- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 v10 00/11] High Performance Container Resource View Isolation
by GONG Ruiqi 27 May '25

27 May '25

v10: - Move all bpf progs to samples/bpf/ v9: - Fix the missing of sourcing kernel/bpf-rvi/Kconfig in an existing Kconfig v8: - Move generic_single_iter.c to kernel/bpf-rvi/ - Refine the decompling with CONFIG_PROC_FS v7: - Add bpf_arch_flags to let cpuinfo_x86 get flags from kernel - Decomple CONFIG_BPF_RVI with CONFIG_PROC_FS - Move {bpf,get}_current_level1_reaper() from kernel/pid_namespace.c to kernel/pid.c, as it doesn't depends on CONFIG_PID_NS - Add 'depends on CONFIG_CPUSETS' to CONFIG_BPF_RVI, as we need task_cs(). v6: Don't remove uncompilable bpf progs in selftests, as demanded v5: Merge only cpuinfo_x86 and cpu_online for stage 1 v4: Fix valid checkpatch warnings v3: Add commit message for all commits v2: Add config control for all code --- Common supports: bpf: Add CONFIG_BPF_RVI bpf: Add generic_single_iter bpf: cpuset: Add bpf_cpuset_from_task() kfunc cpuset: Add task_effective_cpumask() bpf: Add bpf_cpumask_weight() kfunc bpf: pidns: Add {bpf,get}_current_level1_reaper() Cpuinfo_x86: selftests/bpf: Avoid building x86 cpuinfo prog for other arch bpf: Add cpuinfo_x86 iterator target bpf: Add bpf_arch_flags kunc for x86 selftests/bpf: Add iterator program for cpuinfo_x86 Cpu_online: selftests/bpf: Add iterator program for cpu_online --- GONG Ruiqi (11): bpf: Add CONFIG_BPF_RVI bpf: Add generic_single_iter bpf: cpuset: Add bpf_cpuset_from_task() kfunc cpuset: Add task_effective_cpumask() bpf: Add bpf_cpumask_weight() kfunc bpf: pidns: Add {bpf,get}_current_level1_reaper() bpf: Add cpuinfo_x86 iterator target bpf: Add bpf_arch_flags kunc for x86 samples/bpf: Add iterator program for cpuinfo_x86 samples/bpf: Add iterator program for cpu_online config: Turn on CONFIG_BPF_RVI for openeuler_defconfig arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + arch/x86/kernel/cpu/Makefile | 1 + arch/x86/kernel/cpu/bpf-rvi.c | 159 +++++++++++++++++++++++ arch/x86/kernel/cpu/proc.c | 2 +- include/linux/cpuset.h | 11 ++ include/linux/pid_namespace.h | 4 + init/Kconfig | 1 + kernel/Makefile | 2 + kernel/bpf-rvi/Kconfig | 19 +++ kernel/bpf-rvi/Makefile | 4 + kernel/bpf-rvi/generic_single_iter.c | 72 +++++++++++ kernel/bpf/helpers.c | 29 +++++ kernel/cgroup/cpuset.c | 50 ++++++++ kernel/pid.c | 25 ++++ samples/bpf/Makefile | 4 + samples/bpf/bpf_rvi_cpu_online.bpf.c | 55 ++++++++ samples/bpf/bpf_rvi_cpuinfo_x86.bpf.c | 169 +++++++++++++++++++++++++ 18 files changed, 608 insertions(+), 1 deletion(-) create mode 100644 arch/x86/kernel/cpu/bpf-rvi.c create mode 100644 kernel/bpf-rvi/Kconfig create mode 100644 kernel/bpf-rvi/Makefile create mode 100644 kernel/bpf-rvi/generic_single_iter.c create mode 100644 samples/bpf/bpf_rvi_cpu_online.bpf.c create mode 100644 samples/bpf/bpf_rvi_cpuinfo_x86.bpf.c -- 2.25.1

2 12

[PATCH OLK-6.6 v4 00/14] Cgroup-Based Interference Statistics
by Pu Lehui 27 May '25

27 May '25

Pu Lehui (6): interference: Add CGROUP_IFS config interference: Add CGROUP_IFS_DEFAULT_ENABLED config cgroup: Export cgroup_init_cftypes as internal interface cgroup: Export cgroup_addrm_files as internal interface interference: Add cgroup v1 support for CGROUP_IFS openeuler_defconfig: Disable CGROUP_IFS config by default Tengda Wu (5): interference: Add sched rundelay interference track support interference: Add sched sleep interference track support interference: Add sched throttle interference track support interference: Exclude throttle time from rundelay interference: Add sched wakelat interference track support Xu Kuohai (3): interference: Add cgroup-based inteference statistics framework interference: Add smt interference track support interference: Add irq interference track support arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + arch/x86/kernel/smpboot.c | 5 +- drivers/base/arch_topology.c | 4 + include/linux/cgroup-defs.h | 4 + include/linux/cgroup.h | 189 ++++++++++++++ include/linux/sched.h | 9 + init/Kconfig | 23 ++ kernel/cgroup/Makefile | 1 + kernel/cgroup/cgroup-internal.h | 20 ++ kernel/cgroup/cgroup.c | 27 +- kernel/cgroup/ifs.c | 339 +++++++++++++++++++++++++ kernel/sched/core.c | 23 +- kernel/sched/cpuacct.c | 15 ++ kernel/sched/cputime.c | 8 +- kernel/sched/deadline.c | 4 +- kernel/sched/fair.c | 14 +- kernel/sched/rt.c | 4 +- kernel/sched/sched.h | 11 +- kernel/sched/stats.c | 2 + kernel/sched/stats.h | 54 +++- 21 files changed, 729 insertions(+), 29 deletions(-) create mode 100644 kernel/cgroup/ifs.c -- 2.34.1

2 15

[PATCH OLK-6.6 0/9] v5: ucounts: rlimit scalability issues
by Chen Ridong 27 May '25

27 May '25

v5: ucounts: rlimit scalability issues Chen Ridong (4): ucounts: add CONFIG_UCOUNTS_PERCPU_COUNTER ucounts: add input for inc_rlimit_[get_]ucounts_limit ucounts: reinplement rlimit with percpu_counter ucount: fix kabi for ucounts MengEn Sun (1): ucounts: move kfree() out of critical zone protected by ucounts_lock Sebastian Andrzej Siewior (4): rcu: provide a static initializer for hlist_nulls_head ucount: replace get_ucounts_or_wrap() with atomic_inc_not_zero() ucount: use RCU for ucounts lookups ucount: use rcuref_t for reference counting arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/list_nulls.h | 1 + include/linux/user_namespace.h | 44 +++- init/Kconfig | 9 + init/main.c | 1 + ipc/mqueue.c | 3 +- kernel/signal.c | 2 +- kernel/ucount.c | 268 +++++++++++++++++++------ mm/mlock.c | 2 +- 10 files changed, 268 insertions(+), 64 deletions(-) -- 2.34.1

2 10

[PATCH OLK-6.6 0/8] net: tcp: scale connect() under pressure
by Dong Chenchen 27 May '25

27 May '25

scale connect() under pressure. Eric Dumazet (6): tcp: use RCU in __inet{6}_check_established() tcp: optimize inet_use_bhash2_on_bind() tcp: add RCU management to inet_bind_bucket tcp: use RCU lookup in __inet_hash_connect() inet: change lport contribution to inet_ehashfn() and inet6_ehashfn() inet: call inet6_ehashfn() once from inet6_hash_connect() Kuniyuki Iwashima (2): tcp: Use bhash2 for v4-mapped-v6 non-wildcard address. tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses. include/net/inet_hashtables.h | 9 ++-- include/net/ip.h | 2 +- net/ipv4/inet_connection_sock.c | 20 +++++--- net/ipv4/inet_hashtables.c | 88 ++++++++++++++++++++++++--------- net/ipv4/inet_timewait_sock.c | 2 +- net/ipv6/inet6_hashtables.c | 40 +++++++++++---- 6 files changed, 118 insertions(+), 43 deletions(-) -- 2.25.1

2 9

[PATCH OLK-6.6 0/8] bugfix for hisilicon accelerator driver
by Weili Qian 27 May '25

27 May '25

Chenghai Huang (1): uacce: fix unsigned long print format Weili Qian (7): uacce: fix isolate sysfs check condition uacce: delete some redundant code crypto: hisilicon/qm - fix vfs_num error crypto: hisilicon/qm - alloc power of 2 interrupts crypto: hisilicon - enable error reporting again crypto: hisilicon/trng - use DEFINE_MUTEX() for mutex lock crypto: hisilicon/zip - do not expose hashagg algorithm when uacce mode is 2 drivers/crypto/hisilicon/hpre/hpre_main.c | 11 +++++ drivers/crypto/hisilicon/qm.c | 60 ++++++++++++++++------- drivers/crypto/hisilicon/sec2/sec_main.c | 11 +++++ drivers/crypto/hisilicon/trng/trng.c | 38 +++++++------- drivers/crypto/hisilicon/zip/dae_main.c | 10 +++- drivers/crypto/hisilicon/zip/zip_main.c | 11 +++++ drivers/misc/uacce/uacce.c | 10 ++-- 7 files changed, 107 insertions(+), 44 deletions(-) -- 2.33.0

2 9

[PATCH OLK-6.6 V1] wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi
by Wang Tao 27 May '25

27 May '25

From: Manish Dharanenthiran <quic_mdharane(a)quicinc.com> stable inclusion from stable-v6.6.88 commit 7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC9HOO CVE: CVE-2025-37943 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9a0dddfb30f120db3851627935851d262e4e7acb ] In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields in the header within the ath12k_dp_rx_h_undecap_nwifi function for DP_RX_DECAP_TYPE_NATIVE_WIFI decap type and potentially resulting in invalid data access and memory corruption. Add a sanity check before processing the SKB to prevent invalid data access in the undecap native Wi-Fi function for the DP_RX_DECAP_TYPE_NATIVE_WIFI decap type. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Signed-off-by: Manish Dharanenthiran <quic_mdharane(a)quicinc.com> Signed-off-by: Tamizh Chelvam Raja <tamizh.raja(a)oss.qualcomm.com> Link: https://patch.msgid.link/20250211090302.4105141-1-tamizh.raja@oss.qualcomm.… Signed-off-by: Jeff Johnson <jeff.johnson(a)oss.qualcomm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/net/wireless/ath/ath12k/dp_rx.c | 42 +++++++++++++++++++++++-- 1 file changed, 40 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c index 70ad035acac7..8d9315038a75 100644 --- a/drivers/net/wireless/ath/ath12k/dp_rx.c +++ b/drivers/net/wireless/ath/ath12k/dp_rx.c @@ -2484,6 +2484,29 @@ static void ath12k_dp_rx_deliver_msdu(struct ath12k *ar, struct napi_struct *nap ieee80211_rx_napi(ar->hw, pubsta, msdu, napi); } +static bool ath12k_dp_rx_check_nwifi_hdr_len_valid(struct ath12k_base *ab, + struct hal_rx_desc *rx_desc, + struct sk_buff *msdu) +{ + struct ieee80211_hdr *hdr; + u8 decap_type; + u32 hdr_len; + + decap_type = ath12k_dp_rx_h_decap_type(ab, rx_desc); + if (decap_type != DP_RX_DECAP_TYPE_NATIVE_WIFI) + return true; + + hdr = (struct ieee80211_hdr *)msdu->data; + hdr_len = ieee80211_hdrlen(hdr->frame_control); + + if ((likely(hdr_len <= DP_MAX_NWIFI_HDR_LEN))) + return true; + + ab->soc_stats.invalid_rbm++; + WARN_ON_ONCE(1); + return false; +} + static int ath12k_dp_rx_process_msdu(struct ath12k *ar, struct sk_buff *msdu, struct sk_buff_head *msdu_list, @@ -2542,6 +2565,11 @@ static int ath12k_dp_rx_process_msdu(struct ath12k *ar, } } + if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, rx_desc, msdu))) { + ret = -EINVAL; + goto free_out; + } + ath12k_dp_rx_h_ppdu(ar, rx_desc, rx_status); ath12k_dp_rx_h_mpdu(ar, msdu, rx_desc, rx_status); @@ -2867,6 +2895,9 @@ static int ath12k_dp_rx_h_verify_tkip_mic(struct ath12k *ar, struct ath12k_peer RX_FLAG_IV_STRIPPED | RX_FLAG_DECRYPTED; skb_pull(msdu, hal_rx_desc_sz); + if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, rx_desc, msdu))) + return -EINVAL; + ath12k_dp_rx_h_ppdu(ar, rx_desc, rxs); ath12k_dp_rx_h_undecap(ar, msdu, rx_desc, HAL_ENCRYPT_TYPE_TKIP_MIC, rxs, true); @@ -3590,6 +3621,9 @@ static int ath12k_dp_rx_h_null_q_desc(struct ath12k *ar, struct sk_buff *msdu, skb_put(msdu, hal_rx_desc_sz + l3pad_bytes + msdu_len); skb_pull(msdu, hal_rx_desc_sz + l3pad_bytes); } + if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, desc, msdu))) + return -EINVAL; + ath12k_dp_rx_h_ppdu(ar, desc, status); ath12k_dp_rx_h_mpdu(ar, msdu, desc, status); @@ -3634,7 +3668,7 @@ static bool ath12k_dp_rx_h_reo_err(struct ath12k *ar, struct sk_buff *msdu, return drop; } -static void ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, +static bool ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, struct ieee80211_rx_status *status) { struct ath12k_base *ab = ar->ab; @@ -3652,6 +3686,9 @@ static void ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, skb_put(msdu, hal_rx_desc_sz + l3pad_bytes + msdu_len); skb_pull(msdu, hal_rx_desc_sz + l3pad_bytes); + if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, desc, msdu))) + return true; + ath12k_dp_rx_h_ppdu(ar, desc, status); status->flag |= (RX_FLAG_MMIC_STRIPPED | RX_FLAG_MMIC_ERROR | @@ -3659,6 +3696,7 @@ static void ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, ath12k_dp_rx_h_undecap(ar, msdu, desc, HAL_ENCRYPT_TYPE_TKIP_MIC, status, false); + return false; } static bool ath12k_dp_rx_h_rxdma_err(struct ath12k *ar, struct sk_buff *msdu, @@ -3677,7 +3715,7 @@ static bool ath12k_dp_rx_h_rxdma_err(struct ath12k *ar, struct sk_buff *msdu, case HAL_REO_ENTR_RING_RXDMA_ECODE_TKIP_MIC_ERR: err_bitmap = ath12k_dp_rx_h_mpdu_err(ab, rx_desc); if (err_bitmap & HAL_RX_MPDU_ERR_TKIP_MIC) { - ath12k_dp_rx_h_tkip_mic_err(ar, msdu, status); + drop = ath12k_dp_rx_h_tkip_mic_err(ar, msdu, status); break; } fallthrough; -- 2.34.1

2 1

[PATCH OLK-6.6 V1] pds_core: make wait_context part of q_info
by Wang Tao 27 May '25

27 May '25

From: Shannon Nelson <shannon.nelson(a)amd.com> stable inclusion from stable-v6.6.89 commit 1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6M6F CVE: CVE-2025-37886 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3f77c3dfffc7063428b100c4945ca2a7a8680380 ] Make the wait_context a full part of the q_info struct rather than a stack variable that goes away after pdsc_adminq_post() is done so that the context is still available after the wait loop has given up. There was a case where a slow development firmware caused the adminq request to time out, but then later the FW finally finished the request and sent the interrupt. The handler tried to complete_all() the completion context that had been created on the stack in pdsc_adminq_post() but no longer existed. This caused bad pointer usage, kernel crashes, and much wailing and gnashing of teeth. Fixes: 01ba61b55b20 ("pds_core: Add adminq processing and commands") Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Shannon Nelson <shannon.nelson(a)amd.com> Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Link: https://patch.msgid.link/20250421174606.3892-5-shannon.nelson@amd.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/net/ethernet/amd/pds_core/adminq.c | 36 +++++++++------------- drivers/net/ethernet/amd/pds_core/core.c | 4 ++- drivers/net/ethernet/amd/pds_core/core.h | 2 +- 3 files changed, 18 insertions(+), 24 deletions(-) diff --git a/drivers/net/ethernet/amd/pds_core/adminq.c b/drivers/net/ethernet/amd/pds_core/adminq.c index ea773cfa0af6..733f133d69e7 100644 --- a/drivers/net/ethernet/amd/pds_core/adminq.c +++ b/drivers/net/ethernet/amd/pds_core/adminq.c @@ -5,11 +5,6 @@ #include "core.h" -struct pdsc_wait_context { - struct pdsc_qcq *qcq; - struct completion wait_completion; -}; - static int pdsc_process_notifyq(struct pdsc_qcq *qcq) { union pds_core_notifyq_comp *comp; @@ -110,10 +105,10 @@ void pdsc_process_adminq(struct pdsc_qcq *qcq) q_info = &q->info[q->tail_idx]; q->tail_idx = (q->tail_idx + 1) & (q->num_descs - 1); - /* Copy out the completion data */ - memcpy(q_info->dest, comp, sizeof(*comp)); - - complete_all(&q_info->wc->wait_completion); + if (!completion_done(&q_info->completion)) { + memcpy(q_info->dest, comp, sizeof(*comp)); + complete(&q_info->completion); + } if (cq->tail_idx == cq->num_descs - 1) cq->done_color = !cq->done_color; @@ -166,8 +161,7 @@ irqreturn_t pdsc_adminq_isr(int irq, void *data) static int __pdsc_adminq_post(struct pdsc *pdsc, struct pdsc_qcq *qcq, union pds_core_adminq_cmd *cmd, - union pds_core_adminq_comp *comp, - struct pdsc_wait_context *wc) + union pds_core_adminq_comp *comp) { struct pdsc_queue *q = &qcq->q; struct pdsc_q_info *q_info; @@ -209,9 +203,9 @@ static int __pdsc_adminq_post(struct pdsc *pdsc, /* Post the request */ index = q->head_idx; q_info = &q->info[index]; - q_info->wc = wc; q_info->dest = comp; memcpy(q_info->desc, cmd, sizeof(*cmd)); + reinit_completion(&q_info->completion); dev_dbg(pdsc->dev, "head_idx %d tail_idx %d\n", q->head_idx, q->tail_idx); @@ -235,16 +229,13 @@ int pdsc_adminq_post(struct pdsc *pdsc, union pds_core_adminq_comp *comp, bool fast_poll) { - struct pdsc_wait_context wc = { - .wait_completion = - COMPLETION_INITIALIZER_ONSTACK(wc.wait_completion), - }; unsigned long poll_interval = 1; unsigned long poll_jiffies; unsigned long time_limit; unsigned long time_start; unsigned long time_done; unsigned long remaining; + struct completion *wc; int err = 0; int index; @@ -254,20 +245,19 @@ int pdsc_adminq_post(struct pdsc *pdsc, return -ENXIO; } - wc.qcq = &pdsc->adminqcq; - index = __pdsc_adminq_post(pdsc, &pdsc->adminqcq, cmd, comp, &wc); + index = __pdsc_adminq_post(pdsc, &pdsc->adminqcq, cmd, comp); if (index < 0) { err = index; goto err_out; } + wc = &pdsc->adminqcq.q.info[index].completion; time_start = jiffies; time_limit = time_start + HZ * pdsc->devcmd_timeout; do { /* Timeslice the actual wait to catch IO errors etc early */ poll_jiffies = msecs_to_jiffies(poll_interval); - remaining = wait_for_completion_timeout(&wc.wait_completion, - poll_jiffies); + remaining = wait_for_completion_timeout(wc, poll_jiffies); if (remaining) break; @@ -296,9 +286,11 @@ int pdsc_adminq_post(struct pdsc *pdsc, dev_dbg(pdsc->dev, "%s: elapsed %d msecs\n", __func__, jiffies_to_msecs(time_done - time_start)); - /* Check the results */ - if (time_after_eq(time_done, time_limit)) + /* Check the results and clear an un-completed timeout */ + if (time_after_eq(time_done, time_limit) && !completion_done(wc)) { err = -ETIMEDOUT; + complete(wc); + } dev_dbg(pdsc->dev, "read admin queue completion idx %d:\n", index); dynamic_hex_dump("comp ", DUMP_PREFIX_OFFSET, 16, 1, diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c index eb73c921dc1e..b3fa867c8ccd 100644 --- a/drivers/net/ethernet/amd/pds_core/core.c +++ b/drivers/net/ethernet/amd/pds_core/core.c @@ -169,8 +169,10 @@ static void pdsc_q_map(struct pdsc_queue *q, void *base, dma_addr_t base_pa) q->base = base; q->base_pa = base_pa; - for (i = 0, cur = q->info; i < q->num_descs; i++, cur++) + for (i = 0, cur = q->info; i < q->num_descs; i++, cur++) { cur->desc = base + (i * q->desc_size); + init_completion(&cur->completion); + } } static void pdsc_cq_map(struct pdsc_cq *cq, void *base, dma_addr_t base_pa) diff --git a/drivers/net/ethernet/amd/pds_core/core.h b/drivers/net/ethernet/amd/pds_core/core.h index f410f7d13205..858bebf79776 100644 --- a/drivers/net/ethernet/amd/pds_core/core.h +++ b/drivers/net/ethernet/amd/pds_core/core.h @@ -96,7 +96,7 @@ struct pdsc_q_info { unsigned int bytes; unsigned int nbufs; struct pdsc_buf_info bufs[PDS_CORE_MAX_FRAGS]; - struct pdsc_wait_context *wc; + struct completion completion; void *dest; }; -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] CVE-2024-50140
by Liu Kai 27 May '25

27 May '25

CVE-2024-50140 Linus Torvalds (1): task_work: make TWA_NMI_CURRENT handling conditional on IRQ_WORK Liu Kai (1): task_work: Fix kabi breakage in enum task_work_notify_mode Sebastian Andrzej Siewior (1): task_work: Add TWA_NMI_CURRENT as an additional notify mode. Waiman Long (1): sched/core: Disable page allocation in task_tick_mm_cid() include/linux/task_work.h | 8 +++++++- kernel/sched/core.c | 4 +++- kernel/task_work.c | 43 +++++++++++++++++++++++++++++++++++---- 3 files changed, 49 insertions(+), 6 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 V1] drm/i915/huc: Fix fence not released on early probe errors
by Wang Tao 27 May '25

27 May '25

From: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> stable inclusion from stable-v6.6.88 commit 9f5ef4a5eaa61a7a4ed31231da45deb85065397a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BKX CVE: CVE-2025-37754 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e3ea2eae70692a455e256787e4f54153fb739b90 ] HuC delayed loading fence, introduced with commit 27536e03271da ("drm/i915/huc: track delayed HuC load with a fence"), is registered with object tracker early on driver probe but unregistered only from driver remove, which is not called on early probe errors. Since its memory is allocated under devres, then released anyway, it may happen to be allocated again to the fence and reused on future driver probes, resulting in kernel warnings that taint the kernel: <4> [309.731371] ------------[ cut here ]------------ <3> [309.731373] ODEBUG: init destroyed (active state 0) object: ffff88813d7dd2e0 object type: i915_sw_fence hint: sw_fence_dummy_notify+0x0/0x20 [i915] <4> [309.731575] WARNING: CPU: 2 PID: 3161 at lib/debugobjects.c:612 debug_print_object+0x93/0xf0 ... <4> [309.731693] CPU: 2 UID: 0 PID: 3161 Comm: i915_module_loa Tainted: G U 6.14.0-CI_DRM_16362-gf0fd77956987+ #1 ... <4> [309.731700] RIP: 0010:debug_print_object+0x93/0xf0 ... <4> [309.731728] Call Trace: <4> [309.731730] <TASK> ... <4> [309.731949] __debug_object_init+0x17b/0x1c0 <4> [309.731957] debug_object_init+0x34/0x50 <4> [309.732126] __i915_sw_fence_init+0x34/0x60 [i915] <4> [309.732256] intel_huc_init_early+0x4b/0x1d0 [i915] <4> [309.732468] intel_uc_init_early+0x61/0x680 [i915] <4> [309.732667] intel_gt_common_init_early+0x105/0x130 [i915] <4> [309.732804] intel_root_gt_init_early+0x63/0x80 [i915] <4> [309.732938] i915_driver_probe+0x1fa/0xeb0 [i915] <4> [309.733075] i915_pci_probe+0xe6/0x220 [i915] <4> [309.733198] local_pci_probe+0x44/0xb0 <4> [309.733203] pci_device_probe+0xf4/0x270 <4> [309.733209] really_probe+0xee/0x3c0 <4> [309.733215] __driver_probe_device+0x8c/0x180 <4> [309.733219] driver_probe_device+0x24/0xd0 <4> [309.733223] __driver_attach+0x10f/0x220 <4> [309.733230] bus_for_each_dev+0x7d/0xe0 <4> [309.733236] driver_attach+0x1e/0x30 <4> [309.733239] bus_add_driver+0x151/0x290 <4> [309.733244] driver_register+0x5e/0x130 <4> [309.733247] __pci_register_driver+0x7d/0x90 <4> [309.733251] i915_pci_register_driver+0x23/0x30 [i915] <4> [309.733413] i915_init+0x34/0x120 [i915] <4> [309.733655] do_one_initcall+0x62/0x3f0 <4> [309.733667] do_init_module+0x97/0x2a0 <4> [309.733671] load_module+0x25ff/0x2890 <4> [309.733688] init_module_from_file+0x97/0xe0 <4> [309.733701] idempotent_init_module+0x118/0x330 <4> [309.733711] __x64_sys_finit_module+0x77/0x100 <4> [309.733715] x64_sys_call+0x1f37/0x2650 <4> [309.733719] do_syscall_64+0x91/0x180 <4> [309.733763] entry_SYSCALL_64_after_hwframe+0x76/0x7e <4> [309.733792] </TASK> ... <4> [309.733806] ---[ end trace 0000000000000000 ]--- That scenario is most easily reproducible with igt@i915_module_load@reload-with-fault-injection. Fix the issue by moving the cleanup step to driver release path. Fixes: 27536e03271da ("drm/i915/huc: track delayed HuC load with a fence") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/13592 Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> Cc: Alan Previn <alan.previn.teres.alexis(a)intel.com> Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> Reviewed-by: Krzysztof Karas <krzysztof.karas(a)intel.com> Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> Link: https://lore.kernel.org/r/20250402172057.209924-2-janusz.krzysztofik@linux.… (cherry picked from commit 795dbde92fe5c6996a02a5b579481de73035e7bf) Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/gpu/drm/i915/gt/uc/intel_huc.c | 11 +++++------ drivers/gpu/drm/i915/gt/uc/intel_huc.h | 1 + drivers/gpu/drm/i915/gt/uc/intel_uc.c | 1 + 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/uc/intel_huc.c b/drivers/gpu/drm/i915/gt/uc/intel_huc.c index ba9e07fc2b57..552662953e7a 100644 --- a/drivers/gpu/drm/i915/gt/uc/intel_huc.c +++ b/drivers/gpu/drm/i915/gt/uc/intel_huc.c @@ -316,6 +316,11 @@ void intel_huc_init_early(struct intel_huc *huc) } } +void intel_huc_fini_late(struct intel_huc *huc) +{ + delayed_huc_load_fini(huc); +} + #define HUC_LOAD_MODE_STRING(x) (x ? "GSC" : "legacy") static int check_huc_loading_mode(struct intel_huc *huc) { @@ -413,12 +418,6 @@ int intel_huc_init(struct intel_huc *huc) void intel_huc_fini(struct intel_huc *huc) { - /* - * the fence is initialized in init_early, so we need to clean it up - * even if HuC loading is off. - */ - delayed_huc_load_fini(huc); - if (huc->heci_pkt) i915_vma_unpin_and_release(&huc->heci_pkt, 0); diff --git a/drivers/gpu/drm/i915/gt/uc/intel_huc.h b/drivers/gpu/drm/i915/gt/uc/intel_huc.h index ba5cb08e9e7b..09aff3148f7d 100644 --- a/drivers/gpu/drm/i915/gt/uc/intel_huc.h +++ b/drivers/gpu/drm/i915/gt/uc/intel_huc.h @@ -55,6 +55,7 @@ struct intel_huc { int intel_huc_sanitize(struct intel_huc *huc); void intel_huc_init_early(struct intel_huc *huc); +void intel_huc_fini_late(struct intel_huc *huc); int intel_huc_init(struct intel_huc *huc); void intel_huc_fini(struct intel_huc *huc); void intel_huc_suspend(struct intel_huc *huc); diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc.c b/drivers/gpu/drm/i915/gt/uc/intel_uc.c index 98b103375b7a..c29d187ddad1 100644 --- a/drivers/gpu/drm/i915/gt/uc/intel_uc.c +++ b/drivers/gpu/drm/i915/gt/uc/intel_uc.c @@ -145,6 +145,7 @@ void intel_uc_init_late(struct intel_uc *uc) void intel_uc_driver_late_release(struct intel_uc *uc) { + intel_huc_fini_late(&uc->huc); } /** -- 2.34.1

2 1

[PATCH OLK-6.6] tpm: Add a driver for Loongson TPM device
by Hongchen Zhang 27 May '25

27 May '25

From: Qunqin Zhao <zhaoqunqin(a)loongson.cn> LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICATLF CVE: NA -------------------------------- Loongson security engine supports random number generation, hash, symmetric encryption and asymmetric encryption. Based on these encryption functions, TPM2 have been implemented in the Loongson security engine firmware. This driver is responsible for copying data into the memory visible to the firmware and receiving data from the firmware. Co-developed-by: Yinggang Gu <guyinggang(a)loongson.cn> Signed-off-by: Yinggang Gu <guyinggang(a)loongson.cn> Signed-off-by: Qunqin Zhao <zhaoqunqin(a)loongson.cn> Change-Id: I029740a822afd797d211a868b36e5ba8dd3b6b6a --- MAINTAINERS | 5 + arch/loongarch/configs/loongson3_defconfig | 1 + drivers/char/Kconfig | 1 + drivers/char/loongson_se.c | 33 +++++-- drivers/char/tpm/Kconfig | 9 ++ drivers/char/tpm/Makefile | 1 + drivers/char/tpm/tpm_loongson.c | 103 +++++++++++++++++++++ include/soc/loongson/se.h | 1 + 8 files changed, 144 insertions(+), 10 deletions(-) create mode 100644 drivers/char/tpm/tpm_loongson.c diff --git a/MAINTAINERS b/MAINTAINERS index c6a3ac61989c..546459e25d4a 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -7337,6 +7337,11 @@ F: Documentation/networking/net_dim.rst F: include/linux/dim.h F: lib/dim/ +LOONGSON TPM DRIVER +M: Qunqin Zhao <zhaoqunqin(a)loongson.cn> +S: Maintained +F: drivers/char/tpm/tpm_loongson.c + DYNAMIC THERMAL POWER MANAGEMENT (DTPM) M: Daniel Lezcano <daniel.lezcano(a)kernel.org> L: linux-pm(a)vger.kernel.org diff --git a/arch/loongarch/configs/loongson3_defconfig b/arch/loongarch/configs/loongson3_defconfig index 106b2029211b..e9e9f67c0b33 100644 --- a/arch/loongarch/configs/loongson3_defconfig +++ b/arch/loongarch/configs/loongson3_defconfig @@ -1145,6 +1145,7 @@ CONFIG_TCG_TIS_I2C_INFINEON=m CONFIG_TCG_TIS_I2C_NUVOTON=m CONFIG_TCG_ATMEL=m CONFIG_TCG_INFINEON=m +CONFIG_TCG_LOONGSON=m CONFIG_TCG_TIS_ST33ZP24_I2C=m CONFIG_TCG_TIS_ST33ZP24_SPI=m CONFIG_I2C_CHARDEV=y diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig index ea7ace87a9df..1d2957bc100d 100644 --- a/drivers/char/Kconfig +++ b/drivers/char/Kconfig @@ -394,6 +394,7 @@ config UV_MMTIMER config LOONGSON_SE tristate "LOONGSON SECURITY MODULE Interface" depends on LOONGARCH + select MFD_CORE default m help If you have LOONGSON security module (SE) support say Yes and it diff --git a/drivers/char/loongson_se.c b/drivers/char/loongson_se.c index 853f7e10cd41..c9bd51adc792 100644 --- a/drivers/char/loongson_se.c +++ b/drivers/char/loongson_se.c @@ -14,6 +14,7 @@ #include <linux/iopoll.h> #include <linux/kernel.h> #include <linux/module.h> +#include <linux/mfd/core.h> #include <linux/platform_device.h> #include <soc/loongson/se.h> @@ -309,19 +310,25 @@ int se_send_ch_requeset(struct lsse_ch *ch) { struct loongson_se *se; u32 status, int_bit; + int err; se = ch->se; int_bit = ch->int_bit; + mutex_lock(&se->ch_init_lock); if ((se_readl(se, SE_L2SINT_STAT) & int_bit) || - !(se_readl(se, SE_L2SINT_EN) & int_bit)) + !(se_readl(se, SE_L2SINT_EN) & int_bit)) { + mutex_unlock(&se->ch_init_lock); return -EBUSY; + } se_enable_int(se, int_bit); se_writel(se, int_bit, SE_L2SINT_SET); - return readl_relaxed_poll_timeout_atomic(se->base + SE_L2SINT_STAT, status, + err = readl_relaxed_poll_timeout_atomic(se->base + SE_L2SINT_STAT, status, !(status & int_bit), 10, 10000); + mutex_unlock(&se->ch_init_lock); + return err; } EXPORT_SYMBOL_GPL(se_send_ch_requeset); @@ -337,10 +344,10 @@ struct lsse_ch *se_init_ch(struct device *dev, int id, int data_size, int msg_si { struct loongson_se *se = dev_get_drvdata(dev); struct lsse_ch *ch; - unsigned long flag; int data_first, data_nr; int msg_first, msg_nr; + mutex_lock(&se->ch_init_lock); if (!se) { pr_err("SE has bot been initialized\n"); return NULL; @@ -356,8 +363,6 @@ struct lsse_ch *se_init_ch(struct device *dev, int id, int data_size, int msg_si return NULL; } - spin_lock_irqsave(&se->dev_lock, flag); - ch = &se->chs[id]; ch->se = se; ch->id = id; @@ -369,7 +374,7 @@ struct lsse_ch *se_init_ch(struct device *dev, int id, int data_size, int msg_si 0, data_nr, 0); if (data_first >= se->mem_map_pages) { dev_err(se->dev, "Insufficient memory space\n"); - spin_unlock_irqrestore(&se->dev_lock, flag); + mutex_unlock(&se->ch_init_lock); return NULL; } @@ -384,7 +389,7 @@ struct lsse_ch *se_init_ch(struct device *dev, int id, int data_size, int msg_si if (msg_first >= se->mem_map_pages) { dev_err(se->dev, "Insufficient memory space\n"); bitmap_clear(se->mem_map, data_first, data_nr); - spin_unlock_irqrestore(&se->dev_lock, flag); + mutex_unlock(&se->ch_init_lock); return NULL; } @@ -396,14 +401,15 @@ struct lsse_ch *se_init_ch(struct device *dev, int id, int data_size, int msg_si ch->priv = priv; spin_lock_init(&ch->ch_lock); - spin_unlock_irqrestore(&se->dev_lock, flag); if (loongson_se_set_msg(ch)) { dev_err(se->dev, "Channel %d setup message address failed\n", id); + mutex_unlock(&se->ch_init_lock); return NULL; } se_enable_int(se, ch->int_bit); + mutex_unlock(&se->ch_init_lock); return ch; } @@ -448,6 +454,10 @@ void se_deinit_ch(struct lsse_ch *ch) } EXPORT_SYMBOL_GPL(se_deinit_ch); +static const struct mfd_cell engines[] = { + { .name = "loongson-tpm" }, +}; + static int loongson_se_probe(struct platform_device *pdev) { struct loongson_se *se; @@ -460,6 +470,7 @@ static int loongson_se_probe(struct platform_device *pdev) se->dev = dev; dev_set_drvdata(dev, se); init_completion(&se->cmd_completion); + mutex_init(&se->ch_init_lock); spin_lock_init(&se->cmd_lock); spin_lock_init(&se->dev_lock); /* Setup DMA buffer */ @@ -497,10 +508,12 @@ static int loongson_se_probe(struct platform_device *pdev) } err = se_init_hw(se, se->mem_addr, size); - if (err) + if (err) { se_disable_hw(se); + return err; + } - return err; + return devm_mfd_add_devices(dev, 0, engines, ARRAY_SIZE(engines), NULL, 0, NULL); } static const struct acpi_device_id loongson_se_acpi_match[] = { diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig index 301284e07603..3524b2e6086e 100644 --- a/drivers/char/tpm/Kconfig +++ b/drivers/char/tpm/Kconfig @@ -174,6 +174,15 @@ config TCG_IBMVTPM will be accessible from within Linux. To compile this driver as a module, choose M here; the module will be called tpm_ibmvtpm. +config TCG_LOONGSON + tristate "Loongson TPM Interface" + depends on LOONGSON_SE + help + If you want to make Loongson TPM support available, say Yes and + it will be accessible from within Linux. To compile this + driver as a module, choose M here; the module will be called + tpm_loongson. + config TCG_XEN tristate "XEN TPM Interface" depends on TCG_TPM && XEN diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile index 8f868c9b9ce7..ea2919ddbd6e 100644 --- a/drivers/char/tpm/Makefile +++ b/drivers/char/tpm/Makefile @@ -44,3 +44,4 @@ obj-$(CONFIG_TCG_VTPM_PROXY) += tpm_vtpm_proxy.o obj-$(CONFIG_TCG_FTPM_TEE) += tpm_ftpm_tee.o obj-$(CONFIG_TCG_HYGON) += tpm_hygon.o obj-$(CONFIG_TCM_HYGON) += tcm_hygon.o +obj-$(CONFIG_TCG_LOONGSON) += tpm_loongson.o diff --git a/drivers/char/tpm/tpm_loongson.c b/drivers/char/tpm/tpm_loongson.c new file mode 100644 index 000000000000..3c27d86b77ba --- /dev/null +++ b/drivers/char/tpm/tpm_loongson.c @@ -0,0 +1,103 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2025 Loongson Technology Corporation Limited. */ + +#include <linux/device.h> +#include <soc/loongson/se.h> +#include <linux/platform_device.h> +#include <linux/wait.h> + +#include "tpm.h" + +struct tpm_loongson_msg { + u32 cmd; + u32 data_off; + u32 data_len; + u32 info[5]; +}; + +struct tpm_loongson_dev { + struct lsse_ch *se_ch; + struct completion tpm_loongson_completion; +}; + +static void tpm_loongson_complete(struct lsse_ch *ch) +{ + struct tpm_loongson_dev *td = ch->priv; + + complete(&td->tpm_loongson_completion); +} + +static int tpm_loongson_recv(struct tpm_chip *chip, u8 *buf, size_t count) +{ + struct tpm_loongson_dev *td = dev_get_drvdata(&chip->dev); + struct tpm_loongson_msg *rmsg; + int sig; + + sig = wait_for_completion_interruptible(&td->tpm_loongson_completion); + if (sig) + return sig; + + rmsg = td->se_ch->rmsg; + memcpy(buf, td->se_ch->data_buffer, rmsg->data_len); + + return rmsg->data_len; +} + +static int tpm_loongson_send(struct tpm_chip *chip, u8 *buf, size_t count) +{ + struct tpm_loongson_dev *td = dev_get_drvdata(&chip->dev); + struct tpm_loongson_msg *smsg = td->se_ch->smsg; + + memcpy(td->se_ch->data_buffer, buf, count); + smsg->data_len = count; + + return se_send_ch_requeset(td->se_ch); +} + +static const struct tpm_class_ops tpm_loongson_ops = { + .flags = TPM_OPS_AUTO_STARTUP, + .recv = tpm_loongson_recv, + .send = tpm_loongson_send, +}; + +static int tpm_loongson_probe(struct platform_device *pdev) +{ + struct device *dev = &pdev->dev; + struct tpm_loongson_msg *smsg; + struct tpm_loongson_dev *td; + struct tpm_chip *chip; + + td = devm_kzalloc(dev, sizeof(struct tpm_loongson_dev), GFP_KERNEL); + if (!td) + return -ENOMEM; + + init_completion(&td->tpm_loongson_completion); + td->se_ch = se_init_ch(dev->parent, SE_CH_TPM, PAGE_SIZE, + 2 * sizeof(struct tpm_loongson_msg), td, + tpm_loongson_complete); + if (!td->se_ch) + return -ENODEV; + smsg = td->se_ch->smsg; + smsg->cmd = SE_CMD_TPM; + smsg->data_off = td->se_ch->data_buffer - td->se_ch->se->mem_base; + + chip = tpmm_chip_alloc(dev, &tpm_loongson_ops); + if (IS_ERR(chip)) + return PTR_ERR(chip); + chip->flags = TPM_CHIP_FLAG_TPM2 | TPM_CHIP_FLAG_IRQ; + dev_set_drvdata(&chip->dev, td); + + return tpm_chip_register(chip); +} + +static struct platform_driver tpm_loongson_driver = { + .probe = tpm_loongson_probe, + .driver = { + .name = "loongson-tpm", + }, +}; +module_platform_driver(tpm_loongson_driver); + +MODULE_ALIAS("platform:loongson-tpm"); +MODULE_LICENSE("GPL"); +MODULE_DESCRIPTION("Loongson TPM driver"); diff --git a/include/soc/loongson/se.h b/include/soc/loongson/se.h index d9864e3f3b85..22872f7d1a19 100644 --- a/include/soc/loongson/se.h +++ b/include/soc/loongson/se.h @@ -109,6 +109,7 @@ struct loongson_se { void __iomem *base; u32 version; u32 ch_status; + struct mutex ch_init_lock; spinlock_t cmd_lock; spinlock_t dev_lock; -- 2.33.0

2 1