 2.20.1

1 7

[PATCH openEuler-22.09 1/7] bpf: sched: basic infrastructure for scheduler bpf
by Zheng Zengkai 22 Jul '22

22 Jul '22

From: Roman Gushchin <guro(a)fb.com> maillist inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5F6X6 CVE: NA Reference: https://lore.kernel.org/all/20210916162451.709260-1-guro@fb.com/ ------------------- This commit introduces basic definitions and infrastructure for scheduler bpf programs. It defines the BPF_PROG_TYPE_SCHED program type and the BPF_SCHED attachment type. The implementation is inspired by lsm bpf programs and is based on kretprobes. This will allow to add new hooks with a minimal changes to the kernel code and without any changes to libbpf/bpftool. It's very convenient as I anticipate a large number of private patches being used for a long time before (or if at all) reaching upstream. Sched programs are expected to return an int, which meaning will be context defined. This patch doesn't add any real scheduler hooks (only a stub), it will be done by following patches in the series. Scheduler bpf programs as now are very restricted in what they can do: only the bpf_printk() helper is available. The scheduler context can impose significant restrictions on what's safe and what's not. So let's extend their abilities on case by case basis when a need arise. Signed-off-by: Roman Gushchin <guro(a)fb.com> Signed-off-by: Chen Hui <judy.chenhui(a)huawei.com> Signed-off-by: Ren Zhijie <renzhijie2(a)huawei.com> --- include/linux/bpf_sched.h | 26 ++++++++++++++ include/linux/bpf_types.h | 4 +++ include/linux/sched_hook_defs.h | 2 ++ include/uapi/linux/bpf.h | 2 ++ init/Kconfig | 10 ++++++ kernel/bpf/btf.c | 1 + kernel/bpf/syscall.c | 9 +++++ kernel/bpf/trampoline.c | 1 + kernel/bpf/verifier.c | 11 +++++- kernel/sched/Makefile | 1 + kernel/sched/bpf_sched.c | 62 +++++++++++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 2 ++ 12 files changed, 130 insertions(+), 1 deletion(-) create mode 100644 include/linux/bpf_sched.h create mode 100644 include/linux/sched_hook_defs.h create mode 100644 kernel/sched/bpf_sched.c diff --git a/include/linux/bpf_sched.h b/include/linux/bpf_sched.h new file mode 100644 index 000000000000..874393e6a6aa --- /dev/null +++ b/include/linux/bpf_sched.h @@ -0,0 +1,26 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _LINUX_BPF_SCHED_H +#define _LINUX_BPF_SCHED_H + +#include <linux/bpf.h> + +#ifdef CONFIG_BPF_SCHED + +#define BPF_SCHED_HOOK(RET, DEFAULT, NAME, ...) \ + RET bpf_sched_##NAME(__VA_ARGS__); +#include <linux/sched_hook_defs.h> +#undef BPF_SCHED_HOOK + +int bpf_sched_verify_prog(struct bpf_verifier_log *vlog, + const struct bpf_prog *prog); + +#else /* !CONFIG_BPF_SCHED */ + +static inline int bpf_sched_verify_prog(struct bpf_verifier_log *vlog, + const struct bpf_prog *prog) +{ + return -EOPNOTSUPP; +} + +#endif /* CONFIG_BPF_SCHED */ +#endif /* _LINUX_BPF_SCHED_H */ diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h index a8137bb6dd3c..5732b485c539 100644 --- a/include/linux/bpf_types.h +++ b/include/linux/bpf_types.h @@ -77,6 +77,10 @@ BPF_PROG_TYPE(BPF_PROG_TYPE_LSM, lsm, void *, void *) #endif /* CONFIG_BPF_LSM */ #endif +#ifdef CONFIG_BPF_SCHED +BPF_PROG_TYPE(BPF_PROG_TYPE_SCHED, bpf_sched, + void *, void *) +#endif /* CONFIG_BPF_SCHED */ BPF_MAP_TYPE(BPF_MAP_TYPE_ARRAY, array_map_ops) BPF_MAP_TYPE(BPF_MAP_TYPE_PERCPU_ARRAY, percpu_array_map_ops) diff --git a/include/linux/sched_hook_defs.h b/include/linux/sched_hook_defs.h new file mode 100644 index 000000000000..14344004e335 --- /dev/null +++ b/include/linux/sched_hook_defs.h @@ -0,0 +1,2 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +BPF_SCHED_HOOK(int, 0, dummy, void) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 8fae845d80e2..4f8f3f2113a7 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -199,6 +199,7 @@ enum bpf_prog_type { BPF_PROG_TYPE_EXT, BPF_PROG_TYPE_LSM, BPF_PROG_TYPE_SK_LOOKUP, + BPF_PROG_TYPE_SCHED, }; enum bpf_attach_type { @@ -240,6 +241,7 @@ enum bpf_attach_type { BPF_XDP_CPUMAP, BPF_SK_LOOKUP, BPF_XDP, + BPF_SCHED, __MAX_BPF_ATTACH_TYPE }; diff --git a/init/Kconfig b/init/Kconfig index 27c5ed16fef1..c3fa3240d87d 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1749,6 +1749,16 @@ config BPF_LSM If you are unsure how to answer this question, answer N. +config BPF_SCHED + bool "SCHED Instrumentation with BPF" + depends on BPF_EVENTS + depends on BPF_SYSCALL + help + Enables instrumentation of the sched hooks with eBPF programs for + implementing dynamic scheduling Policies. + + If you are unsure how to answer this question, answer N. + config BPF_SYSCALL bool "Enable bpf() system call" select BPF diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index fba28f17e61a..9a0a9895ec62 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -4479,6 +4479,7 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, return true; t = btf_type_by_id(btf, t->type); break; + case BPF_SCHED: case BPF_MODIFY_RETURN: /* For now the BPF_MODIFY_RETURN can only be attached to * functions that return an int. diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 419dbc3d060e..ff65862ae5ce 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1997,6 +1997,7 @@ bpf_prog_load_check_attach(enum bpf_prog_type prog_type, case BPF_PROG_TYPE_LSM: case BPF_PROG_TYPE_STRUCT_OPS: case BPF_PROG_TYPE_EXT: + case BPF_PROG_TYPE_SCHED: break; default: return -EINVAL; @@ -2108,6 +2109,7 @@ static bool is_perfmon_prog_type(enum bpf_prog_type prog_type) case BPF_PROG_TYPE_LSM: case BPF_PROG_TYPE_STRUCT_OPS: /* has access to struct sock */ case BPF_PROG_TYPE_EXT: /* extends any prog */ + case BPF_PROG_TYPE_SCHED: return true; default: return false; @@ -2608,6 +2610,12 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog, goto out_put_prog; } break; + case BPF_PROG_TYPE_SCHED: + if (prog->expected_attach_type != BPF_SCHED) { + err = -EINVAL; + goto out_put_prog; + } + break; default: err = -EINVAL; goto out_put_prog; @@ -2838,6 +2846,7 @@ static int bpf_raw_tracepoint_open(const union bpf_attr *attr) case BPF_PROG_TYPE_TRACING: case BPF_PROG_TYPE_EXT: case BPF_PROG_TYPE_LSM: + case BPF_PROG_TYPE_SCHED: if (attr->raw_tracepoint.name) { /* The attach point for this category of programs * should be specified via btf_id during program load. diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c index 986dabc3d11f..cc6ba35a1d14 100644 --- a/kernel/bpf/trampoline.c +++ b/kernel/bpf/trampoline.c @@ -357,6 +357,7 @@ static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(struct bpf_prog *prog) switch (prog->expected_attach_type) { case BPF_TRACE_FENTRY: return BPF_TRAMP_FENTRY; + case BPF_SCHED: case BPF_MODIFY_RETURN: return BPF_TRAMP_MODIFY_RETURN; case BPF_TRACE_FEXIT: diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 6423f1714a2f..d26104b258ba 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -22,6 +22,7 @@ #include <linux/error-injection.h> #include <linux/bpf_lsm.h> #include <linux/btf_ids.h> +#include <linux/bpf_sched.h> #include "disasm.h" @@ -12178,6 +12179,7 @@ int bpf_check_attach_target(struct bpf_verifier_log *log, case BPF_LSM_MAC: case BPF_TRACE_FENTRY: case BPF_TRACE_FEXIT: + case BPF_SCHED: if (!btf_type_is_func(t)) { bpf_log(log, "attach_btf_id %u is not a function\n", btf_id); @@ -12283,7 +12285,8 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) if (prog->type != BPF_PROG_TYPE_TRACING && prog->type != BPF_PROG_TYPE_LSM && - prog->type != BPF_PROG_TYPE_EXT) + prog->type != BPF_PROG_TYPE_EXT && + prog->type != BPF_PROG_TYPE_SCHED) return 0; ret = bpf_check_attach_target(&env->log, prog, tgt_prog, btf_id, &tgt_info); @@ -12323,6 +12326,12 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) return ret; } + if (prog->type == BPF_PROG_TYPE_SCHED) { + ret = bpf_sched_verify_prog(&env->log, prog); + if (ret < 0) + return ret; + } + key = bpf_trampoline_compute_key(tgt_prog, btf_id); tr = bpf_trampoline_get(key, &tgt_info); if (!tr) diff --git a/kernel/sched/Makefile b/kernel/sched/Makefile index 5fc9c9b70862..8ae9e39eb83a 100644 --- a/kernel/sched/Makefile +++ b/kernel/sched/Makefile @@ -36,3 +36,4 @@ obj-$(CONFIG_CPU_FREQ_GOV_SCHEDUTIL) += cpufreq_schedutil.o obj-$(CONFIG_MEMBARRIER) += membarrier.o obj-$(CONFIG_CPU_ISOLATION) += isolation.o obj-$(CONFIG_PSI) += psi.o +obj-$(CONFIG_BPF_SCHED) += bpf_sched.o \ No newline at end of file diff --git a/kernel/sched/bpf_sched.c b/kernel/sched/bpf_sched.c new file mode 100644 index 000000000000..2f05c186cfd0 --- /dev/null +++ b/kernel/sched/bpf_sched.c @@ -0,0 +1,62 @@ +// SPDX-License-Identifier: GPL-2.0 +#include <linux/bpf.h> +#include <linux/cgroup.h> +#include <linux/bpf_verifier.h> +#include <linux/bpf_sched.h> +#include <linux/btf_ids.h> +#include "sched.h" + +/* + * For every hook declare a nop function where a BPF program can be attached. + */ +#define BPF_SCHED_HOOK(RET, DEFAULT, NAME, ...) \ +noinline RET bpf_sched_##NAME(__VA_ARGS__) \ +{ \ + return DEFAULT; \ +} + +#include <linux/sched_hook_defs.h> +#undef BPF_SCHED_HOOK + +#define BPF_SCHED_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_sched_##NAME) +BTF_SET_START(bpf_sched_hooks) +#include <linux/sched_hook_defs.h> +#undef BPF_SCHED_HOOK +BTF_SET_END(bpf_sched_hooks) + +int bpf_sched_verify_prog(struct bpf_verifier_log *vlog, + const struct bpf_prog *prog) +{ + if (!prog->gpl_compatible) { + bpf_log(vlog, + "sched programs must have a GPL compatible license\n"); + return -EINVAL; + } + + if (!btf_id_set_contains(&bpf_sched_hooks, prog->aux->attach_btf_id)) { + bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n", + prog->aux->attach_btf_id, prog->aux->attach_func_name); + return -EINVAL; + } + + return 0; +} + +static const struct bpf_func_proto * +bpf_sched_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) +{ + switch (func_id) { + case BPF_FUNC_trace_printk: + return bpf_get_trace_printk_proto(); + default: + return NULL; + } +} + +const struct bpf_prog_ops bpf_sched_prog_ops = { +}; + +const struct bpf_verifier_ops bpf_sched_verifier_ops = { + .get_func_proto = bpf_sched_func_proto, + .is_valid_access = btf_ctx_access, +}; diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index a44cb5155825..7d7c04f698ec 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -199,6 +199,7 @@ enum bpf_prog_type { BPF_PROG_TYPE_EXT, BPF_PROG_TYPE_LSM, BPF_PROG_TYPE_SK_LOOKUP, + BPF_PROG_TYPE_SCHED, }; enum bpf_attach_type { @@ -240,6 +241,7 @@ enum bpf_attach_type { BPF_XDP_CPUMAP, BPF_SK_LOOKUP, BPF_XDP, + BPF_SCHED, __MAX_BPF_ATTACH_TYPE }; -- 2.20.1

1 6

[PATCH openEuler-1.0-LTS 0/6] sched: Introduce dynamic affinity
by Yongqiang Liu 21 Jul '22

21 Jul '22

*** BLURB HERE *** Hui Tang (6): sched: Introduce dynamic affinity for cfs scheduler cpuset: Introduce new interface for scheduler dynamic affinity sched: Adjust wakeup cpu range according CPU util dynamicly sched: Adjust cpu range in load balance dynamicly sched: Add statistics for scheduler dynamic affinity config: enable CONFIG_QOS_SCHED_DYNAMIC_AFFINITY by default arch/arm64/configs/hulk_defconfig | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/hulk_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/sched.h | 36 ++++++ include/linux/sched/sysctl.h | 4 + init/Kconfig | 10 ++ init/init_task.c | 3 + kernel/cgroup/cpuset.c | 151 ++++++++++++++++++++++- kernel/fork.c | 13 ++ kernel/sched/core.c | 103 ++++++++++++++++ kernel/sched/debug.c | 7 ++ kernel/sched/fair.c | 159 +++++++++++++++++++++++++ kernel/sysctl.c | 11 ++ 14 files changed, 500 insertions(+), 1 deletion(-) -- 2.25.1

1 6

[PATCH openEuler-1.0-LTS 1/3] video: fbdev: sm712fb: Fix crash in smtcfb_read()
by Yongqiang Liu 21 Jul '22

21 Jul '22

From: Helge Deller <deller(a)gmx.de> stable inclusion from stable-v4.19.238 commit 1caa40af491dcfe17b3ae870a854388d8ea01984 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5GKWU CVE: CVE-2022-2380 -------------------------------- Zheyu Ma reported this crash in the sm712fb driver when reading three bytes from the framebuffer: BUG: unable to handle page fault for address: ffffc90001ffffff RIP: 0010:smtcfb_read+0x230/0x3e0 Call Trace: vfs_read+0x198/0xa00 ? do_sys_openat2+0x27d/0x350 ? __fget_light+0x54/0x340 ksys_read+0xce/0x190 do_syscall_64+0x43/0x90 Fix it by removing the open-coded endianess fixup-code and by moving the pointer post decrement out the fb_readl() function. Reported-by: Zheyu Ma <zheyuma97(a)gmail.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Tested-by: Zheyu Ma <zheyuma97(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Longlong <xialonglong1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/video/fbdev/sm712fb.c | 25 +++++++------------------ 1 file changed, 7 insertions(+), 18 deletions(-) diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c index f1dcc6766d1e..0713b8444ecc 100644 --- a/drivers/video/fbdev/sm712fb.c +++ b/drivers/video/fbdev/sm712fb.c @@ -1047,7 +1047,7 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf, if (count + p > total_size) count = total_size - p; - buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL); + buffer = kmalloc(PAGE_SIZE, GFP_KERNEL); if (!buffer) return -ENOMEM; @@ -1059,24 +1059,13 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf, while (count) { c = (count > PAGE_SIZE) ? PAGE_SIZE : count; dst = buffer; - for (i = c >> 2; i--;) { - *dst = fb_readl(src++); - *dst = big_swap(*dst); - dst++; - } - if (c & 3) { - u8 *dst8 = (u8 *)dst; - u8 __iomem *src8 = (u8 __iomem *)src; + for (i = (c + 3) >> 2; i--;) { + u32 val; - for (i = c & 3; i--;) { - if (i & 1) { - *dst8++ = fb_readb(++src8); - } else { - *dst8++ = fb_readb(--src8); - src8 += 2; - } - } - src = (u32 __iomem *)src8; + val = fb_readl(src); + *dst = big_swap(val); + src++; + dst++; } if (copy_to_user(buf, buffer, c)) { -- 2.25.1

1 2

openEuler kernel SIG例会
by openEuler conference 21 Jul '22

21 Jul '22

您好！ Kernel SIG 邀请您参加 2022-07-22 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler kernel SIG例会会议内容： 1、introduce scheduler BPF特性回合评审 2、支持在离线混部任务优先级负载均衡特性回合评审 3、kernel仓支持PR回合补丁介绍 4、kernel仓库瘦身讨论会议链接：https://us06web.zoom.us/j/81074273618?pwd=dTV6UmRETzR6Umd3amU0OFRXVlhndz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-07-22 14:00, The subject of the conference is openEuler kernel SIG例会, Summary: 1、introduce scheduler BPF特性回合评审 2、支持在离线混部任务优先级负载均衡特性回合评审 3、kernel仓支持PR回合补丁介绍 4、kernel仓库瘦身讨论 You can join the meeting at https://us06web.zoom.us/j/81074273618?pwd=dTV6UmRETzR6Umd3amU0OFRXVlhndz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS 1/2] block: don't delete queue kobject before its children
by Yongqiang Liu 20 Jul '22

20 Jul '22

From: Eric Biggers <ebiggers(a)google.com> stable inclusion from linux-4.19.238 commit b2001eb10f59363da930cdd6e086a2861986fa18 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5EWKO CVE: NA -------------------------------- [ Upstream commit 0f69288253e9fc7c495047720e523b9f1aba5712 ] kobjects aren't supposed to be deleted before their child kobjects are deleted. Apparently this is usually benign; however, a WARN will be triggered if one of the child kobjects has a named attribute group: sysfs group 'modes' not found for kobject 'crypto' WARNING: CPU: 0 PID: 1 at fs/sysfs/group.c:278 sysfs_remove_group+0x72/0x80 ... Call Trace: sysfs_remove_groups+0x29/0x40 fs/sysfs/group.c:312 __kobject_del+0x20/0x80 lib/kobject.c:611 kobject_cleanup+0xa4/0x140 lib/kobject.c:696 kobject_release lib/kobject.c:736 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x53/0x70 lib/kobject.c:753 blk_crypto_sysfs_unregister+0x10/0x20 block/blk-crypto-sysfs.c:159 blk_unregister_queue+0xb0/0x110 block/blk-sysfs.c:962 del_gendisk+0x117/0x250 block/genhd.c:610 Fix this by moving the kobject_del() and the corresponding kobject_uevent() to the correct place. Fixes: 2c2086afc2b8 ("block: Protect less code with sysfs_lock in blk_{un,}register_queue()") Reviewed-by: Hannes Reinecke <hare(a)suse.de> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Eric Biggers <ebiggers(a)google.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20220124215938.2769-3-ebiggers@kernel.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflict: block/blk-sysfs.c Signed-off-by: Zhang Wensheng <zhangwensheng5(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- block/blk-sysfs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index 6beca7743c11..ee963759ae10 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -1037,8 +1037,6 @@ void blk_unregister_queue(struct gendisk *disk) blk_mq_unregister_dev(disk_to_dev(disk), q); mutex_unlock(&q->sysfs_lock); - kobject_uevent(&q->kobj, KOBJ_REMOVE); - kobject_del(&q->kobj); blk_trace_remove_sysfs(disk_to_dev(disk)); mutex_lock(&q->sysfs_lock); @@ -1046,5 +1044,9 @@ void blk_unregister_queue(struct gendisk *disk) elv_unregister_queue(q); mutex_unlock(&q->sysfs_lock); + /* Now that we've deleted all child objects, we can delete the queue. */ + kobject_uevent(&q->kobj, KOBJ_REMOVE); + kobject_del(&q->kobj); + kobject_put(&disk_to_dev(disk)->kobj); } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/2] etmem:fix kasan slab-out-of-bounds in do_swapcache_reclaim
by Laibin Qiu 20 Jul '22

20 Jul '22

From: liubo <liubo254(a)huawei.com> euleros inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GN7K CVE: NA -------------------------------- In the do_swapcache_reclaim interface, there is a slab-out-of-bounds kasan problem; The reason for the problem is that when list_for_each_entry_safe_reverse_from traverses the LRU linked list, it does not consider that next may be equal to the head address, which may lead to the head address being accessed as the page address, causing problems. In response to the above problems, add a judgment about whether pos is head. Signed-off-by: liubo <liubo254(a)huawei.com> Reviewed-by: Miaohe Lin <linmiaohe(a)huawei.com> Reviewed-by: wangkefeng <wangkefeng.wang(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- mm/vmscan.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/mm/vmscan.c b/mm/vmscan.c index 42f24473756b..011827f666cc 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -4555,7 +4555,6 @@ EXPORT_SYMBOL_GPL(get_page_from_vaddr); static int add_page_for_reclaim_swapcache(struct page *page, struct list_head *pagelist, struct lruvec *lruvec, enum lru_list lru) { - struct list_head *src = &lruvec->lists[lru]; struct page *head; /* If the page is mapped by more than one process, do not swap it */ @@ -4574,7 +4573,6 @@ static int add_page_for_reclaim_swapcache(struct page *page, reliable_lru_add(lru, head, -hpage_nr_pages(head)); break; case -EBUSY: - list_move(&head->lru, src); return -1; default: break; @@ -4744,7 +4742,7 @@ int do_swapcache_reclaim(unsigned long *swapcache_watermark, * check if pos page is been released or not in LRU list, if true, * cancel the subsequent page scanning of the current node. */ - if (!pos) { + if (!pos || &pos->lru == src) { spin_unlock_irq(&pgdat->lru_lock); continue; } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/8] ext4: fix race condition between ext4_ioctl_setflags and ext4_fiemap
by Yongqiang Liu 20 Jul '22

20 Jul '22

From: Baokun Li <libaokun1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187222, https://gitee.com/openeuler/kernel/issues/I5H3KE CVE: NA -------------------------------- Hulk Robot reported a BUG: ================================================================== kernel BUG at fs/ext4/extents_status.c:762! invalid opcode: 0000 [#1] SMP KASAN PTI [...] Call Trace: ext4_cache_extents+0x238/0x2f0 ext4_find_extent+0x785/0xa40 ext4_fiemap+0x36d/0xe90 do_vfs_ioctl+0x6af/0x1200 [...] ================================================================== Above issue may happen as follows: ------------------------------------- cpu1 cpu2 _____________________|_____________________ do_vfs_ioctl ext4_ioctl ext4_ioctl_setflags ext4_ind_migrate do_vfs_ioctl ioctl_fiemap ext4_fiemap ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS) ext4_fill_fiemap_extents down_write(&EXT4_I(inode)->i_data_sem); ext4_ext_check_inode ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS) memset(ei->i_data, 0, sizeof(ei->i_data)) up_write(&EXT4_I(inode)->i_data_sem); down_read(&EXT4_I(inode)->i_data_sem); ext4_find_extent ext4_cache_extents ext4_es_cache_extent BUG_ON(end < lblk) We can easily reproduce this problem with the syzkaller testcase: ``` 02:37:07 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x40086602, &(0x7f0000000080)={0x17e}) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000180)={0x0, 0x1, 0x0, 0xef3, 0x6, []}) (async, rerun: 32) ioctl$FS_IOC_FSSETXATTR(r1, 0x40086602, &(0x7f0000000140)={0x17e}) (rerun: 32) ``` To solve this issue, we use __generic_block_fiemap() instead of generic_block_fiemap() and add inode_lock_shared to avoid race condition. Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/extents.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index d08e6d4afba6..8e5ed3e315cd 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -5267,13 +5267,18 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, return error; } + inode_lock_shared(inode); /* fallback to generic here if not in extents fmt */ - if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) - return generic_block_fiemap(inode, fieinfo, start, len, + if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) { + error = __generic_block_fiemap(inode, fieinfo, start, len, ext4_get_block); + goto out_unlock; + } - if (fiemap_check_flags(fieinfo, EXT4_FIEMAP_FLAGS)) - return -EBADR; + if (fiemap_check_flags(fieinfo, EXT4_FIEMAP_FLAGS)) { + error = -EBADR; + goto out_unlock; + } if (fieinfo->fi_flags & FIEMAP_FLAG_XATTR) { error = ext4_xattr_fiemap(inode, fieinfo); @@ -5294,6 +5299,8 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, error = ext4_fill_fiemap_extents(inode, start_blk, len_blks, fieinfo); } +out_unlock: + inode_unlock_shared(inode); return error; } -- 2.25.1

1 7

[PATCH openEuler-5.10 01/29] crypto: hisilicon/sec - don't sleep when in softirq
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: Zhengchao Shao <shaozhengchao(a)huawei.com> mainline inclusion from mainline-v5.19-rc6 commit 02884a4f12de11f54d4ca67a07dd1f111d96fdbd category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GEVR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git/c… -------------------------------- When kunpeng920 encryption driver is used to deencrypt and decrypt packets during the softirq, it is not allowed to use mutex lock. The kernel will report the following error: BUG: scheduling while atomic: swapper/57/0/0x00000300 Call trace: dump_backtrace+0x0/0x1e4 show_stack+0x20/0x2c dump_stack+0xd8/0x140 __schedule_bug+0x68/0x80 __schedule+0x728/0x840 schedule+0x50/0xe0 schedule_preempt_disabled+0x18/0x24 __mutex_lock.constprop.0+0x594/0x5dc __mutex_lock_slowpath+0x1c/0x30 mutex_lock+0x50/0x60 sec_request_init+0x8c/0x1a0 [hisi_sec2] sec_process+0x28/0x1ac [hisi_sec2] sec_skcipher_crypto+0xf4/0x1d4 [hisi_sec2] sec_skcipher_encrypt+0x1c/0x30 [hisi_sec2] crypto_skcipher_encrypt+0x2c/0x40 crypto_authenc_encrypt+0xc8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp_output_tail+0x348/0x5c0 [esp4] esp_output+0x120/0x19c [esp4] xfrm_output_one+0x25c/0x4d4 xfrm_output_resume+0x6c/0x1fc xfrm_output+0xac/0x3c0 xfrm4_output+0x64/0x130 ip_build_and_send_pkt+0x158/0x20c tcp_v4_send_synack+0xdc/0x1f0 tcp_conn_request+0x7d0/0x994 tcp_v4_conn_request+0x58/0x6c tcp_v6_conn_request+0xf0/0x100 tcp_rcv_state_process+0x1cc/0xd60 tcp_v4_do_rcv+0x10c/0x250 tcp_v4_rcv+0xfc4/0x10a4 ip_protocol_deliver_rcu+0xf4/0x200 ip_local_deliver_finish+0x58/0x70 ip_local_deliver+0x68/0x120 ip_sublist_rcv_finish+0x70/0x94 ip_list_rcv_finish.constprop.0+0x17c/0x1d0 ip_sublist_rcv+0x40/0xb0 ip_list_rcv+0x140/0x1dc __netif_receive_skb_list_core+0x154/0x28c __netif_receive_skb_list+0x120/0x1a0 netif_receive_skb_list_internal+0xe4/0x1f0 napi_complete_done+0x70/0x1f0 gro_cell_poll+0x9c/0xb0 napi_poll+0xcc/0x264 net_rx_action+0xd4/0x21c __do_softirq+0x130/0x358 irq_exit+0x11c/0x13c __handle_domain_irq+0x88/0xf0 gic_handle_irq+0x78/0x2c0 el1_irq+0xb8/0x140 arch_cpu_idle+0x18/0x40 default_idle_call+0x5c/0x1c0 cpuidle_idle_call+0x174/0x1b0 do_idle+0xc8/0x160 cpu_startup_entry+0x30/0x11c secondary_start_kernel+0x158/0x1e4 softirq: huh, entered softirq 3 NET_RX 0000000093774ee4 with preempt_count 00000100, exited with fffffe00? Fixes: 416d82204df4 ("crypto: hisilicon - add HiSilicon SEC V2 driver") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/crypto/hisilicon/sec2/sec.h | 2 +- drivers/crypto/hisilicon/sec2/sec_crypto.c | 20 ++++++++++---------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h index c2e9b01187a7..a44c8dba3cda 100644 --- a/drivers/crypto/hisilicon/sec2/sec.h +++ b/drivers/crypto/hisilicon/sec2/sec.h @@ -119,7 +119,7 @@ struct sec_qp_ctx { struct idr req_idr; struct sec_alg_res res[QM_Q_DEPTH]; struct sec_ctx *ctx; - struct mutex req_lock; + spinlock_t req_lock; struct list_head backlog; struct hisi_acc_sgl_pool *c_in_pool; struct hisi_acc_sgl_pool *c_out_pool; diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c index 6eebe739893c..71dfa7db6394 100644 --- a/drivers/crypto/hisilicon/sec2/sec_crypto.c +++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c @@ -127,11 +127,11 @@ static int sec_alloc_req_id(struct sec_req *req, struct sec_qp_ctx *qp_ctx) { int req_id; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); req_id = idr_alloc_cyclic(&qp_ctx->req_idr, NULL, 0, QM_Q_DEPTH, GFP_ATOMIC); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); if (unlikely(req_id < 0)) { dev_err(req->ctx->dev, "alloc req id fail!\n"); return req_id; @@ -156,9 +156,9 @@ static void sec_free_req_id(struct sec_req *req) qp_ctx->req_list[req_id] = NULL; req->qp_ctx = NULL; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); idr_remove(&qp_ctx->req_idr, req_id); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); } static u8 pre_parse_finished_bd(struct bd_status *status, void *resp) @@ -273,7 +273,7 @@ static int sec_bd_send(struct sec_ctx *ctx, struct sec_req *req) !(req->flag & CRYPTO_TFM_REQ_MAY_BACKLOG)) return -EBUSY; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); ret = hisi_qp_send(qp_ctx->qp, &req->sec_sqe); if (ctx->fake_req_limit <= @@ -281,10 +281,10 @@ static int sec_bd_send(struct sec_ctx *ctx, struct sec_req *req) list_add_tail(&req->backlog_head, &qp_ctx->backlog); atomic64_inc(&ctx->sec->debug.dfx.send_cnt); atomic64_inc(&ctx->sec->debug.dfx.send_busy_cnt); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); return -EBUSY; } - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); if (unlikely(ret == -EBUSY)) return -ENOBUFS; @@ -487,7 +487,7 @@ static int sec_create_qp_ctx(struct hisi_qm *qm, struct sec_ctx *ctx, qp->req_cb = sec_req_cb; - mutex_init(&qp_ctx->req_lock); + spin_lock_init(&qp_ctx->req_lock); idr_init(&qp_ctx->req_idr); INIT_LIST_HEAD(&qp_ctx->backlog); @@ -1382,7 +1382,7 @@ static struct sec_req *sec_back_req_clear(struct sec_ctx *ctx, { struct sec_req *backlog_req = NULL; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); if (ctx->fake_req_limit >= atomic_read(&qp_ctx->qp->qp_status.used) && !list_empty(&qp_ctx->backlog)) { @@ -1390,7 +1390,7 @@ static struct sec_req *sec_back_req_clear(struct sec_ctx *ctx, typeof(*backlog_req), backlog_head); list_del(&backlog_req->backlog_head); } - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); return backlog_req; } -- 2.20.1

1 28

[PATCH openEuler-5.10-LTS 1/5] crypto: hisilicon/sec - don't sleep when in softirq
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: Zhengchao Shao <shaozhengchao(a)huawei.com> mainline inclusion from mainline-v5.19-rc6 commit 02884a4f12de11f54d4ca67a07dd1f111d96fdbd category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GEVR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git/c… -------------------------------- When kunpeng920 encryption driver is used to deencrypt and decrypt packets during the softirq, it is not allowed to use mutex lock. The kernel will report the following error: BUG: scheduling while atomic: swapper/57/0/0x00000300 Call trace: dump_backtrace+0x0/0x1e4 show_stack+0x20/0x2c dump_stack+0xd8/0x140 __schedule_bug+0x68/0x80 __schedule+0x728/0x840 schedule+0x50/0xe0 schedule_preempt_disabled+0x18/0x24 __mutex_lock.constprop.0+0x594/0x5dc __mutex_lock_slowpath+0x1c/0x30 mutex_lock+0x50/0x60 sec_request_init+0x8c/0x1a0 [hisi_sec2] sec_process+0x28/0x1ac [hisi_sec2] sec_skcipher_crypto+0xf4/0x1d4 [hisi_sec2] sec_skcipher_encrypt+0x1c/0x30 [hisi_sec2] crypto_skcipher_encrypt+0x2c/0x40 crypto_authenc_encrypt+0xc8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp_output_tail+0x348/0x5c0 [esp4] esp_output+0x120/0x19c [esp4] xfrm_output_one+0x25c/0x4d4 xfrm_output_resume+0x6c/0x1fc xfrm_output+0xac/0x3c0 xfrm4_output+0x64/0x130 ip_build_and_send_pkt+0x158/0x20c tcp_v4_send_synack+0xdc/0x1f0 tcp_conn_request+0x7d0/0x994 tcp_v4_conn_request+0x58/0x6c tcp_v6_conn_request+0xf0/0x100 tcp_rcv_state_process+0x1cc/0xd60 tcp_v4_do_rcv+0x10c/0x250 tcp_v4_rcv+0xfc4/0x10a4 ip_protocol_deliver_rcu+0xf4/0x200 ip_local_deliver_finish+0x58/0x70 ip_local_deliver+0x68/0x120 ip_sublist_rcv_finish+0x70/0x94 ip_list_rcv_finish.constprop.0+0x17c/0x1d0 ip_sublist_rcv+0x40/0xb0 ip_list_rcv+0x140/0x1dc __netif_receive_skb_list_core+0x154/0x28c __netif_receive_skb_list+0x120/0x1a0 netif_receive_skb_list_internal+0xe4/0x1f0 napi_complete_done+0x70/0x1f0 gro_cell_poll+0x9c/0xb0 napi_poll+0xcc/0x264 net_rx_action+0xd4/0x21c __do_softirq+0x130/0x358 irq_exit+0x11c/0x13c __handle_domain_irq+0x88/0xf0 gic_handle_irq+0x78/0x2c0 el1_irq+0xb8/0x140 arch_cpu_idle+0x18/0x40 default_idle_call+0x5c/0x1c0 cpuidle_idle_call+0x174/0x1b0 do_idle+0xc8/0x160 cpu_startup_entry+0x30/0x11c secondary_start_kernel+0x158/0x1e4 softirq: huh, entered softirq 3 NET_RX 0000000093774ee4 with preempt_count 00000100, exited with fffffe00? Fixes: 416d82204df4 ("crypto: hisilicon - add HiSilicon SEC V2 driver") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/crypto/hisilicon/sec2/sec.h | 2 +- drivers/crypto/hisilicon/sec2/sec_crypto.c | 20 ++++++++++---------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h index d97cf02b1df7..cff00fd29765 100644 --- a/drivers/crypto/hisilicon/sec2/sec.h +++ b/drivers/crypto/hisilicon/sec2/sec.h @@ -119,7 +119,7 @@ struct sec_qp_ctx { struct idr req_idr; struct sec_alg_res res[QM_Q_DEPTH]; struct sec_ctx *ctx; - struct mutex req_lock; + spinlock_t req_lock; struct list_head backlog; struct hisi_acc_sgl_pool *c_in_pool; struct hisi_acc_sgl_pool *c_out_pool; diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c index 9d0a39f60fb2..b2228a935dcd 100644 --- a/drivers/crypto/hisilicon/sec2/sec_crypto.c +++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c @@ -127,11 +127,11 @@ static int sec_alloc_req_id(struct sec_req *req, struct sec_qp_ctx *qp_ctx) { int req_id; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); req_id = idr_alloc_cyclic(&qp_ctx->req_idr, NULL, 0, QM_Q_DEPTH, GFP_ATOMIC); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); if (unlikely(req_id < 0)) { dev_err(req->ctx->dev, "alloc req id fail!\n"); return req_id; @@ -156,9 +156,9 @@ static void sec_free_req_id(struct sec_req *req) qp_ctx->req_list[req_id] = NULL; req->qp_ctx = NULL; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); idr_remove(&qp_ctx->req_idr, req_id); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); } static u8 pre_parse_finished_bd(struct bd_status *status, void *resp) @@ -273,7 +273,7 @@ static int sec_bd_send(struct sec_ctx *ctx, struct sec_req *req) !(req->flag & CRYPTO_TFM_REQ_MAY_BACKLOG)) return -EBUSY; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); ret = hisi_qp_send(qp_ctx->qp, &req->sec_sqe); if (ctx->fake_req_limit <= @@ -281,10 +281,10 @@ static int sec_bd_send(struct sec_ctx *ctx, struct sec_req *req) list_add_tail(&req->backlog_head, &qp_ctx->backlog); atomic64_inc(&ctx->sec->debug.dfx.send_cnt); atomic64_inc(&ctx->sec->debug.dfx.send_busy_cnt); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); return -EBUSY; } - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); if (unlikely(ret == -EBUSY)) return -ENOBUFS; @@ -487,7 +487,7 @@ static int sec_create_qp_ctx(struct hisi_qm *qm, struct sec_ctx *ctx, qp->req_cb = sec_req_cb; - mutex_init(&qp_ctx->req_lock); + spin_lock_init(&qp_ctx->req_lock); idr_init(&qp_ctx->req_idr); INIT_LIST_HEAD(&qp_ctx->backlog); @@ -1382,7 +1382,7 @@ static struct sec_req *sec_back_req_clear(struct sec_ctx *ctx, { struct sec_req *backlog_req = NULL; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); if (ctx->fake_req_limit >= atomic_read(&qp_ctx->qp->qp_status.used) && !list_empty(&qp_ctx->backlog)) { @@ -1390,7 +1390,7 @@ static struct sec_req *sec_back_req_clear(struct sec_ctx *ctx, typeof(*backlog_req), backlog_head); list_del(&backlog_req->backlog_head); } - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); return backlog_req; } -- 2.20.1

1 4

[PATCH openEuler-5.10 01/46] Driver for Zhaoxin CPU core temperature monitoring
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> zhaoxin inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I52DS7 CVE: NA -------------------------------------------- Add support for the temperature sensor inside CPU. Supported are all known variants of the Zhaoxin processors. v1: Fix some character encoding mistaken. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/hwmon/Kconfig | 9 + drivers/hwmon/Makefile | 1 + drivers/hwmon/via-cputemp.c | 1 - drivers/hwmon/zhaoxin-cputemp.c | 292 ++++++++++++++++++++++++++++++++ 4 files changed, 302 insertions(+), 1 deletion(-) create mode 100644 drivers/hwmon/zhaoxin-cputemp.c diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig index 45a1a5969d01..f2fe56e6f8bd 100644 --- a/drivers/hwmon/Kconfig +++ b/drivers/hwmon/Kconfig @@ -1899,6 +1899,15 @@ config SENSORS_VIA_CPUTEMP sensor inside your CPU. Supported are all known variants of the VIA C7 and Nano. +config SENSORS_ZHAOXIN_CPUTEMP + tristate "Zhaoxin CPU temperature sensor" + depends on X86 + select HWMON_VID + help + If you say yes here you get support for the temperature + sensor inside your CPU. Supported are all known variants of + the Zhaoxin processors. + config SENSORS_VIA686A tristate "VIA686A" depends on PCI diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile index c22a5316bd91..95908c478b94 100644 --- a/drivers/hwmon/Makefile +++ b/drivers/hwmon/Makefile @@ -184,6 +184,7 @@ obj-$(CONFIG_SENSORS_TMP421) += tmp421.o obj-$(CONFIG_SENSORS_TMP513) += tmp513.o obj-$(CONFIG_SENSORS_VEXPRESS) += vexpress-hwmon.o obj-$(CONFIG_SENSORS_VIA_CPUTEMP)+= via-cputemp.o +obj-$(CONFIG_SENSORS_ZHAOXIN_CPUTEMP) += zhaoxin-cputemp.o obj-$(CONFIG_SENSORS_VIA686A) += via686a.o obj-$(CONFIG_SENSORS_VT1211) += vt1211.o obj-$(CONFIG_SENSORS_VT8231) += vt8231.o diff --git a/drivers/hwmon/via-cputemp.c b/drivers/hwmon/via-cputemp.c index e5d18dac8ee7..0a5057dbe51a 100644 --- a/drivers/hwmon/via-cputemp.c +++ b/drivers/hwmon/via-cputemp.c @@ -273,7 +273,6 @@ static const struct x86_cpu_id __initconst cputemp_ids[] = { X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_A, NULL), X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_D, NULL), X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_NANO, NULL), - X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), {} }; MODULE_DEVICE_TABLE(x86cpu, cputemp_ids); diff --git a/drivers/hwmon/zhaoxin-cputemp.c b/drivers/hwmon/zhaoxin-cputemp.c new file mode 100644 index 000000000000..39e729590eba --- /dev/null +++ b/drivers/hwmon/zhaoxin-cputemp.c @@ -0,0 +1,292 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * zhaoxin-cputemp.c - Driver for Zhaoxin CPU core temperature monitoring + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include <linux/module.h> +#include <linux/init.h> +#include <linux/slab.h> +#include <linux/hwmon.h> +#include <linux/hwmon-vid.h> +#include <linux/sysfs.h> +#include <linux/hwmon-sysfs.h> +#include <linux/err.h> +#include <linux/mutex.h> +#include <linux/list.h> +#include <linux/platform_device.h> +#include <linux/cpu.h> +#include <asm/msr.h> +#include <asm/processor.h> +#include <asm/cpu_device_id.h> + +#define DRVNAME "zhaoxin_cputemp" + +enum { SHOW_TEMP, SHOW_LABEL, SHOW_NAME }; + +/* Functions declaration */ + +struct zhaoxin_cputemp_data { + struct device *hwmon_dev; + const char *name; + u8 vrm; + u32 id; + u32 msr_temp; + u32 msr_vid; +}; + +/* Sysfs stuff */ + +static ssize_t name_show(struct device *dev, struct device_attribute *devattr, + char *buf) +{ + int ret; + struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr); + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + + if (attr->index == SHOW_NAME) + ret = sprintf(buf, "%s\n", data->name); + else /* show label */ + ret = sprintf(buf, "Core %d\n", data->id); + return ret; +} + +static ssize_t temp_show(struct device *dev, struct device_attribute *devattr, char *buf) +{ + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + u32 eax, edx; + int err; + + err = rdmsr_safe_on_cpu(data->id, data->msr_temp, &eax, &edx); + if (err) + return -EAGAIN; + + return sprintf(buf, "%lu\n", ((unsigned long)eax & 0xffffff) * 1000); +} + +static ssize_t cpu0_vid_show(struct device *dev, struct device_attribute *devattr, char *buf) +{ + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + u32 eax, edx; + int err; + + err = rdmsr_safe_on_cpu(data->id, data->msr_vid, &eax, &edx); + if (err) + return -EAGAIN; + + return sprintf(buf, "%d\n", vid_from_reg(~edx & 0x7f, data->vrm)); +} + +static SENSOR_DEVICE_ATTR_RO(temp1_input, temp, SHOW_TEMP); +static SENSOR_DEVICE_ATTR_RO(temp1_label, name, SHOW_LABEL); +static SENSOR_DEVICE_ATTR_RO(name, name, SHOW_NAME); + +static struct attribute *zhaoxin_cputemp_attributes[] = { + &sensor_dev_attr_name.dev_attr.attr, + &sensor_dev_attr_temp1_label.dev_attr.attr, + &sensor_dev_attr_temp1_input.dev_attr.attr, + NULL +}; + +static const struct attribute_group zhaoxin_cputemp_group = { + .attrs = zhaoxin_cputemp_attributes, +}; + +/* Optional attributes */ +static DEVICE_ATTR_RO(cpu0_vid); + +static int zhaoxin_cputemp_probe(struct platform_device *pdev) +{ + struct zhaoxin_cputemp_data *data; + int err; + u32 eax, edx; + + data = devm_kzalloc(&pdev->dev, sizeof(struct zhaoxin_cputemp_data), GFP_KERNEL); + if (!data) + return -ENOMEM; + + data->id = pdev->id; + data->name = "zhaoxin_cputemp"; + data->msr_temp = 0x1423; + + /* test if we can access the TEMPERATURE MSR */ + err = rdmsr_safe_on_cpu(data->id, data->msr_temp, &eax, &edx); + if (err) { + dev_err(&pdev->dev, "Unable to access TEMPERATURE MSR, giving up\n"); + return err; + } + + platform_set_drvdata(pdev, data); + + err = sysfs_create_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + if (err) + return err; + + if (data->msr_vid) + data->vrm = vid_which_vrm(); + + if (data->vrm) { + err = device_create_file(&pdev->dev, &dev_attr_cpu0_vid); + if (err) + goto exit_remove; + } + + data->hwmon_dev = hwmon_device_register(&pdev->dev); + if (IS_ERR(data->hwmon_dev)) { + err = PTR_ERR(data->hwmon_dev); + dev_err(&pdev->dev, "Class registration failed (%d)\n", err); + goto exit_remove; + } + + return 0; + +exit_remove: + if (data->vrm) + device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + return err; +} + +static int zhaoxin_cputemp_remove(struct platform_device *pdev) +{ + struct zhaoxin_cputemp_data *data = platform_get_drvdata(pdev); + + hwmon_device_unregister(data->hwmon_dev); + if (data->vrm) + device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + return 0; +} + +static struct platform_driver zhaoxin_cputemp_driver = { + .driver = { + .name = DRVNAME, + }, + .probe = zhaoxin_cputemp_probe, + .remove = zhaoxin_cputemp_remove, +}; + +struct pdev_entry { + struct list_head list; + struct platform_device *pdev; + unsigned int cpu; +}; + +static LIST_HEAD(pdev_list); +static DEFINE_MUTEX(pdev_list_mutex); + +static int zhaoxin_cputemp_online(unsigned int cpu) +{ + int err; + struct platform_device *pdev; + struct pdev_entry *pdev_entry; + + pdev = platform_device_alloc(DRVNAME, cpu); + if (!pdev) { + err = -ENOMEM; + pr_err("Device allocation failed\n"); + goto exit; + } + + pdev_entry = kzalloc(sizeof(struct pdev_entry), GFP_KERNEL); + if (!pdev_entry) { + err = -ENOMEM; + goto exit_device_put; + } + + err = platform_device_add(pdev); + if (err) { + pr_err("Device addition failed (%d)\n", err); + goto exit_device_free; + } + + pdev_entry->pdev = pdev; + pdev_entry->cpu = cpu; + mutex_lock(&pdev_list_mutex); + list_add_tail(&pdev_entry->list, &pdev_list); + mutex_unlock(&pdev_list_mutex); + + return 0; + +exit_device_free: + kfree(pdev_entry); +exit_device_put: + platform_device_put(pdev); +exit: + return err; +} + +static int zhaoxin_cputemp_down_prep(unsigned int cpu) +{ + struct pdev_entry *p; + + mutex_lock(&pdev_list_mutex); + list_for_each_entry(p, &pdev_list, list) { + if (p->cpu == cpu) { + platform_device_unregister(p->pdev); + list_del(&p->list); + mutex_unlock(&pdev_list_mutex); + kfree(p); + return 0; + } + } + mutex_unlock(&pdev_list_mutex); + return 0; +} + +static const struct x86_cpu_id __initconst cputemp_ids[] = { + X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), + X86_MATCH_VENDOR_FAM_MODEL(ZHAOXIN, 7, X86_MODEL_ANY, NULL), + {} +}; +MODULE_DEVICE_TABLE(x86cpu, cputemp_ids); + +static enum cpuhp_state zhaoxin_temp_online; + +static int __init zhaoxin_cputemp_init(void) +{ + int err; + + if (!x86_match_cpu(cputemp_ids)) + return -ENODEV; + + err = platform_driver_register(&zhaoxin_cputemp_driver); + if (err) + goto exit; + + err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hwmon/zhaoxin:online", + zhaoxin_cputemp_online, zhaoxin_cputemp_down_prep); + if (err < 0) + goto exit_driver_unreg; + zhaoxin_temp_online = err; + +#ifndef CONFIG_HOTPLUG_CPU + if (list_empty(&pdev_list)) { + err = -ENODEV; + goto exit_hp_unreg; + } +#endif + return 0; + +#ifndef CONFIG_HOTPLUG_CPU +exit_hp_unreg: + cpuhp_remove_state_nocalls(zhaoxin_temp_online); +#endif +exit_driver_unreg: + platform_driver_unregister(&zhaoxin_cputemp_driver); +exit: + return err; +} + +static void __exit zhaoxin_cputemp_exit(void) +{ + cpuhp_remove_state(zhaoxin_temp_online); + platform_driver_unregister(&zhaoxin_cputemp_driver); +} + +MODULE_DESCRIPTION("Zhaoxin CPU temperature monitor"); +MODULE_LICENSE("GPL"); + +module_init(zhaoxin_cputemp_init) +module_exit(zhaoxin_cputemp_exit) -- 2.20.1

1 45

[PATCH openEuler-5.10-LTS 01/10] Driver for Zhaoxin CPU core temperature monitoring
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> zhaoxin inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I52DS7 CVE: NA -------------------------------------------- Add support for the temperature sensor inside CPU. Supported are all known variants of the Zhaoxin processors. v1: Fix some character encoding mistaken. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/hwmon/Kconfig | 9 + drivers/hwmon/Makefile | 1 + drivers/hwmon/via-cputemp.c | 1 - drivers/hwmon/zhaoxin-cputemp.c | 292 ++++++++++++++++++++++++++++++++ 4 files changed, 302 insertions(+), 1 deletion(-) create mode 100644 drivers/hwmon/zhaoxin-cputemp.c diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig index 45a1a5969d01..f2fe56e6f8bd 100644 --- a/drivers/hwmon/Kconfig +++ b/drivers/hwmon/Kconfig @@ -1899,6 +1899,15 @@ config SENSORS_VIA_CPUTEMP sensor inside your CPU. Supported are all known variants of the VIA C7 and Nano. +config SENSORS_ZHAOXIN_CPUTEMP + tristate "Zhaoxin CPU temperature sensor" + depends on X86 + select HWMON_VID + help + If you say yes here you get support for the temperature + sensor inside your CPU. Supported are all known variants of + the Zhaoxin processors. + config SENSORS_VIA686A tristate "VIA686A" depends on PCI diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile index c22a5316bd91..95908c478b94 100644 --- a/drivers/hwmon/Makefile +++ b/drivers/hwmon/Makefile @@ -184,6 +184,7 @@ obj-$(CONFIG_SENSORS_TMP421) += tmp421.o obj-$(CONFIG_SENSORS_TMP513) += tmp513.o obj-$(CONFIG_SENSORS_VEXPRESS) += vexpress-hwmon.o obj-$(CONFIG_SENSORS_VIA_CPUTEMP)+= via-cputemp.o +obj-$(CONFIG_SENSORS_ZHAOXIN_CPUTEMP) += zhaoxin-cputemp.o obj-$(CONFIG_SENSORS_VIA686A) += via686a.o obj-$(CONFIG_SENSORS_VT1211) += vt1211.o obj-$(CONFIG_SENSORS_VT8231) += vt8231.o diff --git a/drivers/hwmon/via-cputemp.c b/drivers/hwmon/via-cputemp.c index e5d18dac8ee7..0a5057dbe51a 100644 --- a/drivers/hwmon/via-cputemp.c +++ b/drivers/hwmon/via-cputemp.c @@ -273,7 +273,6 @@ static const struct x86_cpu_id __initconst cputemp_ids[] = { X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_A, NULL), X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_D, NULL), X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_NANO, NULL), - X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), {} }; MODULE_DEVICE_TABLE(x86cpu, cputemp_ids); diff --git a/drivers/hwmon/zhaoxin-cputemp.c b/drivers/hwmon/zhaoxin-cputemp.c new file mode 100644 index 000000000000..39e729590eba --- /dev/null +++ b/drivers/hwmon/zhaoxin-cputemp.c @@ -0,0 +1,292 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * zhaoxin-cputemp.c - Driver for Zhaoxin CPU core temperature monitoring + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include <linux/module.h> +#include <linux/init.h> +#include <linux/slab.h> +#include <linux/hwmon.h> +#include <linux/hwmon-vid.h> +#include <linux/sysfs.h> +#include <linux/hwmon-sysfs.h> +#include <linux/err.h> +#include <linux/mutex.h> +#include <linux/list.h> +#include <linux/platform_device.h> +#include <linux/cpu.h> +#include <asm/msr.h> +#include <asm/processor.h> +#include <asm/cpu_device_id.h> + +#define DRVNAME "zhaoxin_cputemp" + +enum { SHOW_TEMP, SHOW_LABEL, SHOW_NAME }; + +/* Functions declaration */ + +struct zhaoxin_cputemp_data { + struct device *hwmon_dev; + const char *name; + u8 vrm; + u32 id; + u32 msr_temp; + u32 msr_vid; +}; + +/* Sysfs stuff */ + +static ssize_t name_show(struct device *dev, struct device_attribute *devattr, + char *buf) +{ + int ret; + struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr); + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + + if (attr->index == SHOW_NAME) + ret = sprintf(buf, "%s\n", data->name); + else /* show label */ + ret = sprintf(buf, "Core %d\n", data->id); + return ret; +} + +static ssize_t temp_show(struct device *dev, struct device_attribute *devattr, char *buf) +{ + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + u32 eax, edx; + int err; + + err = rdmsr_safe_on_cpu(data->id, data->msr_temp, &eax, &edx); + if (err) + return -EAGAIN; + + return sprintf(buf, "%lu\n", ((unsigned long)eax & 0xffffff) * 1000); +} + +static ssize_t cpu0_vid_show(struct device *dev, struct device_attribute *devattr, char *buf) +{ + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + u32 eax, edx; + int err; + + err = rdmsr_safe_on_cpu(data->id, data->msr_vid, &eax, &edx); + if (err) + return -EAGAIN; + + return sprintf(buf, "%d\n", vid_from_reg(~edx & 0x7f, data->vrm)); +} + +static SENSOR_DEVICE_ATTR_RO(temp1_input, temp, SHOW_TEMP); +static SENSOR_DEVICE_ATTR_RO(temp1_label, name, SHOW_LABEL); +static SENSOR_DEVICE_ATTR_RO(name, name, SHOW_NAME); + +static struct attribute *zhaoxin_cputemp_attributes[] = { + &sensor_dev_attr_name.dev_attr.attr, + &sensor_dev_attr_temp1_label.dev_attr.attr, + &sensor_dev_attr_temp1_input.dev_attr.attr, + NULL +}; + +static const struct attribute_group zhaoxin_cputemp_group = { + .attrs = zhaoxin_cputemp_attributes, +}; + +/* Optional attributes */ +static DEVICE_ATTR_RO(cpu0_vid); + +static int zhaoxin_cputemp_probe(struct platform_device *pdev) +{ + struct zhaoxin_cputemp_data *data; + int err; + u32 eax, edx; + + data = devm_kzalloc(&pdev->dev, sizeof(struct zhaoxin_cputemp_data), GFP_KERNEL); + if (!data) + return -ENOMEM; + + data->id = pdev->id; + data->name = "zhaoxin_cputemp"; + data->msr_temp = 0x1423; + + /* test if we can access the TEMPERATURE MSR */ + err = rdmsr_safe_on_cpu(data->id, data->msr_temp, &eax, &edx); + if (err) { + dev_err(&pdev->dev, "Unable to access TEMPERATURE MSR, giving up\n"); + return err; + } + + platform_set_drvdata(pdev, data); + + err = sysfs_create_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + if (err) + return err; + + if (data->msr_vid) + data->vrm = vid_which_vrm(); + + if (data->vrm) { + err = device_create_file(&pdev->dev, &dev_attr_cpu0_vid); + if (err) + goto exit_remove; + } + + data->hwmon_dev = hwmon_device_register(&pdev->dev); + if (IS_ERR(data->hwmon_dev)) { + err = PTR_ERR(data->hwmon_dev); + dev_err(&pdev->dev, "Class registration failed (%d)\n", err); + goto exit_remove; + } + + return 0; + +exit_remove: + if (data->vrm) + device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + return err; +} + +static int zhaoxin_cputemp_remove(struct platform_device *pdev) +{ + struct zhaoxin_cputemp_data *data = platform_get_drvdata(pdev); + + hwmon_device_unregister(data->hwmon_dev); + if (data->vrm) + device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + return 0; +} + +static struct platform_driver zhaoxin_cputemp_driver = { + .driver = { + .name = DRVNAME, + }, + .probe = zhaoxin_cputemp_probe, + .remove = zhaoxin_cputemp_remove, +}; + +struct pdev_entry { + struct list_head list; + struct platform_device *pdev; + unsigned int cpu; +}; + +static LIST_HEAD(pdev_list); +static DEFINE_MUTEX(pdev_list_mutex); + +static int zhaoxin_cputemp_online(unsigned int cpu) +{ + int err; + struct platform_device *pdev; + struct pdev_entry *pdev_entry; + + pdev = platform_device_alloc(DRVNAME, cpu); + if (!pdev) { + err = -ENOMEM; + pr_err("Device allocation failed\n"); + goto exit; + } + + pdev_entry = kzalloc(sizeof(struct pdev_entry), GFP_KERNEL); + if (!pdev_entry) { + err = -ENOMEM; + goto exit_device_put; + } + + err = platform_device_add(pdev); + if (err) { + pr_err("Device addition failed (%d)\n", err); + goto exit_device_free; + } + + pdev_entry->pdev = pdev; + pdev_entry->cpu = cpu; + mutex_lock(&pdev_list_mutex); + list_add_tail(&pdev_entry->list, &pdev_list); + mutex_unlock(&pdev_list_mutex); + + return 0; + +exit_device_free: + kfree(pdev_entry); +exit_device_put: + platform_device_put(pdev); +exit: + return err; +} + +static int zhaoxin_cputemp_down_prep(unsigned int cpu) +{ + struct pdev_entry *p; + + mutex_lock(&pdev_list_mutex); + list_for_each_entry(p, &pdev_list, list) { + if (p->cpu == cpu) { + platform_device_unregister(p->pdev); + list_del(&p->list); + mutex_unlock(&pdev_list_mutex); + kfree(p); + return 0; + } + } + mutex_unlock(&pdev_list_mutex); + return 0; +} + +static const struct x86_cpu_id __initconst cputemp_ids[] = { + X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), + X86_MATCH_VENDOR_FAM_MODEL(ZHAOXIN, 7, X86_MODEL_ANY, NULL), + {} +}; +MODULE_DEVICE_TABLE(x86cpu, cputemp_ids); + +static enum cpuhp_state zhaoxin_temp_online; + +static int __init zhaoxin_cputemp_init(void) +{ + int err; + + if (!x86_match_cpu(cputemp_ids)) + return -ENODEV; + + err = platform_driver_register(&zhaoxin_cputemp_driver); + if (err) + goto exit; + + err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hwmon/zhaoxin:online", + zhaoxin_cputemp_online, zhaoxin_cputemp_down_prep); + if (err < 0) + goto exit_driver_unreg; + zhaoxin_temp_online = err; + +#ifndef CONFIG_HOTPLUG_CPU + if (list_empty(&pdev_list)) { + err = -ENODEV; + goto exit_hp_unreg; + } +#endif + return 0; + +#ifndef CONFIG_HOTPLUG_CPU +exit_hp_unreg: + cpuhp_remove_state_nocalls(zhaoxin_temp_online); +#endif +exit_driver_unreg: + platform_driver_unregister(&zhaoxin_cputemp_driver); +exit: + return err; +} + +static void __exit zhaoxin_cputemp_exit(void) +{ + cpuhp_remove_state(zhaoxin_temp_online); + platform_driver_unregister(&zhaoxin_cputemp_driver); +} + +MODULE_DESCRIPTION("Zhaoxin CPU temperature monitor"); +MODULE_LICENSE("GPL"); + +module_init(zhaoxin_cputemp_init) +module_exit(zhaoxin_cputemp_exit) -- 2.20.1

1 9

[PATCH openEuler-5.10 00/95] Backport 5.10.112 LTS
by Zheng Zengkai 19 Jul '22

19 Jul '22

Backport 5.10.112 LTS patches from upstream. git cherry-pick v5.10.111..v5.10.112~1 -s Complicts: Already merged(10): 80a4df14643f7 hamradio: defer 6pack kfree after unregister_netdev cfa98ffc42f16 hamradio: remove needs_free_netdev to avoid UAF 5ea00fc60676 ax25: add refcount in ax25_dev to avoid UAF bugs 5ddae8d06441 ax25: fix reference count leaks of ax25_dev 57cc15f5fd55 ax25: fix UAF bugs of net_device caused by rebinding operation b20a5ab0f5fb ax25: Fix refcount leaks caused by ax25_cb_del() a4942c6fea87 ax25: fix UAF bug in ax25_send_control() 145ea8d213e8 ax25: fix NPD bug in ax25_disconnect f934fa478dd1 ax25: Fix NULL pointer dereferences in ax25 timers 5c62d3bf1410 ax25: Fix UAF bugs in ax25 timers Rejected(1, KABI changed and hard to fix): 845f44ce3d9f net/sched: flower: fix parsing of ethertype following VLAN header KABI fixes(2): scsi: iscsi: fix kabi broken in struct iscsi_cls_conn scsi: iscsi: fix kabi broken in struct iscsi_transport Total patches: 104 - 10 - 1 + 2 = 95 Adrian Hunter (1): perf tools: Fix misleading add event PMU debug message Ajish Koshy (2): scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63 scsi: pm80xx: Enable upper inbound, outbound queues Alexey Galakhov (1): scsi: mvsas: Add PCI ID of RocketRaid 2640 Andy Chiu (1): net: axienet: setup mdio unconditionally Anna-Maria Behnsen (1): timers: Fix warning condition in __run_timers() Athira Rajeev (1): testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set Aurabindo Pillai (1): drm/amd: Add USBC connector ID Benedikt Spranger (1): net/sched: taprio: Check if socket flags are valid Borislav Petkov (1): perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant Calvin Johnson (1): net: mdio: Alphabetically sort header inclusion Chandrakanth patil (1): scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan Chao Gao (1): dma-direct: avoid redundant memory sync for swiotlb Charlene Liu (1): drm/amd/display: fix audio format not updated after edid updated Chiawen Huang (1): drm/amd/display: FEC check in timing validation Christian Lamparter (1): ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs Chuck Lever (1): SUNRPC: Fix the svc_deferred_event trace class Cristian Marussi (1): firmware: arm_scmi: Fix sorting of retrieved clock rates Darrick J. Wong (1): btrfs: fix fallocate to use file_modified to update permissions consistently Dinh Nguyen (1): net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link Duoming Zhou (1): drivers: net: slip: fix NPD bug in sl_tx_timeout() Fabio M. De Francesco (1): ALSA: pcm: Test for "silence" field in struct "pcm_format_data" Felix Kuehling (1): drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu Guillaume Nault (1): veth: Ensure eth header is in skb's linear part Harshit Mogalapalli (1): cifs: potential buffer overflow in handling symlinks James Smart (1): scsi: lpfc: Fix queue failures when recovering from PCI parity error Jason A. Donenfeld (1): gcc-plugins: latent_entropy: use /dev/urandom Jeremy Linton (1): net: bcmgenet: Revert "Use stronger register read/writes to assure ordering" Jia-Ju Bai (1): btrfs: fix root ref counts in error handling in btrfs_get_root_ref Joey Gouly (1): arm64: alternatives: mark patch_alternative() as `noinstr` Johan Hovold (1): memory: renesas-rpc-if: fix platform-device leak in error path Johannes Berg (1): nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size Jonathan Bakker (1): regulator: wm8994: Add an off-on delay for WM8994 variant Josef Bacik (1): btrfs: do not warn for free space inode in cow_file_range Juergen Gross (1): mm, page_alloc: fix build_zonerefs_node() Karsten Graul (1): net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() Khazhismel Kumykov (1): dm mpath: only use ktime_get_ns() in historical selector Kyle Copperfield (1): media: rockchip/rga: do proper error checking in probe Leo (Hanghong) Ma (1): drm/amd/display: Update VTEM Infopacket definition Leo Ruan (1): gpu: ipu-v3: Fix dev_dbg frequency output Li Nan (1): scsi: iscsi: fix kabi broken in struct iscsi_transport Lin Ma (1): nfc: nci: add flush_workqueue to prevent uaf Linus Torvalds (1): gpiolib: acpi: use correct format characters Marcelo Ricardo Leitner (1): net/sched: fix initialization order when updating chain 0 head Marcin Kozlowski (1): net: usb: aqc111: Fix out-of-bounds accesses in RX fixup Mario Limonciello (2): cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function ACPI: processor idle: Check for architectural support for LPI Martin Leung (1): drm/amd/display: Revert FEC check in validation Martin Povišer (1): i2c: pasemi: Wait for write xfers to finish Melissa Wen (1): drm/amd/display: don't ignore alpha property on pre-multiplied mode Miaoqian Lin (1): memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe Michael Kelley (1): Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer Michael Walle (1): net: dsa: felix: suppress -EPROBE_DEFER errors Mike Christie (10): scsi: iscsi: Stop queueing during ep_disconnect scsi: iscsi: Force immediate failure during shutdown scsi: iscsi: Use system_unbound_wq for destroy_work scsi: iscsi: Rel ref after iscsi_lookup_endpoint() scsi: iscsi: Fix in-kernel conn failure handling scsi: iscsi: Move iscsi_ep_disconnect() scsi: iscsi: Fix offload conn cleanup when iscsid restarts scsi: iscsi: Fix conn cleanup and stop race during iscsid restart scsi: iscsi: Fix endpoint reuse regression scsi: iscsi: Fix unbound endpoint error handling Mikulas Patocka (1): dm integrity: fix memory corruption when tag_size is less than digest size Minchan Kim (1): mm: fix unexpected zeroed page mapping with zram swap Nadav Amit (1): smp: Fix offline cpu check in flush_smp_call_function_queue() Naohiro Aota (1): btrfs: mark resumed async balance as writing Nathan Chancellor (2): btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups() ARM: davinci: da850-evm: Avoid NULL pointer dereference Nicolas Dichtel (1): ipv6: fix panic when forwarding a pkt with no in6 dev Patrick Wang (1): mm: kmemleak: take a full lowmem check in kmemleak_*_phys() Paul Gortmaker (1): tick/nohz: Use WARN_ON_ONCE() to prevent console saturation Petr Malat (1): sctp: Initialize daddr on peeled off socket QintaoShen (1): drm/amdkfd: Check for potential null return of kmalloc_array() Rameshkumar Sundaram (1): cfg80211: hold bss_lock while updating nontrans_list Randy Dunlap (1): net: micrel: fix KS8851_MLL Kconfig Rei Yamamoto (1): genirq/affinity: Consider that CPUs on nodes can be unbalanced Rob Clark (2): drm/msm: Add missing put_task_struct() in debugfs path drm/msm: Fix range size vs end confusion Roman Li (1): drm/amd/display: Fix allocate_mst_payload assert on resume Sean Christopherson (1): KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded Stephen Boyd (1): drm/msm/dsi: Use connector directly in msm_dsi_manager_connector_init() Steve Capper (1): tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry Tao Jin (1): ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers Tianci Yin (1): drm/amdgpu/vcn: improve vcn dpg stop procedure Tim Crawford (1): ALSA: hda/realtek: Add quirk for Clevo PD50PNT Toke Høiland-Jørgensen (2): ath9k: Properly clear TX status area before reporting to mac80211 ath9k: Fix usage of driver-private space in tx_info Tomasz Moń (1): drm/amdgpu: Enable gfxoff quirk on MacBook Pro Tushar Patel (1): drm/amdkfd: Fix Incorrect VMIDs passed to HWS Tyrel Datwyler (1): scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 Vadim Pasternak (1): mlxsw: i2c: Fix initialization error flow Xiaoguang Wang (1): scsi: target: tcmu: Fix possible page UAF Xiaomeng Tong (1): myri10ge: fix an incorrect free for skb in myri10ge_sw_tso Zhang Wensheng (1): scsi: iscsi: fix kabi broken in struct iscsi_cls_conn arch/arm/mach-davinci/board-da850-evm.c | 4 +- arch/arm64/kernel/alternative.c | 6 +- arch/arm64/kernel/cpuidle.c | 6 +- arch/x86/include/asm/kvm_host.h | 5 +- arch/x86/kvm/mmu/mmu.c | 20 +- arch/x86/kvm/x86.c | 20 +- drivers/acpi/processor_idle.c | 15 +- drivers/ata/libata-core.c | 3 + drivers/firmware/arm_scmi/clock.c | 3 +- drivers/gpio/gpiolib-acpi.c | 4 +- drivers/gpu/drm/amd/amdgpu/ObjectID.h | 1 + .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 + drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 3 + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 11 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 2 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +- .../gpu/drm/amd/display/dc/core/dc_resource.c | 4 +- .../amd/display/dc/dcn10/dcn10_hw_sequencer.c | 14 +- .../drm/amd/display/dc/dcn20/dcn20_hwseq.c | 14 +- .../display/modules/info_packet/info_packet.c | 5 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 +- drivers/gpu/drm/msm/dsi/dsi_manager.c | 2 +- drivers/gpu/drm/msm/msm_gem.c | 1 + drivers/gpu/ipu-v3/ipu-di.c | 5 +- drivers/hv/ring_buffer.c | 11 +- drivers/i2c/busses/i2c-pasemi.c | 6 + drivers/infiniband/ulp/iser/iscsi_iser.c | 9 +- drivers/md/dm-historical-service-time.c | 10 +- drivers/md/dm-integrity.c | 7 +- drivers/media/platform/rockchip/rga/rga.c | 2 +- drivers/memory/atmel-ebi.c | 23 +- drivers/memory/renesas-rpc-if.c | 10 +- drivers/net/dsa/ocelot/felix_vsc9959.c | 2 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- drivers/net/ethernet/mellanox/mlxsw/i2c.c | 1 + drivers/net/ethernet/micrel/Kconfig | 1 + .../net/ethernet/myricom/myri10ge/myri10ge.c | 6 +- .../ethernet/stmicro/stmmac/altr_tse_pcs.c | 8 - .../ethernet/stmicro/stmmac/altr_tse_pcs.h | 4 + .../ethernet/stmicro/stmmac/dwmac-socfpga.c | 13 +- .../net/ethernet/xilinx/xilinx_axienet_main.c | 13 +- drivers/net/mdio/mdio-bcm-unimac.c | 16 +- drivers/net/mdio/mdio-bitbang.c | 4 +- drivers/net/mdio/mdio-cavium.c | 2 +- drivers/net/mdio/mdio-gpio.c | 10 +- drivers/net/mdio/mdio-ipq4019.c | 4 +- drivers/net/mdio/mdio-ipq8064.c | 4 +- drivers/net/mdio/mdio-mscc-miim.c | 8 +- drivers/net/mdio/mdio-mux-bcm-iproc.c | 10 +- drivers/net/mdio/mdio-mux-gpio.c | 8 +- drivers/net/mdio/mdio-mux-mmioreg.c | 6 +- drivers/net/mdio/mdio-mux-multiplexer.c | 2 +- drivers/net/mdio/mdio-mux.c | 6 +- drivers/net/mdio/mdio-octeon.c | 8 +- drivers/net/mdio/mdio-thunder.c | 10 +- drivers/net/mdio/mdio-xgene.c | 6 +- drivers/net/mdio/of_mdio.c | 10 +- drivers/net/slip/slip.c | 2 +- drivers/net/usb/aqc111.c | 9 +- drivers/net/veth.c | 2 +- drivers/net/wireless/ath/ath9k/main.c | 2 +- drivers/net/wireless/ath/ath9k/xmit.c | 33 +- drivers/perf/fsl_imx8_ddr_perf.c | 2 +- drivers/regulator/wm8994-regulator.c | 42 +- drivers/scsi/be2iscsi/be_iscsi.c | 19 +- drivers/scsi/be2iscsi/be_main.c | 8 +- drivers/scsi/bnx2i/bnx2i_iscsi.c | 31 +- drivers/scsi/cxgbi/cxgb3i/cxgb3i.c | 8 +- drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 8 +- drivers/scsi/cxgbi/libcxgbi.c | 12 +- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 2 +- drivers/scsi/libiscsi.c | 70 ++- drivers/scsi/lpfc/lpfc_init.c | 2 + drivers/scsi/megaraid/megaraid_sas.h | 3 + drivers/scsi/megaraid/megaraid_sas_base.c | 7 + drivers/scsi/mvsas/mv_init.c | 1 + drivers/scsi/pm8001/pm80xx_hwi.c | 33 +- drivers/scsi/qedi/qedi_iscsi.c | 32 +- drivers/scsi/qla4xxx/ql4_os.c | 8 +- drivers/scsi/scsi_transport_iscsi.c | 587 +++++++++++------- drivers/target/target_core_user.c | 3 +- fs/btrfs/block-group.c | 4 - fs/btrfs/disk-io.c | 5 +- fs/btrfs/file.c | 13 +- fs/btrfs/inode.c | 1 - fs/btrfs/volumes.c | 2 + fs/cifs/link.c | 3 + include/asm-generic/tlb.h | 10 +- include/scsi/iscsi_if.h | 1 + include/scsi/libiscsi.h | 1 + include/scsi/scsi_transport_iscsi.h | 39 +- include/trace/events/sunrpc.h | 7 +- kernel/dma/direct.h | 3 +- kernel/irq/affinity.c | 5 +- kernel/smp.c | 2 +- kernel/time/tick-sched.c | 2 +- kernel/time/timer.c | 11 +- mm/kmemleak.c | 8 +- mm/page_alloc.c | 2 +- mm/page_io.c | 54 -- net/ipv6/ip6_output.c | 2 +- net/nfc/nci/core.c | 4 + net/sched/cls_api.c | 2 +- net/sched/sch_taprio.c | 3 +- net/sctp/socket.c | 2 +- net/smc/smc_pnet.c | 5 +- net/wireless/nl80211.c | 3 +- net/wireless/scan.c | 2 + scripts/gcc-plugins/latent_entropy_plugin.c | 44 +- sound/core/pcm_misc.c | 2 +- sound/pci/hda/patch_realtek.c | 2 + tools/perf/util/parse-events.c | 5 +- .../testing/selftests/mqueue/mq_perf_tests.c | 25 +- 115 files changed, 1046 insertions(+), 565 deletions(-) -- 2.20.1

1 95

[PATCH openEuler-5.10 01/23] mm/sharepool: Allow share THP to kernel
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5DS9S CVE: NA -------------------------------------------------- This is not used for THP but the user page table is just like THP. The user alloc hugepages via a special driver and its vma is not marked with VM_HUGETLB. This commit allow to share those vma to kernel. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/share_pool.h | 1 + mm/share_pool.c | 44 +++++++++++++++++++++++++++++++++----- 2 files changed, 40 insertions(+), 5 deletions(-) diff --git a/include/linux/share_pool.h b/include/linux/share_pool.h index 6f294911c6af..d95084b8f624 100644 --- a/include/linux/share_pool.h +++ b/include/linux/share_pool.h @@ -178,6 +178,7 @@ struct sp_walk_data { unsigned long uva_aligned; unsigned long page_size; bool is_hugepage; + bool is_page_type_set; pmd_t *pmd; }; diff --git a/mm/share_pool.c b/mm/share_pool.c index 76088952d0a5..60ad48e238c4 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -2994,9 +2994,40 @@ EXPORT_SYMBOL_GPL(mg_sp_make_share_k2u); static int sp_pmd_entry(pmd_t *pmd, unsigned long addr, unsigned long next, struct mm_walk *walk) { + struct page *page; struct sp_walk_data *sp_walk_data = walk->private; + /* + * There exist a scene in DVPP where the pagetable is huge page but its + * vma doesn't record it, something like THP. + * So we cannot make out whether it is a hugepage map until we access the + * pmd here. If mixed size of pages appear, just return an error. + */ + if (pmd_huge(*pmd)) { + if (!sp_walk_data->is_page_type_set) { + sp_walk_data->is_page_type_set = true; + sp_walk_data->is_hugepage = true; + } else if (!sp_walk_data->is_hugepage) + return -EFAULT; + + /* To skip pte level walk */ + walk->action = ACTION_CONTINUE; + + page = pmd_page(*pmd); + get_page(page); + sp_walk_data->pages[sp_walk_data->page_count++] = page; + + return 0; + } + + if (!sp_walk_data->is_page_type_set) { + sp_walk_data->is_page_type_set = true; + sp_walk_data->is_hugepage = false; + } else if (sp_walk_data->is_hugepage) + return -EFAULT; + sp_walk_data->pmd = pmd; + return 0; } @@ -3140,6 +3171,8 @@ static int __sp_walk_page_range(unsigned long uva, unsigned long size, sp_walk.pmd_entry = sp_pmd_entry; } + sp_walk_data->is_page_type_set = false; + sp_walk_data->page_count = 0; sp_walk_data->page_size = page_size; uva_aligned = ALIGN_DOWN(uva, page_size); sp_walk_data->uva_aligned = uva_aligned; @@ -3164,8 +3197,12 @@ static int __sp_walk_page_range(unsigned long uva, unsigned long size, ret = walk_page_range(mm, uva_aligned, uva_aligned + size_aligned, &sp_walk, sp_walk_data); - if (ret) + if (ret) { + while (sp_walk_data->page_count--) + put_page(pages[sp_walk_data->page_count]); kvfree(pages); + sp_walk_data->pages = NULL; + } return ret; } @@ -3201,9 +3238,7 @@ void *sp_make_share_u2k(unsigned long uva, unsigned long size, int pid) int ret = 0; struct mm_struct *mm = current->mm; void *p = ERR_PTR(-ESRCH); - struct sp_walk_data sp_walk_data = { - .page_count = 0, - }; + struct sp_walk_data sp_walk_data; struct vm_struct *area; check_interrupt_context(); @@ -3544,7 +3579,6 @@ int sp_walk_page_range(unsigned long uva, unsigned long size, return -ESRCH; } - sp_walk_data->page_count = 0; down_write(&mm->mmap_lock); if (likely(!mm->core_state)) ret = __sp_walk_page_range(uva, size, mm, sp_walk_data); -- 2.20.1

1 22

[PATCH openEuler-5.10-LTS 00/94] Backport 5.10.112 LTS
by Zheng Zengkai 18 Jul '22

18 Jul '22

Backport 5.10.112 LTS patches from upstream. git cherry-pick v5.10.111..v5.10.112~1 -s Complicts: Already merged(10): 80a4df14643f7 hamradio: defer 6pack kfree after unregister_netdev cfa98ffc42f16 hamradio: remove needs_free_netdev to avoid UAF 5ea00fc60676 ax25: add refcount in ax25_dev to avoid UAF bugs 5ddae8d06441 ax25: fix reference count leaks of ax25_dev 57cc15f5fd55 ax25: fix UAF bugs of net_device caused by rebinding operation b20a5ab0f5fb ax25: Fix refcount leaks caused by ax25_cb_del() a4942c6fea87 ax25: fix UAF bug in ax25_send_control() 145ea8d213e8 ax25: fix NPD bug in ax25_disconnect f934fa478dd1 ax25: Fix NULL pointer dereferences in ax25 timers 5c62d3bf1410 ax25: Fix UAF bugs in ax25 timers Total patches: 104 - 10 = 94 Adrian Hunter (1): perf tools: Fix misleading add event PMU debug message Ajish Koshy (2): scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63 scsi: pm80xx: Enable upper inbound, outbound queues Alexey Galakhov (1): scsi: mvsas: Add PCI ID of RocketRaid 2640 Andy Chiu (1): net: axienet: setup mdio unconditionally Anna-Maria Behnsen (1): timers: Fix warning condition in __run_timers() Athira Rajeev (1): testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set Aurabindo Pillai (1): drm/amd: Add USBC connector ID Benedikt Spranger (1): net/sched: taprio: Check if socket flags are valid Borislav Petkov (1): perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant Calvin Johnson (1): net: mdio: Alphabetically sort header inclusion Chandrakanth patil (1): scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan Chao Gao (1): dma-direct: avoid redundant memory sync for swiotlb Charlene Liu (1): drm/amd/display: fix audio format not updated after edid updated Chiawen Huang (1): drm/amd/display: FEC check in timing validation Christian Lamparter (1): ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs Chuck Lever (1): SUNRPC: Fix the svc_deferred_event trace class Cristian Marussi (1): firmware: arm_scmi: Fix sorting of retrieved clock rates Darrick J. Wong (1): btrfs: fix fallocate to use file_modified to update permissions consistently Dinh Nguyen (1): net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link Duoming Zhou (1): drivers: net: slip: fix NPD bug in sl_tx_timeout() Fabio M. De Francesco (1): ALSA: pcm: Test for "silence" field in struct "pcm_format_data" Felix Kuehling (1): drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu Guillaume Nault (1): veth: Ensure eth header is in skb's linear part Harshit Mogalapalli (1): cifs: potential buffer overflow in handling symlinks James Smart (1): scsi: lpfc: Fix queue failures when recovering from PCI parity error Jason A. Donenfeld (1): gcc-plugins: latent_entropy: use /dev/urandom Jeremy Linton (1): net: bcmgenet: Revert "Use stronger register read/writes to assure ordering" Jia-Ju Bai (1): btrfs: fix root ref counts in error handling in btrfs_get_root_ref Joey Gouly (1): arm64: alternatives: mark patch_alternative() as `noinstr` Johan Hovold (1): memory: renesas-rpc-if: fix platform-device leak in error path Johannes Berg (1): nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size Jonathan Bakker (1): regulator: wm8994: Add an off-on delay for WM8994 variant Josef Bacik (1): btrfs: do not warn for free space inode in cow_file_range Juergen Gross (1): mm, page_alloc: fix build_zonerefs_node() Karsten Graul (1): net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() Khazhismel Kumykov (1): dm mpath: only use ktime_get_ns() in historical selector Kyle Copperfield (1): media: rockchip/rga: do proper error checking in probe Leo (Hanghong) Ma (1): drm/amd/display: Update VTEM Infopacket definition Leo Ruan (1): gpu: ipu-v3: Fix dev_dbg frequency output Lin Ma (1): nfc: nci: add flush_workqueue to prevent uaf Linus Torvalds (1): gpiolib: acpi: use correct format characters Marcelo Ricardo Leitner (1): net/sched: fix initialization order when updating chain 0 head Marcin Kozlowski (1): net: usb: aqc111: Fix out-of-bounds accesses in RX fixup Mario Limonciello (2): cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function ACPI: processor idle: Check for architectural support for LPI Martin Leung (1): drm/amd/display: Revert FEC check in validation Martin Povišer (1): i2c: pasemi: Wait for write xfers to finish Melissa Wen (1): drm/amd/display: don't ignore alpha property on pre-multiplied mode Miaoqian Lin (1): memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe Michael Kelley (1): Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer Michael Walle (1): net: dsa: felix: suppress -EPROBE_DEFER errors Mike Christie (10): scsi: iscsi: Stop queueing during ep_disconnect scsi: iscsi: Force immediate failure during shutdown scsi: iscsi: Use system_unbound_wq for destroy_work scsi: iscsi: Rel ref after iscsi_lookup_endpoint() scsi: iscsi: Fix in-kernel conn failure handling scsi: iscsi: Move iscsi_ep_disconnect() scsi: iscsi: Fix offload conn cleanup when iscsid restarts scsi: iscsi: Fix conn cleanup and stop race during iscsid restart scsi: iscsi: Fix endpoint reuse regression scsi: iscsi: Fix unbound endpoint error handling Mikulas Patocka (1): dm integrity: fix memory corruption when tag_size is less than digest size Minchan Kim (1): mm: fix unexpected zeroed page mapping with zram swap Nadav Amit (1): smp: Fix offline cpu check in flush_smp_call_function_queue() Naohiro Aota (1): btrfs: mark resumed async balance as writing Nathan Chancellor (2): btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups() ARM: davinci: da850-evm: Avoid NULL pointer dereference Nicolas Dichtel (1): ipv6: fix panic when forwarding a pkt with no in6 dev Patrick Wang (1): mm: kmemleak: take a full lowmem check in kmemleak_*_phys() Paul Gortmaker (1): tick/nohz: Use WARN_ON_ONCE() to prevent console saturation Petr Malat (1): sctp: Initialize daddr on peeled off socket QintaoShen (1): drm/amdkfd: Check for potential null return of kmalloc_array() Rameshkumar Sundaram (1): cfg80211: hold bss_lock while updating nontrans_list Randy Dunlap (1): net: micrel: fix KS8851_MLL Kconfig Rei Yamamoto (1): genirq/affinity: Consider that CPUs on nodes can be unbalanced Rob Clark (2): drm/msm: Add missing put_task_struct() in debugfs path drm/msm: Fix range size vs end confusion Roman Li (1): drm/amd/display: Fix allocate_mst_payload assert on resume Sean Christopherson (1): KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded Stephen Boyd (1): drm/msm/dsi: Use connector directly in msm_dsi_manager_connector_init() Steve Capper (1): tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry Tao Jin (1): ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers Tianci Yin (1): drm/amdgpu/vcn: improve vcn dpg stop procedure Tim Crawford (1): ALSA: hda/realtek: Add quirk for Clevo PD50PNT Toke Høiland-Jørgensen (2): ath9k: Properly clear TX status area before reporting to mac80211 ath9k: Fix usage of driver-private space in tx_info Tomasz Moń (1): drm/amdgpu: Enable gfxoff quirk on MacBook Pro Tushar Patel (1): drm/amdkfd: Fix Incorrect VMIDs passed to HWS Tyrel Datwyler (1): scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 Vadim Pasternak (1): mlxsw: i2c: Fix initialization error flow Vlad Buslov (1): net/sched: flower: fix parsing of ethertype following VLAN header Xiaoguang Wang (1): scsi: target: tcmu: Fix possible page UAF Xiaomeng Tong (1): myri10ge: fix an incorrect free for skb in myri10ge_sw_tso arch/arm/mach-davinci/board-da850-evm.c | 4 +- arch/arm64/kernel/alternative.c | 6 +- arch/arm64/kernel/cpuidle.c | 6 +- arch/x86/include/asm/kvm_host.h | 5 +- arch/x86/kvm/mmu/mmu.c | 20 +- arch/x86/kvm/x86.c | 20 +- drivers/acpi/processor_idle.c | 15 +- drivers/ata/libata-core.c | 3 + drivers/firmware/arm_scmi/clock.c | 3 +- drivers/gpio/gpiolib-acpi.c | 4 +- drivers/gpu/drm/amd/amdgpu/ObjectID.h | 1 + .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 + drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 3 + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 11 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 2 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +- .../gpu/drm/amd/display/dc/core/dc_resource.c | 4 +- .../amd/display/dc/dcn10/dcn10_hw_sequencer.c | 14 +- .../drm/amd/display/dc/dcn20/dcn20_hwseq.c | 14 +- .../display/modules/info_packet/info_packet.c | 5 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 +- drivers/gpu/drm/msm/dsi/dsi_manager.c | 2 +- drivers/gpu/drm/msm/msm_gem.c | 1 + drivers/gpu/ipu-v3/ipu-di.c | 5 +- drivers/hv/ring_buffer.c | 11 +- drivers/i2c/busses/i2c-pasemi.c | 6 + drivers/infiniband/ulp/iser/iscsi_iser.c | 2 + drivers/md/dm-historical-service-time.c | 10 +- drivers/md/dm-integrity.c | 7 +- drivers/media/platform/rockchip/rga/rga.c | 2 +- drivers/memory/atmel-ebi.c | 23 +- drivers/memory/renesas-rpc-if.c | 10 +- drivers/net/dsa/ocelot/felix_vsc9959.c | 2 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- drivers/net/ethernet/mellanox/mlxsw/i2c.c | 1 + drivers/net/ethernet/micrel/Kconfig | 1 + .../net/ethernet/myricom/myri10ge/myri10ge.c | 6 +- .../ethernet/stmicro/stmmac/altr_tse_pcs.c | 8 - .../ethernet/stmicro/stmmac/altr_tse_pcs.h | 4 + .../ethernet/stmicro/stmmac/dwmac-socfpga.c | 13 +- .../net/ethernet/xilinx/xilinx_axienet_main.c | 13 +- drivers/net/mdio/mdio-bcm-unimac.c | 16 +- drivers/net/mdio/mdio-bitbang.c | 4 +- drivers/net/mdio/mdio-cavium.c | 2 +- drivers/net/mdio/mdio-gpio.c | 10 +- drivers/net/mdio/mdio-ipq4019.c | 4 +- drivers/net/mdio/mdio-ipq8064.c | 4 +- drivers/net/mdio/mdio-mscc-miim.c | 8 +- drivers/net/mdio/mdio-mux-bcm-iproc.c | 10 +- drivers/net/mdio/mdio-mux-gpio.c | 8 +- drivers/net/mdio/mdio-mux-mmioreg.c | 6 +- drivers/net/mdio/mdio-mux-multiplexer.c | 2 +- drivers/net/mdio/mdio-mux.c | 6 +- drivers/net/mdio/mdio-octeon.c | 8 +- drivers/net/mdio/mdio-thunder.c | 10 +- drivers/net/mdio/mdio-xgene.c | 6 +- drivers/net/mdio/of_mdio.c | 10 +- drivers/net/slip/slip.c | 2 +- drivers/net/usb/aqc111.c | 9 +- drivers/net/veth.c | 2 +- drivers/net/wireless/ath/ath9k/main.c | 2 +- drivers/net/wireless/ath/ath9k/xmit.c | 33 +- drivers/perf/fsl_imx8_ddr_perf.c | 2 +- drivers/regulator/wm8994-regulator.c | 42 +- drivers/scsi/be2iscsi/be_iscsi.c | 19 +- drivers/scsi/be2iscsi/be_main.c | 1 + drivers/scsi/bnx2i/bnx2i_iscsi.c | 24 +- drivers/scsi/cxgbi/cxgb3i/cxgb3i.c | 1 + drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 1 + drivers/scsi/cxgbi/libcxgbi.c | 12 +- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 2 +- drivers/scsi/libiscsi.c | 70 ++- drivers/scsi/lpfc/lpfc_init.c | 2 + drivers/scsi/megaraid/megaraid_sas.h | 3 + drivers/scsi/megaraid/megaraid_sas_base.c | 7 + drivers/scsi/mvsas/mv_init.c | 1 + drivers/scsi/pm8001/pm80xx_hwi.c | 33 +- drivers/scsi/qedi/qedi_iscsi.c | 26 +- drivers/scsi/qla4xxx/ql4_os.c | 2 + drivers/scsi/scsi_transport_iscsi.c | 541 +++++++++++------- drivers/target/target_core_user.c | 3 +- fs/btrfs/block-group.c | 4 - fs/btrfs/disk-io.c | 5 +- fs/btrfs/file.c | 13 +- fs/btrfs/inode.c | 1 - fs/btrfs/volumes.c | 2 + fs/cifs/link.c | 3 + include/asm-generic/tlb.h | 10 +- include/net/flow_dissector.h | 2 + include/scsi/libiscsi.h | 1 + include/scsi/scsi_transport_iscsi.h | 14 +- include/trace/events/sunrpc.h | 7 +- kernel/dma/direct.h | 3 +- kernel/irq/affinity.c | 5 +- kernel/smp.c | 2 +- kernel/time/tick-sched.c | 2 +- kernel/time/timer.c | 11 +- mm/kmemleak.c | 8 +- mm/page_alloc.c | 2 +- mm/page_io.c | 54 -- net/core/flow_dissector.c | 1 + net/ipv6/ip6_output.c | 2 +- net/nfc/nci/core.c | 4 + net/sched/cls_api.c | 2 +- net/sched/cls_flower.c | 18 +- net/sched/sch_taprio.c | 3 +- net/sctp/socket.c | 2 +- net/smc/smc_pnet.c | 5 +- net/wireless/nl80211.c | 3 +- net/wireless/scan.c | 2 + scripts/gcc-plugins/latent_entropy_plugin.c | 44 +- sound/core/pcm_misc.c | 2 +- sound/pci/hda/patch_realtek.c | 2 + tools/perf/util/parse-events.c | 5 +- .../testing/selftests/mqueue/mq_perf_tests.c | 25 +- 117 files changed, 959 insertions(+), 554 deletions(-) -- 2.20.1

1 94

[PATCH openEuler-5.10-LTS 000/166] Backport 5.10.111 LTS
by Zheng Zengkai 14 Jul '22

14 Jul '22

Backport 5.10.111 LTS patches from upstream. Complicts: Already merged(4): 2dc49f58a29c ubifs: Rectify space amount budget for mkdir/tmpfile operations c688705a3978 Revert "NFSv4: Handle the special Linux file open access mode" 2827328e646d io_uring: fix race between timeout flush and removal 4665722d36ad cgroup: Use open-time credentials for process migraton perm checks Context conflict(3): 4820847e8bc2 usb: ehci: add pci device support for Aspeed platforms 8a7ada4b8f5d scsi: hisi_sas: Free irq vectors in order for v3 HW 9de98470db6e arm64: Add part number for Arm Cortex-A78AE Rejected(1): 2f2f017ea873 dm: requeue IO if mapping table not yet available Implement changed(-1+1): d36febbcd537 powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit Added(1): ipv6: fix kabi for mc_forwarding in struct ipv6_devconf Total patches: 170 - 4 - 1 + 1 - 1 + 1 = 166 Adam Wujek (1): clk: si5341: fix reported clk_rate when output divider is 2 Adrian Hunter (1): perf tools: Fix perf's libperf_print callback Aharon Landau (1): RDMA/mlx5: Don't remove cache MRs when a delay is needed Alex Deucher (2): drm/amdkfd: make CRAT table missing message informational only drm/amdgpu/smu10: fix SoC/fclk units in auto mode Alexander Lobakin (1): MIPS: fix fortify panic when copying asm exception handlers Amjad Ouled-Ameur (1): phy: amlogic: meson8b-usb2: Use dev_err_probe() Anatolii Gerasymenko (2): ice: Set txq_teid to ICE_INVAL_TEID on ring creation ice: Do not skip not enabled queues in ice_vc_dis_qs_msg Andre Przywara (1): irqchip/gic, gic-v3: Prevent GSI to SGI translations Andrea Parri (Microsoft) (1): Drivers: hv: vmbus: Replace smp_store_mb() with virt_store_mb() Andreas Gruenbacher (2): gfs2: Check for active reservation in gfs2_release gfs2: gfs2_setattr_size error path fix Andy Gospodarek (1): bnxt_en: reserve space inside receive page for skb_shared_info Anisse Astier (1): drm: Add orientation quirk for GPD Win Max Arnaldo Carvalho de Melo (4): perf build: Don't use -ffat-lto-objects in the python feature test when building with clang-13 perf python: Fix probing for some clang command line options tools build: Filter out options and warnings not supported by clang tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts Avraham Stern (1): cfg80211: don't add non transmitted BSS to 6GHz scanned channels Bob Peterson (1): gfs2: Fix gfs2_release for non-writers regression Chanho Park (1): arm64: Add part number for Arm Cortex-A78AE Chen-Yu Tsai (1): net: stmmac: Fix unset max_speed difference between DT and non-DT platforms Christian Lamparter (1): ata: sata_dwc_460ex: Fix crash due to OOB write Christophe JAILLET (1): scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() Dale Zhao (1): drm/amd/display: Add signal type check when verify stream backends same Damien Le Moal (5): scsi: pm8001: Fix pm80xx_pci_mem_copy() interface scsi: pm8001: Fix pm8001_mpi_task_abort_resp() scsi: pm8001: Fix task leak in pm8001_send_abort_all() scsi: pm8001: Fix tag leaks on error scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() Dan Carpenter (1): drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire() David Ahern (1): ipv6: Fix stats accounting in ip6_pkt_drop Denis Nikitin (1): perf session: Remap buf if there is no space for event Dongli Zhang (1): xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 Douglas Miller (1): RDMA/hfi1: Fix use-after-free bug for mm struct Dust Li (1): net/smc: correct settings of RMB window update limit Eric Dumazet (2): ipv6: make mc_forwarding atomic rxrpc: fix a race in rxrpc_exit_net() Ethan Lien (1): btrfs: fix qgroup reserve overflow the qgroup limit Evgeny Boger (1): power: supply: axp20x_battery: properly report current when discharging Fangrui Song (1): arm64: module: remove (NOLOAD) from linker script Guilherme G. Piccoli (1): Drivers: hv: vmbus: Fix potential crash on module unload Guo Ren (1): arm64: patch_text: Fixup last cpu should be master Guo Xuenan (1): lz4: fix LZ4_decompress_safe_partial read out of bound H. Nikolaus Schaller (1): usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm Haimin Zhang (1): jfs: prevent NULL deref in diFree Hangyu Hua (2): mips: ralink: fix a refcount leak in ill_acc_of_setup() powerpc/secvar: fix refcount leak in format_show() Hans de Goede (1): power: supply: axp288-charger: Set Vhold to 4.4V Harold Huang (1): tuntap: add sanity checks about msg_controllen in sendmsg Helge Deller (1): parisc: Fix CPU affinity for Lasi, WAX and Dino chips Hou Wenlong (1): KVM: x86/emulator: Emulate RDPID only if it is enabled in guest Hou Zhiqiang (1): PCI: endpoint: Fix alignment fault error in copy tests Ido Schimmel (1): ipv4: Invalidate neighbour for broadcast address upon address addition Ilan Peer (1): iwlwifi: mvm: Correctly set fragmented EBS Ilya Maximets (2): net: openvswitch: don't send internal clone attribute to the userspace. net: openvswitch: fix leak of nested actions Ivan Vecera (1): ice: Clear default forwarding VSI during VSI release Jakub Kicinski (2): net: account alternate interface name memory net: limit altnames to 64k total Jakub Sitnicki (1): bpf: Make dst_port field in struct bpf_sock 16-bit wide James Clark (1): perf: arm-spe: Fix perf report --mem-mode Jamie Bainbridge (1): qede: confirm skb is allocated before using Jianglei Nie (1): scsi: libfc: Fix use after free in fc_exch_abts_resp() Jiasheng Jiang (2): rtc: wm8350: Handle error for wm8350_register_irq drm/imx: imx-ldb: Check for null pointer after calling kmemdup Jim Mattson (1): KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs Jiri Slaby (1): serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() John David Anglin (1): parisc: Fix patch code locking and flushing Jordy Zomer (1): dm ioctl: prevent potential spectre v1 gadget José Expósito (1): drm/imx: Fix memory leak in imx_pd_connector_get_modes Kaiwen Hu (1): btrfs: prevent subvol with swapfile from being deleted Kalle Valo (1): ath11k: mhi: use mhi_sync_power_up() Kamal Dasu (1): spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op() Karol Herbst (1): drm/nouveau/pmu: Add missing callbacks for Tegra devices Kees Cook (1): ubsan: remove CONFIG_UBSAN_OBJECT_SIZE Kefeng Wang (1): powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit Krzysztof Kozlowski (1): MIPS: ingenic: correct unit node address Lee Jones (1): drm/amdkfd: Create file descriptor after client is added to smi_clients list Li Chen (1): PCI: endpoint: Fix misused goto label Lorenzo Bianconi (1): mt76: dma: initialize skip_unmap in mt76_dma_rx_fill Lucas Denefle (1): w1: w1_therm: fixes w1_seq for ds28ea00 sensors Luiz Augusto von Dentz (2): Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg} Bluetooth: Fix use after free in hci_send_acl Lv Yunlong (1): drbd: Fix five use after free bugs in get_initial_state Maciej Fijalkowski (1): ice: synchronize_rcu() when terminating rings Manivannan Sadhasivam (1): PCI: pciehp: Add Qualcomm quirk for Command Completed erratum Marc Zyngier (1): irqchip/gic-v3: Fix GICR_CTLR.RWP polling Martin Habets (1): sfc: Do not free an empty page_ring Mauricio Faria de Oliveira (1): mm: fix race between MADV_FREE reclaim and blkdev direct IO read Max Filippov (1): xtensa: fix DTC warning unit_address_format Maxim Kiselev (1): powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 Maxim Mikityanskiy (1): bpf: Support dual-stack sockets in bpf_tcp_check_syncookie Maxime Ripard (1): clk: Enforce that disjoints limits are invalid Miaohe Lin (1): mm/mempolicy: fix mpol_new leak in shared_policy_replace Miaoqian Lin (1): dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe Michael Chan (1): bnxt_en: Eliminate unintended link toggle during FW reset Michael Walle (2): net: sfp: add 2500base-X quirk for Lantech SFP module net: phy: mscc-miim: reject clause 45 register accesses Minghao Chi (CGEL ZTE) (1): Bluetooth: use memset avoid memory leaks Nathan Chancellor (1): x86/Kconfig: Do not allow CONFIG_X86_X32_ABI=y with llvm-objcopy Neal Liu (1): usb: ehci: add pci device support for Aspeed platforms NeilBrown (5): SUNRPC/call_alloc: async tasks mustn't block waiting for memory SUNRPC/xprt: async tasks mustn't block waiting for memory SUNRPC: remove scheduling boost for "SWAPPER" tasks. NFS: swap IO handling is slightly different for O_DIRECT IO NFS: swap-out must always use STABLE writes. Niels Dossche (1): IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition Nikolay Aleksandrov (1): net: ipv4: fix route with nexthop object delete warning Oliver Hartkopp (1): can: isotp: set default value for N_As to 50 micro seconds Pali Rohár (2): PCI: aardvark: Fix support for MSI interrupts Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" Paolo Bonzini (1): mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) Pavel Begunkov (1): io_uring: don't touch scm_fp_list after queueing skb Pawan Gupta (2): x86/pm: Save the MSR validity status at context setup x86/speculation: Restore speculation related MSRs during S3 resume Peter Xu (1): mm: don't skip swap entry even if zap_details specified Qi Liu (1): scsi: hisi_sas: Free irq vectors in order for v3 HW Qinghua Jin (1): minix: fix bug when opening a file with O_DIRECT Rajneesh Bhardwaj (1): drm/amdgpu: Fix recursive locking warning Randy Dunlap (3): scsi: aha152x: Fix aha152x_setup() __setup handler return value init/main.c: return 1 from handled __setup() functions virtio_console: eliminate anonymous module_init & module_exit Sachin Sant (1): selftests/cgroup: Fix build on older distros Sasha Levin (1): Revert "hv: utils: add PTP_1588_CLOCK to Kconfig to fix build" Sebastian Andrzej Siewior (1): tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH. Shreeya Patel (1): gpio: Restrict usage of GPIO chip irq members before initialization Sourabh Jain (1): powerpc: Set crashkernel offset to mid of RMA region Stefan Wahren (1): staging: vchiq_core: handle NULL result of find_service_by_handle Sven Eckelmann (1): macvtap: advertise link netns via netlink Tejun Heo (3): selftests: cgroup: Make cg_create() use 0755 for permission instead of 0644 selftests: cgroup: Test open-time credential usage for migration checks selftests: cgroup: Test open-time cgroup namespace usage for migration checks Tony Lindgren (2): clk: ti: Preserve node in ti_dt_clocks_register() iommu/omap: Fix regression in probe for NULL pointer dereference Trond Myklebust (7): NFSv4: Protect the state recovery thread against direct reclaim SUNRPC: Fix socket waits for write buffer space NFS: nfsiod should not block forever in mempool_alloc() NFS: Avoid writeback threads getting stuck in mempool_alloc() SUNRPC: Handle ENOMEM in call_transmit_status() SUNRPC: Handle low memory situations in call_status() SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec() Venkateswara Naralasetty (1): ath11k: fix kernel panic during unload/load ath11k modules Vinod Koul (1): dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error" Waiman Long (1): mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning Wang Yufen (1): netlabel: fix out-of-bounds memory accesses Wayne Chang (2): usb: gadget: tegra-xudc: Do not program SPARAM usb: gadget: tegra-xudc: Fix control endpoint's definitions Wolfram Sang (1): mmc: renesas_sdhi: don't overwrite TAP settings when HS400 tuning is complete Xiaoke Wang (1): staging: wfx: fix an error handling in wfx_init_common() Xiaomeng Tong (1): perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator Xin Xiong (2): drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify() Xiubo Li (1): ceph: fix memory leak in ceph_readdir when note_last_dentry returns error Yang Guang (3): ptp: replace snprintf with sysfs_emit scsi: mvsas: Replace snprintf() with sysfs_emit() scsi: bfa: Replace snprintf() with sysfs_emit() Yang Li (1): mt76: mt7615: Fix assigning negative values to unsigned variable Yann Gautier (1): mmc: mmci: stm32: correctly check all elements of sg list Yonghong Song (1): libbpf: Fix build issue with llvm-readelf Zekun Shen (1): ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 Zheng Zengkai (2): ipv6: fix kabi for mc_forwarding in struct ipv6_devconf Revert "powerpc: Fix virt_addr_valid() check" Zhou Guanghui (1): iommu/arm-smmu-v3: fix event handling soft lockup Ziyang Xuan (1): net/tls: fix slab-out-of-bounds bug in decrypt_internal arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/module.lds.h | 6 +- arch/arm64/kernel/insn.c | 4 +- arch/arm64/kernel/proton-pack.c | 1 + arch/mips/boot/dts/ingenic/jz4780.dtsi | 2 +- arch/mips/include/asm/setup.h | 2 +- arch/mips/kernel/traps.c | 22 +-- arch/mips/ralink/ill_acc.c | 1 + arch/parisc/kernel/patch.c | 25 ++- arch/powerpc/boot/dts/fsl/t104xrdb.dtsi | 4 +- arch/powerpc/include/asm/page.h | 7 +- arch/powerpc/kernel/rtas.c | 6 + arch/powerpc/kernel/secvar-sysfs.c | 9 +- arch/powerpc/kexec/core.c | 15 +- arch/x86/Kconfig | 5 + arch/x86/kvm/emulate.c | 4 +- arch/x86/kvm/kvm_emulate.h | 1 + arch/x86/kvm/svm/pmu.c | 8 +- arch/x86/kvm/x86.c | 6 + arch/x86/power/cpu.c | 21 ++- arch/x86/xen/smp_hvm.c | 6 + arch/x86/xen/time.c | 24 ++- arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi | 8 +- arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi | 8 +- arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi | 4 +- drivers/ata/sata_dwc_460ex.c | 6 +- drivers/block/drbd/drbd_int.h | 8 +- drivers/block/drbd/drbd_nl.c | 41 +++-- drivers/block/drbd/drbd_state.c | 18 +- drivers/block/drbd/drbd_state_change.h | 8 +- drivers/char/virtio_console.c | 8 +- drivers/clk/clk-si5341.c | 16 +- drivers/clk/clk.c | 24 +++ drivers/clk/ti/clk.c | 13 +- drivers/dma/sh/shdma-base.c | 4 +- drivers/gpio/gpiolib.c | 19 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 24 ++- .../gpu/drm/amd/display/dc/core/dc_resource.c | 3 + .../drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c | 8 +- .../gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/imx/imx-ldb.c | 2 + drivers/gpu/drm/imx/parallel-display.c | 4 +- .../gpu/drm/nouveau/nvkm/subdev/pmu/gm20b.c | 1 + .../gpu/drm/nouveau/nvkm/subdev/pmu/gp102.c | 2 +- .../gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c | 1 + .../gpu/drm/nouveau/nvkm/subdev/pmu/priv.h | 1 + drivers/hv/Kconfig | 1 - drivers/hv/channel_mgmt.c | 6 +- drivers/hv/vmbus_drv.c | 9 +- drivers/infiniband/hw/hfi1/mmu_rb.c | 6 + drivers/infiniband/hw/mlx5/mr.c | 4 +- drivers/infiniband/sw/rdmavt/qp.c | 6 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 1 + drivers/iommu/omap-iommu.c | 2 +- drivers/irqchip/irq-gic-v3.c | 14 +- drivers/irqchip/irq-gic.c | 6 + drivers/md/dm-ioctl.c | 2 + drivers/mmc/host/mmci_stm32_sdmmc.c | 6 +- drivers/mmc/host/renesas_sdhi_core.c | 4 +- drivers/mmc/host/sdhci-xenon.c | 10 -- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 3 +- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 +- .../net/ethernet/freescale/dpaa2/dpaa2-ptp.c | 4 +- drivers/net/ethernet/intel/ice/ice.h | 2 +- drivers/net/ethernet/intel/ice/ice_lib.c | 3 + drivers/net/ethernet/intel/ice/ice_main.c | 4 +- .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 4 +- drivers/net/ethernet/intel/ice/ice_xsk.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 3 + drivers/net/ethernet/sfc/rx_common.c | 3 + .../ethernet/stmicro/stmmac/stmmac_platform.c | 3 +- drivers/net/macvtap.c | 6 + drivers/net/mdio/mdio-mscc-miim.c | 6 + drivers/net/phy/sfp-bus.c | 6 + drivers/net/tap.c | 3 +- drivers/net/tun.c | 3 +- drivers/net/wireless/ath/ath11k/ahb.c | 2 + drivers/net/wireless/ath/ath11k/mhi.c | 2 +- drivers/net/wireless/ath/ath5k/eeprom.c | 3 + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 5 +- drivers/net/wireless/mediatek/mt76/dma.c | 1 + .../net/wireless/mediatek/mt76/mt7615/mac.c | 2 +- drivers/parisc/dino.c | 41 ++++- drivers/parisc/gsc.c | 31 ++++ drivers/parisc/gsc.h | 1 + drivers/parisc/lasi.c | 7 +- drivers/parisc/wax.c | 7 +- drivers/pci/controller/pci-aardvark.c | 16 +- drivers/pci/endpoint/functions/pci-epf-test.c | 14 +- drivers/pci/hotplug/pciehp_hpc.c | 2 + drivers/perf/qcom_l2_pmu.c | 6 +- drivers/phy/amlogic/phy-meson8b-usb2.c | 5 +- drivers/power/supply/axp20x_battery.c | 13 +- drivers/power/supply/axp288_charger.c | 14 +- drivers/ptp/ptp_sysfs.c | 4 +- drivers/rtc/rtc-wm8350.c | 11 +- drivers/scsi/aha152x.c | 6 +- drivers/scsi/bfa/bfad_attr.c | 26 +-- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 16 +- drivers/scsi/libfc/fc_exch.c | 1 + drivers/scsi/mvsas/mv_init.c | 4 +- drivers/scsi/pm8001/pm8001_hwi.c | 27 ++- drivers/scsi/pm8001/pm8001_sas.c | 2 +- drivers/scsi/pm8001/pm80xx_hwi.c | 17 +- drivers/scsi/zorro7xx.c | 2 + drivers/spi/spi-bcm-qspi.c | 4 +- .../interface/vchiq_arm/vchiq_core.c | 6 + drivers/staging/wfx/main.c | 7 +- drivers/tty/serial/samsung_tty.c | 5 +- drivers/usb/dwc3/dwc3-omap.c | 2 +- drivers/usb/gadget/udc/tegra-xudc.c | 20 +-- drivers/usb/host/ehci-pci.c | 9 + drivers/vhost/net.c | 1 + drivers/w1/slaves/w1_therm.c | 8 +- fs/btrfs/extent_io.h | 2 +- fs/btrfs/inode.c | 22 +++ fs/ceph/dir.c | 11 +- fs/gfs2/bmap.c | 2 +- fs/gfs2/file.c | 3 +- fs/gfs2/inode.c | 2 +- fs/gfs2/rgrp.c | 7 +- fs/gfs2/rgrp.h | 2 +- fs/gfs2/super.c | 2 +- fs/io_uring.c | 8 +- fs/jfs/inode.c | 3 +- fs/minix/inode.c | 3 +- fs/nfs/direct.c | 48 +++-- fs/nfs/file.c | 4 +- fs/nfs/internal.h | 7 + fs/nfs/nfs42proc.c | 9 +- fs/nfs/nfs4state.c | 12 ++ fs/nfs/pagelist.c | 10 +- fs/nfs/pnfs_nfs.c | 8 +- fs/nfs/write.c | 34 ++-- include/linux/gpio/driver.h | 9 + include/linux/ipv6.h | 2 +- include/linux/mmzone.h | 11 +- include/linux/nfs_fs.h | 10 +- include/net/arp.h | 1 + include/net/bluetooth/bluetooth.h | 14 +- include/uapi/linux/bpf.h | 3 +- include/uapi/linux/can/isotp.h | 28 ++- init/main.c | 6 +- lib/lz4/lz4_decompress.c | 8 +- lib/test_ubsan.c | 11 -- mm/memory.c | 25 ++- mm/mempolicy.c | 1 + mm/mremap.c | 3 + mm/rmap.c | 25 ++- net/batman-adv/multicast.c | 2 +- net/bluetooth/hci_event.c | 3 +- net/bluetooth/l2cap_core.c | 1 + net/can/isotp.c | 12 +- net/core/filter.c | 27 ++- net/core/rtnetlink.c | 13 +- net/ipv4/arp.c | 9 +- net/ipv4/fib_frontend.c | 5 +- net/ipv4/fib_semantics.c | 7 +- net/ipv4/inet_hashtables.c | 53 +++--- net/ipv6/addrconf.c | 4 +- net/ipv6/inet6_hashtables.c | 5 +- net/ipv6/ip6_input.c | 2 +- net/ipv6/ip6mr.c | 8 +- net/ipv6/route.c | 2 +- net/netlabel/netlabel_kapi.c | 2 + net/openvswitch/actions.c | 2 +- net/openvswitch/flow_netlink.c | 99 ++++++++++- net/rxrpc/net_ns.c | 2 +- net/smc/smc_core.c | 2 +- net/sunrpc/clnt.c | 7 + net/sunrpc/sched.c | 11 +- net/sunrpc/svcsock.c | 4 +- net/sunrpc/xprt.c | 16 +- net/sunrpc/xprtrdma/transport.c | 6 +- net/sunrpc/xprtsock.c | 54 ++++-- net/tls/tls_sw.c | 2 +- net/wireless/scan.c | 9 +- scripts/Makefile.ubsan | 1 - tools/build/feature/Makefile | 9 +- tools/lib/bpf/Makefile | 4 +- tools/perf/Makefile.config | 6 + tools/perf/arch/arm64/util/arm-spe.c | 6 + tools/perf/perf.c | 2 +- tools/perf/util/session.c | 15 +- tools/perf/util/setup.py | 8 +- tools/testing/selftests/cgroup/cgroup_util.c | 6 +- tools/testing/selftests/cgroup/test_core.c | 165 ++++++++++++++++++ 191 files changed, 1365 insertions(+), 496 deletions(-) -- 2.20.1

1 165

[PATCH openEuler-1.0-LTS 1/5] rcu/tree: Mark functions as notrace
by Yongqiang Liu 14 Jul '22

14 Jul '22

From: Zheng Yejian <zhengyejian1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187209, https://gitee.com/openeuler/kernel/issues/I5GWFT CVE: NA -------------------------------- Syzkaller report a softlockup problem, see following logs: [ 41.463870] watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [ksoftirqd/0:9] [ 41.509763] Modules linked in: [ 41.512295] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.19.90 #13 [ 41.516134] Hardware name: linux,dummy-virt (DT) [ 41.519182] pstate: 80c00005 (Nzcv daif +PAN +UAO) [ 41.522415] pc : perf_trace_buf_alloc+0x138/0x238 [ 41.525583] lr : perf_trace_buf_alloc+0x138/0x238 [ 41.528656] sp : ffff8000c137e880 [ 41.531050] x29: ffff8000c137e880 x28: ffff20000850ced0 [ 41.534759] x27: 0000000000000000 x26: ffff8000c137e9c0 [ 41.538456] x25: ffff8000ce5c2ae0 x24: ffff200008358b08 [ 41.542151] x23: 0000000000000000 x22: ffff2000084a50ac [ 41.545834] x21: ffff8000c137e880 x20: 000000000000001c [ 41.549516] x19: ffff7dffbfdf88e8 x18: 0000000000000000 [ 41.553202] x17: 0000000000000000 x16: 0000000000000000 [ 41.556892] x15: 1ffff00036e07805 x14: 0000000000000000 [ 41.560592] x13: 0000000000000004 x12: 0000000000000000 [ 41.564315] x11: 1fffefbff7fbf120 x10: ffff0fbff7fbf120 [ 41.568003] x9 : dfff200000000000 x8 : ffff7dffbfdf8904 [ 41.571699] x7 : 0000000000000000 x6 : ffff0fbff7fbf121 [ 41.575398] x5 : ffff0fbff7fbf121 x4 : ffff0fbff7fbf121 [ 41.579086] x3 : ffff20000850cdc8 x2 : 0000000000000008 [ 41.582773] x1 : ffff8000c1376000 x0 : 0000000000000100 [ 41.586495] Call trace: [ 41.588922] perf_trace_buf_alloc+0x138/0x238 [ 41.591912] perf_ftrace_function_call+0x1ac/0x248 [ 41.595123] ftrace_ops_no_ops+0x3a4/0x488 [ 41.597998] ftrace_graph_call+0x0/0xc [ 41.600715] rcu_dynticks_curr_cpu_in_eqs+0x14/0x70 [ 41.603962] rcu_is_watching+0xc/0x20 [ 41.606635] ftrace_ops_no_ops+0x240/0x488 [ 41.609530] ftrace_graph_call+0x0/0xc [ 41.612249] __read_once_size_nocheck.constprop.0+0x1c/0x38 [ 41.615905] unwind_frame+0x140/0x358 [ 41.618597] walk_stackframe+0x34/0x60 [ 41.621359] __save_stack_trace+0x204/0x3b8 [ 41.624328] save_stack_trace+0x2c/0x38 [ 41.627112] __kasan_slab_free+0x120/0x228 [ 41.630018] kasan_slab_free+0x10/0x18 [ 41.632752] kfree+0x84/0x250 [ 41.635107] skb_free_head+0x70/0xb0 [ 41.637772] skb_release_data+0x3f8/0x730 [ 41.640626] skb_release_all+0x50/0x68 [ 41.643350] kfree_skb+0x84/0x278 [ 41.645890] kfree_skb_list+0x4c/0x78 [ 41.648595] __dev_queue_xmit+0x1a4c/0x23a0 [ 41.651541] dev_queue_xmit+0x28/0x38 [ 41.654254] ip6_finish_output2+0xeb0/0x1630 [ 41.657261] ip6_finish_output+0x2d8/0x7f8 [ 41.660174] ip6_output+0x19c/0x348 [ 41.663850] mld_sendpack+0x560/0x9e0 [ 41.666564] mld_ifc_timer_expire+0x484/0x8a8 [ 41.669624] call_timer_fn+0x68/0x4b0 [ 41.672355] expire_timers+0x168/0x498 [ 41.675126] run_timer_softirq+0x230/0x7a8 [ 41.678052] __do_softirq+0x2d0/0xba0 [ 41.680763] run_ksoftirqd+0x110/0x1a0 [ 41.683512] smpboot_thread_fn+0x31c/0x620 [ 41.686429] kthread+0x2c8/0x348 [ 41.688927] ret_from_fork+0x10/0x18 Look into above call stack, we found a recursive call in 'ftrace_graph_call', see a snippet: __read_once_size_nocheck.constprop.0 ftrace_graph_call ...... rcu_dynticks_curr_cpu_in_eqs ftrace_graph_call We analyze that 'rcu_dynticks_curr_cpu_in_eqs' should not be tracable, and we verify that mark related functions as 'notrace' can avoid the problem. Comparing mainline kernel, we find that commit ff5c4f5cad33 ("rcu/tree: Mark the idle relevant functions noinstr") mark related functions as 'noinstr' which implies notrace, noinline and sticks things in the .noinstr.text section. Link: https://lore.kernel.org/all/20200416114706.625340212@infradead.org/ Currently 'noinstr' mechanism has not been introduced, so we would not directly backport that commit (otherwise more changes may be introduced). Instead, we mark the functions as 'notrace' where it is 'noinstr' in that commit. Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Reviewed-by: Zhen Lei <thunder.leizhen(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/rcu/tree.c | 22 +++++++++++----------- kernel/rcu/tree_plugin.h | 4 ++-- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c index 594d6ea99024..ea05c59096a2 100644 --- a/kernel/rcu/tree.c +++ b/kernel/rcu/tree.c @@ -275,7 +275,7 @@ static DEFINE_PER_CPU(struct rcu_dynticks, rcu_dynticks) = { * Record entry into an extended quiescent state. This is only to be * called when not already in an extended quiescent state. */ -static void rcu_dynticks_eqs_enter(void) +static notrace void rcu_dynticks_eqs_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); int seq; @@ -298,7 +298,7 @@ static void rcu_dynticks_eqs_enter(void) * Record exit from an extended quiescent state. This is only to be * called from an extended quiescent state. */ -static void rcu_dynticks_eqs_exit(void) +static notrace void rcu_dynticks_eqs_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); int seq; @@ -343,7 +343,7 @@ static void rcu_dynticks_eqs_online(void) * * No ordering, as we are sampling CPU-local information. */ -bool rcu_dynticks_curr_cpu_in_eqs(void) +static __always_inline bool rcu_dynticks_curr_cpu_in_eqs(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -706,7 +706,7 @@ static struct rcu_node *rcu_get_root(struct rcu_state *rsp) * the possibility of usermode upcalls having messed up our count * of interrupt nesting level during the prior busy period. */ -static void rcu_eqs_enter(bool user) +static notrace void rcu_eqs_enter(bool user) { struct rcu_state *rsp; struct rcu_data *rdp; @@ -763,7 +763,7 @@ void rcu_idle_enter(void) * If you add or remove a call to rcu_user_enter(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_user_enter(void) +notrace void rcu_user_enter(void) { lockdep_assert_irqs_disabled(); rcu_eqs_enter(true); @@ -781,7 +781,7 @@ void rcu_user_enter(void) * If you add or remove a call to rcu_nmi_exit(), be sure to test * with CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_nmi_exit(void) +notrace void rcu_nmi_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -829,7 +829,7 @@ void rcu_nmi_exit(void) * If you add or remove a call to rcu_irq_exit(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_irq_exit(void) +notrace void rcu_irq_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -864,7 +864,7 @@ void rcu_irq_exit_irqson(void) * allow for the possibility of usermode upcalls messing up our count of * interrupt nesting level during the busy period that is just now starting. */ -static void rcu_eqs_exit(bool user) +static notrace void rcu_eqs_exit(bool user) { struct rcu_dynticks *rdtp; long oldval; @@ -914,7 +914,7 @@ void rcu_idle_exit(void) * If you add or remove a call to rcu_user_exit(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_user_exit(void) +void notrace rcu_user_exit(void) { rcu_eqs_exit(1); } @@ -932,7 +932,7 @@ void rcu_user_exit(void) * If you add or remove a call to rcu_nmi_enter(), be sure to test * with CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_nmi_enter(void) +notrace void rcu_nmi_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); long incby = 2; @@ -982,7 +982,7 @@ void rcu_nmi_enter(void) * If you add or remove a call to rcu_irq_enter(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_irq_enter(void) +notrace void rcu_irq_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h index 5f6de49dc78e..568818bef28f 100644 --- a/kernel/rcu/tree_plugin.h +++ b/kernel/rcu/tree_plugin.h @@ -2677,7 +2677,7 @@ static void rcu_bind_gp_kthread(void) } /* Record the current task on dyntick-idle entry. */ -static void rcu_dynticks_task_enter(void) +static notrace void rcu_dynticks_task_enter(void) { #if defined(CONFIG_TASKS_RCU) && defined(CONFIG_NO_HZ_FULL) WRITE_ONCE(current->rcu_tasks_idle_cpu, smp_processor_id()); @@ -2685,7 +2685,7 @@ static void rcu_dynticks_task_enter(void) } /* Record no current task on dyntick-idle exit. */ -static void rcu_dynticks_task_exit(void) +static notrace void rcu_dynticks_task_exit(void) { #if defined(CONFIG_TASKS_RCU) && defined(CONFIG_NO_HZ_FULL) WRITE_ONCE(current->rcu_tasks_idle_cpu, -1); -- 2.25.1

1 4

[PATCH openEuler-1.0-LTS 1/5] rcu/tree: Mark functions as notrace
by Yongqiang Liu 14 Jul '22

14 Jul '22

From: Zheng Yejian <zhengyejian1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187209, https://gitee.com/openeuler/kernel/issues/I5GWFT CVE: NA -------------------------------- Syzkaller report a softlockup problem, see following logs: [ 41.463870] watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [ksoftirqd/0:9] [ 41.509763] Modules linked in: [ 41.512295] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.19.90 #13 [ 41.516134] Hardware name: linux,dummy-virt (DT) [ 41.519182] pstate: 80c00005 (Nzcv daif +PAN +UAO) [ 41.522415] pc : perf_trace_buf_alloc+0x138/0x238 [ 41.525583] lr : perf_trace_buf_alloc+0x138/0x238 [ 41.528656] sp : ffff8000c137e880 [ 41.531050] x29: ffff8000c137e880 x28: ffff20000850ced0 [ 41.534759] x27: 0000000000000000 x26: ffff8000c137e9c0 [ 41.538456] x25: ffff8000ce5c2ae0 x24: ffff200008358b08 [ 41.542151] x23: 0000000000000000 x22: ffff2000084a50ac [ 41.545834] x21: ffff8000c137e880 x20: 000000000000001c [ 41.549516] x19: ffff7dffbfdf88e8 x18: 0000000000000000 [ 41.553202] x17: 0000000000000000 x16: 0000000000000000 [ 41.556892] x15: 1ffff00036e07805 x14: 0000000000000000 [ 41.560592] x13: 0000000000000004 x12: 0000000000000000 [ 41.564315] x11: 1fffefbff7fbf120 x10: ffff0fbff7fbf120 [ 41.568003] x9 : dfff200000000000 x8 : ffff7dffbfdf8904 [ 41.571699] x7 : 0000000000000000 x6 : ffff0fbff7fbf121 [ 41.575398] x5 : ffff0fbff7fbf121 x4 : ffff0fbff7fbf121 [ 41.579086] x3 : ffff20000850cdc8 x2 : 0000000000000008 [ 41.582773] x1 : ffff8000c1376000 x0 : 0000000000000100 [ 41.586495] Call trace: [ 41.588922] perf_trace_buf_alloc+0x138/0x238 [ 41.591912] perf_ftrace_function_call+0x1ac/0x248 [ 41.595123] ftrace_ops_no_ops+0x3a4/0x488 [ 41.597998] ftrace_graph_call+0x0/0xc [ 41.600715] rcu_dynticks_curr_cpu_in_eqs+0x14/0x70 [ 41.603962] rcu_is_watching+0xc/0x20 [ 41.606635] ftrace_ops_no_ops+0x240/0x488 [ 41.609530] ftrace_graph_call+0x0/0xc [ 41.612249] __read_once_size_nocheck.constprop.0+0x1c/0x38 [ 41.615905] unwind_frame+0x140/0x358 [ 41.618597] walk_stackframe+0x34/0x60 [ 41.621359] __save_stack_trace+0x204/0x3b8 [ 41.624328] save_stack_trace+0x2c/0x38 [ 41.627112] __kasan_slab_free+0x120/0x228 [ 41.630018] kasan_slab_free+0x10/0x18 [ 41.632752] kfree+0x84/0x250 [ 41.635107] skb_free_head+0x70/0xb0 [ 41.637772] skb_release_data+0x3f8/0x730 [ 41.640626] skb_release_all+0x50/0x68 [ 41.643350] kfree_skb+0x84/0x278 [ 41.645890] kfree_skb_list+0x4c/0x78 [ 41.648595] __dev_queue_xmit+0x1a4c/0x23a0 [ 41.651541] dev_queue_xmit+0x28/0x38 [ 41.654254] ip6_finish_output2+0xeb0/0x1630 [ 41.657261] ip6_finish_output+0x2d8/0x7f8 [ 41.660174] ip6_output+0x19c/0x348 [ 41.663850] mld_sendpack+0x560/0x9e0 [ 41.666564] mld_ifc_timer_expire+0x484/0x8a8 [ 41.669624] call_timer_fn+0x68/0x4b0 [ 41.672355] expire_timers+0x168/0x498 [ 41.675126] run_timer_softirq+0x230/0x7a8 [ 41.678052] __do_softirq+0x2d0/0xba0 [ 41.680763] run_ksoftirqd+0x110/0x1a0 [ 41.683512] smpboot_thread_fn+0x31c/0x620 [ 41.686429] kthread+0x2c8/0x348 [ 41.688927] ret_from_fork+0x10/0x18 Look into above call stack, we found a recursive call in 'ftrace_graph_call', see a snippet: __read_once_size_nocheck.constprop.0 ftrace_graph_call ...... rcu_dynticks_curr_cpu_in_eqs ftrace_graph_call We analyze that 'rcu_dynticks_curr_cpu_in_eqs' should not be tracable, and we verify that mark related functions as 'notrace' can avoid the problem. Comparing mainline kernel, we find that commit ff5c4f5cad33 ("rcu/tree: Mark the idle relevant functions noinstr") mark related functions as 'noinstr' which implies notrace, noinline and sticks things in the .noinstr.text section. Link: https://lore.kernel.org/all/20200416114706.625340212@infradead.org/ Currently 'noinstr' mechanism has not been introduced, so we would not directly backport that commit (otherwise more changes may be introduced). Instead, we mark the functions as 'notrace' where it is 'noinstr' in that commit. Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Reviewed-by: Zhen Lei <thunder.leizhen(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/rcu/tree.c | 22 +++++++++++----------- kernel/rcu/tree_plugin.h | 4 ++-- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c index 594d6ea99024..ea05c59096a2 100644 --- a/kernel/rcu/tree.c +++ b/kernel/rcu/tree.c @@ -275,7 +275,7 @@ static DEFINE_PER_CPU(struct rcu_dynticks, rcu_dynticks) = { * Record entry into an extended quiescent state. This is only to be * called when not already in an extended quiescent state. */ -static void rcu_dynticks_eqs_enter(void) +static notrace void rcu_dynticks_eqs_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); int seq; @@ -298,7 +298,7 @@ static void rcu_dynticks_eqs_enter(void) * Record exit from an extended quiescent state. This is only to be * called from an extended quiescent state. */ -static void rcu_dynticks_eqs_exit(void) +static notrace void rcu_dynticks_eqs_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); int seq; @@ -343,7 +343,7 @@ static void rcu_dynticks_eqs_online(void) * * No ordering, as we are sampling CPU-local information. */ -bool rcu_dynticks_curr_cpu_in_eqs(void) +static __always_inline bool rcu_dynticks_curr_cpu_in_eqs(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -706,7 +706,7 @@ static struct rcu_node *rcu_get_root(struct rcu_state *rsp) * the possibility of usermode upcalls having messed up our count * of interrupt nesting level during the prior busy period. */ -static void rcu_eqs_enter(bool user) +static notrace void rcu_eqs_enter(bool user) { struct rcu_state *rsp; struct rcu_data *rdp; @@ -763,7 +763,7 @@ void rcu_idle_enter(void) * If you add or remove a call to rcu_user_enter(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_user_enter(void) +notrace void rcu_user_enter(void) { lockdep_assert_irqs_disabled(); rcu_eqs_enter(true); @@ -781,7 +781,7 @@ void rcu_user_enter(void) * If you add or remove a call to rcu_nmi_exit(), be sure to test * with CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_nmi_exit(void) +notrace void rcu_nmi_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -829,7 +829,7 @@ void rcu_nmi_exit(void) * If you add or remove a call to rcu_irq_exit(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_irq_exit(void) +notrace void rcu_irq_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -864,7 +864,7 @@ void rcu_irq_exit_irqson(void) * allow for the possibility of usermode upcalls messing up our count of * interrupt nesting level during the busy period that is just now starting. */ -static void rcu_eqs_exit(bool user) +static notrace void rcu_eqs_exit(bool user) { struct rcu_dynticks *rdtp; long oldval; @@ -914,7 +914,7 @@ void rcu_idle_exit(void) * If you add or remove a call to rcu_user_exit(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_user_exit(void) +void notrace rcu_user_exit(void) { rcu_eqs_exit(1); } @@ -932,7 +932,7 @@ void rcu_user_exit(void) * If you add or remove a call to rcu_nmi_enter(), be sure to test * with CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_nmi_enter(void) +notrace void rcu_nmi_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); long incby = 2; @@ -982,7 +982,7 @@ void rcu_nmi_enter(void) * If you add or remove a call to rcu_irq_enter(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_irq_enter(void) +notrace void rcu_irq_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h index 5f6de49dc78e..568818bef28f 100644 --- a/kernel/rcu/tree_plugin.h +++ b/kernel/rcu/tree_plugin.h @@ -2677,7 +2677,7 @@ static void rcu_bind_gp_kthread(void) } /* Record the current task on dyntick-idle entry. */ -static void rcu_dynticks_task_enter(void) +static notrace void rcu_dynticks_task_enter(void) { #if defined(CONFIG_TASKS_RCU) && defined(CONFIG_NO_HZ_FULL) WRITE_ONCE(current->rcu_tasks_idle_cpu, smp_processor_id()); @@ -2685,7 +2685,7 @@ static void rcu_dynticks_task_enter(void) } /* Record no current task on dyntick-idle exit. */ -static void rcu_dynticks_task_exit(void) +static notrace void rcu_dynticks_task_exit(void) { #if defined(CONFIG_TASKS_RCU) && defined(CONFIG_NO_HZ_FULL) WRITE_ONCE(current->rcu_tasks_idle_cpu, -1); -- 2.25.1

1 4

[PATCH openEuler-1.0-LTS 1/4] vt: drop old FONT ioctls
by Yongqiang Liu 13 Jul '22

13 Jul '22

From: Jiri Slaby <jslaby(a)suse.cz> stable inclusion from stable-4.19.250 commit b15d5731b708a2190fec836990b8aefbbf36b07a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5GKVX CVE: CVE-2021-33656 -------------------------------- commit ff2047fb755d4415ec3c70ac799889371151796d upstream. Drop support for these ioctls: * PIO_FONT, PIO_FONTX * GIO_FONT, GIO_FONTX * PIO_FONTRESET As was demonstrated by commit 90bfdeef83f1 (tty: make FONTX ioctl use the tty pointer they were actually passed), these ioctls are not used from userspace, as: 1) they used to be broken (set up font on current console, not the open one) and racy (before the commit above) 2) KDFONTOP ioctl is used for years instead Note that PIO_FONTRESET is defunct on most systems as VGA_CONSOLE is set on them for ages. That turns on BROKEN_GRAPHICS_PROGRAMS which makes PIO_FONTRESET just return an error. We are removing KD_FONT_FLAG_OLD here as it was used only by these removed ioctls. kd.h header exists both in kernel and uapi headers, so we can remove the kernel one completely. Everyone includeing kd.h will now automatically get the uapi one. There are now unused definitions of the ioctl numbers and "struct consolefontdesc" in kd.h, but as it is a uapi header, I am not touching these. Signed-off-by: Jiri Slaby <jslaby(a)suse.cz> Link: https://lore.kernel.org/r/20210105120239.28031-8-jslaby@suse.cz Cc: guodaxing <guodaxing(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/tty/vt/vt.c | 39 +--------- drivers/tty/vt/vt_ioctl.c | 149 -------------------------------------- include/linux/kd.h | 8 -- 3 files changed, 3 insertions(+), 193 deletions(-) delete mode 100644 include/linux/kd.h diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 72e3989dffa6..dca627ccece5 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -4472,16 +4472,8 @@ static int con_font_get(struct vc_data *vc, struct console_font_op *op) if (op->data && font.charcount > op->charcount) rc = -ENOSPC; - if (!(op->flags & KD_FONT_FLAG_OLD)) { - if (font.width > op->width || font.height > op->height) - rc = -ENOSPC; - } else { - if (font.width != 8) - rc = -EIO; - else if ((op->height && font.height > op->height) || - font.height > 32) - rc = -ENOSPC; - } + if (font.width > op->width || font.height > op->height) + rc = -ENOSPC; if (rc) goto out; @@ -4509,7 +4501,7 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op) return -EINVAL; if (op->charcount > 512) return -EINVAL; - if (op->width <= 0 || op->width > 32 || op->height > 32) + if (op->width <= 0 || op->width > 32 || !op->height || op->height > 32) return -EINVAL; size = (op->width+7)/8 * 32 * op->charcount; if (size > max_font_size) @@ -4519,31 +4511,6 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op) if (IS_ERR(font.data)) return PTR_ERR(font.data); - if (!op->height) { /* Need to guess font height [compat] */ - int h, i; - u8 *charmap = font.data; - - /* - * If from KDFONTOP ioctl, don't allow things which can be done - * in userland,so that we can get rid of this soon - */ - if (!(op->flags & KD_FONT_FLAG_OLD)) { - kfree(font.data); - return -EINVAL; - } - - for (h = 32; h > 0; h--) - for (i = 0; i < op->charcount; i++) - if (charmap[32*i+h-1]) - goto nonzero; - - kfree(font.data); - return -EINVAL; - - nonzero: - op->height = h; - } - font.charcount = op->charcount; font.width = op->width; font.height = op->height; diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c index 13675008d1c7..915b0173b4f8 100644 --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -241,48 +241,6 @@ int vt_waitactive(int n) #define GPLAST 0x3df #define GPNUM (GPLAST - GPFIRST + 1) - - -static inline int -do_fontx_ioctl(struct vc_data *vc, int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op) -{ - struct consolefontdesc cfdarg; - int i; - - if (copy_from_user(&cfdarg, user_cfd, sizeof(struct consolefontdesc))) - return -EFAULT; - - switch (cmd) { - case PIO_FONTX: - if (!perm) - return -EPERM; - op->op = KD_FONT_OP_SET; - op->flags = KD_FONT_FLAG_OLD; - op->width = 8; - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = cfdarg.chardata; - return con_font_op(vc, op); - - case GIO_FONTX: - op->op = KD_FONT_OP_GET; - op->flags = KD_FONT_FLAG_OLD; - op->width = 8; - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = cfdarg.chardata; - i = con_font_op(vc, op); - if (i) - return i; - cfdarg.charheight = op->height; - cfdarg.charcount = op->charcount; - if (copy_to_user(user_cfd, &cfdarg, sizeof(struct consolefontdesc))) - return -EFAULT; - return 0; - } - return -EINVAL; -} - static inline int do_unimap_ioctl(int cmd, struct unimapdesc __user *user_ud, int perm, struct vc_data *vc) { @@ -918,30 +876,6 @@ int vt_ioctl(struct tty_struct *tty, break; } - case PIO_FONT: { - if (!perm) - return -EPERM; - op.op = KD_FONT_OP_SET; - op.flags = KD_FONT_FLAG_OLD | KD_FONT_FLAG_DONT_RECALC; /* Compatibility */ - op.width = 8; - op.height = 0; - op.charcount = 256; - op.data = up; - ret = con_font_op(vc, &op); - break; - } - - case GIO_FONT: { - op.op = KD_FONT_OP_GET; - op.flags = KD_FONT_FLAG_OLD; - op.width = 8; - op.height = 32; - op.charcount = 256; - op.data = up; - ret = con_font_op(vc, &op); - break; - } - case PIO_CMAP: if (!perm) ret = -EPERM; @@ -953,36 +887,6 @@ int vt_ioctl(struct tty_struct *tty, ret = con_get_cmap(up); break; - case PIO_FONTX: - case GIO_FONTX: - ret = do_fontx_ioctl(vc, cmd, up, perm, &op); - break; - - case PIO_FONTRESET: - { - if (!perm) - return -EPERM; - -#ifdef BROKEN_GRAPHICS_PROGRAMS - /* With BROKEN_GRAPHICS_PROGRAMS defined, the default - font is not saved. */ - ret = -ENOSYS; - break; -#else - { - op.op = KD_FONT_OP_SET_DEFAULT; - op.data = NULL; - ret = con_font_op(vc, &op); - if (ret) - break; - console_lock(); - con_set_default_unimap(vc); - console_unlock(); - break; - } -#endif - } - case KDFONTOP: { if (copy_from_user(&op, up, sizeof(op))) { ret = -EFAULT; @@ -1096,54 +1000,6 @@ void vc_SAK(struct work_struct *work) #ifdef CONFIG_COMPAT -struct compat_consolefontdesc { - unsigned short charcount; /* characters in font (256 or 512) */ - unsigned short charheight; /* scan lines per character (1-32) */ - compat_caddr_t chardata; /* font data in expanded form */ -}; - -static inline int -compat_fontx_ioctl(struct vc_data *vc, int cmd, - struct compat_consolefontdesc __user *user_cfd, - int perm, struct console_font_op *op) -{ - struct compat_consolefontdesc cfdarg; - int i; - - if (copy_from_user(&cfdarg, user_cfd, sizeof(struct compat_consolefontdesc))) - return -EFAULT; - - switch (cmd) { - case PIO_FONTX: - if (!perm) - return -EPERM; - op->op = KD_FONT_OP_SET; - op->flags = KD_FONT_FLAG_OLD; - op->width = 8; - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = compat_ptr(cfdarg.chardata); - return con_font_op(vc, op); - - case GIO_FONTX: - op->op = KD_FONT_OP_GET; - op->flags = KD_FONT_FLAG_OLD; - op->width = 8; - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = compat_ptr(cfdarg.chardata); - i = con_font_op(vc, op); - if (i) - return i; - cfdarg.charheight = op->height; - cfdarg.charcount = op->charcount; - if (copy_to_user(user_cfd, &cfdarg, sizeof(struct compat_consolefontdesc))) - return -EFAULT; - return 0; - } - return -EINVAL; -} - struct compat_console_font_op { compat_uint_t op; /* operation code KD_FONT_OP_* */ compat_uint_t flags; /* KD_FONT_FLAG_* */ @@ -1221,11 +1077,6 @@ long vt_compat_ioctl(struct tty_struct *tty, /* * these need special handlers for incompatible data structures */ - case PIO_FONTX: - case GIO_FONTX: - ret = compat_fontx_ioctl(vc, cmd, up, perm, &op); - break; - case KDFONTOP: ret = compat_kdfontop_ioctl(up, perm, &op, vc); break; diff --git a/include/linux/kd.h b/include/linux/kd.h deleted file mode 100644 index b130a18f860f..000000000000 --- a/include/linux/kd.h +++ /dev/null @@ -1,8 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef _LINUX_KD_H -#define _LINUX_KD_H - -#include <uapi/linux/kd.h> - -#define KD_FONT_FLAG_OLD 0x80000000 /* Invoked via old interface [compat] */ -#endif /* _LINUX_KD_H */ -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS] dm thin: Fix crash in dm_sm_register_threshold_callback()
by Yongqiang Liu 13 Jul '22

13 Jul '22

From: Luo Meng <luomeng12(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GRX6 CVE: NA -------------------------------- Fault inject on pool metadata device report: BUG: KASAN: use-after-free in dm_pool_register_metadata_threshold+0x40/0x80 Read of size 8 at addr ffff8881b9d50068 by task dmsetup/950 CPU: 7 PID: 950 Comm: dmsetup Tainted: G W 5.19.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_address_description.constprop.0.cold+0xeb/0x3f4 kasan_report.cold+0xe6/0x147 dm_pool_register_metadata_threshold+0x40/0x80 pool_ctr+0xa0a/0x1150 dm_table_add_target+0x2c8/0x640 table_load+0x1fd/0x430 ctl_ioctl+0x2c4/0x5a0 dm_ctl_ioctl+0xa/0x10 __x64_sys_ioctl+0xb3/0xd0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 This can be easy reproduce: echo offline > /sys/block/sda/device/state dd if=/dev/zero of=/dev/mapper/thin bs=4k count=10 dmsetup load pool --table "0 20971520 thin-pool /dev/sda /dev/sdb 128 0 0" If metadata commit failed, the transaction will be aborted and the metadata space manager will be destroyed. If load table on this pool, when register the metadata threshold callback, the UAF will happen on metadata space manager. So return error when load table if the pool is on FAIL status. Fixes: ac8c3f3df65e4 ("dm thin: generate event when metadata threshold passed") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/md/dm-thin-metadata.c | 8 +++++++- drivers/md/dm-thin.c | 4 +++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c index a6a5cee6b943..c3dc171114dc 100644 --- a/drivers/md/dm-thin-metadata.c +++ b/drivers/md/dm-thin-metadata.c @@ -1997,9 +1997,15 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd, int r; down_write(&pmd->root_lock); + if (pmd->fail_io) { + r = -EINVAL; + goto out; + } + r = dm_sm_register_threshold_callback(pmd->metadata_sm, threshold, fn, context); - up_write(&pmd->root_lock); +out: + up_write(&pmd->root_lock); return r; } diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c index 435a2ee4a392..2b6dd7a275eb 100644 --- a/drivers/md/dm-thin.c +++ b/drivers/md/dm-thin.c @@ -3383,8 +3383,10 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) calc_metadata_threshold(pt), metadata_low_callback, pool); - if (r) + if (r) { + ti->error = "Error registering metadata threshold"; goto out_flags_changed; + } pt->callbacks.congested_fn = pool_is_congested; dm_table_add_target_callbacks(ti->table, &pt->callbacks); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 01/21] kabi: deduplication friendly structs
by Zheng Zengkai 13 Jul '22

13 Jul '22

From: Li Lingfeng <lilingfeng3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DI4S CVE: NA Reference: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/commit… --------------------------- We don't really need the field names to be globally unique, it is enough when they are unique in the given struct. Since structs do not generally span mutliple files, using the line number is enough to ensure an unique identifier. It means that we can't use two KABI_RENAME macros on the same line but that's not happening anyway. This allows pahole to deduplicate the type info of structs using KABI macros, lowering the size of vmlinuz from 26M to 8.5 Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/kabi.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/include/linux/kabi.h b/include/linux/kabi.h index a52d9fa72cfa..fe3213c0f576 100644 --- a/include/linux/kabi.h +++ b/include/linux/kabi.h @@ -393,6 +393,8 @@ # define __KABI_CHECK_SIZE(_item, _size) #endif +#define KABI_UNIQUE_ID __PASTE(kabi_hidden_, __LINE__) + # define _KABI_DEPRECATE(_type, _orig) _type kabi_reserved_##_orig # define _KABI_DEPRECATE_FN(_type, _orig, _args...) \ _type (* kabi_reserved_##_orig)(_args) @@ -402,7 +404,7 @@ _new; \ struct { \ _orig; \ - } __UNIQUE_ID(kabi_hide); \ + } KABI_UNIQUE_ID; \ __KABI_CHECK_SIZE_ALIGN(_orig, _new); \ } #else -- 2.20.1

1 20

[PATCH openEuler-1.0-LTS 1/6] xen/blkfront: fix memory allocation flags in blkfront_setup_indirect()
by Yongqiang Liu 13 Jul '22

13 Jul '22

From: Juergen Gross <jgross(a)suse.com> stable inclusion from stable-v4.19.116 commit 5f547e7cbd8435be3aa2a27e2ae594b4fd94865b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5GLXT CVE: CVE-2022-26365 -------------------------------- commit 3a169c0be75b59dd85d159493634870cdec6d3c4 upstream. Commit 1d5c76e664333 ("xen-blkfront: switch kcalloc to kvcalloc for large array allocation") didn't fix the issue it was meant to, as the flags for allocating the memory are GFP_NOIO, which will lead the memory allocation falling back to kmalloc(). So instead of GFP_NOIO use GFP_KERNEL and do all the memory allocation in blkfront_setup_indirect() in a memalloc_noio_{save,restore} section. Fixes: 1d5c76e664333 ("xen-blkfront: switch kcalloc to kvcalloc for large array allocation") Cc: stable(a)vger.kernel.org Signed-off-by: Juergen Gross <jgross(a)suse.com> Reviewed-by: Boris Ostrovsky <boris.ostrovsky(a)oracle.com> Acked-by: Roger Pau Monné <roger.pau(a)citrix.com> Link: https://lore.kernel.org/r/20200403090034.8753-1-jgross@suse.com Signed-off-by: Juergen Gross <jgross(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/block/xen-blkfront.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c index 0e451b17f33a..8059ff5ab4a6 100644 --- a/drivers/block/xen-blkfront.c +++ b/drivers/block/xen-blkfront.c @@ -47,6 +47,7 @@ #include <linux/bitmap.h> #include <linux/list.h> #include <linux/workqueue.h> +#include <linux/sched/mm.h> #include <xen/xen.h> #include <xen/xenbus.h> @@ -2251,10 +2252,12 @@ static void blkfront_setup_discard(struct blkfront_info *info) static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) { - unsigned int psegs, grants; + unsigned int psegs, grants, memflags; int err, i; struct blkfront_info *info = rinfo->dev_info; + memflags = memalloc_noio_save(); + if (info->max_indirect_segments == 0) { if (!HAS_EXTRA_REQ) grants = BLKIF_MAX_SEGMENTS_PER_REQUEST; @@ -2286,7 +2289,7 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) BUG_ON(!list_empty(&rinfo->indirect_pages)); for (i = 0; i < num; i++) { - struct page *indirect_page = alloc_page(GFP_NOIO); + struct page *indirect_page = alloc_page(GFP_KERNEL); if (!indirect_page) goto out_of_memory; list_add(&indirect_page->lru, &rinfo->indirect_pages); @@ -2297,15 +2300,15 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) rinfo->shadow[i].grants_used = kvcalloc(grants, sizeof(rinfo->shadow[i].grants_used[0]), - GFP_NOIO); + GFP_KERNEL); rinfo->shadow[i].sg = kvcalloc(psegs, sizeof(rinfo->shadow[i].sg[0]), - GFP_NOIO); + GFP_KERNEL); if (info->max_indirect_segments) rinfo->shadow[i].indirect_grants = kvcalloc(INDIRECT_GREFS(grants), sizeof(rinfo->shadow[i].indirect_grants[0]), - GFP_NOIO); + GFP_KERNEL); if ((rinfo->shadow[i].grants_used == NULL) || (rinfo->shadow[i].sg == NULL) || (info->max_indirect_segments && @@ -2314,6 +2317,7 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) sg_init_table(rinfo->shadow[i].sg, psegs); } + memalloc_noio_restore(memflags); return 0; @@ -2333,6 +2337,9 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) __free_page(indirect_page); } } + + memalloc_noio_restore(memflags); + return -ENOMEM; } -- 2.25.1

1 5

[PATCH openEuler-5.10 01/23] blk-throttle: fix io hung due to configuration updates
by Zheng Zengkai 12 Jul '22

12 Jul '22

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I58VE5 CVE: NA -------------------------------- If new configuration is submitted while a bio is throttled, then new waiting time is recaculated regardless that the bio might aready wait for some time: tg_conf_updated throtl_start_new_slice tg_update_disptime throtl_schedule_next_dispatch Then io hung can be triggered by always submmiting new configuration before the throttled bio is dispatched. Fix the problem by respecting the time that throttled bio aready waited. In order to do that, instead of start new slice in tg_conf_updated(), just update 'bytes_disp' and 'io_disp' based on the new configuration. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/blk-throttle.c | 79 ++++++++++++++++++++++++++++++++++++-------- 1 file changed, 66 insertions(+), 13 deletions(-) diff --git a/block/blk-throttle.c b/block/blk-throttle.c index 95a13da1f343..0427c9c63e81 100644 --- a/block/blk-throttle.c +++ b/block/blk-throttle.c @@ -1421,7 +1421,57 @@ static int tg_print_conf_uint(struct seq_file *sf, void *v) return 0; } -static void tg_conf_updated(struct throtl_grp *tg, bool global) +static u64 throtl_update_bytes_disp(u64 dispatched, u64 new_limit, + u64 old_limit) +{ + if (new_limit == old_limit) + return dispatched; + + if (!dispatched) + return 0; + + /* + * In the case that multiply will overflow, just return 0. It will only + * let bios to be dispatched earlier. + */ + if (div64_u64(U64_MAX, dispatched) < new_limit) + return 0; + + dispatched *= new_limit; + return div64_u64(dispatched, old_limit); +} + +static u32 throtl_update_io_disp(u32 dispatched, u32 new_limit, u32 old_limit) +{ + if (new_limit == old_limit) + return dispatched; + + if (!dispatched) + return 0; + /* + * In the case that multiply will overflow, just return 0. It will only + * let bios to be dispatched earlier. + */ + if (UINT_MAX / dispatched < new_limit) + return 0; + + dispatched *= new_limit; + return dispatched / old_limit; +} + +static void throtl_update_slice(struct throtl_grp *tg, u64 *old_limits) +{ + tg->bytes_disp[READ] = throtl_update_bytes_disp(tg->bytes_disp[READ], + tg_bps_limit(tg, READ), old_limits[0]); + tg->bytes_disp[WRITE] = throtl_update_bytes_disp(tg->bytes_disp[WRITE], + tg_bps_limit(tg, WRITE), old_limits[1]); + tg->io_disp[READ] = throtl_update_io_disp(tg->io_disp[READ], + tg_iops_limit(tg, READ), (u32)old_limits[2]); + tg->io_disp[WRITE] = throtl_update_io_disp(tg->io_disp[WRITE], + tg_iops_limit(tg, WRITE), (u32)old_limits[3]); +} + +static void tg_conf_updated(struct throtl_grp *tg, u64 *old_limits, bool global) { struct throtl_service_queue *sq = &tg->service_queue; struct cgroup_subsys_state *pos_css; @@ -1460,16 +1510,7 @@ static void tg_conf_updated(struct throtl_grp *tg, bool global) parent_tg->latency_target); } - /* - * We're already holding queue_lock and know @tg is valid. Let's - * apply the new config directly. - * - * Restart the slices for both READ and WRITES. It might happen - * that a group's limit are dropped suddenly and we don't want to - * account recently dispatched IO with new low rate. - */ - throtl_start_new_slice(tg, READ); - throtl_start_new_slice(tg, WRITE); + throtl_update_slice(tg, old_limits); if (tg->flags & THROTL_TG_PENDING) { tg_update_disptime(tg); @@ -1502,6 +1543,14 @@ static inline int throtl_restart_syscall_when_busy(int errno) return ret; } +static void tg_get_limits(struct throtl_grp *tg, u64 *limits) +{ + limits[0] = tg_bps_limit(tg, READ); + limits[1] = tg_bps_limit(tg, WRITE); + limits[2] = tg_iops_limit(tg, READ); + limits[3] = tg_iops_limit(tg, WRITE); +} + static ssize_t tg_set_conf(struct kernfs_open_file *of, char *buf, size_t nbytes, loff_t off, bool is_u64) { @@ -1510,6 +1559,7 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of, struct throtl_grp *tg; int ret; u64 v; + u64 old_limits[4]; ret = blkg_conf_prep(blkcg, &blkcg_policy_throtl, buf, &ctx); if (ret) @@ -1526,13 +1576,14 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of, v = U64_MAX; tg = blkg_to_tg(ctx.blkg); + tg_get_limits(tg, old_limits); if (is_u64) *(u64 *)((void *)tg + of_cft(of)->private) = v; else *(unsigned int *)((void *)tg + of_cft(of)->private) = v; - tg_conf_updated(tg, false); + tg_conf_updated(tg, old_limits, false); ret = 0; out_finish: blkg_conf_finish(&ctx); @@ -1703,6 +1754,7 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of, struct blkg_conf_ctx ctx; struct throtl_grp *tg; u64 v[4]; + u64 old_limits[4]; unsigned long idle_time; unsigned long latency_time; int ret; @@ -1721,6 +1773,7 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of, v[1] = tg->bps_conf[WRITE][index]; v[2] = tg->iops_conf[READ][index]; v[3] = tg->iops_conf[WRITE][index]; + tg_get_limits(tg, old_limits); idle_time = tg->idletime_threshold_conf; latency_time = tg->latency_target_conf; @@ -1807,7 +1860,7 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of, tg->td->limit_index = LIMIT_LOW; } else tg->td->limit_index = LIMIT_MAX; - tg_conf_updated(tg, index == LIMIT_LOW && + tg_conf_updated(tg, old_limits, index == LIMIT_LOW && tg->td->limit_valid[LIMIT_LOW]); ret = 0; out_finish: -- 2.20.1

1 22

[PATCH openEuler-1.0-LTS 1/2] tmpfs: fix undefined-behaviour in shmem_reconfigure()
by Yongqiang Liu 12 Jul '22

12 Jul '22

From: Luo Meng <luomeng12(a)huawei.com> mainline inclusion from mainline-v5.19-rc3 commit d14f5efadd846dbde561bd734318de6a9e6b26e6 category: bugfix bugzilla: 186471 https://gitee.com/openeuler/kernel/issues/I5DRKR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- When shmem_reconfigure() calls __percpu_counter_compare(), the second parameter is unsigned long long. But in the definition of __percpu_counter_compare(), the second parameter is s64. So when __percpu_counter_compare() executes abs(count - rhs), UBSAN shows the following warning: Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> ================================================================================ UBSAN: Undefined behaviour in lib/percpu_counter.c:209:6 signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long long int' CPU: 1 PID: 9636 Comm: syz-executor.2 Tainted: G ---------r- - 4.18.0 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack home/install/linux-rh-3-10/lib/dump_stack.c:77 [inline] dump_stack+0x125/0x1ae home/install/linux-rh-3-10/lib/dump_stack.c:117 ubsan_epilogue+0xe/0x81 home/install/linux-rh-3-10/lib/ubsan.c:159 handle_overflow+0x19d/0x1ec home/install/linux-rh-3-10/lib/ubsan.c:190 __percpu_counter_compare+0x124/0x140 home/install/linux-rh-3-10/lib/percpu_counter.c:209 percpu_counter_compare home/install/linux-rh-3-10/./include/linux/percpu_counter.h:50 [inline] shmem_remount_fs+0x1ce/0x6b0 home/install/linux-rh-3-10/mm/shmem.c:3530 do_remount_sb+0x11b/0x530 home/install/linux-rh-3-10/fs/super.c:888 do_remount home/install/linux-rh-3-10/fs/namespace.c:2344 [inline] do_mount+0xf8d/0x26b0 home/install/linux-rh-3-10/fs/namespace.c:2844 ksys_mount+0xad/0x120 home/install/linux-rh-3-10/fs/namespace.c:3075 __do_sys_mount home/install/linux-rh-3-10/fs/namespace.c:3089 [inline] __se_sys_mount home/install/linux-rh-3-10/fs/namespace.c:3086 [inline] __x64_sys_mount+0xbf/0x160 home/install/linux-rh-3-10/fs/namespace.c:3086 do_syscall_64+0xca/0x5c0 home/install/linux-rh-3-10/arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x6a/0xdf RIP: 0033:0x46b5e9 Code: 5d db fa ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b db fa ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f54d5f22c68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 000000000077bf60 RCX: 000000000046b5e9 RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000000 RBP: 000000000077bf60 R08: 0000000020000140 R09: 0000000000000000 R10: 00000000026740a4 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd1fb1592f R14: 00007f54d5f239c0 R15: 000000000077bf6c ================================================================================ [akpm(a)linux-foundation.org: tweak error message text] Link: https://lkml.kernel.org/r/20220513025225.2678727-1-luomeng12@huawei.com Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/shmem.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/shmem.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mm/shmem.c b/mm/shmem.c index 8915a5b9ad0a..be91fb743426 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -3605,6 +3605,10 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data) spin_lock(&sbinfo->stat_lock); inodes = sbinfo->max_inodes - sbinfo->free_inodes; + if (config.max_blocks > S64_MAX) { + pr_err("Number of blocks too large"); + goto out; + } if (percpu_counter_compare(&sbinfo->used_blocks, config.max_blocks) > 0) goto out; if (config.max_inodes < inodes) -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] mm/sharepool: Check sp_is_enabled() before show spa_stat
by Yongqiang Liu 12 Jul '22

12 Jul '22

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GO4E CVE: NA -------------------------------- When we read file /proc/sharepool/spa_stat, we use sp_mapping_normal to iterator all the normal sp_area. The global pointer sp_mapping_normal is NULL if the sharepool feature is not enabled via kernel bootarg. This leads to a null-pointer-dereference issue. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/mm/share_pool.c b/mm/share_pool.c index 893e5352bf01..661036a7df64 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -4365,6 +4365,9 @@ void spg_overview_show(struct seq_file *seq) static int spa_stat_show(struct seq_file *seq, void *offset) { + if (!sp_is_enabled()) + return 0; + spg_overview_show(seq); spa_overview_show(seq); /* print the file header */ @@ -4425,6 +4428,9 @@ static int idr_proc_stat_cb(int id, void *p, void *data) static int proc_stat_show(struct seq_file *seq, void *offset) { + if (!sp_is_enabled()) + return 0; + spg_overview_show(seq); spa_overview_show(seq); /* print the file header */ @@ -4474,6 +4480,9 @@ static int idr_proc_overview_cb(int id, void *p, void *data) static int proc_overview_show(struct seq_file *seq, void *offset) { + if (!sp_is_enabled()) + return 0; + seq_printf(seq, "%-8s %-16s %-9s %-9s %-9s %-10s %-10s %-8s\n", "PID", "COMM", "SP_ALLOC", "SP_K2U", "SP_RES", "Non-SP_RES", "Non-SP_Shm", "VIRT"); -- 2.25.1

1 0

[PATCH v1 OLK-5.10 51/71] sw64: iommu: fix iommu interrupt handler
by Gu Zitao 12 Jul '22

12 Jul '22

From: Zheng Chongzhen <zhengchongzhen(a)wxiat.com> Sunway inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I56OSP -------------------------------- When porting ZX200 chipset driver on SW64 platform, we meet an IOMMU exception show as follows: iommu_interrupt, iommu_status = 0xc8014000dffe0000, devid 0xa00, dva 0xdffe0000, 1Unable to handle kernel paging request at virtual address 0000000000000040 CPU 0 swapper/0(0): Oops 0 pc = [<ffffffff81424b80>] ra = [<ffffffff81424b24>] ps = 0001 Not tainted pc is at iommu_interrupt+0x140/0x3e0 ra is at iommu_interrupt+0xe4/0x3e0 v0 = 0000000000000051 t0 = c8014000dffe0000 t1 = 0000000000000000 t2 = 0000000000000000 t3 = 0000000000000000 t4 = 0000000000000001 t5 = 0000000000000001 t6 = 0000000000000000 t7 = ffffffff82948000 s0 = fff00003ffff0400 s1 = 0000000000000001 s2 = 0000000000000a00 s3 = 0000000000000a00 s4 = 00000000dffe0000 s5 = fff0000100680e80 s6 = ffffffff8294ba70 a0 = 0000000000000001 a1 = 0000000000000001 a2 = ffffffff8294b790 a3 = ffffffff8294b7a8 a4 = 0000000000000000 a5 = ffffffff82c5fb7a t8 = 0000000000000001 t9 = fffffffffffcac48 t10 = 0000000000000000 t11= 0000000000000000 pv = ffffffff809f4f10 at = ffffffff82bff6c0 gp = ffffffff82c1f510 sp = (____ptrval____) The root cause is that the device which raises iommu exception is not in the device list, then reference a null sdev will cause a page fualt. To work around this problem, we apply this patch by just clearing IOMMUEXCPT_STATUS and then go on. BTW, why the device raise IOMMU exception is not a valid device ID, it's a puzzling problem. Signed-off-by: Zheng Chongzhen <zhengchongzhen(a)wxiat.com> Signed-off-by: Gu Zitao <guzitao(a)wxiat.com> --- drivers/iommu/sw64/sunway_iommu.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/sw64/sunway_iommu.c b/drivers/iommu/sw64/sunway_iommu.c index 5797adf8fbc5..b6c8f1272d28 100644 --- a/drivers/iommu/sw64/sunway_iommu.c +++ b/drivers/iommu/sw64/sunway_iommu.c @@ -648,10 +648,21 @@ irqreturn_t iommu_interrupt(int irq, void *dev) type = (iommu_status >> 59) & 0x7; devid = (iommu_status >> 37) & 0xffff; dva = iommu_status & 0xffffffff; - sdev = search_dev_data(devid); - sdomain = sdev->domain; pr_info("%s, iommu_status = %#lx, devid %#lx, dva %#lx, ", __func__, iommu_status, devid, dva); + + sdev = search_dev_data(devid); + if (sdev == NULL) { + pr_info("no such dev!!!\n"); + + iommu_status &= ~(1UL << 62); + write_piu_ior0(hose->node, hose->index, + IOMMUEXCPT_STATUS, iommu_status); + + return IRQ_HANDLED; + } + + sdomain = sdev->domain; switch (type) { case DTE_LEVEL1: pr_info("invalid level1 dte, addr:%#lx, val:%#lx\n", @@ -674,7 +685,6 @@ irqreturn_t iommu_interrupt(int irq, void *dev) fetch_pte(sdomain, dva, PTE_LEVEL2_VAL)); iommu_status &= ~(1UL << 62); - iommu_status = iommu_status | (1UL << 63); write_piu_ior0(hose->node, hose->index, IOMMUEXCPT_STATUS, iommu_status); break; -- 2.17.1

1 20

[PATCH v1 OLK-5.10 00/71] sw64 update
by Gu Zitao 12 Jul '22

12 Jul '22

Gu Zitao (2): sw64: add ARCH_TRACEHOOK and regset support sw64: rename CONFIG_HAVE_GENERIC_GUP to CONFIG_HAVE_FAST_GUP Hang Xiaoqian (2): sw64: change the value of physical_id in /proc/cpuinfo sw64: remove unaligned count He Chuyue (6): sw64: simplify __phys_addr and __virt_addr_valid sw64: check integrity for dtb passed by BIOS sw64: fix some structs related to pt_regs sw64: perf: add exclude_user and exclude_kernel support sw64: perf: fix the number of supported raw events sw64: perf: fix raw event count He Sheng (36): sw64: remove unused header files sw64: uapi: generate some uapi headers from generic ones sw64: uapi: include generic param.h sw64: kapi: remove unused header-y from Kbuild sw64: kapi: generate some kapi headers from generic ones sw64: move ucontext.h to uapi sw64: kapi: remove redudant SMP_CACHE_BYTES sw64: kapi: remove unimplemented IPLs sw64: kapi: include generic modules.h sw64: remove VGA_HOSE things sw64: clean up unused pci iounmap operation sw64: kapi: use generic vga.h sw64: remove unused IO_CONCAT sw64: do not include sw64io.h in io.h sw64: read host IO registers with rdio64 hmcall sw64: map logical address with __va() sw64: access IO space with readX/writeX sw64: add fpu state save/restore interfaces sw64: switch to generic fork like system calls sw64: remove r9_r15 argument of dik_show_regs and die_if_kernel sw64: remove switch_stack from entMM and entSys sw64: remove switch_stack from signal handling sw64: dump callee-saved registers from pt_regs sw64: get blocked thread's frame pointer from thread_struct sw64: remove switch_stack and allregs from entUna sw64: remove switch_stack from __sw64_vcpu_run sw64: remove other struct switch_stack things sw64: access pt_regs with regoffsets where appropriate sw64: move struct pt_regs to kapi ptrace.h sw64: avoid copying thread_struct twice sw64: simplify pgtable helpers sw64: remove discontiguous memory support sw64: merge user_fpsimd_state into thread_struct sw64: fix ptrace.h with types.h and NOT __ASSEMBLY__ sw64: rewrite elf core copy interfaces sw64: rename debugfs dir sw_64 to sw64 Lu Feifei (2): sw64: add memhotplug support for guest os sw64: add a misc device to chip_vt.dts for memory-hotplug Mao Minkai (2): sw64: fix __csum_and_copy when dest is not 8-byte aligned sw64: fix simd version of memset Min Fanlei (1): sw64: kvm: fix incorrect page_ref_count() call Wang Yuanheng (1): sw64: kvm: enable binding_vcpu debug dynamically Wu Liliu (4): sw64: perf: add fp based stack trace support sw64: reimplement show_stack() method sw64: reimplement get_wchan() sw64: reimplement save_stack_trace() Xiong Aifei (2): sw64: gpu: correct low-level mmio memset/memcpy direct calls sw64: gpu: replace '_memset_c_io' by 'memset_io' Xu Chenjiao (2): sw64: fix compile errors for NOT chip3 sw64: pcie: fix lack of PME and AER interrupt service routines Yang Qiang (2): sw64: dtb: check address validity with physical address sw64: pci: fix maximum bus number for pci scan Zhao Yihan (1): sw64: map address by OR operation in __va() Zheng Chongzhen (2): sw64: fix dma features for zx200 sw64: iommu: fix iommu interrupt handler Zhou Qihang (1): sw64: iommu: work around iova mapping on pci bars Zhou Xuemei (1): sw64: fix floating point register corruption Zhu Donghong (4): irqchip: add sw64 chip3 builtin LPC interrupt controller driver sw64: add builtin LPC interrupt controller to chip3.dts drivers/irqchip: add sw64 interrupt controller support sw64: deliver a hot reset to Root Complex with plugin JMicron 585 card arch/sw_64/Kconfig | 28 +- arch/sw_64/boot/dts/chip3.dts | 16 +- arch/sw_64/boot/dts/chip_vt.dts | 12 + arch/sw_64/chip/chip3/Makefile | 1 - arch/sw_64/chip/chip3/chip.c | 66 ++- arch/sw_64/chip/chip3/i2c-lib.c | 41 +- arch/sw_64/include/asm/Kbuild | 26 +- arch/sw_64/include/asm/agp.h | 19 - arch/sw_64/include/asm/asm-prototypes.h | 1 - arch/sw_64/include/asm/cache.h | 4 +- arch/sw_64/include/asm/compiler.h | 7 - arch/sw_64/include/asm/console.h | 11 - arch/sw_64/include/asm/div64.h | 7 - arch/sw_64/include/asm/elf.h | 40 +- arch/sw_64/include/asm/emergency-restart.h | 7 - arch/sw_64/include/asm/exec.h | 7 - arch/sw_64/include/asm/extable.h | 4 + arch/sw_64/include/asm/floppy.h | 116 ----- arch/sw_64/include/asm/hcall.h | 1 + arch/sw_64/include/asm/io.h | 33 -- arch/sw_64/include/asm/irq_impl.h | 3 + arch/sw_64/include/asm/irq_regs.h | 7 - arch/sw_64/include/asm/irqflags.h | 8 - arch/sw_64/include/asm/kmap_types.h | 15 - arch/sw_64/include/asm/kvm_asm.h | 3 + arch/sw_64/include/asm/kvm_host.h | 11 +- arch/sw_64/include/asm/local.h | 125 ----- arch/sw_64/include/asm/local64.h | 7 - arch/sw_64/include/asm/memory.h | 1 + arch/sw_64/include/asm/mmu_context.h | 8 +- arch/sw_64/include/asm/mmzone.h | 30 -- arch/sw_64/include/asm/module.h | 10 +- arch/sw_64/include/asm/page.h | 5 +- arch/sw_64/include/asm/param.h | 11 - arch/sw_64/include/asm/parport.h | 19 - arch/sw_64/include/asm/pci.h | 4 +- arch/sw_64/include/asm/pgalloc.h | 2 +- arch/sw_64/include/asm/pgtable.h | 98 ++-- arch/sw_64/include/asm/preempt.h | 7 - arch/sw_64/include/asm/processor.h | 49 +- arch/sw_64/include/asm/ptrace.h | 54 +- arch/sw_64/include/asm/seccomp.h | 15 - arch/sw_64/include/asm/sections.h | 8 - arch/sw_64/include/asm/segment.h | 7 - arch/sw_64/include/asm/serial.h | 16 - arch/sw_64/include/asm/shmparam.h | 7 - arch/sw_64/include/asm/special_insns.h | 20 - arch/sw_64/include/asm/stacktrace.h | 72 +++ arch/sw_64/include/asm/sw64_init.h | 1 + arch/sw_64/include/asm/sw64io.h | 89 ++-- arch/sw_64/include/asm/switch_to.h | 37 +- arch/sw_64/include/asm/thread_info.h | 5 + arch/sw_64/include/asm/trace_clock.h | 10 - arch/sw_64/include/asm/types.h | 7 - arch/sw_64/include/asm/unaligned.h | 12 - arch/sw_64/include/asm/vga.h | 85 ---- arch/sw_64/include/asm/wrperfmon.h | 8 +- arch/sw_64/include/uapi/asm/Kbuild | 1 + arch/sw_64/include/uapi/asm/console.h | 51 -- arch/sw_64/include/uapi/asm/ipcbuf.h | 7 - arch/sw_64/include/uapi/asm/kvm_para.h | 7 - arch/sw_64/include/uapi/asm/msgbuf.h | 28 -- arch/sw_64/include/uapi/asm/param.h | 9 +- arch/sw_64/include/uapi/asm/perf_regs.h | 7 + arch/sw_64/include/uapi/asm/poll.h | 7 - arch/sw_64/include/uapi/asm/posix_types.h | 18 - arch/sw_64/include/uapi/asm/ptrace.h | 76 +-- arch/sw_64/include/uapi/asm/sembuf.h | 23 - arch/sw_64/include/uapi/asm/shmbuf.h | 39 -- arch/sw_64/include/uapi/asm/statfs.h | 9 - arch/sw_64/include/uapi/asm/types.h | 28 -- arch/sw_64/include/{ => uapi}/asm/ucontext.h | 8 +- arch/sw_64/kernel/Makefile | 7 +- arch/sw_64/kernel/asm-offsets.c | 136 ++--- arch/sw_64/kernel/bindvcpu.c | 29 ++ arch/sw_64/kernel/core.c | 35 -- arch/sw_64/kernel/dup_print.c | 10 +- arch/sw_64/kernel/entry.S | 467 +++++------------- arch/sw_64/kernel/fpu.S | 102 ++++ arch/sw_64/kernel/kgdb.c | 14 +- arch/sw_64/kernel/pci.c | 55 ++- arch/sw_64/kernel/pci_impl.h | 2 + arch/sw_64/kernel/perf_event.c | 100 +++- arch/sw_64/kernel/process.c | 156 ++---- arch/sw_64/kernel/proto.h | 5 +- arch/sw_64/kernel/ptrace.c | 245 ++++----- arch/sw_64/kernel/setup.c | 19 +- arch/sw_64/kernel/signal.c | 51 +- arch/sw_64/kernel/stacktrace.c | 212 +++++++- arch/sw_64/kernel/syscalls/syscall.tbl | 6 +- arch/sw_64/kernel/traps.c | 182 ++----- arch/sw_64/kernel/unaligned.c | 56 --- arch/sw_64/kvm/Kconfig | 7 + arch/sw_64/kvm/entry.S | 97 ++-- arch/sw_64/kvm/handle_exit.c | 5 + arch/sw_64/kvm/kvm-sw64.c | 137 ++++- arch/sw_64/lib/csum_partial_copy.c | 15 +- arch/sw_64/lib/deep-memset.S | 5 +- arch/sw_64/lib/iomap.c | 40 +- arch/sw_64/mm/fault.c | 20 +- arch/sw_64/mm/init.c | 25 +- arch/sw_64/mm/physaddr.c | 30 +- arch/sw_64/platform/platform_xuelang.c | 18 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 12 + drivers/gpu/drm/radeon/radeon_vce.c | 2 +- drivers/gpu/drm/radeon/vce_v1_0.c | 5 + drivers/iommu/sw64/sunway_iommu.c | 21 +- drivers/irqchip/Kconfig | 26 +- drivers/irqchip/Makefile | 3 +- drivers/irqchip/irq-intc-v1.c | 104 ---- .../irqchip/irq-sw64-intc-v2.c | 64 ++- drivers/irqchip/irq-sw64-lpc-intc.c | 137 +++++ drivers/mfd/lpc_sunway_chip3.c | 130 ----- drivers/misc/Kconfig | 8 + drivers/misc/Makefile | 1 + drivers/misc/sunway-ged.c | 253 ++++++++++ 116 files changed, 2009 insertions(+), 2686 deletions(-) delete mode 100644 arch/sw_64/include/asm/agp.h delete mode 100644 arch/sw_64/include/asm/compiler.h delete mode 100644 arch/sw_64/include/asm/console.h delete mode 100644 arch/sw_64/include/asm/div64.h delete mode 100644 arch/sw_64/include/asm/emergency-restart.h delete mode 100644 arch/sw_64/include/asm/exec.h delete mode 100644 arch/sw_64/include/asm/floppy.h delete mode 100644 arch/sw_64/include/asm/irq_regs.h delete mode 100644 arch/sw_64/include/asm/kmap_types.h delete mode 100644 arch/sw_64/include/asm/local.h delete mode 100644 arch/sw_64/include/asm/local64.h delete mode 100644 arch/sw_64/include/asm/param.h delete mode 100644 arch/sw_64/include/asm/parport.h delete mode 100644 arch/sw_64/include/asm/preempt.h delete mode 100644 arch/sw_64/include/asm/seccomp.h delete mode 100644 arch/sw_64/include/asm/sections.h delete mode 100644 arch/sw_64/include/asm/segment.h delete mode 100644 arch/sw_64/include/asm/serial.h delete mode 100644 arch/sw_64/include/asm/shmparam.h delete mode 100644 arch/sw_64/include/asm/special_insns.h create mode 100644 arch/sw_64/include/asm/stacktrace.h delete mode 100644 arch/sw_64/include/asm/trace_clock.h delete mode 100644 arch/sw_64/include/asm/types.h delete mode 100644 arch/sw_64/include/asm/unaligned.h delete mode 100644 arch/sw_64/include/asm/vga.h delete mode 100644 arch/sw_64/include/uapi/asm/console.h delete mode 100644 arch/sw_64/include/uapi/asm/ipcbuf.h delete mode 100644 arch/sw_64/include/uapi/asm/kvm_para.h delete mode 100644 arch/sw_64/include/uapi/asm/msgbuf.h delete mode 100644 arch/sw_64/include/uapi/asm/poll.h delete mode 100644 arch/sw_64/include/uapi/asm/posix_types.h delete mode 100644 arch/sw_64/include/uapi/asm/sembuf.h delete mode 100644 arch/sw_64/include/uapi/asm/shmbuf.h delete mode 100644 arch/sw_64/include/uapi/asm/statfs.h delete mode 100644 arch/sw_64/include/uapi/asm/types.h rename arch/sw_64/include/{ => uapi}/asm/ucontext.h (56%) create mode 100644 arch/sw_64/kernel/bindvcpu.c delete mode 100644 arch/sw_64/kernel/core.c create mode 100644 arch/sw_64/kernel/fpu.S delete mode 100644 arch/sw_64/kernel/unaligned.c delete mode 100644 drivers/irqchip/irq-intc-v1.c rename arch/sw_64/chip/chip3/irq_chip.c => drivers/irqchip/irq-sw64-intc-v2.c (59%) create mode 100644 drivers/irqchip/irq-sw64-lpc-intc.c create mode 100644 drivers/misc/sunway-ged.c -- 2.17.1

1 50

[PATCH openEuler-5.10-LTS 1/7] arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones
by Zheng Zengkai 11 Jul '22

11 Jul '22

From: Vijay Balakrishna <vijayb(a)linux.microsoft.com> stable inclusion from stable-v5.10.110 commit a25864c5bc20966cdc5ba5eb65b74b9b1e9ec8d2 bugzilla: https://gitee.com/openeuler/kernel/issues/I574AL Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 031495635b4668f94e964e037ca93d0d38bfde58 upstream. The following patches resulted in deferring crash kernel reservation to mem_init(), mainly aimed at platforms with DMA memory zones (no IOMMU), in particular Raspberry Pi 4. commit 1a8e1cef7603 ("arm64: use both ZONE_DMA and ZONE_DMA32") commit 8424ecdde7df ("arm64: mm: Set ZONE_DMA size based on devicetree's dma-ranges") commit 0a30c53573b0 ("arm64: mm: Move reserve_crashkernel() into mem_init()") commit 2687275a5843 ("arm64: Force NO_BLOCK_MAPPINGS if crashkernel reservation is required") Above changes introduced boot slowdown due to linear map creation for all the memory banks with NO_BLOCK_MAPPINGS, see discussion[1]. The proposed changes restore crash kernel reservation to earlier behavior thus avoids slow boot, particularly for platforms with IOMMU (no DMA memory zones). Tested changes to confirm no ~150ms boot slowdown on our SoC with IOMMU and 8GB memory. Also tested with ZONE_DMA and/or ZONE_DMA32 configs to confirm no regression to deferring scheme of crash kernel memory reservation. In both cases successfully collected kernel crash dump. [1] https://lore.kernel.org/all/9436d033-579b-55fa-9b00-6f4b661c2dd7@linux.micr… Signed-off-by: Vijay Balakrishna <vijayb(a)linux.microsoft.com> Cc: stable(a)vger.kernel.org Reviewed-by: Pasha Tatashin <pasha.tatashin(a)soleen.com> Link: https://lore.kernel.org/r/1646242689-20744-1-git-send-email-vijayb@linux.mi… [will: Add #ifdef CONFIG_KEXEC_CORE guards to fix 'crashk_res' references in allnoconfig build] Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> Conflicts: arch/arm64/mm/mmu.c Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/arm64/mm/init.c | 36 ++++++++++++++++++++++++++++++++---- arch/arm64/mm/mmu.c | 26 ++++++++++++++++---------- 2 files changed, 48 insertions(+), 14 deletions(-) diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c index f5bd046f9e19..5023c7e1f754 100644 --- a/arch/arm64/mm/init.c +++ b/arch/arm64/mm/init.c @@ -63,8 +63,34 @@ EXPORT_SYMBOL(memstart_addr); * unless restricted on specific platforms (e.g. 30-bit on Raspberry Pi 4). * In such case, ZONE_DMA32 covers the rest of the 32-bit addressable memory, * otherwise it is empty. + * + * Memory reservation for crash kernel either done early or deferred + * depending on DMA memory zones configs (ZONE_DMA) -- + * + * In absence of ZONE_DMA configs arm64_dma_phys_limit initialized + * here instead of max_zone_phys(). This lets early reservation of + * crash kernel memory which has a dependency on arm64_dma_phys_limit. + * Reserving memory early for crash kernel allows linear creation of block + * mappings (greater than page-granularity) for all the memory bank rangs. + * In this scheme a comparatively quicker boot is observed. + * + * If ZONE_DMA configs are defined, crash kernel memory reservation + * is delayed until DMA zone memory range size initilazation performed in + * zone_sizes_init(). The defer is necessary to steer clear of DMA zone + * memory range to avoid overlap allocation. So crash kernel memory boundaries + * are not known when mapping all bank memory ranges, which otherwise means + * not possible to exclude crash kernel range from creating block mappings + * so page-granularity mappings are created for the entire memory range. + * Hence a slightly slower boot is observed. + * + * Note: Page-granularity mapppings are necessary for crash kernel memory + * range for shrinking its size via /sys/kernel/kexec_crash_size interface. */ -phys_addr_t arm64_dma_phys_limit __ro_after_init; +#if IS_ENABLED(CONFIG_ZONE_DMA) || IS_ENABLED(CONFIG_ZONE_DMA32) +phys_addr_t __ro_after_init arm64_dma_phys_limit; +#else +phys_addr_t __ro_after_init arm64_dma_phys_limit = PHYS_MASK + 1; +#endif #ifndef CONFIG_KEXEC_CORE static void __init reserve_crashkernel(void) @@ -173,8 +199,6 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max) if (!arm64_dma_phys_limit) arm64_dma_phys_limit = dma32_phys_limit; #endif - if (!arm64_dma_phys_limit) - arm64_dma_phys_limit = PHYS_MASK + 1; max_zone_pfns[ZONE_NORMAL] = max; free_area_init(max_zone_pfns); @@ -498,6 +522,9 @@ void __init arm64_memblock_init(void) reserve_elfcorehdr(); + if (!IS_ENABLED(CONFIG_ZONE_DMA) && !IS_ENABLED(CONFIG_ZONE_DMA32)) + reserve_crashkernel(); + high_memory = __va(memblock_end_of_DRAM() - 1) + 1; } @@ -553,7 +580,8 @@ void __init bootmem_init(void) * request_standard_resources() depends on crashkernel's memory being * reserved, so do it here. */ - reserve_crashkernel(); + if (IS_ENABLED(CONFIG_ZONE_DMA) || IS_ENABLED(CONFIG_ZONE_DMA32)) + reserve_crashkernel(); reserve_quick_kexec(); diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index 00e89be15ad2..e76765354040 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -562,16 +562,6 @@ static void __init map_mem(pgd_t *pgdp) PAGE_KERNEL, NO_CONT_MAPPINGS); memblock_clear_nomap(kernel_start, kernel_end - kernel_start); -#ifdef CONFIG_KEXEC_CORE - if (crashk_res.end) { - __map_memblock(pgdp, crashk_res.start, - crashk_res.end + 1, - PAGE_KERNEL, - NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS); - memblock_clear_nomap(crashk_res.start, - resource_size(&crashk_res)); - } -#endif #ifdef CONFIG_KFENCE /* * Map the __kfence_pool at page granularity now. @@ -584,6 +574,22 @@ static void __init map_mem(pgd_t *pgdp) memblock_clear_nomap(__pa(__kfence_pool), KFENCE_POOL_SIZE); } #endif + + /* + * Use page-level mappings here so that we can shrink the region + * in page granularity and put back unused memory to buddy system + * through /sys/kernel/kexec_crash_size interface. + */ +#ifdef CONFIG_KEXEC_CORE + if (crashk_res.end) { + __map_memblock(pgdp, crashk_res.start, + crashk_res.end + 1, + PAGE_KERNEL, + NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS); + memblock_clear_nomap(crashk_res.start, + resource_size(&crashk_res)); + } +#endif } void mark_rodata_ro(void) -- 2.20.1

1 6

[PATCH 01/34] ARM: 9196/1: spectre-bhb: enable for Cortex-A15
by Laibin Qiu 08 Jul '22

08 Jul '22

From: Ard Biesheuvel <ardb(a)kernel.org> stable inclusion from stable-4.19.245 commit 0569702c238290924fc1c7c6954258aa4a5fd649 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5FNPY CVE: NA -------------------------------- [ Upstream commit 0dc14aa94ccd8ba35eb17a0f9b123d1566efd39e ] The Spectre-BHB mitigations were inadvertently left disabled for Cortex-A15, due to the fact that cpu_v7_bugs_init() is not called in that case. So fix that. Fixes: b9baf5c8c5c3 ("ARM: Spectre-BHB workaround") Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- arch/arm/mm/proc-v7-bugs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c index 87a93b76e148..8c7d00cb63ef 100644 --- a/arch/arm/mm/proc-v7-bugs.c +++ b/arch/arm/mm/proc-v7-bugs.c @@ -299,6 +299,7 @@ void cpu_v7_ca15_ibe(void) { if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0))) cpu_v7_spectre_v2_init(); + cpu_v7_spectre_bhb_init(); } void cpu_v7_bugs_init(void) -- 2.25.1

1 33

[PATCH openEuler-1.0-LTS 1/4] block: rename bd_invalidated
by Laibin Qiu 08 Jul '22

08 Jul '22

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v5.10-rc1 commit f4ad06f2bb8476548b08f89919ee65abc4e40212 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5ETAB CVE: NA ------------------------------------------------- Replace bd_invalidate with a new BDEV_NEED_PART_SCAN flag in a bd_flags variable to better describe the condition. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: fs/block_dev.c include/linux/blk_types.h Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- block/genhd.c | 2 +- block/partition-generic.c | 6 +++--- drivers/block/nbd.c | 8 ++++---- fs/block_dev.c | 12 ++++++------ include/linux/fs.h | 4 +++- 5 files changed, 17 insertions(+), 15 deletions(-) diff --git a/block/genhd.c b/block/genhd.c index fc24384e2c85..afa3cf525f43 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -646,7 +646,7 @@ static void register_disk(struct device *parent, struct gendisk *disk) if (!bdev) goto exit; - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); err = blkdev_get(bdev, FMODE_READ, NULL); if (err < 0) goto exit; diff --git a/block/partition-generic.c b/block/partition-generic.c index 2261566741f4..ae3761fed854 100644 --- a/block/partition-generic.c +++ b/block/partition-generic.c @@ -546,7 +546,7 @@ int rescan_partitions(struct gendisk *disk, struct block_device *bdev) if (disk->fops->revalidate_disk) disk->fops->revalidate_disk(disk); check_disk_size_change(disk, bdev, true); - bdev->bd_invalidated = 0; + clear_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); if (!get_capacity(disk) || !(state = check_partition(disk, bdev))) return 0; if (IS_ERR(state)) { @@ -662,7 +662,7 @@ int invalidate_partitions(struct gendisk *disk, struct block_device *bdev) { int res; - if (!bdev->bd_invalidated) + if (!test_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags)) return 0; res = drop_partitions(disk, bdev); @@ -671,7 +671,7 @@ int invalidate_partitions(struct gendisk *disk, struct block_device *bdev) set_capacity(disk, 0); check_disk_size_change(disk, bdev, false); - bdev->bd_invalidated = 0; + clear_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); /* tell userspace that the media / partition table may have changed */ kobject_uevent(&disk_to_dev(disk)->kobj, KOBJ_CHANGE); diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index c2e5ba599418..f1986d8bb47c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -317,7 +317,7 @@ static void nbd_size_update(struct nbd_device *nbd, bool start) if (start) set_blocksize(bdev, config->blksize); } else - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); bdput(bdev); } kobject_uevent(&nbd_to_dev(nbd)->kobj, KOBJ_CHANGE); @@ -1343,7 +1343,7 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b return ret; if (max_part) - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); mutex_unlock(&nbd->config_lock); ret = wait_event_interruptible(config->recv_wq, atomic_read(&config->recv_threads) == 0); @@ -1518,9 +1518,9 @@ static int nbd_open(struct block_device *bdev, fmode_t mode) refcount_set(&nbd->config_refs, 1); refcount_inc(&nbd->refs); mutex_unlock(&nbd->config_lock); - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); } else if (nbd_disconnected(nbd->config)) { - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); } out: mutex_unlock(&nbd_index_mutex); diff --git a/fs/block_dev.c b/fs/block_dev.c index 9868b21b8ef9..f521b7cf907f 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -922,7 +922,7 @@ struct block_device *bdget(dev_t dev) bdev->bd_inode = inode; bdev->bd_block_size = i_blocksize(inode); bdev->bd_part_count = 0; - bdev->bd_invalidated = 0; + bdev->bd_flags = 0; inode->i_mode = S_IFBLK; inode->i_rdev = dev; inode->i_bdev = bdev; @@ -1404,7 +1404,7 @@ static void flush_disk(struct block_device *bdev, bool kill_dirty) "resized disk %s\n", bdev->bd_disk ? bdev->bd_disk->disk_name : ""); } - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); } /** @@ -1457,7 +1457,7 @@ int revalidate_disk(struct gendisk *disk) mutex_lock(&bdev->bd_mutex); check_disk_size_change(disk, bdev, ret == 0); - bdev->bd_invalidated = 0; + clear_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); mutex_unlock(&bdev->bd_mutex); bdput(bdev); return ret; @@ -1520,7 +1520,7 @@ static void bdev_disk_changed(struct block_device *bdev, bool invalidate) up_read(&disk->lookup_sem); } else { check_disk_size_change(bdev->bd_disk, bdev, !invalidate); - bdev->bd_invalidated = 0; + clear_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); } } @@ -1605,7 +1605,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) * The latter is necessary to prevent ghost * partitions on a removed medium. */ - if (bdev->bd_invalidated && + if (test_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags) && (!ret || ret == -ENOMEDIUM)) bdev_disk_changed(bdev, ret == -ENOMEDIUM); @@ -1642,7 +1642,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) if (bdev->bd_disk->fops->open) ret = bdev->bd_disk->fops->open(bdev, mode); /* the same as first opener case, read comment there */ - if (bdev->bd_invalidated && + if (test_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags) && (!ret || ret == -ENOMEDIUM)) bdev_disk_changed(bdev, ret == -ENOMEDIUM); if (ret) diff --git a/include/linux/fs.h b/include/linux/fs.h index bcd2131ca06c..480936c2d938 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -459,6 +459,8 @@ struct address_space { */ struct request_queue; +#define BDEV_NEED_PART_SCAN 0 + struct block_device { dev_t bd_dev; /* not a kdev_t - it's a search key */ int bd_openers; @@ -479,7 +481,7 @@ struct block_device { struct hd_struct * bd_part; /* number of times partitions within this device have been opened. */ unsigned bd_part_count; - int bd_invalidated; + unsigned long bd_flags; struct gendisk * bd_disk; struct request_queue * bd_queue; struct backing_dev_info *bd_bdi; -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 1/3] scsi: hisi_sas: Change DMA setup lock timeout to 2.5s
by Laibin Qiu 07 Jul '22

07 Jul '22

From: Xingui Yang <yangxingui(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5BXH1 CVE: NA ------------------------------------------------------------------- DMA setup lock timeout protection is added when DMA setup frames are received, it's a function outside the protocol and used to prevent SATA disk I/Os from being delivered for a long time. The default value is 100ms , it's too strict and easily triggered timeout when the disk is overloaded or faulty. Based on the average I/O latency of 300 disks, we adjust the value to 2.5s. Signed-off-by: Xingui Yang <yangxingui(a)huawei.com> Reviewed-by: kang fenglong <kangfenglong(a)huawei.com> Acked-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index baae04adc8e4..91f02357d5b4 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -35,6 +35,7 @@ #define SATA_INITI_D2H_STORE_ADDR_HI 0x64 #define CFG_MAX_TAG 0x68 #define SAS_DMAC_OUTSTAND 0x6c +#define TRANS_LOCK_ICT_TIME 0X70 #define HGC_SAS_TX_OPEN_FAIL_RETRY_CTRL 0x84 #define HGC_SAS_TXFAIL_RETRY_CTRL 0x88 #define HGC_GET_ITV_TIME 0x90 @@ -596,6 +597,8 @@ static void init_reg_v3_hw(struct hisi_hba *hisi_hba) (u32)((1ULL << hisi_hba->queue_count) - 1)); hisi_sas_write32(hisi_hba, SAS_AXI_USER3, 0); hisi_sas_write32(hisi_hba, CFG_MAX_TAG, 0xfff0400); + /* time / CLK_AHB = 2.5s / 2ns = 0x4A817C80 */ + hisi_sas_write32(hisi_hba, TRANS_LOCK_ICT_TIME, 0x4A817C80); hisi_sas_write32(hisi_hba, HGC_SAS_TXFAIL_RETRY_CTRL, 0x108); hisi_sas_write32(hisi_hba, CFG_AGING_TIME, 0x1); hisi_sas_write32(hisi_hba, INT_COAL_EN, 0x1); @@ -3061,6 +3064,7 @@ static const struct hisi_sas_debugfs_reg_lu debugfs_global_reg_lu[] = { HISI_SAS_DEBUGFS_REG(SATA_INITI_D2H_STORE_ADDR_LO), HISI_SAS_DEBUGFS_REG(SATA_INITI_D2H_STORE_ADDR_HI), HISI_SAS_DEBUGFS_REG(CFG_MAX_TAG), + HISI_SAS_DEBUGFS_REG(TRANS_LOCK_ICT_TIME), HISI_SAS_DEBUGFS_REG(HGC_SAS_TX_OPEN_FAIL_RETRY_CTRL), HISI_SAS_DEBUGFS_REG(HGC_SAS_TXFAIL_RETRY_CTRL), HISI_SAS_DEBUGFS_REG(HGC_GET_ITV_TIME), -- 2.25.1

1 2

[PATCH openEuler-5.10 01/40] mm,hwpoison: drain pcplists before bailing out for non-buddy zero-refcount page
by Zheng Zengkai 06 Jul '22

06 Jul '22

From: Oscar Salvador <osalvador(a)suse.de> mainline inclusion from mainline-v5.11-rc1 commit 17e395b60f5b3dea204fcae60c7b38e84a00d87a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5E2IG CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Patch series "HWpoison: further fixes and cleanups", v5. This patchset includes some more fixes and a cleanup. Patch#2 and patch#3 are both fixes for taking a HWpoison page off a buddy freelist, since having them there has proved to be bad (see [1] and pathch#2's commit log). Patch#3 does the same for hugetlb pages. [1] https://lkml.org/lkml/2020/9/22/565 This patch (of 4): A page with 0-refcount and !PageBuddy could perfectly be a pcppage. Currently, we bail out with an error if we encounter such a page, meaning that we do not handle pcppages neither from hard-offline nor from soft-offline path. Fix this by draining pcplists whenever we find this kind of page and retry the check again. It might be that pcplists have been spilled into the buddy allocator and so we can handle it. Link: https://lkml.kernel.org/r/20201013144447.6706-1-osalvador@suse.de Link: https://lkml.kernel.org/r/20201013144447.6706-2-osalvador@suse.de Signed-off-by: Oscar Salvador <osalvador(a)suse.de> Acked-by: Naoya Horiguchi <naoya.horiguchi(a)nec.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- mm/memory-failure.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 63bacfcca122..de36b4aa4b6f 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -947,13 +947,13 @@ static int page_action(struct page_state *ps, struct page *p, } /** - * get_hwpoison_page() - Get refcount for memory error handling: + * __get_hwpoison_page() - Get refcount for memory error handling: * @page: raw error page (hit by memory error) * * Return: return 0 if failed to grab the refcount, otherwise true (some * non-zero value.) */ -static int get_hwpoison_page(struct page *page) +static int __get_hwpoison_page(struct page *page) { struct page *head = compound_head(page); @@ -983,6 +983,26 @@ static int get_hwpoison_page(struct page *page) return 0; } +static int get_hwpoison_page(struct page *p) +{ + int ret; + bool drained = false; + +retry: + ret = __get_hwpoison_page(p); + if (!ret && !is_free_buddy_page(p) && !page_count(p) && !drained) { + /* + * The page might be in a pcplist, so try to drain those + * and see if we are lucky. + */ + drain_all_pages(page_zone(p)); + drained = true; + goto retry; + } + + return ret; +} + /* * Do all that is necessary to remove user space mappings. Unmap * the pages and send SIGBUS to the processes if the data was dirty. -- 2.20.1

1 38

[PATCH openEuler-5.10 01/30] Documentation: Add documentation for Processor MMIO Stale Data
by Zheng Zengkai 06 Jul '22

06 Jul '22

From: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> stable inclusion from stable-v5.10.123 commit f8a85334a57e7842320476ff27be3a5f151da364 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5D5RS CVE: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4419470191386456e0b8ed4eb06a70b0021798a6 upstream Add the admin guide for Processor MMIO stale data vulnerabilities. Signed-off-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Signed-off-by: Borislav Petkov <bp(a)suse.de> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- Documentation/admin-guide/hw-vuln/index.rst | 1 + .../hw-vuln/processor_mmio_stale_data.rst | 246 ++++++++++++++++++ 2 files changed, 247 insertions(+) create mode 100644 Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst index ca4dbdd9016d..2adec1e6520a 100644 --- a/Documentation/admin-guide/hw-vuln/index.rst +++ b/Documentation/admin-guide/hw-vuln/index.rst @@ -15,3 +15,4 @@ are configurable at compile, boot or run time. tsx_async_abort multihit.rst special-register-buffer-data-sampling.rst + processor_mmio_stale_data.rst diff --git a/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst new file mode 100644 index 000000000000..9393c50b5afc --- /dev/null +++ b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst @@ -0,0 +1,246 @@ +========================================= +Processor MMIO Stale Data Vulnerabilities +========================================= + +Processor MMIO Stale Data Vulnerabilities are a class of memory-mapped I/O +(MMIO) vulnerabilities that can expose data. The sequences of operations for +exposing data range from simple to very complex. Because most of the +vulnerabilities require the attacker to have access to MMIO, many environments +are not affected. System environments using virtualization where MMIO access is +provided to untrusted guests may need mitigation. These vulnerabilities are +not transient execution attacks. However, these vulnerabilities may propagate +stale data into core fill buffers where the data can subsequently be inferred +by an unmitigated transient execution attack. Mitigation for these +vulnerabilities includes a combination of microcode update and software +changes, depending on the platform and usage model. Some of these mitigations +are similar to those used to mitigate Microarchitectural Data Sampling (MDS) or +those used to mitigate Special Register Buffer Data Sampling (SRBDS). + +Data Propagators +================ +Propagators are operations that result in stale data being copied or moved from +one microarchitectural buffer or register to another. Processor MMIO Stale Data +Vulnerabilities are operations that may result in stale data being directly +read into an architectural, software-visible state or sampled from a buffer or +register. + +Fill Buffer Stale Data Propagator (FBSDP) +----------------------------------------- +Stale data may propagate from fill buffers (FB) into the non-coherent portion +of the uncore on some non-coherent writes. Fill buffer propagation by itself +does not make stale data architecturally visible. Stale data must be propagated +to a location where it is subject to reading or sampling. + +Sideband Stale Data Propagator (SSDP) +------------------------------------- +The sideband stale data propagator (SSDP) is limited to the client (including +Intel Xeon server E3) uncore implementation. The sideband response buffer is +shared by all client cores. For non-coherent reads that go to sideband +destinations, the uncore logic returns 64 bytes of data to the core, including +both requested data and unrequested stale data, from a transaction buffer and +the sideband response buffer. As a result, stale data from the sideband +response and transaction buffers may now reside in a core fill buffer. + +Primary Stale Data Propagator (PSDP) +------------------------------------ +The primary stale data propagator (PSDP) is limited to the client (including +Intel Xeon server E3) uncore implementation. Similar to the sideband response +buffer, the primary response buffer is shared by all client cores. For some +processors, MMIO primary reads will return 64 bytes of data to the core fill +buffer including both requested data and unrequested stale data. This is +similar to the sideband stale data propagator. + +Vulnerabilities +=============== +Device Register Partial Write (DRPW) (CVE-2022-21166) +----------------------------------------------------- +Some endpoint MMIO registers incorrectly handle writes that are smaller than +the register size. Instead of aborting the write or only copying the correct +subset of bytes (for example, 2 bytes for a 2-byte write), more bytes than +specified by the write transaction may be written to the register. On +processors affected by FBSDP, this may expose stale data from the fill buffers +of the core that created the write transaction. + +Shared Buffers Data Sampling (SBDS) (CVE-2022-21125) +---------------------------------------------------- +After propagators may have moved data around the uncore and copied stale data +into client core fill buffers, processors affected by MFBDS can leak data from +the fill buffer. It is limited to the client (including Intel Xeon server E3) +uncore implementation. + +Shared Buffers Data Read (SBDR) (CVE-2022-21123) +------------------------------------------------ +It is similar to Shared Buffer Data Sampling (SBDS) except that the data is +directly read into the architectural software-visible state. It is limited to +the client (including Intel Xeon server E3) uncore implementation. + +Affected Processors +=================== +Not all the CPUs are affected by all the variants. For instance, most +processors for the server market (excluding Intel Xeon E3 processors) are +impacted by only Device Register Partial Write (DRPW). + +Below is the list of affected Intel processors [#f1]_: + + =================== ============ ========= + Common name Family_Model Steppings + =================== ============ ========= + HASWELL_X 06_3FH 2,4 + SKYLAKE_L 06_4EH 3 + BROADWELL_X 06_4FH All + SKYLAKE_X 06_55H 3,4,6,7,11 + BROADWELL_D 06_56H 3,4,5 + SKYLAKE 06_5EH 3 + ICELAKE_X 06_6AH 4,5,6 + ICELAKE_D 06_6CH 1 + ICELAKE_L 06_7EH 5 + ATOM_TREMONT_D 06_86H All + LAKEFIELD 06_8AH 1 + KABYLAKE_L 06_8EH 9 to 12 + ATOM_TREMONT 06_96H 1 + ATOM_TREMONT_L 06_9CH 0 + KABYLAKE 06_9EH 9 to 13 + COMETLAKE 06_A5H 2,3,5 + COMETLAKE_L 06_A6H 0,1 + ROCKETLAKE 06_A7H 1 + =================== ============ ========= + +If a CPU is in the affected processor list, but not affected by a variant, it +is indicated by new bits in MSR IA32_ARCH_CAPABILITIES. As described in a later +section, mitigation largely remains the same for all the variants, i.e. to +clear the CPU fill buffers via VERW instruction. + +New bits in MSRs +================ +Newer processors and microcode update on existing affected processors added new +bits to IA32_ARCH_CAPABILITIES MSR. These bits can be used to enumerate +specific variants of Processor MMIO Stale Data vulnerabilities and mitigation +capability. + +MSR IA32_ARCH_CAPABILITIES +-------------------------- +Bit 13 - SBDR_SSDP_NO - When set, processor is not affected by either the + Shared Buffers Data Read (SBDR) vulnerability or the sideband stale + data propagator (SSDP). +Bit 14 - FBSDP_NO - When set, processor is not affected by the Fill Buffer + Stale Data Propagator (FBSDP). +Bit 15 - PSDP_NO - When set, processor is not affected by Primary Stale Data + Propagator (PSDP). +Bit 17 - FB_CLEAR - When set, VERW instruction will overwrite CPU fill buffer + values as part of MD_CLEAR operations. Processors that do not + enumerate MDS_NO (meaning they are affected by MDS) but that do + enumerate support for both L1D_FLUSH and MD_CLEAR implicitly enumerate + FB_CLEAR as part of their MD_CLEAR support. +Bit 18 - FB_CLEAR_CTRL - Processor supports read and write to MSR + IA32_MCU_OPT_CTRL[FB_CLEAR_DIS]. On such processors, the FB_CLEAR_DIS + bit can be set to cause the VERW instruction to not perform the + FB_CLEAR action. Not all processors that support FB_CLEAR will support + FB_CLEAR_CTRL. + +MSR IA32_MCU_OPT_CTRL +--------------------- +Bit 3 - FB_CLEAR_DIS - When set, VERW instruction does not perform the FB_CLEAR +action. This may be useful to reduce the performance impact of FB_CLEAR in +cases where system software deems it warranted (for example, when performance +is more critical, or the untrusted software has no MMIO access). Note that +FB_CLEAR_DIS has no impact on enumeration (for example, it does not change +FB_CLEAR or MD_CLEAR enumeration) and it may not be supported on all processors +that enumerate FB_CLEAR. + +Mitigation +========== +Like MDS, all variants of Processor MMIO Stale Data vulnerabilities have the +same mitigation strategy to force the CPU to clear the affected buffers before +an attacker can extract the secrets. + +This is achieved by using the otherwise unused and obsolete VERW instruction in +combination with a microcode update. The microcode clears the affected CPU +buffers when the VERW instruction is executed. + +Kernel reuses the MDS function to invoke the buffer clearing: + + mds_clear_cpu_buffers() + +On MDS affected CPUs, the kernel already invokes CPU buffer clear on +kernel/userspace, hypervisor/guest and C-state (idle) transitions. No +additional mitigation is needed on such CPUs. + +For CPUs not affected by MDS or TAA, mitigation is needed only for the attacker +with MMIO capability. Therefore, VERW is not required for kernel/userspace. For +virtualization case, VERW is only needed at VMENTER for a guest with MMIO +capability. + +Mitigation points +----------------- +Return to user space +^^^^^^^^^^^^^^^^^^^^ +Same mitigation as MDS when affected by MDS/TAA, otherwise no mitigation +needed. + +C-State transition +^^^^^^^^^^^^^^^^^^ +Control register writes by CPU during C-state transition can propagate data +from fill buffer to uncore buffers. Execute VERW before C-state transition to +clear CPU fill buffers. + +Guest entry point +^^^^^^^^^^^^^^^^^ +Same mitigation as MDS when processor is also affected by MDS/TAA, otherwise +execute VERW at VMENTER only for MMIO capable guests. On CPUs not affected by +MDS/TAA, guest without MMIO access cannot extract secrets using Processor MMIO +Stale Data vulnerabilities, so there is no need to execute VERW for such guests. + +Mitigation control on the kernel command line +--------------------------------------------- +The kernel command line allows to control the Processor MMIO Stale Data +mitigations at boot time with the option "mmio_stale_data=". The valid +arguments for this option are: + + ========== ================================================================= + full If the CPU is vulnerable, enable mitigation; CPU buffer clearing + on exit to userspace and when entering a VM. Idle transitions are + protected as well. It does not automatically disable SMT. + full,nosmt Same as full, with SMT disabled on vulnerable CPUs. This is the + complete mitigation. + off Disables mitigation completely. + ========== ================================================================= + +If the CPU is affected and mmio_stale_data=off is not supplied on the kernel +command line, then the kernel selects the appropriate mitigation. + +Mitigation status information +----------------------------- +The Linux kernel provides a sysfs interface to enumerate the current +vulnerability status of the system: whether the system is vulnerable, and +which mitigations are active. The relevant sysfs file is: + + /sys/devices/system/cpu/vulnerabilities/mmio_stale_data + +The possible values in this file are: + + .. list-table:: + + * - 'Not affected' + - The processor is not vulnerable + * - 'Vulnerable' + - The processor is vulnerable, but no mitigation enabled + * - 'Vulnerable: Clear CPU buffers attempted, no microcode' + - The processor is vulnerable, but microcode is not updated. The + mitigation is enabled on a best effort basis. + * - 'Mitigation: Clear CPU buffers' + - The processor is vulnerable and the CPU buffer clearing mitigation is + enabled. + +If the processor is vulnerable then the following information is appended to +the above information: + + ======================== =========================================== + 'SMT vulnerable' SMT is enabled + 'SMT disabled' SMT is disabled + 'SMT Host state unknown' Kernel runs in a VM, Host SMT state unknown + ======================== =========================================== + +References +---------- +.. [#f1] Affected Processors + https://www.intel.com/content/www/us/en/developer/topic-technology/software… -- 2.20.1

1 29

[PATCH openEuler-5.10 000/557] Backport 5.10.110 LTS
by Zheng Zengkai 06 Jul '22

06 Jul '22

Backport 5.10.110 LTS patches from upstream arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" can: m_can: m_can_tx_handler(): fix use after free of skb openvswitch: Fixed nd target mask field in the flow dump. docs: sysctl/kernel: add missing bit to panic_print um: Fix uml_mconsole stop/go ARM: dts: spear13xx: Update SPI dma properties ARM: dts: spear1340: Update serial node properties ASoC: topology: Allow TLV control to be either read or write dt-bindings: spi: mxic: The interrupt property is not mandatory dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: mtd: nand-controller: Fix the reg property description bpf: Fix comment for helper bpf_current_task_under_cgroup() bpf: Adjust BPF stack helper functions to accommodate skip > 0 mm/usercopy: return 1 from hardened_usercopy __setup() handler mm/memcontrol: return 1 from cgroup.memory __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/mmap: return 1 from stack_guard_gap __setup() handler batman-adv: Check ptr for NULL before reducing its refcnt ASoC: soc-compress: Change the check for codec_dai staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet proc: bootconfig: Add null pointer check can: isotp: restore accidentally removed MSG_PEEK feature platform/chrome: cros_ec_typec: Check for EC device ACPI: CPPC: Avoid out of bounds access when parsing _CPC data riscv module: remove (NOLOAD) io_uring: fix memory leak of uid in files registration ARM: iop32x: offset IRQ numbers by 1 ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function pinctrl: pinconf-generic: Print arguments for bias-pull-* watch_queue: Free the page array when watch_queue is dismantled crypto: arm/aes-neonbs-cbc - Select generic cbc and aes mailbox: imx: fix wakeup failure from freeze mode rxrpc: Fix call timer start racing with call destruction gfs2: Make sure FITRIM minlen is rounded up to fs block size rtc: check if __rtc_read_time was successful XArray: Update the LRU list in xas_split() can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value can: mcba_usb: properly check endpoint type XArray: Fix xas_create_range() when multi-order entry present wireguard: socket: ignore v6 endpoints when ipv6 is disabled wireguard: socket: free skb in send6 when ipv6 is disabled wireguard: queueing: use CFI-safe ptr_ring cleanup function ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM KVM: SVM: fix panic on out-of-bounds guest IRQ KVM: x86: fix sending PV IPI KVM: Prevent module exit until all VMs are freed KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated platform: chrome: Split trace include file scsi: qla2xxx: Use correct feature type field during RFF_ID processing scsi: qla2xxx: Reduce false trigger to login scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() scsi: qla2xxx: Check for firmware dump already collected scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Fix warning for missing error code scsi: qla2xxx: Fix wrong FDMI data for 64G adapter scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix stuck session in gpdb powerpc: Fix build errors with newer binutils powerpc/lib/sstep: Fix build errors with newer binutils powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/kasan: Fix early region not updated correctly KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU ALSA: hda/realtek: Add alc256-samsung-headphone fixup media: atomisp: fix bad usage at error handling logic mmc: host: Return an error when ->enable_sdio_irq() ops is missing media: hdpvr: initialize dev->worker at hdpvr_register_videodev media: Revert "media: em28xx: add missing em28xx_close_extension" video: fbdev: sm712fb: Fix crash in smtcfb_write() ARM: mmp: Fix failure to remove sram device ARM: tegra: tamonten: Fix I2C3 pad setting lib/test_lockup: fix kernel pointer check for separate address spaces uaccess: fix type mismatch warnings from access_ok() media: cx88-mpeg: clear interrupt status register before streaming video ASoC: soc-core: skip zero num_dai component in searching dai name ARM: dts: bcm2711: Add the missing L1/L2 cache information video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() arm64: defconfig: build imx-sdma as a module ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk ARM: ftrace: avoid redundant loads or clobbering IP media: atomisp: fix dummy_ptr check to avoid duplicate active_bo media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards ASoC: madera: Add dependencies on MFD ARM: dts: bcm2837: Add the missing L1/L2 cache information ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit video: fbdev: cirrusfb: check pixclock to avoid divide by zero video: fbdev: w100fb: Reset global state video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow media: ir_toy: free before error exiting media: staging: media: zoran: fix various V4L2 compliance errors media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com media: staging: media: zoran: move videodev alloc ntfs: add sanity check on allocation size f2fs: compress: fix to print raw data size in error path of lz4 decompression NFSD: Fix nfsd_breaker_owns_lease() return values f2fs: fix to do sanity check on curseg->alloc_type ext4: don't BUG if someone dirty pages without asking ext4 first ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb locking/lockdep: Iterate lock_classes directly when reading lockdep files spi: tegra20: Use of_device_get_match_data() nvme-tcp: lockdep: annotate in-kernel sockets parisc: Fix handling off probe non-access faults PM: core: keep irq flags in device_pm_check_callbacks() ACPI/APEI: Limit printable size of BERT table data Revert "Revert "block, bfq: honor already-setup queue merges"" lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 ACPICA: Avoid walking the ACPI Namespace if it is not there fs/binfmt_elf: Fix AT_PHDR for unusual ELF files irqchip/nvic: Release nvic_base upon failure irqchip/qcom-pdc: Fix broken locking Fix incorrect type in assignment of ipv6 port for audit loop: use sysfs_emit() in the sysfs xxx show() selinux: allow FIOCLEX and FIONCLEX with policy capability selinux: use correct type for context length pinctrl: npcm: Fix broken references to chip->parent_device gcc-plugins/stackleak: Exactly match strings instead of prefixes regulator: rpi-panel: Handle I2C errors/timing to the Atmel LSM: general protection fault in legacy_parse_param fs: fix fd table size alignment properly lib/test: use after free in register_test_dev_kmod() fs: fd tables have to be multiples of BITS_PER_LONG net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator NFSv4/pNFS: Fix another issue with a list iterator pointing to the head qlcnic: dcb: default to returning -EOPNOTSUPP selftests: test_vxlan_under_vrf: Fix broken test case net: phy: broadcom: Fix brcm_fet_config_init() net: enetc: report software timestamping via SO_TIMESTAMPING xen: fix is_xen_pmu() clk: Initialize orphan req_rate clk: qcom: gcc-msm8994: Fix gpll4 width kdb: Fix the putarea helper function NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options jfs: fix divide error in dbNextAG driver core: dd: fix return value of __setup handler firmware: google: Properly state IOMEM dependency kgdbts: fix return value of __setup handler serial: 8250: fix XOFF/XON sending when DMA is used kgdboc: fix return value of __setup handler tty: hvc: fix return value of __setup handler pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init staging: mt7621-dts: fix GB-PC2 devicetree staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix formatting staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree NFS: remove unneeded check in decode_devicenotify_args() clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver clk: clps711x: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: actions: Terminate clk_div_table with sentinel element nvdimm/region: Fix default alignment for small regions remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma clk: qcom: clk-rcg2: Update the frac table for pixel clock clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: at91: sama7g5: fix parents of PDMCs' GCLK clk: imx7d: Remove audio_mclk_root_clk dma-debug: fix return value of __setup handlers NFS: Return valid errors from nfs2/3_decode_dirent() habanalabs: Add check for pci_enable_device iio: adc: Add check for devm_request_threaded_irq serial: 8250: Fix race condition in RTS-after-send handling NFS: Use of mapping_set_error() results in spurious errors serial: 8250_lpss: Balance reference count for PCI DMA device serial: 8250_mid: Balance reference count for PCI DMA device phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) clk: qcom: ipq8074: Use floor ops for SDCC1 clock pinctrl: renesas: checker: Fix miscalculation of number of states pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel staging:iio:adc:ad7280a: Fix handing of device address bit reversing. iio: mma8452: Fix probe failing when an i2c_device_id is used clk: qcom: ipq8074: fix PCI-E clock oops soundwire: intel: fix wrong register name in intel_shim_wake cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse misc: alcor_pci: Fix an error handling path fsi: Aspeed: Fix a potential double free fsi: aspeed: convert to devm_platform_ioremap_resource pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() mxser: fix xmit_buf leak in activate when LSR == 0xff mfd: asic3: Add missing iounmap() on error asic3_mfd_probe tipc: fix the timer expires after interval 100ms openvswitch: always update flow key after nat tcp: ensure PMTU updates are processed during fastopen net: bcmgenet: Use stronger register read/writes to assure ordering PCI: Avoid broken MSI on SB600 USB devices selftests/bpf/test_lirc_mode2.sh: Exit with proper code i2c: mux: demux-pinctrl: do not deactivate a master that is not active i2c: meson: Fix wrong speed use from probe af_netlink: Fix shift out of bounds in group mask calculation ipv4: Fix route lookups when handling ICMP redirects and PMTU updates Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed selftests/bpf: Fix error reporting from sock_fields programs bareudp: use ipv6_mod_enabled to check if IPv6 enabled can: isotp: support MSG_TRUNC flag when reading from socket can: isotp: return -EADDRNOTAVAIL when reading from unbound socket USB: storage: ums-realtek: fix error code in rts51x_read_mem() samples/bpf, xdpsock: Fix race when running for fix duration of time RDMA/mlx5: Fix memory leak in error flow for subscribe event routine mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init MIPS: pgalloc: fix memory leak caused by pgd_free() MIPS: RB532: fix return value of __setup handler mips: cdmm: Fix refcount leak in mips_cdmm_phys_base ath10k: Fix error handling in ath10k_setup_msa_resources vxcan: enable local echo for sent CAN frames powerpc: 8xx: fix a return value error in mpc8xx_pic_init platform/x86: huawei-wmi: check the return value of device_create_file() selftests/bpf: Make test_lwt_ip_encap more stable and faster libbpf: Unmap rings when umem deleted mfd: mc13xxx: Add check for mc13xxx_irq_request powerpc/sysdev: fix incorrect use to determine if list is empty mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n net: axienet: fix RX ring refill allocation failure handling IB/hfi1: Allow larger MTU without AIP power: supply: wm8350-power: Add missing free in free_charger_irq power: supply: wm8350-power: Handle error for wm8350_register_irq i2c: xiic: Make bus names unique hv_balloon: rate-limit "Unhandled message" warning KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() KVM: x86: Fix emulation in writing cr8 powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() libbpf: Skip forward declaration when counting duplicated type names gpu: host1x: Fix a memory leak in 'host1x_remove()' bpf, arm64: Feed byte-offset into bpf line info bpf, arm64: Call build_prologue() first in first JIT pass drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt scsi: hisi_sas: Change permission of parameter prot_mask power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return drm/tegra: Fix reference leak in tegra_dsi_ganged_probe ext2: correct max file size computing TOMOYO: fix __setup handlers return values drm/amd/display: Remove vupdate_int_entry definition RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR scsi: pm8001: Fix abort all task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix command initialization in pm80XX_send_read_log() dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS drm/msm/dpu: fix dp audio condition drm/msm/dpu: add DSPP blocks teardown drm/msm/dp: populate connector of struct dp_panel iwlwifi: mvm: Fix an error code in iwl_mvm_up() iwlwifi: Fix -EIO error code that is never returned dax: make sure inodes are flushed before destroy cache IB/cma: Allow XRC INI QPs to set their local ACK timeout drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug drm/amd/pm: enable pm sysfs write for one VF mode iommu/ipmmu-vmsa: Check for error num after setting mask HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init drm/bridge: dw-hdmi: use safe format when first in bridge chain PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge scripts/dtc: Call pkg-config POSIXly correct net: dsa: mv88e6xxx: Enable port policy support on 6097 mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode powerpc/perf: Don't use perf_hw_context for trace IMC PMU KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch ray_cs: Check ioremap return value power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe i40e: respect metadata on XSK Rx to skb i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb KVM: PPC: Fix vmx/vsx mixup in mmio emulation RDMA/core: Set MR type in ib_reg_user_mr ath9k_htc: fix uninit value bugs drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() ionic: fix type complaint in ionic_dev_cmd_clean() drm/edid: Don't clear formats if using deep color mtd: rawnand: gpmi: fix controller timings setting mtd: onenand: Check for error irq Bluetooth: hci_serdev: call init_rwsem() before p->open() udmabuf: validate ubuf->pagecount libbpf: Fix possible NULL pointer dereference when destroying skeleton drm/panfrost: Check for error num after setting mask ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern drm: bridge: adv7511: Fix ADV7535 HPD enablement drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() mmc: davinci_mmc: Handle error for clk_enable ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe ASoC: imx-es8328: Fix error return code in imx_es8328_probe() ASoC: fsl_spdif: Disable TX clock when stop ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: dmaengine: do not use a NULL prepare_slave_config() callback ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ivtv: fix incorrect device_caps for ivtvfb media: saa7134: fix incorrect use to determine if list is empty media: saa7134: convert list_for_each to entry variant video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ASoC: fsi: Add check for clk_enable ASoC: wm8350: Handle error for wm8350_register_irq ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe media: vidtv: Check for null return of vzalloc media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction memory: emif: check the pointer temp in get_device_details() memory: emif: Add check for setup_interrupts ASoC: soc-compress: prevent the potentially use of null pointer ASoC: dwc-i2s: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: mxs-saif: Handle errors for clk_enable printk: fix return value of printk.devkmsg __setup handler arm64: dts: broadcom: Fix sata nodename arm64: dts: ns2: Fix spi-cpol and spi-cpha property ALSA: spi: Add check for clk_enable() ASoC: ti: davinci-i2s: Add check for clk_enable() ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() uaccess: fix nios2 and microblaze get_user_8() ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put media: cedrus: h264: Fix neighbour info buffer size media: cedrus: H265: Fix neighbour info buffer size media: usb: go7007: s2250-board: fix leak in probe() media: em28xx: initialize refcount before kref_get media: video/hdmi: handle short reads of hdmi info frame. ARM: dts: imx: Add missing LVDS decoder on M53Menlo ARM: dts: sun8i: v3s: Move the csi1 block to follow address order soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc arm64: dts: qcom: sdm845: fix microphone bias properties and values soc: qcom: aoss: remove spurious IRQF_ONESHOT flags soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: qcom: rpmpd: Check for null return of devm_kcalloc ARM: dts: qcom: ipq4019: fix sleep clock firmware: qcom: scm: Remove reassignment to desc following initializer video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() video: fbdev: controlfb: Fix COMPILE_TEST build video: fbdev: controlfb: Fix set but not used warnings video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen media: aspeed: Correct value for h-total-pixels media: hantro: Fix overfill bottom register field name media: meson: vdec: potential dereference of null pointer media: coda: Fix missing put_device() call in coda_get_vdoa_data ASoC: generic: simple-card-utils: remove useless assignment ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting media: bttv: fix WARNING regression on tunerless devices media: mtk-vcodec: potential dereference of null pointer media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size kunit: make kunit_test_timeout compatible with comment selftests, x86: fix how check_cc.sh is being invoked f2fs: fix compressed file start atomic write may cause data corruption f2fs: compress: remove unneeded read when rewrite whole cluster btrfs: fix unexpected error path when reflinking an inline extent f2fs: fix to avoid potential deadlock nfsd: more robust allocation failure handling in nfsd_file_cache_init f2fs: fix missing free nid in f2fs_handle_failed_inode perf/x86/intel/pt: Fix address filter config for 32-bit kernel perf/core: Fix address filter parser for multiple filters rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() sched/core: Export pelt_thermal_tp sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa f2fs: fix to enable ATGC correctly via gc_idle sysfs interface watch_queue: Actually free the watch watch_queue: Fix NULL dereference in error cleanup io_uring: terminate manual loop iterator loop correctly for non-vecs clocksource: acpi_pm: fix return value of __setup handler hwmon: (pmbus) Add Vin unit off handling hwrng: nomadik - Change clk_disable to clk_disable_unprepare amba: Make the remove callback return void vfio: platform: simplify device removal crypto: ccree - Fix use after free in cc_cipher_exit() crypto: ccp - ccp_dmaengine_unregister release dma channels ACPI: APEI: fix return value of __setup handlers clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() clocksource/drivers/timer-microchip-pit64b: Use notrace clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts clocksource/drivers/exynos_mct: Refactor resources allocation clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix crypto: vmx - add missing dependencies crypto: amlogic - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: sun8i-ss - call finalize with bh disabled hwrng: atmel - disable trng on failure path spi: spi-zynqmp-gqspi: Handle error for dma_set_mask PM: suspend: fix return value of __setup handler PM: hibernate: fix __setup handler error handling block: don't delete queue kobject before its children nvme: cleanup __nvme_check_ids hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING hwmon: (pmbus) Add mutex to regulator ops spi: pxa2xx-pci: Balance reference count for PCI DMA device crypto: ccree - don't attempt 0 len DMA mappings EVM: fix the evm= __setup handler return value audit: log AUDIT_TIME_* records only from rules crypto: rockchip - ECB does not need IV selftests/x86: Add validity check and allow field splitting arm64/mm: avoid fixmap race condition when create pud mapping spi: tegra114: Add missing IRQ check in tegra_spi_probe thermal: int340x: Check for NULL after calling kmemdup() crypto: mxs-dcp - Fix scatterlist processing crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: sun8i-ss - really disable hash on A80 hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER hwrng: cavium - Check health status while reading random data selinux: check return value of sel_make_avc_files regulator: qcom_smd: fix for_each_child.cocci warnings PCI: xgene: Revert "PCI: xgene: Fix IB window setup" PCI: pciehp: Clear cmd_busy bit in polling mode drm/i915/gem: add missing boundary check in vm_access brcmfmac: pcie: Fix crashes due to early IRQs brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: firmware: Allocate space for default boardrev in nvram xtensa: fix xtensa_wsr always writing 0 xtensa: fix stop_machine_cpuslocked call in patch_text media: davinci: vpif: fix unbalanced runtime PM enable media: davinci: vpif: fix unbalanced runtime PM get media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC DEC: Limit PMAX memory probing to R3k systems crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - only allow with rsa exec: Force single empty string when argv is empty lib/raid6/test: fix multiple definition linking error thermal: int340x: Increase bitmap size pstore: Don't use semaphores in always-atomic-context code carl9170: fix missing bit-wise or operator for tx_params mgag200 fix memmapsl configuration in GCTL6 register ARM: dts: exynos: add missing HDMI supplies on SMDK5420 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: at91: sama5d2: Fix PMERRLOC resource size video: fbdev: atari: Atari 2 bpp (STe) palette bugfix video: fbdev: sm712fb: Fix crash in smtcfb_read() drm/edid: check basic audio support on CEA extension block block: limit request dispatch loop duration mailbox: tegra-hsp: Flush whole channel ext4: fix fs corruption when tring to remove a non-empty directory with IO error ext4: fix ext4_fc_stats trace point coredump: Also dump first pages of non-executable ELF libraries ACPI: properties: Consistently return -ENOENT if there are no more references arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: signal: nofpsimd: Do not allocate fp/simd context when not available udp: call udp_encap_enable for v6 sockets when enabling encap powerpc/kvm: Fix kvm_use_magic_page can: isotp: sanitize CAN ID checks in isotp_bind() drbd: fix potential silent data corruption dm integrity: set journal entry unused when shrinking device mm/kmemleak: reset tag when compare object pointer mm,hwpoison: unmap poisoned page before invalidation Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" mm: madvise: return correct bytes advised with process_madvise mm: madvise: skip unmapped vma holes passed to process_madvise ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock ALSA: hda: Avoid unsol event during RPM suspending ALSA: cs4236: fix an incorrect NULL check on list iterator cifs: fix NULL ptr dereference in smb2_ioctl_query_info() cifs: prevent bad output lengths in smb2_ioctl_query_info() Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" riscv: Increase stack size under KASAN riscv: Fix fill_callchain return value qed: display VF trust config scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands mempolicy: mbind_range() set_policy() after vma_merge() mm: invalidate hwpoison page cache page in fault path mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node mtd: rawnand: protect access to rawnand devices while in suspend spi: mxic: Fix the transmit path pinctrl: samsung: drop pin banks references on error paths remoteproc: Fix count check in rproc_coredump_write() f2fs: fix to do sanity check on .cp_pack_total_block_count f2fs: quota: fix loop condition at f2fs_quota_sync() f2fs: fix to unlock page correctly in error path of is_alive() NFSD: prevent integer overflow on 32 bit systems NFSD: prevent underflow in nfssvc_decode_writeargs() SUNRPC: avoid race between mod_timer() and del_timer_sync() HID: intel-ish-hid: Use dma_alloc_coherent for firmware update firmware: stratix10-svc: add missing callback parameter on RSU Documentation: update stable tree link Documentation: add link to stable release candidate tree KEYS: fix length validation in keyctl_pkey_params_get_2() clk: uniphier: Fix fixed-rate initialization greybus: svc: fix an error handling bug in gb_svc_hello() iio: inkern: make a best effort on offset calculation iio: inkern: apply consumer scale when no channel scale is available iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: afe: rescale: use s64 for temporary scale calculations coresight: Fix TRCCONFIGR.QE sysfs interface mei: avoid iterator usage outside of list_for_each_entry mei: me: add Alder Lake N device id. xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() xhci: make xhci_handshake timeout for xhci_reset() adjustable xhci: fix runtime PM imbalance in USB2 resume xhci: fix garbage USBSTS being logged in some cases USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c virtio-blk: Use blk_validate_block_size() to validate block size tpm: fix reference counting for struct tpm_chip iommu/iova: Improve 32-bit free space estimate locking/lockdep: Avoid potential access of invalid memory in lock_class net: dsa: microchip: add spi_device_id tables Input: zinitix - do not report shadow fingers spi: Fix erroneous sgs value with min_t() Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" net:mcf8390: Use platform_get_irq() to get the interrupt spi: Fix invalid sgs value gpio: Revert regression in sysfs-gpio (gpiolib.c) ethernet: sun: Free the coherent when failing in probing tools/virtio: fix virtio_test execution vdpa/mlx5: should verify CTRL_VQ feature exists for MQ virtio_console: break out of buf poll on remove ARM: mstar: Select HAVE_ARM_ARCH_TIMER xfrm: fix tunnel model fragmentation behavior HID: logitech-dj: add new lightspeed receiver id hv: utils: add PTP_1588_CLOCK to Kconfig to fix build USB: serial: simple: add Nokia phone driver USB: serial: pl2303: add IBM device IDs already merged(32) can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path KVM: x86/mmu: do compare-and-exchange of gPTE via the user address ubi: fastmap: Return error code if memory allocation fails in add_aeb() ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path ubifs: rename_whiteout: correct old_dir size computing ubifs: Fix to add refcount once page is set private ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() ubifs: setflags: Make dirtied_ino_d 8 bytes aligned ubifs: Add missing iput if do_tmpfile() failed in rename whiteout ubifs: Fix deadlock in concurrent rename whiteout and inode writeback ubifs: rename_whiteout: Fix double free for whiteout_ui->data bfq: fix use-after-free in bfq_dispatch_request block, bfq: don't move oom_bfqq net/x25: Fix null-ptr-deref caused by x25_disconnect net: hns3: fix bug when PF set the duplicate MAC address for VFs bpf, sockmap: Fix double uncharge the mem of sk_msg bpf, sockmap: Fix more uncharged while msg has more_data bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full livepatch: Fix build failure on 32 bits processors drm/i915/opregion: check port number bounds for SWSCI display power state bcache: fixup multiple threads crash drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() jffs2: fix memory leak in jffs2_scan_medium jffs2: fix memory leak in jffs2_do_mount_fs jffs2: fix use-after-free in jffs2_clear_xattr_subsystem can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register netdevice: add the case if dev is NULL swiotlb: fix info leak with DMA_FROM_DEVICE kabi conflict(8) PCI: Reduce warnings on possible RW1C corruption qed: validate and restrict untrusted VFs vlan promisc mode block: don't merge across cgroup boundaries if blkcg is enabled rseq: Remove broken uapi field layout on 32-bit little endian coredump: Use the vma snapshot in fill_files_note coredump/elf: Pass coredump_params into fill_note_info coredump: Remove the WARN_ON in dump_vma_snapshot coredump: Snapshot the vmas in do_coredump Total Patches = 597 - 32 - 8 = 557 Aaron Conole (1): openvswitch: always update flow key after nat Aashish Sharma (1): dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS Abel Vesa (2): clk: imx7d: Remove audio_mclk_root_clk ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk Adrian Hunter (2): perf/core: Fix address filter parser for multiple filters perf/x86/intel/pt: Fix address filter config for 32-bit kernel Aharon Landau (1): RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR Akira Kawata (1): fs/binfmt_elf: Fix AT_PHDR for unusual ELF files Alan Stern (1): USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c Alexander Lobakin (2): i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb i40e: respect metadata on XSK Rx to skb Alexander Usyskin (2): mei: me: add Alder Lake N device id. mei: avoid iterator usage outside of list_for_each_entry Alexey Khoroshilov (1): NFS: remove unneeded check in decode_devicenotify_args() Alistair Delva (1): remoteproc: Fix count check in rproc_coredump_write() Alistair Popple (1): mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node Amadeusz Sławiński (1): ASoC: topology: Allow TLV control to be either read or write Amir Goldstein (1): nfsd: more robust allocation failure handling in nfsd_file_cache_init Ammar Faizi (1): ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM Anders Roxell (3): powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/lib/sstep: Fix build errors with newer binutils powerpc: Fix build errors with newer binutils Andre Przywara (1): ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS Andreas Gruenbacher (1): powerpc/kvm: Fix kvm_use_magic_page Andrew Price (1): gfs2: Make sure FITRIM minlen is rounded up to fs block size Andy Shevchenko (3): spi: pxa2xx-pci: Balance reference count for PCI DMA device serial: 8250_mid: Balance reference count for PCI DMA device serial: 8250_lpss: Balance reference count for PCI DMA device Ang Tien Sung (1): firmware: stratix10-svc: add missing callback parameter on RSU Anssi Hannula (3): xhci: fix garbage USBSTS being logged in some cases xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() hv_balloon: rate-limit "Unhandled message" warning Anton Ivanov (1): um: Fix uml_mconsole stop/go Ard Biesheuvel (1): ARM: ftrace: avoid redundant loads or clobbering IP Armin Wolf (1): hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING Arnd Bergmann (4): uaccess: fix nios2 and microblaze get_user_8() uaccess: fix type mismatch warnings from access_ok() lib/test_lockup: fix kernel pointer check for separate address spaces ARM: iop32x: offset IRQ numbers by 1 Arun Easi (2): scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests Arınç ÜNAL (5): staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree staging: mt7621-dts: fix formatting staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix GB-PC2 devicetree staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet Athira Rajeev (1): powerpc/perf: Don't use perf_hw_context for trace IMC PMU Bagas Sanjaya (2): Documentation: add link to stable release candidate tree Documentation: update stable tree link Bartosz Golaszewski (1): Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" Bharata B Rao (1): sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa Biju Das (2): spi: Fix invalid sgs value spi: Fix erroneous sgs value with min_t() Bikash Hazarika (1): scsi: qla2xxx: Fix wrong FDMI data for 64G adapter Bjorn Helgaas (1): PCI: Avoid broken MSI on SB600 USB devices Brandon Wyman (1): hwmon: (pmbus) Add Vin unit off handling Casey Schaufler (2): LSM: general protection fault in legacy_parse_param Fix incorrect type in assignment of ipv6 port for audit Chaitanya Kulkarni (1): loop: use sysfs_emit() in the sysfs xxx show() Chao Yu (6): f2fs: fix to unlock page correctly in error path of is_alive() f2fs: fix to do sanity check on .cp_pack_total_block_count f2fs: fix to enable ATGC correctly via gc_idle sysfs interface f2fs: fix to avoid potential deadlock f2fs: fix to do sanity check on curseg->alloc_type f2fs: compress: fix to print raw data size in error path of lz4 decompression Charan Teja Kalla (3): mm: madvise: skip unmapped vma holes passed to process_madvise mm: madvise: return correct bytes advised with process_madvise Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" Charles Keepax (1): ASoC: madera: Add dependencies on MFD Chen Jingwen (1): powerpc/kasan: Fix early region not updated correctly Chen-Yu Tsai (7): media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: hantro: Fix overfill bottom register field name pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: pinconf-generic: Print arguments for bias-pull-* Chris Leech (1): nvme-tcp: lockdep: annotate in-kernel sockets Christian Göttsche (2): selinux: check return value of sel_make_avc_files selinux: use correct type for context length Christoph Hellwig (1): nvme: cleanup __nvme_check_ids Christophe JAILLET (4): firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined gpu: host1x: Fix a memory leak in 'host1x_remove()' fsi: Aspeed: Fix a potential double free misc: alcor_pci: Fix an error handling path Chuck Lever (1): NFSD: Fix nfsd_breaker_owns_lease() return values Claudiu Beznea (3): net: dsa: microchip: add spi_device_id tables hwrng: atmel - disable trng on failure path clocksource/drivers/timer-microchip-pit64b: Use notrace Codrin Ciubotariu (2): ASoC: dmaengine: do not use a NULL prepare_slave_config() callback clk: at91: sama7g5: fix parents of PDMCs' GCLK Colin Ian King (2): carl9170: fix missing bit-wise or operator for tx_params iwlwifi: Fix -EIO error code that is never returned Cooper Chiou (1): drm/edid: check basic audio support on CEA extension block Corentin Labbe (8): crypto: sun8i-ss - really disable hash on A80 crypto: rockchip - ECB does not need IV crypto: sun8i-ss - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: amlogic - call finalize with bh disabled media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size media: staging: media: zoran: move videodev alloc media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com Dafna Hirschfeld (1): media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED Damien Le Moal (11): scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands scsi: pm8001: Fix command initialization in pm80XX_send_read_log() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix abort all task initialization Dan Carpenter (9): greybus: svc: fix an error handling bug in gb_svc_hello() NFSD: prevent underflow in nfssvc_decode_writeargs() NFSD: prevent integer overflow on 32 bit systems video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() media: usb: go7007: s2250-board: fix leak in probe() iwlwifi: mvm: Fix an error code in iwl_mvm_up() USB: storage: ums-realtek: fix error code in rts51x_read_mem() lib/test: use after free in register_test_dev_kmod() Dan Williams (1): nvdimm/region: Fix default alignment for small regions Daniel González Cabanelas (1): media: cx88-mpeg: clear interrupt status register before streaming video Daniel Henrique Barboza (1): powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() Daniel Palmer (1): ARM: mstar: Select HAVE_ARM_ARCH_TIMER Daniel Thompson (2): soc: qcom: aoss: remove spurious IRQF_ONESHOT flags kdb: Fix the putarea helper function Dario Binacchi (1): mtd: rawnand: gpmi: fix controller timings setting Darren Hart (1): ACPI/APEI: Limit printable size of BERT table data Dave Stevenson (1): regulator: rpi-panel: Handle I2C errors/timing to the Atmel David Engraf (1): arm64: signal: nofpsimd: Do not allocate fp/simd context when not available David Gow (1): firmware: google: Properly state IOMEM dependency David Heidelberg (2): arm64: dts: qcom: sdm845: fix microphone bias properties and values ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 David Howells (3): watch_queue: Fix NULL dereference in error cleanup watch_queue: Actually free the watch rxrpc: Fix call timer start racing with call destruction David Matlack (1): KVM: Prevent module exit until all VMs are freed Dirk Buchwalder (1): clk: qcom: ipq8074: Use floor ops for SDCC1 clock Dirk Müller (1): lib/raid6/test: fix multiple definition linking error Dmitry Baryshkov (3): drm/msm/dpu: add DSPP blocks teardown drm/msm/dpu: fix dp audio condition PM: core: keep irq flags in device_pm_check_callbacks() Dmitry Torokhov (1): HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports Dmitry Vyukov (1): riscv: Increase stack size under KASAN Dongliang Mu (3): media: em28xx: initialize refcount before kref_get ntfs: add sanity check on allocation size media: hdpvr: initialize dev->worker at hdpvr_register_videodev Drew Fustini (1): clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix Dāvis Mosāns (1): crypto: ccp - ccp_dmaengine_unregister release dma channels Eddie James (1): USB: serial: pl2303: add IBM device IDs Eric Biggers (6): KEYS: fix length validation in keyctl_pkey_params_get_2() crypto: rsa-pkcs1pad - only allow with rsa crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() block: don't delete queue kobject before its children Eric Dumazet (2): rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() watch_queue: Free the page array when watch_queue is dismantled Evgeny Novikov (1): video: fbdev: w100fb: Reset global state Fabiano Rosas (2): KVM: PPC: Fix vmx/vsx mixup in mmio emulation KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init Fangrui Song (1): riscv module: remove (NOLOAD) Felix Maurer (1): selftests/bpf: Make test_lwt_ip_encap more stable and faster Fengnan Chang (2): f2fs: compress: remove unneeded read when rewrite whole cluster f2fs: fix compressed file start atomic write may cause data corruption Filipe Manana (1): btrfs: fix unexpected error path when reflinking an inline extent Florian Fainelli (1): net: phy: broadcom: Fix brcm_fet_config_init() Frank Wunderlich (1): arm64: dts: broadcom: Fix sata nodename Geert Uytterhoeven (3): hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel pinctrl: renesas: checker: Fix miscalculation of number of states George Kennedy (1): video: fbdev: cirrusfb: check pixclock to avoid divide by zero Gilad Ben-Yossef (1): crypto: ccree - don't attempt 0 len DMA mappings Guilherme G. Piccoli (1): docs: sysctl/kernel: add missing bit to panic_print Guillaume Nault (1): ipv4: Fix route lookups when handling ICMP redirects and PMTU updates Guillaume Ranquet (1): clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() Guillaume Tucker (1): selftests, x86: fix how check_cc.sh is being invoked Gwendal Grignou (2): HID: intel-ish-hid: Use dma_alloc_coherent for firmware update platform: chrome: Split trace include file Hangbin Liu (2): bareudp: use ipv6_mod_enabled to check if IPv6 enabled selftests/bpf/test_lirc_mode2.sh: Exit with proper code Hangyu Hua (1): powerpc: 8xx: fix a return value error in mpc8xx_pic_init Hans Verkuil (2): ivtv: fix incorrect device_caps for ivtvfb media: staging: media: zoran: fix various V4L2 compliance errors Hans de Goede (3): power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return iio: mma8452: Fix probe failing when an i2c_device_id is used media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards Hector Martin (4): brcmfmac: firmware: Allocate space for default boardrev in nvram brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Fix crashes due to early IRQs Helge Deller (1): video: fbdev: sm712fb: Fix crash in smtcfb_read() Hengqi Chen (1): bpf: Fix comment for helper bpf_current_task_under_cgroup() Henry Lin (1): xhci: fix runtime PM imbalance in USB2 resume Herbert Xu (2): crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: arm/aes-neonbs-cbc - Select generic cbc and aes Hoang Le (1): tipc: fix the timer expires after interval 100ms Hou Tao (2): bpf, arm64: Call build_prologue() first in first JIT pass bpf, arm64: Feed byte-offset into bpf line info Hou Wenlong (1): KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() Hugh Dickins (1): mempolicy: mbind_range() set_policy() after vma_merge() Håkon Bugge (1): IB/cma: Allow XRC INI QPs to set their local ACK timeout Ido Schimmel (1): selftests: test_vxlan_under_vrf: Fix broken test case Ilpo Järvinen (1): serial: 8250: fix XOFF/XON sending when DMA is used Jaegeuk Kim (1): f2fs: fix missing free nid in f2fs_handle_failed_inode Jagan Teki (1): drm: bridge: adv7511: Fix ADV7535 HPD enablement Jakob Koschel (2): media: saa7134: fix incorrect use to determine if list is empty powerpc/sysdev: fix incorrect use to determine if list is empty Jakub Kicinski (1): tcp: ensure PMTU updates are processed during fastopen Jakub Sitnicki (1): selftests/bpf: Fix error reporting from sock_fields programs James Clark (1): coresight: Fix TRCCONFIGR.QE sysfs interface Jammy Huang (1): media: aspeed: Correct value for h-total-pixels Jann Horn (2): coredump: Also dump first pages of non-executable ELF libraries pstore: Don't use semaphores in always-atomic-context code Jason A. Donenfeld (2): wireguard: queueing: use CFI-safe ptr_ring cleanup function wireguard: socket: ignore v6 endpoints when ipv6 is disabled Jens Axboe (1): io_uring: terminate manual loop iterator loop correctly for non-vecs Jeremy Linton (1): net: bcmgenet: Use stronger register read/writes to assure ordering Jernej Skrabec (2): media: cedrus: H265: Fix neighbour info buffer size media: cedrus: h264: Fix neighbour info buffer size Jia-Ju Bai (3): ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() memory: emif: check the pointer temp in get_device_details() platform/x86: huawei-wmi: check the return value of device_create_file() Jianglei Nie (1): crypto: ccree - Fix use after free in cc_cipher_exit() Jianyong Wu (1): arm64/mm: avoid fixmap race condition when create pud mapping Jiasheng Jiang (26): thermal: int340x: Check for NULL after calling kmemdup() spi: spi-zynqmp-gqspi: Handle error for dma_set_mask media: mtk-vcodec: potential dereference of null pointer media: meson: vdec: potential dereference of null pointer soc: qcom: rpmpd: Check for null return of devm_kcalloc ASoC: ti: davinci-i2s: Add check for clk_enable() ALSA: spi: Add check for clk_enable() ASoC: mxs-saif: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: dwc-i2s: Handle errors for clk_enable ASoC: soc-compress: prevent the potentially use of null pointer memory: emif: Add check for setup_interrupts media: vidtv: Check for null return of vzalloc ASoC: wm8350: Handle error for wm8350_register_irq ASoC: fsi: Add check for clk_enable mmc: davinci_mmc: Handle error for clk_enable drm/panfrost: Check for error num after setting mask mtd: onenand: Check for error irq ray_cs: Check ioremap return value iommu/ipmmu-vmsa: Check for error num after setting mask power: supply: wm8350-power: Handle error for wm8350_register_irq power: supply: wm8350-power: Add missing free in free_charger_irq mfd: mc13xxx: Add check for mc13xxx_irq_request iio: adc: Add check for devm_request_threaded_irq habanalabs: Add check for pci_enable_device ASoC: soc-compress: Change the check for codec_dai Jiaxin Yu (1): ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs Jie Hai (1): dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma Jing Yao (3): video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit Jiri Slaby (1): mxser: fix xmit_buf leak in activate when LSR == 0xff Jocelyn Falempe (1): mgag200 fix memmapsl configuration in GCTL6 register Joe Carnuccio (2): scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Check for firmware dump already collected Johan Hovold (3): USB: serial: simple: add Nokia phone driver media: davinci: vpif: fix unbalanced runtime PM get media: davinci: vpif: fix unbalanced runtime PM enable John David Anglin (1): parisc: Fix handling off probe non-access faults Jonathan Cameron (1): staging:iio:adc:ad7280a: Fix handing of device address bit reversing. Jonathan Neuschäfer (5): clk: actions: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: clps711x: Terminate clk_div_table with sentinel element pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() José Expósito (1): Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" Juergen Gross (1): xen: fix is_xen_pmu() Juhyung Park (1): f2fs: quota: fix loop condition at f2fs_quota_sync() Kai-Heng Feng (1): ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 Kees Cook (2): exec: Force single empty string when argv is empty gcc-plugins/stackleak: Exactly match strings instead of prefixes Konrad Dybcio (1): clk: qcom: gcc-msm8994: Fix gpll4 width Krzysztof Kozlowski (5): pinctrl: samsung: drop pin banks references on error paths ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5420 clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts Kuan-Ying Lee (1): mm/kmemleak: reset tag when compare object pointer Kuldeep Singh (3): arm64: dts: ns2: Fix spi-cpol and spi-cpha property ARM: dts: spear1340: Update serial node properties ARM: dts: spear13xx: Update SPI dma properties Kunihiko Hayashi (1): clk: uniphier: Fix fixed-rate initialization Kuogee Hsieh (1): drm/msm/dp: populate connector of struct dp_panel Lars Ellenberg (1): drbd: fix potential silent data corruption Li RongQing (1): KVM: x86: fix sending PV IPI Liam Beguin (4): iio: afe: rescale: use s64 for temporary scale calculations iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: inkern: apply consumer scale when no channel scale is available iio: inkern: make a best effort on offset calculation Libin Yang (1): soundwire: intel: fix wrong register name in intel_shim_wake Liguang Zhang (1): PCI: pciehp: Clear cmd_busy bit in polling mode Lina Wang (1): xfrm: fix tunnel model fragmentation behavior Lino Sanfilippo (1): tpm: fix reference counting for struct tpm_chip Linus Torvalds (2): fs: fd tables have to be multiples of BITS_PER_LONG fs: fix fd table size alignment properly Linus Walleij (1): Input: zinitix - do not report shadow fingers Liu Ying (1): phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) Lorenzo Bianconi (4): mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update Luca Weiss (1): cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse Lucas Tanure (1): i2c: meson: Fix wrong speed use from probe Lucas Zampieri (1): HID: logitech-dj: add new lightspeed receiver id Lv Ruyi (1): proc: bootconfig: Add null pointer check Maciej W. Rozycki (1): DEC: Limit PMAX memory probing to R3k systems Manish Chopra (1): qed: display VF trust config Manish Rangankar (1): scsi: qla2xxx: Use correct feature type field during RFF_ID processing Maor Gottlieb (1): RDMA/core: Set MR type in ib_reg_user_mr Marc Kleine-Budde (1): can: m_can: m_can_tx_handler(): fix use after free of skb Marc Zyngier (4): PCI: xgene: Revert "PCI: xgene: Fix IB window setup" pinctrl: npcm: Fix broken references to chip->parent_device irqchip/qcom-pdc: Fix broken locking PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" Marcel Ziswiler (1): arm64: defconfig: build imx-sdma as a module Marcelo Roberto Jimenez (1): gpio: Revert regression in sysfs-gpio (gpiolib.c) Marek Szyprowski (1): clocksource/drivers/exynos_mct: Refactor resources allocation Marek Vasut (1): ARM: dts: imx: Add missing LVDS decoder on M53Menlo Marijn Suijten (1): firmware: qcom: scm: Remove reassignment to desc following initializer Martin Blumenstingl (1): drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops Martin Varghese (1): openvswitch: Fixed nd target mask field in the flow dump. Mastan Katragadda (1): drm/i915/gem: add missing boundary check in vm_access Mathias Nyman (1): xhci: make xhci_handshake timeout for xhci_reset() adjustable Matt Kramer (1): ALSA: hda/realtek: Add alc256-samsung-headphone fixup Matthew Wilcox (Oracle) (2): XArray: Fix xas_create_range() when multi-order entry present XArray: Update the LRU list in xas_split() Maulik Shah (1): arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc Mauro Carvalho Chehab (1): media: atomisp: fix bad usage at error handling logic Max Filippov (2): xtensa: fix stop_machine_cpuslocked call in patch_text xtensa: fix xtensa_wsr always writing 0 Maxim Kiselev (1): powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch Maxime Ripard (2): drm/edid: Don't clear formats if using deep color clk: Initialize orphan req_rate Maíra Canal (1): drm/amd/display: Remove vupdate_int_entry definition Miaoqian Lin (31): spi: tegra114: Add missing IRQ check in tegra_spi_probe hwrng: nomadik - Change clk_disable to clk_disable_unprepare media: coda: Fix missing put_device() call in coda_get_vdoa_data soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init drm/tegra: Fix reference leak in tegra_dsi_ganged_probe ath10k: Fix error handling in ath10k_setup_msa_resources mips: cdmm: Fix refcount leak in mips_cdmm_phys_base mfd: asic3: Add missing iounmap() on error asic3_mfd_probe remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function Michael Ellerman (1): powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit Michael S. Tsirkin (1): virtio_console: break out of buf poll on remove Michael Schmitz (1): video: fbdev: atari: Atari 2 bpp (STe) palette bugfix Mike Marciniszyn (1): IB/hfi1: Allow larger MTU without AIP Mikulas Patocka (1): dm integrity: set journal entry unused when shrinking device Minghao Chi (1): spi: tegra20: Use of_device_get_match_data() Minghao Chi (CGEL ZTE) (1): net:mcf8390: Use platform_get_irq() to get the interrupt Miquel Raynal (4): spi: mxic: Fix the transmit path dt-bindings: mtd: nand-controller: Fix the reg property description dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: spi: mxic: The interrupt property is not mandatory Mohan Kumar (1): ALSA: hda: Avoid unsol event during RPM suspending Muhammad Usama Anjum (1): selftests/x86: Add validity check and allow field splitting Namhyung Kim (1): bpf: Adjust BPF stack helper functions to accommodate skip > 0 Neil Armstrong (1): drm/bridge: dw-hdmi: use safe format when first in bridge chain NeilBrown (1): SUNRPC: avoid race between mod_timer() and del_timer_sync() Niels Dossche (1): Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed Nikita Shubin (1): riscv: Fix fill_callchain return value Niklas Söderlund (1): samples/bpf, xdpsock: Fix race when running for fix duration of time Nilesh Javali (1): scsi: qla2xxx: Fix warning for missing error code Nishanth Menon (4): arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt Olga Kornievskaia (1): NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error Oliver Hartkopp (5): can: isotp: sanitize CAN ID checks in isotp_bind() vxcan: enable local echo for sent CAN frames can: isotp: return -EADDRNOTAVAIL when reading from unbound socket can: isotp: support MSG_TRUNC flag when reading from socket can: isotp: restore accidentally removed MSG_PEEK feature Ondrej Zary (1): media: bttv: fix WARNING regression on tunerless devices Pablo Neira Ayuso (1): netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options Pali Rohár (1): PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge Paolo Valente (1): Revert "Revert "block, bfq: honor already-setup queue merges"" Patrick Rudolph (1): hwmon: (pmbus) Add mutex to regulator ops Paul Kocialkowski (1): ARM: dts: sun8i: v3s: Move the csi1 block to follow address order Paul Menzel (1): lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 Paulo Alcantara (2): cifs: prevent bad output lengths in smb2_ioctl_query_info() cifs: fix NULL ptr dereference in smb2_ioctl_query_info() Pavel Begunkov (1): io_uring: fix memory leak of uid in files registration Pavel Kubelun (1): ARM: dts: qcom: ipq4019: fix sleep clock Pavel Skripkin (6): udmabuf: validate ubuf->pagecount Bluetooth: hci_serdev: call init_rwsem() before p->open() ath9k_htc: fix uninit value bugs jfs: fix divide error in dbNextAG media: Revert "media: em28xx: add missing em28xx_close_extension" can: mcba_usb: properly check endpoint type Peiwei Hu (1): media: ir_toy: free before error exiting Pekka Pessi (1): mailbox: tegra-hsp: Flush whole channel Peng Liu (1): kunit: make kunit_test_timeout compatible with comment Peter Rosin (1): i2c: mux: demux-pinctrl: do not deactivate a master that is not active Petr Machata (1): af_netlink: Fix shift out of bounds in group mask calculation Petr Vorel (1): crypto: vmx - add missing dependencies Pierre-Louis Bossart (1): ASoC: generic: simple-card-utils: remove useless assignment Prashant Malani (1): platform/chrome: cros_ec_typec: Check for EC device Qais Yousef (1): sched/core: Export pelt_thermal_tp Quinn Tran (7): scsi: qla2xxx: Fix stuck session in gpdb scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Reduce false trigger to login Rafael J. Wysocki (2): ACPICA: Avoid walking the ACPI Namespace if it is not there ACPI: CPPC: Avoid out of bounds access when parsing _CPC data Randy Dunlap (20): hv: utils: add PTP_1588_CLOCK to Kconfig to fix build EVM: fix the evm= __setup handler return value PM: hibernate: fix __setup handler error handling PM: suspend: fix return value of __setup handler ACPI: APEI: fix return value of __setup handlers clocksource: acpi_pm: fix return value of __setup handler printk: fix return value of printk.devkmsg __setup handler m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined TOMOYO: fix __setup handlers return values mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n MIPS: RB532: fix return value of __setup handler dma-debug: fix return value of __setup handlers tty: hvc: fix return value of __setup handler kgdboc: fix return value of __setup handler kgdbts: fix return value of __setup handler driver core: dd: fix return value of __setup handler mm/mmap: return 1 from stack_guard_gap __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/memcontrol: return 1 from cgroup.memory __setup() handler mm/usercopy: return 1 from hardened_usercopy __setup() handler Richard Guy Briggs (1): audit: log AUDIT_TIME_* records only from rules Richard Haines (1): selinux: allow FIOCLEX and FIONCLEX with policy capability Richard Leitner (1): ARM: tegra: tamonten: Fix I2C3 pad setting Richard Schleich (2): ARM: dts: bcm2837: Add the missing L1/L2 cache information ARM: dts: bcm2711: Add the missing L1/L2 cache information Rik van Riel (2): mm: invalidate hwpoison page cache page in fault path mm,hwpoison: unmap poisoned page before invalidation Ritesh Harjani (3): ext4: fix ext4_fc_stats trace point ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit Rob Herring (1): arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly Robert Hancock (3): ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting i2c: xiic: Make bus names unique net: axienet: fix RX ring refill allocation failure handling Robert Marko (1): clk: qcom: ipq8074: fix PCI-E clock oops Robin Gong (1): mailbox: imx: fix wakeup failure from freeze mode Robin Murphy (1): iommu/iova: Improve 32-bit free space estimate Roman Li (1): drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug Sakari Ailus (1): ACPI: properties: Consistently return -ENOENT if there are no more references Sam Ravnborg (1): video: fbdev: controlfb: Fix set but not used warnings Saurav Kashyap (1): scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() Sean Christopherson (1): KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU Sean Nyekjaer (1): mtd: rawnand: protect access to rawnand devices while in suspend Sean Young (1): media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC Shannon Nelson (1): ionic: fix type complaint in ionic_dev_cmd_clean() Shengjiu Wang (2): ASoC: fsl_spdif: Disable TX clock when stop ASoC: soc-core: skip zero num_dai component in searching dai name Shin'ichiro Kawasaki (1): block: limit request dispatch loop duration Si-Wei Liu (1): vdpa/mlx5: should verify CTRL_VQ feature exists for MQ Souptick Joarder (HPE) (1): irqchip/nvic: Release nvic_base upon failure Srinivas Kandagatla (1): ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put Srinivas Pandruvada (1): thermal: int340x: Increase bitmap size Stefano Garzarella (1): tools/virtio: fix virtio_test execution Sunil Goutham (1): hwrng: cavium - Check health status while reading random data Sven Eckelmann (1): batman-adv: Check ptr for NULL before reducing its refcnt Takashi Iwai (1): ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock Takashi Sakamoto (1): ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction Taniya Das (2): clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: qcom: clk-rcg2: Update the frac table for pixel clock Theodore Ts'o (1): ext4: don't BUG if someone dirty pages without asking ext4 first Thomas Bracht Laumann Jespersen (1): scripts/dtc: Call pkg-config POSIXly correct Tim Gardner (1): video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow Tobias Waldekranz (1): net: dsa: mv88e6xxx: Enable port policy support on 6097 Tom Rix (5): media: video/hdmi: handle short reads of hdmi info frame. drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function qlcnic: dcb: default to returning -EOPNOTSUPP can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value rtc: check if __rtc_read_time was successful Tomas Paukrt (1): crypto: mxs-dcp - Fix scatterlist processing Tong Zhang (1): dax: make sure inodes are flushed before destroy cache Trond Myklebust (3): NFS: Use of mapping_set_error() results in spurious errors NFS: Return valid errors from nfs2/3_decode_dirent() NFSv4/pNFS: Fix another issue with a list iterator pointing to the head Tsuchiya Yuto (1): media: atomisp: fix dummy_ptr check to avoid duplicate active_bo Tudor Ambarus (1): ARM: dts: at91: sama5d2: Fix PMERRLOC resource size Ulf Hansson (1): mmc: host: Return an error when ->enable_sdio_irq() ops is missing Uwe Kleine-König (5): vfio: platform: simplify device removal amba: Make the remove callback return void pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() serial: 8250: Fix race condition in RTS-after-send handling ARM: mmp: Fix failure to remove sram device Vijay Balakrishna (1): arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones Vitaly Kuznetsov (1): KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated Vladimir Oltean (1): net: enetc: report software timestamping via SO_TIMESTAMPING Waiman Long (2): locking/lockdep: Avoid potential access of invalid memory in lock_class locking/lockdep: Iterate lock_classes directly when reading lockdep files Wang Hai (2): video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() wireguard: socket: free skb in send6 when ipv6 is disabled Wang Wensheng (1): ASoC: imx-es8328: Fix error return code in imx_es8328_probe() Wen Gong (1): ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern Xiang Chen (1): scsi: hisi_sas: Change permission of parameter prot_mask Xiaomeng Tong (2): ALSA: cs4236: fix an incorrect NULL check on list iterator net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator Xie Yongji (1): virtio-blk: Use blk_validate_block_size() to validate block size Xin Long (1): udp: call udp_encap_enable for v6 sockets when enabling encap Xin Xiong (1): mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init Xu Kuohai (1): libbpf: Skip forward declaration when counting duplicated type names Yafang Shao (1): libbpf: Fix possible NULL pointer dereference when destroying skeleton Yake Yang (1): Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt Yaliang Wang (1): MIPS: pgalloc: fix memory leak caused by pgd_free() Yang Guang (1): video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit Yang Yingliang (3): media: saa7134: convert list_for_each to entry variant ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() Yangtao Li (1): fsi: aspeed: convert to devm_platform_ioremap_resource Ye Bin (1): ext4: fix fs corruption when tring to remove a non-empty directory with IO error Yi Wang (1): KVM: SVM: fix panic on out-of-bounds guest IRQ Yiqing Yao (1): drm/amd/pm: enable pm sysfs write for one VF mode Yongzhi Liu (1): RDMA/mlx5: Fix memory leak in error flow for subscribe event routine YueHaibing (1): video: fbdev: controlfb: Fix COMPILE_TEST build Z. Liu (1): video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen Zhang Yi (1): ext2: correct max file size computing Zhenzhong Duan (1): KVM: x86: Fix emulation in writing cr8 Zheyu Ma (2): ethernet: sun: Free the coherent when failing in probing video: fbdev: sm712fb: Fix crash in smtcfb_write() Zhou Qingyang (2): drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() kernel test robot (1): regulator: qcom_smd: fix for_each_child.cocci warnings lic121 (1): libbpf: Unmap rings when umem deleted Documentation/admin-guide/sysctl/kernel.rst | 1 + .../bindings/mtd/nand-controller.yaml | 4 +- .../devicetree/bindings/spi/spi-mxic.txt | 4 +- Documentation/process/stable-kernel-rules.rst | 11 +- Documentation/sound/hd-audio/models.rst | 4 + arch/arc/kernel/process.c | 2 +- arch/arm/boot/dts/bcm2711.dtsi | 50 +++++ arch/arm/boot/dts/bcm2837.dtsi | 49 ++++ arch/arm/boot/dts/dra7-l4.dtsi | 5 +- arch/arm/boot/dts/dra7.dtsi | 8 +- arch/arm/boot/dts/exynos5250-pinctrl.dtsi | 2 +- arch/arm/boot/dts/exynos5250-smdk5250.dts | 3 + arch/arm/boot/dts/exynos5420-smdk5420.dts | 3 + arch/arm/boot/dts/imx53-m53menlo.dts | 29 ++- arch/arm/boot/dts/imx7-colibri.dtsi | 4 +- arch/arm/boot/dts/imx7-mba7.dtsi | 2 +- arch/arm/boot/dts/imx7d-nitrogen7.dts | 2 +- arch/arm/boot/dts/imx7d-pico-hobbit.dts | 4 +- arch/arm/boot/dts/imx7d-pico-pi.dts | 4 +- arch/arm/boot/dts/imx7d-sdb.dts | 4 +- arch/arm/boot/dts/imx7s-warp.dts | 4 +- arch/arm/boot/dts/qcom-ipq4019.dtsi | 3 +- arch/arm/boot/dts/qcom-msm8960.dtsi | 8 +- arch/arm/boot/dts/sama5d2.dtsi | 2 +- arch/arm/boot/dts/spear1340.dtsi | 6 +- arch/arm/boot/dts/spear13xx.dtsi | 6 +- arch/arm/boot/dts/sun8i-v3s.dtsi | 22 +- arch/arm/boot/dts/tegra20-tamonten.dtsi | 6 +- arch/arm/configs/multi_v5_defconfig | 1 + arch/arm/crypto/Kconfig | 2 + arch/arm/kernel/entry-ftrace.S | 51 ++--- arch/arm/kernel/swp_emulate.c | 2 +- arch/arm/kernel/traps.c | 2 +- .../mach-iop32x/include/mach/entry-macro.S | 2 +- arch/arm/mach-iop32x/include/mach/irqs.h | 2 +- arch/arm/mach-iop32x/irq.c | 6 +- arch/arm/mach-iop32x/irqs.h | 60 ++--- arch/arm/mach-mmp/sram.c | 22 +- arch/arm/mach-mstar/Kconfig | 1 + arch/arm/mach-s3c/mach-jive.c | 6 +- .../boot/dts/broadcom/northstar2/ns2-svk.dts | 8 +- .../boot/dts/broadcom/northstar2/ns2.dtsi | 2 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 8 +- arch/arm64/boot/dts/qcom/sm8150.dtsi | 6 +- .../boot/dts/rockchip/rk3399-firefly.dts | 4 +- arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-am65.dtsi | 1 + arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-j7200.dtsi | 1 + arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-j721e.dtsi | 1 + arch/arm64/configs/defconfig | 2 +- arch/arm64/kernel/signal.c | 10 +- arch/arm64/mm/init.c | 36 ++- arch/arm64/mm/mmu.c | 36 ++- arch/arm64/net/bpf_jit_comp.c | 18 +- arch/csky/kernel/perf_callchain.c | 2 +- arch/csky/kernel/signal.c | 2 +- arch/m68k/coldfire/device.c | 6 +- arch/microblaze/include/asm/uaccess.h | 18 +- arch/mips/dec/int-handler.S | 6 +- arch/mips/dec/prom/Makefile | 2 +- arch/mips/dec/setup.c | 3 +- arch/mips/include/asm/dec/prom.h | 15 +- arch/mips/include/asm/pgalloc.h | 6 + arch/mips/rb532/devices.c | 6 +- arch/nios2/include/asm/uaccess.h | 26 ++- arch/nios2/kernel/signal.c | 20 +- arch/parisc/include/asm/traps.h | 1 + arch/parisc/kernel/traps.c | 2 + arch/parisc/mm/fault.c | 89 ++++++++ arch/powerpc/Makefile | 2 +- arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts | 30 +++ arch/powerpc/boot/dts/fsl/t1040rdb.dts | 8 +- arch/powerpc/include/asm/io.h | 40 +++- arch/powerpc/include/asm/uaccess.h | 3 + arch/powerpc/kernel/kvm.c | 2 +- arch/powerpc/kvm/book3s_hv.c | 5 +- arch/powerpc/kvm/powerpc.c | 4 +- arch/powerpc/lib/sstep.c | 12 +- arch/powerpc/mm/kasan/kasan_init_32.c | 3 +- arch/powerpc/mm/numa.c | 4 +- arch/powerpc/perf/imc-pmu.c | 6 +- arch/powerpc/platforms/8xx/pic.c | 1 + arch/powerpc/platforms/powernv/rng.c | 6 +- arch/powerpc/sysdev/fsl_gtm.c | 4 +- arch/riscv/include/asm/module.lds.h | 6 +- arch/riscv/include/asm/thread_info.h | 10 +- arch/riscv/kernel/perf_callchain.c | 6 +- arch/sparc/kernel/signal_32.c | 2 +- arch/um/drivers/mconsole_kern.c | 3 +- arch/x86/events/intel/pt.c | 2 +- arch/x86/kernel/kvm.c | 2 +- arch/x86/kvm/emulate.c | 14 +- arch/x86/kvm/hyperv.c | 9 +- arch/x86/kvm/lapic.c | 5 +- arch/x86/kvm/mmu/tdp_mmu.c | 3 + arch/x86/kvm/svm/avic.c | 10 +- arch/x86/xen/pmu.c | 10 +- arch/x86/xen/pmu.h | 3 +- arch/x86/xen/smp_pv.c | 2 +- arch/xtensa/include/asm/processor.h | 4 +- arch/xtensa/kernel/jump_label.c | 2 +- block/bfq-iosched.c | 16 +- block/blk-mq-sched.c | 9 +- block/blk-sysfs.c | 8 +- crypto/authenc.c | 2 +- crypto/rsa-pkcs1pad.c | 11 +- drivers/acpi/acpica/nswalk.c | 3 + drivers/acpi/apei/bert.c | 10 +- drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/hest.c | 2 +- drivers/acpi/cppc_acpi.c | 5 + drivers/acpi/property.c | 2 +- drivers/amba/bus.c | 5 +- drivers/base/dd.c | 2 +- drivers/base/power/main.c | 6 +- drivers/block/drbd/drbd_req.c | 3 +- drivers/block/loop.c | 10 +- drivers/block/virtio_blk.c | 12 +- drivers/bluetooth/btmtksdio.c | 4 +- drivers/bluetooth/hci_serdev.c | 3 +- drivers/bus/mips_cdmm.c | 1 + drivers/char/hw_random/Kconfig | 2 +- drivers/char/hw_random/atmel-rng.c | 1 + drivers/char/hw_random/cavium-rng-vf.c | 194 +++++++++++++++- drivers/char/hw_random/cavium-rng.c | 11 +- drivers/char/hw_random/nomadik-rng.c | 7 +- drivers/char/tpm/tpm-chip.c | 46 +--- drivers/char/tpm/tpm.h | 2 + drivers/char/tpm/tpm2-space.c | 65 ++++++ drivers/char/virtio_console.c | 7 + drivers/clk/actions/owl-s700.c | 1 + drivers/clk/actions/owl-s900.c | 2 +- drivers/clk/at91/sama7g5.c | 8 +- drivers/clk/clk-clps711x.c | 2 + drivers/clk/clk.c | 13 ++ drivers/clk/imx/clk-imx7d.c | 1 - drivers/clk/loongson1/clk-loongson1c.c | 1 + drivers/clk/qcom/clk-rcg2.c | 14 +- drivers/clk/qcom/gcc-ipq8074.c | 21 +- drivers/clk/qcom/gcc-msm8994.c | 1 + drivers/clk/tegra/clk-tegra124-emc.c | 1 + .../clk/uniphier/clk-uniphier-fixed-rate.c | 1 + drivers/clocksource/acpi_pm.c | 6 +- drivers/clocksource/exynos_mct.c | 60 +++-- drivers/clocksource/timer-microchip-pit64b.c | 2 +- drivers/clocksource/timer-of.c | 6 +- drivers/clocksource/timer-ti-dm-systimer.c | 4 +- drivers/cpufreq/qcom-cpufreq-nvmem.c | 2 +- .../allwinner/sun8i-ce/sun8i-ce-cipher.c | 3 + .../crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 3 + .../allwinner/sun8i-ss/sun8i-ss-cipher.c | 3 + .../crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 2 + .../crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 3 + drivers/crypto/amlogic/amlogic-gxl-cipher.c | 2 + drivers/crypto/ccp/ccp-dmaengine.c | 16 ++ drivers/crypto/ccree/cc_buffer_mgr.c | 7 + drivers/crypto/ccree/cc_cipher.c | 2 +- drivers/crypto/mxs-dcp.c | 2 +- .../crypto/rockchip/rk3288_crypto_skcipher.c | 1 - drivers/crypto/vmx/Kconfig | 4 + drivers/dax/super.c | 1 + drivers/dma-buf/udmabuf.c | 4 + drivers/dma/hisi_dma.c | 2 +- drivers/dma/pl330.c | 3 +- drivers/firmware/efi/efi-pstore.c | 2 +- drivers/firmware/google/Kconfig | 2 +- drivers/firmware/qcom_scm.c | 6 - drivers/firmware/stratix10-svc.c | 2 +- drivers/fsi/fsi-master-aspeed.c | 21 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +- .../display/dc/irq/dcn21/irq_service_dcn21.c | 14 -- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 4 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 2 +- drivers/gpu/drm/bridge/adv7511/adv7511.h | 1 + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 29 ++- drivers/gpu/drm/bridge/cdns-dsi.c | 1 + drivers/gpu/drm/bridge/nwl-dsi.c | 1 + drivers/gpu/drm/bridge/sil-sii8620.c | 2 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 5 +- drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c | 1 + drivers/gpu/drm/drm_edid.c | 11 +- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 2 +- drivers/gpu/drm/meson/meson_drv.c | 6 +- drivers/gpu/drm/meson/meson_osd_afbcd.c | 41 ++-- drivers/gpu/drm/meson/meson_osd_afbcd.h | 1 + drivers/gpu/drm/mgag200/mgag200_mode.c | 5 +- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 8 + drivers/gpu/drm/msm/dp/dp_display.c | 5 + .../gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c | 9 +- drivers/gpu/drm/panfrost/panfrost_gpu.c | 5 +- drivers/gpu/drm/pl111/pl111_drv.c | 4 +- drivers/gpu/drm/tegra/dsi.c | 4 +- drivers/gpu/host1x/dev.c | 1 + drivers/greybus/svc.c | 8 +- drivers/hid/hid-logitech-dj.c | 1 + drivers/hid/i2c-hid/i2c-hid-core.c | 32 ++- drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 29 +-- drivers/hv/Kconfig | 1 + drivers/hv/hv_balloon.c | 2 +- drivers/hwmon/pmbus/pmbus.h | 1 + drivers/hwmon/pmbus/pmbus_core.c | 18 +- drivers/hwmon/sch56xx-common.c | 2 +- drivers/hwtracing/coresight/coresight-catu.c | 3 +- .../hwtracing/coresight/coresight-cpu-debug.c | 4 +- .../hwtracing/coresight/coresight-cti-core.c | 4 +- drivers/hwtracing/coresight/coresight-etb10.c | 4 +- .../coresight/coresight-etm3x-core.c | 4 +- .../coresight/coresight-etm4x-core.c | 4 +- .../coresight/coresight-etm4x-sysfs.c | 8 +- .../hwtracing/coresight/coresight-funnel.c | 4 +- .../coresight/coresight-replicator.c | 4 +- drivers/hwtracing/coresight/coresight-stm.c | 4 +- .../hwtracing/coresight/coresight-tmc-core.c | 4 +- drivers/hwtracing/coresight/coresight-tpiu.c | 4 +- drivers/i2c/busses/i2c-meson.c | 12 +- drivers/i2c/busses/i2c-nomadik.c | 4 +- drivers/i2c/busses/i2c-xiic.c | 3 +- drivers/i2c/muxes/i2c-demux-pinctrl.c | 5 +- drivers/iio/accel/mma8452.c | 29 ++- drivers/iio/adc/twl6030-gpadc.c | 2 + drivers/iio/afe/iio-rescale.c | 8 +- drivers/iio/inkern.c | 40 +++- drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/verbs.c | 1 + drivers/infiniband/hw/hfi1/verbs.c | 3 +- drivers/infiniband/hw/mlx5/devx.c | 4 +- drivers/infiniband/hw/mlx5/mr.c | 2 + drivers/input/input.c | 6 - drivers/input/serio/ambakmi.c | 3 +- drivers/input/touchscreen/zinitix.c | 44 +++- drivers/iommu/iova.c | 5 +- drivers/iommu/ipmmu-vmsa.c | 4 +- drivers/irqchip/irq-nvic.c | 2 + drivers/irqchip/qcom-pdc.c | 5 +- drivers/mailbox/imx-mailbox.c | 9 + drivers/mailbox/tegra-hsp.c | 5 + drivers/md/dm-crypt.c | 2 +- drivers/md/dm-integrity.c | 6 +- drivers/media/i2c/adv7511-v4l2.c | 2 +- drivers/media/i2c/adv7604.c | 2 +- drivers/media/i2c/adv7842.c | 2 +- drivers/media/pci/bt8xx/bttv-driver.c | 4 +- drivers/media/pci/cx88/cx88-mpeg.c | 3 + drivers/media/pci/ivtv/ivtv-driver.h | 1 - drivers/media/pci/ivtv/ivtv-ioctl.c | 10 +- drivers/media/pci/ivtv/ivtv-streams.c | 11 +- drivers/media/pci/saa7134/saa7134-alsa.c | 8 +- drivers/media/platform/aspeed-video.c | 9 +- drivers/media/platform/coda/coda-common.c | 1 + drivers/media/platform/davinci/vpif.c | 12 +- .../platform/mtk-vcodec/mtk_vcodec_fw_vpu.c | 2 + drivers/media/rc/gpio-ir-tx.c | 28 ++- drivers/media/rc/ir_toy.c | 2 +- .../media/test-drivers/vidtv/vidtv_s302m.c | 17 +- drivers/media/usb/em28xx/em28xx-cards.c | 13 +- drivers/media/usb/go7007/s2250-board.c | 10 +- drivers/media/usb/hdpvr/hdpvr-video.c | 4 +- drivers/media/usb/stk1160/stk1160-core.c | 2 +- drivers/media/usb/stk1160/stk1160-v4l.c | 10 +- drivers/media/usb/stk1160/stk1160.h | 2 +- drivers/media/v4l2-core/v4l2-mem2mem.c | 53 ++++- drivers/memory/emif.c | 8 +- drivers/memory/pl172.c | 4 +- drivers/memory/pl353-smc.c | 4 +- drivers/mfd/asic3.c | 10 +- drivers/mfd/mc13xxx-core.c | 4 +- drivers/misc/cardreader/alcor_pci.c | 9 +- drivers/misc/habanalabs/common/debugfs.c | 2 + drivers/misc/kgdbts.c | 4 +- drivers/misc/mei/hw-me-regs.h | 1 + drivers/misc/mei/interrupt.c | 35 ++- drivers/misc/mei/pci-me.c | 1 + drivers/mmc/core/host.c | 15 +- drivers/mmc/host/davinci_mmc.c | 6 +- drivers/mmc/host/mmci.c | 4 +- drivers/mtd/nand/onenand/generic.c | 7 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 14 +- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 3 + drivers/mtd/nand/raw/nand_base.c | 44 ++-- drivers/net/bareudp.c | 25 +-- drivers/net/can/m_can/m_can.c | 5 +- .../net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +- drivers/net/can/usb/mcba_usb.c | 26 ++- drivers/net/can/vxcan.c | 2 +- drivers/net/dsa/bcm_sf2_cfp.c | 6 +- drivers/net/dsa/microchip/ksz8795_spi.c | 11 + drivers/net/dsa/microchip/ksz9477_spi.c | 12 + drivers/net/dsa/mv88e6xxx/chip.c | 1 + drivers/net/ethernet/8390/mcf8390.c | 10 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- .../ethernet/freescale/enetc/enetc_ethtool.c | 5 +- drivers/net/ethernet/intel/i40e/i40e_xsk.c | 16 +- .../net/ethernet/pensando/ionic/ionic_main.c | 6 +- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 1 + .../net/ethernet/qlogic/qlcnic/qlcnic_dcb.h | 10 +- drivers/net/ethernet/sun/sunhme.c | 6 +- .../net/ethernet/xilinx/xilinx_axienet_main.c | 72 +++--- drivers/net/phy/broadcom.c | 21 ++ drivers/net/wireguard/queueing.c | 3 +- drivers/net/wireguard/socket.c | 5 +- drivers/net/wireless/ath/ath10k/snoc.c | 2 +- drivers/net/wireless/ath/ath10k/wow.c | 7 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 5 + drivers/net/wireless/ath/carl9170/main.c | 2 +- .../broadcom/brcm80211/brcmfmac/firmware.c | 2 + .../broadcom/brcm80211/brcmfmac/pcie.c | 66 ++---- .../net/wireless/intel/iwlwifi/dvm/mac80211.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 +- .../net/wireless/mediatek/mt76/mt7603/main.c | 3 + .../net/wireless/mediatek/mt76/mt7615/main.c | 3 + .../net/wireless/mediatek/mt76/mt7915/mcu.c | 9 +- drivers/net/wireless/ray_cs.c | 6 + drivers/nvdimm/region_devs.c | 3 + drivers/nvme/host/core.c | 9 +- drivers/nvme/host/tcp.c | 40 ++++ drivers/pci/controller/pci-aardvark.c | 4 +- drivers/pci/controller/pci-xgene.c | 35 ++- drivers/pci/hotplug/pciehp_hpc.c | 2 + drivers/pci/quirks.c | 12 + drivers/phy/phy-core-mipi-dphy.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 2 + drivers/pinctrl/mediatek/pinctrl-paris.c | 30 ++- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 185 ++++++++-------- drivers/pinctrl/pinconf-generic.c | 6 +- drivers/pinctrl/pinctrl-rockchip.c | 2 + drivers/pinctrl/renesas/core.c | 5 +- drivers/pinctrl/renesas/pfc-r8a77470.c | 4 +- drivers/pinctrl/samsung/pinctrl-samsung.c | 30 ++- drivers/platform/chrome/Makefile | 3 +- .../platform/chrome/cros_ec_sensorhub_ring.c | 3 +- .../platform/chrome/cros_ec_sensorhub_trace.h | 123 +++++++++++ drivers/platform/chrome/cros_ec_trace.h | 95 -------- drivers/platform/chrome/cros_ec_typec.c | 6 + drivers/platform/x86/huawei-wmi.c | 13 +- drivers/power/reset/gemini-poweroff.c | 4 +- drivers/power/supply/ab8500_fg.c | 4 +- drivers/power/supply/bq24190_charger.c | 7 +- drivers/power/supply/wm8350_power.c | 97 ++++++-- drivers/pwm/pwm-lpc18xx-sct.c | 20 +- drivers/regulator/qcom_smd-regulator.c | 4 +- .../regulator/rpi-panel-attiny-regulator.c | 56 ++++- drivers/remoteproc/qcom_q6v5_adsp.c | 1 + drivers/remoteproc/qcom_q6v5_mss.c | 11 +- drivers/remoteproc/qcom_wcnss.c | 1 + drivers/remoteproc/remoteproc_debugfs.c | 2 +- drivers/rtc/interface.c | 7 +- drivers/rtc/rtc-pl030.c | 4 +- drivers/rtc/rtc-pl031.c | 4 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- drivers/scsi/libsas/sas_ata.c | 2 +- drivers/scsi/pm8001/pm8001_hwi.c | 23 +- drivers/scsi/pm8001/pm80xx_hwi.c | 209 ++++++++++-------- drivers/scsi/qla2xxx/qla_attr.c | 7 +- drivers/scsi/qla2xxx/qla_def.h | 10 +- drivers/scsi/qla2xxx/qla_gs.c | 5 +- drivers/scsi/qla2xxx/qla_init.c | 73 ++++-- drivers/scsi/qla2xxx/qla_iocb.c | 8 +- drivers/scsi/qla2xxx/qla_isr.c | 1 + drivers/scsi/qla2xxx/qla_mbx.c | 14 +- drivers/scsi/qla2xxx/qla_nvme.c | 22 ++ drivers/scsi/qla2xxx/qla_os.c | 8 +- drivers/scsi/qla2xxx/qla_sup.c | 4 +- drivers/scsi/qla2xxx/qla_target.c | 4 +- drivers/soc/qcom/ocmem.c | 1 + drivers/soc/qcom/qcom_aoss.c | 2 +- drivers/soc/qcom/rpmpd.c | 3 + drivers/soc/ti/wkup_m3_ipc.c | 4 +- drivers/soundwire/intel.c | 4 +- drivers/spi/spi-mxic.c | 28 +-- drivers/spi/spi-pl022.c | 5 +- drivers/spi/spi-pxa2xx-pci.c | 17 +- drivers/spi/spi-tegra114.c | 4 + drivers/spi/spi-tegra20-slink.c | 8 +- drivers/spi/spi-zynqmp-gqspi.c | 5 +- drivers/spi/spi.c | 4 +- drivers/staging/iio/adc/ad7280a.c | 4 +- .../staging/media/atomisp/pci/atomisp_acc.c | 28 ++- .../media/atomisp/pci/atomisp_gmin_platform.c | 18 ++ drivers/staging/media/atomisp/pci/hmm/hmm.c | 7 +- .../staging/media/hantro/hantro_h1_jpeg_enc.c | 2 +- drivers/staging/media/hantro/hantro_h1_regs.h | 2 +- drivers/staging/media/meson/vdec/esparser.c | 7 +- .../staging/media/meson/vdec/vdec_helpers.c | 8 +- .../staging/media/meson/vdec/vdec_helpers.h | 4 +- .../staging/media/sunxi/cedrus/cedrus_h264.c | 2 +- .../staging/media/sunxi/cedrus/cedrus_h265.c | 2 +- drivers/staging/media/zoran/zoran.h | 2 +- drivers/staging/media/zoran/zoran_card.c | 86 ++++--- drivers/staging/media/zoran/zoran_device.c | 7 +- drivers/staging/media/zoran/zoran_driver.c | 18 +- drivers/staging/mt7621-dts/gbpc1.dts | 40 ++-- drivers/staging/mt7621-dts/gbpc2.dts | 116 +++++++++- drivers/staging/mt7621-dts/mt7621.dtsi | 26 ++- .../intel/int340x_thermal/int3400_thermal.c | 7 +- drivers/tty/hvc/hvc_iucv.c | 4 +- drivers/tty/mxser.c | 15 +- drivers/tty/serial/8250/8250_dma.c | 11 +- drivers/tty/serial/8250/8250_lpss.c | 28 ++- drivers/tty/serial/8250/8250_mid.c | 19 +- drivers/tty/serial/8250/8250_port.c | 16 +- drivers/tty/serial/amba-pl010.c | 4 +- drivers/tty/serial/amba-pl011.c | 3 +- drivers/tty/serial/kgdboc.c | 6 +- drivers/tty/serial/serial_core.c | 14 ++ drivers/usb/host/xhci-hub.c | 5 +- drivers/usb/host/xhci-mem.c | 2 +- drivers/usb/host/xhci.c | 20 +- drivers/usb/host/xhci.h | 14 +- drivers/usb/serial/Kconfig | 1 + drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 3 + drivers/usb/serial/usb-serial-simple.c | 7 + drivers/usb/storage/ene_ub6250.c | 155 +++++++------ drivers/usb/storage/realtek_cr.c | 2 +- drivers/vdpa/mlx5/net/mlx5_vnet.c | 18 +- drivers/vfio/platform/vfio_amba.c | 15 +- drivers/video/fbdev/amba-clcd.c | 4 +- drivers/video/fbdev/atafb.c | 12 +- drivers/video/fbdev/atmel_lcdfb.c | 11 +- drivers/video/fbdev/cirrusfb.c | 16 +- drivers/video/fbdev/controlfb.c | 6 +- drivers/video/fbdev/core/fbcvt.c | 53 ++--- drivers/video/fbdev/matrox/matroxfb_base.c | 2 +- drivers/video/fbdev/nvidia/nv_i2c.c | 2 +- .../omap2/omapfb/displays/connector-dvi.c | 1 + .../omap2/omapfb/displays/panel-dsi-cm.c | 8 +- .../omapfb/displays/panel-sony-acx565akm.c | 2 +- .../omapfb/displays/panel-tpo-td043mtea1.c | 4 +- drivers/video/fbdev/sm712fb.c | 46 +--- drivers/video/fbdev/smscufx.c | 3 +- drivers/video/fbdev/udlfb.c | 8 +- drivers/video/fbdev/w100fb.c | 15 +- drivers/watchdog/rti_wdt.c | 1 + drivers/watchdog/sp805_wdt.c | 4 +- fs/binfmt_elf.c | 24 +- fs/btrfs/reflink.c | 7 +- fs/cifs/smb2ops.c | 130 ++++++----- fs/coredump.c | 39 +++- fs/exec.c | 26 ++- fs/ext2/super.c | 6 +- fs/ext4/inline.c | 9 +- fs/ext4/inode.c | 25 +++ fs/ext4/mballoc.c | 126 ++++++----- fs/ext4/namei.c | 10 +- fs/f2fs/checkpoint.c | 8 +- fs/f2fs/compress.c | 5 +- fs/f2fs/data.c | 9 +- fs/f2fs/file.c | 5 +- fs/f2fs/gc.c | 4 +- fs/f2fs/inode.c | 1 + fs/f2fs/node.c | 6 +- fs/f2fs/segment.c | 7 + fs/f2fs/super.c | 6 +- fs/f2fs/sysfs.c | 2 +- fs/file.c | 31 ++- fs/gfs2/rgrp.c | 3 +- fs/io_uring.c | 7 +- fs/jfs/jfs_dmap.c | 7 + fs/nfs/callback_proc.c | 27 +-- fs/nfs/callback_xdr.c | 4 - fs/nfs/nfs2xdr.c | 2 +- fs/nfs/nfs3xdr.c | 21 +- fs/nfs/nfs4proc.c | 1 + fs/nfs/pnfs.c | 11 + fs/nfs/pnfs.h | 2 + fs/nfs/write.c | 5 +- fs/nfsd/filecache.c | 6 +- fs/nfsd/nfs4state.c | 12 +- fs/nfsd/nfsproc.c | 2 +- fs/nfsd/xdr.h | 2 +- fs/ntfs/inode.c | 4 + fs/proc/bootconfig.c | 2 + fs/pstore/platform.c | 38 ++-- include/linux/amba/bus.h | 2 +- include/linux/mtd/rawnand.h | 2 + include/linux/pstore.h | 6 +- include/linux/serial_core.h | 2 + include/linux/soc/ti/ti_sci_protocol.h | 2 +- include/linux/sunrpc/xdr.h | 2 + include/net/udp.h | 1 + include/net/udp_tunnel.h | 3 +- include/sound/pcm.h | 1 + include/trace/events/ext4.h | 78 ++++--- include/trace/events/rxrpc.h | 8 +- include/uapi/linux/bpf.h | 12 +- kernel/audit.h | 4 + kernel/auditsc.c | 87 ++++++-- kernel/bpf/stackmap.c | 56 ++--- kernel/debug/kdb/kdb_support.c | 2 +- kernel/dma/debug.c | 4 +- kernel/events/core.c | 3 + kernel/locking/lockdep.c | 38 ++-- kernel/locking/lockdep_internals.h | 6 +- kernel/locking/lockdep_proc.c | 51 ++++- kernel/power/hibernate.c | 2 +- kernel/power/suspend_test.c | 8 +- kernel/printk/printk.c | 6 +- kernel/rseq.c | 9 + kernel/sched/core.c | 1 + kernel/sched/debug.c | 10 - kernel/watch_queue.c | 4 +- lib/kunit/try-catch.c | 2 +- lib/raid6/test/Makefile | 4 +- lib/raid6/test/test.c | 1 - lib/test_kmod.c | 1 + lib/test_lockup.c | 11 +- lib/test_xarray.c | 22 ++ lib/xarray.c | 4 + mm/kmemleak.c | 9 +- mm/madvise.c | 3 +- mm/memcontrol.c | 2 +- mm/memory.c | 17 +- mm/mempolicy.c | 8 +- mm/mmap.c | 2 +- mm/page_alloc.c | 9 +- mm/usercopy.c | 5 +- net/batman-adv/bridge_loop_avoidance.c | 6 + net/batman-adv/distributed-arp-table.c | 3 + net/batman-adv/gateway_client.c | 12 +- net/batman-adv/gateway_client.h | 16 +- net/batman-adv/hard-interface.h | 3 + net/batman-adv/network-coding.c | 6 + net/batman-adv/originator.c | 72 +----- net/batman-adv/originator.h | 96 +++++++- net/batman-adv/soft-interface.c | 15 +- net/batman-adv/soft-interface.h | 16 +- net/batman-adv/tp_meter.c | 3 + net/batman-adv/translation-table.c | 22 +- net/batman-adv/translation-table.h | 18 +- net/batman-adv/tvlv.c | 6 + net/bluetooth/hci_conn.c | 2 + net/can/isotp.c | 69 +++--- net/ipv4/route.c | 18 +- net/ipv4/tcp_output.c | 5 +- net/ipv4/udp.c | 6 + net/ipv6/udp.c | 4 +- net/ipv6/xfrm6_output.c | 16 ++ net/netfilter/nf_conntrack_proto_tcp.c | 17 +- net/netlink/af_netlink.c | 2 + net/openvswitch/conntrack.c | 118 +++++----- net/openvswitch/flow_netlink.c | 4 +- net/rxrpc/ar-internal.h | 15 +- net/rxrpc/call_event.c | 2 +- net/rxrpc/call_object.c | 40 +++- net/sunrpc/xprt.c | 7 + net/tipc/socket.c | 3 +- net/xfrm/xfrm_interface.c | 5 +- samples/bpf/xdpsock_user.c | 5 +- scripts/dtc/Makefile | 2 +- scripts/gcc-plugins/stackleak_plugin.c | 25 ++- security/integrity/evm/evm_main.c | 2 +- security/keys/keyctl_pkey.c | 14 +- security/security.c | 17 +- security/selinux/hooks.c | 11 +- security/selinux/include/policycap.h | 1 + security/selinux/include/policycap_names.h | 3 +- security/selinux/include/security.h | 7 + security/selinux/selinuxfs.c | 2 + security/selinux/xfrm.c | 2 +- security/smack/smack_lsm.c | 2 +- security/tomoyo/load_policy.c | 4 +- sound/arm/aaci.c | 4 +- sound/core/pcm.c | 1 + sound/core/pcm_lib.c | 9 +- sound/core/pcm_native.c | 39 +++- sound/firewire/fcp.c | 4 +- sound/isa/cs423x/cs4236.c | 8 +- sound/pci/hda/patch_hdmi.c | 8 +- sound/pci/hda/patch_realtek.c | 15 +- sound/soc/atmel/atmel_ssc_dai.c | 5 +- sound/soc/atmel/sam9g20_wm8731.c | 1 + sound/soc/atmel/sam9x5_wm8731.c | 16 +- sound/soc/codecs/Kconfig | 5 + sound/soc/codecs/msm8916-wcd-analog.c | 22 +- sound/soc/codecs/msm8916-wcd-digital.c | 5 +- sound/soc/codecs/mt6358.c | 4 + sound/soc/codecs/rt5663.c | 2 + sound/soc/codecs/wcd934x.c | 6 +- sound/soc/codecs/wm8350.c | 28 ++- sound/soc/dwc/dwc-i2s.c | 17 +- sound/soc/fsl/fsl_spdif.c | 2 + sound/soc/fsl/imx-es8328.c | 1 + sound/soc/generic/simple-card-utils.c | 2 +- sound/soc/mxs/mxs-saif.c | 5 +- sound/soc/mxs/mxs-sgtl5000.c | 3 + sound/soc/rockchip/rockchip_i2s.c | 18 +- sound/soc/sh/fsi.c | 19 +- sound/soc/soc-compress.c | 5 + sound/soc/soc-core.c | 2 +- sound/soc/soc-generic-dmaengine-pcm.c | 6 +- sound/soc/soc-topology.c | 3 +- sound/soc/sof/imx/imx8m.c | 1 + sound/soc/sof/intel/hda-loader.c | 11 +- sound/soc/ti/davinci-i2s.c | 5 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 25 +++ sound/spi/at73c213.c | 27 ++- tools/include/uapi/linux/bpf.h | 4 +- tools/lib/bpf/btf_dump.c | 5 + tools/lib/bpf/libbpf.c | 3 + tools/lib/bpf/xsk.c | 11 + .../selftests/bpf/progs/test_sock_fields.c | 2 +- .../testing/selftests/bpf/test_lirc_mode2.sh | 5 +- .../selftests/bpf/test_lwt_ip_encap.sh | 10 +- .../selftests/net/test_vxlan_under_vrf.sh | 8 +- tools/testing/selftests/vm/Makefile | 6 +- tools/testing/selftests/x86/Makefile | 6 +- tools/testing/selftests/x86/check_cc.sh | 2 +- tools/virtio/virtio_test.c | 1 + virt/kvm/kvm_main.c | 13 ++ 613 files changed, 4980 insertions(+), 2512 deletions(-) create mode 100644 arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts create mode 100644 drivers/platform/chrome/cros_ec_sensorhub_trace.h -- 2.20.1

1 557

[PATCH openEuler-1.0-LTS 00/16] intel CVEs fix
by Yongqiang Liu 06 Jul '22

06 Jul '22

CVE-2022-21123,CVE-2022-21125,CVE-2022-21166 Gayatri Kammela (2): x86/cpu: Add Elkhart Lake to Intel family x86/cpu: Add another Alder Lake CPU to the Intel family Guenter Roeck (1): cpu/speculation: Add prototype for cpu_show_srbds() Josh Poimboeuf (1): x86/speculation/mmio: Print SMT warning Pawan Gupta (10): Documentation: Add documentation for Processor MMIO Stale Data x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug x86/speculation: Add a common function for MD_CLEAR mitigation update x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations x86/speculation/mmio: Enable CPU Fill buffer clearing on idle x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data x86/speculation/srbds: Update SRBDS mitigation selection x86/speculation/mmio: Reuse SRBDS mitigation for SBDS KVM: x86/speculation: Disable Fill buffer clear within guests Tony Luck (1): x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family Zhang Rui (1): x86/cpu: Add Jasper Lake to Intel family .../ABI/testing/sysfs-devices-system-cpu | 1 + Documentation/admin-guide/hw-vuln/index.rst | 1 + .../hw-vuln/processor_mmio_stale_data.rst | 246 ++++++++++++++++++ .../admin-guide/kernel-parameters.txt | 36 +++ arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/intel-family.h | 11 + arch/x86/include/asm/msr-index.h | 25 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 235 ++++++++++++++--- arch/x86/kernel/cpu/common.c | 52 +++- arch/x86/kvm/vmx.c | 76 +++++- arch/x86/kvm/x86.c | 4 + drivers/base/cpu.c | 8 + include/linux/cpu.h | 4 + 14 files changed, 662 insertions(+), 40 deletions(-) create mode 100644 Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst -- 2.25.1

1 16

[PATCH openEuler-1.0-LTS 1/4] fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages
by Yongqiang Liu 06 Jul '22

06 Jul '22

From: Zhihao Cheng <chengzhihao1(a)huawei.com> mainline inclusion from mainline-5.19-rc1 commit 68f4c6eba70df70a720188bce95c85570ddfcc87 category: bugfix bugzilla: 186540, https://gitee.com/openeuler/kernel/issues/I55AKK CVE: NA -------------------------------- Commit 505a666ee3fc ("writeback: plug writeback in wb_writeback() and writeback_inodes_wb()") has us holding a plug during wb_writeback, which may cause a potential ABBA dead lock: wb_writeback fat_file_fsync blk_start_plug(&plug) for (;;) { iter i-1: some reqs have been added into plug->mq_list // LOCK A iter i: progress = __writeback_inodes_wb(wb, work) . writeback_sb_inodes // fat's bdev . __writeback_single_inode . . generic_writepages . . __block_write_full_page . . . . __generic_file_fsync . . . . sync_inode_metadata . . . . writeback_single_inode . . . . __writeback_single_inode . . . . fat_write_inode . . . . __fat_write_inode . . . . sync_dirty_buffer // fat's bdev . . . . lock_buffer(bh) // LOCK B . . . . submit_bh . . . . blk_mq_get_tag // LOCK A . . . trylock_buffer(bh) // LOCK B . . . redirty_page_for_writepage . . . wbc->pages_skipped++ . . --wbc->nr_to_write . wrote += write_chunk - wbc.nr_to_write // wrote > 0 . requeue_inode . redirty_tail_locked if (progress) // progress > 0 continue; iter i+1: queue_io // similar process with iter i, infinite for-loop ! } blk_finish_plug(&plug) // flush plug won't be called Above process triggers a hungtask like: [ 399.044861] INFO: task bb:2607 blocked for more than 30 seconds. [ 399.046824] Not tainted 5.18.0-rc1-00005-gefae4d9eb6a2-dirty [ 399.051539] task:bb state:D stack: 0 pid: 2607 ppid: 2426 flags:0x00004000 [ 399.051556] Call Trace: [ 399.051570] __schedule+0x480/0x1050 [ 399.051592] schedule+0x92/0x1a0 [ 399.051602] io_schedule+0x22/0x50 [ 399.051613] blk_mq_get_tag+0x1d3/0x3c0 [ 399.051640] __blk_mq_alloc_requests+0x21d/0x3f0 [ 399.051657] blk_mq_submit_bio+0x68d/0xca0 [ 399.051674] __submit_bio+0x1b5/0x2d0 [ 399.051708] submit_bio_noacct+0x34e/0x720 [ 399.051718] submit_bio+0x3b/0x150 [ 399.051725] submit_bh_wbc+0x161/0x230 [ 399.051734] __sync_dirty_buffer+0xd1/0x420 [ 399.051744] sync_dirty_buffer+0x17/0x20 [ 399.051750] __fat_write_inode+0x289/0x310 [ 399.051766] fat_write_inode+0x2a/0xa0 [ 399.051783] __writeback_single_inode+0x53c/0x6f0 [ 399.051795] writeback_single_inode+0x145/0x200 [ 399.051803] sync_inode_metadata+0x45/0x70 [ 399.051856] __generic_file_fsync+0xa3/0x150 [ 399.051880] fat_file_fsync+0x1d/0x80 [ 399.051895] vfs_fsync_range+0x40/0xb0 [ 399.051929] __x64_sys_fsync+0x18/0x30 In my test, 'need_resched()' (which is imported by 590dca3a71 "fs-writeback: unplug before cond_resched in writeback_sb_inodes") in function 'writeback_sb_inodes()' seldom comes true, unless cond_resched() is deleted from write_cache_pages(). Fix it by correcting wrote number according number of skipped pages in writeback_sb_inodes(). Goto Link to find a reproducer. Link: https://bugzilla.kernel.org/show_bug.cgi?id=215837 Cc: stable(a)vger.kernel.org # v4.3 Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20220510133805.1988292-1-chengzhihao1@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/fs-writeback.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c index 5abb71da2b9a..23a632f02839 100644 --- a/fs/fs-writeback.c +++ b/fs/fs-writeback.c @@ -1568,11 +1568,12 @@ static long writeback_sb_inodes(struct super_block *sb, }; unsigned long start_time = jiffies; long write_chunk; - long wrote = 0; /* count both pages and inodes */ + long total_wrote = 0; /* count both pages and inodes */ while (!list_empty(&wb->b_io)) { struct inode *inode = wb_inode(wb->b_io.prev); struct bdi_writeback *tmp_wb; + long wrote; if (inode->i_sb != sb) { if (work->sb) { @@ -1648,7 +1649,9 @@ static long writeback_sb_inodes(struct super_block *sb, wbc_detach_inode(&wbc); work->nr_pages -= write_chunk - wbc.nr_to_write; - wrote += write_chunk - wbc.nr_to_write; + wrote = write_chunk - wbc.nr_to_write - wbc.pages_skipped; + wrote = wrote < 0 ? 0 : wrote; + total_wrote += wrote; if (need_resched()) { /* @@ -1670,7 +1673,7 @@ static long writeback_sb_inodes(struct super_block *sb, tmp_wb = inode_to_wb_and_lock_list(inode); spin_lock(&inode->i_lock); if (!(inode->i_state & I_DIRTY_ALL)) - wrote++; + total_wrote++; requeue_inode(inode, tmp_wb, &wbc); inode_sync_complete(inode); spin_unlock(&inode->i_lock); @@ -1684,14 +1687,14 @@ static long writeback_sb_inodes(struct super_block *sb, * bail out to wb_writeback() often enough to check * background threshold and other termination conditions. */ - if (wrote) { + if (total_wrote) { if (time_is_before_jiffies(start_time + HZ / 10UL)) break; if (work->nr_pages <= 0) break; } } - return wrote; + return total_wrote; } static long __writeback_inodes_wb(struct bdi_writeback *wb, -- 2.25.1

1 3

[PATCH openEuler-5.10-LTS 01/30] Documentation: Add documentation for Processor MMIO Stale Data
by Zheng Zengkai 05 Jul '22

05 Jul '22

From: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> stable inclusion from stable-v5.10.123 commit f8a85334a57e7842320476ff27be3a5f151da364 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5D5RS CVE: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4419470191386456e0b8ed4eb06a70b0021798a6 upstream Add the admin guide for Processor MMIO stale data vulnerabilities. Signed-off-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Signed-off-by: Borislav Petkov <bp(a)suse.de> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- Documentation/admin-guide/hw-vuln/index.rst | 1 + .../hw-vuln/processor_mmio_stale_data.rst | 246 ++++++++++++++++++ 2 files changed, 247 insertions(+) create mode 100644 Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst index ca4dbdd9016d..2adec1e6520a 100644 --- a/Documentation/admin-guide/hw-vuln/index.rst +++ b/Documentation/admin-guide/hw-vuln/index.rst @@ -15,3 +15,4 @@ are configurable at compile, boot or run time. tsx_async_abort multihit.rst special-register-buffer-data-sampling.rst + processor_mmio_stale_data.rst diff --git a/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst new file mode 100644 index 000000000000..9393c50b5afc --- /dev/null +++ b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst @@ -0,0 +1,246 @@ +========================================= +Processor MMIO Stale Data Vulnerabilities +========================================= + +Processor MMIO Stale Data Vulnerabilities are a class of memory-mapped I/O +(MMIO) vulnerabilities that can expose data. The sequences of operations for +exposing data range from simple to very complex. Because most of the +vulnerabilities require the attacker to have access to MMIO, many environments +are not affected. System environments using virtualization where MMIO access is +provided to untrusted guests may need mitigation. These vulnerabilities are +not transient execution attacks. However, these vulnerabilities may propagate +stale data into core fill buffers where the data can subsequently be inferred +by an unmitigated transient execution attack. Mitigation for these +vulnerabilities includes a combination of microcode update and software +changes, depending on the platform and usage model. Some of these mitigations +are similar to those used to mitigate Microarchitectural Data Sampling (MDS) or +those used to mitigate Special Register Buffer Data Sampling (SRBDS). + +Data Propagators +================ +Propagators are operations that result in stale data being copied or moved from +one microarchitectural buffer or register to another. Processor MMIO Stale Data +Vulnerabilities are operations that may result in stale data being directly +read into an architectural, software-visible state or sampled from a buffer or +register. + +Fill Buffer Stale Data Propagator (FBSDP) +----------------------------------------- +Stale data may propagate from fill buffers (FB) into the non-coherent portion +of the uncore on some non-coherent writes. Fill buffer propagation by itself +does not make stale data architecturally visible. Stale data must be propagated +to a location where it is subject to reading or sampling. + +Sideband Stale Data Propagator (SSDP) +------------------------------------- +The sideband stale data propagator (SSDP) is limited to the client (including +Intel Xeon server E3) uncore implementation. The sideband response buffer is +shared by all client cores. For non-coherent reads that go to sideband +destinations, the uncore logic returns 64 bytes of data to the core, including +both requested data and unrequested stale data, from a transaction buffer and +the sideband response buffer. As a result, stale data from the sideband +response and transaction buffers may now reside in a core fill buffer. + +Primary Stale Data Propagator (PSDP) +------------------------------------ +The primary stale data propagator (PSDP) is limited to the client (including +Intel Xeon server E3) uncore implementation. Similar to the sideband response +buffer, the primary response buffer is shared by all client cores. For some +processors, MMIO primary reads will return 64 bytes of data to the core fill +buffer including both requested data and unrequested stale data. This is +similar to the sideband stale data propagator. + +Vulnerabilities +=============== +Device Register Partial Write (DRPW) (CVE-2022-21166) +----------------------------------------------------- +Some endpoint MMIO registers incorrectly handle writes that are smaller than +the register size. Instead of aborting the write or only copying the correct +subset of bytes (for example, 2 bytes for a 2-byte write), more bytes than +specified by the write transaction may be written to the register. On +processors affected by FBSDP, this may expose stale data from the fill buffers +of the core that created the write transaction. + +Shared Buffers Data Sampling (SBDS) (CVE-2022-21125) +---------------------------------------------------- +After propagators may have moved data around the uncore and copied stale data +into client core fill buffers, processors affected by MFBDS can leak data from +the fill buffer. It is limited to the client (including Intel Xeon server E3) +uncore implementation. + +Shared Buffers Data Read (SBDR) (CVE-2022-21123) +------------------------------------------------ +It is similar to Shared Buffer Data Sampling (SBDS) except that the data is +directly read into the architectural software-visible state. It is limited to +the client (including Intel Xeon server E3) uncore implementation. + +Affected Processors +=================== +Not all the CPUs are affected by all the variants. For instance, most +processors for the server market (excluding Intel Xeon E3 processors) are +impacted by only Device Register Partial Write (DRPW). + +Below is the list of affected Intel processors [#f1]_: + + =================== ============ ========= + Common name Family_Model Steppings + =================== ============ ========= + HASWELL_X 06_3FH 2,4 + SKYLAKE_L 06_4EH 3 + BROADWELL_X 06_4FH All + SKYLAKE_X 06_55H 3,4,6,7,11 + BROADWELL_D 06_56H 3,4,5 + SKYLAKE 06_5EH 3 + ICELAKE_X 06_6AH 4,5,6 + ICELAKE_D 06_6CH 1 + ICELAKE_L 06_7EH 5 + ATOM_TREMONT_D 06_86H All + LAKEFIELD 06_8AH 1 + KABYLAKE_L 06_8EH 9 to 12 + ATOM_TREMONT 06_96H 1 + ATOM_TREMONT_L 06_9CH 0 + KABYLAKE 06_9EH 9 to 13 + COMETLAKE 06_A5H 2,3,5 + COMETLAKE_L 06_A6H 0,1 + ROCKETLAKE 06_A7H 1 + =================== ============ ========= + +If a CPU is in the affected processor list, but not affected by a variant, it +is indicated by new bits in MSR IA32_ARCH_CAPABILITIES. As described in a later +section, mitigation largely remains the same for all the variants, i.e. to +clear the CPU fill buffers via VERW instruction. + +New bits in MSRs +================ +Newer processors and microcode update on existing affected processors added new +bits to IA32_ARCH_CAPABILITIES MSR. These bits can be used to enumerate +specific variants of Processor MMIO Stale Data vulnerabilities and mitigation +capability. + +MSR IA32_ARCH_CAPABILITIES +-------------------------- +Bit 13 - SBDR_SSDP_NO - When set, processor is not affected by either the + Shared Buffers Data Read (SBDR) vulnerability or the sideband stale + data propagator (SSDP). +Bit 14 - FBSDP_NO - When set, processor is not affected by the Fill Buffer + Stale Data Propagator (FBSDP). +Bit 15 - PSDP_NO - When set, processor is not affected by Primary Stale Data + Propagator (PSDP). +Bit 17 - FB_CLEAR - When set, VERW instruction will overwrite CPU fill buffer + values as part of MD_CLEAR operations. Processors that do not + enumerate MDS_NO (meaning they are affected by MDS) but that do + enumerate support for both L1D_FLUSH and MD_CLEAR implicitly enumerate + FB_CLEAR as part of their MD_CLEAR support. +Bit 18 - FB_CLEAR_CTRL - Processor supports read and write to MSR + IA32_MCU_OPT_CTRL[FB_CLEAR_DIS]. On such processors, the FB_CLEAR_DIS + bit can be set to cause the VERW instruction to not perform the + FB_CLEAR action. Not all processors that support FB_CLEAR will support + FB_CLEAR_CTRL. + +MSR IA32_MCU_OPT_CTRL +--------------------- +Bit 3 - FB_CLEAR_DIS - When set, VERW instruction does not perform the FB_CLEAR +action. This may be useful to reduce the performance impact of FB_CLEAR in +cases where system software deems it warranted (for example, when performance +is more critical, or the untrusted software has no MMIO access). Note that +FB_CLEAR_DIS has no impact on enumeration (for example, it does not change +FB_CLEAR or MD_CLEAR enumeration) and it may not be supported on all processors +that enumerate FB_CLEAR. + +Mitigation +========== +Like MDS, all variants of Processor MMIO Stale Data vulnerabilities have the +same mitigation strategy to force the CPU to clear the affected buffers before +an attacker can extract the secrets. + +This is achieved by using the otherwise unused and obsolete VERW instruction in +combination with a microcode update. The microcode clears the affected CPU +buffers when the VERW instruction is executed. + +Kernel reuses the MDS function to invoke the buffer clearing: + + mds_clear_cpu_buffers() + +On MDS affected CPUs, the kernel already invokes CPU buffer clear on +kernel/userspace, hypervisor/guest and C-state (idle) transitions. No +additional mitigation is needed on such CPUs. + +For CPUs not affected by MDS or TAA, mitigation is needed only for the attacker +with MMIO capability. Therefore, VERW is not required for kernel/userspace. For +virtualization case, VERW is only needed at VMENTER for a guest with MMIO +capability. + +Mitigation points +----------------- +Return to user space +^^^^^^^^^^^^^^^^^^^^ +Same mitigation as MDS when affected by MDS/TAA, otherwise no mitigation +needed. + +C-State transition +^^^^^^^^^^^^^^^^^^ +Control register writes by CPU during C-state transition can propagate data +from fill buffer to uncore buffers. Execute VERW before C-state transition to +clear CPU fill buffers. + +Guest entry point +^^^^^^^^^^^^^^^^^ +Same mitigation as MDS when processor is also affected by MDS/TAA, otherwise +execute VERW at VMENTER only for MMIO capable guests. On CPUs not affected by +MDS/TAA, guest without MMIO access cannot extract secrets using Processor MMIO +Stale Data vulnerabilities, so there is no need to execute VERW for such guests. + +Mitigation control on the kernel command line +--------------------------------------------- +The kernel command line allows to control the Processor MMIO Stale Data +mitigations at boot time with the option "mmio_stale_data=". The valid +arguments for this option are: + + ========== ================================================================= + full If the CPU is vulnerable, enable mitigation; CPU buffer clearing + on exit to userspace and when entering a VM. Idle transitions are + protected as well. It does not automatically disable SMT. + full,nosmt Same as full, with SMT disabled on vulnerable CPUs. This is the + complete mitigation. + off Disables mitigation completely. + ========== ================================================================= + +If the CPU is affected and mmio_stale_data=off is not supplied on the kernel +command line, then the kernel selects the appropriate mitigation. + +Mitigation status information +----------------------------- +The Linux kernel provides a sysfs interface to enumerate the current +vulnerability status of the system: whether the system is vulnerable, and +which mitigations are active. The relevant sysfs file is: + + /sys/devices/system/cpu/vulnerabilities/mmio_stale_data + +The possible values in this file are: + + .. list-table:: + + * - 'Not affected' + - The processor is not vulnerable + * - 'Vulnerable' + - The processor is vulnerable, but no mitigation enabled + * - 'Vulnerable: Clear CPU buffers attempted, no microcode' + - The processor is vulnerable, but microcode is not updated. The + mitigation is enabled on a best effort basis. + * - 'Mitigation: Clear CPU buffers' + - The processor is vulnerable and the CPU buffer clearing mitigation is + enabled. + +If the processor is vulnerable then the following information is appended to +the above information: + + ======================== =========================================== + 'SMT vulnerable' SMT is enabled + 'SMT disabled' SMT is disabled + 'SMT Host state unknown' Kernel runs in a VM, Host SMT state unknown + ======================== =========================================== + +References +---------- +.. [#f1] Affected Processors + https://www.intel.com/content/www/us/en/developer/topic-technology/software… -- 2.20.1

1 29

[PATCH openEuler-5.10-LTS 000/559] Backport 5.10.110 LTS
by Zheng Zengkai 05 Jul '22

05 Jul '22

Backport 5.10.110 LTS patches from upstream PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" can: m_can: m_can_tx_handler(): fix use after free of skb openvswitch: Fixed nd target mask field in the flow dump. docs: sysctl/kernel: add missing bit to panic_print um: Fix uml_mconsole stop/go ARM: dts: spear13xx: Update SPI dma properties ARM: dts: spear1340: Update serial node properties ASoC: topology: Allow TLV control to be either read or write dt-bindings: spi: mxic: The interrupt property is not mandatory dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: mtd: nand-controller: Fix the reg property description bpf: Fix comment for helper bpf_current_task_under_cgroup() bpf: Adjust BPF stack helper functions to accommodate skip > 0 mm/usercopy: return 1 from hardened_usercopy __setup() handler mm/memcontrol: return 1 from cgroup.memory __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/mmap: return 1 from stack_guard_gap __setup() handler batman-adv: Check ptr for NULL before reducing its refcnt ASoC: soc-compress: Change the check for codec_dai staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet proc: bootconfig: Add null pointer check can: isotp: restore accidentally removed MSG_PEEK feature platform/chrome: cros_ec_typec: Check for EC device ACPI: CPPC: Avoid out of bounds access when parsing _CPC data riscv module: remove (NOLOAD) io_uring: fix memory leak of uid in files registration ARM: iop32x: offset IRQ numbers by 1 ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function pinctrl: pinconf-generic: Print arguments for bias-pull-* watch_queue: Free the page array when watch_queue is dismantled crypto: arm/aes-neonbs-cbc - Select generic cbc and aes mailbox: imx: fix wakeup failure from freeze mode rxrpc: Fix call timer start racing with call destruction gfs2: Make sure FITRIM minlen is rounded up to fs block size rtc: check if __rtc_read_time was successful XArray: Update the LRU list in xas_split() can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value can: mcba_usb: properly check endpoint type XArray: Fix xas_create_range() when multi-order entry present wireguard: socket: ignore v6 endpoints when ipv6 is disabled wireguard: socket: free skb in send6 when ipv6 is disabled wireguard: queueing: use CFI-safe ptr_ring cleanup function ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM KVM: SVM: fix panic on out-of-bounds guest IRQ KVM: x86: fix sending PV IPI KVM: Prevent module exit until all VMs are freed KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated platform: chrome: Split trace include file scsi: qla2xxx: Use correct feature type field during RFF_ID processing scsi: qla2xxx: Reduce false trigger to login scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() scsi: qla2xxx: Check for firmware dump already collected scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Fix warning for missing error code scsi: qla2xxx: Fix wrong FDMI data for 64G adapter scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix stuck session in gpdb powerpc: Fix build errors with newer binutils powerpc/lib/sstep: Fix build errors with newer binutils powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/kasan: Fix early region not updated correctly KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU ALSA: hda/realtek: Add alc256-samsung-headphone fixup media: atomisp: fix bad usage at error handling logic mmc: host: Return an error when ->enable_sdio_irq() ops is missing media: hdpvr: initialize dev->worker at hdpvr_register_videodev media: Revert "media: em28xx: add missing em28xx_close_extension" video: fbdev: sm712fb: Fix crash in smtcfb_write() ARM: mmp: Fix failure to remove sram device ARM: tegra: tamonten: Fix I2C3 pad setting lib/test_lockup: fix kernel pointer check for separate address spaces uaccess: fix type mismatch warnings from access_ok() media: cx88-mpeg: clear interrupt status register before streaming video ASoC: soc-core: skip zero num_dai component in searching dai name ARM: dts: bcm2711: Add the missing L1/L2 cache information video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() arm64: defconfig: build imx-sdma as a module ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk ARM: ftrace: avoid redundant loads or clobbering IP media: atomisp: fix dummy_ptr check to avoid duplicate active_bo media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards ASoC: madera: Add dependencies on MFD ARM: dts: bcm2837: Add the missing L1/L2 cache information ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit video: fbdev: cirrusfb: check pixclock to avoid divide by zero video: fbdev: w100fb: Reset global state video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow media: ir_toy: free before error exiting media: staging: media: zoran: fix various V4L2 compliance errors media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com media: staging: media: zoran: move videodev alloc ntfs: add sanity check on allocation size f2fs: compress: fix to print raw data size in error path of lz4 decompression NFSD: Fix nfsd_breaker_owns_lease() return values f2fs: fix to do sanity check on curseg->alloc_type ext4: don't BUG if someone dirty pages without asking ext4 first ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb locking/lockdep: Iterate lock_classes directly when reading lockdep files spi: tegra20: Use of_device_get_match_data() nvme-tcp: lockdep: annotate in-kernel sockets parisc: Fix handling off probe non-access faults PM: core: keep irq flags in device_pm_check_callbacks() ACPI/APEI: Limit printable size of BERT table data Revert "Revert "block, bfq: honor already-setup queue merges"" lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 ACPICA: Avoid walking the ACPI Namespace if it is not there fs/binfmt_elf: Fix AT_PHDR for unusual ELF files irqchip/nvic: Release nvic_base upon failure irqchip/qcom-pdc: Fix broken locking Fix incorrect type in assignment of ipv6 port for audit loop: use sysfs_emit() in the sysfs xxx show() selinux: allow FIOCLEX and FIONCLEX with policy capability selinux: use correct type for context length pinctrl: npcm: Fix broken references to chip->parent_device gcc-plugins/stackleak: Exactly match strings instead of prefixes regulator: rpi-panel: Handle I2C errors/timing to the Atmel LSM: general protection fault in legacy_parse_param fs: fix fd table size alignment properly lib/test: use after free in register_test_dev_kmod() fs: fd tables have to be multiples of BITS_PER_LONG net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator NFSv4/pNFS: Fix another issue with a list iterator pointing to the head qlcnic: dcb: default to returning -EOPNOTSUPP selftests: test_vxlan_under_vrf: Fix broken test case net: phy: broadcom: Fix brcm_fet_config_init() net: enetc: report software timestamping via SO_TIMESTAMPING xen: fix is_xen_pmu() clk: Initialize orphan req_rate clk: qcom: gcc-msm8994: Fix gpll4 width kdb: Fix the putarea helper function NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options jfs: fix divide error in dbNextAG driver core: dd: fix return value of __setup handler firmware: google: Properly state IOMEM dependency kgdbts: fix return value of __setup handler serial: 8250: fix XOFF/XON sending when DMA is used kgdboc: fix return value of __setup handler tty: hvc: fix return value of __setup handler pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init staging: mt7621-dts: fix GB-PC2 devicetree staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix formatting staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree NFS: remove unneeded check in decode_devicenotify_args() clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver clk: clps711x: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: actions: Terminate clk_div_table with sentinel element nvdimm/region: Fix default alignment for small regions remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma clk: qcom: clk-rcg2: Update the frac table for pixel clock clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: at91: sama7g5: fix parents of PDMCs' GCLK clk: imx7d: Remove audio_mclk_root_clk dma-debug: fix return value of __setup handlers NFS: Return valid errors from nfs2/3_decode_dirent() habanalabs: Add check for pci_enable_device iio: adc: Add check for devm_request_threaded_irq serial: 8250: Fix race condition in RTS-after-send handling NFS: Use of mapping_set_error() results in spurious errors serial: 8250_lpss: Balance reference count for PCI DMA device serial: 8250_mid: Balance reference count for PCI DMA device phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) clk: qcom: ipq8074: Use floor ops for SDCC1 clock pinctrl: renesas: checker: Fix miscalculation of number of states pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel staging:iio:adc:ad7280a: Fix handing of device address bit reversing. iio: mma8452: Fix probe failing when an i2c_device_id is used clk: qcom: ipq8074: fix PCI-E clock oops soundwire: intel: fix wrong register name in intel_shim_wake cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse misc: alcor_pci: Fix an error handling path fsi: Aspeed: Fix a potential double free fsi: aspeed: convert to devm_platform_ioremap_resource pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() mxser: fix xmit_buf leak in activate when LSR == 0xff mfd: asic3: Add missing iounmap() on error asic3_mfd_probe tipc: fix the timer expires after interval 100ms openvswitch: always update flow key after nat tcp: ensure PMTU updates are processed during fastopen net: bcmgenet: Use stronger register read/writes to assure ordering PCI: Avoid broken MSI on SB600 USB devices selftests/bpf/test_lirc_mode2.sh: Exit with proper code i2c: mux: demux-pinctrl: do not deactivate a master that is not active i2c: meson: Fix wrong speed use from probe af_netlink: Fix shift out of bounds in group mask calculation ipv4: Fix route lookups when handling ICMP redirects and PMTU updates Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed selftests/bpf: Fix error reporting from sock_fields programs bareudp: use ipv6_mod_enabled to check if IPv6 enabled can: isotp: support MSG_TRUNC flag when reading from socket can: isotp: return -EADDRNOTAVAIL when reading from unbound socket USB: storage: ums-realtek: fix error code in rts51x_read_mem() samples/bpf, xdpsock: Fix race when running for fix duration of time bpf, sockmap: Fix double uncharge the mem of sk_msg bpf, sockmap: Fix more uncharged while msg has more_data bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full RDMA/mlx5: Fix memory leak in error flow for subscribe event routine mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init MIPS: pgalloc: fix memory leak caused by pgd_free() MIPS: RB532: fix return value of __setup handler mips: cdmm: Fix refcount leak in mips_cdmm_phys_base ath10k: Fix error handling in ath10k_setup_msa_resources vxcan: enable local echo for sent CAN frames powerpc: 8xx: fix a return value error in mpc8xx_pic_init platform/x86: huawei-wmi: check the return value of device_create_file() selftests/bpf: Make test_lwt_ip_encap more stable and faster libbpf: Unmap rings when umem deleted mfd: mc13xxx: Add check for mc13xxx_irq_request powerpc/sysdev: fix incorrect use to determine if list is empty mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n net: axienet: fix RX ring refill allocation failure handling IB/hfi1: Allow larger MTU without AIP power: supply: wm8350-power: Add missing free in free_charger_irq power: supply: wm8350-power: Handle error for wm8350_register_irq i2c: xiic: Make bus names unique hv_balloon: rate-limit "Unhandled message" warning KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() KVM: x86: Fix emulation in writing cr8 powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() libbpf: Skip forward declaration when counting duplicated type names gpu: host1x: Fix a memory leak in 'host1x_remove()' bpf, arm64: Feed byte-offset into bpf line info bpf, arm64: Call build_prologue() first in first JIT pass drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt scsi: hisi_sas: Change permission of parameter prot_mask power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return drm/tegra: Fix reference leak in tegra_dsi_ganged_probe ext2: correct max file size computing TOMOYO: fix __setup handlers return values drm/amd/display: Remove vupdate_int_entry definition RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR scsi: pm8001: Fix abort all task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix command initialization in pm80XX_send_read_log() dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS drm/msm/dpu: fix dp audio condition drm/msm/dpu: add DSPP blocks teardown drm/msm/dp: populate connector of struct dp_panel iwlwifi: mvm: Fix an error code in iwl_mvm_up() iwlwifi: Fix -EIO error code that is never returned dax: make sure inodes are flushed before destroy cache IB/cma: Allow XRC INI QPs to set their local ACK timeout drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug drm/amd/pm: enable pm sysfs write for one VF mode iommu/ipmmu-vmsa: Check for error num after setting mask HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init drm/bridge: dw-hdmi: use safe format when first in bridge chain PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge scripts/dtc: Call pkg-config POSIXly correct net: dsa: mv88e6xxx: Enable port policy support on 6097 mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode powerpc/perf: Don't use perf_hw_context for trace IMC PMU KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch ray_cs: Check ioremap return value power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe i40e: respect metadata on XSK Rx to skb i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb KVM: PPC: Fix vmx/vsx mixup in mmio emulation RDMA/core: Set MR type in ib_reg_user_mr ath9k_htc: fix uninit value bugs drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() ionic: fix type complaint in ionic_dev_cmd_clean() drm/edid: Don't clear formats if using deep color mtd: rawnand: gpmi: fix controller timings setting mtd: onenand: Check for error irq Bluetooth: hci_serdev: call init_rwsem() before p->open() udmabuf: validate ubuf->pagecount libbpf: Fix possible NULL pointer dereference when destroying skeleton drm/panfrost: Check for error num after setting mask ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern drm: bridge: adv7511: Fix ADV7535 HPD enablement drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() mmc: davinci_mmc: Handle error for clk_enable ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe ASoC: imx-es8328: Fix error return code in imx_es8328_probe() ASoC: fsl_spdif: Disable TX clock when stop ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: dmaengine: do not use a NULL prepare_slave_config() callback ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ivtv: fix incorrect device_caps for ivtvfb media: saa7134: fix incorrect use to determine if list is empty media: saa7134: convert list_for_each to entry variant video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ASoC: fsi: Add check for clk_enable ASoC: wm8350: Handle error for wm8350_register_irq ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe media: vidtv: Check for null return of vzalloc media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction memory: emif: check the pointer temp in get_device_details() memory: emif: Add check for setup_interrupts ASoC: soc-compress: prevent the potentially use of null pointer ASoC: dwc-i2s: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: mxs-saif: Handle errors for clk_enable printk: fix return value of printk.devkmsg __setup handler arm64: dts: broadcom: Fix sata nodename arm64: dts: ns2: Fix spi-cpol and spi-cpha property ALSA: spi: Add check for clk_enable() ASoC: ti: davinci-i2s: Add check for clk_enable() ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() uaccess: fix nios2 and microblaze get_user_8() ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put media: cedrus: h264: Fix neighbour info buffer size media: cedrus: H265: Fix neighbour info buffer size media: usb: go7007: s2250-board: fix leak in probe() media: em28xx: initialize refcount before kref_get media: video/hdmi: handle short reads of hdmi info frame. ARM: dts: imx: Add missing LVDS decoder on M53Menlo ARM: dts: sun8i: v3s: Move the csi1 block to follow address order soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc arm64: dts: qcom: sdm845: fix microphone bias properties and values soc: qcom: aoss: remove spurious IRQF_ONESHOT flags soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: qcom: rpmpd: Check for null return of devm_kcalloc ARM: dts: qcom: ipq4019: fix sleep clock firmware: qcom: scm: Remove reassignment to desc following initializer video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() video: fbdev: controlfb: Fix COMPILE_TEST build video: fbdev: controlfb: Fix set but not used warnings video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen media: aspeed: Correct value for h-total-pixels media: hantro: Fix overfill bottom register field name media: meson: vdec: potential dereference of null pointer media: coda: Fix missing put_device() call in coda_get_vdoa_data ASoC: generic: simple-card-utils: remove useless assignment ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting media: bttv: fix WARNING regression on tunerless devices media: mtk-vcodec: potential dereference of null pointer media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size kunit: make kunit_test_timeout compatible with comment selftests, x86: fix how check_cc.sh is being invoked f2fs: fix compressed file start atomic write may cause data corruption f2fs: compress: remove unneeded read when rewrite whole cluster btrfs: fix unexpected error path when reflinking an inline extent f2fs: fix to avoid potential deadlock nfsd: more robust allocation failure handling in nfsd_file_cache_init f2fs: fix missing free nid in f2fs_handle_failed_inode perf/x86/intel/pt: Fix address filter config for 32-bit kernel perf/core: Fix address filter parser for multiple filters rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() sched/core: Export pelt_thermal_tp sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa f2fs: fix to enable ATGC correctly via gc_idle sysfs interface watch_queue: Actually free the watch watch_queue: Fix NULL dereference in error cleanup io_uring: terminate manual loop iterator loop correctly for non-vecs clocksource: acpi_pm: fix return value of __setup handler hwmon: (pmbus) Add Vin unit off handling hwrng: nomadik - Change clk_disable to clk_disable_unprepare amba: Make the remove callback return void vfio: platform: simplify device removal crypto: ccree - Fix use after free in cc_cipher_exit() crypto: ccp - ccp_dmaengine_unregister release dma channels ACPI: APEI: fix return value of __setup handlers clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() clocksource/drivers/timer-microchip-pit64b: Use notrace clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts clocksource/drivers/exynos_mct: Refactor resources allocation clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix crypto: vmx - add missing dependencies crypto: amlogic - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: sun8i-ss - call finalize with bh disabled hwrng: atmel - disable trng on failure path spi: spi-zynqmp-gqspi: Handle error for dma_set_mask PM: suspend: fix return value of __setup handler PM: hibernate: fix __setup handler error handling block: don't delete queue kobject before its children nvme: cleanup __nvme_check_ids hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING hwmon: (pmbus) Add mutex to regulator ops spi: pxa2xx-pci: Balance reference count for PCI DMA device crypto: ccree - don't attempt 0 len DMA mappings EVM: fix the evm= __setup handler return value audit: log AUDIT_TIME_* records only from rules crypto: rockchip - ECB does not need IV selftests/x86: Add validity check and allow field splitting arm64/mm: avoid fixmap race condition when create pud mapping spi: tegra114: Add missing IRQ check in tegra_spi_probe thermal: int340x: Check for NULL after calling kmemdup() crypto: mxs-dcp - Fix scatterlist processing crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: sun8i-ss - really disable hash on A80 hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER hwrng: cavium - Check health status while reading random data selinux: check return value of sel_make_avc_files regulator: qcom_smd: fix for_each_child.cocci warnings PCI: xgene: Revert "PCI: xgene: Fix IB window setup" PCI: pciehp: Clear cmd_busy bit in polling mode drm/i915/gem: add missing boundary check in vm_access brcmfmac: pcie: Fix crashes due to early IRQs brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: firmware: Allocate space for default boardrev in nvram xtensa: fix xtensa_wsr always writing 0 xtensa: fix stop_machine_cpuslocked call in patch_text media: davinci: vpif: fix unbalanced runtime PM enable media: davinci: vpif: fix unbalanced runtime PM get media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC DEC: Limit PMAX memory probing to R3k systems crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - only allow with rsa exec: Force single empty string when argv is empty lib/raid6/test: fix multiple definition linking error thermal: int340x: Increase bitmap size pstore: Don't use semaphores in always-atomic-context code carl9170: fix missing bit-wise or operator for tx_params mgag200 fix memmapsl configuration in GCTL6 register ARM: dts: exynos: add missing HDMI supplies on SMDK5420 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: at91: sama5d2: Fix PMERRLOC resource size video: fbdev: atari: Atari 2 bpp (STe) palette bugfix video: fbdev: sm712fb: Fix crash in smtcfb_read() drm/edid: check basic audio support on CEA extension block block: limit request dispatch loop duration mailbox: tegra-hsp: Flush whole channel ext4: fix fs corruption when tring to remove a non-empty directory with IO error ext4: fix ext4_fc_stats trace point coredump: Also dump first pages of non-executable ELF libraries ACPI: properties: Consistently return -ENOENT if there are no more references arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: signal: nofpsimd: Do not allocate fp/simd context when not available udp: call udp_encap_enable for v6 sockets when enabling encap powerpc/kvm: Fix kvm_use_magic_page can: isotp: sanitize CAN ID checks in isotp_bind() drbd: fix potential silent data corruption dm integrity: set journal entry unused when shrinking device mm/kmemleak: reset tag when compare object pointer mm,hwpoison: unmap poisoned page before invalidation Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" mm: madvise: return correct bytes advised with process_madvise mm: madvise: skip unmapped vma holes passed to process_madvise ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock ALSA: hda: Avoid unsol event during RPM suspending ALSA: cs4236: fix an incorrect NULL check on list iterator cifs: fix NULL ptr dereference in smb2_ioctl_query_info() cifs: prevent bad output lengths in smb2_ioctl_query_info() Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" riscv: Increase stack size under KASAN riscv: Fix fill_callchain return value qed: display VF trust config scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands mempolicy: mbind_range() set_policy() after vma_merge() mm: invalidate hwpoison page cache page in fault path mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node mtd: rawnand: protect access to rawnand devices while in suspend spi: mxic: Fix the transmit path pinctrl: samsung: drop pin banks references on error paths remoteproc: Fix count check in rproc_coredump_write() f2fs: fix to do sanity check on .cp_pack_total_block_count f2fs: quota: fix loop condition at f2fs_quota_sync() f2fs: fix to unlock page correctly in error path of is_alive() NFSD: prevent integer overflow on 32 bit systems NFSD: prevent underflow in nfssvc_decode_writeargs() SUNRPC: avoid race between mod_timer() and del_timer_sync() HID: intel-ish-hid: Use dma_alloc_coherent for firmware update firmware: stratix10-svc: add missing callback parameter on RSU Documentation: update stable tree link Documentation: add link to stable release candidate tree KEYS: fix length validation in keyctl_pkey_params_get_2() clk: uniphier: Fix fixed-rate initialization greybus: svc: fix an error handling bug in gb_svc_hello() iio: inkern: make a best effort on offset calculation iio: inkern: apply consumer scale when no channel scale is available iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: afe: rescale: use s64 for temporary scale calculations coresight: Fix TRCCONFIGR.QE sysfs interface mei: avoid iterator usage outside of list_for_each_entry mei: me: add Alder Lake N device id. xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() xhci: make xhci_handshake timeout for xhci_reset() adjustable xhci: fix runtime PM imbalance in USB2 resume xhci: fix garbage USBSTS being logged in some cases USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c virtio-blk: Use blk_validate_block_size() to validate block size tpm: fix reference counting for struct tpm_chip iommu/iova: Improve 32-bit free space estimate locking/lockdep: Avoid potential access of invalid memory in lock_class net: dsa: microchip: add spi_device_id tables Input: zinitix - do not report shadow fingers spi: Fix erroneous sgs value with min_t() Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" net:mcf8390: Use platform_get_irq() to get the interrupt spi: Fix invalid sgs value gpio: Revert regression in sysfs-gpio (gpiolib.c) ethernet: sun: Free the coherent when failing in probing tools/virtio: fix virtio_test execution vdpa/mlx5: should verify CTRL_VQ feature exists for MQ virtio_console: break out of buf poll on remove ARM: mstar: Select HAVE_ARM_ARCH_TIMER xfrm: fix tunnel model fragmentation behavior HID: logitech-dj: add new lightspeed receiver id hv: utils: add PTP_1588_CLOCK to Kconfig to fix build USB: serial: simple: add Nokia phone driver USB: serial: pl2303: add IBM device IDs already merged(30) arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path KVM: x86/mmu: do compare-and-exchange of gPTE via the user address ubi: fastmap: Return error code if memory allocation fails in add_aeb() ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path ubifs: rename_whiteout: correct old_dir size computing ubifs: Fix to add refcount once page is set private ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() ubifs: setflags: Make dirtied_ino_d 8 bytes aligned ubifs: Add missing iput if do_tmpfile() failed in rename whiteout ubifs: Fix deadlock in concurrent rename whiteout and inode writeback ubifs: rename_whiteout: Fix double free for whiteout_ui->data bfq: fix use-after-free in bfq_dispatch_request net/x25: Fix null-ptr-deref caused by x25_disconnect net: hns3: fix bug when PF set the duplicate MAC address for VFs livepatch: Fix build failure on 32 bits processors bcache: fixup multiple threads crash drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() jffs2: fix memory leak in jffs2_scan_medium jffs2: fix memory leak in jffs2_do_mount_fs jffs2: fix use-after-free in jffs2_clear_xattr_subsystem can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register netdevice: add the case if dev is NULL swiotlb: fix info leak with DMA_FROM_DEVICE block, bfq: don't move oom_bfqq drm/i915/opregion: check port number bounds for SWSCI display power state kabi conflict(8) PCI: Reduce warnings on possible RW1C corruption qed: validate and restrict untrusted VFs vlan promisc mode block: don't merge across cgroup boundaries if blkcg is enabled rseq: Remove broken uapi field layout on 32-bit little endian coredump: Snapshot the vmas in do_coredump coredump: Use the vma snapshot in fill_files_note coredump/elf: Pass coredump_params into fill_note_info coredump: Remove the WARN_ON in dump_vma_snapshot all patches: 597 - 30 - 8 = 559 Aaron Conole (1): openvswitch: always update flow key after nat Aashish Sharma (1): dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS Abel Vesa (2): clk: imx7d: Remove audio_mclk_root_clk ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk Adrian Hunter (2): perf/core: Fix address filter parser for multiple filters perf/x86/intel/pt: Fix address filter config for 32-bit kernel Aharon Landau (1): RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR Akira Kawata (1): fs/binfmt_elf: Fix AT_PHDR for unusual ELF files Alan Stern (1): USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c Alexander Lobakin (2): i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb i40e: respect metadata on XSK Rx to skb Alexander Usyskin (2): mei: me: add Alder Lake N device id. mei: avoid iterator usage outside of list_for_each_entry Alexey Khoroshilov (1): NFS: remove unneeded check in decode_devicenotify_args() Alistair Delva (1): remoteproc: Fix count check in rproc_coredump_write() Alistair Popple (1): mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node Amadeusz Sławiński (1): ASoC: topology: Allow TLV control to be either read or write Amir Goldstein (1): nfsd: more robust allocation failure handling in nfsd_file_cache_init Ammar Faizi (1): ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM Anders Roxell (3): powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/lib/sstep: Fix build errors with newer binutils powerpc: Fix build errors with newer binutils Andre Przywara (1): ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS Andreas Gruenbacher (1): powerpc/kvm: Fix kvm_use_magic_page Andrew Price (1): gfs2: Make sure FITRIM minlen is rounded up to fs block size Andy Shevchenko (3): spi: pxa2xx-pci: Balance reference count for PCI DMA device serial: 8250_mid: Balance reference count for PCI DMA device serial: 8250_lpss: Balance reference count for PCI DMA device Ang Tien Sung (1): firmware: stratix10-svc: add missing callback parameter on RSU Anssi Hannula (3): xhci: fix garbage USBSTS being logged in some cases xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() hv_balloon: rate-limit "Unhandled message" warning Anton Ivanov (1): um: Fix uml_mconsole stop/go Ard Biesheuvel (1): ARM: ftrace: avoid redundant loads or clobbering IP Armin Wolf (1): hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING Arnd Bergmann (4): uaccess: fix nios2 and microblaze get_user_8() uaccess: fix type mismatch warnings from access_ok() lib/test_lockup: fix kernel pointer check for separate address spaces ARM: iop32x: offset IRQ numbers by 1 Arun Easi (2): scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests Arınç ÜNAL (5): staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree staging: mt7621-dts: fix formatting staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix GB-PC2 devicetree staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet Athira Rajeev (1): powerpc/perf: Don't use perf_hw_context for trace IMC PMU Bagas Sanjaya (2): Documentation: add link to stable release candidate tree Documentation: update stable tree link Bartosz Golaszewski (1): Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" Bharata B Rao (1): sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa Biju Das (2): spi: Fix invalid sgs value spi: Fix erroneous sgs value with min_t() Bikash Hazarika (1): scsi: qla2xxx: Fix wrong FDMI data for 64G adapter Bjorn Helgaas (1): PCI: Avoid broken MSI on SB600 USB devices Brandon Wyman (1): hwmon: (pmbus) Add Vin unit off handling Casey Schaufler (2): LSM: general protection fault in legacy_parse_param Fix incorrect type in assignment of ipv6 port for audit Chaitanya Kulkarni (1): loop: use sysfs_emit() in the sysfs xxx show() Chao Yu (6): f2fs: fix to unlock page correctly in error path of is_alive() f2fs: fix to do sanity check on .cp_pack_total_block_count f2fs: fix to enable ATGC correctly via gc_idle sysfs interface f2fs: fix to avoid potential deadlock f2fs: fix to do sanity check on curseg->alloc_type f2fs: compress: fix to print raw data size in error path of lz4 decompression Charan Teja Kalla (3): mm: madvise: skip unmapped vma holes passed to process_madvise mm: madvise: return correct bytes advised with process_madvise Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" Charles Keepax (1): ASoC: madera: Add dependencies on MFD Chen Jingwen (1): powerpc/kasan: Fix early region not updated correctly Chen-Yu Tsai (7): media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: hantro: Fix overfill bottom register field name pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: pinconf-generic: Print arguments for bias-pull-* Chris Leech (1): nvme-tcp: lockdep: annotate in-kernel sockets Christian Göttsche (2): selinux: check return value of sel_make_avc_files selinux: use correct type for context length Christoph Hellwig (1): nvme: cleanup __nvme_check_ids Christophe JAILLET (4): firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined gpu: host1x: Fix a memory leak in 'host1x_remove()' fsi: Aspeed: Fix a potential double free misc: alcor_pci: Fix an error handling path Chuck Lever (1): NFSD: Fix nfsd_breaker_owns_lease() return values Claudiu Beznea (3): net: dsa: microchip: add spi_device_id tables hwrng: atmel - disable trng on failure path clocksource/drivers/timer-microchip-pit64b: Use notrace Codrin Ciubotariu (2): ASoC: dmaengine: do not use a NULL prepare_slave_config() callback clk: at91: sama7g5: fix parents of PDMCs' GCLK Colin Ian King (2): carl9170: fix missing bit-wise or operator for tx_params iwlwifi: Fix -EIO error code that is never returned Cooper Chiou (1): drm/edid: check basic audio support on CEA extension block Corentin Labbe (8): crypto: sun8i-ss - really disable hash on A80 crypto: rockchip - ECB does not need IV crypto: sun8i-ss - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: amlogic - call finalize with bh disabled media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size media: staging: media: zoran: move videodev alloc media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com Dafna Hirschfeld (1): media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED Damien Le Moal (11): scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands scsi: pm8001: Fix command initialization in pm80XX_send_read_log() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix abort all task initialization Dan Carpenter (9): greybus: svc: fix an error handling bug in gb_svc_hello() NFSD: prevent underflow in nfssvc_decode_writeargs() NFSD: prevent integer overflow on 32 bit systems video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() media: usb: go7007: s2250-board: fix leak in probe() iwlwifi: mvm: Fix an error code in iwl_mvm_up() USB: storage: ums-realtek: fix error code in rts51x_read_mem() lib/test: use after free in register_test_dev_kmod() Dan Williams (1): nvdimm/region: Fix default alignment for small regions Daniel González Cabanelas (1): media: cx88-mpeg: clear interrupt status register before streaming video Daniel Henrique Barboza (1): powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() Daniel Palmer (1): ARM: mstar: Select HAVE_ARM_ARCH_TIMER Daniel Thompson (2): soc: qcom: aoss: remove spurious IRQF_ONESHOT flags kdb: Fix the putarea helper function Dario Binacchi (1): mtd: rawnand: gpmi: fix controller timings setting Darren Hart (1): ACPI/APEI: Limit printable size of BERT table data Dave Stevenson (1): regulator: rpi-panel: Handle I2C errors/timing to the Atmel David Engraf (1): arm64: signal: nofpsimd: Do not allocate fp/simd context when not available David Gow (1): firmware: google: Properly state IOMEM dependency David Heidelberg (2): arm64: dts: qcom: sdm845: fix microphone bias properties and values ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 David Howells (3): watch_queue: Fix NULL dereference in error cleanup watch_queue: Actually free the watch rxrpc: Fix call timer start racing with call destruction David Matlack (1): KVM: Prevent module exit until all VMs are freed Dirk Buchwalder (1): clk: qcom: ipq8074: Use floor ops for SDCC1 clock Dirk Müller (1): lib/raid6/test: fix multiple definition linking error Dmitry Baryshkov (3): drm/msm/dpu: add DSPP blocks teardown drm/msm/dpu: fix dp audio condition PM: core: keep irq flags in device_pm_check_callbacks() Dmitry Torokhov (1): HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports Dmitry Vyukov (1): riscv: Increase stack size under KASAN Dongliang Mu (3): media: em28xx: initialize refcount before kref_get ntfs: add sanity check on allocation size media: hdpvr: initialize dev->worker at hdpvr_register_videodev Drew Fustini (1): clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix Dāvis Mosāns (1): crypto: ccp - ccp_dmaengine_unregister release dma channels Eddie James (1): USB: serial: pl2303: add IBM device IDs Eric Biggers (6): KEYS: fix length validation in keyctl_pkey_params_get_2() crypto: rsa-pkcs1pad - only allow with rsa crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() block: don't delete queue kobject before its children Eric Dumazet (2): rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() watch_queue: Free the page array when watch_queue is dismantled Evgeny Novikov (1): video: fbdev: w100fb: Reset global state Fabiano Rosas (2): KVM: PPC: Fix vmx/vsx mixup in mmio emulation KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init Fangrui Song (1): riscv module: remove (NOLOAD) Felix Maurer (1): selftests/bpf: Make test_lwt_ip_encap more stable and faster Fengnan Chang (2): f2fs: compress: remove unneeded read when rewrite whole cluster f2fs: fix compressed file start atomic write may cause data corruption Filipe Manana (1): btrfs: fix unexpected error path when reflinking an inline extent Florian Fainelli (1): net: phy: broadcom: Fix brcm_fet_config_init() Frank Wunderlich (1): arm64: dts: broadcom: Fix sata nodename Geert Uytterhoeven (3): hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel pinctrl: renesas: checker: Fix miscalculation of number of states George Kennedy (1): video: fbdev: cirrusfb: check pixclock to avoid divide by zero Gilad Ben-Yossef (1): crypto: ccree - don't attempt 0 len DMA mappings Guilherme G. Piccoli (1): docs: sysctl/kernel: add missing bit to panic_print Guillaume Nault (1): ipv4: Fix route lookups when handling ICMP redirects and PMTU updates Guillaume Ranquet (1): clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() Guillaume Tucker (1): selftests, x86: fix how check_cc.sh is being invoked Gwendal Grignou (2): HID: intel-ish-hid: Use dma_alloc_coherent for firmware update platform: chrome: Split trace include file Hangbin Liu (2): bareudp: use ipv6_mod_enabled to check if IPv6 enabled selftests/bpf/test_lirc_mode2.sh: Exit with proper code Hangyu Hua (1): powerpc: 8xx: fix a return value error in mpc8xx_pic_init Hans Verkuil (2): ivtv: fix incorrect device_caps for ivtvfb media: staging: media: zoran: fix various V4L2 compliance errors Hans de Goede (3): power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return iio: mma8452: Fix probe failing when an i2c_device_id is used media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards Hector Martin (4): brcmfmac: firmware: Allocate space for default boardrev in nvram brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Fix crashes due to early IRQs Helge Deller (1): video: fbdev: sm712fb: Fix crash in smtcfb_read() Hengqi Chen (1): bpf: Fix comment for helper bpf_current_task_under_cgroup() Henry Lin (1): xhci: fix runtime PM imbalance in USB2 resume Herbert Xu (2): crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: arm/aes-neonbs-cbc - Select generic cbc and aes Hoang Le (1): tipc: fix the timer expires after interval 100ms Hou Tao (2): bpf, arm64: Call build_prologue() first in first JIT pass bpf, arm64: Feed byte-offset into bpf line info Hou Wenlong (1): KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() Hugh Dickins (1): mempolicy: mbind_range() set_policy() after vma_merge() Håkon Bugge (1): IB/cma: Allow XRC INI QPs to set their local ACK timeout Ido Schimmel (1): selftests: test_vxlan_under_vrf: Fix broken test case Ilpo Järvinen (1): serial: 8250: fix XOFF/XON sending when DMA is used Jaegeuk Kim (1): f2fs: fix missing free nid in f2fs_handle_failed_inode Jagan Teki (1): drm: bridge: adv7511: Fix ADV7535 HPD enablement Jakob Koschel (2): media: saa7134: fix incorrect use to determine if list is empty powerpc/sysdev: fix incorrect use to determine if list is empty Jakub Kicinski (1): tcp: ensure PMTU updates are processed during fastopen Jakub Sitnicki (1): selftests/bpf: Fix error reporting from sock_fields programs James Clark (1): coresight: Fix TRCCONFIGR.QE sysfs interface Jammy Huang (1): media: aspeed: Correct value for h-total-pixels Jann Horn (2): coredump: Also dump first pages of non-executable ELF libraries pstore: Don't use semaphores in always-atomic-context code Jason A. Donenfeld (2): wireguard: queueing: use CFI-safe ptr_ring cleanup function wireguard: socket: ignore v6 endpoints when ipv6 is disabled Jens Axboe (1): io_uring: terminate manual loop iterator loop correctly for non-vecs Jeremy Linton (1): net: bcmgenet: Use stronger register read/writes to assure ordering Jernej Skrabec (2): media: cedrus: H265: Fix neighbour info buffer size media: cedrus: h264: Fix neighbour info buffer size Jia-Ju Bai (3): ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() memory: emif: check the pointer temp in get_device_details() platform/x86: huawei-wmi: check the return value of device_create_file() Jianglei Nie (1): crypto: ccree - Fix use after free in cc_cipher_exit() Jianyong Wu (1): arm64/mm: avoid fixmap race condition when create pud mapping Jiasheng Jiang (26): thermal: int340x: Check for NULL after calling kmemdup() spi: spi-zynqmp-gqspi: Handle error for dma_set_mask media: mtk-vcodec: potential dereference of null pointer media: meson: vdec: potential dereference of null pointer soc: qcom: rpmpd: Check for null return of devm_kcalloc ASoC: ti: davinci-i2s: Add check for clk_enable() ALSA: spi: Add check for clk_enable() ASoC: mxs-saif: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: dwc-i2s: Handle errors for clk_enable ASoC: soc-compress: prevent the potentially use of null pointer memory: emif: Add check for setup_interrupts media: vidtv: Check for null return of vzalloc ASoC: wm8350: Handle error for wm8350_register_irq ASoC: fsi: Add check for clk_enable mmc: davinci_mmc: Handle error for clk_enable drm/panfrost: Check for error num after setting mask mtd: onenand: Check for error irq ray_cs: Check ioremap return value iommu/ipmmu-vmsa: Check for error num after setting mask power: supply: wm8350-power: Handle error for wm8350_register_irq power: supply: wm8350-power: Add missing free in free_charger_irq mfd: mc13xxx: Add check for mc13xxx_irq_request iio: adc: Add check for devm_request_threaded_irq habanalabs: Add check for pci_enable_device ASoC: soc-compress: Change the check for codec_dai Jiaxin Yu (1): ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs Jie Hai (1): dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma Jing Yao (3): video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit Jiri Slaby (1): mxser: fix xmit_buf leak in activate when LSR == 0xff Jocelyn Falempe (1): mgag200 fix memmapsl configuration in GCTL6 register Joe Carnuccio (2): scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Check for firmware dump already collected Johan Hovold (3): USB: serial: simple: add Nokia phone driver media: davinci: vpif: fix unbalanced runtime PM get media: davinci: vpif: fix unbalanced runtime PM enable John David Anglin (1): parisc: Fix handling off probe non-access faults Jonathan Cameron (1): staging:iio:adc:ad7280a: Fix handing of device address bit reversing. Jonathan Neuschäfer (5): clk: actions: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: clps711x: Terminate clk_div_table with sentinel element pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() José Expósito (1): Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" Juergen Gross (1): xen: fix is_xen_pmu() Juhyung Park (1): f2fs: quota: fix loop condition at f2fs_quota_sync() Kai-Heng Feng (1): ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 Kees Cook (2): exec: Force single empty string when argv is empty gcc-plugins/stackleak: Exactly match strings instead of prefixes Konrad Dybcio (1): clk: qcom: gcc-msm8994: Fix gpll4 width Krzysztof Kozlowski (5): pinctrl: samsung: drop pin banks references on error paths ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5420 clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts Kuan-Ying Lee (1): mm/kmemleak: reset tag when compare object pointer Kuldeep Singh (3): arm64: dts: ns2: Fix spi-cpol and spi-cpha property ARM: dts: spear1340: Update serial node properties ARM: dts: spear13xx: Update SPI dma properties Kunihiko Hayashi (1): clk: uniphier: Fix fixed-rate initialization Kuogee Hsieh (1): drm/msm/dp: populate connector of struct dp_panel Lars Ellenberg (1): drbd: fix potential silent data corruption Li RongQing (1): KVM: x86: fix sending PV IPI Liam Beguin (4): iio: afe: rescale: use s64 for temporary scale calculations iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: inkern: apply consumer scale when no channel scale is available iio: inkern: make a best effort on offset calculation Libin Yang (1): soundwire: intel: fix wrong register name in intel_shim_wake Liguang Zhang (1): PCI: pciehp: Clear cmd_busy bit in polling mode Lina Wang (1): xfrm: fix tunnel model fragmentation behavior Lino Sanfilippo (1): tpm: fix reference counting for struct tpm_chip Linus Torvalds (2): fs: fd tables have to be multiples of BITS_PER_LONG fs: fix fd table size alignment properly Linus Walleij (1): Input: zinitix - do not report shadow fingers Liu Ying (1): phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) Lorenzo Bianconi (4): mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update Luca Weiss (1): cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse Lucas Tanure (1): i2c: meson: Fix wrong speed use from probe Lucas Zampieri (1): HID: logitech-dj: add new lightspeed receiver id Lv Ruyi (1): proc: bootconfig: Add null pointer check Maciej W. Rozycki (1): DEC: Limit PMAX memory probing to R3k systems Manish Chopra (1): qed: display VF trust config Manish Rangankar (1): scsi: qla2xxx: Use correct feature type field during RFF_ID processing Maor Gottlieb (1): RDMA/core: Set MR type in ib_reg_user_mr Marc Kleine-Budde (1): can: m_can: m_can_tx_handler(): fix use after free of skb Marc Zyngier (4): PCI: xgene: Revert "PCI: xgene: Fix IB window setup" pinctrl: npcm: Fix broken references to chip->parent_device irqchip/qcom-pdc: Fix broken locking PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" Marcel Ziswiler (1): arm64: defconfig: build imx-sdma as a module Marcelo Roberto Jimenez (1): gpio: Revert regression in sysfs-gpio (gpiolib.c) Marek Szyprowski (1): clocksource/drivers/exynos_mct: Refactor resources allocation Marek Vasut (1): ARM: dts: imx: Add missing LVDS decoder on M53Menlo Marijn Suijten (1): firmware: qcom: scm: Remove reassignment to desc following initializer Martin Blumenstingl (1): drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops Martin Varghese (1): openvswitch: Fixed nd target mask field in the flow dump. Mastan Katragadda (1): drm/i915/gem: add missing boundary check in vm_access Mathias Nyman (1): xhci: make xhci_handshake timeout for xhci_reset() adjustable Matt Kramer (1): ALSA: hda/realtek: Add alc256-samsung-headphone fixup Matthew Wilcox (Oracle) (2): XArray: Fix xas_create_range() when multi-order entry present XArray: Update the LRU list in xas_split() Maulik Shah (1): arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc Mauro Carvalho Chehab (1): media: atomisp: fix bad usage at error handling logic Max Filippov (2): xtensa: fix stop_machine_cpuslocked call in patch_text xtensa: fix xtensa_wsr always writing 0 Maxim Kiselev (1): powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch Maxime Ripard (2): drm/edid: Don't clear formats if using deep color clk: Initialize orphan req_rate Maíra Canal (1): drm/amd/display: Remove vupdate_int_entry definition Miaoqian Lin (31): spi: tegra114: Add missing IRQ check in tegra_spi_probe hwrng: nomadik - Change clk_disable to clk_disable_unprepare media: coda: Fix missing put_device() call in coda_get_vdoa_data soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init drm/tegra: Fix reference leak in tegra_dsi_ganged_probe ath10k: Fix error handling in ath10k_setup_msa_resources mips: cdmm: Fix refcount leak in mips_cdmm_phys_base mfd: asic3: Add missing iounmap() on error asic3_mfd_probe remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function Michael Ellerman (1): powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit Michael S. Tsirkin (1): virtio_console: break out of buf poll on remove Michael Schmitz (1): video: fbdev: atari: Atari 2 bpp (STe) palette bugfix Mike Marciniszyn (1): IB/hfi1: Allow larger MTU without AIP Mikulas Patocka (1): dm integrity: set journal entry unused when shrinking device Minghao Chi (1): spi: tegra20: Use of_device_get_match_data() Minghao Chi (CGEL ZTE) (1): net:mcf8390: Use platform_get_irq() to get the interrupt Miquel Raynal (4): spi: mxic: Fix the transmit path dt-bindings: mtd: nand-controller: Fix the reg property description dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: spi: mxic: The interrupt property is not mandatory Mohan Kumar (1): ALSA: hda: Avoid unsol event during RPM suspending Muhammad Usama Anjum (1): selftests/x86: Add validity check and allow field splitting Namhyung Kim (1): bpf: Adjust BPF stack helper functions to accommodate skip > 0 Neil Armstrong (1): drm/bridge: dw-hdmi: use safe format when first in bridge chain NeilBrown (1): SUNRPC: avoid race between mod_timer() and del_timer_sync() Niels Dossche (1): Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed Nikita Shubin (1): riscv: Fix fill_callchain return value Niklas Söderlund (1): samples/bpf, xdpsock: Fix race when running for fix duration of time Nilesh Javali (1): scsi: qla2xxx: Fix warning for missing error code Nishanth Menon (4): arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt Olga Kornievskaia (1): NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error Oliver Hartkopp (5): can: isotp: sanitize CAN ID checks in isotp_bind() vxcan: enable local echo for sent CAN frames can: isotp: return -EADDRNOTAVAIL when reading from unbound socket can: isotp: support MSG_TRUNC flag when reading from socket can: isotp: restore accidentally removed MSG_PEEK feature Ondrej Zary (1): media: bttv: fix WARNING regression on tunerless devices Pablo Neira Ayuso (1): netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options Pali Rohár (1): PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge Paolo Valente (1): Revert "Revert "block, bfq: honor already-setup queue merges"" Patrick Rudolph (1): hwmon: (pmbus) Add mutex to regulator ops Paul Kocialkowski (1): ARM: dts: sun8i: v3s: Move the csi1 block to follow address order Paul Menzel (1): lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 Paulo Alcantara (2): cifs: prevent bad output lengths in smb2_ioctl_query_info() cifs: fix NULL ptr dereference in smb2_ioctl_query_info() Pavel Begunkov (1): io_uring: fix memory leak of uid in files registration Pavel Kubelun (1): ARM: dts: qcom: ipq4019: fix sleep clock Pavel Skripkin (6): udmabuf: validate ubuf->pagecount Bluetooth: hci_serdev: call init_rwsem() before p->open() ath9k_htc: fix uninit value bugs jfs: fix divide error in dbNextAG media: Revert "media: em28xx: add missing em28xx_close_extension" can: mcba_usb: properly check endpoint type Peiwei Hu (1): media: ir_toy: free before error exiting Pekka Pessi (1): mailbox: tegra-hsp: Flush whole channel Peng Liu (1): kunit: make kunit_test_timeout compatible with comment Peter Rosin (1): i2c: mux: demux-pinctrl: do not deactivate a master that is not active Petr Machata (1): af_netlink: Fix shift out of bounds in group mask calculation Petr Vorel (1): crypto: vmx - add missing dependencies Pierre-Louis Bossart (1): ASoC: generic: simple-card-utils: remove useless assignment Prashant Malani (1): platform/chrome: cros_ec_typec: Check for EC device Qais Yousef (1): sched/core: Export pelt_thermal_tp Quinn Tran (7): scsi: qla2xxx: Fix stuck session in gpdb scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Reduce false trigger to login Rafael J. Wysocki (2): ACPICA: Avoid walking the ACPI Namespace if it is not there ACPI: CPPC: Avoid out of bounds access when parsing _CPC data Randy Dunlap (20): hv: utils: add PTP_1588_CLOCK to Kconfig to fix build EVM: fix the evm= __setup handler return value PM: hibernate: fix __setup handler error handling PM: suspend: fix return value of __setup handler ACPI: APEI: fix return value of __setup handlers clocksource: acpi_pm: fix return value of __setup handler printk: fix return value of printk.devkmsg __setup handler m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined TOMOYO: fix __setup handlers return values mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n MIPS: RB532: fix return value of __setup handler dma-debug: fix return value of __setup handlers tty: hvc: fix return value of __setup handler kgdboc: fix return value of __setup handler kgdbts: fix return value of __setup handler driver core: dd: fix return value of __setup handler mm/mmap: return 1 from stack_guard_gap __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/memcontrol: return 1 from cgroup.memory __setup() handler mm/usercopy: return 1 from hardened_usercopy __setup() handler Richard Guy Briggs (1): audit: log AUDIT_TIME_* records only from rules Richard Haines (1): selinux: allow FIOCLEX and FIONCLEX with policy capability Richard Leitner (1): ARM: tegra: tamonten: Fix I2C3 pad setting Richard Schleich (2): ARM: dts: bcm2837: Add the missing L1/L2 cache information ARM: dts: bcm2711: Add the missing L1/L2 cache information Rik van Riel (2): mm: invalidate hwpoison page cache page in fault path mm,hwpoison: unmap poisoned page before invalidation Ritesh Harjani (3): ext4: fix ext4_fc_stats trace point ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit Rob Herring (1): arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly Robert Hancock (3): ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting i2c: xiic: Make bus names unique net: axienet: fix RX ring refill allocation failure handling Robert Marko (1): clk: qcom: ipq8074: fix PCI-E clock oops Robin Gong (1): mailbox: imx: fix wakeup failure from freeze mode Robin Murphy (1): iommu/iova: Improve 32-bit free space estimate Roman Li (1): drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug Sakari Ailus (1): ACPI: properties: Consistently return -ENOENT if there are no more references Sam Ravnborg (1): video: fbdev: controlfb: Fix set but not used warnings Saurav Kashyap (1): scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() Sean Christopherson (1): KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU Sean Nyekjaer (1): mtd: rawnand: protect access to rawnand devices while in suspend Sean Young (1): media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC Shannon Nelson (1): ionic: fix type complaint in ionic_dev_cmd_clean() Shengjiu Wang (2): ASoC: fsl_spdif: Disable TX clock when stop ASoC: soc-core: skip zero num_dai component in searching dai name Shin'ichiro Kawasaki (1): block: limit request dispatch loop duration Si-Wei Liu (1): vdpa/mlx5: should verify CTRL_VQ feature exists for MQ Souptick Joarder (HPE) (1): irqchip/nvic: Release nvic_base upon failure Srinivas Kandagatla (1): ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put Srinivas Pandruvada (1): thermal: int340x: Increase bitmap size Stefano Garzarella (1): tools/virtio: fix virtio_test execution Sunil Goutham (1): hwrng: cavium - Check health status while reading random data Sven Eckelmann (1): batman-adv: Check ptr for NULL before reducing its refcnt Takashi Iwai (1): ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock Takashi Sakamoto (1): ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction Taniya Das (2): clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: qcom: clk-rcg2: Update the frac table for pixel clock Theodore Ts'o (1): ext4: don't BUG if someone dirty pages without asking ext4 first Thomas Bracht Laumann Jespersen (1): scripts/dtc: Call pkg-config POSIXly correct Tim Gardner (1): video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow Tobias Waldekranz (1): net: dsa: mv88e6xxx: Enable port policy support on 6097 Tom Rix (5): media: video/hdmi: handle short reads of hdmi info frame. drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function qlcnic: dcb: default to returning -EOPNOTSUPP can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value rtc: check if __rtc_read_time was successful Tomas Paukrt (1): crypto: mxs-dcp - Fix scatterlist processing Tong Zhang (1): dax: make sure inodes are flushed before destroy cache Trond Myklebust (3): NFS: Use of mapping_set_error() results in spurious errors NFS: Return valid errors from nfs2/3_decode_dirent() NFSv4/pNFS: Fix another issue with a list iterator pointing to the head Tsuchiya Yuto (1): media: atomisp: fix dummy_ptr check to avoid duplicate active_bo Tudor Ambarus (1): ARM: dts: at91: sama5d2: Fix PMERRLOC resource size Ulf Hansson (1): mmc: host: Return an error when ->enable_sdio_irq() ops is missing Uwe Kleine-König (5): vfio: platform: simplify device removal amba: Make the remove callback return void pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() serial: 8250: Fix race condition in RTS-after-send handling ARM: mmp: Fix failure to remove sram device Vitaly Kuznetsov (1): KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated Vladimir Oltean (1): net: enetc: report software timestamping via SO_TIMESTAMPING Waiman Long (2): locking/lockdep: Avoid potential access of invalid memory in lock_class locking/lockdep: Iterate lock_classes directly when reading lockdep files Wang Hai (2): video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() wireguard: socket: free skb in send6 when ipv6 is disabled Wang Wensheng (1): ASoC: imx-es8328: Fix error return code in imx_es8328_probe() Wang Yufen (3): bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full bpf, sockmap: Fix more uncharged while msg has more_data bpf, sockmap: Fix double uncharge the mem of sk_msg Wen Gong (1): ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern Xiang Chen (1): scsi: hisi_sas: Change permission of parameter prot_mask Xiaomeng Tong (2): ALSA: cs4236: fix an incorrect NULL check on list iterator net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator Xie Yongji (1): virtio-blk: Use blk_validate_block_size() to validate block size Xin Long (1): udp: call udp_encap_enable for v6 sockets when enabling encap Xin Xiong (1): mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init Xu Kuohai (1): libbpf: Skip forward declaration when counting duplicated type names Yafang Shao (1): libbpf: Fix possible NULL pointer dereference when destroying skeleton Yake Yang (1): Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt Yaliang Wang (1): MIPS: pgalloc: fix memory leak caused by pgd_free() Yang Guang (1): video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit Yang Yingliang (3): media: saa7134: convert list_for_each to entry variant ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() Yangtao Li (1): fsi: aspeed: convert to devm_platform_ioremap_resource Ye Bin (1): ext4: fix fs corruption when tring to remove a non-empty directory with IO error Yi Wang (1): KVM: SVM: fix panic on out-of-bounds guest IRQ Yiqing Yao (1): drm/amd/pm: enable pm sysfs write for one VF mode Yongzhi Liu (1): RDMA/mlx5: Fix memory leak in error flow for subscribe event routine YueHaibing (1): video: fbdev: controlfb: Fix COMPILE_TEST build Z. Liu (1): video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen Zhang Yi (1): ext2: correct max file size computing Zhenzhong Duan (1): KVM: x86: Fix emulation in writing cr8 Zheyu Ma (2): ethernet: sun: Free the coherent when failing in probing video: fbdev: sm712fb: Fix crash in smtcfb_write() Zhou Qingyang (2): drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() kernel test robot (1): regulator: qcom_smd: fix for_each_child.cocci warnings lic121 (1): libbpf: Unmap rings when umem deleted Documentation/admin-guide/sysctl/kernel.rst | 1 + .../bindings/mtd/nand-controller.yaml | 4 +- .../devicetree/bindings/spi/spi-mxic.txt | 4 +- Documentation/process/stable-kernel-rules.rst | 11 +- Documentation/sound/hd-audio/models.rst | 4 + arch/arc/kernel/process.c | 2 +- arch/arm/boot/dts/bcm2711.dtsi | 50 +++++ arch/arm/boot/dts/bcm2837.dtsi | 49 ++++ arch/arm/boot/dts/dra7-l4.dtsi | 5 +- arch/arm/boot/dts/dra7.dtsi | 8 +- arch/arm/boot/dts/exynos5250-pinctrl.dtsi | 2 +- arch/arm/boot/dts/exynos5250-smdk5250.dts | 3 + arch/arm/boot/dts/exynos5420-smdk5420.dts | 3 + arch/arm/boot/dts/imx53-m53menlo.dts | 29 ++- arch/arm/boot/dts/imx7-colibri.dtsi | 4 +- arch/arm/boot/dts/imx7-mba7.dtsi | 2 +- arch/arm/boot/dts/imx7d-nitrogen7.dts | 2 +- arch/arm/boot/dts/imx7d-pico-hobbit.dts | 4 +- arch/arm/boot/dts/imx7d-pico-pi.dts | 4 +- arch/arm/boot/dts/imx7d-sdb.dts | 4 +- arch/arm/boot/dts/imx7s-warp.dts | 4 +- arch/arm/boot/dts/qcom-ipq4019.dtsi | 3 +- arch/arm/boot/dts/qcom-msm8960.dtsi | 8 +- arch/arm/boot/dts/sama5d2.dtsi | 2 +- arch/arm/boot/dts/spear1340.dtsi | 6 +- arch/arm/boot/dts/spear13xx.dtsi | 6 +- arch/arm/boot/dts/sun8i-v3s.dtsi | 22 +- arch/arm/boot/dts/tegra20-tamonten.dtsi | 6 +- arch/arm/configs/multi_v5_defconfig | 1 + arch/arm/crypto/Kconfig | 2 + arch/arm/kernel/entry-ftrace.S | 51 ++--- arch/arm/kernel/swp_emulate.c | 2 +- arch/arm/kernel/traps.c | 2 +- .../mach-iop32x/include/mach/entry-macro.S | 2 +- arch/arm/mach-iop32x/include/mach/irqs.h | 2 +- arch/arm/mach-iop32x/irq.c | 6 +- arch/arm/mach-iop32x/irqs.h | 60 ++--- arch/arm/mach-mmp/sram.c | 22 +- arch/arm/mach-mstar/Kconfig | 1 + arch/arm/mach-s3c/mach-jive.c | 6 +- .../boot/dts/broadcom/northstar2/ns2-svk.dts | 8 +- .../boot/dts/broadcom/northstar2/ns2.dtsi | 2 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 8 +- arch/arm64/boot/dts/qcom/sm8150.dtsi | 6 +- .../boot/dts/rockchip/rk3399-firefly.dts | 4 +- arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-am65.dtsi | 1 + arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-j7200.dtsi | 1 + arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-j721e.dtsi | 1 + arch/arm64/configs/defconfig | 2 +- arch/arm64/kernel/signal.c | 10 +- arch/arm64/mm/mmu.c | 9 + arch/arm64/net/bpf_jit_comp.c | 18 +- arch/csky/kernel/perf_callchain.c | 2 +- arch/csky/kernel/signal.c | 2 +- arch/m68k/coldfire/device.c | 6 +- arch/microblaze/include/asm/uaccess.h | 18 +- arch/mips/dec/int-handler.S | 6 +- arch/mips/dec/prom/Makefile | 2 +- arch/mips/dec/setup.c | 3 +- arch/mips/include/asm/dec/prom.h | 15 +- arch/mips/include/asm/pgalloc.h | 6 + arch/mips/rb532/devices.c | 6 +- arch/nios2/include/asm/uaccess.h | 26 ++- arch/nios2/kernel/signal.c | 20 +- arch/parisc/include/asm/traps.h | 1 + arch/parisc/kernel/traps.c | 2 + arch/parisc/mm/fault.c | 89 ++++++++ arch/powerpc/Makefile | 2 +- arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts | 30 +++ arch/powerpc/boot/dts/fsl/t1040rdb.dts | 8 +- arch/powerpc/include/asm/io.h | 40 +++- arch/powerpc/include/asm/uaccess.h | 3 + arch/powerpc/kernel/kvm.c | 2 +- arch/powerpc/kvm/book3s_hv.c | 5 +- arch/powerpc/kvm/powerpc.c | 4 +- arch/powerpc/lib/sstep.c | 12 +- arch/powerpc/mm/kasan/kasan_init_32.c | 3 +- arch/powerpc/mm/numa.c | 4 +- arch/powerpc/perf/imc-pmu.c | 6 +- arch/powerpc/platforms/8xx/pic.c | 1 + arch/powerpc/platforms/powernv/rng.c | 6 +- arch/powerpc/sysdev/fsl_gtm.c | 4 +- arch/riscv/include/asm/module.lds.h | 6 +- arch/riscv/include/asm/thread_info.h | 10 +- arch/riscv/kernel/perf_callchain.c | 6 +- arch/sparc/kernel/signal_32.c | 2 +- arch/um/drivers/mconsole_kern.c | 3 +- arch/x86/events/intel/pt.c | 2 +- arch/x86/kernel/kvm.c | 2 +- arch/x86/kvm/emulate.c | 14 +- arch/x86/kvm/hyperv.c | 9 +- arch/x86/kvm/lapic.c | 5 +- arch/x86/kvm/mmu/tdp_mmu.c | 3 + arch/x86/kvm/svm/avic.c | 10 +- arch/x86/xen/pmu.c | 10 +- arch/x86/xen/pmu.h | 3 +- arch/x86/xen/smp_pv.c | 2 +- arch/xtensa/include/asm/processor.h | 4 +- arch/xtensa/kernel/jump_label.c | 2 +- block/bfq-iosched.c | 16 +- block/blk-mq-sched.c | 9 +- block/blk-sysfs.c | 8 +- crypto/authenc.c | 2 +- crypto/rsa-pkcs1pad.c | 11 +- drivers/acpi/acpica/nswalk.c | 3 + drivers/acpi/apei/bert.c | 10 +- drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/hest.c | 2 +- drivers/acpi/cppc_acpi.c | 5 + drivers/acpi/property.c | 2 +- drivers/amba/bus.c | 5 +- drivers/base/dd.c | 2 +- drivers/base/power/main.c | 6 +- drivers/block/drbd/drbd_req.c | 3 +- drivers/block/loop.c | 10 +- drivers/block/virtio_blk.c | 12 +- drivers/bluetooth/btmtksdio.c | 4 +- drivers/bluetooth/hci_serdev.c | 3 +- drivers/bus/mips_cdmm.c | 1 + drivers/char/hw_random/Kconfig | 2 +- drivers/char/hw_random/atmel-rng.c | 1 + drivers/char/hw_random/cavium-rng-vf.c | 194 +++++++++++++++- drivers/char/hw_random/cavium-rng.c | 11 +- drivers/char/hw_random/nomadik-rng.c | 7 +- drivers/char/tpm/tpm-chip.c | 46 +--- drivers/char/tpm/tpm.h | 2 + drivers/char/tpm/tpm2-space.c | 65 ++++++ drivers/char/virtio_console.c | 7 + drivers/clk/actions/owl-s700.c | 1 + drivers/clk/actions/owl-s900.c | 2 +- drivers/clk/at91/sama7g5.c | 8 +- drivers/clk/clk-clps711x.c | 2 + drivers/clk/clk.c | 13 ++ drivers/clk/imx/clk-imx7d.c | 1 - drivers/clk/loongson1/clk-loongson1c.c | 1 + drivers/clk/qcom/clk-rcg2.c | 14 +- drivers/clk/qcom/gcc-ipq8074.c | 21 +- drivers/clk/qcom/gcc-msm8994.c | 1 + drivers/clk/tegra/clk-tegra124-emc.c | 1 + .../clk/uniphier/clk-uniphier-fixed-rate.c | 1 + drivers/clocksource/acpi_pm.c | 6 +- drivers/clocksource/exynos_mct.c | 60 +++-- drivers/clocksource/timer-microchip-pit64b.c | 2 +- drivers/clocksource/timer-of.c | 6 +- drivers/clocksource/timer-ti-dm-systimer.c | 4 +- drivers/cpufreq/qcom-cpufreq-nvmem.c | 2 +- .../allwinner/sun8i-ce/sun8i-ce-cipher.c | 3 + .../crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 3 + .../allwinner/sun8i-ss/sun8i-ss-cipher.c | 3 + .../crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 2 + .../crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 3 + drivers/crypto/amlogic/amlogic-gxl-cipher.c | 2 + drivers/crypto/ccp/ccp-dmaengine.c | 16 ++ drivers/crypto/ccree/cc_buffer_mgr.c | 7 + drivers/crypto/ccree/cc_cipher.c | 2 +- drivers/crypto/mxs-dcp.c | 2 +- .../crypto/rockchip/rk3288_crypto_skcipher.c | 1 - drivers/crypto/vmx/Kconfig | 4 + drivers/dax/super.c | 1 + drivers/dma-buf/udmabuf.c | 4 + drivers/dma/hisi_dma.c | 2 +- drivers/dma/pl330.c | 3 +- drivers/firmware/efi/efi-pstore.c | 2 +- drivers/firmware/google/Kconfig | 2 +- drivers/firmware/qcom_scm.c | 6 - drivers/firmware/stratix10-svc.c | 2 +- drivers/fsi/fsi-master-aspeed.c | 21 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +- .../display/dc/irq/dcn21/irq_service_dcn21.c | 14 -- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 4 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 2 +- drivers/gpu/drm/bridge/adv7511/adv7511.h | 1 + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 29 ++- drivers/gpu/drm/bridge/cdns-dsi.c | 1 + drivers/gpu/drm/bridge/nwl-dsi.c | 1 + drivers/gpu/drm/bridge/sil-sii8620.c | 2 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 5 +- drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c | 1 + drivers/gpu/drm/drm_edid.c | 11 +- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 2 +- drivers/gpu/drm/meson/meson_drv.c | 6 +- drivers/gpu/drm/meson/meson_osd_afbcd.c | 41 ++-- drivers/gpu/drm/meson/meson_osd_afbcd.h | 1 + drivers/gpu/drm/mgag200/mgag200_mode.c | 5 +- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 8 + drivers/gpu/drm/msm/dp/dp_display.c | 5 + .../gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c | 9 +- drivers/gpu/drm/panfrost/panfrost_gpu.c | 5 +- drivers/gpu/drm/pl111/pl111_drv.c | 4 +- drivers/gpu/drm/tegra/dsi.c | 4 +- drivers/gpu/host1x/dev.c | 1 + drivers/greybus/svc.c | 8 +- drivers/hid/hid-logitech-dj.c | 1 + drivers/hid/i2c-hid/i2c-hid-core.c | 32 ++- drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 29 +-- drivers/hv/Kconfig | 1 + drivers/hv/hv_balloon.c | 2 +- drivers/hwmon/pmbus/pmbus.h | 1 + drivers/hwmon/pmbus/pmbus_core.c | 18 +- drivers/hwmon/sch56xx-common.c | 2 +- drivers/hwtracing/coresight/coresight-catu.c | 3 +- .../hwtracing/coresight/coresight-cpu-debug.c | 4 +- .../hwtracing/coresight/coresight-cti-core.c | 4 +- drivers/hwtracing/coresight/coresight-etb10.c | 4 +- .../coresight/coresight-etm3x-core.c | 4 +- .../coresight/coresight-etm4x-core.c | 4 +- .../coresight/coresight-etm4x-sysfs.c | 8 +- .../hwtracing/coresight/coresight-funnel.c | 4 +- .../coresight/coresight-replicator.c | 4 +- drivers/hwtracing/coresight/coresight-stm.c | 4 +- .../hwtracing/coresight/coresight-tmc-core.c | 4 +- drivers/hwtracing/coresight/coresight-tpiu.c | 4 +- drivers/i2c/busses/i2c-meson.c | 12 +- drivers/i2c/busses/i2c-nomadik.c | 4 +- drivers/i2c/busses/i2c-xiic.c | 3 +- drivers/i2c/muxes/i2c-demux-pinctrl.c | 5 +- drivers/iio/accel/mma8452.c | 29 ++- drivers/iio/adc/twl6030-gpadc.c | 2 + drivers/iio/afe/iio-rescale.c | 8 +- drivers/iio/inkern.c | 40 +++- drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/verbs.c | 1 + drivers/infiniband/hw/hfi1/verbs.c | 3 +- drivers/infiniband/hw/mlx5/devx.c | 4 +- drivers/infiniband/hw/mlx5/mr.c | 2 + drivers/input/input.c | 6 - drivers/input/serio/ambakmi.c | 3 +- drivers/input/touchscreen/zinitix.c | 44 +++- drivers/iommu/iova.c | 5 +- drivers/iommu/ipmmu-vmsa.c | 4 +- drivers/irqchip/irq-nvic.c | 2 + drivers/irqchip/qcom-pdc.c | 5 +- drivers/mailbox/imx-mailbox.c | 9 + drivers/mailbox/tegra-hsp.c | 5 + drivers/md/dm-crypt.c | 2 +- drivers/md/dm-integrity.c | 6 +- drivers/media/i2c/adv7511-v4l2.c | 2 +- drivers/media/i2c/adv7604.c | 2 +- drivers/media/i2c/adv7842.c | 2 +- drivers/media/pci/bt8xx/bttv-driver.c | 4 +- drivers/media/pci/cx88/cx88-mpeg.c | 3 + drivers/media/pci/ivtv/ivtv-driver.h | 1 - drivers/media/pci/ivtv/ivtv-ioctl.c | 10 +- drivers/media/pci/ivtv/ivtv-streams.c | 11 +- drivers/media/pci/saa7134/saa7134-alsa.c | 8 +- drivers/media/platform/aspeed-video.c | 9 +- drivers/media/platform/coda/coda-common.c | 1 + drivers/media/platform/davinci/vpif.c | 12 +- .../platform/mtk-vcodec/mtk_vcodec_fw_vpu.c | 2 + drivers/media/rc/gpio-ir-tx.c | 28 ++- drivers/media/rc/ir_toy.c | 2 +- .../media/test-drivers/vidtv/vidtv_s302m.c | 17 +- drivers/media/usb/em28xx/em28xx-cards.c | 13 +- drivers/media/usb/go7007/s2250-board.c | 10 +- drivers/media/usb/hdpvr/hdpvr-video.c | 4 +- drivers/media/usb/stk1160/stk1160-core.c | 2 +- drivers/media/usb/stk1160/stk1160-v4l.c | 10 +- drivers/media/usb/stk1160/stk1160.h | 2 +- drivers/media/v4l2-core/v4l2-mem2mem.c | 53 ++++- drivers/memory/emif.c | 8 +- drivers/memory/pl172.c | 4 +- drivers/memory/pl353-smc.c | 4 +- drivers/mfd/asic3.c | 10 +- drivers/mfd/mc13xxx-core.c | 4 +- drivers/misc/cardreader/alcor_pci.c | 9 +- drivers/misc/habanalabs/common/debugfs.c | 2 + drivers/misc/kgdbts.c | 4 +- drivers/misc/mei/hw-me-regs.h | 1 + drivers/misc/mei/interrupt.c | 35 ++- drivers/misc/mei/pci-me.c | 1 + drivers/mmc/core/host.c | 15 +- drivers/mmc/host/davinci_mmc.c | 6 +- drivers/mmc/host/mmci.c | 4 +- drivers/mtd/nand/onenand/generic.c | 7 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 14 +- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 3 + drivers/mtd/nand/raw/nand_base.c | 44 ++-- drivers/net/bareudp.c | 25 +-- drivers/net/can/m_can/m_can.c | 5 +- .../net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +- drivers/net/can/usb/mcba_usb.c | 26 ++- drivers/net/can/vxcan.c | 2 +- drivers/net/dsa/bcm_sf2_cfp.c | 6 +- drivers/net/dsa/microchip/ksz8795_spi.c | 11 + drivers/net/dsa/microchip/ksz9477_spi.c | 12 + drivers/net/dsa/mv88e6xxx/chip.c | 1 + drivers/net/ethernet/8390/mcf8390.c | 10 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- .../ethernet/freescale/enetc/enetc_ethtool.c | 5 +- drivers/net/ethernet/intel/i40e/i40e_xsk.c | 16 +- .../net/ethernet/pensando/ionic/ionic_main.c | 6 +- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 1 + .../net/ethernet/qlogic/qlcnic/qlcnic_dcb.h | 10 +- drivers/net/ethernet/sun/sunhme.c | 6 +- .../net/ethernet/xilinx/xilinx_axienet_main.c | 72 +++--- drivers/net/phy/broadcom.c | 21 ++ drivers/net/wireguard/queueing.c | 3 +- drivers/net/wireguard/socket.c | 5 +- drivers/net/wireless/ath/ath10k/snoc.c | 2 +- drivers/net/wireless/ath/ath10k/wow.c | 7 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 5 + drivers/net/wireless/ath/carl9170/main.c | 2 +- .../broadcom/brcm80211/brcmfmac/firmware.c | 2 + .../broadcom/brcm80211/brcmfmac/pcie.c | 66 ++---- .../net/wireless/intel/iwlwifi/dvm/mac80211.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 +- .../net/wireless/mediatek/mt76/mt7603/main.c | 3 + .../net/wireless/mediatek/mt76/mt7615/main.c | 3 + .../net/wireless/mediatek/mt76/mt7915/mcu.c | 9 +- drivers/net/wireless/ray_cs.c | 6 + drivers/nvdimm/region_devs.c | 3 + drivers/nvme/host/core.c | 9 +- drivers/nvme/host/tcp.c | 40 ++++ drivers/pci/controller/pci-aardvark.c | 4 +- drivers/pci/controller/pci-xgene.c | 35 ++- drivers/pci/hotplug/pciehp_hpc.c | 2 + drivers/pci/quirks.c | 12 + drivers/phy/phy-core-mipi-dphy.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 2 + drivers/pinctrl/mediatek/pinctrl-paris.c | 30 ++- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 185 ++++++++-------- drivers/pinctrl/pinconf-generic.c | 6 +- drivers/pinctrl/pinctrl-rockchip.c | 2 + drivers/pinctrl/renesas/core.c | 5 +- drivers/pinctrl/renesas/pfc-r8a77470.c | 4 +- drivers/pinctrl/samsung/pinctrl-samsung.c | 30 ++- drivers/platform/chrome/Makefile | 3 +- .../platform/chrome/cros_ec_sensorhub_ring.c | 3 +- .../platform/chrome/cros_ec_sensorhub_trace.h | 123 +++++++++++ drivers/platform/chrome/cros_ec_trace.h | 95 -------- drivers/platform/chrome/cros_ec_typec.c | 6 + drivers/platform/x86/huawei-wmi.c | 13 +- drivers/power/reset/gemini-poweroff.c | 4 +- drivers/power/supply/ab8500_fg.c | 4 +- drivers/power/supply/bq24190_charger.c | 7 +- drivers/power/supply/wm8350_power.c | 97 ++++++-- drivers/pwm/pwm-lpc18xx-sct.c | 20 +- drivers/regulator/qcom_smd-regulator.c | 4 +- .../regulator/rpi-panel-attiny-regulator.c | 56 ++++- drivers/remoteproc/qcom_q6v5_adsp.c | 1 + drivers/remoteproc/qcom_q6v5_mss.c | 11 +- drivers/remoteproc/qcom_wcnss.c | 1 + drivers/remoteproc/remoteproc_debugfs.c | 2 +- drivers/rtc/interface.c | 7 +- drivers/rtc/rtc-pl030.c | 4 +- drivers/rtc/rtc-pl031.c | 4 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- drivers/scsi/libsas/sas_ata.c | 2 +- drivers/scsi/pm8001/pm8001_hwi.c | 23 +- drivers/scsi/pm8001/pm80xx_hwi.c | 209 ++++++++++-------- drivers/scsi/qla2xxx/qla_attr.c | 7 +- drivers/scsi/qla2xxx/qla_def.h | 10 +- drivers/scsi/qla2xxx/qla_gs.c | 5 +- drivers/scsi/qla2xxx/qla_init.c | 73 ++++-- drivers/scsi/qla2xxx/qla_iocb.c | 8 +- drivers/scsi/qla2xxx/qla_isr.c | 1 + drivers/scsi/qla2xxx/qla_mbx.c | 14 +- drivers/scsi/qla2xxx/qla_nvme.c | 22 ++ drivers/scsi/qla2xxx/qla_os.c | 8 +- drivers/scsi/qla2xxx/qla_sup.c | 4 +- drivers/scsi/qla2xxx/qla_target.c | 4 +- drivers/soc/qcom/ocmem.c | 1 + drivers/soc/qcom/qcom_aoss.c | 2 +- drivers/soc/qcom/rpmpd.c | 3 + drivers/soc/ti/wkup_m3_ipc.c | 4 +- drivers/soundwire/intel.c | 4 +- drivers/spi/spi-mxic.c | 28 +-- drivers/spi/spi-pl022.c | 5 +- drivers/spi/spi-pxa2xx-pci.c | 17 +- drivers/spi/spi-tegra114.c | 4 + drivers/spi/spi-tegra20-slink.c | 8 +- drivers/spi/spi-zynqmp-gqspi.c | 5 +- drivers/spi/spi.c | 4 +- drivers/staging/iio/adc/ad7280a.c | 4 +- .../staging/media/atomisp/pci/atomisp_acc.c | 28 ++- .../media/atomisp/pci/atomisp_gmin_platform.c | 18 ++ drivers/staging/media/atomisp/pci/hmm/hmm.c | 7 +- .../staging/media/hantro/hantro_h1_jpeg_enc.c | 2 +- drivers/staging/media/hantro/hantro_h1_regs.h | 2 +- drivers/staging/media/meson/vdec/esparser.c | 7 +- .../staging/media/meson/vdec/vdec_helpers.c | 8 +- .../staging/media/meson/vdec/vdec_helpers.h | 4 +- .../staging/media/sunxi/cedrus/cedrus_h264.c | 2 +- .../staging/media/sunxi/cedrus/cedrus_h265.c | 2 +- drivers/staging/media/zoran/zoran.h | 2 +- drivers/staging/media/zoran/zoran_card.c | 86 ++++--- drivers/staging/media/zoran/zoran_device.c | 7 +- drivers/staging/media/zoran/zoran_driver.c | 18 +- drivers/staging/mt7621-dts/gbpc1.dts | 40 ++-- drivers/staging/mt7621-dts/gbpc2.dts | 116 +++++++++- drivers/staging/mt7621-dts/mt7621.dtsi | 26 ++- .../intel/int340x_thermal/int3400_thermal.c | 7 +- drivers/tty/hvc/hvc_iucv.c | 4 +- drivers/tty/mxser.c | 15 +- drivers/tty/serial/8250/8250_dma.c | 11 +- drivers/tty/serial/8250/8250_lpss.c | 28 ++- drivers/tty/serial/8250/8250_mid.c | 19 +- drivers/tty/serial/8250/8250_port.c | 16 +- drivers/tty/serial/amba-pl010.c | 4 +- drivers/tty/serial/amba-pl011.c | 3 +- drivers/tty/serial/kgdboc.c | 6 +- drivers/tty/serial/serial_core.c | 14 ++ drivers/usb/host/xhci-hub.c | 5 +- drivers/usb/host/xhci-mem.c | 2 +- drivers/usb/host/xhci.c | 20 +- drivers/usb/host/xhci.h | 14 +- drivers/usb/serial/Kconfig | 1 + drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 3 + drivers/usb/serial/usb-serial-simple.c | 7 + drivers/usb/storage/ene_ub6250.c | 155 +++++++------ drivers/usb/storage/realtek_cr.c | 2 +- drivers/vdpa/mlx5/net/mlx5_vnet.c | 18 +- drivers/vfio/platform/vfio_amba.c | 15 +- drivers/video/fbdev/amba-clcd.c | 4 +- drivers/video/fbdev/atafb.c | 12 +- drivers/video/fbdev/atmel_lcdfb.c | 11 +- drivers/video/fbdev/cirrusfb.c | 16 +- drivers/video/fbdev/controlfb.c | 6 +- drivers/video/fbdev/core/fbcvt.c | 53 ++--- drivers/video/fbdev/matrox/matroxfb_base.c | 2 +- drivers/video/fbdev/nvidia/nv_i2c.c | 2 +- .../omap2/omapfb/displays/connector-dvi.c | 1 + .../omap2/omapfb/displays/panel-dsi-cm.c | 8 +- .../omapfb/displays/panel-sony-acx565akm.c | 2 +- .../omapfb/displays/panel-tpo-td043mtea1.c | 4 +- drivers/video/fbdev/sm712fb.c | 46 +--- drivers/video/fbdev/smscufx.c | 3 +- drivers/video/fbdev/udlfb.c | 8 +- drivers/video/fbdev/w100fb.c | 15 +- drivers/watchdog/rti_wdt.c | 1 + drivers/watchdog/sp805_wdt.c | 4 +- fs/binfmt_elf.c | 24 +- fs/btrfs/reflink.c | 7 +- fs/cifs/smb2ops.c | 130 ++++++----- fs/coredump.c | 39 +++- fs/exec.c | 26 ++- fs/ext2/super.c | 6 +- fs/ext4/inline.c | 9 +- fs/ext4/inode.c | 25 +++ fs/ext4/mballoc.c | 126 ++++++----- fs/ext4/namei.c | 10 +- fs/f2fs/checkpoint.c | 8 +- fs/f2fs/compress.c | 5 +- fs/f2fs/data.c | 9 +- fs/f2fs/file.c | 5 +- fs/f2fs/gc.c | 4 +- fs/f2fs/inode.c | 1 + fs/f2fs/node.c | 6 +- fs/f2fs/segment.c | 7 + fs/f2fs/super.c | 6 +- fs/f2fs/sysfs.c | 2 +- fs/file.c | 31 ++- fs/gfs2/rgrp.c | 3 +- fs/io_uring.c | 7 +- fs/jfs/jfs_dmap.c | 7 + fs/nfs/callback_proc.c | 27 +-- fs/nfs/callback_xdr.c | 4 - fs/nfs/nfs2xdr.c | 2 +- fs/nfs/nfs3xdr.c | 21 +- fs/nfs/nfs4proc.c | 1 + fs/nfs/pnfs.c | 11 + fs/nfs/pnfs.h | 2 + fs/nfs/write.c | 5 +- fs/nfsd/filecache.c | 6 +- fs/nfsd/nfs4state.c | 12 +- fs/nfsd/nfsproc.c | 2 +- fs/nfsd/xdr.h | 2 +- fs/ntfs/inode.c | 4 + fs/proc/bootconfig.c | 2 + fs/pstore/platform.c | 38 ++-- include/linux/amba/bus.h | 2 +- include/linux/mtd/rawnand.h | 2 + include/linux/pstore.h | 6 +- include/linux/serial_core.h | 2 + include/linux/soc/ti/ti_sci_protocol.h | 2 +- include/linux/sunrpc/xdr.h | 2 + include/net/udp.h | 1 + include/net/udp_tunnel.h | 3 +- include/sound/pcm.h | 1 + include/trace/events/ext4.h | 78 ++++--- include/trace/events/rxrpc.h | 8 +- include/uapi/linux/bpf.h | 12 +- kernel/audit.h | 4 + kernel/auditsc.c | 87 ++++++-- kernel/bpf/stackmap.c | 56 ++--- kernel/debug/kdb/kdb_support.c | 2 +- kernel/dma/debug.c | 4 +- kernel/events/core.c | 3 + kernel/locking/lockdep.c | 38 ++-- kernel/locking/lockdep_internals.h | 6 +- kernel/locking/lockdep_proc.c | 51 ++++- kernel/power/hibernate.c | 2 +- kernel/power/suspend_test.c | 8 +- kernel/printk/printk.c | 6 +- kernel/rseq.c | 9 + kernel/sched/core.c | 1 + kernel/sched/debug.c | 10 - kernel/watch_queue.c | 4 +- lib/kunit/try-catch.c | 2 +- lib/raid6/test/Makefile | 4 +- lib/raid6/test/test.c | 1 - lib/test_kmod.c | 1 + lib/test_lockup.c | 11 +- lib/test_xarray.c | 22 ++ lib/xarray.c | 4 + mm/kmemleak.c | 9 +- mm/madvise.c | 3 +- mm/memcontrol.c | 2 +- mm/memory.c | 17 +- mm/mempolicy.c | 8 +- mm/mmap.c | 2 +- mm/page_alloc.c | 9 +- mm/usercopy.c | 5 +- net/batman-adv/bridge_loop_avoidance.c | 6 + net/batman-adv/distributed-arp-table.c | 3 + net/batman-adv/gateway_client.c | 12 +- net/batman-adv/gateway_client.h | 16 +- net/batman-adv/hard-interface.h | 3 + net/batman-adv/network-coding.c | 6 + net/batman-adv/originator.c | 72 +----- net/batman-adv/originator.h | 96 +++++++- net/batman-adv/soft-interface.c | 15 +- net/batman-adv/soft-interface.h | 16 +- net/batman-adv/tp_meter.c | 3 + net/batman-adv/translation-table.c | 22 +- net/batman-adv/translation-table.h | 18 +- net/batman-adv/tvlv.c | 6 + net/bluetooth/hci_conn.c | 2 + net/can/isotp.c | 69 +++--- net/core/skmsg.c | 17 +- net/ipv4/route.c | 18 +- net/ipv4/tcp_bpf.c | 14 +- net/ipv4/tcp_output.c | 5 +- net/ipv4/udp.c | 6 + net/ipv6/udp.c | 4 +- net/ipv6/xfrm6_output.c | 16 ++ net/netfilter/nf_conntrack_proto_tcp.c | 17 +- net/netlink/af_netlink.c | 2 + net/openvswitch/conntrack.c | 118 +++++----- net/openvswitch/flow_netlink.c | 4 +- net/rxrpc/ar-internal.h | 15 +- net/rxrpc/call_event.c | 2 +- net/rxrpc/call_object.c | 40 +++- net/sunrpc/xprt.c | 7 + net/tipc/socket.c | 3 +- net/xfrm/xfrm_interface.c | 5 +- samples/bpf/xdpsock_user.c | 5 +- scripts/dtc/Makefile | 2 +- scripts/gcc-plugins/stackleak_plugin.c | 25 ++- security/integrity/evm/evm_main.c | 2 +- security/keys/keyctl_pkey.c | 14 +- security/security.c | 17 +- security/selinux/hooks.c | 11 +- security/selinux/include/policycap.h | 1 + security/selinux/include/policycap_names.h | 3 +- security/selinux/include/security.h | 7 + security/selinux/selinuxfs.c | 2 + security/selinux/xfrm.c | 2 +- security/smack/smack_lsm.c | 2 +- security/tomoyo/load_policy.c | 4 +- sound/arm/aaci.c | 4 +- sound/core/pcm.c | 1 + sound/core/pcm_lib.c | 9 +- sound/core/pcm_native.c | 39 +++- sound/firewire/fcp.c | 4 +- sound/isa/cs423x/cs4236.c | 8 +- sound/pci/hda/patch_hdmi.c | 8 +- sound/pci/hda/patch_realtek.c | 15 +- sound/soc/atmel/atmel_ssc_dai.c | 5 +- sound/soc/atmel/sam9g20_wm8731.c | 1 + sound/soc/atmel/sam9x5_wm8731.c | 16 +- sound/soc/codecs/Kconfig | 5 + sound/soc/codecs/msm8916-wcd-analog.c | 22 +- sound/soc/codecs/msm8916-wcd-digital.c | 5 +- sound/soc/codecs/mt6358.c | 4 + sound/soc/codecs/rt5663.c | 2 + sound/soc/codecs/wcd934x.c | 6 +- sound/soc/codecs/wm8350.c | 28 ++- sound/soc/dwc/dwc-i2s.c | 17 +- sound/soc/fsl/fsl_spdif.c | 2 + sound/soc/fsl/imx-es8328.c | 1 + sound/soc/generic/simple-card-utils.c | 2 +- sound/soc/mxs/mxs-saif.c | 5 +- sound/soc/mxs/mxs-sgtl5000.c | 3 + sound/soc/rockchip/rockchip_i2s.c | 18 +- sound/soc/sh/fsi.c | 19 +- sound/soc/soc-compress.c | 5 + sound/soc/soc-core.c | 2 +- sound/soc/soc-generic-dmaengine-pcm.c | 6 +- sound/soc/soc-topology.c | 3 +- sound/soc/sof/imx/imx8m.c | 1 + sound/soc/sof/intel/hda-loader.c | 11 +- sound/soc/ti/davinci-i2s.c | 5 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 25 +++ sound/spi/at73c213.c | 27 ++- tools/include/uapi/linux/bpf.h | 4 +- tools/lib/bpf/btf_dump.c | 5 + tools/lib/bpf/libbpf.c | 3 + tools/lib/bpf/xsk.c | 11 + .../selftests/bpf/progs/test_sock_fields.c | 2 +- .../testing/selftests/bpf/test_lirc_mode2.sh | 5 +- .../selftests/bpf/test_lwt_ip_encap.sh | 10 +- .../selftests/net/test_vxlan_under_vrf.sh | 8 +- tools/testing/selftests/vm/Makefile | 6 +- tools/testing/selftests/x86/Makefile | 6 +- tools/testing/selftests/x86/check_cc.sh | 2 +- tools/virtio/virtio_test.c | 1 + virt/kvm/kvm_main.c | 13 ++ 614 files changed, 4953 insertions(+), 2507 deletions(-) create mode 100644 arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts create mode 100644 drivers/platform/chrome/cros_ec_sensorhub_trace.h -- 2.20.1

1 559

[PATCH] vfio: framework supporting vfio device hot migration
by RongWang 05 Jul '22

05 Jul '22

From: Rong Wang <w_angrong(a)163.com> kunpeng inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5CO9A CVE: NA --------------------------------- As pass through devices, hypervisor can`t control the status of device, and can`t track dirty memory DMA from device, during migration. The goal of this framework is to combine hardware to accomplish the task above. qemu |status control and dirty memory report vfio |ops to hardware hardware Signed-off-by: Rong Wang <w_angrong(a)163.com> Signed-off-by: HuHua Li <18245010845(a)163.com> Signed-off-by: Ripeng Qiu <965412048(a)qq.com> --- drivers/vfio/pci/Makefile | 2 +- drivers/vfio/pci/vfio_pci.c | 54 +++ drivers/vfio/pci/vfio_pci_migration.c | 755 ++++++++++++++++++++++++++++++++++ drivers/vfio/pci/vfio_pci_private.h | 14 +- drivers/vfio/vfio.c | 411 +++++++++++++++++- include/linux/vfio_pci_migration.h | 136 ++++++ 6 files changed, 1367 insertions(+), 5 deletions(-) create mode 100644 drivers/vfio/pci/vfio_pci_migration.c create mode 100644 include/linux/vfio_pci_migration.h diff --git a/drivers/vfio/pci/Makefile b/drivers/vfio/pci/Makefile index 76d8ec0..80a777d 100644 --- a/drivers/vfio/pci/Makefile +++ b/drivers/vfio/pci/Makefile @@ -1,5 +1,5 @@ -vfio-pci-y := vfio_pci.o vfio_pci_intrs.o vfio_pci_rdwr.o vfio_pci_config.o +vfio-pci-y := vfio_pci.o vfio_pci_intrs.o vfio_pci_rdwr.o vfio_pci_config.o vfio_pci_migration.o vfio-pci-$(CONFIG_VFIO_PCI_IGD) += vfio_pci_igd.o obj-$(CONFIG_VFIO_PCI) += vfio-pci.o diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index 51b791c..59d8280 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -30,6 +30,7 @@ #include <linux/vgaarb.h> #include <linux/nospec.h> #include <linux/sched/mm.h> +#include <linux/vfio_pci_migration.h> #include "vfio_pci_private.h" @@ -296,6 +297,14 @@ static int vfio_pci_enable(struct vfio_pci_device *vdev) vfio_pci_probe_mmaps(vdev); + if (vfio_dev_migration_is_supported(pdev)) { + ret = vfio_pci_migration_init(vdev); + if (ret) { + dev_warn(&vdev->pdev->dev, "Failed to init vfio_pci_migration\n"); + vfio_pci_disable(vdev); + return ret; + } + } return 0; } @@ -392,6 +401,7 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev) out: pci_disable_device(pdev); + vfio_pci_migration_exit(vdev); vfio_pci_try_bus_reset(vdev); if (!disable_idle_d3) @@ -642,6 +652,41 @@ struct vfio_devices { int max_index; }; +static long vfio_pci_handle_log_buf_ctl(struct vfio_pci_device *vdev, + const unsigned long arg) +{ + struct vfio_log_buf_ctl *log_buf_ctl = NULL; + struct vfio_log_buf_info *log_buf_info = NULL; + struct vf_migration_log_info migration_log_info; + long ret = 0; + + log_buf_ctl = (struct vfio_log_buf_ctl *)arg; + log_buf_info = (struct vfio_log_buf_info *)log_buf_ctl->data; + + switch (log_buf_ctl->flags) { + case VFIO_DEVICE_LOG_BUF_FLAG_START: + migration_log_info.dom_uuid = log_buf_info->uuid; + migration_log_info.buffer_size = + log_buf_info->buffer_size; + migration_log_info.sge_num = log_buf_info->addrs_size; + migration_log_info.sge_len = log_buf_info->frag_size; + migration_log_info.sgevec = log_buf_info->sgevec; + ret = vfio_pci_device_log_start(vdev, + &migration_log_info); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STOP: + ret = vfio_pci_device_log_stop(vdev, + log_buf_info->uuid); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY: + ret = vfio_pci_device_log_status_query(vdev); + break; + default: + ret = -EINVAL; + break; + } + return ret; +} static long vfio_pci_ioctl(void *device_data, unsigned int cmd, unsigned long arg) { @@ -1142,6 +1187,8 @@ static long vfio_pci_ioctl(void *device_data, return vfio_pci_ioeventfd(vdev, ioeventfd.offset, ioeventfd.data, count, ioeventfd.fd); + } else if (cmd == VFIO_DEVICE_LOG_BUF_CTL) { + return vfio_pci_handle_log_buf_ctl(vdev, arg); } return -ENOTTY; @@ -1566,6 +1613,9 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) pci_set_power_state(pdev, PCI_D3hot); } + if (vfio_dev_migration_is_supported(pdev)) + ret = vfio_pci_device_init(pdev); + return ret; } @@ -1591,6 +1641,10 @@ static void vfio_pci_remove(struct pci_dev *pdev) if (!disable_idle_d3) pci_set_power_state(pdev, PCI_D0); + + if (vfio_dev_migration_is_supported(pdev)) { + vfio_pci_device_uninit(pdev); + } } static pci_ers_result_t vfio_pci_aer_err_detected(struct pci_dev *pdev, diff --git a/drivers/vfio/pci/vfio_pci_migration.c b/drivers/vfio/pci/vfio_pci_migration.c new file mode 100644 index 0000000..f69cd13 --- /dev/null +++ b/drivers/vfio/pci/vfio_pci_migration.c @@ -0,0 +1,755 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) 2022 Huawei Technologies Co., Ltd. All rights reserved. + */ + +#include <linux/module.h> +#include <linux/io.h> +#include <linux/pci.h> +#include <linux/uaccess.h> +#include <linux/vfio.h> +#include <linux/vfio_pci_migration.h> + +#include "vfio_pci_private.h" + +static LIST_HEAD(vfio_pci_mig_drivers_list); +static DEFINE_MUTEX(vfio_pci_mig_drivers_mutex); + +static void vfio_pci_add_mig_drv(struct vfio_pci_vendor_mig_driver *mig_drv) +{ + mutex_lock(&vfio_pci_mig_drivers_mutex); + atomic_set(&mig_drv->count, 1); + list_add_tail(&mig_drv->list, &vfio_pci_mig_drivers_list); + mutex_unlock(&vfio_pci_mig_drivers_mutex); +} + +static void vfio_pci_remove_mig_drv(struct vfio_pci_vendor_mig_driver *mig_drv) +{ + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_del(&mig_drv->list); + mutex_unlock(&vfio_pci_mig_drivers_mutex); +} + +static struct vfio_pci_vendor_mig_driver * + vfio_pci_find_mig_drv(struct pci_dev *pdev, struct module *module) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = NULL; + + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_for_each_entry(mig_drv, &vfio_pci_mig_drivers_list, list) { + if (mig_drv->owner == module) { + if (mig_drv->bus_num == pdev->bus->number) + goto out; + } + } + mig_drv = NULL; +out: + mutex_unlock(&vfio_pci_mig_drivers_mutex); + return mig_drv; +} + +static struct vfio_pci_vendor_mig_driver * + vfio_pci_get_mig_driver(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = NULL; + struct pci_dev *pf_dev = pci_physfn(pdev); + + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_for_each_entry(mig_drv, &vfio_pci_mig_drivers_list, list) { + if (mig_drv->bus_num == pf_dev->bus->number) + goto out; + } + mig_drv = NULL; +out: + mutex_unlock(&vfio_pci_mig_drivers_mutex); + return mig_drv; +} + +bool vfio_dev_migration_is_supported(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + mig_driver = vfio_pci_get_mig_driver(pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_warn(&pdev->dev, "unable to find a mig_drv module\n"); + return false; + } + + return true; +} + +int vfio_pci_device_log_start(struct vfio_pci_device *vdev, + struct vf_migration_log_info *log_info) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->log_start || + (mig_driver->dev_mig_ops->log_start(vdev->pdev, + log_info) != 0)) { + dev_err(&vdev->pdev->dev, "failed to set log start\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_log_stop(struct vfio_pci_device *vdev, uint32_t uuid) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->log_stop || + (mig_driver->dev_mig_ops->log_stop(vdev->pdev, uuid) != 0)) { + dev_err(&vdev->pdev->dev, "failed to set log stop\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_log_status_query(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->get_log_status || + (mig_driver->dev_mig_ops->get_log_status(vdev->pdev) != 0)) { + dev_err(&vdev->pdev->dev, "failed to get log status\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_init(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv; + + mig_drv = vfio_pci_get_mig_driver(pdev); + if (!mig_drv || !mig_drv->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (mig_drv->dev_mig_ops->init) + return mig_drv->dev_mig_ops->init(pdev); + + return -EFAULT; +} + +void vfio_pci_device_uninit(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv; + + mig_drv = vfio_pci_get_mig_driver(pdev); + if (!mig_drv || !mig_drv->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_drv module\n"); + return; + } + + if (mig_drv->dev_mig_ops->uninit) + mig_drv->dev_mig_ops->uninit(pdev); +} + +static void vfio_pci_device_release(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (mig_drv->dev_mig_ops->release) + mig_drv->dev_mig_ops->release(pdev); +} + +static int vfio_pci_device_get_info(struct pci_dev *pdev, + struct vfio_device_migration_info *mig_info, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (mig_drv->dev_mig_ops->get_info) + return mig_drv->dev_mig_ops->get_info(pdev, mig_info); + return -EFAULT; +} + +static int vfio_pci_device_enable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->enable || + (mig_drv->dev_mig_ops->enable(pdev) != 0)) { + return -EINVAL; + } + + return 0; +} + +static int vfio_pci_device_disable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->disable || + (mig_drv->dev_mig_ops->disable(pdev) != 0)) + return -EINVAL; + + return 0; +} + +static int vfio_pci_device_pre_enable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->pre_enable || + (mig_drv->dev_mig_ops->pre_enable(pdev) != 0)) + return -EINVAL; + + return 0; +} + +static int vfio_pci_device_state_save(struct pci_dev *pdev, + struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_info = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + void *base = (void *)mig_info; + int ret = 0; + + if ((mig_info->device_state & VFIO_DEVICE_STATE_RUNNING) != 0) { + ret = vfio_pci_device_disable(pdev, mig_drv); + if (ret) { + dev_err(&pdev->dev, "failed to stop VF function!\n"); + return ret; + } + mig_info->device_state &= ~VFIO_DEVICE_STATE_RUNNING; + } + + if (mig_drv->dev_mig_ops && mig_drv->dev_mig_ops->save) { + ret = mig_drv->dev_mig_ops->save(pdev, base, + mig_info->data_offset, data->state_size); + if (ret) { + dev_err(&pdev->dev, "failed to save device state!\n"); + return -EINVAL; + } + } else { + return -EFAULT; + } + + mig_info->data_size = data->state_size; + mig_info->pending_bytes = mig_info->data_size; + return ret; +} + +static int vfio_pci_device_state_restore(struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_info = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + void *base = (void *)mig_info; + int ret; + + if (mig_drv->dev_mig_ops && mig_drv->dev_mig_ops->restore) { + ret = mig_drv->dev_mig_ops->restore(pdev, base, + mig_info->data_offset, mig_info->data_size); + if (ret) { + dev_err(&pdev->dev, "failed to restore device state!\n"); + return -EINVAL; + } + return 0; + } + + return -EFAULT; +} + +static int vfio_pci_set_device_state(struct vfio_pci_migration_data *data, + u32 state) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + int ret = 0; + + if (state == mig_ctl->device_state) + return 0; + + if (!mig_drv->dev_mig_ops) + return -EINVAL; + + switch (state) { + case VFIO_DEVICE_STATE_RUNNING: + if (!(mig_ctl->device_state & + VFIO_DEVICE_STATE_RUNNING)) + ret = vfio_pci_device_enable(pdev, mig_drv); + break; + case VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING: + /* + * (pre-copy) - device should start logging data. + */ + ret = 0; + break; + case VFIO_DEVICE_STATE_SAVING: + /* stop the vf function, save state */ + ret = vfio_pci_device_state_save(pdev, data); + break; + case VFIO_DEVICE_STATE_STOP: + if (mig_ctl->device_state & VFIO_DEVICE_STATE_RUNNING) + ret = vfio_pci_device_disable(pdev, mig_drv); + break; + case VFIO_DEVICE_STATE_RESUMING: + ret = vfio_pci_device_pre_enable(pdev, mig_drv); + break; + default: + ret = -EFAULT; + break; + } + + if (ret) + return ret; + + mig_ctl->device_state = state; + return 0; +} + +static ssize_t vfio_pci_handle_mig_dev_state( + struct vfio_pci_migration_data *data, + char __user *buf, size_t count, bool iswrite) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + u32 device_state; + int ret; + + if (count != sizeof(device_state)) + return -EINVAL; + + if (iswrite) { + if (copy_from_user(&device_state, buf, count)) + return -EFAULT; + + ret = vfio_pci_set_device_state(data, device_state); + if (ret) + return ret; + } else { + if (copy_to_user(buf, &mig_ctl->device_state, count)) + return -EFAULT; + } + + return count; +} + +static ssize_t vfio_pci_handle_mig_pending_bytes( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 pending_bytes; + + if (count != sizeof(pending_bytes) || iswrite) + return -EINVAL; + + if (mig_info->device_state == + (VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING)) { + /* In pre-copy state we have no data to return for now, + * return 0 pending bytes + */ + pending_bytes = 0; + } else { + pending_bytes = mig_info->pending_bytes; + } + + if (copy_to_user(buf, &pending_bytes, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_offset( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 data_offset = mig_info->data_offset; + + if (count != sizeof(data_offset) || iswrite) + return -EINVAL; + + if (copy_to_user(buf, &data_offset, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_size( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 data_size; + + if (count != sizeof(data_size)) + return -EINVAL; + + if (iswrite) { + /* data_size is writable only during resuming state */ + if (mig_info->device_state != VFIO_DEVICE_STATE_RESUMING) + return -EINVAL; + + if (copy_from_user(&data_size, buf, sizeof(data_size))) + return -EFAULT; + + mig_info->data_size = data_size; + } else { + if (mig_info->device_state != VFIO_DEVICE_STATE_SAVING) + return -EINVAL; + + if (copy_to_user(buf, &mig_info->data_size, + sizeof(data_size))) + return -EFAULT; + } + + return count; +} + +static ssize_t vfio_pci_handle_mig_dev_cmd(struct vfio_pci_migration_data *data, + char __user *buf, size_t count, bool iswrite) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + u32 device_cmd; + int ret = -EFAULT; + + if (count != sizeof(device_cmd) || !iswrite || !mig_drv->dev_mig_ops) + return -EINVAL; + + if (copy_from_user(&device_cmd, buf, count)) + return -EFAULT; + + switch (device_cmd) { + case VFIO_DEVICE_MIGRATION_CANCEL: + if (mig_drv->dev_mig_ops->cancel) + ret = mig_drv->dev_mig_ops->cancel(pdev); + break; + default: + dev_err(&pdev->dev, "cmd is invaild\n"); + return -EINVAL; + } + + if (ret != 0) + return ret; + + return count; +} + +static ssize_t vfio_pci_handle_mig_drv_version( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u32 version_id = mig_info->version_id; + + if (count != sizeof(version_id) || iswrite) + return -EINVAL; + + if (copy_to_user(buf, &version_id, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_rw( + struct vfio_pci_migration_data *data, + char __user *buf, size_t count, u64 pos, bool iswrite) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + void *data_addr = data->vf_data; + + if (count == 0) { + dev_err(&data->vf_dev->dev, "qemu operation data size error!\n"); + return -EINVAL; + } + + data_addr += pos - mig_ctl->data_offset; + if (iswrite) { + if (copy_from_user(data_addr, buf, count)) + return -EFAULT; + + mig_ctl->pending_bytes += count; + if (mig_ctl->pending_bytes > data->state_size) + return -EINVAL; + } else { + if (copy_to_user(buf, data_addr, count)) + return -EFAULT; + + if (mig_ctl->pending_bytes < count) + return -EINVAL; + + mig_ctl->pending_bytes -= count; + } + + return count; +} + +static ssize_t vfio_pci_dev_migrn_rw(struct vfio_pci_device *vdev, + char __user *buf, size_t count, loff_t *ppos, bool iswrite) +{ + unsigned int index = + VFIO_PCI_OFFSET_TO_INDEX(*ppos) - VFIO_PCI_NUM_REGIONS; + struct vfio_pci_migration_data *data = + (struct vfio_pci_migration_data *)vdev->region[index].data; + loff_t pos = *ppos & VFIO_PCI_OFFSET_MASK; + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + int ret; + + if (pos >= vdev->region[index].size) + return -EINVAL; + + count = min(count, (size_t)(vdev->region[index].size - pos)); + if (pos >= VFIO_MIGRATION_REGION_DATA_OFFSET) + return vfio_pci_handle_mig_data_rw(data, + buf, count, pos, iswrite); + + switch (pos) { + case VFIO_DEVICE_MIGRATION_OFFSET(device_state): + ret = vfio_pci_handle_mig_dev_state(data, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(pending_bytes): + ret = vfio_pci_handle_mig_pending_bytes(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(data_offset): + ret = vfio_pci_handle_mig_data_offset(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(data_size): + ret = vfio_pci_handle_mig_data_size(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(device_cmd): + ret = vfio_pci_handle_mig_dev_cmd(data, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(version_id): + ret = vfio_pci_handle_mig_drv_version(mig_ctl, + buf, count, iswrite); + break; + default: + dev_err(&vdev->pdev->dev, "invalid pos offset\n"); + ret = -EFAULT; + break; + } + + if (mig_ctl->device_state == VFIO_DEVICE_STATE_RESUMING && + mig_ctl->pending_bytes == data->state_size && + mig_ctl->data_size == data->state_size) { + if (vfio_pci_device_state_restore(data) != 0) { + dev_err(&vdev->pdev->dev, "Failed to restore device state!\n"); + return -EFAULT; + } + mig_ctl->pending_bytes = 0; + mig_ctl->data_size = 0; + } + + return ret; +} + +static void vfio_pci_dev_migrn_release(struct vfio_pci_device *vdev, + struct vfio_pci_region *region) +{ + struct vfio_pci_migration_data *data = region->data; + + if (data) { + kfree(data->mig_ctl); + kfree(data); + } +} + +static const struct vfio_pci_regops vfio_pci_migration_regops = { + .rw = vfio_pci_dev_migrn_rw, + .release = vfio_pci_dev_migrn_release, +}; + +static int vfio_pci_migration_info_init(struct pci_dev *pdev, + struct vfio_device_migration_info *mig_info, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + int ret; + + ret = vfio_pci_device_get_info(pdev, mig_info, mig_drv); + if (ret) { + dev_err(&pdev->dev, "failed to get device info\n"); + return ret; + } + + if (mig_info->data_size > VFIO_MIGRATION_BUFFER_MAX_SIZE) { + dev_err(&pdev->dev, "mig_info->data_size %llu is invalid\n", + mig_info->data_size); + return -EINVAL; + } + + mig_info->data_offset = VFIO_MIGRATION_REGION_DATA_OFFSET; + return ret; +} + +static int vfio_device_mig_data_init(struct vfio_pci_device *vdev, + struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_ctl; + u64 mig_offset; + int ret; + + mig_ctl = kzalloc(sizeof(*mig_ctl), GFP_KERNEL); + if (!mig_ctl) + return -ENOMEM; + + ret = vfio_pci_migration_info_init(vdev->pdev, mig_ctl, + data->mig_driver); + if (ret) { + dev_err(&vdev->pdev->dev, "get device info error!\n"); + goto err; + } + + mig_offset = sizeof(struct vfio_device_migration_info); + data->state_size = mig_ctl->data_size; + data->mig_ctl = krealloc(mig_ctl, mig_offset + data->state_size, + GFP_KERNEL); + if (!data->mig_ctl) { + ret = -ENOMEM; + goto err; + } + + data->vf_data = (void *)((char *)data->mig_ctl + mig_offset); + memset(data->vf_data, 0, data->state_size); + data->mig_ctl->data_size = 0; + + ret = vfio_pci_register_dev_region(vdev, VFIO_REGION_TYPE_MIGRATION, + VFIO_REGION_SUBTYPE_MIGRATION, + &vfio_pci_migration_regops, mig_offset + data->state_size, + VFIO_REGION_INFO_FLAG_READ | VFIO_REGION_INFO_FLAG_WRITE, data); + if (ret) { + kfree(data->mig_ctl); + return ret; + } + + return 0; +err: + kfree(mig_ctl); + return ret; +} + +int vfio_pci_migration_init(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + struct vfio_pci_migration_data *data = NULL; + struct pci_dev *pdev = vdev->pdev; + int ret; + + mig_driver = vfio_pci_get_mig_driver(pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_driver module\n"); + return -EINVAL; + } + + if (!try_module_get(mig_driver->owner)) { + pr_err("module %s is not live\n", mig_driver->owner->name); + return -ENODEV; + } + + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) { + module_put(mig_driver->owner); + return -ENOMEM; + } + + data->mig_driver = mig_driver; + data->vf_dev = pdev; + + ret = vfio_device_mig_data_init(vdev, data); + if (ret) { + dev_err(&pdev->dev, "failed to init vfio device migration data!\n"); + goto err; + } + + return ret; +err: + kfree(data); + module_put(mig_driver->owner); + return ret; +} + +void vfio_pci_migration_exit(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_warn(&vdev->pdev->dev, "mig_driver is not found\n"); + return; + } + + if (module_refcount(mig_driver->owner) > 0) { + vfio_pci_device_release(vdev->pdev, mig_driver); + module_put(mig_driver->owner); + } +} + +int vfio_pci_register_migration_ops(struct vfio_device_migration_ops *ops, + struct module *mod, struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + if (!ops || !mod || !pdev) + return -EINVAL; + + mig_driver = vfio_pci_find_mig_drv(pdev, mod); + if (mig_driver) { + pr_info("%s migration ops has already been registered\n", + mod->name); + atomic_add(1, &mig_driver->count); + return 0; + } + + if (!try_module_get(THIS_MODULE)) + return -ENODEV; + + mig_driver = kzalloc(sizeof(*mig_driver), GFP_KERNEL); + if (!mig_driver) { + module_put(THIS_MODULE); + return -ENOMEM; + } + + mig_driver->pdev = pdev; + mig_driver->bus_num = pdev->bus->number; + mig_driver->owner = mod; + mig_driver->dev_mig_ops = ops; + + vfio_pci_add_mig_drv(mig_driver); + + return 0; +} +EXPORT_SYMBOL_GPL(vfio_pci_register_migration_ops); + +void vfio_pci_unregister_migration_ops(struct module *mod, struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + if (!mod || !pdev) + return; + + mig_driver = vfio_pci_find_mig_drv(pdev, mod); + if (!mig_driver) { + pr_err("mig_driver is not found\n"); + return; + } + + if (atomic_sub_and_test(1, &mig_driver->count)) { + vfio_pci_remove_mig_drv(mig_driver); + kfree(mig_driver); + module_put(THIS_MODULE); + pr_info("%s succeed to unregister migration ops\n", + THIS_MODULE->name); + } +} +EXPORT_SYMBOL_GPL(vfio_pci_unregister_migration_ops); diff --git a/drivers/vfio/pci/vfio_pci_private.h b/drivers/vfio/pci/vfio_pci_private.h index 17d2bae..03af269 100644 --- a/drivers/vfio/pci/vfio_pci_private.h +++ b/drivers/vfio/pci/vfio_pci_private.h @@ -15,6 +15,7 @@ #include <linux/pci.h> #include <linux/irqbypass.h> #include <linux/types.h> +#include <linux/vfio_pci_migration.h> #ifndef VFIO_PCI_PRIVATE_H #define VFIO_PCI_PRIVATE_H @@ -55,7 +56,7 @@ struct vfio_pci_irq_ctx { struct vfio_pci_region; struct vfio_pci_regops { - size_t (*rw)(struct vfio_pci_device *vdev, char __user *buf, + ssize_t (*rw)(struct vfio_pci_device *vdev, char __user *buf, size_t count, loff_t *ppos, bool iswrite); void (*release)(struct vfio_pci_device *vdev, struct vfio_pci_region *region); @@ -173,4 +174,15 @@ static inline int vfio_pci_igd_init(struct vfio_pci_device *vdev) return -ENODEV; } #endif + +extern bool vfio_dev_migration_is_supported(struct pci_dev *pdev); +extern int vfio_pci_migration_init(struct vfio_pci_device *vdev); +extern void vfio_pci_migration_exit(struct vfio_pci_device *vdev); +extern int vfio_pci_device_log_start(struct vfio_pci_device *vdev, + struct vf_migration_log_info *log_info); +extern int vfio_pci_device_log_stop(struct vfio_pci_device *vdev, + uint32_t uuid); +extern int vfio_pci_device_log_status_query(struct vfio_pci_device *vdev); +extern int vfio_pci_device_init(struct pci_dev *pdev); +extern void vfio_pci_device_uninit(struct pci_dev *pdev); #endif /* VFIO_PCI_PRIVATE_H */ diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c index 7a386fb..35f2a29 100644 --- a/drivers/vfio/vfio.c +++ b/drivers/vfio/vfio.c @@ -33,6 +33,7 @@ #include <linux/string.h> #include <linux/uaccess.h> #include <linux/vfio.h> +#include <linux/vfio_pci_migration.h> #include <linux/wait.h> #include <linux/sched/signal.h> @@ -40,6 +41,9 @@ #define DRIVER_AUTHOR "Alex Williamson <alex.williamson(a)redhat.com>" #define DRIVER_DESC "VFIO - User Level meta-driver" +#define LOG_BUF_FRAG_SIZE (2 * 1024 * 1024) // fix to 2M +#define LOG_BUF_MAX_ADDRS_SIZE 128 // max vm ram size is 1T + static struct vfio { struct class *class; struct list_head iommu_drivers_list; @@ -57,6 +61,14 @@ struct vfio_iommu_driver { struct list_head vfio_next; }; +struct vfio_log_buf { + struct vfio_log_buf_info info; + int fd; + int buffer_state; + int device_state; + unsigned long *cpu_addrs; +}; + struct vfio_container { struct kref kref; struct list_head group_list; @@ -64,6 +76,7 @@ struct vfio_container { struct vfio_iommu_driver *iommu_driver; void *iommu_data; bool noiommu; + struct vfio_log_buf log_buf; }; struct vfio_unbound_dev { @@ -1158,8 +1171,398 @@ static long vfio_ioctl_set_iommu(struct vfio_container *container, return ret; } +static long vfio_dispatch_cmd_to_devices(const struct vfio_container *container, + unsigned int cmd, unsigned long arg) +{ + struct vfio_group *group = NULL; + struct vfio_device *device = NULL; + long ret = -ENXIO; + + list_for_each_entry(group, &container->group_list, container_next) { + list_for_each_entry(device, &group->device_list, group_next) { + ret = device->ops->ioctl(device->device_data, cmd, arg); + if (ret) { + pr_err("dispatch cmd to devices failed\n"); + return ret; + } + } + } + return ret; +} + +static long vfio_log_buf_start(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret; + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_START; + log_buf_ctl.data = (void *)&container->log_buf.info; + ret = vfio_dispatch_cmd_to_devices(container, VFIO_DEVICE_LOG_BUF_CTL, + (unsigned long)&log_buf_ctl); + if (ret) + return ret; + + container->log_buf.device_state = 1; + return 0; +} + +static long vfio_log_buf_stop(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret; + + if (container->log_buf.device_state == 0) { + pr_warn("device already stopped\n"); + return 0; + } + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_STOP; + log_buf_ctl.data = (void *)&container->log_buf.info; + ret = vfio_dispatch_cmd_to_devices(container, VFIO_DEVICE_LOG_BUF_CTL, + (unsigned long)&log_buf_ctl); + if (ret) + return ret; + + container->log_buf.device_state = 0; + return 0; +} + +static long vfio_log_buf_query(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY; + log_buf_ctl.data = (void *)&container->log_buf.info; + + return vfio_dispatch_cmd_to_devices(container, + VFIO_DEVICE_LOG_BUF_CTL, (unsigned long)&log_buf_ctl); +} + +static int vfio_log_buf_fops_mmap(struct file *filep, + struct vm_area_struct *vma) +{ + struct vfio_container *container = filep->private_data; + struct vfio_log_buf *log_buf = &container->log_buf; + unsigned long frag_pg_size; + unsigned long frag_offset; + phys_addr_t pa; + int ret = -EINVAL; + + if (!log_buf->cpu_addrs) { + pr_err("mmap before setup, please setup log buf first\n"); + return ret; + } + + if (log_buf->info.frag_size < PAGE_SIZE) { + pr_err("mmap frag size should not less than page size!\n"); + return ret; + } + + frag_pg_size = log_buf->info.frag_size / PAGE_SIZE; + frag_offset = vma->vm_pgoff / frag_pg_size; + + if (frag_offset >= log_buf->info.addrs_size) { + pr_err("mmap offset out of range!\n"); + return ret; + } + + if (vma->vm_end - vma->vm_start != log_buf->info.frag_size) { + pr_err("mmap size error, should be aligned with frag size!\n"); + return ret; + } + + pa = virt_to_phys((void *)log_buf->cpu_addrs[frag_offset]); + ret = remap_pfn_range(vma, vma->vm_start, + pa >> PAGE_SHIFT, + vma->vm_end - vma->vm_start, + vma->vm_page_prot); + if (ret) + pr_err("remap_pfn_range error!\n"); + return ret; +} + +static struct device *vfio_get_dev(struct vfio_container *container) +{ + struct vfio_group *group = NULL; + struct vfio_device *device = NULL; + + list_for_each_entry(group, &container->group_list, container_next) { + list_for_each_entry(device, &group->device_list, group_next) { + return device->dev; + } + } + return NULL; +} + +static void vfio_log_buf_release_dma(struct device *dev, + struct vfio_log_buf *log_buf) +{ + int i; + + for (i = 0; i < log_buf->info.addrs_size; i++) { + if ((log_buf->cpu_addrs && log_buf->cpu_addrs[i] != 0) && + (log_buf->info.sgevec && + log_buf->info.sgevec[i].addr != 0)) { + dma_free_coherent(dev, log_buf->info.frag_size, + (void *)log_buf->cpu_addrs[i], + log_buf->info.sgevec[i].addr); + log_buf->cpu_addrs[i] = 0; + log_buf->info.sgevec[i].addr = 0; + } + } +} + +static long vfio_log_buf_alloc_dma(struct vfio_log_buf_info *info, + struct vfio_log_buf *log_buf, struct device *dev) +{ + int i; + + for (i = 0; i < info->addrs_size; i++) { + log_buf->cpu_addrs[i] = (unsigned long)dma_alloc_coherent(dev, + info->frag_size, &log_buf->info.sgevec[i].addr, + GFP_KERNEL); + log_buf->info.sgevec[i].len = info->frag_size; + if (log_buf->cpu_addrs[i] == 0 || + log_buf->info.sgevec[i].addr == 0) { + return -ENOMEM; + } + } + return 0; +} + +static long vfio_log_buf_alloc_addrs(struct vfio_log_buf_info *info, + struct vfio_log_buf *log_buf) +{ + log_buf->info.sgevec = kcalloc(info->addrs_size, + sizeof(struct vfio_log_buf_sge), GFP_KERNEL); + if (!log_buf->info.sgevec) + return -ENOMEM; + + log_buf->cpu_addrs = kcalloc(info->addrs_size, + sizeof(unsigned long), GFP_KERNEL); + if (!log_buf->cpu_addrs) { + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; + return -ENOMEM; + } + + return 0; +} + +static long vfio_log_buf_info_valid(struct vfio_log_buf_info *info) +{ + if (info->addrs_size > LOG_BUF_MAX_ADDRS_SIZE || + info->addrs_size == 0) { + pr_err("can`t support vm ram size larger than 1T or equal to 0\n"); + return -EINVAL; + } + if (info->frag_size != LOG_BUF_FRAG_SIZE) { + pr_err("only support %d frag size\n", LOG_BUF_FRAG_SIZE); + return -EINVAL; + } + return 0; +} + +static long vfio_log_buf_setup(struct vfio_container *container, + unsigned long data) +{ + struct vfio_log_buf_info info; + struct vfio_log_buf *log_buf = &container->log_buf; + struct device *dev = NULL; + long ret; + + if (log_buf->info.sgevec) { + pr_warn("log buf already setup\n"); + return 0; + } + + if (copy_from_user(&info, (void __user *)data, + sizeof(struct vfio_log_buf_info))) + return -EFAULT; + + ret = vfio_log_buf_info_valid(&info); + if (ret) + return ret; + + ret = vfio_log_buf_alloc_addrs(&info, log_buf); + if (ret) + goto err_out; + + dev = vfio_get_dev(container); + if (!dev) { + pr_err("can`t get dev\n"); + goto err_free_addrs; + } + + ret = vfio_log_buf_alloc_dma(&info, log_buf, dev); + if (ret) + goto err_free_dma_array; + + log_buf->info.uuid = info.uuid; + log_buf->info.buffer_size = info.buffer_size; + log_buf->info.frag_size = info.frag_size; + log_buf->info.addrs_size = info.addrs_size; + log_buf->buffer_state = 1; + return 0; + +err_free_dma_array: + vfio_log_buf_release_dma(dev, log_buf); +err_free_addrs: + kfree(log_buf->cpu_addrs); + log_buf->cpu_addrs = NULL; + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; +err_out: + return -ENOMEM; +} + +static long vfio_log_buf_release_buffer(struct vfio_container *container) +{ + struct vfio_log_buf *log_buf = &container->log_buf; + struct device *dev = NULL; + + if (log_buf->buffer_state == 0) { + pr_warn("buffer already released\n"); + return 0; + } + + dev = vfio_get_dev(container); + if (!dev) { + pr_err("can`t get dev\n"); + return -EFAULT; + } + + vfio_log_buf_release_dma(dev, log_buf); + + kfree(log_buf->cpu_addrs); + log_buf->cpu_addrs = NULL; + + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; + + log_buf->buffer_state = 0; + return 0; +} + +static int vfio_log_buf_release(struct inode *inode, struct file *filep) +{ + struct vfio_container *container = filep->private_data; + + vfio_log_buf_stop(container); + vfio_log_buf_release_buffer(container); + memset(&container->log_buf, 0, sizeof(struct vfio_log_buf)); + return 0; +} + +static long vfio_ioctl_handle_log_buf_ctl(struct vfio_container *container, + unsigned long arg) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret = 0; + + if (copy_from_user(&log_buf_ctl, (void __user *)arg, + sizeof(struct vfio_log_buf_ctl))) + return -EFAULT; + + switch (log_buf_ctl.flags) { + case VFIO_DEVICE_LOG_BUF_FLAG_SETUP: + ret = vfio_log_buf_setup(container, + (unsigned long)log_buf_ctl.data); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_RELEASE: + ret = vfio_log_buf_release_buffer(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_START: + ret = vfio_log_buf_start(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STOP: + ret = vfio_log_buf_stop(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY: + ret = vfio_log_buf_query(container); + break; + default: + pr_err("log buf control flag incorrect\n"); + ret = -EINVAL; + break; + } + return ret; +} + +static long vfio_log_buf_fops_unl_ioctl(struct file *filep, + unsigned int cmd, unsigned long arg) +{ + struct vfio_container *container = filep->private_data; + long ret = -EINVAL; + + switch (cmd) { + case VFIO_LOG_BUF_CTL: + ret = vfio_ioctl_handle_log_buf_ctl(container, arg); + break; + default: + pr_err("log buf control cmd incorrect\n"); + break; + } + + return ret; +} + +#ifdef CONFIG_COMPAT +static long vfio_log_buf_fops_compat_ioctl(struct file *filep, + unsigned int cmd, unsigned long arg) +{ + arg = (unsigned long)compat_ptr(arg); + return vfio_log_buf_fops_unl_ioctl(filep, cmd, arg); +} +#endif /* CONFIG_COMPAT */ + +static const struct file_operations vfio_log_buf_fops = { + .owner = THIS_MODULE, + .mmap = vfio_log_buf_fops_mmap, + .unlocked_ioctl = vfio_log_buf_fops_unl_ioctl, + .release = vfio_log_buf_release, +#ifdef CONFIG_COMPAT + .compat_ioctl = vfio_log_buf_fops_compat_ioctl, +#endif +}; + +static int vfio_get_log_buf_fd(struct vfio_container *container, + unsigned long arg) +{ + struct file *filep = NULL; + int ret; + + if (container->log_buf.fd > 0) + return container->log_buf.fd; + + ret = get_unused_fd_flags(O_CLOEXEC); + if (ret < 0) { + pr_err("get_unused_fd_flags get fd failed\n"); + return ret; + } + + filep = anon_inode_getfile("[vfio-log-buf]", &vfio_log_buf_fops, + container, O_RDWR); + if (IS_ERR(filep)) { + pr_err("anon_inode_getfile failed\n"); + put_unused_fd(ret); + ret = PTR_ERR(filep); + return ret; + } + + filep->f_mode |= (FMODE_READ | FMODE_WRITE | FMODE_LSEEK); + + fd_install(ret, filep); + + container->log_buf.fd = ret; + return ret; +} + static long vfio_fops_unl_ioctl(struct file *filep, - unsigned int cmd, unsigned long arg) + unsigned int cmd, unsigned long arg) { struct vfio_container *container = filep->private_data; struct vfio_iommu_driver *driver; @@ -1179,6 +1582,9 @@ static long vfio_fops_unl_ioctl(struct file *filep, case VFIO_SET_IOMMU: ret = vfio_ioctl_set_iommu(container, arg); break; + case VFIO_GET_LOG_BUF_FD: + ret = vfio_get_log_buf_fd(container, arg); + break; default: driver = container->iommu_driver; data = container->iommu_data; @@ -1210,6 +1616,7 @@ static int vfio_fops_open(struct inode *inode, struct file *filep) INIT_LIST_HEAD(&container->group_list); init_rwsem(&container->group_lock); kref_init(&container->kref); + memset(&container->log_buf, 0, sizeof(struct vfio_log_buf)); filep->private_data = container; @@ -1219,9 +1626,7 @@ static int vfio_fops_open(struct inode *inode, struct file *filep) static int vfio_fops_release(struct inode *inode, struct file *filep) { struct vfio_container *container = filep->private_data; - filep->private_data = NULL; - vfio_container_put(container); return 0; diff --git a/include/linux/vfio_pci_migration.h b/include/linux/vfio_pci_migration.h new file mode 100644 index 0000000..464ffb4 --- /dev/null +++ b/include/linux/vfio_pci_migration.h @@ -0,0 +1,136 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) 2022 Huawei Technologies Co., Ltd. All rights reserved. + */ + +#ifndef VFIO_PCI_MIGRATION_H +#define VFIO_PCI_MIGRATION_H + +#include <linux/types.h> +#include <linux/pci.h> + +#define VFIO_REGION_TYPE_MIGRATION (3) +/* sub-types for VFIO_REGION_TYPE_MIGRATION */ +#define VFIO_REGION_SUBTYPE_MIGRATION (1) + +#define VFIO_MIGRATION_BUFFER_MAX_SIZE SZ_256K +#define VFIO_MIGRATION_REGION_DATA_OFFSET \ + (sizeof(struct vfio_device_migration_info)) +#define VFIO_DEVICE_MIGRATION_OFFSET(x) \ + offsetof(struct vfio_device_migration_info, x) + +struct vfio_device_migration_info { + __u32 device_state; /* VFIO device state */ +#define VFIO_DEVICE_STATE_STOP (0) +#define VFIO_DEVICE_STATE_RUNNING (1 << 0) +#define VFIO_DEVICE_STATE_SAVING (1 << 1) +#define VFIO_DEVICE_STATE_RESUMING (1 << 2) +#define VFIO_DEVICE_STATE_MASK (VFIO_DEVICE_STATE_RUNNING | \ + VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RESUMING) + __u32 reserved; + + __u32 device_cmd; + __u32 version_id; + + __u64 pending_bytes; + __u64 data_offset; + __u64 data_size; +}; + +enum { + VFIO_DEVICE_STOP = 0xffff0001, + VFIO_DEVICE_CONTINUE, + VFIO_DEVICE_MIGRATION_CANCEL, +}; + +struct vfio_log_buf_sge { + __u64 len; + __u64 addr; +}; + +struct vfio_log_buf_info { + __u32 uuid; + __u64 buffer_size; + __u64 addrs_size; + __u64 frag_size; + struct vfio_log_buf_sge *sgevec; +}; + +struct vfio_log_buf_ctl { + __u32 argsz; + __u32 flags; + #define VFIO_DEVICE_LOG_BUF_FLAG_SETUP (1 << 0) + #define VFIO_DEVICE_LOG_BUF_FLAG_RELEASE (1 << 1) + #define VFIO_DEVICE_LOG_BUF_FLAG_START (1 << 2) + #define VFIO_DEVICE_LOG_BUF_FLAG_STOP (1 << 3) + #define VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY (1 << 4) + void *data; +}; +#define VFIO_LOG_BUF_CTL _IO(VFIO_TYPE, VFIO_BASE + 21) +#define VFIO_GET_LOG_BUF_FD _IO(VFIO_TYPE, VFIO_BASE + 22) +#define VFIO_DEVICE_LOG_BUF_CTL _IO(VFIO_TYPE, VFIO_BASE + 23) + +struct vf_migration_log_info { + __u32 dom_uuid; + __u64 buffer_size; + __u64 sge_len; + __u64 sge_num; + struct vfio_log_buf_sge *sgevec; +}; + +struct vfio_device_migration_ops { + /* Get device information */ + int (*get_info)(struct pci_dev *pdev, + struct vfio_device_migration_info *info); + /* Enable a vf device */ + int (*enable)(struct pci_dev *pdev); + /* Disable a vf device */ + int (*disable)(struct pci_dev *pdev); + /* Save a vf device */ + int (*save)(struct pci_dev *pdev, void *base, + uint64_t off, uint64_t count); + /* Resuming a vf device */ + int (*restore)(struct pci_dev *pdev, void *base, + uint64_t off, uint64_t count); + /* Log start a vf device */ + int (*log_start)(struct pci_dev *pdev, + struct vf_migration_log_info *log_info); + /* Log stop a vf device */ + int (*log_stop)(struct pci_dev *pdev, uint32_t uuid); + /* Get vf device log status */ + int (*get_log_status)(struct pci_dev *pdev); + /* Pre enable a vf device(load_setup, before restore a vf) */ + int (*pre_enable)(struct pci_dev *pdev); + /* Cancel a vf device when live migration failed (rollback) */ + int (*cancel)(struct pci_dev *pdev); + /* Init a vf device */ + int (*init)(struct pci_dev *pdev); + /* Uninit a vf device */ + void (*uninit)(struct pci_dev *pdev); + /* Release a vf device */ + void (*release)(struct pci_dev *pdev); +}; + +struct vfio_pci_vendor_mig_driver { + struct pci_dev *pdev; + unsigned char bus_num; + struct vfio_device_migration_ops *dev_mig_ops; + struct module *owner; + atomic_t count; + struct list_head list; +}; + +struct vfio_pci_migration_data { + u64 state_size; + struct pci_dev *vf_dev; + struct vfio_pci_vendor_mig_driver *mig_driver; + struct vfio_device_migration_info *mig_ctl; + void *vf_data; +}; + +int vfio_pci_register_migration_ops(struct vfio_device_migration_ops *ops, + struct module *mod, struct pci_dev *pdev); +void vfio_pci_unregister_migration_ops(struct module *mod, + struct pci_dev *pdev); + +#endif /* VFIO_PCI_MIGRATION_H */ -- 1.8.3.1

3 2

[PATCH OLK-5.10 0/7] eulerfs: Add extended attributes support
by gouhao＠uniontech.com 05 Jul '22

05 Jul '22

From: Gou Hao <gouhao(a)uniontech.com> Patch series "Add extended attributes support for EulerFS". I refer to the extended attribute implementation code of ext2 file system. At first, I implemented it completely according to the extended attribute of ext file system. But later, I changed the disk layout of entries. About layout of entry: The layout of ext2's extended attribute is that name and value are stored separately,with name growing from top to bottom and value growing from bottom to top. I think the layout of ext2 wastes space, because, Name and value are aligned with 4 bytes, In the worst case, the name and value of entry need 3 bytes of padding respectively, and a total of 6 bytes are wasted. I store the name and value together. In the worst case, only need 3 bytes of padding.Use xattr-test.c selftests, with the same block size, my method can store 112 entries, while using ext2 layout can only store 102 entries. In ext4 file system, value can be stored in different blocks, which increases the scalability. In my method, it can add a pointer to the next block in the header to achieve the same function, and it is simpler. The performance of my method is the same as that of ext2, or even better. About block share: In ext2, if the extended attributes of two files are exactly the same, they can share the same disk block. Its implementation process is: 1. When accessing the extended attribute of a file, add this extended attribute block to a specific cache. 2. When setting the extended attribute of a file, if there is a block with exactly the same content as this extended attribute in the cache, share that block directly. There is a problem here. If the block of a file is not added to the cache, the extended attribute block will not be shared.So in this patch set, I didn't realize the shared disk block. I'll implement it later when there is a good method or when there is a need. At present, only user. prefix xattr is implemented. Trusted, ACL and security will be implemented later. Gou Hao (7): eulerfs: add EULER_FS_XATTR config eulerfs: add related fields of extended attributes eulerfs: add alloc xattr block interface eulerfs: implement extended attribute core functions eulerfs: add callback interface of extended attribute eulerfs: add implementation of user. prefix extended attribute eulerfs: add selftests for eulerfs extended attribute fs/eulerfs/Kconfig | 9 + fs/eulerfs/Makefile | 1 + fs/eulerfs/alloc_interface.h | 4 + fs/eulerfs/const.h | 1 + fs/eulerfs/euler.h | 1 + fs/eulerfs/euler_def.h | 3 + fs/eulerfs/file.c | 1 + fs/eulerfs/inode.c | 3 + fs/eulerfs/namei.c | 2 + fs/eulerfs/nvalloc.c | 1 + fs/eulerfs/nvalloc.h | 1 + fs/eulerfs/nvm_struct.h | 12 + fs/eulerfs/super.c | 36 +- fs/eulerfs/symlink.c | 1 + fs/eulerfs/xattr.c | 422 ++++++++++++++ fs/eulerfs/xattr.h | 99 ++++ fs/eulerfs/xattr_user.c | 43 ++ tools/testing/selftests/eulerfs/Makefile | 6 + tools/testing/selftests/eulerfs/xattr-test.c | 565 +++++++++++++++++++ 19 files changed, 1209 insertions(+), 2 deletions(-) create mode 100644 fs/eulerfs/xattr.c create mode 100644 fs/eulerfs/xattr.h create mode 100644 fs/eulerfs/xattr_user.c create mode 100644 tools/testing/selftests/eulerfs/Makefile create mode 100644 tools/testing/selftests/eulerfs/xattr-test.c -- 2.20.1

1 7

openEuler kernel SIG例会
by openEuler conference 05 Jul '22

05 Jul '22

您好！ Kernel SIG 邀请您参加 2022-07-08 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler kernel SIG例会会议内容：美团贡献富容器隔离及内部自研混部特性到openEuler kernel的讨论会议链接：https://us06web.zoom.us/j/89123664797?pwd=S1BKR3BHTTBOZUd0TTg2VE9FRUVMQT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-07-08 14:00, The subject of the conference is openEuler kernel SIG例会, Summary: 美团贡献富容器隔离及内部自研混部特性到openEuler kernel的讨论 You can join the meeting at https://us06web.zoom.us/j/89123664797?pwd=S1BKR3BHTTBOZUd0TTg2VE9FRUVMQT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

请问咱们的内核有对飞腾的的设备的支持吗？
by sireg 04 Jul '22

04 Jul '22

我运行咱们的系统在一台分腾d2000的机器上，发现网卡是驱动不起来的。网卡型号是PHYT0004，走的MDIO的总线，使用stmmac的驱动。以上是我了解的相关技术，目前网卡驱动不起来，所以没有相关dmesg日志。正在着手解决该问题，所以提请咨询。                                                                    王铭 sireg firerun(a)qq.com  

2 1

请问咱们的内核有对飞腾的的设备的支持吗？
by sireg 04 Jul '22

04 Jul '22

我运行咱们的系统在一台飞腾d2000的机器上，发现网卡驱动不起来。以上是我了解的相关技术，目前网卡驱动不起来，所以没有相关dmesg日志。网卡型号是PHYT0004，如果驱动起来，应该是走的MDIO的总线，使用stmmac的驱动。正在着手解决该问题，所以提请咨询。                                                                    王铭 sireg firerun(a)qq.com  

1 0

[PATCH openEuler-1.0-LTS 1/4] ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
by Yongqiang Liu 02 Jul '22

02 Jul '22

From: Baokun Li <libaokun1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186866, https://gitee.com/openeuler/kernel/issues/I5DTBL CVE: NA -------------------------------- When adding an xattr to an inode, we must ensure that the inode_size is not less than EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. Otherwise, the end position may be greater than the start position, resulting in UAF. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/xattr.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h index f39cad2abe2a..990084e00374 100644 --- a/fs/ext4/xattr.h +++ b/fs/ext4/xattr.h @@ -95,6 +95,19 @@ struct ext4_xattr_entry { #define EXT4_ZERO_XATTR_VALUE ((void *)-1) +/* + * If we want to add an xattr to the inode, we should make sure that + * i_extra_isize is not 0 and that the inode size is not less than + * EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. + * EXT4_GOOD_OLD_INODE_SIZE extra_isize header entry pad data + * |--------------------------|------------|------|---------|---|-------| + */ +#define EXT4_INODE_HAS_XATTR_SPACE(inode) \ + ((EXT4_I(inode)->i_extra_isize != 0) && \ + (EXT4_GOOD_OLD_INODE_SIZE + EXT4_I(inode)->i_extra_isize + \ + sizeof(struct ext4_xattr_ibody_header) + EXT4_XATTR_PAD <= \ + EXT4_INODE_SIZE((inode)->i_sb))) + struct ext4_xattr_info { const char *name; const void *value; -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 1/4] mm/sharepool: Fix using uninitialized sp_flag
by Yongqiang Liu 01 Jul '22

01 Jul '22

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I578LV CVE: NA ------------------------------------------------- Add the missing initialization for kc.sp_flag in sp_make_share_kva_to_spg(). Or a random value would be used in sp_remap_kva_to_vma(). Fixes: da51b55eeff9 ("mm/share_pool: Support read-only memory allocation") Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index ec889155b0ff..893e5352bf01 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -3023,7 +3023,7 @@ static void *sp_make_share_kva_to_spg(unsigned long kva, unsigned long size, } spa->kva = kva; - + kc.sp_flags = sp_flags; list_for_each_entry(spg_node, &spg->procs, proc_node) { mm = spg_node->master->mm; kc.state = K2U_NORMAL; -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 1/4] alinux: sched: Defend cfs and rt bandwidth against overflow
by liuzhengyuan＠kylinos.cn 30 Jun '22

30 Jun '22

From: Huaixin Chang <changhuaixin(a)linux.alibaba.com> anolis inclusion from anolis_master commit 9d168f216486333f24aa1b33706eddf3b13d7228 category: performance bugzilla: NA CVE: NA --------------------------- Kernel limitation on cpu.cfs_quota_us is insufficient. Some large numbers might cause overflow in to_ratio() calculation and produce unexpected results. For example, if we make two cpu cgroups and then write a reasonable value and a large value into child's and parent's cpu.cfs_quota_us. This will cause a write error. cd /sys/fs/cgroup/cpu mkdir parent; mkdir parent/child echo 8000 > parent/child/cpu.cfs_quota_us # 17592186044416 is (1UL << 44) echo 17592186044416 > parent/cpu.cfs_quota_us In this case, quota will overflow and thus fail the __cfs_schedulable check. Similar overflow also affects rt bandwidth. Burstable CFS bandwidth controller will also benefit from limiting quota. Change-Id: I0f89d1f26b168c5cfa041e886395c7f3068114ae Reviewed-by: Shanpei Chen <shanpeic(a)linux.alibaba.com> Signed-off-by: Huaixin Chang <changhuaixin(a)linux.alibaba.com> Signed-off-by: Zhengyuan Liu <liuzhengyuan(a)kylinos.cn> --- kernel/sched/core.c | 8 ++++++++ kernel/sched/rt.c | 9 +++++++++ kernel/sched/sched.h | 2 ++ 3 files changed, 19 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 36d7422da0ac..51fdd30f188a 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -6679,6 +6679,8 @@ static DEFINE_MUTEX(cfs_constraints_mutex); const u64 max_cfs_quota_period = 1 * NSEC_PER_SEC; /* 1s */ const u64 min_cfs_quota_period = 1 * NSEC_PER_MSEC; /* 1ms */ +/* More than 203 days if BW_SHIFT equals 20. */ +const u64 max_cfs_runtime = MAX_BW_USEC * NSEC_PER_USEC; static int __cfs_schedulable(struct task_group *tg, u64 period, u64 runtime); @@ -6706,6 +6708,12 @@ static int tg_set_cfs_bandwidth(struct task_group *tg, u64 period, u64 quota) if (period > max_cfs_quota_period) return -EINVAL; + /* + * Bound quota to defend quota against overflow during bandwidth shift. + */ + if (quota != RUNTIME_INF && quota > max_cfs_runtime) + return -EINVAL; + /* * Prevent race between setting of cfs_rq->runtime_enabled and * unthrottle_offline_cfs_rqs(). diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index 301ba04d9130..f31e0aaf1f43 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -2518,6 +2518,9 @@ static int __rt_schedulable(struct task_group *tg, u64 period, u64 runtime) return ret; } +/* More than 203 days if BW_SHIFT equals 20. */ +static const u64 max_rt_runtime = MAX_BW_USEC * NSEC_PER_USEC; + static int tg_set_rt_bandwidth(struct task_group *tg, u64 rt_period, u64 rt_runtime) { @@ -2534,6 +2537,12 @@ static int tg_set_rt_bandwidth(struct task_group *tg, if (rt_period == 0) return -EINVAL; + /* + * Bound quota to defend quota against overflow during bandwidth shift. + */ + if (rt_runtime != RUNTIME_INF && rt_runtime > max_rt_runtime) + return -EINVAL; + mutex_lock(&rt_constraints_mutex); read_lock(&tasklist_lock); err = __rt_schedulable(tg, rt_period, rt_runtime); diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index ae3068153093..f3808a49ce48 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -1732,6 +1732,8 @@ extern void init_dl_rq_bw_ratio(struct dl_rq *dl_rq); #define BW_SHIFT 20 #define BW_UNIT (1 << BW_SHIFT) #define RATIO_SHIFT 8 +#define MAX_BW_BITS (64 - BW_SHIFT) +#define MAX_BW_USEC ((1UL << MAX_BW_BITS) - 1) unsigned long to_ratio(u64 period, u64 runtime); extern void init_entity_runnable_average(struct sched_entity *se); -- 2.25.1

3 6

[PATCH openEuler-1.0-LTS 01/14] mm/sharepool: Delete single-group mode
by Yongqiang Liu 29 Jun '22

29 Jun '22

From: Zhou Guanghui <zhouguanghui1(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5EORS CVE: NA -------------------------------- The single-group mode has no application scenario. Therefore, the related branch is deleted. The boot option "enable_sp_multi_group_mode" does not take effect. Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 137 +++++++++--------------------------------------- 1 file changed, 25 insertions(+), 112 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index 5ba353ddfabd..48e309e3ddd3 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -65,9 +65,6 @@ #define byte2mb(size) ((size) >> 20) #define page2kb(page_num) ((page_num) << (PAGE_SHIFT - 10)) -#define SINGLE_GROUP_MODE 1 -#define MULTI_GROUP_MODE 2 - #define MAX_GROUP_FOR_SYSTEM 50000 #define MAX_GROUP_FOR_TASK 3000 #define MAX_PROC_PER_GROUP 1024 @@ -98,8 +95,6 @@ int sysctl_sp_perf_alloc; int sysctl_sp_perf_k2u; -static int share_pool_group_mode = SINGLE_GROUP_MODE; - static int system_group_count; static unsigned int sp_device_number; @@ -1088,12 +1083,6 @@ static int mm_add_group_init(struct mm_struct *mm, struct sp_group *spg) struct sp_group_master *master = mm->sp_group_master; bool exist = false; - if (share_pool_group_mode == SINGLE_GROUP_MODE && master && - master->count == 1) { - pr_err_ratelimited("at most one sp group for a task is allowed in single mode\n"); - return -EEXIST; - } - master = sp_init_group_master_locked(mm, &exist); if (IS_ERR(master)) return PTR_ERR(master); @@ -2235,72 +2224,30 @@ static int sp_alloc_prepare(unsigned long size, unsigned long sp_flags, if (sp_flags & SP_HUGEPAGE_ONLY) sp_flags |= SP_HUGEPAGE; - if (share_pool_group_mode == SINGLE_GROUP_MODE) { - spg = __sp_find_spg(current->pid, SPG_ID_DEFAULT); - if (spg) { - if (spg_id != SPG_ID_DEFAULT && spg->id != spg_id) { - sp_group_drop(spg); - return -ENODEV; - } - - /* up_read will be at the end of sp_alloc */ - down_read(&spg->rw_lock); - if (!spg_valid(spg)) { - up_read(&spg->rw_lock); - sp_group_drop(spg); - pr_err_ratelimited("allocation failed, spg is dead\n"); - return -ENODEV; - } - } else { /* alocation pass through scene */ - if (enable_mdc_default_group) { - int ret = 0; - - ret = sp_group_add_task(current->tgid, spg_id); - if (ret < 0) { - pr_err_ratelimited("add group failed in pass through\n"); - return ret; - } - - spg = __sp_find_spg(current->pid, SPG_ID_DEFAULT); - - /* up_read will be at the end of sp_alloc */ - down_read(&spg->rw_lock); - if (!spg_valid(spg)) { - up_read(&spg->rw_lock); - sp_group_drop(spg); - pr_err_ratelimited("pass through allocation failed, spg is dead\n"); - return -ENODEV; - } - } else { - spg = spg_none; - } + if (spg_id != SPG_ID_DEFAULT) { + spg = __sp_find_spg(current->pid, spg_id); + if (!spg) { + pr_err_ratelimited("allocation failed, can't find group\n"); + return -ENODEV; } - } else { - if (spg_id != SPG_ID_DEFAULT) { - spg = __sp_find_spg(current->pid, spg_id); - if (!spg) { - pr_err_ratelimited("allocation failed, can't find group\n"); - return -ENODEV; - } - /* up_read will be at the end of sp_alloc */ - down_read(&spg->rw_lock); - if (!spg_valid(spg)) { - up_read(&spg->rw_lock); - sp_group_drop(spg); - pr_err_ratelimited("allocation failed, spg is dead\n"); - return -ENODEV; - } + /* up_read will be at the end of sp_alloc */ + down_read(&spg->rw_lock); + if (!spg_valid(spg)) { + up_read(&spg->rw_lock); + sp_group_drop(spg); + pr_err_ratelimited("allocation failed, spg is dead\n"); + return -ENODEV; + } - if (!is_process_in_group(spg, current->mm)) { - up_read(&spg->rw_lock); - sp_group_drop(spg); - pr_err_ratelimited("allocation failed, task not in group\n"); - return -ENODEV; - } - } else { /* alocation pass through scene */ - spg = spg_none; + if (!is_process_in_group(spg, current->mm)) { + up_read(&spg->rw_lock); + sp_group_drop(spg); + pr_err_ratelimited("allocation failed, task not in group\n"); + return -ENODEV; } + } else { /* alocation pass through scene */ + spg = spg_none; } if (sp_flags & SP_HUGEPAGE) { @@ -2914,33 +2861,12 @@ static int sp_k2u_prepare(unsigned long kva, unsigned long size, kc->size_aligned = size_aligned; kc->sp_flags = sp_flags; kc->spg_id = spg_id; - kc->to_task = false; - return 0; -} - -static int sp_check_k2task(struct sp_k2u_context *kc) -{ - int ret = 0; - int spg_id = kc->spg_id; - - if (share_pool_group_mode == SINGLE_GROUP_MODE) { - struct sp_group *spg = get_first_group(current->mm); + if (spg_id == SPG_ID_DEFAULT || spg_id == SPG_ID_NONE) + kc->to_task = true; + else + kc->to_task = false; - if (!spg) { - if (spg_id != SPG_ID_NONE && spg_id != SPG_ID_DEFAULT) - ret = -EINVAL; - else - kc->to_task = true; - } else { - if (spg_id != SPG_ID_DEFAULT && spg_id != spg->id) - ret = -EINVAL; - sp_group_drop(spg); - } - } else { - if (spg_id == SPG_ID_DEFAULT || spg_id == SPG_ID_NONE) - kc->to_task = true; - } - return ret; + return 0; } static void *sp_k2u_finish(void *uva, struct sp_k2u_context *kc) @@ -2985,12 +2911,6 @@ void *sp_make_share_k2u(unsigned long kva, unsigned long size, if (ret) return ERR_PTR(ret); - ret = sp_check_k2task(&kc); - if (ret) { - uva = ERR_PTR(ret); - goto out; - } - if (kc.to_task) uva = sp_make_share_kva_to_task(kc.kva_aligned, kc.size_aligned, kc.sp_flags); else { @@ -3738,13 +3658,6 @@ static int __init enable_share_k2u_to_group(char *s) } __setup("enable_sp_share_k2u_spg", enable_share_k2u_to_group); -static int __init enable_sp_multi_group_mode(char *s) -{ - share_pool_group_mode = MULTI_GROUP_MODE; - return 1; -} -__setup("enable_sp_multi_group_mode", enable_sp_multi_group_mode); - /*** Statistical and maintenance functions ***/ static void free_process_spg_proc_stat(struct sp_proc_stat *proc_stat) -- 2.25.1

1 13

[PATCH openEuler-22.03-LTS 1/2] ipmi/watchdog: replace atomic_add() and atomic_sub()
by Miaohe Lin 29 Jun '22

29 Jun '22

From: Yejune Deng <yejune.deng(a)gmail.com> mainline inclusion from v5.11-rc1 commit a01a89b1db1066a6af23ae08b9a0c345b7966f0b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DVR9 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- atomic_inc() and atomic_dec() looks better Signed-off-by: Yejune Deng <yejune.deng(a)gmail.com> Message-Id: <1605511807-7135-1-git-send-email-yejune.deng(a)gmail.com> Signed-off-by: Corey Minyard <cminyard(a)mvista.com> Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com> --- drivers/char/ipmi/ipmi_watchdog.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c index f78156d93c3f..32c334e34d55 100644 --- a/drivers/char/ipmi/ipmi_watchdog.c +++ b/drivers/char/ipmi/ipmi_watchdog.c @@ -495,7 +495,7 @@ static void panic_halt_ipmi_heartbeat(void) msg.cmd = IPMI_WDOG_RESET_TIMER; msg.data = NULL; msg.data_len = 0; - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = ipmi_request_supply_msgs(watchdog_user, (struct ipmi_addr *) &addr, 0, @@ -505,7 +505,7 @@ static void panic_halt_ipmi_heartbeat(void) &panic_halt_heartbeat_recv_msg, 1); if (rv) - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); } static struct ipmi_smi_msg panic_halt_smi_msg = { @@ -529,12 +529,12 @@ static void panic_halt_ipmi_set_timeout(void) /* Wait for the messages to be free. */ while (atomic_read(&panic_done_count) != 0) ipmi_poll_interface(watchdog_user); - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = __ipmi_set_timeout(&panic_halt_smi_msg, &panic_halt_recv_msg, &send_heartbeat_now); if (rv) { - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); pr_warn("Unable to extend the watchdog timeout\n"); } else { if (send_heartbeat_now) -- 2.23.0

1 1

[PATCH openEuler-5.10-LTS 1/8] net: hns3: set port base vlan tbl_sta to false before removing old vlan
by Zheng Zengkai 28 Jun '22

28 Jun '22

From: Guangbin Huang <huangguangbin2(a)huawei.com> mainline inclusion from mainline-v5.19-rc1 commit 9eda7d8bcbdb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DGNU CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- When modify port base vlan, the port base vlan tbl_sta needs to set to false before removing old vlan, to indicate this operation is not finish. Fixes: c0f46de30c96 ("net: hns3: fix port base vlan add fail when concurrent with reset") Signed-off-by: Guangbin Huang <huangguangbin2(a)huawei.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Jiantao Xiao <xiaojiantao1(a)h-partners.com> Reviewed-by: Jian Shen <shenjian15(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 3e0d8388ad3f..57aaa2f1536f 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -10117,6 +10117,7 @@ static int hclge_modify_port_base_vlan_tag(struct hclge_vport *vport, if (ret) return ret; + vport->port_base_vlan_cfg.tbl_sta = false; /* remove old VLAN tag */ if (old_info->vlan_tag == 0) ret = hclge_set_vf_vlan_common(hdev, vport->vport_id, -- 2.20.1

1 7

[PATCH OLK-5.10 v3 1/2] ipmi/watchdog: replace atomic_add() and atomic_sub()
by Miaohe Lin 28 Jun '22

28 Jun '22

From: Yejune Deng <yejune.deng(a)gmail.com> mainline inclusion from v5.11-rc1 commit a01a89b1db1066a6af23ae08b9a0c345b7966f0b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DVR9 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- atomic_inc() and atomic_dec() looks better Signed-off-by: Yejune Deng <yejune.deng(a)gmail.com> Message-Id: <1605511807-7135-1-git-send-email-yejune.deng(a)gmail.com> Signed-off-by: Corey Minyard <cminyard(a)mvista.com> Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com> --- drivers/char/ipmi/ipmi_watchdog.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c index f78156d93c3f..32c334e34d55 100644 --- a/drivers/char/ipmi/ipmi_watchdog.c +++ b/drivers/char/ipmi/ipmi_watchdog.c @@ -495,7 +495,7 @@ static void panic_halt_ipmi_heartbeat(void) msg.cmd = IPMI_WDOG_RESET_TIMER; msg.data = NULL; msg.data_len = 0; - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = ipmi_request_supply_msgs(watchdog_user, (struct ipmi_addr *) &addr, 0, @@ -505,7 +505,7 @@ static void panic_halt_ipmi_heartbeat(void) &panic_halt_heartbeat_recv_msg, 1); if (rv) - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); } static struct ipmi_smi_msg panic_halt_smi_msg = { @@ -529,12 +529,12 @@ static void panic_halt_ipmi_set_timeout(void) /* Wait for the messages to be free. */ while (atomic_read(&panic_done_count) != 0) ipmi_poll_interface(watchdog_user); - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = __ipmi_set_timeout(&panic_halt_smi_msg, &panic_halt_recv_msg, &send_heartbeat_now); if (rv) { - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); pr_warn("Unable to extend the watchdog timeout\n"); } else { if (send_heartbeat_now) -- 2.23.0

1 1

[PATCH openEuler-5.10 1/5] lockdown: also lock down previous kgdb use
by Zheng Zengkai 28 Jun '22

28 Jun '22

From: Daniel Thompson <daniel.thompson(a)linaro.org> from stable-v5.10.119 commit a8f4d63142f947cd22fa615b8b3b8921cdaf4991 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5A5YP CVE: CVE-2022-21499 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… commit eadb2f47a3ced5c64b23b90fd2a3463f63726066 upstream. KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port (for example, via a hypervisor console, which some cloud vendors provide over the network) could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. Fix this by integrating lockdown into kdb's existing permissions mechanism. Unfortunately kgdb does not have any permissions mechanism (although it certainly could be added later) so, for now, kgdb is simply and brutally disabled by immediately exiting the gdb stub without taking any action. For lockdowns established early in the boot (e.g. the normal case) then this should be fine but on systems where kgdb has set breakpoints before the lockdown is enacted than "bad things" will happen. CVE: CVE-2022-21499 Co-developed-by: Stephen Brennan <stephen.s.brennan(a)oracle.com> Signed-off-by: Stephen Brennan <stephen.s.brennan(a)oracle.com> Reviewed-by: Douglas Anderson <dianders(a)chromium.org> Signed-off-by: Daniel Thompson <daniel.thompson(a)linaro.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/security.h | 2 ++ kernel/debug/debug_core.c | 24 ++++++++++++++ kernel/debug/kdb/kdb_main.c | 62 +++++++++++++++++++++++++++++++++++-- security/security.c | 2 ++ 4 files changed, 87 insertions(+), 3 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index 35355429648e..330029ef7e89 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -121,10 +121,12 @@ enum lockdown_reason { LOCKDOWN_DEBUGFS, LOCKDOWN_XMON_WR, LOCKDOWN_BPF_WRITE_USER, + LOCKDOWN_DBG_WRITE_KERNEL, LOCKDOWN_INTEGRITY_MAX, LOCKDOWN_KCORE, LOCKDOWN_KPROBES, LOCKDOWN_BPF_READ, + LOCKDOWN_DBG_READ_KERNEL, LOCKDOWN_PERF, LOCKDOWN_TRACEFS, LOCKDOWN_XMON_RW, diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c index be5b6b97adbf..363f781b56ca 100644 --- a/kernel/debug/debug_core.c +++ b/kernel/debug/debug_core.c @@ -56,6 +56,7 @@ #include <linux/vmacache.h> #include <linux/rcupdate.h> #include <linux/irq.h> +#include <linux/security.h> #include <asm/cacheflush.h> #include <asm/byteorder.h> @@ -762,6 +763,29 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs, continue; kgdb_connected = 0; } else { + /* + * This is a brutal way to interfere with the debugger + * and prevent gdb being used to poke at kernel memory. + * This could cause trouble if lockdown is applied when + * there is already an active gdb session. For now the + * answer is simply "don't do that". Typically lockdown + * *will* be applied before the debug core gets started + * so only developers using kgdb for fairly advanced + * early kernel debug can be biten by this. Hopefully + * they are sophisticated enough to take care of + * themselves, especially with help from the lockdown + * message printed on the console! + */ + if (security_locked_down(LOCKDOWN_DBG_WRITE_KERNEL)) { + if (IS_ENABLED(CONFIG_KGDB_KDB)) { + /* Switch back to kdb if possible... */ + dbg_kdb_mode = 1; + continue; + } else { + /* ... otherwise just bail */ + break; + } + } error = gdb_serial_stub(ks); } diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c index 930ac1b25ec7..4e09fab52faf 100644 --- a/kernel/debug/kdb/kdb_main.c +++ b/kernel/debug/kdb/kdb_main.c @@ -45,6 +45,7 @@ #include <linux/proc_fs.h> #include <linux/uaccess.h> #include <linux/slab.h> +#include <linux/security.h> #include "kdb_private.h" #undef MODULE_PARAM_PREFIX @@ -197,10 +198,62 @@ struct task_struct *kdb_curr_task(int cpu) } /* - * Check whether the flags of the current command and the permissions - * of the kdb console has allow a command to be run. + * Update the permissions flags (kdb_cmd_enabled) to match the + * current lockdown state. + * + * Within this function the calls to security_locked_down() are "lazy". We + * avoid calling them if the current value of kdb_cmd_enabled already excludes + * flags that might be subject to lockdown. Additionally we deliberately check + * the lockdown flags independently (even though read lockdown implies write + * lockdown) since that results in both simpler code and clearer messages to + * the user on first-time debugger entry. + * + * The permission masks during a read+write lockdown permits the following + * flags: INSPECT, SIGNAL, REBOOT (and ALWAYS_SAFE). + * + * The INSPECT commands are not blocked during lockdown because they are + * not arbitrary memory reads. INSPECT covers the backtrace family (sometimes + * forcing them to have no arguments) and lsmod. These commands do expose + * some kernel state but do not allow the developer seated at the console to + * choose what state is reported. SIGNAL and REBOOT should not be controversial, + * given these are allowed for root during lockdown already. + */ +static void kdb_check_for_lockdown(void) +{ + const int write_flags = KDB_ENABLE_MEM_WRITE | + KDB_ENABLE_REG_WRITE | + KDB_ENABLE_FLOW_CTRL; + const int read_flags = KDB_ENABLE_MEM_READ | + KDB_ENABLE_REG_READ; + + bool need_to_lockdown_write = false; + bool need_to_lockdown_read = false; + + if (kdb_cmd_enabled & (KDB_ENABLE_ALL | write_flags)) + need_to_lockdown_write = + security_locked_down(LOCKDOWN_DBG_WRITE_KERNEL); + + if (kdb_cmd_enabled & (KDB_ENABLE_ALL | read_flags)) + need_to_lockdown_read = + security_locked_down(LOCKDOWN_DBG_READ_KERNEL); + + /* De-compose KDB_ENABLE_ALL if required */ + if (need_to_lockdown_write || need_to_lockdown_read) + if (kdb_cmd_enabled & KDB_ENABLE_ALL) + kdb_cmd_enabled = KDB_ENABLE_MASK & ~KDB_ENABLE_ALL; + + if (need_to_lockdown_write) + kdb_cmd_enabled &= ~write_flags; + + if (need_to_lockdown_read) + kdb_cmd_enabled &= ~read_flags; +} + +/* + * Check whether the flags of the current command, the permissions of the kdb + * console and the lockdown state allow a command to be run. */ -static inline bool kdb_check_flags(kdb_cmdflags_t flags, int permissions, +static bool kdb_check_flags(kdb_cmdflags_t flags, int permissions, bool no_args) { /* permissions comes from userspace so needs massaging slightly */ @@ -1194,6 +1247,9 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs, kdb_curr_task(raw_smp_processor_id()); KDB_DEBUG_STATE("kdb_local 1", reason); + + kdb_check_for_lockdown(); + kdb_go_count = 0; if (reason == KDB_REASON_DEBUG) { /* special case below */ diff --git a/security/security.c b/security/security.c index 4fb58543eeb9..2fc40217d49d 100644 --- a/security/security.c +++ b/security/security.c @@ -59,10 +59,12 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { [LOCKDOWN_DEBUGFS] = "debugfs access", [LOCKDOWN_XMON_WR] = "xmon write access", [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM", + [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM", [LOCKDOWN_INTEGRITY_MAX] = "integrity", [LOCKDOWN_KCORE] = "/proc/kcore access", [LOCKDOWN_KPROBES] = "use of kprobes", [LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM", + [LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM", [LOCKDOWN_PERF] = "unsafe use of perf", [LOCKDOWN_TRACEFS] = "use of tracefs", [LOCKDOWN_XMON_RW] = "xmon read and write access", -- 2.20.1

1 4

[PATCH openEuler-5.10 00/31] Backport 5.10.109 LTS
by Zheng Zengkai 28 Jun '22

28 Jun '22

Backport 5.10.109 LTS patches from upstream nds32: fix access_ok() checks in get/put_user wcn36xx: Differentiate wcn3660 from wcn3620 tpm: use try_get_ops() in tpm-space.c mac80211: fix potential double free on mesh join rcu: Don't deboost before reporting expedited quiescent state Revert "ath: add support for special 0x0 regulatory domain" crypto: qat - disable registration of algorithms ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board drivers: net: xgene: Fix regression in CRC stripping ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec ALSA: cmipci: Restore aux vol on suspend/resume ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB ALSA: pcm: Add stream lock during PCM reset ioctl operations ALSA: pcm: Fix races among concurrent prealloc proc writes ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls ALSA: pcm: Fix races among concurrent read/write and buffer changes ALSA: pcm: Fix races among concurrent hw_params and hw_free calls ALSA: hda/realtek: Add quirk for ASUS GA402 ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 ALSA: hda/realtek: Add quirk for Clevo NP50PNJ ALSA: hda/realtek: Add quirk for Clevo NP70PNJ ALSA: usb-audio: add mapping for new Corsair Virtuoso SE ALSA: oss: Fix PCM OSS buffer allocation overflow ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call staging: fbtft: fb_st7789v: reset display before initialization tpm: Fix error handling in async work cgroup-v1: Correct privileges check in release_agent writes exfat: avoid incorrectly releasing for root inode net: ipv6: fix skb_over_panic in __ip6_append_data Already merged: llc: only change llc->dev when bind() succeeds netfilter: nf_tables: initialize registers in nft_do_chain() llc: fix netdevice reference leaks in llc_ui_bind() cgroup: Use open-time cgroup namespace for process migration perm checks cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION Total patches: 37 - 6 = 31 Arnd Bergmann (1): nds32: fix access_ok() checks in get/put_user Brian Norris (1): Revert "ath: add support for special 0x0 regulatory domain" Bryan O'Donoghue (1): wcn36xx: Differentiate wcn3660 from wcn3620 Chen Li (1): exfat: avoid incorrectly releasing for root inode Giacomo Guiduzzi (1): ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec Giovanni Cabiddu (1): crypto: qat - disable registration of algorithms James Bottomley (1): tpm: use try_get_ops() in tpm-space.c Jason Zheng (1): ALSA: hda/realtek: Add quirk for ASUS GA402 Jonathan Teh (1): ALSA: cmipci: Restore aux vol on suspend/resume Lars-Peter Clausen (1): ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB Linus Lüssing (1): mac80211: fix potential double free on mesh join Mark Cilissen (1): ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board Maximilian Luz (1): ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 Michal Koutný (1): cgroup-v1: Correct privileges check in release_agent writes Oliver Graute (1): staging: fbtft: fb_st7789v: reset display before initialization Paul E. McKenney (1): rcu: Don't deboost before reporting expedited quiescent state Reza Jahanbakhshi (1): ALSA: usb-audio: add mapping for new Corsair Virtuoso SE Stephane Graber (1): drivers: net: xgene: Fix regression in CRC stripping Tadeusz Struk (2): net: ipv6: fix skb_over_panic in __ip6_append_data tpm: Fix error handling in async work Takashi Iwai (7): ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call ALSA: oss: Fix PCM OSS buffer allocation overflow ALSA: pcm: Fix races among concurrent hw_params and hw_free calls ALSA: pcm: Fix races among concurrent read/write and buffer changes ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls ALSA: pcm: Fix races among concurrent prealloc proc writes ALSA: pcm: Add stream lock during PCM reset ioctl operations Tim Crawford (2): ALSA: hda/realtek: Add quirk for Clevo NP70PNJ ALSA: hda/realtek: Add quirk for Clevo NP50PNJ Werner Sembach (1): ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU huangwenhui (1): ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 arch/nds32/include/asm/uaccess.h | 22 ++++- arch/x86/kernel/acpi/boot.c | 24 +++++ drivers/acpi/battery.c | 12 +++ drivers/acpi/video_detect.c | 75 ++++++++++++++ drivers/char/tpm/tpm-dev-common.c | 8 +- drivers/char/tpm/tpm2-space.c | 8 +- drivers/crypto/qat/qat_common/qat_crypto.c | 8 ++ .../net/ethernet/apm/xgene/xgene_enet_main.c | 12 ++- drivers/net/wireless/ath/regd.c | 10 +- drivers/net/wireless/ath/wcn36xx/main.c | 3 + drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 + drivers/staging/fbtft/fb_st7789v.c | 2 + fs/exfat/super.c | 2 +- include/sound/pcm.h | 1 + kernel/cgroup/cgroup-v1.c | 6 +- kernel/rcu/tree_plugin.h | 9 +- net/ipv6/ip6_output.c | 4 +- net/mac80211/cfg.c | 3 - sound/core/oss/pcm_oss.c | 12 ++- sound/core/oss/pcm_plugin.c | 5 +- sound/core/pcm.c | 2 + sound/core/pcm_lib.c | 4 + sound/core/pcm_memory.c | 11 ++- sound/core/pcm_native.c | 97 ++++++++++++------- sound/pci/ac97/ac97_codec.c | 4 +- sound/pci/cmipci.c | 3 +- sound/pci/hda/patch_realtek.c | 4 + sound/soc/sti/uniperif_player.c | 6 +- sound/soc/sti/uniperif_reader.c | 2 +- sound/usb/mixer_maps.c | 10 ++ sound/usb/mixer_quirks.c | 7 +- 31 files changed, 289 insertions(+), 88 deletions(-) -- 2.20.1

1 31

[PATCH openEuler-1.0-LTS] io_uring: io_close: Set owner as current->files if req->work.files uninitialized
by Yongqiang Liu 28 Jun '22

28 Jun '22

From: Zhihao Cheng <chengzhihao1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186543, https://gitee.com/openeuler/kernel/issues/I5BGFA CVE: NA -------------------------------- Following process will trigger an use-after-free problem: 1. open /proc/sysvipc/msg and lock it by file lock fcntl_setlk do_lock_file_wait vfs_lock_file posix_lock_file locks_insert_lock_ctx locks_insert_global_locks // Added to lock list 2. Close /proc/sysvipc/msg by io_uring filp_close(close->put_file, req->work.files) // req->work.files equals NULL，io_grab_files() initialize it, non-async operations won't invokes the function. locks_remove_posix(filp, NULL) lock.fl_owner = NULL vfs_lock_file posix_lock_file posix_same_owner // Return false according to fl_owner. locks_delete_lock_ctx(fl, &dispose) and locks_dispose_list won't be executed, flock is not removed from lock list fput(filp) // release filp 3. Read /proc/locks seq_read locks_start // Get flock from lock list locks_show lock_get_status file_inode(f->file) // Access released file, UAF occurs! Fix it by passing current->files when req->work.files is uninitialized, because io-sq thread shares same files with uring_fd task, so it still works in SQPOLL mode. Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index c104425b2557..7ae8ba98e73b 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3903,7 +3903,7 @@ static int io_close(struct io_kiocb *req, bool force_nonblock, } /* No ->flush() or already async, safely close from here */ - ret = filp_close(close->put_file, req->work.files); + ret = filp_close(close->put_file, req->work.files ? : current->files); if (ret < 0) req_set_fail_links(req); fput(close->put_file); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 1/5] lockdown: also lock down previous kgdb use
by Zheng Zengkai 27 Jun '22

27 Jun '22

From: Daniel Thompson <daniel.thompson(a)linaro.org> from stable-v5.10.119 commit a8f4d63142f947cd22fa615b8b3b8921cdaf4991 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5A5YP CVE: CVE-2022-21499 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… commit eadb2f47a3ced5c64b23b90fd2a3463f63726066 upstream. KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port (for example, via a hypervisor console, which some cloud vendors provide over the network) could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. Fix this by integrating lockdown into kdb's existing permissions mechanism. Unfortunately kgdb does not have any permissions mechanism (although it certainly could be added later) so, for now, kgdb is simply and brutally disabled by immediately exiting the gdb stub without taking any action. For lockdowns established early in the boot (e.g. the normal case) then this should be fine but on systems where kgdb has set breakpoints before the lockdown is enacted than "bad things" will happen. CVE: CVE-2022-21499 Co-developed-by: Stephen Brennan <stephen.s.brennan(a)oracle.com> Signed-off-by: Stephen Brennan <stephen.s.brennan(a)oracle.com> Reviewed-by: Douglas Anderson <dianders(a)chromium.org> Signed-off-by: Daniel Thompson <daniel.thompson(a)linaro.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/security.h | 2 ++ kernel/debug/debug_core.c | 24 ++++++++++++++ kernel/debug/kdb/kdb_main.c | 62 +++++++++++++++++++++++++++++++++++-- security/security.c | 2 ++ 4 files changed, 87 insertions(+), 3 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index 35355429648e..330029ef7e89 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -121,10 +121,12 @@ enum lockdown_reason { LOCKDOWN_DEBUGFS, LOCKDOWN_XMON_WR, LOCKDOWN_BPF_WRITE_USER, + LOCKDOWN_DBG_WRITE_KERNEL, LOCKDOWN_INTEGRITY_MAX, LOCKDOWN_KCORE, LOCKDOWN_KPROBES, LOCKDOWN_BPF_READ, + LOCKDOWN_DBG_READ_KERNEL, LOCKDOWN_PERF, LOCKDOWN_TRACEFS, LOCKDOWN_XMON_RW, diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c index be5b6b97adbf..363f781b56ca 100644 --- a/kernel/debug/debug_core.c +++ b/kernel/debug/debug_core.c @@ -56,6 +56,7 @@ #include <linux/vmacache.h> #include <linux/rcupdate.h> #include <linux/irq.h> +#include <linux/security.h> #include <asm/cacheflush.h> #include <asm/byteorder.h> @@ -762,6 +763,29 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs, continue; kgdb_connected = 0; } else { + /* + * This is a brutal way to interfere with the debugger + * and prevent gdb being used to poke at kernel memory. + * This could cause trouble if lockdown is applied when + * there is already an active gdb session. For now the + * answer is simply "don't do that". Typically lockdown + * *will* be applied before the debug core gets started + * so only developers using kgdb for fairly advanced + * early kernel debug can be biten by this. Hopefully + * they are sophisticated enough to take care of + * themselves, especially with help from the lockdown + * message printed on the console! + */ + if (security_locked_down(LOCKDOWN_DBG_WRITE_KERNEL)) { + if (IS_ENABLED(CONFIG_KGDB_KDB)) { + /* Switch back to kdb if possible... */ + dbg_kdb_mode = 1; + continue; + } else { + /* ... otherwise just bail */ + break; + } + } error = gdb_serial_stub(ks); } diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c index 930ac1b25ec7..4e09fab52faf 100644 --- a/kernel/debug/kdb/kdb_main.c +++ b/kernel/debug/kdb/kdb_main.c @@ -45,6 +45,7 @@ #include <linux/proc_fs.h> #include <linux/uaccess.h> #include <linux/slab.h> +#include <linux/security.h> #include "kdb_private.h" #undef MODULE_PARAM_PREFIX @@ -197,10 +198,62 @@ struct task_struct *kdb_curr_task(int cpu) } /* - * Check whether the flags of the current command and the permissions - * of the kdb console has allow a command to be run. + * Update the permissions flags (kdb_cmd_enabled) to match the + * current lockdown state. + * + * Within this function the calls to security_locked_down() are "lazy". We + * avoid calling them if the current value of kdb_cmd_enabled already excludes + * flags that might be subject to lockdown. Additionally we deliberately check + * the lockdown flags independently (even though read lockdown implies write + * lockdown) since that results in both simpler code and clearer messages to + * the user on first-time debugger entry. + * + * The permission masks during a read+write lockdown permits the following + * flags: INSPECT, SIGNAL, REBOOT (and ALWAYS_SAFE). + * + * The INSPECT commands are not blocked during lockdown because they are + * not arbitrary memory reads. INSPECT covers the backtrace family (sometimes + * forcing them to have no arguments) and lsmod. These commands do expose + * some kernel state but do not allow the developer seated at the console to + * choose what state is reported. SIGNAL and REBOOT should not be controversial, + * given these are allowed for root during lockdown already. + */ +static void kdb_check_for_lockdown(void) +{ + const int write_flags = KDB_ENABLE_MEM_WRITE | + KDB_ENABLE_REG_WRITE | + KDB_ENABLE_FLOW_CTRL; + const int read_flags = KDB_ENABLE_MEM_READ | + KDB_ENABLE_REG_READ; + + bool need_to_lockdown_write = false; + bool need_to_lockdown_read = false; + + if (kdb_cmd_enabled & (KDB_ENABLE_ALL | write_flags)) + need_to_lockdown_write = + security_locked_down(LOCKDOWN_DBG_WRITE_KERNEL); + + if (kdb_cmd_enabled & (KDB_ENABLE_ALL | read_flags)) + need_to_lockdown_read = + security_locked_down(LOCKDOWN_DBG_READ_KERNEL); + + /* De-compose KDB_ENABLE_ALL if required */ + if (need_to_lockdown_write || need_to_lockdown_read) + if (kdb_cmd_enabled & KDB_ENABLE_ALL) + kdb_cmd_enabled = KDB_ENABLE_MASK & ~KDB_ENABLE_ALL; + + if (need_to_lockdown_write) + kdb_cmd_enabled &= ~write_flags; + + if (need_to_lockdown_read) + kdb_cmd_enabled &= ~read_flags; +} + +/* + * Check whether the flags of the current command, the permissions of the kdb + * console and the lockdown state allow a command to be run. */ -static inline bool kdb_check_flags(kdb_cmdflags_t flags, int permissions, +static bool kdb_check_flags(kdb_cmdflags_t flags, int permissions, bool no_args) { /* permissions comes from userspace so needs massaging slightly */ @@ -1194,6 +1247,9 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs, kdb_curr_task(raw_smp_processor_id()); KDB_DEBUG_STATE("kdb_local 1", reason); + + kdb_check_for_lockdown(); + kdb_go_count = 0; if (reason == KDB_REASON_DEBUG) { /* special case below */ diff --git a/security/security.c b/security/security.c index 4fb58543eeb9..2fc40217d49d 100644 --- a/security/security.c +++ b/security/security.c @@ -59,10 +59,12 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { [LOCKDOWN_DEBUGFS] = "debugfs access", [LOCKDOWN_XMON_WR] = "xmon write access", [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM", + [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM", [LOCKDOWN_INTEGRITY_MAX] = "integrity", [LOCKDOWN_KCORE] = "/proc/kcore access", [LOCKDOWN_KPROBES] = "use of kprobes", [LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM", + [LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM", [LOCKDOWN_PERF] = "unsafe use of perf", [LOCKDOWN_TRACEFS] = "use of tracefs", [LOCKDOWN_XMON_RW] = "xmon read and write access", -- 2.20.1

1 4

[PATCH openEuler-5.10-LTS 00/31] Backport 5.10.109 LTS
by Zheng Zengkai 27 Jun '22

27 Jun '22

Backport 5.10.109 LTS patches from upstream nds32: fix access_ok() checks in get/put_user wcn36xx: Differentiate wcn3660 from wcn3620 tpm: use try_get_ops() in tpm-space.c mac80211: fix potential double free on mesh join rcu: Don't deboost before reporting expedited quiescent state Revert "ath: add support for special 0x0 regulatory domain" crypto: qat - disable registration of algorithms ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board drivers: net: xgene: Fix regression in CRC stripping ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec ALSA: cmipci: Restore aux vol on suspend/resume ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB ALSA: pcm: Add stream lock during PCM reset ioctl operations ALSA: pcm: Fix races among concurrent prealloc proc writes ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls ALSA: pcm: Fix races among concurrent read/write and buffer changes ALSA: pcm: Fix races among concurrent hw_params and hw_free calls ALSA: hda/realtek: Add quirk for ASUS GA402 ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 ALSA: hda/realtek: Add quirk for Clevo NP50PNJ ALSA: hda/realtek: Add quirk for Clevo NP70PNJ ALSA: usb-audio: add mapping for new Corsair Virtuoso SE ALSA: oss: Fix PCM OSS buffer allocation overflow ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call staging: fbtft: fb_st7789v: reset display before initialization tpm: Fix error handling in async work cgroup-v1: Correct privileges check in release_agent writes exfat: avoid incorrectly releasing for root inode net: ipv6: fix skb_over_panic in __ip6_append_data Already merged: llc: only change llc->dev when bind() succeeds netfilter: nf_tables: initialize registers in nft_do_chain() llc: fix netdevice reference leaks in llc_ui_bind() cgroup: Use open-time cgroup namespace for process migration perm checks cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION Total patches: 37 - 6 = 31 Arnd Bergmann (1): nds32: fix access_ok() checks in get/put_user Brian Norris (1): Revert "ath: add support for special 0x0 regulatory domain" Bryan O'Donoghue (1): wcn36xx: Differentiate wcn3660 from wcn3620 Chen Li (1): exfat: avoid incorrectly releasing for root inode Giacomo Guiduzzi (1): ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec Giovanni Cabiddu (1): crypto: qat - disable registration of algorithms James Bottomley (1): tpm: use try_get_ops() in tpm-space.c Jason Zheng (1): ALSA: hda/realtek: Add quirk for ASUS GA402 Jonathan Teh (1): ALSA: cmipci: Restore aux vol on suspend/resume Lars-Peter Clausen (1): ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB Linus Lüssing (1): mac80211: fix potential double free on mesh join Mark Cilissen (1): ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board Maximilian Luz (1): ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 Michal Koutný (1): cgroup-v1: Correct privileges check in release_agent writes Oliver Graute (1): staging: fbtft: fb_st7789v: reset display before initialization Paul E. McKenney (1): rcu: Don't deboost before reporting expedited quiescent state Reza Jahanbakhshi (1): ALSA: usb-audio: add mapping for new Corsair Virtuoso SE Stephane Graber (1): drivers: net: xgene: Fix regression in CRC stripping Tadeusz Struk (2): net: ipv6: fix skb_over_panic in __ip6_append_data tpm: Fix error handling in async work Takashi Iwai (7): ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call ALSA: oss: Fix PCM OSS buffer allocation overflow ALSA: pcm: Fix races among concurrent hw_params and hw_free calls ALSA: pcm: Fix races among concurrent read/write and buffer changes ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls ALSA: pcm: Fix races among concurrent prealloc proc writes ALSA: pcm: Add stream lock during PCM reset ioctl operations Tim Crawford (2): ALSA: hda/realtek: Add quirk for Clevo NP70PNJ ALSA: hda/realtek: Add quirk for Clevo NP50PNJ Werner Sembach (1): ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU huangwenhui (1): ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 arch/nds32/include/asm/uaccess.h | 22 ++++- arch/x86/kernel/acpi/boot.c | 24 +++++ drivers/acpi/battery.c | 12 +++ drivers/acpi/video_detect.c | 75 ++++++++++++++ drivers/char/tpm/tpm-dev-common.c | 8 +- drivers/char/tpm/tpm2-space.c | 8 +- drivers/crypto/qat/qat_common/qat_crypto.c | 8 ++ .../net/ethernet/apm/xgene/xgene_enet_main.c | 12 ++- drivers/net/wireless/ath/regd.c | 10 +- drivers/net/wireless/ath/wcn36xx/main.c | 3 + drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 + drivers/staging/fbtft/fb_st7789v.c | 2 + fs/exfat/super.c | 2 +- include/sound/pcm.h | 1 + kernel/cgroup/cgroup-v1.c | 6 +- kernel/rcu/tree_plugin.h | 9 +- net/ipv6/ip6_output.c | 4 +- net/mac80211/cfg.c | 3 - sound/core/oss/pcm_oss.c | 12 ++- sound/core/oss/pcm_plugin.c | 5 +- sound/core/pcm.c | 2 + sound/core/pcm_lib.c | 4 + sound/core/pcm_memory.c | 11 ++- sound/core/pcm_native.c | 97 ++++++++++++------- sound/pci/ac97/ac97_codec.c | 4 +- sound/pci/cmipci.c | 3 +- sound/pci/hda/patch_realtek.c | 4 + sound/soc/sti/uniperif_player.c | 6 +- sound/soc/sti/uniperif_reader.c | 2 +- sound/usb/mixer_maps.c | 10 ++ sound/usb/mixer_quirks.c | 7 +- 31 files changed, 289 insertions(+), 88 deletions(-) -- 2.20.1

1 31

[PATCH openEuler-1.0-LTS] mm/memcontrol: fix wrong vmstats for dying memcg
by Yongqiang Liu 27 Jun '22

27 Jun '22

From: Lu Jialin <lujialin4(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5E8LA CVE: NA -------------------------------- At present, only when the absolute value of stat_cpu->count exceeds MEMCG_CHARGE_BATCH will it be updated to stat, so there will always be a certain lag difference between stat and the correct value. In addition, since the partially deleted memcg is still referenced, it will not be freed immediately after it is offline. Although the remaining memcg has released the page, it and the parent's stat will still be not 0 or too large due to the update lag, which leads to the abnormality of the total_<count> parameter in the memory.stat file. This patch mainly solves the problem of synchronization between memcg's stat and the correct value during the destruction process from two aspects: 1) Perform a flush synchronization operation when memcg is offline 2) For memcg in the process of being destroyed, bypass the threshold judgment when updating vmstats Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/memcontrol.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 2983baf910f4..345a9d159ad8 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -697,7 +697,8 @@ void __mod_memcg_state(struct mem_cgroup *memcg, int idx, int val) return; x = val + __this_cpu_read(memcg->stat_cpu->count[idx]); - if (unlikely(abs(x) > MEMCG_CHARGE_BATCH)) { + if (unlikely(abs(x) > MEMCG_CHARGE_BATCH || + memcg->css.flags & CSS_DYING)) { struct mem_cgroup *mi; struct mem_cgroup_extension *memcg_ext; @@ -3244,8 +3245,10 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg) stat[i] = 0; for_each_online_cpu(cpu) - for (i = 0; i < MEMCG_NR_STAT; i++) + for (i = 0; i < MEMCG_NR_STAT; i++) { stat[i] += per_cpu(memcg->stat_cpu->count[i], cpu); + per_cpu(memcg->stat_cpu->count[i], cpu) = 0; + } for (mi = memcg; mi; mi = parent_mem_cgroup(mi)) for (i = 0; i < MEMCG_NR_STAT; i++) @@ -3259,9 +3262,11 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg) stat[i] = 0; for_each_online_cpu(cpu) - for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++) + for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++) { stat[i] += per_cpu( pn->lruvec_stat_cpu->count[i], cpu); + per_cpu(pn->lruvec_stat_cpu->count[i], cpu) = 0; + } for (pi = pn; pi; pi = parent_nodeinfo(pi, node)) for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++) @@ -3279,9 +3284,11 @@ static void memcg_flush_percpu_vmevents(struct mem_cgroup *memcg) events[i] = 0; for_each_online_cpu(cpu) - for (i = 0; i < NR_VM_EVENT_ITEMS; i++) + for (i = 0; i < NR_VM_EVENT_ITEMS; i++) { events[i] += per_cpu(memcg->stat_cpu->events[i], cpu); + per_cpu(memcg->stat_cpu->events[i], cpu) = 0; + } for (mi = memcg; mi; mi = parent_mem_cgroup(mi)) for (i = 0; i < NR_VM_EVENT_ITEMS; i++) @@ -5106,6 +5113,9 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css) memcg_offline_kmem(memcg); wb_memcg_offline(memcg); + memcg_flush_percpu_vmstats(memcg); + memcg_flush_percpu_vmevents(memcg); + mem_cgroup_id_put(memcg); } -- 2.25.1

1 0

sig-Intel-Arch 例会
by Tian, Jun J 27 Jun '22

27 Jun '22

大家好，本次Intel Arch例会定于本周二6/28 10:00-11:00AM进行, 欢迎大家提出更多需求或议题和参与讨论。本次初步议题： Agenda: *Status update *SPR feature PRs merge into intel-kernel & OLK-5.10 kernel *Compiler support for new instructions *Support 22.09 release for SPR fundamental features -----Original Appointment----- From: openEuler conference <public(a)openeuler.org> Sent: Monday, June 20, 2022 3:10 PM To: openEuler conference; jun.j.tian@intel.com,kai.liu@suse.com Subject: sig-Intel-Arch When: Tuesday, June 28, 2022 10:00 AM-11:00 AM (UTC+08:00) Beijing, Chongqing, Hong Kong, Urumqi. Where: 您好！ sig-Intel-Arch SIG 邀请您参加 2022-06-28 10:00 召开的Zoom会议会议主题：sig-Intel-Arch 会议链接：https://us06web.zoom.us/j/81976528831?pwd=cVIxUkRhUXFGcldFV0ZtNkpvUFpxZz09 会议纪要：https://etherpad.openeuler.org/p/sig-Intel-Arch-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler sig-Intel-Arch SIG invites you to attend the Zoom conference will be held at 2022-06-28 10:00, The subject of the conference is sig-Intel-Arch, You can join the meeting at https://us06web.zoom.us/j/81976528831?pwd=cVIxUkRhUXFGcldFV0ZtNkpvUFpxZz09. Add topics at https://etherpad.openeuler.org/p/sig-Intel-Arch-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] ext4: recover csum seed of tmp_inode after migrating to extents
by Yongqiang Liu 25 Jun '22

25 Jun '22

From: Li Lingfeng <lilingfeng3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186944, https://gitee.com/openeuler/kernel/issues/I5DAJY CVE: NA -------------------------------- When migrating to extents, the checksum seed of temporary inode need to be replaced by inode's, otherwise the inode checksums will be incorrect when swapping the inodes data. However, the temporary inode can not match it's checksum to itself since it has lost it's own checksum seed. mkfs.ext4 -F /dev/sdc mount /dev/sdc /mnt/sdc xfs_io -fc "pwrite 4k 4k" -c "fsync" /mnt/sdc/testfile chattr -e /mnt/sdc/testfile chattr +e /mnt/sdc/testfile fsck -fn /dev/sdc ======== ... Pass 1: Checking inodes, blocks, and sizes Inode 13 passes checks, but checksum does not match inode. Fix? no ... ======== The fix is simple, save the checksum seed of temporary inode, and recover it after migrating to extents. Fixes: e81c9302a6c3 ("ext4: set csum seed in tmp inode while migrating to extents") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/migrate.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c index 75a769634b2b..ed9e7816efbb 100644 --- a/fs/ext4/migrate.c +++ b/fs/ext4/migrate.c @@ -415,7 +415,7 @@ int ext4_ext_migrate(struct inode *inode) struct inode *tmp_inode = NULL; struct migrate_struct lb; unsigned long max_entries; - __u32 goal; + __u32 goal, tmp_csum_seed; uid_t owner[2]; /* @@ -463,6 +463,7 @@ int ext4_ext_migrate(struct inode *inode) * the migration. */ ei = EXT4_I(inode); + tmp_csum_seed = EXT4_I(tmp_inode)->i_csum_seed; EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed; i_size_write(tmp_inode, i_size_read(inode)); /* @@ -573,6 +574,7 @@ int ext4_ext_migrate(struct inode *inode) * the inode is not visible to user space. */ tmp_inode->i_blocks = 0; + EXT4_I(tmp_inode)->i_csum_seed = tmp_csum_seed; /* Reset the extent details */ ext4_ext_tree_init(handle, tmp_inode); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] vfio: framework supporting vfio device hot migration
by RongWang 24 Jun '22

24 Jun '22

From: Rong Wang <w_angrong(a)163.com> kunpeng inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5CO9A CVE: NA --------------------------------- As pass through devices, hypervisor can`t control the status of device, and can`t track dirty memory DMA from device, during migration. The goal of this framework is to combine hardware to accomplish the task above. qemu |status control and dirty memory report vfio |ops to hardware hardware Signed-off-by: Rong Wang <w_angrong(a)163.com> Signed-off-by: HuHua Li <18245010845(a)163.com> Signed-off-by: Ripeng Qiu <965412048(a)qq.com> --- drivers/vfio/pci/Makefile | 2 +- drivers/vfio/pci/vfio_pci.c | 54 +++ drivers/vfio/pci/vfio_pci_migration.c | 755 ++++++++++++++++++++++++++++++++++ drivers/vfio/pci/vfio_pci_private.h | 14 +- drivers/vfio/vfio.c | 411 +++++++++++++++++- include/linux/vfio_pci_migration.h | 136 ++++++ 6 files changed, 1367 insertions(+), 5 deletions(-) create mode 100644 drivers/vfio/pci/vfio_pci_migration.c create mode 100644 include/linux/vfio_pci_migration.h diff --git a/drivers/vfio/pci/Makefile b/drivers/vfio/pci/Makefile index 76d8ec0..80a777d 100644 --- a/drivers/vfio/pci/Makefile +++ b/drivers/vfio/pci/Makefile @@ -1,5 +1,5 @@ -vfio-pci-y := vfio_pci.o vfio_pci_intrs.o vfio_pci_rdwr.o vfio_pci_config.o +vfio-pci-y := vfio_pci.o vfio_pci_intrs.o vfio_pci_rdwr.o vfio_pci_config.o vfio_pci_migration.o vfio-pci-$(CONFIG_VFIO_PCI_IGD) += vfio_pci_igd.o obj-$(CONFIG_VFIO_PCI) += vfio-pci.o diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index 51b791c..59d8280 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -30,6 +30,7 @@ #include <linux/vgaarb.h> #include <linux/nospec.h> #include <linux/sched/mm.h> +#include <linux/vfio_pci_migration.h> #include "vfio_pci_private.h" @@ -296,6 +297,14 @@ static int vfio_pci_enable(struct vfio_pci_device *vdev) vfio_pci_probe_mmaps(vdev); + if (vfio_dev_migration_is_supported(pdev)) { + ret = vfio_pci_migration_init(vdev); + if (ret) { + dev_warn(&vdev->pdev->dev, "Failed to init vfio_pci_migration\n"); + vfio_pci_disable(vdev); + return ret; + } + } return 0; } @@ -392,6 +401,7 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev) out: pci_disable_device(pdev); + vfio_pci_migration_exit(vdev); vfio_pci_try_bus_reset(vdev); if (!disable_idle_d3) @@ -642,6 +652,41 @@ struct vfio_devices { int max_index; }; +static long vfio_pci_handle_log_buf_ctl(struct vfio_pci_device *vdev, + const unsigned long arg) +{ + struct vfio_log_buf_ctl *log_buf_ctl = NULL; + struct vfio_log_buf_info *log_buf_info = NULL; + struct vf_migration_log_info migration_log_info; + long ret = 0; + + log_buf_ctl = (struct vfio_log_buf_ctl *)arg; + log_buf_info = (struct vfio_log_buf_info *)log_buf_ctl->data; + + switch (log_buf_ctl->flags) { + case VFIO_DEVICE_LOG_BUF_FLAG_START: + migration_log_info.dom_uuid = log_buf_info->uuid; + migration_log_info.buffer_size = + log_buf_info->buffer_size; + migration_log_info.sge_num = log_buf_info->addrs_size; + migration_log_info.sge_len = log_buf_info->frag_size; + migration_log_info.sgevec = log_buf_info->sgevec; + ret = vfio_pci_device_log_start(vdev, + &migration_log_info); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STOP: + ret = vfio_pci_device_log_stop(vdev, + log_buf_info->uuid); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY: + ret = vfio_pci_device_log_status_query(vdev); + break; + default: + ret = -EINVAL; + break; + } + return ret; +} static long vfio_pci_ioctl(void *device_data, unsigned int cmd, unsigned long arg) { @@ -1142,6 +1187,8 @@ static long vfio_pci_ioctl(void *device_data, return vfio_pci_ioeventfd(vdev, ioeventfd.offset, ioeventfd.data, count, ioeventfd.fd); + } else if (cmd == VFIO_DEVICE_LOG_BUF_CTL) { + return vfio_pci_handle_log_buf_ctl(vdev, arg); } return -ENOTTY; @@ -1566,6 +1613,9 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) pci_set_power_state(pdev, PCI_D3hot); } + if (vfio_dev_migration_is_supported(pdev)) + ret = vfio_pci_device_init(pdev); + return ret; } @@ -1591,6 +1641,10 @@ static void vfio_pci_remove(struct pci_dev *pdev) if (!disable_idle_d3) pci_set_power_state(pdev, PCI_D0); + + if (vfio_dev_migration_is_supported(pdev)) { + vfio_pci_device_uninit(pdev); + } } static pci_ers_result_t vfio_pci_aer_err_detected(struct pci_dev *pdev, diff --git a/drivers/vfio/pci/vfio_pci_migration.c b/drivers/vfio/pci/vfio_pci_migration.c new file mode 100644 index 0000000..f69cd13 --- /dev/null +++ b/drivers/vfio/pci/vfio_pci_migration.c @@ -0,0 +1,755 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) 2022 Huawei Technologies Co., Ltd. All rights reserved. + */ + +#include <linux/module.h> +#include <linux/io.h> +#include <linux/pci.h> +#include <linux/uaccess.h> +#include <linux/vfio.h> +#include <linux/vfio_pci_migration.h> + +#include "vfio_pci_private.h" + +static LIST_HEAD(vfio_pci_mig_drivers_list); +static DEFINE_MUTEX(vfio_pci_mig_drivers_mutex); + +static void vfio_pci_add_mig_drv(struct vfio_pci_vendor_mig_driver *mig_drv) +{ + mutex_lock(&vfio_pci_mig_drivers_mutex); + atomic_set(&mig_drv->count, 1); + list_add_tail(&mig_drv->list, &vfio_pci_mig_drivers_list); + mutex_unlock(&vfio_pci_mig_drivers_mutex); +} + +static void vfio_pci_remove_mig_drv(struct vfio_pci_vendor_mig_driver *mig_drv) +{ + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_del(&mig_drv->list); + mutex_unlock(&vfio_pci_mig_drivers_mutex); +} + +static struct vfio_pci_vendor_mig_driver * + vfio_pci_find_mig_drv(struct pci_dev *pdev, struct module *module) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = NULL; + + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_for_each_entry(mig_drv, &vfio_pci_mig_drivers_list, list) { + if (mig_drv->owner == module) { + if (mig_drv->bus_num == pdev->bus->number) + goto out; + } + } + mig_drv = NULL; +out: + mutex_unlock(&vfio_pci_mig_drivers_mutex); + return mig_drv; +} + +static struct vfio_pci_vendor_mig_driver * + vfio_pci_get_mig_driver(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = NULL; + struct pci_dev *pf_dev = pci_physfn(pdev); + + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_for_each_entry(mig_drv, &vfio_pci_mig_drivers_list, list) { + if (mig_drv->bus_num == pf_dev->bus->number) + goto out; + } + mig_drv = NULL; +out: + mutex_unlock(&vfio_pci_mig_drivers_mutex); + return mig_drv; +} + +bool vfio_dev_migration_is_supported(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + mig_driver = vfio_pci_get_mig_driver(pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_warn(&pdev->dev, "unable to find a mig_drv module\n"); + return false; + } + + return true; +} + +int vfio_pci_device_log_start(struct vfio_pci_device *vdev, + struct vf_migration_log_info *log_info) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->log_start || + (mig_driver->dev_mig_ops->log_start(vdev->pdev, + log_info) != 0)) { + dev_err(&vdev->pdev->dev, "failed to set log start\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_log_stop(struct vfio_pci_device *vdev, uint32_t uuid) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->log_stop || + (mig_driver->dev_mig_ops->log_stop(vdev->pdev, uuid) != 0)) { + dev_err(&vdev->pdev->dev, "failed to set log stop\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_log_status_query(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->get_log_status || + (mig_driver->dev_mig_ops->get_log_status(vdev->pdev) != 0)) { + dev_err(&vdev->pdev->dev, "failed to get log status\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_init(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv; + + mig_drv = vfio_pci_get_mig_driver(pdev); + if (!mig_drv || !mig_drv->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (mig_drv->dev_mig_ops->init) + return mig_drv->dev_mig_ops->init(pdev); + + return -EFAULT; +} + +void vfio_pci_device_uninit(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv; + + mig_drv = vfio_pci_get_mig_driver(pdev); + if (!mig_drv || !mig_drv->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_drv module\n"); + return; + } + + if (mig_drv->dev_mig_ops->uninit) + mig_drv->dev_mig_ops->uninit(pdev); +} + +static void vfio_pci_device_release(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (mig_drv->dev_mig_ops->release) + mig_drv->dev_mig_ops->release(pdev); +} + +static int vfio_pci_device_get_info(struct pci_dev *pdev, + struct vfio_device_migration_info *mig_info, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (mig_drv->dev_mig_ops->get_info) + return mig_drv->dev_mig_ops->get_info(pdev, mig_info); + return -EFAULT; +} + +static int vfio_pci_device_enable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->enable || + (mig_drv->dev_mig_ops->enable(pdev) != 0)) { + return -EINVAL; + } + + return 0; +} + +static int vfio_pci_device_disable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->disable || + (mig_drv->dev_mig_ops->disable(pdev) != 0)) + return -EINVAL; + + return 0; +} + +static int vfio_pci_device_pre_enable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->pre_enable || + (mig_drv->dev_mig_ops->pre_enable(pdev) != 0)) + return -EINVAL; + + return 0; +} + +static int vfio_pci_device_state_save(struct pci_dev *pdev, + struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_info = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + void *base = (void *)mig_info; + int ret = 0; + + if ((mig_info->device_state & VFIO_DEVICE_STATE_RUNNING) != 0) { + ret = vfio_pci_device_disable(pdev, mig_drv); + if (ret) { + dev_err(&pdev->dev, "failed to stop VF function!\n"); + return ret; + } + mig_info->device_state &= ~VFIO_DEVICE_STATE_RUNNING; + } + + if (mig_drv->dev_mig_ops && mig_drv->dev_mig_ops->save) { + ret = mig_drv->dev_mig_ops->save(pdev, base, + mig_info->data_offset, data->state_size); + if (ret) { + dev_err(&pdev->dev, "failed to save device state!\n"); + return -EINVAL; + } + } else { + return -EFAULT; + } + + mig_info->data_size = data->state_size; + mig_info->pending_bytes = mig_info->data_size; + return ret; +} + +static int vfio_pci_device_state_restore(struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_info = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + void *base = (void *)mig_info; + int ret; + + if (mig_drv->dev_mig_ops && mig_drv->dev_mig_ops->restore) { + ret = mig_drv->dev_mig_ops->restore(pdev, base, + mig_info->data_offset, mig_info->data_size); + if (ret) { + dev_err(&pdev->dev, "failed to restore device state!\n"); + return -EINVAL; + } + return 0; + } + + return -EFAULT; +} + +static int vfio_pci_set_device_state(struct vfio_pci_migration_data *data, + u32 state) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + int ret = 0; + + if (state == mig_ctl->device_state) + return 0; + + if (!mig_drv->dev_mig_ops) + return -EINVAL; + + switch (state) { + case VFIO_DEVICE_STATE_RUNNING: + if (!(mig_ctl->device_state & + VFIO_DEVICE_STATE_RUNNING)) + ret = vfio_pci_device_enable(pdev, mig_drv); + break; + case VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING: + /* + * (pre-copy) - device should start logging data. + */ + ret = 0; + break; + case VFIO_DEVICE_STATE_SAVING: + /* stop the vf function, save state */ + ret = vfio_pci_device_state_save(pdev, data); + break; + case VFIO_DEVICE_STATE_STOP: + if (mig_ctl->device_state & VFIO_DEVICE_STATE_RUNNING) + ret = vfio_pci_device_disable(pdev, mig_drv); + break; + case VFIO_DEVICE_STATE_RESUMING: + ret = vfio_pci_device_pre_enable(pdev, mig_drv); + break; + default: + ret = -EFAULT; + break; + } + + if (ret) + return ret; + + mig_ctl->device_state = state; + return 0; +} + +static ssize_t vfio_pci_handle_mig_dev_state( + struct vfio_pci_migration_data *data, + char __user *buf, size_t count, bool iswrite) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + u32 device_state; + int ret; + + if (count != sizeof(device_state)) + return -EINVAL; + + if (iswrite) { + if (copy_from_user(&device_state, buf, count)) + return -EFAULT; + + ret = vfio_pci_set_device_state(data, device_state); + if (ret) + return ret; + } else { + if (copy_to_user(buf, &mig_ctl->device_state, count)) + return -EFAULT; + } + + return count; +} + +static ssize_t vfio_pci_handle_mig_pending_bytes( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 pending_bytes; + + if (count != sizeof(pending_bytes) || iswrite) + return -EINVAL; + + if (mig_info->device_state == + (VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING)) { + /* In pre-copy state we have no data to return for now, + * return 0 pending bytes + */ + pending_bytes = 0; + } else { + pending_bytes = mig_info->pending_bytes; + } + + if (copy_to_user(buf, &pending_bytes, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_offset( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 data_offset = mig_info->data_offset; + + if (count != sizeof(data_offset) || iswrite) + return -EINVAL; + + if (copy_to_user(buf, &data_offset, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_size( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 data_size; + + if (count != sizeof(data_size)) + return -EINVAL; + + if (iswrite) { + /* data_size is writable only during resuming state */ + if (mig_info->device_state != VFIO_DEVICE_STATE_RESUMING) + return -EINVAL; + + if (copy_from_user(&data_size, buf, sizeof(data_size))) + return -EFAULT; + + mig_info->data_size = data_size; + } else { + if (mig_info->device_state != VFIO_DEVICE_STATE_SAVING) + return -EINVAL; + + if (copy_to_user(buf, &mig_info->data_size, + sizeof(data_size))) + return -EFAULT; + } + + return count; +} + +static ssize_t vfio_pci_handle_mig_dev_cmd(struct vfio_pci_migration_data *data, + char __user *buf, size_t count, bool iswrite) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + u32 device_cmd; + int ret = -EFAULT; + + if (count != sizeof(device_cmd) || !iswrite || !mig_drv->dev_mig_ops) + return -EINVAL; + + if (copy_from_user(&device_cmd, buf, count)) + return -EFAULT; + + switch (device_cmd) { + case VFIO_DEVICE_MIGRATION_CANCEL: + if (mig_drv->dev_mig_ops->cancel) + ret = mig_drv->dev_mig_ops->cancel(pdev); + break; + default: + dev_err(&pdev->dev, "cmd is invaild\n"); + return -EINVAL; + } + + if (ret != 0) + return ret; + + return count; +} + +static ssize_t vfio_pci_handle_mig_drv_version( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u32 version_id = mig_info->version_id; + + if (count != sizeof(version_id) || iswrite) + return -EINVAL; + + if (copy_to_user(buf, &version_id, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_rw( + struct vfio_pci_migration_data *data, + char __user *buf, size_t count, u64 pos, bool iswrite) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + void *data_addr = data->vf_data; + + if (count == 0) { + dev_err(&data->vf_dev->dev, "qemu operation data size error!\n"); + return -EINVAL; + } + + data_addr += pos - mig_ctl->data_offset; + if (iswrite) { + if (copy_from_user(data_addr, buf, count)) + return -EFAULT; + + mig_ctl->pending_bytes += count; + if (mig_ctl->pending_bytes > data->state_size) + return -EINVAL; + } else { + if (copy_to_user(buf, data_addr, count)) + return -EFAULT; + + if (mig_ctl->pending_bytes < count) + return -EINVAL; + + mig_ctl->pending_bytes -= count; + } + + return count; +} + +static ssize_t vfio_pci_dev_migrn_rw(struct vfio_pci_device *vdev, + char __user *buf, size_t count, loff_t *ppos, bool iswrite) +{ + unsigned int index = + VFIO_PCI_OFFSET_TO_INDEX(*ppos) - VFIO_PCI_NUM_REGIONS; + struct vfio_pci_migration_data *data = + (struct vfio_pci_migration_data *)vdev->region[index].data; + loff_t pos = *ppos & VFIO_PCI_OFFSET_MASK; + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + int ret; + + if (pos >= vdev->region[index].size) + return -EINVAL; + + count = min(count, (size_t)(vdev->region[index].size - pos)); + if (pos >= VFIO_MIGRATION_REGION_DATA_OFFSET) + return vfio_pci_handle_mig_data_rw(data, + buf, count, pos, iswrite); + + switch (pos) { + case VFIO_DEVICE_MIGRATION_OFFSET(device_state): + ret = vfio_pci_handle_mig_dev_state(data, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(pending_bytes): + ret = vfio_pci_handle_mig_pending_bytes(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(data_offset): + ret = vfio_pci_handle_mig_data_offset(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(data_size): + ret = vfio_pci_handle_mig_data_size(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(device_cmd): + ret = vfio_pci_handle_mig_dev_cmd(data, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(version_id): + ret = vfio_pci_handle_mig_drv_version(mig_ctl, + buf, count, iswrite); + break; + default: + dev_err(&vdev->pdev->dev, "invalid pos offset\n"); + ret = -EFAULT; + break; + } + + if (mig_ctl->device_state == VFIO_DEVICE_STATE_RESUMING && + mig_ctl->pending_bytes == data->state_size && + mig_ctl->data_size == data->state_size) { + if (vfio_pci_device_state_restore(data) != 0) { + dev_err(&vdev->pdev->dev, "Failed to restore device state!\n"); + return -EFAULT; + } + mig_ctl->pending_bytes = 0; + mig_ctl->data_size = 0; + } + + return ret; +} + +static void vfio_pci_dev_migrn_release(struct vfio_pci_device *vdev, + struct vfio_pci_region *region) +{ + struct vfio_pci_migration_data *data = region->data; + + if (data) { + kfree(data->mig_ctl); + kfree(data); + } +} + +static const struct vfio_pci_regops vfio_pci_migration_regops = { + .rw = vfio_pci_dev_migrn_rw, + .release = vfio_pci_dev_migrn_release, +}; + +static int vfio_pci_migration_info_init(struct pci_dev *pdev, + struct vfio_device_migration_info *mig_info, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + int ret; + + ret = vfio_pci_device_get_info(pdev, mig_info, mig_drv); + if (ret) { + dev_err(&pdev->dev, "failed to get device info\n"); + return ret; + } + + if (mig_info->data_size > VFIO_MIGRATION_BUFFER_MAX_SIZE) { + dev_err(&pdev->dev, "mig_info->data_size %llu is invalid\n", + mig_info->data_size); + return -EINVAL; + } + + mig_info->data_offset = VFIO_MIGRATION_REGION_DATA_OFFSET; + return ret; +} + +static int vfio_device_mig_data_init(struct vfio_pci_device *vdev, + struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_ctl; + u64 mig_offset; + int ret; + + mig_ctl = kzalloc(sizeof(*mig_ctl), GFP_KERNEL); + if (!mig_ctl) + return -ENOMEM; + + ret = vfio_pci_migration_info_init(vdev->pdev, mig_ctl, + data->mig_driver); + if (ret) { + dev_err(&vdev->pdev->dev, "get device info error!\n"); + goto err; + } + + mig_offset = sizeof(struct vfio_device_migration_info); + data->state_size = mig_ctl->data_size; + data->mig_ctl = krealloc(mig_ctl, mig_offset + data->state_size, + GFP_KERNEL); + if (!data->mig_ctl) { + ret = -ENOMEM; + goto err; + } + + data->vf_data = (void *)((char *)data->mig_ctl + mig_offset); + memset(data->vf_data, 0, data->state_size); + data->mig_ctl->data_size = 0; + + ret = vfio_pci_register_dev_region(vdev, VFIO_REGION_TYPE_MIGRATION, + VFIO_REGION_SUBTYPE_MIGRATION, + &vfio_pci_migration_regops, mig_offset + data->state_size, + VFIO_REGION_INFO_FLAG_READ | VFIO_REGION_INFO_FLAG_WRITE, data); + if (ret) { + kfree(data->mig_ctl); + return ret; + } + + return 0; +err: + kfree(mig_ctl); + return ret; +} + +int vfio_pci_migration_init(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + struct vfio_pci_migration_data *data = NULL; + struct pci_dev *pdev = vdev->pdev; + int ret; + + mig_driver = vfio_pci_get_mig_driver(pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_driver module\n"); + return -EINVAL; + } + + if (!try_module_get(mig_driver->owner)) { + pr_err("module %s is not live\n", mig_driver->owner->name); + return -ENODEV; + } + + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) { + module_put(mig_driver->owner); + return -ENOMEM; + } + + data->mig_driver = mig_driver; + data->vf_dev = pdev; + + ret = vfio_device_mig_data_init(vdev, data); + if (ret) { + dev_err(&pdev->dev, "failed to init vfio device migration data!\n"); + goto err; + } + + return ret; +err: + kfree(data); + module_put(mig_driver->owner); + return ret; +} + +void vfio_pci_migration_exit(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_warn(&vdev->pdev->dev, "mig_driver is not found\n"); + return; + } + + if (module_refcount(mig_driver->owner) > 0) { + vfio_pci_device_release(vdev->pdev, mig_driver); + module_put(mig_driver->owner); + } +} + +int vfio_pci_register_migration_ops(struct vfio_device_migration_ops *ops, + struct module *mod, struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + if (!ops || !mod || !pdev) + return -EINVAL; + + mig_driver = vfio_pci_find_mig_drv(pdev, mod); + if (mig_driver) { + pr_info("%s migration ops has already been registered\n", + mod->name); + atomic_add(1, &mig_driver->count); + return 0; + } + + if (!try_module_get(THIS_MODULE)) + return -ENODEV; + + mig_driver = kzalloc(sizeof(*mig_driver), GFP_KERNEL); + if (!mig_driver) { + module_put(THIS_MODULE); + return -ENOMEM; + } + + mig_driver->pdev = pdev; + mig_driver->bus_num = pdev->bus->number; + mig_driver->owner = mod; + mig_driver->dev_mig_ops = ops; + + vfio_pci_add_mig_drv(mig_driver); + + return 0; +} +EXPORT_SYMBOL_GPL(vfio_pci_register_migration_ops); + +void vfio_pci_unregister_migration_ops(struct module *mod, struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + if (!mod || !pdev) + return; + + mig_driver = vfio_pci_find_mig_drv(pdev, mod); + if (!mig_driver) { + pr_err("mig_driver is not found\n"); + return; + } + + if (atomic_sub_and_test(1, &mig_driver->count)) { + vfio_pci_remove_mig_drv(mig_driver); + kfree(mig_driver); + module_put(THIS_MODULE); + pr_info("%s succeed to unregister migration ops\n", + THIS_MODULE->name); + } +} +EXPORT_SYMBOL_GPL(vfio_pci_unregister_migration_ops); diff --git a/drivers/vfio/pci/vfio_pci_private.h b/drivers/vfio/pci/vfio_pci_private.h index 17d2bae..03af269 100644 --- a/drivers/vfio/pci/vfio_pci_private.h +++ b/drivers/vfio/pci/vfio_pci_private.h @@ -15,6 +15,7 @@ #include <linux/pci.h> #include <linux/irqbypass.h> #include <linux/types.h> +#include <linux/vfio_pci_migration.h> #ifndef VFIO_PCI_PRIVATE_H #define VFIO_PCI_PRIVATE_H @@ -55,7 +56,7 @@ struct vfio_pci_irq_ctx { struct vfio_pci_region; struct vfio_pci_regops { - size_t (*rw)(struct vfio_pci_device *vdev, char __user *buf, + ssize_t (*rw)(struct vfio_pci_device *vdev, char __user *buf, size_t count, loff_t *ppos, bool iswrite); void (*release)(struct vfio_pci_device *vdev, struct vfio_pci_region *region); @@ -173,4 +174,15 @@ static inline int vfio_pci_igd_init(struct vfio_pci_device *vdev) return -ENODEV; } #endif + +extern bool vfio_dev_migration_is_supported(struct pci_dev *pdev); +extern int vfio_pci_migration_init(struct vfio_pci_device *vdev); +extern void vfio_pci_migration_exit(struct vfio_pci_device *vdev); +extern int vfio_pci_device_log_start(struct vfio_pci_device *vdev, + struct vf_migration_log_info *log_info); +extern int vfio_pci_device_log_stop(struct vfio_pci_device *vdev, + uint32_t uuid); +extern int vfio_pci_device_log_status_query(struct vfio_pci_device *vdev); +extern int vfio_pci_device_init(struct pci_dev *pdev); +extern void vfio_pci_device_uninit(struct pci_dev *pdev); #endif /* VFIO_PCI_PRIVATE_H */ diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c index 7a386fb..35f2a29 100644 --- a/drivers/vfio/vfio.c +++ b/drivers/vfio/vfio.c @@ -33,6 +33,7 @@ #include <linux/string.h> #include <linux/uaccess.h> #include <linux/vfio.h> +#include <linux/vfio_pci_migration.h> #include <linux/wait.h> #include <linux/sched/signal.h> @@ -40,6 +41,9 @@ #define DRIVER_AUTHOR "Alex Williamson <alex.williamson(a)redhat.com>" #define DRIVER_DESC "VFIO - User Level meta-driver" +#define LOG_BUF_FRAG_SIZE (2 * 1024 * 1024) // fix to 2M +#define LOG_BUF_MAX_ADDRS_SIZE 128 // max vm ram size is 1T + static struct vfio { struct class *class; struct list_head iommu_drivers_list; @@ -57,6 +61,14 @@ struct vfio_iommu_driver { struct list_head vfio_next; }; +struct vfio_log_buf { + struct vfio_log_buf_info info; + int fd; + int buffer_state; + int device_state; + unsigned long *cpu_addrs; +}; + struct vfio_container { struct kref kref; struct list_head group_list; @@ -64,6 +76,7 @@ struct vfio_container { struct vfio_iommu_driver *iommu_driver; void *iommu_data; bool noiommu; + struct vfio_log_buf log_buf; }; struct vfio_unbound_dev { @@ -1158,8 +1171,398 @@ static long vfio_ioctl_set_iommu(struct vfio_container *container, return ret; } +static long vfio_dispatch_cmd_to_devices(const struct vfio_container *container, + unsigned int cmd, unsigned long arg) +{ + struct vfio_group *group = NULL; + struct vfio_device *device = NULL; + long ret = -ENXIO; + + list_for_each_entry(group, &container->group_list, container_next) { + list_for_each_entry(device, &group->device_list, group_next) { + ret = device->ops->ioctl(device->device_data, cmd, arg); + if (ret) { + pr_err("dispatch cmd to devices failed\n"); + return ret; + } + } + } + return ret; +} + +static long vfio_log_buf_start(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret; + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_START; + log_buf_ctl.data = (void *)&container->log_buf.info; + ret = vfio_dispatch_cmd_to_devices(container, VFIO_DEVICE_LOG_BUF_CTL, + (unsigned long)&log_buf_ctl); + if (ret) + return ret; + + container->log_buf.device_state = 1; + return 0; +} + +static long vfio_log_buf_stop(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret; + + if (container->log_buf.device_state == 0) { + pr_warn("device already stopped\n"); + return 0; + } + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_STOP; + log_buf_ctl.data = (void *)&container->log_buf.info; + ret = vfio_dispatch_cmd_to_devices(container, VFIO_DEVICE_LOG_BUF_CTL, + (unsigned long)&log_buf_ctl); + if (ret) + return ret; + + container->log_buf.device_state = 0; + return 0; +} + +static long vfio_log_buf_query(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY; + log_buf_ctl.data = (void *)&container->log_buf.info; + + return vfio_dispatch_cmd_to_devices(container, + VFIO_DEVICE_LOG_BUF_CTL, (unsigned long)&log_buf_ctl); +} + +static int vfio_log_buf_fops_mmap(struct file *filep, + struct vm_area_struct *vma) +{ + struct vfio_container *container = filep->private_data; + struct vfio_log_buf *log_buf = &container->log_buf; + unsigned long frag_pg_size; + unsigned long frag_offset; + phys_addr_t pa; + int ret = -EINVAL; + + if (!log_buf->cpu_addrs) { + pr_err("mmap before setup, please setup log buf first\n"); + return ret; + } + + if (log_buf->info.frag_size < PAGE_SIZE) { + pr_err("mmap frag size should not less than page size!\n"); + return ret; + } + + frag_pg_size = log_buf->info.frag_size / PAGE_SIZE; + frag_offset = vma->vm_pgoff / frag_pg_size; + + if (frag_offset >= log_buf->info.addrs_size) { + pr_err("mmap offset out of range!\n"); + return ret; + } + + if (vma->vm_end - vma->vm_start != log_buf->info.frag_size) { + pr_err("mmap size error, should be aligned with frag size!\n"); + return ret; + } + + pa = virt_to_phys((void *)log_buf->cpu_addrs[frag_offset]); + ret = remap_pfn_range(vma, vma->vm_start, + pa >> PAGE_SHIFT, + vma->vm_end - vma->vm_start, + vma->vm_page_prot); + if (ret) + pr_err("remap_pfn_range error!\n"); + return ret; +} + +static struct device *vfio_get_dev(struct vfio_container *container) +{ + struct vfio_group *group = NULL; + struct vfio_device *device = NULL; + + list_for_each_entry(group, &container->group_list, container_next) { + list_for_each_entry(device, &group->device_list, group_next) { + return device->dev; + } + } + return NULL; +} + +static void vfio_log_buf_release_dma(struct device *dev, + struct vfio_log_buf *log_buf) +{ + int i; + + for (i = 0; i < log_buf->info.addrs_size; i++) { + if ((log_buf->cpu_addrs && log_buf->cpu_addrs[i] != 0) && + (log_buf->info.sgevec && + log_buf->info.sgevec[i].addr != 0)) { + dma_free_coherent(dev, log_buf->info.frag_size, + (void *)log_buf->cpu_addrs[i], + log_buf->info.sgevec[i].addr); + log_buf->cpu_addrs[i] = 0; + log_buf->info.sgevec[i].addr = 0; + } + } +} + +static long vfio_log_buf_alloc_dma(struct vfio_log_buf_info *info, + struct vfio_log_buf *log_buf, struct device *dev) +{ + int i; + + for (i = 0; i < info->addrs_size; i++) { + log_buf->cpu_addrs[i] = (unsigned long)dma_alloc_coherent(dev, + info->frag_size, &log_buf->info.sgevec[i].addr, + GFP_KERNEL); + log_buf->info.sgevec[i].len = info->frag_size; + if (log_buf->cpu_addrs[i] == 0 || + log_buf->info.sgevec[i].addr == 0) { + return -ENOMEM; + } + } + return 0; +} + +static long vfio_log_buf_alloc_addrs(struct vfio_log_buf_info *info, + struct vfio_log_buf *log_buf) +{ + log_buf->info.sgevec = kcalloc(info->addrs_size, + sizeof(struct vfio_log_buf_sge), GFP_KERNEL); + if (!log_buf->info.sgevec) + return -ENOMEM; + + log_buf->cpu_addrs = kcalloc(info->addrs_size, + sizeof(unsigned long), GFP_KERNEL); + if (!log_buf->cpu_addrs) { + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; + return -ENOMEM; + } + + return 0; +} + +static long vfio_log_buf_info_valid(struct vfio_log_buf_info *info) +{ + if (info->addrs_size > LOG_BUF_MAX_ADDRS_SIZE || + info->addrs_size == 0) { + pr_err("can`t support vm ram size larger than 1T or equal to 0\n"); + return -EINVAL; + } + if (info->frag_size != LOG_BUF_FRAG_SIZE) { + pr_err("only support %d frag size\n", LOG_BUF_FRAG_SIZE); + return -EINVAL; + } + return 0; +} + +static long vfio_log_buf_setup(struct vfio_container *container, + unsigned long data) +{ + struct vfio_log_buf_info info; + struct vfio_log_buf *log_buf = &container->log_buf; + struct device *dev = NULL; + long ret; + + if (log_buf->info.sgevec) { + pr_warn("log buf already setup\n"); + return 0; + } + + if (copy_from_user(&info, (void __user *)data, + sizeof(struct vfio_log_buf_info))) + return -EFAULT; + + ret = vfio_log_buf_info_valid(&info); + if (ret) + return ret; + + ret = vfio_log_buf_alloc_addrs(&info, log_buf); + if (ret) + goto err_out; + + dev = vfio_get_dev(container); + if (!dev) { + pr_err("can`t get dev\n"); + goto err_free_addrs; + } + + ret = vfio_log_buf_alloc_dma(&info, log_buf, dev); + if (ret) + goto err_free_dma_array; + + log_buf->info.uuid = info.uuid; + log_buf->info.buffer_size = info.buffer_size; + log_buf->info.frag_size = info.frag_size; + log_buf->info.addrs_size = info.addrs_size; + log_buf->buffer_state = 1; + return 0; + +err_free_dma_array: + vfio_log_buf_release_dma(dev, log_buf); +err_free_addrs: + kfree(log_buf->cpu_addrs); + log_buf->cpu_addrs = NULL; + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; +err_out: + return -ENOMEM; +} + +static long vfio_log_buf_release_buffer(struct vfio_container *container) +{ + struct vfio_log_buf *log_buf = &container->log_buf; + struct device *dev = NULL; + + if (log_buf->buffer_state == 0) { + pr_warn("buffer already released\n"); + return 0; + } + + dev = vfio_get_dev(container); + if (!dev) { + pr_err("can`t get dev\n"); + return -EFAULT; + } + + vfio_log_buf_release_dma(dev, log_buf); + + kfree(log_buf->cpu_addrs); + log_buf->cpu_addrs = NULL; + + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; + + log_buf->buffer_state = 0; + return 0; +} + +static int vfio_log_buf_release(struct inode *inode, struct file *filep) +{ + struct vfio_container *container = filep->private_data; + + vfio_log_buf_stop(container); + vfio_log_buf_release_buffer(container); + memset(&container->log_buf, 0, sizeof(struct vfio_log_buf)); + return 0; +} + +static long vfio_ioctl_handle_log_buf_ctl(struct vfio_container *container, + unsigned long arg) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret = 0; + + if (copy_from_user(&log_buf_ctl, (void __user *)arg, + sizeof(struct vfio_log_buf_ctl))) + return -EFAULT; + + switch (log_buf_ctl.flags) { + case VFIO_DEVICE_LOG_BUF_FLAG_SETUP: + ret = vfio_log_buf_setup(container, + (unsigned long)log_buf_ctl.data); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_RELEASE: + ret = vfio_log_buf_release_buffer(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_START: + ret = vfio_log_buf_start(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STOP: + ret = vfio_log_buf_stop(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY: + ret = vfio_log_buf_query(container); + break; + default: + pr_err("log buf control flag incorrect\n"); + ret = -EINVAL; + break; + } + return ret; +} + +static long vfio_log_buf_fops_unl_ioctl(struct file *filep, + unsigned int cmd, unsigned long arg) +{ + struct vfio_container *container = filep->private_data; + long ret = -EINVAL; + + switch (cmd) { + case VFIO_LOG_BUF_CTL: + ret = vfio_ioctl_handle_log_buf_ctl(container, arg); + break; + default: + pr_err("log buf control cmd incorrect\n"); + break; + } + + return ret; +} + +#ifdef CONFIG_COMPAT +static long vfio_log_buf_fops_compat_ioctl(struct file *filep, + unsigned int cmd, unsigned long arg) +{ + arg = (unsigned long)compat_ptr(arg); + return vfio_log_buf_fops_unl_ioctl(filep, cmd, arg); +} +#endif /* CONFIG_COMPAT */ + +static const struct file_operations vfio_log_buf_fops = { + .owner = THIS_MODULE, + .mmap = vfio_log_buf_fops_mmap, + .unlocked_ioctl = vfio_log_buf_fops_unl_ioctl, + .release = vfio_log_buf_release, +#ifdef CONFIG_COMPAT + .compat_ioctl = vfio_log_buf_fops_compat_ioctl, +#endif +}; + +static int vfio_get_log_buf_fd(struct vfio_container *container, + unsigned long arg) +{ + struct file *filep = NULL; + int ret; + + if (container->log_buf.fd > 0) + return container->log_buf.fd; + + ret = get_unused_fd_flags(O_CLOEXEC); + if (ret < 0) { + pr_err("get_unused_fd_flags get fd failed\n"); + return ret; + } + + filep = anon_inode_getfile("[vfio-log-buf]", &vfio_log_buf_fops, + container, O_RDWR); + if (IS_ERR(filep)) { + pr_err("anon_inode_getfile failed\n"); + put_unused_fd(ret); + ret = PTR_ERR(filep); + return ret; + } + + filep->f_mode |= (FMODE_READ | FMODE_WRITE | FMODE_LSEEK); + + fd_install(ret, filep); + + container->log_buf.fd = ret; + return ret; +} + static long vfio_fops_unl_ioctl(struct file *filep, - unsigned int cmd, unsigned long arg) + unsigned int cmd, unsigned long arg) { struct vfio_container *container = filep->private_data; struct vfio_iommu_driver *driver; @@ -1179,6 +1582,9 @@ static long vfio_fops_unl_ioctl(struct file *filep, case VFIO_SET_IOMMU: ret = vfio_ioctl_set_iommu(container, arg); break; + case VFIO_GET_LOG_BUF_FD: + ret = vfio_get_log_buf_fd(container, arg); + break; default: driver = container->iommu_driver; data = container->iommu_data; @@ -1210,6 +1616,7 @@ static int vfio_fops_open(struct inode *inode, struct file *filep) INIT_LIST_HEAD(&container->group_list); init_rwsem(&container->group_lock); kref_init(&container->kref); + memset(&container->log_buf, 0, sizeof(struct vfio_log_buf)); filep->private_data = container; @@ -1219,9 +1626,7 @@ static int vfio_fops_open(struct inode *inode, struct file *filep) static int vfio_fops_release(struct inode *inode, struct file *filep) { struct vfio_container *container = filep->private_data; - filep->private_data = NULL; - vfio_container_put(container); return 0; diff --git a/include/linux/vfio_pci_migration.h b/include/linux/vfio_pci_migration.h new file mode 100644 index 0000000..464ffb4 --- /dev/null +++ b/include/linux/vfio_pci_migration.h @@ -0,0 +1,136 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) 2022 Huawei Technologies Co., Ltd. All rights reserved. + */ + +#ifndef VFIO_PCI_MIGRATION_H +#define VFIO_PCI_MIGRATION_H + +#include <linux/types.h> +#include <linux/pci.h> + +#define VFIO_REGION_TYPE_MIGRATION (3) +/* sub-types for VFIO_REGION_TYPE_MIGRATION */ +#define VFIO_REGION_SUBTYPE_MIGRATION (1) + +#define VFIO_MIGRATION_BUFFER_MAX_SIZE SZ_256K +#define VFIO_MIGRATION_REGION_DATA_OFFSET \ + (sizeof(struct vfio_device_migration_info)) +#define VFIO_DEVICE_MIGRATION_OFFSET(x) \ + offsetof(struct vfio_device_migration_info, x) + +struct vfio_device_migration_info { + __u32 device_state; /* VFIO device state */ +#define VFIO_DEVICE_STATE_STOP (0) +#define VFIO_DEVICE_STATE_RUNNING (1 << 0) +#define VFIO_DEVICE_STATE_SAVING (1 << 1) +#define VFIO_DEVICE_STATE_RESUMING (1 << 2) +#define VFIO_DEVICE_STATE_MASK (VFIO_DEVICE_STATE_RUNNING | \ + VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RESUMING) + __u32 reserved; + + __u32 device_cmd; + __u32 version_id; + + __u64 pending_bytes; + __u64 data_offset; + __u64 data_size; +}; + +enum { + VFIO_DEVICE_STOP = 0xffff0001, + VFIO_DEVICE_CONTINUE, + VFIO_DEVICE_MIGRATION_CANCEL, +}; + +struct vfio_log_buf_sge { + __u64 len; + __u64 addr; +}; + +struct vfio_log_buf_info { + __u32 uuid; + __u64 buffer_size; + __u64 addrs_size; + __u64 frag_size; + struct vfio_log_buf_sge *sgevec; +}; + +struct vfio_log_buf_ctl { + __u32 argsz; + __u32 flags; + #define VFIO_DEVICE_LOG_BUF_FLAG_SETUP (1 << 0) + #define VFIO_DEVICE_LOG_BUF_FLAG_RELEASE (1 << 1) + #define VFIO_DEVICE_LOG_BUF_FLAG_START (1 << 2) + #define VFIO_DEVICE_LOG_BUF_FLAG_STOP (1 << 3) + #define VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY (1 << 4) + void *data; +}; +#define VFIO_LOG_BUF_CTL _IO(VFIO_TYPE, VFIO_BASE + 21) +#define VFIO_GET_LOG_BUF_FD _IO(VFIO_TYPE, VFIO_BASE + 22) +#define VFIO_DEVICE_LOG_BUF_CTL _IO(VFIO_TYPE, VFIO_BASE + 23) + +struct vf_migration_log_info { + __u32 dom_uuid; + __u64 buffer_size; + __u64 sge_len; + __u64 sge_num; + struct vfio_log_buf_sge *sgevec; +}; + +struct vfio_device_migration_ops { + /* Get device information */ + int (*get_info)(struct pci_dev *pdev, + struct vfio_device_migration_info *info); + /* Enable a vf device */ + int (*enable)(struct pci_dev *pdev); + /* Disable a vf device */ + int (*disable)(struct pci_dev *pdev); + /* Save a vf device */ + int (*save)(struct pci_dev *pdev, void *base, + uint64_t off, uint64_t count); + /* Resuming a vf device */ + int (*restore)(struct pci_dev *pdev, void *base, + uint64_t off, uint64_t count); + /* Log start a vf device */ + int (*log_start)(struct pci_dev *pdev, + struct vf_migration_log_info *log_info); + /* Log stop a vf device */ + int (*log_stop)(struct pci_dev *pdev, uint32_t uuid); + /* Get vf device log status */ + int (*get_log_status)(struct pci_dev *pdev); + /* Pre enable a vf device(load_setup, before restore a vf) */ + int (*pre_enable)(struct pci_dev *pdev); + /* Cancel a vf device when live migration failed (rollback) */ + int (*cancel)(struct pci_dev *pdev); + /* Init a vf device */ + int (*init)(struct pci_dev *pdev); + /* Uninit a vf device */ + void (*uninit)(struct pci_dev *pdev); + /* Release a vf device */ + void (*release)(struct pci_dev *pdev); +}; + +struct vfio_pci_vendor_mig_driver { + struct pci_dev *pdev; + unsigned char bus_num; + struct vfio_device_migration_ops *dev_mig_ops; + struct module *owner; + atomic_t count; + struct list_head list; +}; + +struct vfio_pci_migration_data { + u64 state_size; + struct pci_dev *vf_dev; + struct vfio_pci_vendor_mig_driver *mig_driver; + struct vfio_device_migration_info *mig_ctl; + void *vf_data; +}; + +int vfio_pci_register_migration_ops(struct vfio_device_migration_ops *ops, + struct module *mod, struct pci_dev *pdev); +void vfio_pci_unregister_migration_ops(struct module *mod, + struct pci_dev *pdev); + +#endif /* VFIO_PCI_MIGRATION_H */ -- 1.8.3.1

2 1

[PATCH] vfio: framework supporting vfio device hot migration
by RongWang 24 Jun '22

24 Jun '22

From: Rong Wang <w_angrong(a)163.com> kunpeng inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5CO9A CVE: NA --------------------------------- As pass through devices, hypervisor can`t control the status of device, and can`t track dirty memory DMA from device, during migration. The goal of this framework is to combine hardware to accomplish the task above. qemu |status control and dirty memory report vfio |ops to hardware hardware Signed-off-by: Rong Wang <w_angrong(a)163.com> Signed-off-by: HuHua Li <18245010845(a)163.com> Signed-off-by: Ripeng Qiu <965412048(a)qq.com> --- drivers/vfio/pci/Makefile | 2 +- drivers/vfio/pci/vfio_pci.c | 54 +++ drivers/vfio/pci/vfio_pci_migration.c | 755 ++++++++++++++++++++++++++++++++++ drivers/vfio/pci/vfio_pci_private.h | 14 +- drivers/vfio/vfio.c | 411 +++++++++++++++++- include/linux/vfio_pci_migration.h | 136 ++++++ 6 files changed, 1367 insertions(+), 5 deletions(-) create mode 100644 drivers/vfio/pci/vfio_pci_migration.c create mode 100644 include/linux/vfio_pci_migration.h diff --git a/drivers/vfio/pci/Makefile b/drivers/vfio/pci/Makefile index 76d8ec0..80a777d 100644 --- a/drivers/vfio/pci/Makefile +++ b/drivers/vfio/pci/Makefile @@ -1,5 +1,5 @@ -vfio-pci-y := vfio_pci.o vfio_pci_intrs.o vfio_pci_rdwr.o vfio_pci_config.o +vfio-pci-y := vfio_pci.o vfio_pci_intrs.o vfio_pci_rdwr.o vfio_pci_config.o vfio_pci_migration.o vfio-pci-$(CONFIG_VFIO_PCI_IGD) += vfio_pci_igd.o obj-$(CONFIG_VFIO_PCI) += vfio-pci.o diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index 51b791c..59d8280 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -30,6 +30,7 @@ #include <linux/vgaarb.h> #include <linux/nospec.h> #include <linux/sched/mm.h> +#include <linux/vfio_pci_migration.h> #include "vfio_pci_private.h" @@ -296,6 +297,14 @@ static int vfio_pci_enable(struct vfio_pci_device *vdev) vfio_pci_probe_mmaps(vdev); + if (vfio_dev_migration_is_supported(pdev)) { + ret = vfio_pci_migration_init(vdev); + if (ret) { + dev_warn(&vdev->pdev->dev, "Failed to init vfio_pci_migration\n"); + vfio_pci_disable(vdev); + return ret; + } + } return 0; } @@ -392,6 +401,7 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev) out: pci_disable_device(pdev); + vfio_pci_migration_exit(vdev); vfio_pci_try_bus_reset(vdev); if (!disable_idle_d3) @@ -642,6 +652,41 @@ struct vfio_devices { int max_index; }; +static long vfio_pci_handle_log_buf_ctl(struct vfio_pci_device *vdev, + const unsigned long arg) +{ + struct vfio_log_buf_ctl *log_buf_ctl = NULL; + struct vfio_log_buf_info *log_buf_info = NULL; + struct vf_migration_log_info migration_log_info; + long ret = 0; + + log_buf_ctl = (struct vfio_log_buf_ctl *)arg; + log_buf_info = (struct vfio_log_buf_info *)log_buf_ctl->data; + + switch (log_buf_ctl->flags) { + case VFIO_DEVICE_LOG_BUF_FLAG_START: + migration_log_info.dom_uuid = log_buf_info->uuid; + migration_log_info.buffer_size = + log_buf_info->buffer_size; + migration_log_info.sge_num = log_buf_info->addrs_size; + migration_log_info.sge_len = log_buf_info->frag_size; + migration_log_info.sgevec = log_buf_info->sgevec; + ret = vfio_pci_device_log_start(vdev, + &migration_log_info); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STOP: + ret = vfio_pci_device_log_stop(vdev, + log_buf_info->uuid); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY: + ret = vfio_pci_device_log_status_query(vdev); + break; + default: + ret = -EINVAL; + break; + } + return ret; +} static long vfio_pci_ioctl(void *device_data, unsigned int cmd, unsigned long arg) { @@ -1142,6 +1187,8 @@ static long vfio_pci_ioctl(void *device_data, return vfio_pci_ioeventfd(vdev, ioeventfd.offset, ioeventfd.data, count, ioeventfd.fd); + } else if (cmd == VFIO_DEVICE_LOG_BUF_CTL) { + return vfio_pci_handle_log_buf_ctl(vdev, arg); } return -ENOTTY; @@ -1566,6 +1613,9 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) pci_set_power_state(pdev, PCI_D3hot); } + if (vfio_dev_migration_is_supported(pdev)) + ret = vfio_pci_device_init(pdev); + return ret; } @@ -1591,6 +1641,10 @@ static void vfio_pci_remove(struct pci_dev *pdev) if (!disable_idle_d3) pci_set_power_state(pdev, PCI_D0); + + if (vfio_dev_migration_is_supported(pdev)) { + vfio_pci_device_uninit(pdev); + } } static pci_ers_result_t vfio_pci_aer_err_detected(struct pci_dev *pdev, diff --git a/drivers/vfio/pci/vfio_pci_migration.c b/drivers/vfio/pci/vfio_pci_migration.c new file mode 100644 index 0000000..f69cd13 --- /dev/null +++ b/drivers/vfio/pci/vfio_pci_migration.c @@ -0,0 +1,755 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) 2022 Huawei Technologies Co., Ltd. All rights reserved. + */ + +#include <linux/module.h> +#include <linux/io.h> +#include <linux/pci.h> +#include <linux/uaccess.h> +#include <linux/vfio.h> +#include <linux/vfio_pci_migration.h> + +#include "vfio_pci_private.h" + +static LIST_HEAD(vfio_pci_mig_drivers_list); +static DEFINE_MUTEX(vfio_pci_mig_drivers_mutex); + +static void vfio_pci_add_mig_drv(struct vfio_pci_vendor_mig_driver *mig_drv) +{ + mutex_lock(&vfio_pci_mig_drivers_mutex); + atomic_set(&mig_drv->count, 1); + list_add_tail(&mig_drv->list, &vfio_pci_mig_drivers_list); + mutex_unlock(&vfio_pci_mig_drivers_mutex); +} + +static void vfio_pci_remove_mig_drv(struct vfio_pci_vendor_mig_driver *mig_drv) +{ + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_del(&mig_drv->list); + mutex_unlock(&vfio_pci_mig_drivers_mutex); +} + +static struct vfio_pci_vendor_mig_driver * + vfio_pci_find_mig_drv(struct pci_dev *pdev, struct module *module) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = NULL; + + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_for_each_entry(mig_drv, &vfio_pci_mig_drivers_list, list) { + if (mig_drv->owner == module) { + if (mig_drv->bus_num == pdev->bus->number) + goto out; + } + } + mig_drv = NULL; +out: + mutex_unlock(&vfio_pci_mig_drivers_mutex); + return mig_drv; +} + +static struct vfio_pci_vendor_mig_driver * + vfio_pci_get_mig_driver(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = NULL; + struct pci_dev *pf_dev = pci_physfn(pdev); + + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_for_each_entry(mig_drv, &vfio_pci_mig_drivers_list, list) { + if (mig_drv->bus_num == pf_dev->bus->number) + goto out; + } + mig_drv = NULL; +out: + mutex_unlock(&vfio_pci_mig_drivers_mutex); + return mig_drv; +} + +bool vfio_dev_migration_is_supported(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + mig_driver = vfio_pci_get_mig_driver(pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_warn(&pdev->dev, "unable to find a mig_drv module\n"); + return false; + } + + return true; +} + +int vfio_pci_device_log_start(struct vfio_pci_device *vdev, + struct vf_migration_log_info *log_info) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->log_start || + (mig_driver->dev_mig_ops->log_start(vdev->pdev, + log_info) != 0)) { + dev_err(&vdev->pdev->dev, "failed to set log start\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_log_stop(struct vfio_pci_device *vdev, uint32_t uuid) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->log_stop || + (mig_driver->dev_mig_ops->log_stop(vdev->pdev, uuid) != 0)) { + dev_err(&vdev->pdev->dev, "failed to set log stop\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_log_status_query(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->get_log_status || + (mig_driver->dev_mig_ops->get_log_status(vdev->pdev) != 0)) { + dev_err(&vdev->pdev->dev, "failed to get log status\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_init(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv; + + mig_drv = vfio_pci_get_mig_driver(pdev); + if (!mig_drv || !mig_drv->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (mig_drv->dev_mig_ops->init) + return mig_drv->dev_mig_ops->init(pdev); + + return -EFAULT; +} + +void vfio_pci_device_uninit(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv; + + mig_drv = vfio_pci_get_mig_driver(pdev); + if (!mig_drv || !mig_drv->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_drv module\n"); + return; + } + + if (mig_drv->dev_mig_ops->uninit) + mig_drv->dev_mig_ops->uninit(pdev); +} + +static void vfio_pci_device_release(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (mig_drv->dev_mig_ops->release) + mig_drv->dev_mig_ops->release(pdev); +} + +static int vfio_pci_device_get_info(struct pci_dev *pdev, + struct vfio_device_migration_info *mig_info, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (mig_drv->dev_mig_ops->get_info) + return mig_drv->dev_mig_ops->get_info(pdev, mig_info); + return -EFAULT; +} + +static int vfio_pci_device_enable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->enable || + (mig_drv->dev_mig_ops->enable(pdev) != 0)) { + return -EINVAL; + } + + return 0; +} + +static int vfio_pci_device_disable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->disable || + (mig_drv->dev_mig_ops->disable(pdev) != 0)) + return -EINVAL; + + return 0; +} + +static int vfio_pci_device_pre_enable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->pre_enable || + (mig_drv->dev_mig_ops->pre_enable(pdev) != 0)) + return -EINVAL; + + return 0; +} + +static int vfio_pci_device_state_save(struct pci_dev *pdev, + struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_info = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + void *base = (void *)mig_info; + int ret = 0; + + if ((mig_info->device_state & VFIO_DEVICE_STATE_RUNNING) != 0) { + ret = vfio_pci_device_disable(pdev, mig_drv); + if (ret) { + dev_err(&pdev->dev, "failed to stop VF function!\n"); + return ret; + } + mig_info->device_state &= ~VFIO_DEVICE_STATE_RUNNING; + } + + if (mig_drv->dev_mig_ops && mig_drv->dev_mig_ops->save) { + ret = mig_drv->dev_mig_ops->save(pdev, base, + mig_info->data_offset, data->state_size); + if (ret) { + dev_err(&pdev->dev, "failed to save device state!\n"); + return -EINVAL; + } + } else { + return -EFAULT; + } + + mig_info->data_size = data->state_size; + mig_info->pending_bytes = mig_info->data_size; + return ret; +} + +static int vfio_pci_device_state_restore(struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_info = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + void *base = (void *)mig_info; + int ret; + + if (mig_drv->dev_mig_ops && mig_drv->dev_mig_ops->restore) { + ret = mig_drv->dev_mig_ops->restore(pdev, base, + mig_info->data_offset, mig_info->data_size); + if (ret) { + dev_err(&pdev->dev, "failed to restore device state!\n"); + return -EINVAL; + } + return 0; + } + + return -EFAULT; +} + +static int vfio_pci_set_device_state(struct vfio_pci_migration_data *data, + u32 state) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + int ret = 0; + + if (state == mig_ctl->device_state) + return 0; + + if (!mig_drv->dev_mig_ops) + return -EINVAL; + + switch (state) { + case VFIO_DEVICE_STATE_RUNNING: + if (!(mig_ctl->device_state & + VFIO_DEVICE_STATE_RUNNING)) + ret = vfio_pci_device_enable(pdev, mig_drv); + break; + case VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING: + /* + * (pre-copy) - device should start logging data. + */ + ret = 0; + break; + case VFIO_DEVICE_STATE_SAVING: + /* stop the vf function, save state */ + ret = vfio_pci_device_state_save(pdev, data); + break; + case VFIO_DEVICE_STATE_STOP: + if (mig_ctl->device_state & VFIO_DEVICE_STATE_RUNNING) + ret = vfio_pci_device_disable(pdev, mig_drv); + break; + case VFIO_DEVICE_STATE_RESUMING: + ret = vfio_pci_device_pre_enable(pdev, mig_drv); + break; + default: + ret = -EFAULT; + break; + } + + if (ret) + return ret; + + mig_ctl->device_state = state; + return 0; +} + +static ssize_t vfio_pci_handle_mig_dev_state( + struct vfio_pci_migration_data *data, + char __user *buf, size_t count, bool iswrite) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + u32 device_state; + int ret; + + if (count != sizeof(device_state)) + return -EINVAL; + + if (iswrite) { + if (copy_from_user(&device_state, buf, count)) + return -EFAULT; + + ret = vfio_pci_set_device_state(data, device_state); + if (ret) + return ret; + } else { + if (copy_to_user(buf, &mig_ctl->device_state, count)) + return -EFAULT; + } + + return count; +} + +static ssize_t vfio_pci_handle_mig_pending_bytes( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 pending_bytes; + + if (count != sizeof(pending_bytes) || iswrite) + return -EINVAL; + + if (mig_info->device_state == + (VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING)) { + /* In pre-copy state we have no data to return for now, + * return 0 pending bytes + */ + pending_bytes = 0; + } else { + pending_bytes = mig_info->pending_bytes; + } + + if (copy_to_user(buf, &pending_bytes, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_offset( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 data_offset = mig_info->data_offset; + + if (count != sizeof(data_offset) || iswrite) + return -EINVAL; + + if (copy_to_user(buf, &data_offset, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_size( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 data_size; + + if (count != sizeof(data_size)) + return -EINVAL; + + if (iswrite) { + /* data_size is writable only during resuming state */ + if (mig_info->device_state != VFIO_DEVICE_STATE_RESUMING) + return -EINVAL; + + if (copy_from_user(&data_size, buf, sizeof(data_size))) + return -EFAULT; + + mig_info->data_size = data_size; + } else { + if (mig_info->device_state != VFIO_DEVICE_STATE_SAVING) + return -EINVAL; + + if (copy_to_user(buf, &mig_info->data_size, + sizeof(data_size))) + return -EFAULT; + } + + return count; +} + +static ssize_t vfio_pci_handle_mig_dev_cmd(struct vfio_pci_migration_data *data, + char __user *buf, size_t count, bool iswrite) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + u32 device_cmd; + int ret = -EFAULT; + + if (count != sizeof(device_cmd) || !iswrite || !mig_drv->dev_mig_ops) + return -EINVAL; + + if (copy_from_user(&device_cmd, buf, count)) + return -EFAULT; + + switch (device_cmd) { + case VFIO_DEVICE_MIGRATION_CANCEL: + if (mig_drv->dev_mig_ops->cancel) + ret = mig_drv->dev_mig_ops->cancel(pdev); + break; + default: + dev_err(&pdev->dev, "cmd is invaild\n"); + return -EINVAL; + } + + if (ret != 0) + return ret; + + return count; +} + +static ssize_t vfio_pci_handle_mig_drv_version( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u32 version_id = mig_info->version_id; + + if (count != sizeof(version_id) || iswrite) + return -EINVAL; + + if (copy_to_user(buf, &version_id, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_rw( + struct vfio_pci_migration_data *data, + char __user *buf, size_t count, u64 pos, bool iswrite) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + void *data_addr = data->vf_data; + + if (count == 0) { + dev_err(&data->vf_dev->dev, "qemu operation data size error!\n"); + return -EINVAL; + } + + data_addr += pos - mig_ctl->data_offset; + if (iswrite) { + if (copy_from_user(data_addr, buf, count)) + return -EFAULT; + + mig_ctl->pending_bytes += count; + if (mig_ctl->pending_bytes > data->state_size) + return -EINVAL; + } else { + if (copy_to_user(buf, data_addr, count)) + return -EFAULT; + + if (mig_ctl->pending_bytes < count) + return -EINVAL; + + mig_ctl->pending_bytes -= count; + } + + return count; +} + +static ssize_t vfio_pci_dev_migrn_rw(struct vfio_pci_device *vdev, + char __user *buf, size_t count, loff_t *ppos, bool iswrite) +{ + unsigned int index = + VFIO_PCI_OFFSET_TO_INDEX(*ppos) - VFIO_PCI_NUM_REGIONS; + struct vfio_pci_migration_data *data = + (struct vfio_pci_migration_data *)vdev->region[index].data; + loff_t pos = *ppos & VFIO_PCI_OFFSET_MASK; + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + int ret; + + if (pos >= vdev->region[index].size) + return -EINVAL; + + count = min(count, (size_t)(vdev->region[index].size - pos)); + if (pos >= VFIO_MIGRATION_REGION_DATA_OFFSET) + return vfio_pci_handle_mig_data_rw(data, + buf, count, pos, iswrite); + + switch (pos) { + case VFIO_DEVICE_MIGRATION_OFFSET(device_state): + ret = vfio_pci_handle_mig_dev_state(data, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(pending_bytes): + ret = vfio_pci_handle_mig_pending_bytes(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(data_offset): + ret = vfio_pci_handle_mig_data_offset(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(data_size): + ret = vfio_pci_handle_mig_data_size(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(device_cmd): + ret = vfio_pci_handle_mig_dev_cmd(data, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(version_id): + ret = vfio_pci_handle_mig_drv_version(mig_ctl, + buf, count, iswrite); + break; + default: + dev_err(&vdev->pdev->dev, "invalid pos offset\n"); + ret = -EFAULT; + break; + } + + if (mig_ctl->device_state == VFIO_DEVICE_STATE_RESUMING && + mig_ctl->pending_bytes == data->state_size && + mig_ctl->data_size == data->state_size) { + if (vfio_pci_device_state_restore(data) != 0) { + dev_err(&vdev->pdev->dev, "Failed to restore device state!\n"); + return -EFAULT; + } + mig_ctl->pending_bytes = 0; + mig_ctl->data_size = 0; + } + + return ret; +} + +static void vfio_pci_dev_migrn_release(struct vfio_pci_device *vdev, + struct vfio_pci_region *region) +{ + struct vfio_pci_migration_data *data = region->data; + + if (data) { + kfree(data->mig_ctl); + kfree(data); + } +} + +static const struct vfio_pci_regops vfio_pci_migration_regops = { + .rw = vfio_pci_dev_migrn_rw, + .release = vfio_pci_dev_migrn_release, +}; + +static int vfio_pci_migration_info_init(struct pci_dev *pdev, + struct vfio_device_migration_info *mig_info, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + int ret; + + ret = vfio_pci_device_get_info(pdev, mig_info, mig_drv); + if (ret) { + dev_err(&pdev->dev, "failed to get device info\n"); + return ret; + } + + if (mig_info->data_size > VFIO_MIGRATION_BUFFER_MAX_SIZE) { + dev_err(&pdev->dev, "mig_info->data_size %llu is invalid\n", + mig_info->data_size); + return -EINVAL; + } + + mig_info->data_offset = VFIO_MIGRATION_REGION_DATA_OFFSET; + return ret; +} + +static int vfio_device_mig_data_init(struct vfio_pci_device *vdev, + struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_ctl; + u64 mig_offset; + int ret; + + mig_ctl = kzalloc(sizeof(*mig_ctl), GFP_KERNEL); + if (!mig_ctl) + return -ENOMEM; + + ret = vfio_pci_migration_info_init(vdev->pdev, mig_ctl, + data->mig_driver); + if (ret) { + dev_err(&vdev->pdev->dev, "get device info error!\n"); + goto err; + } + + mig_offset = sizeof(struct vfio_device_migration_info); + data->state_size = mig_ctl->data_size; + data->mig_ctl = krealloc(mig_ctl, mig_offset + data->state_size, + GFP_KERNEL); + if (!data->mig_ctl) { + ret = -ENOMEM; + goto err; + } + + data->vf_data = (void *)((char *)data->mig_ctl + mig_offset); + memset(data->vf_data, 0, data->state_size); + data->mig_ctl->data_size = 0; + + ret = vfio_pci_register_dev_region(vdev, VFIO_REGION_TYPE_MIGRATION, + VFIO_REGION_SUBTYPE_MIGRATION, + &vfio_pci_migration_regops, mig_offset + data->state_size, + VFIO_REGION_INFO_FLAG_READ | VFIO_REGION_INFO_FLAG_WRITE, data); + if (ret) { + kfree(data->mig_ctl); + return ret; + } + + return 0; +err: + kfree(mig_ctl); + return ret; +} + +int vfio_pci_migration_init(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + struct vfio_pci_migration_data *data = NULL; + struct pci_dev *pdev = vdev->pdev; + int ret; + + mig_driver = vfio_pci_get_mig_driver(pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_driver module\n"); + return -EINVAL; + } + + if (!try_module_get(mig_driver->owner)) { + pr_err("module %s is not live\n", mig_driver->owner->name); + return -ENODEV; + } + + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) { + module_put(mig_driver->owner); + return -ENOMEM; + } + + data->mig_driver = mig_driver; + data->vf_dev = pdev; + + ret = vfio_device_mig_data_init(vdev, data); + if (ret) { + dev_err(&pdev->dev, "failed to init vfio device migration data!\n"); + goto err; + } + + return ret; +err: + kfree(data); + module_put(mig_driver->owner); + return ret; +} + +void vfio_pci_migration_exit(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_warn(&vdev->pdev->dev, "mig_driver is not found\n"); + return; + } + + if (module_refcount(mig_driver->owner) > 0) { + vfio_pci_device_release(vdev->pdev, mig_driver); + module_put(mig_driver->owner); + } +} + +int vfio_pci_register_migration_ops(struct vfio_device_migration_ops *ops, + struct module *mod, struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + if (!ops || !mod || !pdev) + return -EINVAL; + + mig_driver = vfio_pci_find_mig_drv(pdev, mod); + if (mig_driver) { + pr_info("%s migration ops has already been registered\n", + mod->name); + atomic_add(1, &mig_driver->count); + return 0; + } + + if (!try_module_get(THIS_MODULE)) + return -ENODEV; + + mig_driver = kzalloc(sizeof(*mig_driver), GFP_KERNEL); + if (!mig_driver) { + module_put(THIS_MODULE); + return -ENOMEM; + } + + mig_driver->pdev = pdev; + mig_driver->bus_num = pdev->bus->number; + mig_driver->owner = mod; + mig_driver->dev_mig_ops = ops; + + vfio_pci_add_mig_drv(mig_driver); + + return 0; +} +EXPORT_SYMBOL_GPL(vfio_pci_register_migration_ops); + +void vfio_pci_unregister_migration_ops(struct module *mod, struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + if (!mod || !pdev) + return; + + mig_driver = vfio_pci_find_mig_drv(pdev, mod); + if (!mig_driver) { + pr_err("mig_driver is not found\n"); + return; + } + + if (atomic_sub_and_test(1, &mig_driver->count)) { + vfio_pci_remove_mig_drv(mig_driver); + kfree(mig_driver); + module_put(THIS_MODULE); + pr_info("%s succeed to unregister migration ops\n", + THIS_MODULE->name); + } +} +EXPORT_SYMBOL_GPL(vfio_pci_unregister_migration_ops); diff --git a/drivers/vfio/pci/vfio_pci_private.h b/drivers/vfio/pci/vfio_pci_private.h index 17d2bae..03af269 100644 --- a/drivers/vfio/pci/vfio_pci_private.h +++ b/drivers/vfio/pci/vfio_pci_private.h @@ -15,6 +15,7 @@ #include <linux/pci.h> #include <linux/irqbypass.h> #include <linux/types.h> +#include <linux/vfio_pci_migration.h> #ifndef VFIO_PCI_PRIVATE_H #define VFIO_PCI_PRIVATE_H @@ -55,7 +56,7 @@ struct vfio_pci_irq_ctx { struct vfio_pci_region; struct vfio_pci_regops { - size_t (*rw)(struct vfio_pci_device *vdev, char __user *buf, + ssize_t (*rw)(struct vfio_pci_device *vdev, char __user *buf, size_t count, loff_t *ppos, bool iswrite); void (*release)(struct vfio_pci_device *vdev, struct vfio_pci_region *region); @@ -173,4 +174,15 @@ static inline int vfio_pci_igd_init(struct vfio_pci_device *vdev) return -ENODEV; } #endif + +extern bool vfio_dev_migration_is_supported(struct pci_dev *pdev); +extern int vfio_pci_migration_init(struct vfio_pci_device *vdev); +extern void vfio_pci_migration_exit(struct vfio_pci_device *vdev); +extern int vfio_pci_device_log_start(struct vfio_pci_device *vdev, + struct vf_migration_log_info *log_info); +extern int vfio_pci_device_log_stop(struct vfio_pci_device *vdev, + uint32_t uuid); +extern int vfio_pci_device_log_status_query(struct vfio_pci_device *vdev); +extern int vfio_pci_device_init(struct pci_dev *pdev); +extern void vfio_pci_device_uninit(struct pci_dev *pdev); #endif /* VFIO_PCI_PRIVATE_H */ diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c index 7a386fb..35f2a29 100644 --- a/drivers/vfio/vfio.c +++ b/drivers/vfio/vfio.c @@ -33,6 +33,7 @@ #include <linux/string.h> #include <linux/uaccess.h> #include <linux/vfio.h> +#include <linux/vfio_pci_migration.h> #include <linux/wait.h> #include <linux/sched/signal.h> @@ -40,6 +41,9 @@ #define DRIVER_AUTHOR "Alex Williamson <alex.williamson(a)redhat.com>" #define DRIVER_DESC "VFIO - User Level meta-driver" +#define LOG_BUF_FRAG_SIZE (2 * 1024 * 1024) // fix to 2M +#define LOG_BUF_MAX_ADDRS_SIZE 128 // max vm ram size is 1T + static struct vfio { struct class *class; struct list_head iommu_drivers_list; @@ -57,6 +61,14 @@ struct vfio_iommu_driver { struct list_head vfio_next; }; +struct vfio_log_buf { + struct vfio_log_buf_info info; + int fd; + int buffer_state; + int device_state; + unsigned long *cpu_addrs; +}; + struct vfio_container { struct kref kref; struct list_head group_list; @@ -64,6 +76,7 @@ struct vfio_container { struct vfio_iommu_driver *iommu_driver; void *iommu_data; bool noiommu; + struct vfio_log_buf log_buf; }; struct vfio_unbound_dev { @@ -1158,8 +1171,398 @@ static long vfio_ioctl_set_iommu(struct vfio_container *container, return ret; } +static long vfio_dispatch_cmd_to_devices(const struct vfio_container *container, + unsigned int cmd, unsigned long arg) +{ + struct vfio_group *group = NULL; + struct vfio_device *device = NULL; + long ret = -ENXIO; + + list_for_each_entry(group, &container->group_list, container_next) { + list_for_each_entry(device, &group->device_list, group_next) { + ret = device->ops->ioctl(device->device_data, cmd, arg); + if (ret) { + pr_err("dispatch cmd to devices failed\n"); + return ret; + } + } + } + return ret; +} + +static long vfio_log_buf_start(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret; + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_START; + log_buf_ctl.data = (void *)&container->log_buf.info; + ret = vfio_dispatch_cmd_to_devices(container, VFIO_DEVICE_LOG_BUF_CTL, + (unsigned long)&log_buf_ctl); + if (ret) + return ret; + + container->log_buf.device_state = 1; + return 0; +} + +static long vfio_log_buf_stop(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret; + + if (container->log_buf.device_state == 0) { + pr_warn("device already stopped\n"); + return 0; + } + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_STOP; + log_buf_ctl.data = (void *)&container->log_buf.info; + ret = vfio_dispatch_cmd_to_devices(container, VFIO_DEVICE_LOG_BUF_CTL, + (unsigned long)&log_buf_ctl); + if (ret) + return ret; + + container->log_buf.device_state = 0; + return 0; +} + +static long vfio_log_buf_query(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY; + log_buf_ctl.data = (void *)&container->log_buf.info; + + return vfio_dispatch_cmd_to_devices(container, + VFIO_DEVICE_LOG_BUF_CTL, (unsigned long)&log_buf_ctl); +} + +static int vfio_log_buf_fops_mmap(struct file *filep, + struct vm_area_struct *vma) +{ + struct vfio_container *container = filep->private_data; + struct vfio_log_buf *log_buf = &container->log_buf; + unsigned long frag_pg_size; + unsigned long frag_offset; + phys_addr_t pa; + int ret = -EINVAL; + + if (!log_buf->cpu_addrs) { + pr_err("mmap before setup, please setup log buf first\n"); + return ret; + } + + if (log_buf->info.frag_size < PAGE_SIZE) { + pr_err("mmap frag size should not less than page size!\n"); + return ret; + } + + frag_pg_size = log_buf->info.frag_size / PAGE_SIZE; + frag_offset = vma->vm_pgoff / frag_pg_size; + + if (frag_offset >= log_buf->info.addrs_size) { + pr_err("mmap offset out of range!\n"); + return ret; + } + + if (vma->vm_end - vma->vm_start != log_buf->info.frag_size) { + pr_err("mmap size error, should be aligned with frag size!\n"); + return ret; + } + + pa = virt_to_phys((void *)log_buf->cpu_addrs[frag_offset]); + ret = remap_pfn_range(vma, vma->vm_start, + pa >> PAGE_SHIFT, + vma->vm_end - vma->vm_start, + vma->vm_page_prot); + if (ret) + pr_err("remap_pfn_range error!\n"); + return ret; +} + +static struct device *vfio_get_dev(struct vfio_container *container) +{ + struct vfio_group *group = NULL; + struct vfio_device *device = NULL; + + list_for_each_entry(group, &container->group_list, container_next) { + list_for_each_entry(device, &group->device_list, group_next) { + return device->dev; + } + } + return NULL; +} + +static void vfio_log_buf_release_dma(struct device *dev, + struct vfio_log_buf *log_buf) +{ + int i; + + for (i = 0; i < log_buf->info.addrs_size; i++) { + if ((log_buf->cpu_addrs && log_buf->cpu_addrs[i] != 0) && + (log_buf->info.sgevec && + log_buf->info.sgevec[i].addr != 0)) { + dma_free_coherent(dev, log_buf->info.frag_size, + (void *)log_buf->cpu_addrs[i], + log_buf->info.sgevec[i].addr); + log_buf->cpu_addrs[i] = 0; + log_buf->info.sgevec[i].addr = 0; + } + } +} + +static long vfio_log_buf_alloc_dma(struct vfio_log_buf_info *info, + struct vfio_log_buf *log_buf, struct device *dev) +{ + int i; + + for (i = 0; i < info->addrs_size; i++) { + log_buf->cpu_addrs[i] = (unsigned long)dma_alloc_coherent(dev, + info->frag_size, &log_buf->info.sgevec[i].addr, + GFP_KERNEL); + log_buf->info.sgevec[i].len = info->frag_size; + if (log_buf->cpu_addrs[i] == 0 || + log_buf->info.sgevec[i].addr == 0) { + return -ENOMEM; + } + } + return 0; +} + +static long vfio_log_buf_alloc_addrs(struct vfio_log_buf_info *info, + struct vfio_log_buf *log_buf) +{ + log_buf->info.sgevec = kcalloc(info->addrs_size, + sizeof(struct vfio_log_buf_sge), GFP_KERNEL); + if (!log_buf->info.sgevec) + return -ENOMEM; + + log_buf->cpu_addrs = kcalloc(info->addrs_size, + sizeof(unsigned long), GFP_KERNEL); + if (!log_buf->cpu_addrs) { + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; + return -ENOMEM; + } + + return 0; +} + +static long vfio_log_buf_info_valid(struct vfio_log_buf_info *info) +{ + if (info->addrs_size > LOG_BUF_MAX_ADDRS_SIZE || + info->addrs_size == 0) { + pr_err("can`t support vm ram size larger than 1T or equal to 0\n"); + return -EINVAL; + } + if (info->frag_size != LOG_BUF_FRAG_SIZE) { + pr_err("only support %d frag size\n", LOG_BUF_FRAG_SIZE); + return -EINVAL; + } + return 0; +} + +static long vfio_log_buf_setup(struct vfio_container *container, + unsigned long data) +{ + struct vfio_log_buf_info info; + struct vfio_log_buf *log_buf = &container->log_buf; + struct device *dev = NULL; + long ret; + + if (log_buf->info.sgevec) { + pr_warn("log buf already setup\n"); + return 0; + } + + if (copy_from_user(&info, (void __user *)data, + sizeof(struct vfio_log_buf_info))) + return -EFAULT; + + ret = vfio_log_buf_info_valid(&info); + if (ret) + return ret; + + ret = vfio_log_buf_alloc_addrs(&info, log_buf); + if (ret) + goto err_out; + + dev = vfio_get_dev(container); + if (!dev) { + pr_err("can`t get dev\n"); + goto err_free_addrs; + } + + ret = vfio_log_buf_alloc_dma(&info, log_buf, dev); + if (ret) + goto err_free_dma_array; + + log_buf->info.uuid = info.uuid; + log_buf->info.buffer_size = info.buffer_size; + log_buf->info.frag_size = info.frag_size; + log_buf->info.addrs_size = info.addrs_size; + log_buf->buffer_state = 1; + return 0; + +err_free_dma_array: + vfio_log_buf_release_dma(dev, log_buf); +err_free_addrs: + kfree(log_buf->cpu_addrs); + log_buf->cpu_addrs = NULL; + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; +err_out: + return -ENOMEM; +} + +static long vfio_log_buf_release_buffer(struct vfio_container *container) +{ + struct vfio_log_buf *log_buf = &container->log_buf; + struct device *dev = NULL; + + if (log_buf->buffer_state == 0) { + pr_warn("buffer already released\n"); + return 0; + } + + dev = vfio_get_dev(container); + if (!dev) { + pr_err("can`t get dev\n"); + return -EFAULT; + } + + vfio_log_buf_release_dma(dev, log_buf); + + kfree(log_buf->cpu_addrs); + log_buf->cpu_addrs = NULL; + + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; + + log_buf->buffer_state = 0; + return 0; +} + +static int vfio_log_buf_release(struct inode *inode, struct file *filep) +{ + struct vfio_container *container = filep->private_data; + + vfio_log_buf_stop(container); + vfio_log_buf_release_buffer(container); + memset(&container->log_buf, 0, sizeof(struct vfio_log_buf)); + return 0; +} + +static long vfio_ioctl_handle_log_buf_ctl(struct vfio_container *container, + unsigned long arg) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret = 0; + + if (copy_from_user(&log_buf_ctl, (void __user *)arg, + sizeof(struct vfio_log_buf_ctl))) + return -EFAULT; + + switch (log_buf_ctl.flags) { + case VFIO_DEVICE_LOG_BUF_FLAG_SETUP: + ret = vfio_log_buf_setup(container, + (unsigned long)log_buf_ctl.data); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_RELEASE: + ret = vfio_log_buf_release_buffer(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_START: + ret = vfio_log_buf_start(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STOP: + ret = vfio_log_buf_stop(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY: + ret = vfio_log_buf_query(container); + break; + default: + pr_err("log buf control flag incorrect\n"); + ret = -EINVAL; + break; + } + return ret; +} + +static long vfio_log_buf_fops_unl_ioctl(struct file *filep, + unsigned int cmd, unsigned long arg) +{ + struct vfio_container *container = filep->private_data; + long ret = -EINVAL; + + switch (cmd) { + case VFIO_LOG_BUF_CTL: + ret = vfio_ioctl_handle_log_buf_ctl(container, arg); + break; + default: + pr_err("log buf control cmd incorrect\n"); + break; + } + + return ret; +} + +#ifdef CONFIG_COMPAT +static long vfio_log_buf_fops_compat_ioctl(struct file *filep, + unsigned int cmd, unsigned long arg) +{ + arg = (unsigned long)compat_ptr(arg); + return vfio_log_buf_fops_unl_ioctl(filep, cmd, arg); +} +#endif /* CONFIG_COMPAT */ + +static const struct file_operations vfio_log_buf_fops = { + .owner = THIS_MODULE, + .mmap = vfio_log_buf_fops_mmap, + .unlocked_ioctl = vfio_log_buf_fops_unl_ioctl, + .release = vfio_log_buf_release, +#ifdef CONFIG_COMPAT + .compat_ioctl = vfio_log_buf_fops_compat_ioctl, +#endif +}; + +static int vfio_get_log_buf_fd(struct vfio_container *container, + unsigned long arg) +{ + struct file *filep = NULL; + int ret; + + if (container->log_buf.fd > 0) + return container->log_buf.fd; + + ret = get_unused_fd_flags(O_CLOEXEC); + if (ret < 0) { + pr_err("get_unused_fd_flags get fd failed\n"); + return ret; + } + + filep = anon_inode_getfile("[vfio-log-buf]", &vfio_log_buf_fops, + container, O_RDWR); + if (IS_ERR(filep)) { + pr_err("anon_inode_getfile failed\n"); + put_unused_fd(ret); + ret = PTR_ERR(filep); + return ret; + } + + filep->f_mode |= (FMODE_READ | FMODE_WRITE | FMODE_LSEEK); + + fd_install(ret, filep); + + container->log_buf.fd = ret; + return ret; +} + static long vfio_fops_unl_ioctl(struct file *filep, - unsigned int cmd, unsigned long arg) + unsigned int cmd, unsigned long arg) { struct vfio_container *container = filep->private_data; struct vfio_iommu_driver *driver; @@ -1179,6 +1582,9 @@ static long vfio_fops_unl_ioctl(struct file *filep, case VFIO_SET_IOMMU: ret = vfio_ioctl_set_iommu(container, arg); break; + case VFIO_GET_LOG_BUF_FD: + ret = vfio_get_log_buf_fd(container, arg); + break; default: driver = container->iommu_driver; data = container->iommu_data; @@ -1210,6 +1616,7 @@ static int vfio_fops_open(struct inode *inode, struct file *filep) INIT_LIST_HEAD(&container->group_list); init_rwsem(&container->group_lock); kref_init(&container->kref); + memset(&container->log_buf, 0, sizeof(struct vfio_log_buf)); filep->private_data = container; @@ -1219,9 +1626,7 @@ static int vfio_fops_open(struct inode *inode, struct file *filep) static int vfio_fops_release(struct inode *inode, struct file *filep) { struct vfio_container *container = filep->private_data; - filep->private_data = NULL; - vfio_container_put(container); return 0; diff --git a/include/linux/vfio_pci_migration.h b/include/linux/vfio_pci_migration.h new file mode 100644 index 0000000..464ffb4 --- /dev/null +++ b/include/linux/vfio_pci_migration.h @@ -0,0 +1,136 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) 2022 Huawei Technologies Co., Ltd. All rights reserved. + */ + +#ifndef VFIO_PCI_MIGRATION_H +#define VFIO_PCI_MIGRATION_H + +#include <linux/types.h> +#include <linux/pci.h> + +#define VFIO_REGION_TYPE_MIGRATION (3) +/* sub-types for VFIO_REGION_TYPE_MIGRATION */ +#define VFIO_REGION_SUBTYPE_MIGRATION (1) + +#define VFIO_MIGRATION_BUFFER_MAX_SIZE SZ_256K +#define VFIO_MIGRATION_REGION_DATA_OFFSET \ + (sizeof(struct vfio_device_migration_info)) +#define VFIO_DEVICE_MIGRATION_OFFSET(x) \ + offsetof(struct vfio_device_migration_info, x) + +struct vfio_device_migration_info { + __u32 device_state; /* VFIO device state */ +#define VFIO_DEVICE_STATE_STOP (0) +#define VFIO_DEVICE_STATE_RUNNING (1 << 0) +#define VFIO_DEVICE_STATE_SAVING (1 << 1) +#define VFIO_DEVICE_STATE_RESUMING (1 << 2) +#define VFIO_DEVICE_STATE_MASK (VFIO_DEVICE_STATE_RUNNING | \ + VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RESUMING) + __u32 reserved; + + __u32 device_cmd; + __u32 version_id; + + __u64 pending_bytes; + __u64 data_offset; + __u64 data_size; +}; + +enum { + VFIO_DEVICE_STOP = 0xffff0001, + VFIO_DEVICE_CONTINUE, + VFIO_DEVICE_MIGRATION_CANCEL, +}; + +struct vfio_log_buf_sge { + __u64 len; + __u64 addr; +}; + +struct vfio_log_buf_info { + __u32 uuid; + __u64 buffer_size; + __u64 addrs_size; + __u64 frag_size; + struct vfio_log_buf_sge *sgevec; +}; + +struct vfio_log_buf_ctl { + __u32 argsz; + __u32 flags; + #define VFIO_DEVICE_LOG_BUF_FLAG_SETUP (1 << 0) + #define VFIO_DEVICE_LOG_BUF_FLAG_RELEASE (1 << 1) + #define VFIO_DEVICE_LOG_BUF_FLAG_START (1 << 2) + #define VFIO_DEVICE_LOG_BUF_FLAG_STOP (1 << 3) + #define VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY (1 << 4) + void *data; +}; +#define VFIO_LOG_BUF_CTL _IO(VFIO_TYPE, VFIO_BASE + 21) +#define VFIO_GET_LOG_BUF_FD _IO(VFIO_TYPE, VFIO_BASE + 22) +#define VFIO_DEVICE_LOG_BUF_CTL _IO(VFIO_TYPE, VFIO_BASE + 23) + +struct vf_migration_log_info { + __u32 dom_uuid; + __u64 buffer_size; + __u64 sge_len; + __u64 sge_num; + struct vfio_log_buf_sge *sgevec; +}; + +struct vfio_device_migration_ops { + /* Get device information */ + int (*get_info)(struct pci_dev *pdev, + struct vfio_device_migration_info *info); + /* Enable a vf device */ + int (*enable)(struct pci_dev *pdev); + /* Disable a vf device */ + int (*disable)(struct pci_dev *pdev); + /* Save a vf device */ + int (*save)(struct pci_dev *pdev, void *base, + uint64_t off, uint64_t count); + /* Resuming a vf device */ + int (*restore)(struct pci_dev *pdev, void *base, + uint64_t off, uint64_t count); + /* Log start a vf device */ + int (*log_start)(struct pci_dev *pdev, + struct vf_migration_log_info *log_info); + /* Log stop a vf device */ + int (*log_stop)(struct pci_dev *pdev, uint32_t uuid); + /* Get vf device log status */ + int (*get_log_status)(struct pci_dev *pdev); + /* Pre enable a vf device(load_setup, before restore a vf) */ + int (*pre_enable)(struct pci_dev *pdev); + /* Cancel a vf device when live migration failed (rollback) */ + int (*cancel)(struct pci_dev *pdev); + /* Init a vf device */ + int (*init)(struct pci_dev *pdev); + /* Uninit a vf device */ + void (*uninit)(struct pci_dev *pdev); + /* Release a vf device */ + void (*release)(struct pci_dev *pdev); +}; + +struct vfio_pci_vendor_mig_driver { + struct pci_dev *pdev; + unsigned char bus_num; + struct vfio_device_migration_ops *dev_mig_ops; + struct module *owner; + atomic_t count; + struct list_head list; +}; + +struct vfio_pci_migration_data { + u64 state_size; + struct pci_dev *vf_dev; + struct vfio_pci_vendor_mig_driver *mig_driver; + struct vfio_device_migration_info *mig_ctl; + void *vf_data; +}; + +int vfio_pci_register_migration_ops(struct vfio_device_migration_ops *ops, + struct module *mod, struct pci_dev *pdev); +void vfio_pci_unregister_migration_ops(struct module *mod, + struct pci_dev *pdev); + +#endif /* VFIO_PCI_MIGRATION_H */ -- 1.8.3.1

1 0

[PATCH OLK-5.10 v2 1/2] ipmi/watchdog: replace atomic_add() and atomic_sub()
by Miaohe Lin 24 Jun '22

24 Jun '22

From: Yejune Deng <yejune.deng(a)gmail.com> mainline inclusion from v5.11-rc1 commit a01a89b1db1066a6af23ae08b9a0c345b7966f0b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DVR9 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- atomic_inc() and atomic_dec() looks better Signed-off-by: Yejune Deng <yejune.deng(a)gmail.com> Message-Id: <1605511807-7135-1-git-send-email-yejune.deng(a)gmail.com> Signed-off-by: Corey Minyard <cminyard(a)mvista.com> --- drivers/char/ipmi/ipmi_watchdog.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c index f78156d93c3f..32c334e34d55 100644 --- a/drivers/char/ipmi/ipmi_watchdog.c +++ b/drivers/char/ipmi/ipmi_watchdog.c @@ -495,7 +495,7 @@ static void panic_halt_ipmi_heartbeat(void) msg.cmd = IPMI_WDOG_RESET_TIMER; msg.data = NULL; msg.data_len = 0; - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = ipmi_request_supply_msgs(watchdog_user, (struct ipmi_addr *) &addr, 0, @@ -505,7 +505,7 @@ static void panic_halt_ipmi_heartbeat(void) &panic_halt_heartbeat_recv_msg, 1); if (rv) - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); } static struct ipmi_smi_msg panic_halt_smi_msg = { @@ -529,12 +529,12 @@ static void panic_halt_ipmi_set_timeout(void) /* Wait for the messages to be free. */ while (atomic_read(&panic_done_count) != 0) ipmi_poll_interface(watchdog_user); - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = __ipmi_set_timeout(&panic_halt_smi_msg, &panic_halt_recv_msg, &send_heartbeat_now); if (rv) { - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); pr_warn("Unable to extend the watchdog timeout\n"); } else { if (send_heartbeat_now) -- 2.23.0

1 1

[PATCH OLK-5.10 1/2] ipmi/watchdog: replace atomic_add() and atomic_sub()
by Miaohe Lin 23 Jun '22

23 Jun '22

From: Yejune Deng <yejune.deng(a)gmail.com> mainline inclusion from v5.11-rc1 commit a01a89b1db1066a6af23ae08b9a0c345b7966f0b category: bugfix bugzilla: NA CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- atomic_inc() and atomic_dec() looks better Signed-off-by: Yejune Deng <yejune.deng(a)gmail.com> Message-Id: <1605511807-7135-1-git-send-email-yejune.deng(a)gmail.com> Signed-off-by: Corey Minyard <cminyard(a)mvista.com> --- drivers/char/ipmi/ipmi_watchdog.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c index f78156d93c3f..32c334e34d55 100644 --- a/drivers/char/ipmi/ipmi_watchdog.c +++ b/drivers/char/ipmi/ipmi_watchdog.c @@ -495,7 +495,7 @@ static void panic_halt_ipmi_heartbeat(void) msg.cmd = IPMI_WDOG_RESET_TIMER; msg.data = NULL; msg.data_len = 0; - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = ipmi_request_supply_msgs(watchdog_user, (struct ipmi_addr *) &addr, 0, @@ -505,7 +505,7 @@ static void panic_halt_ipmi_heartbeat(void) &panic_halt_heartbeat_recv_msg, 1); if (rv) - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); } static struct ipmi_smi_msg panic_halt_smi_msg = { @@ -529,12 +529,12 @@ static void panic_halt_ipmi_set_timeout(void) /* Wait for the messages to be free. */ while (atomic_read(&panic_done_count) != 0) ipmi_poll_interface(watchdog_user); - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = __ipmi_set_timeout(&panic_halt_smi_msg, &panic_halt_recv_msg, &send_heartbeat_now); if (rv) { - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); pr_warn("Unable to extend the watchdog timeout\n"); } else { if (send_heartbeat_now) -- 2.23.0

2 2

[PATCH openEuler-5.10 01/59] bcache: fix race between setting bdev state to none and new write request direct to backing
by Zheng Zengkai 22 Jun '22

22 Jun '22

From: Dongsheng Yang <dongsheng.yang(a)easystack.cn> mainline inclusion from v5.11-rc1 commit df4ad53242158f9f1f97daf4feddbb4f8b77f080 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I59A5L?from=project-issue CVE: N/A ----------------------------------------------- There is a race condition in detaching as below: A. detaching B. Write request (1) writing back (2) write back done, set bdev state to clean. (3) cached_dev_put() and schedule_work(&dc->detach); (4) write data [0 - 4K] directly into backing and ack to user. (5) power-failure... When we restart this bcache device, this bdev is clean but not detached, and read [0 - 4K], we will get unexpected old data from cache device. To fix this problem, set the bdev state to none when we writeback done in detaching, and then if power-failure happened as above, the data in cache will not be used in next bcache device starting, it's detached, we will read the correct data from backing derectly. Signed-off-by: Dongsheng Yang <dongsheng.yang(a)easystack.cn> Signed-off-by: Coly Li <colyli(a)suse.de> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/md/bcache/super.c | 9 --------- drivers/md/bcache/writeback.c | 9 +++++++++ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index 81f1cc5b3499..b7d9d1b79ac2 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1151,9 +1151,6 @@ static void cancel_writeback_rate_update_dwork(struct cached_dev *dc) static void cached_dev_detach_finish(struct work_struct *w) { struct cached_dev *dc = container_of(w, struct cached_dev, detach); - struct closure cl; - - closure_init_stack(&cl); BUG_ON(!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)); BUG_ON(refcount_read(&dc->count)); @@ -1167,12 +1164,6 @@ static void cached_dev_detach_finish(struct work_struct *w) dc->writeback_thread = NULL; } - memset(&dc->sb.set_uuid, 0, 16); - SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE); - - bch_write_bdev_super(dc, &cl); - closure_sync(&cl); - mutex_lock(&bch_register_lock); calc_cached_dev_sectors(dc->disk.c); diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c index 3c74996978da..a129e4d2707c 100644 --- a/drivers/md/bcache/writeback.c +++ b/drivers/md/bcache/writeback.c @@ -705,6 +705,15 @@ static int bch_writeback_thread(void *arg) * bch_cached_dev_detach(). */ if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)) { + struct closure cl; + + closure_init_stack(&cl); + memset(&dc->sb.set_uuid, 0, 16); + SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE); + + bch_write_bdev_super(dc, &cl); + closure_sync(&cl); + up_write(&dc->writeback_lock); break; } -- 2.20.1

1 58

[PATCH openEuler-5.10 00/28] Backport 5.10.108 LTS
by Zheng Zengkai 22 Jun '22

22 Jun '22

Backport 5.10.108 LTS patches from upstream Revert "selftests/bpf: Add test for bpf_timer overwriting crash" smsc95xx: Ignore -ENODEV errors when device is unplugged net: usb: Correct reset handling of smsc95xx net: usb: Correct PHY handling of smsc95xx perf symbols: Fix symbol size calculation condition Input: aiptek - properly check endpoint type scsi: mpt3sas: Page fault in reply q processing usb: usbtmc: Fix bug in pipe direction for control transfers usb: gadget: Fix use-after-free bug by not setting udc->dev.driver net: mscc: ocelot: fix backwards compatibility with single-chain tc-flower offload net: bcmgenet: skip invalid partial checksums bnx2x: fix built-in kernel driver load failure net: phy: mscc: Add MODULE_FIRMWARE macros net: dsa: Add missing of_node_put() in dsa_port_parse_of net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit() drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings drm/imx: parallel-display: Remove bus flags check in imx_pd_bridge_atomic_check() hv_netvsc: Add check for kvmalloc_array atm: eni: Add check for dma_map_single net/packet: fix slab-out-of-bounds access in packet_recvmsg() net: phy: marvell: Fix invalid comparison in the resume and suspend functions esp6: fix check on ipv6_skip_exthdr's return value vsock: each transport cycles only on its own sockets efi: fix return value of __setup handlers mm: swap: get rid of livelock in swapin readahead ocfs2: fix crash when initialize filecheck kobj fails crypto: qcom-rng - ensure buffer for generate is completely filled already merged (2) esp: Fix possible buffer overflow in ESP transformation arm64: fix clang warning about TRAMP_VALIAS Total patches = 30 - 2 = 28 Alan Stern (2): usb: gadget: Fix use-after-free bug by not setting udc->dev.driver usb: usbtmc: Fix bug in pipe direction for control transfers Brian Masney (1): crypto: qcom-rng - ensure buffer for generate is completely filled Christoph Niedermaier (1): drm/imx: parallel-display: Remove bus flags check in imx_pd_bridge_atomic_check() Dan Carpenter (1): usb: gadget: rndis: prevent integer overflow in rndis_set_response() Doug Berger (1): net: bcmgenet: skip invalid partial checksums Eric Dumazet (1): net/packet: fix slab-out-of-bounds access in packet_recvmsg() Fabio Estevam (1): smsc95xx: Ignore -ENODEV errors when device is unplugged Greg Kroah-Hartman (1): Revert "selftests/bpf: Add test for bpf_timer overwriting crash" Guo Ziliang (1): mm: swap: get rid of livelock in swapin readahead Jiasheng Jiang (2): atm: eni: Add check for dma_map_single hv_netvsc: Add check for kvmalloc_array Jiyong Park (1): vsock: each transport cycles only on its own sockets Joseph Qi (1): ocfs2: fix crash when initialize filecheck kobj fails Juerg Haefliger (1): net: phy: mscc: Add MODULE_FIRMWARE macros Kurt Cancemi (1): net: phy: marvell: Fix invalid comparison in the resume and suspend functions Manish Chopra (1): bnx2x: fix built-in kernel driver load failure Marek Vasut (1): drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings Markus Reichl (1): net: usb: Correct reset handling of smsc95xx Martyn Welch (1): net: usb: Correct PHY handling of smsc95xx Matt Lupfer (1): scsi: mpt3sas: Page fault in reply q processing Miaoqian Lin (1): net: dsa: Add missing of_node_put() in dsa_port_parse_of Michael Petlan (1): perf symbols: Fix symbol size calculation condition Nicolas Dichtel (1): net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit() Pavel Skripkin (1): Input: aiptek - properly check endpoint type Randy Dunlap (1): efi: fix return value of __setup handlers Sabrina Dubroca (1): esp6: fix check on ipv6_skip_exthdr's return value Vladimir Oltean (1): net: mscc: ocelot: fix backwards compatibility with single-chain tc-flower offload drivers/atm/eni.c | 2 + drivers/crypto/qcom-rng.c | 17 ++-- drivers/firmware/efi/apple-properties.c | 2 +- drivers/firmware/efi/efi.c | 2 +- drivers/gpu/drm/imx/parallel-display.c | 8 -- drivers/gpu/drm/panel/panel-simple.c | 2 +- drivers/input/tablet/aiptek.c | 10 +-- drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 2 - .../net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 28 +++--- .../net/ethernet/broadcom/bnx2x/bnx2x_main.c | 15 +--- .../net/ethernet/broadcom/genet/bcmgenet.c | 6 +- drivers/net/ethernet/mscc/ocelot_flower.c | 16 +++- drivers/net/hyperv/netvsc_drv.c | 3 + drivers/net/phy/marvell.c | 8 +- drivers/net/phy/mscc/mscc_main.c | 3 + drivers/net/usb/smsc95xx.c | 86 +++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.c | 5 +- drivers/usb/class/usbtmc.c | 13 ++- drivers/usb/gadget/function/rndis.c | 1 + drivers/usb/gadget/udc/core.c | 3 - drivers/vhost/vsock.c | 3 +- fs/ocfs2/super.c | 22 ++--- include/linux/if_arp.h | 1 + include/net/af_vsock.h | 3 +- mm/swap_state.c | 2 +- net/dsa/dsa2.c | 1 + net/ipv6/esp6.c | 3 +- net/packet/af_packet.c | 11 ++- net/vmw_vsock/af_vsock.c | 9 +- net/vmw_vsock/virtio_transport.c | 7 +- net/vmw_vsock/vmci_transport.c | 5 +- tools/perf/util/symbol.c | 2 +- .../selftests/bpf/prog_tests/timer_crash.c | 32 ------- .../testing/selftests/bpf/progs/timer_crash.c | 54 ------------ 34 files changed, 175 insertions(+), 212 deletions(-) delete mode 100644 tools/testing/selftests/bpf/prog_tests/timer_crash.c delete mode 100644 tools/testing/selftests/bpf/progs/timer_crash.c -- 2.20.1

1 28

[PATCH openEuler-1.0-LTS] xfs: show the proper user quota options
by Laibin Qiu 22 Jun '22

22 Jun '22

From: Kaixu Xia <kaixuxia(a)tencent.com> mainline inclusion from mainline-v5.11-rc6 commit 237d7887ae723af7d978e8b9a385fdff416f357b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5AG18 CVE: NA -------------------------------- The quota option 'usrquota' should be shown if both the XFS_UQUOTA_ACCT and XFS_UQUOTA_ENFD flags are set. The option 'uqnoenforce' should be shown when only the XFS_UQUOTA_ACCT flag is set. The current code logic seems wrong, Fix it and show proper options. Signed-off-by: Kaixu Xia <kaixuxia(a)tencent.com> Reviewed-by: Darrick J. Wong <darrick.wong(a)oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong(a)oracle.com> Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> Reviewed-by: Xuenan Guo <guoxuenan(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- fs/xfs/xfs_super.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c index e126bc6cdeb8..5d8e3a4d2671 100644 --- a/fs/xfs/xfs_super.c +++ b/fs/xfs/xfs_super.c @@ -505,10 +505,12 @@ xfs_showargs( seq_printf(m, ",swidth=%d", (int)XFS_FSB_TO_BB(mp, mp->m_swidth)); - if (mp->m_qflags & (XFS_UQUOTA_ACCT|XFS_UQUOTA_ENFD)) - seq_puts(m, ",usrquota"); - else if (mp->m_qflags & XFS_UQUOTA_ACCT) - seq_puts(m, ",uqnoenforce"); + if (mp->m_qflags & XFS_UQUOTA_ACCT) { + if (mp->m_qflags & XFS_UQUOTA_ENFD) + seq_puts(m, ",usrquota"); + else + seq_puts(m, ",uqnoenforce"); + } if (mp->m_qflags & XFS_PQUOTA_ACCT) { if (mp->m_qflags & XFS_PQUOTA_ENFD) -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 01/55] bcache: fix race between setting bdev state to none and new write request direct to backing
by Zheng Zengkai 21 Jun '22

21 Jun '22

From: Dongsheng Yang <dongsheng.yang(a)easystack.cn> mainline inclusion from v5.11-rc1 commit df4ad53242158f9f1f97daf4feddbb4f8b77f080 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I59A5L?from=project-issue CVE: N/A ----------------------------------------------- There is a race condition in detaching as below: A. detaching B. Write request (1) writing back (2) write back done, set bdev state to clean. (3) cached_dev_put() and schedule_work(&dc->detach); (4) write data [0 - 4K] directly into backing and ack to user. (5) power-failure... When we restart this bcache device, this bdev is clean but not detached, and read [0 - 4K], we will get unexpected old data from cache device. To fix this problem, set the bdev state to none when we writeback done in detaching, and then if power-failure happened as above, the data in cache will not be used in next bcache device starting, it's detached, we will read the correct data from backing derectly. Signed-off-by: Dongsheng Yang <dongsheng.yang(a)easystack.cn> Signed-off-by: Coly Li <colyli(a)suse.de> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/md/bcache/super.c | 9 --------- drivers/md/bcache/writeback.c | 9 +++++++++ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index 81f1cc5b3499..b7d9d1b79ac2 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1151,9 +1151,6 @@ static void cancel_writeback_rate_update_dwork(struct cached_dev *dc) static void cached_dev_detach_finish(struct work_struct *w) { struct cached_dev *dc = container_of(w, struct cached_dev, detach); - struct closure cl; - - closure_init_stack(&cl); BUG_ON(!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)); BUG_ON(refcount_read(&dc->count)); @@ -1167,12 +1164,6 @@ static void cached_dev_detach_finish(struct work_struct *w) dc->writeback_thread = NULL; } - memset(&dc->sb.set_uuid, 0, 16); - SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE); - - bch_write_bdev_super(dc, &cl); - closure_sync(&cl); - mutex_lock(&bch_register_lock); calc_cached_dev_sectors(dc->disk.c); diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c index 3c74996978da..a129e4d2707c 100644 --- a/drivers/md/bcache/writeback.c +++ b/drivers/md/bcache/writeback.c @@ -705,6 +705,15 @@ static int bch_writeback_thread(void *arg) * bch_cached_dev_detach(). */ if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)) { + struct closure cl; + + closure_init_stack(&cl); + memset(&dc->sb.set_uuid, 0, 16); + SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE); + + bch_write_bdev_super(dc, &cl); + closure_sync(&cl); + up_write(&dc->writeback_lock); break; } -- 2.20.1

1 54

[PATCH openEuler-5.10-LTS 00/28] Backport 5.10.108 LTS
by Zheng Zengkai 21 Jun '22

21 Jun '22

Backport 5.10.108 LTS patches from upstream Revert "selftests/bpf: Add test for bpf_timer overwriting crash" smsc95xx: Ignore -ENODEV errors when device is unplugged net: usb: Correct reset handling of smsc95xx net: usb: Correct PHY handling of smsc95xx perf symbols: Fix symbol size calculation condition Input: aiptek - properly check endpoint type scsi: mpt3sas: Page fault in reply q processing usb: usbtmc: Fix bug in pipe direction for control transfers usb: gadget: Fix use-after-free bug by not setting udc->dev.driver net: mscc: ocelot: fix backwards compatibility with single-chain tc-flower offload net: bcmgenet: skip invalid partial checksums bnx2x: fix built-in kernel driver load failure net: phy: mscc: Add MODULE_FIRMWARE macros net: dsa: Add missing of_node_put() in dsa_port_parse_of net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit() drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings drm/imx: parallel-display: Remove bus flags check in imx_pd_bridge_atomic_check() hv_netvsc: Add check for kvmalloc_array atm: eni: Add check for dma_map_single net/packet: fix slab-out-of-bounds access in packet_recvmsg() net: phy: marvell: Fix invalid comparison in the resume and suspend functions esp6: fix check on ipv6_skip_exthdr's return value vsock: each transport cycles only on its own sockets efi: fix return value of __setup handlers mm: swap: get rid of livelock in swapin readahead ocfs2: fix crash when initialize filecheck kobj fails crypto: qcom-rng - ensure buffer for generate is completely filled already merged (2) esp: Fix possible buffer overflow in ESP transformation arm64: fix clang warning about TRAMP_VALIAS Total patches = 30 - 2 = 28 Alan Stern (2): usb: gadget: Fix use-after-free bug by not setting udc->dev.driver usb: usbtmc: Fix bug in pipe direction for control transfers Brian Masney (1): crypto: qcom-rng - ensure buffer for generate is completely filled Christoph Niedermaier (1): drm/imx: parallel-display: Remove bus flags check in imx_pd_bridge_atomic_check() Dan Carpenter (1): usb: gadget: rndis: prevent integer overflow in rndis_set_response() Doug Berger (1): net: bcmgenet: skip invalid partial checksums Eric Dumazet (1): net/packet: fix slab-out-of-bounds access in packet_recvmsg() Fabio Estevam (1): smsc95xx: Ignore -ENODEV errors when device is unplugged Greg Kroah-Hartman (1): Revert "selftests/bpf: Add test for bpf_timer overwriting crash" Guo Ziliang (1): mm: swap: get rid of livelock in swapin readahead Jiasheng Jiang (2): atm: eni: Add check for dma_map_single hv_netvsc: Add check for kvmalloc_array Jiyong Park (1): vsock: each transport cycles only on its own sockets Joseph Qi (1): ocfs2: fix crash when initialize filecheck kobj fails Juerg Haefliger (1): net: phy: mscc: Add MODULE_FIRMWARE macros Kurt Cancemi (1): net: phy: marvell: Fix invalid comparison in the resume and suspend functions Manish Chopra (1): bnx2x: fix built-in kernel driver load failure Marek Vasut (1): drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings Markus Reichl (1): net: usb: Correct reset handling of smsc95xx Martyn Welch (1): net: usb: Correct PHY handling of smsc95xx Matt Lupfer (1): scsi: mpt3sas: Page fault in reply q processing Miaoqian Lin (1): net: dsa: Add missing of_node_put() in dsa_port_parse_of Michael Petlan (1): perf symbols: Fix symbol size calculation condition Nicolas Dichtel (1): net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit() Pavel Skripkin (1): Input: aiptek - properly check endpoint type Randy Dunlap (1): efi: fix return value of __setup handlers Sabrina Dubroca (1): esp6: fix check on ipv6_skip_exthdr's return value Vladimir Oltean (1): net: mscc: ocelot: fix backwards compatibility with single-chain tc-flower offload drivers/atm/eni.c | 2 + drivers/crypto/qcom-rng.c | 17 ++-- drivers/firmware/efi/apple-properties.c | 2 +- drivers/firmware/efi/efi.c | 2 +- drivers/gpu/drm/imx/parallel-display.c | 8 -- drivers/gpu/drm/panel/panel-simple.c | 2 +- drivers/input/tablet/aiptek.c | 10 +-- drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 2 - .../net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 28 +++--- .../net/ethernet/broadcom/bnx2x/bnx2x_main.c | 15 +--- .../net/ethernet/broadcom/genet/bcmgenet.c | 6 +- drivers/net/ethernet/mscc/ocelot_flower.c | 16 +++- drivers/net/hyperv/netvsc_drv.c | 3 + drivers/net/phy/marvell.c | 8 +- drivers/net/phy/mscc/mscc_main.c | 3 + drivers/net/usb/smsc95xx.c | 86 +++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.c | 5 +- drivers/usb/class/usbtmc.c | 13 ++- drivers/usb/gadget/function/rndis.c | 1 + drivers/usb/gadget/udc/core.c | 3 - drivers/vhost/vsock.c | 3 +- fs/ocfs2/super.c | 22 ++--- include/linux/if_arp.h | 1 + include/net/af_vsock.h | 3 +- mm/swap_state.c | 2 +- net/dsa/dsa2.c | 1 + net/ipv6/esp6.c | 3 +- net/packet/af_packet.c | 11 ++- net/vmw_vsock/af_vsock.c | 9 +- net/vmw_vsock/virtio_transport.c | 7 +- net/vmw_vsock/vmci_transport.c | 5 +- tools/perf/util/symbol.c | 2 +- .../selftests/bpf/prog_tests/timer_crash.c | 32 ------- .../testing/selftests/bpf/progs/timer_crash.c | 54 ------------ 34 files changed, 175 insertions(+), 212 deletions(-) delete mode 100644 tools/testing/selftests/bpf/prog_tests/timer_crash.c delete mode 100644 tools/testing/selftests/bpf/progs/timer_crash.c -- 2.20.1

1 28

[PATCH openEuler-1.0-LTS 1/4] sched: Introduce qos smt expeller for co-location
by liuzhengyuan＠kylinos.cn 21 Jun '22

21 Jun '22

From: Guan Jing <guanjing6(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I52611 CVE: NA -------------------------------- We introduce the qos smt expeller, which lets online tasks to expel offline tasks on the smt sibling cpus, and exclusively occupy CPU resources.In this way we are able to improve QOS of online tasks in co-location. Change-Id: I1860d20d5e78467773e67cc47b4fa2d1f0110783 Signed-off-by: Guan Jing <guanjing6(a)huawei.com> Reviewed-by: Chen Hui <judy.chenhui(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Zhengyuan Liu <liuzhengyuan(a)kylinos.cn> --- init/Kconfig | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/init/Kconfig b/init/Kconfig index ac1c864524ac..dd81d19e2fcb 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -794,6 +794,15 @@ config QOS_SCHED default n +config QOS_SCHED_SMT_EXPELLER + bool "Qos smt expeller" + depends on SCHED_SMT + depends on QOS_SCHED + default n + help + This feature enable online tasks to expel offline tasks + on the smt sibling cpus, and exclusively occupy CPU resources. + config FAIR_GROUP_SCHED bool "Group scheduling for SCHED_OTHER" depends on CGROUP_SCHED -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 1/6] drivers core: Use sysfs_emit and sysfs_emit_at for show(device *...) functions
by Yongqiang Liu 21 Jun '22

21 Jun '22

From: Joe Perches <joe(a)perches.com> mainline inclusion from mainline-v5.10-rc1 commit aa838896d87af561a33ecefea1caa4c15a68bc47 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5C32F CVE: CVE-2022-20166 ---------------------------------------------- Convert the various sprintf fmaily calls in sysfs device show functions to sysfs_emit and sysfs_emit_at for PAGE_SIZE buffer safety. Done with: $ spatch -sp-file sysfs_emit_dev.cocci --in-place --max-width=80 . And cocci script: $ cat sysfs_emit_dev.cocci @@ identifier d_show; identifier dev, attr, buf; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... return - sprintf(buf, + sysfs_emit(buf, ...); ...> } @@ identifier d_show; identifier dev, attr, buf; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... return - snprintf(buf, PAGE_SIZE, + sysfs_emit(buf, ...); ...> } @@ identifier d_show; identifier dev, attr, buf; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... return - scnprintf(buf, PAGE_SIZE, + sysfs_emit(buf, ...); ...> } @@ identifier d_show; identifier dev, attr, buf; expression chr; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... return - strcpy(buf, chr); + sysfs_emit(buf, chr); ...> } @@ identifier d_show; identifier dev, attr, buf; identifier len; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... len = - sprintf(buf, + sysfs_emit(buf, ...); ...> return len; } @@ identifier d_show; identifier dev, attr, buf; identifier len; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... len = - snprintf(buf, PAGE_SIZE, + sysfs_emit(buf, ...); ...> return len; } @@ identifier d_show; identifier dev, attr, buf; identifier len; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... len = - scnprintf(buf, PAGE_SIZE, + sysfs_emit(buf, ...); ...> return len; } @@ identifier d_show; identifier dev, attr, buf; identifier len; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { <... - len += scnprintf(buf + len, PAGE_SIZE - len, + len += sysfs_emit_at(buf, len, ...); ...> return len; } @@ identifier d_show; identifier dev, attr, buf; expression chr; @@ ssize_t d_show(struct device *dev, struct device_attribute *attr, char *buf) { ... - strcpy(buf, chr); - return strlen(buf); + return sysfs_emit(buf, chr); } Signed-off-by: Joe Perches <joe(a)perches.com> Link: https://lore.kernel.org/r/3d033c33056d88bbe34d4ddb62afd05ee166ab9a.16002859… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/base/node.c Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/base/arch_topology.c | 3 +- drivers/base/cacheinfo.c | 18 ++++----- drivers/base/core.c | 8 ++-- drivers/base/cpu.c | 26 ++++++------ drivers/base/firmware_loader/fallback.c | 2 +- drivers/base/memory.c | 24 +++++------ drivers/base/node.c | 26 ++++++------ drivers/base/platform.c | 2 +- drivers/base/power/sysfs.c | 53 +++++++++++++------------ drivers/base/soc.c | 8 ++-- 10 files changed, 86 insertions(+), 84 deletions(-) diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c index 7157e4039b4c..729dded51e7b 100644 --- a/drivers/base/arch_topology.c +++ b/drivers/base/arch_topology.c @@ -42,7 +42,8 @@ static ssize_t cpu_capacity_show(struct device *dev, { struct cpu *cpu = container_of(dev, struct cpu, dev); - return sprintf(buf, "%lu\n", topology_get_cpu_scale(NULL, cpu->dev.id)); + return sysfs_emit(buf, "%lu\n", + topology_get_cpu_scale(NULL, cpu->dev.id)); } static DEVICE_ATTR_RO(cpu_capacity); diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c index aee69d78c2e7..f7d107ca1a66 100644 --- a/drivers/base/cacheinfo.c +++ b/drivers/base/cacheinfo.c @@ -415,7 +415,7 @@ static ssize_t size_show(struct device *dev, { struct cacheinfo *this_leaf = dev_get_drvdata(dev); - return sprintf(buf, "%uK\n", this_leaf->size >> 10); + return sysfs_emit(buf, "%uK\n", this_leaf->size >> 10); } static ssize_t shared_cpumap_show_func(struct device *dev, bool list, char *buf) @@ -445,11 +445,11 @@ static ssize_t type_show(struct device *dev, switch (this_leaf->type) { case CACHE_TYPE_DATA: - return sprintf(buf, "Data\n"); + return sysfs_emit(buf, "Data\n"); case CACHE_TYPE_INST: - return sprintf(buf, "Instruction\n"); + return sysfs_emit(buf, "Instruction\n"); case CACHE_TYPE_UNIFIED: - return sprintf(buf, "Unified\n"); + return sysfs_emit(buf, "Unified\n"); default: return -EINVAL; } @@ -463,11 +463,11 @@ static ssize_t allocation_policy_show(struct device *dev, int n = 0; if ((ci_attr & CACHE_READ_ALLOCATE) && (ci_attr & CACHE_WRITE_ALLOCATE)) - n = sprintf(buf, "ReadWriteAllocate\n"); + n = sysfs_emit(buf, "ReadWriteAllocate\n"); else if (ci_attr & CACHE_READ_ALLOCATE) - n = sprintf(buf, "ReadAllocate\n"); + n = sysfs_emit(buf, "ReadAllocate\n"); else if (ci_attr & CACHE_WRITE_ALLOCATE) - n = sprintf(buf, "WriteAllocate\n"); + n = sysfs_emit(buf, "WriteAllocate\n"); return n; } @@ -479,9 +479,9 @@ static ssize_t write_policy_show(struct device *dev, int n = 0; if (ci_attr & CACHE_WRITE_THROUGH) - n = sprintf(buf, "WriteThrough\n"); + n = sysfs_emit(buf, "WriteThrough\n"); else if (ci_attr & CACHE_WRITE_BACK) - n = sprintf(buf, "WriteBack\n"); + n = sysfs_emit(buf, "WriteBack\n"); return n; } diff --git a/drivers/base/core.c b/drivers/base/core.c index f6d8a4246adf..b4f80e82a91f 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -994,7 +994,7 @@ ssize_t device_show_ulong(struct device *dev, char *buf) { struct dev_ext_attribute *ea = to_ext_attr(attr); - return snprintf(buf, PAGE_SIZE, "%lx\n", *(unsigned long *)(ea->var)); + return sysfs_emit(buf, "%lx\n", *(unsigned long *)(ea->var)); } EXPORT_SYMBOL_GPL(device_show_ulong); @@ -1019,7 +1019,7 @@ ssize_t device_show_int(struct device *dev, { struct dev_ext_attribute *ea = to_ext_attr(attr); - return snprintf(buf, PAGE_SIZE, "%d\n", *(int *)(ea->var)); + return sysfs_emit(buf, "%d\n", *(int *)(ea->var)); } EXPORT_SYMBOL_GPL(device_show_int); @@ -1040,7 +1040,7 @@ ssize_t device_show_bool(struct device *dev, struct device_attribute *attr, { struct dev_ext_attribute *ea = to_ext_attr(attr); - return snprintf(buf, PAGE_SIZE, "%d\n", *(bool *)(ea->var)); + return sysfs_emit(buf, "%d\n", *(bool *)(ea->var)); } EXPORT_SYMBOL_GPL(device_show_bool); @@ -1273,7 +1273,7 @@ static ssize_t online_show(struct device *dev, struct device_attribute *attr, device_lock(dev); val = !dev->offline; device_unlock(dev); - return sprintf(buf, "%u\n", val); + return sysfs_emit(buf, "%u\n", val); } static ssize_t online_store(struct device *dev, struct device_attribute *attr, diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c index 1df057486176..128e5867c35d 100644 --- a/drivers/base/cpu.c +++ b/drivers/base/cpu.c @@ -156,7 +156,7 @@ static ssize_t show_crash_notes(struct device *dev, struct device_attribute *att * operation should be safe. No locking required. */ addr = per_cpu_ptr_to_phys(per_cpu_ptr(crash_notes, cpunum)); - rc = sprintf(buf, "%Lx\n", addr); + rc = sysfs_emit(buf, "%Lx\n", addr); return rc; } static DEVICE_ATTR(crash_notes, 0400, show_crash_notes, NULL); @@ -167,7 +167,7 @@ static ssize_t show_crash_notes_size(struct device *dev, { ssize_t rc; - rc = sprintf(buf, "%zu\n", sizeof(note_buf_t)); + rc = sysfs_emit(buf, "%zu\n", sizeof(note_buf_t)); return rc; } static DEVICE_ATTR(crash_notes_size, 0400, show_crash_notes_size, NULL); @@ -328,8 +328,8 @@ static ssize_t print_cpu_modalias(struct device *dev, ssize_t n; u32 i; - n = sprintf(buf, "cpu:type:" CPU_FEATURE_TYPEFMT ":feature:", - CPU_FEATURE_TYPEVAL); + n = sysfs_emit(buf, "cpu:type:" CPU_FEATURE_TYPEFMT ":feature:", + CPU_FEATURE_TYPEVAL); for (i = 0; i < MAX_CPU_FEATURES; i++) if (cpu_have_feature(i)) { @@ -519,56 +519,56 @@ static void __init cpu_dev_register_generic(void) ssize_t __weak cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_spec_store_bypass(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_l1tf(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_mds(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_tsx_async_abort(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_itlb_multihit(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } ssize_t __weak cpu_show_srbds(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "Not affected\n"); + return sysfs_emit(buf, "Not affected\n"); } static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c index 818d8c37d70a..ab619da92734 100644 --- a/drivers/base/firmware_loader/fallback.c +++ b/drivers/base/firmware_loader/fallback.c @@ -216,7 +216,7 @@ static ssize_t firmware_loading_show(struct device *dev, loading = fw_sysfs_loading(fw_sysfs->fw_priv); mutex_unlock(&fw_lock); - return sprintf(buf, "%d\n", loading); + return sysfs_emit(buf, "%d\n", loading); } /* one pages buffer should be mapped/unmapped only once */ diff --git a/drivers/base/memory.c b/drivers/base/memory.c index 1b97f305173f..54225b812cd7 100644 --- a/drivers/base/memory.c +++ b/drivers/base/memory.c @@ -140,7 +140,7 @@ static ssize_t phys_index_show(struct device *dev, unsigned long phys_index; phys_index = mem->start_section_nr / sections_per_block; - return sprintf(buf, "%08lx\n", phys_index); + return sysfs_emit(buf, "%08lx\n", phys_index); } /* @@ -164,7 +164,7 @@ static ssize_t removable_show(struct device *dev, struct device_attribute *attr, } out: - return sprintf(buf, "%d\n", ret); + return sysfs_emit(buf, "%d\n", ret); } /* @@ -182,17 +182,17 @@ static ssize_t state_show(struct device *dev, struct device_attribute *attr, */ switch (mem->state) { case MEM_ONLINE: - len = sprintf(buf, "online\n"); + len = sysfs_emit(buf, "online\n"); break; case MEM_OFFLINE: - len = sprintf(buf, "offline\n"); + len = sysfs_emit(buf, "offline\n"); break; case MEM_GOING_OFFLINE: - len = sprintf(buf, "going-offline\n"); + len = sysfs_emit(buf, "going-offline\n"); break; default: - len = sprintf(buf, "ERROR-UNKNOWN-%ld\n", - mem->state); + len = sysfs_emit(buf, "ERROR-UNKNOWN-%ld\n", + mem->state); WARN_ON(1); break; } @@ -389,7 +389,7 @@ static ssize_t phys_device_show(struct device *dev, struct device_attribute *attr, char *buf) { struct memory_block *mem = to_memory_block(dev); - return sprintf(buf, "%d\n", mem->phys_device); + return sysfs_emit(buf, "%d\n", mem->phys_device); } #ifdef CONFIG_MEMORY_HOTREMOVE @@ -427,7 +427,7 @@ static ssize_t valid_zones_show(struct device *dev, */ if (!test_pages_in_a_zone(start_pfn, start_pfn + nr_pages, &valid_start_pfn, &valid_end_pfn)) - return sprintf(buf, "none\n"); + return sysfs_emit(buf, "none\n"); start_pfn = valid_start_pfn; strcat(buf, page_zone(pfn_to_page(start_pfn))->name); goto out; @@ -461,7 +461,7 @@ static DEVICE_ATTR_RO(removable); static ssize_t block_size_bytes_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%lx\n", get_memory_block_size()); + return sysfs_emit(buf, "%lx\n", get_memory_block_size()); } static DEVICE_ATTR_RO(block_size_bytes); @@ -473,8 +473,8 @@ static DEVICE_ATTR_RO(block_size_bytes); static ssize_t auto_online_blocks_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%s\n", - online_type_to_str[memhp_default_online_type]); + return sysfs_emit(buf, "%s\n", + online_type_to_str[memhp_default_online_type]); } static ssize_t auto_online_blocks_store(struct device *dev, diff --git a/drivers/base/node.c b/drivers/base/node.c index ac44db3f63c7..7a807e471fbf 100644 --- a/drivers/base/node.c +++ b/drivers/base/node.c @@ -457,19 +457,19 @@ static DEVICE_ATTR(meminfo, S_IRUGO, node_read_meminfo, NULL); static ssize_t node_read_numastat(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, - "numa_hit %lu\n" - "numa_miss %lu\n" - "numa_foreign %lu\n" - "interleave_hit %lu\n" - "local_node %lu\n" - "other_node %lu\n", - sum_zone_numa_state(dev->id, NUMA_HIT), - sum_zone_numa_state(dev->id, NUMA_MISS), - sum_zone_numa_state(dev->id, NUMA_FOREIGN), - sum_zone_numa_state(dev->id, NUMA_INTERLEAVE_HIT), - sum_zone_numa_state(dev->id, NUMA_LOCAL), - sum_zone_numa_state(dev->id, NUMA_OTHER)); + return sysfs_emit(buf, + "numa_hit %lu\n" + "numa_miss %lu\n" + "numa_foreign %lu\n" + "interleave_hit %lu\n" + "local_node %lu\n" + "other_node %lu\n", + sum_zone_numa_state(dev->id, NUMA_HIT), + sum_zone_numa_state(dev->id, NUMA_MISS), + sum_zone_numa_state(dev->id, NUMA_FOREIGN), + sum_zone_numa_state(dev->id, NUMA_INTERLEAVE_HIT), + sum_zone_numa_state(dev->id, NUMA_LOCAL), + sum_zone_numa_state(dev->id, NUMA_OTHER)); } static DEVICE_ATTR(numastat, S_IRUGO, node_read_numastat, NULL); diff --git a/drivers/base/platform.c b/drivers/base/platform.c index 349c2754eed7..fe3f4225d80a 100644 --- a/drivers/base/platform.c +++ b/drivers/base/platform.c @@ -907,7 +907,7 @@ static ssize_t driver_override_show(struct device *dev, ssize_t len; device_lock(dev); - len = sprintf(buf, "%s\n", pdev->driver_override); + len = sysfs_emit(buf, "%s\n", pdev->driver_override); device_unlock(dev); return len; } diff --git a/drivers/base/power/sysfs.c b/drivers/base/power/sysfs.c index d713738ce796..d071d5d1a6d7 100644 --- a/drivers/base/power/sysfs.c +++ b/drivers/base/power/sysfs.c @@ -101,7 +101,7 @@ static const char ctrl_on[] = "on"; static ssize_t control_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%s\n", + return sysfs_emit(buf, "%s\n", dev->power.runtime_auto ? ctrl_auto : ctrl_on); } @@ -127,7 +127,8 @@ static ssize_t runtime_active_time_show(struct device *dev, int ret; spin_lock_irq(&dev->power.lock); update_pm_runtime_accounting(dev); - ret = sprintf(buf, "%i\n", jiffies_to_msecs(dev->power.active_jiffies)); + ret = sysfs_emit(buf, "%i\n", + jiffies_to_msecs(dev->power.active_jiffies)); spin_unlock_irq(&dev->power.lock); return ret; } @@ -140,8 +141,8 @@ static ssize_t runtime_suspended_time_show(struct device *dev, int ret; spin_lock_irq(&dev->power.lock); update_pm_runtime_accounting(dev); - ret = sprintf(buf, "%i\n", - jiffies_to_msecs(dev->power.suspended_jiffies)); + ret = sysfs_emit(buf, "%i\n", + jiffies_to_msecs(dev->power.suspended_jiffies)); spin_unlock_irq(&dev->power.lock); return ret; } @@ -175,7 +176,7 @@ static ssize_t runtime_status_show(struct device *dev, return -EIO; } } - return sprintf(buf, p); + return sysfs_emit(buf, p); } static DEVICE_ATTR_RO(runtime_status); @@ -185,7 +186,7 @@ static ssize_t autosuspend_delay_ms_show(struct device *dev, { if (!dev->power.use_autosuspend) return -EIO; - return sprintf(buf, "%d\n", dev->power.autosuspend_delay); + return sysfs_emit(buf, "%d\n", dev->power.autosuspend_delay); } static ssize_t autosuspend_delay_ms_store(struct device *dev, @@ -214,11 +215,11 @@ static ssize_t pm_qos_resume_latency_us_show(struct device *dev, s32 value = dev_pm_qos_requested_resume_latency(dev); if (value == 0) - return sprintf(buf, "n/a\n"); + return sysfs_emit(buf, "n/a\n"); if (value == PM_QOS_RESUME_LATENCY_NO_CONSTRAINT) value = 0; - return sprintf(buf, "%d\n", value); + return sysfs_emit(buf, "%d\n", value); } static ssize_t pm_qos_resume_latency_us_store(struct device *dev, @@ -258,11 +259,11 @@ static ssize_t pm_qos_latency_tolerance_us_show(struct device *dev, s32 value = dev_pm_qos_get_user_latency_tolerance(dev); if (value < 0) - return sprintf(buf, "auto\n"); + return sysfs_emit(buf, "auto\n"); if (value == PM_QOS_LATENCY_ANY) - return sprintf(buf, "any\n"); + return sysfs_emit(buf, "any\n"); - return sprintf(buf, "%d\n", value); + return sysfs_emit(buf, "%d\n", value); } static ssize_t pm_qos_latency_tolerance_us_store(struct device *dev, @@ -294,8 +295,8 @@ static ssize_t pm_qos_no_power_off_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%d\n", !!(dev_pm_qos_requested_flags(dev) - & PM_QOS_FLAG_NO_POWER_OFF)); + return sysfs_emit(buf, "%d\n", !!(dev_pm_qos_requested_flags(dev) + & PM_QOS_FLAG_NO_POWER_OFF)); } static ssize_t pm_qos_no_power_off_store(struct device *dev, @@ -323,9 +324,9 @@ static const char _disabled[] = "disabled"; static ssize_t wakeup_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%s\n", device_can_wakeup(dev) - ? (device_may_wakeup(dev) ? _enabled : _disabled) - : ""); + return sysfs_emit(buf, "%s\n", device_can_wakeup(dev) + ? (device_may_wakeup(dev) ? _enabled : _disabled) + : ""); } static ssize_t wakeup_store(struct device *dev, struct device_attribute *attr, @@ -511,7 +512,7 @@ static DEVICE_ATTR_RO(wakeup_prevent_sleep_time_ms); static ssize_t runtime_usage_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%d\n", atomic_read(&dev->power.usage_count)); + return sysfs_emit(buf, "%d\n", atomic_read(&dev->power.usage_count)); } static DEVICE_ATTR_RO(runtime_usage); @@ -519,8 +520,8 @@ static ssize_t runtime_active_kids_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%d\n", dev->power.ignore_children ? - 0 : atomic_read(&dev->power.child_count)); + return sysfs_emit(buf, "%d\n", dev->power.ignore_children ? + 0 : atomic_read(&dev->power.child_count)); } static DEVICE_ATTR_RO(runtime_active_kids); @@ -528,12 +529,12 @@ static ssize_t runtime_enabled_show(struct device *dev, struct device_attribute *attr, char *buf) { if (dev->power.disable_depth && (dev->power.runtime_auto == false)) - return sprintf(buf, "disabled & forbidden\n"); + return sysfs_emit(buf, "disabled & forbidden\n"); if (dev->power.disable_depth) - return sprintf(buf, "disabled\n"); + return sysfs_emit(buf, "disabled\n"); if (dev->power.runtime_auto == false) - return sprintf(buf, "forbidden\n"); - return sprintf(buf, "enabled\n"); + return sysfs_emit(buf, "forbidden\n"); + return sysfs_emit(buf, "enabled\n"); } static DEVICE_ATTR_RO(runtime_enabled); @@ -541,9 +542,9 @@ static DEVICE_ATTR_RO(runtime_enabled); static ssize_t async_show(struct device *dev, struct device_attribute *attr, char *buf) { - return sprintf(buf, "%s\n", - device_async_suspend_enabled(dev) ? - _enabled : _disabled); + return sysfs_emit(buf, "%s\n", + device_async_suspend_enabled(dev) ? + _enabled : _disabled); } static ssize_t async_store(struct device *dev, struct device_attribute *attr, diff --git a/drivers/base/soc.c b/drivers/base/soc.c index 7e91894a380b..23bc9eb794a2 100644 --- a/drivers/base/soc.c +++ b/drivers/base/soc.c @@ -72,13 +72,13 @@ static ssize_t soc_info_get(struct device *dev, struct soc_device *soc_dev = container_of(dev, struct soc_device, dev); if (attr == &dev_attr_machine) - return sprintf(buf, "%s\n", soc_dev->attr->machine); + return sysfs_emit(buf, "%s\n", soc_dev->attr->machine); if (attr == &dev_attr_family) - return sprintf(buf, "%s\n", soc_dev->attr->family); + return sysfs_emit(buf, "%s\n", soc_dev->attr->family); if (attr == &dev_attr_revision) - return sprintf(buf, "%s\n", soc_dev->attr->revision); + return sysfs_emit(buf, "%s\n", soc_dev->attr->revision); if (attr == &dev_attr_soc_id) - return sprintf(buf, "%s\n", soc_dev->attr->soc_id); + return sysfs_emit(buf, "%s\n", soc_dev->attr->soc_id); return -EINVAL; -- 2.25.1

1 5

[PATCH] drm/atomic-helper: Bump vblank timeout to 100 ms
by jiazhenyuan＠uniontech.com 21 Jun '22

21 Jun '22

From: jiazhenyuan <jiazhenyuan(a)uniontech.com> mainline inclusion from mainline-v5.1.0-rc2 commit b3198c38f02d54a5e964258a2180d502abe6eaf0 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5D0PL CVE: NA -------------------------------- The 50 ms default timeout waiting for vblanks is too small for the first vblank from the ST-Ericsson MCDE display controller over DSI. Presumably this is because the DSI display is command-mode only and the state machine will take some time setting up its state for the first display update, and we hit a timeout. 100 ms makes it pass without problems. Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Reviewed-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Reviewed-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20190430093746.26485-1-linus.… Signed-off-by: jiazhenyuan <jiazhenyuan(a)uniontech.com> --- drivers/gpu/drm/drm_atomic_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index c22062cc9992..f9306c3e9bab 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -1380,7 +1380,7 @@ drm_atomic_helper_wait_for_vblanks(struct drm_device *dev, ret = wait_event_timeout(dev->vblank[i].queue, old_state->crtcs[i].last_vblank_count != drm_crtc_vblank_count(crtc), - msecs_to_jiffies(50)); + msecs_to_jiffies(100)); WARN(!ret, "[CRTC:%d:%s] vblank wait timed out\n", crtc->base.id, crtc->name); -- 2.27.0

1 0

[PATCH openEuler-1.0-LTS] RDMA/cma: Do not change route.addr.src_addr.ss_family
by tangbin 21 Jun '22

21 Jun '22

From: Jason Gunthorpe <jgg(a)nvidia.com> mainline inclusion from mainline-v5.15-rc4 commit bc0bdc5afaa740d782fbf936aaeebd65e5c2921d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I59840 CVE: CVE-2021-4028 -------------------------------- Conflicts: The conditional statement to verify RDMA_CM_IDLE state is a little bit different from the upstream to 4.19. The commit 732d41c545bb (RDMA/cma: Make the locking for automatic state transition more clear) is missing from 4.19. So, the context has been modified. If the state is not idle then rdma_bind_addr() will immediately fail and no change to global state should happen. For instance if the state is already RDMA_CM_LISTEN then this will corrupt the src_addr and would cause the test in cma_cancel_operation(): if (cma_any_addr(cma_src_addr(id_priv)) && !id_priv->cma_dev) To view a mangled src_addr, eg with a IPv6 loopback address but an IPv4 family, failing the test. This would manifest as this trace from syzkaller: BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0 lib/list_debug.c:26 Read of size 8 at addr ffff8881546491e0 by task syz-executor.1/32204 CPU: 1 PID: 32204 Comm: syz-executor.1 Not tainted 5.12.0-rc8-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416 __list_add_valid+0x93/0xa0 lib/list_debug.c:26 __list_add include/linux/list.h:67 [inline] list_add_tail include/linux/list.h:100 [inline] cma_listen_on_all drivers/infiniband/core/cma.c:2557 [inline] rdma_listen+0x787/0xe00 drivers/infiniband/core/cma.c:3751 ucma_listen+0x16a/0x210 drivers/infiniband/core/ucma.c:1102 ucma_write+0x259/0x350 drivers/infiniband/core/ucma.c:1732 vfs_write+0x28e/0xa30 fs/read_write.c:603 ksys_write+0x1ee/0x250 fs/read_write.c:658 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae Which is indicating that an rdma_id_private was destroyed without doing cma_cancel_listens(). Instead of trying to re-use the src_addr memory to indirectly create an any address build one explicitly on the stack and bind to that as any other normal flow would do. Link: https://lore.kernel.org/r/0-v1-9fbb33f5e201+2a-cma_listen_jgg@nvidia.com Cc: stable(a)vger.kernel.org Fixes: 732d41c545bb ("RDMA/cma: Make the locking for automatic state transition more clear") Reported-by: syzbot+6bb0528b13611047209c(a)syzkaller.appspotmail.com Tested-by: Hao Sun <sunhao.th(a)gmail.com> Reviewed-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> --- drivers/infiniband/core/cma.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 319bfef00a4a..7444df92e7cf 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -3375,8 +3375,13 @@ int rdma_listen(struct rdma_cm_id *id, int backlog) id_priv = container_of(id, struct rdma_id_private, id); if (id_priv->state == RDMA_CM_IDLE) { - id->route.addr.src_addr.ss_family = AF_INET; - ret = rdma_bind_addr(id, cma_src_addr(id_priv)); + struct sockaddr_in any_in = { + .sin_family = AF_INET, + .sin_addr.s_addr = htonl(INADDR_ANY), + }; + + /* For a well behaved ULP state will be RDMA_CM_IDLE */ + ret = rdma_bind_addr(id, (struct sockaddr *)&any_in); if (ret) return ret; } -- 2.18.4

1 0

[PATCH openEuler-1.0-LTS] arm64: fix out-of-range error when adapting for ARM64_SPECTRE_BHB
by Yongqiang Liu 20 Jun '22

20 Jun '22

From: Chen Jiahao <chenjiahao16(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186460, https://gitee.com/src-openeuler/kernel/issues/I53MHA CVE: CVE-2022-23960 -------------------------------- In cpufeature.c, when num is set to ARM64_SPECTRE_BHB, it should not be passed to cpu_hwcap_keys, otherwise the out-of-range error would happen as below: UBSAN: Undefined behaviour in arch/arm64/kernel/cpufeature.c:1742:3 index 40 is out of range for type 'static_key_false [39]' CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.90+ #1 Call trace: dump_backtrace+0x0/0x390 show_stack+0x24/0x30 dump_stack+0x130/0x188 ubsan_epilogue+0x14/0xa4 __ubsan_handle_out_of_bounds+0x144/0x184 __enable_cpu_capabilities+0x158/0x1d4 setup_cpu_features+0x34/0xc8 smp_cpus_done+0x44/0x13c smp_init+0x188/0x1a4 kernel_init_freeable+0x454/0x974 kernel_init+0x18/0x150 ret_from_fork+0x10/0x18 Because KABI cpu_hwcap_keys is consistent and defined with length ARM64_NCAPS, which is smaller than ARM64_SPECTRE_BHB. Fixes: 2df7cf898c5b ("arm64: fix extra cpucaps setup problem") Signed-off-by: Chen Jiahao <chenjiahao16(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/arm64/kernel/cpufeature.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 996d3476f3c8..d7d8a4ab94b4 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -1732,8 +1732,10 @@ __enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps, for (; caps->matches; caps++) { unsigned int num = caps->capability; - if (num == ARM64_SPECTRE_BHB) + if (num == ARM64_SPECTRE_BHB) { set_cap_spectre_bhb = true; + continue; + } if (!(caps->type & scope_mask) || !cpus_have_cap(num)) continue; -- 2.25.1

1 0

[Cancel] openEuler kernel SIG例会&技术分享
by openEuler conference 20 Jun '22

20 Jun '22

Sorry! The Zoom meeting will be held at 2022-06-24 14:00 scheduled by openEuler Kernel SIG has been cancelled.

1 0

openEuler kernel SIG例会&技术分享
by openEuler conference 20 Jun '22

20 Jun '22

您好！ Kernel SIG 邀请您参加 2022-06-24 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler kernel SIG例会&技术分享会议内容： openEuler kernel 技术分享：执行实体创建与切换会议链接：https://us06web.zoom.us/j/83567640355?pwd=OHVRQ2VKcFNka0FhVjg2emQybG1Edz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-06-24 14:00, The subject of the conference is openEuler kernel SIG例会&技术分享, Summary: openEuler kernel 技术分享：执行实体创建与切换 You can join the meeting at https://us06web.zoom.us/j/83567640355?pwd=OHVRQ2VKcFNka0FhVjg2emQybG1Edz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

openEuler kernel SIG例会&技术分享
by openEuler conference 20 Jun '22

20 Jun '22

您好！ Kernel SIG 邀请您参加 2022-06-24 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler kernel SIG例会&技术分享会议内容： openEuler kernel 技术分享：执行实体创建与切换会议链接：https://us06web.zoom.us/j/81671713618?pwd=eWIxeGowd1hvNTNZQUlRRmplNlZydz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-06-24 14:00, The subject of the conference is openEuler kernel SIG例会&技术分享, Summary: openEuler kernel 技术分享：执行实体创建与切换 You can join the meeting at https://us06web.zoom.us/j/81671713618?pwd=eWIxeGowd1hvNTNZQUlRRmplNlZydz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS 1/8] xfs: abort xattr scrub if fatal signals are pending
by Laibin Qiu 18 Jun '22

18 Jun '22

From: "Darrick J. Wong" <darrick.wong(a)oracle.com> mainline inclusion from mainline-v5.1-rc1 commit 3258cb208caba74258ffdd8bd59972bbda9bfee1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5BDCU CVE: NA -------------------------------- The extended attribute scrubber should abort the "read all attrs" loop if there's a fatal signal pending on the process. Signed-off-by: Darrick J. Wong <darrick.wong(a)oracle.com> Reviewed-by: Brian Foster <bfoster(a)redhat.com> Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> Reviewed-by: Lihong Kou <koulihong(a)huawei.com> Reviewed-by: Xuenan Guo <guoxuenan(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- fs/xfs/scrub/attr.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/xfs/scrub/attr.c b/fs/xfs/scrub/attr.c index 81d5e90547a1..9960bc5b5d76 100644 --- a/fs/xfs/scrub/attr.c +++ b/fs/xfs/scrub/attr.c @@ -82,6 +82,11 @@ xchk_xattr_listent( sx = container_of(context, struct xchk_xattr, context); + if (xchk_should_terminate(sx->sc, &error)) { + context->seen_enough = 1; + return; + } + if (flags & XFS_ATTR_INCOMPLETE) { /* Incomplete attr key, just mark the inode for preening. */ xchk_ino_set_preen(sx->sc, context->dp->i_ino); -- 2.25.1

1 7

[PATCH openEuler-1.0-LTS 0/8] xfs: fix the xfstests problem
by tangbin 18 Jun '22

18 Jun '22

Hi all: These patches are used to resolve the xfs problem when perform xfstests. For details about how to fix the problem, we can see the link below: https://lore.kernel.org/linux-xfs/154697976479.2839.3584921201780682011.stg… https://lore.kernel.org/linux-xfs/157232182246.593721.4902116478429075171.s… Thanks --- Darrick J. Wong (8): xfs: abort xattr scrub if fatal signals are pending xfs: scrub should flag dir/attr offsets that aren't mappable with xfs_dablk_t xfs: check directory name validity xfs: check attribute name validity xfs: check attribute leaf block structure xfs: namecheck attribute names before listing them xfs: namecheck directory entry names before listing them xfs: replace -EIO with -EFSCORRUPTED for corrupt metadata fs/xfs/libxfs/xfs_attr.c | 17 +++++++++ fs/xfs/libxfs/xfs_attr.h | 2 +- fs/xfs/libxfs/xfs_attr_leaf.c | 68 +++++++++++++++++++++++++++++++++-- fs/xfs/libxfs/xfs_attr_leaf.h | 4 +-- fs/xfs/libxfs/xfs_bmap.c | 6 ++-- fs/xfs/libxfs/xfs_dir2.c | 17 +++++++++ fs/xfs/libxfs/xfs_dir2.h | 1 + fs/xfs/libxfs/xfs_types.c | 11 ++++++ fs/xfs/libxfs/xfs_types.h | 1 + fs/xfs/scrub/attr.c | 11 ++++++ fs/xfs/scrub/bmap.c | 27 ++++++++++++++ fs/xfs/scrub/dir.c | 6 ++++ fs/xfs/xfs_attr_inactive.c | 6 ++-- fs/xfs/xfs_attr_list.c | 60 ++++++++++++++++++++----------- fs/xfs/xfs_dir2_readdir.c | 27 +++++++++++--- fs/xfs/xfs_dquot.c | 2 +- 16 files changed, 228 insertions(+), 38 deletions(-) -- 2.18.4

2 9

[PATCH OLK_5.10] update via-cputemp driver
by LeoLiuoc 17 Jun '22

17 Jun '22

zhaoxin inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I52DS7 CVE: NA -------------------------------- Optimize driver code and add support for Zhaoxin CPU. Signed-off-by: LeoLiuoc <LeoLiu-oc(a)zhaoxin.com> --- drivers/hwmon/Makefile | 3 +- drivers/hwmon/via-cputemp.c | 69 ++++++++++++++++++++----------------- 2 files changed, 39 insertions(+), 33 deletions(-) diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile index c22a5316bd91..115c0e002718 100644 --- a/drivers/hwmon/Makefile +++ b/drivers/hwmon/Makefile @@ -183,7 +183,8 @@ obj-$(CONFIG_SENSORS_TMP401) += tmp401.o obj-$(CONFIG_SENSORS_TMP421) += tmp421.o obj-$(CONFIG_SENSORS_TMP513) += tmp513.o obj-$(CONFIG_SENSORS_VEXPRESS) += vexpress-hwmon.o -obj-$(CONFIG_SENSORS_VIA_CPUTEMP)+= via-cputemp.o +obj-$(CONFIG_SENSORS_VIA_CPUTEMP) += cputemp-hwmon.o +cputemp-hwmon-objs := via-cputemp.o obj-$(CONFIG_SENSORS_VIA686A) += via686a.o obj-$(CONFIG_SENSORS_VT1211) += vt1211.o obj-$(CONFIG_SENSORS_VT8231) += vt8231.o diff --git a/drivers/hwmon/via-cputemp.c b/drivers/hwmon/via-cputemp.c index e5d18dac8ee7..1599440cc451 100644 --- a/drivers/hwmon/via-cputemp.c +++ b/drivers/hwmon/via-cputemp.c @@ -26,7 +26,8 @@ #include <asm/processor.h> #include <asm/cpu_device_id.h> -#define DRVNAME "via_cputemp" +#define VIA_DRVNAME "via_cputemp" +#define ZHAOXIN_DRVNAME "zhaoxin_cputemp" enum { SHOW_TEMP, SHOW_LABEL, SHOW_NAME }; @@ -114,17 +115,17 @@ static int via_cputemp_probe(struct platform_device *pdev) int err; u32 eax, edx; - data = devm_kzalloc(&pdev->dev, sizeof(struct via_cputemp_data), - GFP_KERNEL); + data = devm_kzalloc(&pdev->dev, sizeof(struct via_cputemp_data), GFP_KERNEL); if (!data) return -ENOMEM; data->id = pdev->id; - data->name = "via_cputemp"; if (c->x86 == 7) { + data->name = ZHAOXIN_DRVNAME; data->msr_temp = 0x1423; } else { + data->name = VIA_DRVNAME; switch (c->x86_model) { case 0xA: /* C7 A */ @@ -145,8 +146,7 @@ static int via_cputemp_probe(struct platform_device *pdev) /* test if we can access the TEMPERATURE MSR */ err = rdmsr_safe_on_cpu(data->id, data->msr_temp, &eax, &edx); if (err) { - dev_err(&pdev->dev, - "Unable to access TEMPERATURE MSR, giving up\n"); + dev_err(&pdev->dev, "Unable to access TEMPERATURE MSR, giving up\n"); return err; } @@ -165,11 +165,10 @@ static int via_cputemp_probe(struct platform_device *pdev) goto exit_remove; } - data->hwmon_dev = hwmon_device_register(&pdev->dev); + data->hwmon_dev = hwmon_device_register_with_info(&pdev->dev, data->name, NULL, NULL, NULL); if (IS_ERR(data->hwmon_dev)) { err = PTR_ERR(data->hwmon_dev); - dev_err(&pdev->dev, "Class registration failed (%d)\n", - err); + dev_err(&pdev->dev, "Class registration failed (%d)\n", err); goto exit_remove; } @@ -194,13 +193,12 @@ static int via_cputemp_remove(struct platform_device *pdev) } static struct platform_driver via_cputemp_driver = { - .driver = { - .name = DRVNAME, - }, .probe = via_cputemp_probe, .remove = via_cputemp_remove, }; +static struct platform_device_info cputemp_device_info; + struct pdev_entry { struct list_head list; struct platform_device *pdev; @@ -216,23 +214,20 @@ static int via_cputemp_online(unsigned int cpu) struct platform_device *pdev; struct pdev_entry *pdev_entry; - pdev = platform_device_alloc(DRVNAME, cpu); - if (!pdev) { - err = -ENOMEM; - pr_err("Device allocation failed\n"); + cputemp_device_info.id = cpu; + + pdev = platform_device_register_full(&cputemp_device_info); + if (IS_ERR(pdev)) { + err = PTR_ERR(pdev); + pr_err("Device registration failed (%d)\n", err); goto exit; } pdev_entry = kzalloc(sizeof(struct pdev_entry), GFP_KERNEL); if (!pdev_entry) { err = -ENOMEM; - goto exit_device_put; - } - - err = platform_device_add(pdev); - if (err) { - pr_err("Device addition failed (%d)\n", err); - goto exit_device_free; + pr_err("Pdev_entry alloc failed (%d)\n", err); + goto exit_device_unregister; } pdev_entry->pdev = pdev; @@ -243,10 +238,8 @@ static int via_cputemp_online(unsigned int cpu) return 0; -exit_device_free: - kfree(pdev_entry); -exit_device_put: - platform_device_put(pdev); +exit_device_unregister: + platform_device_unregister(pdev); exit: return err; } @@ -270,10 +263,11 @@ static int via_cputemp_down_prep(unsigned int cpu) } static const struct x86_cpu_id __initconst cputemp_ids[] = { - X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_A, NULL), - X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_D, NULL), - X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_NANO, NULL), - X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), + X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_A, NULL), + X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_D, NULL), + X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_NANO, NULL), + X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), + X86_MATCH_VENDOR_FAM_MODEL(ZHAOXIN, 7, X86_MODEL_ANY, NULL), {} }; MODULE_DEVICE_TABLE(x86cpu, cputemp_ids); @@ -283,15 +277,26 @@ static enum cpuhp_state via_temp_online; static int __init via_cputemp_init(void) { int err; + char *cpuhp_name; if (!x86_match_cpu(cputemp_ids)) return -ENODEV; + if (boot_cpu_data.x86 == 0x7) { + via_cputemp_driver.driver.name = ZHAOXIN_DRVNAME; + cputemp_device_info.name = ZHAOXIN_DRVNAME; + cpuhp_name = "hwmon/zhaoxin:online"; + } else { + via_cputemp_driver.driver.name = VIA_DRVNAME; + cputemp_device_info.name = VIA_DRVNAME; + cpuhp_name = "hwmon/via:online"; + } + err = platform_driver_register(&via_cputemp_driver); if (err) goto exit; - err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hwmon/via:online", + err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, cpuhp_name, via_cputemp_online, via_cputemp_down_prep); if (err < 0) goto exit_driver_unreg; -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS 1/2] tcp: change source port randomizarion at connect() time
by Yongqiang Liu 17 Jun '22

17 Jun '22

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.246 commit ddec440133913a6b8880e53b896d521a4b7ff24f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5C3A9 CVE: CVE-2022-32296 -------------------------------- commit 190cc82489f46f9d88e73c81a47e14f80a791e1a upstream. RFC 6056 (Recommendations for Transport-Protocol Port Randomization) provides good summary of why source selection needs extra care. David Dworken reminded us that linux implements Algorithm 3 as described in RFC 6056 3.3.3 Quoting David : In the context of the web, this creates an interesting info leak where websites can count how many TCP connections a user's computer is establishing over time. For example, this allows a website to count exactly how many subresources a third party website loaded. This also allows: - Distinguishing between different users behind a VPN based on distinct source port ranges. - Tracking users over time across multiple networks. - Covert communication channels between different browsers/browser profiles running on the same computer - Tracking what applications are running on a computer based on the pattern of how fast source ports are getting incremented. Section 3.3.4 describes an enhancement, that reduces attackers ability to use the basic information currently stored into the shared 'u32 hint'. This change also decreases collision rate when multiple applications need to connect() to different destinations. Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reported-by: David Dworken <ddworken(a)google.com> Cc: Willem de Bruijn <willemb(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> [SG: Adjusted context] Signed-off-by: Stefan Ghinea <stefan.ghinea(a)windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/ipv4/inet_hashtables.c Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv4/inet_hashtables.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index bd0108aaa45b..72b8b6f44add 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -666,6 +666,17 @@ void inet_unhash(struct sock *sk) } EXPORT_SYMBOL_GPL(inet_unhash); +/* RFC 6056 3.3.4. Algorithm 4: Double-Hash Port Selection Algorithm + * Note that we use 32bit integers (vs RFC 'short integers') + * because 2^16 is not a multiple of num_ephemeral and this + * property might be used by clever attacker. + * RFC claims using TABLE_LENGTH=10 buckets gives an improvement, + * we use 256 instead to really give more isolation and + * privacy, this only consumes 1 KB of kernel memory. + */ +#define INET_TABLE_PERTURB_SHIFT 8 +static u32 table_perturb[1 << INET_TABLE_PERTURB_SHIFT]; + int __inet_hash_connect(struct inet_timewait_death_row *death_row, struct sock *sk, u64 port_offset, int (*check_established)(struct inet_timewait_death_row *, @@ -679,8 +690,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, struct inet_bind_bucket *tb; u32 remaining, offset; int ret, i, low, high; - static u32 hint; int l3mdev; + u32 index; if (port) { head = &hinfo->bhash[inet_bhashfn(net, port, @@ -707,7 +718,10 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, if (likely(remaining > 1)) remaining &= ~1U; - offset = hint + port_offset; + net_get_random_once(table_perturb, sizeof(table_perturb)); + index = hash_32(port_offset, INET_TABLE_PERTURB_SHIFT); + + offset = READ_ONCE(table_perturb[index]) + port_offset; offset %= remaining; /* In first pass we try ports of @low parity. * inet_csk_get_port() does the opposite choice. @@ -762,7 +776,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, return -EADDRNOTAVAIL; ok: - hint += i + 2; + WRITE_ONCE(table_perturb[index], READ_ONCE(table_perturb[index]) + i + 2); /* Head lock still held and bh's disabled */ inet_bind_hash(sk, tb, port); -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] arm64: fix extra cpucaps setup problem
by Yongqiang Liu 16 Jun '22

16 Jun '22

From: Chen Jiahao <chenjiahao16(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186460, https://gitee.com/src-openeuler/kernel/issues/I53MHA CVE: CVE-2022-23960 -------------------------------- When introducing a new cpucaps macro ARM64_SPECTRE_BHB, ARM64_NCAPS was not able to modified easily due to KABI consistency. Here introduce a workaround to properly setup ARM64_SPECTRE_BHB beyond ARM64_NCAPS range. Fixes: def2df575d30 ("KVM: arm64: Add templates for BHB mitigation sequences") Signed-off-by: Chen Jiahao <chenjiahao16(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/arm64/include/asm/cpufeature.h | 15 +++++++++++++++ arch/arm64/kernel/alternative.c | 5 +++++ arch/arm64/kernel/cpufeature.c | 3 +++ 3 files changed, 23 insertions(+) diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h index bfb699957880..ffb0a1ec0088 100644 --- a/arch/arm64/include/asm/cpufeature.h +++ b/arch/arm64/include/asm/cpufeature.h @@ -368,6 +368,8 @@ extern struct static_key_false arm64_const_caps_ready; #define ARM64_NPATCHABLE (ARM64_NCAPS + 1) extern DECLARE_BITMAP(boot_capabilities, ARM64_NPATCHABLE); +extern bool set_cap_spectre_bhb; + bool this_cpu_has_cap(unsigned int cap); static inline bool cpu_have_feature(unsigned int num) @@ -378,15 +380,23 @@ static inline bool cpu_have_feature(unsigned int num) /* System capability check for constant caps */ static __always_inline bool __cpus_have_const_cap(int num) { + if (num == ARM64_SPECTRE_BHB) + return set_cap_spectre_bhb; + if (num >= ARM64_NCAPS) return false; + return static_branch_unlikely(&cpu_hwcap_keys[num]); } static inline bool cpus_have_cap(unsigned int num) { + if (num == ARM64_SPECTRE_BHB) + return set_cap_spectre_bhb; + if (num >= ARM64_NCAPS) return false; + return test_bit(num, cpu_hwcaps); } @@ -400,6 +410,11 @@ static __always_inline bool cpus_have_const_cap(int num) static inline void cpus_set_cap(unsigned int num) { + if (num == ARM64_SPECTRE_BHB) { + set_cap_spectre_bhb = true; + return; + } + if (num >= ARM64_NCAPS) { pr_warn("Attempt to set an illegal CPU capability (%d >= %d)\n", num, ARM64_NCAPS); diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c index 8511fc3b94bb..ce5a26080b46 100644 --- a/arch/arm64/kernel/alternative.c +++ b/arch/arm64/kernel/alternative.c @@ -41,8 +41,13 @@ struct alt_region { struct alt_instr *end; }; +bool set_cap_spectre_bhb; + bool alternative_is_applied(u16 cpufeature) { + if (cpufeature == ARM64_SPECTRE_BHB) + return set_cap_spectre_bhb; + if (WARN_ON(cpufeature >= ARM64_NCAPS)) return false; diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index aa9178e9acc6..996d3476f3c8 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -1732,6 +1732,9 @@ __enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps, for (; caps->matches; caps++) { unsigned int num = caps->capability; + if (num == ARM64_SPECTRE_BHB) + set_cap_spectre_bhb = true; + if (!(caps->type & scope_mask) || !cpus_have_cap(num)) continue; -- 2.25.1

1 0

[Cancel] openEuler kernel SIG例会&技术分享
by openEuler conference 16 Jun '22

16 Jun '22

Sorry! The Zoom meeting will be held at 2022-06-17 14:00 scheduled by openEuler Kernel SIG has been cancelled.

1 0

[PATCH openEuler-1.0-LTS 1/3] powerpc/32: Fix overread/overwrite of thread_struct via ptrace
by Yongqiang Liu 15 Jun '22

15 Jun '22

From: Michael Ellerman <mpe(a)ellerman.id.au> mainline inclusion from mainline-v5.19-rc2 commit 8e1278444446fc97778a5e5c99bca1ce0bbc5ec9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5C43D CVE: CVE-2022-32981 -------------------------------- The ptrace PEEKUSR/POKEUSR (aka PEEKUSER/POKEUSER) API allows a process to read/write registers of another process. To get/set a register, the API takes an index into an imaginary address space called the "USER area", where the registers of the process are laid out in some fashion. The kernel then maps that index to a particular register in its own data structures and gets/sets the value. The API only allows a single machine-word to be read/written at a time. So 4 bytes on 32-bit kernels and 8 bytes on 64-bit kernels. The way floating point registers (FPRs) are addressed is somewhat complicated, because double precision float values are 64-bit even on 32-bit CPUs. That means on 32-bit kernels each FPR occupies two word-sized locations in the USER area. On 64-bit kernels each FPR occupies one word-sized location in the USER area. Internally the kernel stores the FPRs in an array of u64s, or if VSX is enabled, an array of pairs of u64s where one half of each pair stores the FPR. Which half of the pair stores the FPR depends on the kernel's endianness. To handle the different layouts of the FPRs depending on VSX/no-VSX and big/little endian, the TS_FPR() macro was introduced. Unfortunately the TS_FPR() macro does not take into account the fact that the addressing of each FPR differs between 32-bit and 64-bit kernels. It just takes the index into the "USER area" passed from userspace and indexes into the fp_state.fpr array. On 32-bit there are 64 indexes that address FPRs, but only 32 entries in the fp_state.fpr array, meaning the user can read/write 256 bytes past the end of the array. Because the fp_state sits in the middle of the thread_struct there are various fields than can be overwritten, including some pointers. As such it may be exploitable. It has also been observed to cause systems to hang or otherwise misbehave when using gdbserver, and is probably the root cause of this report which could not be easily reproduced: https://lore.kernel.org/linuxppc-dev/dc38afe9-6b78-f3f5-666b-986939e40fc6@k… Rather than trying to make the TS_FPR() macro even more complicated to fix the bug, or add more macros, instead add a special-case for 32-bit kernels. This is more obvious and hopefully avoids a similar bug happening again in future. Note that because 32-bit kernels never have VSX enabled the code doesn't need to consider TS_FPRWIDTH/OFFSET at all. Add a BUILD_BUG_ON() to ensure that 32-bit && VSX is never enabled. Fixes: 87fec0514f61 ("powerpc: PTRACE_PEEKUSR/PTRACE_POKEUSER of FPR registers in little endian builds") Cc: stable(a)vger.kernel.org # v3.13+ Reported-by: Ariel Miculas <ariel.miculas(a)belden.com> Tested-by: Christophe Leroy <christophe.leroy(a)csgroup.eu> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://lore.kernel.org/r/20220609133245.573565-1-mpe@ellerman.id.au Conflicts: arch/powerpc/kernel/ptrace/ptrace-fpu.c arch/powerpc/kernel/ptrace/ptrace.c Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/powerpc/kernel/ptrace.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c index e08b32ccf1d9..d245f0af412a 100644 --- a/arch/powerpc/kernel/ptrace.c +++ b/arch/powerpc/kernel/ptrace.c @@ -2980,6 +2980,9 @@ long arch_ptrace(struct task_struct *child, long request, void __user *datavp = (void __user *) data; unsigned long __user *datalp = datavp; + // ptrace_get/put_fpr() rely on PPC32 and VSX being incompatible + BUILD_BUG_ON(IS_ENABLED(CONFIG_PPC32) && IS_ENABLED(CONFIG_VSX)); + switch (request) { /* read the word at location addr in the USER area. */ case PTRACE_PEEKUSR: { @@ -3006,10 +3009,13 @@ long arch_ptrace(struct task_struct *child, long request, unsigned int fpidx = index - PT_FPR0; flush_fp_to_thread(child); - if (fpidx < (PT_FPSCR - PT_FPR0)) - memcpy(&tmp, &child->thread.TS_FPR(fpidx), - sizeof(long)); - else + if (fpidx < (PT_FPSCR - PT_FPR0)) { + if (IS_ENABLED(CONFIG_PPC32)) + // On 32-bit the index we are passed refers to 32-bit words + tmp = ((u32 *)child->thread.fp_state.fpr)[fpidx]; + else + memcpy(&tmp, &child->thread.TS_FPR(fpidx), sizeof(long)); + } else tmp = child->thread.fp_state.fpscr; } ret = put_user(tmp, datalp); @@ -3039,10 +3045,13 @@ long arch_ptrace(struct task_struct *child, long request, unsigned int fpidx = index - PT_FPR0; flush_fp_to_thread(child); - if (fpidx < (PT_FPSCR - PT_FPR0)) - memcpy(&child->thread.TS_FPR(fpidx), &data, - sizeof(long)); - else + if (fpidx < (PT_FPSCR - PT_FPR0)) { + if (IS_ENABLED(CONFIG_PPC32)) + // On 32-bit the index we are passed refers to 32-bit words + ((u32 *)child->thread.fp_state.fpr)[fpidx] = data; + else + memcpy(&child->thread.TS_FPR(fpidx), &data, sizeof(long)); + } else child->thread.fp_state.fpscr = data; ret = 0; } -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS] sctp: use call_rcu to free endpoint
by Yongqiang Liu 14 Jun '22

14 Jun '22

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v4.19.224 commit af6e6e58f7ebf86b4e7201694b1e4f3a62cbc3ec category: bugfix bugzilla: 186701, https://gitee.com/src-openeuler/kernel/issues/I5CAM2 CVE: CVE-2022-20154 -------------------------------- [ Upstream commit 5ec7d18d1813a5bead0b495045606c93873aecbb ] This patch is to delay the endpoint free by calling call_rcu() to fix another use-after-free issue in sctp_sock_dump(): BUG: KASAN: use-after-free in __lock_acquire+0x36d9/0x4c20 Call Trace: __lock_acquire+0x36d9/0x4c20 kernel/locking/lockdep.c:3218 lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168 spin_lock_bh include/linux/spinlock.h:334 [inline] __lock_sock+0x203/0x350 net/core/sock.c:2253 lock_sock_nested+0xfe/0x120 net/core/sock.c:2774 lock_sock include/net/sock.h:1492 [inline] sctp_sock_dump+0x122/0xb20 net/sctp/diag.c:324 sctp_for_each_transport+0x2b5/0x370 net/sctp/socket.c:5091 sctp_diag_dump+0x3ac/0x660 net/sctp/diag.c:527 __inet_diag_dump+0xa8/0x140 net/ipv4/inet_diag.c:1049 inet_diag_dump+0x9b/0x110 net/ipv4/inet_diag.c:1065 netlink_dump+0x606/0x1080 net/netlink/af_netlink.c:2244 __netlink_dump_start+0x59a/0x7c0 net/netlink/af_netlink.c:2352 netlink_dump_start include/linux/netlink.h:216 [inline] inet_diag_handler_cmd+0x2ce/0x3f0 net/ipv4/inet_diag.c:1170 __sock_diag_cmd net/core/sock_diag.c:232 [inline] sock_diag_rcv_msg+0x31d/0x410 net/core/sock_diag.c:263 netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2477 sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:274 This issue occurs when asoc is peeled off and the old sk is freed after getting it by asoc->base.sk and before calling lock_sock(sk). To prevent the sk free, as a holder of the sk, ep should be alive when calling lock_sock(). This patch uses call_rcu() and moves sock_put and ep free into sctp_endpoint_destroy_rcu(), so that it's safe to try to hold the ep under rcu_read_lock in sctp_transport_traverse_process(). If sctp_endpoint_hold() returns true, it means this ep is still alive and we have held it and can continue to dump it; If it returns false, it means this ep is dead and can be freed after rcu_read_unlock, and we should skip it. In sctp_sock_dump(), after locking the sk, if this ep is different from tsp->asoc->ep, it means during this dumping, this asoc was peeled off before calling lock_sock(), and the sk should be skipped; If this ep is the same with tsp->asoc->ep, it means no peeloff happens on this asoc, and due to lock_sock, no peeloff will happen either until release_sock. Note that delaying endpoint free won't delay the port release, as the port release happens in sctp_endpoint_destroy() before calling call_rcu(). Also, freeing endpoint by call_rcu() makes it safe to access the sk by asoc->base.sk in sctp_assocs_seq_show() and sctp_rcv(). Thanks Jones to bring this issue up. v1->v2: - improve the changelog. - add kfree(ep) into sctp_endpoint_destroy_rcu(), as Jakub noticed. Reported-by: syzbot+9276d76e83e3bcde6c99(a)syzkaller.appspotmail.com Reported-by: Lee Jones <lee.jones(a)linaro.org> Fixes: d25adbeb0cdb ("sctp: fix an use-after-free issue in sctp_sock_dump") Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Huang Guobin <huangguobin4(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/net/sctp/sctp.h | 6 +++--- include/net/sctp/structs.h | 3 ++- net/sctp/diag.c | 12 ++++++------ net/sctp/endpointola.c | 23 +++++++++++++++-------- net/sctp/socket.c | 23 +++++++++++++++-------- 5 files changed, 41 insertions(+), 26 deletions(-) diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h index fef8c3372aee..6d201c6700be 100644 --- a/include/net/sctp/sctp.h +++ b/include/net/sctp/sctp.h @@ -118,6 +118,7 @@ extern struct percpu_counter sctp_sockets_allocated; int sctp_asconf_mgmt(struct sctp_sock *, struct sctp_sockaddr_entry *); struct sk_buff *sctp_skb_recv_datagram(struct sock *, int, int, int *); +typedef int (*sctp_callback_t)(struct sctp_endpoint *, struct sctp_transport *, void *); void sctp_transport_walk_start(struct rhashtable_iter *iter); void sctp_transport_walk_stop(struct rhashtable_iter *iter); struct sctp_transport *sctp_transport_get_next(struct net *net, @@ -128,9 +129,8 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *), struct net *net, const union sctp_addr *laddr, const union sctp_addr *paddr, void *p); -int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *), - int (*cb_done)(struct sctp_transport *, void *), - struct net *net, int *pos, void *p); +int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done, + struct net *net, int *pos, void *p); int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *), void *p); int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc, struct sctp_info *info); diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h index 2882bc7a5b4b..18f9924aa250 100644 --- a/include/net/sctp/structs.h +++ b/include/net/sctp/structs.h @@ -1348,6 +1348,7 @@ struct sctp_endpoint { u32 secid; u32 peer_secid; + struct rcu_head rcu; }; /* Recover the outter endpoint structure. */ @@ -1363,7 +1364,7 @@ static inline struct sctp_endpoint *sctp_ep(struct sctp_ep_common *base) struct sctp_endpoint *sctp_endpoint_new(struct sock *, gfp_t); void sctp_endpoint_free(struct sctp_endpoint *); void sctp_endpoint_put(struct sctp_endpoint *); -void sctp_endpoint_hold(struct sctp_endpoint *); +int sctp_endpoint_hold(struct sctp_endpoint *ep); void sctp_endpoint_add_asoc(struct sctp_endpoint *, struct sctp_association *); struct sctp_association *sctp_endpoint_lookup_assoc( const struct sctp_endpoint *ep, diff --git a/net/sctp/diag.c b/net/sctp/diag.c index 8767405de9fa..0a9db0a7f423 100644 --- a/net/sctp/diag.c +++ b/net/sctp/diag.c @@ -307,9 +307,8 @@ static int sctp_tsp_dump_one(struct sctp_transport *tsp, void *p) return err; } -static int sctp_sock_dump(struct sctp_transport *tsp, void *p) +static int sctp_sock_dump(struct sctp_endpoint *ep, struct sctp_transport *tsp, void *p) { - struct sctp_endpoint *ep = tsp->asoc->ep; struct sctp_comm_param *commp = p; struct sock *sk = ep->base.sk; struct sk_buff *skb = commp->skb; @@ -319,6 +318,8 @@ static int sctp_sock_dump(struct sctp_transport *tsp, void *p) int err = 0; lock_sock(sk); + if (ep != tsp->asoc->ep) + goto release; list_for_each_entry(assoc, &ep->asocs, asocs) { if (cb->args[4] < cb->args[1]) goto next; @@ -361,9 +362,8 @@ static int sctp_sock_dump(struct sctp_transport *tsp, void *p) return err; } -static int sctp_sock_filter(struct sctp_transport *tsp, void *p) +static int sctp_sock_filter(struct sctp_endpoint *ep, struct sctp_transport *tsp, void *p) { - struct sctp_endpoint *ep = tsp->asoc->ep; struct sctp_comm_param *commp = p; struct sock *sk = ep->base.sk; const struct inet_diag_req_v2 *r = commp->r; @@ -521,8 +521,8 @@ static void sctp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb, if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE))) goto done; - sctp_for_each_transport(sctp_sock_filter, sctp_sock_dump, - net, &pos, &commp); + sctp_transport_traverse_process(sctp_sock_filter, sctp_sock_dump, + net, &pos, &commp); cb->args[2] = pos; done: diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c index 8640dedcf64f..c4068451b9c7 100644 --- a/net/sctp/endpointola.c +++ b/net/sctp/endpointola.c @@ -242,6 +242,18 @@ void sctp_endpoint_free(struct sctp_endpoint *ep) } /* Final destructor for endpoint. */ +static void sctp_endpoint_destroy_rcu(struct rcu_head *head) +{ + struct sctp_endpoint *ep = container_of(head, struct sctp_endpoint, rcu); + struct sock *sk = ep->base.sk; + + sctp_sk(sk)->ep = NULL; + sock_put(sk); + + kfree(ep); + SCTP_DBG_OBJCNT_DEC(ep); +} + static void sctp_endpoint_destroy(struct sctp_endpoint *ep) { struct sock *sk; @@ -275,18 +287,13 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep) if (sctp_sk(sk)->bind_hash) sctp_put_port(sk); - sctp_sk(sk)->ep = NULL; - /* Give up our hold on the sock */ - sock_put(sk); - - kfree(ep); - SCTP_DBG_OBJCNT_DEC(ep); + call_rcu(&ep->rcu, sctp_endpoint_destroy_rcu); } /* Hold a reference to an endpoint. */ -void sctp_endpoint_hold(struct sctp_endpoint *ep) +int sctp_endpoint_hold(struct sctp_endpoint *ep) { - refcount_inc(&ep->base.refcnt); + return refcount_inc_not_zero(&ep->base.refcnt); } /* Release a reference to an endpoint and clean up if there are diff --git a/net/sctp/socket.c b/net/sctp/socket.c index cfa54e56add9..0e979a273dcd 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -5059,11 +5059,12 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *), } EXPORT_SYMBOL_GPL(sctp_transport_lookup_process); -int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *), - int (*cb_done)(struct sctp_transport *, void *), - struct net *net, int *pos, void *p) { +int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done, + struct net *net, int *pos, void *p) +{ struct rhashtable_iter hti; struct sctp_transport *tsp; + struct sctp_endpoint *ep; int ret; again: @@ -5072,26 +5073,32 @@ int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *), tsp = sctp_transport_get_idx(net, &hti, *pos + 1); for (; !IS_ERR_OR_NULL(tsp); tsp = sctp_transport_get_next(net, &hti)) { - ret = cb(tsp, p); - if (ret) - break; + ep = tsp->asoc->ep; + if (sctp_endpoint_hold(ep)) { /* asoc can be peeled off */ + ret = cb(ep, tsp, p); + if (ret) + break; + sctp_endpoint_put(ep); + } (*pos)++; sctp_transport_put(tsp); } sctp_transport_walk_stop(&hti); if (ret) { - if (cb_done && !cb_done(tsp, p)) { + if (cb_done && !cb_done(ep, tsp, p)) { (*pos)++; + sctp_endpoint_put(ep); sctp_transport_put(tsp); goto again; } + sctp_endpoint_put(ep); sctp_transport_put(tsp); } return ret; } -EXPORT_SYMBOL_GPL(sctp_for_each_transport); +EXPORT_SYMBOL_GPL(sctp_transport_traverse_process); /* 7.2.1 Association Status (SCTP_STATUS) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] ext4: convert from atomic_t to refcount_t on ext4_io_end->count
by Yongqiang Liu 14 Jun '22

14 Jun '22

From: Xiyu Yang <xiyuyang19(a)fudan.edu.cn> hulk inclusion category: bugfix bugzilla: 186971, https://gitee.com/openeuler/kernel/issues/I5C8IW CVE: NA -------------------------------- refcount_t type and corresponding API can protect refcounters from accidental underflow and overflow and further use-after-free situations. Signed-off-by: Xiyu Yang <xiyuyang19(a)fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf(a)gmail.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/1626674355-55795-1-git-send-email-xiyuyang19@fuda… Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Li Nan <linan122(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/ext4.h | 3 ++- fs/ext4/page-io.c | 8 ++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index 16e2b719d47c..6efc710b07bf 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -17,6 +17,7 @@ #ifndef _EXT4_H #define _EXT4_H +#include <linux/refcount.h> #include <linux/types.h> #include <linux/blkdev.h> #include <linux/magic.h> @@ -231,7 +232,7 @@ typedef struct ext4_io_end { struct bio *bio; /* Linked list of completed * bios covering the extent */ unsigned int flag; /* unwritten or not */ - atomic_t count; /* reference counter */ + refcount_t count; /* reference counter */ loff_t offset; /* offset in the file */ ssize_t size; /* size of the extent */ } ext4_io_end_t; diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c index 3de933354a08..decae80aeb98 100644 --- a/fs/ext4/page-io.c +++ b/fs/ext4/page-io.c @@ -256,14 +256,14 @@ ext4_io_end_t *ext4_init_io_end(struct inode *inode, gfp_t flags) if (io) { io->inode = inode; INIT_LIST_HEAD(&io->list); - atomic_set(&io->count, 1); + refcount_set(&io->count, 1); } return io; } void ext4_put_io_end_defer(ext4_io_end_t *io_end) { - if (atomic_dec_and_test(&io_end->count)) { + if (refcount_dec_and_test(&io_end->count)) { if (!(io_end->flag & EXT4_IO_END_UNWRITTEN) || !io_end->size) { ext4_release_io_end(io_end); return; @@ -276,7 +276,7 @@ int ext4_put_io_end(ext4_io_end_t *io_end) { int err = 0; - if (atomic_dec_and_test(&io_end->count)) { + if (refcount_dec_and_test(&io_end->count)) { if (io_end->flag & EXT4_IO_END_UNWRITTEN) { err = ext4_convert_unwritten_extents(io_end->handle, io_end->inode, io_end->offset, @@ -291,7 +291,7 @@ int ext4_put_io_end(ext4_io_end_t *io_end) ext4_io_end_t *ext4_get_io_end(ext4_io_end_t *io_end) { - atomic_inc(&io_end->count); + refcount_inc(&io_end->count); return io_end; } -- 2.25.1

1 0

[PATCH openEuler-5.10 01/49] io_uring: always use original task when preparing req identity
by Zheng Zengkai 14 Jun '22

14 Jun '22

From: Jens Axboe <axboe(a)kernel.dk> stable inclusion from stable-v5.10.116 commit 29f077d070519a88a793fbc70f1e6484dc6d9e35 category: bugfix bugzilla: 186865,https://gitee.com/src-openeuler/kernel/issues/I593SI CVE: CVE-2022-1786 -------------------------------- If the ring is setup with IORING_SETUP_IOPOLL and we have more than one task doing submissions on a ring, we can up in a situation where we assign the context from the current task rather than the request originator. Always use req->task rather than assume it's the same as current. No upstream patch exists for this issue, as only older kernels with the non-native workers have this problem. Reported-by: Kyle Zeng <zengyhkyle(a)gmail.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Xuenan <guoxuenan(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 2ed0da75000e..cadd491edc6f 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1156,7 +1156,7 @@ static inline void __io_req_init_async(struct io_kiocb *req) */ static inline void io_req_init_async(struct io_kiocb *req) { - struct io_uring_task *tctx = current->io_uring; + struct io_uring_task *tctx = req->task->io_uring; if (req->flags & REQ_F_WORK_INITIALIZED) return; -- 2.20.1

1 48

[openEuler-5.10 00/19] Backport 5.10.107 LTS
by Zheng Zengkai 14 Jun '22

14 Jun '22

Backport 5.10.107 LTS patches from upstream kselftest/vm: fix tests build with old libc sfc: extend the locking on mcdi->seqno tcp: make tcp_read_sock() more robust nl80211: Update bss channel on channel switch for P2P_CLIENT drm/vrr: Set VRR capable prop only if it is attached to connector iwlwifi: don't advertise TWT support atm: firestream: check the return value of ioremap() in fs_init() can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE MIPS: smp: fill in sibling and core maps earlier mac80211: refuse aggregations sessions before authorized ARM: dts: rockchip: fix a typo on rk3288 crypto-controller ARM: dts: rockchip: reorder rk322x hmdi clocks arm64: dts: agilex: use the compatible "intel,socfpga-agilex-hsotg" arm64: dts: rockchip: reorder rk3399 hdmi clocks arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity xfrm: Fix xfrm migrate issues when address family changes xfrm: Check if_id in xfrm_migrate Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" Already merged(3) arm64: kvm: Fix copy-and-paste error in bhb templates for v5.10 stable io_uring: return back safer resurrect sctp: fix the processing for INIT chunk Total patches: 22 - 3 = 19 Alexander Lobakin (1): MIPS: smp: fill in sibling and core maps earlier Chengming Zhou (1): kselftest/vm: fix tests build with old libc Corentin Labbe (1): ARM: dts: rockchip: fix a typo on rk3288 crypto-controller Dinh Nguyen (1): arm64: dts: agilex: use the compatible "intel,socfpga-agilex-hsotg" Eric Dumazet (1): tcp: make tcp_read_sock() more robust Golan Ben Ami (1): iwlwifi: don't advertise TWT support Jakob Unterwurzacher (1): arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity Jia-Ju Bai (1): atm: firestream: check the return value of ioremap() in fs_init() Johannes Berg (1): mac80211: refuse aggregations sessions before authorized Julian Braha (1): ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE Kai Lueke (1): Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" Lad Prabhakar (1): can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready Manasi Navare (1): drm/vrr: Set VRR capable prop only if it is attached to connector Niels Dossche (1): sfc: extend the locking on mcdi->seqno Sascha Hauer (2): arm64: dts: rockchip: reorder rk3399 hdmi clocks ARM: dts: rockchip: reorder rk322x hmdi clocks Sreeramya Soratkal (1): nl80211: Update bss channel on channel switch for P2P_CLIENT Yan Yan (2): xfrm: Check if_id in xfrm_migrate xfrm: Fix xfrm migrate issues when address family changes arch/arm/boot/dts/rk322x.dtsi | 4 +-- arch/arm/boot/dts/rk3288.dtsi | 2 +- arch/arm64/boot/dts/intel/socfpga_agilex.dtsi | 4 +-- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 6 +++++ arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 ++--- arch/mips/kernel/smp.c | 6 ++--- drivers/atm/firestream.c | 2 ++ drivers/gpu/drm/drm_connector.c | 3 +++ drivers/net/can/rcar/rcar_canfd.c | 6 ++--- drivers/net/ethernet/sfc/mcdi.c | 2 +- .../wireless/intel/iwlwifi/iwl-nvm-parse.c | 3 +-- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 1 - include/net/xfrm.h | 5 ++-- lib/Kconfig | 1 - net/ipv4/tcp.c | 10 ++++--- net/key/af_key.c | 2 +- net/mac80211/agg-tx.c | 10 ++++++- net/wireless/nl80211.c | 3 ++- net/xfrm/xfrm_policy.c | 14 +++++----- net/xfrm/xfrm_state.c | 15 ++++++++--- net/xfrm/xfrm_user.c | 27 ++++++------------- tools/testing/selftests/vm/userfaultfd.c | 1 + 22 files changed, 76 insertions(+), 57 deletions(-) -- 2.20.1

1 19

[PATCH openEuler-1.0-LTS 1/9] HID: add hid_is_usb() function to make it simpler for USB detection
by Yongqiang Liu 14 Jun '22

14 Jun '22

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> stable inclusion from linux-4.19.221 commit b1efa723b986a84f84a95b6907cffe3a357338c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5BTIG CVE: CVE-2022-20132 -------------------------------- commit f83baa0cb6cfc92ebaf7f9d3a99d7e34f2e77a8a upstream. A number of HID drivers already call hid_is_using_ll_driver() but only for the detection of if this is a USB device or not. Make this more obvious by creating hid_is_usb() and calling the function that way. Also converts the existing hid_is_using_ll_driver() functions to use the new call. Cc: Jiri Kosina <jikos(a)kernel.org> Cc: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Cc: linux-input(a)vger.kernel.org Cc: stable(a)vger.kernel.org Tested-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Link: https://lore.kernel.org/r/20211201183503.2373082-1-gregkh@linuxfoundation.o… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Rui Xiang <rui.xiang(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/hid/hid-asus.c | 2 +- drivers/hid/wacom_sys.c | 2 +- include/linux/hid.h | 5 +++++ 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 88a5672f42cd..800b2364e29e 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -622,7 +622,7 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id) if (drvdata->quirks & QUIRK_IS_MULTITOUCH) drvdata->tp = &asus_i2c_tp; - if (drvdata->quirks & QUIRK_T100_KEYBOARD) { + if ((drvdata->quirks & QUIRK_T100_KEYBOARD) && hid_is_usb(hdev)) { struct usb_interface *intf = to_usb_interface(hdev->dev.parent); if (intf->altsetting->desc.bInterfaceNumber == T100_TPAD_INTF) { diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c index 3038c975e417..101b5ae2c3a7 100644 --- a/drivers/hid/wacom_sys.c +++ b/drivers/hid/wacom_sys.c @@ -2154,7 +2154,7 @@ static void wacom_update_name(struct wacom *wacom, const char *suffix) if ((features->type == HID_GENERIC) && !strcmp("Wacom HID", features->name)) { char *product_name = wacom->hdev->name; - if (hid_is_using_ll_driver(wacom->hdev, &usb_hid_driver)) { + if (hid_is_usb(wacom->hdev)) { struct usb_interface *intf = to_usb_interface(wacom->hdev->dev.parent); struct usb_device *dev = interface_to_usbdev(intf); product_name = dev->product; diff --git a/include/linux/hid.h b/include/linux/hid.h index bbbe6c0e0e26..7f321909ec58 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -832,6 +832,11 @@ static inline bool hid_is_using_ll_driver(struct hid_device *hdev, return hdev->ll_driver == driver; } +static inline bool hid_is_usb(struct hid_device *hdev) +{ + return hid_is_using_ll_driver(hdev, &usb_hid_driver); +} + #define PM_HINT_FULLON 1<<5 #define PM_HINT_NORMAL 1<<1 -- 2.25.1

1 8

[PATCH openEuler-5.10-LTS 01/42] netfilter: nf_tables: sanitize nft_set_desc_concat_parse()
by Zheng Zengkai 14 Jun '22

14 Jun '22

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.120 commit c0aff1faf66b6b7a19103f83e6a5d0fdc64b9048 category: bugfix bugzilla: 186913 https://gitee.com/src-openeuler/kernel/issues/I5B69E CVE: CVE-2022-1972 -------------------------------- commit fecf31ee395b0295f2d7260aa29946b7605f7c85 upstream. Add several sanity checks for nft_set_desc_concat_parse(): - validate desc->field_count not larger than desc->field_len array. - field length cannot be larger than desc->field_len (ie. U8_MAX) - total length of the concatenation cannot be larger than register array. Joint work with Florian Westphal. Fixes: f3a2181e16f1 ("netfilter: nf_tables: Support for sets with multiple ranged fields") Reported-by: <zhangziming.zzm(a)antgroup.com> Reviewed-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- net/netfilter/nf_tables_api.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index fdd1da9ecea9..164b686bb4c9 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4047,6 +4047,9 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr, u32 len; int err; + if (desc->field_count >= ARRAY_SIZE(desc->field_len)) + return -E2BIG; + err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr, nft_concat_policy, NULL); if (err < 0) @@ -4056,9 +4059,8 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr, return -EINVAL; len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN])); - - if (len * BITS_PER_BYTE / 32 > NFT_REG32_COUNT) - return -E2BIG; + if (!len || len > U8_MAX) + return -EINVAL; desc->field_len[desc->field_count++] = len; @@ -4069,7 +4071,8 @@ static int nft_set_desc_concat(struct nft_set_desc *desc, const struct nlattr *nla) { struct nlattr *attr; - int rem, err; + u32 num_regs = 0; + int rem, err, i; nla_for_each_nested(attr, nla, rem) { if (nla_type(attr) != NFTA_LIST_ELEM) @@ -4080,6 +4083,12 @@ static int nft_set_desc_concat(struct nft_set_desc *desc, return err; } + for (i = 0; i < desc->field_count; i++) + num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32)); + + if (num_regs > NFT_REG32_COUNT) + return -E2BIG; + return 0; } -- 2.20.1

1 41

[PATCH openEuler-5.10 00/19] Backport 5.10.107 LTS
by Zheng Zengkai 14 Jun '22

14 Jun '22

Backport 5.10.107 LTS patches from upstream kselftest/vm: fix tests build with old libc sfc: extend the locking on mcdi->seqno tcp: make tcp_read_sock() more robust nl80211: Update bss channel on channel switch for P2P_CLIENT drm/vrr: Set VRR capable prop only if it is attached to connector iwlwifi: don't advertise TWT support atm: firestream: check the return value of ioremap() in fs_init() can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE MIPS: smp: fill in sibling and core maps earlier mac80211: refuse aggregations sessions before authorized ARM: dts: rockchip: fix a typo on rk3288 crypto-controller ARM: dts: rockchip: reorder rk322x hmdi clocks arm64: dts: agilex: use the compatible "intel,socfpga-agilex-hsotg" arm64: dts: rockchip: reorder rk3399 hdmi clocks arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity xfrm: Fix xfrm migrate issues when address family changes xfrm: Check if_id in xfrm_migrate Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" Already merged(3) arm64: kvm: Fix copy-and-paste error in bhb templates for v5.10 stable io_uring: return back safer resurrect sctp: fix the processing for INIT chunk Total patches: 22 - 3 = 19 Alexander Lobakin (1): MIPS: smp: fill in sibling and core maps earlier Chengming Zhou (1): kselftest/vm: fix tests build with old libc Corentin Labbe (1): ARM: dts: rockchip: fix a typo on rk3288 crypto-controller Dinh Nguyen (1): arm64: dts: agilex: use the compatible "intel,socfpga-agilex-hsotg" Eric Dumazet (1): tcp: make tcp_read_sock() more robust Golan Ben Ami (1): iwlwifi: don't advertise TWT support Jakob Unterwurzacher (1): arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity Jia-Ju Bai (1): atm: firestream: check the return value of ioremap() in fs_init() Johannes Berg (1): mac80211: refuse aggregations sessions before authorized Julian Braha (1): ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE Kai Lueke (1): Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" Lad Prabhakar (1): can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready Manasi Navare (1): drm/vrr: Set VRR capable prop only if it is attached to connector Niels Dossche (1): sfc: extend the locking on mcdi->seqno Sascha Hauer (2): arm64: dts: rockchip: reorder rk3399 hdmi clocks ARM: dts: rockchip: reorder rk322x hmdi clocks Sreeramya Soratkal (1): nl80211: Update bss channel on channel switch for P2P_CLIENT Yan Yan (2): xfrm: Check if_id in xfrm_migrate xfrm: Fix xfrm migrate issues when address family changes arch/arm/boot/dts/rk322x.dtsi | 4 +-- arch/arm/boot/dts/rk3288.dtsi | 2 +- arch/arm64/boot/dts/intel/socfpga_agilex.dtsi | 4 +-- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 6 +++++ arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 ++--- arch/mips/kernel/smp.c | 6 ++--- drivers/atm/firestream.c | 2 ++ drivers/gpu/drm/drm_connector.c | 3 +++ drivers/net/can/rcar/rcar_canfd.c | 6 ++--- drivers/net/ethernet/sfc/mcdi.c | 2 +- .../wireless/intel/iwlwifi/iwl-nvm-parse.c | 3 +-- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 1 - include/net/xfrm.h | 5 ++-- lib/Kconfig | 1 - net/ipv4/tcp.c | 10 ++++--- net/key/af_key.c | 2 +- net/mac80211/agg-tx.c | 10 ++++++- net/wireless/nl80211.c | 3 ++- net/xfrm/xfrm_policy.c | 14 +++++----- net/xfrm/xfrm_state.c | 15 ++++++++--- net/xfrm/xfrm_user.c | 27 ++++++------------- tools/testing/selftests/vm/userfaultfd.c | 1 + 22 files changed, 76 insertions(+), 57 deletions(-) -- 2.20.1

1 19

[PATCH openEuler-1.0-LTS] netfilter: nf_tables: disallow non-stateful expression in sets earlier
by Yongqiang Liu 14 Jun '22

14 Jun '22

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v5.19-rc1 commit 520778042ccca019f3ffa136dd0ca565c486cedd category: bugfix bugzilla: 186905, https://gitee.com/src-openeuler/kernel/issues/I5B3QZ CVE: CVE-2022-1966 -------------------------------- Since 3e135cd499bf ("netfilter: nft_dynset: dynamic stateful expression instantiation"), it is possible to attach stateful expressions to set elements. cd5125d8f518 ("netfilter: nf_tables: split set destruction in deactivate and destroy phase") introduces conditional destruction on the object to accomodate transaction semantics. nft_expr_init() calls expr->ops->init() first, then check for NFT_STATEFUL_EXPR, this stills allows to initialize a non-stateful lookup expressions which points to a set, which might lead to UAF since the set is not properly detached from the set->binding for this case. Anyway, this combination is non-sense from nf_tables perspective. This patch fixes this problem by checking for NFT_STATEFUL_EXPR before expr->ops->init() is called. The reporter provides a KASAN splat and a poc reproducer (similar to those autogenerated by syzbot to report use-after-free errors). It is unknown to me if they are using syzbot or if they use similar automated tool to locate the bug that they are reporting. For the record, this is the KASAN splat. [ 85.431824] ================================================================== [ 85.432901] BUG: KASAN: use-after-free in nf_tables_bind_set+0x81b/0xa20 [ 85.433825] Write of size 8 at addr ffff8880286f0e98 by task poc/776 [ 85.434756] [ 85.434999] CPU: 1 PID: 776 Comm: poc Tainted: G W 5.18.0+ #2 [ 85.436023] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Fixes: 0b2d8a7b638b ("netfilter: nf_tables: add helper functions for expression handling") Reported-and-tested-by: Aaron Adams <edg-e(a)nccgroup.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> conflict: net/netfilter/nf_tables_api.c net/netfilter/nft_dynset.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/netfilter/nf_tables_api.c | 16 ++++++++++------ net/netfilter/nft_dynset.c | 3 --- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 9cc8e92f4b00..ab68076d2cba 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2167,27 +2167,31 @@ struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, err = nf_tables_expr_parse(ctx, nla, &info); if (err < 0) - goto err1; + goto err_expr_parse; + + err = -EOPNOTSUPP; + if (!(info.ops->type->flags & NFT_EXPR_STATEFUL)) + goto err_expr_stateful; err = -ENOMEM; expr = kzalloc(info.ops->size, GFP_KERNEL); if (expr == NULL) - goto err2; + goto err_expr_stateful; err = nf_tables_newexpr(ctx, &info, expr); if (err < 0) - goto err3; + goto err_expr_new; return expr; -err3: +err_expr_new: kfree(expr); -err2: +err_expr_stateful: owner = info.ops->type->owner; if (info.ops->type->release_ops) info.ops->type->release_ops(info.ops); module_put(owner); -err1: +err_expr_parse: return ERR_PTR(err); } diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c index 4e544044fc2d..cc076d535e14 100644 --- a/net/netfilter/nft_dynset.c +++ b/net/netfilter/nft_dynset.c @@ -193,9 +193,6 @@ static int nft_dynset_init(const struct nft_ctx *ctx, return PTR_ERR(priv->expr); err = -EOPNOTSUPP; - if (!(priv->expr->ops->type->flags & NFT_EXPR_STATEFUL)) - goto err1; - if (priv->expr->ops->type->flags & NFT_EXPR_GC) { if (set->flags & NFT_SET_TIMEOUT) goto err1; -- 2.25.1

1 0

[PATCH OLK-5.10 v2] eulerfs: fix potential sbi->persisters free error
by gouhao＠uniontech.com 14 Jun '22

14 Jun '22

From: Gou Hao <gouhao(a)uniontech.com> uniontech inclusion category: bugfix bugzilla: NA CVE: NA ------------------- After alloc the sbi->persisters memory, dep_init will call dep_fini when error happened.Because sbi->persisters is not set to 0, -> dep_fini() can be called with sbi->persisters[] uninitialized, thus kthread_stop() can be called with random value. Signed-off-by: Gou Hao <gouhao(a)uniontech.com> --- fs/eulerfs/dep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/eulerfs/dep.c b/fs/eulerfs/dep.c index ec014bbf3700..a41471c5f2ec 100644 --- a/fs/eulerfs/dep.c +++ b/fs/eulerfs/dep.c @@ -718,7 +718,7 @@ int dep_init(struct super_block *sb) for_each_possible_cpu(cpu) init_llist_head(per_cpu_ptr(sbi->persistee_list, cpu)); - sbi->persisters = kmalloc(sizeof(struct task_struct *) * + sbi->persisters = kzalloc(sizeof(struct task_struct *) * persisters_per_socket * num_sockets, GFP_KERNEL); if (!sbi->persisters) { -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 1/2] Revert "NFSv4: Handle the special Linux file open access mode"
by Yongqiang Liu 14 Jun '22

14 Jun '22

From: ChenXiaoSong <chenxiaosong2(a)huawei.com> mainline inclusion from mainline-v5.18-rc2 commit ab0fc21bc7105b54bafd85bd8b82742f9e68898a category: bugfix bugzilla: 186890, https://gitee.com/openeuler/kernel/issues/I5BZTX CVE: NA -------------------------------- This reverts commit 44942b4e457beda00981f616402a1a791e8c616e. After secondly opening a file with O_ACCMODE|O_DIRECT flags, nfs4_valid_open_stateid() will dereference NULL nfs4_state when lseek(). Reproducer: 1. mount -t nfs -o vers=4.2 $server_ip:/ /mnt/ 2. fd = open("/mnt/file", O_ACCMODE|O_DIRECT|O_CREAT) 3. close(fd) 4. fd = open("/mnt/file", O_ACCMODE|O_DIRECT) 5. lseek(fd) Reported-by: Lyu Tao <tao.lyu(a)epfl.ch> Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/nfs/inode.c | 1 - fs/nfs/nfs4file.c | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c index db52430dfbd7..053e78d777f1 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -1103,7 +1103,6 @@ int nfs_open(struct inode *inode, struct file *filp) nfs_fscache_open_file(inode, filp); return 0; } -EXPORT_SYMBOL_GPL(nfs_open); /* * This function is called whenever some part of NFS notices that diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c index e053a883d08d..09d65a654c2b 100644 --- a/fs/nfs/nfs4file.c +++ b/fs/nfs/nfs4file.c @@ -49,7 +49,7 @@ nfs4_file_open(struct inode *inode, struct file *filp) return err; if ((openflags & O_ACCMODE) == 3) - return nfs_open(inode, filp); + openflags--; /* We can't create new files here */ openflags &= ~(O_CREAT|O_EXCL); -- 2.25.1

1 1