- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] blk-cgroup: synchronize blkg creation against policy deactivation
by Yang Yingliang 01 Nov '21

01 Nov '21

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v5.16 commit 0c9d338c8443b06da8e8d3bfce824c5ea6d3488f category: bugfix bugzilla: 182378 CVE: NA --------------------------- Our test reports a null pointer dereference: [ 168.534653] ================================================================== [ 168.535614] Disabling lock debugging due to kernel taint [ 168.536346] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 168.537274] #PF: supervisor read access in kernel mode [ 168.537964] #PF: error_code(0x0000) - not-present page [ 168.538667] PGD 0 P4D 0 [ 168.539025] Oops: 0000 [#1] PREEMPT SMP KASAN [ 168.539656] CPU: 13 PID: 759 Comm: bash Tainted: G B 5.15.0-rc2-next-202100 [ 168.540954] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_0738364 [ 168.542736] RIP: 0010:bfq_pd_init+0x88/0x1e0 [ 168.543318] Code: 98 00 00 00 e8 c9 e4 5b ff 4c 8b 65 00 49 8d 7c 24 08 e8 bb e4 5b ff 4d0 [ 168.545803] RSP: 0018:ffff88817095f9c0 EFLAGS: 00010002 [ 168.546497] RAX: 0000000000000001 RBX: ffff888101a1c000 RCX: 0000000000000000 [ 168.547438] RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff888106553428 [ 168.548402] RBP: ffff888106553400 R08: ffffffff961bcaf4 R09: 0000000000000001 [ 168.549365] R10: ffffffffa2e16c27 R11: fffffbfff45c2d84 R12: 0000000000000000 [ 168.550291] R13: ffff888101a1c098 R14: ffff88810c7a08c8 R15: ffffffffa55541a0 [ 168.551221] FS: 00007fac75227700(0000) GS:ffff88839ba80000(0000) knlGS:0000000000000000 [ 168.552278] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 168.553040] CR2: 0000000000000008 CR3: 0000000165ce7000 CR4: 00000000000006e0 [ 168.554000] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 168.554929] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 168.555888] Call Trace: [ 168.556221] <TASK> [ 168.556510] blkg_create+0x1c0/0x8c0 [ 168.556989] blkg_conf_prep+0x574/0x650 [ 168.557502] ? stack_trace_save+0x99/0xd0 [ 168.558033] ? blkcg_conf_open_bdev+0x1b0/0x1b0 [ 168.558629] tg_set_conf.constprop.0+0xb9/0x280 [ 168.559231] ? kasan_set_track+0x29/0x40 [ 168.559758] ? kasan_set_free_info+0x30/0x60 [ 168.560344] ? tg_set_limit+0xae0/0xae0 [ 168.560853] ? do_sys_openat2+0x33b/0x640 [ 168.561383] ? do_sys_open+0xa2/0x100 [ 168.561877] ? __x64_sys_open+0x4e/0x60 [ 168.562383] ? __kasan_check_write+0x20/0x30 [ 168.562951] ? copyin+0x48/0x70 [ 168.563390] ? _copy_from_iter+0x234/0x9e0 [ 168.563948] tg_set_conf_u64+0x17/0x20 [ 168.564467] cgroup_file_write+0x1ad/0x380 [ 168.565014] ? cgroup_file_poll+0x80/0x80 [ 168.565568] ? __mutex_lock_slowpath+0x30/0x30 [ 168.566165] ? pgd_free+0x100/0x160 [ 168.566649] kernfs_fop_write_iter+0x21d/0x340 [ 168.567246] ? cgroup_file_poll+0x80/0x80 [ 168.567796] new_sync_write+0x29f/0x3c0 [ 168.568314] ? new_sync_read+0x410/0x410 [ 168.568840] ? __handle_mm_fault+0x1c97/0x2d80 [ 168.569425] ? copy_page_range+0x2b10/0x2b10 [ 168.570007] ? _raw_read_lock_bh+0xa0/0xa0 [ 168.570622] vfs_write+0x46e/0x630 [ 168.571091] ksys_write+0xcd/0x1e0 [ 168.571563] ? __x64_sys_read+0x60/0x60 [ 168.572081] ? __kasan_check_write+0x20/0x30 [ 168.572659] ? do_user_addr_fault+0x446/0xff0 [ 168.573264] __x64_sys_write+0x46/0x60 [ 168.573774] do_syscall_64+0x35/0x80 [ 168.574264] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 168.574960] RIP: 0033:0x7fac74915130 [ 168.575456] Code: 73 01 c3 48 8b 0d 58 ed 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 444 [ 168.577969] RSP: 002b:00007ffc3080e288 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 168.578986] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007fac74915130 [ 168.579937] RDX: 0000000000000009 RSI: 000056007669f080 RDI: 0000000000000001 [ 168.580884] RBP: 000056007669f080 R08: 000000000000000a R09: 00007fac75227700 [ 168.581841] R10: 000056007655c8f0 R11: 0000000000000246 R12: 0000000000000009 [ 168.582796] R13: 0000000000000001 R14: 00007fac74be55e0 R15: 00007fac74be08c0 [ 168.583757] </TASK> [ 168.584063] Modules linked in: [ 168.584494] CR2: 0000000000000008 [ 168.584964] ---[ end trace 2475611ad0f77a1a ]--- This is because blkg_alloc() is called from blkg_conf_prep() without holding 'q->queue_lock', and elevator is exited before blkg_create(): thread 1 thread 2 blkg_conf_prep spin_lock_irq(&q->queue_lock); blkg_lookup_check -> return NULL spin_unlock_irq(&q->queue_lock); blkg_alloc blkcg_policy_enabled -> true pd = ->pd_alloc_fn blkg->pd[i] = pd blk_mq_exit_sched bfq_exit_queue blkcg_deactivate_policy spin_lock_irq(&q->queue_lock); __clear_bit(pol->plid, q->blkcg_pols); spin_unlock_irq(&q->queue_lock); q->elevator = NULL; spin_lock_irq(&q->queue_lock); blkg_create if (blkg->pd[i]) ->pd_init_fn -> q->elevator is NULL spin_unlock_irq(&q->queue_lock); Because blkcg_deactivate_policy() requires queue to be frozen, we can grab q_usage_counter to synchoronize blkg_conf_prep() against blkcg_deactivate_policy(). Fixes: e21b7a0b9887 ("block, bfq: add full hierarchical scheduling and cgroups support") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Acked-by: Tejun Heo <tj(a)kernel.org> Link: https://lore.kernel.org/r/20211020014036.2141723-1-yukuai3@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflict: block/blk-cgroup.c - commit ed6cddefdfd3 ("block: convert the rest of block to bdev_get_queue") is not backported. - commit 015d254cb02b ("blkcg: separate blkcg_conf_get_disk() out of blkg_conf_prep()") is not backported. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-cgroup.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 7dca3a0144243..d4a8d8fbe1a0e 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -857,6 +857,14 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, q = disk->queue; + /* + * blkcg_deactivate_policy() requires queue to be frozen, we can grab + * q_usage_counter to prevent concurrent with blkcg_deactivate_policy(). + */ + ret = blk_queue_enter(q, 0); + if (ret) + goto fail; + rcu_read_lock(); spin_lock_irq(q->queue_lock); @@ -891,13 +899,13 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, new_blkg = blkg_alloc(pos, q, GFP_KERNEL); if (unlikely(!new_blkg)) { ret = -ENOMEM; - goto fail; + goto fail_exit_queue; } if (radix_tree_preload(GFP_KERNEL)) { blkg_free(new_blkg); ret = -ENOMEM; - goto fail; + goto fail_exit_queue; } rcu_read_lock(); @@ -926,6 +934,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, goto success; } success: + blk_queue_exit(q); ctx->disk = disk; ctx->blkg = blkg; ctx->body = body; @@ -936,6 +945,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, fail_unlock: spin_unlock_irq(q->queue_lock); rcu_read_unlock(); +fail_exit_queue: + blk_queue_exit(q); fail: put_disk_and_module(disk); /* -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] isdn: cpai: check ctr->cnr to avoid array index out of bound
by Yang Yingliang 01 Nov '21

01 Nov '21

From: Xiaolong Huang <butterflyhuangxx(a)gmail.com> stable inclusion from linux-4.19.214 commit 7d91adc0ccb060ce564103315189466eb822cc6a CVE: CVE-2021-3896 -------------------------------- commit 1f3e2e97c003f80c4b087092b225c8787ff91e4d upstream. The cmtp_add_connection() would add a cmtp session to a controller and run a kernel thread to process cmtp. __module_get(THIS_MODULE); session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d", session->num); During this process, the kernel thread would call detach_capi_ctr() to detach a register controller. if the controller was not attached yet, detach_capi_ctr() would trigger an array-index-out-bounds bug. [ 46.866069][ T6479] UBSAN: array-index-out-of-bounds in drivers/isdn/capi/kcapi.c:483:21 [ 46.867196][ T6479] index -1 is out of range for type 'capi_ctr *[32]' [ 46.867982][ T6479] CPU: 1 PID: 6479 Comm: kcmtpd_ctr_0 Not tainted 5.15.0-rc2+ #8 [ 46.869002][ T6479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [ 46.870107][ T6479] Call Trace: [ 46.870473][ T6479] dump_stack_lvl+0x57/0x7d [ 46.870974][ T6479] ubsan_epilogue+0x5/0x40 [ 46.871458][ T6479] __ubsan_handle_out_of_bounds.cold+0x43/0x48 [ 46.872135][ T6479] detach_capi_ctr+0x64/0xc0 [ 46.872639][ T6479] cmtp_session+0x5c8/0x5d0 [ 46.873131][ T6479] ? __init_waitqueue_head+0x60/0x60 [ 46.873712][ T6479] ? cmtp_add_msgpart+0x120/0x120 [ 46.874256][ T6479] kthread+0x147/0x170 [ 46.874709][ T6479] ? set_kthread_struct+0x40/0x40 [ 46.875248][ T6479] ret_from_fork+0x1f/0x30 [ 46.875773][ T6479] Signed-off-by: Xiaolong Huang <butterflyhuangxx(a)gmail.com> Acked-by: Arnd Bergmann <arnd(a)arndb.de> Link: https://lore.kernel.org/r/20211008065830.305057-1-butterflyhuangxx@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Rui Xiang <rui.xiang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/isdn/capi/kcapi.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c index a4ceb61c5b603..ed9ee2bbf232e 100644 --- a/drivers/isdn/capi/kcapi.c +++ b/drivers/isdn/capi/kcapi.c @@ -565,6 +565,11 @@ int detach_capi_ctr(struct capi_ctr *ctr) ctr_down(ctr, CAPI_CTR_DETACHED); + if (ctr->cnr < 1 || ctr->cnr - 1 >= CAPI_MAXCONTR) { + err = -EINVAL; + goto unlock_out; + } + if (capi_controller[ctr->cnr - 1] != ctr) { err = -EINVAL; goto unlock_out; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] nbd: Fix use-after-free in pid_show
by Yang Yingliang 01 Nov '21

01 Nov '21

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v5.16 commit 0c98057be9efa32de78dbc4685fc73da9d71faa1 category: bugfix bugzilla: 182939 CVE: NA ----------------------------------------------- I got issue as follows: [ 263.886511] BUG: KASAN: use-after-free in pid_show+0x11f/0x13f [ 263.888359] Read of size 4 at addr ffff8880bf0648c0 by task cat/746 [ 263.890479] CPU: 0 PID: 746 Comm: cat Not tainted 4.19.90-dirty #140 [ 263.893162] Call Trace: [ 263.893509] dump_stack+0x108/0x15f [ 263.893999] print_address_description+0xa5/0x372 [ 263.894641] kasan_report.cold+0x236/0x2a8 [ 263.895696] __asan_report_load4_noabort+0x25/0x30 [ 263.896365] pid_show+0x11f/0x13f [ 263.897422] dev_attr_show+0x48/0x90 [ 263.898361] sysfs_kf_seq_show+0x24d/0x4b0 [ 263.899479] kernfs_seq_show+0x14e/0x1b0 [ 263.900029] seq_read+0x43f/0x1150 [ 263.900499] kernfs_fop_read+0xc7/0x5a0 [ 263.903764] vfs_read+0x113/0x350 [ 263.904231] ksys_read+0x103/0x270 [ 263.905230] __x64_sys_read+0x77/0xc0 [ 263.906284] do_syscall_64+0x106/0x360 [ 263.906797] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Reproduce this issue as follows: 1. nbd-server 8000 /tmp/disk 2. nbd-client localhost 8000 /dev/nbd1 3. cat /sys/block/nbd1/pid Then trigger use-after-free in pid_show. Reason is after do step '2', nbd-client progress is already exit. So it's task_struct already freed. To solve this issue, revert part of 6521d39a64b3's modify and remove useless 'recv_task' member of nbd_device. Fixes: 6521d39a64b3 ("nbd: Remove variable 'pid'") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Link: https://lore.kernel.org/r/20211020073959.2679255-1-yebin10@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> conflicts: drivers/block/nbd.c Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/nbd.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 45e6ae6add382..2a3794801704a 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -112,11 +112,11 @@ struct nbd_device { struct workqueue_struct *recv_workq; struct list_head list; - struct task_struct *task_recv; struct task_struct *task_setup; struct completion *destroy_complete; unsigned long flags; + pid_t pid; /* pid of nbd-client, if attached */ }; #define NBD_CMD_REQUEUED 1 @@ -211,7 +211,7 @@ static ssize_t pid_show(struct device *dev, struct gendisk *disk = dev_to_disk(dev); struct nbd_device *nbd = (struct nbd_device *)disk->private_data; - return sprintf(buf, "%d\n", task_pid_nr(nbd->task_recv)); + return sprintf(buf, "%d\n", nbd->pid); } static const struct device_attribute pid_attr = { @@ -329,7 +329,7 @@ static void nbd_size_set(struct nbd_device *nbd, loff_t blocksize, struct nbd_config *config = nbd->config; config->blksize = blocksize; config->bytesize = blocksize * nr_blocks; - if (nbd->task_recv != NULL) + if (nbd->pid) nbd_size_update(nbd, false); } @@ -1234,7 +1234,7 @@ static void nbd_config_put(struct nbd_device *nbd) if (test_and_clear_bit(NBD_RT_HAS_PID_FILE, &config->runtime_flags)) device_remove_file(disk_to_dev(nbd->disk), &pid_attr); - nbd->task_recv = NULL; + nbd->pid = 0; nbd_clear_sock(nbd); if (config->num_connections) { int i; @@ -1269,7 +1269,7 @@ static int nbd_start_device(struct nbd_device *nbd) int num_connections = config->num_connections; int error = 0, i; - if (nbd->task_recv) + if (nbd->pid) return -EBUSY; if (!config->socks) return -EINVAL; @@ -1288,7 +1288,7 @@ static int nbd_start_device(struct nbd_device *nbd) } blk_mq_update_nr_hw_queues(&nbd->tag_set, config->num_connections); - nbd->task_recv = current; + nbd->pid = task_pid_nr(current); nbd_parse_flags(nbd); @@ -1546,8 +1546,8 @@ static int nbd_dbg_tasks_show(struct seq_file *s, void *unused) { struct nbd_device *nbd = s->private; - if (nbd->task_recv) - seq_printf(s, "recv: %d\n", task_pid_nr(nbd->task_recv)); + if (nbd->pid) + seq_printf(s, "recv: %d\n", nbd->pid); return 0; } @@ -2106,7 +2106,7 @@ static int nbd_genl_reconfigure(struct sk_buff *skb, struct genl_info *info) mutex_lock(&nbd->config_lock); config = nbd->config; if (!test_bit(NBD_RT_BOUND, &config->runtime_flags) || - !nbd->task_recv) { + !nbd->pid) { dev_err(nbd_to_dev(nbd), "not configured, cannot reconfigure\n"); ret = -EINVAL; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] iommu/arm-smmu-v3: Add suspend and resume support
by Yang Yingliang 01 Nov '21

01 Nov '21

From: Bixuan Cui <cuibixuan(a)huawei.com> ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4DZ7Q CVE: NA ------------------------------------------------------- Add suspend and resume support for smmuv3. The smmu is stopped when suspending and started when resuming. Signed-off-by: Bixuan Cui <cuibixuan(a)huawei.com> Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/arm-smmu-v3.c | 98 +++++++++++++++++++++++++++++++++---- 1 file changed, 88 insertions(+), 10 deletions(-) diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c index 560980c54014a..12d503bb3b1e0 100644 --- a/drivers/iommu/arm-smmu-v3.c +++ b/drivers/iommu/arm-smmu-v3.c @@ -693,6 +693,7 @@ struct arm_smmu_device { unsigned int mpam_partid_max; unsigned int mpam_pmg_max; + bool bypass; }; struct arm_smmu_stream { @@ -3455,6 +3456,13 @@ static void arm_smmu_write_msi_msg(struct msi_desc *desc, struct msi_msg *msg) doorbell = (((u64)msg->address_hi) << 32) | msg->address_lo; doorbell &= MSI_CFG0_ADDR_MASK; +#ifdef CONFIG_PM_SLEEP + /* Saves the msg (base addr of msi irq) and restores it during resume */ + desc->msg.address_lo = msg->address_lo; + desc->msg.address_hi = msg->address_hi; + desc->msg.data = msg->data; +#endif + writeq_relaxed(doorbell, smmu->base + cfg[0]); writel_relaxed(msg->data, smmu->base + cfg[1]); writel_relaxed(ARM_SMMU_MEMATTR_DEVICE_nGnRE, smmu->base + cfg[2]); @@ -3510,6 +3518,40 @@ static void arm_smmu_setup_msis(struct arm_smmu_device *smmu) devm_add_action(dev, arm_smmu_free_msis, dev); } +#ifdef CONFIG_PM_SLEEP +static void arm_smmu_resume_msis(struct arm_smmu_device *smmu) +{ + struct msi_desc *desc; + struct device *dev = smmu->dev; + + for_each_msi_entry(desc, dev) { + switch (desc->platform.msi_index) { + case EVTQ_MSI_INDEX: + case GERROR_MSI_INDEX: + case PRIQ_MSI_INDEX: { + phys_addr_t *cfg = arm_smmu_msi_cfg[desc->platform.msi_index]; + struct msi_msg *msg = &desc->msg; + phys_addr_t doorbell = (((u64)msg->address_hi) << 32) | msg->address_lo; + + doorbell &= MSI_CFG0_ADDR_MASK; + writeq_relaxed(doorbell, smmu->base + cfg[0]); + writel_relaxed(msg->data, smmu->base + cfg[1]); + writel_relaxed(ARM_SMMU_MEMATTR_DEVICE_nGnRE, + smmu->base + cfg[2]); + break; + } + default: + continue; + + } + } +} +#else +static void arm_smmu_resume_msis(struct arm_smmu_device *smmu) +{ +} +#endif + static void arm_smmu_setup_message_based_spi(struct arm_smmu_device *smmu) { struct irq_desc *desc; @@ -3541,11 +3583,17 @@ static void arm_smmu_setup_message_based_spi(struct arm_smmu_device *smmu) } } -static void arm_smmu_setup_unique_irqs(struct arm_smmu_device *smmu) +static void arm_smmu_setup_unique_irqs(struct arm_smmu_device *smmu, bool resume) { int irq, ret; - arm_smmu_setup_msis(smmu); + if (!resume) + arm_smmu_setup_msis(smmu); + else { + /* The irq doesn't need to be re-requested during resume */ + arm_smmu_resume_msis(smmu); + return; + } /* Request interrupt lines */ irq = smmu->evtq.q.irq; @@ -3587,7 +3635,7 @@ static void arm_smmu_setup_unique_irqs(struct arm_smmu_device *smmu) } } -static int arm_smmu_setup_irqs(struct arm_smmu_device *smmu) +static int arm_smmu_setup_irqs(struct arm_smmu_device *smmu, bool resume) { int ret, irq; u32 irqen_flags = IRQ_CTRL_EVTQ_IRQEN | IRQ_CTRL_GERROR_IRQEN; @@ -3614,7 +3662,7 @@ static int arm_smmu_setup_irqs(struct arm_smmu_device *smmu) if (ret < 0) dev_warn(smmu->dev, "failed to enable combined irq\n"); } else - arm_smmu_setup_unique_irqs(smmu); + arm_smmu_setup_unique_irqs(smmu, resume); if (smmu->features & ARM_SMMU_FEAT_PRI) irqen_flags |= IRQ_CTRL_PRIQ_IRQEN; @@ -3642,7 +3690,7 @@ static int arm_smmu_device_disable(struct arm_smmu_device *smmu) return ret; } -static int arm_smmu_device_reset(struct arm_smmu_device *smmu, bool bypass) +static int arm_smmu_device_reset(struct arm_smmu_device *smmu, bool resume) { int ret; u32 reg, enables; @@ -3747,7 +3795,7 @@ static int arm_smmu_device_reset(struct arm_smmu_device *smmu, bool bypass) } } - ret = arm_smmu_setup_irqs(smmu); + ret = arm_smmu_setup_irqs(smmu, resume); if (ret) { dev_err(smmu->dev, "failed to setup irqs\n"); return ret; @@ -3757,7 +3805,7 @@ static int arm_smmu_device_reset(struct arm_smmu_device *smmu, bool bypass) enables &= ~(CR0_EVTQEN | CR0_PRIQEN); /* Enable the SMMU interface, or ensure bypass */ - if (!bypass || disable_bypass) { + if (!smmu->bypass || disable_bypass) { enables |= CR0_SMMUEN; } else { ret = arm_smmu_update_gbpa(smmu, 0, GBPA_ABORT); @@ -4383,6 +4431,26 @@ int arm_smmu_get_dev_user_mpam_en(struct device *dev, int *user_mpam_en) } EXPORT_SYMBOL(arm_smmu_get_dev_user_mpam_en); +#ifdef CONFIG_PM_SLEEP +static int arm_smmu_suspend(struct device *dev) +{ + /* + * The smmu is powered off and related registers are automatically + * cleared when suspend. No need to do anything. + */ + return 0; +} + +static int arm_smmu_resume(struct device *dev) +{ + struct arm_smmu_device *smmu = dev_get_drvdata(dev); + + arm_smmu_device_reset(smmu, true); + + return 0; +} +#endif + static int arm_smmu_device_probe(struct platform_device *pdev) { int irq, ret; @@ -4390,7 +4458,6 @@ static int arm_smmu_device_probe(struct platform_device *pdev) resource_size_t ioaddr; struct arm_smmu_device *smmu; struct device *dev = &pdev->dev; - bool bypass; smmu = devm_kzalloc(dev, sizeof(*smmu), GFP_KERNEL); if (!smmu) { @@ -4408,7 +4475,7 @@ static int arm_smmu_device_probe(struct platform_device *pdev) } /* Set bypass mode according to firmware probing result */ - bypass = !!ret; + smmu->bypass = !!ret; /* Base address */ res = platform_get_resource(pdev, IORESOURCE_MEM, 0); @@ -4454,7 +4521,7 @@ static int arm_smmu_device_probe(struct platform_device *pdev) platform_set_drvdata(pdev, smmu); /* Reset the device */ - ret = arm_smmu_device_reset(smmu, bypass); + ret = arm_smmu_device_reset(smmu, false); if (ret) return ret; @@ -4527,11 +4594,22 @@ static const struct of_device_id arm_smmu_of_match[] = { }; MODULE_DEVICE_TABLE(of, arm_smmu_of_match); +#ifdef CONFIG_PM_SLEEP +static const struct dev_pm_ops arm_smmu_pm_ops = { + .suspend = arm_smmu_suspend, + .resume = arm_smmu_resume, +}; +#define ARM_SMMU_PM_OPS (&arm_smmu_pm_ops) +#else +#define ARM_SMMU_PM_OPS NULL +#endif + static struct platform_driver arm_smmu_driver = { .driver = { .name = "arm-smmu-v3", .of_match_table = of_match_ptr(arm_smmu_of_match), .suppress_bind_attrs = true, + .pm = ARM_SMMU_PM_OPS, }, .probe = arm_smmu_device_probe, .remove = arm_smmu_device_remove, -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
by Yang Yingliang 01 Nov '21

01 Nov '21

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v5.16 commit 4e3ace0051e7e504b55d239daab8789dd89b863c category: bugfix bugzilla: 176010 CVE: NA ----------------------------------------------- The following warning was observed running syzkaller: [ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in; [ 3813.830724] program syz-executor not setting count and/or reply_len properly [ 3813.836956] ================================================================== [ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0 [ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549 [ 3813.846612] Call Trace: [ 3813.846995] dump_stack+0x108/0x15f [ 3813.847524] print_address_description+0xa5/0x372 [ 3813.848243] kasan_report.cold+0x236/0x2a8 [ 3813.849439] check_memory_region+0x240/0x270 [ 3813.850094] memcpy+0x30/0x80 [ 3813.850553] sg_copy_buffer+0x157/0x1e0 [ 3813.853032] sg_copy_from_buffer+0x13/0x20 [ 3813.853660] fill_from_dev_buffer+0x135/0x370 [ 3813.854329] resp_readcap16+0x1ac/0x280 [ 3813.856917] schedule_resp+0x41f/0x1630 [ 3813.858203] scsi_debug_queuecommand+0xb32/0x17e0 [ 3813.862699] scsi_dispatch_cmd+0x330/0x950 [ 3813.863329] scsi_request_fn+0xd8e/0x1710 [ 3813.863946] __blk_run_queue+0x10b/0x230 [ 3813.864544] blk_execute_rq_nowait+0x1d8/0x400 [ 3813.865220] sg_common_write.isra.0+0xe61/0x2420 [ 3813.871637] sg_write+0x6c8/0xef0 [ 3813.878853] __vfs_write+0xe4/0x800 [ 3813.883487] vfs_write+0x17b/0x530 [ 3813.884008] ksys_write+0x103/0x270 [ 3813.886268] __x64_sys_write+0x77/0xc0 [ 3813.886841] do_syscall_64+0x106/0x360 [ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9 This issue can be reproduced with the following syzkaller log: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\x00') open_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782) write$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d"], 0x126) In resp_readcap16() we get "int alloc_len" value -1104926854, and then pass the huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This leads to OOB in sg_copy_buffer(). To solve this issue, define alloc_len as u32. Link: https://lore.kernel.org/r/20211013033913.2551004-2-yebin10@huawei.com Acked-by: Douglas Gilbert <dgilbert(a)interlog.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> conflicts: drivers/scsi/scsi_debug.c Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/scsi_debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c index 082b2695e02f3..d8befc6fbec9c 100644 --- a/drivers/scsi/scsi_debug.c +++ b/drivers/scsi/scsi_debug.c @@ -1665,7 +1665,7 @@ static int resp_readcap16(struct scsi_cmnd *scp, { unsigned char *cmd = scp->cmnd; unsigned char arr[SDEBUG_READCAP16_ARR_SZ]; - int alloc_len; + u32 alloc_len; alloc_len = get_unaligned_be32(cmd + 10); /* following just in case virtual_gb changed */ @@ -1694,7 +1694,7 @@ static int resp_readcap16(struct scsi_cmnd *scp, } return fill_from_dev_buffer(scp, arr, - min(alloc_len, SDEBUG_READCAP16_ARR_SZ)); + min_t(u32, alloc_len, SDEBUG_READCAP16_ARR_SZ)); } #define SDEBUG_MAX_TGTPGS_ARR_SZ 1412 -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS V2] README: README optimize
by Laibin Qiu 01 Nov '21

01 Nov '21

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4FS3G?from=project-issue CVE: NA --------------------------- There are some language problems in the README file, and MarkDown fromat syntax is not effective, and it needs to be adjusted. Signed-off-by: suqin <suqin2(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- README | 226 ---------------------------------------- README.md | 237 ++++++++++++++++++++++++++++++++++++++++++ scripts/checkpatch.pl | 2 +- 3 files changed, 238 insertions(+), 227 deletions(-) delete mode 100644 README create mode 100644 README.md diff --git a/README b/README deleted file mode 100644 index 46c9ea352..000000000 --- a/README +++ /dev/null @@ -1,226 +0,0 @@ -Contributions to openEuler kernel project -========================================= - -Sign CLA --------- - -Before submitting any Contributions to openEuler, you have to sign CLA. - -See: - https://openeuler.org/zh/cla.html - https://openeuler.org/en/cla.html - -Steps of submitting patches ---------------------------- - -1. Compile and test your patches successfully. -2. Generate patches - Your patches should be based on top of latest openEuler branch, and should - use git-format-patch to generate patches, and if it's a patchset, it's - better to use --cover-letter option to describe what the patchset does. - - Using scripts/checkpatch.pl to make sure there's no coding style issue. - - And make sure your patch follow unified openEuler patch format describe - below. - -3. Send patch to openEuler mailing list - Use this command to send patches to openEuler mailing list: - - git send-email *.patch -to="kernel(a)openeuler.org" --suppress-cc=all - - *NOTE*: that you must add --suppress-cc=all if you use git send-email, - otherwise the email will be cced to the people in upstream community and mailing - lists. - - *See*: How to send patches using git-send-email - https://git-scm.com/docs/git-send-email - -4. Mark "v1, v2, v3 ..." in your patch subject if you have multiple versions - to send out. - - Use --subject-prefix="PATCH v2" option to add v2 tag for patchset. - git format-patch --subject-prefix="PATCH v2" -1 - - Subject examples: - Subject: [PATCH v2 01/27] fork: fix some -Wmissing-prototypes warnings - Subject: [PATCH v3] ext2: improve scalability of bitmap searching - -5. Upstream your kernel patch to kernel community is strongly recommended. - openEuler will sync up with kernel master timely. - -6. Sign your work - the Developer’s Certificate of Origin - As the same of upstream kernel community, you also need to sign your patch. - - See: https://www.kernel.org/doc/html/latest/process/submitting-patches.html - - The sign-off is a simple line at the end of the explanation for the patch, - which certifies that you wrote it or otherwise have the right to pass it - on as an open-source patch. The rules are pretty simple: if you can certify - the below: - - Developer’s Certificate of Origin 1.1 - ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - - By making a contribution to this project, I certify that: - - (a) The contribution was created in whole or in part by me and I have - the right to submit it under the open source license indicated in - the file; or - - (b The contribution is based upon previous work that, to the best of - my knowledge, is covered under an appropriate open source license - and I have the right under that license to submit that work with - modifications, whether created in whole or in part by me, under - the same open source license (unless I am permitted to submit under - a different license), as indicated in the file; or - - (c) The contribution was provided directly to me by some other person - who certified (a), (b) or (c) and I have not modified it. - - (d) I understand and agree that this project and the contribution are - public and that a record of the contribution (including all personal - information I submit with it, including my sign-off) is maintained - indefinitely and may be redistributed consistent with this project - or the open source license(s) involved. - - then you just add a line saying: - - Signed-off-by: Random J Developer <random(a)developer.example.org> - - using your real name (sorry, no pseudonyms or anonymous contributions.) - -Use unified patch format ------------------------- - -Reasons: - -1. long term maintainability - openEuler will merge massive patches. If all patches are merged by casual - changelog format without a unified format, the git log will be messy, and - then it's hard to figure out the original patch. - -2. kernel upgrade - We definitely will upgrade our openEuler kernel in someday, using strict - patch management will alleviate the pain to migrate patches during big upgrade. - -3. easy for script parsing - Keyword highlighting is necessary for script parsing. - -Patch format definition ------------------------ - -[M] stands for "mandatory" -[O] stands for "option" -$category can be: bug preparation, bugfix, perf, feature, doc, other... - -If category is feature, then we also need to add feature name like below: - category: feature - feature: YYY (the feature name) - -If the patch is related to CVE or bugzilla, then we need add the corresponding -tag like below (In general, it should include at least one of the following): - CVE: $cve-id - bugzilla: $bug-id - -Additional changelog should include at least one of the flollwing: - 1) Why we should apply this patch - 2) What real problem in product does this patch resolved - 3) How could we reproduce this bug or how to test - 4) Other useful information for help to understand this patch or problem - -The detail information is very useful for porting patch to another kenrel branch. - -Example for mainline patch: - - mainline inclusion [M] - from $mainline-version [M] - commit $id [M] - category: $category [M] - bugzilla: $bug-id [O] - CVE: $cve-id [O] - - additional changelog [O] - - -------------------------------- - - original changelog - - Signed-off-by: $yourname <$yourname(a)huawei.com> [M] - - ($mainline-version could be mainline-3.5, mainline-3.6, etc...) - -Examples --------- - -mainline inclusion -from mainline-4.10 -commit 0becc0ae5b42828785b589f686725ff5bc3b9b25 -category: bugfix -bugzilla: 3004 -CVE: NA - -The patch fixes a BUG_ON in the product: injecting single bit ECC error -to memory before system boot use hardware inject tools, which cause a -large amount of CMCI during system booting . - -[ 1.146580] mce: [Hardware Error]: Machine check events logged -[ 1.152908] ------------[ cut here ]------------ -[ 1.157751] kernel BUG at kernel/timer.c:951! -[ 1.162321] invalid opcode: 0000 [#1] SMP -... - -------------------------------------------------- - -original changelog - -<original S-O-B> -Signed-off-by: Zhang San <zhangsan(a)huawei.com> -Tested-by: Li Si <lisi(a)huawei.com> - -Email Client - Thunderbird Settings ------------------------------------ - -If you are newly developer in the kernel community, it is highly recommended -to use thunderbird mail client. - -1. Thunderbird Installation - Get English version Thunderbird from http://www.mozilla.org/ and install - it on your system。 - - Download url: https://www.thunderbird.net/en-US/thunderbird/all/ - -2. Settings - 2.1 Use plain text format instead of HTML format - Options -> Account Settings -> Composition & Addressing, do *NOT* select - "Compose message in HTML format". - - 2.2 Editor Settings - Tools->Options->Advanced->Config editor. - - - To bring up the thunderbird's registry editor, and set: - "mailnews.send_plaintext_flowed" to "false". - - Disable HTML Format: Set "mail.identity.id1.compose_html" to "false". - - Enable UTF8: Set "prefs.converted-to-utf8" to "true". - - View message in UTF-8: Set "mailnews.view_default_charset" to "UTF-8". - - Set mailnews.wraplength to 9999 for avoiding auto-wrap - -Linux kernel -============ - -There are several guides for kernel developers and users. These guides can -be rendered in a number of formats, like HTML and PDF. Please read -Documentation/admin-guide/README.rst first. - -In order to build the documentation, use ``make htmldocs`` or -``make pdfdocs``. The formatted documentation can also be read online at: - - https://www.kernel.org/doc/html/latest/ - -There are various text files in the Documentation/ subdirectory, -several of them using the Restructured Text markup notation. -See Documentation/00-INDEX for a list of what is contained in each file. - -Please read the Documentation/process/changes.rst file, as it contains the -requirements for building and running the kernel, and information about -the problems which may result by upgrading your kernel. diff --git a/README.md b/README.md new file mode 100644 index 000000000..3374c4726 --- /dev/null +++ b/README.md @@ -0,0 +1,237 @@ +# How to Contribute +------- + +- [How to Contribute](#How to Contribute) + + \- [Sign the CLA](#Sign the CLA) + + \- [Steps of submitting patches](#Steps of submitting patches) + + \- [Use the unified patch format](#Use the unified patch format) + + \- [Define the patch format](#Define the patch format) + + \- [Examples](#Examples) + + \- [Email client - Thunderbird settings](#Email client - Thunderbird settings) + +- [Linux kernel](#Linux kernel) + +### Sign the CLA + +------- + +Before making any contributions to openEuler, sign the CLA first. + +Address: [https://openeuler.org/en/cla.html](https://openeuler.org/en/cla.html) + +### Steps of submitting patches +------- + +**Step 1** Compile and test your patches. + +**Step 2** Generate patches. + +Your patches should be generated based on the latest openEuler branch using git-format-patch. If your patches are in a patchset, it is better to use the **--cover-letter** option to describe what the patchset does. + +Use **scripts/checkpatch.pl** to ensure that no coding style issue exists. + +In addition, ensure that your patches comply with the unified openEuler patch format described below. + +**Step 3** Send your patches to the openEuler mailing list. + +To do so, run the following command: + + `git send-email *.patch -to="kernel(a)openeuler.org" --suppress-cc=all` + +*NOTE*: Add **--suppress-cc=all** if you use git-send-email; otherwise, the email will be copied to all people in the upstream community and mailing lists. + +For details about how to send patches using git-send-email, see [https://git-scm.com/docs/git-send-email](https://git-scm.com/docs/git-send-…. + +**Step 4** Mark "v1, v2, v3 ..." in your patch subject if you have multiple versions to send out. + +Use the **--subject-prefix="PATCH v2"** option to add the v2 tag to the patchset. + + `git format-patch --subject-prefix="PATCH v2" -1` + +Subject examples: + + Subject: [PATCH v2 01/27] fork: fix some -Wmissing-prototypes warnings + + Subject: [PATCH v3] ext2: improve scalability of bitmap searching + +**Step 5** Upstream your kernel patches to the kernel community (recommended). openEuler will synchronize with the kernel master in a timely manner. + +**Step 6** Sign your work - the Developer’s Certificate of Origin. + + Similar to the upstream kernel community, you also need to sign your patch. + + For details, see [https://www.kernel.org/doc/html/latest/process/submitting-patches.html](htt…. + + The sign-off is a simple line at the end of the explanation of the patch, which certifies that you wrote it or otherwise have the right to pass it on as an open source patch. The rules are pretty simple. You can certify as below: + + Developer’s Certificate of Origin 1.1 + + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + + By making a contribution to this project, I certify that: + + (a) The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; + + (b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; + + (c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it. + + (d) I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved. + +Then you add a line saying: + +Signed-off-by: Random J Developer <random(a)developer.example.org> + +Use your real name (sorry, no pseudonyms or anonymous contributions). + +### Use the unified patch format +------- + +Reasons: + +1. Long term maintainability + + openEuler will merge massive patches. If all patches are merged by casual + + changelog formats without a unified format, the git logs will be messy, and + + then it is hard to figure out the original patches. + +2. Kernel upgrade + + We definitely will upgrade our openEuler kernel in someday, so strict patch management + + will alleviate the pain to migrate patches during big upgrades. + +3. Easy for script parsing + + Keyword highlighting is necessary for script parsing. + +### Define the patch format +------- + +[M] stands for "mandatory". + +[O] stands for "option". + +$category can be: bug preparation, bugfix, perf, feature, doc, other... + +If category is feature, we need to add a feature name as below: + +```cpp +category: feature +feature: YYY (the feature name) +``` + +If the patch is related to CVE or bugzilla, we need to add the corresponding tag as below (In general, it should include at least one of the following): + +```cpp +CVE: $cve-id +bugzilla: $bug-id +``` + +Additional changelog should include at least one of the following: + +1. Why we should apply this patch + +2. What real problems in the product does this patch resolved + +3. How could we reproduce this bug or how to test + +4. Other useful information for help to understand this patch or problem + +The detailed information is very useful for migrating a patch to another kernel branch. + +Example for mainline patch: + +```cpp +mainline inclusion [M] +from $mainline-version [M] +commit $id [M] +category: $category [M] +bugzilla: $bug-id [O] +CVE: $cve-id [O] + +additional changelog [O] + +-------------------------------- + +original changelog +Signed-off-by: $yourname <$yourname(a)huawei.com> [M] +($mainline-version could be mainline-3.5, mainline-3.6, etc...) +``` + +### Examples +------- + +```cpp +mainline inclusion +from mainline-4.10 +commit 0becc0ae5b42828785b589f686725ff5bc3b9b25 +category: bugfix +bugzilla: 3004 +CVE: N/A + +The patch fixes a BUG_ON in the product: Injecting a single bit ECC error to the memory before system boot using hardware inject tools will cause a large amount of CMCI during system booting . +[ 1.146580] mce: [Hardware Error]: Machine check events logged +[ 1.152908] ------------[ cut here ]------------ +[ 1.157751] kernel BUG at kernel/timer.c:951! +[ 1.162321] invalid opcode: 0000 [#1] SMP + +------------------------------------------------- + +original changelog + +<original S-O-B> +Signed-off-by: Zhang San <zhangsan(a)huawei.com> +Tested-by: Li Si <lisi(a)huawei.com> +``` + +### Email client - Thunderbird settings +------- + +If you are a new developer in the kernel community, it is highly recommended that you use the Thunderbird mail client. + +1. Thunderbird Installation + + Obtain the English version of Thunderbird from [http://www.mozilla.org/]( http://www.mozilla.org/) and install it on your system. + + Download URL: https://www.thunderbird.net/en-US/thunderbird/all/ + +2. Settings + + 2.1 Use the plain text format instead of the HTML format. + + Choose **Options > Account Settings > Composition & Addressing**, and do **NOT** select Compose message in HTML format. + + 2.2 Editor settings + + **Tools > Options> Advanced > Config editor** + + \- To bring up the Thunderbird's registry editor, set **mailnews.send_plaintext_flowed** to **false**. + + \- Disable HTML Format: Set **mail.identity.id1.compose_html** to **false**. + + \- Enable UTF-8: Set **prefs.converted-to-utf8** to **true**. + + \- View messages in UTF-8: Set **mailnews.view_default_charset** to **UTF-8**. + + \- Set **mailnews.wraplength** to **9999** to avoid auto-wrap. + +# Linux kernel +------- + +There are several guides for kernel developers and users, which can be rendered in a number of formats, like HTML and PDF. You can read **Documentation/admin-guide/README.rst** first. + +In order to build the documentation, use **make htmldocs** or **make pdfdocs**. The formatted documentation can also be read online at: https://www.kernel.org/doc/html/latest/ + +There are various text files in the Documentation/ subdirectory, several of which use the Restructured Text markup notation. See Documentation/00-INDEX for a list of what is contained in each file. + +Read the **Documentation/process/changes.rst** file, as it contains the requirements for building and running the kernel, and information about the problems that may be caused by upgrading your kernel. + diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl index 161b0224d..d9a8ae4da 100755 --- a/scripts/checkpatch.pl +++ b/scripts/checkpatch.pl @@ -1063,7 +1063,7 @@ sub top_of_kernel_tree { my @tree_check = ( "COPYING", "CREDITS", "Kbuild", "MAINTAINERS", "Makefile", - "README", "Documentation", "arch", "include", "drivers", + "README.md", "Documentation", "arch", "include", "drivers", "fs", "init", "ipc", "kernel", "lib", "scripts", ); -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS] scsi: hisi_sas: unsupported DIX between OS and HBA only for SATA device
by Yang Yingliang 01 Nov '21

01 Nov '21

From: Yang Xingui <yangxingui(a)huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA Signed-off-by: Yang Xingui <yangxingui(a)huawei.com> Reviewed-by: Ouyangdelong <ouyangdelong(a)huawei.com> Reviewed-by: Kangfenglong <kangfenglong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas.h | 10 ++++++++++ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 7 ++++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h index 3fd32606ecb00..8e9424e62a150 100644 --- a/drivers/scsi/hisi_sas/hisi_sas.h +++ b/drivers/scsi/hisi_sas/hisi_sas.h @@ -77,6 +77,16 @@ #define HISI_SAS_SATA_PROTOCOL_FPDMA 0x8 #define HISI_SAS_SATA_PROTOCOL_ATAPI 0x10 +#define HISI_SAS_DIF_PROT_MASK (SHOST_DIF_TYPE1_PROTECTION | \ + SHOST_DIF_TYPE2_PROTECTION | \ + SHOST_DIF_TYPE3_PROTECTION) + +#define HISI_SAS_DIX_PROT_MASK (SHOST_DIX_TYPE1_PROTECTION | \ + SHOST_DIX_TYPE2_PROTECTION | \ + SHOST_DIX_TYPE3_PROTECTION) + +#define HISI_SAS_PROT_MASK (HISI_SAS_DIF_PROT_MASK | HISI_SAS_DIX_PROT_MASK) + #define CLEAR_ITCT_TIMEOUT 20 struct hisi_hba; diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index 0e4cc16e542d6..9d6e21be35841 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -3357,9 +3357,14 @@ hisi_sas_shost_alloc_pci(struct pci_dev *pdev) hisi_hba->dev = dev; hisi_hba->shost = shost; SHOST_TO_SAS_HA(shost) = &hisi_hba->sha; - hisi_hba->enable_dix_dif = enable_dix_dif; hisi_hba->user_ctl_irq = user_ctl_irq; + if (enable_dix_dif & ~HISI_SAS_PROT_MASK) + dev_err(dev, "unsupported protection mask 0x%x, using default (0x0)\n", + enable_dix_dif); + else + hisi_hba->enable_dix_dif = enable_dix_dif; + timer_setup(&hisi_hba->timer, NULL, 0); if (hisi_sas_get_fw_info(hisi_hba) < 0) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 01/19] nbd: don't handle response without a corresponding request message
by Yang Yingliang 30 Oct '21

30 Oct '21

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-next-20211018 commit b5644a3a79bf3be5f1238db1b2f241374b27b0f0 category: bugfix bugzilla: 49890 CVE: NA --------------------------- While handling a response message from server, nbd_read_stat() will try to get request by tag, and then complete the request. However, this is problematic if nbd haven't sent a corresponding request message: t1 t2 submit_bio nbd_queue_rq blk_mq_start_request recv_work nbd_read_stat blk_mq_tag_to_rq blk_mq_complete_request nbd_send_cmd Thus add a new cmd flag 'NBD_CMD_INFLIGHT', it will be set in nbd_send_cmd() and checked in nbd_read_stat(). Noted that this patch can't fix that blk_mq_tag_to_rq() might return a freed request, and this will be fixed in following patches. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Link: https://lore.kernel.org/r/20210916093350.1410403-2-yukuai3@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/nbd.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 6a72c07ce3cba..05153b84d5400 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -120,6 +120,12 @@ struct nbd_device { }; #define NBD_CMD_REQUEUED 1 +/* + * This flag will be set if nbd_queue_rq() succeed, and will be checked and + * cleared in completion. Both setting and clearing of the flag are protected + * by cmd->lock. + */ +#define NBD_CMD_INFLIGHT 2 struct nbd_cmd { struct nbd_device *nbd; @@ -369,6 +375,7 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req, if (!mutex_trylock(&cmd->lock)) return BLK_EH_RESET_TIMER; + __clear_bit(NBD_CMD_INFLIGHT, &cmd->flags); if (!refcount_inc_not_zero(&nbd->config_refs)) { cmd->status = BLK_STS_TIMEOUT; mutex_unlock(&cmd->lock); @@ -674,6 +681,12 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index) cmd = blk_mq_rq_to_pdu(req); mutex_lock(&cmd->lock); + if (!__test_and_clear_bit(NBD_CMD_INFLIGHT, &cmd->flags)) { + dev_err(disk_to_dev(nbd->disk), "Suspicious reply %d (status %u flags %lu)", + tag, cmd->status, cmd->flags); + ret = -ENOENT; + goto out; + } if (cmd->cmd_cookie != nbd_handle_to_cookie(handle)) { dev_err(disk_to_dev(nbd->disk), "Double reply on req %p, cmd_cookie %u, handle cookie %u\n", req, cmd->cmd_cookie, nbd_handle_to_cookie(handle)); @@ -768,6 +781,7 @@ static void nbd_clear_req(struct request *req, void *data, bool reserved) struct nbd_cmd *cmd = blk_mq_rq_to_pdu(req); mutex_lock(&cmd->lock); + __clear_bit(NBD_CMD_INFLIGHT, &cmd->flags); cmd->status = BLK_STS_IOERR; mutex_unlock(&cmd->lock); @@ -903,7 +917,13 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index) * returns EAGAIN can be retried on a different socket. */ ret = nbd_send_cmd(nbd, cmd, index); - if (ret == -EAGAIN) { + /* + * Access to this flag is protected by cmd->lock, thus it's safe to set + * the flag after nbd_send_cmd() succeed to send request to server. + */ + if (!ret) + __set_bit(NBD_CMD_INFLIGHT, &cmd->flags); + else if (ret == -EAGAIN) { dev_err_ratelimited(disk_to_dev(nbd->disk), "Request send failed, requeueing\n"); nbd_mark_nsock_dead(nbd, nsock, 1); -- 2.25.1

1 18

[PATCH openEuler-1.0-LTS 1/5] numa: Move the management structures for cdm nodes to ddr
by Yang Yingliang 30 Oct '21

30 Oct '21

From: Wang Wensheng <wangwensheng4(a)huawei.com> ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4D63I CVE: NA ------------------------------------------------- The cdm nodes are easiler to raise an ECC error and it may cause the kernel crash if the essential structures went wrong. So move the management structures for hbm nodes to the ddr nodes of the same partion to reduce the probability of kernel crashes. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/Kconfig | 10 ++++++++ arch/arm64/mm/numa.c | 54 +++++++++++++++++++++++++++++++++++++++- include/linux/nodemask.h | 7 ++++++ mm/sparse.c | 8 +++--- 4 files changed, 75 insertions(+), 4 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 9d49b9524e1d4..2f34aef79179e 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1470,6 +1470,16 @@ config ASCEND_SHARE_POOL help This feature allows multiple processes to share virtual memory both in kernel and user level, which is only enabled for ascend platform. + +config ASCEND_CLEAN_CDM + bool "move the management structure for HBM to DDR" + def_bool n + depends on COHERENT_DEVICE + help + The cdm nodes sometimes are easiler to raise an ECC error and it may + cause the kernel crash if the essential structures went wrong. So move + the management structures for hbm nodes to the ddr nodes of the same + partion to reduce the probability of kernel crashes. endif endmenu diff --git a/arch/arm64/mm/numa.c b/arch/arm64/mm/numa.c index a9d3ad5ee0cc3..a194bad6fdfcf 100644 --- a/arch/arm64/mm/numa.c +++ b/arch/arm64/mm/numa.c @@ -45,6 +45,57 @@ inline int arch_check_node_cdm(int nid) return node_isset(nid, cdmmask); } +#ifdef CONFIG_ASCEND_CLEAN_CDM +/** + * cdm_node_to_ddr_node - Convert the cdm node to the ddr node of the + * same partion. + * @nid: input node ID + * + * Here is a typical memory topology in usage. + * There are some DDR and HBM in each partion and DDRs present at first, then + * come all the HBMs of the first partion, then HBMs of the second partion, etc. + * + * ------------------------- + * | P0 | P1 | + * ----------- | ----------- + * |node0 DDR| | |node1 DDR| + * |---------- | ----------| + * |node2 HBM| | |node4 HBM| + * |---------- | ----------| + * |node3 HBM| | |node5 HBM| + * ----------- | ----------- + * + * Return: + * This function returns a ddr node which is of the same partion with the input + * node if the input node is a HBM node. + * The input nid is returned if it is a DDR node or if the memory topology of + * the system doesn't apply to the above model. + */ +int __init cdm_node_to_ddr_node(int nid) +{ + nodemask_t ddr_mask; + int nr_ddr, cdm_per_part, fake_nid; + int nr_cdm = nodes_weight(cdmmask); + + if (!nr_cdm || nodes_empty(numa_nodes_parsed)) + return nid; + + if (!node_isset(nid, cdmmask)) + return nid; + + nodes_xor(ddr_mask, cdmmask, numa_nodes_parsed); + nr_ddr = nodes_weight(ddr_mask); + cdm_per_part = nr_cdm / nr_ddr ? : 1; + + fake_nid = (nid - nr_ddr) / cdm_per_part; + fake_nid = !node_isset(fake_nid, cdmmask) ? fake_nid : nid; + + pr_info("nid: %d, fake_nid: %d\n", nid, fake_nid); + + return fake_nid; +} +#endif + static int __init cdm_nodes_setup(char *s) { int nid; @@ -264,11 +315,12 @@ static void __init setup_node_data(int nid, u64 start_pfn, u64 end_pfn) u64 nd_pa; void *nd; int tnid; + int fake_nid = cdm_node_to_ddr_node(nid); if (start_pfn >= end_pfn) pr_info("Initmem setup node %d [<memory-less node>]\n", nid); - nd_pa = memblock_alloc_try_nid(nd_size, SMP_CACHE_BYTES, nid); + nd_pa = memblock_alloc_try_nid(nd_size, SMP_CACHE_BYTES, fake_nid); nd = __va(nd_pa); /* report and initialize */ diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h index 41fb047bdba80..7c0571b95ce4d 100644 --- a/include/linux/nodemask.h +++ b/include/linux/nodemask.h @@ -508,6 +508,12 @@ static inline int node_random(const nodemask_t *mask) #ifdef CONFIG_COHERENT_DEVICE extern int arch_check_node_cdm(int nid); +#ifdef CONFIG_ASCEND_CLEAN_CDM +extern int cdm_node_to_ddr_node(int nid); +#else +static inline int cdm_node_to_ddr_node(int nid) { return nid; } +#endif + static inline nodemask_t system_mem_nodemask(void) { nodemask_t system_mem; @@ -551,6 +557,7 @@ static inline void node_clear_state_cdm(int node) #else static inline int arch_check_node_cdm(int nid) { return 0; } +static inline int cdm_node_to_ddr_node(int nid) { return nid; } static inline nodemask_t system_mem_nodemask(void) { diff --git a/mm/sparse.c b/mm/sparse.c index 62ae3880a9add..f19d2ca250cee 100644 --- a/mm/sparse.c +++ b/mm/sparse.c @@ -458,21 +458,23 @@ static void __init sparse_init_nid(int nid, unsigned long pnum_begin, { unsigned long pnum, usemap_longs, *usemap; struct page *map; + int fake_nid = cdm_node_to_ddr_node(nid); usemap_longs = BITS_TO_LONGS(SECTION_BLOCKFLAGS_BITS); - usemap = sparse_early_usemaps_alloc_pgdat_section(NODE_DATA(nid), + usemap = sparse_early_usemaps_alloc_pgdat_section(NODE_DATA(fake_nid), usemap_size() * map_count); if (!usemap) { pr_err("%s: node[%d] usemap allocation failed", __func__, nid); goto failed; } - sparse_buffer_init(map_count * section_map_size(), nid); + + sparse_buffer_init(map_count * section_map_size(), fake_nid); for_each_present_section_nr(pnum_begin, pnum) { if (pnum >= pnum_end) break; - map = sparse_mem_map_populate(pnum, nid, NULL); + map = sparse_mem_map_populate(pnum, fake_nid, NULL); if (!map) { pr_err("%s: node[%d] memory map backing failed. Some memory will not be available.", __func__, nid); -- 2.25.1

1 4

[PATCH openEuler-1.0-LTS 1/4] perf: hisi: Add support for HiSilicon SoC PMU driver dt probe
by Yang Yingliang 30 Oct '21

30 Oct '21

From: Fang Lijun <fanglijun3(a)huawei.com> ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4D4WR CVE: NA --------------------------- Add support for hisi PMU driver dt probe, Fix its compile error when disable CONFIG_ACPI. Signed-off-by: Fang Lijun <fanglijun3(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/perf/Kconfig | 2 +- drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c | 1 + drivers/perf/hisilicon/hisi_uncore_hha_pmu.c | 23 +++++++++++++++---- drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 20 +++++++++++++--- 4 files changed, 38 insertions(+), 8 deletions(-) diff --git a/drivers/perf/Kconfig b/drivers/perf/Kconfig index 92be6a36a128f..d4b9681418f88 100644 --- a/drivers/perf/Kconfig +++ b/drivers/perf/Kconfig @@ -72,7 +72,7 @@ config ARM_DSU_PMU config HISI_PMU bool "HiSilicon SoC PMU" - depends on ARM64 && ACPI + depends on ARM64 help Support for HiSilicon SoC uncore performance monitoring unit (PMU), such as: L3C, HHA and DDRC. diff --git a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c index 090667d487504..3f3f4ab3aacce 100644 --- a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c +++ b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c @@ -17,6 +17,7 @@ #include <linux/interrupt.h> #include <linux/irq.h> #include <linux/list.h> +#include <linux/of.h> #include <linux/platform_device.h> #include <linux/smp.h> diff --git a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c index c35bc248db7e7..4dd4d6b650aed 100644 --- a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c +++ b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c @@ -17,6 +17,7 @@ #include <linux/interrupt.h> #include <linux/irq.h> #include <linux/list.h> +#include <linux/of.h> #include <linux/platform_device.h> #include <linux/smp.h> @@ -235,20 +236,34 @@ static const struct acpi_device_id hisi_hha_pmu_acpi_match[] = { }; MODULE_DEVICE_TABLE(acpi, hisi_hha_pmu_acpi_match); -static int hisi_hha_pmu_init_data(struct platform_device *pdev, +#ifdef CONFIG_ACPI +static int hisi_hha_pmu_init_index(struct platform_device *pdev, struct hisi_pmu *hha_pmu) { - unsigned long long id; - struct resource *res; acpi_status status; + unsigned long long id; status = acpi_evaluate_integer(ACPI_HANDLE(&pdev->dev), - "_UID", NULL, &id); + "_UID", NULL, &id); if (ACPI_FAILURE(status)) return -EINVAL; hha_pmu->index_id = id; + return 0; +} +#endif + +static int hisi_hha_pmu_init_data(struct platform_device *pdev, + struct hisi_pmu *hha_pmu) +{ + struct resource *res; + +#ifdef CONFIG_ACPI + if (hisi_hha_pmu_init_index(pdev, hha_pmu)) + dev_info(&pdev->dev, "Can not init index id by acpi!\n"); +#endif + /* * Use SCCL_ID and UID to identify the HHA PMU, while * SCCL_ID is in MPIDR[aff2]. diff --git a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c index 6ce1d69c63198..4a42926800e50 100644 --- a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c +++ b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c @@ -17,6 +17,7 @@ #include <linux/interrupt.h> #include <linux/irq.h> #include <linux/list.h> +#include <linux/of.h> #include <linux/platform_device.h> #include <linux/smp.h> @@ -234,20 +235,33 @@ static const struct acpi_device_id hisi_l3c_pmu_acpi_match[] = { }; MODULE_DEVICE_TABLE(acpi, hisi_l3c_pmu_acpi_match); -static int hisi_l3c_pmu_init_data(struct platform_device *pdev, +#ifdef CONFIG_ACPI +static int hisi_l3c_pmu_init_index(struct platform_device *pdev, struct hisi_pmu *l3c_pmu) { unsigned long long id; - struct resource *res; acpi_status status; status = acpi_evaluate_integer(ACPI_HANDLE(&pdev->dev), - "_UID", NULL, &id); + "_UID", NULL, &id); if (ACPI_FAILURE(status)) return -EINVAL; l3c_pmu->index_id = id; + return 0; +} +#endif + +static int hisi_l3c_pmu_init_data(struct platform_device *pdev, + struct hisi_pmu *l3c_pmu) +{ + struct resource *res; + +#ifdef CONFIG_ACPI + if (hisi_l3c_pmu_init_index(pdev, l3c_pmu)) + dev_info(&pdev->dev, "Can not init index id by acpi!"); +#endif /* * Use the SCCL_ID and CCL_ID to identify the L3C PMU, while * SCCL_ID is in MPIDR[aff2] and CCL_ID is in MPIDR[aff1]. -- 2.25.1

1 3

2025

2024

2023

2022

2021

2020

2019

Kernel