- Kernel - mailweb.openeuler.org

[PATCH 0/4] fixes CVE-2020-27673
by Yang Yingliang 27 Oct '20

27 Oct '20

Juergen Gross (4): xen/events: add a new "late EOI" evtchn framework xen/events: switch user event channels to lateeoi model xen/events: use a common cpu hotplug hook for event channels xen/events: defer eoi in case of excessive number of events .../admin-guide/kernel-parameters.txt | 8 + drivers/xen/events/events_2l.c | 7 +- drivers/xen/events/events_base.c | 363 +++++++++++++++++- drivers/xen/events/events_fifo.c | 70 ++-- drivers/xen/events/events_internal.h | 17 +- drivers/xen/evtchn.c | 7 +- include/xen/events.h | 21 + 7 files changed, 420 insertions(+), 73 deletions(-) -- 2.25.1

1 4

openEuler 选择 5.10 作为下一个长期维护的内核版本 (公示)
by Xie XiuQi 27 Oct '20

27 Oct '20

openEuler 选择 5.10 作为下一个长期维护的内核版本 (公示) - /本文//链接 <https://gitee.com/openeuler/community/blob/master/sig/Kernel/kernel-upgrade…>/ Linux 5.10 预计是 Linux 社区今年的 LTS (long-term support) 版本。openEuler 社区经过多轮沟通，选择 5.10 作为 openEuler 内核的下一个长期维护版本（openEuler Long-term support Kernel, OLK）。openEuler 社区提供不少于4年的维护时间和不少于2年的扩展维护时间。按照规划 openEuler 21.03、21.09 以及 openEuler 22.03 LTS 都将选择该内核版本。（具体时间以openEuler社区官网公布为准）升级安排： * v5.10-rc1 版本发布后，openEuler master 分支切换成 5.10。 * 由于主线 rc 版本尚在更新，openeuler_defconfig 暂时在 src-openeuler/kernel 仓库中提供，待 5.10 正式版本发布之后，再提交到源码仓库。 * openeuler_defconfig 基于 openEuler 20.09 的 config 修改适配，后续根据需求进行调整。 * 版本号格式，切换成 5.10.0-<devel_release>.<maintainence_release>。 * 首先支持 arm64 和 x86_64 架构，risc-v 的支持需要 risc-v sig 做适配。 * 上游社区 5.10 正式发布后（预计12月下旬）， openeuler/kernel 正式建立 OLK-5.10 分支（OLK: openEuler Long-term support Kernel），作为 5.10 的长期维护分支，接受补丁。 * 上游 5.10 正式发布前，如果有补丁需要发送 5.10，可以在 kernel(a)openeuler.org <mailto:kernel@openeuler.org> 中发 RFC 补丁，提前 Review 和讨论。 * 我们也可能提前建立 OLK-5.10 分支，以提前合入部分补丁做验证，但是在上游社区 5.10 正式发布之前，该分支可能会经常做 rebase 和 force push。对 OLK-5.10 或 openEuler 21.03 kernel 的需求 * 需求可以在 https://gitee.com/openeuler/kernel/issues 中提出。 * 如对 defconfig 有诉求也请在上述链接中提 issue。 * openEuler 21.03 计划使用该内核版本，预计2021年1月份之后，将从 OLK-5.10 拉出 openEuler-21.03 维护分支，同时补丁将受限合入 openEuler 21.03。注意事项和说明 * OLK 是 openEuler Long-term support Kernel 的缩写。openEuler LTS 版本和部分创新版本的内核基于 OLK 拉出分支进行维护。 * openEuler 5.10 内核不是基于 openEuler 4.19 内核的演进，而是基于上游社区内核的重新选型，因此如果您之前有合入 openEuler 4.19 的补丁，且这些补丁没有进入上游 5.10 内核，则需要您重新适配后推送到 openEuler 5.10 内核。 * openEuler 5.10 和 openEuler 4.19 两个版本 kabi 不兼容，您在 4.19 编译的 ko 不能直接在 5.10 上安装使用，需要重新适配和编译。 * openEuler 4.19 内核仍然处于维护周期内，如果您正在使用 4.19 内核，也不必紧张，您仍然能收到 4.19 的更新和增强。问题反馈 * kernel 升级期间，如果遇到兼容性、功能等问题，可以在 https://gitee.com/openeuler/kernel/issues 提交 issue。有疑问也可以在 PR 评论中，或者提交 issue 讨论。 * 你也可以发邮件到 kernel(a)openeuler.org <mailto:kernel@openeuler.org> 报议题在 kernel sig 例会中讨论。 * 如果 kernel sig 范围内协调或解决不了的问题，你也可以在 tc 报议题讨论。相关讨论纪要 kernel-sig 切换 5.10 的会议纪要： https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/thread/6… openEuler kernel 版本号在 TC 的议题及会议纪要： * 议题及讨论记录： https://mailweb.openeuler.org/hyperkitty/list/tc@openeuler.org/thread/KOHJN… https://mailweb.openeuler.org/hyperkitty/list/tc@openeuler.org/thread/VNJQ6… * 纪要： https://mailweb.openeuler.org/hyperkitty/list/tc@openeuler.org/thread/ZLAWQ…

1 0

[PATCH] xen/events: avoid removing an event channel while handling it
by Yang Yingliang 27 Oct '20

27 Oct '20

From: Juergen Gross <jgross(a)suse.com> mainline inclusion from mainline-v5.10 commit 073d0552ead5bfc7a3a9c01de590e924f11b5dd2 category: bugfix bugzilla: NA CVE: CVE-2020-27675 -------------------------------- Today it can happen that an event channel is being removed from the system while the event handling loop is active. This can lead to a race resulting in crashes or WARN() splats when trying to access the irq_info structure related to the event channel. Fix this problem by using a rwlock taken as reader in the event handling loop and as writer when deallocating the irq_info structure. As the observed problem was a NULL dereference in evtchn_from_irq() make this function more robust against races by testing the irq_info pointer to be not NULL before dereferencing it. And finally make all accesses to evtchn_to_irq[row][col] atomic ones in order to avoid seeing partial updates of an array element in irq handling. Note that irq handling can be entered only for event channels which have been valid before, so any not populated row isn't a problem in this regard, as rows are only ever added and never removed. This is XSA-331. Cc: stable(a)vger.kernel.org Reported-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> Reported-by: Jinoh Kang <luke1337(a)theori.io> Signed-off-by: Juergen Gross <jgross(a)suse.com> Reviewed-by: Stefano Stabellini <sstabellini(a)kernel.org> Reviewed-by: Wei Liu <wl(a)xen.org> Conflicts: drivers/xen/events/events_base.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/xen/events/events_base.c | 40 ++++++++++++++++++++++++++++---- 1 file changed, 35 insertions(+), 5 deletions(-) diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c index 95e5a9300ff0..75eade7d2017 100644 --- a/drivers/xen/events/events_base.c +++ b/drivers/xen/events/events_base.c @@ -32,6 +32,7 @@ #include <linux/slab.h> #include <linux/irqnr.h> #include <linux/pci.h> +#include <linux/spinlock.h> #ifdef CONFIG_X86 #include <asm/desc.h> @@ -69,6 +70,23 @@ const struct evtchn_ops *evtchn_ops; */ static DEFINE_MUTEX(irq_mapping_update_lock); +/* + * Lock protecting event handling loop against removing event channels. + * Adding of event channels is no issue as the associated IRQ becomes active + * only after everything is setup (before request_[threaded_]irq() the handler + * can't be entered for an event, as the event channel will be unmasked only + * then). + */ +static DEFINE_RWLOCK(evtchn_rwlock); + +/* + * Lock hierarchy: + * + * irq_mapping_update_lock + * evtchn_rwlock + * IRQ-desc lock + */ + static LIST_HEAD(xen_irq_list_head); /* IRQ <-> VIRQ mapping. */ @@ -101,7 +119,7 @@ static void clear_evtchn_to_irq_row(unsigned row) unsigned col; for (col = 0; col < EVTCHN_PER_ROW; col++) - evtchn_to_irq[row][col] = -1; + WRITE_ONCE(evtchn_to_irq[row][col], -1); } static void clear_evtchn_to_irq_all(void) @@ -138,7 +156,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq) clear_evtchn_to_irq_row(row); } - evtchn_to_irq[row][col] = irq; + WRITE_ONCE(evtchn_to_irq[row][col], irq); return 0; } @@ -148,7 +166,7 @@ int get_evtchn_to_irq(unsigned evtchn) return -1; if (evtchn_to_irq[EVTCHN_ROW(evtchn)] == NULL) return -1; - return evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)]; + return READ_ONCE(evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)]); } /* Get info for IRQ */ @@ -246,10 +264,14 @@ static void xen_irq_info_cleanup(struct irq_info *info) */ unsigned int evtchn_from_irq(unsigned irq) { - if (unlikely(WARN(irq >= nr_irqs, "Invalid irq %d!\n", irq))) + const struct irq_info *info = NULL; + + if (likely(irq < nr_irqs)) + info = info_for_irq(irq); + if (!info) return 0; - return info_for_irq(irq)->evtchn; + return info->evtchn; } unsigned irq_from_evtchn(unsigned int evtchn) @@ -425,16 +447,21 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) static void xen_free_irq(unsigned irq) { struct irq_info *info = irq_get_chip_data(irq); + unsigned long flags; if (WARN_ON(!info)) return; + write_lock_irqsave(&evtchn_rwlock, flags); + list_del(&info->list); irq_set_chip_data(irq, NULL); WARN_ON(info->refcnt > 0); + write_unlock_irqrestore(&evtchn_rwlock, flags); + kfree(info); /* Legacy IRQ descriptors are managed by the arch. */ @@ -1220,6 +1247,8 @@ static void __xen_evtchn_do_upcall(void) int cpu = get_cpu(); unsigned count; + read_lock(&evtchn_rwlock); + do { vcpu_info->evtchn_upcall_pending = 0; @@ -1236,6 +1265,7 @@ static void __xen_evtchn_do_upcall(void) out: + read_unlock(&evtchn_rwlock); put_cpu(); } -- 2.25.1

1 0

[PATCH 1/7] iommu/sysfs: Rename iommu_release_device()
by Yang Yingliang 27 Oct '20

27 Oct '20

From: Joerg Roedel <jroedel(a)suse.de> mainline inclusion from mainline-v4.20-rc1 commit 6954cf9bfda153f9544c63761aabf0199710aec3 category:bugfix bugzilla:NA CVE:NA ------------------- Remove the iommu_ prefix from the function and a few other static data structures so that the iommu_release_device name can be re-used in iommu core code. Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/iommu-sysfs.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/iommu-sysfs.c b/drivers/iommu/iommu-sysfs.c index 36d1a7ce7fc4..71c2249d3260 100644 --- a/drivers/iommu/iommu-sysfs.c +++ b/drivers/iommu/iommu-sysfs.c @@ -22,25 +22,25 @@ static struct attribute *devices_attr[] = { NULL, }; -static const struct attribute_group iommu_devices_attr_group = { +static const struct attribute_group devices_attr_group = { .name = "devices", .attrs = devices_attr, }; -static const struct attribute_group *iommu_dev_groups[] = { - &iommu_devices_attr_group, +static const struct attribute_group *dev_groups[] = { + &devices_attr_group, NULL, }; -static void iommu_release_device(struct device *dev) +static void release_device(struct device *dev) { kfree(dev); } static struct class iommu_class = { .name = "iommu", - .dev_release = iommu_release_device, - .dev_groups = iommu_dev_groups, + .dev_release = release_device, + .dev_groups = dev_groups, }; static int __init iommu_dev_init(void) -- 2.25.1

1 6

[PATCH 1/8] bcache: use a separate data structure for the on-disk super block
by Yang Yingliang 26 Oct '20

26 Oct '20

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-5.6-rc1 commit a702a692cd7559053ea573f4e2c84828f0e62824 category: feature bugzilla: 43003 CVE: NA --------------------------- Split out an on-disk version struct cache_sb with the proper endianness annotations. This fixes a fair chunk of sparse warnings, but there are some left due to the way the checksum is defined. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Coly Li <colyli(a)suse.de> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Acked-by: Hanjun Guo <guohanjun(a)huawei.com> Reviewed-by: Yufen Yu <yuyufen(a)huawei.com> Signed-off-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/md/bcache/super.c | 6 ++--- include/uapi/linux/bcache.h | 51 +++++++++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 3 deletions(-) diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index 78854837f398..8f8a0a69cc0e 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -63,14 +63,14 @@ static const char *read_super(struct cache_sb *sb, struct block_device *bdev, struct page **res) { const char *err; - struct cache_sb *s; + struct cache_sb_disk *s; struct buffer_head *bh = __bread(bdev, 1, SB_SIZE); unsigned int i; if (!bh) return "IO error"; - s = (struct cache_sb *) bh->b_data; + s = (struct cache_sb_disk *)bh->b_data; sb->offset = le64_to_cpu(s->offset); sb->version = le64_to_cpu(s->version); @@ -209,7 +209,7 @@ static void write_bdev_super_endio(struct bio *bio) static void __write_super(struct cache_sb *sb, struct bio *bio) { - struct cache_sb *out = page_address(bio_first_page_all(bio)); + struct cache_sb_disk *out = page_address(bio_first_page_all(bio)); unsigned int i; bio->bi_iter.bi_sector = SB_SECTOR; diff --git a/include/uapi/linux/bcache.h b/include/uapi/linux/bcache.h index 5d4f58e059fd..1d8b3a9fc080 100644 --- a/include/uapi/linux/bcache.h +++ b/include/uapi/linux/bcache.h @@ -156,6 +156,57 @@ static inline struct bkey *bkey_idx(const struct bkey *k, unsigned int nr_keys) #define BDEV_DATA_START_DEFAULT 16 /* sectors */ +struct cache_sb_disk { + __le64 csum; + __le64 offset; /* sector where this sb was written */ + __le64 version; + + __u8 magic[16]; + + __u8 uuid[16]; + union { + __u8 set_uuid[16]; + __le64 set_magic; + }; + __u8 label[SB_LABEL_SIZE]; + + __le64 flags; + __le64 seq; + __le64 pad[8]; + + union { + struct { + /* Cache devices */ + __le64 nbuckets; /* device size */ + + __le16 block_size; /* sectors */ + __le16 bucket_size; /* sectors */ + + __le16 nr_in_set; + __le16 nr_this_dev; + }; + struct { + /* Backing devices */ + __le64 data_offset; + + /* + * block_size from the cache device section is still used by + * backing devices, so don't add anything here until we fix + * things to not need it for backing devices anymore + */ + }; + }; + + __le32 last_mount; /* time overflow in y2106 */ + + __le16 first_bucket; + union { + __le16 njournal_buckets; + __le16 keys; + }; + __le64 d[SB_JOURNAL_BUCKETS]; /* journal buckets */ +}; + struct cache_sb { __u64 csum; __u64 offset; /* sector where this sb was written */ -- 2.25.1

1 7

[PATCH 1/2] list: introduce list_for_each_continue()
by Yang Yingliang 26 Oct '20

26 Oct '20

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v5.6-rc1 commit 28ca0d6d39ab1d01c86762c82a585b7cedd2920c category: bugfix bugzilla: 35619 CVE: NA -------------------------------- As other *continue() helpers, this continues iteration from a given position. Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/list.h | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/include/linux/list.h b/include/linux/list.h index de04cc5ed536..0e540581d52c 100644 --- a/include/linux/list.h +++ b/include/linux/list.h @@ -455,6 +455,16 @@ static inline void list_splice_tail_init(struct list_head *list, #define list_for_each(pos, head) \ for (pos = (head)->next; pos != (head); pos = pos->next) +/** + * list_for_each_continue - continue iteration over a list + * @pos: the &struct list_head to use as a loop cursor. + * @head: the head for your list. + * + * Continue to iterate over a list, continuing after the current position. + */ +#define list_for_each_continue(pos, head) \ + for (pos = pos->next; pos != (head); pos = pos->next) + /** * list_for_each_prev - iterate over a list backwards * @pos: the &struct list_head to use as a loop cursor. -- 2.25.1

1 1

[PATCH 1/6] driver core: Introduce device_iommu_mapped() function
by Yang Yingliang 22 Oct '20

22 Oct '20

From: Joerg Roedel <jroedel(a)suse.de> mainline inclusion from mainline-v4.20-rc1 commit dbba197edf32209d110727a02d3a91de4c88520f category:feature bugzilla:NA CVE:NA ------------------- Some places in the kernel check the iommu_group pointer in 'struct device' in order to find out whether a device is mapped by an IOMMU. This is not good way to make this check, as the pointer will be moved to 'struct dev_iommu_data'. This way to make the check is also not very readable. Introduce an explicit function to perform this check. Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Acked-by: Robin Murphy <robin.murphy(a)arm.com> Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/device.h | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/include/linux/device.h b/include/linux/device.h index ee4ed3af30d0..cb9df20a9c97 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -1090,6 +1090,16 @@ static inline struct device *kobj_to_dev(struct kobject *kobj) return container_of(kobj, struct device, kobj); } +/** + * device_iommu_mapped - Returns true when the device DMA is translated + * by an IOMMU + * @dev: Device to perform the check on + */ +static inline bool device_iommu_mapped(struct device *dev) +{ + return (dev->iommu_group != NULL); +} + /* Get the wakeup routines, which depend on struct device */ #include <linux/pm_wakeup.h> -- 2.25.1

1 5

[PATCH 1/6] net/hinic: Fix the driver does not report an error when setting MAC fails
by Yang Yingliang 22 Oct '20

22 Oct '20

From: Chiqijun <chiqijun(a)huawei.com> driver inclusion category: bugfix bugzilla: 4472 ----------------------------------------------------------------------- When using the ip link command to configure the MAC for the VF in the PF, the status 4 will be returned when the MAC is set on the VF; when the PF driver receives the status 4 returned by the firmwre, the MAC setting failed and an error should be reported. Signed-off-by: Chiqijun <chiqijun(a)huawei.com> Reviewed-by: Wangxiaoyun <cloud.wangxiaoyun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- .../net/ethernet/huawei/hinic/hinic_main.c | 7 +++- .../net/ethernet/huawei/hinic/hinic_nic_cfg.c | 41 ++++++++++++------- 2 files changed, 31 insertions(+), 17 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c index b5d0bdadf509..cf7b6ceef060 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_main.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c @@ -1305,8 +1305,11 @@ static int hinic_set_mac_addr(struct net_device *netdev, void *addr) err = hinic_update_mac(nic_dev->hwdev, netdev->dev_addr, saddr->sa_data, 0, func_id); - if (err) - return err; + if (err) { + nicif_err(nic_dev, drv, netdev, "Failed to update mac, err: %d\n", + err); + return err == HINIC_PF_SET_VF_ALREADY ? -EPERM : err; + } memcpy(netdev->dev_addr, saddr->sa_data, ETH_ALEN); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c index a42dea0ad707..2b349e17260b 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c @@ -231,6 +231,23 @@ int hinic_get_fw_support_func(void *hwdev) #define HINIC_ADD_VLAN_IN_MAC 0x8000 #define HINIC_VLAN_ID_MASK 0x7FFF +#define PF_SET_VF_MAC(hwdev, status) \ + (HINIC_FUNC_TYPE(hwdev) == TYPE_VF && \ + (status) == HINIC_PF_SET_VF_ALREADY) + +static int hinic_check_mac_status(struct hinic_hwdev *hwdev, u8 status, + u16 vlan_id) +{ + if ((status && status != HINIC_MGMT_STATUS_EXIST) || + (vlan_id & CHECK_IPSU_15BIT && status == HINIC_MGMT_STATUS_EXIST)) { + if (PF_SET_VF_MAC(hwdev, status)) + return 0; + + return -EINVAL; + } + + return 0; +} int hinic_set_mac(void *hwdev, const u8 *mac_addr, u16 vlan_id, u16 func_id) { @@ -255,17 +272,14 @@ int hinic_set_mac(void *hwdev, const u8 *mac_addr, u16 vlan_id, u16 func_id) err = l2nic_msg_to_mgmt_sync(hwdev, HINIC_PORT_CMD_SET_MAC, &mac_info, sizeof(mac_info), &mac_info, &out_size); if (err || !out_size || - (mac_info.status && mac_info.status != HINIC_MGMT_STATUS_EXIST && - mac_info.status != HINIC_PF_SET_VF_ALREADY) || - (mac_info.vlan_id & CHECK_IPSU_15BIT && - mac_info.status == HINIC_MGMT_STATUS_EXIST)) { + hinic_check_mac_status(hwdev, mac_info.status, mac_info.vlan_id)) { nic_err(nic_hwdev->dev_hdl, "Failed to update MAC, err: %d, status: 0x%x, out size: 0x%x\n", err, mac_info.status, out_size); - return -EINVAL; + return -EIO; } - if (mac_info.status == HINIC_PF_SET_VF_ALREADY) { + if (PF_SET_VF_MAC(nic_hwdev, mac_info.status)) { nic_warn(nic_hwdev->dev_hdl, "PF has already set VF mac, Ignore set operation\n"); return HINIC_PF_SET_VF_ALREADY; } @@ -302,13 +316,13 @@ int hinic_del_mac(void *hwdev, const u8 *mac_addr, u16 vlan_id, u16 func_id) err = l2nic_msg_to_mgmt_sync(hwdev, HINIC_PORT_CMD_DEL_MAC, &mac_info, sizeof(mac_info), &mac_info, &out_size); if (err || !out_size || - (mac_info.status && mac_info.status != HINIC_PF_SET_VF_ALREADY)) { + (mac_info.status && !PF_SET_VF_MAC(nic_hwdev, mac_info.status))) { nic_err(nic_hwdev->dev_hdl, "Failed to delete MAC, err: %d, status: 0x%x, out size: 0x%x\n", err, mac_info.status, out_size); - return -EINVAL; + return -EIO; } - if (mac_info.status == HINIC_PF_SET_VF_ALREADY) { + if (PF_SET_VF_MAC(nic_hwdev, mac_info.status)) { nic_warn(nic_hwdev->dev_hdl, "PF has already set VF mac, Ignore delete operation\n"); return HINIC_PF_SET_VF_ALREADY; } @@ -343,17 +357,14 @@ int hinic_update_mac(void *hwdev, u8 *old_mac, u8 *new_mac, u16 vlan_id, &mac_info, sizeof(mac_info), &mac_info, &out_size); if (err || !out_size || - (mac_info.status && mac_info.status != HINIC_MGMT_STATUS_EXIST && - mac_info.status != HINIC_PF_SET_VF_ALREADY) || - (mac_info.vlan_id & CHECK_IPSU_15BIT && - mac_info.status == HINIC_MGMT_STATUS_EXIST)) { + hinic_check_mac_status(hwdev, mac_info.status, mac_info.vlan_id)) { nic_err(nic_hwdev->dev_hdl, "Failed to update MAC, err: %d, status: 0x%x, out size: 0x%x\n", err, mac_info.status, out_size); - return -EINVAL; + return -EIO; } - if (mac_info.status == HINIC_PF_SET_VF_ALREADY) { + if (PF_SET_VF_MAC(nic_hwdev, mac_info.status)) { nic_warn(nic_hwdev->dev_hdl, "PF has already set VF MAC. Ignore update operation\n"); return HINIC_PF_SET_VF_ALREADY; } -- 2.25.1

1 5

[PATCH 01/20] nvme-rdma: remove redundant reference between ib_device and tagset
by Yang Yingliang 22 Oct '20

22 Oct '20

From: Max Gurtovoy <maxg(a)mellanox.com> mainline inclusion from mainline-v5.2-rc1 commit 87fd125344d68adf7699ec7396aa9f905ce79a80 category: bugfix bugzilla: NA CVE: NA Link: https://gitee.com/openeuler/kernel/issues/I1WGZE ------------------------------------------------- In the past, before adding f41725bb ("nvme-rdma: Use mr pool") commit, we needed a reference on the ib_device as long as the tagset was alive, as the MRs in the request structures needed a valid ib_device. Now, we allocate/deallocate MR pool per QP and consume on demand. Also remove nvme_rdma_free_tagset function and use blk_mq_free_tag_set instead, as it unneeded anymore. This commit also fixes a memory leakage and possible segmentation fault. When configuring the system with NIC teaming (aka bonding), we use 1 network interface to create an HA connection to the target side. In case one connection breaks down, nvme-rdma driver will get notification from rdma-cm layer that underlying address was change and will start error recovery process. During this process, we'll reconnect to the target via the second interface in the bond without destroying the tagset. This will cause a leakage of the initial rdma device (ndev) and miscount in the reference count of the new created rdma device (new ndev). In the final destruction (or in another error flow), we'll get a warning dump from the ib_dealloc_pd that we still have inflight MR's related to that pd. This happens becasue of the miscount of the reference tag of the rdma device and causing access violation to it's elements (some queues are not destroyed yet). Signed-off-by: Max Gurtovoy <maxg(a)mellanox.com> Signed-off-by: Israel Rukshin <israelr(a)mellanox.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Chao Leng <lengchao(a)huawei.com> Reviewed-by: Jike Cheng <chengjike.cheng(a)huawei.com> Conflicts: drivers/nvme/host/rdma.c [lrz: adjust context] Signed-off-by: Ruozhu Li <liruozhu(a)huawei.com> Signed-off-by: Lijie <lijie34(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/nvme/host/rdma.c | 34 +++++----------------------------- 1 file changed, 5 insertions(+), 29 deletions(-) diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index 077c67816665..0bfc1875575d 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -666,15 +666,6 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl) return ret; } -static void nvme_rdma_free_tagset(struct nvme_ctrl *nctrl, - struct blk_mq_tag_set *set) -{ - struct nvme_rdma_ctrl *ctrl = to_rdma_ctrl(nctrl); - - blk_mq_free_tag_set(set); - nvme_rdma_dev_put(ctrl->device); -} - static struct blk_mq_tag_set *nvme_rdma_alloc_tagset(struct nvme_ctrl *nctrl, bool admin) { @@ -712,24 +703,9 @@ static struct blk_mq_tag_set *nvme_rdma_alloc_tagset(struct nvme_ctrl *nctrl, ret = blk_mq_alloc_tag_set(set); if (ret) - goto out; - - /* - * We need a reference on the device as long as the tag_set is alive, - * as the MRs in the request structures need a valid ib_device. - */ - ret = nvme_rdma_dev_get(ctrl->device); - if (!ret) { - ret = -EINVAL; - goto out_free_tagset; - } + return ERR_PTR(ret); return set; - -out_free_tagset: - blk_mq_free_tag_set(set); -out: - return ERR_PTR(ret); } static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl, @@ -737,7 +713,7 @@ static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl, { if (remove) { blk_cleanup_queue(ctrl->ctrl.admin_q); - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset); + blk_mq_free_tag_set(ctrl->ctrl.admin_tagset); } if (ctrl->async_event_sqe.data) { cancel_work_sync(&ctrl->ctrl.async_event_work); @@ -815,7 +791,7 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl, blk_cleanup_queue(ctrl->ctrl.admin_q); out_free_tagset: if (new) - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset); + blk_mq_free_tag_set(ctrl->ctrl.admin_tagset); out_free_async_qe: if (ctrl->async_event_sqe.data) { nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe, @@ -832,7 +808,7 @@ static void nvme_rdma_destroy_io_queues(struct nvme_rdma_ctrl *ctrl, { if (remove) { blk_cleanup_queue(ctrl->ctrl.connect_q); - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.tagset); + blk_mq_free_tag_set(ctrl->ctrl.tagset); } nvme_rdma_free_io_queues(ctrl); } @@ -873,7 +849,7 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new) blk_cleanup_queue(ctrl->ctrl.connect_q); out_free_tag_set: if (new) - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.tagset); + blk_mq_free_tag_set(ctrl->ctrl.tagset); out_free_io_queues: nvme_rdma_free_io_queues(ctrl); return ret; -- 2.25.1

1 19

【议题收集】【Meeting Notice】openEuler kernel sig meeting Time: 2020-10-16 10:00-12:00
by Xie XiuQi 20 Oct '20

20 Oct '20

openEuler kernel sig meeting 定于 2020-10-16 10:00-12:00 召开，欢迎回复邮件申报议题。 --- 会议信息 --- 会议链接：https://zoom.us/j/94156903933 会议 ID : 94156903933 --- 会议纪要归档 --- Meeting Record 20200918： https://gitee.com/openeuler/kernel/issues/I1WGN0

1 3