November 2021 - Kernel - mailweb.openeuler.org

[PATCH openEuler-5.10 01/66] ARM: 9132/1: Fix __get_user_check failure with ARM KASAN images
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Lexi Shao <shaolexi(a)huawei.com> stable inclusion from stable-5.10.77 commit 3ceaa85c331d30752af3b88d280cc1bcaee2eb27 bugzilla: 185677 https://gitee.com/openeuler/kernel/issues/I4IAP7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit df909df0770779f1a5560c2bb641a2809655ef28 upstream. ARM: kasan: Fix __get_user_check failure with kasan In macro __get_user_check defined in arch/arm/include/asm/uaccess.h, error code is store in register int __e(r0). When kasan is enabled, assigning value to kernel address might trigger kasan check, which unexpectedly overwrites r0 and causes undefined behavior on arm kasan images. One example is failure in do_futex and results in process soft lockup. Log: watchdog: BUG: soft lockup - CPU#0 stuck for 62946ms! [rs:main Q:Reg:1151] ... (__asan_store4) from (futex_wait_setup+0xf8/0x2b4) (futex_wait_setup) from (futex_wait+0x138/0x394) (futex_wait) from (do_futex+0x164/0xe40) (do_futex) from (sys_futex_time32+0x178/0x230) (sys_futex_time32) from (ret_fast_syscall+0x0/0x50) The soft lockup happens in function futex_wait_setup. The reason is function get_futex_value_locked always return EINVAL, thus pc jump back to retry label and causes looping. This line in function get_futex_value_locked ret = __get_user(*dest, from); is expanded to *dest = (typeof(*(p))) __r2; , in macro __get_user_check. Writing to pointer dest triggers kasan check and overwrites the return value of __get_user_x function. The assembly code of get_futex_value_locked in kernel/futex.c: ... c01f6dc8: eb0b020e bl c04b7608 <__get_user_4> // "x = (typeof(*(p))) __r2;" triggers kasan check and r0 is overwritten c01f6dCc: e1a00007 mov r0, r7 c01f6dd0: e1a05002 mov r5, r2 c01f6dd4: eb04f1e6 bl c0333574 <__asan_store4> c01f6dd8: e5875000 str r5, [r7] // save ret value of __get_user(*dest, from), which is dest address now c01f6ddc: e1a05000 mov r5, r0 ... // checking return value of __get_user failed c01f6e00: e3550000 cmp r5, #0 ... c01f6e0c: 01a00005 moveq r0, r5 // assign return value to EINVAL c01f6e10: 13e0000d mvnne r0, #13 Return value is the destination address of get_user thus certainly non-zero, so get_futex_value_locked always return EINVAL. Fix it by using a tmp vairable to store the error code before the assignment. This fix has no effects to non-kasan images thanks to compiler optimization. It only affects cases that overwrite r0 due to kasan check. This should fix bug discussed in Link: [1] https://lore.kernel.org/linux-arm-kernel/0ef7c2a5-5d8b-c5e0-63fa-31693fd449… Fixes: 421015713b30 ("ARM: 9017/2: Enable KASan for ARM") Signed-off-by: Lexi Shao <shaolexi(a)huawei.com> Signed-off-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- arch/arm/include/asm/uaccess.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h index 476d1a15e669..da2a9e5fc59b 100644 --- a/arch/arm/include/asm/uaccess.h +++ b/arch/arm/include/asm/uaccess.h @@ -200,6 +200,7 @@ extern int __get_user_64t_4(void *); register unsigned long __l asm("r1") = __limit; \ register int __e asm("r0"); \ unsigned int __ua_flags = uaccess_save_and_enable(); \ + int __tmp_e; \ switch (sizeof(*(__p))) { \ case 1: \ if (sizeof((x)) >= 8) \ @@ -227,9 +228,10 @@ extern int __get_user_64t_4(void *); break; \ default: __e = __get_user_bad(); break; \ } \ + __tmp_e = __e; \ uaccess_restore(__ua_flags); \ x = (typeof(*(p))) __r2; \ - __e; \ + __tmp_e; \ }) #define get_user(x, p) \ -- 2.20.1

1 65

[PATCH openEuler-5.10 01/14] block, bfq: fix UAF problem in bfqg_stats_init()
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Zheng Liang <zhengliang6(a)huawei.com> mainline inclusion from mainline commit 2fc428f6b7ca80794cb9928c90d4de524366659f category: bugfix bugzilla: 185657 https://gitee.com/openeuler/kernel/issues/I4DDEL Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- In bfq_pd_alloc(), the function bfqg_stats_init() init bfqg. If blkg_rwstat_init() init bfqg_stats->bytes successful and init bfqg_stats->ios failed, bfqg_stats_init() return failed, bfqg will be freed. But blkg_rwstat->cpu_cnt is not deleted from the list of percpu_counters. If we traverse the list of percpu_counters, It will have UAF problem. we should use blkg_rwstat_exit() to cleanup bfqg_stats bytes in the above scenario. Fixes: commit fd41e60331b ("bfq-iosched: stop using blkg->stat_bytes and ->stat_ios") Signed-off-by: Zheng Liang <zhengliang6(a)huawei.com> Acked-by: Tejun Heo <tj(a)kernel.org> Link: https://lore.kernel.org/r/20211018024225.1493938-1-zhengliang6@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- block/bfq-cgroup.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c index b791e2041e49..a6bcc779c912 100644 --- a/block/bfq-cgroup.c +++ b/block/bfq-cgroup.c @@ -463,7 +463,7 @@ static int bfqg_stats_init(struct bfqg_stats *stats, gfp_t gfp) { if (blkg_rwstat_init(&stats->bytes, gfp) || blkg_rwstat_init(&stats->ios, gfp)) - return -ENOMEM; + goto error; #ifdef CONFIG_BFQ_CGROUP_DEBUG if (blkg_rwstat_init(&stats->merged, gfp) || @@ -476,13 +476,15 @@ static int bfqg_stats_init(struct bfqg_stats *stats, gfp_t gfp) bfq_stat_init(&stats->dequeue, gfp) || bfq_stat_init(&stats->group_wait_time, gfp) || bfq_stat_init(&stats->idle_time, gfp) || - bfq_stat_init(&stats->empty_time, gfp)) { - bfqg_stats_exit(stats); - return -ENOMEM; - } + bfq_stat_init(&stats->empty_time, gfp)) + goto error; #endif return 0; + +error: + bfqg_stats_exit(stats); + return -ENOMEM; } static struct bfq_group_data *cpd_to_bfqgd(struct blkcg_policy_data *cpd) -- 2.20.1

1 13

[openEuler-5.10 1/4] ARM: 9077/1: PLT: Move struct plt_entries definition to header
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Alex Sverdlin <alexander.sverdlin(a)nokia.com> stable inclusion from stable-5.10.69 commit ce90c6706d5a95ddda8d3cea01768bd0b4445851 bugzilla: 182675 https://gitee.com/openeuler/kernel/issues/I4I3ED Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- commit 4e271701c17dee70c6e1351c4d7d42e70405c6a9 upstream upstream No functional change, later it will be re-used in several files. Signed-off-by: Alexander Sverdlin <alexander.sverdlin(a)nokia.com> Signed-off-by: Russell King <rmk+kernel(a)armlinux.org.uk> Signed-off-by: Florian Fainelli <f.fainelli(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/arm/include/asm/module.h Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> Reviewed-by: Yang Jihong <yangjihong1(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- arch/arm/include/asm/module.h | 9 +++++++++ arch/arm/kernel/module-plts.c | 9 --------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/arch/arm/include/asm/module.h b/arch/arm/include/asm/module.h index ac3df84b935c..9b17d2f5ab53 100644 --- a/arch/arm/include/asm/module.h +++ b/arch/arm/include/asm/module.h @@ -19,6 +19,15 @@ enum { }; #endif +#define PLT_ENT_STRIDE L1_CACHE_BYTES +#define PLT_ENT_COUNT (PLT_ENT_STRIDE / sizeof(u32)) +#define PLT_ENT_SIZE (sizeof(struct plt_entries) / PLT_ENT_COUNT) + +struct plt_entries { + u32 ldr[PLT_ENT_COUNT]; + u32 lit[PLT_ENT_COUNT]; +}; + struct mod_plt_sec { int plt_shndx; int plt_count; diff --git a/arch/arm/kernel/module-plts.c b/arch/arm/kernel/module-plts.c index 1dbdf2726505..f019f389337b 100644 --- a/arch/arm/kernel/module-plts.c +++ b/arch/arm/kernel/module-plts.c @@ -12,10 +12,6 @@ #include <asm/cache.h> #include <asm/opcodes.h> -#define PLT_ENT_STRIDE L1_CACHE_BYTES -#define PLT_ENT_COUNT (PLT_ENT_STRIDE / sizeof(u32)) -#define PLT_ENT_SIZE (sizeof(struct plt_entries) / PLT_ENT_COUNT) - #ifdef CONFIG_THUMB2_KERNEL #define PLT_ENT_LDR __opcode_to_mem_thumb32(0xf8dff000 | \ (PLT_ENT_STRIDE - 4)) @@ -24,11 +20,6 @@ (PLT_ENT_STRIDE - 8)) #endif -struct plt_entries { - u32 ldr[PLT_ENT_COUNT]; - u32 lit[PLT_ENT_COUNT]; -}; - static bool in_init(const struct module *mod, unsigned long loc) { return loc - (u32)mod->init_layout.base < mod->init_layout.size; -- 2.20.1

1 3

[PATCH openEuler-5.10 01/16] ext4: avoid recheck extent for EXT4_EX_FORCE_CACHE
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: yangerkun <yangerkun(a)huawei.com> hulk inclusion category: bugfix bugzilla: 182952 https://gitee.com/openeuler/kernel/issues/I4DDEL --------------------------- Buffer with verified means that it has been checked before. No need verify and call set_buffer_verified again. Signed-off-by: yangerkun <yangerkun(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- fs/ext4/extents.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 618675a41efb..a77e25ca6867 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -544,13 +544,16 @@ __read_extent_tree_block(const char *function, unsigned int line, if (err < 0) goto errout; } - if (buffer_verified(bh) && !(flags & EXT4_EX_FORCE_CACHE)) - return bh; - err = __ext4_ext_check(function, line, inode, ext_block_hdr(bh), - depth, pblk, le32_to_cpu(idx->ei_block)); - if (err) - goto errout; - set_buffer_verified(bh); + if (buffer_verified(bh)) { + if (!(flags & EXT4_EX_FORCE_CACHE)) + return bh; + } else { + err = __ext4_ext_check(function, line, inode, ext_block_hdr(bh), + depth, pblk, le32_to_cpu(idx->ei_block)); + if (err) + goto errout; + set_buffer_verified(bh); + } /* * If this is a leaf block, cache all of its entries */ -- 2.20.1

1 15

[PATCH openEuler-5.10 01/92] parisc: math-emu: Fix fall-through warnings
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Helge Deller <deller(a)gmx.de> stable inclusion from stable-5.10.76 commit b3b7f831a49b56c258ab8ef08d04045fcfb9b4a7 bugzilla: 182988 https://gitee.com/openeuler/kernel/issues/I4IAHF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6f1fce595b78b775d7fb585c15c2dc3a6994f96e upstream. Fix lots of fallthrough warnings, e.g.: arch/parisc/math-emu/fpudispatch.c:323:33: warning: this statement may fall through [-Wimplicit-fallthrough=] Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- arch/parisc/math-emu/fpudispatch.c | 56 ++++++++++++++++++++++++++++-- 1 file changed, 53 insertions(+), 3 deletions(-) diff --git a/arch/parisc/math-emu/fpudispatch.c b/arch/parisc/math-emu/fpudispatch.c index 7c46969ead9b..01ed133227c2 100644 --- a/arch/parisc/math-emu/fpudispatch.c +++ b/arch/parisc/math-emu/fpudispatch.c @@ -310,12 +310,15 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) r1 &= ~3; fpregs[t+3] = fpregs[r1+3]; fpregs[t+2] = fpregs[r1+2]; + fallthrough; case 1: /* double */ fpregs[t+1] = fpregs[r1+1]; + fallthrough; case 0: /* single */ fpregs[t] = fpregs[r1]; return(NOEXCEPTION); } + BUG(); case 3: /* FABS */ switch (fmt) { case 2: /* illegal */ @@ -325,13 +328,16 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) r1 &= ~3; fpregs[t+3] = fpregs[r1+3]; fpregs[t+2] = fpregs[r1+2]; + fallthrough; case 1: /* double */ fpregs[t+1] = fpregs[r1+1]; + fallthrough; case 0: /* single */ /* copy and clear sign bit */ fpregs[t] = fpregs[r1] & 0x7fffffff; return(NOEXCEPTION); } + BUG(); case 6: /* FNEG */ switch (fmt) { case 2: /* illegal */ @@ -341,13 +347,16 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) r1 &= ~3; fpregs[t+3] = fpregs[r1+3]; fpregs[t+2] = fpregs[r1+2]; + fallthrough; case 1: /* double */ fpregs[t+1] = fpregs[r1+1]; + fallthrough; case 0: /* single */ /* copy and invert sign bit */ fpregs[t] = fpregs[r1] ^ 0x80000000; return(NOEXCEPTION); } + BUG(); case 7: /* FNEGABS */ switch (fmt) { case 2: /* illegal */ @@ -357,13 +366,16 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) r1 &= ~3; fpregs[t+3] = fpregs[r1+3]; fpregs[t+2] = fpregs[r1+2]; + fallthrough; case 1: /* double */ fpregs[t+1] = fpregs[r1+1]; + fallthrough; case 0: /* single */ /* copy and set sign bit */ fpregs[t] = fpregs[r1] | 0x80000000; return(NOEXCEPTION); } + BUG(); case 4: /* FSQRT */ switch (fmt) { case 0: @@ -376,6 +388,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) case 3: /* quad not implemented */ return(MAJOR_0C_EXCP); } + BUG(); case 5: /* FRND */ switch (fmt) { case 0: @@ -389,7 +402,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) return(MAJOR_0C_EXCP); } } /* end of switch (subop) */ - + BUG(); case 1: /* class 1 */ df = extru(ir,fpdfpos,2); /* get dest format */ if ((df & 2) || (fmt & 2)) { @@ -419,6 +432,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) case 3: /* dbl/dbl */ return(MAJOR_0C_EXCP); } + BUG(); case 1: /* FCNVXF */ switch(fmt) { case 0: /* sgl/sgl */ @@ -434,6 +448,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) return(dbl_to_dbl_fcnvxf(&fpregs[r1],0, &fpregs[t],status)); } + BUG(); case 2: /* FCNVFX */ switch(fmt) { case 0: /* sgl/sgl */ @@ -449,6 +464,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) return(dbl_to_dbl_fcnvfx(&fpregs[r1],0, &fpregs[t],status)); } + BUG(); case 3: /* FCNVFXT */ switch(fmt) { case 0: /* sgl/sgl */ @@ -464,6 +480,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) return(dbl_to_dbl_fcnvfxt(&fpregs[r1],0, &fpregs[t],status)); } + BUG(); case 5: /* FCNVUF (PA2.0 only) */ switch(fmt) { case 0: /* sgl/sgl */ @@ -479,6 +496,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) return(dbl_to_dbl_fcnvuf(&fpregs[r1],0, &fpregs[t],status)); } + BUG(); case 6: /* FCNVFU (PA2.0 only) */ switch(fmt) { case 0: /* sgl/sgl */ @@ -494,6 +512,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) return(dbl_to_dbl_fcnvfu(&fpregs[r1],0, &fpregs[t],status)); } + BUG(); case 7: /* FCNVFUT (PA2.0 only) */ switch(fmt) { case 0: /* sgl/sgl */ @@ -509,10 +528,11 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) return(dbl_to_dbl_fcnvfut(&fpregs[r1],0, &fpregs[t],status)); } + BUG(); case 4: /* undefined */ return(MAJOR_0C_EXCP); } /* end of switch subop */ - + BUG(); case 2: /* class 2 */ fpu_type_flags=fpregs[FPU_TYPE_FLAG_POS]; r2 = extru(ir, fpr2pos, 5) * sizeof(double)/sizeof(u_int); @@ -590,6 +610,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) case 3: /* quad not implemented */ return(MAJOR_0C_EXCP); } + BUG(); case 1: /* FTEST */ switch (fmt) { case 0: @@ -609,8 +630,10 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) case 3: return(MAJOR_0C_EXCP); } + BUG(); } /* end of switch subop */ } /* end of else for PA1.0 & PA1.1 */ + BUG(); case 3: /* class 3 */ r2 = extru(ir,fpr2pos,5) * sizeof(double)/sizeof(u_int); if (r2 == 0) @@ -633,6 +656,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) case 3: /* quad not implemented */ return(MAJOR_0C_EXCP); } + BUG(); case 1: /* FSUB */ switch (fmt) { case 0: @@ -645,6 +669,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) case 3: /* quad not implemented */ return(MAJOR_0C_EXCP); } + BUG(); case 2: /* FMPY */ switch (fmt) { case 0: @@ -657,6 +682,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) case 3: /* quad not implemented */ return(MAJOR_0C_EXCP); } + BUG(); case 3: /* FDIV */ switch (fmt) { case 0: @@ -669,6 +695,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) case 3: /* quad not implemented */ return(MAJOR_0C_EXCP); } + BUG(); case 4: /* FREM */ switch (fmt) { case 0: @@ -681,6 +708,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[]) case 3: /* quad not implemented */ return(MAJOR_0C_EXCP); } + BUG(); } /* end of class 3 switch */ } /* end of switch(class) */ @@ -736,10 +764,12 @@ u_int fpregs[]; return(MAJOR_0E_EXCP); case 1: /* double */ fpregs[t+1] = fpregs[r1+1]; + fallthrough; case 0: /* single */ fpregs[t] = fpregs[r1]; return(NOEXCEPTION); } + BUG(); case 3: /* FABS */ switch (fmt) { case 2: @@ -747,10 +777,12 @@ u_int fpregs[]; return(MAJOR_0E_EXCP); case 1: /* double */ fpregs[t+1] = fpregs[r1+1]; + fallthrough; case 0: /* single */ fpregs[t] = fpregs[r1] & 0x7fffffff; return(NOEXCEPTION); } + BUG(); case 6: /* FNEG */ switch (fmt) { case 2: @@ -758,10 +790,12 @@ u_int fpregs[]; return(MAJOR_0E_EXCP); case 1: /* double */ fpregs[t+1] = fpregs[r1+1]; + fallthrough; case 0: /* single */ fpregs[t] = fpregs[r1] ^ 0x80000000; return(NOEXCEPTION); } + BUG(); case 7: /* FNEGABS */ switch (fmt) { case 2: @@ -769,10 +803,12 @@ u_int fpregs[]; return(MAJOR_0E_EXCP); case 1: /* double */ fpregs[t+1] = fpregs[r1+1]; + fallthrough; case 0: /* single */ fpregs[t] = fpregs[r1] | 0x80000000; return(NOEXCEPTION); } + BUG(); case 4: /* FSQRT */ switch (fmt) { case 0: @@ -785,6 +821,7 @@ u_int fpregs[]; case 3: return(MAJOR_0E_EXCP); } + BUG(); case 5: /* FRMD */ switch (fmt) { case 0: @@ -798,7 +835,7 @@ u_int fpregs[]; return(MAJOR_0E_EXCP); } } /* end of switch (subop */ - + BUG(); case 1: /* class 1 */ df = extru(ir,fpdfpos,2); /* get dest format */ /* @@ -826,6 +863,7 @@ u_int fpregs[]; case 3: /* dbl/dbl */ return(MAJOR_0E_EXCP); } + BUG(); case 1: /* FCNVXF */ switch(fmt) { case 0: /* sgl/sgl */ @@ -841,6 +879,7 @@ u_int fpregs[]; return(dbl_to_dbl_fcnvxf(&fpregs[r1],0, &fpregs[t],status)); } + BUG(); case 2: /* FCNVFX */ switch(fmt) { case 0: /* sgl/sgl */ @@ -856,6 +895,7 @@ u_int fpregs[]; return(dbl_to_dbl_fcnvfx(&fpregs[r1],0, &fpregs[t],status)); } + BUG(); case 3: /* FCNVFXT */ switch(fmt) { case 0: /* sgl/sgl */ @@ -871,6 +911,7 @@ u_int fpregs[]; return(dbl_to_dbl_fcnvfxt(&fpregs[r1],0, &fpregs[t],status)); } + BUG(); case 5: /* FCNVUF (PA2.0 only) */ switch(fmt) { case 0: /* sgl/sgl */ @@ -886,6 +927,7 @@ u_int fpregs[]; return(dbl_to_dbl_fcnvuf(&fpregs[r1],0, &fpregs[t],status)); } + BUG(); case 6: /* FCNVFU (PA2.0 only) */ switch(fmt) { case 0: /* sgl/sgl */ @@ -901,6 +943,7 @@ u_int fpregs[]; return(dbl_to_dbl_fcnvfu(&fpregs[r1],0, &fpregs[t],status)); } + BUG(); case 7: /* FCNVFUT (PA2.0 only) */ switch(fmt) { case 0: /* sgl/sgl */ @@ -916,9 +959,11 @@ u_int fpregs[]; return(dbl_to_dbl_fcnvfut(&fpregs[r1],0, &fpregs[t],status)); } + BUG(); case 4: /* undefined */ return(MAJOR_0C_EXCP); } /* end of switch subop */ + BUG(); case 2: /* class 2 */ /* * Be careful out there. @@ -994,6 +1039,7 @@ u_int fpregs[]; } } /* end of switch subop */ } /* end of else for PA1.0 & PA1.1 */ + BUG(); case 3: /* class 3 */ /* * Be careful out there. @@ -1026,6 +1072,7 @@ u_int fpregs[]; return(dbl_fadd(&fpregs[r1],&fpregs[r2], &fpregs[t],status)); } + BUG(); case 1: /* FSUB */ switch (fmt) { case 0: @@ -1035,6 +1082,7 @@ u_int fpregs[]; return(dbl_fsub(&fpregs[r1],&fpregs[r2], &fpregs[t],status)); } + BUG(); case 2: /* FMPY or XMPYU */ /* * check for integer multiply (x bit set) @@ -1071,6 +1119,7 @@ u_int fpregs[]; &fpregs[r2],&fpregs[t],status)); } } + BUG(); case 3: /* FDIV */ switch (fmt) { case 0: @@ -1080,6 +1129,7 @@ u_int fpregs[]; return(dbl_fdiv(&fpregs[r1],&fpregs[r2], &fpregs[t],status)); } + BUG(); case 4: /* FREM */ switch (fmt) { case 0: -- 2.20.1

1 91

[PATCH openEuler-5.10 001/100] ALSA: usb-audio: Add quirk for VF0770
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Jonas Hahnfeld <hahnjo(a)hahnjo.de> stable inclusion from stable-5.10.75 commit f077d699c1d2aa05c8d5982bd646b040353f052c bugzilla: 182987 https://gitee.com/openeuler/kernel/issues/I4I3MP Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48827e1d6af58f219e89c7ec08dccbca28c7694e upstream. The device advertises 8 formats, but only a rate of 48kHz is honored by the hardware and 24 bits give chopped audio, so only report the one working combination. This fixes out-of-the-box audio experience with PipeWire which otherwise attempts to choose S24_3LE (while PulseAudio defaulted to S16_LE). Signed-off-by: Jonas Hahnfeld <hahnjo(a)hahnjo.de> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20211012200906.3492-1-hahnjo@hahnjo.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- sound/usb/quirks-table.h | 42 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h index 5728bf722c88..7c649cd38049 100644 --- a/sound/usb/quirks-table.h +++ b/sound/usb/quirks-table.h @@ -77,6 +77,48 @@ /* E-Mu 0204 USB */ { USB_DEVICE_VENDOR_SPEC(0x041e, 0x3f19) }, +/* + * Creative Technology, Ltd Live! Cam Sync HD [VF0770] + * The device advertises 8 formats, but only a rate of 48kHz is honored by the + * hardware and 24 bits give chopped audio, so only report the one working + * combination. + */ +{ + USB_DEVICE(0x041e, 0x4095), + .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { + .ifnum = QUIRK_ANY_INTERFACE, + .type = QUIRK_COMPOSITE, + .data = &(const struct snd_usb_audio_quirk[]) { + { + .ifnum = 2, + .type = QUIRK_AUDIO_STANDARD_MIXER, + }, + { + .ifnum = 3, + .type = QUIRK_AUDIO_FIXED_ENDPOINT, + .data = &(const struct audioformat) { + .formats = SNDRV_PCM_FMTBIT_S16_LE, + .channels = 2, + .fmt_bits = 16, + .iface = 3, + .altsetting = 4, + .altset_idx = 4, + .endpoint = 0x82, + .ep_attr = 0x05, + .rates = SNDRV_PCM_RATE_48000, + .rate_min = 48000, + .rate_max = 48000, + .nr_rates = 1, + .rate_table = (unsigned int[]) { 48000 }, + }, + }, + { + .ifnum = -1 + }, + }, + }, +}, + /* * HP Wireless Audio * When not ignored, causes instability issues for some users, forcing them to -- 2.20.1

1 99

[PATCH openEuler-5.10 01/20] ASoC: Intel: sof_sdw: tag SoundWire BEs as non-atomic
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> stable inclusion from stable-5.10.74 commit 0bcfa99e8faeef75567e6d3a5ac9680d28240b21 bugzilla: 182986 https://gitee.com/openeuler/kernel/issues/I4I3MG Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 58eafe1ff52ee1ce255759fc15729519af180cbb ] The SoundWire BEs make use of 'stream' functions for .prepare and .trigger. These functions will in turn force a Bank Switch, which implies a wait operation. Mark SoundWire BEs as nonatomic for consistency, but keep all other types of BEs as is. The initialization of .nonatomic is done outside of the create_sdw_dailink helper to avoid adding more parameters to deal with a single exception to the rule that BEs are atomic. Suggested-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Reviewed-by: Rander Wang <rander.wang(a)intel.com> Reviewed-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Reviewed-by: Bard Liao <bard.liao(a)intel.com> Link: https://lore.kernel.org/r/20210907184436.33152-1-pierre-louis.bossart@linux… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- sound/soc/intel/boards/sof_sdw.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c index 2770e8179983..25548555d8d7 100644 --- a/sound/soc/intel/boards/sof_sdw.c +++ b/sound/soc/intel/boards/sof_sdw.c @@ -847,6 +847,11 @@ static int create_sdw_dailink(struct device *dev, int *be_index, cpus + *cpu_id, cpu_dai_num, codecs, codec_num, NULL, &sdw_ops); + /* + * SoundWire DAILINKs use 'stream' functions and Bank Switch operations + * based on wait_for_completion(), tag them as 'nonatomic'. + */ + dai_links[*be_index].nonatomic = true; ret = set_codec_init_func(link, dai_links + (*be_index)++, playback, group_id); -- 2.20.1

1 19

[PATCH openEuler-5.10 01/80] Partially revert "usb: Kconfig: using select for USB_COMMON dependency"
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Ben Hutchings <ben(a)decadent.org.uk> stable inclusion from stable-5.10.73 commit 16d728110bd76d1ebb4aad8bcf36596f7ce11be0 bugzilla: 182983 https://gitee.com/openeuler/kernel/issues/I4I3M0 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4d1aa9112c8e6995ef2c8a76972c9671332ccfea upstream. This reverts commit cb9c1cfc86926d0e86d19c8e34f6c23458cd3478 for USB_LED_TRIG. This config symbol has bool type and enables extra code in usb_common itself, not a separate driver. Enabling it should not force usb_common to be built-in! Fixes: cb9c1cfc8692 ("usb: Kconfig: using select for USB_COMMON dependency") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Ben Hutchings <ben(a)decadent.org.uk> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Link: https://lore.kernel.org/r/20210921143442.340087-1-carnil@debian.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- drivers/usb/common/Kconfig | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/usb/common/Kconfig b/drivers/usb/common/Kconfig index 5e8a04e3dd3c..b856622431a7 100644 --- a/drivers/usb/common/Kconfig +++ b/drivers/usb/common/Kconfig @@ -6,8 +6,7 @@ config USB_COMMON config USB_LED_TRIG bool "USB LED Triggers" - depends on LEDS_CLASS && LEDS_TRIGGERS - select USB_COMMON + depends on LEDS_CLASS && USB_COMMON && LEDS_TRIGGERS help This option adds LED triggers for USB host and/or gadget activity. -- 2.20.1

1 79

[PATCH openEuler-5.10 1/7] nbd: don't handle response without a corresponding request message
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-next-20211018 commit b5644a3a79bf3be5f1238db1b2f241374b27b0f0 category: bugfix bugzilla: 49890 https://gitee.com/openeuler/kernel/issues/I4DDEL Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- While handling a response message from server, nbd_read_stat() will try to get request by tag, and then complete the request. However, this is problematic if nbd haven't sent a corresponding request message: t1 t2 submit_bio nbd_queue_rq blk_mq_start_request recv_work nbd_read_stat blk_mq_tag_to_rq blk_mq_complete_request nbd_send_cmd Thus add a new cmd flag 'NBD_CMD_INFLIGHT', it will be set in nbd_send_cmd() and checked in nbd_read_stat(). Noted that this patch can't fix that blk_mq_tag_to_rq() might return a freed request, and this will be fixed in following patches. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Link: https://lore.kernel.org/r/20210916093350.1410403-2-yukuai3@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- drivers/block/nbd.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 8a841d5f422d..cdee84f3c672 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -122,6 +122,12 @@ struct nbd_device { }; #define NBD_CMD_REQUEUED 1 +/* + * This flag will be set if nbd_queue_rq() succeed, and will be checked and + * cleared in completion. Both setting and clearing of the flag are protected + * by cmd->lock. + */ +#define NBD_CMD_INFLIGHT 2 struct nbd_cmd { struct nbd_device *nbd; @@ -389,6 +395,7 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req, if (!mutex_trylock(&cmd->lock)) return BLK_EH_RESET_TIMER; + __clear_bit(NBD_CMD_INFLIGHT, &cmd->flags); if (!refcount_inc_not_zero(&nbd->config_refs)) { cmd->status = BLK_STS_TIMEOUT; mutex_unlock(&cmd->lock); @@ -718,6 +725,12 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index) cmd = blk_mq_rq_to_pdu(req); mutex_lock(&cmd->lock); + if (!__test_and_clear_bit(NBD_CMD_INFLIGHT, &cmd->flags)) { + dev_err(disk_to_dev(nbd->disk), "Suspicious reply %d (status %u flags %lu)", + tag, cmd->status, cmd->flags); + ret = -ENOENT; + goto out; + } if (cmd->cmd_cookie != nbd_handle_to_cookie(handle)) { dev_err(disk_to_dev(nbd->disk), "Double reply on req %p, cmd_cookie %u, handle cookie %u\n", req, cmd->cmd_cookie, nbd_handle_to_cookie(handle)); @@ -817,6 +830,7 @@ static bool nbd_clear_req(struct request *req, void *data, bool reserved) return true; mutex_lock(&cmd->lock); + __clear_bit(NBD_CMD_INFLIGHT, &cmd->flags); cmd->status = BLK_STS_IOERR; mutex_unlock(&cmd->lock); @@ -953,7 +967,13 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index) * returns EAGAIN can be retried on a different socket. */ ret = nbd_send_cmd(nbd, cmd, index); - if (ret == -EAGAIN) { + /* + * Access to this flag is protected by cmd->lock, thus it's safe to set + * the flag after nbd_send_cmd() succeed to send request to server. + */ + if (!ret) + __set_bit(NBD_CMD_INFLIGHT, &cmd->flags); + else if (ret == -EAGAIN) { dev_err_ratelimited(disk_to_dev(nbd->disk), "Request send failed, requeueing\n"); nbd_mark_nsock_dead(nbd, nsock, 1); -- 2.20.1

1 6

[PATCH openEuler-5.10 01/29] spi: rockchip: handle zero length transfers without timing out
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Tobias Schramm <t.schramm(a)manjaro.org> stable inclusion from stable-5.10.72 commit 2ababcd8c2ababe7f11032b928b9e8ab35af5e8c bugzilla: 182982 https://gitee.com/openeuler/kernel/issues/I4I3L1 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5457773ef99f25fcc4b238ac76b68e28273250f4 ] Previously zero length transfers submitted to the Rokchip SPI driver would time out in the SPI layer. This happens because the SPI peripheral does not trigger a transfer completion interrupt for zero length transfers. Fix that by completing zero length transfers immediately at start of transfer. Signed-off-by: Tobias Schramm <t.schramm(a)manjaro.org> Link: https://lore.kernel.org/r/20210827050357.165409-1-t.schramm@manjaro.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- drivers/spi/spi-rockchip.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c index 0aab37cd64e7..624273d0e727 100644 --- a/drivers/spi/spi-rockchip.c +++ b/drivers/spi/spi-rockchip.c @@ -582,6 +582,12 @@ static int rockchip_spi_transfer_one( int ret; bool use_dma; + /* Zero length transfers won't trigger an interrupt on completion */ + if (!xfer->len) { + spi_finalize_current_transfer(ctlr); + return 1; + } + WARN_ON(readl_relaxed(rs->regs + ROCKCHIP_SPI_SSIENR) && (readl_relaxed(rs->regs + ROCKCHIP_SPI_SR) & SR_BUSY)); -- 2.20.1

1 28

[PATCH openEuler-5.10 01/86] tty: Fix out-of-bound vmalloc access in imageblit
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Igor Matheus Andrade Torrente <igormtorrente(a)gmail.com> stable inclusion from stable-5.10.71 commit d570c48dd37dbe8fc6875d4461d01a9554ae2560 bugzilla: 182981 https://gitee.com/openeuler/kernel/issues/I4I3KD Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3b0c406124719b625b1aba431659f5cdc24a982c ] This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values. If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value. To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently. Cc: stable <stable(a)vger.kernel.org> # after 5.15-rc2 is out, give it time to bake Reported-and-tested-by: syzbot+858dc7a2f7ef07c2c219(a)syzkaller.appspotmail.com Signed-off-by: Igor Matheus Andrade Torrente <igormtorrente(a)gmail.com> Link: https://lore.kernel.org/r/20210628134509.15895-1-igormtorrente@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- drivers/tty/vt/vt.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index cea40ef090b7..a7ee1171eeb3 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -1220,8 +1220,25 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, new_row_size = new_cols << 1; new_screen_size = new_row_size * new_rows; - if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) - return 0; + if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) { + /* + * This function is being called here to cover the case + * where the userspace calls the FBIOPUT_VSCREENINFO twice, + * passing the same fb_var_screeninfo containing the fields + * yres/xres equal to a number non-multiple of vc_font.height + * and yres_virtual/xres_virtual equal to number lesser than the + * vc_font.height and yres/xres. + * In the second call, the struct fb_var_screeninfo isn't + * being modified by the underlying driver because of the + * if above, and this causes the fbcon_display->vrows to become + * negative and it eventually leads to out-of-bound + * access by the imageblit function. + * To give the correct values to the struct and to not have + * to deal with possible errors from the code below, we call + * the resize_screen here as well. + */ + return resize_screen(vc, new_cols, new_rows, user); + } if (new_screen_size > KMALLOC_MAX_SIZE || !new_screen_size) return -EINVAL; -- 2.20.1

1 85

[PATCH openEuler-5.10 01/13] cgroup: Fix memory leak caused by missing cgroup_bpf_offline
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Quanyang Wang <quanyang.wang(a)windriver.com> mainline inclusion from mainline commit 04f8ef5643bcd8bcde25dfdebef998aea480b2ba category: bugfix bugzilla: 182945 https://gitee.com/openeuler/kernel/issues/I4DDEL Reference: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/… --------------------------- When enabling CONFIG_CGROUP_BPF, kmemleak can be observed by running the command as below: $mount -t cgroup -o none,name=foo cgroup cgroup/ $umount cgroup/ unreferenced object 0xc3585c40 (size 64): comm "mount", pid 425, jiffies 4294959825 (age 31.990s) hex dump (first 32 bytes): 01 00 00 80 84 8c 28 c0 00 00 00 00 00 00 00 00 ......(......... 00 00 00 00 00 00 00 00 6c 43 a0 c3 00 00 00 00 ........lC...... backtrace: [<e95a2f9e>] cgroup_bpf_inherit+0x44/0x24c [<1f03679c>] cgroup_setup_root+0x174/0x37c [<ed4b0ac5>] cgroup1_get_tree+0x2c0/0x4a0 [<f85b12fd>] vfs_get_tree+0x24/0x108 [<f55aec5c>] path_mount+0x384/0x988 [<e2d5e9cd>] do_mount+0x64/0x9c [<208c9cfe>] sys_mount+0xfc/0x1f4 [<06dd06e0>] ret_fast_syscall+0x0/0x48 [<a8308cb3>] 0xbeb4daa8 This is because that since the commit 2b0d3d3e4fcf ("percpu_ref: reduce memory footprint of percpu_ref in fast path") root_cgrp->bpf.refcnt.data is allocated by the function percpu_ref_init in cgroup_bpf_inherit which is called by cgroup_setup_root when mounting, but not freed along with root_cgrp when umounting. Adding cgroup_bpf_offline which calls percpu_ref_kill to cgroup_kill_sb can free root_cgrp->bpf.refcnt.data in umount path. This patch also fixes the commit 4bfc0bb2c60e ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself"). A cgroup_bpf_offline is needed to do a cleanup that frees the resources which are allocated by cgroup_bpf_inherit in cgroup_setup_root. And inside cgroup_bpf_offline, cgroup_get() is at the beginning and cgroup_put is at the end of cgroup_bpf_release which is called by cgroup_bpf_offline. So cgroup_bpf_offline can keep the balance of cgroup's refcount. Fixes: 2b0d3d3e4fcf ("percpu_ref: reduce memory footprint of percpu_ref in fast path") Fixes: 4bfc0bb2c60e ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself") Signed-off-by: Quanyang Wang <quanyang.wang(a)windriver.com> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Acked-by: Roman Gushchin <guro(a)fb.com> Acked-by: John Fastabend <john.fastabend(a)gmail.com> Link: https://lore.kernel.org/bpf/20211018075623.26884-1-quanyang.wang@windriver.… Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> Reviewed-by: weiyang wang <wangweiyang2(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- kernel/cgroup/cgroup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 86ab4a1305f6..5e4a50091c18 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -2159,8 +2159,10 @@ static void cgroup_kill_sb(struct super_block *sb) * And don't kill the default root. */ if (list_empty(&root->cgrp.self.children) && root != &cgrp_dfl_root && - !percpu_ref_is_dying(&root->cgrp.self.refcnt)) + !percpu_ref_is_dying(&root->cgrp.self.refcnt)) { + cgroup_bpf_offline(&root->cgrp); percpu_ref_kill(&root->cgrp.self.refcnt); + } cgroup_put(&root->cgrp); kernfs_kill_sb(sb); } -- 2.20.1

1 12

[PATCH openEuler-5.10 01/97] PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Pali Rohár <pali(a)kernel.org> stable inclusion from stable-5.10.70 commit 31bd6cd06a18315c9a1b4c6035d027f086c59942 bugzilla: 182949 https://gitee.com/openeuler/kernel/issues/I4I3GQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2b58db229eb617d97d5746113b77045f1f884bcb upstream. Measurements in different conditions showed that aardvark hardware PIO response can take up to 1.44s. Increase wait timeout from 1ms to 1.5s to ensure that we do not miss responses from hardware. After 1.44s hardware returns errors (e.g. Completer abort). The previous two patches fixed checking for PIO status, so now we can use it to also catch errors which are reported by hardware after 1.44s. After applying this patch, kernel can detect and print PIO errors to dmesg: [ 6.879999] advk-pcie d0070000.pcie: Non-posted PIO Response Status: CA, 0xe00 @ 0x100004 [ 6.896436] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100004 [ 6.913049] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100010 [ 6.929663] advk-pcie d0070000.pcie: Non-posted PIO Response Status: CA, 0xe00 @ 0x100010 [ 6.953558] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100014 [ 6.970170] advk-pcie d0070000.pcie: Non-posted PIO Response Status: CA, 0xe00 @ 0x100014 [ 6.994328] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100004 Without this patch kernel prints only a generic error to dmesg: [ 5.246847] advk-pcie d0070000.pcie: config read/write timed out Link: https://lore.kernel.org/r/20210722144041.12661-3-pali@kernel.org Signed-off-by: Pali Rohár <pali(a)kernel.org> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi(a)arm.com> Reviewed-by: Marek Behún <kabel(a)kernel.org> Cc: stable(a)vger.kernel.org # 7fbcb5da811b ("PCI: aardvark: Don't rely on jiffies while holding spinlock") Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- drivers/pci/controller/pci-aardvark.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c index f175cff39b46..4f1a29ede576 100644 --- a/drivers/pci/controller/pci-aardvark.c +++ b/drivers/pci/controller/pci-aardvark.c @@ -214,7 +214,7 @@ (PCIE_CONF_BUS(bus) | PCIE_CONF_DEV(PCI_SLOT(devfn)) | \ PCIE_CONF_FUNC(PCI_FUNC(devfn)) | PCIE_CONF_REG(where)) -#define PIO_RETRY_CNT 500 +#define PIO_RETRY_CNT 750000 /* 1.5 s */ #define PIO_RETRY_DELAY 2 /* 2 us*/ #define LINK_WAIT_MAX_RETRIES 10 -- 2.20.1

1 96

[PATCH openEuler-5.10 1/5] arm64: remove page granularity limitation from KFENCE
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Liu Shixin <liushixin2(a)huawei.com> hulk inclusion category: bugfix bugzilla: 181005 https://gitee.com/openeuler/kernel/issues/I4DDEL ------------------------------------------------- Currently if KFENCE is enabled in arm64, the entire linear map will be mapped at page granularity which seems overkilled. Actually only the kfence pool requires to be mapped at page granularity. We can remove the restriction from KFENCE and force the linear mapping of the kfence pool at page granularity later in arch_kfence_init_pool(). Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- arch/arm64/include/asm/kfence.h | 70 ++++++++++++++++++++++++++++++++- arch/arm64/mm/mmu.c | 6 +-- 2 files changed, 71 insertions(+), 5 deletions(-) diff --git a/arch/arm64/include/asm/kfence.h b/arch/arm64/include/asm/kfence.h index d061176d57ea..322e95bc228d 100644 --- a/arch/arm64/include/asm/kfence.h +++ b/arch/arm64/include/asm/kfence.h @@ -8,9 +8,77 @@ #ifndef __ASM_KFENCE_H #define __ASM_KFENCE_H +#include <linux/kfence.h> #include <asm/cacheflush.h> +#include <asm/pgalloc.h> -static inline bool arch_kfence_init_pool(void) { return true; } +static inline int split_pud_page(pud_t *pud, unsigned long addr) +{ + int i; + pmd_t *pmd = pmd_alloc_one(&init_mm, addr); + unsigned long pfn = PFN_DOWN(__pa(addr)); + + if (!pmd) + return -ENOMEM; + + for (i = 0; i < PTRS_PER_PMD; i++) + set_pmd(pmd + i, pmd_mkhuge(pfn_pmd(pfn + i * PTRS_PER_PTE, PAGE_KERNEL))); + + smp_wmb(); /* See comment in __pte_alloc */ + pud_populate(&init_mm, pud, pmd); + + flush_tlb_kernel_range(addr, addr + PUD_SIZE); + return 0; +} + +static inline int split_pmd_page(pmd_t *pmd, unsigned long addr) +{ + int i; + pte_t *pte = pte_alloc_one_kernel(&init_mm); + unsigned long pfn = PFN_DOWN(__pa(addr)); + + if (!pte) + return -ENOMEM; + + for (i = 0; i < PTRS_PER_PTE; i++) + set_pte(pte + i, pfn_pte(pfn + i, PAGE_KERNEL)); + + smp_wmb(); /* See comment in __pte_alloc */ + pmd_populate_kernel(&init_mm, pmd, pte); + + flush_tlb_kernel_range(addr, addr + PMD_SIZE); + return 0; +} + +static inline bool arch_kfence_init_pool(void) +{ + unsigned long addr; + pgd_t *pgd; + p4d_t *p4d; + pud_t *pud; + pmd_t *pmd; + + for (addr = (unsigned long)__kfence_pool; is_kfence_address((void *)addr); + addr += PAGE_SIZE) { + pgd = pgd_offset(&init_mm, addr); + if (pgd_leaf(*pgd)) + return false; + p4d = p4d_offset(pgd, addr); + if (p4d_leaf(*p4d)) + return false; + pud = pud_offset(p4d, addr); + if (pud_leaf(*pud)) { + if (split_pud_page(pud, addr & PUD_MASK)) + return false; + } + pmd = pmd_offset(pud, addr); + if (pmd_leaf(*pmd)) { + if (split_pmd_page(pmd, addr & PMD_MASK)) + return false; + } + } + return true; +} static inline bool kfence_protect_page(unsigned long addr, bool protect) { diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index b6a9895d6655..1c2a965e65b3 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -492,8 +492,7 @@ static void __init map_mem(pgd_t *pgdp) int flags = 0; u64 i; - if (rodata_full || crash_mem_map || debug_pagealloc_enabled() || - IS_ENABLED(CONFIG_KFENCE)) + if (rodata_full || crash_mem_map || debug_pagealloc_enabled()) flags = NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS; /* @@ -1458,8 +1457,7 @@ int arch_add_memory(int nid, u64 start, u64 size, * KFENCE requires linear map to be mapped at page granularity, so that * it is possible to protect/unprotect single pages in the KFENCE pool. */ - if (rodata_full || debug_pagealloc_enabled() || - IS_ENABLED(CONFIG_KFENCE)) + if (rodata_full || debug_pagealloc_enabled()) flags = NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS; __create_pgd_mapping(swapper_pg_dir, start, __phys_to_virt(start), -- 2.20.1

1 4

[PATCH openEuler-5.10 01/56] PCI: pci-bridge-emul: Add PCIe Root Capabilities Register
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Pali Rohár <pali(a)kernel.org> stable inclusion from stable-5.10.69 commit 9e766b86a9ef653a8ca48a9f70d3dbb580284594 bugzilla: 182675 https://gitee.com/openeuler/kernel/issues/I4I3ED Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e902bb7c24a7099d0eb0eb4cba06f2d91e9299f3 upstream. The 16-bit Root Capabilities register is at offset 0x1e in the PCIe Capability. Rename current 'rsvd' struct member to 'rootcap'. Link: https://lore.kernel.org/r/20210722144041.12661-4-pali@kernel.org Signed-off-by: Pali Rohár <pali(a)kernel.org> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi(a)arm.com> Reviewed-by: Marek Behún <kabel(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- drivers/pci/pci-bridge-emul.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/pci-bridge-emul.h b/drivers/pci/pci-bridge-emul.h index b31883022a8e..49bbd37ee318 100644 --- a/drivers/pci/pci-bridge-emul.h +++ b/drivers/pci/pci-bridge-emul.h @@ -54,7 +54,7 @@ struct pci_bridge_emul_pcie_conf { __le16 slotctl; __le16 slotsta; __le16 rootctl; - __le16 rsvd; + __le16 rootcap; __le32 rootsta; __le32 devcap2; __le16 devctl2; -- 2.20.1

1 55

[PATCH openEuler-5.10 01/26] sched/fair: fix sd_llc_alloc_all() compile error
by Zheng Zengkai 15 Nov '21

15 Nov '21

From: Cheng Jian <cj.chengjian(a)huawei.com> hulk inclusion category: bugfix bugzilla: 38261, https://gitee.com/openeuler/kernel/issues/I49XPZ CVE: NA --------------------------- when CONFIG_SCHED_STEAL disabled: kernel/sched/topology.c:24:74: warning: ‘struct s_data’ declared inside parameter list will not be visible outside of this definition or declaration 24 | static inline int sd_llc_alloc_all(const struct cpumask *cpu_map, struct s_data *d) { return 0; } | ^~~~~~ kernel/sched/topology.c: In function ‘build_sched_domains’: kernel/sched/topology.c:2188:32: error: passing argument 2 of ‘sd_llc_alloc_all’ from incompatible pointer type [-Werror=incompatible-pointer-types] 2188 | if (sd_llc_alloc_all(cpu_map, &d)) | ^~ | | | struct s_data * Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- kernel/sched/topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c index 0564aeabbcb8..fcf6aebb13c4 100644 --- a/kernel/sched/topology.c +++ b/kernel/sched/topology.c @@ -13,8 +13,8 @@ DEFINE_MUTEX(sched_domains_mutex); static cpumask_var_t sched_domains_tmpmask; static cpumask_var_t sched_domains_tmpmask2; -#ifdef CONFIG_SCHED_STEAL struct s_data; +#ifdef CONFIG_SCHED_STEAL static int sd_llc_alloc(struct sched_domain *sd); static void sd_llc_free(struct sched_domain *sd); static int sd_llc_alloc_all(const struct cpumask *cpu_map, struct s_data *d); -- 2.20.1

1 25

[PATCH openEuler-1.0-LTS] iommu: smmuv2: fix compile error when CONFIG_ARCH_PHYTIUM is off
by Yang Yingliang 15 Nov '21

15 Nov '21

From: Zheng Zengkai <zhengzengkai(a)huawei.com> phytium inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I41AUQ -------------------------------------- Disabling CONFIG_ARCH_PHYTIUM results in following compile errors: drivers/iommu/arm-smmu.c: In function ‘phytium_smmu_def_domain_type’: drivers/iommu/arm-smmu.c:1641:6: error: implicit declaration of function ‘typeof_ft2000plus’ [-Werror=implicit-function-declaration] 1641 | if (typeof_ft2000plus() || typeof_s2500()) { | ^~~~~~~~~~~~~~~~~ drivers/iommu/arm-smmu.c:1641:29: error: implicit declaration of function ‘typeof_s2500’ [-Werror=implicit-function-declaration] 1641 | if (typeof_ft2000plus() || typeof_s2500()) { | ^~~~~~~~~~~~ cc1: some warnings being treated as errors Fix it by using CONFIG_ARCH_PHYTIUM to control phytium related code. Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Zhen Lei <thunder.leizhen(a)huawei.com> Reviewed-by: wangxiongfeng 00379786 <wangxiongfeng2(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/arm-smmu.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c index 18863198bb036..d1c00b1dfd2ef 100644 --- a/drivers/iommu/arm-smmu.c +++ b/drivers/iommu/arm-smmu.c @@ -1634,8 +1634,7 @@ static void arm_smmu_put_resv_regions(struct device *dev, #ifdef CONFIG_SMMU_BYPASS_DEV -#ifdef CONFIG_ARM64 -#include <asm/cputype.h> +#ifdef CONFIG_ARCH_PHYTIUM static int phytium_smmu_def_domain_type(struct device *dev, unsigned int *type) { if (typeof_ft2000plus() || typeof_s2500()) { -- 2.25.1

1 0

[PATCH OLK-5.10] SCSI: spfc: fix typo of last_cmsn
by Yanling Song 15 Nov '21

15 Nov '21

Ramaxel inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4I0OZ CVE: NA Fix typo of last_cmsn which should be last_pmsn Signed-off-by: Yanling Song <songyl(a)ramaxel.com> --- drivers/scsi/spfc/hw/spfc_queue.c | 28 ++++++++++++++-------------- drivers/scsi/spfc/hw/spfc_queue.h | 2 +- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/drivers/scsi/spfc/hw/spfc_queue.c b/drivers/scsi/spfc/hw/spfc_queue.c index 3f73fa26aad1..abcf1ff3f49f 100644 --- a/drivers/scsi/spfc/hw/spfc_queue.c +++ b/drivers/scsi/spfc/hw/spfc_queue.c @@ -1027,7 +1027,7 @@ u32 spfc_create_ssq(void *handle) sq_ctrl->wqe_offset = 0; sq_ctrl->head_start_cmsn = 0; sq_ctrl->head_end_cmsn = SPFC_GET_WP_END_CMSN(0, sq_ctrl->wqe_num_per_buf); - sq_ctrl->last_cmsn = 0; + sq_ctrl->last_pmsn = 0; /* Linked List SQ Owner Bit 1 valid,0 invalid */ sq_ctrl->last_pi_owner = 1; atomic_set(&sq_ctrl->sq_valid, true); @@ -3127,7 +3127,7 @@ static u32 spfc_parent_sq_ring_direct_wqe_doorbell(struct spfc_parent_ssq_info * struct spfc_hba_info *hba; hba = (struct spfc_hba_info *)sq->hba; - pmsn = sq->last_cmsn; + pmsn = sq->last_pmsn; if (sq->cache_id == INVALID_VALUE32) { FC_DRV_PRINT(UNF_LOG_IO_ATT, UNF_ERR, @@ -3166,7 +3166,7 @@ u32 spfc_parent_sq_ring_doorbell(struct spfc_parent_ssq_info *sq, u8 qos_level, struct spfc_parent_sq_db door_bell; hba = (struct spfc_hba_info *)sq->hba; - pmsn = sq->last_cmsn; + pmsn = sq->last_pmsn; /* Obtain the low 8 Bit of PMSN */ pmsn_lo = (u8)(pmsn & SPFC_PMSN_MASK); /* Obtain the high 8 Bit of PMSN */ @@ -3231,10 +3231,10 @@ u32 spfc_direct_sq_enqueue(struct spfc_parent_ssq_info *ssq, struct spfc_sqe *io FC_DRV_PRINT(UNF_LOG_NORMAL, UNF_INFO, "[info]Ssq(0x%x), xid(0x%x) qid(0x%x) add wqepage at Pmsn(0x%x), sqe_minus_cqe_cnt(0x%x)", ssq->sqn, ssq->context_id, ssq->sq_queue_id, - ssq->last_cmsn, + ssq->last_pmsn, atomic_read(&ssq->sqe_minus_cqe_cnt)); - link_wqe_msn = SPFC_MSN_DEC(ssq->last_cmsn); + link_wqe_msn = SPFC_MSN_DEC(ssq->last_pmsn); link_wqe = (struct spfc_linkwqe *)spfc_get_wqe_page_entry(tail_wpg, ssq->wqe_offset); msn_wd = be32_to_cpu(link_wqe->val_wd1); @@ -3250,7 +3250,7 @@ u32 spfc_direct_sq_enqueue(struct spfc_parent_ssq_info *ssq, struct spfc_sqe *io } sqe_in_wp = (struct spfc_sqe *)spfc_get_wqe_page_entry(tail_wpg, ssq->wqe_offset); - spfc_build_wqe_owner_pmsn(io_sqe, (ssq->last_pi_owner), ssq->last_cmsn); + spfc_build_wqe_owner_pmsn(io_sqe, (ssq->last_pi_owner), ssq->last_pmsn); SPFC_IO_STAT((struct spfc_hba_info *)ssq->hba, wqe_type); wqe_gpa = tail_wpg->wpg_phy_addr + (ssq->wqe_offset * sizeof(struct spfc_sqe)); @@ -3260,11 +3260,11 @@ u32 spfc_direct_sq_enqueue(struct spfc_parent_ssq_info *ssq, struct spfc_sqe *io dre_door_bell.wd0.cos = 0; dre_door_bell.wd0.c = 0; dre_door_bell.wd0.pi_hi = - (u32)(ssq->last_cmsn >> UNF_SHIFT_12) & SPFC_DB_WD0_PI_H_MASK; + (u32)(ssq->last_pmsn >> UNF_SHIFT_12) & SPFC_DB_WD0_PI_H_MASK; dre_door_bell.wd0.cntx_size = SPFC_CNTX_SIZE_T_256B; dre_door_bell.wd0.xid = ssq->context_id; dre_door_bell.wd1.sm_data = ssq->cache_id; - dre_door_bell.wd1.pi_lo = (u32)(ssq->last_cmsn & SPFC_DB_WD0_PI_L_MASK); + dre_door_bell.wd1.pi_lo = (u32)(ssq->last_pmsn & SPFC_DB_WD0_PI_L_MASK); io_sqe->db_val = *(u64 *)&dre_door_bell; spfc_convert_parent_wqe_to_big_endian(io_sqe); @@ -3275,7 +3275,7 @@ u32 spfc_direct_sq_enqueue(struct spfc_parent_ssq_info *ssq, struct spfc_sqe *io "[INFO]Ssq(0x%x) xid:0x%x,qid:0x%x wqegpa:0x%llx,o:0x%x,outstandind:0x%x,pmsn:0x%x,cmsn:0x%x", ssq->sqn, ssq->context_id, ssq->sq_queue_id, wqe_gpa, ssq->last_pi_owner, atomic_read(&ssq->sqe_minus_cqe_cnt), - ssq->last_cmsn, SPFC_GET_QUEUE_CMSN(ssq)); + ssq->last_pmsn, SPFC_GET_QUEUE_CMSN(ssq)); ssq->accum_wqe_cnt++; if (ssq->accum_wqe_cnt == accum_db_num) { @@ -3286,7 +3286,7 @@ u32 spfc_direct_sq_enqueue(struct spfc_parent_ssq_info *ssq, struct spfc_sqe *io } ssq->wqe_offset += 1; - ssq->last_cmsn = SPFC_MSN_INC(ssq->last_cmsn); + ssq->last_pmsn = SPFC_MSN_INC(ssq->last_pmsn); atomic_inc(&ssq->sq_wqe_cnt); atomic_inc(&ssq->sqe_minus_cqe_cnt); SPFC_SQ_IO_STAT(ssq, wqe_type); @@ -3319,7 +3319,7 @@ u32 spfc_parent_ssq_enqueue(struct spfc_parent_ssq_info *ssq, struct spfc_sqe *i FC_DRV_PRINT(UNF_LOG_NORMAL, UNF_INFO, "[info]Ssq(0x%x), xid(0x%x) qid(0x%x) add wqepage at Pmsn(0x%x), WpgCnt(0x%x)", ssq->sqn, ssq->context_id, ssq->sq_queue_id, - ssq->last_cmsn, + ssq->last_pmsn, atomic_read(&ssq->wqe_page_cnt)); cur_cmsn = SPFC_GET_QUEUE_CMSN(ssq); spfc_free_sq_wqe_page(ssq, cur_cmsn); @@ -3335,7 +3335,7 @@ u32 spfc_parent_ssq_enqueue(struct spfc_parent_ssq_info *ssq, struct spfc_sqe *i link_wqe->next_page_addr_hi = cpu_to_be32(addr_wd); addr_wd = SPFC_LSD(new_wqe_page->wpg_phy_addr); link_wqe->next_page_addr_lo = cpu_to_be32(addr_wd); - link_wqe_msn = SPFC_MSN_DEC(ssq->last_cmsn); + link_wqe_msn = SPFC_MSN_DEC(ssq->last_pmsn); msn_wd = be32_to_cpu(link_wqe->val_wd1); msn_wd |= ((u32)(link_wqe_msn & SPFC_MSNWD_L_MASK)); msn_wd |= (((u32)(link_wqe_msn & SPFC_MSNWD_H_MASK)) << UNF_SHIFT_16); @@ -3351,7 +3351,7 @@ u32 spfc_parent_ssq_enqueue(struct spfc_parent_ssq_info *ssq, struct spfc_sqe *i atomic_inc(&ssq->wqe_page_cnt); } - spfc_build_wqe_owner_pmsn(io_sqe, !(ssq->last_pi_owner), ssq->last_cmsn); + spfc_build_wqe_owner_pmsn(io_sqe, !(ssq->last_pi_owner), ssq->last_pmsn); SPFC_IO_STAT((struct spfc_hba_info *)ssq->hba, wqe_type); spfc_convert_parent_wqe_to_big_endian(io_sqe); sqe_in_wp = (struct spfc_sqe *)spfc_get_wqe_page_entry(tail_wpg, ssq->wqe_offset); @@ -3371,7 +3371,7 @@ u32 spfc_parent_ssq_enqueue(struct spfc_parent_ssq_info *ssq, struct spfc_sqe *i ssq->accum_wqe_cnt = 0; } ssq->wqe_offset += 1; - ssq->last_cmsn = SPFC_MSN_INC(ssq->last_cmsn); + ssq->last_pmsn = SPFC_MSN_INC(ssq->last_pmsn); atomic_inc(&ssq->sq_wqe_cnt); atomic_inc(&ssq->sqe_minus_cqe_cnt); SPFC_SQ_IO_STAT(ssq, wqe_type); diff --git a/drivers/scsi/spfc/hw/spfc_queue.h b/drivers/scsi/spfc/hw/spfc_queue.h index b1184eb17556..c09f098e7324 100644 --- a/drivers/scsi/spfc/hw/spfc_queue.h +++ b/drivers/scsi/spfc/hw/spfc_queue.h @@ -597,7 +597,7 @@ struct spfc_parent_ssq_info { u32 wqe_offset; u16 head_start_cmsn; u16 head_end_cmsn; - u16 last_cmsn; + u16 last_pmsn; u16 last_pi_owner; u32 queue_style; atomic_t sq_valid; -- 2.30.0

2 1

[PATCH OLK-5.10] Change CPU page size to 4KB for ARM architecture
by shenzijun 15 Nov '21

15 Nov '21

From: 沈子俊 <shenzijun(a)kylinos.cn> kylin inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4HDHZ?from=project-issue CVE: NA ---------------------------------------------------------------------- change config about ARM64_4K_PAGES in openeuler-defconfig from arch/arm64 Signed-off-by: 沈子俊 <shenzijun(a)kylinos.cn> --- arch/arm64/configs/openeuler_defconfig | 31 +++++++++++++------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 76d6a118330d..87cf82bcb30e 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -250,12 +250,12 @@ CONFIG_TRACEPOINTS=y CONFIG_ARM64=y CONFIG_64BIT=y CONFIG_MMU=y -CONFIG_ARM64_PAGE_SHIFT=16 -CONFIG_ARM64_CONT_PTE_SHIFT=5 -CONFIG_ARM64_CONT_PMD_SHIFT=5 -CONFIG_ARCH_MMAP_RND_BITS_MIN=14 -CONFIG_ARCH_MMAP_RND_BITS_MAX=14 -CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=7 +CONFIG_ARM64_PAGE_SHIFT=12 +CONFIG_ARM64_CONT_PTE_SHIFT=4 +CONFIG_ARM64_CONT_PMD_SHIFT=4 +CONFIG_ARCH_MMAP_RND_BITS_MIN=18 +CONFIG_ARCH_MMAP_RND_BITS_MAX=24 +CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16 CONFIG_STACKTRACE_SUPPORT=y CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 @@ -365,17 +365,17 @@ CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH=y CONFIG_SOCIONEXT_SYNQUACER_PREITS=y # end of ARM errata workarounds via the alternatives framework -# CONFIG_ARM64_4K_PAGES is not set +CONFIG_ARM64_4K_PAGES=y # CONFIG_ARM64_16K_PAGES is not set -CONFIG_ARM64_64K_PAGES=y -# CONFIG_ARM64_VA_BITS_42 is not set +# CONFIG_ARM64_64K_PAGES is not set +CONFIG_ARM64_VA_BITS_39=y # CONFIG_ARM64_VA_BITS_48 is not set -CONFIG_ARM64_VA_BITS_52=y +# CONFIG_ARM64_VA_BITS_52 is not set # CONFIG_ARM64_FORCE_52BIT is not set -CONFIG_ARM64_VA_BITS=52 -# CONFIG_ARM64_PA_BITS_48 is not set -CONFIG_ARM64_PA_BITS_52=y -CONFIG_ARM64_PA_BITS=52 +CONFIG_ARM64_VA_BITS=39 +CONFIG_ARM64_PA_BITS_48=y +# CONFIG_ARM64_PA_BITS_52 is not set +CONFIG_ARM64_PA_BITS=48 # CONFIG_CPU_BIG_ENDIAN is not set CONFIG_CPU_LITTLE_ENDIAN=y CONFIG_SCHED_MC=y @@ -402,6 +402,7 @@ CONFIG_ARCH_SELECT_MEMORY_MODEL=y CONFIG_HAVE_ARCH_PFN_VALID=y CONFIG_HW_PERF_EVENTS=y CONFIG_SYS_SUPPORTS_HUGETLBFS=y +CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y CONFIG_PARAVIRT=y @@ -411,7 +412,7 @@ CONFIG_KEXEC=y CONFIG_CRASH_DUMP=y CONFIG_ARM64_CPU_PARK=y # CONFIG_XEN is not set -CONFIG_FORCE_MAX_ZONEORDER=14 +CONFIG_FORCE_MAX_ZONEORDER=11 CONFIG_UNMAP_KERNEL_AT_EL0=y CONFIG_RODATA_FULL_DEFAULT_ENABLED=y CONFIG_ARM64_PMEM_RESERVE=y -- 2.30.0

1 0

[PATCH OLK-5.10] fix structure type undeclared error in topology.c
by shenzijun 15 Nov '21

15 Nov '21

From: 沈子俊 <shenzijun(a)kylinos.cn> kylin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4I4E2#note_7386759 CVE: NA ------------------------------------------------------------------ add declaration of 'struct s_data' Signed-off-by: 沈子俊 <shenzijun(a)kylinos.cn> --- kernel/sched/topology.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c index 0564aeabbcb8..1fac5d28c0dc 100644 --- a/kernel/sched/topology.c +++ b/kernel/sched/topology.c @@ -20,6 +20,7 @@ static void sd_llc_free(struct sched_domain *sd); static int sd_llc_alloc_all(const struct cpumask *cpu_map, struct s_data *d); static void sd_llc_free_all(const struct cpumask *cpu_map); #else +struct s_data; static inline void sd_llc_free(struct sched_domain *sd) {} static inline int sd_llc_alloc_all(const struct cpumask *cpu_map, struct s_data *d) { return 0; } static inline void sd_llc_free_all(const struct cpumask *cpu_map) {} -- 2.30.0

1 0

[PATCH kernel-4.19 v2] fix the problem that the pointer may be double free
by zhangyue 15 Nov '21

15 Nov '21

kylin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AH11?from=project-issue CVE: NA int driver/md/md.c, if the function autorun_array() is called, first called do_md_run() and then do_md_stop(), this time, the pointer mddev->private may be double free Signed-off-by: zhangyue <zhangyue1(a)kylinos.cn> --- drivers/md/md.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 4406bb137a27..aa204ec74066 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -6000,8 +6000,10 @@ static void __md_stop(struct mddev *mddev) spin_lock(&mddev->lock); mddev->pers = NULL; spin_unlock(&mddev->lock); - pers->free(mddev, mddev->private); - mddev->private = NULL; + if (mddev->private) { + pers->free(mddev, mddev->private); + mddev->private = NULL; + } if (pers->sync_request && mddev->to_remove == NULL) mddev->to_remove = &md_redundancy_group; module_put(pers->owner); -- 2.30.0

1 0

[PATCH kernel-4.19 v2] fix the problem that the pointer "sp" is double free
by zhangyue 15 Nov '21

15 Nov '21

kylin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AFG6?from=project-issue CVE: NA in function qla24xx_sp_unmap, it is already called sp->free(sp), then it`s not need to called sp->free(sp) after qla24xx_sp_unmap is called. Signed-off-by: zhangyue <zhangyue1(a)kylinos.cn> --- drivers/scsi/qla2xxx/qla_gs.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c index c3195d4c25e5..a7198a1e23fb 100644 --- a/drivers/scsi/qla2xxx/qla_gs.c +++ b/drivers/scsi/qla2xxx/qla_gs.c @@ -4228,7 +4228,6 @@ static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res) if (rc) { /* Cleanup here to prevent memory leak */ qla24xx_sp_unmap(vha, sp); - sp->free(sp); } spin_lock_irqsave(&vha->work_lock, flags); -- 2.30.0

1 0

[PATCH kernel-4.19] fix the problem that the pointer "sp" is double free
by zhangyue 13 Nov '21

13 Nov '21

mainline inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4AFG6?from=project-issue CVE: NA in function qla24xx_sp_unmap, it is already called sp->free(sp), then it`s not need to called sp->free(sp) after qla24xx_sp_unmap is called. Signed-off-by: zhangyue <zhangyue1(a)kylinos.cn> --- drivers/scsi/qla2xxx/qla_gs.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c index c3195d4c25e5..a7198a1e23fb 100644 --- a/drivers/scsi/qla2xxx/qla_gs.c +++ b/drivers/scsi/qla2xxx/qla_gs.c @@ -4228,7 +4228,6 @@ static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res) if (rc) { /* Cleanup here to prevent memory leak */ qla24xx_sp_unmap(vha, sp); - sp->free(sp); } spin_lock_irqsave(&vha->work_lock, flags); -- 2.30.0

2 1

[PATCH OLK-5.10 0/3] support test GCM/CCM mode for SM4
by shenzijun 13 Nov '21

13 Nov '21

From: 沈子俊 <shenzijun(a)kylinos.cn> The GCM/CCM mode of SM4 is defined in the RFC 8998 specification: https://datatracker.ietf.org/doc/html/rfc8998 沈子俊 (3): crypto: tcrypt - Fix missing return value check crypto: testmgr - Add GCM/CCM mode test of SM4 algorithm crypto: tcrypt - add GCM/CCM mode test for SM4 algorithm crypto/tcrypt.c | 73 ++++++++++++++++++++--- crypto/testmgr.c | 29 ++++++++++ crypto/testmgr.h | 148 +++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 241 insertions(+), 9 deletions(-) -- 2.30.0

1 3

[PATCH openEuler-1.0-LTS 1/2] crypto: hisilicon - add CRYPTO_TFM_REQ_MAY_BACKLOG flag judge in sec_process()
by Yang Yingliang 12 Nov '21

12 Nov '21

From: Yu'an Wang <wangyuan46(a)huawei.com> driver inclusion category: Bugfix bugzilla: NA CVE: NA Set the flag CRYPTO_TFM_REQ_MAY_BACKLOG in the crypto driver, which can limit task process Signed-off-by: Yu'an Wang <wangyuan46(a)huawei.com> Reviewed-by: Longfang Liu <liulongfang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/crypto/hisilicon/sec2/sec.h | 1 + drivers/crypto/hisilicon/sec2/sec_crypto.c | 11 ++++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h index f6d1878edcc5c..51b93e25b750b 100644 --- a/drivers/crypto/hisilicon/sec2/sec.h +++ b/drivers/crypto/hisilicon/sec2/sec.h @@ -43,6 +43,7 @@ struct sec_req { int err_type; int req_id; + u32 flag; /* Status of the SEC request */ bool fake_busy; diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c index 68fb0e5ef761d..482aa8d26640e 100644 --- a/drivers/crypto/hisilicon/sec2/sec_crypto.c +++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c @@ -171,10 +171,13 @@ static int sec_bd_send(struct sec_ctx *ctx, struct sec_req *req) struct sec_qp_ctx *qp_ctx = req->qp_ctx; int ret; - mutex_lock(&qp_ctx->req_lock); + if (ctx->fake_req_limit <= + atomic_read(&qp_ctx->qp->qp_status.used) && + !(req->flag & CRYPTO_TFM_REQ_MAY_BACKLOG)) + return -EBUSY; + mutex_lock(&qp_ctx->req_lock); ret = hisi_qp_send(qp_ctx->qp, &req->sec_sqe); - if (ctx->fake_req_limit <= atomic_read(&qp_ctx->qp->qp_status.used) && !ret) { list_add_tail(&req->backlog_head, &qp_ctx->backlog); @@ -917,7 +920,8 @@ static int sec_process(struct sec_ctx *ctx, struct sec_req *req) sec_update_iv(req, ctx->alg_type); ret = ctx->req_op->bd_send(ctx, req); - if (unlikely(ret != -EBUSY && ret != -EINPROGRESS)) { + if (unlikely((ret != -EBUSY && ret != -EINPROGRESS) || + (ret == -EBUSY && !(req->flag & CRYPTO_TFM_REQ_MAY_BACKLOG)))) { dev_err_ratelimited(SEC_CTX_DEV(ctx), "send sec request failed!\n"); goto err_send_req; @@ -1009,6 +1013,7 @@ static int sec_skcipher_crypto(struct skcipher_request *sk_req, bool encrypt) if (!sk_req->cryptlen) return 0; + req->flag = sk_req->base.flags; req->c_req.sk_req = sk_req; req->c_req.encrypt = encrypt; req->ctx = ctx; -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/3] tcp: always set retrans_stamp on recovery
by Yang Yingliang 12 Nov '21

12 Nov '21

From: Yuchung Cheng <ycheng(a)google.com> mainline inclusion from mainline-v5.1-rc1 commit 7ae189759cc48cf8b54beebff566e9fd2d4e7d7c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AFRJ?from=project-issue CVE: NA ------------------------------------------------------------ Previously TCP socket's retrans_stamp is not set if the retransmission has failed to send. As a result if a socket is experiencing local issues to retransmit packets, determining when to abort a socket is complicated w/o knowning the starting time of the recovery since retrans_stamp may remain zero. This complication causes sub-optimal behavior that TCP may use the latest, instead of the first, retransmission time to compute the elapsed time of a stalling connection due to local issues. Then TCP may disrecard TCP retries settings and keep retrying until it finally succeed: not a good idea when the local host is already strained. The simple fix is to always timestamp the start of a recovery. It's worth noting that retrans_stamp is also used to compare echo timestamp values to detect spurious recovery. This patch does not break that because retrans_stamp is still later than when the original packet was sent. Signed-off-by: Yuchung Cheng <ycheng(a)google.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Neal Cardwell <ncardwell(a)google.com> Reviewed-by: Soheil Hassas Yeganeh <soheil(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/ipv4/tcp_timer.c Signed-off-by: Jiazhenyuan <jiazhenyuan@uniontech> #openEuler_contributor Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/ipv4/tcp_output.c | 9 ++++----- net/ipv4/tcp_timer.c | 23 +++-------------------- 2 files changed, 7 insertions(+), 25 deletions(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 97b9d671a83c9..6710056fd1b23 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -3011,13 +3011,12 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) #endif TCP_SKB_CB(skb)->sacked |= TCPCB_RETRANS; tp->retrans_out += tcp_skb_pcount(skb); - - /* Save stamp of the first retransmit. */ - if (!tp->retrans_stamp) - tp->retrans_stamp = tcp_skb_timestamp(skb); - } + /* Save stamp of the first (attempted) retransmit. */ + if (!tp->retrans_stamp) + tp->retrans_stamp = tcp_skb_timestamp(skb); + if (tp->undo_retrans < 0) tp->undo_retrans = 0; tp->undo_retrans += tcp_skb_pcount(skb); diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c index 681882a409686..8435cbad337d8 100644 --- a/net/ipv4/tcp_timer.c +++ b/net/ipv4/tcp_timer.c @@ -22,27 +22,13 @@ #include <linux/gfp.h> #include <net/tcp.h> -static u32 tcp_retransmit_stamp(const struct sock *sk) -{ - u32 start_ts = tcp_sk(sk)->retrans_stamp; - - if (unlikely(!start_ts)) { - struct sk_buff *head = tcp_rtx_queue_head(sk); - - if (!head) - return 0; - start_ts = tcp_skb_timestamp(head); - } - return start_ts; -} - static u32 tcp_clamp_rto_to_user_timeout(const struct sock *sk) { struct inet_connection_sock *icsk = inet_csk(sk); u32 elapsed, start_ts; - start_ts = tcp_retransmit_stamp(sk); - if (!icsk->icsk_user_timeout || !start_ts) + start_ts = tcp_sk(sk)->retrans_stamp; + if (!icsk->icsk_user_timeout) return icsk->icsk_rto; elapsed = tcp_time_stamp(tcp_sk(sk)) - start_ts; if (elapsed >= icsk->icsk_user_timeout) @@ -196,10 +182,7 @@ static bool retransmits_timed_out(struct sock *sk, if (!inet_csk(sk)->icsk_retransmits) return false; - start_ts = tcp_retransmit_stamp(sk); - if (!start_ts) - return false; - + start_ts = tcp_sk(sk)->retrans_stamp; if (likely(timeout == 0)) { linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base); -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS 01/49] perf/x86/intel/pt: Fix mask of num_address_ranges
by Yang Yingliang 12 Nov '21

12 Nov '21

From: Xiaoyao Li <xiaoyao.li(a)intel.com> stable inclusion from linux-4.19.207 commit f109e8a1678ce920b7f0df7865f2a31754ec5d1c -------------------------------- [ Upstream commit c53c6b7409f4cd9e542991b53d597fbe2751d7db ] Per SDM, bit 2:0 of CPUID(0x14,1).EAX[2:0] reports the number of configurable address ranges for filtering, not bit 1:0. Signed-off-by: Xiaoyao Li <xiaoyao.li(a)intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Acked-by: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Link: https://lkml.kernel.org/r/20210824040622.4081502-1-xiaoyao.li@intel.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/x86/events/intel/pt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c index db969f3f175cb..774fb0f0bf6df 100644 --- a/arch/x86/events/intel/pt.c +++ b/arch/x86/events/intel/pt.c @@ -69,7 +69,7 @@ static struct pt_cap_desc { PT_CAP(topa_multiple_entries, 0, CPUID_ECX, BIT(1)), PT_CAP(single_range_output, 0, CPUID_ECX, BIT(2)), PT_CAP(payloads_lip, 0, CPUID_ECX, BIT(31)), - PT_CAP(num_address_ranges, 1, CPUID_EAX, 0x3), + PT_CAP(num_address_ranges, 1, CPUID_EAX, 0x7), PT_CAP(mtc_periods, 1, CPUID_EAX, 0xffff0000), PT_CAP(cycle_thresholds, 1, CPUID_EBX, 0xffff), PT_CAP(psb_periods, 1, CPUID_EBX, 0xffff0000), -- 2.25.1

1 48

[PATCH openEuler-1.0-LTS 1/9] Revert "EMMC: fix ascend hisi emmc probe failed problem according to mmc_host struct"
by Yang Yingliang 12 Nov '21

12 Nov '21

From: zhangguijiang <zhangguijiang(a)huawei.com> ascend inclusion category: bugfix feature: Ascend emmc adaption bugzilla: https://gitee.com/openeuler/kernel/issues/I4F4LL CVE: NA -------------------- This reverts commit 80e65cb9c78f00090a95e6db3126e3e60ec2804d. Signed-off-by: zhangguijiang <zhangguijiang(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Reviewed-by: YANHONG LU <luyanhong.luyanhong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/mmc/core/sd.c | 38 +++++++++++++++++++++++++++++--- drivers/mmc/host/dw_mmc_extern.h | 2 +- include/linux/mmc/host.h | 2 +- 3 files changed, 37 insertions(+), 5 deletions(-) diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c index 8760b749292b8..20ca371b9f874 100644 --- a/drivers/mmc/core/sd.c +++ b/drivers/mmc/core/sd.c @@ -1163,9 +1163,9 @@ static int _mmc_sd_suspend(struct mmc_host *host) err = mmc_deselect_cards(host); if (!err) { - if (!mmc_is_ascend_customized(host->parent)) + if (!(mmc_is_ascend_customized(host->parent))) mmc_power_off(host); - else if (!mmc_card_keep_power(host)) + else if (mmc_card_keep_power(host)) mmc_power_off(host); mmc_card_set_suspended(host->card); } @@ -1269,10 +1269,42 @@ static int mmc_sd_runtime_resume(struct mmc_host *host) return 0; } +#ifdef CONFIG_ASCEND_HISI_MMC +/*********************sd ops begin**********************/ +static int mmc_do_sd_reset(struct mmc_host *host) +{ + struct mmc_card *card = host->card; + + if (!host->bus_ops->power_restore) + return -EOPNOTSUPP; + + if (!card) + return -EINVAL; + + /* hw_reset for ip reset */ + if (host->ops->hw_reset) + host->ops->hw_reset(host); + + /* Only for K930/920 SD slow down clk*/ + if (host->ops->slowdown_clk) + host->ops->slowdown_clk(host, host->ios.timing); + + mmc_power_off(host); + mmc_set_clock(host, host->f_init); + /* Wait at least 200 ms */ + mmc_delay(200); + mmc_power_up(host, host->card->ocr); + (void)mmc_select_voltage(host, host->card->ocr); + + return host->bus_ops->power_restore(host); +} +#endif static int mmc_sd_hw_reset(struct mmc_host *host) { +#ifdef CONFIG_ASCEND_HISI_MMC if (mmc_is_ascend_customized(host->parent)) - return mmc_sd_reset(host); + return mmc_do_sd_reset(host); +#endif mmc_power_cycle(host, host->card->ocr); return mmc_sd_init_card(host, host->card->ocr, host->card); } diff --git a/drivers/mmc/host/dw_mmc_extern.h b/drivers/mmc/host/dw_mmc_extern.h index ab077b4955940..04d8c23f39e9a 100644 --- a/drivers/mmc/host/dw_mmc_extern.h +++ b/drivers/mmc/host/dw_mmc_extern.h @@ -8,7 +8,7 @@ #include "dw_mmc.h" -#if defined(CONFIG_MMC_DW_HI3XXX) || defined(CONFIG_MMC_DW_HI3XXX_MODULE) +#ifdef CONFIG_MMC_DW_HI3XXX_MODULE extern void dw_mci_reg_dump(struct dw_mci *host); extern void dw_mci_set_timeout(struct dw_mci *host); extern bool dw_mci_stop_abort_cmd(struct mmc_command *cmd); diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h index fabc23d156242..78b4d0a813b71 100644 --- a/include/linux/mmc/host.h +++ b/include/linux/mmc/host.h @@ -542,13 +542,13 @@ struct mmc_host { bool cqe_enabled; bool cqe_on; + unsigned long private[0] ____cacheline_aligned; #ifdef CONFIG_ASCEND_HISI_MMC const struct mmc_cmdq_host_ops *cmdq_ops; int sdio_present; unsigned int cmdq_slots; struct mmc_cmdq_context_info cmdq_ctx; #endif - unsigned long private[0] ____cacheline_aligned; }; struct device_node; -- 2.25.1

1 8

[PATCH openEuler-1.0-LTS] iommu: support phytium ft2000plus and S2500 iommu function
by Yang Yingliang 11 Nov '21

11 Nov '21

From: Mao HongBo <maohongbo(a)phytium.com.cn> phytium inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I41AUQ ----------------------------------- To fix iommu issue of device access in virtualization scenario for ft2000plus and S2500. Convert to new cputype macros naming of phytium. Signed-off-by: Mao HongBo <maohongbo(a)phytium.com.cn> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/include/asm/cputype.h | 14 +++++-- .../arm64/include/asm/phytium_machine_types.h | 37 +++++++++++++++++++ arch/arm64/kernel/topology.c | 2 +- drivers/iommu/arm-smmu.c | 29 +++++++++++++-- drivers/irqchip/irq-gic-v3-its.c | 9 +++++ drivers/pci/quirks.c | 4 ++ drivers/usb/host/xhci-pci.c | 2 +- 7 files changed, 87 insertions(+), 10 deletions(-) create mode 100644 arch/arm64/include/asm/phytium_machine_types.h diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index 23298b0aedaf7..aa38796121300 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -101,8 +101,11 @@ #define HISI_CPU_PART_TSV110 0xD01 #define HISI_CPU_PART_TSV200 0xD02 -#define PHYTIUM_CPU_PART_FTC662 0x662 -#define PHYTIUM_CPU_PART_FTC663 0x663 +#define PHYTIUM_CPU_PART_1500A 0X660 +#define PHYTIUM_CPU_PART_2000AHK 0X661 +#define PHYTIUM_CPU_PART_2000PLUS 0X662 +#define PHYTIUM_CPU_PART_2004 0X663 +#define PHYTIUM_CPU_PART_2500 0X663 #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53) #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57) @@ -124,8 +127,11 @@ #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) #define MIDR_HISI_TSV200 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV200) -#define MIDR_PHYTIUM_FT2000PLUS MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_FTC662) -#define MIDR_PHYTIUM_FT2500 MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_FTC663) +#define MIDR_FT_1500A MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_1500A) +#define MIDR_FT_2000AHK MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2000AHK) +#define MIDR_FT_2000PLUS MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2000PLUS) +#define MIDR_FT_2004 MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2004) +#define MIDR_FT_2500 MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2500) #ifndef __ASSEMBLY__ diff --git a/arch/arm64/include/asm/phytium_machine_types.h b/arch/arm64/include/asm/phytium_machine_types.h new file mode 100644 index 0000000000000..fb791988f0cee --- /dev/null +++ b/arch/arm64/include/asm/phytium_machine_types.h @@ -0,0 +1,37 @@ +/* + * Authors: Wang Yinfeng <wangyinfenng(a)phytium.com.cn> + * + * Copyright (C) 2021, PHYTIUM Information Technology Co., Ltd. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, see <http://www.gnu.org/licenses/>. + */ + +#ifndef __PHYTIUM_MACHINE_TYPES_H__ +#define __PHYTIUM_MACHINE_TYPES_H__ + +#include <asm/cputype.h> +#include <linux/types.h> + +static inline bool phytium_part(u32 cpuid) +{ + return ((read_cpuid_id() & MIDR_CPU_MODEL_MASK) == cpuid); +} + +#define typeof_ft1500a() phytium_part(MIDR_FT_1500A) +#define typeof_ft2000ahk() phytium_part(MIDR_FT_2000AHK) +#define typeof_ft2000plus() phytium_part(MIDR_FT_2000PLUS) +#define typeof_ft2004() phytium_part(MIDR_FT_2004) +#define typeof_s2500() phytium_part(MIDR_FT_2500) + +#endif diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c index 02d3e688d657d..2646695e2f2a4 100644 --- a/arch/arm64/kernel/topology.c +++ b/arch/arm64/kernel/topology.c @@ -291,7 +291,7 @@ void store_cpu_topology(unsigned int cpuid) cpuid_topo->package_id = cpu_to_node(cpuid); /* Some PHYTIUM FT2000PLUS platform firmware has no PPTT table */ - if ((read_cpuid_id() & MIDR_CPU_MODEL_MASK) == MIDR_PHYTIUM_FT2000PLUS + if ((read_cpuid_id() & MIDR_CPU_MODEL_MASK) == MIDR_FT_2000PLUS && cpu_to_node(cpuid) == NUMA_NO_NODE) { cpuid_topo->thread_id = 0; cpuid_topo->package_id = 0; diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c index 8a268ab82ef02..18863198bb036 100644 --- a/drivers/iommu/arm-smmu.c +++ b/drivers/iommu/arm-smmu.c @@ -56,6 +56,10 @@ #include "arm-smmu-regs.h" +#ifdef CONFIG_ARCH_PHYTIUM +#include <asm/phytium_machine_types.h> +#endif + /* * Apparently, some Qualcomm arm64 platforms which appear to expose their SMMU * global register space are still, in fact, using a hypervisor to mediate it @@ -1407,6 +1411,20 @@ static int arm_smmu_add_device(struct device *dev) return -ENODEV; } +#ifdef CONFIG_ARCH_PHYTIUM + /* ft2000+ */ + if (typeof_ft2000plus()) { + int num = fwspec->num_ids; + + for (i = 0; i < num; i++) { +#define FWID_READ(id) (((u16)(id) >> 3) | (((id) >> SMR_MASK_SHIFT | 0x7000) << SMR_MASK_SHIFT)) + u32 fwid = FWID_READ(fwspec->ids[i]); + + iommu_fwspec_add_ids(dev, &fwid, 1); + } + } +#endif + ret = -EINVAL; for (i = 0; i < fwspec->num_ids; i++) { u16 sid = fwspec->ids[i]; @@ -1481,6 +1499,12 @@ static struct iommu_group *arm_smmu_device_group(struct device *dev) if (group && smmu->s2crs[idx].group && group != smmu->s2crs[idx].group) return ERR_PTR(-EINVAL); +#ifdef CONFIG_ARCH_PHYTIUM + if (typeof_s2500()) + break; + if (typeof_ft2000plus() && !smmu->s2crs[idx].group) + continue; +#endif group = smmu->s2crs[idx].group; } @@ -1614,10 +1638,7 @@ static void arm_smmu_put_resv_regions(struct device *dev, #include <asm/cputype.h> static int phytium_smmu_def_domain_type(struct device *dev, unsigned int *type) { - u32 midr = read_cpuid_id(); - - if (((midr & MIDR_CPU_MODEL_MASK) == MIDR_PHYTIUM_FT2000PLUS) - || ((midr & MIDR_CPU_MODEL_MASK) == MIDR_PHYTIUM_FT2500)) { + if (typeof_ft2000plus() || typeof_s2500()) { *type = IOMMU_DOMAIN_IDENTITY; return 0; } diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 1a2ecfa23fd8c..79648a2139412 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -51,6 +51,10 @@ #include "irq-gic-common.h" +#ifdef CONFIG_ARCH_PHYTIUM +#include <asm/phytium_machine_types.h> +#endif + #define ITS_FLAGS_CMDQ_NEEDS_FLUSHING (1ULL << 0) #define ITS_FLAGS_WORKAROUND_CAVIUM_22375 (1ULL << 1) #define ITS_FLAGS_WORKAROUND_CAVIUM_23144 (1ULL << 2) @@ -1223,6 +1227,11 @@ static void its_irq_compose_msi_msg(struct irq_data *d, struct msi_msg *msg) msg->address_hi = upper_32_bits(addr); msg->data = its_get_event_id(d); +#ifdef CONFIG_ARCH_PHYTIUM + if (typeof_ft2000plus()) + return; +#endif + iommu_dma_map_msi_msg(d->irq, msg); } diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index 961003c6dc807..99657b9bc82e0 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -4646,6 +4646,10 @@ static const struct pci_dev_acs_enabled { { PCI_VENDOR_ID_ZHAOXIN, 0x9083, pci_quirk_mf_endpoint_acs }, /* Zhaoxin Root/Downstream Ports */ { PCI_VENDOR_ID_ZHAOXIN, PCI_ANY_ID, pci_quirk_zhaoxin_pcie_ports_acs }, + /* because PLX switch Vendor id is 0x10b5 on phytium cpu */ + { 0x10b5, PCI_ANY_ID, pci_quirk_xgene_acs }, + /* because rootcomplex Vendor id is 0x17cd on phytium cpu */ + { 0x17cd, PCI_ANY_ID, pci_quirk_xgene_acs }, { 0 } }; diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c index 886cd6fc4b640..238a32cc311c9 100644 --- a/drivers/usb/host/xhci-pci.c +++ b/drivers/usb/host/xhci-pci.c @@ -313,7 +313,7 @@ static void phytium_xhci_pci_workaround(struct pci_dev *dev) u32 midr = read_cpuid_id(); /* Firmware bug, DMA mask is not reported by the firmware */ - if ((midr & MIDR_CPU_MODEL_MASK) == MIDR_PHYTIUM_FT2000PLUS) + if ((midr & MIDR_CPU_MODEL_MASK) == MIDR_FT_2000PLUS) dma_set_mask(&dev->dev, DMA_BIT_MASK(64)); } #else -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] arm64: Errata: fix kabi changed by cpu_errata and enable idc
by Yang Yingliang 11 Nov '21

11 Nov '21

From: Weilong Chen <chenweilong(a)huawei.com> ascend inclusion category: feature bugzilla: 46922 CVE: NA ------------------------------------- Patch "cache: Workaround HiSilicon Taishan DC CVAU" breaks the kabi symbols: cpu_hwcaps cpu_hwcap_keys Patch "arm64: Errata: fix kabi changed by cpu_errata" try to fix it but incomplete. Eable IDC on platform TSV{110,200}. Signed-off-by: Weilong Chen <chenweilong(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/kernel/cpufeature.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 822e6a2c0af1d..1bf9d84265de2 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -912,6 +912,19 @@ static bool has_cache_idc(const struct arm64_cpu_capabilities *entry, { u64 ctr; +#ifndef CONFIG_HISILICON_ERRATUM_1980005 + /* Fix kABI compatible for CONFIG_HISILICON_ERRATUM_1980005 */ + static const struct midr_range idc_support_list[] = { + MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + MIDR_REV(MIDR_HISI_TSV200, 1, 0), + { /* sentinel */ } + }; + if (is_midr_in_range_list(read_cpuid_id(), idc_support_list)) { + pr_info("CPU features: detected: Taishan IDC coherence workaround\n"); + return true; + } +#endif + if (scope == SCOPE_SYSTEM) ctr = arm64_ftr_reg_ctrel0.sys_val; else -- 2.25.1

1 0

[PATCH openEuler-5.10 01/59] psi: support psi under cgroup v1
by Zheng Zengkai 11 Nov '21

11 Nov '21

From: Xunlei Pang <xlpang(a)linux.alibaba.com> Export "cpu|io|memory.pressure" to cgroup v1 "cpuacct" subsystem. hulk inclusion category: feature bugzilla: 182979 https://gitee.com/openeuler/kernel/issues/I4HOX6 ------------------------------------------ Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Signed-off-by: Xunlei Pang <xlpang(a)linux.alibaba.com> Signed-off-by: Chen Wandun <chenwandun(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- init/Kconfig | 10 ++++++++++ kernel/cgroup/cgroup.c | 28 ++++++++++++++++++++++++++++ kernel/sched/cpuacct.c | 10 ++++++++++ kernel/sched/psi.c | 4 ++++ kernel/sched/sched.h | 4 ++++ 5 files changed, 56 insertions(+) diff --git a/init/Kconfig b/init/Kconfig index 04bc46ca0b9e..0afdb08131eb 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -635,6 +635,16 @@ config PSI_DEFAULT_DISABLED Say N if unsure. +config PSI_CGROUP_V1 + bool "Support PSI under cgroup v1" + default Y + depends on PSI + help + If set, pressure stall information tracking will be used + for cgroup v1 other than v2. + + Say N if unsure. + endmenu # "CPU/Task time and stats accounting" config CPU_ISOLATION diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 701ef7ba4f95..86ab4a1305f6 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -3659,6 +3659,34 @@ static void cgroup_pressure_release(struct kernfs_open_file *of) { psi_trigger_replace(&of->priv, NULL); } + +struct cftype cgroup_v1_psi_files[] = { + { + .name = "io.pressure", + .flags = CFTYPE_NO_PREFIX, + .seq_show = cgroup_io_pressure_show, + .write = cgroup_io_pressure_write, + .poll = cgroup_pressure_poll, + .release = cgroup_pressure_release, + }, + { + .name = "memory.pressure", + .flags = CFTYPE_NO_PREFIX, + .seq_show = cgroup_memory_pressure_show, + .write = cgroup_memory_pressure_write, + .poll = cgroup_pressure_poll, + .release = cgroup_pressure_release, + }, + { + .name = "cpu.pressure", + .flags = CFTYPE_NO_PREFIX, + .seq_show = cgroup_cpu_pressure_show, + .write = cgroup_cpu_pressure_write, + .poll = cgroup_pressure_poll, + .release = cgroup_pressure_release, + }, + { } /* terminate */ +}; #endif /* CONFIG_PSI */ static int cgroup_freeze_show(struct seq_file *seq, void *v) diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c index 941c28cf9738..4e5488659339 100644 --- a/kernel/sched/cpuacct.c +++ b/kernel/sched/cpuacct.c @@ -374,3 +374,13 @@ struct cgroup_subsys cpuacct_cgrp_subsys = { .legacy_cftypes = files, .early_init = true, }; + +#ifdef CONFIG_PSI +static int __init cgroup_v1_psi_init(void) +{ + cgroup_add_legacy_cftypes(&cpuacct_cgrp_subsys, cgroup_v1_psi_files); + return 0; +} + +late_initcall_sync(cgroup_v1_psi_init); +#endif diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index d50a31ecedee..0b48a74cbfac 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -752,7 +752,11 @@ static struct psi_group *iterate_groups(struct task_struct *task, void **iter) struct cgroup *cgroup = NULL; if (!*iter) +#ifdef CONFIG_PSI_CGROUP_V1 + cgroup = task_cgroup(task, cpuacct_cgrp_id); +#else cgroup = task->cgroups->dfl_cgrp; +#endif else if (*iter == &psi_system) return NULL; else diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 4ce573eeca4c..e29f051f824f 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -2585,6 +2585,10 @@ unsigned long scale_irq_capacity(unsigned long util, unsigned long irq, unsigned } #endif +#ifdef CONFIG_PSI +extern struct cftype cgroup_v1_psi_files[]; +#endif + #if defined(CONFIG_ENERGY_MODEL) && defined(CONFIG_CPU_FREQ_GOV_SCHEDUTIL) #define perf_domain_span(pd) (to_cpumask(((pd)->em_pd->cpus))) -- 2.20.1

1 58

[PATCH openEuler-1.0-LTS] blk-mq: don't free tags if the tag_set is used by other device in queue initialztion
by Yang Yingliang 10 Nov '21

10 Nov '21

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v5.16 commit a846a8e6c9a5949582c5a6a8bbc83a7d27fd891e category: bugfix bugzilla: 185668 CVE: NA ----------------------------------------------- We got UAF report on v5.10 as follows: [ 1446.674930] ================================================================== [ 1446.675970] BUG: KASAN: use-after-free in blk_mq_get_driver_tag+0x9a4/0xa90 [ 1446.676902] Read of size 8 at addr ffff8880185afd10 by task kworker/1:2/12348 [ 1446.677851] [ 1446.678073] CPU: 1 PID: 12348 Comm: kworker/1:2 Not tainted 5.10.0-10177-gc9c81b1e346a #2 [ 1446.679168] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 1446.680692] Workqueue: kthrotld blk_throtl_dispatch_work_fn [ 1446.681448] Call Trace: [ 1446.681800] dump_stack+0x9b/0xce [ 1446.682916] print_address_description.constprop.6+0x3e/0x60 [ 1446.685999] kasan_report.cold.9+0x22/0x3a [ 1446.687186] blk_mq_get_driver_tag+0x9a4/0xa90 [ 1446.687785] blk_mq_dispatch_rq_list+0x21a/0x1d40 [ 1446.692576] __blk_mq_do_dispatch_sched+0x394/0x830 [ 1446.695758] __blk_mq_sched_dispatch_requests+0x398/0x4f0 [ 1446.698279] blk_mq_sched_dispatch_requests+0xdf/0x140 [ 1446.698967] __blk_mq_run_hw_queue+0xc0/0x270 [ 1446.699561] __blk_mq_delay_run_hw_queue+0x4cc/0x550 [ 1446.701407] blk_mq_run_hw_queue+0x13b/0x2b0 [ 1446.702593] blk_mq_sched_insert_requests+0x1de/0x390 [ 1446.703309] blk_mq_flush_plug_list+0x4b4/0x760 [ 1446.705408] blk_flush_plug_list+0x2c5/0x480 [ 1446.708471] blk_finish_plug+0x55/0xa0 [ 1446.708980] blk_throtl_dispatch_work_fn+0x23b/0x2e0 [ 1446.711236] process_one_work+0x6d4/0xfe0 [ 1446.711778] worker_thread+0x91/0xc80 [ 1446.713400] kthread+0x32d/0x3f0 [ 1446.714362] ret_from_fork+0x1f/0x30 [ 1446.714846] [ 1446.715062] Allocated by task 1: [ 1446.715509] kasan_save_stack+0x19/0x40 [ 1446.716026] __kasan_kmalloc.constprop.1+0xc1/0xd0 [ 1446.716673] blk_mq_init_tags+0x6d/0x330 [ 1446.717207] blk_mq_alloc_rq_map+0x50/0x1c0 [ 1446.717769] __blk_mq_alloc_map_and_request+0xe5/0x320 [ 1446.718459] blk_mq_alloc_tag_set+0x679/0xdc0 [ 1446.719050] scsi_add_host_with_dma.cold.3+0xa0/0x5db [ 1446.719736] virtscsi_probe+0x7bf/0xbd0 [ 1446.720265] virtio_dev_probe+0x402/0x6c0 [ 1446.720808] really_probe+0x276/0xde0 [ 1446.721320] driver_probe_device+0x267/0x3d0 [ 1446.721892] device_driver_attach+0xfe/0x140 [ 1446.722491] __driver_attach+0x13a/0x2c0 [ 1446.723037] bus_for_each_dev+0x146/0x1c0 [ 1446.723603] bus_add_driver+0x3fc/0x680 [ 1446.724145] driver_register+0x1c0/0x400 [ 1446.724693] init+0xa2/0xe8 [ 1446.725091] do_one_initcall+0x9e/0x310 [ 1446.725626] kernel_init_freeable+0xc56/0xcb9 [ 1446.726231] kernel_init+0x11/0x198 [ 1446.726714] ret_from_fork+0x1f/0x30 [ 1446.727212] [ 1446.727433] Freed by task 26992: [ 1446.727882] kasan_save_stack+0x19/0x40 [ 1446.728420] kasan_set_track+0x1c/0x30 [ 1446.728943] kasan_set_free_info+0x1b/0x30 [ 1446.729517] __kasan_slab_free+0x111/0x160 [ 1446.730084] kfree+0xb8/0x520 [ 1446.730507] blk_mq_free_map_and_requests+0x10b/0x1b0 [ 1446.731206] blk_mq_realloc_hw_ctxs+0x8cb/0x15b0 [ 1446.731844] blk_mq_init_allocated_queue+0x374/0x1380 [ 1446.732540] blk_mq_init_queue_data+0x7f/0xd0 [ 1446.733155] scsi_mq_alloc_queue+0x45/0x170 [ 1446.733730] scsi_alloc_sdev+0x73c/0xb20 [ 1446.734281] scsi_probe_and_add_lun+0x9a6/0x2d90 [ 1446.734916] __scsi_scan_target+0x208/0xc50 [ 1446.735500] scsi_scan_channel.part.3+0x113/0x170 [ 1446.736149] scsi_scan_host_selected+0x25a/0x360 [ 1446.736783] store_scan+0x290/0x2d0 [ 1446.737275] dev_attr_store+0x55/0x80 [ 1446.737782] sysfs_kf_write+0x132/0x190 [ 1446.738313] kernfs_fop_write_iter+0x319/0x4b0 [ 1446.738921] new_sync_write+0x40e/0x5c0 [ 1446.739429] vfs_write+0x519/0x720 [ 1446.739877] ksys_write+0xf8/0x1f0 [ 1446.740332] do_syscall_64+0x2d/0x40 [ 1446.740802] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1446.741462] [ 1446.741670] The buggy address belongs to the object at ffff8880185afd00 [ 1446.741670] which belongs to the cache kmalloc-256 of size 256 [ 1446.743276] The buggy address is located 16 bytes inside of [ 1446.743276] 256-byte region [ffff8880185afd00, ffff8880185afe00) [ 1446.744765] The buggy address belongs to the page: [ 1446.745416] page:ffffea0000616b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x185ac [ 1446.746694] head:ffffea0000616b00 order:2 compound_mapcount:0 compound_pincount:0 [ 1446.747719] flags: 0x1fffff80010200(slab|head) [ 1446.748337] raw: 001fffff80010200 ffffea00006a3208 ffffea000061bf08 ffff88801004f240 [ 1446.749404] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 1446.750455] page dumped because: kasan: bad access detected [ 1446.751227] [ 1446.751445] Memory state around the buggy address: [ 1446.752102] ffff8880185afc00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1446.753090] ffff8880185afc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1446.754079] >ffff8880185afd00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1446.755065] ^ [ 1446.755589] ffff8880185afd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1446.756574] ffff8880185afe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1446.757566] ================================================================== Flag 'BLK_MQ_F_TAG_QUEUE_SHARED' will be set if the second device on the same host initializes it's queue successfully. However, if the second device failed to allocate memory in blk_mq_alloc_and_init_hctx() from blk_mq_realloc_hw_ctxs() from blk_mq_init_allocated_queue(), __blk_mq_free_map_and_rqs() will be called on error path, and if 'BLK_MQ_TAG_HCTX_SHARED' is not set, 'tag_set->tags' will be freed while it's still used by the first device. To fix this issue we move release newly allocated hardware context from blk_mq_realloc_hw_ctxs to __blk_mq_update_nr_hw_queues. As there is needn't to release hardware context in blk_mq_init_allocated_queue. Fixes: 868f2f0b7206 ("blk-mq: dynamic h/w context count") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20211108074019.1058843-1-yebin10@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> conflicts: block/blk-mq.c Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-mq.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 55c81dcafbdc2..ef62a83314a5d 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2804,8 +2804,6 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set, struct blk_mq_hw_ctx *hctx = hctxs[j]; if (hctx) { - if (hctx->tags) - blk_mq_free_map_and_requests(set, j); blk_mq_exit_hctx(q, set, hctx, j); hctxs[j] = NULL; } @@ -3236,8 +3234,13 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, list_for_each_entry(q, &set->tag_list, tag_set_list) { blk_mq_realloc_hw_ctxs(set, q); if (q->nr_hw_queues != set->nr_hw_queues) { + int i = prev_nr_hw_queues; + pr_warn("Increasing nr_hw_queues to %d fails, fallback to %d\n", nr_hw_queues, prev_nr_hw_queues); + for (; i < set->nr_hw_queues; i++) + blk_mq_free_map_and_requests(set, i); + set->nr_hw_queues = prev_nr_hw_queues; blk_mq_map_queues(set); goto fallback; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] nbd: add a flush_workqueue in nbd_start_device
by Yang Yingliang 10 Nov '21

10 Nov '21

From: Sun Ke <sunke32(a)huawei.com> mainline inclusion from mainline-v5.6-rc1 commit 5c0dd228b5fc30a3b732c7ae2657e0161ec7ed80 category: bugfix bugzilla: 185690 CVE: NA ----------------------------------------------- When kzalloc fail, may cause trying to destroy the workqueue from inside the workqueue. If num_connections is m (2 < m), and NO.1 ~ NO.n (1 < n < m) kzalloc are successful. The NO.(n + 1) failed. Then, nbd_start_device will return ENOMEM to nbd_start_device_ioctl, and nbd_start_device_ioctl will return immediately without running flush_workqueue. However, we still have n recv threads. If nbd_release run first, recv threads may have to drop the last config_refs and try to destroy the workqueue from inside the workqueue. To fix it, add a flush_workqueue in nbd_start_device. Fixes: e9e006f5fcf2 ("nbd: fix max number of supported devs") Signed-off-by: Sun Ke <sunke32(a)huawei.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/nbd.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 33a52be762d24..775cbb4c1bbcd 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1306,6 +1306,16 @@ static int nbd_start_device(struct nbd_device *nbd) args = kzalloc(sizeof(*args), GFP_KERNEL); if (!args) { sock_shutdown(nbd); + /* + * If num_connections is m (2 < m), + * and NO.1 ~ NO.n(1 < n < m) kzallocs are successful. + * But NO.(n + 1) failed. We still have n recv threads. + * So, add flush_workqueue here to prevent recv threads + * dropping the last config_refs and trying to destroy + * the workqueue from inside the workqueue. + */ + if (i) + flush_workqueue(nbd->recv_workq); return -ENOMEM; } sk_set_memalloc(config->socks[i]->sock->sk); -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/2] bpf, cgroup: Assign cgroup in cgroup_sk_alloc when called from interrupt
by Yang Yingliang 10 Nov '21

10 Nov '21

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v5.15-rc4 commit 78cc316e9583067884eb8bd154301dc1e9ee945c category: bugfix bugzilla: 184472 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… If cgroup_sk_alloc() is called from interrupt context, then just assign the root cgroup to skcd->cgroup. Prior to commit 8520e224f547 ("bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode") we would just return, and later on in sock_cgroup_ptr(), we were NULL-testing the cgroup in fast-path, and iff indeed NULL returning the root cgroup (v ?: &cgrp_dfl_root.cgrp). Rather than re-adding the NULL-test to the fast-path we can just assign it once from cgroup_sk_alloc() given v1/v2 handling has been simplified. The migration from NULL test with returning &cgrp_dfl_root.cgrp to assigning &cgrp_dfl_root.cgrp directly does /not/ change behavior for callers of sock_cgroup_ptr(). syzkaller was able to trigger a splat in the legacy netrom code base, where the RX handler in nr_rx_frame() calls nr_make_new() which calls sk_alloc() and therefore cgroup_sk_alloc() with in_interrupt() condition. Thus the NULL skcd->cgroup, where it trips over on cgroup_sk_free() side given it expects a non-NULL object. There are a few other candidates aside from netrom which have similar pattern where in their accept-like implementation, they just call to sk_alloc() and thus cgroup_sk_alloc() instead of sk_clone_lock() with the corresponding cgroup_sk_clone() which then inherits the cgroup from the parent socket. None of them are related to core protocols where BPF cgroup programs are running from. However, in future, they should follow to implement a similar inheritance mechanism. Additionally, with a !CONFIG_CGROUP_NET_PRIO and !CONFIG_CGROUP_NET_CLASSID configuration, the same issue was exposed also prior to 8520e224f547 due to commit e876ecc67db8 ("cgroup: memcg: net: do not associate sock with unrelated cgroup") which added the early in_interrupt() return back then. Fixes: 8520e224f547 ("bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode") Fixes: e876ecc67db8 ("cgroup: memcg: net: do not associate sock with unrelated cgroup") Reported-by: syzbot+df709157a4ecaf192b03(a)syzkaller.appspotmail.com Reported-by: syzbot+533f389d4026d86a2a95(a)syzkaller.appspotmail.com Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Tested-by: syzbot+df709157a4ecaf192b03(a)syzkaller.appspotmail.com Tested-by: syzbot+533f389d4026d86a2a95(a)syzkaller.appspotmail.com Acked-by: Tejun Heo <tj(a)kernel.org> Link: https://lore.kernel.org/bpf/20210927123921.21535-1-daniel@iogearbox.net Conflicts: kernel/cgroup/cgroup.c Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/cgroup/cgroup.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 682c5e231bddc..7897f1ab77266 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -5935,8 +5935,11 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd) } /* Don't associate the sock with unrelated interrupted task's cgroup. */ - if (in_interrupt()) + if (in_interrupt()) { + cgroup_get(&cgrp_dfl_root.cgrp); + skcd->val = (unsigned long)&cgrp_dfl_root.cgrp; return; + } rcu_read_lock(); -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/7] sctp: use init_tag from inithdr for ABORT chunk
by Yang Yingliang 10 Nov '21

10 Nov '21

From: Xin Long <lucien.xin(a)gmail.com> mainline inclusion from mainline-v5.15 commit 4f7019c7eb33967eb87766e0e4602b5576873680 category: bugfix bugzilla: NA CVE: CVE-2021-3772 ------------------------------------------------- Currently Linux SCTP uses the verification tag of the existing SCTP asoc when failing to process and sending the packet with the ABORT chunk. This will result in the peer accepting the ABORT chunk and removing the SCTP asoc. One could exploit this to terminate a SCTP asoc. This patch is to fix it by always using the initiate tag of the received INIT chunk for the ABORT chunk to be sent. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Huang Guobin <huangguobin4(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/sctp/sm_statefuns.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index 19bd14a4eb07e..9ae0676afd5d4 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -6261,6 +6261,7 @@ static struct sctp_packet *sctp_ootb_pkt_new( * yet. */ switch (chunk->chunk_hdr->type) { + case SCTP_CID_INIT: case SCTP_CID_INIT_ACK: { struct sctp_initack_chunk *initack; -- 2.25.1

1 6

[PATCH kernel-4.19] fix the problem that the pointer may be double free
by zhangyue 10 Nov '21

10 Nov '21

mainline inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4AH11?from=project-issue CVE: NA int driver/md/md.c, if the function autorun_array() is called, first called do_md_run() and then do_md_stop(), this time, the pointer mddev->private may be double free Signed-off-by: zhangyue <zhangyue1(a)kylinos.cn> --- drivers/md/md.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 4406bb137a27..aa204ec74066 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -6000,8 +6000,10 @@ static void __md_stop(struct mddev *mddev) spin_lock(&mddev->lock); mddev->pers = NULL; spin_unlock(&mddev->lock); - pers->free(mddev, mddev->private); - mddev->private = NULL; + if (mddev->private) { + pers->free(mddev, mddev->private); + mddev->private = NULL; + } if (pers->sync_request && mddev->to_remove == NULL) mddev->to_remove = &md_redundancy_group; module_put(pers->owner); -- 2.30.0

1 0

[PATCH kernel-4.19] bios_parser.c: fix uninitialized variable in device_type_from_device_id
by shenzijun 10 Nov '21

10 Nov '21

From: 沈子俊 <shenzijun(a)kylinos.cn> kylin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AH6U?from=project-issue CVE: NA ----------------------------------------------------------------------------- add uninitialization of result_device_id.raw_device_tag Signed-off-by: 沈子俊 <shenzijun(a)kylinos.cn> --- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c index be8a2494355a..9375757fb640 100644 --- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c +++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c @@ -2450,6 +2450,7 @@ static struct device_id device_type_from_device_id(uint16_t device_id) { struct device_id result_device_id; + result_device_id.raw_device_tag = 0; switch (device_id) { case ATOM_DEVICE_LCD1_SUPPORT: -- 2.30.0

1 0

Re: [PATCH openEuler-1.0-LTS 0/6] Fix the problem that the number of tcp timeout retransmissions is lost
by QiuLaibin 09 Nov '21

09 Nov '21

hi zhenyuan: 针对你先前提交的“Fix the problem that the number of tcp timeout retransmissions is lost”补丁集，我们在内部review的时候committer给了如下检视意见切换EDT主线有 tcp 和 fq 的几个patchset和bugfix, 这里建议先合入解决本问题后边的3个patch。因此是否只合后三个patch就可以满足能够解决你目前遇到的问题。 best regard On 2021/10/22 18:52, Jiazhenyuan wrote: > > > > From: Jiazhenyuan <jiazhenyuan(a)uniontech.com> > > issue: https://gitee.com/openeuler/kernel/issues/I4AFRJ?from=project-issue > > jiazhenyuan (6): > tcp: switch tcp and sch_fq to new earliest departure time > net_sched: sch_fq: ensure maxrate fq parameter applies to EDT flows > From 9efdda4e3abed13f0903b7b6e4d4c2102019440a Mon Sep 17 00:00:00 2001 > From: Eric Dumazet <edumazet(a)google.com> Date: Sat, 24 Nov 2018 > 09:12:24 -0800 Subject: [PATCH] tcp: address problems caused by EDT > misshaps > From 7ae189759cc48cf8b54beebff566e9fd2d4e7d7c Mon Sep 17 00:00:00 2001 > From: Yuchung Cheng <ycheng(a)google.com> Date: Wed, 16 Jan 2019 > 15:05:30 -0800 Subject: [PATCH] tcp: always set retrans_stamp on > recovery > From 01a523b071618abbc634d1958229fe3bd2dfa5fa Mon Sep 17 00:00:00 2001 > From: Yuchung Cheng <ycheng(a)google.com> Date: Wed, 16 Jan 2019 > 15:05:32 -0800 Subject: [PATCH] tcp: create a helper to model > exponential backoff > From 3256a2d6ab1f71f9a1bd2d7f6f18eb8108c48d17 Mon Sep 17 00:00:00 2001 > From: Eric Dumazet <edumazet(a)google.com> Date: Mon, 30 Sep 2019 > 15:44:44 -0700 Subject: [PATCH] tcp: adjust rto_base in > retransmits_timed_out() > > net/ipv4/tcp_bbr.c | 7 +++-- > net/ipv4/tcp_input.c | 17 +++++++----- > net/ipv4/tcp_output.c | 29 ++++++++++++++------ > net/ipv4/tcp_timer.c | 64 ++++++++++++++++++++----------------------- > net/sched/sch_fq.c | 46 ++++++++++++++++++------------- > 5 files changed, 92 insertions(+), 71 deletions(-) > > -- > 2.27.0 > _______________________________________________ Kernel mailing list -- kernel(a)openeuler.org To unsubscribe send an email to kernel-leave(a)openeuler.org

2 1

(无主题)
by 汪越越 09 Nov '21

09 Nov '21

。

1 0

[PATCH openEuler-1.0-LTS 01/18] drivers/perf: arm_spe: Don't error on high-order pages for aux buf
by Yang Yingliang 09 Nov '21

09 Nov '21

From: Will Deacon <will.deacon(a)arm.com> mainline inclusion from mainline-v5.1-rc3 commit 14ae42a6f0b13130a97d94d23481128961de5d38 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4A1XO CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------------------------ Since commit 5768402fd9c6 ("perf/ring_buffer: Use high order allocations for AUX buffers optimistically"), the perf core tends to back aux buffer allocations with high-order pages with the order encoded in the PagePrivate data. The Arm SPE driver explicitly rejects such pages, causing the perf tool to fail with: | failed to mmap with 12 (Cannot allocate memory) In actual fact, we can simply treat these pages just like any other since the perf core takes care to populate the page array appropriately. In theory we could try to map with PMDs where possible, but for now, let's just get things working again. Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Fixes: 5768402fd9c6 ("perf/ring_buffer: Use high order allocations for AUX buffers optimistically") Reported-by: Hanjun Guo <guohanjun(a)huawei.com> Tested-by: Hanjun Guo <guohanjun(a)huawei.com> Tested-by: Sudeep Holla <sudeep.holla(a)arm.com> Signed-off-by: Will Deacon <will.deacon(a)arm.com> Signed-off-by: Qi Liu <liuqi115(a)huawei.com> Reviewed-by: Yang Jihong <yangjihong1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/perf/arm_spe_pmu.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c index a11951b083307..4fb65c61c8eab 100644 --- a/drivers/perf/arm_spe_pmu.c +++ b/drivers/perf/arm_spe_pmu.c @@ -856,16 +856,8 @@ static void *arm_spe_pmu_setup_aux(struct perf_event *event, void **pages, if (!pglist) goto out_free_buf; - for (i = 0; i < nr_pages; ++i) { - struct page *page = virt_to_page(pages[i]); - - if (PagePrivate(page)) { - pr_warn("unexpected high-order page for auxbuf!"); - goto out_free_pglist; - } - + for (i = 0; i < nr_pages; ++i) pglist[i] = virt_to_page(pages[i]); - } buf->base = vmap(pglist, nr_pages, VM_MAP, PAGE_KERNEL); if (!buf->base) -- 2.25.1

1 17

[PATCH openEuler-1.0-LTS 1/2] drm/hisilicon: Support i2c driver algorithms for bit-shift adapters
by Yang Yingliang 09 Nov '21

09 Nov '21

From: Tian Tao <tiantao6(a)hisilicon.com> mainline inclusion from mainline-v5.14.0-rc7 commit 4eb4d99dfe3018d86f4529112aa7082f43b6996a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I469VQ CVE: NA Remove #include <drm/drm_probe_helper.h> in hibmc_drm_i2c.c. ----------------------------- Adding driver implementation to support i2c driver algorithms for bit-shift adapters, so hibmc will using the interface provided by drm to read edid. Signed-off-by: Tian Tao <tiantao6(a)hisilicon.com> Reviewed-by: Thomas Zimmermann <tzimmermann(a)suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/1600778670-60370-2-git-send-e… Signed-off-by: gouhao <gouhao(a)uniontech.com> Reviewed-by: tian tao <tiantao6(a)hisilicon.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/gpu/drm/hisilicon/hibmc/Makefile | 3 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 25 +++++ .../gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c | 98 +++++++++++++++++++ 3 files changed, 125 insertions(+), 1 deletion(-) create mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c diff --git a/drivers/gpu/drm/hisilicon/hibmc/Makefile b/drivers/gpu/drm/hisilicon/hibmc/Makefile index 3df726696372f..71c248f4c7562 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/Makefile +++ b/drivers/gpu/drm/hisilicon/hibmc/Makefile @@ -1,3 +1,4 @@ -hibmc-drm-y := hibmc_drm_drv.o hibmc_drm_de.o hibmc_drm_vdac.o hibmc_drm_fbdev.o hibmc_ttm.o +hibmc-drm-y := hibmc_drm_drv.o hibmc_drm_de.o hibmc_drm_vdac.o \ + hibmc_drm_fbdev.o hibmc_ttm.o hibmc_drm_i2c.o obj-$(CONFIG_DRM_HISI_HIBMC) += hibmc-drm.o diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h index 4395dc6674bbc..c246151b29942 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h @@ -19,12 +19,18 @@ #ifndef HIBMC_DRM_DRV_H #define HIBMC_DRM_DRV_H +#include <linux/gpio/consumer.h> +#include <linux/i2c-algo-bit.h> +#include <linux/i2c.h> + +#include <drm/drm_edid.h> #include <drm/drmP.h> #include <drm/drm_atomic.h> #include <drm/drm_fb_helper.h> #include <drm/drm_gem.h> #include <drm/ttm/ttm_bo_driver.h> + struct hibmc_framebuffer { struct drm_framebuffer fb; struct drm_gem_object *obj; @@ -36,6 +42,13 @@ struct hibmc_fbdev { int size; }; +struct hibmc_connector { + struct drm_connector base; + + struct i2c_adapter adapter; + struct i2c_algo_bit_data bit_data; +}; + struct hibmc_drm_private { /* hw */ void __iomem *mmio; @@ -46,6 +59,7 @@ struct hibmc_drm_private { /* drm */ struct drm_device *dev; + struct hibmc_connector connector; bool mode_config_initialized; struct drm_atomic_state *suspend_state; @@ -60,6 +74,16 @@ struct hibmc_drm_private { bool mm_inited; }; +static inline struct hibmc_connector *to_hibmc_connector(struct drm_connector *connector) +{ + return container_of(connector, struct hibmc_connector, base); +} + +static inline struct hibmc_drm_private *to_hibmc_drm_private(struct drm_device *dev) +{ + return dev->dev_private; +} + #define to_hibmc_framebuffer(x) container_of(x, struct hibmc_framebuffer, fb) struct hibmc_bo { @@ -110,6 +134,7 @@ int hibmc_dumb_create(struct drm_file *file, struct drm_device *dev, int hibmc_dumb_mmap_offset(struct drm_file *file, struct drm_device *dev, u32 handle, u64 *offset); int hibmc_mmap(struct file *filp, struct vm_area_struct *vma); +int hibmc_ddc_create(struct drm_device *drm_dev, struct hibmc_connector *connector); extern const struct drm_mode_config_funcs hibmc_mode_funcs; diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c new file mode 100644 index 0000000000000..ffd7c7bf4b7d8 --- /dev/null +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c @@ -0,0 +1,98 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* Hisilicon Hibmc SoC drm driver + * + * Based on the bochs drm driver. + * + * Copyright (c) 2016 Huawei Limited. + * + * Author: + * Tian Tao <tiantao6(a)hisilicon.com> + */ + +#include <linux/delay.h> +#include <linux/pci.h> + +#include <drm/drm_atomic_helper.h> + +#include "hibmc_drm_drv.h" + +#define GPIO_DATA 0x0802A0 +#define GPIO_DATA_DIRECTION 0x0802A4 + +#define I2C_SCL_MASK BIT(0) +#define I2C_SDA_MASK BIT(1) + +static void hibmc_set_i2c_signal(void *data, u32 mask, int value) +{ + struct hibmc_connector *hibmc_connector = data; + struct hibmc_drm_private *priv = to_hibmc_drm_private(hibmc_connector->base.dev); + u32 tmp_dir = readl(priv->mmio + GPIO_DATA_DIRECTION); + + if (value) { + tmp_dir &= ~mask; + writel(tmp_dir, priv->mmio + GPIO_DATA_DIRECTION); + } else { + u32 tmp_data = readl(priv->mmio + GPIO_DATA); + + tmp_data &= ~mask; + writel(tmp_data, priv->mmio + GPIO_DATA); + + tmp_dir |= mask; + writel(tmp_dir, priv->mmio + GPIO_DATA_DIRECTION); + } +} + +static int hibmc_get_i2c_signal(void *data, u32 mask) +{ + struct hibmc_connector *hibmc_connector = data; + struct hibmc_drm_private *priv = to_hibmc_drm_private(hibmc_connector->base.dev); + u32 tmp_dir = readl(priv->mmio + GPIO_DATA_DIRECTION); + + if ((tmp_dir & mask) != mask) { + tmp_dir &= ~mask; + writel(tmp_dir, priv->mmio + GPIO_DATA_DIRECTION); + } + + return (readl(priv->mmio + GPIO_DATA) & mask) ? 1 : 0; +} + +static void hibmc_ddc_setsda(void *data, int state) +{ + hibmc_set_i2c_signal(data, I2C_SDA_MASK, state); +} + +static void hibmc_ddc_setscl(void *data, int state) +{ + hibmc_set_i2c_signal(data, I2C_SCL_MASK, state); +} + +static int hibmc_ddc_getsda(void *data) +{ + return hibmc_get_i2c_signal(data, I2C_SDA_MASK); +} + +static int hibmc_ddc_getscl(void *data) +{ + return hibmc_get_i2c_signal(data, I2C_SCL_MASK); +} + +int hibmc_ddc_create(struct drm_device *drm_dev, + struct hibmc_connector *connector) +{ + connector->adapter.owner = THIS_MODULE; + connector->adapter.class = I2C_CLASS_DDC; + snprintf(connector->adapter.name, I2C_NAME_SIZE, "HIS i2c bit bus"); + connector->adapter.dev.parent = &drm_dev->pdev->dev; + i2c_set_adapdata(&connector->adapter, connector); + connector->adapter.algo_data = &connector->bit_data; + + connector->bit_data.udelay = 20; + connector->bit_data.timeout = usecs_to_jiffies(2000); + connector->bit_data.data = connector; + connector->bit_data.setsda = hibmc_ddc_setsda; + connector->bit_data.setscl = hibmc_ddc_setscl; + connector->bit_data.getsda = hibmc_ddc_getsda; + connector->bit_data.getscl = hibmc_ddc_getscl; + + return i2c_bit_add_bus(&connector->adapter); +} -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] compiler.h: fix barrier_data() on clang
by Yang Yingliang 09 Nov '21

09 Nov '21

From: Arvind Sankar <nivedita(a)alum.mit.edu> stable inclusion from linux-4.19.164 commit b207caff4176e3a6ba273243da2db2e595e4aad2 CVE: CVE-2021-0938 -------------------------------- commit 3347acc6fcd4ee71ad18a9ff9d9dac176b517329 upstream. Commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive") neglected to copy barrier_data() from compiler-gcc.h into compiler-clang.h. The definition in compiler-gcc.h was really to work around clang's more aggressive optimization, so this broke barrier_data() on clang, and consequently memzero_explicit() as well. For example, this results in at least the memzero_explicit() call in lib/crypto/sha256.c:sha256_transform() being optimized away by clang. Fix this by moving the definition of barrier_data() into compiler.h. Also move the gcc/clang definition of barrier() into compiler.h, __memory_barrier() is icc-specific (and barrier() is already defined using it in compiler-intel.h) and doesn't belong in compiler.h. [rdunlap(a)infradead.org: fix ALPHA builds when SMP is not enabled] Link: https://lkml.kernel.org/r/20201101231835.4589-1-rdunlap@infradead.org Fixes: 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive") Signed-off-by: Arvind Sankar <nivedita(a)alum.mit.edu> Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Tested-by: Nick Desaulniers <ndesaulniers(a)google.com> Reviewed-by: Nick Desaulniers <ndesaulniers(a)google.com> Reviewed-by: Kees Cook <keescook(a)chromium.org> Cc: <stable(a)vger.kernel.org> Link: https://lkml.kernel.org/r/20201014212631.207844-1-nivedita@alum.mit.edu Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> [nd: backport to account for missing commit e506ea451254a ("compiler.h: Split {READ,WRITE}_ONCE definitions out into rwonce.h") commit d08b9f0ca6605 ("scs: Add support for Clang's Shadow Call Stack (SCS)") commit a3f8a30f3f00 ("Compiler Attributes: use feature checks instead of version checks")] Signed-off-by: Nick Desaulniers <ndesaulniers(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/compiler-clang.h | 1 - include/linux/compiler-gcc.h | 19 ------------------- include/linux/compiler.h | 18 ++++++++++++++++-- 3 files changed, 16 insertions(+), 22 deletions(-) diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h index d756f2318efe0..2d6e5e4bb5d93 100644 --- a/include/linux/compiler-clang.h +++ b/include/linux/compiler-clang.h @@ -39,7 +39,6 @@ * and may be redefined here because they should not be shared with other * compilers, like ICC. */ -#define barrier() __asm__ __volatile__("" : : : "memory") #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0])) #define __assume_aligned(a, ...) \ __attribute__((__assume_aligned__(a, ## __VA_ARGS__))) diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h index 3ebee1ce6f982..14be095371093 100644 --- a/include/linux/compiler-gcc.h +++ b/include/linux/compiler-gcc.h @@ -14,25 +14,6 @@ # error Sorry, your compiler is too old - please upgrade it. #endif -/* Optimization barrier */ - -/* The "volatile" is due to gcc bugs */ -#define barrier() __asm__ __volatile__("": : :"memory") -/* - * This version is i.e. to prevent dead stores elimination on @ptr - * where gcc and llvm may behave differently when otherwise using - * normal barrier(): while gcc behavior gets along with a normal - * barrier(), llvm needs an explicit input variable to be assumed - * clobbered. The issue is as follows: while the inline asm might - * access any memory it wants, the compiler could have fit all of - * @ptr into memory registers instead, and since @ptr never escaped - * from that, it proved that the inline asm wasn't touching any of - * it. This version works well with both compilers, i.e. we're telling - * the compiler that the inline asm absolutely may see the contents - * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495 - */ -#define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory") - /* * This macro obfuscates arithmetic on a variable address so that gcc * shouldn't recognize the original var, and make assumptions about it. diff --git a/include/linux/compiler.h b/include/linux/compiler.h index bb22908c79e83..0e769548e14f8 100644 --- a/include/linux/compiler.h +++ b/include/linux/compiler.h @@ -79,11 +79,25 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val, /* Optimization barrier */ #ifndef barrier -# define barrier() __memory_barrier() +/* The "volatile" is due to gcc bugs */ +# define barrier() __asm__ __volatile__("": : :"memory") #endif #ifndef barrier_data -# define barrier_data(ptr) barrier() +/* + * This version is i.e. to prevent dead stores elimination on @ptr + * where gcc and llvm may behave differently when otherwise using + * normal barrier(): while gcc behavior gets along with a normal + * barrier(), llvm needs an explicit input variable to be assumed + * clobbered. The issue is as follows: while the inline asm might + * access any memory it wants, the compiler could have fit all of + * @ptr into memory registers instead, and since @ptr never escaped + * from that, it proved that the inline asm wasn't touching any of + * it. This version works well with both compilers, i.e. we're telling + * the compiler that the inline asm absolutely may see the contents + * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495 + */ +# define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory") #endif /* workaround for GCC PR82365 if needed */ -- 2.25.1

1 0

[PATCH openEuler-5.10] spfc: Fix compile errors when O=xxx is specified
by Zheng Zengkai 09 Nov '21

09 Nov '21

From: Yanling Song <songyl(a)ramaxel.com> Ramaxel inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4DBD7 CVE: NA ----------------------------------------- Fix two compile errors: 1. Compile failed when O=xxx is specified; 2. Compile conflicted when spfc and spnic are compiled in parallel by -j option because they share some .c files. make O=tmp -j200 > build.log In file included from ../drivers/scsi/spfc/hw/spfc_utils.c:4:0: ../drivers/scsi/spfc/hw/spfc_utils.h:7:10: fatal error: unf_type.h: No such file or directory #include "unf_type.h" ^~~~~~~~~~~~ compilation terminated. make[4]: *** [drivers/scsi/spfc/hw/spfc_utils.o] Error 1 make[4]: *** Waiting for unfinished jobs.... make[3]: *** [drivers/scsi/spfc] Error 2 make[3]: *** Waiting for unfinished jobs.... ../drivers/net/ethernet/ramaxel/spnic/spnic_sriov.c:9:10: fatal error: sphw_common.h: No such file or directory #include "sphw_common.h" ^~~~~~~~~~~~~~~ compilation terminated. Signed-off-by: Yanling Song <songyl(a)ramaxel.com> Reviewed-by: Zhang Lei<zhanglei48(a)huawei.com> [zzk: Adjusted commit message] Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/net/ethernet/ramaxel/spnic/Makefile | 2 +- drivers/scsi/spfc/Makefile | 30 ++++++++++----------- drivers/scsi/spfc/sphw_api_cmd.c | 1 + drivers/scsi/spfc/sphw_cmdq.c | 1 + drivers/scsi/spfc/sphw_common.c | 1 + drivers/scsi/spfc/sphw_eqs.c | 1 + drivers/scsi/spfc/sphw_hw_cfg.c | 1 + drivers/scsi/spfc/sphw_hw_comm.c | 1 + drivers/scsi/spfc/sphw_hwdev.c | 1 + drivers/scsi/spfc/sphw_hwif.c | 1 + drivers/scsi/spfc/sphw_mbox.c | 1 + drivers/scsi/spfc/sphw_mgmt.c | 1 + drivers/scsi/spfc/sphw_prof_adap.c | 1 + drivers/scsi/spfc/sphw_wq.c | 1 + 14 files changed, 28 insertions(+), 16 deletions(-) create mode 120000 drivers/scsi/spfc/sphw_api_cmd.c create mode 120000 drivers/scsi/spfc/sphw_cmdq.c create mode 120000 drivers/scsi/spfc/sphw_common.c create mode 120000 drivers/scsi/spfc/sphw_eqs.c create mode 120000 drivers/scsi/spfc/sphw_hw_cfg.c create mode 120000 drivers/scsi/spfc/sphw_hw_comm.c create mode 120000 drivers/scsi/spfc/sphw_hwdev.c create mode 120000 drivers/scsi/spfc/sphw_hwif.c create mode 120000 drivers/scsi/spfc/sphw_mbox.c create mode 120000 drivers/scsi/spfc/sphw_mgmt.c create mode 120000 drivers/scsi/spfc/sphw_prof_adap.c create mode 120000 drivers/scsi/spfc/sphw_wq.c diff --git a/drivers/net/ethernet/ramaxel/spnic/Makefile b/drivers/net/ethernet/ramaxel/spnic/Makefile index f86ccff374f6..207e1d9c431a 100644 --- a/drivers/net/ethernet/ramaxel/spnic/Makefile +++ b/drivers/net/ethernet/ramaxel/spnic/Makefile @@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0-only obj-$(CONFIG_SPNIC) += spnic.o -subdir-ccflags-y += -I$(src)/hw +subdir-ccflags-y += -I$(srctree)/$(src)/hw spnic-objs := hw/sphw_common.o \ hw/sphw_hwif.o \ diff --git a/drivers/scsi/spfc/Makefile b/drivers/scsi/spfc/Makefile index 02fe0213e048..849b730ac733 100644 --- a/drivers/scsi/spfc/Makefile +++ b/drivers/scsi/spfc/Makefile @@ -1,9 +1,9 @@ # SPDX-License-Identifier: GPL-2.0-only obj-$(CONFIG_SPFC) += spfc.o -subdir-ccflags-y += -I$(src)/../../net/ethernet/ramaxel/spnic/hw -subdir-ccflags-y += -I$(src)/hw -subdir-ccflags-y += -I$(src)/common +subdir-ccflags-y += -I$(srctree)/$(src)/../../net/ethernet/ramaxel/spnic/hw +subdir-ccflags-y += -I$(srctree)/$(src)/hw +subdir-ccflags-y += -I$(srctree)/$(src)/common spfc-objs := common/unf_init.o \ common/unf_event.o \ @@ -33,15 +33,15 @@ spfc-objs := common/unf_init.o \ hw/spfc_cqm_bitmap_table.o \ hw/spfc_cqm_main.o \ hw/spfc_cqm_object.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_hwdev.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_hw_cfg.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_hw_comm.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_prof_adap.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_common.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_hwif.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_wq.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_eqs.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_mbox.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_api_cmd.o + sphw_hwdev.o \ + sphw_hw_cfg.o \ + sphw_hw_comm.o \ + sphw_prof_adap.o \ + sphw_common.o \ + sphw_hwif.o \ + sphw_wq.o \ + sphw_cmdq.o \ + sphw_eqs.o \ + sphw_mbox.o \ + sphw_mgmt.o \ + sphw_api_cmd.o diff --git a/drivers/scsi/spfc/sphw_api_cmd.c b/drivers/scsi/spfc/sphw_api_cmd.c new file mode 120000 index 000000000000..27c7c0770fa3 --- /dev/null +++ b/drivers/scsi/spfc/sphw_api_cmd.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_api_cmd.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_cmdq.c b/drivers/scsi/spfc/sphw_cmdq.c new file mode 120000 index 000000000000..5ac779ba274b --- /dev/null +++ b/drivers/scsi/spfc/sphw_cmdq.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_common.c b/drivers/scsi/spfc/sphw_common.c new file mode 120000 index 000000000000..a1a30a4840e1 --- /dev/null +++ b/drivers/scsi/spfc/sphw_common.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_common.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_eqs.c b/drivers/scsi/spfc/sphw_eqs.c new file mode 120000 index 000000000000..74430dcb9dc5 --- /dev/null +++ b/drivers/scsi/spfc/sphw_eqs.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_eqs.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_hw_cfg.c b/drivers/scsi/spfc/sphw_hw_cfg.c new file mode 120000 index 000000000000..4f43d68624c1 --- /dev/null +++ b/drivers/scsi/spfc/sphw_hw_cfg.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_hw_cfg.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_hw_comm.c b/drivers/scsi/spfc/sphw_hw_comm.c new file mode 120000 index 000000000000..c943b3b2933a --- /dev/null +++ b/drivers/scsi/spfc/sphw_hw_comm.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_hw_comm.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_hwdev.c b/drivers/scsi/spfc/sphw_hwdev.c new file mode 120000 index 000000000000..b7279f17eaa2 --- /dev/null +++ b/drivers/scsi/spfc/sphw_hwdev.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_hwdev.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_hwif.c b/drivers/scsi/spfc/sphw_hwif.c new file mode 120000 index 000000000000..d40ef71f9033 --- /dev/null +++ b/drivers/scsi/spfc/sphw_hwif.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_hwif.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_mbox.c b/drivers/scsi/spfc/sphw_mbox.c new file mode 120000 index 000000000000..1b00fe7289cc --- /dev/null +++ b/drivers/scsi/spfc/sphw_mbox.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_mbox.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_mgmt.c b/drivers/scsi/spfc/sphw_mgmt.c new file mode 120000 index 000000000000..fd18a73e9d3a --- /dev/null +++ b/drivers/scsi/spfc/sphw_mgmt.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_prof_adap.c b/drivers/scsi/spfc/sphw_prof_adap.c new file mode 120000 index 000000000000..fbc7db05dd27 --- /dev/null +++ b/drivers/scsi/spfc/sphw_prof_adap.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_prof_adap.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_wq.c b/drivers/scsi/spfc/sphw_wq.c new file mode 120000 index 000000000000..cdfcb3a610c0 --- /dev/null +++ b/drivers/scsi/spfc/sphw_wq.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_wq.c \ No newline at end of file -- 2.20.1

1 0

[PATCH OLK-5.10] SCSI:SPFC, NET:Ethernet:SPNIC: fix compile error
by Yanling Song 09 Nov '21

09 Nov '21

Ramaxel inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4DBD7 CVE: NA Fix two compile errors: 1. Compile failed when O=xxx is specified; 2. Compile confliction when spfc and spnic are compiled in parallel by -j option because they share some .c files Signed-off-by: Yanling Song <songyl(a)ramaxel.com> --- drivers/net/ethernet/ramaxel/spnic/Makefile | 2 +- drivers/scsi/spfc/Makefile | 30 ++++++++++----------- drivers/scsi/spfc/sphw_api_cmd.c | 1 + drivers/scsi/spfc/sphw_cmdq.c | 1 + drivers/scsi/spfc/sphw_common.c | 1 + drivers/scsi/spfc/sphw_eqs.c | 1 + drivers/scsi/spfc/sphw_hw_cfg.c | 1 + drivers/scsi/spfc/sphw_hw_comm.c | 1 + drivers/scsi/spfc/sphw_hwdev.c | 1 + drivers/scsi/spfc/sphw_hwif.c | 1 + drivers/scsi/spfc/sphw_mbox.c | 1 + drivers/scsi/spfc/sphw_mgmt.c | 1 + drivers/scsi/spfc/sphw_prof_adap.c | 1 + drivers/scsi/spfc/sphw_wq.c | 1 + 14 files changed, 28 insertions(+), 16 deletions(-) create mode 120000 drivers/scsi/spfc/sphw_api_cmd.c create mode 120000 drivers/scsi/spfc/sphw_cmdq.c create mode 120000 drivers/scsi/spfc/sphw_common.c create mode 120000 drivers/scsi/spfc/sphw_eqs.c create mode 120000 drivers/scsi/spfc/sphw_hw_cfg.c create mode 120000 drivers/scsi/spfc/sphw_hw_comm.c create mode 120000 drivers/scsi/spfc/sphw_hwdev.c create mode 120000 drivers/scsi/spfc/sphw_hwif.c create mode 120000 drivers/scsi/spfc/sphw_mbox.c create mode 120000 drivers/scsi/spfc/sphw_mgmt.c create mode 120000 drivers/scsi/spfc/sphw_prof_adap.c create mode 120000 drivers/scsi/spfc/sphw_wq.c diff --git a/drivers/net/ethernet/ramaxel/spnic/Makefile b/drivers/net/ethernet/ramaxel/spnic/Makefile index f86ccff374f6..207e1d9c431a 100644 --- a/drivers/net/ethernet/ramaxel/spnic/Makefile +++ b/drivers/net/ethernet/ramaxel/spnic/Makefile @@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0-only obj-$(CONFIG_SPNIC) += spnic.o -subdir-ccflags-y += -I$(src)/hw +subdir-ccflags-y += -I$(srctree)/$(src)/hw spnic-objs := hw/sphw_common.o \ hw/sphw_hwif.o \ diff --git a/drivers/scsi/spfc/Makefile b/drivers/scsi/spfc/Makefile index 02fe0213e048..849b730ac733 100644 --- a/drivers/scsi/spfc/Makefile +++ b/drivers/scsi/spfc/Makefile @@ -1,9 +1,9 @@ # SPDX-License-Identifier: GPL-2.0-only obj-$(CONFIG_SPFC) += spfc.o -subdir-ccflags-y += -I$(src)/../../net/ethernet/ramaxel/spnic/hw -subdir-ccflags-y += -I$(src)/hw -subdir-ccflags-y += -I$(src)/common +subdir-ccflags-y += -I$(srctree)/$(src)/../../net/ethernet/ramaxel/spnic/hw +subdir-ccflags-y += -I$(srctree)/$(src)/hw +subdir-ccflags-y += -I$(srctree)/$(src)/common spfc-objs := common/unf_init.o \ common/unf_event.o \ @@ -33,15 +33,15 @@ spfc-objs := common/unf_init.o \ hw/spfc_cqm_bitmap_table.o \ hw/spfc_cqm_main.o \ hw/spfc_cqm_object.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_hwdev.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_hw_cfg.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_hw_comm.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_prof_adap.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_common.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_hwif.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_wq.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_eqs.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_mbox.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.o \ - ../../net/ethernet/ramaxel/spnic/hw/sphw_api_cmd.o + sphw_hwdev.o \ + sphw_hw_cfg.o \ + sphw_hw_comm.o \ + sphw_prof_adap.o \ + sphw_common.o \ + sphw_hwif.o \ + sphw_wq.o \ + sphw_cmdq.o \ + sphw_eqs.o \ + sphw_mbox.o \ + sphw_mgmt.o \ + sphw_api_cmd.o diff --git a/drivers/scsi/spfc/sphw_api_cmd.c b/drivers/scsi/spfc/sphw_api_cmd.c new file mode 120000 index 000000000000..27c7c0770fa3 --- /dev/null +++ b/drivers/scsi/spfc/sphw_api_cmd.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_api_cmd.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_cmdq.c b/drivers/scsi/spfc/sphw_cmdq.c new file mode 120000 index 000000000000..5ac779ba274b --- /dev/null +++ b/drivers/scsi/spfc/sphw_cmdq.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_common.c b/drivers/scsi/spfc/sphw_common.c new file mode 120000 index 000000000000..a1a30a4840e1 --- /dev/null +++ b/drivers/scsi/spfc/sphw_common.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_common.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_eqs.c b/drivers/scsi/spfc/sphw_eqs.c new file mode 120000 index 000000000000..74430dcb9dc5 --- /dev/null +++ b/drivers/scsi/spfc/sphw_eqs.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_eqs.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_hw_cfg.c b/drivers/scsi/spfc/sphw_hw_cfg.c new file mode 120000 index 000000000000..4f43d68624c1 --- /dev/null +++ b/drivers/scsi/spfc/sphw_hw_cfg.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_hw_cfg.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_hw_comm.c b/drivers/scsi/spfc/sphw_hw_comm.c new file mode 120000 index 000000000000..c943b3b2933a --- /dev/null +++ b/drivers/scsi/spfc/sphw_hw_comm.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_hw_comm.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_hwdev.c b/drivers/scsi/spfc/sphw_hwdev.c new file mode 120000 index 000000000000..b7279f17eaa2 --- /dev/null +++ b/drivers/scsi/spfc/sphw_hwdev.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_hwdev.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_hwif.c b/drivers/scsi/spfc/sphw_hwif.c new file mode 120000 index 000000000000..d40ef71f9033 --- /dev/null +++ b/drivers/scsi/spfc/sphw_hwif.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_hwif.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_mbox.c b/drivers/scsi/spfc/sphw_mbox.c new file mode 120000 index 000000000000..1b00fe7289cc --- /dev/null +++ b/drivers/scsi/spfc/sphw_mbox.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_mbox.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_mgmt.c b/drivers/scsi/spfc/sphw_mgmt.c new file mode 120000 index 000000000000..fd18a73e9d3a --- /dev/null +++ b/drivers/scsi/spfc/sphw_mgmt.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_prof_adap.c b/drivers/scsi/spfc/sphw_prof_adap.c new file mode 120000 index 000000000000..fbc7db05dd27 --- /dev/null +++ b/drivers/scsi/spfc/sphw_prof_adap.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_prof_adap.c \ No newline at end of file diff --git a/drivers/scsi/spfc/sphw_wq.c b/drivers/scsi/spfc/sphw_wq.c new file mode 120000 index 000000000000..cdfcb3a610c0 --- /dev/null +++ b/drivers/scsi/spfc/sphw_wq.c @@ -0,0 +1 @@ +../../net/ethernet/ramaxel/spnic/hw/sphw_wq.c \ No newline at end of file -- 2.27.0

2 1

【议题申报】主线特性DAMON（Data Access Monitor）回合
by zouyue (A) 09 Nov '21

09 Nov '21

DAMON(Data Access Monitor)特性议题申报 DAMON特性是一个能轻量级在线监控特定用户空间进程的内存访问情况的内核特性模块。通过基于region采样和自适应调整region大小两种核心机制，允许用户态和内核态两种策略定义模式，进行data access访问监控和内存优化管理。应用场景： 1．监控当前内存过负载或者过高的访问频率 2．内存管理优化： 1) 高访问频率的内存区域放到LRU列表头部 2) 低访问频率的内存区域调整到LRU列表尾部或者换出 3) 大内存消耗且高访问频率的区域可以使用较大页 3．监控一些低效率的进程间通信 DAMON总体框架如下： [cid:image003.png@01D7D54E.EA5ABEE0] 特性补丁链接: http://patchwork.huawei.com/project/olk5.10/list/?series=20179

1 0

[PATCH openEuler-1.0-LTS 1/7] ath: Use safer key clearing with key cache entries
by Yang Yingliang 08 Nov '21

08 Nov '21

From: Jouni Malinen <jouni(a)codeaurora.org> stable inclusion from linux-4.19.205 commit dd5815f023b89c9a28325d8a2a5f0779b57b7190 CVE: CVE-2020-3702 -------------------------------- commit 56c5485c9e444c2e85e11694b6c44f1338fc20fd upstream. It is possible for there to be pending frames in TXQs with a reference to the key cache entry that is being deleted. If such a key cache entry is cleared, those pending frame in TXQ might get transmitted without proper encryption. It is safer to leave the previously used key into the key cache in such cases. Instead, only clear the MAC address to prevent RX processing from using this key cache entry. This is needed in particularly in AP mode where the TXQs cannot be flushed on station disconnection. This change alone may not be able to address all cases where the key cache entry might get reused for other purposes immediately (the key cache entry should be released for reuse only once the TXQs do not have any remaining references to them), but this makes it less likely to get unprotected frames and the more complete changes may end up being significantly more complex. Signed-off-by: Jouni Malinen <jouni(a)codeaurora.org> Signed-off-by: Kalle Valo <kvalo(a)codeaurora.org> Link: https://lore.kernel.org/r/20201214172118.18100-2-jouni@codeaurora.org Cc: Pali Rohár <pali(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/wireless/ath/key.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c index 1816b4e7dc264..59618bb41f6c5 100644 --- a/drivers/net/wireless/ath/key.c +++ b/drivers/net/wireless/ath/key.c @@ -583,7 +583,16 @@ EXPORT_SYMBOL(ath_key_config); */ void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key) { - ath_hw_keyreset(common, key->hw_key_idx); + /* Leave CCMP and TKIP (main key) configured to avoid disabling + * encryption for potentially pending frames already in a TXQ with the + * keyix pointing to this key entry. Instead, only clear the MAC address + * to prevent RX processing from using this key cache entry. + */ + if (test_bit(key->hw_key_idx, common->ccmp_keymap) || + test_bit(key->hw_key_idx, common->tkip_keymap)) + ath_hw_keysetmac(common, key->hw_key_idx, NULL); + else + ath_hw_keyreset(common, key->hw_key_idx); if (key->hw_key_idx < IEEE80211_WEP_NKID) return; -- 2.25.1

1 6

[PATCH kernel-4.19] vfs: move cap_convert_nscap() call into vfs_setxattr()
by zhangyue 08 Nov '21

08 Nov '21

mainline inclusion category: feature bugzilla:https://gitee.com/openeuler/kernel/issues/I4GVH3?from=project-issue CVE: NA cap_convert_nscap() does permission checking as well as conversion of the xattr value conditionally based on fs's user-ns. This is needed by overlayfs and probably other layered fs (ecryptfs) and is what vfs_foo() is supposed to do anyway. Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Acked-by: James Morris <jamorris(a)linux.microsoft.com> Signed-off-by: zhangyue <zhangyue1(a)kylinos.cn> --- fs/xattr.c | 18 ++++++++++++------ include/linux/capability.h | 2 +- security/commoncap.c | 3 +-- 3 files changed, 14 insertions(+), 9 deletions(-) diff --git a/fs/xattr.c b/fs/xattr.c index adb11cb82be5..653e12d6060f 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -263,8 +263,16 @@ vfs_setxattr(struct dentry *dentry, const char *name, const void *value, { struct inode *inode = dentry->d_inode; struct inode *delegated_inode = NULL; + const void *orig_value = value; int error; + if (size && strcmp(name, XATTR_NAME_CAPS) == 0) { + error = cap_convert_nscap(dentry, &value, size); + if (error < 0) + return error; + size = error; + } + retry_deleg: inode_lock(inode); error = __vfs_setxattr_locked(dentry, name, value, size, flags, @@ -276,6 +284,10 @@ vfs_setxattr(struct dentry *dentry, const char *name, const void *value, if (!error) goto retry_deleg; } + + if (value != orig_value) + kfree(value); + return error; } EXPORT_SYMBOL_GPL(vfs_setxattr); @@ -530,12 +542,6 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value, if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) || (strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0)) posix_acl_fix_xattr_from_user(kvalue, size); - else if (strcmp(kname, XATTR_NAME_CAPS) == 0) { - error = cap_convert_nscap(d, &kvalue, size); - if (error < 0) - goto out; - size = error; - } } error = vfs_setxattr(d, kname, kvalue, size, flags); diff --git a/include/linux/capability.h b/include/linux/capability.h index f640dcbc880c..9fee9a86505c 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h @@ -249,6 +249,6 @@ extern bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns); /* audit system wants to get cap info from files as well */ extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps); -extern int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size); +extern int cap_convert_nscap(struct dentry *dentry, const void **ivalue, size_t size); #endif /* !_LINUX_CAPABILITY_H */ diff --git a/security/commoncap.c b/security/commoncap.c index 876cfe01d939..83546a782796 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -498,7 +498,7 @@ static bool validheader(size_t size, const struct vfs_cap_data *cap) * * If all is ok, we return the new size, on error return < 0. */ -int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size) +int cap_convert_nscap(struct dentry *dentry, const void **ivalue, size_t size) { struct vfs_ns_cap_data *nscap; uid_t nsrootid; @@ -541,7 +541,6 @@ int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size) nscap->magic_etc = cpu_to_le32(nsmagic); memcpy(&nscap->data, &cap->data, sizeof(__le32) * 2 * VFS_CAP_U32); - kvfree(*ivalue); *ivalue = nscap; return newsize; } -- 2.30.0

1 0

[PATCH openEuler-1.0-LTS] ext4: if zeroout fails fall back to splitting the extent node
by Yang Yingliang 08 Nov '21

08 Nov '21

From: Theodore Ts'o <tytso(a)mit.edu> mainline inclusion from mainline-5.15-rc1 commit 308c57ccf4318236be75dfa251c84713e694457b category: bugfix bugzilla: 109297 CVE: NA --------------------------- If the underlying storage device is using thin-provisioning, it's possible for a zeroout operation to return ENOSPC. Commit df22291ff0fd ("ext4: Retry block allocation if we have free blocks left") added logic to retry block allocation since we might get free block after we commit a transaction. But the ENOSPC from thin-provisioning will confuse ext4, and lead to an infinite loop. Since using zeroout instead of splitting the extent node is an optimization, if it fails, we might as well fall back to splitting the extent node. Reported-by: yangerkun <yangerkun(a)huawei.com> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: yangerkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/extents.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index fc00a78163117..10298c13a67d7 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -3696,7 +3696,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle, split_map.m_len - ee_block); err = ext4_ext_zeroout(inode, &zero_ex1); if (err) - goto out; + goto fallback; split_map.m_len = allocated; } if (split_map.m_lblk - ee_block + split_map.m_len < @@ -3710,7 +3710,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle, ext4_ext_pblock(ex)); err = ext4_ext_zeroout(inode, &zero_ex2); if (err) - goto out; + goto fallback; } split_map.m_len += split_map.m_lblk - ee_block; @@ -3719,6 +3719,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle, } } +fallback: err = ext4_split_extent(handle, inode, ppath, &split_map, split_flag, flags); if (err > 0) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] dccp: don't duplicate ccid when cloning dccp sock
by Yang Yingliang 08 Nov '21

08 Nov '21

From: "Lin, Zhenpeng" <zplin(a)psu.edu> mainline inclusion from mainline-v5.15-rc2 commit d9ea761fdd197351890418acd462c51f241014a7 category: bugfix bugzilla: 85666 CVE: CVE-2020-16119 ------------------------------------------------- Commit 2677d2067731 ("dccp: don't free ccid2_hc_tx_sock ...") fixed a UAF but reintroduced CVE-2017-6074. When the sock is cloned, two dccps_hc_tx_ccid will reference to the same ccid. So one can free the ccid object twice from two socks after cloning. This issue was found by "Hadar Manor" as well and assigned with CVE-2020-16119, which was fixed in Ubuntu's kernel. So here I port the patch from Ubuntu to fix it. The patch prevents cloned socks from referencing the same ccid. Fixes: 2677d2067731410 ("dccp: don't free ccid2_hc_tx_sock ...") Signed-off-by: Zhenpeng Lin <zplin(a)psu.edu> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/dccp/minisocks.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c index ba6fc3c1186b9..e91838a7b8497 100644 --- a/net/dccp/minisocks.c +++ b/net/dccp/minisocks.c @@ -98,6 +98,8 @@ struct sock *dccp_create_openreq_child(const struct sock *sk, newdp->dccps_role = DCCP_ROLE_SERVER; newdp->dccps_hc_rx_ackvec = NULL; newdp->dccps_service_list = NULL; + newdp->dccps_hc_rx_ccid = NULL; + newdp->dccps_hc_tx_ccid = NULL; newdp->dccps_service = dreq->dreq_service; newdp->dccps_timestamp_echo = dreq->dreq_timestamp_echo; newdp->dccps_timestamp_time = dreq->dreq_timestamp_time; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 01/14] Revert "selftests/bpf: add test_spec_readahead_xfs_file to support specail async readahead"
by Yang Yingliang 05 Nov '21

05 Nov '21

From: Hou Tao <houtao1(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4H3JT CVE: NA --------------------------- There are two issues with the current solution: 1) tracepoint xfs_read_file is visible in tracefs It forms an ABI for userspace. It is bad because new field may be added into xfs_writable_file to export more information to userspace. 2) tracepoint xfs_read_file is specific to xfs HDFS can be stacked on ext4. A new solution is proposed which uses vfs bare tracepoint, so reverts commit 69513cfbe62d267c4a5e6025f31741b1f2cb946c. Signed-off-by: Hou Tao <houtao1(a)huawei.com> Reviewed-by: Kuohai Xu <xukuohai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- tools/include/uapi/linux/xfs.h | 1 - tools/testing/selftests/bpf/Makefile | 3 +- .../bpf/test_spec_readahead_xfs_file.c | 39 ------------------- tools/testing/selftests/bpf/test_xfs_file.c | 9 +---- 4 files changed, 3 insertions(+), 49 deletions(-) delete mode 100644 tools/testing/selftests/bpf/test_spec_readahead_xfs_file.c diff --git a/tools/include/uapi/linux/xfs.h b/tools/include/uapi/linux/xfs.h index 1409b45affd34..a0d37e411ee18 100644 --- a/tools/include/uapi/linux/xfs.h +++ b/tools/include/uapi/linux/xfs.h @@ -6,7 +6,6 @@ #define FMODE_RANDOM (0x1000) #define FMODE_WILLNEED (0x400000) -#define FMODE_SPC_READAHEAD (0x800000) struct xfs_writable_file { const unsigned char *name; diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index 46b1d5b864f5a..8d2737285f185 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -36,8 +36,7 @@ TEST_GEN_FILES = test_pkt_access.o test_xdp.o test_l4lb.o test_tcp_estats.o test test_get_stack_rawtp.o test_sockmap_kern.o test_sockhash_kern.o \ test_lwt_seg6local.o sendmsg4_prog.o sendmsg6_prog.o test_lirc_mode2_kern.o \ get_cgroup_id_kern.o socket_cookie_prog.o test_select_reuseport_kern.o \ - test_skb_cgroup_id_kern.o test_set_xfs_file.o test_clear_xfs_file.o \ - test_spec_readahead_xfs_file.o + test_skb_cgroup_id_kern.o test_set_xfs_file.o test_clear_xfs_file.o # Order correspond to 'make run_tests' order TEST_PROGS := test_kmod.sh \ diff --git a/tools/testing/selftests/bpf/test_spec_readahead_xfs_file.c b/tools/testing/selftests/bpf/test_spec_readahead_xfs_file.c deleted file mode 100644 index ff8794a14cdcd..0000000000000 --- a/tools/testing/selftests/bpf/test_spec_readahead_xfs_file.c +++ /dev/null @@ -1,39 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0 - -#include <linux/bpf.h> -#include "bpf_helpers.h" -#include <string.h> -#include <linux/xfs.h> - -/* from /sys/kernel/debug/tracing/events/xfs/xfs_read_file */ -struct xfs_read_buffer_args { - struct xfs_writable_file *file; -}; - -SEC("tracepoint/xfs/xfs_file_read") -int bpf_prog1(struct xfs_read_buffer_args *ctx) -{ - char fmt[] = "name: %s, set f_mode: %u\n"; - struct xfs_writable_file *file = ctx->file; - char name[64] = {}; - char *tmp; - unsigned long i_size; - int len; - - bpf_probe_read(&tmp, 8, &(file->name)); - len = bpf_probe_read_str(name, 64, tmp); - bpf_probe_read(&i_size, 8, &(file->i_size)); - - if (!strncmp("blk_", name, 4)) { - /* blk_xxx.meta or blk_xxx with size < 2M */ - if (len == 27 || (len == 15 && i_size <= 2 * 1024 * 1024)) - file->f_mode |= FMODE_WILLNEED; - else if (len == 15) /* blk_xxx */ - file->f_mode |= FMODE_SPC_READAHEAD; - bpf_trace_printk(fmt, sizeof(fmt), name, file->f_mode); - } - return 0; -} - -char _license[] SEC("license") = "GPL"; -__u32 _version SEC("version") = 1; diff --git a/tools/testing/selftests/bpf/test_xfs_file.c b/tools/testing/selftests/bpf/test_xfs_file.c index 89e79d959677c..247c42be029b2 100644 --- a/tools/testing/selftests/bpf/test_xfs_file.c +++ b/tools/testing/selftests/bpf/test_xfs_file.c @@ -20,7 +20,6 @@ int main(int argc, char *argv[]) { const char *set_file = "./test_set_xfs_file.o"; const char *clear_file = "./test_clear_xfs_file.o"; - const char *spec_readahead_file = "./test_spec_readahead_xfs_file.o"; const char *file = set_file; struct bpf_object *obj; int efd, err, prog_fd; @@ -32,12 +31,8 @@ int main(int argc, char *argv[]) delay = strtol(str, &endptr, 10); } - if (argc >= 2) { - if (!strcmp("clear", argv[1])) - file = clear_file; - if (!strcmp("spec_readahead", argv[1])) - file = spec_readahead_file; - } + if (argc >= 2 && !strcmp("clear", argv[1])) + file = clear_file; err = bpf_prog_load(file, BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE, &obj, &prog_fd); -- 2.25.1

1 13