- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS v2] netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
by Zhengchao Shao 16 Nov '23

16 Nov '23

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.5-rc1 commit ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8EZSO CVE: CVE-2023-39197 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Eric Dumazet says: nf_conntrack_dccp_packet() has an unique: dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); And nothing more is 'pulled' from the packet, depending on the content. dh->dccph_doff, and/or dh->dccph_x ...) So dccp_ack_seq() is happily reading stuff past the _dh buffer. BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 [..] Fix this by increasing the stack buffer to also include room for the extra sequence numbers and all the known dccp packet type headers, then pull again after the initial validation of the basic header. While at it, mark packets invalid that lack 48bit sequence bit but where RFC says the type MUST use them. Compile tested only. v2: first skb_header_pointer() now needs to adjust the size to only pull the generic header. (Eric) Heads-up: I intend to remove dccp conntrack support later this year. Fixes: 2bc780499aa3 ("[NETFILTER]: nf_conntrack: add DCCP protocol support") Reported-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_conntrack_proto_dccp.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/nf_conntrack_proto_dccp.c | 50 ++++++++++++++++++++++++- 1 file changed, 48 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c index 3ba1f4d9934f..cd7a51a0f100 100644 --- a/net/netfilter/nf_conntrack_proto_dccp.c +++ b/net/netfilter/nf_conntrack_proto_dccp.c @@ -433,17 +433,47 @@ static u64 dccp_ack_seq(const struct dccp_hdr *dh) ntohl(dhack->dccph_ack_nr_low); } +struct nf_conntrack_dccp_buf { + struct dccp_hdr dh; /* generic header part */ + struct dccp_hdr_ext ext; /* optional depending dh->dccph_x */ + union { /* depends on header type */ + struct dccp_hdr_ack_bits ack; + struct dccp_hdr_request req; + struct dccp_hdr_response response; + struct dccp_hdr_reset rst; + } u; +}; + +static struct dccp_hdr * +dccp_header_pointer(const struct sk_buff *skb, int offset, const struct dccp_hdr *dh, + struct nf_conntrack_dccp_buf *buf) +{ + unsigned int hdrlen = __dccp_hdr_len(dh); + + if (hdrlen > sizeof(*buf)) + return NULL; + + return skb_header_pointer(skb, offset, hdrlen, buf); +} + static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb, unsigned int dataoff, enum ip_conntrack_info ctinfo) { enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); - struct dccp_hdr _dh, *dh; + struct nf_conntrack_dccp_buf _dh; u_int8_t type, old_state, new_state; enum ct_dccp_roles role; unsigned int *timeouts; + struct dccp_hdr *dh; dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); BUG_ON(dh == NULL); + + /* pull again, including possible 48 bit sequences and subtype header */ + dh = dccp_header_pointer(skb, dataoff, dh, &_dh); + if (!dh) + return NF_DROP; + type = dh->dccph_type; if (type == DCCP_PKT_RESET && @@ -526,10 +556,20 @@ static int dccp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb, unsigned int dataoff, u_int8_t pf, unsigned int hooknum) { + static const unsigned long require_seq48 = 1 << DCCP_PKT_REQUEST | + 1 << DCCP_PKT_RESPONSE | + 1 << DCCP_PKT_CLOSEREQ | + 1 << DCCP_PKT_CLOSE | + 1 << DCCP_PKT_RESET | + 1 << DCCP_PKT_SYNC | + 1 << DCCP_PKT_SYNCACK; struct dccp_hdr _dh, *dh; unsigned int dccp_len = skb->len - dataoff; unsigned int cscov; const char *msg; + u8 type; + + BUILD_BUG_ON(DCCP_PKT_INVALID >= BITS_PER_LONG); dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); if (dh == NULL) { @@ -559,11 +599,17 @@ static int dccp_error(struct net *net, struct nf_conn *tmpl, goto out_invalid; } - if (dh->dccph_type >= DCCP_PKT_INVALID) { + type = dh->dccph_type; + if (type >= DCCP_PKT_INVALID) { msg = "nf_ct_dccp: reserved packet type "; goto out_invalid; } + if (test_bit(type, &require_seq48) && !dh->dccph_x) { + msg = "nf_ct_dccp: type lacks 48bit sequence numbers"; + goto out_invalid; + } + return NF_ACCEPT; out_invalid: -- 2.34.1

2 1

[OLK-5.10 0/2] Support SRQ Context tracing by debugfs
by Chengchang Tang 16 Nov '23

16 Nov '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> The first patch refactors the hns debugfs function, and the second patch supports querying SRQ context by debugfs. Junxian Huang (1): RDMA/hns: Refactor hns RoCE debugfs wenglianfa (1): RDMA/hns: Support SRQ Context tracing by debugfs drivers/infiniband/hw/hns/hns_roce_debugfs.c | 318 +++++++++---------- drivers/infiniband/hw/hns/hns_roce_debugfs.h | 57 ++++ drivers/infiniband/hw/hns/hns_roce_device.h | 7 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 26 +- drivers/infiniband/hw/hns/hns_roce_main.c | 1 - drivers/infiniband/hw/hns/hns_roce_srq.c | 12 + 6 files changed, 242 insertions(+), 179 deletions(-) -- 2.30.0

1 2

[PATCH OLK-5.10 v5 00/19] introduce smart_grid zone
by Yipeng Zou 16 Nov '23

16 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Since v4: 1. Place the highest level task in current domain level itself in sched_grid_prefer_cpus Since v3: 1. fix CI warning Since v2: 1. static alloc sg_zone cpumask. 2. fix some warning Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 11 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 135 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/fair.c | 496 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 273 ++++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 21 files changed, 1601 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

1 19

[PATCH openEuler-1.0-LTS,v2] netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
by Zhengchao Shao 16 Nov '23

16 Nov '23

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.5-rc1 commit ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8EZSO CVE: CVE-2023-39197 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Eric Dumazet says: nf_conntrack_dccp_packet() has an unique: dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); And nothing more is 'pulled' from the packet, depending on the content. dh->dccph_doff, and/or dh->dccph_x ...) So dccp_ack_seq() is happily reading stuff past the _dh buffer. BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 [..] Fix this by increasing the stack buffer to also include room for the extra sequence numbers and all the known dccp packet type headers, then pull again after the initial validation of the basic header. While at it, mark packets invalid that lack 48bit sequence bit but where RFC says the type MUST use them. Compile tested only. v2: first skb_header_pointer() now needs to adjust the size to only pull the generic header. (Eric) Heads-up: I intend to remove dccp conntrack support later this year. Fixes: 2bc780499aa3 ("[NETFILTER]: nf_conntrack: add DCCP protocol support") Reported-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_conntrack_proto_dccp.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/nf_conntrack_proto_dccp.c | 50 ++++++++++++++++++++++++- 1 file changed, 48 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c index 3ba1f4d9934f..cd7a51a0f100 100644 --- a/net/netfilter/nf_conntrack_proto_dccp.c +++ b/net/netfilter/nf_conntrack_proto_dccp.c @@ -433,17 +433,47 @@ static u64 dccp_ack_seq(const struct dccp_hdr *dh) ntohl(dhack->dccph_ack_nr_low); } +struct nf_conntrack_dccp_buf { + struct dccp_hdr dh; /* generic header part */ + struct dccp_hdr_ext ext; /* optional depending dh->dccph_x */ + union { /* depends on header type */ + struct dccp_hdr_ack_bits ack; + struct dccp_hdr_request req; + struct dccp_hdr_response response; + struct dccp_hdr_reset rst; + } u; +}; + +static struct dccp_hdr * +dccp_header_pointer(const struct sk_buff *skb, int offset, const struct dccp_hdr *dh, + struct nf_conntrack_dccp_buf *buf) +{ + unsigned int hdrlen = __dccp_hdr_len(dh); + + if (hdrlen > sizeof(*buf)) + return NULL; + + return skb_header_pointer(skb, offset, hdrlen, buf); +} + static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb, unsigned int dataoff, enum ip_conntrack_info ctinfo) { enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); - struct dccp_hdr _dh, *dh; + struct nf_conntrack_dccp_buf _dh; u_int8_t type, old_state, new_state; enum ct_dccp_roles role; unsigned int *timeouts; + struct dccp_hdr *dh; dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); BUG_ON(dh == NULL); + + /* pull again, including possible 48 bit sequences and subtype header */ + dh = dccp_header_pointer(skb, dataoff, dh, &_dh); + if (!dh) + return NF_DROP; + type = dh->dccph_type; if (type == DCCP_PKT_RESET && @@ -526,10 +556,20 @@ static int dccp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb, unsigned int dataoff, u_int8_t pf, unsigned int hooknum) { + static const unsigned long require_seq48 = 1 << DCCP_PKT_REQUEST | + 1 << DCCP_PKT_RESPONSE | + 1 << DCCP_PKT_CLOSEREQ | + 1 << DCCP_PKT_CLOSE | + 1 << DCCP_PKT_RESET | + 1 << DCCP_PKT_SYNC | + 1 << DCCP_PKT_SYNCACK; struct dccp_hdr _dh, *dh; unsigned int dccp_len = skb->len - dataoff; unsigned int cscov; const char *msg; + u8 type; + + BUILD_BUG_ON(DCCP_PKT_INVALID >= BITS_PER_LONG); dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); if (dh == NULL) { @@ -559,11 +599,17 @@ static int dccp_error(struct net *net, struct nf_conn *tmpl, goto out_invalid; } - if (dh->dccph_type >= DCCP_PKT_INVALID) { + type = dh->dccph_type; + if (type >= DCCP_PKT_INVALID) { msg = "nf_ct_dccp: reserved packet type "; goto out_invalid; } + if (test_bit(type, &require_seq48) && !dh->dccph_x) { + msg = "nf_ct_dccp: type lacks 48bit sequence numbers"; + goto out_invalid; + } + return NF_ACCEPT; out_invalid: -- 2.34.1

1 0

[PATCH OLK-5.10 v5 00/19] introduce smart_grid zone
by Yipeng Zou 16 Nov '23

16 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Since v4: 1. Place the highest level task in current domain level itself in sched_grid_prefer_cpus Since v3: 1. fix CI warning Since v2: 1. static alloc sg_zone cpumask. 2. fix some warning Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 11 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 135 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/fair.c | 496 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 273 ++++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 21 files changed, 1601 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

1 19

[PATCH OLK-5.10 v5 00/19] introduce smart_grid zone
by Yipeng Zou 16 Nov '23

16 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Since v4: 1. Place the highest level task in current domain level itself in sched_grid_prefer_cpus Since v3: 1. fix CI warning Since v2: 1. static alloc sg_zone cpumask. 2. fix some warning Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 11 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 135 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/fair.c | 496 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 273 ++++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 21 files changed, 1601 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

1 19

[PATCH OLK-5.10 v5 00/19] introduce smart_grid zone
by Yipeng Zou 16 Nov '23

16 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Since v4: 1. Place the highest level task in current domain level itself in sched_grid_prefer_cpus Since v3: 1. fix CI warning Since v2: 1. static alloc sg_zone cpumask. 2. fix some warning Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 11 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 135 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/fair.c | 496 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 273 ++++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 21 files changed, 1601 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

1 19

[PATCH openEuler-1.0-LTS] mm, memory_hotplug: update pcp lists everytime onlining a memory block
by Liu Shixin 15 Nov '23

15 Nov '23

From: Charan Teja Reddy <charante(a)codeaurora.org> mainline inclusion from mainline-v5.9-rc1 commit de1193f0be66f88e2c6d0fd965137668fc2ec4a5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8GREH CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When onlining a first memory block in a zone, pcp lists are not updated thus pcp struct will have the default setting of ->high = 0,->batch = 1. This means till the second memory block in a zone(if it have) is onlined the pcp lists of this zone will not contain any pages because pcp's ->count is always greater than ->high thus free_pcppages_bulk() is called to free batch size(=1) pages every time system wants to add a page to the pcp list through free_unref_page(). To put this in a word, system is not using benefits offered by the pcp lists when there is a single onlineable memory block in a zone. Correct this by always updating the pcp lists when memory block is onlined. Fixes: 1f522509c77a ("mem-hotplug: avoid multiple zones sharing same boot strapping boot_pageset") Signed-off-by: Charan Teja Reddy <charante(a)codeaurora.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Reviewed-by: David Hildenbrand <david(a)redhat.com> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Acked-by: Michal Hocko <mhocko(a)suse.com> Cc: Vinayak Menon <vinmenon(a)codeaurora.org> Link: http://lkml.kernel.org/r/1596372896-15336-1-git-send-email-charante@codeaur… Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflicts: mm/memory_hotplug.c Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/memory_hotplug.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c index 3b961b0fffcc..cebfa881e516 100644 --- a/mm/memory_hotplug.c +++ b/mm/memory_hotplug.c @@ -878,8 +878,7 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, int online_typ node_states_set_node(nid, &arg); if (need_zonelists_rebuild) build_all_zonelists(NULL); - else - zone_pcp_update(zone); + zone_pcp_update(zone); } init_per_zone_wmark_min(); -- 2.25.1

2 1

[PATCH OLK-5.10] netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
by Zhengchao Shao 15 Nov '23

15 Nov '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.188 commit 9bdcda7abaf22f6453e5b5efb7eb4e524095d5d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8EZSO CVE: CVE-2023-39197 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30 ] Eric Dumazet says: nf_conntrack_dccp_packet() has an unique: dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); And nothing more is 'pulled' from the packet, depending on the content. dh->dccph_doff, and/or dh->dccph_x ...) So dccp_ack_seq() is happily reading stuff past the _dh buffer. BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 [..] Fix this by increasing the stack buffer to also include room for the extra sequence numbers and all the known dccp packet type headers, then pull again after the initial validation of the basic header. While at it, mark packets invalid that lack 48bit sequence bit but where RFC says the type MUST use them. Compile tested only. v2: first skb_header_pointer() now needs to adjust the size to only pull the generic header. (Eric) Heads-up: I intend to remove dccp conntrack support later this year. Fixes: 2bc780499aa3 ("[NETFILTER]: nf_conntrack: add DCCP protocol support") Reported-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/nf_conntrack_proto_dccp.c | 52 +++++++++++++++++++++++-- 1 file changed, 49 insertions(+), 3 deletions(-) diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c index 94001eb51ffe..a9ae292e932a 100644 --- a/net/netfilter/nf_conntrack_proto_dccp.c +++ b/net/netfilter/nf_conntrack_proto_dccp.c @@ -431,9 +431,19 @@ static bool dccp_error(const struct dccp_hdr *dh, struct sk_buff *skb, unsigned int dataoff, const struct nf_hook_state *state) { + static const unsigned long require_seq48 = 1 << DCCP_PKT_REQUEST | + 1 << DCCP_PKT_RESPONSE | + 1 << DCCP_PKT_CLOSEREQ | + 1 << DCCP_PKT_CLOSE | + 1 << DCCP_PKT_RESET | + 1 << DCCP_PKT_SYNC | + 1 << DCCP_PKT_SYNCACK; unsigned int dccp_len = skb->len - dataoff; unsigned int cscov; const char *msg; + u8 type; + + BUILD_BUG_ON(DCCP_PKT_INVALID >= BITS_PER_LONG); if (dh->dccph_doff * 4 < sizeof(struct dccp_hdr) || dh->dccph_doff * 4 > dccp_len) { @@ -458,10 +468,17 @@ static bool dccp_error(const struct dccp_hdr *dh, goto out_invalid; } - if (dh->dccph_type >= DCCP_PKT_INVALID) { + type = dh->dccph_type; + if (type >= DCCP_PKT_INVALID) { msg = "nf_ct_dccp: reserved packet type "; goto out_invalid; } + + if (test_bit(type, &require_seq48) && !dh->dccph_x) { + msg = "nf_ct_dccp: type lacks 48bit sequence numbers"; + goto out_invalid; + } + return false; out_invalid: nf_l4proto_log_invalid(skb, state->net, state->pf, @@ -469,24 +486,53 @@ static bool dccp_error(const struct dccp_hdr *dh, return true; } +struct nf_conntrack_dccp_buf { + struct dccp_hdr dh; /* generic header part */ + struct dccp_hdr_ext ext; /* optional depending dh->dccph_x */ + union { /* depends on header type */ + struct dccp_hdr_ack_bits ack; + struct dccp_hdr_request req; + struct dccp_hdr_response response; + struct dccp_hdr_reset rst; + } u; +}; + +static struct dccp_hdr * +dccp_header_pointer(const struct sk_buff *skb, int offset, const struct dccp_hdr *dh, + struct nf_conntrack_dccp_buf *buf) +{ + unsigned int hdrlen = __dccp_hdr_len(dh); + + if (hdrlen > sizeof(*buf)) + return NULL; + + return skb_header_pointer(skb, offset, hdrlen, buf); +} + int nf_conntrack_dccp_packet(struct nf_conn *ct, struct sk_buff *skb, unsigned int dataoff, enum ip_conntrack_info ctinfo, const struct nf_hook_state *state) { enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); - struct dccp_hdr _dh, *dh; + struct nf_conntrack_dccp_buf _dh; u_int8_t type, old_state, new_state; enum ct_dccp_roles role; unsigned int *timeouts; + struct dccp_hdr *dh; - dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); + dh = skb_header_pointer(skb, dataoff, sizeof(*dh), &_dh.dh); if (!dh) return NF_DROP; if (dccp_error(dh, skb, dataoff, state)) return -NF_ACCEPT; + /* pull again, including possible 48 bit sequences and subtype header */ + dh = dccp_header_pointer(skb, dataoff, dh, &_dh); + if (!dh) + return NF_DROP; + type = dh->dccph_type; if (!nf_ct_is_confirmed(ct) && !dccp_new(ct, skb, dh)) return -NF_ACCEPT; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
by Zhengchao Shao 15 Nov '23

15 Nov '23

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.5-rc1 commit ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8EZSO CVE: CVE-2023-39197 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Eric Dumazet says: nf_conntrack_dccp_packet() has an unique: dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); And nothing more is 'pulled' from the packet, depending on the content. dh->dccph_doff, and/or dh->dccph_x ...) So dccp_ack_seq() is happily reading stuff past the _dh buffer. BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 [..] Fix this by increasing the stack buffer to also include room for the extra sequence numbers and all the known dccp packet type headers, then pull again after the initial validation of the basic header. While at it, mark packets invalid that lack 48bit sequence bit but where RFC says the type MUST use them. Compile tested only. v2: first skb_header_pointer() now needs to adjust the size to only pull the generic header. (Eric) Heads-up: I intend to remove dccp conntrack support later this year. Fixes: 2bc780499aa3 ("[NETFILTER]: nf_conntrack: add DCCP protocol support") Reported-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_conntrack_proto_dccp.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/nf_conntrack_proto_dccp.c | 32 ++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c index 3ba1f4d9934f..9681c0ce1d6f 100644 --- a/net/netfilter/nf_conntrack_proto_dccp.c +++ b/net/netfilter/nf_conntrack_proto_dccp.c @@ -433,17 +433,47 @@ static u64 dccp_ack_seq(const struct dccp_hdr *dh) ntohl(dhack->dccph_ack_nr_low); } +struct nf_conntrack_dccp_buf { + struct dccp_hdr dh; /* generic header part */ + struct dccp_hdr_ext ext; /* optional depending dh->dccph_x */ + union { /* depends on header type */ + struct dccp_hdr_ack_bits ack; + struct dccp_hdr_request req; + struct dccp_hdr_response response; + struct dccp_hdr_reset rst; + } u; +}; + +static struct dccp_hdr * +dccp_header_pointer(const struct sk_buff *skb, int offset, const struct dccp_hdr *dh, + struct nf_conntrack_dccp_buf *buf) +{ + unsigned int hdrlen = __dccp_hdr_len(dh); + + if (hdrlen > sizeof(*buf)) + return NULL; + + return skb_header_pointer(skb, offset, hdrlen, buf); +} + static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb, unsigned int dataoff, enum ip_conntrack_info ctinfo) { enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); - struct dccp_hdr _dh, *dh; + struct nf_conntrack_dccp_buf _dh; u_int8_t type, old_state, new_state; enum ct_dccp_roles role; unsigned int *timeouts; + struct dccp_hdr *dh; dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); BUG_ON(dh == NULL); + + /* pull again, including possible 48 bit sequences and subtype header */ + dh = dccp_header_pointer(skb, dataoff, dh, &_dh); + if (!dh) + return NF_DROP; + type = dh->dccph_type; if (type == DCCP_PKT_RESET && -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS 0/3] bugfix for CVE-2022-45884
by liwei 14 Nov '23

14 Nov '23

bugfix for CVE-2022-45884 Dinghao Liu (1): media: dvbdev: Fix memleak in dvb_register_device Hyunwoo Kim (1): media: dvb-core: Fix use-after-free due to race at dvb_register_device() Mauro Carvalho Chehab (1): media: dvbdev: fix error logic at dvb_register_device() drivers/media/dvb-core/dvbdev.c | 88 +++++++++++++++++++++++++-------- include/media/dvbdev.h | 15 ++++++ 2 files changed, 83 insertions(+), 20 deletions(-) -- 2.25.1

2 4

[PATCH openEuler-22.03-LTS-SP1 0/3] bugfix for CVE-2022-45884
by liwei 14 Nov '23

14 Nov '23

bugfix for CVE-2022-45884 Dinghao Liu (1): media: dvbdev: Fix memleak in dvb_register_device Hyunwoo Kim (1): media: dvb-core: Fix use-after-free due to race at dvb_register_device() Mauro Carvalho Chehab (1): media: dvbdev: fix error logic at dvb_register_device() drivers/media/dvb-core/dvbdev.c | 88 +++++++++++++++++++++++++-------- include/media/dvbdev.h | 15 ++++++ 2 files changed, 83 insertions(+), 20 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 v4 00/19] introduce smart_grid zone
by Yipeng Zou 14 Nov '23

14 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Since v3: 1. fix CI warning Since v2: 1. static alloc sg_zone cpumask. 2. fix some warning Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 11 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 135 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/cpufreq_schedutil.c | 1 + kernel/sched/fair.c | 497 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 268 +++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 22 files changed, 1598 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

2 20

[PATCH OLK-5.10 v3 00/19] introduce smart_grid zone
by Yipeng Zou 14 Nov '23

14 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Since v2: 1. static alloc sg_zone cpumask. 2. fix some warning Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 6 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 135 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/cpufreq_schedutil.c | 1 + kernel/sched/fair.c | 497 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 267 +++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 22 files changed, 1592 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

2 20

[OLK-5.10 0/6] Support SW stats with debugfs
by Chengchang Tang 14 Nov '23

14 Nov '23

Support SW stats with debugfs. Juan Zhou (2): Revert "RDMA/hns: Fix missing dealloc_dfx_cnt() during device unregister" Revert "RDMA/hns: Add dfx cnt stats" Junxian Huang (4): RDMA/hns: Fix an inappropriate err code for unsupported operations RDMA/hns: Support SW stats with debugfs RDMA/hns: Remove return value checks of debugfs functions RDMA/hns: Don't set the HW stats ops for VF and HIP08 drivers/infiniband/hw/hns/hns_roce_cq.c | 6 +- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 95 +++++++++++++++----- drivers/infiniband/hw/hns/hns_roce_device.h | 4 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 35 +++++--- drivers/infiniband/hw/hns/hns_roce_main.c | 70 +++++---------- drivers/infiniband/hw/hns/hns_roce_pd.c | 2 +- 6 files changed, 121 insertions(+), 91 deletions(-) -- 2.30.0

1 6

[PATCH v2 OLK-5.10] MAINTAINERS: update openEuler/MAINTAINERS for vdpa driver
by Jiang Dongxu 14 Nov '23

14 Nov '23

From: jiangdongxu <jiangdongxu1(a)huawei.com> driver inclusion category: doc bugzilla: https://gitee.com/openeuler/kernel/issues/I8G7VC ---------------------------- Add vdpa vhost-vdpa driver maintainers to openEuler/MAINTAINERS Signed-off-by: jiangdongxu <jiangdongxu1(a)huawei.com> --- openEuler/MAINTAINERS | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/openEuler/MAINTAINERS b/openEuler/MAINTAINERS index a74c666b0bf7..5c2108d55c2d 100644 --- a/openEuler/MAINTAINERS +++ b/openEuler/MAINTAINERS @@ -243,6 +243,12 @@ F: drivers/iommu/hisilicon F: drivers/ubc F: drivers/vfio/ubc +VDPA DRIVER +M: jiangdongxu <jiangdongxu1(a)huawei.com> +S: Maintained +F: drivers/vdpa +F: drivers/vhost/vdpa.c + THE REST M: xiexiuqi(a)huawei.com M: zhengzengkai(a)huawei.com -- 2.27.0

2 1

[PATCH OLK-5.10 0/3] bugfix for CVE-2022-45884
by liwei 14 Nov '23

14 Nov '23

bugfix for CVE-2022-45884 Dinghao Liu (1): media: dvbdev: Fix memleak in dvb_register_device Hyunwoo Kim (1): media: dvb-core: Fix use-after-free due to race at dvb_register_device() Mauro Carvalho Chehab (1): media: dvbdev: fix error logic at dvb_register_device() drivers/media/dvb-core/dvbdev.c | 88 +++++++++++++++++++++++++-------- include/media/dvbdev.h | 15 ++++++ 2 files changed, 83 insertions(+), 20 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] MAINTAINERS: update openEuler/MAINTAINERS for vdpa driver
by Jiang Dongxu 14 Nov '23

14 Nov '23

From: jiangdongxu <jiangdongxu1(a)huawei.com> driver inclusion category: doc bugzilla: https://gitee.com/openeuler/kernel/issues/I8G7VC ---------------------------- Add vdpa vhost-vdpa driver maintainers to openEuler/MAINTAINERS --- openEuler/MAINTAINERS | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/openEuler/MAINTAINERS b/openEuler/MAINTAINERS index a74c666b0bf7..5c2108d55c2d 100644 --- a/openEuler/MAINTAINERS +++ b/openEuler/MAINTAINERS @@ -243,6 +243,12 @@ F: drivers/iommu/hisilicon F: drivers/ubc F: drivers/vfio/ubc +VDPA DRIVER +M: jiangdongxu <jiangdongxu1(a)huawei.com> +S: Maintained +F: drivers/vdpa +F: drivers/vhost/vdpa.c + THE REST M: xiexiuqi(a)huawei.com M: zhengzengkai(a)huawei.com -- 2.27.0

2 1

[PATCH OLK-5.10 v3 00/19] introduce smart_grid zone
by Yipeng Zou 14 Nov '23

14 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Since v2: 1. static alloc sg_zone cpumask. 2. fix some warning Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 6 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 135 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/cpufreq_schedutil.c | 1 + kernel/sched/fair.c | 497 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 267 +++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 22 files changed, 1592 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

2 20

[PATCH OLK-5.10 v3 00/19] introduce smart_grid zone
by Yipeng Zou 13 Nov '23

13 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Since v2: 1. static alloc sg_zone cpumask. 2. fix some warning Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 6 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 135 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/cpufreq_schedutil.c | 1 + kernel/sched/fair.c | 497 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 267 +++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 22 files changed, 1592 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

1 19

[PATCH OLK-5.10 v3 00/19] introduce smart_grid zone
by Yipeng Zou 13 Nov '23

13 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Since v2: 1. static alloc sg_zone cpumask. 2. fix some warning Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 6 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 135 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/cpufreq_schedutil.c | 1 + kernel/sched/fair.c | 497 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 267 +++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 22 files changed, 1592 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

2 20

[PATCH OLK-5.10 00/19] introduce smart_grid zone
by Yipeng Zou 13 Nov '23

13 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Since v2: 1. static alloc sg_zone cpumask. 2. fix some warning Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 6 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 135 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/cpufreq_schedutil.c | 1 + kernel/sched/fair.c | 497 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 267 +++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 22 files changed, 1592 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

2 20

[PATCH OLK-5.10 v3 00/19] introduce smart_grid zone
by Yipeng Zou 13 Nov '23

13 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Since v2: 1. static alloc sg_zone cpumask. 2. fix some warning Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 6 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 135 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/cpufreq_schedutil.c | 1 + kernel/sched/fair.c | 497 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 267 +++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 22 files changed, 1592 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

2 20

[PATCH OLK-5.10 00/19] introduce smart_grid zone
by Yipeng Zou 13 Nov '23

13 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Since v2: 1. static alloc sg_zone cpumask. 2. fix some warning Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 6 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 135 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/cpufreq_schedutil.c | 1 + kernel/sched/fair.c | 497 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 267 +++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 22 files changed, 1592 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

2 20

[PATCH OLK-5.10 v3 00/19] introduce smart_grid zone
by Yipeng Zou 13 Nov '23

13 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Since v2: 1. static alloc sg_zone cpumask. 2. fix some warning Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 6 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 135 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/cpufreq_schedutil.c | 1 + kernel/sched/fair.c | 497 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 267 +++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 22 files changed, 1592 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

2 20

[PATCH OLK-5.10 v3 0/2] Add error handle for sd
by Li Nan 13 Nov '23

13 Nov '23

Luis Chamberlain (1): scsi: sd: Add error handling support for add_disk() Zhong Jinghua (1): scsi: sd: Clean up sdkp if device_add_disk() failed drivers/scsi/sd.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH OLK-5.10 00/19] introduce smart_grid zone
by Yipeng Zou 13 Nov '23

13 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 6 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 136 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/cpufreq_schedutil.c | 1 + kernel/sched/fair.c | 497 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 263 +++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 22 files changed, 1589 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

2 20

[PATCH OLK-5.10 v2 00/19] introduce smart_grid zone
by Yipeng Zou 13 Nov '23

13 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 234 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 6 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 136 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/cpufreq_schedutil.c | 1 + kernel/sched/fair.c | 497 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 263 +++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 22 files changed, 1589 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

1 19

[PATCH openEuler-1.0-LTS] drm/qxl: fix UAF on handle creation
by Guo Mengqi 13 Nov '23

13 Nov '23

From: Wander Lairson Costa <wander(a)redhat.com> stable inclusion from stable-v5.15.128 commit d578c919deb786b4d6ba8c7639255cb658731671 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8EZY4 CVE: CVE-2023-39198 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c611589b4259ed63b9b77be6872b1ce07ec0ac16 upstream. qxl_mode_dumb_create() dereferences the qobj returned by qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. A potential attacker could guess the returned handle value and closes it between the return of qxl_gem_object_create_with_handle() and the qobj usage, triggering a use-after-free scenario. Reproducer: int dri_fd =-1; struct drm_mode_create_dumb arg = {0}; void gem_close(int handle); void* trigger(void* ptr) { int ret; arg.width = arg.height = 0x20; arg.bpp = 32; ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &arg); if(ret) { perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed"); exit(-1); } gem_close(arg.handle); while(1) { struct drm_mode_create_dumb args = {0}; args.width = args.height = 0x20; args.bpp = 32; ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &args); if (ret) { perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed"); exit(-1); } printf("[*] DRM_IOCTL_MODE_CREATE_DUMB created, %d\n", args.handle); gem_close(args.handle); } return NULL; } void gem_close(int handle) { struct drm_gem_close args; args.handle = handle; int ret = ioctl(dri_fd, DRM_IOCTL_GEM_CLOSE, &args); // gem close handle if (!ret) printf("gem close handle %d\n", args.handle); } int main(void) { dri_fd= open("/dev/dri/card0", O_RDWR); printf("fd:%d\n", dri_fd); if(dri_fd == -1) return -1; pthread_t tid1; if(pthread_create(&tid1,NULL,trigger,NULL)){ perror("[*] thread_create tid1\n"); return -1; } while (1) { gem_close(arg.handle); } return 0; } This is a KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69 Write of size 1 at addr ffff88801136c240 by task poc/515 CPU: 1 PID: 515 Comm: poc Not tainted 6.3.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014 Call Trace: <TASK> __dump_stack linux/lib/dump_stack.c:88 dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106 print_address_description linux/mm/kasan/report.c:319 print_report+0xd2/0x660 linux/mm/kasan/report.c:430 kasan_report+0xd2/0x110 linux/mm/kasan/report.c:536 __asan_report_store1_noabort+0x17/0x30 linux/mm/kasan/report_generic.c:383 qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 RIP: 0033:0x7ff5004ff5f7 Code: 00 00 00 48 8b 05 99 c8 0d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 69 c8 0d 00 f7 d8 64 89 01 48 RSP: 002b:00007ff500408ea8 EFLAGS: 00000286 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff5004ff5f7 RDX: 00007ff500408ec0 RSI: 00000000c02064b2 RDI: 0000000000000003 RBP: 00007ff500408ef0 R08: 0000000000000000 R09: 000000000000002a R10: 0000000000000000 R11: 0000000000000286 R12: 00007fff1c6cdafe R13: 00007fff1c6cdaff R14: 00007ff500408fc0 R15: 0000000000802000 </TASK> Allocated by task 515: kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45 kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52 kasan_save_alloc_info+0x1e/0x40 linux/mm/kasan/generic.c:510 ____kasan_kmalloc linux/mm/kasan/common.c:374 __kasan_kmalloc+0xc3/0xd0 linux/mm/kasan/common.c:383 kasan_kmalloc linux/./include/linux/kasan.h:196 kmalloc_trace+0x48/0xc0 linux/mm/slab_common.c:1066 kmalloc linux/./include/linux/slab.h:580 kzalloc linux/./include/linux/slab.h:720 qxl_bo_create+0x11a/0x610 linux/drivers/gpu/drm/qxl/qxl_object.c:124 qxl_gem_object_create+0xd9/0x360 linux/drivers/gpu/drm/qxl/qxl_gem.c:58 qxl_gem_object_create_with_handle+0xa1/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:89 qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 Freed by task 515: kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45 kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x60 linux/mm/kasan/generic.c:521 ____kasan_slab_free linux/mm/kasan/common.c:236 ____kasan_slab_free+0x180/0x1f0 linux/mm/kasan/common.c:200 __kasan_slab_free+0x12/0x30 linux/mm/kasan/common.c:244 kasan_slab_free linux/./include/linux/kasan.h:162 slab_free_hook linux/mm/slub.c:1781 slab_free_freelist_hook+0xd2/0x1a0 linux/mm/slub.c:1807 slab_free linux/mm/slub.c:3787 __kmem_cache_free+0x196/0x2d0 linux/mm/slub.c:3800 kfree+0x78/0x120 linux/mm/slab_common.c:1019 qxl_ttm_bo_destroy+0x140/0x1a0 linux/drivers/gpu/drm/qxl/qxl_object.c:49 ttm_bo_release+0x678/0xa30 linux/drivers/gpu/drm/ttm/ttm_bo.c:381 kref_put linux/./include/linux/kref.h:65 ttm_bo_put+0x50/0x80 linux/drivers/gpu/drm/ttm/ttm_bo.c:393 qxl_gem_object_free+0x3e/0x60 linux/drivers/gpu/drm/qxl/qxl_gem.c:42 drm_gem_object_free+0x5c/0x90 linux/drivers/gpu/drm/drm_gem.c:974 kref_put linux/./include/linux/kref.h:65 __drm_gem_object_put linux/./include/drm/drm_gem.h:431 drm_gem_object_put linux/./include/drm/drm_gem.h:444 qxl_gem_object_create_with_handle+0x151/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:100 qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 The buggy address belongs to the object at ffff88801136c000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 576 bytes inside of freed 1024-byte region [ffff88801136c000, ffff88801136c400) The buggy address belongs to the physical page: page:0000000089fc329b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11368 head:0000000089fc329b order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0010200 ffff888007841dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88801136c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801136c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88801136c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801136c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801136c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint Instead of returning a weak reference to the qxl_bo object, return the created drm_gem_object and let the caller decrement the reference count when it no longer needs it. As a convenience, if the caller is not interested in the gobj object, it can pass NULL to the parameter and the reference counting is descremented internally. The bug and the reproducer were originally found by the Zero Day Initiative project (ZDI-CAN-20940). Link: https://www.zerodayinitiative.com/ Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Cc: stable(a)vger.kernel.org Reviewed-by: Dave Airlie <airlied(a)redhat.com> Signed-off-by: Dave Airlie <airlied(a)redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230814165119.90847-1-wander… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 2 +- drivers/gpu/drm/qxl/qxl_dumb.c | 5 ++++- drivers/gpu/drm/qxl/qxl_gem.c | 25 +++++++++++++++++-------- drivers/gpu/drm/qxl/qxl_ioctl.c | 6 ++---- 4 files changed, 24 insertions(+), 14 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h index 01220d386b0a..1414907ddb50 100644 --- a/drivers/gpu/drm/qxl/qxl_drv.h +++ b/drivers/gpu/drm/qxl/qxl_drv.h @@ -379,7 +379,7 @@ int qxl_gem_object_create_with_handle(struct qxl_device *qdev, u32 domain, size_t size, struct qxl_surface *surf, - struct qxl_bo **qobj, + struct drm_gem_object **gobj, uint32_t *handle); void qxl_gem_object_free(struct drm_gem_object *gobj); int qxl_gem_object_open(struct drm_gem_object *obj, struct drm_file *file_priv); diff --git a/drivers/gpu/drm/qxl/qxl_dumb.c b/drivers/gpu/drm/qxl/qxl_dumb.c index c666b89eed5d..e5d5ab5b64ee 100644 --- a/drivers/gpu/drm/qxl/qxl_dumb.c +++ b/drivers/gpu/drm/qxl/qxl_dumb.c @@ -34,6 +34,7 @@ int qxl_mode_dumb_create(struct drm_file *file_priv, { struct qxl_device *qdev = dev->dev_private; struct qxl_bo *qobj; + struct drm_gem_object *gobj; uint32_t handle; int r; struct qxl_surface surf; @@ -59,11 +60,13 @@ int qxl_mode_dumb_create(struct drm_file *file_priv, surf.format = format; r = qxl_gem_object_create_with_handle(qdev, file_priv, QXL_GEM_DOMAIN_VRAM, - args->size, &surf, &qobj, + args->size, &surf, &gobj, &handle); if (r) return r; + qobj = gem_to_qxl_bo(gobj); qobj->is_dumb = true; + drm_gem_object_put_unlocked(gobj); args->pitch = pitch; args->handle = handle; return 0; diff --git a/drivers/gpu/drm/qxl/qxl_gem.c b/drivers/gpu/drm/qxl/qxl_gem.c index f5c1e7872e92..886f0cae2dc5 100644 --- a/drivers/gpu/drm/qxl/qxl_gem.c +++ b/drivers/gpu/drm/qxl/qxl_gem.c @@ -73,32 +73,41 @@ int qxl_gem_object_create(struct qxl_device *qdev, int size, return 0; } +/* + * If the caller passed a valid gobj pointer, it is responsible to call + * drm_gem_object_put() when it no longer needs to acess the object. + * + * If gobj is NULL, it is handled internally. + */ int qxl_gem_object_create_with_handle(struct qxl_device *qdev, struct drm_file *file_priv, u32 domain, size_t size, struct qxl_surface *surf, - struct qxl_bo **qobj, + struct drm_gem_object **gobj, uint32_t *handle) { - struct drm_gem_object *gobj; int r; + struct drm_gem_object *local_gobj; - BUG_ON(!qobj); BUG_ON(!handle); r = qxl_gem_object_create(qdev, size, 0, domain, false, false, surf, - &gobj); + &local_gobj); if (r) return -ENOMEM; - r = drm_gem_handle_create(file_priv, gobj, handle); + r = drm_gem_handle_create(file_priv, local_gobj, handle); if (r) return r; - /* drop reference from allocate - handle holds it now */ - *qobj = gem_to_qxl_bo(gobj); - drm_gem_object_put_unlocked(gobj); + + if (gobj) + *gobj = local_gobj; + else + /* drop reference from allocate - handle holds it now */ + drm_gem_object_put_unlocked(local_gobj); + return 0; } diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index b60e3df003b4..eb4d6827f74a 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -36,7 +36,6 @@ static int qxl_alloc_ioctl(struct drm_device *dev, void *data, struct qxl_device *qdev = dev->dev_private; struct drm_qxl_alloc *qxl_alloc = data; int ret; - struct qxl_bo *qobj; uint32_t handle; u32 domain = QXL_GEM_DOMAIN_VRAM; @@ -48,7 +47,7 @@ static int qxl_alloc_ioctl(struct drm_device *dev, void *data, domain, qxl_alloc->size, NULL, - &qobj, &handle); + NULL, &handle); if (ret) { DRM_ERROR("%s: failed to create gem ret=%d\n", __func__, ret); @@ -391,7 +390,6 @@ static int qxl_alloc_surf_ioctl(struct drm_device *dev, void *data, { struct qxl_device *qdev = dev->dev_private; struct drm_qxl_alloc_surf *param = data; - struct qxl_bo *qobj; int handle; int ret; int size, actual_stride; @@ -411,7 +409,7 @@ static int qxl_alloc_surf_ioctl(struct drm_device *dev, void *data, QXL_GEM_DOMAIN_SURFACE, size, &surf, - &qobj, &handle); + NULL, &handle); if (ret) { DRM_ERROR("%s: failed to create gem ret=%d\n", __func__, ret); -- 2.17.1

2 1

[PATCH OLK-5.10] drm/qxl: fix UAF on handle creation
by Guo Mengqi 13 Nov '23

13 Nov '23

From: Wander Lairson Costa <wander(a)redhat.com> stable inclusion from stable-v5.15.128 commit d578c919deb786b4d6ba8c7639255cb658731671 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8EZY4 CVE: CVE-2023-39198 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c611589b4259ed63b9b77be6872b1ce07ec0ac16 upstream. qxl_mode_dumb_create() dereferences the qobj returned by qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. A potential attacker could guess the returned handle value and closes it between the return of qxl_gem_object_create_with_handle() and the qobj usage, triggering a use-after-free scenario. Reproducer: int dri_fd =-1; struct drm_mode_create_dumb arg = {0}; void gem_close(int handle); void* trigger(void* ptr) { int ret; arg.width = arg.height = 0x20; arg.bpp = 32; ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &arg); if(ret) { perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed"); exit(-1); } gem_close(arg.handle); while(1) { struct drm_mode_create_dumb args = {0}; args.width = args.height = 0x20; args.bpp = 32; ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &args); if (ret) { perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed"); exit(-1); } printf("[*] DRM_IOCTL_MODE_CREATE_DUMB created, %d\n", args.handle); gem_close(args.handle); } return NULL; } void gem_close(int handle) { struct drm_gem_close args; args.handle = handle; int ret = ioctl(dri_fd, DRM_IOCTL_GEM_CLOSE, &args); // gem close handle if (!ret) printf("gem close handle %d\n", args.handle); } int main(void) { dri_fd= open("/dev/dri/card0", O_RDWR); printf("fd:%d\n", dri_fd); if(dri_fd == -1) return -1; pthread_t tid1; if(pthread_create(&tid1,NULL,trigger,NULL)){ perror("[*] thread_create tid1\n"); return -1; } while (1) { gem_close(arg.handle); } return 0; } This is a KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69 Write of size 1 at addr ffff88801136c240 by task poc/515 CPU: 1 PID: 515 Comm: poc Not tainted 6.3.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014 Call Trace: <TASK> __dump_stack linux/lib/dump_stack.c:88 dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106 print_address_description linux/mm/kasan/report.c:319 print_report+0xd2/0x660 linux/mm/kasan/report.c:430 kasan_report+0xd2/0x110 linux/mm/kasan/report.c:536 __asan_report_store1_noabort+0x17/0x30 linux/mm/kasan/report_generic.c:383 qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 RIP: 0033:0x7ff5004ff5f7 Code: 00 00 00 48 8b 05 99 c8 0d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 69 c8 0d 00 f7 d8 64 89 01 48 RSP: 002b:00007ff500408ea8 EFLAGS: 00000286 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff5004ff5f7 RDX: 00007ff500408ec0 RSI: 00000000c02064b2 RDI: 0000000000000003 RBP: 00007ff500408ef0 R08: 0000000000000000 R09: 000000000000002a R10: 0000000000000000 R11: 0000000000000286 R12: 00007fff1c6cdafe R13: 00007fff1c6cdaff R14: 00007ff500408fc0 R15: 0000000000802000 </TASK> Allocated by task 515: kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45 kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52 kasan_save_alloc_info+0x1e/0x40 linux/mm/kasan/generic.c:510 ____kasan_kmalloc linux/mm/kasan/common.c:374 __kasan_kmalloc+0xc3/0xd0 linux/mm/kasan/common.c:383 kasan_kmalloc linux/./include/linux/kasan.h:196 kmalloc_trace+0x48/0xc0 linux/mm/slab_common.c:1066 kmalloc linux/./include/linux/slab.h:580 kzalloc linux/./include/linux/slab.h:720 qxl_bo_create+0x11a/0x610 linux/drivers/gpu/drm/qxl/qxl_object.c:124 qxl_gem_object_create+0xd9/0x360 linux/drivers/gpu/drm/qxl/qxl_gem.c:58 qxl_gem_object_create_with_handle+0xa1/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:89 qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 Freed by task 515: kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45 kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x60 linux/mm/kasan/generic.c:521 ____kasan_slab_free linux/mm/kasan/common.c:236 ____kasan_slab_free+0x180/0x1f0 linux/mm/kasan/common.c:200 __kasan_slab_free+0x12/0x30 linux/mm/kasan/common.c:244 kasan_slab_free linux/./include/linux/kasan.h:162 slab_free_hook linux/mm/slub.c:1781 slab_free_freelist_hook+0xd2/0x1a0 linux/mm/slub.c:1807 slab_free linux/mm/slub.c:3787 __kmem_cache_free+0x196/0x2d0 linux/mm/slub.c:3800 kfree+0x78/0x120 linux/mm/slab_common.c:1019 qxl_ttm_bo_destroy+0x140/0x1a0 linux/drivers/gpu/drm/qxl/qxl_object.c:49 ttm_bo_release+0x678/0xa30 linux/drivers/gpu/drm/ttm/ttm_bo.c:381 kref_put linux/./include/linux/kref.h:65 ttm_bo_put+0x50/0x80 linux/drivers/gpu/drm/ttm/ttm_bo.c:393 qxl_gem_object_free+0x3e/0x60 linux/drivers/gpu/drm/qxl/qxl_gem.c:42 drm_gem_object_free+0x5c/0x90 linux/drivers/gpu/drm/drm_gem.c:974 kref_put linux/./include/linux/kref.h:65 __drm_gem_object_put linux/./include/drm/drm_gem.h:431 drm_gem_object_put linux/./include/drm/drm_gem.h:444 qxl_gem_object_create_with_handle+0x151/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:100 qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 The buggy address belongs to the object at ffff88801136c000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 576 bytes inside of freed 1024-byte region [ffff88801136c000, ffff88801136c400) The buggy address belongs to the physical page: page:0000000089fc329b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11368 head:0000000089fc329b order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0010200 ffff888007841dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88801136c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801136c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88801136c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801136c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801136c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint Instead of returning a weak reference to the qxl_bo object, return the created drm_gem_object and let the caller decrement the reference count when it no longer needs it. As a convenience, if the caller is not interested in the gobj object, it can pass NULL to the parameter and the reference counting is descremented internally. The bug and the reproducer were originally found by the Zero Day Initiative project (ZDI-CAN-20940). Link: https://www.zerodayinitiative.com/ Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Cc: stable(a)vger.kernel.org Reviewed-by: Dave Airlie <airlied(a)redhat.com> Signed-off-by: Dave Airlie <airlied(a)redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230814165119.90847-1-wander… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 2 +- drivers/gpu/drm/qxl/qxl_dumb.c | 5 ++++- drivers/gpu/drm/qxl/qxl_gem.c | 25 +++++++++++++++++-------- drivers/gpu/drm/qxl/qxl_ioctl.c | 6 ++---- 4 files changed, 24 insertions(+), 14 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h index aae90a9ee1db..ee59ef2cba77 100644 --- a/drivers/gpu/drm/qxl/qxl_drv.h +++ b/drivers/gpu/drm/qxl/qxl_drv.h @@ -329,7 +329,7 @@ int qxl_gem_object_create_with_handle(struct qxl_device *qdev, u32 domain, size_t size, struct qxl_surface *surf, - struct qxl_bo **qobj, + struct drm_gem_object **gobj, uint32_t *handle); void qxl_gem_object_free(struct drm_gem_object *gobj); int qxl_gem_object_open(struct drm_gem_object *obj, struct drm_file *file_priv); diff --git a/drivers/gpu/drm/qxl/qxl_dumb.c b/drivers/gpu/drm/qxl/qxl_dumb.c index e377bdbff90d..f7bafc791b1e 100644 --- a/drivers/gpu/drm/qxl/qxl_dumb.c +++ b/drivers/gpu/drm/qxl/qxl_dumb.c @@ -34,6 +34,7 @@ int qxl_mode_dumb_create(struct drm_file *file_priv, { struct qxl_device *qdev = to_qxl(dev); struct qxl_bo *qobj; + struct drm_gem_object *gobj; uint32_t handle; int r; struct qxl_surface surf; @@ -62,11 +63,13 @@ int qxl_mode_dumb_create(struct drm_file *file_priv, r = qxl_gem_object_create_with_handle(qdev, file_priv, QXL_GEM_DOMAIN_SURFACE, - args->size, &surf, &qobj, + args->size, &surf, &gobj, &handle); if (r) return r; + qobj = gem_to_qxl_bo(gobj); qobj->is_dumb = true; + drm_gem_object_put(gobj); args->pitch = pitch; args->handle = handle; return 0; diff --git a/drivers/gpu/drm/qxl/qxl_gem.c b/drivers/gpu/drm/qxl/qxl_gem.c index a08da0bd9098..fc5e3763c359 100644 --- a/drivers/gpu/drm/qxl/qxl_gem.c +++ b/drivers/gpu/drm/qxl/qxl_gem.c @@ -72,32 +72,41 @@ int qxl_gem_object_create(struct qxl_device *qdev, int size, return 0; } +/* + * If the caller passed a valid gobj pointer, it is responsible to call + * drm_gem_object_put() when it no longer needs to acess the object. + * + * If gobj is NULL, it is handled internally. + */ int qxl_gem_object_create_with_handle(struct qxl_device *qdev, struct drm_file *file_priv, u32 domain, size_t size, struct qxl_surface *surf, - struct qxl_bo **qobj, + struct drm_gem_object **gobj, uint32_t *handle) { - struct drm_gem_object *gobj; int r; + struct drm_gem_object *local_gobj; - BUG_ON(!qobj); BUG_ON(!handle); r = qxl_gem_object_create(qdev, size, 0, domain, false, false, surf, - &gobj); + &local_gobj); if (r) return -ENOMEM; - r = drm_gem_handle_create(file_priv, gobj, handle); + r = drm_gem_handle_create(file_priv, local_gobj, handle); if (r) return r; - /* drop reference from allocate - handle holds it now */ - *qobj = gem_to_qxl_bo(gobj); - drm_gem_object_put(gobj); + + if (gobj) + *gobj = local_gobj; + else + /* drop reference from allocate - handle holds it now */ + drm_gem_object_put(local_gobj); + return 0; } diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index 5cea6eea72ab..9a02c4871400 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -39,7 +39,6 @@ static int qxl_alloc_ioctl(struct drm_device *dev, void *data, struct qxl_device *qdev = to_qxl(dev); struct drm_qxl_alloc *qxl_alloc = data; int ret; - struct qxl_bo *qobj; uint32_t handle; u32 domain = QXL_GEM_DOMAIN_VRAM; @@ -51,7 +50,7 @@ static int qxl_alloc_ioctl(struct drm_device *dev, void *data, domain, qxl_alloc->size, NULL, - &qobj, &handle); + NULL, &handle); if (ret) { DRM_ERROR("%s: failed to create gem ret=%d\n", __func__, ret); @@ -393,7 +392,6 @@ static int qxl_alloc_surf_ioctl(struct drm_device *dev, void *data, { struct qxl_device *qdev = to_qxl(dev); struct drm_qxl_alloc_surf *param = data; - struct qxl_bo *qobj; int handle; int ret; int size, actual_stride; @@ -413,7 +411,7 @@ static int qxl_alloc_surf_ioctl(struct drm_device *dev, void *data, QXL_GEM_DOMAIN_SURFACE, size, &surf, - &qobj, &handle); + NULL, &handle); if (ret) { DRM_ERROR("%s: failed to create gem ret=%d\n", __func__, ret); -- 2.17.1

2 1

[PATCH OLK-5.10 00/19] introduce smart_grid zone
by Yipeng Zou 11 Nov '23

11 Nov '23

The patch sets include two parts: 1. patch 1~15: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (4): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control arch/arm64/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 231 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 76 ++++ include/linux/cpufreq.h | 6 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 133 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 158 +++++++- kernel/sched/cpufreq_schedutil.c | 1 + kernel/sched/fair.c | 497 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 263 +++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 51 ++- kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 22 files changed, 1583 insertions(+), 19 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

2 20

[PATCH OLK-5.10 v3 00/22] Add error handle for driver
by Li Nan 11 Nov '23

11 Nov '23

Christoph Hellwig (9): block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Li Lingfeng (1): nbd: fix uaf in nbd_open Luis Chamberlain (7): loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sd: Add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Zhong Jinghua (3): scsi: sd: Clean up sdkp if device_add_disk() failed mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup include/linux/blk-mq.h | 12 +++++ include/linux/genhd.h | 23 +++++++++ block/blk-mq.c | 19 ++++++++ block/genhd.c | 42 +++++++++++++++- drivers/block/brd.c | 103 +++++++++++++++++---------------------- drivers/block/loop.c | 26 +++++----- drivers/block/nbd.c | 60 ++++++++++------------- drivers/mtd/ubi/block.c | 76 ++++++++++++++--------------- drivers/nvme/host/core.c | 41 ++++++++-------- drivers/scsi/sd.c | 8 ++- drivers/scsi/sr.c | 7 ++- 11 files changed, 246 insertions(+), 171 deletions(-) -- 2.39.2

1 22

[PATCH OLK-5.10 v3 00/22] Add error handle for driver
by Li Nan 10 Nov '23

10 Nov '23

Christoph Hellwig (9): block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Li Lingfeng (1): nbd: fix uaf in nbd_open Luis Chamberlain (7): loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sd: Add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Zhong Jinghua (3): scsi: sd: Clean up sdkp if device_add_disk() failed mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup include/linux/blk-mq.h | 12 +++++ include/linux/genhd.h | 23 +++++++++ block/blk-mq.c | 19 ++++++++ block/genhd.c | 42 +++++++++++++++- drivers/block/brd.c | 103 +++++++++++++++++---------------------- drivers/block/loop.c | 26 +++++----- drivers/block/nbd.c | 60 ++++++++++------------- drivers/mtd/ubi/block.c | 76 ++++++++++++++--------------- drivers/nvme/host/core.c | 41 ++++++++-------- drivers/scsi/sd.c | 8 ++- drivers/scsi/sr.c | 7 ++- 11 files changed, 246 insertions(+), 171 deletions(-) -- 2.39.2

1 22

openEuler Kernel SIG 双周例会
by openEuler conference 10 Nov '23

10 Nov '23

您好！ Kernel SIG 邀请您参加 2023-11-24 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG 双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复邮件申请，也可直接填至会议看板）会议链接：https://bmeeting.huaweicloud.com:36443/#/j/963265866 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the WeLink conference(auto recording) will be held at 2023-11-24 14:00, The subject of the conference is openEuler Kernel SIG 双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复邮件申请，也可直接填至会议看板） You can join the meeting at https://bmeeting.huaweicloud.com:36443/#/j/963265866. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-22.03-LTS 00/22] Add error handle for add_disk
by Li Nan 09 Nov '23

09 Nov '23

To make applying the mainline patch easier, reorder the nbd commit about the first_minor check here. Christoph Hellwig (5): block: fold register_disk into device_add_disk block: call blk_integrity_add earlier in device_add_disk block: add the events* attributes to disk_attrs block: fix error unwinding in device_add_disk block: clear ->slave_dir when dropping the main slave_dir reference Luis Chamberlain (4): block: return errors from blk_integrity_add block: return errors from disk_alloc_events block: add error handling for device_add_disk / add_disk block: fix device_add_disk() kobject_create_and_add() error handling Tetsuo Handa (1): block: check minor range in device_add_disk() Wen Yang (1): Revert "Revert "block: nbd: add sanity check for first_minor"" Yu Kuai (3): nbd: fix max value for 'first_minor' nbd: fix possible overflow for 'first_minor' in nbd_dev_add() block: fix memory leak for elevator on add_disk failure Zhang Wensheng (1): nbd: fix possible overflow on 'first_minor' in nbd_dev_add() Zhong Jinghua (7): nbd: Reorganize the messy commit log about the first_minor check block: return errors from blk_register_region block: Fix the kabi change in device_add_disk block: Fix the kabi change on blk_register_region block: call blk_get_queue earlier in __device_add_disk block: Fix minor range check in device_add_disk() block: Set memalloc_noio to false in the error path block/blk.h | 5 +- include/linux/genhd.h | 13 +++ block/blk-integrity.c | 12 ++- block/genhd.c | 246 +++++++++++++++++++++++++----------------- drivers/block/nbd.c | 15 +-- 5 files changed, 175 insertions(+), 116 deletions(-) -- 2.39.2

2 23

[PATCH OLK-5.10 v2 00/20] Add error handle for driver
by Li Nan 09 Nov '23

09 Nov '23

Christoph Hellwig (9): block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Li Lingfeng (1): nbd: fix uaf in nbd_open Luis Chamberlain (6): loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Zhong Jinghua (2): mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup include/linux/blk-mq.h | 12 +++++ include/linux/genhd.h | 23 +++++++++ block/blk-mq.c | 19 ++++++++ block/genhd.c | 42 +++++++++++++++- drivers/block/brd.c | 103 +++++++++++++++++---------------------- drivers/block/loop.c | 26 +++++----- drivers/block/nbd.c | 60 ++++++++++------------- drivers/mtd/ubi/block.c | 76 ++++++++++++++--------------- drivers/nvme/host/core.c | 41 ++++++++-------- drivers/scsi/sr.c | 7 ++- 10 files changed, 239 insertions(+), 170 deletions(-) -- 2.39.2

2 21

[PATCH OLK-5.10] arm64: config: Disable CONFIG_ARM64_PBHA by default
by Wupeng Ma 09 Nov '23

09 Nov '23

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7ZC0H -------------------------------- Disable feature PBHA for arm64 by default. Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index aa12c2a7ebaa..ea2452d5576d 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -479,7 +479,7 @@ CONFIG_ARM64_VHE=y CONFIG_ARM64_PMEM=y CONFIG_ARM64_RAS_EXTN=y CONFIG_ARM64_CNP=y -CONFIG_ARM64_PBHA=y +# CONFIG_ARM64_PBHA is not set # end of ARMv8.2 architectural features # -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] Fix memleak in disassociate_ctty()
by Yi Yang 09 Nov '23

09 Nov '23

Fix it by revert hulk patch and backport patch from mainline. Yi Yang (2): Revert "tty: fix pid memleak in disassociate_ctty()" tty: tty_jobctrl: fix pid memleak in disassociate_ctty() drivers/tty/tty_jobctrl.c | 29 +++++++++++------------------ 1 file changed, 11 insertions(+), 18 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] Fix memleak in disassociate_ctty()
by Yi Yang 09 Nov '23

09 Nov '23

Fix it by revert hulk patch and backport patch from mainline. Yi Yang (2): Revert "tty: fix pid memleak in disassociate_ctty()" tty: tty_jobctrl: fix pid memleak in disassociate_ctty() drivers/tty/tty_jobctrl.c | 29 +++++++++++------------------ 1 file changed, 11 insertions(+), 18 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 00/20] Add error handle for driver
by Li Nan 09 Nov '23

09 Nov '23

Christoph Hellwig (9): block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Li Lingfeng (1): nbd: fix uaf in nbd_open Luis Chamberlain (6): loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Zhong Jinghua (2): mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup include/linux/blk-mq.h | 12 +++++ include/linux/genhd.h | 23 +++++++++ block/blk-mq.c | 19 ++++++++ block/genhd.c | 42 +++++++++++++++- drivers/block/brd.c | 103 +++++++++++++++++---------------------- drivers/block/loop.c | 26 +++++----- drivers/block/nbd.c | 60 ++++++++++------------- drivers/mtd/ubi/block.c | 76 ++++++++++++++--------------- drivers/nvme/host/core.c | 41 ++++++++-------- drivers/scsi/sr.c | 7 ++- 10 files changed, 239 insertions(+), 170 deletions(-) -- 2.39.2

2 21

[PATCH openEuler-1.0-LTS v4 0/3] bugfix for CVE-2022-45884
by liwei 09 Nov '23

09 Nov '23

bugfix for CVE-2022-45884 Dinghao Liu (1): media: dvbdev: Fix memleak in dvb_register_device Fuqian Huang (1): media: media/dvb: Use kmemdup rather than duplicating its implementation Hyunwoo Kim (1): media: dvb-core: Fix use-after-free due to race at dvb_register_device() drivers/media/dvb-core/dvbdev.c | 86 ++++++++++++++++----- drivers/media/dvb-frontends/drx39xyj/drxj.c | 5 +- include/media/dvbdev.h | 15 ++++ 3 files changed, 82 insertions(+), 24 deletions(-) -- 2.25.1

2 4

openEuler Kernel SIG双周例会
by openEuler conference 09 Nov '23

09 Nov '23

您好！ Kernel SIG 邀请您参加 2023-11-10 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 内容征集中（议题申报可回复邮件，或直接填入会议看板）会议链接：https://us06web.zoom.us/j/87016190729?pwd=QXivFoXObEngRNR23faQCqS1XGbrs3.1 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-11-10 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 内容征集中（议题申报可回复邮件，或直接填入会议看板） You can join the meeting at https://us06web.zoom.us/j/87016190729?pwd=QXivFoXObEngRNR23faQCqS1XGbrs3.1. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] sched/fair: Refill bandwidth before scaling
by Xia Fukun 08 Nov '23

08 Nov '23

From: Huaixin Chang <changhuaixin(a)linux.alibaba.com> mainline inclusion from mainline-v6.5-rc7 commit 5a6d6a6ccb5f48ca8cf7c6d64ff83fd9c7999390 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8EUCE CVE: NA -------------------------------- In order to prevent possible hardlockup of sched_cfs_period_timer() loop, loop count is introduced to denote whether to scale quota and period or not. However, scale is done between forwarding period timer and refilling cfs bandwidth runtime, which means that period timer is forwarded with old "period" while runtime is refilled with scaled "quota". Move do_sched_cfs_period_timer() before scaling to solve this. Fixes: 2e8e19226398 ("sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup") Signed-off-by: Huaixin Chang <changhuaixin(a)linux.alibaba.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Ben Segall <bsegall(a)google.com> Reviewed-by: Phil Auld <pauld(a)redhat.com> Link: https://lkml.kernel.org/r/20200420024421.22442-3-changhuaixin@linux.alibaba… Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/sched/fair.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 1c78e2f29901..ccd2a060c2df 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -5099,6 +5099,8 @@ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer) if (!overrun) break; + idle = do_sched_cfs_period_timer(cfs_b, overrun, flags); + if (++count > 3) { u64 new, old = ktime_to_ns(cfs_b->period); @@ -5128,8 +5130,6 @@ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer) /* reset count so we don't come right back in here */ count = 0; } - - idle = do_sched_cfs_period_timer(cfs_b, overrun, flags); } if (idle) cfs_b->period_active = 0; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] signal: Properly set TRACE_SIGNAL_LOSE_INFO in __send_signal
by Xia Fukun 08 Nov '23

08 Nov '23

From: "Eric W. Biederman" <ebiederm(a)xmission.com> mainline inclusion from mainline-v6.5-rc7 commit 8917bef336f5301edd616cfa97b97d0319fd0496 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8ETTA CVE: NA -------------------------------- Any time siginfo is not stored in the signal queue information is lost. Therefore set TRACE_SIGNAL_LOSE_INFO every time the code does not allocate a signal queue entry, and a queue overflow abort is not triggered. Fixes: ba005e1f4172 ("tracepoint: Add signal loss events") Signed-off-by: "Eric W. Biederman" <ebiederm(a)xmission.com> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/signal.c | 33 ++++++++++++++++----------------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/kernel/signal.c b/kernel/signal.c index 69b9d8bff5a8..4166d22645f8 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -1163,23 +1163,22 @@ static int __send_signal(int sig, struct siginfo *info, struct task_struct *t, userns_fixup_signal_uid(&q->info, t); - } else if (!is_si_special(info)) { - if (sig >= SIGRTMIN && info->si_code != SI_USER) { - /* - * Queue overflow, abort. We may abort if the - * signal was rt and sent by user using something - * other than kill(). - */ - result = TRACE_SIGNAL_OVERFLOW_FAIL; - ret = -EAGAIN; - goto ret; - } else { - /* - * This is a silent loss of information. We still - * send the signal, but the *info bits are lost. - */ - result = TRACE_SIGNAL_LOSE_INFO; - } + } else if (!is_si_special(info) && + sig >= SIGRTMIN && info->si_code != SI_USER) { + /* + * Queue overflow, abort. We may abort if the + * signal was rt and sent by user using something + * other than kill(). + */ + result = TRACE_SIGNAL_OVERFLOW_FAIL; + ret = -EAGAIN; + goto ret; + } else { + /* + * This is a silent loss of information. We still + * send the signal, but the *info bits are lost. + */ + result = TRACE_SIGNAL_LOSE_INFO; } out_set: -- 2.34.1

2 1

[PATCH OLK-5.10 0/9] handle uninitialized numa nodes gracefully.
by Wupeng Ma 08 Nov '23

08 Nov '23

From: Ma Wupeng <mawupeng1(a)huawei.com> handle uninitialized numa nodes gracefully. Haifeng Xu (1): mm/memcontrol: do not tweak node in mem_cgroup_init() Michal Hocko (5): mm, memory_hotplug: make arch_alloc_nodedata independent on CONFIG_MEMORY_HOTPLUG mm: handle uninitialized numa nodes gracefully mm, memory_hotplug: drop arch_free_nodedata mm, memory_hotplug: reorganize new pgdat initialization mm: make free_area_init_node aware of memory less nodes Oscar Salvador (1): arch/x86/mm/numa: Do not initialize nodes twice Srikar Dronamraju (1): powerpc/numa: Handle partially initialized numa nodes Wei Yang (1): memcg: do not tweak node in alloc_mem_cgroup_per_node_info arch/ia64/mm/discontig.c | 11 +-- arch/powerpc/mm/numa.c | 2 +- arch/x86/mm/numa.c | 33 +++++---- include/linux/memory_hotplug.h | 118 ++++++++++++++++----------------- include/linux/mm.h | 1 - mm/internal.h | 2 + mm/memcontrol.c | 17 +---- mm/memory_hotplug.c | 55 +++------------ mm/page_alloc.c | 78 +++++++++++++++++++--- 9 files changed, 163 insertions(+), 154 deletions(-) -- 2.25.1

2 10

[PATCH OLK-5.10 v6 00/10] AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device
by Qian Zou 08 Nov '23

08 Nov '23

Some use-cases, such as system management, require the ability to generate a non-maskable event to the OS to request the OS kernel to perform a diagnostic dump and reset the system. Arm Generic Diagnostic Dump and Reset device enables a maintainer to request OS to perform a diagnostic dump and reset a system via SDEI event or an interrupt. This patch implements SDEI path and discards the interrupted context before proceeding to the crash kernel. D Scott Phillips (1): arm64: sdei: abort running SDEI handlers during crash Ilkka Koskinen (4): ACPI: tables: Add AGDI to the list of known table signatures ACPI: AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device ACPICA: iASL: Add suppport for AGDI table ACPI: AGDI: Fix missing prototype warning for acpi_agdi_init() Jia He (3): EDAC/ghes: Add a notifier for reporting memory errors EDAC/ghes: Prepare to make ghes_edac a proper module EDAC/ghes: Make ghes_edac a proper module Li Yang (1): APEI: GHES: correctly return NULL for ghes_get_devices() Shuai Xue (1): ACPI: APEI: explicit init of HEST and GHES in apci_init() arch/arm64/include/asm/sdei.h | 6 ++ arch/arm64/kernel/entry.S | 27 +++++++- arch/arm64/kernel/sdei.c | 3 + arch/arm64/kernel/smp.c | 8 +-- drivers/acpi/apei/ghes.c | 85 ++++++++++++++++++++---- drivers/acpi/arm64/Kconfig | 10 +++ drivers/acpi/arm64/Makefile | 1 + drivers/acpi/arm64/agdi.c | 117 ++++++++++++++++++++++++++++++++++ drivers/acpi/bus.c | 4 ++ drivers/acpi/pci_root.c | 3 - drivers/acpi/tables.c | 2 +- drivers/edac/Kconfig | 4 +- drivers/edac/ghes_edac.c | 90 ++++++++++++++++---------- drivers/firmware/Kconfig | 1 + drivers/firmware/arm_sdei.c | 32 ++++++---- include/acpi/actbl2.h | 20 ++++++ include/acpi/apei.h | 4 +- include/acpi/ghes.h | 34 +++------- include/linux/acpi_agdi.h | 13 ++++ include/linux/arm_sdei.h | 4 ++ 20 files changed, 371 insertions(+), 97 deletions(-) create mode 100644 drivers/acpi/arm64/agdi.c create mode 100644 include/linux/acpi_agdi.h -- 2.33.0

2 11

[PATCH v3 OLK-5.10 00/24] arm64/perf: Enable branch stack sampling
by Junhao He 08 Nov '23

08 Nov '23

This series enables perf branch stack sampling support on arm64 platform via a new arch feature called Branch Record Buffer Extension (BRBE). All relevant register definitions could be accessed here. v2-v3: - Remove indentation before macro #ifdef v1-v2: - Fix kabi breakage in struct perf_branch_entry Anshuman Khandual (16): perf tools: Add missing branch_sample_type to perf_event_attr__fprintf() perf: Add irq and exception return branch types perf: Add system error and not in transaction branch types perf: Extend branch type classification perf: Capture branch privilege information perf: Add PERF_BR_NEW_ARCH_[N] map for BRBE on arm64 platform perf branch: Add system error and not in transaction branch types perf branch: Extend branch type classification perf branch: Add branch privilege information request flag perf branch: Add PERF_BR_NEW_ARCH_[N] map for BRBE on arm64 platform perf: Consolidate branch sample filter helpers perf record: Add remaining branch filters: "no_cycles", "no_flags" & "hw_index" arm64/sysreg: Add BRBE registers and fields drivers: perf: arm_pmu: Add new sched_task() callback drivers: perf: arm_pmuv3: Enable branch stack sampling framework drivers: perf: arm_pmuv3: Enable branch stack sampling via FEAT_BRBE James Clark (5): perf evsel: Add error message for unsupported branch stack cases perf session: Print branch stack entry type in --dump-raw-trace perf script: Refactor branch stack printing perf script: Output branch sample type perf branch: Fix interpretation of branch records Junhao He (1): perf: Fix kabi breakage in struct perf_branch_entry Mark Brown (1): arm64/sysreg: Introduce helpers for access to sysreg fields Sandipan Das (1): perf/core: Add speculation info to branch entries arch/arm64/include/asm/perf_event.h | 56 ++ arch/arm64/include/asm/sysreg.h | 511 ++++++++++++++ arch/arm64/kernel/head.S | 48 ++ arch/arm64/kernel/perf_event.c | 90 ++- arch/x86/events/intel/lbr.c | 4 +- drivers/perf/Kconfig | 11 + drivers/perf/Makefile | 1 + drivers/perf/arm_brbe.c | 779 ++++++++++++++++++++++ drivers/perf/arm_brbe.h | 258 +++++++ drivers/perf/arm_pmu.c | 34 +- include/linux/perf/arm_pmu.h | 28 +- include/linux/perf_event.h | 27 + include/uapi/linux/perf_event.h | 53 ++ kernel/events/core.c | 9 +- tools/include/uapi/linux/perf_event.h | 38 +- tools/perf/builtin-script.c | 28 +- tools/perf/util/branch.c | 72 +- tools/perf/util/branch.h | 8 +- tools/perf/util/evsel.c | 4 + tools/perf/util/parse-branch-options.c | 4 + tools/perf/util/perf_event_attr_fprintf.c | 2 +- tools/perf/util/session.c | 5 +- 22 files changed, 2035 insertions(+), 35 deletions(-) create mode 100644 drivers/perf/arm_brbe.c create mode 100644 drivers/perf/arm_brbe.h -- 2.33.0

2 25

[PATCH v4 openEuler-1.0-LTS 0/3] handle uninitialized numa nodes gracefully.
by Wupeng Ma 08 Nov '23

08 Nov '23

From: Ma Wupeng <mawupeng1(a)huawei.com> handle uninitialized numa nodes gracefully. Michal Hocko (2): mm, memory_hotplug: make arch_alloc_nodedata independent on CONFIG_MEMORY_HOTPLUG mm: handle uninitialized numa nodes gracefully Oscar Salvador (1): arch/x86/mm/numa: Do not initialize nodes twice arch/ia64/mm/discontig.c | 6 +- arch/x86/mm/numa.c | 26 +++---- include/linux/memory_hotplug.h | 120 ++++++++++++++++----------------- mm/internal.h | 2 + mm/memory_hotplug.c | 24 +++---- mm/page_alloc.c | 45 +++++++++++-- 6 files changed, 123 insertions(+), 100 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 v6 00/10] AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device
by Qian Zou 08 Nov '23

08 Nov '23

Some use-cases, such as system management, require the ability to generate a non-maskable event to the OS to request the OS kernel to perform a diagnostic dump and reset the system. Arm Generic Diagnostic Dump and Reset device enables a maintainer to request OS to perform a diagnostic dump and reset a system via SDEI event or an interrupt. This patch implements SDEI path and discards the interrupted context before proceeding to the crash kernel. D Scott Phillips (1): arm64: sdei: abort running SDEI handlers during crash Ilkka Koskinen (4): ACPI: tables: Add AGDI to the list of known table signatures ACPI: AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device ACPICA: iASL: Add suppport for AGDI table ACPI: AGDI: Fix missing prototype warning for acpi_agdi_init() Jia He (3): EDAC/ghes: Add a notifier for reporting memory errors EDAC/ghes: Prepare to make ghes_edac a proper module EDAC/ghes: Make ghes_edac a proper module Li Yang (1): APEI: GHES: correctly return NULL for ghes_get_devices() Shuai Xue (1): ACPI: APEI: explicit init of HEST and GHES in apci_init() arch/arm64/include/asm/sdei.h | 6 ++ arch/arm64/kernel/entry.S | 27 +++++++- arch/arm64/kernel/sdei.c | 3 + arch/arm64/kernel/smp.c | 8 +-- drivers/acpi/apei/ghes.c | 85 ++++++++++++++++++++---- drivers/acpi/arm64/Kconfig | 10 +++ drivers/acpi/arm64/Makefile | 1 + drivers/acpi/arm64/agdi.c | 117 ++++++++++++++++++++++++++++++++++ drivers/acpi/bus.c | 4 ++ drivers/acpi/pci_root.c | 3 - drivers/acpi/tables.c | 2 +- drivers/edac/Kconfig | 4 +- drivers/edac/ghes_edac.c | 90 ++++++++++++++++---------- drivers/firmware/Kconfig | 1 + drivers/firmware/arm_sdei.c | 32 ++++++---- include/acpi/actbl2.h | 20 ++++++ include/acpi/apei.h | 4 +- include/acpi/ghes.h | 34 +++------- include/linux/acpi_agdi.h | 13 ++++ include/linux/arm_sdei.h | 4 ++ 20 files changed, 371 insertions(+), 97 deletions(-) create mode 100644 drivers/acpi/arm64/agdi.c create mode 100644 include/linux/acpi_agdi.h -- 2.33.0

1 9

[PATCH OLK-5.10 v5 0/9] AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device
by Qian Zou 08 Nov '23

08 Nov '23

From: “z00447436” <zouqian4(a)huawei.com> Some use-cases, such as system management, require the ability to generate a non-maskable event to the OS to request the OS kernel to perform a diagnostic dump and reset the system. Arm Generic Diagnostic Dump and Reset device enables a maintainer to request OS to perform a diagnostic dump and reset a system via SDEI event or an interrupt. This patch implements SDEI path and discards the interrupted context before proceeding to the crash kernel. D Scott Phillips (1): arm64: sdei: abort running SDEI handlers during crash Ilkka Koskinen (4): ACPI: tables: Add AGDI to the list of known table signatures ACPI: AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device ACPICA: iASL: Add suppport for AGDI table ACPI: AGDI: Fix missing prototype warning for acpi_agdi_init() Jia He (3): EDAC/ghes: Add a notifier for reporting memory errors EDAC/ghes: Prepare to make ghes_edac a proper module EDAC/ghes: Make ghes_edac a proper module Shuai Xue (1): ACPI: APEI: explicit init of HEST and GHES in apci_init() arch/arm64/include/asm/sdei.h | 6 ++ arch/arm64/kernel/entry.S | 27 +++++++- arch/arm64/kernel/sdei.c | 3 + arch/arm64/kernel/smp.c | 8 +-- drivers/acpi/apei/ghes.c | 83 ++++++++++++++++++++---- drivers/acpi/arm64/Kconfig | 10 +++ drivers/acpi/arm64/Makefile | 1 + drivers/acpi/arm64/agdi.c | 117 ++++++++++++++++++++++++++++++++++ drivers/acpi/bus.c | 4 ++ drivers/acpi/pci_root.c | 3 - drivers/acpi/tables.c | 2 +- drivers/edac/Kconfig | 4 +- drivers/edac/ghes_edac.c | 90 ++++++++++++++++---------- drivers/firmware/Kconfig | 1 + drivers/firmware/arm_sdei.c | 32 ++++++---- include/acpi/actbl2.h | 20 ++++++ include/acpi/apei.h | 4 +- include/acpi/ghes.h | 34 +++------- include/linux/acpi_agdi.h | 13 ++++ include/linux/arm_sdei.h | 4 ++ 20 files changed, 369 insertions(+), 97 deletions(-) create mode 100644 drivers/acpi/arm64/agdi.c create mode 100644 include/linux/acpi_agdi.h -- 2.33.0

2 10

[PATCH v2 OLK-5.10 00/24] arm64/perf: Enable branch stack sampling
by Junhao He 07 Nov '23

07 Nov '23

This series enables perf branch stack sampling support on arm64 platform via a new arch feature called Branch Record Buffer Extension (BRBE). All relevant register definitions could be accessed here. Anshuman Khandual (16): perf tools: Add missing branch_sample_type to perf_event_attr__fprintf() perf: Add irq and exception return branch types perf: Add system error and not in transaction branch types perf: Extend branch type classification perf: Capture branch privilege information perf: Add PERF_BR_NEW_ARCH_[N] map for BRBE on arm64 platform perf branch: Add system error and not in transaction branch types perf branch: Extend branch type classification perf branch: Add branch privilege information request flag perf branch: Add PERF_BR_NEW_ARCH_[N] map for BRBE on arm64 platform perf: Consolidate branch sample filter helpers perf record: Add remaining branch filters: "no_cycles", "no_flags" & "hw_index" arm64/sysreg: Add BRBE registers and fields drivers: perf: arm_pmu: Add new sched_task() callback drivers: perf: arm_pmuv3: Enable branch stack sampling framework drivers: perf: arm_pmuv3: Enable branch stack sampling via FEAT_BRBE James Clark (5): perf evsel: Add error message for unsupported branch stack cases perf session: Print branch stack entry type in --dump-raw-trace perf script: Refactor branch stack printing perf script: Output branch sample type perf branch: Fix interpretation of branch records Junhao He (1): perf: Fix kabi breakage in struct perf_branch_entry Mark Brown (1): arm64/sysreg: Introduce helpers for access to sysreg fields Sandipan Das (1): perf/core: Add speculation info to branch entries arch/arm64/include/asm/perf_event.h | 56 ++ arch/arm64/include/asm/sysreg.h | 511 ++++++++++++++ arch/arm64/kernel/head.S | 48 ++ arch/arm64/kernel/perf_event.c | 90 ++- arch/x86/events/intel/lbr.c | 4 +- drivers/perf/Kconfig | 11 + drivers/perf/Makefile | 1 + drivers/perf/arm_brbe.c | 779 ++++++++++++++++++++++ drivers/perf/arm_brbe.h | 258 +++++++ drivers/perf/arm_pmu.c | 34 +- include/linux/perf/arm_pmu.h | 28 +- include/linux/perf_event.h | 27 + include/uapi/linux/perf_event.h | 53 ++ kernel/events/core.c | 9 +- tools/include/uapi/linux/perf_event.h | 38 +- tools/perf/builtin-script.c | 28 +- tools/perf/util/branch.c | 72 +- tools/perf/util/branch.h | 8 +- tools/perf/util/evsel.c | 4 + tools/perf/util/parse-branch-options.c | 4 + tools/perf/util/perf_event_attr_fprintf.c | 2 +- tools/perf/util/session.c | 5 +- 22 files changed, 2035 insertions(+), 35 deletions(-) create mode 100644 drivers/perf/arm_brbe.c create mode 100644 drivers/perf/arm_brbe.h -- 2.33.0

2 25

2023年度openEuler社区优秀贡献者奖评选启动，欢迎大家参加
by openEuler 07 Nov '23

07 Nov '23

1 0

[PATCH v3 openEuler-1.0-LTS 0/3] handle uninitialized numa nodes gracefully
by Wupeng Ma 07 Nov '23

07 Nov '23

From: Ma Wupeng <mawupeng1(a)huawei.com> handle uninitialized numa nodes gracefully. Changelog since v2: - fix compile error. Changelog since v1: - add bugfix patch #3. Michal Hocko (2): mm, memory_hotplug: make arch_alloc_nodedata independent on CONFIG_MEMORY_HOTPLUG mm: handle uninitialized numa nodes gracefully Oscar Salvador (1): arch/x86/mm/numa: Do not initialize nodes twice arch/ia64/mm/discontig.c | 6 +- arch/x86/mm/numa.c | 26 +++---- include/linux/memory_hotplug.h | 120 ++++++++++++++++----------------- mm/internal.h | 2 + mm/memory_hotplug.c | 24 +++---- mm/page_alloc.c | 45 +++++++++++-- 6 files changed, 123 insertions(+), 100 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 v2 00/22] Add error handle for add_disk
by Li Nan 07 Nov '23

07 Nov '23

To make applying the mainline patch easier, reorder the nbd commit about the first_minor check here. Christoph Hellwig (5): block: fold register_disk into device_add_disk block: call blk_integrity_add earlier in device_add_disk block: add the events* attributes to disk_attrs block: fix error unwinding in device_add_disk block: clear ->slave_dir when dropping the main slave_dir reference Luis Chamberlain (4): block: return errors from blk_integrity_add block: return errors from disk_alloc_events block: add error handling for device_add_disk / add_disk block: fix device_add_disk() kobject_create_and_add() error handling Tetsuo Handa (1): block: check minor range in device_add_disk() Wen Yang (1): Revert "Revert "block: nbd: add sanity check for first_minor"" Yu Kuai (3): nbd: fix max value for 'first_minor' nbd: fix possible overflow for 'first_minor' in nbd_dev_add() block: fix memory leak for elevator on add_disk failure Zhang Wensheng (1): nbd: fix possible overflow on 'first_minor' in nbd_dev_add() Zhong Jinghua (7): nbd: Reorganize the messy commit log about the first_minor check block: return errors from blk_register_region block: Fix the kabi change in device_add_disk block: Fix the kabi change on blk_register_region block: call blk_get_queue earlier in __device_add_disk block: Fix minor range check in device_add_disk() block: Set memalloc_noio to false in the error path block/blk.h | 5 +- include/linux/genhd.h | 13 +++ block/blk-integrity.c | 12 ++- block/genhd.c | 246 +++++++++++++++++++++++++----------------- drivers/block/nbd.c | 15 +-- 5 files changed, 175 insertions(+), 116 deletions(-) -- 2.39.2

2 23

[PATCH OLK-5.10 v2 0/2] cpufreq: Abort show()/store() for half-initialized policies
by Jinjie Ruan 07 Nov '23

07 Nov '23

Fix cpu offline but cat scaling_cur_freq is the same as online bug. Schspa Shi (2): cpufreq: Abort show()/store() for half-initialized policies cpufreq: make interface functions and lock holding state clear drivers/cpufreq/cpufreq.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS v2 0/2] cpufreq: Abort show()/store() for half-initialized policies
by Jinjie Ruan 07 Nov '23

07 Nov '23

Fix cpu offline but cat scaling_cur_freq is the same as online bug. Changes in v2: - Fix the CHECKPATCH warnings. Schspa Shi (2): cpufreq: Abort show()/store() for half-initialized policies cpufreq: make interface functions and lock holding state clear drivers/cpufreq/cpufreq.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] cpufreq: Abort show()/store() for half-initialized policies
by Jinjie Ruan 07 Nov '23

07 Nov '23

Fix cpu offline but cat scaling_cur_freq is the same as online bug. Schspa Shi (2): cpufreq: Abort show()/store() for half-initialized policies cpufreq: make interface functions and lock holding state clear drivers/cpufreq/cpufreq.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] cpufreq: Abort show()/store() for half-initialized policies
by Jinjie Ruan 07 Nov '23

07 Nov '23

Fix cpu offline but cat scaling_cur_freq is the same as online bug. Schspa Shi (2): cpufreq: Abort show()/store() for half-initialized policies cpufreq: make interface functions and lock holding state clear drivers/cpufreq/cpufreq.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) -- 2.34.1

2 3

[PATCH v2 openEuler-1.0-LTS 0/3] handle uninitialized numa nodes gracefully
by Wupeng Ma 07 Nov '23

07 Nov '23

From: Ma Wupeng <mawupeng1(a)huawei.com> handle uninitialized numa nodes gracefully. Changelog since v1: - add bugfix patch #3. Michal Hocko (2): mm, memory_hotplug: make arch_alloc_nodedata independent on CONFIG_MEMORY_HOTPLUG mm: handle uninitialized numa nodes gracefully Oscar Salvador (1): arch/x86/mm/numa: Do not initialize nodes twice arch/ia64/mm/discontig.c | 6 +- arch/x86/mm/numa.c | 26 +++---- include/linux/memory_hotplug.h | 120 ++++++++++++++++----------------- mm/internal.h | 2 + mm/memory_hotplug.c | 24 +++---- mm/page_alloc.c | 45 +++++++++++-- 6 files changed, 123 insertions(+), 100 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 v3] blk-mq: avoid housekeeping CPUs scheduling a worker on a non-housekeeping CPU
by Xiongfeng Wang 07 Nov '23

07 Nov '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7ZBTV CVE: N/A ---------------------------------------------------- When NOHZ_FULL is enabled, such as in HPC situation, CPUs are divided into housekeeping CPUs and non-housekeeping CPUs. Non-housekeeping CPUs are NOHZ_FULL CPUs and are often monopolized by the userspace process, such HPC application process. Any sort of interruption is not expected. blk_mq_hctx_next_cpu() selects each cpu in 'hctx->cpumask' alternately to schedule the work thread blk_mq_run_work_fn(). When 'hctx->cpumask' contains housekeeping CPU and non-housekeeping CPU at the same time, a housekeeping CPU, which want to request a IO, may schedule a worker on a non-housekeeping CPU. This may affect the performance of the userspace application running on non-housekeeping CPUs. So let's just schedule the worker thread on the current CPU when the current CPU is housekeeping CPU. Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- block/blk-mq.c | 12 +++++++++++- include/linux/sched/isolation.h | 2 ++ kernel/sched/isolation.c | 8 ++++++++ 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 1d1200afb771..3245809453b8 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -23,6 +23,9 @@ #include <linux/sched/sysctl.h> #include <linux/sched/topology.h> #include <linux/sched/signal.h> +#ifndef __GENKSYMS__ +#include <linux/sched/isolation.h> +#endif #include <linux/delay.h> #include <linux/crash_dump.h> #include <linux/prefetch.h> @@ -1676,6 +1679,8 @@ static int blk_mq_hctx_next_cpu(struct blk_mq_hw_ctx *hctx) static void __blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async, unsigned long msecs) { + int work_cpu; + if (unlikely(blk_mq_hctx_stopped(hctx))) return; @@ -1697,7 +1702,12 @@ static void __blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async, if (!percpu_ref_tryget(&hctx->queue->q_usage_counter)) return; - kblockd_mod_delayed_work_on(blk_mq_hctx_next_cpu(hctx), &hctx->run_work, + if (enhanced_isolcpus && tick_nohz_full_enabled() && + housekeeping_cpu(raw_smp_processor_id(), HK_FLAG_WQ)) + work_cpu = raw_smp_processor_id(); + else + work_cpu = blk_mq_hctx_next_cpu(hctx); + kblockd_mod_delayed_work_on(work_cpu, &hctx->run_work, msecs_to_jiffies(msecs)); percpu_ref_put(&hctx->queue->q_usage_counter); } diff --git a/include/linux/sched/isolation.h b/include/linux/sched/isolation.h index cc9f393e2a70..2f93081ad7a0 100644 --- a/include/linux/sched/isolation.h +++ b/include/linux/sched/isolation.h @@ -18,6 +18,7 @@ enum hk_flags { }; #ifdef CONFIG_CPU_ISOLATION +extern bool enhanced_isolcpus; DECLARE_STATIC_KEY_FALSE(housekeeping_overridden); extern int housekeeping_any_cpu(enum hk_flags flags); extern const struct cpumask *housekeeping_cpumask(enum hk_flags flags); @@ -28,6 +29,7 @@ extern void __init housekeeping_init(void); #else +#define enhanced_isolcpus 0 static inline int housekeeping_any_cpu(enum hk_flags flags) { return smp_processor_id(); diff --git a/kernel/sched/isolation.c b/kernel/sched/isolation.c index 5a6ea03f9882..785ef5201116 100644 --- a/kernel/sched/isolation.c +++ b/kernel/sched/isolation.c @@ -198,3 +198,11 @@ static int __init housekeeping_isolcpus_setup(char *str) return housekeeping_setup(str, flags); } __setup("isolcpus=", housekeeping_isolcpus_setup); + +bool enhanced_isolcpus; +static int __init enhanced_isolcpus_setup(char *str) +{ + enhanced_isolcpus = true; + return 0; +} +__setup("enhanced_isolcpus", enhanced_isolcpus_setup); -- 2.20.1

2 1

[PATCH OLK-5.10 00/67] backport SME feature from mainline
by Wang ShaoBo 07 Nov '23

07 Nov '23

From: w00502114 <bobo.shaobowang(a)huawei.com> backport SME feature from mainline Alexandru Elisei (1): arm64: Do not trap PMSNEVFR_EL1 Marc Zyngier (10): KVM: arm64: Let vcpu_sve_pffr() handle HYP VAs KVM: arm64: Provide KVM's own save/restore SVE primitives KVM: arm64: Use {read,write}_sysreg_el1 to access ZCR_EL1 KVM: arm64: Introduce vcpu_sve_vq() helper arm64: sve: Provide a conditional update accessor for ZCR_ELx KVM: arm64: Map SVE context at EL2 when available KVM: arm64: Rework SVE host-save/guest-restore KVM: arm64: Save guest's ZCR_EL1 before saving the FPSIMD state KVM: arm64: Save/restore SVE state for nVHE KVM: arm64: Always start with clearing SME flag on load Mark Brown (54): arm64/sve: Remove redundant system_supports_sve() tests arm64/sve: Add compile time checks for SVE hooks in generic functions arm64/sve: Rework SVE access trap to convert state in registers arm64/sve: Split _sve_flush macro into separate Z and predicate flushes arm64/sve: Skip flushing Z registers with 128 bit vectors arm64/sve: Use the sve_flush macros in sve_load_from_fpsimd_state() arm64/sve: Remove sve_load_from_fpsimd_state() arm64/sve: Better handle failure to allocate SVE register storage arm64/fp: Reindent fpsimd_save() arm64/sve: Make access to FFR optional arm64/sve: Rename find_supported_vector_length() arm64/sve: Use accessor functions for vector lengths in thread_struct arm64/sve: Put system wide vector length information into structs arm64/sve: Explicitly load vector length when restoring SVE state arm64/sve: Track vector lengths for tasks in an array arm64/sve: Make sysctl interface for SVE reusable by SME arm64/sve: Generalise vector length configuration prctl() for SME arm64/sve: Minor clarification of ABI documentation arm64: cpufeature: Always specify and use a field width for capabilities arm64/sme: Provide ABI documentation for SME arm64/sme: System register and exception syndrome definitions arm64/sme: Manually encode SME instructions arm64: Disable fine grained traps on boot arm64/sme: Early CPU setup for SME arm64/sme: Basic enumeration support arm64/sme: Identify supported SME vector lengths at boot arm64/sme: Implement sysctl to set the default vector length arm64/sme: Implement vector length configuration prctl()s arm64/sme: Implement support for TPIDR2 arm64/sme: Implement SVCR context switching arm64/sme: Implement streaming SVE context switching arm64/sme: Implement ZA context switching arm64/sme: Implement traps and syscall handling for SME arm64/sme: Disable ZA and streaming mode when handling signals arm64/sme: Implement streaming SVE signal handling arm64/sme: Implement ZA signal handling arm64/sme: Implement ptrace support for streaming mode SVE registers arm64/sme: Add ptrace support for ZA arm64/sme: Disable streaming mode and ZA when flushing CPU state arm64/sme: Save and restore streaming mode over EFI runtime calls arm64/sme: Provide Kconfig for SME arm64/sme: Add ID_AA64SMFR0_EL1 to __read_sysreg_by_encoding() arm64/sme: More sensibly define the size for the ZA register set KVM: arm64: Hide SME system registers from guests KVM: arm64: Trap SME usage in guest KVM: arm64: Handle SME host state when running guests arm64/fp: Make SVE and SME length register definition match architecture arm64/fp: Rename SVE and SME LEN field name to _WIDTH arm64/sme: Drop SYS_ from SMIDR_EL1 defines arm64/sme: Standardise bitfield names for SVCR arm64/sme: Remove _EL0 from name of SVCR - FIXME sysreg.h arm64/sme: Fix tests for 0b1111 value ID registers arm64/sme: Fix SVE/SME typo in ABI documentation arm64/sme: Fix EFI save/restore Wan Jiabing (1): arm64/sme: Fix NULL check after kzalloc Xiaofei Tan (1): arm64: sve: Provide sve_cond_update_zcr_vq fallback when !ARM64_SVE Documentation/arm64/elf_hwcaps.rst | 34 + Documentation/arm64/index.rst | 1 + Documentation/arm64/sme.rst | 428 ++++++++++ Documentation/arm64/sve.rst | 72 +- arch/arm64/Kconfig | 11 + arch/arm64/include/asm/cpu.h | 4 + arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/cpufeature.h | 25 + arch/arm64/include/asm/esr.h | 13 +- arch/arm64/include/asm/exception.h | 1 + arch/arm64/include/asm/fpsimd.h | 262 ++++++- arch/arm64/include/asm/fpsimdmacros.h | 108 ++- arch/arm64/include/asm/hwcap.h | 8 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 14 +- arch/arm64/include/asm/kvm_hyp.h | 2 + arch/arm64/include/asm/processor.h | 78 +- arch/arm64/include/asm/signal_common.h | 19 +- arch/arm64/include/asm/sysreg.h | 79 +- arch/arm64/include/asm/thread_info.h | 4 +- arch/arm64/include/uapi/asm/hwcap.h | 8 + arch/arm64/include/uapi/asm/ptrace.h | 69 +- arch/arm64/include/uapi/asm/sigcontext.h | 55 +- arch/arm64/kernel/cpufeature.c | 282 +++++-- arch/arm64/kernel/cpuinfo.c | 13 + arch/arm64/kernel/entry-common.c | 11 + arch/arm64/kernel/entry-fpsimd.S | 72 +- arch/arm64/kernel/fpsimd.c | 944 ++++++++++++++++++----- arch/arm64/kernel/head.S | 87 +++ arch/arm64/kernel/process.c | 45 +- arch/arm64/kernel/ptrace.c | 373 +++++++-- arch/arm64/kernel/signal.c | 175 ++++- arch/arm64/kernel/syscall.c | 29 +- arch/arm64/kernel/traps.c | 1 + arch/arm64/kvm/fpsimd.c | 70 +- arch/arm64/kvm/guest.c | 6 +- arch/arm64/kvm/hyp/fpsimd.S | 12 + arch/arm64/kvm/hyp/include/hyp/switch.h | 75 +- arch/arm64/kvm/hyp/nvhe/switch.c | 38 +- arch/arm64/kvm/hyp/vhe/switch.c | 10 +- arch/arm64/kvm/reset.c | 14 +- arch/arm64/kvm/sys_regs.c | 8 +- include/uapi/linux/elf.h | 2 + include/uapi/linux/prctl.h | 9 + kernel/sys.c | 12 + 45 files changed, 3126 insertions(+), 460 deletions(-) create mode 100644 Documentation/arm64/sme.rst -- 2.25.1

1 67

[PATCH OLK-5.10 00/23] arm64/perf: Enable branch stack sampling
by Junhao He 07 Nov '23

07 Nov '23

This series enables perf branch stack sampling support on arm64 platform via a new arch feature called Branch Record Buffer Extension (BRBE). All relevant register definitions could be accessed here. Anshuman Khandual (16): perf tools: Add missing branch_sample_type to perf_event_attr__fprintf() perf: Add irq and exception return branch types perf: Add system error and not in transaction branch types perf: Extend branch type classification perf: Capture branch privilege information perf: Add PERF_BR_NEW_ARCH_[N] map for BRBE on arm64 platform perf branch: Add system error and not in transaction branch types perf branch: Extend branch type classification perf branch: Add branch privilege information request flag perf branch: Add PERF_BR_NEW_ARCH_[N] map for BRBE on arm64 platform perf: Consolidate branch sample filter helpers perf record: Add remaining branch filters: "no_cycles", "no_flags" & "hw_index" arm64/sysreg: Add BRBE registers and fields drivers: perf: arm_pmu: Add new sched_task() callback drivers: perf: arm_pmuv3: Enable branch stack sampling framework drivers: perf: arm_pmuv3: Enable branch stack sampling via FEAT_BRBE James Clark (5): perf evsel: Add error message for unsupported branch stack cases perf session: Print branch stack entry type in --dump-raw-trace perf script: Refactor branch stack printing perf script: Output branch sample type perf branch: Fix interpretation of branch records Mark Brown (1): arm64/sysreg: Introduce helpers for access to sysreg fields Sandipan Das (1): perf/core: Add speculation info to branch entries Documentation/arch/arm64/brbe.rst | 145 ++++ arch/arm64/include/asm/perf_event.h | 60 ++ arch/arm64/include/asm/sysreg.h | 499 ++++++++++++++ arch/arm64/kernel/head.S | 48 ++ arch/arm64/kernel/perf_event.c | 90 ++- arch/x86/events/intel/lbr.c | 4 +- drivers/perf/Kconfig | 11 + drivers/perf/Makefile | 1 + drivers/perf/arm_brbe.c | 779 ++++++++++++++++++++++ drivers/perf/arm_brbe.h | 261 ++++++++ drivers/perf/arm_pmu.c | 34 +- include/linux/perf/arm_pmu.h | 28 +- include/linux/perf_event.h | 27 + include/uapi/linux/perf_event.h | 51 +- kernel/events/core.c | 9 +- tools/include/uapi/linux/perf_event.h | 38 +- tools/perf/builtin-script.c | 28 +- tools/perf/util/branch.c | 72 +- tools/perf/util/branch.h | 8 +- tools/perf/util/evsel.c | 4 + tools/perf/util/parse-branch-options.c | 4 + tools/perf/util/perf_event_attr_fprintf.c | 2 +- tools/perf/util/session.c | 5 +- 23 files changed, 2172 insertions(+), 36 deletions(-) create mode 100644 Documentation/arch/arm64/brbe.rst create mode 100644 drivers/perf/arm_brbe.c create mode 100644 drivers/perf/arm_brbe.h -- 2.33.0

2 24

[PATCH OLK-5.10 00/67] backport SME feature from mainline
by w00502114 07 Nov '23

07 Nov '23

backport SME feature from mainline Alexandru Elisei (1): arm64: Do not trap PMSNEVFR_EL1 Marc Zyngier (10): KVM: arm64: Let vcpu_sve_pffr() handle HYP VAs KVM: arm64: Provide KVM's own save/restore SVE primitives KVM: arm64: Use {read,write}_sysreg_el1 to access ZCR_EL1 KVM: arm64: Introduce vcpu_sve_vq() helper arm64: sve: Provide a conditional update accessor for ZCR_ELx KVM: arm64: Map SVE context at EL2 when available KVM: arm64: Rework SVE host-save/guest-restore KVM: arm64: Save guest's ZCR_EL1 before saving the FPSIMD state KVM: arm64: Save/restore SVE state for nVHE KVM: arm64: Always start with clearing SME flag on load Mark Brown (54): arm64/sve: Remove redundant system_supports_sve() tests arm64/sve: Add compile time checks for SVE hooks in generic functions arm64/sve: Rework SVE access trap to convert state in registers arm64/sve: Split _sve_flush macro into separate Z and predicate flushes arm64/sve: Skip flushing Z registers with 128 bit vectors arm64/sve: Use the sve_flush macros in sve_load_from_fpsimd_state() arm64/sve: Remove sve_load_from_fpsimd_state() arm64/sve: Better handle failure to allocate SVE register storage arm64/fp: Reindent fpsimd_save() arm64/sve: Make access to FFR optional arm64/sve: Rename find_supported_vector_length() arm64/sve: Use accessor functions for vector lengths in thread_struct arm64/sve: Put system wide vector length information into structs arm64/sve: Explicitly load vector length when restoring SVE state arm64/sve: Track vector lengths for tasks in an array arm64/sve: Make sysctl interface for SVE reusable by SME arm64/sve: Generalise vector length configuration prctl() for SME arm64/sve: Minor clarification of ABI documentation arm64: cpufeature: Always specify and use a field width for capabilities arm64/sme: Provide ABI documentation for SME arm64/sme: System register and exception syndrome definitions arm64/sme: Manually encode SME instructions arm64: Disable fine grained traps on boot arm64/sme: Early CPU setup for SME arm64/sme: Basic enumeration support arm64/sme: Identify supported SME vector lengths at boot arm64/sme: Implement sysctl to set the default vector length arm64/sme: Implement vector length configuration prctl()s arm64/sme: Implement support for TPIDR2 arm64/sme: Implement SVCR context switching arm64/sme: Implement streaming SVE context switching arm64/sme: Implement ZA context switching arm64/sme: Implement traps and syscall handling for SME arm64/sme: Disable ZA and streaming mode when handling signals arm64/sme: Implement streaming SVE signal handling arm64/sme: Implement ZA signal handling arm64/sme: Implement ptrace support for streaming mode SVE registers arm64/sme: Add ptrace support for ZA arm64/sme: Disable streaming mode and ZA when flushing CPU state arm64/sme: Save and restore streaming mode over EFI runtime calls arm64/sme: Provide Kconfig for SME arm64/sme: Add ID_AA64SMFR0_EL1 to __read_sysreg_by_encoding() arm64/sme: More sensibly define the size for the ZA register set KVM: arm64: Hide SME system registers from guests KVM: arm64: Trap SME usage in guest KVM: arm64: Handle SME host state when running guests arm64/fp: Make SVE and SME length register definition match architecture arm64/fp: Rename SVE and SME LEN field name to _WIDTH arm64/sme: Drop SYS_ from SMIDR_EL1 defines arm64/sme: Standardise bitfield names for SVCR arm64/sme: Remove _EL0 from name of SVCR - FIXME sysreg.h arm64/sme: Fix tests for 0b1111 value ID registers arm64/sme: Fix SVE/SME typo in ABI documentation arm64/sme: Fix EFI save/restore Wan Jiabing (1): arm64/sme: Fix NULL check after kzalloc Xiaofei Tan (1): arm64: sve: Provide sve_cond_update_zcr_vq fallback when !ARM64_SVE Documentation/arm64/elf_hwcaps.rst | 34 + Documentation/arm64/index.rst | 1 + Documentation/arm64/sme.rst | 428 ++++++++++ Documentation/arm64/sve.rst | 72 +- arch/arm64/Kconfig | 11 + arch/arm64/include/asm/cpu.h | 4 + arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/cpufeature.h | 25 + arch/arm64/include/asm/esr.h | 13 +- arch/arm64/include/asm/exception.h | 1 + arch/arm64/include/asm/fpsimd.h | 262 ++++++- arch/arm64/include/asm/fpsimdmacros.h | 108 ++- arch/arm64/include/asm/hwcap.h | 8 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 14 +- arch/arm64/include/asm/kvm_hyp.h | 2 + arch/arm64/include/asm/processor.h | 78 +- arch/arm64/include/asm/signal_common.h | 19 +- arch/arm64/include/asm/sysreg.h | 79 +- arch/arm64/include/asm/thread_info.h | 4 +- arch/arm64/include/uapi/asm/hwcap.h | 8 + arch/arm64/include/uapi/asm/ptrace.h | 69 +- arch/arm64/include/uapi/asm/sigcontext.h | 55 +- arch/arm64/kernel/cpufeature.c | 282 +++++-- arch/arm64/kernel/cpuinfo.c | 13 + arch/arm64/kernel/entry-common.c | 11 + arch/arm64/kernel/entry-fpsimd.S | 72 +- arch/arm64/kernel/fpsimd.c | 944 ++++++++++++++++++----- arch/arm64/kernel/head.S | 87 +++ arch/arm64/kernel/process.c | 45 +- arch/arm64/kernel/ptrace.c | 373 +++++++-- arch/arm64/kernel/signal.c | 175 ++++- arch/arm64/kernel/syscall.c | 29 +- arch/arm64/kernel/traps.c | 1 + arch/arm64/kvm/fpsimd.c | 70 +- arch/arm64/kvm/guest.c | 6 +- arch/arm64/kvm/hyp/fpsimd.S | 12 + arch/arm64/kvm/hyp/include/hyp/switch.h | 75 +- arch/arm64/kvm/hyp/nvhe/switch.c | 38 +- arch/arm64/kvm/hyp/vhe/switch.c | 10 +- arch/arm64/kvm/reset.c | 14 +- arch/arm64/kvm/sys_regs.c | 8 +- include/uapi/linux/elf.h | 2 + include/uapi/linux/prctl.h | 9 + kernel/sys.c | 12 + 45 files changed, 3126 insertions(+), 460 deletions(-) create mode 100644 Documentation/arm64/sme.rst -- 2.25.1

1 67

[PATCH OLK-5.10 v2] blk-mq: avoid housekeeping CPUs scheduling a worker on a non-housekeeping CPU
by Xiongfeng Wang 07 Nov '23

07 Nov '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7ZBTV CVE: N/A ---------------------------------------------------- When NOHZ_FULL is enabled, such as in HPC situation, CPUs are divided into housekeeping CPUs and non-housekeeping CPUs. Non-housekeeping CPUs are NOHZ_FULL CPUs and are often monopolized by the userspace process, such HPC application process. Any sort of interruption is not expected. blk_mq_hctx_next_cpu() selects each cpu in 'hctx->cpumask' alternately to schedule the work thread blk_mq_run_work_fn(). When 'hctx->cpumask' contains housekeeping CPU and non-housekeeping CPU at the same time, a housekeeping CPU, which want to request a IO, may schedule a worker on a non-housekeeping CPU. This may affect the performance of the userspace application running on non-housekeeping CPUs. So let's just schedule the worker thread on the current CPU when the current CPU is housekeeping CPU. Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- block/blk-mq.c | 13 ++++++++++++- include/linux/sched/isolation.h | 2 ++ kernel/sched/isolation.c | 8 ++++++++ 3 files changed, 22 insertions(+), 1 deletion(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 1d1200afb771..b81d4a69056c 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -23,6 +23,9 @@ #include <linux/sched/sysctl.h> #include <linux/sched/topology.h> #include <linux/sched/signal.h> +#ifndef __GENKSYMS__ +#include <linux/sched/isolation.h> +#endif #include <linux/delay.h> #include <linux/crash_dump.h> #include <linux/prefetch.h> @@ -1676,6 +1679,8 @@ static int blk_mq_hctx_next_cpu(struct blk_mq_hw_ctx *hctx) static void __blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async, unsigned long msecs) { + int work_cpu; + if (unlikely(blk_mq_hctx_stopped(hctx))) return; @@ -1697,7 +1702,13 @@ static void __blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async, if (!percpu_ref_tryget(&hctx->queue->q_usage_counter)) return; - kblockd_mod_delayed_work_on(blk_mq_hctx_next_cpu(hctx), &hctx->run_work, + if (enhanced_isolcpus && tick_nohz_full_enabled() && + housekeeping_cpu(raw_smp_processor_id(), HK_FLAG_WQ)) + work_cpu = smp_processor_id(); + else + work_cpu = blk_mq_hctx_next_cpu(hctx); + + kblockd_mod_delayed_work_on(work_cpu, &hctx->run_work, msecs_to_jiffies(msecs)); percpu_ref_put(&hctx->queue->q_usage_counter); } diff --git a/include/linux/sched/isolation.h b/include/linux/sched/isolation.h index cc9f393e2a70..2f93081ad7a0 100644 --- a/include/linux/sched/isolation.h +++ b/include/linux/sched/isolation.h @@ -18,6 +18,7 @@ enum hk_flags { }; #ifdef CONFIG_CPU_ISOLATION +extern bool enhanced_isolcpus; DECLARE_STATIC_KEY_FALSE(housekeeping_overridden); extern int housekeeping_any_cpu(enum hk_flags flags); extern const struct cpumask *housekeeping_cpumask(enum hk_flags flags); @@ -28,6 +29,7 @@ extern void __init housekeeping_init(void); #else +#define enhanced_isolcpus 0 static inline int housekeeping_any_cpu(enum hk_flags flags) { return smp_processor_id(); diff --git a/kernel/sched/isolation.c b/kernel/sched/isolation.c index 5a6ea03f9882..785ef5201116 100644 --- a/kernel/sched/isolation.c +++ b/kernel/sched/isolation.c @@ -198,3 +198,11 @@ static int __init housekeeping_isolcpus_setup(char *str) return housekeeping_setup(str, flags); } __setup("isolcpus=", housekeeping_isolcpus_setup); + +bool enhanced_isolcpus; +static int __init enhanced_isolcpus_setup(char *str) +{ + enhanced_isolcpus = true; + return 0; +} +__setup("enhanced_isolcpus", enhanced_isolcpus_setup); -- 2.20.1

2 1

[PATCH OLK-5.10 00/22] Add error handle for add_disk
by Li Nan 07 Nov '23

07 Nov '23

To make applying the mainline patch easier, reorder the nbd commit about the first_minor check here. Christoph Hellwig (5): block: fold register_disk into device_add_disk block: call blk_integrity_add earlier in device_add_disk block: add the events* attributes to disk_attrs block: fix error unwinding in device_add_disk block: clear ->slave_dir when dropping the main slave_dir reference Luis Chamberlain (4): block: return errors from blk_integrity_add block: return errors from disk_alloc_events block: add error handling for device_add_disk / add_disk block: fix device_add_disk() kobject_create_and_add() error handling Tetsuo Handa (1): block: check minor range in device_add_disk() Wen Yang (1): Revert "Revert "block: nbd: add sanity check for first_minor"" Yu Kuai (3): nbd: fix max value for 'first_minor' nbd: fix possible overflow for 'first_minor' in nbd_dev_add() block: fix memory leak for elevator on add_disk failure Zhang Wensheng (1): nbd: fix possible overflow on 'first_minor' in nbd_dev_add() Zhong Jinghua (7): nbd: Reorganize the messy commit log about the first_minor check block: return errors from blk_register_region block: Fix the kabi change in device_add_disk block: Fix the kabi change on blk_register_region block: call blk_get_queue earlier in __device_add_disk block: Fix minor range check in device_add_disk() block: Set memalloc_noio to false in the error path block/blk.h | 5 +- include/linux/genhd.h | 13 +++ block/blk-integrity.c | 12 ++- block/genhd.c | 246 +++++++++++++++++++++++++----------------- drivers/block/nbd.c | 15 +-- 5 files changed, 175 insertions(+), 116 deletions(-) -- 2.39.2

2 23

[PATCH OLK-5.10 v2 00/42] Add error handle for add_disk
by Li Nan 07 Nov '23

07 Nov '23

Christoph Hellwig (14): block: fold register_disk into device_add_disk block: call blk_integrity_add earlier in device_add_disk block: add the events* attributes to disk_attrs block: fix error unwinding in device_add_disk block: clear ->slave_dir when dropping the main slave_dir reference block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Li Lingfeng (1): nbd: fix uaf in nbd_open Luis Chamberlain (10): block: return errors from blk_integrity_add block: return errors from disk_alloc_events block: add error handling for device_add_disk / add_disk block: fix device_add_disk() kobject_create_and_add() error handling loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Tetsuo Handa (1): block: check minor range in device_add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Wen Yang (1): Revert "Revert "block: nbd: add sanity check for first_minor"" Yu Kuai (3): nbd: fix max value for 'first_minor' nbd: fix possible overflow for 'first_minor' in nbd_dev_add() block: fix memory leak for elevator on add_disk failure Zhang Wensheng (1): nbd: fix possible overflow on 'first_minor' in nbd_dev_add() Zhong Jinghua (9): nbd: Reorganize the messy commit log about the first_minor check block: return errors from blk_register_region block: Fix the kabi change in device_add_disk block: Fix the kabi change on blk_register_region block: call blk_get_queue earlier in __device_add_disk block: Fix minor range check in device_add_disk() block: Set memalloc_noio to false in the error path mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup block/blk.h | 5 +- include/linux/blk-mq.h | 12 ++ include/linux/genhd.h | 36 +++++ block/blk-integrity.c | 12 +- block/blk-mq.c | 19 +++ block/genhd.c | 286 ++++++++++++++++++++++++++------------- drivers/block/brd.c | 103 ++++++-------- drivers/block/loop.c | 26 ++-- drivers/block/nbd.c | 75 ++++------ drivers/mtd/ubi/block.c | 76 +++++------ drivers/nvme/host/core.c | 41 +++--- drivers/scsi/sr.c | 7 +- 12 files changed, 413 insertions(+), 285 deletions(-) -- 2.39.2

1 42

[PATCH openEuler-1.0-LTS] crypto: hisilicon/qm - alloc reserve buffer to set and get xqc
by wangyuan 06 Nov '23

06 Nov '23

From: Yu'an Wang <wangyuan46(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8E6ED CVE: NA -------------------------------- If the temporarily applied memory is used to set or get the xqc information, the driver will release the memory after the mailbox timeout. However, the hardware still performs the operation. Therefore, the released memory may be written by hardware. So when load driver, reserve memory is applied for xqc configuration. Signed-off-by: Yu'an Wang <wangyuan46(a)huawei.com> --- drivers/crypto/hisilicon/qm.c | 544 +++++++++++++++------------------- drivers/crypto/hisilicon/qm.h | 13 + 2 files changed, 250 insertions(+), 307 deletions(-) diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c index 64e8ef1bf8e7..25bb24b4c131 100644 --- a/drivers/crypto/hisilicon/qm.c +++ b/drivers/crypto/hisilicon/qm.c @@ -50,7 +50,7 @@ #define QM_SQ_TYPE_MASK 0xf -#define QM_SQ_TAIL_IDX(sqc) ((le16_to_cpu((sqc)->w11) >> 6) & 0x1) +#define QM_SQ_TAIL_IDX(sqc) ((le16_to_cpu((sqc).w11) >> 6) & 0x1) /* cqc shift */ #define QM_CQ_HOP_NUM_SHIFT 0 @@ -64,7 +64,7 @@ #define QM_QC_CQE_SIZE 4 -#define QM_CQ_TAIL_IDX(cqc) ((le16_to_cpu((cqc)->w11) >> 6) & 0x1) +#define QM_CQ_TAIL_IDX(cqc) ((le16_to_cpu((cqc).w11) >> 6) & 0x1) /* eqc shift */ #define QM_EQE_AEQE_SIZE (2UL << 12) @@ -217,19 +217,6 @@ #define QM_MK_SQC_DW3_V2(sqe_sz) \ ((QM_Q_DEPTH - 1) | ((u32)ilog2(sqe_sz) << QM_SQ_SQE_SIZE_SHIFT)) -#define INIT_QC_COMMON(qc, base, pasid) do { \ - (qc)->head = 0; \ - (qc)->tail = 0; \ - (qc)->base_l = cpu_to_le32(lower_32_bits(base)); \ - (qc)->base_h = cpu_to_le32(upper_32_bits(base)); \ - (qc)->dw3 = 0; \ - (qc)->w8 = 0; \ - (qc)->rsvd0 = 0; \ - (qc)->pasid = cpu_to_le16(pasid); \ - (qc)->w11 = 0; \ - (qc)->rsvd1 = 0; \ -} while (0) - #define QMC_ALIGN(sz) ALIGN(sz, 32) static int __hisi_qm_start(struct hisi_qm *qm); @@ -537,6 +524,61 @@ static int hisi_qm_mb_read(struct hisi_qm *qm, u64 *base, u8 cmd, u16 queue) return 0; } +/* op 0: set xqc info to hardware, 1: get xqc info from hardware. */ +static int qm_set_and_get_xqc(struct hisi_qm *qm, u8 cmd, void *xqc, u32 qp_id, + bool op) +{ + struct hisi_qm *pf_qm = pci_get_drvdata(pci_physfn(qm->pdev)); + struct qm_mailbox mailbox; + dma_addr_t xqc_dma; + void *tmp_xqc; + size_t size; + int ret; + + switch (cmd) { + case QM_MB_CMD_SQC: + size = sizeof(struct qm_sqc); + tmp_xqc = qm->xqc_buf.sqc; + xqc_dma = qm->xqc_buf.sqc_dma; + break; + case QM_MB_CMD_CQC: + size = sizeof(struct qm_cqc); + tmp_xqc = qm->xqc_buf.cqc; + xqc_dma = qm->xqc_buf.cqc_dma; + break; + case QM_MB_CMD_EQC: + size = sizeof(struct qm_eqc); + tmp_xqc = qm->xqc_buf.eqc; + xqc_dma = qm->xqc_buf.eqc_dma; + break; + case QM_MB_CMD_AEQC: + size = sizeof(struct qm_aeqc); + tmp_xqc = qm->xqc_buf.aeqc; + xqc_dma = qm->xqc_buf.aeqc_dma; + break; + } + + /* No need to judge if master OOO is blocked. */ + if (qm_check_dev_error(pf_qm)) { + dev_err(&qm->pdev->dev, + "QM mailbox operation failed since qm is stop!\n"); + return -EIO; + } + + mutex_lock(&qm->mailbox_lock); + if (!op) + memcpy(tmp_xqc, xqc, size); + + qm_mb_pre_init(&mailbox, cmd, xqc_dma, qp_id, op); + ret = qm_mb_nolock(qm, &mailbox); + if (!ret && op) + memcpy(xqc, tmp_xqc, size); + + mutex_unlock(&qm->mailbox_lock); + + return ret; +} + static void qm_db_v1(struct hisi_qm *qm, u16 qn, u8 cmd, u16 index, u8 priority) { u64 doorbell; @@ -1166,35 +1208,6 @@ static ssize_t qm_cmd_read(struct file *filp, char __user *buffer, return (*pos = len); } -static void *qm_ctx_alloc(struct hisi_qm *qm, size_t ctx_size, - dma_addr_t *dma_addr) -{ - struct device *dev = &qm->pdev->dev; - void *ctx_addr; - - ctx_addr = kzalloc(ctx_size, GFP_KERNEL); - if (!ctx_addr) - return ERR_PTR(-ENOMEM); - - *dma_addr = dma_map_single(dev, ctx_addr, ctx_size, DMA_FROM_DEVICE); - if (dma_mapping_error(dev, *dma_addr)) { - dev_err(dev, "DMA mapping error!\n"); - kfree(ctx_addr); - return ERR_PTR(-ENOMEM); - } - - return ctx_addr; -} - -static void qm_ctx_free(struct hisi_qm *qm, size_t ctx_size, - const void *ctx_addr, dma_addr_t *dma_addr) -{ - struct device *dev = &qm->pdev->dev; - - dma_unmap_single(dev, *dma_addr, ctx_size, DMA_FROM_DEVICE); - kfree(ctx_addr); -} - static int dump_show(struct hisi_qm *qm, void *info, unsigned int info_size, char *info_name) { @@ -1230,21 +1243,11 @@ static int dump_show(struct hisi_qm *qm, void *info, return 0; } -static int qm_dump_sqc_raw(struct hisi_qm *qm, dma_addr_t dma_addr, u16 qp_id) -{ - return hisi_qm_mb_write(qm, QM_MB_CMD_SQC, dma_addr, qp_id, 1); -} - -static int qm_dump_cqc_raw(struct hisi_qm *qm, dma_addr_t dma_addr, u16 qp_id) -{ - return hisi_qm_mb_write(qm, QM_MB_CMD_CQC, dma_addr, qp_id, 1); -} - static int qm_sqc_dump(struct hisi_qm *qm, const char *s) { struct device *dev = &qm->pdev->dev; - struct qm_sqc *sqc, *sqc_curr; - dma_addr_t sqc_dma; + struct qm_sqc *sqc_curr; + struct qm_sqc sqc; u32 qp_id; int ret; @@ -1257,40 +1260,28 @@ static int qm_sqc_dump(struct hisi_qm *qm, const char *s) return -EINVAL; } - sqc = qm_ctx_alloc(qm, sizeof(struct qm_sqc), &sqc_dma); - if (IS_ERR(sqc)) - return PTR_ERR(sqc); - - ret = qm_dump_sqc_raw(qm, sqc_dma, qp_id); - if (ret) { - down_read(&qm->qps_lock); - if (qm->sqc) { - sqc_curr = qm->sqc + qp_id; - - ret = dump_show(qm, sqc_curr, sizeof(struct qm_sqc), - "SOFT SQC"); - if (ret) - dev_info(dev, "Show soft sqc failed!\n"); - } - up_read(&qm->qps_lock); + ret = qm_set_and_get_xqc(qm, QM_MB_CMD_SQC, &sqc, qp_id, 1); + if (!ret) + return dump_show(qm, &sqc, sizeof(struct qm_sqc), "SQC"); - goto mailbox_fail; + down_read(&qm->qps_lock); + if (qm->sqc) { + sqc_curr = qm->sqc + qp_id; + ret = dump_show(qm, sqc_curr, sizeof(struct qm_sqc), + "SOFT SQC"); + if (ret) + dev_info(dev, "Show soft sqc failed!\n"); } + up_read(&qm->qps_lock); - ret = dump_show(qm, sqc, sizeof(struct qm_sqc), "SQC"); - if (ret) - dev_info(dev, "Show hw sqc failed!\n"); - -mailbox_fail: - qm_ctx_free(qm, sizeof(struct qm_sqc), sqc, &sqc_dma); return ret; } static int qm_cqc_dump(struct hisi_qm *qm, const char *s) { struct device *dev = &qm->pdev->dev; - struct qm_cqc *cqc, *cqc_curr; - dma_addr_t cqc_dma; + struct qm_cqc *cqc_curr; + struct qm_cqc cqc; u32 qp_id; int ret; @@ -1303,40 +1294,28 @@ static int qm_cqc_dump(struct hisi_qm *qm, const char *s) return -EINVAL; } - cqc = qm_ctx_alloc(qm, sizeof(struct qm_cqc), &cqc_dma); - if (IS_ERR(cqc)) - return PTR_ERR(cqc); - - ret = qm_dump_cqc_raw(qm, cqc_dma, qp_id); - if (ret) { - down_read(&qm->qps_lock); - if (qm->cqc) { - cqc_curr = qm->cqc + qp_id; + ret = qm_set_and_get_xqc(qm, QM_MB_CMD_CQC, &cqc, qp_id, 1); + if (!ret) + return dump_show(qm, &cqc, sizeof(struct qm_cqc), "CQC"); - ret = dump_show(qm, cqc_curr, sizeof(struct qm_cqc), - "SOFT CQC"); - if (ret) - dev_info(dev, "Show soft cqc failed!\n"); - } - up_read(&qm->qps_lock); + down_read(&qm->qps_lock); + if (qm->cqc) { + cqc_curr = qm->cqc + qp_id; - goto mailbox_fail; + ret = dump_show(qm, cqc_curr, sizeof(struct qm_cqc), + "SOFT CQC"); + if (ret) + dev_info(dev, "Show soft cqc failed!\n"); } + up_read(&qm->qps_lock); - ret = dump_show(qm, cqc, sizeof(struct qm_cqc), "CQC"); - if (ret) - dev_info(dev, "Show hw cqc failed!\n"); - -mailbox_fail: - qm_ctx_free(qm, sizeof(struct qm_cqc), cqc, &cqc_dma); return ret; } static int qm_eqc_dump(struct hisi_qm *qm, char *s) { struct device *dev = &qm->pdev->dev; - struct qm_eqc *eqc; - dma_addr_t eqc_dma; + struct qm_eqc eqc; int ret; if (strsep(&s, " ")) { @@ -1344,28 +1323,17 @@ static int qm_eqc_dump(struct hisi_qm *qm, char *s) return -EINVAL; } - eqc = qm_ctx_alloc(qm, sizeof(struct qm_eqc), &eqc_dma); - if (IS_ERR(eqc)) - return PTR_ERR(eqc); - - ret = hisi_qm_mb_write(qm, QM_MB_CMD_EQC, eqc_dma, 0, 1); - if (ret) - goto mailbox_fail; - - ret = dump_show(qm, eqc, sizeof(struct qm_eqc), "EQC"); + ret = qm_set_and_get_xqc(qm, QM_MB_CMD_EQC, &eqc, 0, 1); if (ret) - dev_info(dev, "Show eqc failed!\n"); + return ret; -mailbox_fail: - qm_ctx_free(qm, sizeof(struct qm_eqc), eqc, &eqc_dma); - return ret; + return dump_show(qm, &eqc, sizeof(struct qm_eqc), "EQC"); } static int qm_aeqc_dump(struct hisi_qm *qm, char *s) { struct device *dev = &qm->pdev->dev; - struct qm_aeqc *aeqc; - dma_addr_t aeqc_dma; + struct qm_aeqc aeqc; int ret; if (strsep(&s, " ")) { @@ -1373,21 +1341,11 @@ static int qm_aeqc_dump(struct hisi_qm *qm, char *s) return -EINVAL; } - aeqc = qm_ctx_alloc(qm, sizeof(struct qm_aeqc), &aeqc_dma); - if (IS_ERR(aeqc)) - return PTR_ERR(aeqc); - - ret = hisi_qm_mb_write(qm, QM_MB_CMD_AEQC, aeqc_dma, 0, 1); + ret = qm_set_and_get_xqc(qm, QM_MB_CMD_AEQC, &aeqc, 0, 1); if (ret) - goto mailbox_fail; - - ret = dump_show(qm, aeqc, sizeof(struct qm_aeqc), "AEQC"); - if (ret) - dev_info(dev, "Show hw aeqc failed!\n"); + return ret; -mailbox_fail: - qm_ctx_free(qm, sizeof(struct qm_aeqc), aeqc, &aeqc_dma); - return ret; + return dump_show(qm, &aeqc, sizeof(struct qm_aeqc), "AEQC"); } static int q_dump_param_parse(struct hisi_qm *qm, char *s, @@ -1432,7 +1390,6 @@ static int q_dump_param_parse(struct hisi_qm *qm, char *s, static int qm_sq_dump(struct hisi_qm *qm, char *s) { - struct device *dev = &qm->pdev->dev; struct hisi_qp *qp; u32 qp_id, sqe_id; void *sqe_curr; @@ -1447,16 +1404,11 @@ static int qm_sq_dump(struct hisi_qm *qm, char *s) memset(sqe_curr + qm->debug.sqe_mask_offset, SQE_ADDR_MASK, qm->debug.sqe_mask_len); - ret = dump_show(qm, sqe_curr, qm->sqe_size, "SQE"); - if (ret) - dev_info(dev, "Show sqe failed!\n"); - - return ret; + return dump_show(qm, sqe_curr, qm->sqe_size, "SQE"); } static int qm_cq_dump(struct hisi_qm *qm, char *s) { - struct device *dev = &qm->pdev->dev; struct qm_cqe *cqe_curr; struct hisi_qp *qp; u32 qp_id, cqe_id; @@ -1468,11 +1420,8 @@ static int qm_cq_dump(struct hisi_qm *qm, char *s) qp = &qm->qp_array[qp_id]; cqe_curr = qp->cqe + cqe_id; - ret = dump_show(qm, cqe_curr, sizeof(struct qm_cqe), "CQE"); - if (ret) - dev_info(dev, "Show cqe failed!\n"); - return ret; + return dump_show(qm, cqe_curr, sizeof(struct qm_cqe), "CQE"); } static int qm_eq_dump(struct hisi_qm *qm, const char *s) @@ -1895,79 +1844,46 @@ EXPORT_SYMBOL_GPL(hisi_qm_release_qp); static int qm_sq_ctx_cfg(struct hisi_qp *qp, int qp_id, int pasid) { struct hisi_qm *qm = qp->qm; - struct device *dev = &qm->pdev->dev; enum qm_hw_ver ver = qm->ver; - struct qm_sqc *sqc; - dma_addr_t sqc_dma; - int ret; + struct qm_sqc sqc = {0}; - sqc = kzalloc(sizeof(struct qm_sqc), GFP_KERNEL); - if (!sqc) - return -ENOMEM; - sqc_dma = dma_map_single(dev, sqc, sizeof(struct qm_sqc), - DMA_TO_DEVICE); - if (dma_mapping_error(dev, sqc_dma)) { - kfree(sqc); - return -ENOMEM; - } - - INIT_QC_COMMON(sqc, qp->sqe_dma, pasid); if (ver == QM_HW_V1) { - sqc->dw3 = cpu_to_le32(QM_MK_SQC_DW3_V1(0, 0, 0, qm->sqe_size)); - sqc->w8 = cpu_to_le16(QM_Q_DEPTH - 1); + sqc.dw3 = cpu_to_le32(QM_MK_SQC_DW3_V1(0, 0, 0, qm->sqe_size)); + sqc.w8 = cpu_to_le16(QM_Q_DEPTH - 1); } else if (ver == QM_HW_V2) { - sqc->dw3 = cpu_to_le32(QM_MK_SQC_DW3_V2(qm->sqe_size)); - sqc->w8 = 0; /* rand_qc */ + sqc.dw3 = cpu_to_le32(QM_MK_SQC_DW3_V2(qm->sqe_size)); + sqc.w8 = 0; /* rand_qc */ } - sqc->cq_num = cpu_to_le16(qp_id); - sqc->w13 = cpu_to_le16(QM_MK_SQC_W13(0, 1, qp->alg_type)); - - ret = hisi_qm_mb_write(qm, QM_MB_CMD_SQC, sqc_dma, qp_id, 0); - - dma_unmap_single(dev, sqc_dma, sizeof(struct qm_sqc), DMA_TO_DEVICE); - kfree(sqc); + sqc.cq_num = cpu_to_le16(qp_id); + sqc.w13 = cpu_to_le16(QM_MK_SQC_W13(0, 1, qp->alg_type)); + sqc.base_l = cpu_to_le32(lower_32_bits(qp->sqe_dma)); + sqc.base_h = cpu_to_le32(upper_32_bits(qp->sqe_dma)); + sqc.pasid = cpu_to_le16(pasid); - return ret; + return qm_set_and_get_xqc(qm, QM_MB_CMD_SQC, &sqc, qp_id, 0); } static int qm_cq_ctx_cfg(struct hisi_qp *qp, int qp_id, int pasid) { struct hisi_qm *qm = qp->qm; - struct device *dev = &qm->pdev->dev; enum qm_hw_ver ver = qm->ver; - struct qm_cqc *cqc; - dma_addr_t cqc_dma; - int ret; + struct qm_cqc cqc = {0}; - cqc = kzalloc(sizeof(struct qm_cqc), GFP_KERNEL); - if (!cqc) - return -ENOMEM; - - cqc_dma = dma_map_single(dev, cqc, sizeof(struct qm_cqc), - DMA_TO_DEVICE); - if (dma_mapping_error(dev, cqc_dma)) { - kfree(cqc); - return -ENOMEM; - } - - INIT_QC_COMMON(cqc, qp->cqe_dma, pasid); if (ver == QM_HW_V1) { - cqc->dw3 = cpu_to_le32(QM_MK_CQC_DW3_V1(0, 0, 0, + cqc.dw3 = cpu_to_le32(QM_MK_CQC_DW3_V1(0, 0, 0, QM_QC_CQE_SIZE)); - cqc->w8 = cpu_to_le16(QM_Q_DEPTH - 1); + cqc.w8 = cpu_to_le16(QM_Q_DEPTH - 1); } else if (ver == QM_HW_V2) { - cqc->dw3 = cpu_to_le32(QM_MK_CQC_DW3_V2(QM_QC_CQE_SIZE)); - cqc->w8 = 0; /* rand_qc */ + cqc.dw3 = cpu_to_le32(QM_MK_CQC_DW3_V2(QM_QC_CQE_SIZE)); + cqc.w8 = 0; /* rand_qc */ } - cqc->dw6 = cpu_to_le32(1 << QM_CQ_PHASE_SHIFT | - qp->c_flag << QM_CQ_FLAG_SHIFT); - - ret = hisi_qm_mb_write(qm, QM_MB_CMD_CQC, cqc_dma, qp_id, 0); + cqc.dw6 = cpu_to_le32(1 << QM_CQ_PHASE_SHIFT | + qp->c_flag << QM_CQ_FLAG_SHIFT); + cqc.base_l = cpu_to_le32(lower_32_bits(qp->cqe_dma)); + cqc.base_h = cpu_to_le32(upper_32_bits(qp->cqe_dma)); + cqc.pasid = cpu_to_le16(pasid); - dma_unmap_single(dev, cqc_dma, sizeof(struct qm_cqc), DMA_TO_DEVICE); - kfree(cqc); - - return ret; + return qm_set_and_get_xqc(qm, QM_MB_CMD_CQC, &cqc, qp_id, 0); } static int qm_qp_ctx_cfg(struct hisi_qp *qp, int qp_id, int pasid) @@ -2043,54 +1959,40 @@ static void qp_stop_fail_cb(struct hisi_qp *qp) static void qm_qp_has_no_task(struct hisi_qp *qp) { - size_t size = sizeof(struct qm_sqc) + sizeof(struct qm_cqc); - struct device *dev = &qp->qm->pdev->dev; - struct qm_sqc *sqc; - struct qm_cqc *cqc; - dma_addr_t dma_addr; - void *addr; - int i = 0; - int ret; + struct hisi_qm *qm = qp->qm; + struct device *dev = &qm->pdev->dev; + struct qm_sqc sqc; + struct qm_cqc cqc; + int ret, i = 0; if (qp->qm->err_ini.err_info.is_qm_ecc_mbit || qp->qm->err_ini.err_info.is_dev_ecc_mbit) return; - addr = qm_ctx_alloc(qp->qm, size, &dma_addr); - if (IS_ERR(addr)) { - dev_err(dev, "alloc ctx for sqc and cqc failed!\n"); - return; - } - while (++i) { - ret = qm_dump_sqc_raw(qp->qm, dma_addr, qp->qp_id); + ret = qm_set_and_get_xqc(qm, QM_MB_CMD_SQC, &sqc, qp->qp_id, 1); if (ret) { - dev_err(dev, "Failed to dump sqc!\n"); - break; + dev_err_ratelimited(dev, "Fail to dump sqc!\n"); + return; } - sqc = addr; - ret = qm_dump_cqc_raw(qp->qm, - (dma_addr + sizeof(struct qm_sqc)), qp->qp_id); + ret = qm_set_and_get_xqc(qm, QM_MB_CMD_CQC, &cqc, qp->qp_id, 1); if (ret) { - dev_err(dev, "Failed to dump cqc!\n"); - break; + dev_err_ratelimited(dev, "Fail to dump cqc!\n"); + return; } - cqc = addr + sizeof(struct qm_sqc); - if ((sqc->tail == cqc->tail) && - (QM_SQ_TAIL_IDX(sqc) == QM_CQ_TAIL_IDX(cqc))) - break; + if ((QM_SQ_TAIL_IDX(sqc) == QM_CQ_TAIL_IDX(cqc)) && + (sqc.tail == cqc.tail)) + return; if (i == MAX_WAIT_COUNTS) { - dev_err(dev, "Fail to wait for device stop!\n"); - break; + dev_err(dev, "Fail to empty queue %u!\n", qp->qp_id); + return; } usleep_range(WAIT_PERIOD_US_MIN, WAIT_PERIOD_US_MAX); } - - qm_ctx_free(qp->qm, size, addr, &dma_addr); } static int hisi_qm_stop_qp_nolock(struct hisi_qp *qp) @@ -2597,10 +2499,12 @@ static int hisi_qp_memory_init(struct hisi_qm *qm, size_t dma_size, int id) struct hisi_qp *qp; qp = &qm->qp_array[id]; - qp->qdma.va = dma_alloc_coherent(dev, dma_size, - &qp->qdma.dma, GFP_KERNEL); - if (!qp->qdma.va) + qp->qdma.va = dma_alloc_coherent(dev, dma_size, &qp->qdma.dma, + GFP_KERNEL); + if (!qp->qdma.va) { + dev_err(dev, "Fail to alloc qp dma buf size=%zx\n", dma_size); return -ENOMEM; + } qp->sqe = qp->qdma.va; qp->sqe_dma = qp->qdma.dma; @@ -2613,13 +2517,79 @@ static int hisi_qp_memory_init(struct hisi_qm *qm, size_t dma_size, int id) return 0; } +static int hisi_qp_alloc_memory(struct hisi_qm *qm) +{ + size_t qp_dma_size; + int i, ret; + + qm->qp_array = kcalloc(qm->qp_num, sizeof(struct hisi_qp), GFP_KERNEL); + if (!qm->qp_array) + return -ENOMEM; + + /* one more page for device or qp statuses */ + qp_dma_size = qm->sqe_size * QM_Q_DEPTH + + sizeof(struct cqe) * QM_Q_DEPTH; + qp_dma_size = PAGE_ALIGN(qp_dma_size) + PAGE_SIZE; + for (i = 0; i < qm->qp_num; i++) { + ret = hisi_qp_memory_init(qm, qp_dma_size, i); + if (ret) + goto err_init_qp_mem; + } + + return 0; + +err_init_qp_mem: + hisi_qp_memory_uninit(qm, i); + + return ret; +} + +static void hisi_qm_free_rsv_buf(struct hisi_qm *qm) +{ + struct qm_dma *xqc_dma = &qm->xqc_buf.qcdma; + struct device *dev = &qm->pdev->dev; + + dma_free_coherent(dev, xqc_dma->size, xqc_dma->va, xqc_dma->dma); +} + +static int hisi_qm_alloc_rsv_buf(struct hisi_qm *qm) +{ + struct qm_rsv_buf *xqc_buf = &qm->xqc_buf; + struct qm_dma *xqc_dma = &xqc_buf->qcdma; + struct device *dev = &qm->pdev->dev; + size_t off = 0; + +#define QM_XQC_BUF_INIT(xqc_buf, type) do { \ + (xqc_buf)->type = ((xqc_buf)->qcdma.va + (off)); \ + (xqc_buf)->type##_dma = (xqc_buf)->qcdma.dma + (off); \ + off += QMC_ALIGN(sizeof(struct qm_##type)); \ +} while (0) + + xqc_dma->size = QMC_ALIGN(sizeof(struct qm_eqc)) + + QMC_ALIGN(sizeof(struct qm_aeqc)) + + QMC_ALIGN(sizeof(struct qm_sqc)) + + QMC_ALIGN(sizeof(struct qm_cqc)); + + xqc_dma->va = dma_alloc_coherent(dev, xqc_dma->size, &xqc_dma->dma, + GFP_ATOMIC); + if (!xqc_dma->va) { + dev_err(dev, "Fail to alloc qcdma size=%zx\n", xqc_dma->size); + return -ENOMEM; + } + + QM_XQC_BUF_INIT(xqc_buf, eqc); + QM_XQC_BUF_INIT(xqc_buf, aeqc); + QM_XQC_BUF_INIT(xqc_buf, sqc); + QM_XQC_BUF_INIT(xqc_buf, cqc); + + return 0; +} + static int hisi_qm_memory_init(struct hisi_qm *qm) { struct device *dev = &qm->pdev->dev; - size_t qp_dma_size; + int ret = -ENOMEM; size_t off = 0; - int ret = 0; - int i; #define QM_INIT_BUF(qm, type, num) do { \ (qm)->type = ((qm)->qdma.va + (off)); \ @@ -2635,41 +2605,35 @@ static int hisi_qm_memory_init(struct hisi_qm *qm) QMC_ALIGN(sizeof(struct qm_aeqe) * QM_Q_DEPTH) + QMC_ALIGN(sizeof(struct qm_sqc) * qm->qp_num) + QMC_ALIGN(sizeof(struct qm_cqc) * qm->qp_num); - qm->qdma.va = dma_alloc_coherent(dev, qm->qdma.size, - &qm->qdma.dma, GFP_ATOMIC | __GFP_ZERO); - dev_dbg(dev, "allocate qm dma buf size=%zx)\n", qm->qdma.size); - if (!qm->qdma.va) - return -ENOMEM; + qm->qdma.va = dma_alloc_coherent(dev, qm->qdma.size, &qm->qdma.dma, + GFP_ATOMIC | __GFP_ZERO); + if (!qm->qdma.va) { + dev_err(dev, "Fail to alloc qdma size=%zx\n", qm->qdma.size); + goto err_destroy_idr; + } QM_INIT_BUF(qm, eqe, QM_EQ_DEPTH); QM_INIT_BUF(qm, aeqe, QM_Q_DEPTH); QM_INIT_BUF(qm, sqc, qm->qp_num); QM_INIT_BUF(qm, cqc, qm->qp_num); - qm->qp_array = kcalloc(qm->qp_num, sizeof(struct hisi_qp), GFP_KERNEL); - if (!qm->qp_array) { - ret = -ENOMEM; - goto err_alloc_qp_array; - } + ret = hisi_qm_alloc_rsv_buf(qm); + if (ret) + goto err_free_qdma; - /* one more page for device or qp statuses */ - qp_dma_size = qm->sqe_size * QM_Q_DEPTH + - sizeof(struct cqe) * QM_Q_DEPTH; - qp_dma_size = PAGE_ALIGN(qp_dma_size) + PAGE_SIZE; - for (i = 0; i < qm->qp_num; i++) { - ret = hisi_qp_memory_init(qm, qp_dma_size, i); - if (ret) - goto err_init_qp_mem; + ret = hisi_qp_alloc_memory(qm); + if (ret) + goto err_free_reserve_buf; - dev_dbg(dev, "allocate qp dma buf size=%zx)\n", qp_dma_size); - } + return 0; + +err_free_reserve_buf: + hisi_qm_free_rsv_buf(qm); +err_free_qdma: + dma_free_coherent(dev, qm->qdma.size, qm->qdma.va, qm->qdma.dma); +err_destroy_idr: + idr_destroy(&qm->qp_idr); - return ret; -err_init_qp_mem: - hisi_qp_memory_uninit(qm, i); -err_alloc_qp_array: - dma_free_coherent(dev, qm->qdma.size, - qm->qdma.va, qm->qdma.dma); return ret; } @@ -2861,8 +2825,7 @@ void hisi_qm_uninit(struct hisi_qm *qm) hisi_qp_memory_uninit(qm, qm->qp_num); idr_destroy(&qm->qp_idr); - - /* qm hardware buffer free on put_queue if no dma api */ + hisi_qm_free_rsv_buf(qm); if (qm->qdma.va) { hisi_qm_cache_wb(qm); dma_free_coherent(dev, qm->qdma.size, @@ -2962,59 +2925,26 @@ static void qm_init_eq_aeq_status(struct hisi_qm *qm) static int qm_eq_ctx_cfg(struct hisi_qm *qm) { - struct device *dev = &qm->pdev->dev; - struct qm_eqc *eqc; - dma_addr_t eqc_dma; - int ret; + struct qm_eqc eqc = {0}; - eqc = kzalloc(sizeof(struct qm_eqc), GFP_KERNEL); - if (!eqc) - return -ENOMEM; - eqc_dma = dma_map_single(dev, eqc, sizeof(struct qm_eqc), - DMA_TO_DEVICE); - if (dma_mapping_error(dev, eqc_dma)) { - kfree(eqc); - return -ENOMEM; - } - - eqc->base_l = cpu_to_le32(lower_32_bits(qm->eqe_dma)); - eqc->base_h = cpu_to_le32(upper_32_bits(qm->eqe_dma)); + eqc.base_l = cpu_to_le32(lower_32_bits(qm->eqe_dma)); + eqc.base_h = cpu_to_le32(upper_32_bits(qm->eqe_dma)); if (qm->ver == QM_HW_V1) - eqc->dw3 = cpu_to_le32(QM_EQE_AEQE_SIZE); - eqc->dw6 = cpu_to_le32((QM_EQ_DEPTH - 1) | (1 << QM_EQC_PHASE_SHIFT)); - ret = hisi_qm_mb_write(qm, QM_MB_CMD_EQC, eqc_dma, 0, 0); - dma_unmap_single(dev, eqc_dma, sizeof(struct qm_eqc), DMA_TO_DEVICE); - kfree(eqc); + eqc.dw3 = cpu_to_le32(QM_EQE_AEQE_SIZE); + eqc.dw6 = cpu_to_le32((QM_EQ_DEPTH - 1) | (1 << QM_EQC_PHASE_SHIFT)); - return ret; + return qm_set_and_get_xqc(qm, QM_MB_CMD_EQC, &eqc, 0, 0); } static int qm_aeq_ctx_cfg(struct hisi_qm *qm) { - struct device *dev = &qm->pdev->dev; - struct qm_aeqc *aeqc; - dma_addr_t aeqc_dma; - int ret; + struct qm_aeqc aeqc = {0}; - aeqc = kzalloc(sizeof(struct qm_aeqc), GFP_KERNEL); - if (!aeqc) - return -ENOMEM; - aeqc_dma = dma_map_single(dev, aeqc, sizeof(struct qm_aeqc), - DMA_TO_DEVICE); - if (dma_mapping_error(dev, aeqc_dma)) { - kfree(aeqc); - return -ENOMEM; - } + aeqc.base_l = cpu_to_le32(lower_32_bits(qm->aeqe_dma)); + aeqc.base_h = cpu_to_le32(upper_32_bits(qm->aeqe_dma)); + aeqc.dw6 = cpu_to_le32((QM_Q_DEPTH - 1) | (1 << QM_EQC_PHASE_SHIFT)); - aeqc->base_l = cpu_to_le32(lower_32_bits(qm->aeqe_dma)); - aeqc->base_h = cpu_to_le32(upper_32_bits(qm->aeqe_dma)); - aeqc->dw6 = cpu_to_le32((QM_Q_DEPTH - 1) | (1 << QM_EQC_PHASE_SHIFT)); - ret = hisi_qm_mb_write(qm, QM_MB_CMD_AEQC, aeqc_dma, 0, 0); - - dma_unmap_single(dev, aeqc_dma, sizeof(struct qm_aeqc), DMA_TO_DEVICE); - kfree(aeqc); - - return ret; + return qm_set_and_get_xqc(qm, QM_MB_CMD_AEQC, &aeqc, 0, 0); } static int qm_eq_aeq_ctx_cfg(struct hisi_qm *qm) diff --git a/drivers/crypto/hisilicon/qm.h b/drivers/crypto/hisilicon/qm.h index d7d23d1ec34c..9f5e440d7396 100644 --- a/drivers/crypto/hisilicon/qm.h +++ b/drivers/crypto/hisilicon/qm.h @@ -286,6 +286,18 @@ struct hisi_qm_list { bool (*check)(struct hisi_qm *qm); }; +struct qm_rsv_buf { + struct qm_sqc *sqc; + struct qm_cqc *cqc; + struct qm_eqc *eqc; + struct qm_aeqc *aeqc; + dma_addr_t sqc_dma; + dma_addr_t cqc_dma; + dma_addr_t eqc_dma; + dma_addr_t aeqc_dma; + struct qm_dma qcdma; +}; + struct hisi_qm { enum qm_hw_ver ver; enum qm_fun_type fun_type; @@ -309,6 +321,7 @@ struct hisi_qm { dma_addr_t cqc_dma; dma_addr_t eqe_dma; dma_addr_t aeqe_dma; + struct qm_rsv_buf xqc_buf; struct hisi_qm_status status; struct hisi_qm_err_ini err_ini; -- 2.30.0

2 1

[PATCH OLK-5.10 00/42] add error handling for add disk
by Li Nan 06 Nov '23

06 Nov '23

Christoph Hellwig (14): block: fold register_disk into device_add_disk block: call blk_integrity_add earlier in device_add_disk block: add the events* attributes to disk_attrs block: fix error unwinding in device_add_disk block: clear ->slave_dir when dropping the main slave_dir reference block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Li Lingfeng (1): nbd: fix uaf in nbd_open Luis Chamberlain (10): block: return errors from blk_integrity_add block: return errors from disk_alloc_events block: add error handling for device_add_disk / add_disk block: fix device_add_disk() kobject_create_and_add() error handling loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Tetsuo Handa (1): block: check minor range in device_add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Wen Yang (1): Revert "Revert "block: nbd: add sanity check for first_minor"" Yu Kuai (3): nbd: fix max value for 'first_minor' nbd: fix possible overflow for 'first_minor' in nbd_dev_add() block: fix memory leak for elevator on add_disk failure Zhang Wensheng (1): nbd: fix possible overflow on 'first_minor' in nbd_dev_add() Zhong Jinghua (9): nbd: Reorganize the messy commit log about the first_minor check block: return errors from blk_register_region block: Fix the kabi change in device_add_disk block: Fix the kabi change on blk_register_region block: call blk_get_queue earlier in __device_add_disk block: Fix minor range check in device_add_disk() block: Set memalloc_noio to false in the error path mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup block/blk.h | 5 +- include/linux/blk-mq.h | 12 ++ include/linux/genhd.h | 36 +++++ block/blk-integrity.c | 12 +- block/blk-mq.c | 19 +++ block/genhd.c | 286 ++++++++++++++++++++++++++------------- drivers/block/brd.c | 103 ++++++-------- drivers/block/loop.c | 26 ++-- drivers/block/nbd.c | 75 ++++------ drivers/mtd/ubi/block.c | 76 +++++------ drivers/nvme/host/core.c | 41 +++--- drivers/scsi/sr.c | 7 +- 12 files changed, 413 insertions(+), 285 deletions(-) -- 2.39.2

1 42

[PATCH openEuler-1.0-LTS] crypto: hisilicon/qm - alloc reserve buffer to set and get xqc
by wangyuan 06 Nov '23

06 Nov '23

From: Yu'an Wang <wangyuan46(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8E6ED CVE: NA -------------------------------- If the temporarily applied memory is used to set or get the xqc information, the driver will release the memory after the mailbox timeout. However, the hardware still performs the operation. Therefore, the released memory may be written by hardware. So when load driver, reserve memory is applied for xqc configuration. Signed-off-by: Yu'an Wang <wangyuan46(a)huawei.com> --- drivers/crypto/hisilicon/qm.c | 554 +++++++++++++++------------------- drivers/crypto/hisilicon/qm.h | 13 + 2 files changed, 255 insertions(+), 312 deletions(-) diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c index 64e8ef1bf8e7..b4fd97e1e03e 100644 --- a/drivers/crypto/hisilicon/qm.c +++ b/drivers/crypto/hisilicon/qm.c @@ -50,7 +50,7 @@ #define QM_SQ_TYPE_MASK 0xf -#define QM_SQ_TAIL_IDX(sqc) ((le16_to_cpu((sqc)->w11) >> 6) & 0x1) +#define QM_SQ_TAIL_IDX(sqc) ((le16_to_cpu((sqc).w11) >> 6) & 0x1) /* cqc shift */ #define QM_CQ_HOP_NUM_SHIFT 0 @@ -64,7 +64,7 @@ #define QM_QC_CQE_SIZE 4 -#define QM_CQ_TAIL_IDX(cqc) ((le16_to_cpu((cqc)->w11) >> 6) & 0x1) +#define QM_CQ_TAIL_IDX(cqc) ((le16_to_cpu((cqc).w11) >> 6) & 0x1) /* eqc shift */ #define QM_EQE_AEQE_SIZE (2UL << 12) @@ -217,19 +217,6 @@ #define QM_MK_SQC_DW3_V2(sqe_sz) \ ((QM_Q_DEPTH - 1) | ((u32)ilog2(sqe_sz) << QM_SQ_SQE_SIZE_SHIFT)) -#define INIT_QC_COMMON(qc, base, pasid) do { \ - (qc)->head = 0; \ - (qc)->tail = 0; \ - (qc)->base_l = cpu_to_le32(lower_32_bits(base)); \ - (qc)->base_h = cpu_to_le32(upper_32_bits(base)); \ - (qc)->dw3 = 0; \ - (qc)->w8 = 0; \ - (qc)->rsvd0 = 0; \ - (qc)->pasid = cpu_to_le16(pasid); \ - (qc)->w11 = 0; \ - (qc)->rsvd1 = 0; \ -} while (0) - #define QMC_ALIGN(sz) ALIGN(sz, 32) static int __hisi_qm_start(struct hisi_qm *qm); @@ -537,6 +524,61 @@ static int hisi_qm_mb_read(struct hisi_qm *qm, u64 *base, u8 cmd, u16 queue) return 0; } +/* op 0: set xqc info to hardware, 1: get xqc info from hardware. */ +static int qm_set_and_get_xqc(struct hisi_qm *qm, u8 cmd, void *xqc, u32 qp_id, + bool op) +{ + struct hisi_qm *pf_qm = pci_get_drvdata(pci_physfn(qm->pdev)); + struct qm_mailbox mailbox; + dma_addr_t xqc_dma; + void *tmp_xqc; + size_t size; + int ret; + + switch (cmd) { + case QM_MB_CMD_SQC: + size = sizeof(struct qm_sqc); + tmp_xqc = qm->xqc_buf.sqc; + xqc_dma = qm->xqc_buf.sqc_dma; + break; + case QM_MB_CMD_CQC: + size = sizeof(struct qm_cqc); + tmp_xqc = qm->xqc_buf.cqc; + xqc_dma = qm->xqc_buf.cqc_dma; + break; + case QM_MB_CMD_EQC: + size = sizeof(struct qm_eqc); + tmp_xqc = qm->xqc_buf.eqc; + xqc_dma = qm->xqc_buf.eqc_dma; + break; + case QM_MB_CMD_AEQC: + size = sizeof(struct qm_aeqc); + tmp_xqc = qm->xqc_buf.aeqc; + xqc_dma = qm->xqc_buf.aeqc_dma; + break; + } + + /* No need to judge if master OOO is blocked. */ + if (qm_check_dev_error(pf_qm)) { + dev_err(&qm->pdev->dev, + "QM mailbox operation failed since qm is stop!\n"); + return -EIO; + } + + mutex_lock(&qm->mailbox_lock); + if (!op) + memcpy(tmp_xqc, xqc, size); + + qm_mb_pre_init(&mailbox, cmd, xqc_dma, qp_id, op); + ret = qm_mb_nolock(qm, &mailbox); + if (!ret && op) + memcpy(xqc, tmp_xqc, size); + + mutex_unlock(&qm->mailbox_lock); + + return ret; +} + static void qm_db_v1(struct hisi_qm *qm, u16 qn, u8 cmd, u16 index, u8 priority) { u64 doorbell; @@ -1166,35 +1208,6 @@ static ssize_t qm_cmd_read(struct file *filp, char __user *buffer, return (*pos = len); } -static void *qm_ctx_alloc(struct hisi_qm *qm, size_t ctx_size, - dma_addr_t *dma_addr) -{ - struct device *dev = &qm->pdev->dev; - void *ctx_addr; - - ctx_addr = kzalloc(ctx_size, GFP_KERNEL); - if (!ctx_addr) - return ERR_PTR(-ENOMEM); - - *dma_addr = dma_map_single(dev, ctx_addr, ctx_size, DMA_FROM_DEVICE); - if (dma_mapping_error(dev, *dma_addr)) { - dev_err(dev, "DMA mapping error!\n"); - kfree(ctx_addr); - return ERR_PTR(-ENOMEM); - } - - return ctx_addr; -} - -static void qm_ctx_free(struct hisi_qm *qm, size_t ctx_size, - const void *ctx_addr, dma_addr_t *dma_addr) -{ - struct device *dev = &qm->pdev->dev; - - dma_unmap_single(dev, *dma_addr, ctx_size, DMA_FROM_DEVICE); - kfree(ctx_addr); -} - static int dump_show(struct hisi_qm *qm, void *info, unsigned int info_size, char *info_name) { @@ -1205,8 +1218,10 @@ static int dump_show(struct hisi_qm *qm, void *info, #define BYTE_PER_DW 4 info_buf = kzalloc(info_size, GFP_KERNEL); - if (!info_buf) + if (!info_buf) { + dev_err(dev, "Fail to alloc dump info buf\n"); return -ENOMEM; + } for (i = 0; i < info_size; i++, info_curr++) { if (i % BYTE_PER_DW == 0) @@ -1230,21 +1245,11 @@ static int dump_show(struct hisi_qm *qm, void *info, return 0; } -static int qm_dump_sqc_raw(struct hisi_qm *qm, dma_addr_t dma_addr, u16 qp_id) -{ - return hisi_qm_mb_write(qm, QM_MB_CMD_SQC, dma_addr, qp_id, 1); -} - -static int qm_dump_cqc_raw(struct hisi_qm *qm, dma_addr_t dma_addr, u16 qp_id) -{ - return hisi_qm_mb_write(qm, QM_MB_CMD_CQC, dma_addr, qp_id, 1); -} - static int qm_sqc_dump(struct hisi_qm *qm, const char *s) { struct device *dev = &qm->pdev->dev; - struct qm_sqc *sqc, *sqc_curr; - dma_addr_t sqc_dma; + struct qm_sqc *sqc_curr; + struct qm_sqc sqc; u32 qp_id; int ret; @@ -1257,40 +1262,28 @@ static int qm_sqc_dump(struct hisi_qm *qm, const char *s) return -EINVAL; } - sqc = qm_ctx_alloc(qm, sizeof(struct qm_sqc), &sqc_dma); - if (IS_ERR(sqc)) - return PTR_ERR(sqc); - - ret = qm_dump_sqc_raw(qm, sqc_dma, qp_id); - if (ret) { - down_read(&qm->qps_lock); - if (qm->sqc) { - sqc_curr = qm->sqc + qp_id; - - ret = dump_show(qm, sqc_curr, sizeof(struct qm_sqc), - "SOFT SQC"); - if (ret) - dev_info(dev, "Show soft sqc failed!\n"); - } - up_read(&qm->qps_lock); + ret = qm_set_and_get_xqc(qm, QM_MB_CMD_SQC, &sqc, qp_id, 1); + if (!ret) + return dump_show(qm, &sqc, sizeof(struct qm_sqc), "SQC"); - goto mailbox_fail; + down_read(&qm->qps_lock); + if (qm->sqc) { + sqc_curr = qm->sqc + qp_id; + ret = dump_show(qm, sqc_curr, sizeof(struct qm_sqc), + "SOFT SQC"); + if (ret) + dev_info(dev, "Show soft sqc failed!\n"); } + up_read(&qm->qps_lock); - ret = dump_show(qm, sqc, sizeof(struct qm_sqc), "SQC"); - if (ret) - dev_info(dev, "Show hw sqc failed!\n"); - -mailbox_fail: - qm_ctx_free(qm, sizeof(struct qm_sqc), sqc, &sqc_dma); return ret; } static int qm_cqc_dump(struct hisi_qm *qm, const char *s) { struct device *dev = &qm->pdev->dev; - struct qm_cqc *cqc, *cqc_curr; - dma_addr_t cqc_dma; + struct qm_cqc *cqc_curr; + struct qm_cqc cqc; u32 qp_id; int ret; @@ -1303,40 +1296,28 @@ static int qm_cqc_dump(struct hisi_qm *qm, const char *s) return -EINVAL; } - cqc = qm_ctx_alloc(qm, sizeof(struct qm_cqc), &cqc_dma); - if (IS_ERR(cqc)) - return PTR_ERR(cqc); - - ret = qm_dump_cqc_raw(qm, cqc_dma, qp_id); - if (ret) { - down_read(&qm->qps_lock); - if (qm->cqc) { - cqc_curr = qm->cqc + qp_id; + ret = qm_set_and_get_xqc(qm, QM_MB_CMD_CQC, &cqc, qp_id, 1); + if (!ret) + return dump_show(qm, &cqc, sizeof(struct qm_cqc), "CQC"); - ret = dump_show(qm, cqc_curr, sizeof(struct qm_cqc), - "SOFT CQC"); - if (ret) - dev_info(dev, "Show soft cqc failed!\n"); - } - up_read(&qm->qps_lock); + down_read(&qm->qps_lock); + if (qm->cqc) { + cqc_curr = qm->cqc + qp_id; - goto mailbox_fail; + ret = dump_show(qm, cqc_curr, sizeof(struct qm_cqc), + "SOFT CQC"); + if (ret) + dev_info(dev, "Show soft cqc failed!\n"); } + up_read(&qm->qps_lock); - ret = dump_show(qm, cqc, sizeof(struct qm_cqc), "CQC"); - if (ret) - dev_info(dev, "Show hw cqc failed!\n"); - -mailbox_fail: - qm_ctx_free(qm, sizeof(struct qm_cqc), cqc, &cqc_dma); return ret; } static int qm_eqc_dump(struct hisi_qm *qm, char *s) { struct device *dev = &qm->pdev->dev; - struct qm_eqc *eqc; - dma_addr_t eqc_dma; + struct qm_eqc eqc; int ret; if (strsep(&s, " ")) { @@ -1344,28 +1325,17 @@ static int qm_eqc_dump(struct hisi_qm *qm, char *s) return -EINVAL; } - eqc = qm_ctx_alloc(qm, sizeof(struct qm_eqc), &eqc_dma); - if (IS_ERR(eqc)) - return PTR_ERR(eqc); - - ret = hisi_qm_mb_write(qm, QM_MB_CMD_EQC, eqc_dma, 0, 1); + ret = qm_set_and_get_xqc(qm, QM_MB_CMD_EQC, &eqc, 0, 1); if (ret) - goto mailbox_fail; - - ret = dump_show(qm, eqc, sizeof(struct qm_eqc), "EQC"); - if (ret) - dev_info(dev, "Show eqc failed!\n"); + return ret; -mailbox_fail: - qm_ctx_free(qm, sizeof(struct qm_eqc), eqc, &eqc_dma); - return ret; + return dump_show(qm, &eqc, sizeof(struct qm_eqc), "EQC"); } static int qm_aeqc_dump(struct hisi_qm *qm, char *s) { struct device *dev = &qm->pdev->dev; - struct qm_aeqc *aeqc; - dma_addr_t aeqc_dma; + struct qm_aeqc aeqc; int ret; if (strsep(&s, " ")) { @@ -1373,21 +1343,11 @@ static int qm_aeqc_dump(struct hisi_qm *qm, char *s) return -EINVAL; } - aeqc = qm_ctx_alloc(qm, sizeof(struct qm_aeqc), &aeqc_dma); - if (IS_ERR(aeqc)) - return PTR_ERR(aeqc); - - ret = hisi_qm_mb_write(qm, QM_MB_CMD_AEQC, aeqc_dma, 0, 1); - if (ret) - goto mailbox_fail; - - ret = dump_show(qm, aeqc, sizeof(struct qm_aeqc), "AEQC"); + ret = qm_set_and_get_xqc(qm, QM_MB_CMD_AEQC, &aeqc, 0, 1); if (ret) - dev_info(dev, "Show hw aeqc failed!\n"); + return ret; -mailbox_fail: - qm_ctx_free(qm, sizeof(struct qm_aeqc), aeqc, &aeqc_dma); - return ret; + return dump_show(qm, &aeqc, sizeof(struct qm_aeqc), "AEQC"); } static int q_dump_param_parse(struct hisi_qm *qm, char *s, @@ -1432,7 +1392,6 @@ static int q_dump_param_parse(struct hisi_qm *qm, char *s, static int qm_sq_dump(struct hisi_qm *qm, char *s) { - struct device *dev = &qm->pdev->dev; struct hisi_qp *qp; u32 qp_id, sqe_id; void *sqe_curr; @@ -1447,16 +1406,11 @@ static int qm_sq_dump(struct hisi_qm *qm, char *s) memset(sqe_curr + qm->debug.sqe_mask_offset, SQE_ADDR_MASK, qm->debug.sqe_mask_len); - ret = dump_show(qm, sqe_curr, qm->sqe_size, "SQE"); - if (ret) - dev_info(dev, "Show sqe failed!\n"); - - return ret; + return dump_show(qm, sqe_curr, qm->sqe_size, "SQE"); } static int qm_cq_dump(struct hisi_qm *qm, char *s) { - struct device *dev = &qm->pdev->dev; struct qm_cqe *cqe_curr; struct hisi_qp *qp; u32 qp_id, cqe_id; @@ -1468,11 +1422,8 @@ static int qm_cq_dump(struct hisi_qm *qm, char *s) qp = &qm->qp_array[qp_id]; cqe_curr = qp->cqe + cqe_id; - ret = dump_show(qm, cqe_curr, sizeof(struct qm_cqe), "CQE"); - if (ret) - dev_info(dev, "Show cqe failed!\n"); - return ret; + return dump_show(qm, cqe_curr, sizeof(struct qm_cqe), "CQE"); } static int qm_eq_dump(struct hisi_qm *qm, const char *s) @@ -1895,79 +1846,46 @@ EXPORT_SYMBOL_GPL(hisi_qm_release_qp); static int qm_sq_ctx_cfg(struct hisi_qp *qp, int qp_id, int pasid) { struct hisi_qm *qm = qp->qm; - struct device *dev = &qm->pdev->dev; enum qm_hw_ver ver = qm->ver; - struct qm_sqc *sqc; - dma_addr_t sqc_dma; - int ret; + struct qm_sqc sqc = {0}; - sqc = kzalloc(sizeof(struct qm_sqc), GFP_KERNEL); - if (!sqc) - return -ENOMEM; - sqc_dma = dma_map_single(dev, sqc, sizeof(struct qm_sqc), - DMA_TO_DEVICE); - if (dma_mapping_error(dev, sqc_dma)) { - kfree(sqc); - return -ENOMEM; - } - - INIT_QC_COMMON(sqc, qp->sqe_dma, pasid); if (ver == QM_HW_V1) { - sqc->dw3 = cpu_to_le32(QM_MK_SQC_DW3_V1(0, 0, 0, qm->sqe_size)); - sqc->w8 = cpu_to_le16(QM_Q_DEPTH - 1); + sqc.dw3 = cpu_to_le32(QM_MK_SQC_DW3_V1(0, 0, 0, qm->sqe_size)); + sqc.w8 = cpu_to_le16(QM_Q_DEPTH - 1); } else if (ver == QM_HW_V2) { - sqc->dw3 = cpu_to_le32(QM_MK_SQC_DW3_V2(qm->sqe_size)); - sqc->w8 = 0; /* rand_qc */ + sqc.dw3 = cpu_to_le32(QM_MK_SQC_DW3_V2(qm->sqe_size)); + sqc.w8 = 0; /* rand_qc */ } - sqc->cq_num = cpu_to_le16(qp_id); - sqc->w13 = cpu_to_le16(QM_MK_SQC_W13(0, 1, qp->alg_type)); - - ret = hisi_qm_mb_write(qm, QM_MB_CMD_SQC, sqc_dma, qp_id, 0); + sqc.cq_num = cpu_to_le16(qp_id); + sqc.w13 = cpu_to_le16(QM_MK_SQC_W13(0, 1, qp->alg_type)); + sqc.base_l = cpu_to_le32(lower_32_bits(qp->sqe_dma)); + sqc.base_h = cpu_to_le32(upper_32_bits(qp->sqe_dma)); + sqc.pasid = cpu_to_le16(pasid); - dma_unmap_single(dev, sqc_dma, sizeof(struct qm_sqc), DMA_TO_DEVICE); - kfree(sqc); - - return ret; + return qm_set_and_get_xqc(qm, QM_MB_CMD_SQC, &sqc, qp_id, 0); } static int qm_cq_ctx_cfg(struct hisi_qp *qp, int qp_id, int pasid) { struct hisi_qm *qm = qp->qm; - struct device *dev = &qm->pdev->dev; enum qm_hw_ver ver = qm->ver; - struct qm_cqc *cqc; - dma_addr_t cqc_dma; - int ret; - - cqc = kzalloc(sizeof(struct qm_cqc), GFP_KERNEL); - if (!cqc) - return -ENOMEM; - - cqc_dma = dma_map_single(dev, cqc, sizeof(struct qm_cqc), - DMA_TO_DEVICE); - if (dma_mapping_error(dev, cqc_dma)) { - kfree(cqc); - return -ENOMEM; - } + struct qm_cqc cqc = {0}; - INIT_QC_COMMON(cqc, qp->cqe_dma, pasid); if (ver == QM_HW_V1) { - cqc->dw3 = cpu_to_le32(QM_MK_CQC_DW3_V1(0, 0, 0, + cqc.dw3 = cpu_to_le32(QM_MK_CQC_DW3_V1(0, 0, 0, QM_QC_CQE_SIZE)); - cqc->w8 = cpu_to_le16(QM_Q_DEPTH - 1); + cqc.w8 = cpu_to_le16(QM_Q_DEPTH - 1); } else if (ver == QM_HW_V2) { - cqc->dw3 = cpu_to_le32(QM_MK_CQC_DW3_V2(QM_QC_CQE_SIZE)); - cqc->w8 = 0; /* rand_qc */ + cqc.dw3 = cpu_to_le32(QM_MK_CQC_DW3_V2(QM_QC_CQE_SIZE)); + cqc.w8 = 0; /* rand_qc */ } - cqc->dw6 = cpu_to_le32(1 << QM_CQ_PHASE_SHIFT | - qp->c_flag << QM_CQ_FLAG_SHIFT); + cqc.dw6 = cpu_to_le32(1 << QM_CQ_PHASE_SHIFT | + qp->c_flag << QM_CQ_FLAG_SHIFT); + cqc.base_l = cpu_to_le32(lower_32_bits(qp->cqe_dma)); + cqc.base_h = cpu_to_le32(upper_32_bits(qp->cqe_dma)); + cqc.pasid = cpu_to_le16(pasid); - ret = hisi_qm_mb_write(qm, QM_MB_CMD_CQC, cqc_dma, qp_id, 0); - - dma_unmap_single(dev, cqc_dma, sizeof(struct qm_cqc), DMA_TO_DEVICE); - kfree(cqc); - - return ret; + return qm_set_and_get_xqc(qm, QM_MB_CMD_CQC, &cqc, qp_id, 0); } static int qm_qp_ctx_cfg(struct hisi_qp *qp, int qp_id, int pasid) @@ -2043,54 +1961,40 @@ static void qp_stop_fail_cb(struct hisi_qp *qp) static void qm_qp_has_no_task(struct hisi_qp *qp) { - size_t size = sizeof(struct qm_sqc) + sizeof(struct qm_cqc); - struct device *dev = &qp->qm->pdev->dev; - struct qm_sqc *sqc; - struct qm_cqc *cqc; - dma_addr_t dma_addr; - void *addr; - int i = 0; - int ret; + struct hisi_qm *qm = qp->qm; + struct device *dev = &qm->pdev->dev; + struct qm_sqc sqc; + struct qm_cqc cqc; + int ret, i = 0; if (qp->qm->err_ini.err_info.is_qm_ecc_mbit || qp->qm->err_ini.err_info.is_dev_ecc_mbit) return; - addr = qm_ctx_alloc(qp->qm, size, &dma_addr); - if (IS_ERR(addr)) { - dev_err(dev, "alloc ctx for sqc and cqc failed!\n"); - return; - } - while (++i) { - ret = qm_dump_sqc_raw(qp->qm, dma_addr, qp->qp_id); + ret = qm_set_and_get_xqc(qm, QM_MB_CMD_SQC, &sqc, qp->qp_id, 1); if (ret) { - dev_err(dev, "Failed to dump sqc!\n"); - break; + dev_err_ratelimited(dev, "Fail to dump sqc!\n"); + return; } - sqc = addr; - ret = qm_dump_cqc_raw(qp->qm, - (dma_addr + sizeof(struct qm_sqc)), qp->qp_id); + ret = qm_set_and_get_xqc(qm, QM_MB_CMD_CQC, &cqc, qp->qp_id, 1); if (ret) { - dev_err(dev, "Failed to dump cqc!\n"); - break; + dev_err_ratelimited(dev, "Fail to dump cqc!\n"); + return; } - cqc = addr + sizeof(struct qm_sqc); - if ((sqc->tail == cqc->tail) && - (QM_SQ_TAIL_IDX(sqc) == QM_CQ_TAIL_IDX(cqc))) - break; + if ((QM_SQ_TAIL_IDX(sqc) == QM_CQ_TAIL_IDX(cqc)) && + (sqc.tail == cqc.tail)) + return; if (i == MAX_WAIT_COUNTS) { - dev_err(dev, "Fail to wait for device stop!\n"); - break; + dev_err(dev, "Fail to empty queue %u!\n", qp->qp_id); + return; } usleep_range(WAIT_PERIOD_US_MIN, WAIT_PERIOD_US_MAX); } - - qm_ctx_free(qp->qm, size, addr, &dma_addr); } static int hisi_qm_stop_qp_nolock(struct hisi_qp *qp) @@ -2597,10 +2501,12 @@ static int hisi_qp_memory_init(struct hisi_qm *qm, size_t dma_size, int id) struct hisi_qp *qp; qp = &qm->qp_array[id]; - qp->qdma.va = dma_alloc_coherent(dev, dma_size, - &qp->qdma.dma, GFP_KERNEL); - if (!qp->qdma.va) + qp->qdma.va = dma_alloc_coherent(dev, dma_size, &qp->qdma.dma, + GFP_KERNEL); + if (!qp->qdma.va) { + dev_err(dev, "Fail to alloc qp dma buf size=%zx\n", dma_size); return -ENOMEM; + } qp->sqe = qp->qdma.va; qp->sqe_dma = qp->qdma.dma; @@ -2613,13 +2519,79 @@ static int hisi_qp_memory_init(struct hisi_qm *qm, size_t dma_size, int id) return 0; } +static int hisi_qp_alloc_memory(struct hisi_qm *qm) +{ + size_t qp_dma_size; + int i, ret; + + qm->qp_array = kcalloc(qm->qp_num, sizeof(struct hisi_qp), GFP_KERNEL); + if (!qm->qp_array) + return -ENOMEM; + + /* one more page for device or qp statuses */ + qp_dma_size = qm->sqe_size * QM_Q_DEPTH + + sizeof(struct cqe) * QM_Q_DEPTH; + qp_dma_size = PAGE_ALIGN(qp_dma_size) + PAGE_SIZE; + for (i = 0; i < qm->qp_num; i++) { + ret = hisi_qp_memory_init(qm, qp_dma_size, i); + if (ret) + goto err_init_qp_mem; + } + + return 0; + +err_init_qp_mem: + hisi_qp_memory_uninit(qm, i); + + return ret; +} + +static void hisi_qm_free_rsv_buf(struct hisi_qm *qm) +{ + struct qm_dma *xqc_dma = &qm->xqc_buf.qcdma; + struct device *dev = &qm->pdev->dev; + + dma_free_coherent(dev, xqc_dma->size, xqc_dma->va, xqc_dma->dma); +} + +static int hisi_qm_alloc_rsv_buf(struct hisi_qm *qm) +{ + struct qm_rsv_buf *xqc_buf = &qm->xqc_buf; + struct qm_dma *xqc_dma = &xqc_buf->qcdma; + struct device *dev = &qm->pdev->dev; + size_t off = 0; + +#define QM_XQC_BUF_INIT(xqc_buf, type) do { \ + (xqc_buf)->type = ((xqc_buf)->qcdma.va + (off)); \ + (xqc_buf)->type##_dma = (xqc_buf)->qcdma.dma + (off); \ + off += QMC_ALIGN(sizeof(struct qm_##type)); \ +} while (0) + + xqc_dma->size = QMC_ALIGN(sizeof(struct qm_eqc)) + + QMC_ALIGN(sizeof(struct qm_aeqc)) + + QMC_ALIGN(sizeof(struct qm_sqc)) + + QMC_ALIGN(sizeof(struct qm_cqc)); + + xqc_dma->va = dma_alloc_coherent(dev, xqc_dma->size, &xqc_dma->dma, + GFP_ATOMIC); + if (!xqc_dma->va) { + dev_err(dev, "Fail to alloc qcdma size=%zx\n", xqc_dma->size); + return -ENOMEM; + } + + QM_XQC_BUF_INIT(xqc_buf, eqc); + QM_XQC_BUF_INIT(xqc_buf, aeqc); + QM_XQC_BUF_INIT(xqc_buf, sqc); + QM_XQC_BUF_INIT(xqc_buf, cqc); + + return 0; +} + static int hisi_qm_memory_init(struct hisi_qm *qm) { struct device *dev = &qm->pdev->dev; - size_t qp_dma_size; + int ret = -ENOMEM; size_t off = 0; - int ret = 0; - int i; #define QM_INIT_BUF(qm, type, num) do { \ (qm)->type = ((qm)->qdma.va + (off)); \ @@ -2635,41 +2607,35 @@ static int hisi_qm_memory_init(struct hisi_qm *qm) QMC_ALIGN(sizeof(struct qm_aeqe) * QM_Q_DEPTH) + QMC_ALIGN(sizeof(struct qm_sqc) * qm->qp_num) + QMC_ALIGN(sizeof(struct qm_cqc) * qm->qp_num); - qm->qdma.va = dma_alloc_coherent(dev, qm->qdma.size, - &qm->qdma.dma, GFP_ATOMIC | __GFP_ZERO); - dev_dbg(dev, "allocate qm dma buf size=%zx)\n", qm->qdma.size); - if (!qm->qdma.va) - return -ENOMEM; + qm->qdma.va = dma_alloc_coherent(dev, qm->qdma.size, &qm->qdma.dma, + GFP_ATOMIC | __GFP_ZERO); + if (!qm->qdma.va) { + dev_err(dev, "Fail to alloc qdma size=%zx\n", qm->qdma.size); + goto err_destroy_idr; + } QM_INIT_BUF(qm, eqe, QM_EQ_DEPTH); QM_INIT_BUF(qm, aeqe, QM_Q_DEPTH); QM_INIT_BUF(qm, sqc, qm->qp_num); QM_INIT_BUF(qm, cqc, qm->qp_num); - qm->qp_array = kcalloc(qm->qp_num, sizeof(struct hisi_qp), GFP_KERNEL); - if (!qm->qp_array) { - ret = -ENOMEM; - goto err_alloc_qp_array; - } + ret = hisi_qm_alloc_rsv_buf(qm); + if (ret) + goto err_free_qdma; - /* one more page for device or qp statuses */ - qp_dma_size = qm->sqe_size * QM_Q_DEPTH + - sizeof(struct cqe) * QM_Q_DEPTH; - qp_dma_size = PAGE_ALIGN(qp_dma_size) + PAGE_SIZE; - for (i = 0; i < qm->qp_num; i++) { - ret = hisi_qp_memory_init(qm, qp_dma_size, i); - if (ret) - goto err_init_qp_mem; + ret = hisi_qp_alloc_memory(qm); + if (ret) + goto err_free_reserve_buf; - dev_dbg(dev, "allocate qp dma buf size=%zx)\n", qp_dma_size); - } + return 0; + +err_free_reserve_buf: + hisi_qm_free_rsv_buf(qm); +err_free_qdma: + dma_free_coherent(dev, qm->qdma.size, qm->qdma.va, qm->qdma.dma); +err_destroy_idr: + idr_destroy(&qm->qp_idr); - return ret; -err_init_qp_mem: - hisi_qp_memory_uninit(qm, i); -err_alloc_qp_array: - dma_free_coherent(dev, qm->qdma.size, - qm->qdma.va, qm->qdma.dma); return ret; } @@ -2861,8 +2827,7 @@ void hisi_qm_uninit(struct hisi_qm *qm) hisi_qp_memory_uninit(qm, qm->qp_num); idr_destroy(&qm->qp_idr); - - /* qm hardware buffer free on put_queue if no dma api */ + hisi_qm_free_rsv_buf(qm); if (qm->qdma.va) { hisi_qm_cache_wb(qm); dma_free_coherent(dev, qm->qdma.size, @@ -2962,59 +2927,26 @@ static void qm_init_eq_aeq_status(struct hisi_qm *qm) static int qm_eq_ctx_cfg(struct hisi_qm *qm) { - struct device *dev = &qm->pdev->dev; - struct qm_eqc *eqc; - dma_addr_t eqc_dma; - int ret; + struct qm_eqc eqc = {0}; - eqc = kzalloc(sizeof(struct qm_eqc), GFP_KERNEL); - if (!eqc) - return -ENOMEM; - eqc_dma = dma_map_single(dev, eqc, sizeof(struct qm_eqc), - DMA_TO_DEVICE); - if (dma_mapping_error(dev, eqc_dma)) { - kfree(eqc); - return -ENOMEM; - } - - eqc->base_l = cpu_to_le32(lower_32_bits(qm->eqe_dma)); - eqc->base_h = cpu_to_le32(upper_32_bits(qm->eqe_dma)); + eqc.base_l = cpu_to_le32(lower_32_bits(qm->eqe_dma)); + eqc.base_h = cpu_to_le32(upper_32_bits(qm->eqe_dma)); if (qm->ver == QM_HW_V1) - eqc->dw3 = cpu_to_le32(QM_EQE_AEQE_SIZE); - eqc->dw6 = cpu_to_le32((QM_EQ_DEPTH - 1) | (1 << QM_EQC_PHASE_SHIFT)); - ret = hisi_qm_mb_write(qm, QM_MB_CMD_EQC, eqc_dma, 0, 0); - dma_unmap_single(dev, eqc_dma, sizeof(struct qm_eqc), DMA_TO_DEVICE); - kfree(eqc); + eqc.dw3 = cpu_to_le32(QM_EQE_AEQE_SIZE); + eqc.dw6 = cpu_to_le32((QM_EQ_DEPTH - 1) | (1 << QM_EQC_PHASE_SHIFT)); - return ret; + return qm_set_and_get_xqc(qm, QM_MB_CMD_EQC, &eqc, 0, 0); } static int qm_aeq_ctx_cfg(struct hisi_qm *qm) { - struct device *dev = &qm->pdev->dev; - struct qm_aeqc *aeqc; - dma_addr_t aeqc_dma; - int ret; + struct qm_aeqc aeqc = {0}; - aeqc = kzalloc(sizeof(struct qm_aeqc), GFP_KERNEL); - if (!aeqc) - return -ENOMEM; - aeqc_dma = dma_map_single(dev, aeqc, sizeof(struct qm_aeqc), - DMA_TO_DEVICE); - if (dma_mapping_error(dev, aeqc_dma)) { - kfree(aeqc); - return -ENOMEM; - } + aeqc.base_l = cpu_to_le32(lower_32_bits(qm->aeqe_dma)); + aeqc.base_h = cpu_to_le32(upper_32_bits(qm->aeqe_dma)); + aeqc.dw6 = cpu_to_le32((QM_Q_DEPTH - 1) | (1 << QM_EQC_PHASE_SHIFT)); - aeqc->base_l = cpu_to_le32(lower_32_bits(qm->aeqe_dma)); - aeqc->base_h = cpu_to_le32(upper_32_bits(qm->aeqe_dma)); - aeqc->dw6 = cpu_to_le32((QM_Q_DEPTH - 1) | (1 << QM_EQC_PHASE_SHIFT)); - ret = hisi_qm_mb_write(qm, QM_MB_CMD_AEQC, aeqc_dma, 0, 0); - - dma_unmap_single(dev, aeqc_dma, sizeof(struct qm_aeqc), DMA_TO_DEVICE); - kfree(aeqc); - - return ret; + return qm_set_and_get_xqc(qm, QM_MB_CMD_AEQC, &aeqc, 0, 0); } static int qm_eq_aeq_ctx_cfg(struct hisi_qm *qm) @@ -3841,10 +3773,8 @@ static int qm_vf_reset_prepare(struct pci_dev *pdev, ret = hisi_qm_stop(qm, stop_reason); if (ret) { - hisi_qm_set_hw_reset(qm, - QM_RESET_STOP_TX_OFFSET); - hisi_qm_set_hw_reset(qm, - QM_RESET_STOP_RX_OFFSET); + hisi_qm_set_hw_reset(qm, QM_RESET_STOP_TX_OFFSET); + hisi_qm_set_hw_reset(qm, QM_RESET_STOP_RX_OFFSET); atomic_set(&qm->status.flags, QM_STOP); } } diff --git a/drivers/crypto/hisilicon/qm.h b/drivers/crypto/hisilicon/qm.h index d7d23d1ec34c..9f5e440d7396 100644 --- a/drivers/crypto/hisilicon/qm.h +++ b/drivers/crypto/hisilicon/qm.h @@ -286,6 +286,18 @@ struct hisi_qm_list { bool (*check)(struct hisi_qm *qm); }; +struct qm_rsv_buf { + struct qm_sqc *sqc; + struct qm_cqc *cqc; + struct qm_eqc *eqc; + struct qm_aeqc *aeqc; + dma_addr_t sqc_dma; + dma_addr_t cqc_dma; + dma_addr_t eqc_dma; + dma_addr_t aeqc_dma; + struct qm_dma qcdma; +}; + struct hisi_qm { enum qm_hw_ver ver; enum qm_fun_type fun_type; @@ -309,6 +321,7 @@ struct hisi_qm { dma_addr_t cqc_dma; dma_addr_t eqe_dma; dma_addr_t aeqe_dma; + struct qm_rsv_buf xqc_buf; struct hisi_qm_status status; struct hisi_qm_err_ini err_ini; -- 2.30.0

2 1

[PATCH OLK-5.10 v4 0/7] AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device
by Qian Zou 06 Nov '23

06 Nov '23

From: “z00447436” <zouqian4(a)huawei.com> Some use-cases, such as system management, require the ability to generate a non-maskable event to the OS to request the OS kernel to perform a diagnostic dump and reset the system. Arm Generic Diagnostic Dump and Reset device enables a maintainer to request OS to perform a diagnostic dump and reset a system via SDEI event or an interrupt. This patch implements SDEI path and discards the interrupted context before proceeding to the crash kernel. D Scott Phillips (1): arm64: sdei: abort running SDEI handlers during crash Ilkka Koskinen (4): ACPI: tables: Add AGDI to the list of known table signatures ACPI: AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device ACPICA: iASL: Add suppport for AGDI table ACPI: AGDI: Fix missing prototype warning for acpi_agdi_init() Jia He (1): EDAC/ghes: Make ghes_edac a proper module Shuai Xue (1): ACPI: APEI: explicit init of HEST and GHES in apci_init() arch/arm64/include/asm/sdei.h | 6 ++ arch/arm64/kernel/entry.S | 27 +++++++- arch/arm64/kernel/sdei.c | 3 + arch/arm64/kernel/smp.c | 8 +-- drivers/acpi/apei/ghes.c | 23 +++---- drivers/acpi/arm64/Kconfig | 10 +++ drivers/acpi/arm64/Makefile | 1 + drivers/acpi/arm64/agdi.c | 117 ++++++++++++++++++++++++++++++++++ drivers/acpi/bus.c | 4 ++ drivers/acpi/pci_root.c | 3 - drivers/acpi/tables.c | 2 +- drivers/edac/Kconfig | 4 +- drivers/edac/ghes_edac.c | 40 +++++++++++- drivers/firmware/Kconfig | 1 + drivers/firmware/arm_sdei.c | 32 ++++++---- include/acpi/actbl2.h | 20 ++++++ include/acpi/apei.h | 4 +- include/acpi/ghes.h | 20 +----- include/linux/acpi_agdi.h | 13 ++++ include/linux/arm_sdei.h | 4 ++ 20 files changed, 283 insertions(+), 59 deletions(-) create mode 100644 drivers/acpi/arm64/agdi.c create mode 100644 include/linux/acpi_agdi.h -- 2.33.0

2 8

[PATCH OLK-5.10] blk-mq: avoid housekeeping CPUs scheduling a worker on a non-housekeeping CPU
by Xiongfeng Wang 06 Nov '23

06 Nov '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7ZBTV CVE: N/A ---------------------------------------------------- When NOHZ_FULL is enabled, such as in HPC situation, CPUs are divided into housekeeping CPUs and non-housekeeping CPUs. Non-housekeeping CPUs are NOHZ_FULL CPUs and are often monopolized by the userspace process, such HPC application process. Any sort of interruption is not expected. blk_mq_hctx_next_cpu() selects each cpu in 'hctx->cpumask' alternately to schedule the work thread blk_mq_run_work_fn(). When 'hctx->cpumask' contains housekeeping CPU and non-housekeeping CPU at the same time, a housekeeping CPU, which want to request a IO, may schedule a worker on a non-housekeeping CPU. This may affect the performance of the userspace application running on non-housekeeping CPUs. So let's just schedule the worker thread on the current CPU when the current CPU is housekeeping CPU. Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- block/blk-mq.c | 11 ++++++++++- include/linux/sched/isolation.h | 2 ++ kernel/sched/isolation.c | 8 ++++++++ 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 1d1200afb771..d0dce9ef9499 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -23,6 +23,7 @@ #include <linux/sched/sysctl.h> #include <linux/sched/topology.h> #include <linux/sched/signal.h> +#include <linux/sched/isolation.h> #include <linux/delay.h> #include <linux/crash_dump.h> #include <linux/prefetch.h> @@ -1676,6 +1677,8 @@ static int blk_mq_hctx_next_cpu(struct blk_mq_hw_ctx *hctx) static void __blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async, unsigned long msecs) { + int work_cpu; + if (unlikely(blk_mq_hctx_stopped(hctx))) return; @@ -1697,7 +1700,13 @@ static void __blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async, if (!percpu_ref_tryget(&hctx->queue->q_usage_counter)) return; - kblockd_mod_delayed_work_on(blk_mq_hctx_next_cpu(hctx), &hctx->run_work, + if (enhanced_isolcpus && tick_nohz_full_enabled() && + housekeeping_cpu(smp_processor_id(), HK_FLAG_WQ)) + work_cpu = smp_processor_id(); + else + work_cpu = blk_mq_hctx_next_cpu(hctx); + + kblockd_mod_delayed_work_on(work_cpu, &hctx->run_work, msecs_to_jiffies(msecs)); percpu_ref_put(&hctx->queue->q_usage_counter); } diff --git a/include/linux/sched/isolation.h b/include/linux/sched/isolation.h index cc9f393e2a70..2f93081ad7a0 100644 --- a/include/linux/sched/isolation.h +++ b/include/linux/sched/isolation.h @@ -18,6 +18,7 @@ enum hk_flags { }; #ifdef CONFIG_CPU_ISOLATION +extern bool enhanced_isolcpus; DECLARE_STATIC_KEY_FALSE(housekeeping_overridden); extern int housekeeping_any_cpu(enum hk_flags flags); extern const struct cpumask *housekeeping_cpumask(enum hk_flags flags); @@ -28,6 +29,7 @@ extern void __init housekeeping_init(void); #else +#define enhanced_isolcpus 0 static inline int housekeeping_any_cpu(enum hk_flags flags) { return smp_processor_id(); diff --git a/kernel/sched/isolation.c b/kernel/sched/isolation.c index 5a6ea03f9882..785ef5201116 100644 --- a/kernel/sched/isolation.c +++ b/kernel/sched/isolation.c @@ -198,3 +198,11 @@ static int __init housekeeping_isolcpus_setup(char *str) return housekeeping_setup(str, flags); } __setup("isolcpus=", housekeeping_isolcpus_setup); + +bool enhanced_isolcpus; +static int __init enhanced_isolcpus_setup(char *str) +{ + enhanced_isolcpus = true; + return 0; +} +__setup("enhanced_isolcpus", enhanced_isolcpus_setup); -- 2.20.1

3 3

[PATCH OLK-5.10 v3 0/7] AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device
by Qian Zou 06 Nov '23

06 Nov '23

From: “z00447436” <zouqian4(a)huawei.com> Some use-cases, such as system management, require the ability to generate a non-maskable event to the OS to request the OS kernel to perform a diagnostic dump and reset the system. Arm Generic Diagnostic Dump and Reset device enables a maintainer to request OS to perform a diagnostic dump and reset a system via SDEI event or an interrupt. This patch implements SDEI path and discards the interrupted context before proceeding to the crash kernel. D Scott Phillips (1): arm64: sdei: abort running SDEI handlers during crash Ilkka Koskinen (4): ACPI: tables: Add AGDI to the list of known table signatures ACPI: AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device ACPICA: iASL: Add suppport for AGDI table ACPI: AGDI: Fix missing prototype warning for acpi_agdi_init() Jia He (1): EDAC/ghes: Make ghes_edac a proper module Shuai Xue (1): ACPI: APEI: explicit init of HEST and GHES in apci_init() arch/arm64/include/asm/sdei.h | 6 ++ arch/arm64/kernel/entry.S | 27 +++++++- arch/arm64/kernel/sdei.c | 3 + arch/arm64/kernel/smp.c | 8 +-- drivers/acpi/apei/ghes.c | 23 +++---- drivers/acpi/arm64/Kconfig | 10 +++ drivers/acpi/arm64/Makefile | 1 + drivers/acpi/arm64/agdi.c | 117 ++++++++++++++++++++++++++++++++++ drivers/acpi/bus.c | 4 ++ drivers/acpi/pci_root.c | 3 - drivers/acpi/tables.c | 2 +- drivers/edac/Kconfig | 4 +- drivers/edac/ghes_edac.c | 40 +++++++++++- drivers/firmware/Kconfig | 1 + drivers/firmware/arm_sdei.c | 32 ++++++---- include/acpi/actbl2.h | 20 ++++++ include/acpi/apei.h | 4 +- include/acpi/ghes.h | 25 -------- include/linux/acpi_agdi.h | 13 ++++ include/linux/arm_sdei.h | 4 ++ 20 files changed, 281 insertions(+), 66 deletions(-) create mode 100644 drivers/acpi/arm64/agdi.c create mode 100644 include/linux/acpi_agdi.h -- 2.33.0

2 8

[PATCH OLK-5.10 v2 0/7] AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device
by Qian Zou 06 Nov '23

06 Nov '23

From: “z00447436” <zouqian4(a)huawei.com> Some use-cases, such as system management, require the ability to generate a non-maskable event to the OS to request the OS kernel to perform a diagnostic dump and reset the system. Arm Generic Diagnostic Dump and Reset device enables a maintainer to request OS to perform a diagnostic dump and reset a system via SDEI event or an interrupt. This patch implements SDEI path and discards the interrupted context before proceeding to the crash kernel. D Scott Phillips (1): arm64: sdei: abort running SDEI handlers during crash Ilkka Koskinen (4): ACPI: tables: Add AGDI to the list of known table signatures ACPI: AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device ACPICA: iASL: Add suppport for AGDI table ACPI: AGDI: Fix missing prototype warning for acpi_agdi_init() Jia He (1): EDAC/ghes: Make ghes_edac a proper module Shuai Xue (1): ACPI: APEI: explicit init of HEST and GHES in apci_init() arch/arm64/include/asm/sdei.h | 6 ++ arch/arm64/kernel/entry.S | 27 +++++++- arch/arm64/kernel/sdei.c | 3 + arch/arm64/kernel/smp.c | 8 +-- drivers/acpi/apei/ghes.c | 23 +++---- drivers/acpi/arm64/Kconfig | 10 +++ drivers/acpi/arm64/Makefile | 1 + drivers/acpi/arm64/agdi.c | 117 ++++++++++++++++++++++++++++++++++ drivers/acpi/bus.c | 4 ++ drivers/acpi/pci_root.c | 3 - drivers/acpi/tables.c | 2 +- drivers/edac/Kconfig | 4 +- drivers/edac/ghes_edac.c | 40 +++++++++++- drivers/firmware/Kconfig | 1 + drivers/firmware/arm_sdei.c | 32 ++++++---- include/acpi/actbl2.h | 20 ++++++ include/acpi/apei.h | 4 +- include/acpi/ghes.h | 25 -------- include/linux/acpi_agdi.h | 13 ++++ include/linux/arm_sdei.h | 4 ++ 20 files changed, 281 insertions(+), 66 deletions(-) create mode 100644 drivers/acpi/arm64/agdi.c create mode 100644 include/linux/acpi_agdi.h -- 2.33.0

2 8

[PATCH openEuler-1.0-LTS] fs: lockd: avoid possible wrong NULL parameter
by ZhaoLong Wang 06 Nov '23

06 Nov '23

From: Su Hui <suhui(a)nfschina.com> stable inclusion from stable-v4.19.295 commit 35f0749756b848ad4f4a165ad6b1dfa8d0e45a96 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8E5Q5 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit de8d38cf44bac43e83bad28357ba84784c412752 ] clang's static analysis warning: fs/lockd/mon.c: line 293, column 2: Null pointer passed as 2nd argument to memory copy function. Assuming 'hostname' is NULL and calling 'nsm_create_handle()', this will pass NULL as 2nd argument to memory copy function 'memcpy()'. So return NULL if 'hostname' is invalid. Fixes: 77a3ef33e2de ("NSM: More clean up of nsm_get_handle()") Signed-off-by: Su Hui <suhui(a)nfschina.com> Reviewed-by: Nick Desaulniers <ndesaulniers(a)google.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/lockd/mon.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c index 654594ef4f94..68a2eac548c3 100644 --- a/fs/lockd/mon.c +++ b/fs/lockd/mon.c @@ -275,6 +275,9 @@ static struct nsm_handle *nsm_create_handle(const struct sockaddr *sap, { struct nsm_handle *new; + if (!hostname) + return NULL; + new = kzalloc(sizeof(*new) + hostname_len + 1, GFP_KERNEL); if (unlikely(new == NULL)) return NULL; -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] crypto: hisilicon - qm obtain the mailbox config at one time
by wangyuan 06 Nov '23

06 Nov '23

From: Yu'an Wang <wangyuan46(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8E0N4 CVE: NA -------------------------------- The mailbox configuration needs to be obtained from the hardware at one time. If the mailbox configuration is obtained for multiple times, the read value may be incorrect. Use the instruction to read mailbox data instead of readl. Signed-off-by: Yu'an Wang <wangyuan46(a)huawei.com> --- drivers/crypto/hisilicon/qm.c | 187 +++++++++++++++++++++++++--------- 1 file changed, 137 insertions(+), 50 deletions(-) diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c index f2706dc0d55e..64e8ef1bf8e7 100644 --- a/drivers/crypto/hisilicon/qm.c +++ b/drivers/crypto/hisilicon/qm.c @@ -37,6 +37,7 @@ #define QM_MB_OP_SHIFT 14 #define QM_MB_CMD_DATA_ADDR_L 0x304 #define QM_MB_CMD_DATA_ADDR_H 0x308 +#define QM_MB_STATUS_MASK GENMASK(12, 9) /* sqc shift */ #define QM_SQ_HOP_NUM_SHIFT 0 @@ -113,7 +114,7 @@ #define QM_SQC_VFT_NUM_MASK_v2 0x3ff #define QM_DFX_CNT_CLR_CE 0x100118 -#define QM_IN_IDLE_ST_REG 0x1040e4 +#define QM_IN_IDLE_ST_REG 0x1040e4 #define QM_ABNORMAL_INT_SOURCE 0x100000 #define QM_ABNORMAL_INT_MASK 0x100004 @@ -169,6 +170,8 @@ #define TASK_TIMEOUT 10000 #define WAIT_PERIOD 20 +#define QM_MB_WAIT_READY_CNT 10 +#define QM_MB_MAX_WAIT_CNT 21000 #define WAIT_PERIOD_US_MAX 200 #define WAIT_PERIOD_US_MIN 100 #define REMOVE_WAIT_DELAY 10 @@ -382,16 +385,6 @@ static bool qm_qp_avail_state(struct hisi_qm *qm, struct hisi_qp *qp, return avail; } -/* return 0 mailbox ready, -ETIMEDOUT hardware timeout */ -static int qm_wait_mb_ready(struct hisi_qm *qm) -{ - u32 val; - - return readl_relaxed_poll_timeout(qm->io_base + QM_MB_CMD_SEND_BASE, - val, !((val >> QM_MB_BUSY_SHIFT) & - 0x1), POLL_PERIOD, POLL_TIMEOUT); -} - /* 128 bit should be wrote to hardware at one time to trigger a mailbox */ static void qm_mb_write(struct hisi_qm *qm, const void *src) { @@ -400,7 +393,7 @@ static void qm_mb_write(struct hisi_qm *qm, const void *src) asm volatile("ldp %0, %1, %3\n" "stp %0, %1, %2\n" - "dsb sy\n" + "dmb oshst\n" : "=&r" (tmp0), "=&r" (tmp1), "+Q" (*((char __iomem *)fun_base)) @@ -408,45 +401,142 @@ static void qm_mb_write(struct hisi_qm *qm, const void *src) : "memory"); } -static int qm_mb(struct hisi_qm *qm, u8 cmd, dma_addr_t dma_addr, u16 queue, - bool op) +/* 128 bit should be read from hardware at one time*/ +static void qm_mb_read(struct hisi_qm *qm, void *dst) +{ + const void __iomem *fun_base = qm->io_base + QM_MB_CMD_SEND_BASE; + unsigned long tmp0 = 0, tmp1 = 0; + + asm volatile("ldp %0, %1, %3\n" + "stp %0, %1, %2\n" + "dmb oshst\n" + : "=&r" (tmp0), + "=&r" (tmp1), + "+Q" (*((char *)dst)) + : "Q" (*((char __iomem *)fun_base)) + : "memory"); +} + +static int qm_wait_mb_ready(struct hisi_qm *qm) { struct qm_mailbox mailbox; - int ret = 0; + int i = 0; + + while (i++ < QM_MB_WAIT_READY_CNT) { + qm_mb_read(qm, &mailbox); + if (!((le16_to_cpu(mailbox.w0) >> QM_MB_BUSY_SHIFT) & 0x1)) + return 0; - dev_dbg(&qm->pdev->dev, "QM mailbox request to q%u: %u\n", queue, cmd); + usleep_range(WAIT_PERIOD_US_MIN, WAIT_PERIOD_US_MAX); + } - mailbox.w0 = cpu_to_le16(cmd | - (op ? 0x1 << QM_MB_OP_SHIFT : 0) | - (0x1 << QM_MB_BUSY_SHIFT)); - mailbox.queue_num = cpu_to_le16(queue); - mailbox.base_l = cpu_to_le32(lower_32_bits(dma_addr)); - mailbox.base_h = cpu_to_le32(upper_32_bits(dma_addr)); - mailbox.rsvd = 0; + dev_err(&qm->pdev->dev, "QM mailbox is busy to start!\n"); - mutex_lock(&qm->mailbox_lock); + return -EBUSY; +} + +static int qm_wait_mb_finish(struct hisi_qm *qm, struct qm_mailbox *mailbox) +{ + int i = 0; + + while (++i) { + qm_mb_read(qm, mailbox); + if (!((le16_to_cpu(mailbox->w0) >> QM_MB_BUSY_SHIFT) & 0x1)) + break; + + if (i > QM_MB_MAX_WAIT_CNT) { + dev_err(&qm->pdev->dev, + "QM mailbox operation timeout!\n"); + return -ETIMEDOUT; + } - if (unlikely(qm_wait_mb_ready(qm))) { - ret = -EBUSY; - dev_err(&qm->pdev->dev, "QM mailbox is busy to start!\n"); - goto busy_unlock; + usleep_range(WAIT_PERIOD_US_MIN, WAIT_PERIOD_US_MAX); + } + + if (le16_to_cpu(mailbox->w0) & QM_MB_STATUS_MASK) { + dev_err(&qm->pdev->dev, "QM mailbox operation failed!\n"); + return -EIO; } - qm_mb_write(qm, &mailbox); + return 0; +} - if (unlikely(qm_wait_mb_ready(qm))) { - ret = -EBUSY; - dev_err(&qm->pdev->dev, "QM mailbox operation timeout!\n"); - goto busy_unlock; +static int qm_mb_nolock(struct hisi_qm *qm, struct qm_mailbox *mailbox) +{ + int ret; + + ret = qm_wait_mb_ready(qm); + if (ret) + goto mb_busy; + + qm_mb_write(qm, mailbox); + + ret = qm_wait_mb_finish(qm, mailbox); + if (ret) + goto mb_busy; + + return 0; + +mb_busy: + atomic64_inc(&qm->debug.dfx.mb_err_cnt); + return ret; +} + +static void qm_mb_pre_init(struct qm_mailbox *mailbox, u8 cmd, + u64 base, u16 queue, bool op) +{ + mailbox->w0 = cpu_to_le16((cmd) | + ((op) ? 0x1 << QM_MB_OP_SHIFT : 0) | + (0x1 << QM_MB_BUSY_SHIFT)); + mailbox->queue_num = cpu_to_le16(queue); + mailbox->base_l = cpu_to_le32(lower_32_bits(base)); + mailbox->base_h = cpu_to_le32(upper_32_bits(base)); + mailbox->rsvd = 0; +} + +static int qm_check_dev_error(struct hisi_qm *qm); +static int hisi_qm_mb_write(struct hisi_qm *qm, u8 cmd, dma_addr_t dma_addr, + u16 queue, bool op) +{ + struct hisi_qm *pf_qm = pci_get_drvdata(pci_physfn(qm->pdev)); + struct qm_mailbox mailbox; + int ret; + + dev_dbg(&qm->pdev->dev, "QM mailbox request to q%u: %u.\n", queue, cmd); + + /* No need to judge if master OOO is blocked. */ + if (qm_check_dev_error(pf_qm)) { + dev_err(&qm->pdev->dev, + "QM mailbox operation failed since qm is stop!\n"); + return -EIO; } -busy_unlock: + qm_mb_pre_init(&mailbox, cmd, dma_addr, queue, op); + mutex_lock(&qm->mailbox_lock); + ret = qm_mb_nolock(qm, &mailbox); mutex_unlock(&qm->mailbox_lock); - if (ret) - atomic64_inc(&qm->debug.dfx.mb_err_cnt); + return ret; } +static int hisi_qm_mb_read(struct hisi_qm *qm, u64 *base, u8 cmd, u16 queue) +{ + struct qm_mailbox mailbox; + int ret; + + qm_mb_pre_init(&mailbox, cmd, 0, queue, 1); + mutex_lock(&qm->mailbox_lock); + ret = qm_mb_nolock(qm, &mailbox); + mutex_unlock(&qm->mailbox_lock); + if (ret) + return ret; + + *base = le32_to_cpu(mailbox.base_l) | + ((u64)le32_to_cpu(mailbox.base_h) << 32); + + return 0; +} + static void qm_db_v1(struct hisi_qm *qm, u16 qn, u8 cmd, u16 index, u8 priority) { u64 doorbell; @@ -826,12 +916,10 @@ static int qm_get_vft_v2(struct hisi_qm *qm, u32 *base, u32 *number) u64 sqc_vft; int ret; - ret = qm_mb(qm, QM_MB_CMD_SQC_VFT_V2, 0, 0, 1); + ret = hisi_qm_mb_read(qm, &sqc_vft, QM_MB_CMD_SQC_VFT_V2, 0); if (ret) return ret; - sqc_vft = readl(qm->io_base + QM_MB_CMD_DATA_ADDR_L) | - ((u64)readl(qm->io_base + QM_MB_CMD_DATA_ADDR_H) << 32); *base = QM_SQC_VFT_BASE_MASK_V2 & (sqc_vft >> QM_SQC_VFT_BASE_SHIFT_V2); *number = (QM_SQC_VFT_NUM_MASK_v2 & (sqc_vft >> QM_SQC_VFT_NUM_SHIFT_V2)) + 1; @@ -1144,12 +1232,12 @@ static int dump_show(struct hisi_qm *qm, void *info, static int qm_dump_sqc_raw(struct hisi_qm *qm, dma_addr_t dma_addr, u16 qp_id) { - return qm_mb(qm, QM_MB_CMD_SQC, dma_addr, qp_id, 1); + return hisi_qm_mb_write(qm, QM_MB_CMD_SQC, dma_addr, qp_id, 1); } static int qm_dump_cqc_raw(struct hisi_qm *qm, dma_addr_t dma_addr, u16 qp_id) { - return qm_mb(qm, QM_MB_CMD_CQC, dma_addr, qp_id, 1); + return hisi_qm_mb_write(qm, QM_MB_CMD_CQC, dma_addr, qp_id, 1); } static int qm_sqc_dump(struct hisi_qm *qm, const char *s) @@ -1260,7 +1348,7 @@ static int qm_eqc_dump(struct hisi_qm *qm, char *s) if (IS_ERR(eqc)) return PTR_ERR(eqc); - ret = qm_mb(qm, QM_MB_CMD_EQC, eqc_dma, 0, 1); + ret = hisi_qm_mb_write(qm, QM_MB_CMD_EQC, eqc_dma, 0, 1); if (ret) goto mailbox_fail; @@ -1289,7 +1377,7 @@ static int qm_aeqc_dump(struct hisi_qm *qm, char *s) if (IS_ERR(aeqc)) return PTR_ERR(aeqc); - ret = qm_mb(qm, QM_MB_CMD_AEQC, aeqc_dma, 0, 1); + ret = hisi_qm_mb_write(qm, QM_MB_CMD_AEQC, aeqc_dma, 0, 1); if (ret) goto mailbox_fail; @@ -1834,7 +1922,7 @@ static int qm_sq_ctx_cfg(struct hisi_qp *qp, int qp_id, int pasid) sqc->cq_num = cpu_to_le16(qp_id); sqc->w13 = cpu_to_le16(QM_MK_SQC_W13(0, 1, qp->alg_type)); - ret = qm_mb(qm, QM_MB_CMD_SQC, sqc_dma, qp_id, 0); + ret = hisi_qm_mb_write(qm, QM_MB_CMD_SQC, sqc_dma, qp_id, 0); dma_unmap_single(dev, sqc_dma, sizeof(struct qm_sqc), DMA_TO_DEVICE); kfree(sqc); @@ -1874,7 +1962,7 @@ static int qm_cq_ctx_cfg(struct hisi_qp *qp, int qp_id, int pasid) cqc->dw6 = cpu_to_le32(1 << QM_CQ_PHASE_SHIFT | qp->c_flag << QM_CQ_FLAG_SHIFT); - ret = qm_mb(qm, QM_MB_CMD_CQC, cqc_dma, qp_id, 0); + ret = hisi_qm_mb_write(qm, QM_MB_CMD_CQC, cqc_dma, qp_id, 0); dma_unmap_single(dev, cqc_dma, sizeof(struct qm_cqc), DMA_TO_DEVICE); kfree(cqc); @@ -2894,7 +2982,7 @@ static int qm_eq_ctx_cfg(struct hisi_qm *qm) if (qm->ver == QM_HW_V1) eqc->dw3 = cpu_to_le32(QM_EQE_AEQE_SIZE); eqc->dw6 = cpu_to_le32((QM_EQ_DEPTH - 1) | (1 << QM_EQC_PHASE_SHIFT)); - ret = qm_mb(qm, QM_MB_CMD_EQC, eqc_dma, 0, 0); + ret = hisi_qm_mb_write(qm, QM_MB_CMD_EQC, eqc_dma, 0, 0); dma_unmap_single(dev, eqc_dma, sizeof(struct qm_eqc), DMA_TO_DEVICE); kfree(eqc); @@ -2921,7 +3009,7 @@ static int qm_aeq_ctx_cfg(struct hisi_qm *qm) aeqc->base_l = cpu_to_le32(lower_32_bits(qm->aeqe_dma)); aeqc->base_h = cpu_to_le32(upper_32_bits(qm->aeqe_dma)); aeqc->dw6 = cpu_to_le32((QM_Q_DEPTH - 1) | (1 << QM_EQC_PHASE_SHIFT)); - ret = qm_mb(qm, QM_MB_CMD_AEQC, aeqc_dma, 0, 0); + ret = hisi_qm_mb_write(qm, QM_MB_CMD_AEQC, aeqc_dma, 0, 0); dma_unmap_single(dev, aeqc_dma, sizeof(struct qm_aeqc), DMA_TO_DEVICE); kfree(aeqc); @@ -2969,11 +3057,11 @@ static int __hisi_qm_start(struct hisi_qm *qm) if (ret) return ret; - ret = qm_mb(qm, QM_MB_CMD_SQC_BT, qm->sqc_dma, 0, 0); + ret = hisi_qm_mb_write(qm, QM_MB_CMD_SQC_BT, qm->sqc_dma, 0, 0); if (ret) return ret; - ret = qm_mb(qm, QM_MB_CMD_CQC_BT, qm->cqc_dma, 0, 0); + ret = hisi_qm_mb_write(qm, QM_MB_CMD_CQC_BT, qm->cqc_dma, 0, 0); if (ret) return ret; @@ -3194,7 +3282,6 @@ static ssize_t qm_status_read(struct file *filp, char __user *buffer, return (*pos = len); } - static const struct file_operations qm_status_fops = { .owner = THIS_MODULE, .open = simple_open, -- 2.30.0

2 1

[PATCH V5 OLK-5.10] soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods
by Zhang Zekun 06 Nov '23

06 Nov '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8CCP5 ---------------------------------- Hbm memory device add support for acls hot repair. The patch add two methods for userpace: - query a paddr if it support acls repair - repair a paddr in hbm memory device The feature of ACLS hot repair can help to fix a memory error from userspace by passing through the error physical address to HBM hardware. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/soc/hisilicon/Kconfig | 10 +++ drivers/soc/hisilicon/hisi_hbmdev.c | 134 ++++++++++++++++++++++++++++ 2 files changed, 144 insertions(+) diff --git a/drivers/soc/hisilicon/Kconfig b/drivers/soc/hisilicon/Kconfig index 383375f20cac..45754528873e 100644 --- a/drivers/soc/hisilicon/Kconfig +++ b/drivers/soc/hisilicon/Kconfig @@ -44,4 +44,14 @@ config HISI_HBMCACHE To compile the driver as a module, choose M here: the module will be called hisi_hbmcache. +config HISI_HBMDEV_ACLS + bool "Add support for HISI ACLS repair" + depends on HISI_HBMDEV + help + Add ACLS support for hbm device, which can be used to query and + repair hardware error in HBM devices. This feature need to work with + hardware firmwares. + + If not sure say no. + endmenu diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c b/drivers/soc/hisilicon/hisi_hbmdev.c index 5b6b1618148c..a9cc78bde81b 100644 --- a/drivers/soc/hisilicon/hisi_hbmdev.c +++ b/drivers/soc/hisilicon/hisi_hbmdev.c @@ -11,6 +11,7 @@ #include <linux/node.h> #include <linux/arch_topology.h> #include <linux/memory_hotplug.h> +#include <linux/mm.h> #include "hisi_internal.h" @@ -25,6 +26,9 @@ struct cdev_node { struct memory_dev { struct kobject *memdev_kobj; struct kobject *topo_kobj; +#ifdef CONFIG_HISI_HBMDEV_ACLS + struct kobject *acls_kobj; +#endif struct cdev_node cdev_list; nodemask_t cluster_cpumask[MAX_NUMNODES]; }; @@ -85,6 +89,134 @@ static void memory_topo_init(void) kobject_put(mdev->topo_kobj); } +#ifdef CONFIG_HISI_HBMDEV_ACLS +static struct acpi_device *paddr_to_acpi_device(u64 paddr) +{ + unsigned long pfn; + int nid; + + pfn = __phys_to_pfn(paddr); + if (!pfn_valid(pfn)) + return NULL; + + nid = pfn_to_nid(pfn); + if (nid < 0 && nid >= MAX_NUMNODES) + return NULL; + + return hotplug_mdev[nid]; +} + +static ssize_t acls_query_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t count) +{ + struct acpi_object_list arg_list; + struct acpi_device *adev; + union acpi_object obj; + acpi_status status; + u64 paddr, res; + + if (kstrtoull(buf, 16, &paddr)) + return -EINVAL; + + adev = paddr_to_acpi_device(paddr); + if (!adev) + return -EINVAL; + + obj.type = ACPI_TYPE_INTEGER; + obj.integer.value = paddr; + arg_list.count = 1; + arg_list.pointer = &obj; + + status = acpi_evaluate_integer(adev->handle, "AQRY", &arg_list, &res); + if (ACPI_FAILURE(status)) + return -ENODEV; + + /* AQRY will return a positive error code to represent error status */ + if (IS_ERR_VALUE(-res)) + return -res; + else if (res) + return -ENODEV; + + return count; +} + +static struct kobj_attribute acls_query_store_attribute = + __ATTR(acls_query, 0200, NULL, acls_query_store); + +static ssize_t acls_repair_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t count) +{ + struct acpi_object_list arg_list; + struct acpi_device *adev; + union acpi_object obj; + acpi_status status; + u64 paddr, res; + + if (kstrtoull(buf, 16, &paddr)) + return -EINVAL; + + adev = paddr_to_acpi_device(paddr); + if (!adev) + return -EINVAL; + + obj.type = ACPI_TYPE_INTEGER; + obj.integer.value = paddr; + arg_list.count = 1; + arg_list.pointer = &obj; + + status = acpi_evaluate_integer(adev->handle, "AREP", &arg_list, &res); + if (ACPI_FAILURE(status)) + return -ENODEV; + + /* AREP will return a positive error code to represent error status */ + if (IS_ERR_VALUE(-res)) + return -res; + else if (res) + return -ENODEV; + + return count; +} +static struct kobj_attribute acls_repair_store_attribute = + __ATTR(acls_repair, 0200, NULL, acls_repair_store); + +static struct attribute *acls_attrs[] = { + &acls_query_store_attribute.attr, + &acls_repair_store_attribute.attr, + NULL, +}; + +static struct attribute_group acls_attr_group = { + .attrs = acls_attrs, +}; + +static void acls_init(void) +{ + int ret = -ENOMEM; + + mdev->acls_kobj = kobject_create_and_add("acls", mdev->memdev_kobj); + if (!mdev->acls_kobj) + goto out; + + ret = sysfs_create_group(mdev->acls_kobj, &acls_attr_group); + if (ret) + kobject_put(mdev->acls_kobj); + +out: + if (ret) + pr_err("ACLS hot repair is not enabled\n"); +} + +static void acls_remove(void) +{ + kobject_put(mdev->acls_kobj); +} +#else +static void acls_init(void) {} +static void acls_remove(void) {} +#endif + static int get_pxm(struct acpi_device *acpi_device, void *arg) { acpi_handle handle = acpi_device->handle; @@ -284,6 +416,7 @@ static int __init mdev_init(void) } memory_topo_init(); + acls_init(); return ret; } module_init(mdev_init); @@ -293,6 +426,7 @@ static void __exit mdev_exit(void) container_remove(); kobject_put(mdev->memdev_kobj); kobject_put(mdev->topo_kobj); + acls_remove(); kfree(mdev); } module_exit(mdev_exit); -- 2.17.1

3 2

[PATCH v4 OLK-5.10 00/29] Introduce some vdpa ops to support vdpa device live migrate
by Jiang Dongxu 06 Nov '23

06 Nov '23

From: jiangdongxu <jiangdongxu1(a)huawei.com> Patch 1-17: some bugfix and ops intruduced by upstream Patch 18-19: introduce vdpa device logging ops Patch 20-21: introduce vdpa device state ops Patch 22-23: introduce vdpa device migrate state ops Patch 24: introduce new vhost feature BYTEPMAPLOG Patch 25: export iommu_get_resv_regions/iommu_set_resv_regions Patch 26-27: some optimization about vhost-vdpa Patch 28: add vdpa/vhost-vdpa build config Patch 29: fix vhost-vdpa compile warnings Arnaldo Carvalho de Melo (1): tools include UAPI: Sync linux/vhost.h with the kernel sources Cindy Lu (2): vhost_vdpa: fix the crash in unmap a large memory vhost_vdpa: fix unmap process in no-batch mode Eugenio Pérez (1): vdpa: add get_backend_features vdpa operation Gautam Dawar (1): vhost-vdpa: free iommu domain after last use during cleanup Greg Kroah-Hartman (1): vhost-vdpa: vhost_vdpa_alloc_domain() should be using a const struct bus_type * Jason Gunthorpe (1): PCI/IOV: Add pci_iov_vf_id() to get VF index Sebastien Boeuf (3): vdpa: Add resume operation vhost-vdpa: Introduce RESUME backend feature bit vhost-vdpa: uAPI to resume the device Shannon Nelson (2): vhost_vdpa: tell vqs about the negotiated vhost_vdpa: support PACKED when setting-getting vring_base Shunsuke Mie (1): virtio: fix virtio transitional ids Stefano Garzarella (3): vhost-vdpa: fix an iotlb memory leak vdpa: add bind_mm/unbind_mm callbacks vhost-vdpa: use bind_mm/unbind_mm device callbacks Zhu Lingshan (1): virtio: update virtio id table, add transitional ids jiangdongxu (12): vdpa: add log operations vhost-vdpa: add uAPI for logging vdpa: add device state operations vhost-vdpa: add uAPI for device buffer vdpa: add vdpa device migration status ops vhost-vdpa: add uAPI for device migration status vhost: add VHOST feature VHOST_BACKEND_F_BYTEMAPLOG export iommu_get_resv_regions and iommu_set_resv_regions vhost-vdpa: Allow transparent MSI IOV vhost-vdpa: fix msi irq request err arm64: openeuler_defconfig: add VDPA config vhost-vdpa: fix compile warnings arch/arm64/configs/openeuler_defconfig | 6 +- drivers/iommu/iommu.c | 2 + drivers/pci/iov.c | 14 + drivers/vhost/vdpa.c | 383 ++++++++++++++++++++++--- include/linux/pci.h | 8 +- include/linux/vdpa.h | 60 +++- include/uapi/linux/vhost.h | 20 ++ include/uapi/linux/vhost_types.h | 21 ++ include/uapi/linux/virtio_ids.h | 12 + tools/include/uapi/linux/vhost.h | 8 + 10 files changed, 489 insertions(+), 45 deletions(-) -- 2.27.0

2 30

[PATCH V4 OLK-5.10] soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods
by Zhang Zekun 06 Nov '23

06 Nov '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8CCP5 ---------------------------------- Hbm memory device add support for acls hot repair. The patch add two methods for userpace: - query a paddr if it support acls repair - repair a paddr in hbm memory device The feature of ACLS hot repair can help to fix a memory error from userspace by passing through the error physical address to HBM hardware. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- v4 - remove "Offering HULK" to pass CI patch format check v3 - Add #include <linux/mm.h> to avoid compile failure in arch x86_64 v2: - Change "u64 pfn" ot "unsigned long pfn" to avoid compile error - Add two stub to pretiffy the code drivers/soc/hisilicon/Kconfig | 10 +++ drivers/soc/hisilicon/hisi_hbmdev.c | 132 ++++++++++++++++++++++++++++ 2 files changed, 142 insertions(+) diff --git a/drivers/soc/hisilicon/Kconfig b/drivers/soc/hisilicon/Kconfig index 383375f20cac..45754528873e 100644 --- a/drivers/soc/hisilicon/Kconfig +++ b/drivers/soc/hisilicon/Kconfig @@ -44,4 +44,14 @@ config HISI_HBMCACHE To compile the driver as a module, choose M here: the module will be called hisi_hbmcache. +config HISI_HBMDEV_ACLS + bool "Add support for HISI ACLS repair" + depends on HISI_HBMDEV + help + Add ACLS support for hbm device, which can be used to query and + repair hardware error in HBM devices. This feature need to work with + hardware firmwares. + + If not sure say no. + endmenu diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c b/drivers/soc/hisilicon/hisi_hbmdev.c index 5b6b1618148c..8348abc6144c 100644 --- a/drivers/soc/hisilicon/hisi_hbmdev.c +++ b/drivers/soc/hisilicon/hisi_hbmdev.c @@ -11,6 +11,7 @@ #include <linux/node.h> #include <linux/arch_topology.h> #include <linux/memory_hotplug.h> +#include <linux/mm.h> #include "hisi_internal.h" @@ -25,6 +26,9 @@ struct cdev_node { struct memory_dev { struct kobject *memdev_kobj; struct kobject *topo_kobj; +#ifdef CONFIG_HISI_HBMDEV_ACLS + struct kobject *acls_kobj; +#endif struct cdev_node cdev_list; nodemask_t cluster_cpumask[MAX_NUMNODES]; }; @@ -85,6 +89,132 @@ static void memory_topo_init(void) kobject_put(mdev->topo_kobj); } +#ifdef CONFIG_HISI_HBMDEV_ACLS +static struct acpi_device *paddr_to_acpi_device(u64 paddr) +{ + unsigned long pfn; + int nid; + + pfn = __phys_to_pfn(paddr); + if (!pfn_valid(pfn)) + return NULL; + + nid = pfn_to_nid(pfn); + if (nid < 0 && nid >= MAX_NUMNODES) + return NULL; + + return hotplug_mdev[nid]; +} + +static ssize_t acls_query_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t count) +{ + struct acpi_object_list arg_list; + struct acpi_device *adev; + union acpi_object obj; + acpi_status status; + u64 paddr, res; + + if (kstrtoull(buf, 16, &paddr)) + return -EINVAL; + + adev = paddr_to_acpi_device(paddr); + if (!adev) + return -EINVAL; + + obj.type = ACPI_TYPE_INTEGER; + obj.integer.value = paddr; + arg_list.count = 1; + arg_list.pointer = &obj; + + status = acpi_evaluate_integer(adev->handle, "AQRY", &arg_list, &res); + if (ACPI_FAILURE(status)) + return -ENODEV; + + if (IS_ERR_VALUE(-res)) + return -res; + else if (res) + return -ENODEV; + + return count; +} + +static struct kobj_attribute acls_query_store_attribute = + __ATTR(acls_query, 0200, NULL, acls_query_store); + +static ssize_t acls_repair_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t count) +{ + struct acpi_object_list arg_list; + struct acpi_device *adev; + union acpi_object obj; + acpi_status status; + u64 paddr, res; + + if (kstrtoull(buf, 16, &paddr)) + return -EINVAL; + + adev = paddr_to_acpi_device(paddr); + if (!adev) + return -EINVAL; + + obj.type = ACPI_TYPE_INTEGER; + obj.integer.value = paddr; + arg_list.count = 1; + arg_list.pointer = &obj; + + status = acpi_evaluate_integer(adev->handle, "AREP", &arg_list, &res); + if (ACPI_FAILURE(status)) + return -ENODEV; + + if (IS_ERR_VALUE(-res)) + return -res; + else if (res) + return -ENODEV; + + return count; +} +static struct kobj_attribute acls_repair_store_attribute = + __ATTR(acls_repair, 0200, NULL, acls_repair_store); + +static struct attribute *acls_attrs[] = { + &acls_query_store_attribute.attr, + &acls_repair_store_attribute.attr, + NULL, +}; + +static struct attribute_group acls_attr_group = { + .attrs = acls_attrs, +}; + +static void acls_init(void) +{ + int ret = -ENOMEM; + + mdev->acls_kobj = kobject_create_and_add("acls", mdev->memdev_kobj); + if (!mdev->acls_kobj) + goto out; + + ret = sysfs_create_group(mdev->acls_kobj, &acls_attr_group); + if (ret) + kobject_put(mdev->acls_kobj); + +out: + if (ret) + pr_err("ACLS hot repair is not enabled\n"); +} + +static void acls_remove(void) +{ + kobject_put(mdev->acls_kobj); +} +#else +static void acls_init(void) {} +static void acls_remove(void) {} +#endif + static int get_pxm(struct acpi_device *acpi_device, void *arg) { acpi_handle handle = acpi_device->handle; @@ -284,6 +414,7 @@ static int __init mdev_init(void) } memory_topo_init(); + acls_init(); return ret; } module_init(mdev_init); @@ -293,6 +424,7 @@ static void __exit mdev_exit(void) container_remove(); kobject_put(mdev->memdev_kobj); kobject_put(mdev->topo_kobj); + acls_remove(); kfree(mdev); } module_exit(mdev_exit); -- 2.17.1

2 1

[PATCH V3 OLK-5.10] soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods
by Zhang Zekun 06 Nov '23

06 Nov '23

Offering: HULK hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8CCP5 ---------------------------------- Hbm memory device add support for acls hot repair. The patch add two methods for userpace: - query a paddr if it support acls repair - repair a paddr in hbm memory device The feature of ACLS hot repair can help to fix a memory error from userspace by passing through the error physical address to HBM hardware. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- v3 - Add #include <linux/mm.h> to avoid compile failure in arch x86_64 v2: - Change "u64 pfn" ot "unsigned long pfn" to avoid compile error - Add two stub to pretiffy the code drivers/soc/hisilicon/Kconfig | 10 +++ drivers/soc/hisilicon/hisi_hbmdev.c | 132 ++++++++++++++++++++++++++++ 2 files changed, 142 insertions(+) diff --git a/drivers/soc/hisilicon/Kconfig b/drivers/soc/hisilicon/Kconfig index 383375f20cac..45754528873e 100644 --- a/drivers/soc/hisilicon/Kconfig +++ b/drivers/soc/hisilicon/Kconfig @@ -44,4 +44,14 @@ config HISI_HBMCACHE To compile the driver as a module, choose M here: the module will be called hisi_hbmcache. +config HISI_HBMDEV_ACLS + bool "Add support for HISI ACLS repair" + depends on HISI_HBMDEV + help + Add ACLS support for hbm device, which can be used to query and + repair hardware error in HBM devices. This feature need to work with + hardware firmwares. + + If not sure say no. + endmenu diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c b/drivers/soc/hisilicon/hisi_hbmdev.c index 5b6b1618148c..8348abc6144c 100644 --- a/drivers/soc/hisilicon/hisi_hbmdev.c +++ b/drivers/soc/hisilicon/hisi_hbmdev.c @@ -11,6 +11,7 @@ #include <linux/node.h> #include <linux/arch_topology.h> #include <linux/memory_hotplug.h> +#include <linux/mm.h> #include "hisi_internal.h" @@ -25,6 +26,9 @@ struct cdev_node { struct memory_dev { struct kobject *memdev_kobj; struct kobject *topo_kobj; +#ifdef CONFIG_HISI_HBMDEV_ACLS + struct kobject *acls_kobj; +#endif struct cdev_node cdev_list; nodemask_t cluster_cpumask[MAX_NUMNODES]; }; @@ -85,6 +89,132 @@ static void memory_topo_init(void) kobject_put(mdev->topo_kobj); } +#ifdef CONFIG_HISI_HBMDEV_ACLS +static struct acpi_device *paddr_to_acpi_device(u64 paddr) +{ + unsigned long pfn; + int nid; + + pfn = __phys_to_pfn(paddr); + if (!pfn_valid(pfn)) + return NULL; + + nid = pfn_to_nid(pfn); + if (nid < 0 && nid >= MAX_NUMNODES) + return NULL; + + return hotplug_mdev[nid]; +} + +static ssize_t acls_query_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t count) +{ + struct acpi_object_list arg_list; + struct acpi_device *adev; + union acpi_object obj; + acpi_status status; + u64 paddr, res; + + if (kstrtoull(buf, 16, &paddr)) + return -EINVAL; + + adev = paddr_to_acpi_device(paddr); + if (!adev) + return -EINVAL; + + obj.type = ACPI_TYPE_INTEGER; + obj.integer.value = paddr; + arg_list.count = 1; + arg_list.pointer = &obj; + + status = acpi_evaluate_integer(adev->handle, "AQRY", &arg_list, &res); + if (ACPI_FAILURE(status)) + return -ENODEV; + + if (IS_ERR_VALUE(-res)) + return -res; + else if (res) + return -ENODEV; + + return count; +} + +static struct kobj_attribute acls_query_store_attribute = + __ATTR(acls_query, 0200, NULL, acls_query_store); + +static ssize_t acls_repair_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t count) +{ + struct acpi_object_list arg_list; + struct acpi_device *adev; + union acpi_object obj; + acpi_status status; + u64 paddr, res; + + if (kstrtoull(buf, 16, &paddr)) + return -EINVAL; + + adev = paddr_to_acpi_device(paddr); + if (!adev) + return -EINVAL; + + obj.type = ACPI_TYPE_INTEGER; + obj.integer.value = paddr; + arg_list.count = 1; + arg_list.pointer = &obj; + + status = acpi_evaluate_integer(adev->handle, "AREP", &arg_list, &res); + if (ACPI_FAILURE(status)) + return -ENODEV; + + if (IS_ERR_VALUE(-res)) + return -res; + else if (res) + return -ENODEV; + + return count; +} +static struct kobj_attribute acls_repair_store_attribute = + __ATTR(acls_repair, 0200, NULL, acls_repair_store); + +static struct attribute *acls_attrs[] = { + &acls_query_store_attribute.attr, + &acls_repair_store_attribute.attr, + NULL, +}; + +static struct attribute_group acls_attr_group = { + .attrs = acls_attrs, +}; + +static void acls_init(void) +{ + int ret = -ENOMEM; + + mdev->acls_kobj = kobject_create_and_add("acls", mdev->memdev_kobj); + if (!mdev->acls_kobj) + goto out; + + ret = sysfs_create_group(mdev->acls_kobj, &acls_attr_group); + if (ret) + kobject_put(mdev->acls_kobj); + +out: + if (ret) + pr_err("ACLS hot repair is not enabled\n"); +} + +static void acls_remove(void) +{ + kobject_put(mdev->acls_kobj); +} +#else +static void acls_init(void) {} +static void acls_remove(void) {} +#endif + static int get_pxm(struct acpi_device *acpi_device, void *arg) { acpi_handle handle = acpi_device->handle; @@ -284,6 +414,7 @@ static int __init mdev_init(void) } memory_topo_init(); + acls_init(); return ret; } module_init(mdev_init); @@ -293,6 +424,7 @@ static void __exit mdev_exit(void) container_remove(); kobject_put(mdev->memdev_kobj); kobject_put(mdev->topo_kobj); + acls_remove(); kfree(mdev); } module_exit(mdev_exit); -- 2.17.1

3 2

[PATCH openEuler-1.0-LTS 0/2] Sync LTS patches for openEuler-1.0-LTS
by Zhang Zekun 06 Nov '23

06 Nov '23

Sync 4.19 LTS patches for openEuler-1.0-LTS 1. Fix the wrong alloc flags which may cause sleep in atomic. 2. Fix the wrong bit number. Add a cover letter for these patches, which can help to generate PR. Dan Carpenter (1): regmap: rbtree: Use alloc_flags for memory allocations Richard Fitzgerald (1): regmap: rbtree: Fix wrong register marked as in-cache when creating new node drivers/base/regmap/regcache-rbtree.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) -- 2.17.1

2 3

[PATCH openEuler-22.03-LTS 0/4] fix memcgv1 oom meminfo bug
by Lu Jialin 06 Nov '23

06 Nov '23

Sergey Senozhatsky (1): seq_buf: Add seq_buf_do_printk() helper Steven Rostedt (VMware) (1): seq_buf: Add seq_buf_terminate() API Yosry Ahmed (2): memcg: use seq_buf_do_printk() with mem_cgroup_print_oom_meminfo() memcg: dump memory.stat during cgroup OOM for v1 include/linux/seq_buf.h | 27 +++++++++++++ lib/seq_buf.c | 32 +++++++++++++++ mm/memcontrol.c | 87 +++++++++++++++++++++++------------------ 3 files changed, 108 insertions(+), 38 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/5] AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device
by Qian Zou 04 Nov '23

04 Nov '23

From: “z00447436” <zouqian4(a)huawei.com> Some use-cases, such as system management, require the ability to generate a non-maskable event to the OS to request the OS kernel to perform a diagnostic dump and reset the system. Arm Generic Diagnostic Dump and Reset device enables a maintainer to request OS to perform a diagnostic dump and reset a system via SDEI event or an interrupt. This patch implements SDEI path and discards the interrupted context before proceeding to the crash kernel. D Scott Phillips (1): arm64: sdei: abort running SDEI handlers during crash Ilkka Koskinen (3): ACPI: tables: Add AGDI to the list of known table signatures ACPI: AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device ACPICA: iASL: Add suppport for AGDI table Shuai Xue (1): ACPI: APEI: explicit init of HEST and GHES in apci_init() arch/arm64/include/asm/sdei.h | 6 ++ arch/arm64/kernel/entry.S | 27 +++++++- arch/arm64/kernel/sdei.c | 3 + arch/arm64/kernel/smp.c | 8 +-- drivers/acpi/apei/ghes.c | 19 +++--- drivers/acpi/arm64/Kconfig | 10 +++ drivers/acpi/arm64/Makefile | 1 + drivers/acpi/arm64/agdi.c | 116 ++++++++++++++++++++++++++++++++++ drivers/acpi/bus.c | 4 ++ drivers/acpi/pci_root.c | 3 - drivers/acpi/tables.c | 2 +- drivers/firmware/Kconfig | 1 + drivers/firmware/arm_sdei.c | 32 ++++++---- include/acpi/actbl2.h | 20 ++++++ include/acpi/apei.h | 4 +- include/linux/acpi_agdi.h | 13 ++++ include/linux/arm_sdei.h | 4 ++ 17 files changed, 240 insertions(+), 33 deletions(-) create mode 100644 drivers/acpi/arm64/agdi.c create mode 100644 include/linux/acpi_agdi.h -- 2.33.0

2 6

[PATCH OLK-5.10 0/4] AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device
by Qian Zou 04 Nov '23

04 Nov '23

From: “z00447436” <zouqian4(a)huawei.com> Some use-cases, such as system management, require the ability to generate a non-maskable event to the OS to request the OS kernel to perform a diagnostic dump and reset the system. Arm Generic Diagnostic Dump and Reset device enables a maintainer to request OS to perform a diagnostic dump and reset a system via SDEI event or an interrupt. This patch implements SDEI path and discards the interrupted context before proceeding to the crash kernel. D Scott Phillips (1): arm64: sdei: abort running SDEI handlers during crash Ilkka Koskinen (3): ACPI: tables: Add AGDI to the list of known table signatures ACPI: AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device ACPICA: iASL: Add suppport for AGDI table arch/arm64/include/asm/sdei.h | 6 ++++++ arch/arm64/kernel/entry.S | 27 +++++++++++++++++++++++++-- arch/arm64/kernel/sdei.c | 3 +++ arch/arm64/kernel/smp.c | 8 ++++---- drivers/acpi/arm64/Kconfig | 10 ++++++++++ drivers/acpi/arm64/Makefile | 1 + drivers/acpi/bus.c | 2 ++ drivers/acpi/tables.c | 2 +- drivers/firmware/arm_sdei.c | 19 +++++++++++++++++++ include/acpi/actbl2.h | 20 ++++++++++++++++++++ include/linux/acpi_agdi.h | 13 +++++++++++++ include/linux/arm_sdei.h | 2 ++ 12 files changed, 106 insertions(+), 7 deletions(-) create mode 100644 include/linux/acpi_agdi.h -- 2.33.0

2 5

[PATCH OLK-5.10 00/42] add error handling for add disk
by Li Nan 03 Nov '23

03 Nov '23

Christoph Hellwig (14): block: fold register_disk into device_add_disk block: call blk_integrity_add earlier in device_add_disk block: add the events* attributes to disk_attrs block: fix error unwinding in device_add_disk block: clear ->slave_dir when dropping the main slave_dir reference block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Li Lingfeng (1): nbd: fix uaf in nbd_open Luis Chamberlain (10): block: return errors from blk_integrity_add block: return errors from disk_alloc_events block: add error handling for device_add_disk / add_disk block: fix device_add_disk() kobject_create_and_add() error handling loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Tetsuo Handa (1): block: check minor range in device_add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Wen Yang (1): Revert "Revert "block: nbd: add sanity check for first_minor"" Yu Kuai (3): nbd: fix max value for 'first_minor' nbd: fix possible overflow for 'first_minor' in nbd_dev_add() block: fix memory leak for elevator on add_disk failure Zhang Wensheng (1): nbd: fix possible overflow on 'first_minor' in nbd_dev_add() Zhong Jinghua (9): nbd: Reorganize the messy commit log about the first_minor check block: return errors from blk_register_region block: Fix the kabi change in device_add_disk block: Fix the kabi change on blk_register_region block: call blk_get_queue earlier in __device_add_disk block: Fix minor range check in device_add_disk() block: Set memalloc_noio to false in the error path mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup block/blk.h | 5 +- include/linux/blk-mq.h | 12 ++ include/linux/genhd.h | 36 +++++ block/blk-integrity.c | 12 +- block/blk-mq.c | 19 +++ block/genhd.c | 286 ++++++++++++++++++++++++++------------- drivers/block/brd.c | 103 ++++++-------- drivers/block/loop.c | 26 ++-- drivers/block/nbd.c | 75 ++++------ drivers/mtd/ubi/block.c | 76 +++++------ drivers/nvme/host/core.c | 41 +++--- drivers/scsi/sr.c | 7 +- 12 files changed, 413 insertions(+), 285 deletions(-) -- 2.39.2

1 42

[PATCH OLK-5.10 01/42] nbd: Reorganize the messy commit log about the first_minor check
by Li Nan 03 Nov '23

03 Nov '23

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188217 ---------------------------------------- Commits on our branch with check issues on first_minor had serious confusion, resulting in duplicate checks in nbd_dev_add and nbd_genl_connect. So I revert the messy commit, backport lts patch. Revert 881885f30261 [Backport] nbd: fix max value for 'first_minor' Revert 4d759cee3f18 [Backport] Revert "Revert "block: nbd: add sanity check for first_minor"" Revert b95487500a4f [Huawei] nbd: fix assignment error for first_minor in nbd_dev_add Revert 93c4218b2f4d [Backport] nbd: fix possible overflow on 'first_minor' in nbd_dev_add() Revert 60141517d289 nbd: Fix use-after-free in blk_mq_free_rqs Revert 98d3ad1d2589 nbd: add sanity check for first_minor Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/block/nbd.c | 24 +----------------------- 1 file changed, 1 insertion(+), 23 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index fa08f380f5be..29884a0f1fca 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1875,17 +1875,7 @@ static int nbd_dev_add(int index) refcount_set(&nbd->refs, 1); INIT_LIST_HEAD(&nbd->list); disk->major = NBD_MAJOR; - - /* Too big first_minor can cause duplicate creation of - * sysfs files/links, since index << part_shift might overflow, or - * MKDEV() expect that the max bits of first_minor is 20. - */ disk->first_minor = index << part_shift; - if (disk->first_minor < index || disk->first_minor > MINORMASK) { - err = -EINVAL; - goto out_free_idr; - } - disk->fops = &nbd_fops; disk->private_data = nbd; sprintf(disk->disk_name, "nbd%d", index); @@ -1972,20 +1962,8 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) if (!netlink_capable(skb, CAP_SYS_ADMIN)) return -EPERM; - if (info->attrs[NBD_ATTR_INDEX]) { + if (info->attrs[NBD_ATTR_INDEX]) index = nla_get_u32(info->attrs[NBD_ATTR_INDEX]); - - /* - * Too big first_minor can cause duplicate creation of - * sysfs files/links, since index << part_shift might - * overflow, or MKDEV() expect that the max bits of - * first_minor is 20. - */ - if (index < 0 || index > MINORMASK >> part_shift) { - printk(KERN_ERR "nbd: illegal input index %d\n", index); - return -EINVAL; - } - } if (!info->attrs[NBD_ATTR_SOCKETS]) { printk(KERN_ERR "nbd: must specify at least one socket\n"); return -EINVAL; -- 2.39.2

1 3

[PATCH RESEND openEuler-1.0-LTS 0/2] Sync LTS patches for openEuler-1.0-LTS
by Zhang Zekun 03 Nov '23

03 Nov '23

Sync 4.19 LTS patches for openEuler-1.0-LTS 1. Fix the wrong alloc flags which may cause sleep in atomic. 2. Fix the wrong bit number. Add a cover letter for these patches, which can help to generate PR. Dan Carpenter (1): regmap: rbtree: Use alloc_flags for memory allocations Richard Fitzgerald (1): regmap: rbtree: Fix wrong register marked as in-cache when creating new node drivers/base/regmap/regcache-rbtree.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) -- 2.17.1

1 2

[PATCH V2 OLK-5.10] soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods
by Zhang Zekun 03 Nov '23

03 Nov '23

Offering: HULK hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8CCP5 ---------------------------------- Hbm memory device add support for acls hot repair. The patch add two methods for userpace: - query a paddr if it support acls repair - repair a paddr in hbm memory device The feature of ACLS hot repair can help to fix a memory error from userspace by passing through the error physical address to HBM hardware. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- v2: - Change "u64 pfn" ot "unsigned long pfn" to avoid compile error - Add two stub to pretiffy the code drivers/soc/hisilicon/Kconfig | 10 +++ drivers/soc/hisilicon/hisi_hbmdev.c | 131 ++++++++++++++++++++++++++++ 2 files changed, 141 insertions(+) diff --git a/drivers/soc/hisilicon/Kconfig b/drivers/soc/hisilicon/Kconfig index 383375f20cac..45754528873e 100644 --- a/drivers/soc/hisilicon/Kconfig +++ b/drivers/soc/hisilicon/Kconfig @@ -44,4 +44,14 @@ config HISI_HBMCACHE To compile the driver as a module, choose M here: the module will be called hisi_hbmcache. +config HISI_HBMDEV_ACLS + bool "Add support for HISI ACLS repair" + depends on HISI_HBMDEV + help + Add ACLS support for hbm device, which can be used to query and + repair hardware error in HBM devices. This feature need to work with + hardware firmwares. + + If not sure say no. + endmenu diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c b/drivers/soc/hisilicon/hisi_hbmdev.c index 5b6b1618148c..caa2711b2de7 100644 --- a/drivers/soc/hisilicon/hisi_hbmdev.c +++ b/drivers/soc/hisilicon/hisi_hbmdev.c @@ -25,6 +25,9 @@ struct cdev_node { struct memory_dev { struct kobject *memdev_kobj; struct kobject *topo_kobj; +#ifdef CONFIG_HISI_HBMDEV_ACLS + struct kobject *acls_kobj; +#endif struct cdev_node cdev_list; nodemask_t cluster_cpumask[MAX_NUMNODES]; }; @@ -85,6 +88,132 @@ static void memory_topo_init(void) kobject_put(mdev->topo_kobj); } +#ifdef CONFIG_HISI_HBMDEV_ACLS +static struct acpi_device* paddr_to_acpi_device(u64 paddr) +{ + unsigned long pfn; + int nid; + + pfn = __phys_to_pfn(paddr); + if (!pfn_valid(pfn)) + return NULL; + + nid = pfn_to_nid(pfn); + if (nid < 0 && nid >= MAX_NUMNODES) + return NULL; + + return hotplug_mdev[nid]; +} + +static ssize_t acls_query_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t count) +{ + struct acpi_object_list arg_list; + struct acpi_device *adev; + union acpi_object obj; + acpi_status status; + u64 paddr, res; + + if (kstrtoull(buf, 16, &paddr)) + return -EINVAL; + + adev = paddr_to_acpi_device(paddr); + if (!adev) + return -EINVAL; + + obj.type = ACPI_TYPE_INTEGER; + obj.integer.value = paddr; + arg_list.count = 1; + arg_list.pointer = &obj; + + status = acpi_evaluate_integer(adev->handle, "AQRY", &arg_list, &res); + if (ACPI_FAILURE(status)) + return -ENODEV; + + if (IS_ERR_VALUE(-res)) + return -res; + else if (res) + return -ENODEV; + + return count; +} + +static struct kobj_attribute acls_query_store_attribute = + __ATTR(acls_query, 0200, NULL, acls_query_store); + +static ssize_t acls_repair_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t count) +{ + struct acpi_object_list arg_list; + struct acpi_device *adev; + union acpi_object obj; + acpi_status status; + u64 paddr, res; + + if (kstrtoull(buf, 16, &paddr)) + return -EINVAL; + + adev = paddr_to_acpi_device(paddr); + if (!adev) + return -EINVAL; + + obj.type = ACPI_TYPE_INTEGER; + obj.integer.value = paddr; + arg_list.count = 1; + arg_list.pointer = &obj; + + status = acpi_evaluate_integer(adev->handle, "AREP", &arg_list, &res); + if (ACPI_FAILURE(status)) + return -ENODEV; + + if (IS_ERR_VALUE(-res)) + return -res; + else if (res) + return -ENODEV; + + return count; +} +static struct kobj_attribute acls_repair_store_attribute = + __ATTR(acls_repair, 0200, NULL, acls_repair_store); + +static struct attribute *acls_attrs[] = { + &acls_query_store_attribute.attr, + &acls_repair_store_attribute.attr, + NULL, +}; + +static struct attribute_group acls_attr_group = { + .attrs = acls_attrs, +}; + +static void acls_init(void) +{ + int ret = -ENOMEM; + + mdev->acls_kobj = kobject_create_and_add("acls", mdev->memdev_kobj); + if (!mdev->acls_kobj) + goto out; + + ret = sysfs_create_group(mdev->acls_kobj, &acls_attr_group); + if (ret) + kobject_put(mdev->acls_kobj); + +out: + if (ret) + pr_err("ACLS hot repair is not enabled\n"); +} + +static void acls_remove(void) +{ + kobject_put(mdev->acls_kobj); +} +#else +static void acls_init(void) {} +static void acls_remove(void) {} +#endif + static int get_pxm(struct acpi_device *acpi_device, void *arg) { acpi_handle handle = acpi_device->handle; @@ -284,6 +413,7 @@ static int __init mdev_init(void) } memory_topo_init(); + acls_init(); return ret; } module_init(mdev_init); @@ -293,6 +423,7 @@ static void __exit mdev_exit(void) container_remove(); kobject_put(mdev->memdev_kobj); kobject_put(mdev->topo_kobj); + acls_remove(); kfree(mdev); } module_exit(mdev_exit); -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS 1/2] regmap: rbtree: Use alloc_flags for memory allocations
by Zhang Zekun 03 Nov '23

03 Nov '23

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v4.19.295 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8DDE2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------- [ Upstream commit 0c8b0bf42c8cef56f7cd9cd876fbb7ece9217064 ] The kunit tests discovered a sleeping in atomic bug. The allocations in the regcache-rbtree code should use the map->alloc_flags instead of GFP_KERNEL. [ 5.005510] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:306 [ 5.005960] in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 117, name: kunit_try_catch [ 5.006219] preempt_count: 1, expected: 0 [ 5.006414] 1 lock held by kunit_try_catch/117: [ 5.006590] #0: 833b9010 (regmap_kunit:86:(config)->lock){....}-{2:2}, at: regmap_lock_spinlock+0x14/0x1c [ 5.007493] irq event stamp: 162 [ 5.007627] hardirqs last enabled at (161): [<80786738>] crng_make_state+0x1a0/0x294 [ 5.007871] hardirqs last disabled at (162): [<80c531ec>] _raw_spin_lock_irqsave+0x7c/0x80 [ 5.008119] softirqs last enabled at (0): [<801110ac>] copy_process+0x810/0x2138 [ 5.008356] softirqs last disabled at (0): [<00000000>] 0x0 [ 5.008688] CPU: 0 PID: 117 Comm: kunit_try_catch Tainted: G N 6.4.4-rc3-g0e8d2fdfb188 #1 [ 5.009011] Hardware name: Generic DT based system [ 5.009277] unwind_backtrace from show_stack+0x18/0x1c [ 5.009497] show_stack from dump_stack_lvl+0x38/0x5c [ 5.009676] dump_stack_lvl from __might_resched+0x188/0x2d0 [ 5.009860] __might_resched from __kmem_cache_alloc_node+0x1dc/0x25c [ 5.010061] __kmem_cache_alloc_node from kmalloc_trace+0x30/0xc8 [ 5.010254] kmalloc_trace from regcache_rbtree_write+0x26c/0x468 [ 5.010446] regcache_rbtree_write from _regmap_write+0x88/0x140 [ 5.010634] _regmap_write from regmap_write+0x44/0x68 [ 5.010803] regmap_write from basic_read_write+0x8c/0x270 [ 5.010980] basic_read_write from kunit_try_run_case+0x48/0xa0 Fixes: 28644c809f44 ("regmap: Add the rbtree cache support") Reported-by: Guenter Roeck <linux(a)roeck-us.net> Closes: https://lore.kernel.org/all/ee59d128-413c-48ad-a3aa-d9d350c80042@roeck-us.n… Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Tested-by: Guenter Roeck <linux(a)roeck-us.net> Link: https://lore.kernel.org/r/58f12a07-5f4b-4a8f-ab84-0a42d1908cb9@moroto.mount… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/base/regmap/regcache-rbtree.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c index b1e9aae9a5d0..f04007b388ea 100644 --- a/drivers/base/regmap/regcache-rbtree.c +++ b/drivers/base/regmap/regcache-rbtree.c @@ -291,14 +291,14 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, blk = krealloc(rbnode->block, blklen * map->cache_word_size, - GFP_KERNEL); + map->alloc_flags); if (!blk) return -ENOMEM; if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) { present = krealloc(rbnode->cache_present, BITS_TO_LONGS(blklen) * sizeof(*present), - GFP_KERNEL); + map->alloc_flags); if (!present) { kfree(blk); return -ENOMEM; @@ -335,7 +335,7 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg) const struct regmap_range *range; int i; - rbnode = kzalloc(sizeof(*rbnode), GFP_KERNEL); + rbnode = kzalloc(sizeof(*rbnode), map->alloc_flags); if (!rbnode) return NULL; @@ -361,13 +361,13 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg) } rbnode->block = kmalloc_array(rbnode->blklen, map->cache_word_size, - GFP_KERNEL); + map->alloc_flags); if (!rbnode->block) goto err_free; rbnode->cache_present = kcalloc(BITS_TO_LONGS(rbnode->blklen), sizeof(*rbnode->cache_present), - GFP_KERNEL); + map->alloc_flags); if (!rbnode->cache_present) goto err_free_block; -- 2.17.1

2 2

[PATCH OLK-5.10] soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods
by Zhang Zekun 03 Nov '23

03 Nov '23

Offering: HULK hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8CCP5 ---------------------------------- Hbm memory device add support for acls hot repair. The patch add two methods for userpace: - query a paddr if it support acls repair - repair a paddr in hbm memory device The feature of ACLS hot repair can help to fix a memory error from userspace by passing through the error physical address to HBM hardware. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/soc/hisilicon/Kconfig | 10 +++ drivers/soc/hisilicon/hisi_hbmdev.c | 134 ++++++++++++++++++++++++++++ 2 files changed, 144 insertions(+) diff --git a/drivers/soc/hisilicon/Kconfig b/drivers/soc/hisilicon/Kconfig index 383375f20cac..45754528873e 100644 --- a/drivers/soc/hisilicon/Kconfig +++ b/drivers/soc/hisilicon/Kconfig @@ -44,4 +44,14 @@ config HISI_HBMCACHE To compile the driver as a module, choose M here: the module will be called hisi_hbmcache. +config HISI_HBMDEV_ACLS + bool "Add support for HISI ACLS repair" + depends on HISI_HBMDEV + help + Add ACLS support for hbm device, which can be used to query and + repair hardware error in HBM devices. This feature need to work with + hardware firmwares. + + If not sure say no. + endmenu diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c b/drivers/soc/hisilicon/hisi_hbmdev.c index 5b6b1618148c..5cde7a123033 100644 --- a/drivers/soc/hisilicon/hisi_hbmdev.c +++ b/drivers/soc/hisilicon/hisi_hbmdev.c @@ -26,6 +26,9 @@ struct memory_dev { struct kobject *memdev_kobj; struct kobject *topo_kobj; struct cdev_node cdev_list; +#ifdef CONFIG_HISI_HBMDEV_ACLS + struct kobject *acls_kobj; +#endif nodemask_t cluster_cpumask[MAX_NUMNODES]; }; @@ -85,6 +88,131 @@ static void memory_topo_init(void) kobject_put(mdev->topo_kobj); } +#ifdef CONFIG_HISI_HBMDEV_ACLS +static struct acpi_device* paddr_to_acpi_device(u64 paddr) +{ + int nid; + u64 pfn; + + pfn = __phys_to_pfn(paddr); + if (!pfn_valid(pfn)) + return NULL; + + nid = pfn_to_nid(pfn); + if (nid < 0 && nid >= MAX_NUMNODES) + return NULL; + + return hotplug_mdev[nid]; +} + +static ssize_t acls_query_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t count) +{ + struct acpi_object_list arg_list; + struct acpi_device *adev; + union acpi_object obj; + acpi_status status; + u64 paddr, res; + + if (kstrtoull(buf, 16, &paddr)) + return -EINVAL; + + adev = paddr_to_acpi_device(paddr); + if (!adev) + return -EINVAL; + + obj.type = ACPI_TYPE_INTEGER; + obj.integer.value = paddr; + arg_list.count = 1; + arg_list.pointer = &obj; + + status = acpi_evaluate_integer(adev->handle, "AQRY", &arg_list, &res); + if (ACPI_FAILURE(status)) + return -ENODEV; + + if (IS_ERR_VALUE(-res)) + return -res; + else if (res) + return -ENODEV; + + return count; +} + +static struct kobj_attribute acls_query_store_attribute = + __ATTR(acls_query, 0200, NULL, acls_query_store); + +static ssize_t acls_repair_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t count) +{ + struct acpi_object_list arg_list; + struct acpi_device *adev; + union acpi_object obj; + acpi_status status; + u64 paddr, res; + + if (kstrtoull(buf, 16, &paddr)) + return -EINVAL; + + adev = paddr_to_acpi_device(paddr); + if (!adev) + return -EINVAL; + + obj.type = ACPI_TYPE_INTEGER; + obj.integer.value = paddr; + arg_list.count = 1; + arg_list.pointer = &obj; + + status = acpi_evaluate_integer(adev->handle, "AREP", &arg_list, &res); + if (ACPI_FAILURE(status)) + return -ENODEV; + + if (IS_ERR_VALUE(-res)) + return -res; + else if (res) + return -ENODEV; + + return count; +} +static struct kobj_attribute acls_repair_store_attribute = + __ATTR(acls_repair, 0200, NULL, acls_repair_store); + +static struct attribute *acls_attrs[] = { + &acls_query_store_attribute.attr, + &acls_repair_store_attribute.attr, + NULL, +}; + +static struct attribute_group acls_attr_group = { + .attrs = acls_attrs, +}; + +static void acls_init(void) +{ + int ret = -ENOMEM; + + mdev->acls_kobj = kobject_create_and_add("acls", mdev->memdev_kobj); + if (!mdev->acls_kobj) + goto out; + + ret = sysfs_create_group(mdev->acls_kobj, &acls_attr_group); + if (ret) + kobject_put(mdev->acls_kobj); + +out: + if (ret) + pr_err("ACLS hot repair is not enabled\n"); + + return; +} + +static void acls_remove(void) +{ + kobject_put(mdev->acls_kobj); +} +#endif + static int get_pxm(struct acpi_device *acpi_device, void *arg) { acpi_handle handle = acpi_device->handle; @@ -284,6 +412,9 @@ static int __init mdev_init(void) } memory_topo_init(); +#ifdef CONFIG_HISI_HBMDEV_ACLS + acls_init(); +#endif return ret; } module_init(mdev_init); @@ -293,6 +424,9 @@ static void __exit mdev_exit(void) container_remove(); kobject_put(mdev->memdev_kobj); kobject_put(mdev->topo_kobj); +#ifdef CONFIG_HISI_HBMDEV_ACLS + acls_remove(); +#endif kfree(mdev); } module_exit(mdev_exit); -- 2.17.1

2 1

[PATCH OLK-5.10 v2] perf auxtrace ptt: Record whether an auxtrace mmap is needed
by Junhao He 03 Nov '23

03 Nov '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7HI80 CVE: NA ---------------------------------------------------------------------- Add a flag needs_auxtrace_mmap to record whether an auxtrace mmap is needed, in preparation for correctly determining whether or not an auxtrace mmap is needed. The change was added in the mainline [1], but it was deleted when upstream openEuler for fixes build error. openEuler OLK-5.10 now has merge evsel->needs_auxtrace_mmap. Therefore, backport this modification to OpenEuler OLK-5.10. [1] commit 057381a7ece1 ("perf auxtrace arm64: Add support for HiSilicon PCIe Tune and Trace device driver") Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- tools/perf/arch/arm64/util/hisi-ptt.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/perf/arch/arm64/util/hisi-ptt.c b/tools/perf/arch/arm64/util/hisi-ptt.c index 110b2edf3e6b..97696b6e1dd5 100644 --- a/tools/perf/arch/arm64/util/hisi-ptt.c +++ b/tools/perf/arch/arm64/util/hisi-ptt.c @@ -113,6 +113,7 @@ static int hisi_ptt_recording_options(struct auxtrace_record *itr, } evsel->core.attr.freq = 0; evsel->core.attr.sample_period = 1; + evsel->needs_auxtrace_mmap = true; hisi_ptt_evsel = evsel; opts->full_auxtrace = true; } -- 2.33.0

2 1

[PATCH OLK-5.10 00/13] arm64: Add sysreg header generation scripting
by Junhao He 03 Nov '23

03 Nov '23

The arm64 kernel requires some metadata for each system register it may need to access. Currently we have: * A SYS_<regname> definition which sorresponds to a sys_reg() macro. This is used both to look up a sysreg by encoding (e.g. in KVM), and also to generate code to access a sysreg where the assembler is unaware of the specific sysreg encoding. Where assemblers support the S3_<op1>_C<crn>_C<crm>_<op2> syntax for system registers, we could use this rather than manually assembling the instructions. However, we don't have consistent definitions for these and we currently still need to handle toolchains that lack this feature. * A set of <regname>_<fieldname>_SHIFT and <regname>_<fieldname>_MASK definitions, which can be used to extract fields from the register, or to construct a register from a set of fields. These do not follow the convention used by <linux/bitfield.h>, and the masks are not shifted into place, preventing their use in FIELD_PREP() and FIELD_GET(). We require the SHIFT definitions for inline assembly (and WIDTH definitions would be helpful for UBFX/SBFX), so we cannot only define a shifted MASK. Defining a SHIFT, WIDTH, shifted MASK and unshifted MASK is tedious and error-prone and life is much easier when they can be relied up to exist when writing code. * A set of <regname>_<fieldname>_<valname> definitions for each enumerated value a field may hold. These are used when identifying the presence of features. Atop of this, other code has to build up metadata at runtime (e.g. the sets of RES0/RES1 bits in a register). Alejandro Tafalla (1): arm64/sysreg: Fix typo in Enum element regex James Morse (1): arm64/sysreg: Extend the maximum width of a register and symbol name Marc Zyngier (1): arm64: Allow the definition of UNKNOWN system register fields Mark Brown (6): arm64/sysreg: Enable automatic generation of system register definitions arm64/sysreg: Introduce helpers for access to sysreg fields arm64/sysreg: Add SYS_FIELD_GET() helper arm64/sysreg: Support generation of RAZ fields arm64/sysreg: Allow leading blanks on comments in sysreg file arm64/sysreg: Allow enumerations to be declared as signed or unsigned Mark Rutland (4): arm64: Add sysreg header generation scripting arm64/sysreg: improve comment for regs without fields arm64/sysreg: fix odd line spacing arm64/sysreg: allow *Enum blocks in SysregFields blocks arch/arm64/Makefile | 3 + arch/arm64/include/asm/Kbuild | 2 + arch/arm64/include/asm/sysreg.h | 17 ++ arch/arm64/tools/Makefile | 18 ++ arch/arm64/tools/gen-sysreg.awk | 336 ++++++++++++++++++++++++++++++++ arch/arm64/tools/sysreg | 50 +++++ 6 files changed, 426 insertions(+) create mode 100644 arch/arm64/tools/Makefile create mode 100755 arch/arm64/tools/gen-sysreg.awk create mode 100644 arch/arm64/tools/sysreg -- 2.33.0

2 14

[PATCH OLK-5.10] PCI/IOV: Add pci_sriov_numvfs_lock to support enable pci sriov concurrently
by Jialin Zhang 02 Nov '23

02 Nov '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BLQX CVE: NA -------------------------------- "echo sriov_totalvfs > /sys/bus/pci/devices/$PF_BDF/sriov_numvfs" concurrently may cause the following warnings: Warning 1: sysfs: cannot create duplicate filename '/devices/pci0000:95/0000:95:00.0/pci_bus/0000:97' Call trace: dump_backtrace+0x0/0x200 show_stack+0x20/0x30 dump_stack+0xf0/0x138 sysfs_warn_dup+0x6c/0x90 sysfs_create_dir_ns+0xf8/0x11c create_dir+0x30/0x18c kobject_add_internal+0x5c/0x190 kobject_add+0x98/0x110 device_add+0x100/0x4a0 device_register+0x28/0x40 pci_alloc_child_bus+0x184/0x24c pci_add_new_bus+0x20/0xa4 pci_iov_add_virtfn+0x2a8/0x31c sriov_enable+0x20c/0x4d0 pci_enable_sriov+0x38/0x50 virtio_pci_sriov_configure+0x3c/0xf4 [virtio_pci] sriov_numvfs_store+0xb0/0x1b0 dev_attr_store+0x20/0x34 sysfs_kf_write+0x4c/0x5c kernfs_fop_write_iter+0x130/0x1c0 new_sync_write+0xf0/0x194 vfs_write+0x224/0x2c0 ksys_write+0x74/0x104 __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0xa4 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 The reason is that different VFs may create the same pci bus number and try to add new bus concurrently in virtfn_add_bus. Warning 2: proc_dir_entry 'pci/0000:97' already registered Call trace: proc_register+0x100/0x190 proc_mkdir+0x6c/0xa0 pci_proc_attach_device+0xfc/0x120 pci_bus_add_device+0x40/0xd0 pci_iov_add_virtfn+0x2c8/0x31c sriov_enable+0x20c/0x4d0 pci_enable_sriov+0x38/0x50 virtio_pci_sriov_configure+0x3c/0xf4 [virtio_pci] sriov_numvfs_store+0xb0/0x1b0 dev_attr_store+0x20/0x34 sysfs_kf_write+0x4c/0x5c kernfs_fop_write_iter+0x130/0x1c0 new_sync_write+0xf0/0x194 vfs_write+0x224/0x2c0 ksys_write+0x74/0x104 __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0xa4 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 The reason is that different VFs may create '/proc/bus/pci/bus_number' directory using the same bus number in pci_proc_attach_device concurrently. Mutex lock can avoid potential conflict. With the patch below the warnings above are no longer appear. Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/pci/iov.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c index 4afd4ee4f7f0..958f349345ca 100644 --- a/drivers/pci/iov.c +++ b/drivers/pci/iov.c @@ -16,6 +16,8 @@ #define VIRTFN_ID_LEN 16 +static DEFINE_MUTEX(pci_sriov_numvfs_lock); + int pci_iov_virtfn_bus(struct pci_dev *dev, int vf_id) { if (!dev->is_physfn) @@ -299,6 +301,7 @@ static ssize_t sriov_numvfs_store(struct device *dev, if (num_vfs > pci_sriov_get_totalvfs(pdev)) return -ERANGE; + mutex_lock(&pci_sriov_numvfs_lock); device_lock(&pdev->dev); if (num_vfs == pdev->sriov->num_VFs) @@ -335,6 +338,7 @@ static ssize_t sriov_numvfs_store(struct device *dev, exit: device_unlock(&pdev->dev); + mutex_unlock(&pci_sriov_numvfs_lock); if (ret < 0) return ret; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] PCI/IOV: Add pci_sriov_numvfs_lock to support enable pci sriov concurrently
by Jialin Zhang 02 Nov '23

02 Nov '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BLQX CVE: NA -------------------------------- "echo sriov_totalvfs > /sys/bus/pci/devices/$PF_BDF/sriov_numvfs" concurrently may cause the following warnings: Warning 1: sysfs: cannot create duplicate filename '/devices/pci0000:95/0000:95:00.0/pci_bus/0000:97' Call trace: dump_backtrace+0x0/0x200 show_stack+0x20/0x30 dump_stack+0xf0/0x138 sysfs_warn_dup+0x6c/0x90 sysfs_create_dir_ns+0xf8/0x11c create_dir+0x30/0x18c kobject_add_internal+0x5c/0x190 kobject_add+0x98/0x110 device_add+0x100/0x4a0 device_register+0x28/0x40 pci_alloc_child_bus+0x184/0x24c pci_add_new_bus+0x20/0xa4 pci_iov_add_virtfn+0x2a8/0x31c sriov_enable+0x20c/0x4d0 pci_enable_sriov+0x38/0x50 virtio_pci_sriov_configure+0x3c/0xf4 [virtio_pci] sriov_numvfs_store+0xb0/0x1b0 dev_attr_store+0x20/0x34 sysfs_kf_write+0x4c/0x5c kernfs_fop_write_iter+0x130/0x1c0 new_sync_write+0xf0/0x194 vfs_write+0x224/0x2c0 ksys_write+0x74/0x104 __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0xa4 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 The reason is that different VFs may create the same pci bus number and try to add new bus concurrently in virtfn_add_bus. Warning 2: proc_dir_entry 'pci/0000:97' already registered Call trace: proc_register+0x100/0x190 proc_mkdir+0x6c/0xa0 pci_proc_attach_device+0xfc/0x120 pci_bus_add_device+0x40/0xd0 pci_iov_add_virtfn+0x2c8/0x31c sriov_enable+0x20c/0x4d0 pci_enable_sriov+0x38/0x50 virtio_pci_sriov_configure+0x3c/0xf4 [virtio_pci] sriov_numvfs_store+0xb0/0x1b0 dev_attr_store+0x20/0x34 sysfs_kf_write+0x4c/0x5c kernfs_fop_write_iter+0x130/0x1c0 new_sync_write+0xf0/0x194 vfs_write+0x224/0x2c0 ksys_write+0x74/0x104 __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0xa4 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 The reason is that different VFs may create '/proc/bus/pci/bus_number' directory using the same bus number in pci_proc_attach_device concurrently. Mutex lock can avoid potential conflict. With the patch below the warnings above are no longer appear. Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/pci/pci-sysfs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c index 48c56cb08652..e35c2f0ee28c 100644 --- a/drivers/pci/pci-sysfs.c +++ b/drivers/pci/pci-sysfs.c @@ -31,6 +31,8 @@ static int sysfs_initialized; /* = 0 */ +static DEFINE_MUTEX(pci_sriov_numvfs_lock); + /* show configuration fields */ #define pci_config_attr(field, format_string) \ static ssize_t \ @@ -604,6 +606,7 @@ static ssize_t sriov_numvfs_store(struct device *dev, if (num_vfs > pci_sriov_get_totalvfs(pdev)) return -ERANGE; + mutex_lock(&pci_sriov_numvfs_lock); device_lock(&pdev->dev); if (num_vfs == pdev->sriov->num_VFs) @@ -640,6 +643,7 @@ static ssize_t sriov_numvfs_store(struct device *dev, exit: device_unlock(&pdev->dev); + mutex_unlock(&pci_sriov_numvfs_lock); if (ret < 0) return ret; -- 2.25.1

2 1

[PATCH OLK-5.10] coresight: core: fix memory leak in dict->fwnode_list
by Junhao He 02 Nov '23

02 Nov '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8DBW8 CVE: NA ---------------------------------------------------------------------- There are memory leaks reported by kmemleak: ... unreferenced object 0xffff2020103c3200 (size 256): comm "insmod", pid 4476, jiffies 4294978252 (age 50072.536s) hex dump (first 32 bytes): 10 60 40 06 28 20 ff ff 10 c0 59 06 20 20 ff ff .`@.( ....Y. .. 10 e0 47 06 28 20 ff ff 10 00 49 06 28 20 ff ff ..G.( ....I.( .. backtrace: [<0000000034ec4724>] __kmem_cache_alloc_node+0x2f8/0x348 [<0000000057fbc15d>] __kmalloc_node_track_caller+0x5c/0x110 [<00000055d5e34b>] krealloc+0x8c/0x178 [<00000000a4635beb>] coresight_alloc_device_name+0x128/0x188 [coresight] [<00000000a92ddfee>] funnel_cs_ops+0x10/0xfffffffffffedaa0 [coresight_funnel] [<00000000449e20f8>] dynamic_funnel_ids+0x80/0xfffffffffffed840 [coresight_funnel] ... when remove driver, the golab variables defined by the macro DEFINE_CORESIGHT_DEVLIST will be released, dict->nr_idx and dict->fwnode_list are cleared to 0. The lifetime of the golab variable has ended. So the buffer pointer is lost. Use the callback of devm_add_action_or_reset() to free memory. Fixes: 0f5f9b6ba9e1 ("coresight: Use platform agnostic names") Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- drivers/hwtracing/coresight/coresight-core.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c index 9696f402a328..55ec00876989 100644 --- a/drivers/hwtracing/coresight/coresight-core.c +++ b/drivers/hwtracing/coresight/coresight-core.c @@ -1739,6 +1739,20 @@ bool coresight_loses_context_with_cpu(struct device *dev) } EXPORT_SYMBOL_GPL(coresight_loses_context_with_cpu); +void coresight_release_dev_list(void *data) +{ + struct coresight_dev_list *dict = data; + + mutex_lock(&coresight_mutex); + + if (dict->nr_idx) { + kfree(dict->fwnode_list); + dict->nr_idx = 0; + } + + mutex_unlock(&coresight_mutex); +} + /* * coresight_alloc_device_name - Get an index for a given device in the * device index list specific to a driver. An index is allocated for a @@ -1749,12 +1763,16 @@ EXPORT_SYMBOL_GPL(coresight_loses_context_with_cpu); char *coresight_alloc_device_name(struct coresight_dev_list *dict, struct device *dev) { - int idx; + int idx, ret; char *name = NULL; struct fwnode_handle **list; mutex_lock(&coresight_mutex); + ret = devm_add_action_or_reset(dev, coresight_release_dev_list, dict); + if (ret) + goto done; + idx = coresight_search_device_idx(dict, dev_fwnode(dev)); if (idx < 0) { /* Make space for the new entry */ -- 2.33.0

2 1

[PATCH OLK-5.10 v2] perf auxtrace ptt: Record whether an auxtrace mmap is needed
by Junhao He 02 Nov '23

02 Nov '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7HI80 CVE: NA ---------------------------------------------------------------------- Add a flag needs_auxtrace_mmap to record whether an auxtrace mmap is needed, in preparation for correctly determining whether or not an auxtrace mmap is needed. The change was added in the mainline patch [1], but it was deleted when upstream openEuler for fixes build error. openEuler OLK-5.10 now has merge evsel->needs_auxtrace_mmap. Therefore, backport this modification to OpenEuler OLK-5.10. [1] 057381a7ece1 "perf auxtrace arm64: Add support for HiSilicon PCIe Tune and Trace device driver" Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- tools/perf/arch/arm64/util/hisi-ptt.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/perf/arch/arm64/util/hisi-ptt.c b/tools/perf/arch/arm64/util/hisi-ptt.c index 110b2edf3e6b..97696b6e1dd5 100644 --- a/tools/perf/arch/arm64/util/hisi-ptt.c +++ b/tools/perf/arch/arm64/util/hisi-ptt.c @@ -113,6 +113,7 @@ static int hisi_ptt_recording_options(struct auxtrace_record *itr, } evsel->core.attr.freq = 0; evsel->core.attr.sample_period = 1; + evsel->needs_auxtrace_mmap = true; hisi_ptt_evsel = evsel; opts->full_auxtrace = true; } -- 2.33.0

2 1

[PATCH] perf auxtrace ptt: Record whether an auxtrace mmap is needed
by Junhao He 02 Nov '23

02 Nov '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7HI80 CVE: NA ---------------------------------------------------------------------- Add a flag needs_auxtrace_mmap to record whether an auxtrace mmap is needed, in preparation for correctly determining whether or not an auxtrace mmap is needed. The change was added in the mainline patch [1], but it was deleted when upstream openEuler for fixes build error. openEuler OLK-5.10 now has merge evsel->needs_auxtrace_mmap. Therefore, backport this modification to OpenEuler OLK-5.10. [1] 057381a7ece1 "perf auxtrace arm64: Add support for HiSilicon PCIe Tune and Trace device driver" Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- tools/perf/arch/arm64/util/hisi-ptt.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/perf/arch/arm64/util/hisi-ptt.c b/tools/perf/arch/arm64/util/hisi-ptt.c index 110b2edf3e6b..97696b6e1dd5 100644 --- a/tools/perf/arch/arm64/util/hisi-ptt.c +++ b/tools/perf/arch/arm64/util/hisi-ptt.c @@ -113,6 +113,7 @@ static int hisi_ptt_recording_options(struct auxtrace_record *itr, } evsel->core.attr.freq = 0; evsel->core.attr.sample_period = 1; + evsel->needs_auxtrace_mmap = true; hisi_ptt_evsel = evsel; opts->full_auxtrace = true; } -- 2.33.0

1 0

[PATCH v3 openEuler-1.0-LTS] kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail
by Wenyu Huang 02 Nov '23

02 Nov '23

From: Kaitao Cheng <pilgrimtao(a)gmail.com> stable inclusion from stable-v4.19.297 commit 50f9ad607ea891a9308e67b81f774c71736d1098 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BAW8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In the function, if register_trace_sched_migrate_task() returns error, sched_switch/sched_wakeup_new/sched_wakeup won't unregister. That is why fail_deprobe_sched_switch was added. Link: http://lkml.kernel.org/r/20191231133530.2794-1-pilgrimtao@gmail.com Cc: stable(a)vger.kernel.org Fixes: 478142c39c8c2 ("tracing: do not grab lock in wakeup latency function tracing") Signed-off-by: Kaitao Cheng <pilgrimtao(a)gmail.com> Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Signed-off-by: Wenyu Huang <huangwenyu4(a)huawei.com> --- kernel/trace/trace_sched_wakeup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index 0db1b024e786..8041bd5e4262 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -642,7 +642,7 @@ static void start_wakeup_tracer(struct trace_array *tr) if (ret) { pr_info("wakeup trace: Couldn't activate tracepoint" " probe to kernel_sched_migrate_task\n"); - return; + goto fail_deprobe_sched_switch; } wakeup_reset(tr); @@ -660,6 +660,8 @@ static void start_wakeup_tracer(struct trace_array *tr) printk(KERN_ERR "failed to start wakeup tracer\n"); return; +fail_deprobe_sched_switch: + unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); fail_deprobe_wake_new: unregister_trace_sched_wakeup_new(probe_wakeup, NULL); fail_deprobe: -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net: sched: sch_qfq: Use non-work-conserving warning handler
by Liu Jian 02 Nov '23

02 Nov '23

mainline inclusion from mainline-v6.7-rc1 commit 6d25d1dc76bf5943a5c1f4bb74d66d5eac58eb77 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8D8S8 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- A helper function for printing non-work-conserving alarms is added in commit b00355db3f88 ("pkt_sched: sch_hfsc: sch_htb: Add non-work-conserving warning handler."). In this commit, use qdisc_warn_nonwc() instead of WARN_ONCE() to handle the non-work-conserving warning in qfq Qdisc. Signed-off-by: Liu Jian <liujian56(a)huawei.com> Link: https://lore.kernel.org/r/20231023064729.370649-1-liujian56@huawei.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sched/sch_qfq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c index 5b7b149a2b9f..14d009151a5b 100644 --- a/net/sched/sch_qfq.c +++ b/net/sched/sch_qfq.c @@ -1018,7 +1018,7 @@ static inline struct sk_buff *qfq_peek_skb(struct qfq_aggregate *agg, *cl = list_first_entry(&agg->active, struct qfq_class, alist); skb = (*cl)->qdisc->ops->peek((*cl)->qdisc); if (skb == NULL) - WARN_ONCE(1, "qfq_dequeue: non-workconserving leaf\n"); + qdisc_warn_nonwc("qfq_dequeue", (*cl)->qdisc); else *len = qdisc_pkt_len(skb); -- 2.34.1

2 1

[PATCH OLK-5.10] net: sched: sch_qfq: Use non-work-conserving warning handler
by Liu Jian 02 Nov '23

02 Nov '23

mainline inclusion from mainline-v6.7-rc1 commit 6d25d1dc76bf5943a5c1f4bb74d66d5eac58eb77 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8D8S8 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- A helper function for printing non-work-conserving alarms is added in commit b00355db3f88 ("pkt_sched: sch_hfsc: sch_htb: Add non-work-conserving warning handler."). In this commit, use qdisc_warn_nonwc() instead of WARN_ONCE() to handle the non-work-conserving warning in qfq Qdisc. Signed-off-by: Liu Jian <liujian56(a)huawei.com> Link: https://lore.kernel.org/r/20231023064729.370649-1-liujian56@huawei.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sched/sch_qfq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c index 9447f486141d..e48c3baa059e 100644 --- a/net/sched/sch_qfq.c +++ b/net/sched/sch_qfq.c @@ -1005,7 +1005,7 @@ static inline struct sk_buff *qfq_peek_skb(struct qfq_aggregate *agg, *cl = list_first_entry(&agg->active, struct qfq_class, alist); skb = (*cl)->qdisc->ops->peek((*cl)->qdisc); if (skb == NULL) - WARN_ONCE(1, "qfq_dequeue: non-workconserving leaf\n"); + qdisc_warn_nonwc("qfq_dequeue", (*cl)->qdisc); else *len = qdisc_pkt_len(skb); -- 2.34.1

2 1

[PATCH OLK-5.10] ext4: recheck buffer valid after page unlock
by yangerkun 02 Nov '23

02 Nov '23

hulk inclusion category: bugfix bugzilla: 189306, https://gitee.com/openeuler/kernel/issues/I8BBWH CVE: NA ---------------------------------------- We need destination address when we do dio read, and this addr can come from mmap results for a journal data mode inode. Then dio_bio_complete will dirty the page which the mmap addr point to(since we have fill dirty data for this page). ext4_journalled_set_page_dirty will first set PageChecked and then dirty page(do not dirty buffer), which leave __ext4_journalled_writepage in ext4_writepage to do the rest thing needed for journal data mode. We need first start handle and then lock the page, so in __ext4_journalled_writepage we first unlock the page and latter call ext4_journal_start; after we relock the page, we do some check to prevent the concurrence truncate and then walk through buffer to help join journal. Actually, once we unlock the page, since we has not add extra buffer refcount, so the buffer can also gone(concurrent happened for jbd2_journal_commit_transaction and jbd2_log_do_checkpoint can remove the extra buffer head ref and clear buffer dirty, so drop cache can release buffer), and upper walk through buffer will trigger the BUG_ON in page_buffers. The problem does not exist in mainline since 3f079114bf52 ("ext4: Convert data=journal writeback to use ext4_writepages()") delete all this code, and this patchset seems too complex to do the backport. So we just fix it with a simpler way, check buffer valid before walk through buffer. Signed-off-by: yangerkun <yangerkun(a)huawei.com> --- fs/ext4/inode.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 9379a062dba4..0b5521cec637 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -1911,6 +1911,13 @@ static int __ext4_journalled_writepage(struct page *page, goto out; } + if (!page_has_buffers(page)) { + /* Check buffer valid since we ever unlock this page */ + ext4_journal_stop(handle); + ClearPageDirty(page); + goto out; + } + if (inline_data) { ret = ext4_mark_inode_dirty(handle, inode); } else { -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS v3 0/3] bugfixes for CVE-2022-45884
by liwei 02 Nov '23

02 Nov '23

bugfixes for CVE-2022-45884 Dinghao Liu (1): media: dvbdev: Fix memleak in dvb_register_device Fuqian Huang (1): media: media/dvb: Use kmemdup rather than duplicating its implementation Hyunwoo Kim (1): media: dvb-core: Fix use-after-free due to race at dvb_register_device() drivers/media/dvb-core/dvbdev.c | 86 ++++++++++++++++----- drivers/media/dvb-frontends/drx39xyj/drxj.c | 5 +- include/media/dvbdev.h | 15 ++++ 3 files changed, 82 insertions(+), 24 deletions(-) -- 2.25.1

2 4

[PATCH openEuler-1.0-LTS v4 0/7] Fix netfilter conntrack
by Lu Wei 02 Nov '23

02 Nov '23

Florian Westphal (7): netfilter: conntrack: tell compiler to not inline nf_ct_resolve_clash netfilter: conntrack: remove two args from resolve_clash netfilter: conntrack: place confirm-bit setting in a helper netfilter: conntrack: split resolve_clash function netfilter: conntrack: allow insertion of clashing entries netfilter: conntrack: do not auto-delete clash entries on reply netfilter: conntrack: fix infinite loop on rmmod include/linux/rculist_nulls.h | 7 + .../linux/netfilter/nf_conntrack_common.h | 12 +- net/netfilter/nf_conntrack_core.c | 215 +++++++++++++++--- net/netfilter/nf_conntrack_proto_udp.c | 8 +- net/netfilter/nft_flow_offload.c | 2 +- 5 files changed, 206 insertions(+), 38 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-1.0-LTS v2 0/4] ACPI for MPAM 2.0
by Yu Liao 01 Nov '23

01 Nov '23

v1 -> v2: modified commit log Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 21 +++- drivers/acpi/arm64/mpam_v2.c | 175 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 373 insertions(+), 7 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS v2 0/3] bugfixes for CVE-2022-45884
by liwei 01 Nov '23

01 Nov '23

bugfixes for CVE-2022-45884 Dinghao Liu (1): media: dvbdev: Fix memleak in dvb_register_device Fuqian Huang (1): media: media/dvb: Use kmemdup rather than duplicating its implementation Hyunwoo Kim (1): media: dvb-core: Fix use-after-free due to race at dvb_register_device() drivers/media/dvb-core/dvbdev.c | 86 ++++++++++++++++----- drivers/media/dvb-frontends/drx39xyj/drxj.c | 5 +- include/media/dvbdev.h | 15 ++++ 3 files changed, 82 insertions(+), 24 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 v2 0/7] add sample sockmap code for redis
by Liu Jian 31 Oct '23

31 Oct '23

v1->v2: Move local_skb to a reserved field instead of inserting it to a structure hole. Fix a cgroup ref leak bug. Hengqi Chen (1): libbpf: Support uniform BTF-defined key/value specification across all BPF maps Liu Jian (4): cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted net: let sockops can use bpf_get_current_comm() net: add local_skb parameter to identify local tcp connection tools: add sample sockmap code for redis Xu Kuohai (1): bpf, sockmap: Fix map type error in sock_map_del_link Yosry Ahmed (1): cgroup: add cgroup_v1v2_get_from_[fd/file]() include/linux/cgroup.h | 2 + include/linux/filter.h | 1 + include/linux/skbuff.h | 2 +- include/uapi/linux/bpf.h | 1 + kernel/bpf/cgroup.c | 8 +- kernel/cgroup/cgroup.c | 72 +++++++- net/core/filter.c | 9 + net/core/sock_map.c | 10 +- net/ipv4/tcp_input.c | 4 +- net/ipv4/tcp_output.c | 4 + tools/include/uapi/linux/bpf.h | 1 + tools/lib/bpf/libbpf.c | 24 +++ tools/netacc/Makefile | 24 +++ tools/netacc/bpf_sockmap.h | 167 +++++++++++++++++++ tools/netacc/net-acc | 35 ++++ tools/netacc/netacc.c | 296 +++++++++++++++++++++++++++++++++ tools/netacc/netaccsockmap.c | 176 ++++++++++++++++++++ 17 files changed, 820 insertions(+), 16 deletions(-) create mode 100644 tools/netacc/Makefile create mode 100644 tools/netacc/bpf_sockmap.h create mode 100755 tools/netacc/net-acc create mode 100644 tools/netacc/netacc.c create mode 100644 tools/netacc/netaccsockmap.c -- 2.34.1

2 8

[PATCH openEuler-1.0-LTS v3 0/7] Fix netfilter conntrack
by Lu Wei 31 Oct '23

31 Oct '23

Florian Westphal (7): netfilter: conntrack: tell compiler to not inline nf_ct_resolve_clash netfilter: conntrack: remove two args from resolve_clash netfilter: conntrack: place confirm-bit setting in a helper netfilter: conntrack: split resolve_clash function netfilter: conntrack: allow insertion of clashing entries netfilter: conntrack: do not auto-delete clash entries on reply netfilter: conntrack: fix infinite loop on rmmod include/linux/rculist_nulls.h | 7 + .../linux/netfilter/nf_conntrack_common.h | 12 +- net/netfilter/nf_conntrack_core.c | 215 +++++++++++++++--- net/netfilter/nf_conntrack_proto_udp.c | 7 +- net/netfilter/nft_flow_offload.c | 2 +- 5 files changed, 205 insertions(+), 38 deletions(-) -- V3: modify commit message 2.34.1

2 8

[PATCH OLK-5.10 0/3] LoongArch: add 32/64 pc relative relocation type support
by Hongchen Zhang 31 Oct '23

31 Oct '23

Hongchen Zhang (3): LoongArch: Define relocation types for ABI v2.10 LoongArch: Add support for 32_PCREL relocation type LoongArch: Add support for 64_PCREL relocation type arch/loongarch/include/asm/elf.h | 9 +++++++++ arch/loongarch/kernel/module.c | 22 +++++++++++++++++++++- 2 files changed, 30 insertions(+), 1 deletion(-) -- 2.33.0

2 4

[PATCH OLK-5.10 1/3] LoongArch: Define relocation types for ABI v2.10
by Hongchen Zhang 31 Oct '23

31 Oct '23

LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8C3BV ------------------------------------------ The relocation types from 101 to 109 are used by GNU binutils >= 2.41, add their definitions to use them in later patches. Link: https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=include/elf/loongar… Cc: <stable(a)vger.kernel.org> Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/include/asm/elf.h | 9 +++++++++ arch/loongarch/kernel/module.c | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/arch/loongarch/include/asm/elf.h b/arch/loongarch/include/asm/elf.h index 7af0cebf28d7..b9a4ab54285c 100644 --- a/arch/loongarch/include/asm/elf.h +++ b/arch/loongarch/include/asm/elf.h @@ -111,6 +111,15 @@ #define R_LARCH_TLS_GD_HI20 98 #define R_LARCH_32_PCREL 99 #define R_LARCH_RELAX 100 +#define R_LARCH_DELETE 101 +#define R_LARCH_ALIGN 102 +#define R_LARCH_PCREL20_S2 103 +#define R_LARCH_CFA 104 +#define R_LARCH_ADD6 105 +#define R_LARCH_SUB6 106 +#define R_LARCH_ADD_ULEB128 107 +#define R_LARCH_SUB_ULEB128 108 +#define R_LARCH_64_PCREL 109 #ifndef ELF_ARCH diff --git a/arch/loongarch/kernel/module.c b/arch/loongarch/kernel/module.c index 8127df5dd0ad..0b8ce1e0f83b 100644 --- a/arch/loongarch/kernel/module.c +++ b/arch/loongarch/kernel/module.c @@ -387,7 +387,7 @@ typedef int (*reloc_rela_handler)(struct module *mod, u32 *location, Elf_Addr v, /* The handlers for known reloc types */ static reloc_rela_handler reloc_rela_handlers[] = { - [R_LARCH_NONE ... R_LARCH_RELAX] = apply_r_larch_error, + [R_LARCH_NONE ... R_LARCH_64_PCREL] = apply_r_larch_error, [R_LARCH_NONE] = apply_r_larch_none, [R_LARCH_32] = apply_r_larch_32, -- 2.33.0

2 2

[PATCH OLK-5.10 3/3] LoongArch: Add support for 64_PCREL relocation type
by Hongchen Zhang 31 Oct '23

31 Oct '23

LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8C3BV ------------------------------------------ When build and update kernel with the latest upstream binutils and loongson3_defconfig, module loader fails with: kmod: zsmalloc: Unknown relocation type 109 kmod: fuse: Unknown relocation type 109 kmod: fuse: Unknown relocation type 109 kmod: radeon: Unknown relocation type 109 kmod: nf_tables: Unknown relocation type 109 kmod: nf_tables: Unknown relocation type 109 This is because the latest upstream binutils replaces a pair of ADD64 and SUB64 with 64_PCREL, so add support for 64_PCREL relocation type. Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ecb802d02eeb Cc: <stable(a)vger.kernel.org> Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/kernel/module.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/loongarch/kernel/module.c b/arch/loongarch/kernel/module.c index a67f9def7927..b4cf3383a8bc 100644 --- a/arch/loongarch/kernel/module.c +++ b/arch/loongarch/kernel/module.c @@ -381,6 +381,15 @@ static int apply_r_larch_32_pcrel(struct module *mod, u32 *location, Elf_Addr v, return 0; } +static int apply_r_larch_64_pcrel(struct module *mod, u32 *location, Elf_Addr v, + s64 *rela_stack, size_t *rela_stack_top, unsigned int type) +{ + ptrdiff_t offset = (void *)v - (void *)location; + + *(u64 *)location = offset; + return 0; +} + /* * reloc_handlers_rela() - Apply a particular relocation to a module * @mod: the module to apply the reloc to @@ -414,6 +423,7 @@ static reloc_rela_handler reloc_rela_handlers[] = { [R_LARCH_PCALA_HI20...R_LARCH_PCALA64_HI12] = apply_r_larch_pcala, [R_LARCH_GOT_PC_HI20...R_LARCH_GOT_PC_LO12] = apply_r_larch_got_pc, [R_LARCH_32_PCREL] = apply_r_larch_32_pcrel, + [R_LARCH_64_PCREL] = apply_r_larch_64_pcrel, }; int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, -- 2.33.0

1 0

[PATCH OLK-5.10 2/3] LoongArch: Add support for 32_PCREL relocation type
by Hongchen Zhang 31 Oct '23

31 Oct '23

LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8C3BV ------------------------------------------ When build and update kernel with the latest upstream binutils and loongson3_defconfig, module loader fails with: kmod: zsmalloc: Unsupport relocation type 99, please add its support. kmod: fuse: Unsupport relocation type 99, please add its support. kmod: ipmi_msghandler: Unsupport relocation type 99, please add its support. kmod: ipmi_msghandler: Unsupport relocation type 99, please add its support. kmod: pstore: Unsupport relocation type 99, please add its support. kmod: drm_display_helper: Unsupport relocation type 99, please add its support. kmod: drm_display_helper: Unsupport relocation type 99, please add its support. kmod: drm_display_helper: Unsupport relocation type 99, please add its support. kmod: fuse: Unsupport relocation type 99, please add its support. kmod: fat: Unsupport relocation type 99, please add its support. This is because the latest upstream binutils replaces a pair of ADD32 and SUB32 with 32_PCREL, so add support for 32_PCREL relocation type. Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ecb802d02eeb Cc: <stable(a)vger.kernel.org> Co-developed-by: Youling Tang <tangyouling(a)loongson.cn> Signed-off-by: Youling Tang <tangyouling(a)loongson.cn> Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/kernel/module.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/loongarch/kernel/module.c b/arch/loongarch/kernel/module.c index 0b8ce1e0f83b..a67f9def7927 100644 --- a/arch/loongarch/kernel/module.c +++ b/arch/loongarch/kernel/module.c @@ -372,6 +372,15 @@ static int apply_r_larch_got_pc(struct module *mod, u32 *location, Elf_Addr v, return apply_r_larch_pcala(mod, location, got, rela_stack, rela_stack_top, type); } +static int apply_r_larch_32_pcrel(struct module *mod, u32 *location, Elf_Addr v, + s64 *rela_stack, size_t *rela_stack_top, unsigned int type) +{ + ptrdiff_t offset = (void *)v - (void *)location; + + *(u32 *)location = offset; + return 0; +} + /* * reloc_handlers_rela() - Apply a particular relocation to a module * @mod: the module to apply the reloc to @@ -404,6 +413,7 @@ static reloc_rela_handler reloc_rela_handlers[] = { [R_LARCH_B26] = apply_r_larch_b26, [R_LARCH_PCALA_HI20...R_LARCH_PCALA64_HI12] = apply_r_larch_pcala, [R_LARCH_GOT_PC_HI20...R_LARCH_GOT_PC_LO12] = apply_r_larch_got_pc, + [R_LARCH_32_PCREL] = apply_r_larch_32_pcrel, }; int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, -- 2.33.0

1 0

[PATCH OLK-5.10] nvmet-tcp: Fix a possible UAF in queue intialization setup
by Li Lingfeng 31 Oct '23

31 Oct '23

From: Sagi Grimberg <sagi(a)grimberg.me> mainline inclusion from mainline-v6.6-rc7 commit d920abd1e7c4884f9ecd0749d1921b7ab19ddfbd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I88DLS CVE: CVE-2023-5178 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- From Alon: "Due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel, a malicious user can cause a UAF and a double free, which may lead to RCE (may also lead to an LPE in case the attacker already has local privileges)." Hence, when a queue initialization fails after the ahash requests are allocated, it is guaranteed that the queue removal async work will be called, hence leave the deallocation to the queue removal. Also, be extra careful not to continue processing the socket, so set queue rcv_state to NVMET_TCP_RECV_ERR upon a socket error. Cc: stable(a)vger.kernel.org Reported-by: Alon Zahavi <zahavi.alon(a)gmail.com> Tested-by: Alon Zahavi <zahavi.alon(a)gmail.com> Signed-off-by: Sagi Grimberg <sagi(a)grimberg.me> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/nvme/target/tcp.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 2ddbd4f4f628..7ce22d173fc7 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -336,6 +336,7 @@ static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue) static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status) { + queue->rcv_state = NVMET_TCP_RECV_ERR; if (status == -EPIPE || status == -ECONNRESET) kernel_sock_shutdown(queue->sock, SHUT_RDWR); else @@ -882,15 +883,11 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) iov.iov_len = sizeof(*icresp); ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len); if (ret < 0) - goto free_crypto; + return ret; /* queue removal will cleanup */ queue->state = NVMET_TCP_Q_LIVE; nvmet_prepare_receive_pdu(queue); return 0; -free_crypto: - if (queue->hdr_digest || queue->data_digest) - nvmet_tcp_free_crypto(queue); - return ret; } static void nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue, -- 2.31.1

2 1

[PATCH OLK-5.10] integrity: Fix possible multiple allocation in integrity_inode_get()
by felix 31 Oct '23

31 Oct '23

From: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> mainline inclusion from mainline-v6.5-rc1 commit 9df6a4870dc371136e90330cfbbc51464ee66993 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8C2DB CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When integrity_inode_get() is querying and inserting the cache, there is a conditional race in the concurrent environment. The race condition is the result of not properly implementing "double-checked locking". In this case, it first checks to see if the iint cache record exists before taking the lock, but doesn't check again after taking the integrity_iint_lock. Fixes: bf2276d10ce5 ("ima: allocating iint improvements") Signed-off-by: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> Cc: Dmitry Kasatkin <dmitry.kasatkin(a)gmail.com> Cc: <stable(a)vger.kernel.org> # v3.10+ Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/integrity/iint.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/security/integrity/iint.c b/security/integrity/iint.c index 1668cfbeb671..2428037d9e14 100644 --- a/security/integrity/iint.c +++ b/security/integrity/iint.c @@ -43,12 +43,10 @@ static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode) else if (inode > iint->inode) n = n->rb_right; else - break; + return iint; } - if (!n) - return NULL; - return iint; + return NULL; } /* @@ -111,10 +109,15 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode) parent = *p; test_iint = rb_entry(parent, struct integrity_iint_cache, rb_node); - if (inode < test_iint->inode) + if (inode < test_iint->inode) { p = &(*p)->rb_left; - else + } else if (inode > test_iint->inode) { p = &(*p)->rb_right; + } else { + write_unlock(&integrity_iint_lock); + kmem_cache_free(iint_cache, iint); + return test_iint; + } } iint->inode = inode; -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] LoongArch: add 32/64 pc relative relocation type support
by Hongchen Zhang 31 Oct '23

31 Oct '23

Hongchen Zhang (3): LoongArch: Define relocation types for ABI v2.10 LoongArch: Add support for 32_PCREL relocation type LoongArch: Add support for 64_PCREL relocation type arch/loongarch/include/asm/elf.h | 9 +++++++++ arch/loongarch/kernel/module.c | 22 +++++++++++++++++++++- 2 files changed, 30 insertions(+), 1 deletion(-) -- 2.33.0

2 4

[PATCH openEuler-1.0-LTS v2 0/7] Fix netfilter nf_conntrack
by Lu Wei 31 Oct '23

31 Oct '23

Florian Westphal (6): netfilter: conntrack: tell compiler to not inline nf_ct_resolve_clash netfilter: conntrack: remove two args from resolve_clash netfilter: conntrack: place confirm-bit setting in a helper netfilter: conntrack: split resolve_clash function netfilter: conntrack: allow insertion of clashing entries netfilter: conntrack: do not auto-delete clash entries on reply Zhihao Cheng (1): ubi: Refuse attaching if mtd's erasesize is 0 -- V2: add a new bugfix patch 2.34.1

2 8

[PATCH OLK-5.10 0/4] fix memcgv1 oom meminfo bug
by Lu Jialin 31 Oct '23

31 Oct '23

Sergey Senozhatsky (1): seq_buf: Add seq_buf_do_printk() helper Steven Rostedt (VMware) (1): seq_buf: Add seq_buf_terminate() API Yosry Ahmed (2): memcg: use seq_buf_do_printk() with mem_cgroup_print_oom_meminfo() memcg: dump memory.stat during cgroup OOM for v1 include/linux/seq_buf.h | 27 +++++++++++++ lib/seq_buf.c | 32 +++++++++++++++ mm/memcontrol.c | 87 +++++++++++++++++++++++------------------ 3 files changed, 108 insertions(+), 38 deletions(-) -- 2.34.1

2 5

openEuler 测试讨论
by openEuler conference 31 Oct '23

31 Oct '23

您好！ Kernel SIG 邀请您参加 2023-10-31 15:30 召开的WeLink会议会议主题：openEuler 测试讨论会议链接：https://bmeeting.huaweicloud.com:36443/#/j/980828033 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the WeLink conference will be held at 2023-10-31 15:30, The subject of the conference is openEuler 测试讨论, You can join the meeting at https://bmeeting.huaweicloud.com:36443/#/j/980828033. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH OLK-5.10 v2 00/38] Add error handling for device_add_disk
by Zhong Jinghua 31 Oct '23

31 Oct '23

Befor these paths, block is not know when drvier is add fail. Now, add error handling for drivers. Christoph Hellwig (14): block: fold register_disk into device_add_disk block: call blk_integrity_add earlier in device_add_disk block: add the events* attributes to disk_attrs block: fix error unwinding in device_add_disk block: clear ->slave_dir when dropping the main slave_dir reference block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Luis Chamberlain (11): block: return errors from blk_integrity_add block: return errors from disk_alloc_events block: add error handling for device_add_disk / add_disk block: fix device_add_disk() kobject_create_and_add() error handling loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sd: Add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Tetsuo Handa (1): block: check minor range in device_add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Yu Kuai (1): block: fix memory leak for elevator on add_disk failure Zhong Jinghua (9): block: return errors from blk_register_region block: Fix the kabi change in device_add_disk block: Fix the kabi change on blk_register_region block: call blk_get_queue earlier in __device_add_disk block: Fix minor range check in device_add_disk() block: Set memalloc_noio to false in the error path scsi: sd: Clean up sdkp if device_add_disk() failed mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup block/blk-integrity.c | 12 +- block/blk-mq.c | 19 +++ block/blk.h | 5 +- block/genhd.c | 286 ++++++++++++++++++++++++++------------- drivers/block/brd.c | 103 ++++++-------- drivers/block/loop.c | 26 ++-- drivers/block/nbd.c | 59 ++++---- drivers/mtd/ubi/block.c | 76 +++++------ drivers/nvme/host/core.c | 41 +++--- drivers/scsi/sd.c | 8 +- drivers/scsi/sr.c | 7 +- include/linux/blk-mq.h | 12 ++ include/linux/genhd.h | 36 +++++ 13 files changed, 417 insertions(+), 273 deletions(-) -- 2.31.1

2 39

[PATCH OLK-5.10 1/3] LoongArch: Define relocation types for ABI v2.10
by Hongchen Zhang 31 Oct '23

31 Oct '23

The relocation types from 101 to 109 are used by GNU binutils >= 2.41, add their definitions to use them in later patches. Link: https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=include/elf/loongar… Cc: <stable(a)vger.kernel.org> Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/include/asm/elf.h | 9 +++++++++ arch/loongarch/kernel/module.c | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/arch/loongarch/include/asm/elf.h b/arch/loongarch/include/asm/elf.h index 7af0cebf28d7..b9a4ab54285c 100644 --- a/arch/loongarch/include/asm/elf.h +++ b/arch/loongarch/include/asm/elf.h @@ -111,6 +111,15 @@ #define R_LARCH_TLS_GD_HI20 98 #define R_LARCH_32_PCREL 99 #define R_LARCH_RELAX 100 +#define R_LARCH_DELETE 101 +#define R_LARCH_ALIGN 102 +#define R_LARCH_PCREL20_S2 103 +#define R_LARCH_CFA 104 +#define R_LARCH_ADD6 105 +#define R_LARCH_SUB6 106 +#define R_LARCH_ADD_ULEB128 107 +#define R_LARCH_SUB_ULEB128 108 +#define R_LARCH_64_PCREL 109 #ifndef ELF_ARCH diff --git a/arch/loongarch/kernel/module.c b/arch/loongarch/kernel/module.c index 8127df5dd0ad..0b8ce1e0f83b 100644 --- a/arch/loongarch/kernel/module.c +++ b/arch/loongarch/kernel/module.c @@ -387,7 +387,7 @@ typedef int (*reloc_rela_handler)(struct module *mod, u32 *location, Elf_Addr v, /* The handlers for known reloc types */ static reloc_rela_handler reloc_rela_handlers[] = { - [R_LARCH_NONE ... R_LARCH_RELAX] = apply_r_larch_error, + [R_LARCH_NONE ... R_LARCH_64_PCREL] = apply_r_larch_error, [R_LARCH_NONE] = apply_r_larch_none, [R_LARCH_32] = apply_r_larch_32, -- 2.33.0

2 1

[PATCH OLK-5.10 3/3] LoongArch: Add support for 64_PCREL relocation type
by Hongchen Zhang 31 Oct '23

31 Oct '23

When build and update kernel with the latest upstream binutils and loongson3_defconfig, module loader fails with: kmod: zsmalloc: Unknown relocation type 109 kmod: fuse: Unknown relocation type 109 kmod: fuse: Unknown relocation type 109 kmod: radeon: Unknown relocation type 109 kmod: nf_tables: Unknown relocation type 109 kmod: nf_tables: Unknown relocation type 109 This is because the latest upstream binutils replaces a pair of ADD64 and SUB64 with 64_PCREL, so add support for 64_PCREL relocation type. Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ecb802d02eeb Cc: <stable(a)vger.kernel.org> Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/kernel/module.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/loongarch/kernel/module.c b/arch/loongarch/kernel/module.c index a67f9def7927..b4cf3383a8bc 100644 --- a/arch/loongarch/kernel/module.c +++ b/arch/loongarch/kernel/module.c @@ -381,6 +381,15 @@ static int apply_r_larch_32_pcrel(struct module *mod, u32 *location, Elf_Addr v, return 0; } +static int apply_r_larch_64_pcrel(struct module *mod, u32 *location, Elf_Addr v, + s64 *rela_stack, size_t *rela_stack_top, unsigned int type) +{ + ptrdiff_t offset = (void *)v - (void *)location; + + *(u64 *)location = offset; + return 0; +} + /* * reloc_handlers_rela() - Apply a particular relocation to a module * @mod: the module to apply the reloc to @@ -414,6 +423,7 @@ static reloc_rela_handler reloc_rela_handlers[] = { [R_LARCH_PCALA_HI20...R_LARCH_PCALA64_HI12] = apply_r_larch_pcala, [R_LARCH_GOT_PC_HI20...R_LARCH_GOT_PC_LO12] = apply_r_larch_got_pc, [R_LARCH_32_PCREL] = apply_r_larch_32_pcrel, + [R_LARCH_64_PCREL] = apply_r_larch_64_pcrel, }; int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, -- 2.33.0

1 0

[PATCH OLK-5.10 2/3] LoongArch: Add support for 32_PCREL relocation type
by Hongchen Zhang 31 Oct '23

31 Oct '23

When build and update kernel with the latest upstream binutils and loongson3_defconfig, module loader fails with: kmod: zsmalloc: Unsupport relocation type 99, please add its support. kmod: fuse: Unsupport relocation type 99, please add its support. kmod: ipmi_msghandler: Unsupport relocation type 99, please add its support. kmod: ipmi_msghandler: Unsupport relocation type 99, please add its support. kmod: pstore: Unsupport relocation type 99, please add its support. kmod: drm_display_helper: Unsupport relocation type 99, please add its support. kmod: drm_display_helper: Unsupport relocation type 99, please add its support. kmod: drm_display_helper: Unsupport relocation type 99, please add its support. kmod: fuse: Unsupport relocation type 99, please add its support. kmod: fat: Unsupport relocation type 99, please add its support. This is because the latest upstream binutils replaces a pair of ADD32 and SUB32 with 32_PCREL, so add support for 32_PCREL relocation type. Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ecb802d02eeb Cc: <stable(a)vger.kernel.org> Co-developed-by: Youling Tang <tangyouling(a)loongson.cn> Signed-off-by: Youling Tang <tangyouling(a)loongson.cn> Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/kernel/module.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/loongarch/kernel/module.c b/arch/loongarch/kernel/module.c index 0b8ce1e0f83b..a67f9def7927 100644 --- a/arch/loongarch/kernel/module.c +++ b/arch/loongarch/kernel/module.c @@ -372,6 +372,15 @@ static int apply_r_larch_got_pc(struct module *mod, u32 *location, Elf_Addr v, return apply_r_larch_pcala(mod, location, got, rela_stack, rela_stack_top, type); } +static int apply_r_larch_32_pcrel(struct module *mod, u32 *location, Elf_Addr v, + s64 *rela_stack, size_t *rela_stack_top, unsigned int type) +{ + ptrdiff_t offset = (void *)v - (void *)location; + + *(u32 *)location = offset; + return 0; +} + /* * reloc_handlers_rela() - Apply a particular relocation to a module * @mod: the module to apply the reloc to @@ -404,6 +413,7 @@ static reloc_rela_handler reloc_rela_handlers[] = { [R_LARCH_B26] = apply_r_larch_b26, [R_LARCH_PCALA_HI20...R_LARCH_PCALA64_HI12] = apply_r_larch_pcala, [R_LARCH_GOT_PC_HI20...R_LARCH_GOT_PC_LO12] = apply_r_larch_got_pc, + [R_LARCH_32_PCREL] = apply_r_larch_32_pcrel, }; int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, -- 2.33.0

1 0

[PATCH OLK-5.10] io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
by Baokun Li 30 Oct '23

30 Oct '23

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v6.7 commit 7644b1a1c9a7ae8ab99175989bfc8676055edb46 category: bugfix bugzilla: 189322, https://gitee.com/src-openeuler/kernel/issues/I8BQSX CVE: CVE-2023-46862 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We could race with SQ thread exit, and if we do, we'll hit a NULL pointer dereference when the thread is cleared. Grab the SQPOLL data lock before attempting to get the task cpu and pid for fdinfo, this ensures we have a stable view of it. Cc: stable(a)vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=218032 Reviewed-by: Gabriel Krisman Bertazi <krisman(a)suse.de> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/io_uring.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- io_uring/io_uring.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 2e61a67938a7..3fa584b0ee0a 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -10180,7 +10180,7 @@ static int io_uring_show_cred(struct seq_file *m, unsigned int id, static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m) { - struct io_sq_data *sq = NULL; + int sq_pid = -1, sq_cpu = -1; bool has_lock; int i; @@ -10193,13 +10193,19 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m) has_lock = mutex_trylock(&ctx->uring_lock); if (has_lock && (ctx->flags & IORING_SETUP_SQPOLL)) { - sq = ctx->sq_data; - if (!sq->thread) - sq = NULL; + struct io_sq_data *sq = ctx->sq_data; + + if (mutex_trylock(&sq->lock)) { + if (sq->thread) { + sq_pid = task_pid_nr(sq->thread); + sq_cpu = task_cpu(sq->thread); + } + mutex_unlock(&sq->lock); + } } - seq_printf(m, "SqThread:\t%d\n", sq ? task_pid_nr(sq->thread) : -1); - seq_printf(m, "SqThreadCpu:\t%d\n", sq ? task_cpu(sq->thread) : -1); + seq_printf(m, "SqThread:\t%d\n", sq_pid); + seq_printf(m, "SqThreadCpu:\t%d\n", sq_cpu); seq_printf(m, "UserFiles:\t%u\n", ctx->nr_user_files); for (i = 0; has_lock && i < ctx->nr_user_files; i++) { struct file *f = io_file_from_index(ctx, i); -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS 0/4] bugfixes for CVE-2022-45884
by liwei 30 Oct '23

30 Oct '23

bugfixes for CVE-2022-45884 Hyunwoo Kim (1): media: dvb-core: Fix use-after-free due to race at dvb_register_device() Keita Suzuki (1): media: dvb-core: Fix double free in dvb_register_device() Lin Ma (2): media: dvbdev: adopts refcnt to avoid UAF media: dvbdev: fix refcnt bug drivers/media/dvb-core/dvb_ca_en50221.c | 2 +- drivers/media/dvb-core/dvb_frontend.c | 2 +- drivers/media/dvb-core/dvbdev.c | 122 ++++++++++++++++++------ include/media/dvbdev.h | 46 ++++++--- 4 files changed, 128 insertions(+), 44 deletions(-) -- 2.25.1

2 5

[openeuler 0/8] libhns: Support STARS over RDMA
by Chengchang Tang 30 Oct '23

30 Oct '23

STARS is a HW scheduler. These patches support hns RoCE working in STARS mode which means RoCE will be scheduled by STARS. Chengchang Tang (8): Update kernel headers for libhns query_device() libhns: Support query HW ID by hnsdv_query_device() Update kernel headers for supporting POE CQs libhns: Add support for POE CQs Update kernel headers for supporting STARS QP in HNS libhns: Support STARS mode QP Update kernel headers for supporting write with notify libhns: Support write with notify kernel-headers/rdma/hns-abi.h | 38 ++++++- providers/hns/hns_roce_u.c | 50 ++++++--- providers/hns/hns_roce_u.h | 1 + providers/hns/hns_roce_u_abi.h | 3 + providers/hns/hns_roce_u_hw_v2.c | 65 +++++++++-- providers/hns/hns_roce_u_hw_v2.h | 1 + providers/hns/hns_roce_u_verbs.c | 229 +++++++++++++++++++++++++++++++++++---- providers/hns/hnsdv.h | 50 +++++++++ providers/hns/libhns.map | 3 + 9 files changed, 393 insertions(+), 47 deletions(-) -- 2.9.5

1 8

[openeuler 0/6] RDMA/hns: Support STARS over RDMA
by Chengchang Tang 30 Oct '23

30 Oct '23

STARS is a HW scheduler. These patches support STARS taking over HNS RoCE. Chengchang Tang (6): RDMA/hns: Support query HW ID from user space. RDMA/hns: Fix print after query hw id failed. RDMA/hns: Support configuring POE channels and creating POE CQs RDMA/hns: Support STARS mode QP RDMA/hns: Support kernel ULP querying HW ID RDMA/hns: Support write with notify drivers/infiniband/hw/hns/Makefile | 3 +- drivers/infiniband/hw/hns/hns_roce_common.h | 3 + drivers/infiniband/hw/hns/hns_roce_cq.c | 114 +++++++++++++++++- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 111 ++++++++++++++++++ drivers/infiniband/hw/hns/hns_roce_device.h | 63 ++++++++++ drivers/infiniband/hw/hns/hns_roce_ext.c | 143 +++++++++++++++++++++++ drivers/infiniband/hw/hns/hns_roce_ext.h | 66 +++++++++++ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 169 +++++++++++++++++++++++++-- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 52 +++++++++ drivers/infiniband/hw/hns/hns_roce_main.c | 62 +++++++++- drivers/infiniband/hw/hns/hns_roce_poe.c | 97 +++++++++++++++ drivers/infiniband/hw/hns/hns_roce_qp.c | 62 +++++++++- include/uapi/rdma/hns-abi.h | 37 +++++- 13 files changed, 966 insertions(+), 16 deletions(-) create mode 100644 drivers/infiniband/hw/hns/hns_roce_ext.c create mode 100644 drivers/infiniband/hw/hns/hns_roce_ext.h create mode 100644 drivers/infiniband/hw/hns/hns_roce_poe.c -- 2.9.5

1 6

[PATCH OLK-5.10 v2 00/38] Add error handling for device_add_disk
by Zhong Jinghua 30 Oct '23

30 Oct '23

From: Zhong Jinghua <zhongjinghua(a)huaweicloud.com> Befor these paths, block is not know when drvier is add fail. Now, add error handling for drivers. Christoph Hellwig (14): block: fold register_disk into device_add_disk block: call blk_integrity_add earlier in device_add_disk block: add the events* attributes to disk_attrs block: fix error unwinding in device_add_disk block: clear ->slave_dir when dropping the main slave_dir reference block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Luis Chamberlain (11): block: return errors from blk_integrity_add block: return errors from disk_alloc_events block: add error handling for device_add_disk / add_disk block: fix device_add_disk() kobject_create_and_add() error handling loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sd: Add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Tetsuo Handa (1): block: check minor range in device_add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Yu Kuai (1): block: fix memory leak for elevator on add_disk failure Zhong Jinghua (9): block: return errors from blk_register_region block: Fix the kabi change in device_add_disk block: Fix the kabi change on blk_register_region block: call blk_get_queue earlier in __device_add_disk block: Fix minor range check in device_add_disk() block: Set memalloc_noio to false in the error path scsi: sd: Clean up sdkp if device_add_disk() failed mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup block/blk-integrity.c | 12 +- block/blk-mq.c | 19 +++ block/blk.h | 5 +- block/genhd.c | 286 ++++++++++++++++++++++++++------------- drivers/block/brd.c | 103 ++++++-------- drivers/block/loop.c | 26 ++-- drivers/block/nbd.c | 59 ++++---- drivers/mtd/ubi/block.c | 76 +++++------ drivers/nvme/host/core.c | 41 +++--- drivers/scsi/sd.c | 8 +- drivers/scsi/sr.c | 7 +- include/linux/blk-mq.h | 12 ++ include/linux/genhd.h | 36 +++++ 13 files changed, 417 insertions(+), 273 deletions(-) -- 2.31.1

1 38

[PATCH OLK-5.10 0/3] fix CVE-2023-46813
by Yu Liao 30 Oct '23

30 Oct '23

fix CVE-2023-46813 An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it. Borislav Petkov (AMD) (1): [Backport] x86/sev: Disable MMIO emulation from user mode Joerg Roedel (2): [Backport] x86/sev: Check IOBM for IOIO exceptions from user-space [Backport] x86/sev: Check for user-space IOIO pointing to kernel space arch/x86/boot/compressed/sev-es.c | 10 ++++++ arch/x86/kernel/sev-es-shared.c | 53 +++++++++++++++++++++++++------ arch/x86/kernel/sev-es.c | 30 +++++++++++++++++ 3 files changed, 84 insertions(+), 9 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 v2 00/38] Add error handling for device_add_disk
by Zhong Jinghua 30 Oct '23

30 Oct '23

From: Zhong Jinghua <zhongjinghua(a)huaweicloud.com> Befor these paths, block is not know when drvier is add fail. Now, add error handling for drivers. Christoph Hellwig (14): block: fold register_disk into device_add_disk block: call blk_integrity_add earlier in device_add_disk block: add the events* attributes to disk_attrs block: fix error unwinding in device_add_disk block: clear ->slave_dir when dropping the main slave_dir reference block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Luis Chamberlain (11): block: return errors from blk_integrity_add block: return errors from disk_alloc_events block: add error handling for device_add_disk / add_disk block: fix device_add_disk() kobject_create_and_add() error handling loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sd: Add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Tetsuo Handa (1): block: check minor range in device_add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Yu Kuai (1): block: fix memory leak for elevator on add_disk failure Zhong Jinghua (9): block: return errors from blk_register_region block: Fix the kabi change in device_add_disk block: Fix the kabi change on blk_register_region block: call blk_get_queue earlier in __device_add_disk block: Fix minor range check in device_add_disk() block: Set memalloc_noio to false in the error path scsi: sd: Clean up sdkp if device_add_disk() failed mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup block/blk-integrity.c | 12 +- block/blk-mq.c | 19 +++ block/blk.h | 5 +- block/genhd.c | 286 ++++++++++++++++++++++++++------------- drivers/block/brd.c | 103 ++++++-------- drivers/block/loop.c | 26 ++-- drivers/block/nbd.c | 59 ++++---- drivers/mtd/ubi/block.c | 76 +++++------ drivers/nvme/host/core.c | 41 +++--- drivers/scsi/sd.c | 8 +- drivers/scsi/sr.c | 7 +- include/linux/blk-mq.h | 12 ++ include/linux/genhd.h | 36 +++++ 13 files changed, 417 insertions(+), 273 deletions(-) -- 2.31.1

2 39

[openEuler-1.0-LTS 00/15] Fix the UAF when task fails.
by Zhong Jinghua 30 Oct '23

30 Oct '23

The NetLlink mechanism is used to send unreliable notifications when a task fails. Bharath Ravi (1): scsi: iscsi: Perform connection failure entirely in kernel space Gabriel Krisman Bertazi (2): scsi: iscsi: Report connection state in sysfs scsi: iscsi: Fix deadlock on recovery path during GFP_IO reclaim Gulam Mohamed (1): scsi: iscsi: Fix race condition between login and sync thread Mike Christie (10): scsi: iscsi: Fix iSCSI cls conn state scsi: iscsi: Force immediate failure during shutdown scsi: iscsi: Rel ref after iscsi_lookup_endpoint() scsi: iscsi: Fix in-kernel conn failure handling scsi: iscsi: Fix set_param() handling scsi: iscsi: Move iscsi_ep_disconnect() scsi: iscsi: Fix offload conn cleanup when iscsid restarts scsi: iscsi: Fix conn cleanup and stop race during iscsid restart scsi: iscsi: Fix endpoint reuse regression scsi: iscsi: Fix unbound endpoint error handling Zhong Jinghua (1): scsi: iscsi: Fix kabi change in iscsi_cls_conn drivers/infiniband/ulp/iser/iscsi_iser.c | 1 + drivers/scsi/be2iscsi/be_iscsi.c | 19 +- drivers/scsi/bnx2i/bnx2i_iscsi.c | 23 +- drivers/scsi/cxgbi/libcxgbi.c | 12 +- drivers/scsi/libiscsi.c | 21 +- drivers/scsi/qedi/qedi_iscsi.c | 25 +- drivers/scsi/qla4xxx/ql4_os.c | 1 + drivers/scsi/scsi_transport_iscsi.c | 487 ++++++++++++++++++----- include/scsi/scsi_transport_iscsi.h | 28 ++ 9 files changed, 485 insertions(+), 132 deletions(-) -- 2.31.1

1 15

[PATCH OLK-5.10] net: xfrm: Fix xfrm_address_filter OOB read
by Dong Chenchen 30 Oct '23

30 Oct '23

From: Lin Ma <linma(a)zju.edu.cn> stable inclusion from stable-v5.10.192 commit 7e50815d29037e08d3d26f3ebc41bcec729847b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I85DZ6 CVE: CVE-2023-39194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dfa73c17d55b921e1d4e154976de35317e43a93a ] We found below OOB crash: [ 44.211730] ================================================================== [ 44.212045] BUG: KASAN: slab-out-of-bounds in memcmp+0x8b/0xb0 [ 44.212045] Read of size 8 at addr ffff88800870f320 by task poc.xfrm/97 [ 44.212045] [ 44.212045] CPU: 0 PID: 97 Comm: poc.xfrm Not tainted 6.4.0-rc7-00072-gdad9774deaf1-dirty #4 [ 44.212045] Call Trace: [ 44.212045] <TASK> [ 44.212045] dump_stack_lvl+0x37/0x50 [ 44.212045] print_report+0xcc/0x620 [ 44.212045] ? __virt_addr_valid+0xf3/0x170 [ 44.212045] ? memcmp+0x8b/0xb0 [ 44.212045] kasan_report+0xb2/0xe0 [ 44.212045] ? memcmp+0x8b/0xb0 [ 44.212045] kasan_check_range+0x39/0x1c0 [ 44.212045] memcmp+0x8b/0xb0 [ 44.212045] xfrm_state_walk+0x21c/0x420 [ 44.212045] ? __pfx_dump_one_state+0x10/0x10 [ 44.212045] xfrm_dump_sa+0x1e2/0x290 [ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 44.212045] ? __kernel_text_address+0xd/0x40 [ 44.212045] ? kasan_unpoison+0x27/0x60 [ 44.212045] ? mutex_lock+0x60/0xe0 [ 44.212045] ? __pfx_mutex_lock+0x10/0x10 [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] netlink_dump+0x322/0x6c0 [ 44.212045] ? __pfx_netlink_dump+0x10/0x10 [ 44.212045] ? mutex_unlock+0x7f/0xd0 [ 44.212045] ? __pfx_mutex_unlock+0x10/0x10 [ 44.212045] __netlink_dump_start+0x353/0x430 [ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410 [ 44.212045] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 44.212045] ? __pfx_xfrm_dump_sa_done+0x10/0x10 [ 44.212045] ? __stack_depot_save+0x382/0x4e0 [ 44.212045] ? filter_irq_stacks+0x1c/0x70 [ 44.212045] ? kasan_save_stack+0x32/0x50 [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] ? kasan_set_track+0x25/0x30 [ 44.212045] ? __kasan_slab_alloc+0x59/0x70 [ 44.212045] ? kmem_cache_alloc_node+0xf7/0x260 [ 44.212045] ? kmalloc_reserve+0xab/0x120 [ 44.212045] ? __alloc_skb+0xcf/0x210 [ 44.212045] ? netlink_sendmsg+0x509/0x700 [ 44.212045] ? sock_sendmsg+0xde/0xe0 [ 44.212045] ? __sys_sendto+0x18d/0x230 [ 44.212045] ? __x64_sys_sendto+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? netlink_sendmsg+0x509/0x700 [ 44.212045] ? sock_sendmsg+0xde/0xe0 [ 44.212045] ? __sys_sendto+0x18d/0x230 [ 44.212045] ? __x64_sys_sendto+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] ? kasan_set_track+0x25/0x30 [ 44.212045] ? kasan_save_free_info+0x2e/0x50 [ 44.212045] ? __kasan_slab_free+0x10a/0x190 [ 44.212045] ? kmem_cache_free+0x9c/0x340 [ 44.212045] ? netlink_recvmsg+0x23c/0x660 [ 44.212045] ? sock_recvmsg+0xeb/0xf0 [ 44.212045] ? __sys_recvfrom+0x13c/0x1f0 [ 44.212045] ? __x64_sys_recvfrom+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? copyout+0x3e/0x50 [ 44.212045] netlink_rcv_skb+0xd6/0x210 [ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 44.212045] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 44.212045] ? __pfx_sock_has_perm+0x10/0x10 [ 44.212045] ? mutex_lock+0x8d/0xe0 [ 44.212045] ? __pfx_mutex_lock+0x10/0x10 [ 44.212045] xfrm_netlink_rcv+0x44/0x50 [ 44.212045] netlink_unicast+0x36f/0x4c0 [ 44.212045] ? __pfx_netlink_unicast+0x10/0x10 [ 44.212045] ? netlink_recvmsg+0x500/0x660 [ 44.212045] netlink_sendmsg+0x3b7/0x700 [ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.212045] sock_sendmsg+0xde/0xe0 [ 44.212045] __sys_sendto+0x18d/0x230 [ 44.212045] ? __pfx___sys_sendto+0x10/0x10 [ 44.212045] ? rcu_core+0x44a/0xe10 [ 44.212045] ? __rseq_handle_notify_resume+0x45b/0x740 [ 44.212045] ? _raw_spin_lock_irq+0x81/0xe0 [ 44.212045] ? __pfx___rseq_handle_notify_resume+0x10/0x10 [ 44.212045] ? __pfx_restore_fpregs_from_fpstate+0x10/0x10 [ 44.212045] ? __pfx_blkcg_maybe_throttle_current+0x10/0x10 [ 44.212045] ? __pfx_task_work_run+0x10/0x10 [ 44.212045] __x64_sys_sendto+0x71/0x90 [ 44.212045] do_syscall_64+0x3f/0x90 [ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] RIP: 0033:0x44b7da [ 44.212045] RSP: 002b:00007ffdc8838548 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 44.212045] RAX: ffffffffffffffda RBX: 00007ffdc8839978 RCX: 000000000044b7da [ 44.212045] RDX: 0000000000000038 RSI: 00007ffdc8838770 RDI: 0000000000000003 [ 44.212045] RBP: 00007ffdc88385b0 R08: 00007ffdc883858c R09: 000000000000000c [ 44.212045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 44.212045] R13: 00007ffdc8839968 R14: 00000000004c37d0 R15: 0000000000000001 [ 44.212045] </TASK> [ 44.212045] [ 44.212045] Allocated by task 97: [ 44.212045] kasan_save_stack+0x22/0x50 [ 44.212045] kasan_set_track+0x25/0x30 [ 44.212045] __kasan_kmalloc+0x7f/0x90 [ 44.212045] __kmalloc_node_track_caller+0x5b/0x140 [ 44.212045] kmemdup+0x21/0x50 [ 44.212045] xfrm_dump_sa+0x17d/0x290 [ 44.212045] netlink_dump+0x322/0x6c0 [ 44.212045] __netlink_dump_start+0x353/0x430 [ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410 [ 44.212045] netlink_rcv_skb+0xd6/0x210 [ 44.212045] xfrm_netlink_rcv+0x44/0x50 [ 44.212045] netlink_unicast+0x36f/0x4c0 [ 44.212045] netlink_sendmsg+0x3b7/0x700 [ 44.212045] sock_sendmsg+0xde/0xe0 [ 44.212045] __sys_sendto+0x18d/0x230 [ 44.212045] __x64_sys_sendto+0x71/0x90 [ 44.212045] do_syscall_64+0x3f/0x90 [ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] [ 44.212045] The buggy address belongs to the object at ffff88800870f300 [ 44.212045] which belongs to the cache kmalloc-64 of size 64 [ 44.212045] The buggy address is located 32 bytes inside of [ 44.212045] allocated 36-byte region [ffff88800870f300, ffff88800870f324) [ 44.212045] [ 44.212045] The buggy address belongs to the physical page: [ 44.212045] page:00000000e4de16ee refcount:1 mapcount:0 mapping:000000000 ... [ 44.212045] flags: 0x100000000000200(slab|node=0|zone=1) [ 44.212045] page_type: 0xffffffff() [ 44.212045] raw: 0100000000000200 ffff888004c41640 dead000000000122 0000000000000000 [ 44.212045] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 44.212045] page dumped because: kasan: bad access detected [ 44.212045] [ 44.212045] Memory state around the buggy address: [ 44.212045] ffff88800870f200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 44.212045] ffff88800870f280: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] >ffff88800870f300: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ^ [ 44.212045] ffff88800870f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ffff88800870f400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ================================================================== By investigating the code, we find the root cause of this OOB is the lack of checks in xfrm_dump_sa(). The buggy code allows a malicious user to pass arbitrary value of filter->splen/dplen. Hence, with crafted xfrm states, the attacker can achieve 8 bytes heap OOB read, which causes info leak. if (attrs[XFRMA_ADDRESS_FILTER]) { filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]), sizeof(*filter), GFP_KERNEL); if (filter == NULL) return -ENOMEM; // NO MORE CHECKS HERE !!! } This patch fixes the OOB by adding necessary boundary checks, just like the code in pfkey_dump() function. Fixes: d3623099d350 ("ipsec: add support of limited SA dump") Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/xfrm/xfrm_user.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 138f71c67969..9956acbaffcc 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1049,6 +1049,15 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb) sizeof(*filter), GFP_KERNEL); if (filter == NULL) return -ENOMEM; + + /* see addr_match(), (prefix length >> 5) << 2 + * will be used to compare xfrm_address_t + */ + if (filter->splen > (sizeof(xfrm_address_t) << 3) || + filter->dplen > (sizeof(xfrm_address_t) << 3)) { + kfree(filter); + return -EINVAL; + } } if (attrs[XFRMA_PROTO]) -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS v2 00/16] arm64: fix a concurrency issue in emulation_proc_handler()
by Jinjie Ruan 30 Oct '23

30 Oct '23

In linux-6.1, the related code is refactored in commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") and this issue was incidentally fixed. This patch set try to adapt the refactoring stable 5.10 patches to solve the problem of repeated addition of linked lists described below. How to reproduce: CONFIG_ARMV8_DEPRECATED=y, CONFIG_SWP_EMULATION=y, and CONFIG_DEBUG_LIST=y, then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 1 > /proc/sys/abi/swp done or "echo 1 > /proc/sys/abi/swp" and then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 0 > /proc/sys/abi/swp done In emulation_proc_handler(), read and write operations are performed on insn->current_mode. In the concurrency scenario, mutex only protects writing insn->current_mode, and not protects the read. Suppose there are two concurrent tasks, task1 updates insn->current_mode to INSN_EMULATE in the critical section, the prev_mode of task2 is still the old data INSN_UNDEF of insn->current_mode. As a result, two tasks call update_insn_emulation_mode twice with prev_mode = INSN_UNDEF and current_mode = INSN_EMULATE, then call register_emulation_hooks twice, resulting in a list_add double problem. commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") remove the dynamic registration and unregistration so remove the register_undef_hook() function, so the below problem was incidentally fixed. Call trace: __list_add_valid+0xd8/0xe4 register_undef_hook+0x94/0x13c update_insn_emulation_mode+0xd0/0x12c emulation_proc_handler+0xd8/0xf4 proc_sys_call_handler+0x140/0x250 proc_sys_write+0x1c/0x2c new_sync_write+0xec/0x18c vfs_write+0x214/0x2ac ksys_write+0x70/0xfc __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Call trace: __list_del_entry_valid+0xac/0x110 unregister_undef_hook+0x34/0x80 update_insn_emulation_mode+0xf0/0x180 emulation_proc_handler+0x8c/0xd8 proc_sys_call_handler+0x1d8/0x208 proc_sys_write+0x14/0x20 new_sync_write+0xf0/0x190 vfs_write+0x304/0x388 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 el0_svc_common.constprop.4+0x68/0x188 do_el0_svc+0x24/0xa0 el0_svc+0x14/0x20 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 The first patch is the self-developed patch, so revert it. The next 5 patches is a patch set which provides context for subsequent refactoring 9 patches, especially commit 0f2cb928a154 ("arm64: consistently pass ESR_ELx to die()") which modify do_undefinstr() to add a ESR_ELx value arg, and then commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") splits do_undefinstr() handler into separate do_el0_undef() and do_el1_undef() handlers. The 9 patches after that is another refactoring patch set, which is in preparation for the main rework commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling"). To remove struct undef_hook, commit bff8f413c71f ("arm64: factor out EL1 SSBS emulation hook") factor out EL1 SSBS emulation hook, which also avoid call call_undef_hook() in do_el1_undef(), commit f5962add74b6 ("arm64: rework EL0 MRS emulation") factor out EL0 MRS emulation hook, which also prepare for replacing call_undef_hook() in do_el0_undef(). To replace call_undef_hook() function, commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") split the do_undefinstr() into do_el0_undef() and do_el1_undef() functions, and commit dbfbd87efa79 ("arm64: factor insn read out of call_undef_hook()") factor user_insn_read() from call_undef_hook() so the main rework patch can replace the call_undef_hook() in do_el0_undef(). The last patch is a bugfix for the main rework patch. Fixes: af483947d472 ("arm64: fix oops in concurrently setting insn_emulation sysctls") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Jinjie Ruan (1): Revert "arm64: fix a concurrency issue in emulation_proc_handler()" Mark Rutland (14): arm64: report EL1 UNDEFs better arm64: die(): pass 'err' as long arm64: consistently pass ESR_ELx to die() arm64: rework FPAC exception handling arm64: rework BTI exception handling arm64: allow kprobes on EL0 handlers arm64: split EL0/EL1 UNDEF handlers arm64: factor out EL1 SSBS emulation hook arm64: factor insn read out of call_undef_hook() arm64: rework EL0 MRS emulation arm64: armv8_deprecated: fold ops into insn_emulation arm64: armv8_deprecated move emulation functions arm64: armv8_deprecated: move aarch32 helper earlier arm64: armv8_deprecated: rework deprected instruction handling Ren Zhijie (1): arm64: armv8_deprecated: fix unused-function error arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 574 +++++++++++++-------------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 +++--- 10 files changed, 396 insertions(+), 427 deletions(-) -- 2.34.1

2 17

[PATCH openEuler-22.03-LTS-SP1 00/15] arm64: fix a concurrency issue in emulation_proc_handler()
by Jinjie Ruan 30 Oct '23

30 Oct '23

In linux-6.1, the related code is refactored in commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") and this issue was incidentally fixed. This patch set try to adapt the refactoring stable 5.10 patches to solve the problem of repeated addition of linked lists described below. How to reproduce: CONFIG_ARMV8_DEPRECATED=y, CONFIG_SWP_EMULATION=y, and CONFIG_DEBUG_LIST=y, then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 1 > /proc/sys/abi/swp done or "echo 1 > /proc/sys/abi/swp" and then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 0 > /proc/sys/abi/swp done In emulation_proc_handler(), read and write operations are performed on insn->current_mode. In the concurrency scenario, mutex only protects writing insn->current_mode, and not protects the read. Suppose there are two concurrent tasks, task1 updates insn->current_mode to INSN_EMULATE in the critical section, the prev_mode of task2 is still the old data INSN_UNDEF of insn->current_mode. As a result, two tasks call update_insn_emulation_mode twice with prev_mode = INSN_UNDEF and current_mode = INSN_EMULATE, then call register_emulation_hooks twice, resulting in a list_add double problem. commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") remove the dynamic registration and unregistration so remove the register_undef_hook() function, so the below problem was incidentally fixed. Call trace: __list_add_valid+0xd8/0xe4 register_undef_hook+0x94/0x13c update_insn_emulation_mode+0xd0/0x12c emulation_proc_handler+0xd8/0xf4 proc_sys_call_handler+0x140/0x250 proc_sys_write+0x1c/0x2c new_sync_write+0xec/0x18c vfs_write+0x214/0x2ac ksys_write+0x70/0xfc __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Call trace: __list_del_entry_valid+0xac/0x110 unregister_undef_hook+0x34/0x80 update_insn_emulation_mode+0xf0/0x180 emulation_proc_handler+0x8c/0xd8 proc_sys_call_handler+0x1d8/0x208 proc_sys_write+0x14/0x20 new_sync_write+0xf0/0x190 vfs_write+0x304/0x388 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 el0_svc_common.constprop.4+0x68/0x188 do_el0_svc+0x24/0xa0 el0_svc+0x14/0x20 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 The first patch is the self-developed patch, so revert it. The next 4 patches is a patch set which provides context for subsequent refactoring 9 patches, especially commit 0f2cb928a154 ("arm64: consistently pass ESR_ELx to die()") which modify do_undefinstr() to add a ESR_ELx value arg, and then commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") splits do_undefinstr() handler into separate do_el0_undef() and do_el1_undef() handlers. The 9 patches after that is another refactoring patch set, which is in preparation for the main rework commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling"). To remove struct undef_hook, commit bff8f413c71f ("arm64: factor out EL1 SSBS emulation hook") factor out EL1 SSBS emulation hook, which also avoid call call_undef_hook() in do_el1_undef(), commit f5962add74b6 ("arm64: rework EL0 MRS emulation") factor out EL0 MRS emulation hook, which also prepare for replacing call_undef_hook() in do_el0_undef(). To replace call_undef_hook() function, commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") split the do_undefinstr() into do_el0_undef() and do_el1_undef() functions, and commit dbfbd87efa79 ("arm64: factor insn read out of call_undef_hook()") factor user_insn_read() from call_undef_hook() so the main rework patch can replace the call_undef_hook() in do_el0_undef(). The last patch is a bugfix for the main rework patch. Fixes: af483947d472 ("arm64: fix oops in concurrently setting insn_emulation sysctls") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Jinjie Ruan (1): Revert "arm64: fix a concurrency issue in emulation_proc_handler()" Mark Rutland (13): arm64: die(): pass 'err' as long arm64: consistently pass ESR_ELx to die() arm64: rework FPAC exception handling arm64: rework BTI exception handling arm64: allow kprobes on EL0 handlers arm64: split EL0/EL1 UNDEF handlers arm64: factor out EL1 SSBS emulation hook arm64: factor insn read out of call_undef_hook() arm64: rework EL0 MRS emulation arm64: armv8_deprecated: fold ops into insn_emulation arm64: armv8_deprecated move emulation functions arm64: armv8_deprecated: move aarch32 helper earlier arm64: armv8_deprecated: rework deprected instruction handling Ren Zhijie (1): arm64: armv8_deprecated: fix unused-function error arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 574 +++++++++++++-------------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 +++--- 10 files changed, 395 insertions(+), 428 deletions(-) -- 2.34.1

2 16

[PATCH openEuler-22.03-LTS 00/16] arm64: fix a concurrency issue in emulation_proc_handler()
by Jinjie Ruan 30 Oct '23

30 Oct '23

In linux-6.1, the related code is refactored in commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") and this issue was incidentally fixed. This patch set try to adapt the refactoring stable 5.10 patches to solve the problem of repeated addition of linked lists described below. How to reproduce: CONFIG_ARMV8_DEPRECATED=y, CONFIG_SWP_EMULATION=y, and CONFIG_DEBUG_LIST=y, then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 1 > /proc/sys/abi/swp done or "echo 1 > /proc/sys/abi/swp" and then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 0 > /proc/sys/abi/swp done In emulation_proc_handler(), read and write operations are performed on insn->current_mode. In the concurrency scenario, mutex only protects writing insn->current_mode, and not protects the read. Suppose there are two concurrent tasks, task1 updates insn->current_mode to INSN_EMULATE in the critical section, the prev_mode of task2 is still the old data INSN_UNDEF of insn->current_mode. As a result, two tasks call update_insn_emulation_mode twice with prev_mode = INSN_UNDEF and current_mode = INSN_EMULATE, then call register_emulation_hooks twice, resulting in a list_add double problem. commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") remove the dynamic registration and unregistration so remove the register_undef_hook() function, so the below problem was incidentally fixed. Call trace: __list_add_valid+0xd8/0xe4 register_undef_hook+0x94/0x13c update_insn_emulation_mode+0xd0/0x12c emulation_proc_handler+0xd8/0xf4 proc_sys_call_handler+0x140/0x250 proc_sys_write+0x1c/0x2c new_sync_write+0xec/0x18c vfs_write+0x214/0x2ac ksys_write+0x70/0xfc __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Call trace: __list_del_entry_valid+0xac/0x110 unregister_undef_hook+0x34/0x80 update_insn_emulation_mode+0xf0/0x180 emulation_proc_handler+0x8c/0xd8 proc_sys_call_handler+0x1d8/0x208 proc_sys_write+0x14/0x20 new_sync_write+0xf0/0x190 vfs_write+0x304/0x388 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 el0_svc_common.constprop.4+0x68/0x188 do_el0_svc+0x24/0xa0 el0_svc+0x14/0x20 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 The first patch is the self-developed patch, so revert it. The next 5 patches is a patch set which provides context for subsequent refactoring 9 patches, especially commit 0f2cb928a154 ("arm64: consistently pass ESR_ELx to die()") which modify do_undefinstr() to add a ESR_ELx value arg, and then commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") splits do_undefinstr() handler into separate do_el0_undef() and do_el1_undef() handlers. The 9 patches after that is another refactoring patch set, which is in preparation for the main rework commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling"). To remove struct undef_hook, commit bff8f413c71f ("arm64: factor out EL1 SSBS emulation hook") factor out EL1 SSBS emulation hook, which also avoid call call_undef_hook() in do_el1_undef(), commit f5962add74b6 ("arm64: rework EL0 MRS emulation") factor out EL0 MRS emulation hook, which also prepare for replacing call_undef_hook() in do_el0_undef(). To replace call_undef_hook() function, commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") split the do_undefinstr() into do_el0_undef() and do_el1_undef() functions, and commit dbfbd87efa79 ("arm64: factor insn read out of call_undef_hook()") factor user_insn_read() from call_undef_hook() so the main rework patch can replace the call_undef_hook() in do_el0_undef(). The last patch is a bugfix for the main rework patch. Fixes: af483947d472 ("arm64: fix oops in concurrently setting insn_emulation sysctls") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Jinjie Ruan (1): Revert "arm64: fix a concurrency issue in emulation_proc_handler()" Mark Rutland (14): arm64: report EL1 UNDEFs better arm64: die(): pass 'err' as long arm64: consistently pass ESR_ELx to die() arm64: rework FPAC exception handling arm64: rework BTI exception handling arm64: allow kprobes on EL0 handlers arm64: split EL0/EL1 UNDEF handlers arm64: factor out EL1 SSBS emulation hook arm64: factor insn read out of call_undef_hook() arm64: rework EL0 MRS emulation arm64: armv8_deprecated: fold ops into insn_emulation arm64: armv8_deprecated move emulation functions arm64: armv8_deprecated: move aarch32 helper earlier arm64: armv8_deprecated: rework deprected instruction handling Ren Zhijie (1): arm64: armv8_deprecated: fix unused-function error arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 574 +++++++++++++-------------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 +++--- 10 files changed, 396 insertions(+), 427 deletions(-) -- 2.34.1

2 17

[PATCH OLK-5.10 0/3] Synchronize mainline hisilicon uncore pmu driver bugfix to openEuler-OLK-5.10
by Junhao He 28 Oct '23

28 Oct '23

Synchronize mainline hisilicon uncore pmu driver bugfix to openEuler-OLK-5.10 This patchset includes 2 minor updates for the hisi_pcie_pmu: - fix issue that we may touch others events in some case - modify the event->cpu only on the success pmu::event_init() - dix use-after-free when register hisilicon ddrc pmu fails Junhao He (1): perf: hisi: Fix use-after-free when register pmu fails Yicong Yang (2): drivers/perf: hisi_pcie: Check the type first in pmu::event_init() drivers/perf: hisi_pcie: Initialize event->cpu only on success drivers/perf/hisilicon/hisi_pcie_pmu.c | 9 +++++---- drivers/perf/hisilicon/hisi_uncore_pa_pmu.c | 4 ++-- drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c | 4 ++-- 3 files changed, 9 insertions(+), 8 deletions(-) -- 2.33.0

2 4

[PATCH OLK-5.10 0/7] coresight: trbe: Enable ACPI based devices
by Junhao He 28 Oct '23

28 Oct '23

This series enables detection of ACPI based TRBE devices via a stand alone purpose built representative platform device. But as a pre-requisite this changes coresight_platform_data structure assignment for the TRBE device. | commit from OLK-5.10 | patch | Conflict or Not | description | | --------------- | ------------ | --------------- | ------------ | | 003e440c95a0 | coresight: trbe: Enable ACPI based TRBE devices | No | | | c64a976a27cd | coresight: trbe: Add a representative coresight_platform_data for TRBE | No | | | eb630e5b2a47 | arm_pmu: acpi: Add a representative platform device for TRBE | Yes | Resolve code conflicts without changing functions | | a25b79f824ec | arm_pmu: acpi: Refactor arm_spe_acpi_register_device() | No | | | 54c422019d57 | Revert "coresight: Return the pointer of @pdata when not "fwnode"" | No | mainline`s patch "c64a976a27cd" fixes the issue | | 7e4acd18f0d0 | Revert "arm64/trbe: Add initial MADT/SPE probing" | No | mainline`s patch "eb630e5b2a47" adds ARM TRBE device support | | fbdfedf671b9 | Revert "coresight: trbe: Enable ACPI/Platform automatic module loading" | No | mainline`s patch "003e440c95a0" adds ARM TRBE ACPI support | Anshuman Khandual (4): arm_pmu: acpi: Refactor arm_spe_acpi_register_device() arm_pmu: acpi: Add a representative platform device for TRBE coresight: trbe: Add a representative coresight_platform_data for TRBE coresight: trbe: Enable ACPI based TRBE devices Junhao He (3): Revert "coresight: trbe: Enable ACPI/Platform automatic module loading" Revert "arm64/trbe: Add initial MADT/SPE probing" Revert "coresight: Return the pointer of @pdata when not "fwnode"" arch/arm64/configs/openeuler_defconfig | 1 - arch/arm64/kernel/Makefile | 1 - arch/arm64/kernel/acpi_trbe.c | 81 ----------- drivers/hwtracing/coresight/Kconfig | 4 - .../hwtracing/coresight/coresight-platform.c | 6 +- drivers/hwtracing/coresight/coresight-trbe.c | 26 +++- drivers/hwtracing/coresight/coresight-trbe.h | 2 + drivers/perf/arm_pmu_acpi.c | 137 +++++++++++++----- include/linux/coresight.h | 2 - include/linux/perf/arm_pmu.h | 1 + 10 files changed, 123 insertions(+), 138 deletions(-) delete mode 100644 arch/arm64/kernel/acpi_trbe.c -- 2.33.0

2 8

[PATCH OLK-5.10 v3 00/15] arm64: fix a concurrency issue in emulation_proc_handler()
by Jinjie Ruan 28 Oct '23

28 Oct '23

In linux-6.1, the related code is refactored in commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") and this issue was incidentally fixed. This patch set try to adapt the refactoring stable 5.10 patches to solve the problem of repeated addition of linked lists described below. How to reproduce: CONFIG_ARMV8_DEPRECATED=y, CONFIG_SWP_EMULATION=y, and CONFIG_DEBUG_LIST=y, then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 1 > /proc/sys/abi/swp done or "echo 1 > /proc/sys/abi/swp" and then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 0 > /proc/sys/abi/swp done In emulation_proc_handler(), read and write operations are performed on insn->current_mode. In the concurrency scenario, mutex only protects writing insn->current_mode, and not protects the read. Suppose there are two concurrent tasks, task1 updates insn->current_mode to INSN_EMULATE in the critical section, the prev_mode of task2 is still the old data INSN_UNDEF of insn->current_mode. As a result, two tasks call update_insn_emulation_mode twice with prev_mode = INSN_UNDEF and current_mode = INSN_EMULATE, then call register_emulation_hooks twice, resulting in a list_add double problem. commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") remove the dynamic registration and unregistration so remove the register_undef_hook() function, so the below problem was incidentally fixed. Call trace: __list_add_valid+0xd8/0xe4 register_undef_hook+0x94/0x13c update_insn_emulation_mode+0xd0/0x12c emulation_proc_handler+0xd8/0xf4 proc_sys_call_handler+0x140/0x250 proc_sys_write+0x1c/0x2c new_sync_write+0xec/0x18c vfs_write+0x214/0x2ac ksys_write+0x70/0xfc __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Call trace: __list_del_entry_valid+0xac/0x110 unregister_undef_hook+0x34/0x80 update_insn_emulation_mode+0xf0/0x180 emulation_proc_handler+0x8c/0xd8 proc_sys_call_handler+0x1d8/0x208 proc_sys_write+0x14/0x20 new_sync_write+0xf0/0x190 vfs_write+0x304/0x388 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 el0_svc_common.constprop.4+0x68/0x188 do_el0_svc+0x24/0xa0 el0_svc+0x14/0x20 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 The first patch is the self-developed patch, so revert it. The next 4 patches is a patch set which provides context for subsequent refactoring 9 patches, especially commit 0f2cb928a154 ("arm64: consistently pass ESR_ELx to die()") which modify do_undefinstr() to add a ESR_ELx value arg, and then commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") splits do_undefinstr() handler into separate do_el0_undef() and do_el1_undef() handlers. The 9 patches after that is another refactoring patch set, which is in preparation for the main rework commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling"). To remove struct undef_hook, commit bff8f413c71f ("arm64: factor out EL1 SSBS emulation hook") factor out EL1 SSBS emulation hook, which also avoid call call_undef_hook() in do_el1_undef(), commit f5962add74b6 ("arm64: rework EL0 MRS emulation") factor out EL0 MRS emulation hook, which also prepare for replacing call_undef_hook() in do_el0_undef(). To replace call_undef_hook() function, commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") split the do_undefinstr() into do_el0_undef() and do_el1_undef() functions, and commit dbfbd87efa79 ("arm64: factor insn read out of call_undef_hook()") factor user_insn_read() from call_undef_hook() so the main rework patch can replace the call_undef_hook() in do_el0_undef(). The last patch is a bugfix for the main rework patch. I've tested this with userspace programs which use each of the deprecated instructions on Raspberry Pi 4B KVM/Qemu, and I've concurrently modified the support level for each of the features back-and-forth between HW and emulated to check that there are no oops or above repeated addition or deletion call trace. Changes in v3: - Add conflicts message. Fixes: af483947d472 ("arm64: fix oops in concurrently setting insn_emulation sysctls") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Jinjie Ruan (1): Revert "arm64: fix a concurrency issue in emulation_proc_handler()" Mark Rutland (13): arm64: die(): pass 'err' as long arm64: consistently pass ESR_ELx to die() arm64: rework FPAC exception handling arm64: rework BTI exception handling arm64: allow kprobes on EL0 handlers arm64: split EL0/EL1 UNDEF handlers arm64: factor out EL1 SSBS emulation hook arm64: factor insn read out of call_undef_hook() arm64: rework EL0 MRS emulation arm64: armv8_deprecated: fold ops into insn_emulation arm64: armv8_deprecated move emulation functions arm64: armv8_deprecated: move aarch32 helper earlier arm64: armv8_deprecated: rework deprected instruction handling Ren Zhijie (1): arm64: armv8_deprecated: fix unused-function error arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 574 +++++++++++++-------------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 +++--- 10 files changed, 395 insertions(+), 428 deletions(-) -- 2.34.1

2 16

[PATCH openEuler-1.0-LTS] sched/membarrier: fix missing local execution of ipi_sync_rq_state()
by Xia Fukun 28 Oct '23

28 Oct '23

From: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> mainline inclusion from mainline-v6.5-rc7 commit ce29ddc47b91f97e7f69a0fb7cbb5845f52a9825 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BN94 CVE: NA -------------------------------- The function sync_runqueues_membarrier_state() should copy the membarrier state from the @mm received as parameter to each runqueue currently running tasks using that mm. However, the use of smp_call_function_many() skips the current runqueue, which is unintended. Replace by a call to on_each_cpu_mask(). Fixes: 227a4aadc75b ("sched/membarrier: Fix p->mm->membarrier_state racy load") Reported-by: Nadav Amit <nadav.amit(a)gmail.com> Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Cc: stable(a)vger.kernel.org # 5.4.x+ Link: https://lore.kernel.org/r/74F1E842-4A84-47BF-B6C2-5407DFDD4A4A@gmail.com Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/sched/membarrier.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c index 8c4e14e6544a..1757074be994 100644 --- a/kernel/sched/membarrier.c +++ b/kernel/sched/membarrier.c @@ -255,9 +255,7 @@ static int sync_runqueues_membarrier_state(struct mm_struct *mm) } rcu_read_unlock(); - preempt_disable(); - smp_call_function_many(tmpmask, ipi_sync_rq_state, mm, 1); - preempt_enable(); + on_each_cpu_mask(tmpmask, ipi_sync_rq_state, mm, true); free_cpumask_var(tmpmask); cpus_read_unlock(); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] sched/cpuacct: Fix charge cpuacct.usage_sys
by Xia Fukun 28 Oct '23

28 Oct '23

From: Muchun Song <songmuchun(a)bytedance.com> mainline inclusion from mainline-v6.5-rc7 commit dbe9337109c2705f08e6a00392f991eb2d2570a5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BN4B CVE: NA -------------------------------- The user_mode(task_pt_regs(tsk)) always return true for user thread, and false for kernel thread. So it means that the cpuacct.usage_sys is the time that kernel thread uses not the time that thread uses in the kernel mode. We can try get_irq_regs() first, if it is NULL, then we can fall back to task_pt_regs(). Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20200420070453.76815-1-songmuchun@bytedance.com Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/sched/cpuacct.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c index 9fbb10383434..254a60c99435 100644 --- a/kernel/sched/cpuacct.c +++ b/kernel/sched/cpuacct.c @@ -5,6 +5,7 @@ * Based on the work by Paul Menage (menage(a)google.com) and Balbir Singh * (balbir(a)in.ibm.com) */ +#include <asm/irq_regs.h> #include "sched.h" /* Time spent by the tasks of the CPU accounting group executing in ... */ @@ -339,7 +340,7 @@ void cpuacct_charge(struct task_struct *tsk, u64 cputime) { struct cpuacct *ca; int index = CPUACCT_STAT_SYSTEM; - struct pt_regs *regs = task_pt_regs(tsk); + struct pt_regs *regs = get_irq_regs() ? : task_pt_regs(tsk); if (regs && user_mode(regs)) index = CPUACCT_STAT_USER; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail
by Wenyu Huang 28 Oct '23

28 Oct '23

From: Kaitao Cheng <pilgrimtao(a)gmail.com> stable inclusion from stable-4.19 commit 50f9ad607ea891a9308e67b81f774c71736d1098 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BAW8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In the function, if register_trace_sched_migrate_task() returns error, sched_switch/sched_wakeup_new/sched_wakeup won't unregister. That is why fail_deprobe_sched_switch was added. Link: http://lkml.kernel.org/r/20191231133530.2794-1-pilgrimtao@gmail.com Cc: stable(a)vger.kernel.org Fixes: 478142c39c8c2 ("tracing: do not grab lock in wakeup latency function tracing") Signed-off-by: Kaitao Cheng <pilgrimtao(a)gmail.com> Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Signed-off-by: Wenyu Huang <huangwenyu4(a)huawei.com> --- kernel/trace/trace_sched_wakeup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index 0db1b024e786..8041bd5e4262 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -642,7 +642,7 @@ static void start_wakeup_tracer(struct trace_array *tr) if (ret) { pr_info("wakeup trace: Couldn't activate tracepoint" " probe to kernel_sched_migrate_task\n"); - return; + goto fail_deprobe_sched_switch; } wakeup_reset(tr); @@ -660,6 +660,8 @@ static void start_wakeup_tracer(struct trace_array *tr) printk(KERN_ERR "failed to start wakeup tracer\n"); return; +fail_deprobe_sched_switch: + unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); fail_deprobe_wake_new: unregister_trace_sched_wakeup_new(probe_wakeup, NULL); fail_deprobe: -- 2.34.1

2 1

[PATCH OLK-5.10 v5 0/6] Synchronize coresight driver bugfix patches to openEuler
by Junhao He 28 Oct '23

28 Oct '23

1. Fix memory leak coresight: Fix memory leak in acpi_buffer->pointer 2. Fix TRBE bug coresight: trbe: Fix TRBE potential sleep in atomic context coresight: trbe: Allocate platform data per device coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() 3. Fix ETR bug coresight: Fix run time warnings while reusing ETR buffer coresight: tmc-etr: Disable warnings for allocation failures | mainline commit | patch | Conflict or Not | description | | --------------- | ------------ | --------------- | ------------ | | 34149bd82c35 | coresight: Fix memory leak in acpi_buffer->pointer | No | | | 2e0fdff6f374 | coresight: Fix run time warnings while reusing ETR buffer | Yes | Resolve code conflicts without changing functions | | d3ce83b13fbd | coresight: trbe: Fix TRBE potential sleep in atomic context | Yes | Resolve code conflicts without changing functions | | 91ee6ec9039e | coresight: Fix memory leak in acpi_buffer->pointer | Yes | Dependency cleanup patch-set does not applied to OLK-5.10 | | e911e9760c77 | coresight: trbe: Allocate platform data per device | No | depend on ��c7e95621feea�� | | c7e95621feea | coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() | No | | Junhao He (2) coresight: Fix memory leak in acpi_buffer->pointer coresight: trbe: Fix TRBE potential sleep in atomic context Linu Cherian (1): coresight: Fix run time warnings while reusing ETR buffer Suzuki K Poulose (2): coresight: trbe: Allocate platform data per device coresight: tmc-etr: Disable warnings for allocation failures Wei Yongjun (1): coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() .../hwtracing/coresight/coresight-platform.c | 46 ++++++++++++------- .../hwtracing/coresight/coresight-tmc-etr.c | 23 +++++----- drivers/hwtracing/coresight/coresight-trbe.c | 41 ++++++++--------- 3 files changed, 62 insertions(+), 48 deletions(-) -- 2.33.0

2 7

[PATCH OLK-5.10 0/2] Fix CVE-2023-5717
by Yang Jihong 28 Oct '23

28 Oct '23

Peter Zijlstra (1): perf: Disallow mis-matched inherited group reads Yang Jihong (1): perf: Fix kabi breakage in struct perf_event include/linux/perf_event.h | 2 ++ kernel/events/core.c | 40 ++++++++++++++++++++++++++++++++------ 2 files changed, 36 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH v2 openEuler-1.0-LTS] kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail
by Wenyu Huang 27 Oct '23

27 Oct '23

From: Kaitao Cheng <pilgrimtao(a)gmail.com> stable inclusion from stable-v4.19.297 commit 50f9ad607ea891a9308e67b81f774c71736d1098 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BAW8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In the function, if register_trace_sched_migrate_task() returns error, sched_switch/sched_wakeup_new/sched_wakeup won't unregister. That is why fail_deprobe_sched_switch was added. Link: http://lkml.kernel.org/r/20191231133530.2794-1-pilgrimtao@gmail.com Cc: stable(a)vger.kernel.org Fixes: 478142c39c8c2 ("tracing: do not grab lock in wakeup latency function tracing") Signed-off-by: Kaitao Cheng <pilgrimtao(a)gmail.com> Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Signed-off-by: Wenyu Huang <huangwenyu4(a)huawei.com> --- kernel/trace/trace_sched_wakeup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index 0db1b024e786..8041bd5e4262 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -642,7 +642,7 @@ static void start_wakeup_tracer(struct trace_array *tr) if (ret) { pr_info("wakeup trace: Couldn't activate tracepoint" " probe to kernel_sched_migrate_task\n"); - return; + goto fail_deprobe_sched_switch; } wakeup_reset(tr); @@ -660,6 +660,8 @@ static void start_wakeup_tracer(struct trace_array *tr) printk(KERN_ERR "failed to start wakeup tracer\n"); return; +fail_deprobe_sched_switch: + unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); fail_deprobe_wake_new: unregister_trace_sched_wakeup_new(probe_wakeup, NULL); fail_deprobe: -- 2.34.1

2 1

[PATCH OLK-5.10 v2 00/15] arm64: fix a concurrency issue in emulation_proc_handler()
by Jinjie Ruan 27 Oct '23

27 Oct '23

MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In linux-6.1, the related code is refactored in commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") and this issue was incidentally fixed. This patch set try to adapt the refactoring stable 5.10 patches to solve the problem of repeated addition of linked lists described below. How to reproduce: CONFIG_ARMV8_DEPRECATED=y, CONFIG_SWP_EMULATION=y, and CONFIG_DEBUG_LIST=y, then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 1 > /proc/sys/abi/swp done or "echo 1 > /proc/sys/abi/swp" and then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 0 > /proc/sys/abi/swp done In emulation_proc_handler(), read and write operations are performed on insn->current_mode. In the concurrency scenario, mutex only protects writing insn->current_mode, and not protects the read. Suppose there are two concurrent tasks, task1 updates insn->current_mode to INSN_EMULATE in the critical section, the prev_mode of task2 is still the old data INSN_UNDEF of insn->current_mode. As a result, two tasks call update_insn_emulation_mode twice with prev_mode = INSN_UNDEF and current_mode = INSN_EMULATE, then call register_emulation_hooks twice, resulting in a list_add double problem. commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") remove the dynamic registration and unregistration so remove the register_undef_hook() function, so the below problem was incidentally fixed. Call trace: __list_add_valid+0xd8/0xe4 register_undef_hook+0x94/0x13c update_insn_emulation_mode+0xd0/0x12c emulation_proc_handler+0xd8/0xf4 proc_sys_call_handler+0x140/0x250 proc_sys_write+0x1c/0x2c new_sync_write+0xec/0x18c vfs_write+0x214/0x2ac ksys_write+0x70/0xfc __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Call trace: __list_del_entry_valid+0xac/0x110 unregister_undef_hook+0x34/0x80 update_insn_emulation_mode+0xf0/0x180 emulation_proc_handler+0x8c/0xd8 proc_sys_call_handler+0x1d8/0x208 proc_sys_write+0x14/0x20 new_sync_write+0xf0/0x190 vfs_write+0x304/0x388 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 el0_svc_common.constprop.4+0x68/0x188 do_el0_svc+0x24/0xa0 el0_svc+0x14/0x20 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 The first patch is the self-developed patch, so revert it. The next 4 patches is a patch set which provides context for subsequent refactoring 9 patches, especially commit 0f2cb928a154 ("arm64: consistently pass ESR_ELx to die()") which modify do_undefinstr() to add a ESR_ELx value arg, and then commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") splits do_undefinstr() handler into separate do_el0_undef() and do_el1_undef() handlers. The 9 patches after that is another refactoring patch set, which is in preparation for the main rework commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling"). To remove struct undef_hook, commit bff8f413c71f ("arm64: factor out EL1 SSBS emulation hook") factor out EL1 SSBS emulation hook, which also avoid call call_undef_hook() in do_el1_undef(), commit f5962add74b6 ("arm64: rework EL0 MRS emulation") factor out EL0 MRS emulation hook, which also prepare for replacing call_undef_hook() in do_el0_undef(). To replace call_undef_hook() function, commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") split the do_undefinstr() into do_el0_undef() and do_el1_undef() functions, and commit dbfbd87efa79 ("arm64: factor insn read out of call_undef_hook()") factor user_insn_read() from call_undef_hook() so the main rework patch can replace the call_undef_hook() in do_el0_undef(). The last patch is a bugfix for the main rework patch. I've tested this with userspace programs which use each of the deprecated instructions on Raspberry Pi 4B KVM/Qemu, and I've concurrently modified the support level for each of the features back-and-forth between HW and emulated to check that there are no oops or above repeated addition or deletion call trace. Fixes: af483947d472 ("arm64: fix oops in concurrently setting insn_emulation sysctls") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Jinjie Ruan (1): Revert "arm64: fix a concurrency issue in emulation_proc_handler()" Mark Rutland (13): arm64: die(): pass 'err' as long arm64: consistently pass ESR_ELx to die() arm64: rework FPAC exception handling arm64: rework BTI exception handling arm64: allow kprobes on EL0 handlers arm64: split EL0/EL1 UNDEF handlers arm64: factor out EL1 SSBS emulation hook arm64: factor insn read out of call_undef_hook() arm64: rework EL0 MRS emulation arm64: armv8_deprecated: fold ops into insn_emulation arm64: armv8_deprecated move emulation functions arm64: armv8_deprecated: move aarch32 helper earlier arm64: armv8_deprecated: rework deprected instruction handling Ren Zhijie (1): arm64: armv8_deprecated: fix unused-function error arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 574 +++++++++++++-------------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 +++--- 10 files changed, 395 insertions(+), 428 deletions(-) -- 2.34.1

2 16

[PATCH openEuler-1.0-LTS] kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail
by Wenyu Huang 27 Oct '23

27 Oct '23

From: Kaitao Cheng <pilgrimtao(a)gmail.com> stable inclusion from stable-4.19.297 commit 50f9ad607ea891a9308e67b81f774c71736d1098 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BAW8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In the function, if register_trace_sched_migrate_task() returns error, sched_switch/sched_wakeup_new/sched_wakeup won't unregister. That is why fail_deprobe_sched_switch was added. Link: http://lkml.kernel.org/r/20191231133530.2794-1-pilgrimtao@gmail.com Cc: stable(a)vger.kernel.org Fixes: 478142c39c8c2 ("tracing: do not grab lock in wakeup latency function tracing") Signed-off-by: Kaitao Cheng <pilgrimtao(a)gmail.com> Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Signed-off-by: Wenyu Huang <huangwenyu4(a)huawei.com> --- kernel/trace/trace_sched_wakeup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index 0db1b024e786..8041bd5e4262 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -642,7 +642,7 @@ static void start_wakeup_tracer(struct trace_array *tr) if (ret) { pr_info("wakeup trace: Couldn't activate tracepoint" " probe to kernel_sched_migrate_task\n"); - return; + goto fail_deprobe_sched_switch; } wakeup_reset(tr); @@ -660,6 +660,8 @@ static void start_wakeup_tracer(struct trace_array *tr) printk(KERN_ERR "failed to start wakeup tracer\n"); return; +fail_deprobe_sched_switch: + unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); fail_deprobe_wake_new: unregister_trace_sched_wakeup_new(probe_wakeup, NULL); fail_deprobe: -- 2.34.1

2 1

[PATCH OLK-5.10 0/6] improve pagecache PSI annotations
by Liu Shixin 27 Oct '23

27 Oct '23

Currently the VM tries to abuse the block layer submission path for the page cache PSI annotations. This series instead annotates the ->read_folio and ->readahead calls in the core VM code, and then only deals with the odd direct add_to_page_cache_lru calls manually. Christoph Hellwig (5): mm: add PSI accounting around ->read_folio and ->readahead calls sched/psi: export psi_memstall_{enter,leave} btrfs: add manual PSI accounting for compressed reads erofs: add manual PSI accounting for the compressed address space block: remove PSI accounting from the bio layer Johannes Weiner (1): fs: fix leaked psi pressure state block/bio.c | 8 -------- block/blk-core.c | 19 ------------------- fs/btrfs/compression.c | 16 ++++++++++++++-- fs/direct-io.c | 2 -- fs/erofs/zdata.c | 17 ++++++++++++++++- include/linux/blk_types.h | 1 - include/linux/pagemap.h | 2 ++ kernel/sched/psi.c | 2 ++ mm/filemap.c | 7 +++++++ mm/readahead.c | 7 +++++++ 10 files changed, 48 insertions(+), 33 deletions(-) -- 2.25.1

2 7

[PATCH OLK-5.10] ubi: Refuse attaching if mtd's erasesize is 0
by ZhaoLong Wang 27 Oct '23

27 Oct '23

From: Zhihao Cheng <chengzhihao1(a)huawei.com> mainline inclusion from mainline-v6.6-rc5 commit 017c73a34a661a861712f7cc1393a123e5b2208c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6YOAJ CVE: CVE-2023-31085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- There exists mtd devices with zero erasesize, which will trigger a divide-by-zero exception while attaching ubi device. Fix it by refusing attaching if mtd's erasesize is 0. Fixes: 801c135ce73d ("UBI: Unsorted Block Images") Reported-by: Yu Hao <yhao016(a)ucr.edu> Link: https://lore.kernel.org/lkml/977347543.226888.1682011999468.JavaMail.zimbra… Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/build.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c index 1052bb60063f..403f61c3bf73 100644 --- a/drivers/mtd/ubi/build.c +++ b/drivers/mtd/ubi/build.c @@ -896,6 +896,13 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, return -EINVAL; } + /* UBI cannot work on flashes with zero erasesize. */ + if (!mtd->erasesize) { + pr_err("ubi: refuse attaching mtd%d - zero erasesize flash is not supported\n", + mtd->index); + return -EINVAL; + } + if (ubi_num == UBI_DEV_NUM_AUTO) { /* Search for an empty slot in the @ubi_devices array */ for (ubi_num = 0; ubi_num < UBI_MAX_DEVICES; ubi_num++) -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] ubi: Refuse attaching if mtd's erasesize is 0
by ZhaoLong Wang 27 Oct '23

27 Oct '23

From: Zhihao Cheng <chengzhihao1(a)huawei.com> mainline inclusion from mainline-v6.6-rc5 commit 017c73a34a661a861712f7cc1393a123e5b2208c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6YOAJ CVE: CVE-2023-31085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- There exists mtd devices with zero erasesize, which will trigger a divide-by-zero exception while attaching ubi device. Fix it by refusing attaching if mtd's erasesize is 0. Fixes: 801c135ce73d ("UBI: Unsorted Block Images") Reported-by: Yu Hao <yhao016(a)ucr.edu> Link: https://lore.kernel.org/lkml/977347543.226888.1682011999468.JavaMail.zimbra… Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/build.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c index c120c8761fcd..93cce95287ba 100644 --- a/drivers/mtd/ubi/build.c +++ b/drivers/mtd/ubi/build.c @@ -866,6 +866,13 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, return -EINVAL; } + /* UBI cannot work on flashes with zero erasesize. */ + if (!mtd->erasesize) { + pr_err("ubi: refuse attaching mtd%d - zero erasesize flash is not supported\n", + mtd->index); + return -EINVAL; + } + if (ubi_num == UBI_DEV_NUM_AUTO) { /* Search for an empty slot in the @ubi_devices array */ for (ubi_num = 0; ubi_num < UBI_MAX_DEVICES; ubi_num++) -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail
by Wenyu Huang 27 Oct '23

27 Oct '23

From: Kaitao Cheng <pilgrimtao(a)gmail.com> stable inclusion from stable-4.19 commit 50f9ad607ea891a9308e67b81f774c71736d1098 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BAW8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In the function, if register_trace_sched_migrate_task() returns error, sched_switch/sched_wakeup_new/sched_wakeup won't unregister. That is why fail_deprobe_sched_switch was added. Link: http://lkml.kernel.org/r/20191231133530.2794-1-pilgrimtao@gmail.com Cc: stable(a)vger.kernel.org Fixes: 478142c39c8c2 ("tracing: do not grab lock in wakeup latency function tracing") Signed-off-by: Kaitao Cheng <pilgrimtao(a)gmail.com> Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Signed-off-by: Wenyu Huang <huangwenyu4(a)huawei.com> --- kernel/trace/trace_sched_wakeup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index 0db1b024e786..8041bd5e4262 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -642,7 +642,7 @@ static void start_wakeup_tracer(struct trace_array *tr) if (ret) { pr_info("wakeup trace: Couldn't activate tracepoint" " probe to kernel_sched_migrate_task\n"); - return; + goto fail_deprobe_sched_switch; } wakeup_reset(tr); @@ -660,6 +660,8 @@ static void start_wakeup_tracer(struct trace_array *tr) printk(KERN_ERR "failed to start wakeup tracer\n"); return; +fail_deprobe_sched_switch: + unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); fail_deprobe_wake_new: unregister_trace_sched_wakeup_new(probe_wakeup, NULL); fail_deprobe: -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] crypto: hisilicon - fix different versions of devices driver compatibility issue
by zhongkeyi 27 Oct '23

27 Oct '23

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8BFOM CVE: NA ---------------------------------------------------------------------- In order to be compatible with devices of different versions, V1 in the accelerator driver is now isolated, and other versions are the previous V2 processing flow. Signed-off-by: zhongkeyi <zhongkeyi1(a)huawei.com> --- drivers/crypto/hisilicon/hpre/hpre_main.c | 2 +- drivers/crypto/hisilicon/qm.c | 70 +++++++++-------------- drivers/crypto/hisilicon/qm.h | 14 ++--- drivers/crypto/hisilicon/rde/rde_main.c | 12 +--- drivers/crypto/hisilicon/sec2/sec_main.c | 12 +--- drivers/crypto/hisilicon/zip/zip_main.c | 12 +--- 6 files changed, 37 insertions(+), 85 deletions(-) diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c index cbe8ea438fd2..8c71353cd4b5 100644 --- a/drivers/crypto/hisilicon/hpre/hpre_main.c +++ b/drivers/crypto/hisilicon/hpre/hpre_main.c @@ -840,7 +840,7 @@ static int hpre_pf_probe_init(struct hisi_qm *qm) { int ret; - if (qm->ver != QM_HW_V2) + if (qm->ver == QM_HW_V1) return -EINVAL; qm->ctrl_q_num = HPRE_QUEUE_NUM_V2; diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c index f2706dc0d55e..5562c63bfeeb 100644 --- a/drivers/crypto/hisilicon/qm.c +++ b/drivers/crypto/hisilicon/qm.c @@ -682,7 +682,7 @@ static int qm_irq_register(struct hisi_qm *qm) if (ret) return ret; - if (qm->ver == QM_HW_V2) { + if (qm->ver != QM_HW_V1) { ret = request_irq(pci_irq_vector(pdev, QM_AEQ_EVENT_IRQ_VECTOR), qm_aeq_irq, IRQF_SHARED, qm->dev_name, qm); if (ret) @@ -713,13 +713,12 @@ static void qm_irq_unregister(struct hisi_qm *qm) free_irq(pci_irq_vector(pdev, QM_EQ_EVENT_IRQ_VECTOR), qm); - if (qm->ver == QM_HW_V2) { - free_irq(pci_irq_vector(pdev, QM_AEQ_EVENT_IRQ_VECTOR), qm); + if (qm->ver == QM_HW_V1) + return; - if (qm->fun_type == QM_HW_PF) - free_irq(pci_irq_vector(pdev, - QM_ABNORMAL_EVENT_IRQ_VECTOR), qm); - } + free_irq(pci_irq_vector(pdev, QM_AEQ_EVENT_IRQ_VECTOR), qm); + if (qm->fun_type == QM_HW_PF) + free_irq(pci_irq_vector(pdev, QM_ABNORMAL_EVENT_IRQ_VECTOR), qm); } static void qm_init_qp_status(struct hisi_qp *qp) @@ -741,36 +740,26 @@ static void qm_vft_data_cfg(struct hisi_qm *qm, enum vft_type type, u32 base, if (number > 0) { switch (type) { case SQC_VFT: - switch (qm->ver) { - case QM_HW_V1: + if (qm->ver == QM_HW_V1) { tmp = QM_SQC_VFT_BUF_SIZE | QM_SQC_VFT_SQC_SIZE | QM_SQC_VFT_INDEX_NUMBER | QM_SQC_VFT_VALID | (u64)base << QM_SQC_VFT_START_SQN_SHIFT; - break; - case QM_HW_V2: + } else { tmp = (u64)base << QM_SQC_VFT_START_SQN_SHIFT | QM_SQC_VFT_VALID | (u64)(number - 1) << QM_SQC_VFT_SQN_SHIFT; - break; - case QM_HW_UNKNOWN: - break; } break; case CQC_VFT: - switch (qm->ver) { - case QM_HW_V1: + if (qm->ver == QM_HW_V1) { tmp = QM_CQC_VFT_BUF_SIZE | QM_CQC_VFT_SQC_SIZE | QM_CQC_VFT_INDEX_NUMBER | QM_CQC_VFT_VALID; - break; - case QM_HW_V2: + } else { tmp = QM_CQC_VFT_VALID; - break; - case QM_HW_UNKNOWN: - break; } break; } @@ -1827,7 +1816,7 @@ static int qm_sq_ctx_cfg(struct hisi_qp *qp, int qp_id, int pasid) if (ver == QM_HW_V1) { sqc->dw3 = cpu_to_le32(QM_MK_SQC_DW3_V1(0, 0, 0, qm->sqe_size)); sqc->w8 = cpu_to_le16(QM_Q_DEPTH - 1); - } else if (ver == QM_HW_V2) { + } else { sqc->dw3 = cpu_to_le32(QM_MK_SQC_DW3_V2(qm->sqe_size)); sqc->w8 = 0; /* rand_qc */ } @@ -1867,7 +1856,7 @@ static int qm_cq_ctx_cfg(struct hisi_qp *qp, int qp_id, int pasid) cqc->dw3 = cpu_to_le32(QM_MK_CQC_DW3_V1(0, 0, 0, QM_QC_CQE_SIZE)); cqc->w8 = cpu_to_le16(QM_Q_DEPTH - 1); - } else if (ver == QM_HW_V2) { + } else { cqc->dw3 = cpu_to_le32(QM_MK_CQC_DW3_V2(QM_QC_CQE_SIZE)); cqc->w8 = 0; /* rand_qc */ } @@ -2104,14 +2093,13 @@ static void hisi_qm_cache_wb(struct hisi_qm *qm) { unsigned int val; - if (qm->ver == QM_HW_V2) { - writel(0x1, qm->io_base + QM_CACHE_WB_START); - if (readl_relaxed_poll_timeout(qm->io_base + QM_CACHE_WB_DONE, - val, val & BIT(0), POLL_PERIOD, - POLL_TIMEOUT)) - dev_err(&qm->pdev->dev, - "QM writeback sqc cache fail!\n"); - } + if (qm->ver == QM_HW_V1) + return; + + writel(0x1, qm->io_base + QM_CACHE_WB_START); + if (readl_relaxed_poll_timeout(qm->io_base + QM_CACHE_WB_DONE, + val, val & BIT(0), 10, 1000)) + dev_err(&qm->pdev->dev, "QM writeback sqc cache fail!\n"); } int hisi_qm_get_free_qp_num(struct hisi_qm *qm) @@ -2212,12 +2200,12 @@ static int hisi_qm_uacce_mmap(struct uacce_queue *q, switch (qfr->type) { case UACCE_QFRT_MMIO: - if (qm->ver == QM_HW_V2) { - if (WARN_ON(sz > PAGE_SIZE * (QM_DOORBELL_PAGE_NR + - QM_V2_DOORBELL_OFFSET / PAGE_SIZE))) + if (qm->ver == QM_HW_V1) { + if (WARN_ON(sz > PAGE_SIZE * QM_DOORBELL_PAGE_NR)) return -EINVAL; } else { - if (WARN_ON(sz > PAGE_SIZE * QM_DOORBELL_PAGE_NR)) + if (WARN_ON(sz > PAGE_SIZE * (QM_DOORBELL_PAGE_NR + + QM_V2_DOORBELL_OFFSET / PAGE_SIZE))) return -EINVAL; } @@ -2691,16 +2679,10 @@ int hisi_qm_init(struct hisi_qm *qm) struct device *dev = &pdev->dev; int ret; - switch (qm->ver) { - case QM_HW_V1: + if (qm->ver == QM_HW_V1) qm->ops = &qm_hw_ops_v1; - break; - case QM_HW_V2: + else qm->ops = &qm_hw_ops_v2; - break; - default: - return -EINVAL; - } if (qm->use_uacce) { dev_info(dev, "qm register to uacce\n"); @@ -2720,7 +2702,7 @@ int hisi_qm_init(struct hisi_qm *qm) goto err_irq_register; mutex_init(&qm->mailbox_lock); - if (qm->fun_type == QM_HW_VF && qm->ver == QM_HW_V2) { + if (qm->fun_type == QM_HW_VF && qm->ver != QM_HW_V1) { /* v2 or v3 starts to support get vft by mailbox */ ret = hisi_qm_get_vft(qm, &qm->qp_base, &qm->qp_num); if (ret) diff --git a/drivers/crypto/hisilicon/qm.h b/drivers/crypto/hisilicon/qm.h index d7d23d1ec34c..211689579161 100644 --- a/drivers/crypto/hisilicon/qm.h +++ b/drivers/crypto/hisilicon/qm.h @@ -114,6 +114,7 @@ enum qm_hw_ver { QM_HW_UNKNOWN = -1, QM_HW_V1 = 0x20, QM_HW_V2 = 0x21, + QM_HW_V3 = 0x30, }; enum qm_fun_type { @@ -385,7 +386,6 @@ static inline int q_num_set(const char *val, const struct kernel_param *kp, struct pci_dev *pdev = pci_get_device(PCI_VENDOR_ID_HUAWEI, device, NULL); u32 n, q_num; - u8 rev_id; int ret; if (!val) @@ -396,17 +396,10 @@ static inline int q_num_set(const char *val, const struct kernel_param *kp, pr_info("No device found currently, suppose queue number is %d\n", q_num); } else { - rev_id = pdev->revision; - switch (rev_id) { - case QM_HW_V1: + if (pdev->revision == QM_HW_V1) q_num = QNUM_V1; - break; - case QM_HW_V2: + else q_num = QNUM_V2; - break; - default: - return -EINVAL; - } } ret = kstrtou32(val, 10, &n); @@ -474,6 +467,7 @@ static inline int hisi_qm_pre_init(struct hisi_qm *qm, switch (pdev->revision) { case QM_HW_V1: case QM_HW_V2: + case QM_HW_V3: qm->ver = pdev->revision; break; default: diff --git a/drivers/crypto/hisilicon/rde/rde_main.c b/drivers/crypto/hisilicon/rde/rde_main.c index f2e00ff891db..9fee21bfaed0 100644 --- a/drivers/crypto/hisilicon/rde/rde_main.c +++ b/drivers/crypto/hisilicon/rde/rde_main.c @@ -647,18 +647,10 @@ static int hisi_rde_pf_probe_init(struct hisi_qm *qm) hisi_rde->ctrl = ctrl; ctrl->hisi_rde = hisi_rde; - switch (qm->ver) { - case QM_HW_V1: + if (qm->ver == QM_HW_V1) qm->ctrl_q_num = HRDE_QUEUE_NUM_V1; - break; - - case QM_HW_V2: + else qm->ctrl_q_num = HRDE_QUEUE_NUM_V2; - break; - - default: - return -EINVAL; - } ret = qm->err_ini.set_usr_domain_cache(qm); if (ret) diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c index 0f32dcb69e12..2f8dd6c30cb1 100644 --- a/drivers/crypto/hisilicon/sec2/sec_main.c +++ b/drivers/crypto/hisilicon/sec2/sec_main.c @@ -738,18 +738,10 @@ static int sec_pf_probe_init(struct hisi_qm *qm) { int ret; - switch (qm->ver) { - case QM_HW_V1: + if (qm->ver == QM_HW_V1) qm->ctrl_q_num = SEC_QUEUE_NUM_V1; - break; - - case QM_HW_V2: + else qm->ctrl_q_num = SEC_QUEUE_NUM_V2; - break; - - default: - return -EINVAL; - } ret = qm->err_ini.set_usr_domain_cache(qm); if (ret) diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c index 1ca51793e26a..ce931af1007b 100644 --- a/drivers/crypto/hisilicon/zip/zip_main.c +++ b/drivers/crypto/hisilicon/zip/zip_main.c @@ -790,18 +790,10 @@ static int hisi_zip_pf_probe_init(struct hisi_qm *qm) zip->ctrl = ctrl; ctrl->hisi_zip = zip; - switch (qm->ver) { - case QM_HW_V1: + if (qm->ver == QM_HW_V1) qm->ctrl_q_num = HZIP_QUEUE_NUM_V1; - break; - - case QM_HW_V2: + else qm->ctrl_q_num = HZIP_QUEUE_NUM_V2; - break; - - default: - return -EINVAL; - } ret = qm->err_ini.set_usr_domain_cache(qm); if (ret) -- 2.27.0

2 1

[PATCH OLK-5.10 RESEND 00/15] arm64: fix a concurrency issue in emulation_proc_handler()
by Jinjie Ruan 27 Oct '23

27 Oct '23

In linux-6.1, the related code is refactored in commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") and this issue was incidentally fixed. This patch set try to adapt the refactoring stable 5.10 patches to solve the problem of repeated addition of linked lists described below. How to reproduce: CONFIG_ARMV8_DEPRECATED=y, CONFIG_SWP_EMULATION=y, and CONFIG_DEBUG_LIST=y, then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 1 > /proc/sys/abi/swp done or "echo 1 > /proc/sys/abi/swp" and then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 0 > /proc/sys/abi/swp done In emulation_proc_handler(), read and write operations are performed on insn->current_mode. In the concurrency scenario, mutex only protects writing insn->current_mode, and not protects the read. Suppose there are two concurrent tasks, task1 updates insn->current_mode to INSN_EMULATE in the critical section, the prev_mode of task2 is still the old data INSN_UNDEF of insn->current_mode. As a result, two tasks call update_insn_emulation_mode twice with prev_mode = INSN_UNDEF and current_mode = INSN_EMULATE, then call register_emulation_hooks twice, resulting in a list_add double problem. commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") remove the dynamic registration and unregistration so remove the register_undef_hook() function, so the below problem was incidentally fixed. Call trace: __list_add_valid+0xd8/0xe4 register_undef_hook+0x94/0x13c update_insn_emulation_mode+0xd0/0x12c emulation_proc_handler+0xd8/0xf4 proc_sys_call_handler+0x140/0x250 proc_sys_write+0x1c/0x2c new_sync_write+0xec/0x18c vfs_write+0x214/0x2ac ksys_write+0x70/0xfc __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Call trace: __list_del_entry_valid+0xac/0x110 unregister_undef_hook+0x34/0x80 update_insn_emulation_mode+0xf0/0x180 emulation_proc_handler+0x8c/0xd8 proc_sys_call_handler+0x1d8/0x208 proc_sys_write+0x14/0x20 new_sync_write+0xf0/0x190 vfs_write+0x304/0x388 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 el0_svc_common.constprop.4+0x68/0x188 do_el0_svc+0x24/0xa0 el0_svc+0x14/0x20 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 The first patch is the hulk self-developed patch, so revert it. The next 4 patches is a patch set which provides context for subsequent refactoring 9 patches, especially commit 0f2cb928a154 ("arm64: consistently pass ESR_ELx to die()") which modify do_undefinstr() to add a ESR_ELx value arg, and then commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") splits do_undefinstr() handler into separate do_el0_undef() and do_el1_undef() handlers. The 9 patches after that is another refactoring patch set, which is in preparation for the main rework commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling"). To remove struct undef_hook, commit bff8f413c71f ("arm64: factor out EL1 SSBS emulation hook") factor out EL1 SSBS emulation hook, which also avoid call call_undef_hook() in do_el1_undef(), commit f5962add74b6 ("arm64: rework EL0 MRS emulation") factor out EL0 MRS emulation hook, which also prepare for replacing call_undef_hook() in do_el0_undef(). To replace call_undef_hook() function, commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") split the do_undefinstr() into do_el0_undef() and do_el1_undef() functions, and commit dbfbd87efa79 ("arm64: factor insn read out of call_undef_hook()") factor user_insn_read() from call_undef_hook() so the main rework patch can replace the call_undef_hook() in do_el0_undef(). The last patch is a bugfix for the main rework patch. I've tested this with userspace programs which use each of the deprecated instructions on Raspberry Pi 4B KVM/Qemu, and I've concurrently modified the support level for each of the features back-and-forth between HW and emulated to check that there are no oops or above repeated addition or deletion call trace. Fixes: af483947d472 ("arm64: fix oops in concurrently setting insn_emulation sysctls") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Jinjie Ruan (1): Revert "arm64: fix a concurrency issue in emulation_proc_handler()" Mark Rutland (13): arm64: die(): pass 'err' as long arm64: consistently pass ESR_ELx to die() arm64: rework FPAC exception handling arm64: rework BTI exception handling arm64: allow kprobes on EL0 handlers arm64: split EL0/EL1 UNDEF handlers arm64: factor out EL1 SSBS emulation hook arm64: factor insn read out of call_undef_hook() arm64: rework EL0 MRS emulation arm64: armv8_deprecated: fold ops into insn_emulation arm64: armv8_deprecated move emulation functions arm64: armv8_deprecated: move aarch32 helper earlier arm64: armv8_deprecated: rework deprected instruction handling Ren Zhijie (1): arm64: armv8_deprecated: fix unused-function error arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 574 +++++++++++++-------------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 +++--- 10 files changed, 395 insertions(+), 428 deletions(-) -- 2.34.1

1 15

[PATCH openEuler-1.0-LTS v2 0/7] Fix netfilter conntrack
by Lu Wei 27 Oct '23

27 Oct '23

Florian Westphal (7): netfilter: conntrack: tell compiler to not inline nf_ct_resolve_clash netfilter: conntrack: remove two args from resolve_clash netfilter: conntrack: place confirm-bit setting in a helper netfilter: conntrack: split resolve_clash function netfilter: conntrack: allow insertion of clashing entries netfilter: conntrack: do not auto-delete clash entries on reply netfilter: conntrack: fix infinite loop on rmmod include/linux/rculist_nulls.h | 7 + .../linux/netfilter/nf_conntrack_common.h | 12 +- net/netfilter/nf_conntrack_core.c | 215 +++++++++++++++--- net/netfilter/nf_conntrack_proto_udp.c | 7 +- net/netfilter/nft_flow_offload.c | 2 +- 5 files changed, 205 insertions(+), 38 deletions(-) -- 2.34.1

2 8

[PATCH OLK-5.10 v4 0/8] coresight: etm4x: Migrate ACPI AMBA devices to platform drive
by Junhao He 27 Oct '23

27 Oct '23

CoreSight ETM4x devices could be accessed either via MMIO (handled via amba_driver) or CPU system instructions (handled via platform driver). But this has the following issues : - Each new CPU comes up with its own PID and thus we need to keep on adding the "known" PIDs to get it working with AMBA driver. While the ETM4 architecture (and CoreSight architecture) defines way to identify a device as ETM4. Thus older kernels won't be able to "discover" a newer CPU, unless we add the PIDs. - With ACPI, the ETM4x devices have the same HID to identify the device irrespective of the mode of access. This creates a problem where two different drivers (both AMBA based driver and platform driver) would hook into the "HID" and could conflict. e.g., if AMBA driver gets hold of a non-MMIO device, the probe fails. If we have single driver hooked into the given "HID", we could handle them seamlessly, irrespective of the mode of access. - CoreSight is heavily dependent on the runtime power management. With ACPI, amba_driver doesn't get us anywhere with handling the power and thus one need to always turn the power ON to use them. Moving to platform driver gives us the power management for free. Due to all of the above, we are moving ACPI MMIO based etm4x devices to be supported via tha platform driver. The series makes the existing platform driver generic to handle both type of the access modes. Although existing AMBA driver would still continue to support DT based etm4x MMIO devices. Although some problems still remain, such as manually adding PIDs for all new AMBA DT based devices. Anshuman Khandual (5): coresight: etm4x: Allocate and device assign 'struct etmv4_drvdata' earlier coresight: etm4x: Drop iomem 'base' argument from etm4_probe() coresight: etm4x: Drop pid argument from etm4_probe() coresight: etm4x: Change etm4_platform_driver driver for MMIO devices coresight: etm4x: Ensure valid drvdata and clock before clk_put() Junhao He (1): Revert "coresight: ete: Add acpi match id for Hip09" Suzuki K Poulose (2): coresight: platform: acpi: Ignore the absence of graph coresight: etm4x: Add ACPI support in platform driver drivers/acpi/acpi_amba.c | 1 - .../coresight/coresight-etm4x-core.c | 119 ++++++++++++++---- drivers/hwtracing/coresight/coresight-etm4x.h | 4 + .../hwtracing/coresight/coresight-platform.c | 6 +- include/linux/coresight.h | 59 +++++++++ 5 files changed, 162 insertions(+), 27 deletions(-) -- 2.33.0

2 9

[OLK-5.10 v2] RDMA/hns: Append SCC context to the raw dump of QP Resource
by Chengchang Tang 27 Oct '23

27 Oct '23

From: wenglianfa <wenglianfa(a)huawei.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8B8HH -------------------------------------------------------------------------- QP and SCC are bound one by one. Therefore, QPC and SCCC can be combined for output. When the SCC output is disabled, the QPC output is normal, and the SCCC output is all 0. The 512-byte QP context is appended with 64-byte SCC context. Example: $rdma res show qp -jpr [ { "ifindex": 0, "ifname": "hns_0", "data": [ 67,0,0,0... 512bytes 4,0,2... 64bytes] },... } ] Signed-off-by: wenglianfa <wenglianfa(a)huawei.com> --- drivers/infiniband/hw/hns/hns_roce_cmd.h | 3 +++ drivers/infiniband/hw/hns/hns_roce_device.h | 1 + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 25 +++++++++++++++++++ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 6 +++++ drivers/infiniband/hw/hns/hns_roce_restrack.c | 24 +++++++++++++++--- 5 files changed, 56 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_cmd.h b/drivers/infiniband/hw/hns/hns_roce_cmd.h index 052a3d60905a..11dbbabebdc9 100644 --- a/drivers/infiniband/hw/hns/hns_roce_cmd.h +++ b/drivers/infiniband/hw/hns/hns_roce_cmd.h @@ -108,6 +108,9 @@ enum { HNS_ROCE_CMD_QUERY_CEQC = 0x92, HNS_ROCE_CMD_DESTROY_CEQC = 0x93, + /* SCC CTX commands */ + HNS_ROCE_CMD_QUERY_SCCC = 0xa2, + /* SCC CTX BT commands */ HNS_ROCE_CMD_READ_SCCC_BT0 = 0xa4, HNS_ROCE_CMD_WRITE_SCCC_BT0 = 0xa5, diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h index 453c088ad92f..14bc242b6ad6 100644 --- a/drivers/infiniband/hw/hns/hns_roce_device.h +++ b/drivers/infiniband/hw/hns/hns_roce_device.h @@ -1020,6 +1020,7 @@ struct hns_roce_hw { int (*query_cqc)(struct hns_roce_dev *hr_dev, u32 cqn, void *buffer); int (*query_qpc)(struct hns_roce_dev *hr_dev, u32 qpn, void *buffer); int (*query_mpt)(struct hns_roce_dev *hr_dev, u32 key, void *buffer); + int (*query_sccc)(struct hns_roce_dev *hr_dev, u32 qpn, void *buffer); int (*get_dscp)(struct hns_roce_dev *hr_dev, u8 dscp, u8 *tc_mode, u8 *priority); int (*query_hw_counter)(struct hns_roce_dev *hr_dev, diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index 8a1b9714dafb..a9b44ebbbd25 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -5682,6 +5682,30 @@ static int hns_roce_v2_query_qpc(struct hns_roce_dev *hr_dev, u32 qpn, return ret; } +static int hns_roce_v2_query_sccc(struct hns_roce_dev *hr_dev, u32 qpn, + void *buffer) +{ + struct hns_roce_v2_scc_context *context; + struct hns_roce_cmd_mailbox *mailbox; + int ret; + + mailbox = hns_roce_alloc_cmd_mailbox(hr_dev); + if (IS_ERR(mailbox)) + return PTR_ERR(mailbox); + + ret = hns_roce_cmd_mbox(hr_dev, 0, mailbox->dma, HNS_ROCE_CMD_QUERY_SCCC, + qpn); + if (ret) + goto out; + + context = mailbox->buf; + memcpy(buffer, context, sizeof(*context)); + +out: + hns_roce_free_cmd_mailbox(hr_dev, mailbox); + return ret; +} + static u8 get_qp_timeout_attr(struct hns_roce_dev *hr_dev, struct hns_roce_v2_qp_context *context) { @@ -7162,6 +7186,7 @@ static const struct hns_roce_hw hns_roce_hw_v2 = { .query_cqc = hns_roce_v2_query_cqc, .query_qpc = hns_roce_v2_query_qpc, .query_mpt = hns_roce_v2_query_mpt, + .query_sccc = hns_roce_v2_query_sccc, .get_dscp = hns_roce_hw_v2_get_dscp, .hns_roce_dev_ops = &hns_roce_v2_dev_ops, .hns_roce_dev_srq_ops = &hns_roce_v2_dev_srq_ops, diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index cbcd0f6531a4..4293ec92ca53 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -654,6 +654,12 @@ struct hns_roce_v2_qp_context { #define QPCEX_SQ_RQ_NOT_FORBID_EN QPCEX_FIELD_LOC(23, 23) #define QPCEX_STASH QPCEX_FIELD_LOC(82, 82) +#define SCC_CONTEXT_SIZE 16 + +struct hns_roce_v2_scc_context { + __le32 data[SCC_CONTEXT_SIZE]; +}; + #define V2_QP_RWE_S 1 /* rdma write enable */ #define V2_QP_RRE_S 2 /* rdma read enable */ #define V2_QP_ATE_S 3 /* rdma atomic enable */ diff --git a/drivers/infiniband/hw/hns/hns_roce_restrack.c b/drivers/infiniband/hw/hns/hns_roce_restrack.c index 961036b31c18..9b8b40998b2e 100644 --- a/drivers/infiniband/hw/hns/hns_roce_restrack.c +++ b/drivers/infiniband/hw/hns/hns_roce_restrack.c @@ -99,16 +99,34 @@ int hns_roce_fill_res_qp_entry_raw(struct sk_buff *msg, struct ib_qp *ib_qp) { struct hns_roce_dev *hr_dev = to_hr_dev(ib_qp->device); struct hns_roce_qp *hr_qp = to_hr_qp(ib_qp); - struct hns_roce_v2_qp_context context; + struct hns_roce_full_qp_ctx { + struct hns_roce_v2_qp_context qpc; + struct hns_roce_v2_scc_context sccc; + } context = {}; int ret; if (!hr_dev->hw->query_qpc) return -EINVAL; - ret = hr_dev->hw->query_qpc(hr_dev, hr_qp->qpn, &context); + ret = hr_dev->hw->query_qpc(hr_dev, hr_qp->qpn, &context.qpc); if (ret) - return -EINVAL; + return ret; + + if (!(hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_FLOW_CTRL) || + !hr_dev->hw->query_sccc) + goto out; + + /* The scc may not exist. If the scc query fails, + * only the qpc content is displayed, and the + * scc value is all 0. + */ + ret = hr_dev->hw->query_sccc(hr_dev, hr_qp->qpn, &context.sccc); + if (ret) + ibdev_warn_ratelimited(&hr_dev->ib_dev, + "failed to query SCCC, ret = %d.\n", + ret); +out: ret = nla_put(msg, RDMA_NLDEV_ATTR_RES_RAW, sizeof(context), &context); return ret; -- 2.30.0

1 0

[PATCH OLK-5.10 00/15] arm64: fix a concurrency issue in emulation_proc_handler()
by Jinjie Ruan 27 Oct '23

27 Oct '23

In linux-6.1, the related code is refactored in commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") and this issue was incidentally fixed. This patch set try to adapt the refactoring stable 5.10 patches to solve the problem of repeated addition of linked lists described below. How to reproduce: CONFIG_ARMV8_DEPRECATED=y, CONFIG_SWP_EMULATION=y, and CONFIG_DEBUG_LIST=y, then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 1 > /proc/sys/abi/swp done or "echo 1 > /proc/sys/abi/swp" and then launch two shell executions: #!/bin/bash while [ 1 ]; do echo 0 > /proc/sys/abi/swp done In emulation_proc_handler(), read and write operations are performed on insn->current_mode. In the concurrency scenario, mutex only protects writing insn->current_mode, and not protects the read. Suppose there are two concurrent tasks, task1 updates insn->current_mode to INSN_EMULATE in the critical section, the prev_mode of task2 is still the old data INSN_UNDEF of insn->current_mode. As a result, two tasks call update_insn_emulation_mode twice with prev_mode = INSN_UNDEF and current_mode = INSN_EMULATE, then call register_emulation_hooks twice, resulting in a list_add double problem. commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling") remove the dynamic registration and unregistration so remove the register_undef_hook() function, so the below problem was incidentally fixed. Call trace: __list_add_valid+0xd8/0xe4 register_undef_hook+0x94/0x13c update_insn_emulation_mode+0xd0/0x12c emulation_proc_handler+0xd8/0xf4 proc_sys_call_handler+0x140/0x250 proc_sys_write+0x1c/0x2c new_sync_write+0xec/0x18c vfs_write+0x214/0x2ac ksys_write+0x70/0xfc __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Call trace: __list_del_entry_valid+0xac/0x110 unregister_undef_hook+0x34/0x80 update_insn_emulation_mode+0xf0/0x180 emulation_proc_handler+0x8c/0xd8 proc_sys_call_handler+0x1d8/0x208 proc_sys_write+0x14/0x20 new_sync_write+0xf0/0x190 vfs_write+0x304/0x388 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 el0_svc_common.constprop.4+0x68/0x188 do_el0_svc+0x24/0xa0 el0_svc+0x14/0x20 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 The first patch is the hulk self-developed patch, so revert it. The next 4 patches is a patch set which provides context for subsequent refactoring 9 patches, especially commit 0f2cb928a154 ("arm64: consistently pass ESR_ELx to die()") which modify do_undefinstr() to add a ESR_ELx value arg, and then commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") splits do_undefinstr() handler into separate do_el0_undef() and do_el1_undef() handlers. The 9 patches after that is another refactoring patch set, which is in preparation for the main rework commit 124c49b1b5d9 ("arm64: armv8_deprecated: rework deprected instruction handling"). To remove struct undef_hook, commit bff8f413c71f ("arm64: factor out EL1 SSBS emulation hook") factor out EL1 SSBS emulation hook, which also avoid call call_undef_hook() in do_el1_undef(), commit f5962add74b6 ("arm64: rework EL0 MRS emulation") factor out EL0 MRS emulation hook, which also prepare for replacing call_undef_hook() in do_el0_undef(). To replace call_undef_hook() function, commit 61d64a376ea8 ("arm64: split EL0/EL1 UNDEF handlers") split the do_undefinstr() into do_el0_undef() and do_el1_undef() functions, and commit dbfbd87efa79 ("arm64: factor insn read out of call_undef_hook()") factor user_insn_read() from call_undef_hook() so the main rework patch can replace the call_undef_hook() in do_el0_undef(). The last patch is a bugfix for the main rework patch. I've tested this with userspace programs which use each of the deprecated instructions on Raspberry Pi 4B KVM/Qemu, and I've concurrently modified the support level for each of the features back-and-forth between HW and emulated to check that there are no oops or above repeated addition or deletion call trace. Fixes: af483947d472 ("arm64: fix oops in concurrently setting insn_emulation sysctls") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Jinjie Ruan (1): Revert "arm64: fix a concurrency issue in emulation_proc_handler()" Mark Rutland (13): arm64: die(): pass 'err' as long arm64: consistently pass ESR_ELx to die() arm64: rework FPAC exception handling arm64: rework BTI exception handling arm64: allow kprobes on EL0 handlers arm64: split EL0/EL1 UNDEF handlers arm64: factor out EL1 SSBS emulation hook arm64: factor insn read out of call_undef_hook() arm64: rework EL0 MRS emulation arm64: armv8_deprecated: fold ops into insn_emulation arm64: armv8_deprecated move emulation functions arm64: armv8_deprecated: move aarch32 helper earlier arm64: armv8_deprecated: rework deprected instruction handling Ren Zhijie (1): arm64: armv8_deprecated: fix unused-function error arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 574 +++++++++++++-------------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 +++--- 10 files changed, 395 insertions(+), 428 deletions(-) -- 2.34.1

1 15

[openEuler-1.0-LTS] kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail
by Wenyu Huang 27 Oct '23

27 Oct '23

From: Kaitao Cheng <pilgrimtao(a)gmail.com> stable inclusion from stable-4.19 commit 50f9ad607ea891a9308e67b81f774c71736d1098 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BAW8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In the function, if register_trace_sched_migrate_task() returns error, sched_switch/sched_wakeup_new/sched_wakeup won't unregister. That is why fail_deprobe_sched_switch was added. Link: http://lkml.kernel.org/r/20191231133530.2794-1-pilgrimtao@gmail.com Cc: stable(a)vger.kernel.org Fixes: 478142c39c8c2 ("tracing: do not grab lock in wakeup latency function tracing") Signed-off-by: Kaitao Cheng <pilgrimtao(a)gmail.com> Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Signed-off-by: Wenyu Huang <huangwenyu4(a)huawei.com> --- kernel/trace/trace_sched_wakeup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index 0db1b024e786..8041bd5e4262 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -642,7 +642,7 @@ static void start_wakeup_tracer(struct trace_array *tr) if (ret) { pr_info("wakeup trace: Couldn't activate tracepoint" " probe to kernel_sched_migrate_task\n"); - return; + goto fail_deprobe_sched_switch; } wakeup_reset(tr); @@ -660,6 +660,8 @@ static void start_wakeup_tracer(struct trace_array *tr) printk(KERN_ERR "failed to start wakeup tracer\n"); return; +fail_deprobe_sched_switch: + unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); fail_deprobe_wake_new: unregister_trace_sched_wakeup_new(probe_wakeup, NULL); fail_deprobe: -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS 0/6] Fix netfilter conntrack
by Lu Wei 27 Oct '23

27 Oct '23

Florian Westphal (6): netfilter: conntrack: tell compiler to not inline nf_ct_resolve_clash netfilter: conntrack: remove two args from resolve_clash netfilter: conntrack: place confirm-bit setting in a helper netfilter: conntrack: split resolve_clash function netfilter: conntrack: allow insertion of clashing entries netfilter: conntrack: do not auto-delete clash entries on reply include/linux/rculist_nulls.h | 7 + .../linux/netfilter/nf_conntrack_common.h | 12 +- net/netfilter/nf_conntrack_core.c | 202 +++++++++++++++--- net/netfilter/nf_conntrack_proto_udp.c | 7 +- net/netfilter/nft_flow_offload.c | 2 +- 5 files changed, 193 insertions(+), 37 deletions(-) -- 2.34.1

2 7

[PATCH OLK-5.10 v3 0/7] coresight: etm4x: Migrate ACPI AMBA devices to platform driver
by Junhao He 27 Oct '23

27 Oct '23

CoreSight ETM4x devices could be accessed either via MMIO (handled via amba_driver) or CPU system instructions (handled via platform driver). But this has the following issues : - Each new CPU comes up with its own PID and thus we need to keep on adding the "known" PIDs to get it working with AMBA driver. While the ETM4 architecture (and CoreSight architecture) defines way to identify a device as ETM4. Thus older kernels won't be able to "discover" a newer CPU, unless we add the PIDs. - With ACPI, the ETM4x devices have the same HID to identify the device irrespective of the mode of access. This creates a problem where two different drivers (both AMBA based driver and platform driver) would hook into the "HID" and could conflict. e.g., if AMBA driver gets hold of a non-MMIO device, the probe fails. If we have single driver hooked into the given "HID", we could handle them seamlessly, irrespective of the mode of access. - CoreSight is heavily dependent on the runtime power management. With ACPI, amba_driver doesn't get us anywhere with handling the power and thus one need to always turn the power ON to use them. Moving to platform driver gives us the power management for free. Due to all of the above, we are moving ACPI MMIO based etm4x devices to be supported via tha platform driver. The series makes the existing platform driver generic to handle both type of the access modes. Although existing AMBA driver would still continue to support DT based etm4x MMIO devices. Although some problems still remain, such as manually adding PIDs for all new AMBA DT based devices. Anshuman Khandual (4): coresight: etm4x: Allocate and device assign 'struct etmv4_drvdata' earlier coresight: etm4x: Drop iomem 'base' argument from etm4_probe() coresight: etm4x: Drop pid argument from etm4_probe() coresight: etm4x: Change etm4_platform_driver driver for MMIO devices Junhao He (1): Revert "coresight: ete: Add acpi match id for Hip09" Suzuki K Poulose (2): coresight: platform: acpi: Ignore the absence of graph coresight: etm4x: Add ACPI support in platform driver drivers/acpi/acpi_amba.c | 1 - .../coresight/coresight-etm4x-core.c | 119 ++++++++++++++---- drivers/hwtracing/coresight/coresight-etm4x.h | 4 + .../hwtracing/coresight/coresight-platform.c | 6 +- include/linux/coresight.h | 59 +++++++++ 5 files changed, 162 insertions(+), 27 deletions(-) -- 2.33.0

2 8

[PATCH OLK-5.10] preempt/dynamic: Fix setup_preempt_mode() return value
by Xia Fukun 27 Oct '23

27 Oct '23

From: Andrew Halaney <ahalaney(a)redhat.com> mainline inclusion from mainline-v6.5-rc7 commit 9ed20bafc85806ca6c97c9128cec46c3ef80ae86 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BAX7 CVE: NA -------------------------------- __setup() callbacks expect 1 for success and 0 for failure. Correct the usage here to reflect that. Fixes: 826bfeb37bb4 ("preempt/dynamic: Support dynamic preempt with preempt= boot option") Reported-by: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Andrew Halaney <ahalaney(a)redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20211203233203.133581-1-ahalaney@redhat.com Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/sched/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 5d17bffffaf4..44cfb82b4f13 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -5794,11 +5794,11 @@ static int __init setup_preempt_mode(char *str) int mode = sched_dynamic_mode(str); if (mode < 0) { pr_warn("Dynamic Preempt: unsupported mode: %s\n", str); - return 1; + return 0; } sched_dynamic_update(mode); - return 0; + return 1; } __setup("preempt=", setup_preempt_mode); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-44033
by Zhang Xiaoxu 27 Oct '23

27 Oct '23

Jiri Slaby (2): tty: ipwireless: move Kconfig entry to tty char: pcmcia: remove all the drivers Documentation/ioctl/ioctl-number.txt | 1 - Documentation/process/magic-number.rst | 1 - .../translations/zh_CN/magic-number.txt | 1 - MAINTAINERS | 17 - arch/powerpc/configs/ppc6xx_defconfig | 2 - drivers/char/Kconfig | 2 - drivers/char/Makefile | 1 - drivers/char/pcmcia/Kconfig | 67 - drivers/char/pcmcia/Makefile | 10 - drivers/char/pcmcia/cm4000_cs.c | 1920 -------- drivers/char/pcmcia/cm4040_cs.c | 685 --- drivers/char/pcmcia/cm4040_cs.h | 48 - drivers/char/pcmcia/scr24x_cs.c | 373 -- drivers/char/pcmcia/synclink_cs.c | 4305 ----------------- drivers/tty/Kconfig | 9 + include/linux/cm4000_cs.h | 11 - include/uapi/linux/cm4000_cs.h | 64 - 17 files changed, 9 insertions(+), 7508 deletions(-) delete mode 100644 drivers/char/pcmcia/Kconfig delete mode 100644 drivers/char/pcmcia/Makefile delete mode 100644 drivers/char/pcmcia/cm4000_cs.c delete mode 100644 drivers/char/pcmcia/cm4040_cs.c delete mode 100644 drivers/char/pcmcia/cm4040_cs.h delete mode 100644 drivers/char/pcmcia/scr24x_cs.c delete mode 100644 drivers/char/pcmcia/synclink_cs.c delete mode 100644 include/linux/cm4000_cs.h delete mode 100644 include/uapi/linux/cm4000_cs.h -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS 0/2] CVE-2022-44033
by Zhang Xiaoxu 27 Oct '23

27 Oct '23

Jiri Slaby (2): tty: ipwireless: move Kconfig entry to tty char: pcmcia: remove all the drivers Documentation/process/magic-number.rst | 1 - .../it_IT/process/magic-number.rst | 1 - .../zh_CN/process/magic-number.rst | 1 - .../userspace-api/ioctl/ioctl-number.rst | 1 - MAINTAINERS | 17 - arch/powerpc/configs/ppc6xx_defconfig | 2 - drivers/char/Kconfig | 2 - drivers/char/Makefile | 1 - drivers/char/pcmcia/Kconfig | 68 - drivers/char/pcmcia/Makefile | 11 - drivers/char/pcmcia/cm4000_cs.c | 1912 -------- drivers/char/pcmcia/cm4040_cs.c | 685 --- drivers/char/pcmcia/cm4040_cs.h | 48 - drivers/char/pcmcia/scr24x_cs.c | 360 -- drivers/char/pcmcia/synclink_cs.c | 4304 ----------------- drivers/tty/Kconfig | 9 + include/linux/cm4000_cs.h | 11 - include/uapi/linux/cm4000_cs.h | 64 - 18 files changed, 9 insertions(+), 7489 deletions(-) delete mode 100644 drivers/char/pcmcia/Kconfig delete mode 100644 drivers/char/pcmcia/Makefile delete mode 100644 drivers/char/pcmcia/cm4000_cs.c delete mode 100644 drivers/char/pcmcia/cm4040_cs.c delete mode 100644 drivers/char/pcmcia/cm4040_cs.h delete mode 100644 drivers/char/pcmcia/scr24x_cs.c delete mode 100644 drivers/char/pcmcia/synclink_cs.c delete mode 100644 include/linux/cm4000_cs.h delete mode 100644 include/uapi/linux/cm4000_cs.h -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS 0/2] CVE-2022-44033
by Zhang Xiaoxu 27 Oct '23

27 Oct '23

Jiri Slaby (2): tty: ipwireless: move Kconfig entry to tty char: pcmcia: remove all the drivers Documentation/process/magic-number.rst | 1 - .../it_IT/process/magic-number.rst | 1 - .../zh_CN/process/magic-number.rst | 1 - .../userspace-api/ioctl/ioctl-number.rst | 1 - MAINTAINERS | 17 - arch/powerpc/configs/ppc6xx_defconfig | 2 - drivers/char/Kconfig | 2 - drivers/char/Makefile | 1 - drivers/char/pcmcia/Kconfig | 68 - drivers/char/pcmcia/Makefile | 11 - drivers/char/pcmcia/cm4000_cs.c | 1912 -------- drivers/char/pcmcia/cm4040_cs.c | 685 --- drivers/char/pcmcia/cm4040_cs.h | 48 - drivers/char/pcmcia/scr24x_cs.c | 360 -- drivers/char/pcmcia/synclink_cs.c | 4304 ----------------- drivers/tty/Kconfig | 9 + include/linux/cm4000_cs.h | 11 - include/uapi/linux/cm4000_cs.h | 64 - 18 files changed, 9 insertions(+), 7489 deletions(-) delete mode 100644 drivers/char/pcmcia/Kconfig delete mode 100644 drivers/char/pcmcia/Makefile delete mode 100644 drivers/char/pcmcia/cm4000_cs.c delete mode 100644 drivers/char/pcmcia/cm4040_cs.c delete mode 100644 drivers/char/pcmcia/cm4040_cs.h delete mode 100644 drivers/char/pcmcia/scr24x_cs.c delete mode 100644 drivers/char/pcmcia/synclink_cs.c delete mode 100644 include/linux/cm4000_cs.h delete mode 100644 include/uapi/linux/cm4000_cs.h -- 2.34.1

2 3

[PATCH OLK-5.10 v4 0/6] Synchronize coresight driver bugfix patches to openEuler
by Junhao He 26 Oct '23

26 Oct '23

1. Fix memory leak coresight: Fix memory leak in acpi_buffer->pointer 2. Fix TRBE bug coresight: trbe: Fix TRBE potential sleep in atomic context coresight: trbe: Allocate platform data per device coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() 3. Fix ETR bug coresight: Fix run time warnings while reusing ETR buffer coresight: tmc-etr: Disable warnings for allocation failures Junhao He (2): coresight: Fix memory leak in acpi_buffer->pointer coresight: trbe: Fix TRBE potential sleep in atomic context Linu Cherian (1): coresight: Fix run time warnings while reusing ETR buffer Suzuki K Poulose (2): coresight: trbe: Allocate platform data per device coresight: tmc-etr: Disable warnings for allocation failures Wei Yongjun (1): coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() .../hwtracing/coresight/coresight-platform.c | 46 ++++++++++++------- .../hwtracing/coresight/coresight-tmc-etr.c | 23 +++++----- drivers/hwtracing/coresight/coresight-trbe.c | 41 ++++++++--------- 3 files changed, 62 insertions(+), 48 deletions(-) -- 2.33.0

2 7

[PATCH OLK-5.10 0/7] coresight: etm4x: Migrate ACPI AMBA devices to platform driver
by Junhao He 26 Oct '23

26 Oct '23

CoreSight ETM4x devices could be accessed either via MMIO (handled via amba_driver) or CPU system instructions (handled via platform driver). But this has the following issues : - Each new CPU comes up with its own PID and thus we need to keep on adding the "known" PIDs to get it working with AMBA driver. While the ETM4 architecture (and CoreSight architecture) defines way to identify a device as ETM4. Thus older kernels won't be able to "discover" a newer CPU, unless we add the PIDs. - With ACPI, the ETM4x devices have the same HID to identify the device irrespective of the mode of access. This creates a problem where two different drivers (both AMBA based driver and platform driver) would hook into the "HID" and could conflict. e.g., if AMBA driver gets hold of a non-MMIO device, the probe fails. If we have single driver hooked into the given "HID", we could handle them seamlessly, irrespective of the mode of access. - CoreSight is heavily dependent on the runtime power management. With ACPI, amba_driver doesn't get us anywhere with handling the power and thus one need to always turn the power ON to use them. Moving to platform driver gives us the power management for free. Due to all of the above, we are moving ACPI MMIO based etm4x devices to be supported via tha platform driver. The series makes the existing platform driver generic to handle both type of the access modes. Although existing AMBA driver would still continue to support DT based etm4x MMIO devices. Although some problems still remain, such as manually adding PIDs for all new AMBA DT based devices. Anshuman Khandual (4): coresight: etm4x: Allocate and device assign 'struct etmv4_drvdata' earlier coresight: etm4x: Drop iomem 'base' argument from etm4_probe() coresight: etm4x: Drop pid argument from etm4_probe() coresight: etm4x: Change etm4_platform_driver driver for MMIO devices Chengchang Tang (1): RDMA/hns: Add support for RDMA VF over UBL Junhao He (1): Revert "coresight: ete: Add acpi match id for Hip09" Suzuki K Poulose (1): coresight: platform: acpi: Ignore the absence of graph -- 2.33.0

2 8

[PATCH OLK-5.10 v2 0/7] coresight: etm4x: Migrate ACPI AMBA devices to platform driver
by Junhao He 26 Oct '23

26 Oct '23

CoreSight ETM4x devices could be accessed either via MMIO (handled via amba_driver) or CPU system instructions (handled via platform driver). But this has the following issues : - Each new CPU comes up with its own PID and thus we need to keep on adding the "known" PIDs to get it working with AMBA driver. While the ETM4 architecture (and CoreSight architecture) defines way to identify a device as ETM4. Thus older kernels won't be able to "discover" a newer CPU, unless we add the PIDs. - With ACPI, the ETM4x devices have the same HID to identify the device irrespective of the mode of access. This creates a problem where two different drivers (both AMBA based driver and platform driver) would hook into the "HID" and could conflict. e.g., if AMBA driver gets hold of a non-MMIO device, the probe fails. If we have single driver hooked into the given "HID", we could handle them seamlessly, irrespective of the mode of access. - CoreSight is heavily dependent on the runtime power management. With ACPI, amba_driver doesn't get us anywhere with handling the power and thus one need to always turn the power ON to use them. Moving to platform driver gives us the power management for free. Due to all of the above, we are moving ACPI MMIO based etm4x devices to be supported via tha platform driver. The series makes the existing platform driver generic to handle both type of the access modes. Although existing AMBA driver would still continue to support DT based etm4x MMIO devices. Although some problems still remain, such as manually adding PIDs for all new AMBA DT based devices. Anshuman Khandual (4): coresight: etm4x: Allocate and device assign 'struct etmv4_drvdata' earlier coresight: etm4x: Drop iomem 'base' argument from etm4_probe() coresight: etm4x: Drop pid argument from etm4_probe() coresight: etm4x: Change etm4_platform_driver driver for MMIO devices Junhao He (1): Revert "coresight: ete: Add acpi match id for Hip09" Suzuki K Poulose (2): coresight: platform: acpi: Ignore the absence of graph coresight: etm4x: Add ACPI support in platform driver drivers/acpi/acpi_amba.c | 1 - .../coresight/coresight-etm4x-core.c | 119 ++++++++++++++---- drivers/hwtracing/coresight/coresight-etm4x.h | 4 + .../hwtracing/coresight/coresight-platform.c | 6 +- include/linux/coresight.h | 59 +++++++++ 5 files changed, 162 insertions(+), 27 deletions(-) -- 2.33.0

1 7

[PATCH openEuler-1.0-LTS 0/2] Expose SVE2 features for userspace
by Yu Liao 26 Oct '23

26 Oct '23

Andrew Murray (1): arm64: HWCAP: add support for AT_HWCAP2 Dave Martin (1): arm64: Expose SVE2 features for userspace Documentation/arm64/cpu-feature-registers.txt | 16 ++++ Documentation/arm64/elf_hwcaps.txt | 37 ++++++++- Documentation/arm64/sve.txt | 17 ++++ arch/arm64/Kconfig | 3 + arch/arm64/crypto/aes-ce-ccm-glue.c | 2 +- arch/arm64/crypto/aes-neonbs-glue.c | 2 +- arch/arm64/crypto/chacha20-neon-glue.c | 2 +- arch/arm64/crypto/ghash-ce-glue.c | 6 +- arch/arm64/crypto/sha256-glue.c | 4 +- arch/arm64/include/asm/cpufeature.h | 22 +++--- arch/arm64/include/asm/hwcap.h | 55 ++++++++++++- arch/arm64/include/asm/sysreg.h | 14 ++++ arch/arm64/include/uapi/asm/hwcap.h | 12 ++- arch/arm64/kernel/cpufeature.c | 77 +++++++++++-------- arch/arm64/kernel/cpuinfo.c | 12 ++- arch/arm64/kernel/fpsimd.c | 4 +- drivers/clocksource/arm_arch_timer.c | 8 ++ 17 files changed, 236 insertions(+), 57 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2023-5717
by Yang Jihong 26 Oct '23

26 Oct '23

Peter Zijlstra (1): perf: Disallow mis-matched inherited group reads Yang Jihong (1): perf: Fix kabi breakage in struct perf_event include/linux/perf_event.h | 4 ++++ kernel/events/core.c | 40 ++++++++++++++++++++++++++++++++------ 2 files changed, 38 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 1/2] perf: Disallow mis-matched inherited group reads
by Yang Jihong 26 Oct '23

26 Oct '23

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-v4.19.297 commit a714491fa92d2068358dd603cc50bf2062517bd8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8B1X3 CVE: CVE-2023-5717 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- commit 32671e3799ca2e4590773fd0e63aaa4229e50c06 upstream. Because group consistency is non-atomic between parent (filedesc) and children (inherited) events, it is possible for PERF_FORMAT_GROUP read() to try and sum non-matching counter groups -- with non-sensical results. Add group_generation to distinguish the case where a parent group removes and adds an event and thus has the same number, but a different configuration of events as inherited groups. This became a problem when commit fa8c269353d5 ("perf/core: Invert perf_read_group() loops") flipped the order of child_list and sibling_list. Previously it would iterate the group (sibling_list) first, and for each sibling traverse the child_list. In this order, only the group composition of the parent is relevant. By flipping the order the group composition of the child (inherited) events becomes an issue and the mis-match in group composition becomes evident. That said; even prior to this commit, while reading of a group that is not equally inherited was not broken, it still made no sense. (Ab)use ECHILD as error return to indicate issues with child process group composition. Fixes: fa8c269353d5 ("perf/core: Invert perf_read_group() loops") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20231018115654.GK33217@noisy.programming.kicks-as… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Jihong <yangjihong1(a)huawei.com> --- include/linux/perf_event.h | 1 + kernel/events/core.c | 40 ++++++++++++++++++++++++++++++++------ 2 files changed, 35 insertions(+), 6 deletions(-) diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h index 514962a49c62..a4bee4a4ae13 100644 --- a/include/linux/perf_event.h +++ b/include/linux/perf_event.h @@ -622,6 +622,7 @@ struct perf_event { /* The cumulative AND of all event_caps for events in this group. */ int group_caps; + unsigned int group_generation; struct perf_event *group_leader; struct pmu *pmu; void *pmu_private; diff --git a/kernel/events/core.c b/kernel/events/core.c index 5407c5ef7da8..a49860879777 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -1843,6 +1843,7 @@ static void perf_group_attach(struct perf_event *event) list_add_tail(&event->sibling_list, &group_leader->sibling_list); group_leader->nr_siblings++; + group_leader->group_generation++; perf_event__header_size(group_leader); @@ -1934,6 +1935,7 @@ static void perf_group_detach(struct perf_event *event) if (leader != event) { list_del_init(&event->sibling_list); event->group_leader->nr_siblings--; + event->group_leader->group_generation++; goto out; } @@ -4761,7 +4763,7 @@ static int __perf_read_group_add(struct perf_event *leader, u64 read_format, u64 *values) { struct perf_event_context *ctx = leader->ctx; - struct perf_event *sub; + struct perf_event *sub, *parent; unsigned long flags; int n = 1; /* skip @nr */ int ret; @@ -4771,6 +4773,33 @@ static int __perf_read_group_add(struct perf_event *leader, return ret; raw_spin_lock_irqsave(&ctx->lock, flags); + /* + * Verify the grouping between the parent and child (inherited) + * events is still in tact. + * + * Specifically: + * - leader->ctx->lock pins leader->sibling_list + * - parent->child_mutex pins parent->child_list + * - parent->ctx->mutex pins parent->sibling_list + * + * Because parent->ctx != leader->ctx (and child_list nests inside + * ctx->mutex), group destruction is not atomic between children, also + * see perf_event_release_kernel(). Additionally, parent can grow the + * group. + * + * Therefore it is possible to have parent and child groups in a + * different configuration and summing over such a beast makes no sense + * what so ever. + * + * Reject this. + */ + parent = leader->parent; + if (parent && + (parent->group_generation != leader->group_generation || + parent->nr_siblings != leader->nr_siblings)) { + ret = -ECHILD; + goto unlock; + } /* * Since we co-schedule groups, {enabled,running} times of siblings @@ -4800,8 +4829,9 @@ static int __perf_read_group_add(struct perf_event *leader, values[n++] = primary_event_id(sub); } +unlock: raw_spin_unlock_irqrestore(&ctx->lock, flags); - return 0; + return ret; } static int perf_read_group(struct perf_event *event, @@ -4820,10 +4850,6 @@ static int perf_read_group(struct perf_event *event, values[0] = 1 + leader->nr_siblings; - /* - * By locking the child_mutex of the leader we effectively - * lock the child list of all siblings.. XXX explain how. - */ mutex_lock(&leader->child_mutex); ret = __perf_read_group_add(leader, read_format, values); @@ -11679,6 +11705,8 @@ static int inherit_group(struct perf_event *parent_event, if (IS_ERR(child_ctr)) return PTR_ERR(child_ctr); } + if (leader) + leader->group_generation = parent_event->group_generation; return 0; } -- 2.34.1

2 3

[PATCH v5] libhns: Skip resolving MAC for RDMA over UBLink
by Chengchang Tang 26 Oct '23

26 Oct '23

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8AL44 For RDMA over UBLink, MAC Layer if replaced by UBLink, and thus the MAC addr is not nedded. So skip the MAC addr resolving for this mode. Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Signed-off-by: Haoyue Xu <xuhaoyue1(a)hisilicon.com> Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> --- providers/hns/hns_roce_u.c | 37 +++++++++++++++++++++++++++++++- providers/hns/hns_roce_u.h | 9 ++++---- providers/hns/hns_roce_u_hw_v2.c | 2 +- providers/hns/hns_roce_u_verbs.c | 3 ++- 4 files changed, 44 insertions(+), 7 deletions(-) diff --git a/providers/hns/hns_roce_u.c b/providers/hns/hns_roce_u.c index 02ad880..cef64ec 100644 --- a/providers/hns/hns_roce_u.c +++ b/providers/hns/hns_roce_u.c @@ -56,6 +56,7 @@ static const struct verbs_match_ent hca_table[] = { VERBS_PCI_MATCH(PCI_VENDOR_ID_HUAWEI, 0xA22C, &hns_roce_u_hw_v2), VERBS_PCI_MATCH(PCI_VENDOR_ID_HUAWEI, 0xA22D, &hns_roce_u_hw_v2), VERBS_PCI_MATCH(PCI_VENDOR_ID_HUAWEI, 0xA22F, &hns_roce_u_hw_v2), + VERBS_PCI_MATCH(PCI_VENDOR_ID_HUAWEI, 0xA26A, &hns_roce_u_hw_v2), {} }; @@ -95,6 +96,23 @@ static const struct verbs_context_ops hns_common_ops = { .alloc_parent_domain = hns_roce_u_alloc_pad, }; +static struct { + uint32_t device_id; + enum hns_device_link_type link_type; +} device_link_types[] = { + {0xA222, HNS_DEV_LINK_TYPE_ETH}, + {0xA223, HNS_DEV_LINK_TYPE_ETH}, + {0xA224, HNS_DEV_LINK_TYPE_ETH}, + {0xA225, HNS_DEV_LINK_TYPE_ETH}, + {0xA226, HNS_DEV_LINK_TYPE_ETH}, + {0xA228, HNS_DEV_LINK_TYPE_ETH}, + {0xA22F, HNS_DEV_LINK_TYPE_ETH}, + {0xA227, HNS_DEV_LINK_TYPE_HCCS}, + {0xA22C, HNS_DEV_LINK_TYPE_HCCS}, + {0xA22D, HNS_DEV_LINK_TYPE_HCCS}, + {0xA26A, HNS_DEV_LINK_TYPE_UB} +}; + static int mmap_dca(struct hns_roce_context *ctx, int cmd_fd, int page_size, size_t size, uint64_t mmap_key) { @@ -256,6 +274,21 @@ static int hns_roce_mmap(struct hns_roce_device *hr_dev, return 0; } +static int get_link_type(uint32_t device_id, + enum hns_device_link_type *link_type) +{ + int i; + + for (i = 0; i < ARRAY_SIZE(device_link_types); i++) { + if (device_id == device_link_types[i].device_id) { + *link_type = device_link_types[i].link_type; + return 0; + } + } + + return ENOENT; +} + static uint32_t calc_table_shift(uint32_t entry_count, uint32_t size_shift) { uint32_t count_shift = hr_ilog32(entry_count); @@ -302,7 +335,6 @@ static struct verbs_context *hns_roce_alloc_context(struct ibv_device *ibdev, &resp.ibv_resp, sizeof(resp))) goto err_free; - hr_dev->mac_type = resp.mac_type; hr_dev->congest_type = resp.congest_type; if (!resp.cqe_size) @@ -338,6 +370,9 @@ static struct verbs_context *hns_roce_alloc_context(struct ibv_device *ibdev, goto err_free; hr_dev->hw_version = dev_attrs.hw_ver; + if (get_link_type(dev_attrs.vendor_part_id, &hr_dev->link_type)) + hr_dev->link_type = resp.mac_type; + context->max_qp_wr = dev_attrs.max_qp_wr; context->max_sge = dev_attrs.max_sge; context->max_cqe = dev_attrs.max_cqe; diff --git a/providers/hns/hns_roce_u.h b/providers/hns/hns_roce_u.h index 3491097..e7313c2 100644 --- a/providers/hns/hns_roce_u.h +++ b/providers/hns/hns_roce_u.h @@ -161,9 +161,10 @@ enum { #define HNS_ROCE_SRQ_TABLE_BITS 8 #define HNS_ROCE_SRQ_TABLE_SIZE BIT(HNS_ROCE_SRQ_TABLE_BITS) -enum { - HNAE3_MAC_ETH, - HNAE3_MAC_ROH, +enum hns_device_link_type { + HNS_DEV_LINK_TYPE_ETH, + HNS_DEV_LINK_TYPE_HCCS, + HNS_DEV_LINK_TYPE_UB, }; struct hns_roce_device { @@ -171,7 +172,7 @@ struct hns_roce_device { int page_size; const struct hns_roce_u_hw *u_hw; int hw_version; - uint8_t mac_type; + enum hns_device_link_type link_type; uint8_t congest_type; }; diff --git a/providers/hns/hns_roce_u_hw_v2.c b/providers/hns/hns_roce_u_hw_v2.c index 61c4981..fe7e1ac 100644 --- a/providers/hns/hns_roce_u_hw_v2.c +++ b/providers/hns/hns_roce_u_hw_v2.c @@ -1431,7 +1431,7 @@ static int set_ud_wqe(void *wqe, struct hns_roce_qp *qp, struct ibv_send_wr *wr, if (ret) return ret; - if (hr_dev->mac_type == HNAE3_MAC_ROH) + if (hr_dev->link_type == HNS_DEV_LINK_TYPE_HCCS) ud_sq_wqe->dmac[0] = 0xFF; ret = fill_ud_data_seg(ud_sq_wqe, qp, wr, sge_info); diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c index b9be376..abeb1ab 100644 --- a/providers/hns/hns_roce_u_verbs.c +++ b/providers/hns/hns_roce_u_verbs.c @@ -2018,7 +2018,8 @@ struct ibv_ah *hns_roce_u_create_ah(struct ibv_pd *pd, struct ibv_ah_attr *attr) if (ibv_cmd_create_ah(pd, &ah->ibv_ah, attr, &resp.ibv_resp, sizeof(resp))) goto err; - if (ibv_resolve_eth_l2_from_gid(pd->context, attr, ah->av.mac, NULL)) + if (hr_dev->link_type != HNS_DEV_LINK_TYPE_UB && + ibv_resolve_eth_l2_from_gid(pd->context, attr, ah->av.mac, NULL)) goto err; if (resp.tc_mode == HNS_ROCE_TC_MAP_MODE_DSCP) -- 2.30.0

1 2

[PATCH OLK-5.10] LoongArch: default IPMI related defconfig to m
by Hongchen Zhang 26 Oct '23

26 Oct '23

LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8B19Y ------------------------------------------ Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/configs/loongson3_defconfig | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/arch/loongarch/configs/loongson3_defconfig b/arch/loongarch/configs/loongson3_defconfig index ec53e95bf30d..d2beed31ab74 100644 --- a/arch/loongarch/configs/loongson3_defconfig +++ b/arch/loongarch/configs/loongson3_defconfig @@ -512,8 +512,6 @@ CONFIG_NET_CLS_FW=m CONFIG_NET_CLS_U32=m CONFIG_CLS_U32_PERF=y CONFIG_CLS_U32_MARK=y -CONFIG_NET_CLS_RSVP=m -CONFIG_NET_CLS_RSVP6=m CONFIG_NET_CLS_FLOW=m CONFIG_NET_CLS_CGROUP=y CONFIG_NET_CLS_BPF=m @@ -1143,14 +1141,13 @@ CONFIG_NOZOMI=m CONFIG_PRINTER=m CONFIG_PPDEV=m CONFIG_VIRTIO_CONSOLE=y -CONFIG_IPMI_HANDLER=y +CONFIG_IPMI_HANDLER=m CONFIG_IPMI_PANIC_EVENT=y CONFIG_IPMI_PANIC_STRING=y -CONFIG_IPMI_DEVICE_INTERFACE=y -CONFIG_IPMI_SI=y -CONFIG_IPMI_SSIF=y -CONFIG_IPMI_WATCHDOG=y -CONFIG_IPMI_POWEROFF=y +CONFIG_IPMI_DEVICE_INTERFACE=m +CONFIG_IPMI_SSIF=m +CONFIG_IPMI_WATCHDOG=m +CONFIG_IPMI_POWEROFF=m CONFIG_HW_RANDOM=y CONFIG_HW_RANDOM_TIMERIOMEM=m CONFIG_HW_RANDOM_VIRTIO=m @@ -1510,6 +1507,7 @@ CONFIG_DRM_CIRRUS_QEMU=m CONFIG_FB_TILEBLITTING=y CONFIG_FB_EFI=y CONFIG_FB_RADEON=y +CONFIG_FB_SIMPLE=y CONFIG_FB_LS2K500=m CONFIG_LCD_CLASS_DEVICE=m CONFIG_LCD_PLATFORM=m -- 2.33.0

2 1

[PATCH v3 OLK-5.10 00/28] Introduce some vdpa ops to support vdpa device live migrate
by Jiang Dongxu 26 Oct '23

26 Oct '23

From: jiangdongxu <jiangdongxu1(a)huawei.com> Patch 1-17: some bugfix and ops intruduced by upstream Patch 18-19: introduce vdpa device logging ops Patch 20-21: introduce vdpa device state ops Patch 22-23: introduce vdpa device migrate state ops Patch 24: introduce new vhost feature BYTEPMAPLOG Patch 25: export iommu_get_resv_regions/iommu_set_resv_regions Patch 26-27: some optimization about vhost-vdpa Patch 28: add vdpa/vhost-vdpa build config Arnaldo Carvalho de Melo (1): tools include UAPI: Sync linux/vhost.h with the kernel sources Cindy Lu (2): vhost_vdpa: fix the crash in unmap a large memory vhost_vdpa: fix unmap process in no-batch mode Eugenio Pérez (1): vdpa: add get_backend_features vdpa operation Gautam Dawar (1): vhost-vdpa: free iommu domain after last use during cleanup Greg Kroah-Hartman (1): vhost-vdpa: vhost_vdpa_alloc_domain() should be using a const struct bus_type * Jason Gunthorpe (1): PCI/IOV: Add pci_iov_vf_id() to get VF index Sebastien Boeuf (3): vdpa: Add resume operation vhost-vdpa: Introduce RESUME backend feature bit vhost-vdpa: uAPI to resume the device Shannon Nelson (2): vhost_vdpa: tell vqs about the negotiated vhost_vdpa: support PACKED when setting-getting vring_base Shunsuke Mie (1): virtio: fix virtio transitional ids Stefano Garzarella (3): vhost-vdpa: fix an iotlb memory leak vdpa: add bind_mm/unbind_mm callbacks vhost-vdpa: use bind_mm/unbind_mm device callbacks Zhu Lingshan (1): virtio: update virtio id table, add transitional ids jiangdongxu (11): vdpa: add log operations vhost-vdpa: add uAPI for logging vdpa: add device state operations vhost-vdpa: add uAPI for device buffer vdpa: add vdpa device migration status ops vhost-vdpa: add uAPI for device migration status vhost: add VHOST feature VHOST_BACKEND_F_BYTEMAPLOG export iommu_get_resv_regions and iommu_set_resv_regions vhost-vdpa: Allow transparent MSI IOV vhost-vdpa: fix msi irq request err arm64: openeuler_defconfig: add VDPA config arch/arm64/configs/openeuler_defconfig | 6 +- drivers/iommu/iommu.c | 2 + drivers/pci/iov.c | 14 + drivers/vhost/vdpa.c | 385 ++++++++++++++++++++++--- include/linux/pci.h | 8 +- include/linux/vdpa.h | 60 +++- include/uapi/linux/vhost.h | 20 ++ include/uapi/linux/vhost_types.h | 21 ++ include/uapi/linux/virtio_ids.h | 12 + tools/include/uapi/linux/vhost.h | 8 + 10 files changed, 490 insertions(+), 46 deletions(-) -- 2.27.0

2 29

[PATCH openEuler-1.0-LTS] media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
by Peng Zhang 26 Oct '23

26 Oct '23

From: Hyunwoo Kim <v4bel(a)theori.io> mainline inclusion from mainline-v6.4-rc3 commit 280a8ab81733da8bc442253c700a52c4c0886ffd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I63D3C CVE: CVE-2022-45919 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- If the device node of dvb_ca_en50221 is open() and the device is disconnected, a UAF may occur when calling close() on the device node. The root cause is that wake_up() and wait_event() for dvbdev->wait_queue are not implemented. So implement wait_event() function in dvb_ca_en50221_release() and add 'remove_mutex' which prevents race condition for 'ca->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/media/dvb-core/dvb_ca_en50221.c | 37 ++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c index 4d371cea0d5d..fe152007c963 100644 --- a/drivers/media/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb-core/dvb_ca_en50221.c @@ -162,6 +162,12 @@ struct dvb_ca_private { /* mutex serializing ioctls */ struct mutex ioctl_mutex; + + /* A mutex used when a device is disconnected */ + struct mutex remove_mutex; + + /* Whether the device is disconnected */ + int exit; }; static void dvb_ca_private_free(struct dvb_ca_private *ca) @@ -1717,12 +1723,22 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) dprintk("%s\n", __func__); - if (!try_module_get(ca->pub->owner)) + mutex_lock(&ca->remove_mutex); + + if (ca->exit) { + mutex_unlock(&ca->remove_mutex); + return -ENODEV; + } + + if (!try_module_get(ca->pub->owner)) { + mutex_unlock(&ca->remove_mutex); return -EIO; + } err = dvb_generic_open(inode, file); if (err < 0) { module_put(ca->pub->owner); + mutex_unlock(&ca->remove_mutex); return err; } @@ -1747,6 +1763,7 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) dvb_ca_private_get(ca); + mutex_unlock(&ca->remove_mutex); return 0; } @@ -1766,6 +1783,8 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) dprintk("%s\n", __func__); + mutex_lock(&ca->remove_mutex); + /* mark the CA device as closed */ ca->open = 0; dvb_ca_en50221_thread_update_delay(ca); @@ -1776,6 +1795,13 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) dvb_ca_private_put(ca); + if (dvbdev->users == 1 && ca->exit == 1) { + mutex_unlock(&ca->remove_mutex); + wake_up(&dvbdev->wait_queue); + } else { + mutex_unlock(&ca->remove_mutex); + } + return err; } @@ -1900,6 +1926,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter, } mutex_init(&ca->ioctl_mutex); + mutex_init(&ca->remove_mutex); if (signal_pending(current)) { ret = -EINTR; @@ -1942,6 +1969,14 @@ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca) dprintk("%s\n", __func__); + mutex_lock(&ca->remove_mutex); + ca->exit = 1; + mutex_unlock(&ca->remove_mutex); + + if (ca->dvbdev->users < 1) + wait_event(ca->dvbdev->wait_queue, + ca->dvbdev->users == 1); + /* shutdown the thread if there was one */ kthread_stop(ca->thread); -- 2.25.1

2 1

[PATCH OLK-5.10] media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
by Peng Zhang 26 Oct '23

26 Oct '23

From: Hyunwoo Kim <v4bel(a)theori.io> mainline inclusion from mainline-v6.4-rc3 commit 280a8ab81733da8bc442253c700a52c4c0886ffd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I63D3C CVE: CVE-2022-45919 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- If the device node of dvb_ca_en50221 is open() and the device is disconnected, a UAF may occur when calling close() on the device node. The root cause is that wake_up() and wait_event() for dvbdev->wait_queue are not implemented. So implement wait_event() function in dvb_ca_en50221_release() and add 'remove_mutex' which prevents race condition for 'ca->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/media/dvb-core/dvb_ca_en50221.c | 37 ++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c index fd476536d32e..a8b4247cb5e4 100644 --- a/drivers/media/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb-core/dvb_ca_en50221.c @@ -151,6 +151,12 @@ struct dvb_ca_private { /* mutex serializing ioctls */ struct mutex ioctl_mutex; + + /* A mutex used when a device is disconnected */ + struct mutex remove_mutex; + + /* Whether the device is disconnected */ + int exit; }; static void dvb_ca_private_free(struct dvb_ca_private *ca) @@ -1706,12 +1712,22 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) dprintk("%s\n", __func__); - if (!try_module_get(ca->pub->owner)) + mutex_lock(&ca->remove_mutex); + + if (ca->exit) { + mutex_unlock(&ca->remove_mutex); + return -ENODEV; + } + + if (!try_module_get(ca->pub->owner)) { + mutex_unlock(&ca->remove_mutex); return -EIO; + } err = dvb_generic_open(inode, file); if (err < 0) { module_put(ca->pub->owner); + mutex_unlock(&ca->remove_mutex); return err; } @@ -1736,6 +1752,7 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) dvb_ca_private_get(ca); + mutex_unlock(&ca->remove_mutex); return 0; } @@ -1755,6 +1772,8 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) dprintk("%s\n", __func__); + mutex_lock(&ca->remove_mutex); + /* mark the CA device as closed */ ca->open = 0; dvb_ca_en50221_thread_update_delay(ca); @@ -1765,6 +1784,13 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) dvb_ca_private_put(ca); + if (dvbdev->users == 1 && ca->exit == 1) { + mutex_unlock(&ca->remove_mutex); + wake_up(&dvbdev->wait_queue); + } else { + mutex_unlock(&ca->remove_mutex); + } + return err; } @@ -1888,6 +1914,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter, } mutex_init(&ca->ioctl_mutex); + mutex_init(&ca->remove_mutex); if (signal_pending(current)) { ret = -EINTR; @@ -1930,6 +1957,14 @@ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca) dprintk("%s\n", __func__); + mutex_lock(&ca->remove_mutex); + ca->exit = 1; + mutex_unlock(&ca->remove_mutex); + + if (ca->dvbdev->users < 1) + wait_event(ca->dvbdev->wait_queue, + ca->dvbdev->users == 1); + /* shutdown the thread if there was one */ kthread_stop(ca->thread); -- 2.25.1

2 3

[PATCH OLK-5.10 v3 0/8] Synchronize coresight driver bugfix patches to openEuler
by Junhao He 26 Oct '23

26 Oct '23

1. Fix memory leak coresight: Fix memory leak in acpi_buffer->pointer 2. Fix TRBE bug coresight: trbe: Fix TRBE potential sleep in atomic context coresight: trbe: Allocate platform data per device coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() 3. Fix ETR bug coresight: Fix run time warnings while reusing ETR buffer coresight: tmc-etr: Disable warnings for allocation failures 4. acpi: Ignore the absence of graph coresight: platform: acpi: Ignore the absence of graph Revert "coresight: Return the pointer of @pdata when not "fwnode"" Junhao He (3): Revert "coresight: Return the pointer of @pdata when not "fwnode"" coresight: Fix memory leak in acpi_buffer->pointer coresight: trbe: Fix TRBE potential sleep in atomic context Linu Cherian (1): coresight: Fix run time warnings while reusing ETR buffer Suzuki K Poulose (3): coresight: trbe: Allocate platform data per device coresight: platform: acpi: Ignore the absence of graph coresight: tmc-etr: Disable warnings for allocation failures Wei Yongjun (1): coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() .../hwtracing/coresight/coresight-platform.c | 56 ++++++++++++------- .../hwtracing/coresight/coresight-tmc-etr.c | 23 ++++---- drivers/hwtracing/coresight/coresight-trbe.c | 41 +++++++------- 3 files changed, 69 insertions(+), 51 deletions(-) -- 2.33.0

2 9

openEuler Kernel SIG双周例会
by openEuler conference 26 Oct '23

26 Oct '23

您好！ Kernel SIG 邀请您参加 2023-10-27 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（有新增议题可直接回复邮件申报，或录入会议看板）会议链接：https://bmeeting.huaweicloud.com:36443/#/j/965660880 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the WeLink conference(auto recording) will be held at 2023-10-27 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（有新增议题可直接回复邮件申报，或录入会议看板） You can join the meeting at https://bmeeting.huaweicloud.com:36443/#/j/965660880. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH OLK-5.10] media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
by Peng Zhang 26 Oct '23

26 Oct '23

From: Hyunwoo Kim <v4bel(a)theori.io> mainline inclusion from mainline-v6.4-rc3 commit 280a8ab81733da8bc442253c700a52c4c0886ffd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I63D3C CVE: CVE-2022-45919 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- If the device node of dvb_ca_en50221 is open() and the device is disconnected, a UAF may occur when calling close() on the device node. The root cause is that wake_up() and wait_event() for dvbdev->wait_queue are not implemented. So implement wait_event() function in dvb_ca_en50221_release() and add 'remove_mutex' which prevents race condition for 'ca->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/media/dvb-core/dvb_ca_en50221.c | 37 ++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c index fd476536d32e..a8b4247cb5e4 100644 --- a/drivers/media/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb-core/dvb_ca_en50221.c @@ -151,6 +151,12 @@ struct dvb_ca_private { /* mutex serializing ioctls */ struct mutex ioctl_mutex; + + /* A mutex used when a device is disconnected */ + struct mutex remove_mutex; + + /* Whether the device is disconnected */ + int exit; }; static void dvb_ca_private_free(struct dvb_ca_private *ca) @@ -1706,12 +1712,22 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) dprintk("%s\n", __func__); - if (!try_module_get(ca->pub->owner)) + mutex_lock(&ca->remove_mutex); + + if (ca->exit) { + mutex_unlock(&ca->remove_mutex); + return -ENODEV; + } + + if (!try_module_get(ca->pub->owner)) { + mutex_unlock(&ca->remove_mutex); return -EIO; + } err = dvb_generic_open(inode, file); if (err < 0) { module_put(ca->pub->owner); + mutex_unlock(&ca->remove_mutex); return err; } @@ -1736,6 +1752,7 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) dvb_ca_private_get(ca); + mutex_unlock(&ca->remove_mutex); return 0; } @@ -1755,6 +1772,8 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) dprintk("%s\n", __func__); + mutex_lock(&ca->remove_mutex); + /* mark the CA device as closed */ ca->open = 0; dvb_ca_en50221_thread_update_delay(ca); @@ -1765,6 +1784,13 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) dvb_ca_private_put(ca); + if (dvbdev->users == 1 && ca->exit == 1) { + mutex_unlock(&ca->remove_mutex); + wake_up(&dvbdev->wait_queue); + } else { + mutex_unlock(&ca->remove_mutex); + } + return err; } @@ -1888,6 +1914,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter, } mutex_init(&ca->ioctl_mutex); + mutex_init(&ca->remove_mutex); if (signal_pending(current)) { ret = -EINTR; @@ -1930,6 +1957,14 @@ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca) dprintk("%s\n", __func__); + mutex_lock(&ca->remove_mutex); + ca->exit = 1; + mutex_unlock(&ca->remove_mutex); + + if (ca->dvbdev->users < 1) + wait_event(ca->dvbdev->wait_queue, + ca->dvbdev->users == 1); + /* shutdown the thread if there was one */ kthread_stop(ca->thread); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/3] Fix cgroup psi poll UAF
by Lu Jialin 26 Oct '23

26 Oct '23

Arnd Bergmann (1): kernfs: add stub helper for kernfs_generic_poll() Randy Dunlap (1): sched/psi: Select KERNFS as needed Suren Baghdasaryan (1): sched/psi: use kernfs polling functions for PSI trigger polling include/linux/kernfs.h | 4 ++++ include/linux/psi.h | 5 +++-- include/linux/psi_types.h | 3 +++ init/Kconfig | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/sched/psi.c | 29 +++++++++++++++++++++-------- 6 files changed, 33 insertions(+), 11 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] xen/events: replace evtchn_rwlock with RCU
by Liu Shixin 26 Oct '23

26 Oct '23

From: Juergen Gross <jgross(a)suse.com> stable inclusion from stable-v5.10.198 commit 660627c71bc1098aa94e5f208f14748b105b73bc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I896EC CVE: CVE-2023-34324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 87797fad6cce28ec9be3c13f031776ff4f104cfc upstream. In unprivileged Xen guests event handling can cause a deadlock with Xen console handling. The evtchn_rwlock and the hvc_lock are taken in opposite sequence in __hvc_poll() and in Xen console IRQ handling. Normally this is no problem, as the evtchn_rwlock is taken as a reader in both paths, but as soon as an event channel is being closed, the lock will be taken as a writer, which will cause read_lock() to block: CPU0 CPU1 CPU2 (IRQ handling) (__hvc_poll()) (closing event channel) read_lock(evtchn_rwlock) spin_lock(hvc_lock) write_lock(evtchn_rwlock) [blocks] spin_lock(hvc_lock) [blocks] read_lock(evtchn_rwlock) [blocks due to writer waiting, and not in_interrupt()] This issue can be avoided by replacing evtchn_rwlock with RCU in xen_free_irq(). Note that RCU is used only to delay freeing of the irq_info memory. There is no RCU based dereferencing or replacement of pointers involved. In order to avoid potential races between removing the irq_info reference and handling of interrupts, set the irq_info pointer to NULL only when freeing its memory. The IRQ itself must be freed at that time, too, as otherwise the same IRQ number could be allocated again before handling of the old instance would have been finished. This is XSA-441 / CVE-2023-34324. Fixes: 54c9de89895e ("xen/events: add a new "late EOI" evtchn framework") Reported-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> Signed-off-by: Juergen Gross <jgross(a)suse.com> Reviewed-by: Julien Grall <jgrall(a)amazon.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/xen/events/events_base.c | 87 +++++++++++++++++--------------- 1 file changed, 46 insertions(+), 41 deletions(-) diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c index fba78daee449a..52891546e6973 100644 --- a/drivers/xen/events/events_base.c +++ b/drivers/xen/events/events_base.c @@ -33,6 +33,7 @@ #include <linux/slab.h> #include <linux/irqnr.h> #include <linux/pci.h> +#include <linux/rcupdate.h> #include <linux/spinlock.h> #include <linux/cpuhotplug.h> #include <linux/atomic.h> @@ -94,6 +95,7 @@ enum xen_irq_type { struct irq_info { struct list_head list; struct list_head eoi_list; + struct rcu_work rwork; short refcnt; short spurious_cnt; short type; /* type */ @@ -141,23 +143,13 @@ const struct evtchn_ops *evtchn_ops; */ static DEFINE_MUTEX(irq_mapping_update_lock); -/* - * Lock protecting event handling loop against removing event channels. - * Adding of event channels is no issue as the associated IRQ becomes active - * only after everything is setup (before request_[threaded_]irq() the handler - * can't be entered for an event, as the event channel will be unmasked only - * then). - */ -static DEFINE_RWLOCK(evtchn_rwlock); - /* * Lock hierarchy: * * irq_mapping_update_lock - * evtchn_rwlock - * IRQ-desc lock - * percpu eoi_list_lock - * irq_info->lock + * IRQ-desc lock + * percpu eoi_list_lock + * irq_info->lock */ static LIST_HEAD(xen_irq_list_head); @@ -272,6 +264,22 @@ static void set_info_for_irq(unsigned int irq, struct irq_info *info) irq_set_chip_data(irq, info); } +static void delayed_free_irq(struct work_struct *work) +{ + struct irq_info *info = container_of(to_rcu_work(work), struct irq_info, + rwork); + unsigned int irq = info->irq; + + /* Remove the info pointer only now, with no potential users left. */ + set_info_for_irq(irq, NULL); + + kfree(info); + + /* Legacy IRQ descriptors are managed by the arch. */ + if (irq >= nr_legacy_irqs()) + irq_free_desc(irq); +} + /* Constructors for packed IRQ information. */ static int xen_irq_info_common_setup(struct irq_info *info, unsigned irq, @@ -606,33 +614,36 @@ static void xen_irq_lateeoi_worker(struct work_struct *work) eoi = container_of(to_delayed_work(work), struct lateeoi_work, delayed); - read_lock_irqsave(&evtchn_rwlock, flags); + rcu_read_lock(); while (true) { - spin_lock(&eoi->eoi_list_lock); + spin_lock_irqsave(&eoi->eoi_list_lock, flags); info = list_first_entry_or_null(&eoi->eoi_list, struct irq_info, eoi_list); - if (info == NULL || now < info->eoi_time) { - spin_unlock(&eoi->eoi_list_lock); + if (info == NULL) + break; + + if (now < info->eoi_time) { + mod_delayed_work_on(info->eoi_cpu, system_wq, + &eoi->delayed, + info->eoi_time - now); break; } list_del_init(&info->eoi_list); - spin_unlock(&eoi->eoi_list_lock); + spin_unlock_irqrestore(&eoi->eoi_list_lock, flags); info->eoi_time = 0; xen_irq_lateeoi_locked(info, false); } - if (info) - mod_delayed_work_on(info->eoi_cpu, system_wq, - &eoi->delayed, info->eoi_time - now); + spin_unlock_irqrestore(&eoi->eoi_list_lock, flags); - read_unlock_irqrestore(&evtchn_rwlock, flags); + rcu_read_unlock(); } static void xen_cpu_init_eoi(unsigned int cpu) @@ -647,16 +658,15 @@ static void xen_cpu_init_eoi(unsigned int cpu) void xen_irq_lateeoi(unsigned int irq, unsigned int eoi_flags) { struct irq_info *info; - unsigned long flags; - read_lock_irqsave(&evtchn_rwlock, flags); + rcu_read_lock(); info = info_for_irq(irq); if (info) xen_irq_lateeoi_locked(info, eoi_flags & XEN_EOI_FLAG_SPURIOUS); - read_unlock_irqrestore(&evtchn_rwlock, flags); + rcu_read_unlock(); } EXPORT_SYMBOL_GPL(xen_irq_lateeoi); @@ -675,6 +685,7 @@ static void xen_irq_init(unsigned irq) info->type = IRQT_UNBOUND; info->refcnt = -1; + INIT_RCU_WORK(&info->rwork, delayed_free_irq); set_info_for_irq(irq, info); @@ -727,31 +738,18 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) static void xen_free_irq(unsigned irq) { struct irq_info *info = info_for_irq(irq); - unsigned long flags; if (WARN_ON(!info)) return; - write_lock_irqsave(&evtchn_rwlock, flags); - if (!list_empty(&info->eoi_list)) lateeoi_list_del(info); list_del(&info->list); - set_info_for_irq(irq, NULL); - WARN_ON(info->refcnt > 0); - write_unlock_irqrestore(&evtchn_rwlock, flags); - - kfree(info); - - /* Legacy IRQ descriptors are managed by the arch. */ - if (irq < nr_legacy_irqs()) - return; - - irq_free_desc(irq); + queue_rcu_work(system_wq, &info->rwork); } static void xen_evtchn_close(evtchn_port_t port) @@ -1639,7 +1637,14 @@ static void __xen_evtchn_do_upcall(void) int cpu = smp_processor_id(); struct evtchn_loop_ctrl ctrl = { 0 }; - read_lock(&evtchn_rwlock); + /* + * When closing an event channel the associated IRQ must not be freed + * until all cpus have left the event handling loop. This is ensured + * by taking the rcu_read_lock() while handling events, as freeing of + * the IRQ is handled via queue_rcu_work() _after_ closing the event + * channel. + */ + rcu_read_lock(); do { vcpu_info->evtchn_upcall_pending = 0; @@ -1652,7 +1657,7 @@ static void __xen_evtchn_do_upcall(void) } while (vcpu_info->evtchn_upcall_pending); - read_unlock(&evtchn_rwlock); + rcu_read_unlock(); /* * Increment irq_epoch only now to defer EOIs only for -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] Fix cgroup poll UAF
by Lu Jialin 26 Oct '23

26 Oct '23

Arnd Bergmann (1): kernfs: add stub helper for kernfs_generic_poll() Randy Dunlap (1): sched/psi: Select KERNFS as needed Suren Baghdasaryan (1): sched/psi: use kernfs polling functions for PSI trigger polling include/linux/kernfs.h | 4 ++++ include/linux/psi.h | 5 +++-- include/linux/psi_types.h | 3 +++ init/Kconfig | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/sched/psi.c | 29 +++++++++++++++++++++-------- 6 files changed, 33 insertions(+), 11 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] integrity: Fix possible multiple allocation in integrity_inode_get()
by felix 26 Oct '23

26 Oct '23

From: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> mainline inclusion from mainline-v6.5-rc1 commit 9df6a4870dc371136e90330cfbbc51464ee66993 category: bugfix bugzilla: 189204 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When integrity_inode_get() is querying and inserting the cache, there is a conditional race in the concurrent environment. The race condition is the result of not properly implementing "double-checked locking". In this case, it first checks to see if the iint cache record exists before taking the lock, but doesn't check again after taking the integrity_iint_lock. Fixes: bf2276d10ce5 ("ima: allocating iint improvements") Signed-off-by: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> Cc: Dmitry Kasatkin <dmitry.kasatkin(a)gmail.com> Cc: <stable(a)vger.kernel.org> # v3.10+ Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com> Signed-off-by: felix <fuzhen5(a)huawei.com> --- security/integrity/iint.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/security/integrity/iint.c b/security/integrity/iint.c index 1668cfbeb671..2428037d9e14 100644 --- a/security/integrity/iint.c +++ b/security/integrity/iint.c @@ -43,12 +43,10 @@ static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode) else if (inode > iint->inode) n = n->rb_right; else - break; + return iint; } - if (!n) - return NULL; - return iint; + return NULL; } /* @@ -111,10 +109,15 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode) parent = *p; test_iint = rb_entry(parent, struct integrity_iint_cache, rb_node); - if (inode < test_iint->inode) + if (inode < test_iint->inode) { p = &(*p)->rb_left; - else + } else if (inode > test_iint->inode) { p = &(*p)->rb_right; + } else { + write_unlock(&integrity_iint_lock); + kmem_cache_free(iint_cache, iint); + return test_iint; + } } iint->inode = inode; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS 0/3] fix cgroup poll UAF
by Lu Jialin 25 Oct '23

25 Oct '23

Arnd Bergmann (1): kernfs: add stub helper for kernfs_generic_poll() Randy Dunlap (1): sched/psi: Select KERNFS as needed Suren Baghdasaryan (1): sched/psi: use kernfs polling functions for PSI trigger polling include/linux/kernfs.h | 4 ++++ include/linux/psi.h | 5 +++-- include/linux/psi_types.h | 3 +++ init/Kconfig | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/sched/psi.c | 29 +++++++++++++++++++++-------- 6 files changed, 33 insertions(+), 11 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS 0/4] ACPI for MPAM 2.0
by Yu Liao 25 Oct '23

25 Oct '23

Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 21 +++- drivers/acpi/arm64/mpam_v2.c | 175 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 373 insertions(+), 7 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS 0/2] support CPU turbo for
by Yu Liao 25 Oct '23

25 Oct '23

Xiongfeng Wang (2): cpufreq: change '.set_boost' to act on one policy cpufreq: CPPC: add SW BOOST support drivers/cpufreq/acpi-cpufreq.c | 14 ++++---- drivers/cpufreq/cppc_cpufreq.c | 35 ++++++++++++++++++-- drivers/cpufreq/cpufreq.c | 58 +++++++++++++++++++--------------- include/linux/cpufreq.h | 2 +- 4 files changed, 75 insertions(+), 34 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 v2 0/8] Synchronize coresight driver bugfix patches to openEuler
by Junhao He 25 Oct '23

25 Oct '23

1. Fix memory leak coresight: Fix memory leak in acpi_buffer->pointer 2. Fix TRBE bug coresight: trbe: Fix TRBE potential sleep in atomic context coresight: trbe: Allocate platform data per device coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() 3. Fix ETR bug coresight: Fix run time warnings while reusing ETR buffer coresight: tmc-etr: Disable warnings for allocation failures 4. acpi: Ignore the absence of graph coresight: platform: acpi: Ignore the absence of graph Revert "coresight: Return the pointer of @pdata when not "fwnode"" Junhao He (3): Revert "coresight: Return the pointer of @pdata when not "fwnode"" coresight: Fix memory leak in acpi_buffer->pointer coresight: trbe: Fix TRBE potential sleep in atomic context Linu Cherian (1): coresight: Fix run time warnings while reusing ETR buffer Suzuki K Poulose (3): coresight: trbe: Allocate platform data per device coresight: platform: acpi: Ignore the absence of graph coresight: tmc-etr: Disable warnings for allocation failures Wei Yongjun (1): coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() .../hwtracing/coresight/coresight-platform.c | 56 ++++++++++++------- .../hwtracing/coresight/coresight-tmc-etr.c | 23 ++++---- drivers/hwtracing/coresight/coresight-trbe.c | 42 +++++++------- 3 files changed, 70 insertions(+), 51 deletions(-) -- 2.33.0

2 9

[PATCH OLK-5.10 0/7] add sample sockmap code for redis
by Liu Jian 25 Oct '23

25 Oct '23

Hengqi Chen (1): libbpf: Support uniform BTF-defined key/value specification across all BPF maps Liu Jian (4): cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted net: let sockops can use bpf_get_current_comm() net: add local_skb parameter to identify local tcp connection tools: add sample sockmap code for redis Xu Kuohai (1): bpf, sockmap: Fix map type error in sock_map_del_link Yosry Ahmed (1): cgroup: add cgroup_v1v2_get_from_[fd/file]() include/linux/cgroup.h | 2 + include/linux/filter.h | 1 + include/linux/skbuff.h | 3 + include/uapi/linux/bpf.h | 1 + kernel/bpf/cgroup.c | 8 +- kernel/cgroup/cgroup.c | 73 +++++++- net/core/filter.c | 9 + net/core/sock_map.c | 10 +- net/ipv4/tcp_input.c | 4 +- net/ipv4/tcp_output.c | 5 + tools/include/uapi/linux/bpf.h | 1 + tools/lib/bpf/libbpf.c | 24 +++ tools/netacc/Makefile | 24 +++ tools/netacc/bpf_sockmap.h | 167 +++++++++++++++++++ tools/netacc/net-acc | 35 ++++ tools/netacc/netacc.c | 294 +++++++++++++++++++++++++++++++++ tools/netacc/netaccsockmap.c | 176 ++++++++++++++++++++ 17 files changed, 822 insertions(+), 15 deletions(-) create mode 100644 tools/netacc/Makefile create mode 100644 tools/netacc/bpf_sockmap.h create mode 100755 tools/netacc/net-acc create mode 100644 tools/netacc/netacc.c create mode 100644 tools/netacc/netaccsockmap.c -- 2.34.1

2 8

[PATCH openEuler-22.03-LTS] USB: ene_usb6250: Allocate enough memory for full object
by Yipeng Zou 25 Oct '23

25 Oct '23

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.6-rc2 commit ce33e64c1788912976b61314b56935abd4bc97ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I885FJ CVE: CVE-2023-45862 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The allocation of PageBuffer is 512 bytes in size, but the dereferencing of struct ms_bootblock_idi (also size 512) happens at a calculated offset within the allocation, which means the object could potentially extend beyond the end of the allocation. Avoid this case by just allocating enough space to catch any accesses beyond the end. Seen with GCC 13: ../drivers/usb/storage/ene_ub6250.c: In function 'ms_lib_process_bootblock': ../drivers/usb/storage/ene_ub6250.c:1050:44: warning: array subscript 'struct ms_bootblock_idi[0]' is partly outside array bounds of 'unsigned char[512]' [-Warray-bounds=] 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~ ../include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu' 37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x)) | ^ ../drivers/usb/storage/ene_ub6250.c:1050:29: note: in expansion of macro 'le16_to_cpu' 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~~~~~~~~~~ In file included from ../drivers/usb/storage/ene_ub6250.c:5: In function 'kmalloc', inlined from 'ms_lib_process_bootblock' at ../drivers/usb/storage/ene_ub6250.c:942:15: ../include/linux/slab.h:580:24: note: at offset [256, 512] into object of size 512 allocated by 'kmalloc_trace' 580 | return kmalloc_trace( | ^~~~~~~~~~~~~~ 581 | kmalloc_caches[kmalloc_type(flags)][index], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 582 | flags, size); | ~~~~~~~~~~~~ Cc: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20230204183546.never.849-kees@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/usb/storage/ene_ub6250.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c index c9ce1c25c80c..737398f1b896 100644 --- a/drivers/usb/storage/ene_ub6250.c +++ b/drivers/usb/storage/ene_ub6250.c @@ -938,7 +938,7 @@ static int ms_lib_process_bootblock(struct us_data *us, u16 PhyBlock, u8 *PageDa struct ms_lib_type_extdat ExtraData; struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; - PageBuffer = kmalloc(MS_BYTES_PER_PAGE, GFP_KERNEL); + PageBuffer = kzalloc(MS_BYTES_PER_PAGE * 2, GFP_KERNEL); if (PageBuffer == NULL) return (u32)-1; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
by Wang Yufen 25 Oct '23

25 Oct '23

From: "Lee, Chun-Yi" <joeyli.kernel(a)gmail.com> mainline inclusion from mainline-v6.6-rc1 commit 9c33663af9ad115f90c076a1828129a3fbadea98 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6YOAU CVE: CVE-2023-31083 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch adds code to check HCI_UART_PROTO_READY flag before accessing hci_uart->proto. It fixes the race condition in hci_uart_tty_ioctl() between HCIUARTSETPROTO and HCIUARTGETPROTO. This issue bug found by Yu Hao and Weiteng Chen: BUG: general protection fault in hci_uart_tty_ioctl [1] The information of C reproducer can also reference the link [2] Reported-by: Yu Hao <yhao016(a)ucr.edu> Closes: https://lore.kernel.org/all/CA+UBctC3p49aTgzbVgkSZ2+TQcqq4fPDO7yZitFT5uBPDe… [1] Reported-by: Weiteng Chen <wchen130(a)ucr.edu> Closes: https://lore.kernel.org/lkml/CA+UBctDPEvHdkHMwD340=n02rh+jNRJNNQ5LBZNA+Wm4K… [2] Signed-off-by: "Lee, Chun-Yi" <jlee(a)suse.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- drivers/bluetooth/hci_ldisc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c index efeb813..73ba297 100644 --- a/drivers/bluetooth/hci_ldisc.c +++ b/drivers/bluetooth/hci_ldisc.c @@ -772,7 +772,8 @@ static int hci_uart_tty_ioctl(struct tty_struct *tty, struct file *file, break; case HCIUARTGETPROTO: - if (test_bit(HCI_UART_PROTO_SET, &hu->flags)) + if (test_bit(HCI_UART_PROTO_SET, &hu->flags) && + test_bit(HCI_UART_PROTO_READY, &hu->flags)) err = hu->proto->id; else err = -EUNATCH; -- 1.8.3.1

2 1

[PATCH v2 openEuler-22.03-LTS 0/9] scsi: mpt3sas: Driver patch set for openEuler-22.03
by Hao Zhang 25 Oct '23

25 Oct '23

Get patch set from upstream 5.10 LTS stable branch Ranjan Kumar (1): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Sreekanth Reddy (4): scsi: mpt3sas: Fix use-after-free warning scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: re-do lost mpt3sas DMA mask fix scsi: mpt3sas: Remove usage of dma_get_required_mask() API Suganath Prabu S (1): scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 222 ++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 2 + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +- 4 files changed, 175 insertions(+), 67 deletions(-) -- 2.33.0

2 10

[PATCH OLK-5.10] USB: ene_usb6250: Allocate enough memory for full object
by Yipeng Zou 25 Oct '23

25 Oct '23

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.6-rc2 commit ce33e64c1788912976b61314b56935abd4bc97ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I885FJ CVE: CVE-2023-45862 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The allocation of PageBuffer is 512 bytes in size, but the dereferencing of struct ms_bootblock_idi (also size 512) happens at a calculated offset within the allocation, which means the object could potentially extend beyond the end of the allocation. Avoid this case by just allocating enough space to catch any accesses beyond the end. Seen with GCC 13: ../drivers/usb/storage/ene_ub6250.c: In function 'ms_lib_process_bootblock': ../drivers/usb/storage/ene_ub6250.c:1050:44: warning: array subscript 'struct ms_bootblock_idi[0]' is partly outside array bounds of 'unsigned char[512]' [-Warray-bounds=] 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~ ../include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu' 37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x)) | ^ ../drivers/usb/storage/ene_ub6250.c:1050:29: note: in expansion of macro 'le16_to_cpu' 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~~~~~~~~~~ In file included from ../drivers/usb/storage/ene_ub6250.c:5: In function 'kmalloc', inlined from 'ms_lib_process_bootblock' at ../drivers/usb/storage/ene_ub6250.c:942:15: ../include/linux/slab.h:580:24: note: at offset [256, 512] into object of size 512 allocated by 'kmalloc_trace' 580 | return kmalloc_trace( | ^~~~~~~~~~~~~~ 581 | kmalloc_caches[kmalloc_type(flags)][index], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 582 | flags, size); | ~~~~~~~~~~~~ Cc: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20230204183546.never.849-kees@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/usb/storage/ene_ub6250.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c index c9ce1c25c80c..737398f1b896 100644 --- a/drivers/usb/storage/ene_ub6250.c +++ b/drivers/usb/storage/ene_ub6250.c @@ -938,7 +938,7 @@ static int ms_lib_process_bootblock(struct us_data *us, u16 PhyBlock, u8 *PageDa struct ms_lib_type_extdat ExtraData; struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; - PageBuffer = kmalloc(MS_BYTES_PER_PAGE, GFP_KERNEL); + PageBuffer = kzalloc(MS_BYTES_PER_PAGE * 2, GFP_KERNEL); if (PageBuffer == NULL) return (u32)-1; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
by Wang Yufen 25 Oct '23

25 Oct '23

From: "Lee, Chun-Yi" <joeyli.kernel(a)gmail.com> mainline inclusion from mainline-v6.6-rc1 commit 9c33663af9ad115f90c076a1828129a3fbadea98 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6YOAU CVE: CVE-2023-31083 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch adds code to check HCI_UART_PROTO_READY flag before accessing hci_uart->proto. It fixes the race condition in hci_uart_tty_ioctl() between HCIUARTSETPROTO and HCIUARTGETPROTO. This issue bug found by Yu Hao and Weiteng Chen: BUG: general protection fault in hci_uart_tty_ioctl [1] The information of C reproducer can also reference the link [2] Reported-by: Yu Hao <yhao016(a)ucr.edu> Closes: https://lore.kernel.org/all/CA+UBctC3p49aTgzbVgkSZ2+TQcqq4fPDO7yZitFT5uBPDe… [1] Reported-by: Weiteng Chen <wchen130(a)ucr.edu> Closes: https://lore.kernel.org/lkml/CA+UBctDPEvHdkHMwD340=n02rh+jNRJNNQ5LBZNA+Wm4K… [2] Signed-off-by: "Lee, Chun-Yi" <jlee(a)suse.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- drivers/bluetooth/hci_ldisc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c index efeb813..73ba297 100644 --- a/drivers/bluetooth/hci_ldisc.c +++ b/drivers/bluetooth/hci_ldisc.c @@ -772,7 +772,8 @@ static int hci_uart_tty_ioctl(struct tty_struct *tty, struct file *file, break; case HCIUARTGETPROTO: - if (test_bit(HCI_UART_PROTO_SET, &hu->flags)) + if (test_bit(HCI_UART_PROTO_SET, &hu->flags) && + test_bit(HCI_UART_PROTO_READY, &hu->flags)) err = hu->proto->id; else err = -EUNATCH; -- 1.8.3.1

2 1

[PATCH v2 OLK-5.10 00/27] Introduce some vdpa ops to support vdpa device live migrate
by Jiang Dongxu 25 Oct '23

25 Oct '23

From: jiangdongxu1 <jiangdongxu1(a)huawei.com> Patch 1-16: some bugfix and ops intruduced by upstream Patch 17-18: introduce vdpa device logging ops Patch 19-20: introduce vdpa device state ops Patch 21-22: introduce vdpa device migrate state ops Patch 23: introduce new vhost feature BYTEPMAPLOG Patch 24: export iommu_get_resv_regions/iommu_set_resv_regions Patch 25-26: some optimization about vhost-vdpa Patch 27: add vdpa/vhost-vdpa build config Cindy Lu (2): vhost_vdpa: fix the crash in unmap a large memory vhost_vdpa: fix unmap process in no-batch mode Eugenio Pérez (1): vdpa: add get_backend_features vdpa operation Gautam Dawar (1): vhost-vdpa: free iommu domain after last use during cleanup Greg Kroah-Hartman (1): vhost-vdpa: vhost_vdpa_alloc_domain() should be using a const struct bus_type * Jason Gunthorpe (1): PCI/IOV: Add pci_iov_vf_id() to get VF index Sebastien Boeuf (3): vdpa: Add resume operation vhost-vdpa: Introduce RESUME backend feature bit vhost-vdpa: uAPI to resume the device Shannon Nelson (2): vhost_vdpa: tell vqs about the negotiated vhost_vdpa: support PACKED when setting-getting vring_base Shunsuke Mie (1): virtio: fix virtio transitional ids Stefano Garzarella (3): vhost-vdpa: fix an iotlb memory leak vdpa: add bind_mm/unbind_mm callbacks vhost-vdpa: use bind_mm/unbind_mm device callbacks Zhu Lingshan (1): virtio: update virtio id table, add transitional ids jiangdongxu1 (11): vdpa: add log operations vhost-vdpa: add uAPI for logging vdpa: add device state operations vhost-vdpa: add uAPI for device buffer vdpa: add vdpa device migration status ops vhost-vdpa: add uAPI for device migration status vhost: add VHOST feature VHOST_BACKEND_F_BYTEMAPLOG export iommu_get_resv_regions and iommu_set_resv_regions vhost-vdpa: Allow transparent MSI IOV vhost-vdpa: fix msi irq request err arm64: openeuler_defconfig: add VDPA config arch/arm64/configs/openeuler_defconfig | 6 +- drivers/iommu/iommu.c | 2 + drivers/pci/iov.c | 14 + drivers/vhost/vdpa.c | 385 ++++++++++++++++++++++--- include/linux/pci.h | 8 +- include/linux/vdpa.h | 60 +++- include/uapi/linux/vhost.h | 20 ++ include/uapi/linux/vhost_types.h | 21 ++ include/uapi/linux/virtio_ids.h | 12 + 9 files changed, 482 insertions(+), 46 deletions(-) -- 2.33.0

2 28

[PATCH openEuler-22.03-LTS 0/9] scsi: mpt3sas: Driver patch set for openEuler-22.03-LTS
by Hao Zhang 25 Oct '23

25 Oct '23

Get patch set from upstream 5.10 LTS stable branch Ranjan Kumar (1): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Sreekanth Reddy (4): scsi: mpt3sas: Fix use-after-free warning scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: re-do lost mpt3sas DMA mask fix scsi: mpt3sas: Remove usage of dma_get_required_mask() API Suganath Prabu S (1): scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 222 ++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 2 + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +- 4 files changed, 175 insertions(+), 67 deletions(-) -- 2.33.0

2 10

[PATCH openEuler-22.03-LTS 0/9] scsi: mpt3sas: Driver patch set for openEuler-22.03-LTS
by Hao Zhang 25 Oct '23

25 Oct '23

Get patch set from upstream 5.10 LTS stable branch Ranjan Kumar (1): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Sreekanth Reddy (4): scsi: mpt3sas: Fix use-after-free warning scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: re-do lost mpt3sas DMA mask fix scsi: mpt3sas: Remove usage of dma_get_required_mask() API Suganath Prabu S (1): scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 222 ++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 2 + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +- 4 files changed, 175 insertions(+), 67 deletions(-) -- 2.33.0

2 10

[PATCH openEuler-1.0-LTS 0/4] Avoid spin or livelock during panic
by Ye Weihua 25 Oct '23

25 Oct '23

Stephen Brennan (4): printk: Add panic_in_progress helper printk: disable optimistic spin during panic printk: Avoid livelock with heavy printk during panic printk: Drop console_sem during panic kernel/printk/printk.c | 55 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 54 insertions(+), 1 deletion(-) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] xen/events: replace evtchn_rwlock with RCU
by Liu Shixin 25 Oct '23

25 Oct '23

From: Juergen Gross <jgross(a)suse.com> stable inclusion from stable-v4.19.296 commit 3fdf2be9089b5096a28e76376656c60ce410ac4a category: bugfix bugzilla: 189304, https://gitee.com/src-openeuler/kernel/issues/I896EC CVE: CVE-2023-34324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 87797fad6cce28ec9be3c13f031776ff4f104cfc upstream. In unprivileged Xen guests event handling can cause a deadlock with Xen console handling. The evtchn_rwlock and the hvc_lock are taken in opposite sequence in __hvc_poll() and in Xen console IRQ handling. Normally this is no problem, as the evtchn_rwlock is taken as a reader in both paths, but as soon as an event channel is being closed, the lock will be taken as a writer, which will cause read_lock() to block: CPU0 CPU1 CPU2 (IRQ handling) (__hvc_poll()) (closing event channel) read_lock(evtchn_rwlock) spin_lock(hvc_lock) write_lock(evtchn_rwlock) [blocks] spin_lock(hvc_lock) [blocks] read_lock(evtchn_rwlock) [blocks due to writer waiting, and not in_interrupt()] This issue can be avoided by replacing evtchn_rwlock with RCU in xen_free_irq(). Note that RCU is used only to delay freeing of the irq_info memory. There is no RCU based dereferencing or replacement of pointers involved. In order to avoid potential races between removing the irq_info reference and handling of interrupts, set the irq_info pointer to NULL only when freeing its memory. The IRQ itself must be freed at that time, too, as otherwise the same IRQ number could be allocated again before handling of the old instance would have been finished. This is XSA-441 / CVE-2023-34324. Fixes: 54c9de89895e ("xen/events: add a new "late EOI" evtchn framework") Reported-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> Signed-off-by: Juergen Gross <jgross(a)suse.com> Reviewed-by: Julien Grall <jgrall(a)amazon.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/xen/events/events_base.c drivers/xen/events/events_internal.h [ Replace set_info_for_irq() with irq_set_handler_data() ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/xen/events/events_base.c | 84 ++++++++++++++-------------- drivers/xen/events/events_internal.h | 2 + 2 files changed, 45 insertions(+), 41 deletions(-) diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c index 1cb2bf5e5e5b6..9c0ade529ec3f 100644 --- a/drivers/xen/events/events_base.c +++ b/drivers/xen/events/events_base.c @@ -82,22 +82,12 @@ const struct evtchn_ops *evtchn_ops; */ static DEFINE_MUTEX(irq_mapping_update_lock); -/* - * Lock protecting event handling loop against removing event channels. - * Adding of event channels is no issue as the associated IRQ becomes active - * only after everything is setup (before request_[threaded_]irq() the handler - * can't be entered for an event, as the event channel will be unmasked only - * then). - */ -static DEFINE_RWLOCK(evtchn_rwlock); - /* * Lock hierarchy: * * irq_mapping_update_lock - * evtchn_rwlock - * IRQ-desc lock - * percpu eoi_list_lock + * IRQ-desc lock + * percpu eoi_list_lock */ static LIST_HEAD(xen_irq_list_head); @@ -191,6 +181,22 @@ struct irq_info *info_for_irq(unsigned irq) return irq_get_handler_data(irq); } +static void delayed_free_irq(struct work_struct *work) +{ + struct irq_info *info = container_of(to_rcu_work(work), struct irq_info, + rwork); + unsigned int irq = info->irq; + + /* Remove the info pointer only now, with no potential users left. */ + irq_set_handler_data(irq, NULL); + + kfree(info); + + /* Legacy IRQ descriptors are managed by the arch. */ + if (irq >= nr_legacy_irqs()) + irq_free_desc(irq); +} + /* Constructors for packed IRQ information. */ static int xen_irq_info_common_setup(struct irq_info *info, unsigned irq, @@ -474,33 +480,36 @@ static void xen_irq_lateeoi_worker(struct work_struct *work) eoi = container_of(to_delayed_work(work), struct lateeoi_work, delayed); - read_lock_irqsave(&evtchn_rwlock, flags); + rcu_read_lock(); while (true) { - spin_lock(&eoi->eoi_list_lock); + spin_lock_irqsave(&eoi->eoi_list_lock, flags); info = list_first_entry_or_null(&eoi->eoi_list, struct irq_info, eoi_list); - if (info == NULL || now < info->eoi_time) { - spin_unlock(&eoi->eoi_list_lock); + if (info == NULL) + break; + + if (now < info->eoi_time) { + mod_delayed_work_on(info->eoi_cpu, system_wq, + &eoi->delayed, + info->eoi_time - now); break; } list_del_init(&info->eoi_list); - spin_unlock(&eoi->eoi_list_lock); + spin_unlock_irqrestore(&eoi->eoi_list_lock, flags); info->eoi_time = 0; xen_irq_lateeoi_locked(info); } - if (info) - mod_delayed_work_on(info->eoi_cpu, system_wq, - &eoi->delayed, info->eoi_time - now); + spin_unlock_irqrestore(&eoi->eoi_list_lock, flags); - read_unlock_irqrestore(&evtchn_rwlock, flags); + rcu_read_unlock(); } static void xen_cpu_init_eoi(unsigned int cpu) @@ -515,16 +524,15 @@ static void xen_cpu_init_eoi(unsigned int cpu) void xen_irq_lateeoi(unsigned int irq, unsigned int eoi_flags) { struct irq_info *info; - unsigned long flags; - read_lock_irqsave(&evtchn_rwlock, flags); + rcu_read_lock(); info = info_for_irq(irq); if (info) xen_irq_lateeoi_locked(info); - read_unlock_irqrestore(&evtchn_rwlock, flags); + rcu_read_unlock(); } EXPORT_SYMBOL_GPL(xen_irq_lateeoi); @@ -543,6 +551,7 @@ static void xen_irq_init(unsigned irq) info->type = IRQT_UNBOUND; info->refcnt = -1; + INIT_RCU_WORK(&info->rwork, delayed_free_irq); irq_set_handler_data(irq, info); @@ -595,31 +604,18 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) static void xen_free_irq(unsigned irq) { struct irq_info *info = irq_get_handler_data(irq); - unsigned long flags; if (WARN_ON(!info)) return; - write_lock_irqsave(&evtchn_rwlock, flags); - if (!list_empty(&info->eoi_list)) lateeoi_list_del(info); list_del(&info->list); - irq_set_handler_data(irq, NULL); - WARN_ON(info->refcnt > 0); - write_unlock_irqrestore(&evtchn_rwlock, flags); - - kfree(info); - - /* Legacy IRQ descriptors are managed by the arch. */ - if (irq < nr_legacy_irqs()) - return; - - irq_free_desc(irq); + queue_rcu_work(system_wq, &info->rwork); } static void xen_evtchn_close(unsigned int port) @@ -1521,7 +1517,14 @@ static void __xen_evtchn_do_upcall(void) struct evtchn_loop_ctrl ctrl = { 0 }; unsigned count; - read_lock(&evtchn_rwlock); + /* + * When closing an event channel the associated IRQ must not be freed + * until all cpus have left the event handling loop. This is ensured + * by taking the rcu_read_lock() while handling events, as freeing of + * the IRQ is handled via queue_rcu_work() _after_ closing the event + * channel. + */ + rcu_read_lock(); do { vcpu_info->evtchn_upcall_pending = 0; @@ -1538,8 +1541,7 @@ static void __xen_evtchn_do_upcall(void) } while (count != 1 || vcpu_info->evtchn_upcall_pending); out: - - read_unlock(&evtchn_rwlock); + rcu_read_unlock(); /* * Increment irq_epoch only now to defer EOIs only for diff --git a/drivers/xen/events/events_internal.h b/drivers/xen/events/events_internal.h index 2cb9c2d2c5c0f..72e13f1638a36 100644 --- a/drivers/xen/events/events_internal.h +++ b/drivers/xen/events/events_internal.h @@ -8,6 +8,7 @@ */ #ifndef __EVENTS_INTERNAL_H__ #define __EVENTS_INTERNAL_H__ +#include <linux/rcupdate.h> /* Interrupt types. */ enum xen_irq_type { @@ -33,6 +34,7 @@ enum xen_irq_type { struct irq_info { struct list_head list; struct list_head eoi_list; + struct rcu_work rwork; int refcnt; enum xen_irq_type type; /* type */ unsigned irq; -- 2.25.1

2 1

[PATCH OLK-5.10 0/7] Synchronize coresight driver bugfix patches to openEuler
by Junhao He 25 Oct '23

25 Oct '23

1. Fix memory leak coresight: core: fix memory leak in dict->fwnode_list coresight: Fix memory leak in acpi_buffer->pointer 2. Fix TRBE bug coresight: trbe: Fix TRBE potential sleep in atomic context coresight: trbe: Allocate platform data per device coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() 3. Fix ETR bug coresight: Fix run time warnings while reusing ETR buffer 4. acpi: Ignore the absence of graph coresight: platform: acpi: Ignore the absence of graph Revert "coresight: Return the pointer of @pdata when not "fwnode"" Junhao He (3): Revert "coresight: Return the pointer of @pdata when not "fwnode"" coresight: Fix memory leak in acpi_buffer->pointer coresight: trbe: Fix TRBE potential sleep in atomic context Linu Cherian (1): coresight: Fix run time warnings while reusing ETR buffer Suzuki K Poulose (2): coresight: trbe: Allocate platform data per device coresight: platform: acpi: Ignore the absence of graph Wei Yongjun (1): coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() .../hwtracing/coresight/coresight-platform.c | 56 ++++++++++++------- .../hwtracing/coresight/coresight-tmc-etr.c | 20 +++---- drivers/hwtracing/coresight/coresight-trbe.c | 42 +++++++------- 3 files changed, 68 insertions(+), 50 deletions(-) -- 2.33.0

2 8

[PATCH openEuler-22.03-LTS 0/9] scsi: mpt3sas: Driver patch set for openEuler-22.03-LTS
by Hao Zhang 25 Oct '23

25 Oct '23

Get patch set from upstream 5.10 LTS stable branch Ranjan Kumar (1): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Sreekanth Reddy (4): scsi: mpt3sas: Fix use-after-free warning scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: re-do lost mpt3sas DMA mask fix scsi: mpt3sas: Remove usage of dma_get_required_mask() API Suganath Prabu S (1): scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 222 ++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 2 + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +- 4 files changed, 175 insertions(+), 67 deletions(-) -- 2.33.0

2 10

[PATCH OLK-5.10] perf auxtrace: Record whether an auxtrace mmap is needed
by Junhao He 25 Oct '23

25 Oct '23

From: Qi Liu <liuqi115(a)huawei.com> mainline inclusion from mainline-v6.1-rc1 commit 057381a7ece1b2726509ce47cdb9c1a111acfce9 category: Bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7HI80 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Remove ->idx() per_cpu parameter because it isn't needed. Add a flag needs_auxtrace_mmap to record whether an auxtrace mmap is needed, in preparation for correctly determining whether or not an auxtrace mmap is needed. Reviewed-by: Leo Yan <leo.yan(a)linaro.org> Signed-off-by: Qi Liu <liuqi115(a)huawei.com> Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Acked-by: John Garry <john.garry(a)huawei.com> Link: https://lore.kernel.org/r/20220927081400.14364-3-yangyicong@huawei.com Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Signed-off-by: Junhao He <hejunhao3(a)huawei.com> Auxtrace mmap is needed is added to the source patch [1], However, it is deleted when upstream openEuler. Therefore, this patch adds this modification to OpenEuler OLK-5.10. [1] 057381a7ece1 "perf auxtrace arm64: Add support for HiSilicon PCIe Tune and Trace device driver" --- tools/perf/arch/arm64/util/hisi-ptt.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/perf/arch/arm64/util/hisi-ptt.c b/tools/perf/arch/arm64/util/hisi-ptt.c index 110b2edf3e6b..97696b6e1dd5 100644 --- a/tools/perf/arch/arm64/util/hisi-ptt.c +++ b/tools/perf/arch/arm64/util/hisi-ptt.c @@ -113,6 +113,7 @@ static int hisi_ptt_recording_options(struct auxtrace_record *itr, } evsel->core.attr.freq = 0; evsel->core.attr.sample_period = 1; + evsel->needs_auxtrace_mmap = true; hisi_ptt_evsel = evsel; opts->full_auxtrace = true; } -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS 0/4] Avoid spin or livelock during panic
by Ye Weihua 25 Oct '23

25 Oct '23

Stephen Brennan (4): printk: Add panic_in_progress helper printk: disable optimistic spin during panic printk: Avoid livelock with heavy printk during panic printk: Drop console_sem during panic kernel/printk/printk.c | 55 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 54 insertions(+), 1 deletion(-) -- 2.34.1

2 5

[PATCH OLK-5.10] psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n
by Lu Jialin 25 Oct '23

25 Oct '23

From: Suren Baghdasaryan <surenb(a)google.com> mainline inclusion from mainline-v5.17-rc2 commit 51e50fbd3efc6064c30ed73a5e009018b36e290a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I89DEJ CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- When CONFIG_CGROUPS is disabled psi code generates the following warnings: kernel/sched/psi.c:1112:21: warning: no previous prototype for 'psi_trigger_create' [-Wmissing-prototypes] 1112 | struct psi_trigger *psi_trigger_create(struct psi_group *group, | ^~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1182:6: warning: no previous prototype for 'psi_trigger_destroy' [-Wmissing-prototypes] 1182 | void psi_trigger_destroy(struct psi_trigger *t) | ^~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1249:10: warning: no previous prototype for 'psi_trigger_poll' [-Wmissing-prototypes] 1249 | __poll_t psi_trigger_poll(void **trigger_ptr, | ^~~~~~~~~~~~~~~~ Change the declarations of these functions in the header to provide the prototypes even when they are unused. Link: https://lkml.kernel.org/r/20220119223940.787748-2-surenb@google.com Fixes: 0e94682b73bf ("psi: introduce psi monitor") Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Reported-by: kernel test robot <lkp(a)intel.com> Acked-by: Johannes Weiner <hannes(a)cmpxchg.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflict: include/linux/psi.h Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- include/linux/psi.h | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/include/linux/psi.h b/include/linux/psi.h index 41079ebe17a6..86635a5630ba 100644 --- a/include/linux/psi.h +++ b/include/linux/psi.h @@ -26,12 +26,6 @@ void psi_memstall_enter(unsigned long *flags); void psi_memstall_leave(unsigned long *flags); int psi_show(struct seq_file *s, struct psi_group *group, enum psi_res res); - -#ifdef CONFIG_CGROUPS -int psi_cgroup_alloc(struct cgroup *cgrp); -void psi_cgroup_free(struct cgroup *cgrp); -void cgroup_move_task(struct task_struct *p, struct css_set *to); - struct psi_trigger *psi_trigger_create(struct psi_group *group, char *buf, size_t nbytes, enum psi_res res, struct kernfs_open_file *of); @@ -39,6 +33,11 @@ void psi_trigger_destroy(struct psi_trigger *t); __poll_t psi_trigger_poll(void **trigger_ptr, struct file *file, poll_table *wait); + +#ifdef CONFIG_CGROUPS +int psi_cgroup_alloc(struct cgroup *cgrp); +void psi_cgroup_free(struct cgroup *cgrp); +void cgroup_move_task(struct task_struct *p, struct css_set *to); #endif #else /* CONFIG_PSI */ -- 2.34.1

2 1

[PATCH OLK-5.10 00/38] Add error handling for device_add_disk
by Zhong Jinghua 25 Oct '23

25 Oct '23

Befor these paths, block is not know when drvier is add fail. Now, add error handling for drivers. Christoph Hellwig (14): block: fold register_disk into device_add_disk block: call blk_integrity_add earlier in device_add_disk block: add the events* attributes to disk_attrs block: fix error unwinding in device_add_disk block: clear ->slave_dir when dropping the main slave_dir reference block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Luis Chamberlain (11): block: return errors from blk_integrity_add block: return errors from disk_alloc_events block: add error handling for device_add_disk / add_disk block: fix device_add_disk() kobject_create_and_add() error handling loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sd: Add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Tetsuo Handa (1): block: check minor range in device_add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Yu Kuai (1): block: fix memory leak for elevator on add_disk failure Zhong Jinghua (9): block: return errors from blk_register_region block: Fix the kabi change in device_add_disk block: Fix the kabi change on blk_register_region block: call blk_get_queue earlier in __device_add_disk block: Fix minor range check in device_add_disk() block: Set memalloc_noio to false in the error path scsi: sd: Clean up sdkp if device_add_disk() failed mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup block/blk-integrity.c | 12 +- block/blk-mq.c | 19 +++ block/blk.h | 5 +- block/genhd.c | 286 ++++++++++++++++++++++++++------------- drivers/block/brd.c | 103 ++++++-------- drivers/block/loop.c | 26 ++-- drivers/block/nbd.c | 59 ++++---- drivers/mtd/ubi/block.c | 76 +++++------ drivers/nvme/host/core.c | 41 +++--- drivers/scsi/sd.c | 8 +- drivers/scsi/sr.c | 7 +- include/linux/blk-mq.h | 12 ++ include/linux/genhd.h | 36 +++++ 13 files changed, 417 insertions(+), 273 deletions(-) -- 2.31.1

2 39

[openEuler/rdma-core] libhns: Support flexible WQE buffer page size
by Chengchang Tang 23 Oct '23

23 Oct '23

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I87LTM -------------------------------------------------------------------------- Currently, driver fixedly allocates 4K pages for user space WQE buffer even in a 64K system. This results in HW reading WQE with a granularity of 4K even in a 64K system. Considering that we support 1024-byte inline, in the scenario of using SQ inline, HW will switch pages every 4 WQEs. This will introduce a delay of about 400ns, which is an average delay of 100ns per packet. In order to improve performance, we allow user-mode drivers to use a larger page size to allocate WQE buffers, thereby reducing the latency introduced by HW page switching. User-mode drivers will be allowed to allocate WQE buffers between 4K to system page size. During ibv_create_qp(), the driver will dynamically select the appropriate page size based on ibv_qp_cap, thus reducing memory consumption while improving performance. This feature needs to be used in conjunction with the kernel-mode driver. In order to ensure forward compatibility, if the kernel-mode driver does not support this feature, the user-mode driver will continue to use a fixed 4K pagesize to allocate WQE buffer. Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> --- kernel-headers/rdma/hns-abi.h | 5 ++- providers/hns/hns_roce_u.c | 2 +- providers/hns/hns_roce_u.h | 1 + providers/hns/hns_roce_u_verbs.c | 65 ++++++++++++++++++++++++++------ 4 files changed, 59 insertions(+), 14 deletions(-) diff --git a/kernel-headers/rdma/hns-abi.h b/kernel-headers/rdma/hns-abi.h index cab941f..157dc9d 100644 --- a/kernel-headers/rdma/hns-abi.h +++ b/kernel-headers/rdma/hns-abi.h @@ -81,7 +81,8 @@ struct hns_roce_ib_create_qp { __u8 log_sq_bb_count; __u8 log_sq_stride; __u8 sq_no_prefetch; - __u8 reserved[5]; + __u8 reserved[4]; + __u8 pageshift; __aligned_u64 sdb_addr; __aligned_u64 comp_mask; __aligned_u64 create_flags; @@ -122,6 +123,7 @@ enum { HNS_ROCE_RQ_INLINE_FLAGS = 1 << 1, HNS_ROCE_CQE_INLINE_FLAGS = 1 << 2, HNS_ROCE_UCTX_CONFIG_DCA = 1 << 3, + HNS_ROCE_UCTX_DYN_QP_PGSZ = 1 << 4, }; enum { @@ -129,6 +131,7 @@ enum { HNS_ROCE_RSP_RQ_INLINE_FLAGS = 1 << 1, HNS_ROCE_RSP_CQE_INLINE_FLAGS = 1 << 2, HNS_ROCE_UCTX_RSP_DCA_FLAGS = HNS_ROCE_UCTX_CONFIG_DCA, + HNS_ROCE_UCTX_RSP_DYN_QP_PGSZ = HNS_ROCE_UCTX_DYN_QP_PGSZ, }; struct hns_roce_ib_alloc_ucontext_resp { diff --git a/providers/hns/hns_roce_u.c b/providers/hns/hns_roce_u.c index 0660081..02ad880 100644 --- a/providers/hns/hns_roce_u.c +++ b/providers/hns/hns_roce_u.c @@ -267,7 +267,7 @@ static void ucontext_set_cmd(struct hns_roce_alloc_ucontext *cmd, struct hnsdv_context_attr *attr) { cmd->config |= HNS_ROCE_EXSGE_FLAGS | HNS_ROCE_RQ_INLINE_FLAGS | - HNS_ROCE_CQE_INLINE_FLAGS; + HNS_ROCE_CQE_INLINE_FLAGS | HNS_ROCE_UCTX_DYN_QP_PGSZ; if (!attr || !(attr->flags & HNSDV_CONTEXT_FLAGS_DCA)) return; diff --git a/providers/hns/hns_roce_u.h b/providers/hns/hns_roce_u.h index 5501d8e..ae9ae51 100644 --- a/providers/hns/hns_roce_u.h +++ b/providers/hns/hns_roce_u.h @@ -409,6 +409,7 @@ struct hns_roce_qp { uint8_t sl; uint8_t tc_mode; uint8_t priority; + uint8_t pageshift; unsigned int qkey; enum ibv_mtu path_mtu; diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c index 7b58dd0..f76341c 100644 --- a/providers/hns/hns_roce_u_verbs.c +++ b/providers/hns/hns_roce_u_verbs.c @@ -1327,31 +1327,69 @@ static void free_recv_rinl_buf(struct hns_roce_rinl_buf *rinl_buf) } } +static void get_best_multi_region_pg_shift(struct hns_roce_device *hr_dev, + struct hns_roce_context *ctx, + struct hns_roce_qp *qp, bool dca_en) +{ + uint32_t ext_sge_size; + uint32_t sq_size; + uint32_t rq_size; + uint8_t pg_shift; + + if (!(ctx->config & HNS_ROCE_UCTX_RSP_DYN_QP_PGSZ) || dca_en) { + qp->pageshift = HNS_HW_PAGE_SHIFT; + return; + } + + /* + * The larger the pagesize used, the better the performance, but it + * may waste more memory. Therefore, we use the least common multiple + * (aligned to power of 2) of sq wqe buffer size, rq wqe buffer size, + * and ext_sge buffer size as the pagesize. Additionally, since the + * kernel cannot guarantee the allocation of contiguous memory larger + * than the system page, the pagesize must be smaller than the system + * page. + */ + sq_size = qp->sq.wqe_cnt << qp->sq.wqe_shift; + ext_sge_size = qp->ex_sge.sge_cnt << qp->ex_sge.sge_shift; + rq_size = qp->rq.wqe_cnt << qp->rq.wqe_shift; + + pg_shift = max_t(uint8_t, sq_size ? hr_ilog32(sq_size) : 0, + ext_sge_size ? hr_ilog32(ext_sge_size) : 0); + pg_shift = max_t(uint8_t, pg_shift, rq_size ? hr_ilog32(rq_size) : 0); + pg_shift = max_t(uint8_t, pg_shift, HNS_HW_PAGE_SHIFT); + qp->pageshift = min_t(uint8_t, pg_shift, hr_ilog32(hr_dev->page_size)); +} + static int calc_qp_buff_size(struct hns_roce_device *hr_dev, - struct hns_roce_qp *qp) + struct hns_roce_context *ctx, + struct hns_roce_qp *qp, bool dca_en) { struct hns_roce_wq *sq = &qp->sq; struct hns_roce_wq *rq = &qp->rq; + unsigned int page_size; unsigned int size; qp->buf_size = 0; + get_best_multi_region_pg_shift(hr_dev, ctx, qp, dca_en); + page_size = 1 << qp->pageshift; /* SQ WQE */ sq->offset = 0; - size = to_hr_hem_entries_size(sq->wqe_cnt, sq->wqe_shift); + size = align(sq->wqe_cnt << sq->wqe_shift, page_size); qp->buf_size += size; /* extend SGE WQE in SQ */ qp->ex_sge.offset = qp->buf_size; if (qp->ex_sge.sge_cnt > 0) { - size = to_hr_hem_entries_size(qp->ex_sge.sge_cnt, - qp->ex_sge.sge_shift); + size = align(qp->ex_sge.sge_cnt << qp->ex_sge.sge_shift, + page_size); qp->buf_size += size; } /* RQ WQE */ rq->offset = qp->buf_size; - size = to_hr_hem_entries_size(rq->wqe_cnt, rq->wqe_shift); + size = align(rq->wqe_cnt << rq->wqe_shift, page_size); qp->buf_size += size; if (qp->buf_size < 1) @@ -1375,7 +1413,7 @@ static inline bool check_qp_support_dca(struct hns_roce_dca_ctx *dca_ctx, if (hns_attr && (hns_attr->comp_mask & HNSDV_QP_INIT_ATTR_MASK_QP_CREATE_FLAGS) && (hns_attr->create_flags & HNSDV_QP_CREATE_ENABLE_DCA_MODE)) - return true; + return dca_ctx->max_size > 0; return false; } @@ -1396,9 +1434,12 @@ static int qp_alloc_wqe(struct ibv_qp_init_attr_ex *attr, struct hns_roce_qp *qp, struct hns_roce_context *ctx) { struct hns_roce_device *hr_dev = to_hr_dev(ctx->ibv_ctx.context.device); + bool dca_en = check_qp_support_dca(&ctx->dca_ctx, attr, hns_attr); + int ret; - if (calc_qp_buff_size(hr_dev, qp)) - return -EINVAL; + ret = calc_qp_buff_size(hr_dev, ctx, qp, dca_en); + if (ret) + return ret; qp->sq.wrid = malloc(qp->sq.wqe_cnt * sizeof(uint64_t)); if (!qp->sq.wrid) @@ -1416,19 +1457,18 @@ static int qp_alloc_wqe(struct ibv_qp_init_attr_ex *attr, goto err_alloc; } - if (check_qp_support_dca(&ctx->dca_ctx, attr, hns_attr) && - ctx->dca_ctx.max_size > 0) { + if (dca_en) { /* when DCA is enabled, use a buffer list to store page addr */ qp->buf.buf = NULL; qp->dca_wqe.max_cnt = hr_hw_page_count(qp->buf_size); - qp->dca_wqe.shift = HNS_HW_PAGE_SHIFT; + qp->dca_wqe.shift = qp->pageshift; qp->dca_wqe.bufs = calloc(qp->dca_wqe.max_cnt, sizeof(void *)); if (!qp->dca_wqe.bufs) goto err_alloc; verbs_debug(&ctx->ibv_ctx, "alloc DCA buf.\n"); } else { if (hns_roce_alloc_buf(&qp->buf, qp->buf_size, - HNS_HW_PAGE_SIZE)) + 1 << qp->pageshift)) goto err_alloc; } @@ -1642,6 +1682,7 @@ static int qp_exec_create_cmd(struct ibv_qp_init_attr_ex *attr, cmd_ex.buf_addr = (uintptr_t)qp->buf.buf; cmd_ex.log_sq_stride = qp->sq.wqe_shift; cmd_ex.log_sq_bb_count = hr_ilog32(qp->sq.wqe_cnt); + cmd_ex.pageshift = qp->pageshift; if (cmd_flag->congest_type_flags) { cmd_ex.comp_mask |= HNS_ROCE_CREATE_QP_MASK_CONGEST_TYPE; -- 2.30.0

1 2