- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] ext4: fix underflow in ext4_max_bitmap_size()
by Yang Yingliang 23 Feb '22

23 Feb '22

From: Zhang Yi <yi.zhang(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186216, https://gitee.com/openeuler/kernel/issues/I4PW7R CVE: NA -------------------------------- The same to commit 1c2d14212b15 ("ext2: Fix underflow in ext2_max_size()") in ext2 filesystem, ext4 driver has the same issue with 64K block size and ^huge_file, fix this issue the same as ext2. This patch also revert commit 75ca6ad408f4 ("ext4: fix loff_t overflow in ext4_max_bitmap_size()") because it's no longer needed. Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Conflicts: fs/ext4/super.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/super.c | 46 +++++++++++++++++++++++++++++++--------------- 1 file changed, 31 insertions(+), 15 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 59637e70f9e32..8f9d60ec607ea 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -2958,9 +2958,10 @@ static loff_t ext4_max_size(int blkbits, int has_huge_files) */ static loff_t ext4_max_bitmap_size(int bits, int has_huge_files) { - loff_t res = EXT4_NDIR_BLOCKS; + loff_t upper_limit, res = EXT4_NDIR_BLOCKS; int meta_blocks; - loff_t upper_limit; + unsigned int ppb = 1 << (bits - 2); + /* This is calculated to be the largest file size for a dense, block * mapped file such that the file's total number of 512-byte sectors, * including data and all indirect blocks, does not exceed (2^48 - 1). @@ -2991,23 +2992,38 @@ static loff_t ext4_max_bitmap_size(int bits, int has_huge_files) } - /* indirect blocks */ - meta_blocks = 1; - /* double indirect blocks */ - meta_blocks += 1 + (1LL << (bits-2)); - /* tripple indirect blocks */ - meta_blocks += 1 + (1LL << (bits-2)) + (1LL << (2*(bits-2))); - - upper_limit -= meta_blocks; - upper_limit <<= bits; - + /* Compute how many blocks we can address by block tree */ res += 1LL << (bits-2); res += 1LL << (2*(bits-2)); res += 1LL << (3*(bits-2)); + /* Compute how many metadata blocks are needed */ + meta_blocks = 1; + meta_blocks += 1 + ppb; + meta_blocks += 1 + ppb + ppb * ppb; + /* Does block tree limit file size? */ + if (res + meta_blocks <= upper_limit) + goto check_lfs; + + res = upper_limit; + /* How many metadata blocks are needed for addressing upper_limit? */ + upper_limit -= EXT4_NDIR_BLOCKS; + /* indirect blocks */ + meta_blocks = 1; + upper_limit -= ppb; + /* double indirect blocks */ + if (upper_limit < ppb * ppb) { + meta_blocks += 1 + DIV_ROUND_UP(upper_limit, ppb); + res -= meta_blocks; + goto check_lfs; + } + meta_blocks += 1 + ppb; + upper_limit -= ppb * ppb; + /* tripple indirect blocks for the rest */ + meta_blocks += 1 + DIV_ROUND_UP(upper_limit, ppb) + + DIV_ROUND_UP(upper_limit, ppb*ppb); + res -= meta_blocks; +check_lfs: res <<= bits; - if (res > upper_limit) - res = upper_limit; - if (res > MAX_LFS_FILESIZE) res = MAX_LFS_FILESIZE; -- 2.25.1

1 0

[PATCH OLK-5.10 v4 0/7] Backport zhaoxin enhancement and bugfix
by Zheng Zengkai 23 Feb '22

23 Feb '22

v3->v4: Refector 0001 patch. v2->v3: Fix compile warning "ahci_error_intr ISO C90 forbids mixed declarations and code" Backport zhaoxin enhancement and bugfix patches. LeoLiu-oc (7): rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs XHCI:Fix some device identify fail when enable xHCI runtime suspend EHCI:Clear wakeup signal locked in S0 state when device plug in Fix some bugs like plugin support and sata link stability when user enable ahci RTD3 Add support for disabling PhyRdy Change Interrupt based on actual LPM capability Add support for PxSCT.LPM set based on actual LPM capability x86/tsc: Make cur->adjusted values in package#1 to be the same arch/x86/kernel/tsc_sync.c | 5 +++++ drivers/ata/ahci.c | 24 ++++++++++++++++++++++++ drivers/ata/libahci.c | 15 +++++++++++++++ drivers/ata/libata-eh.c | 7 +++++++ drivers/ata/libata-sata.c | 20 ++++++++++++++++++-- drivers/pci/pci-driver.c | 6 +++++- drivers/rtc/rtc-mc146818-lib.c | 28 +++++++++++++++++++++++++--- drivers/usb/host/ehci-hcd.c | 21 +++++++++++++++++++++ drivers/usb/host/ehci-pci.c | 4 ++++ drivers/usb/host/ehci.h | 1 + drivers/usb/host/xhci-pci.c | 2 ++ include/linux/libata.h | 4 ++++ 12 files changed, 131 insertions(+), 6 deletions(-) -- 2.20.1

2 9

[PATCH openEuler-5.10 01/90] ACPICA: Interpreter: fix memory leak by using existing buffer
by Zheng Zengkai 23 Feb '22

23 Feb '22

From: Erik Kaneda <erik.kaneda(a)intel.com> mainline inclusion from mainline-v5.11-rc1 commit 32cf1a12cad43358e47dac8014379c2f33dfbed4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4T7OX CVE: NA -------------------------------- ACPICA commit 52d1da5dcbd79a722b70f02a1a83f04088f51ff6 There was a memory leak that ocurred when a _CID object is defined as a package containing string objects. When _CID is checked for any possible repairs, it calls a helper function to repair _HID (because _CID basically contains multiple _HID entries). The _HID repair function assumes that string objects are standalone objects that are not contained inside of any packages. The _HID repair function replaces the string object with a brand new object and attempts to delete the old object by decrementing the reference count of the old object. Strings inside of packages have a reference count of 2 so the _HID repair function leaves this object in a dangling state and causes a memory leak. Instead of allocating a brand new object and removing the old object, use the existing object when repairing the _HID object. Link: https://github.com/acpica/acpica/commit/52d1da5d Signed-off-by: Erik Kaneda <erik.kaneda(a)intel.com> Signed-off-by: Bob Moore <robert.moore(a)intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Conflicts: drivers/acpi/acpica/nsrepair2.c [wangxiongfeng: fix conflicts caused by context mismatch] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/acpi/acpica/nsrepair2.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/drivers/acpi/acpica/nsrepair2.c b/drivers/acpi/acpica/nsrepair2.c index 125143c41bb8..fb4f8f6209bd 100644 --- a/drivers/acpi/acpica/nsrepair2.c +++ b/drivers/acpi/acpica/nsrepair2.c @@ -491,9 +491,8 @@ acpi_ns_repair_HID(struct acpi_evaluate_info *info, union acpi_operand_object **return_object_ptr) { union acpi_operand_object *return_object = *return_object_ptr; - union acpi_operand_object *new_string; - char *source; char *dest; + char *source; ACPI_FUNCTION_NAME(ns_repair_HID); @@ -514,13 +513,6 @@ acpi_ns_repair_HID(struct acpi_evaluate_info *info, return (AE_OK); } - /* It is simplest to always create a new string object */ - - new_string = acpi_ut_create_string_object(return_object->string.length); - if (!new_string) { - return (AE_NO_MEMORY); - } - /* * Remove a leading asterisk if present. For some unknown reason, there * are many machines in the field that contains IDs like this. @@ -530,7 +522,7 @@ acpi_ns_repair_HID(struct acpi_evaluate_info *info, source = return_object->string.pointer; if (*source == '*') { source++; - new_string->string.length--; + return_object->string.length--; ACPI_DEBUG_PRINT((ACPI_DB_REPAIR, "%s: Removed invalid leading asterisk\n", @@ -545,12 +537,11 @@ acpi_ns_repair_HID(struct acpi_evaluate_info *info, * "NNNN####" where N is an uppercase letter or decimal digit, and * # is a hex digit. */ - for (dest = new_string->string.pointer; *source; dest++, source++) { + for (dest = return_object->string.pointer; *source; dest++, source++) { *dest = (char)toupper((int)*source); } + return_object->string.pointer[return_object->string.length] = 0; - acpi_ut_remove_reference(return_object); - *return_object_ptr = new_string; return (AE_OK); } -- 2.20.1

2 91

Re: [PATCH OLK-5.10 v3 3/7] EHCI: Clear wakeup signal locked in S0 state when device plug in
by Zheng Zengkai 23 Feb '22

23 Feb '22

Loop Leo 在 2022/2/22 17:49, Jackie Liu 写道: > > > 在 2022/2/22 下午4:16, Zheng Zengkai 写道: >> From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> >> zhaoxin inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN >> CVE: NA >> >> ---------------------------------------------------------------- >> >> If we plug in a LS/FS device on USB2 port of EHCI, it will latch a wakeup >> signal in EHCI internal. This is a bug of EHCI for Some project of >> ZhaoXin. If enable EHCI runtime suspend and no device attach. >> PM core will let EHCI go to D3 to save power. However, once EHCI go to D3, >> it will release wakeup signal that latched on device connect to port >> during S0. Which will generate a SCI interrupt and bring EHCI to D0. >> But without device connect, EHCI will go to D3 again. >> So, there is suspend-resume loop and generate SCI interrupt Continuously. >> >> In order to fix this issues, we need to clear the wakeup signal latched >> in EHCI when EHCI suspend function is called. >> >> Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> >> --- >> drivers/pci/pci-driver.c | 6 +++++- >> drivers/usb/host/ehci-hcd.c | 21 +++++++++++++++++++++ >> drivers/usb/host/ehci-pci.c | 4 ++++ >> drivers/usb/host/ehci.h | 1 + >> 4 files changed, 31 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c >> index 8b587fc97f7b..c33d7e0a60b5 100644 >> --- a/drivers/pci/pci-driver.c >> +++ b/drivers/pci/pci-driver.c >> @@ -518,7 +518,11 @@ static int pci_restore_standard_config(struct pci_dev *pci_dev) >> } >> >> pci_restore_state(pci_dev); >> - pci_pme_restore(pci_dev); >> + if (!((pci_dev->vendor == PCI_VENDOR_ID_ZHAOXIN) && >> + (pci_dev->device == 0x3104) && >> + ((pci_dev->revision & 0xf0) == 0x90)) || > >> + !(pci_dev->class == PCI_CLASS_SERIAL_USB_EHCI)) > 上面这句话是不是改变了通用逻辑？增加了一个 pci_dev->class != > PCI_CLASS_SERIAL_USB_EHCI 才进行 restore？ > >> + pci_pme_restore(pci_dev); >> return 0; >> } >> >> diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c >> index 8aff19ff8e8f..586e2735d6e0 100644 >> --- a/drivers/usb/host/ehci-hcd.c >> +++ b/drivers/usb/host/ehci-hcd.c >> @@ -1142,6 +1142,27 @@ int ehci_suspend(struct usb_hcd *hcd, bool do_wakeup) >> return -EBUSY; >> } >> >> + /*clear wakeup signal locked in S0 state when device plug in*/ >> + if (ehci->zx_wakeup_clear == 1) { >> + u32 __iomem *reg = &ehci->regs->port_status[4]; >> + u32 t1 = ehci_readl(ehci, reg); >> + >> + t1 &= (u32)~0xf0000; >> + t1 |= PORT_TEST_FORCE; >> + ehci_writel(ehci, t1, reg); >> + t1 = ehci_readl(ehci, reg); >> + usleep_range(1000, 2000); >> + t1 &= (u32)~0xf0000; >> + ehci_writel(ehci, t1, reg); >> + usleep_range(1000, 2000); >> + t1 = ehci_readl(ehci, reg); >> + ehci_writel(ehci, t1 | PORT_CSC, reg); >> + udelay(500); >> + t1 = ehci_readl(ehci, &ehci->regs->status); >> + ehci_writel(ehci, t1 & STS_PCD, &ehci->regs->status); >> + ehci_readl(ehci, &ehci->regs->status); >> + } >> + >> return 0; >> } >> EXPORT_SYMBOL_GPL(ehci_suspend); >> diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c >> index e87cf3a00fa4..a5e27deda83a 100644 >> --- a/drivers/usb/host/ehci-pci.c >> +++ b/drivers/usb/host/ehci-pci.c >> @@ -222,6 +222,10 @@ static int ehci_pci_setup(struct usb_hcd *hcd) >> ehci->has_synopsys_hc_bug = 1; >> } >> break; >> + case PCI_VENDOR_ID_ZHAOXIN: >> + if (pdev->device == 0x3104 && (pdev->revision & 0xf0) == 0x90) >> + ehci->zx_wakeup_clear = 1; >> + break; >> } >> >> /* optional debug port, normally in the first BAR */ >> diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h >> index 59fd523c55f3..8da080a54668 100644 >> --- a/drivers/usb/host/ehci.h >> +++ b/drivers/usb/host/ehci.h >> @@ -219,6 +219,7 @@ struct ehci_hcd { /* one per controller */ >> unsigned need_oc_pp_cycle:1; /* MPC834X port power */ >> unsigned imx28_write_fix:1; /* For Freescale i.MX28 */ >> unsigned is_aspeed:1; >> + unsigned zx_wakeup_clear:1; >> >> /* required for usb32 quirk */ >> #define OHCI_CTRL_HCFS (3 << 6) >> >> >> Content-type: Text/plain >> >> No virus found >> Checked by Hillstone Network AntiVirus

2 1

Re: [PATCH OLK-5.10 v3 1/7] rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs
by Zheng Zengkai 23 Feb '22

23 Feb '22

Hi Jackie, Leo 在 2022/2/22 17:46, Jackie Liu 写道: > > > 在 2022/2/22 下午4:16, Zheng Zengkai 写道: >> From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> >> zhaoxin inclusion >> category: bugfix >> bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN >> CVE: NA >> >> ---------------------------------------------------------------- >> >> When the RTC divider is changed from reset to an operating time base, >> the first update cycle should be 500ms later. But on some Zhaoxin SOCs, >> this first update cycle is one second later. >> So set RTC time on these Zhaoxin SOCs will causing 500ms delay. >> Skip setup RTC divider on these SOCs in mc146818_set_time to fix it. >> >> Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> >> --- >> drivers/rtc/rtc-mc146818-lib.c | 16 ++++++++++++++++ >> 1 file changed, 16 insertions(+) >> >> diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c >> index 2ecd8752b088..96d9d0219394 100644 >> --- a/drivers/rtc/rtc-mc146818-lib.c >> +++ b/drivers/rtc/rtc-mc146818-lib.c >> @@ -171,8 +171,17 @@ int mc146818_set_time(struct rtc_time *time) >> >> save_control = CMOS_READ(RTC_CONTROL); >> CMOS_WRITE((save_control|RTC_SET), RTC_CONTROL); >> +#ifdef CONFIG_X86 >> + if (!((boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR || >> + boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN) && >> + (boot_cpu_data.x86 <= 7 && boot_cpu_data.x86_model <= 59))) { >> + save_freq_select = CMOS_READ(RTC_FREQ_SELECT); >> + CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); >> + } >> +#else >> save_freq_select = CMOS_READ(RTC_FREQ_SELECT); >> CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); >> +#endif >> >> #ifdef CONFIG_MACH_DECSTATION >> CMOS_WRITE(real_yrs, RTC_DEC_YEAR); >> @@ -190,7 +199,14 @@ int mc146818_set_time(struct rtc_time *time) >> #endif >> >> CMOS_WRITE(save_control, RTC_CONTROL); >> +#ifdef CONFIG_X86 >> + if (!((boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR || >> + boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN) && >> + (boot_cpu_data.x86 <= 7 && boot_cpu_data.x86_model <= 59))) > 在这里直接写个 #endif 后面的 else 和 endif 就不需要了 > >> + CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); >> +#else >> CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); >> +#endif 这里依据上次兆芯同事解释的代码逻辑： X86架构情况下，兆芯的相应平台不执行CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT), 即 commit message中Skip setup RTC divider on these SOCs in mc146818_set_time to fix it; 而其他架构(#else 分支)，仍然需要执行CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); @Jackie @ Leo，两位看下理解是否OK？ >> >> spin_unlock_irqrestore(&rtc_lock, flags); >> >> >> >> Content-type: Text/plain >> >> No virus found >> Checked by Hillstone Network AntiVirus

2 1

Re: [PATCH OLK-5.10 v3 3/7] EHCI: Clear wakeup signal locked in S0 state when device plug in
by Zheng Zengkai 23 Feb '22

23 Feb '22

Hi Jackie, 在 2022/2/22 17:49, Jackie Liu 写道: > > > 在 2022/2/22 下午4:16, Zheng Zengkai 写道: >> From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> >> zhaoxin inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN >> CVE: NA >> >> ---------------------------------------------------------------- >> >> If we plug in a LS/FS device on USB2 port of EHCI, it will latch a wakeup >> signal in EHCI internal. This is a bug of EHCI for Some project of >> ZhaoXin. If enable EHCI runtime suspend and no device attach. >> PM core will let EHCI go to D3 to save power. However, once EHCI go to D3, >> it will release wakeup signal that latched on device connect to port >> during S0. Which will generate a SCI interrupt and bring EHCI to D0. >> But without device connect, EHCI will go to D3 again. >> So, there is suspend-resume loop and generate SCI interrupt Continuously. >> >> In order to fix this issues, we need to clear the wakeup signal latched >> in EHCI when EHCI suspend function is called. >> >> Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> >> --- >> drivers/pci/pci-driver.c | 6 +++++- >> drivers/usb/host/ehci-hcd.c | 21 +++++++++++++++++++++ >> drivers/usb/host/ehci-pci.c | 4 ++++ >> drivers/usb/host/ehci.h | 1 + >> 4 files changed, 31 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c >> index 8b587fc97f7b..c33d7e0a60b5 100644 >> --- a/drivers/pci/pci-driver.c >> +++ b/drivers/pci/pci-driver.c >> @@ -518,7 +518,11 @@ static int pci_restore_standard_config(struct pci_dev *pci_dev) >> } >> >> pci_restore_state(pci_dev); >> - pci_pme_restore(pci_dev); >> + if (!((pci_dev->vendor == PCI_VENDOR_ID_ZHAOXIN) && >> + (pci_dev->device == 0x3104) && >> + ((pci_dev->revision & 0xf0) == 0x90)) || > >> + !(pci_dev->class == PCI_CLASS_SERIAL_USB_EHCI)) > 上面这句话是不是改变了通用逻辑？增加了一个 pci_dev->class != > PCI_CLASS_SERIAL_USB_EHCI 才进行 restore？ > >> + pci_pme_restore(pci_dev); 逻辑上应该是和！((pci_dev->vendor == PCI_VENDOR_ID_ZHAOXIN) && (pci_dev->device == 0x3104) && ((pci_dev->revision & 0xf0) == 0x90) && (pci_dev->class == PCI_CLASS_SERIAL_USB_EHCI)）等同的, 即只有zhaoxin的0x3104 devid的PCI_CLASS_SERIAL_USB_EHCI设备不做pci_pme_restore(pci_dev)操作 >> return 0; >> } >> >> diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c >> index 8aff19ff8e8f..586e2735d6e0 100644 >> --- a/drivers/usb/host/ehci-hcd.c >> +++ b/drivers/usb/host/ehci-hcd.c >> @@ -1142,6 +1142,27 @@ int ehci_suspend(struct usb_hcd *hcd, bool do_wakeup) >> return -EBUSY; >> } >> >> + /*clear wakeup signal locked in S0 state when device plug in*/ >> + if (ehci->zx_wakeup_clear == 1) { >> + u32 __iomem *reg = &ehci->regs->port_status[4]; >> + u32 t1 = ehci_readl(ehci, reg); >> + >> + t1 &= (u32)~0xf0000; >> + t1 |= PORT_TEST_FORCE; >> + ehci_writel(ehci, t1, reg); >> + t1 = ehci_readl(ehci, reg); >> + usleep_range(1000, 2000); >> + t1 &= (u32)~0xf0000; >> + ehci_writel(ehci, t1, reg); >> + usleep_range(1000, 2000); >> + t1 = ehci_readl(ehci, reg); >> + ehci_writel(ehci, t1 | PORT_CSC, reg); >> + udelay(500); >> + t1 = ehci_readl(ehci, &ehci->regs->status); >> + ehci_writel(ehci, t1 & STS_PCD, &ehci->regs->status); >> + ehci_readl(ehci, &ehci->regs->status); >> + } >> + >> return 0; >> } >> EXPORT_SYMBOL_GPL(ehci_suspend); >> diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c >> index e87cf3a00fa4..a5e27deda83a 100644 >> --- a/drivers/usb/host/ehci-pci.c >> +++ b/drivers/usb/host/ehci-pci.c >> @@ -222,6 +222,10 @@ static int ehci_pci_setup(struct usb_hcd *hcd) >> ehci->has_synopsys_hc_bug = 1; >> } >> break; >> + case PCI_VENDOR_ID_ZHAOXIN: >> + if (pdev->device == 0x3104 && (pdev->revision & 0xf0) == 0x90) >> + ehci->zx_wakeup_clear = 1; >> + break; >> } >> >> /* optional debug port, normally in the first BAR */ >> diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h >> index 59fd523c55f3..8da080a54668 100644 >> --- a/drivers/usb/host/ehci.h >> +++ b/drivers/usb/host/ehci.h >> @@ -219,6 +219,7 @@ struct ehci_hcd { /* one per controller */ >> unsigned need_oc_pp_cycle:1; /* MPC834X port power */ >> unsigned imx28_write_fix:1; /* For Freescale i.MX28 */ >> unsigned is_aspeed:1; >> + unsigned zx_wakeup_clear:1; >> >> /* required for usb32 quirk */ >> #define OHCI_CTRL_HCFS (3 << 6) >> >> >> Content-type: Text/plain >> >> No virus found >> Checked by Hillstone Network AntiVirus

1 0

[PATCH OLK-5.10,v4,0/3] Add support for kunpeng920 Ultrasoc System Memory Buffer driver
by Qi Liu 23 Feb '22

23 Feb '22

Add support for kunpeng920 Ultrasoc System Memory Buffer driver v3->4: Resend this patchset as openeuler maillist hasn't received patch[1/3] in v3 series. Qi Liu (3): coresight: etm4x: Modify core-commit to avoid HiSilicon ETM overflow drivers/coresight: Add Ultrasoc System Memory Buffer driver arm64: openeuler_defconfig: Enable config for ultrasoc driver arch/arm64/configs/openeuler_defconfig | 13 +- drivers/hwtracing/coresight/Kconfig | 20 + drivers/hwtracing/coresight/Makefile | 1 + .../coresight/coresight-etm4x-core.c | 98 +++ drivers/hwtracing/coresight/coresight-etm4x.h | 8 + drivers/hwtracing/coresight/ultrasoc-smb.c | 602 ++++++++++++++++++ drivers/hwtracing/coresight/ultrasoc-smb.h | 100 +++ 7 files changed, 841 insertions(+), 1 deletion(-) create mode 100644 drivers/hwtracing/coresight/ultrasoc-smb.c create mode 100644 drivers/hwtracing/coresight/ultrasoc-smb.h -- 2.33.0

1 3

[PATCH OLK-5.10 v2] uce: copy_from_user scenario support kernel recovery
by Tong Tiangen 22 Feb '22

22 Feb '22

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4PM10 CVE: NA -------------------------------- During kernel copy_from_user processing, the kernel triggers a RAS exception when reading pages. In this solution, we identify this scenario in the kernel do_sea processing process, send SIGBUS signals to the process that triggers copy_from_user and isolate memory pages, preventing kernel panic. At the same time, we use both cmdline(uce_kernel_recovery) and proc (/proc/sys/kernel/uce_kernel_recovery) to control this feature on/off. Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- v1->v2: 1. update commit msg. 2. change copy_from_user return value. 3. change copy_from_user proc control bit. arch/arm64/Kconfig | 9 ++ arch/arm64/include/asm/exception.h | 12 +++ arch/arm64/lib/copy_from_user.S | 5 + arch/arm64/mm/fault.c | 154 +++++++++++++++++++++++++++++ include/linux/kernel.h | 4 + kernel/sysctl.c | 11 +++ 6 files changed, 195 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index c0f6a275f798..5858cb9a3dac 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -2155,6 +2155,15 @@ config ARCH_HIBERNATION_HEADER config ARCH_SUSPEND_POSSIBLE def_bool y +config UCE_KERNEL_RECOVERY + bool "uce kernel recovery from special scenario" + def_bool n + help + With ARM v8.2 RAS Extension, SEA are usually triggered when memory errors + are consumed. In some cases, if the error address is in a user page there + is a chance to recover. Such as error occurs in COW and pagecache reading + scenario, we can isolate this page and killing process instead of die. + endmenu menu "CPU Power Management" diff --git a/arch/arm64/include/asm/exception.h b/arch/arm64/include/asm/exception.h index 0756191f44f6..bad92fe763fb 100644 --- a/arch/arm64/include/asm/exception.h +++ b/arch/arm64/include/asm/exception.h @@ -53,4 +53,16 @@ void do_cp15instr(unsigned int esr, struct pt_regs *regs); void do_el0_svc(struct pt_regs *regs); void do_el0_svc_compat(struct pt_regs *regs); void do_ptrauth_fault(struct pt_regs *regs, unsigned int esr); + +#ifdef CONFIG_UCE_KERNEL_RECOVERY +struct uce_kernel_recovery_info { + int (*fn)(void); + const char *name; + unsigned long addr; + unsigned long size; +}; + +extern int copy_from_user_sea_fallback(void); +#endif + #endif /* __ASM_EXCEPTION_H */ diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S index 2cf999e41d30..b03ea0faa118 100644 --- a/arch/arm64/lib/copy_from_user.S +++ b/arch/arm64/lib/copy_from_user.S @@ -60,6 +60,11 @@ SYM_FUNC_START(__arch_copy_from_user) #include "copy_template.S" mov x0, #0 // Nothing to copy ret + + .global copy_from_user_sea_fallback +copy_from_user_sea_fallback: + sub x0, end, dst // bytes not copied + ret SYM_FUNC_END(__arch_copy_from_user) EXPORT_SYMBOL(__arch_copy_from_user) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 3fc5aceb72eb..7f76e277daa3 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -634,6 +634,127 @@ static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs) return 1; /* "fault" */ } +#ifdef CONFIG_UCE_KERNEL_RECOVERY +int kernel_access_sea_recovery; + +#define UCE_KER_REC_NUM ARRAY_SIZE(reco_info) +static struct uce_kernel_recovery_info reco_info[] = { + {NULL, NULL, 0, 0}, + {NULL, NULL, 0, 0}, + {copy_from_user_sea_fallback, "__arch_copy_from_user", (unsigned long)__arch_copy_from_user, 0}, +}; + +static int __init kernel_access_sea_recovery_init(void) +{ + unsigned long addr, size, offset; + unsigned int i; + + for (i = 0; i < UCE_KER_REC_NUM; i++) { + addr = reco_info[i].addr; + if (!kallsyms_lookup_size_offset(addr, &size, &offset)) { + pr_info("UCE: symbol %s lookup addr fail.\n", + reco_info[i].name); + size = 0; + } + + reco_info[i].size = size; + } + + return 1; +} +fs_initcall(kernel_access_sea_recovery_init); + +static int __init enable_kernel_access_sea_recovery(char *str) +{ + int max = (1 << UCE_KER_REC_NUM) - 1; + int val; + + if (kstrtoint(str, 0, &val)) + return -EINVAL; + + if (val < 0 || val > max) { + pr_info("UCE: invalid uce_kernel_recovery value %d", val); + return -EINVAL; + } + + kernel_access_sea_recovery = val; + + return 1; +} +__setup("uce_kernel_recovery=", enable_kernel_access_sea_recovery); + +/* + * what is kernel recovery? + * If the process's private data is accessed in the kernel mode to trigger + * special sea fault, it can controlled by killing the process and isolating + * the failure pages instead of die. + */ +static int is_in_kernel_recovery(unsigned int esr, struct pt_regs *regs) +{ + /* + * target insn: ldp-pre, ldp-post, ldp-offset, + * ldr-64bit-pre/pose, ldr-32bit-pre/post, ldrb-pre/post, ldrh-pre/post + */ + u32 target_insn[] = {0xa8c, 0xa9c, 0xa94, 0xf84, 0x784, 0x384, 0xb84}; + void *pc = (void *)instruction_pointer(regs); + struct uce_kernel_recovery_info *info; + bool insn_match = false; + u32 insn; + int i; + + pr_emerg("UCE: %s-%d, kernel recovery: 0x%x, esr: 0x%08x -- %s, %pS\n", + current->comm, current->pid, kernel_access_sea_recovery, esr, + esr_get_class_string(esr), pc); + + if (aarch64_insn_read((void *)pc, &insn)) { + pr_emerg("UCE: insn read fail.\n"); + return -EFAULT; + } + + /* + * We process special ESR: + * EC : 0b100101 Data Abort taken without a change in Exception level. + * DFSC : 0b010000 Synchronous External abort, not on translation table + * walk or hardware update of translation table. + * eg: 0x96000610 + */ + if (ESR_ELx_EC(esr) != ESR_ELx_EC_DABT_CUR || + (esr & ESR_ELx_FSC) != ESR_ELx_FSC_EXTABT) { + pr_emerg("UCE: esr not match.\n"); + return -EINVAL; + } + + insn = (insn >> 20) & 0xffc; + for (i = 0; i < ARRAY_SIZE(target_insn); i++) { + if (insn == target_insn[i]) { + insn_match = true; + break; + } + } + + if (!insn_match) { + pr_emerg("UCE: insn 0x%x is not match.\n", insn); + return -EINVAL; + } + + for (i = 0; i < UCE_KER_REC_NUM; i++) { + if (!((kernel_access_sea_recovery >> i) & 0x1)) + continue; + + info = &reco_info[i]; + if (info->fn && regs->pc >= info->addr && + regs->pc < (info->addr + info->size)) { + pr_emerg("UCE: total match %s success.\n", info->name); + return i; + } + } + + pr_emerg("UCE: symbol is not match or switch if off, kernel recovery %d.\n", + kernel_access_sea_recovery); + return -EINVAL; +} +#endif + static int do_sea(unsigned long addr, unsigned int esr, struct pt_regs *regs) { const struct fault_info *inf; @@ -649,6 +770,39 @@ static int do_sea(unsigned long addr, unsigned int esr, struct pt_regs *regs) return 0; } +#ifdef CONFIG_UCE_KERNEL_RECOVERY + if (!user_mode(regs)) { + int idx; + + if (!current->mm || !kernel_access_sea_recovery) { + pr_emerg("UCE: kernel recovery %d, %s-%d is %s-thread.\n", + kernel_access_sea_recovery, + current->comm, current->pid, + (current->mm) ? "user" : "kernel"); + die("Uncorrected hardware memory error in kernel-access\n", + regs, esr); + } + + idx = is_in_kernel_recovery(esr, regs); + if (idx >= 0 && idx < UCE_KER_REC_NUM) { + current->thread.fault_address = 0; + current->thread.fault_code = esr; + regs->pc = (unsigned long)reco_info[idx].fn; + + if (esr & ESR_ELx_FnV) + siaddr = NULL; + else + siaddr = (void __user *)addr; + + arm64_force_sig_fault(inf->sig, inf->code, siaddr, + "Uncorrected hardware memory use with kernel recovery in kernel-access\n"); + } else { + die("Uncorrected hardware memory error (not match idx or sence switch is off) in kernel-access\n", + regs, esr); + } + } +#endif + if (esr & ESR_ELx_FnV) siaddr = NULL; else diff --git a/include/linux/kernel.h b/include/linux/kernel.h index 78a0907f0b04..b634fb1cce38 100644 --- a/include/linux/kernel.h +++ b/include/linux/kernel.h @@ -558,6 +558,10 @@ extern int sysctl_panic_on_stackoverflow; extern bool crash_kexec_post_notifiers; +#ifdef CONFIG_UCE_KERNEL_RECOVERY +extern int kernel_access_sea_recovery; +#endif + /* * panic_cpu is used for synchronizing panic() and crash_kexec() execution. It * holds a CPU number which is executing panic() currently. A value of diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 89ef0c1a1642..e38fff657683 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2711,6 +2711,17 @@ static struct ctl_table kern_table[] = { .extra1 = &one_hundred, .extra2 = &one_thousand, }, +#endif +#if defined(CONFIG_UCE_KERNEL_RECOVERY) + { + .procname = "uce_kernel_recovery", + .data = &kernel_access_sea_recovery, + .maxlen = sizeof(kernel_access_sea_recovery), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = &four, + .extra2 = &four, + }, #endif { } }; -- 2.18.0.huawei.25

2 1

[PATCH openEuler-5.10 12/90] x86/cpu/intel: Add a nosgx kernel parameter
by Zheng Zengkai 22 Feb '22

22 Feb '22

From: Jarkko Sakkinen <jarkko(a)kernel.org> mainline inclusion from mainline-v5.11-rc1 commit 38853a303982e3be3eccb1a1132399a5c5e2d806 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4SIGI CVE: NA -------------------------------- Add a kernel parameter to disable SGX kernel support and document it. [ bp: Massage. ] Intel-SIG: commit 38853a303982 x86/cpu/intel: Add a nosgx kernel parameter Backport for SGX Foundations support Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Borislav Petkov <bp(a)suse.de> Reviewed-by: Sean Christopherson <sean.j.christopherson(a)intel.com> Acked-by: Jethro Beekman <jethro(a)fortanix.com> Tested-by: Sean Christopherson <sean.j.christopherson(a)intel.com> Link: https://lkml.kernel.org/r/20201112220135.165028-9-jarkko@kernel.org Signed-off-by: Fan Du <fan.du(a)intel.com> #openEuler_contributor Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Bamvor Zhang <bamvor.zhang(a)suse.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- Documentation/admin-guide/kernel-parameters.txt | 2 ++ arch/x86/kernel/cpu/feat_ctl.c | 9 +++++++++ 2 files changed, 11 insertions(+) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index b73108a82f18..a4e5614bee12 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -3498,6 +3498,8 @@ nosep [BUGS=X86-32] Disables x86 SYSENTER/SYSEXIT support. + nosgx [X86-64,SGX] Disables Intel SGX kernel support. + nosmp [SMP] Tells an SMP kernel to act as a UP kernel, and disable the IO APIC. legacy for "maxcpus=0". diff --git a/arch/x86/kernel/cpu/feat_ctl.c b/arch/x86/kernel/cpu/feat_ctl.c index d38e97325018..3b1b01f2b248 100644 --- a/arch/x86/kernel/cpu/feat_ctl.c +++ b/arch/x86/kernel/cpu/feat_ctl.c @@ -99,6 +99,15 @@ static void clear_sgx_caps(void) setup_clear_cpu_cap(X86_FEATURE_SGX_LC); } +static int __init nosgx(char *str) +{ + clear_sgx_caps(); + + return 0; +} + +early_param("nosgx", nosgx); + void init_ia32_feat_ctl(struct cpuinfo_x86 *c) { bool tboot = tboot_enabled(); -- 2.20.1

1 1

[PATCH OLK-5.10 v2 0/5] net/spnic: spnic bugfix series
by Yanling Song 22 Feb '22

22 Feb '22

Fix 5 bugs: 1. Fix array bounds error in ethtool get_link_ksettings 2. Fix ethtool loopback command failure 3. Fix xor checksum error when sending a non 4B-aligned message to firmware 4. Fix an error when netdev failed to link up 5. Reduce the timeout of the channel between driver and firmware Yanling Song (5): net/spnic: Fix array bounds error in ethtool get_link_ksettings net/spnic: Fix ethtool loopback command failure net/spnic: Fix xor checksum error when sending a non 4B-aligned message to firmware net/spnic: Fix an error when netdev failed to link up net/spnic: Reduce the timeout of the channel between driver and firmware .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c | 2 +- .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.c | 10 ++-- .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c | 2 +- .../ramaxel/spnic/spnic_ethtool_stats.c | 4 +- .../ethernet/ramaxel/spnic/spnic_mag_cfg.c | 2 +- .../ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c | 49 ++++++++++++------- 6 files changed, 41 insertions(+), 28 deletions(-) -- 2.32.0

2 6

2024

2023

2022

2021

2020

2019

Kernel