- Kernel - mailweb.openeuler.org

Re: [PATCH openEuler-22.03-LTS-SP1 0/6] Support dynamic_hugetlb on arm64 and fix some bug
by Liu Shixin 09 Jun '23

09 Jun '23

On 2023/6/9 11:14, Kefeng Wang wrote: > 跟上一版本有啥区别第一个补丁上下文有差异，其他没差别 > > > On 2023/6/9 11:59, Liu Shixin wrote: >> Support dynamic_hugetlb on arm64 and fix some bug. >> >> Liu Shixin (6): >> mm/dynamic_hugetlb: fix kabi broken when enable CONFIG_DYNAMIC_HUGETLB >> on arm64 >> mm/dynamic_hugetlb: support dynamic hugetlb on arm64 >> mm/dynamic_hugetlb: isolate hugepage without dissolve >> mm/dynamic_hugetlb: replace spin_lock with mutex_lock and fix kabi >> broken >> mm/dynamic_hugetlb: set PagePool to bad page >> mm/dynamic_hugetlb: fix type error of pfn in >> __hpool_split_gigantic_page() >> >> fs/Kconfig | 2 +- >> fs/hugetlbfs/inode.c | 2 +- >> include/linux/dynamic_hugetlb.h | 24 +++++++++++++-- >> include/linux/memcontrol.h | 6 +++- >> mm/dynamic_hugetlb.c | 54 +++++++++++++++++++++++++++------ >> mm/hugetlb.c | 7 +++++ >> 6 files changed, 80 insertions(+), 15 deletions(-) >> > . >

1 0

[openEuler/rdma-core v4] libhns: Support user to choose using UD sl or pktype to adapt MPI APP
by Chengchang Tang 09 Jun '23

09 Jun '23

From: Junxian Huang <huangjunxian6(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/rdma-core/issues/I7A5YM --------------------------------------------------------------- According to Annex17_RoCEv2 (A17.4.5.2), for RoCEv2 UD, a CQE should carry a flag that indicates if the received frame is an IPv4, IPv6 or RoCE packet. But currently, the values of the flag corresponding to these packet types haven't been defined yet in WC. In UCX, 'sl' in ibv_wc for UD is used as the packet type flag, and the packet type values have already been defined in the UCX patch of https://github.com/openucx/ucx/commit/ed28845b88633e65d64fce8ec880060aa61bd… Therefore, to adapt UCX, add a create flag to hnsdv_create_qp() to allow users to choose whether they use 'sl' in ibv_wc as service level or packet type for UD. For the latter, obtain and translate the packet type from CQE and fill it to 'sl' in ibv_wc. Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Signed-off-by: Haoyue Xu <xuhaoyue1(a)hisilicon.com> --- providers/hns/hns_roce_u.h | 11 +++++++++++ providers/hns/hns_roce_u_hw_v2.c | 32 +++++++++++++++++++++++++++++--- providers/hns/hns_roce_u_verbs.c | 16 ++++++++++++++++ providers/hns/hnsdv.h | 1 + 4 files changed, 57 insertions(+), 3 deletions(-) diff --git a/providers/hns/hns_roce_u.h b/providers/hns/hns_roce_u.h index 41e9599..e3012e1 100644 --- a/providers/hns/hns_roce_u.h +++ b/providers/hns/hns_roce_u.h @@ -195,6 +195,12 @@ enum hns_roce_tc_map_mode { HNS_ROCE_TC_MAP_MODE_DSCP, }; +enum hns_roce_pktype { + HNS_ROCE_PKTYPE_ROCE_V1, + HNS_ROCE_PKTYPE_ROCE_V2_IPV6, + HNS_ROCE_PKTYPE_ROCE_V2_IPV4, +}; + struct hns_roce_db_page { struct hns_roce_db_page *prev, *next; struct hns_roce_buf buf; @@ -406,6 +412,11 @@ struct hns_roce_qp { void *cur_wqe; unsigned int rb_sq_head; /* roll back sq head */ struct hns_roce_sge_info sge_info; + + /* Just for UD. If not enabled, 'sl' in ibv_wc + * will be filled with 'port_type' in cqe. + */ + bool enable_ud_sl; }; struct hns_roce_av { diff --git a/providers/hns/hns_roce_u_hw_v2.c b/providers/hns/hns_roce_u_hw_v2.c index 4b0ec5c..ee2fffe 100644 --- a/providers/hns/hns_roce_u_hw_v2.c +++ b/providers/hns/hns_roce_u_hw_v2.c @@ -522,9 +522,24 @@ static void handle_recv_rq_inl(struct hns_roce_v2_cqe *cqe, handle_recv_inl_data(cqe, &(cur_qp->rq_rinl_buf), wr_num, wqe_buf); } -static void parse_for_ud_qp(struct hns_roce_v2_cqe *cqe, struct ibv_wc *wc) +static const uint8_t pktype_for_ud[] = { + HNS_ROCE_PKTYPE_ROCE_V1, + HNS_ROCE_PKTYPE_ROCE_V2_IPV4, + HNS_ROCE_PKTYPE_ROCE_V2_IPV6 +}; + +static void parse_for_ud_qp(struct hns_roce_v2_cqe *cqe, struct ibv_wc *wc, + bool enable_ud_sl) { - wc->sl = hr_reg_read(cqe, CQE_SL); + uint8_t port_type; + + if (enable_ud_sl) { + wc->sl = hr_reg_read(cqe, CQE_SL); + } else { + port_type = hr_reg_read(cqe, CQE_PORT_TYPE); + wc->sl = pktype_for_ud[port_type]; + } + wc->src_qp = hr_reg_read(cqe, CQE_RMT_QPN); wc->slid = 0; wc->wc_flags |= hr_reg_read(cqe, CQE_GRH) ? IBV_WC_GRH : 0; @@ -554,7 +569,7 @@ static int parse_cqe_for_resp(struct hns_roce_v2_cqe *cqe, struct ibv_wc *wc, ++wq->tail; if (hr_qp->verbs_qp.qp.qp_type == IBV_QPT_UD) - parse_for_ud_qp(cqe, wc); + parse_for_ud_qp(cqe, wc, hr_qp->enable_ud_sl); if (hr_reg_read(cqe, CQE_CQE_INLINE)) handle_recv_cqe_inl_from_rq(cqe, hr_qp); @@ -2126,6 +2141,17 @@ static uint32_t wc_read_slid(struct ibv_cq_ex *current) static uint8_t wc_read_sl(struct ibv_cq_ex *current) { struct hns_roce_cq *cq = to_hr_cq(ibv_cq_ex_to_cq(current)); + struct hns_roce_context *ctx = to_hr_ctx(current->context); + struct hns_roce_qp *hr_qp; + uint8_t port_type; + uint32_t qpn; + + qpn = hr_reg_read(cq->cqe, CQE_LCL_QPN); + hr_qp = hns_roce_v2_find_qp(ctx, qpn); + if (hr_qp->verbs_qp.qp.qp_type == IBV_QPT_UD && !hr_qp->enable_ud_sl) { + port_type = hr_reg_read(cq->cqe, CQE_PORT_TYPE); + return pktype_for_ud[port_type]; + } return (uint8_t)hr_reg_read(cq->cqe, CQE_SL); } diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c index fa27fc1..4b641ea 100644 --- a/providers/hns/hns_roce_u_verbs.c +++ b/providers/hns/hns_roce_u_verbs.c @@ -1019,6 +1019,11 @@ static int check_qp_congest_type(struct hns_roce_context *ctx, return 0; } +enum { + HNSDV_QP_SUP_CREATE_FLAGS = HNSDV_QP_CREATE_ENABLE_DCA_MODE | + HNSDV_QP_CREATE_ENABLE_UD_SL, +}; + static int check_hnsdv_qp_attr(struct hns_roce_context *ctx, struct hnsdv_qp_init_attr *hns_attr, struct hns_roce_cmd_flag *cmd_flag) @@ -1034,6 +1039,14 @@ static int check_hnsdv_qp_attr(struct hns_roce_context *ctx, return -EINVAL; } + if (hns_attr->comp_mask & HNSDV_QP_INIT_ATTR_MASK_QP_CREATE_FLAGS && + !check_comp_mask(hns_attr->create_flags, + HNSDV_QP_SUP_CREATE_FLAGS)) { + verbs_err(&ctx->ibv_ctx, "invalid create_flags 0x%x.\n", + hns_attr->create_flags); + return -EOPNOTSUPP; + } + ret = check_qp_congest_type(ctx, hns_attr, cmd_flag); if (ret) return ret; @@ -1685,6 +1698,9 @@ static struct ibv_qp *create_qp(struct ibv_context *ibv_ctx, qp_setup_config(attr, qp, context); + if (hns_attr && hns_attr->create_flags & HNSDV_QP_CREATE_ENABLE_UD_SL) + qp->enable_ud_sl = true; + return &qp->verbs_qp.qp; err_dwqe: diff --git a/providers/hns/hnsdv.h b/providers/hns/hnsdv.h index e15b428..365c314 100644 --- a/providers/hns/hnsdv.h +++ b/providers/hns/hnsdv.h @@ -43,6 +43,7 @@ struct ibv_context *hnsdv_open_device(struct ibv_device *device, enum hnsdv_qp_create_flags { HNSDV_QP_CREATE_ENABLE_DCA_MODE = 1 << 0, + HNSDV_QP_CREATE_ENABLE_UD_SL = 1 << 1, }; enum hnsdv_qp_congest_ctrl_type { -- 2.30.0

1 0

[PATCH v4 openEuler-22.03-LTS-SP2 0/4] support ACPI for MPAM 2.0
by Yu Liao 09 Jun '23

09 Jun '23

This patch series support ACPI for MPAM 2.0. v4: add PPTT null check to prevent NULL pointer deference. Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 19 ++- drivers/acpi/arm64/mpam_v2.c | 181 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 ++++++++ include/acpi/actbl2.h | 118 +++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 378 insertions(+), 6 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[PATCH openEuler-22.03-LTS 0/6] Support dynamic_hugetlb on arm64 and fix some bug
by Liu Shixin 09 Jun '23

09 Jun '23

Support dynamic_hugetlb on arm64 and fix some bug. Liu Shixin (6): mm/dynamic_hugetlb: fix kabi broken when enable CONFIG_DYNAMIC_HUGETLB on arm64 mm/dynamic_hugetlb: support dynamic hugetlb on arm64 mm/dynamic_hugetlb: isolate hugepage without dissolve mm/dynamic_hugetlb: replace spin_lock with mutex_lock and fix kabi broken mm/dynamic_hugetlb: set PagePool to bad page mm/dynamic_hugetlb: fix type error of pfn in __hpool_split_gigantic_page() fs/Kconfig | 2 +- fs/hugetlbfs/inode.c | 2 +- include/linux/dynamic_hugetlb.h | 24 +++++++++++++-- include/linux/memcontrol.h | 6 +++- mm/dynamic_hugetlb.c | 54 +++++++++++++++++++++++++++------ mm/hugetlb.c | 7 +++++ 6 files changed, 80 insertions(+), 15 deletions(-) -- 2.25.1

2 7

[PATCH v3 openEuler-22.03-LTS-SP2 0/4] support ACPI for MPAM 2.0
by Yu Liao 08 Jun '23

08 Jun '23

This patch series support ACPI for MPAM 2.0. Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 19 ++- drivers/acpi/arm64/mpam_v2.c | 176 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 373 insertions(+), 6 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

3 9

[PATCH v4 openEuler-22.03-LTS-SP2 0/4] support ACPI for MPAM 2.0
by Yu Liao 08 Jun '23

08 Jun '23

This patch series support ACPI for MPAM 2.0. Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 19 ++- drivers/acpi/arm64/mpam_v2.c | 176 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 373 insertions(+), 6 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS 01/21] udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM).
by Yongqiang Liu 08 Jun '23

08 Jun '23

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> stable inclusion from stable-v4.19.282 commit 9577d9f0fbf1eea95f61b02627572c401499aa32 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7BZ5U CVE: NA -------------------------------- commit 21985f43376cee092702d6cb963ff97a9d2ede68 upstream. Commit 4b340ae20d0e ("IPv6: Complete IPV6_DONTFRAG support") forgot to add a change to free inet6_sk(sk)->rxpmtu while converting an IPv6 socket into IPv4 with IPV6_ADDRFORM. After conversion, sk_prot is changed to udp_prot and ->destroy() never cleans it up, resulting in a memory leak. This is due to the discrepancy between inet6_destroy_sock() and IPV6_ADDRFORM, so let's call inet6_destroy_sock() from IPV6_ADDRFORM to remove the difference. However, this is not enough for now because rxpmtu can be changed without lock_sock() after commit 03485f2adcde ("udpv6: Add lockless sendmsg() support"). We will fix this case in the following patch. Note we will rename inet6_destroy_sock() to inet6_cleanup_sock() and remove unnecessary inet6_destroy_sock() calls in sk_prot->destroy() in the future. Fixes: 4b340ae20d0e ("IPv6: Complete IPV6_DONTFRAG support") Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/net/ipv6.h | 1 + net/ipv6/af_inet6.c | 6 ++++++ net/ipv6/ipv6_sockglue.c | 20 ++++++++------------ 3 files changed, 15 insertions(+), 12 deletions(-) diff --git a/include/net/ipv6.h b/include/net/ipv6.h index 4c2e40882e88..f33be9653aaa 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -1040,6 +1040,7 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port, void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info); void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu); +void inet6_cleanup_sock(struct sock *sk); int inet6_release(struct socket *sock); int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len); int inet6_getname(struct socket *sock, struct sockaddr *uaddr, diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index a6be1ad6994a..d285db413ceb 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -505,6 +505,12 @@ void inet6_destroy_sock(struct sock *sk) } EXPORT_SYMBOL_GPL(inet6_destroy_sock); +void inet6_cleanup_sock(struct sock *sk) +{ + inet6_destroy_sock(sk); +} +EXPORT_SYMBOL_GPL(inet6_cleanup_sock); + /* * This does both peername and sockname. */ diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index dccbc71d7f8e..441febd19674 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -180,9 +180,6 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, if (optlen < sizeof(int)) goto e_inval; if (val == PF_INET) { - struct ipv6_txoptions *opt; - struct sk_buff *pktopt; - if (sk->sk_type == SOCK_RAW) break; @@ -213,7 +210,6 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, break; } - fl6_free_socklist(sk); __ipv6_sock_mc_close(sk); __ipv6_sock_ac_close(sk); @@ -251,14 +247,14 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, sk->sk_socket->ops = &inet_dgram_ops; sk->sk_family = PF_INET; } - opt = xchg((__force struct ipv6_txoptions **)&np->opt, - NULL); - if (opt) { - atomic_sub(opt->tot_len, &sk->sk_omem_alloc); - txopt_put(opt); - } - pktopt = xchg(&np->pktoptions, NULL); - kfree_skb(pktopt); + + /* Disable all options not to allocate memory anymore, + * but there is still a race. See the lockless path + * in udpv6_sendmsg() and ipv6_local_rxpmtu(). + */ + np->rxopt.all = 0; + + inet6_cleanup_sock(sk); /* * ... and add it to the refcnt debug socks count -- 2.25.1

1 20

[PATCH openEuler-22.03-LTS-SP2] perf: hisi: delete global enable pmu from xxx_write_counter()
by Junhao He 08 Jun '23

08 Jun '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7C2U9 CVE: NA ---------------------------------------------------------------------- UC PMU global enable register be setup in pmu callback pmu::enable(), which also be wiil setup in pmu::start()->xxx_write_counter(). And it will start statistical information when callback pmu:start() return, not is pmu:enable() return. Therefore the driver counter counts more data than normal. Fixes: 5ed05cb ("drivers/perf: hisi: Add support for HiSilicon UC PMU driver") Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c index b7b7d3d9d8be..ff9c63f66abc 100644 --- a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c +++ b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c @@ -292,7 +292,6 @@ static u64 hisi_uc_pmu_read_counter(struct hisi_pmu *uc_pmu, static void hisi_uc_pmu_write_counter(struct hisi_pmu *uc_pmu, struct hw_perf_event *hwc, u64 val) { - hisi_uc_pmu_start_counters(uc_pmu); writeq(val, uc_pmu->base + HISI_UC_CNTR_REG(hwc->idx)); } -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP2] xfrm: Reinject transport-mode packets through workqueue
by Liu Jian 08 Jun '23

08 Jun '23

mainline inclusion from mainline-v6.1-rc1 commit 4f4920669d21e1060b7243e5118dc3b71ced1276 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5K0NK CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The following warning is displayed when the tcp6-multi-diffip11 stress test case of the LTP test suite is tested: watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [ns-tcpserver:48198] CPU: 0 PID: 48198 Comm: ns-tcpserver Kdump: loaded Not tainted 6.0.0-rc6+ #39 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : des3_ede_encrypt+0x27c/0x460 [libdes] lr : 0x3f sp : ffff80000ceaa1b0 x29: ffff80000ceaa1b0 x28: ffff0000df056100 x27: ffff0000e51e5280 x26: ffff80004df75030 x25: ffff0000e51e4600 x24: 000000000000003b x23: 0000000000802080 x22: 000000000000003d x21: 0000000000000038 x20: 0000000080000020 x19: 000000000000000a x18: 0000000000000033 x17: ffff0000e51e4780 x16: ffff80004e2d1448 x15: ffff80004e2d1248 x14: ffff0000e51e4680 x13: ffff80004e2d1348 x12: ffff80004e2d1548 x11: ffff80004e2d1848 x10: ffff80004e2d1648 x9 : ffff80004e2d1748 x8 : ffff80004e2d1948 x7 : 000000000bcaf83d x6 : 000000000000001b x5 : ffff80004e2d1048 x4 : 00000000761bf3bf x3 : 000000007f1dd0a3 x2 : ffff0000e51e4780 x1 : ffff0000e3b9a2f8 x0 : 00000000db44e872 Call trace: des3_ede_encrypt+0x27c/0x460 [libdes] crypto_des3_ede_encrypt+0x1c/0x30 [des_generic] crypto_cbc_encrypt+0x148/0x190 crypto_skcipher_encrypt+0x2c/0x40 crypto_authenc_encrypt+0xc8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp6_output_tail+0x1c8/0x5d0 [esp6] esp6_output+0x120/0x278 [esp6] xfrm_output_one+0x458/0x4ec xfrm_output_resume+0x6c/0x1f0 xfrm_output+0xac/0x4ac __xfrm6_output+0x130/0x270 xfrm6_output+0x60/0xec ip6_xmit+0x2ec/0x5bc inet6_csk_xmit+0xbc/0x10c __tcp_transmit_skb+0x460/0x8c0 tcp_write_xmit+0x348/0x890 __tcp_push_pending_frames+0x44/0x110 tcp_rcv_established+0x3c8/0x720 tcp_v6_do_rcv+0xdc/0x4a0 tcp_v6_rcv+0xc24/0xcb0 ip6_protocol_deliver_rcu+0xf0/0x574 ip6_input_finish+0x48/0x7c ip6_input+0x48/0xc0 ip6_rcv_finish+0x80/0x9c xfrm_trans_reinject+0xb0/0xf4 tasklet_action_common.constprop.0+0xf8/0x134 tasklet_action+0x30/0x3c __do_softirq+0x128/0x368 do_softirq+0xb4/0xc0 __local_bh_enable_ip+0xb0/0xb4 put_cpu_fpsimd_context+0x40/0x70 kernel_neon_end+0x20/0x40 sha1_base_do_update.constprop.0.isra.0+0x11c/0x140 [sha1_ce] sha1_ce_finup+0x94/0x110 [sha1_ce] crypto_shash_finup+0x34/0xc0 hmac_finup+0x48/0xe0 crypto_shash_finup+0x34/0xc0 shash_digest_unaligned+0x74/0x90 crypto_shash_digest+0x4c/0x9c shash_ahash_digest+0xc8/0xf0 shash_async_digest+0x28/0x34 crypto_ahash_digest+0x48/0xcc crypto_authenc_genicv+0x88/0xcc [authenc] crypto_authenc_encrypt+0xd8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp6_output_tail+0x1c8/0x5d0 [esp6] esp6_output+0x120/0x278 [esp6] xfrm_output_one+0x458/0x4ec xfrm_output_resume+0x6c/0x1f0 xfrm_output+0xac/0x4ac __xfrm6_output+0x130/0x270 xfrm6_output+0x60/0xec ip6_xmit+0x2ec/0x5bc inet6_csk_xmit+0xbc/0x10c __tcp_transmit_skb+0x460/0x8c0 tcp_write_xmit+0x348/0x890 __tcp_push_pending_frames+0x44/0x110 tcp_push+0xb4/0x14c tcp_sendmsg_locked+0x71c/0xb64 tcp_sendmsg+0x40/0x6c inet6_sendmsg+0x4c/0x80 sock_sendmsg+0x5c/0x6c __sys_sendto+0x128/0x15c __arm64_sys_sendto+0x30/0x40 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x170/0x194 do_el0_svc+0x38/0x4c el0_svc+0x28/0xe0 el0t_64_sync_handler+0xbc/0x13c el0t_64_sync+0x180/0x184 Get softirq info by bcc tool: ./softirqs -NT 10 Tracing soft irq event time... Hit Ctrl-C to end. 15:34:34 SOFTIRQ TOTAL_nsecs block 158990 timer 20030920 sched 46577080 net_rx 676746820 tasklet 9906067650 15:34:45 SOFTIRQ TOTAL_nsecs block 86100 sched 38849790 net_rx 676532470 timer 1163848790 tasklet 9409019620 15:34:55 SOFTIRQ TOTAL_nsecs sched 58078450 net_rx 475156720 timer 533832410 tasklet 9431333300 The tasklet software interrupt takes too much time. Therefore, the xfrm_trans_reinject executor is changed from tasklet to workqueue. Add add spin lock to protect the queue. This reduces the processing flow of the tcp_sendmsg function in this scenario. Fixes: acf568ee859f0 ("xfrm: Reinject transport-mode packets through tasklet") Signed-off-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Conflicts: net/xfrm/xfrm_input.c Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/xfrm/xfrm_input.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c index 77e82033ad70..90af125aa770 100644 --- a/net/xfrm/xfrm_input.c +++ b/net/xfrm/xfrm_input.c @@ -24,7 +24,8 @@ #include "xfrm_inout.h" struct xfrm_trans_tasklet { - struct tasklet_struct tasklet; + struct work_struct work; + spinlock_t queue_lock; struct sk_buff_head queue; }; @@ -760,18 +761,22 @@ int xfrm_input_resume(struct sk_buff *skb, int nexthdr) } EXPORT_SYMBOL(xfrm_input_resume); -static void xfrm_trans_reinject(unsigned long data) +static void xfrm_trans_reinject(struct work_struct *work) { - struct xfrm_trans_tasklet *trans = (void *)data; + struct xfrm_trans_tasklet *trans = container_of(work, struct xfrm_trans_tasklet, work); struct sk_buff_head queue; struct sk_buff *skb; __skb_queue_head_init(&queue); + spin_lock_bh(&trans->queue_lock); skb_queue_splice_init(&trans->queue, &queue); + spin_unlock_bh(&trans->queue_lock); + local_bh_disable(); while ((skb = __skb_dequeue(&queue))) XFRM_TRANS_SKB_CB(skb)->finish(XFRM_TRANS_SKB_CB(skb)->net, NULL, skb); + local_bh_enable(); } int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, @@ -789,8 +794,10 @@ int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, XFRM_TRANS_SKB_CB(skb)->finish = finish; XFRM_TRANS_SKB_CB(skb)->net = net; + spin_lock_bh(&trans->queue_lock); __skb_queue_tail(&trans->queue, skb); - tasklet_schedule(&trans->tasklet); + spin_unlock_bh(&trans->queue_lock); + schedule_work(&trans->work); return 0; } EXPORT_SYMBOL(xfrm_trans_queue_net); @@ -817,8 +824,8 @@ void __init xfrm_input_init(void) struct xfrm_trans_tasklet *trans; trans = &per_cpu(xfrm_trans_tasklet, i); + spin_lock_init(&trans->queue_lock); __skb_queue_head_init(&trans->queue); - tasklet_init(&trans->tasklet, xfrm_trans_reinject, - (unsigned long)trans); + INIT_WORK(&trans->work, xfrm_trans_reinject); } } -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS 1/2] of: overlay: fix for_each_child.cocci warnings
by Yongqiang Liu 08 Jun '23

08 Jun '23

From: kernel test robot <lkp(a)intel.com> mainline inclusion from mainline-v5.13-rc1 commit c4d74f0f978ed5ceee62cd3f6708081042e582a1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I73DDA CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------ Function "for_each_child_of_node" should have of_node_put() before goto. Generated by: scripts/coccinelle/iterators/for_each_child.cocci Fixes: 82c2d81361ec ("coccinelle: iterators: Add for_each_child.cocci script") CC: Sumera Priyadarsini <sylphrenadin(a)gmail.com> Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Julia Lawall <julia.lawall(a)inria.fr> Reviewed-by: Frank Rowand <frank.rowand(a)sony.com> Tested-by: Frank Rowand <frank.rowand(a)sony.com> Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2103221918450.2918@hadrien Signed-off-by: Rob Herring <robh(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> Reviewed-by: xuqiang <xuqiang36(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/of/overlay.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c index a77bfeac867d..b0a765fcef2f 100644 --- a/drivers/of/overlay.c +++ b/drivers/of/overlay.c @@ -713,6 +713,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs, if (!fragment->target) { of_node_put(fragment->overlay); ret = -EINVAL; + of_node_put(node); goto err_free_fragments; } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/2] fs: hfsplus: fix UAF issue in hfsplus_put_super
by Yongqiang Liu 08 Jun '23

08 Jun '23

From: Dongliang Mu <mudongliangabcd(a)gmail.com> stable inclusion from stable-v4.19.273 commit e226f1fdcee1ca6e68233b132718deb578a84e38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I79LIO CVE: CVE-2023-2985 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 07db5e247ab5858439b14dd7cc1fe538b9efcf32 upstream. The current hfsplus_put_super first calls hfs_btree_close on sbi->ext_tree, then invokes iput on sbi->hidden_dir, resulting in an use-after-free issue in hfsplus_release_folio. As shown in hfsplus_fill_super, the error handling code also calls iput before hfs_btree_close. To fix this error, we move all iput calls before hfsplus_btree_close. Note that this patch is tested on Syzbot. Link: https://lkml.kernel.org/r/20230226124948.3175736-1-mudongliangabcd@gmail.com Reported-by: syzbot+57e3e98f7e3b80f64d56(a)syzkaller.appspotmail.com Tested-by: Dongliang Mu <mudongliangabcd(a)gmail.com> Signed-off-by: Dongliang Mu <mudongliangabcd(a)gmail.com> Cc: Bart Van Assche <bvanassche(a)acm.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Muchun Song <songmuchun(a)bytedance.com> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: "Theodore Ts'o" <tytso(a)mit.edu> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/hfsplus/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c index eb4535eba95d..3b1356b10a47 100644 --- a/fs/hfsplus/super.c +++ b/fs/hfsplus/super.c @@ -294,11 +294,11 @@ static void hfsplus_put_super(struct super_block *sb) hfsplus_sync_fs(sb, 1); } + iput(sbi->alloc_file); + iput(sbi->hidden_dir); hfs_btree_close(sbi->attr_tree); hfs_btree_close(sbi->cat_tree); hfs_btree_close(sbi->ext_tree); - iput(sbi->alloc_file); - iput(sbi->hidden_dir); kfree(sbi->s_vhdr_buf); kfree(sbi->s_backup_vhdr_buf); unload_nls(sbi->nls); -- 2.25.1

1 1

[PATCH openEuler-22.03-LTS-SP2 00/35] xfs: fixes patchs and backport patchs
by Long Li 08 Jun '23

08 Jun '23

Allison Henderson (1): xfs: increase rename inode reservation ChenXiaoSong (1): xfs: fix NULL pointer dereference in xfs_getbmap() Darrick J. Wong (6): xfs: check return codes when flushing block devices xfs: fix maxlevels comparisons in the btree staging code xfs: shut down filesystem if we xfs_trans_cancel with deferred work items xfs: don't expose internal symlink metadata buffers to the vfs xfs: fix negative array access in xfs_getbmap iomap: iomap: fix memory corruption when recording errors during writeback Dave Chinner (13): xfs: remove xfs_blkdev_issue_flush xfs: AIL should be log centric xfs: shutdown in intent recovery has non-intent items in the AIL xfs: log shutdown triggers should only shut down the log xfs: xfs_do_force_shutdown needs to block racing shutdowns xfs: xfs_trans_commit() path must check for log shutdown xfs: shutdown during log recovery needs to mark the log shutdown xfs: remove XFS_PREALLOC_SYNC xfs: fallocate() should call file_modified() xfs: sb verifier doesn't handle uncached sb buffer xfs: write page faults in iomap are not buffered writes iomap: write iomap validity checks xfs: use iomap_valid method to detect stale cached iomaps Gao Xiang (1): xfs: account extra freespace btree splits for multiple allocations Guo Xuenan (3): Revert "[Huawei] xfs: fix uaf when leaf dir bestcount not match with dir data blocks" xfs: fix exception caused by unexpected illegal bestcount in leaf dir xfs: force shutdown xfs when xfs_attr_inactive fails Long Li (4): xfs: fix ag count overflow during growfs xfs: fix hung when transaction commit fail in xfs_inactive_ifree xfs: fix a UAF when inode item push xfs: fix a UAF in xfs_iflush_abort_clean Shida Zhang (1): xfs: trim the mapp array accordingly in xfs_da_grow_inode_int Wu Guanghao (1): xfs: fix the problem of mount failure caused by not refreshing mp->m_sb Ye Bin (2): xfs: fix BUG_ON in xfs_getbmap() xfs: fix dead loop when do mount with IO fault injection Zhang Yi (2): xfs: factor out __xfs_da3_node_read() xfs: atomic drop extent entries when inactiving attr fs/iomap/apply.c | 14 +++- fs/iomap/buffered-io.c | 29 ++++++++- fs/xfs/libxfs/xfs_alloc.c | 9 ++- fs/xfs/libxfs/xfs_alloc.h | 1 + fs/xfs/libxfs/xfs_bmap.c | 7 +- fs/xfs/libxfs/xfs_btree_staging.c | 4 +- fs/xfs/libxfs/xfs_da_btree.c | 7 +- fs/xfs/libxfs/xfs_da_btree.h | 15 ++++- fs/xfs/libxfs/xfs_dir2_leaf.c | 21 ++---- fs/xfs/libxfs/xfs_ialloc.c | 1 + fs/xfs/libxfs/xfs_sb.c | 2 +- fs/xfs/libxfs/xfs_trans_resv.c | 4 +- fs/xfs/xfs_aops.c | 2 +- fs/xfs/xfs_attr_inactive.c | 66 ++++++++++++++----- fs/xfs/xfs_bmap_util.c | 34 +++++----- fs/xfs/xfs_buf.c | 7 +- fs/xfs/xfs_buf.h | 7 +- fs/xfs/xfs_buf_item.c | 20 ++++++ fs/xfs/xfs_buf_item_recover.c | 24 +++++++ fs/xfs/xfs_file.c | 49 ++++++++------ fs/xfs/xfs_fsops.c | 9 ++- fs/xfs/xfs_inode.c | 5 +- fs/xfs/xfs_inode_item.c | 11 +++- fs/xfs/xfs_iomap.c | 105 ++++++++++++++++++++++++------ fs/xfs/xfs_iomap.h | 7 +- fs/xfs/xfs_iops.c | 34 +--------- fs/xfs/xfs_log.c | 68 +++++++++++++------ fs/xfs/xfs_log_cil.c | 4 +- fs/xfs/xfs_log_priv.h | 11 ++++ fs/xfs/xfs_log_recover.c | 56 ++++++---------- fs/xfs/xfs_mount.c | 1 + fs/xfs/xfs_pnfs.c | 12 ++-- fs/xfs/xfs_super.c | 7 -- fs/xfs/xfs_super.h | 1 - fs/xfs/xfs_symlink.c | 27 +++++--- fs/xfs/xfs_trans.c | 61 ++++++++++++----- fs/xfs/xfs_trans_ail.c | 30 ++++----- fs/xfs/xfs_trans_priv.h | 3 +- include/linux/iomap.h | 39 +++++++++-- 39 files changed, 549 insertions(+), 265 deletions(-) -- 2.31.1

2 36

[PATCH OLK-5.10 0/5] A set of patch for uploading openEuler
by Yihang Li 08 Jun '23

08 Jun '23

From: xiabing <xiabing12(a)h-partners.com> Arnd Bergmann (1): scsi: hisi_sas: Work around build failure in suspend function Qi Liu (1): scsi: hisi_sas: Add slave_destroy interface for v3 hw Xiang Chen (1): scsi: sd: try more retries of START_STOP when resuming scsi device Yihang Li (2): scsi: hisi_sas: Block requests before take debugfs snapshot scsi: hisi_sas: Check usage count only when the runtime PM status is RPM_SUSPENDING drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 31 +++++++++++++++++++++----- drivers/scsi/sd.c | 24 +++++++++++++++----- 2 files changed, 43 insertions(+), 12 deletions(-) -- 2.30.0

2 6

[PATCH openEuler-22.03-LTS 0/4] io_uring: fix the problem of
by Li Lingfeng 08 Jun '23

08 Jun '23

patch1: arch: setup PF_IO_WORKER threads like PF_KTHREAD pre patch of patch4 patch2: arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() fix patch of patch1 patch3: kernel: don't call do_exit() for PF_IO_WORKER threads fix the segfault patch4: x86/process: setup io_threads more like normal user space threads allow io worker to exit Jens Axboe (3): arch: setup PF_IO_WORKER threads like PF_KTHREAD arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() kernel: don't call do_exit() for PF_IO_WORKER threads Stefan Metzmacher (1): x86/process: setup io_threads more like normal user space threads arch/alpha/kernel/process.c | 2 +- arch/arc/kernel/process.c | 2 +- arch/arm/kernel/process.c | 2 +- arch/arm64/kernel/process.c | 2 +- arch/csky/kernel/process.c | 2 +- arch/h8300/kernel/process.c | 2 +- arch/hexagon/kernel/process.c | 2 +- arch/ia64/kernel/process.c | 2 +- arch/m68k/kernel/process.c | 2 +- arch/microblaze/kernel/process.c | 2 +- arch/mips/kernel/process.c | 2 +- arch/nds32/kernel/process.c | 2 +- arch/nios2/kernel/process.c | 2 +- arch/openrisc/kernel/process.c | 2 +- arch/parisc/kernel/process.c | 2 +- arch/powerpc/kernel/process.c | 2 +- arch/riscv/kernel/process.c | 2 +- arch/s390/kernel/process.c | 2 +- arch/sh/kernel/process_32.c | 2 +- arch/sparc/kernel/process_32.c | 2 +- arch/sparc/kernel/process_64.c | 2 +- arch/um/kernel/process.c | 2 +- arch/x86/kernel/process.c | 17 +++++++++++++++++ arch/xtensa/kernel/process.c | 2 +- kernel/signal.c | 10 +++++++++- 25 files changed, 49 insertions(+), 24 deletions(-) -- 2.31.1

2 5

[PATCH openEuler-22.03-LTS v2] nbd: get config_lock before sock_shutdown
by Zhong Jinghua 08 Jun '23

08 Jun '23

From: Zhong Jinghua <zhongjinghua(a)huaweicloud.com> Offering: HULK hulk inclusion category: bugfix bugzilla: 188799, https://gitee.com/openeuler/kernel/issues/I79QWO CVE: NA ---------------------------------------- Config->socks in sock_shutdown may trigger a UAF problem. The reason is that sock_shutdown does not hold the config_lock, so that nbd_ioctl can release config->socks at this time. T0: NBD_SET_SOCK T1: NBD_DO_IT T0 T1 nbd_ioctl mutex_lock(&nbd->config_lock) // get lock __nbd_ioctl nbd_start_device_ioctl nbd_start_device mutex_unlock(&nbd->config_lock) // relase lock wait_event_interruptible (kill, enter sock_shutdown) sock_shutdown nbd_ioctl mutex_lock(&nbd->config_lock) // get lock __nbd_ioctl nbd_add_socket krealloc kfree(p) //config->socks is NULL nbd_sock *nsock = config->socks // error Fix it by moving config_lock up before sock_shutdown. Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> --- v2: adapt drivers/block/nbd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index ebcdb6025be3..ba98fdaaa35a 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1406,11 +1406,16 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b mutex_unlock(&nbd->config_lock); ret = wait_event_interruptible(config->recv_wq, atomic_read(&config->recv_threads) == 0); + + /* + * recv_work in flush_workqueue will not get this lock, because nbd_open + * will hold nbd->config_refs + */ + mutex_lock(&nbd->config_lock); if (ret) sock_shutdown(nbd); flush_workqueue(nbd->recv_workq); - mutex_lock(&nbd->config_lock); nbd_bdev_reset(bdev); /* user requested, ignore socket errors */ if (test_bit(NBD_RT_DISCONNECT_REQUESTED, &config->runtime_flags)) -- 2.31.1

2 1

[PATCH v3 OLK-5.10 0/4] support ACPI for MPAM 2.0
by Yu Liao 08 Jun '23

08 Jun '23

This patch series support ACPI for MPAM 2.0. Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 19 ++- drivers/acpi/arm64/mpam_v2.c | 176 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 373 insertions(+), 6 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[PATCH OLK-5.10 v2] fs: hfsplus: fix UAF issue in hfsplus_put_super
by Long Li 08 Jun '23

08 Jun '23

From: Dongliang Mu <mudongliangabcd(a)gmail.com> stable inclusion from stable-v5.10.167 commit ef7d71d7bd57b8b7fe514e459927696c1c6d1047 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I79LIO CVE: CVE-2023-2985 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 07db5e247ab5858439b14dd7cc1fe538b9efcf32 upstream. The current hfsplus_put_super first calls hfs_btree_close on sbi->ext_tree, then invokes iput on sbi->hidden_dir, resulting in an use-after-free issue in hfsplus_release_folio. As shown in hfsplus_fill_super, the error handling code also calls iput before hfs_btree_close. To fix this error, we move all iput calls before hfsplus_btree_close. Note that this patch is tested on Syzbot. Link: https://lkml.kernel.org/r/20230226124948.3175736-1-mudongliangabcd@gmail.com Reported-by: syzbot+57e3e98f7e3b80f64d56(a)syzkaller.appspotmail.com Tested-by: Dongliang Mu <mudongliangabcd(a)gmail.com> Signed-off-by: Dongliang Mu <mudongliangabcd(a)gmail.com> Cc: Bart Van Assche <bvanassche(a)acm.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Muchun Song <songmuchun(a)bytedance.com> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: "Theodore Ts'o" <tytso(a)mit.edu> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- fs/hfsplus/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c index 807119ae5adf..7648f64a17a8 100644 --- a/fs/hfsplus/super.c +++ b/fs/hfsplus/super.c @@ -295,11 +295,11 @@ static void hfsplus_put_super(struct super_block *sb) hfsplus_sync_fs(sb, 1); } + iput(sbi->alloc_file); + iput(sbi->hidden_dir); hfs_btree_close(sbi->attr_tree); hfs_btree_close(sbi->cat_tree); hfs_btree_close(sbi->ext_tree); - iput(sbi->alloc_file); - iput(sbi->hidden_dir); kfree(sbi->s_vhdr_buf); kfree(sbi->s_backup_vhdr_buf); unload_nls(sbi->nls); -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS v8 0/2] smart grid scheduler
by Wang ShaoBo 08 Jun '23

08 Jun '23

v8: 处理了下格式问题，调度部分小有修改。 v7: 修复了commit message拼词错误和补丁格式问题。 v6: 自动模式下逃逸改为禁止，当前环境测试，功能OK，收益OK，直接使用根分组收益较小建议新建分组,建议使用mask屏蔽level0。 v5: 调度部分已完成评审完成代码修改，逃逸部分仍然使用pelt. 内存策略调整模块已经按照review已将进行修改. v4: fix KABI add 'cpu.affinity_domain_mask' add some statistics v3: 修改了patchwork错误，但是KABI还有个问题待解决。 v2: formal version 1. Hui Tang (1): sched: Introduce smart grid scheduling strategy for cfs Wang ShaoBo (1): sched: smart grid: init sched_grid_qos structure on QOS purpose fs/proc/array.c | 13 + include/linux/sched.h | 18 ++ include/linux/sched/grid_qos.h | 92 +++++++ include/linux/sched/sysctl.h | 4 + init/Kconfig | 13 + kernel/fork.c | 9 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 147 +++++++++++ kernel/sched/fair.c | 437 ++++++++++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 143 +++++++++++ kernel/sched/grid/stat.c | 32 +++ kernel/sched/sched.h | 50 ++++ kernel/sysctl.c | 9 + mm/mempolicy.c | 12 +- 17 files changed, 1012 insertions(+), 3 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] bugfix the lost interruption problem after live migration
by liulongfang 08 Jun '23

08 Jun '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> The problem of service interruption and loss may be triggered during live migration. In order to ensure normal business, it is necessary to resend an interrupt in the live migration driver. And in the QM service driver, it is guaranteed that the retransmission interrupt can be received normally. Longfang Liu (2): crypto: hisilicon/qm - fix EQ/AEQ interrupt issue vfio/migration: bugfix lost interruption after live migration .../hisilicon/migration/acc_vf_migration.c | 66 +++++++---- .../hisilicon/migration/acc_vf_migration.h | 2 + drivers/crypto/hisilicon/qm.c | 107 +++++++----------- include/linux/hisi_acc_qm.h | 1 + 4 files changed, 86 insertions(+), 90 deletions(-) -- 2.30.0

1 2

[PATCH OLK-5.10 v2] drivers/perf: hisi: Don't migrate perf to the CPU going to teardown
by Junhao He 08 Jun '23

08 Jun '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7BUN2 CVE: NA ---------------------------------------------------------------------- The driver needs to migrate the perf context if the current using CPU going to teardown. By the time calling the cpuhp::teardown() callback the cpu_online_mask() hasn't updated yet and still includes the CPU going to teardown. In current driver's implementation we may migrate the context to the teardown CPU and leads to the below calltrace: ... [ 368.104662][ T932] task:cpuhp/0 state:D stack: 0 pid: 15 ppid: 2 flags:0x00000008 [ 368.113699][ T932] Call trace: [ 368.116834][ T932] __switch_to+0x7c/0xbc [ 368.120924][ T932] __schedule+0x338/0x6f0 [ 368.125098][ T932] schedule+0x50/0xe0 [ 368.128926][ T932] schedule_preempt_disabled+0x18/0x24 [ 368.134229][ T932] __mutex_lock.constprop.0+0x1d4/0x5dc [ 368.139617][ T932] __mutex_lock_slowpath+0x1c/0x30 [ 368.144573][ T932] mutex_lock+0x50/0x60 [ 368.148579][ T932] perf_pmu_migrate_context+0x84/0x2b0 [ 368.153884][ T932] hisi_pcie_pmu_offline_cpu+0x90/0xe0 [hisi_pcie_pmu] [ 368.160579][ T932] cpuhp_invoke_callback+0x2a0/0x650 [ 368.165707][ T932] cpuhp_thread_fun+0xe4/0x190 [ 368.170316][ T932] smpboot_thread_fn+0x15c/0x1a0 [ 368.175099][ T932] kthread+0x108/0x13c [ 368.179012][ T932] ret_from_fork+0x10/0x18 ... Use function cpumask_any_but() to find one correct active cpu to fixes this issue. Fixes: 8404b0fbc7fb ("drivers/perf: hisi: Add driver for HiSilicon PCIe PMU") Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- drivers/perf/hisilicon/hisi_pcie_pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/perf/hisilicon/hisi_pcie_pmu.c b/drivers/perf/hisilicon/hisi_pcie_pmu.c index 88d488765203..8f59387aeab0 100644 --- a/drivers/perf/hisilicon/hisi_pcie_pmu.c +++ b/drivers/perf/hisilicon/hisi_pcie_pmu.c @@ -689,7 +689,7 @@ static int hisi_pcie_pmu_offline_cpu(unsigned int cpu, struct hlist_node *node) pcie_pmu->on_cpu = -1; /* Choose a new CPU from all online cpus. */ - target = cpumask_first(cpu_online_mask); + target = cpumask_any_but(cpu_online_mask, cpu); if (target >= nr_cpu_ids) { pci_err(pcie_pmu->pdev, "There is no CPU to set\n"); return 0; -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP2] drivers/perf: hisi: Don't migrate perf to the CPU going to teardown
by Junhao He 08 Jun '23

08 Jun '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7BUN2 CVE: NA ---------------------------------------------------------------------- The driver needs to migrate the perf context if the current using CPU going to teardown. By the time calling the cpuhp::teardown() callback the cpu_online_mask() hasn't updated yet and still includes the CPU going to teardown. In current driver's implementation we may migrate the context to the teardown CPU and leads to the below calltrace: ... [ 368.104662][ T932] task:cpuhp/0 state:D stack: 0 pid: 15 ppid: 2 flags:0x00000008 [ 368.113699][ T932] Call trace: [ 368.116834][ T932] __switch_to+0x7c/0xbc [ 368.120924][ T932] __schedule+0x338/0x6f0 [ 368.125098][ T932] schedule+0x50/0xe0 [ 368.128926][ T932] schedule_preempt_disabled+0x18/0x24 [ 368.134229][ T932] __mutex_lock.constprop.0+0x1d4/0x5dc [ 368.139617][ T932] __mutex_lock_slowpath+0x1c/0x30 [ 368.144573][ T932] mutex_lock+0x50/0x60 [ 368.148579][ T932] perf_pmu_migrate_context+0x84/0x2b0 [ 368.153884][ T932] hisi_pcie_pmu_offline_cpu+0x90/0xe0 [hisi_pcie_pmu] [ 368.160579][ T932] cpuhp_invoke_callback+0x2a0/0x650 [ 368.165707][ T932] cpuhp_thread_fun+0xe4/0x190 [ 368.170316][ T932] smpboot_thread_fn+0x15c/0x1a0 [ 368.175099][ T932] kthread+0x108/0x13c [ 368.179012][ T932] ret_from_fork+0x10/0x18 ... Use function cpumask_any_but() to find one correct active cpu to fixes this issue. Fixes: 8404b0fbc7fb ("drivers/perf: hisi: Add driver for HiSilicon PCIe PMU") Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- drivers/perf/hisilicon/hisi_pcie_pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/perf/hisilicon/hisi_pcie_pmu.c b/drivers/perf/hisilicon/hisi_pcie_pmu.c index 88d488765203..8f59387aeab0 100644 --- a/drivers/perf/hisilicon/hisi_pcie_pmu.c +++ b/drivers/perf/hisilicon/hisi_pcie_pmu.c @@ -689,7 +689,7 @@ static int hisi_pcie_pmu_offline_cpu(unsigned int cpu, struct hlist_node *node) pcie_pmu->on_cpu = -1; /* Choose a new CPU from all online cpus. */ - target = cpumask_first(cpu_online_mask); + target = cpumask_any_but(cpu_online_mask, cpu); if (target >= nr_cpu_ids) { pci_err(pcie_pmu->pdev, "There is no CPU to set\n"); return 0; -- 2.33.0

1 0

[PATCH OLK-5.10] roh: Fix ROH multi-BD cmdq issue
by Ke Chen 08 Jun '23

08 Jun '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I77OGM --------------------------------------------------------------- When the ROH CMDQ processes multiple BDs, the operations are inconsistent with those in the UM manual. As a result, the CMDQ parses unexpected return values, interrupts the CMDQ processing process, and the ROH MIB statistics query may fail. This patch fix the process method of roh cmdq multiple BDs. Signed-off-by: Ke Chen <chenke54(a)huawei.com> Reviewed-by: Gang Zhang <gang.zhang(a)huawei.com> --- drivers/roh/core/core.c | 35 +----- drivers/roh/core/core.h | 22 +--- drivers/roh/core/core_priv.h | 3 +- drivers/roh/core/sysfs.c | 180 ++++++++++++++++++++----------- drivers/roh/hw/hns3/hns3_cmdq.c | 131 +++++++++++++++------- drivers/roh/hw/hns3/hns3_cmdq.h | 32 +++--- drivers/roh/hw/hns3/hns3_main.c | 10 +- drivers/roh/hw/hns3/hns3_verbs.c | 22 +--- drivers/roh/hw/hns3/hns3_verbs.h | 1 - 9 files changed, 237 insertions(+), 199 deletions(-) diff --git a/drivers/roh/core/core.c b/drivers/roh/core/core.c index 5d27fcbfd..1b8041004 100644 --- a/drivers/roh/core/core.c +++ b/drivers/roh/core/core.c @@ -2,10 +2,10 @@ // Copyright (c) 2022 Hisilicon Limited. #include <linux/pci.h> -#include <net/rtnetlink.h> +#include <linux/inetdevice.h> -#include "core.h" #include "core_priv.h" +#include "core.h" static DEFINE_XARRAY_FLAGS(devices, XA_FLAGS_ALLOC); static DECLARE_RWSEM(devices_rwsem); @@ -193,20 +193,6 @@ static int assign_name(struct roh_device *device) return ret; } -static int setup_device(struct roh_device *device) -{ - int ret; - - /* Query GUID */ - ret = device->ops.query_guid(device, &device->node_guid); - if (ret) { - pr_err("failed to query guid, ret = %d\n", ret); - return ret; - } - - return 0; -} - static void disable_device(struct roh_device *device) { u32 cid; @@ -264,10 +250,8 @@ static int roh_ipv4_event(struct notifier_block *this, unsigned long event, void device = container_of(this, struct roh_device, nb); ndev = ifa->ifa_dev->dev; - if (device->netdev != ndev) { - pr_warn("netdev mismatch.\n"); + if (device->netdev != ndev || event != NETDEV_UP) return NOTIFY_DONE; - } in.sin_addr.s_addr = ifa->ifa_address; @@ -318,12 +302,6 @@ int roh_register_device(struct roh_device *device) return ret; } - ret = setup_device(device); - if (ret) { - pr_err("roh_core: failed to setup device, ret = %d\n", ret); - return ret; - } - dev_set_uevent_suppress(&device->dev, true); ret = device_add(&device->dev); if (ret) { @@ -559,7 +537,7 @@ static int roh_set_pf_mac_by_eid(struct roh_device *device, u32 eid = eid_attr->base; struct net_device *ndev; struct sockaddr s_addr; - u8 mac[ETH_ALEN]; + u8 mac[ETH_ALEN] = {0}; int ret; ndev = device->netdev; @@ -628,11 +606,6 @@ void roh_device_get_eid(struct roh_device *device, struct roh_eid_attr *attr) mutex_unlock(&device->eid_mutex); } -void roh_device_query_guid(struct roh_device *device, struct roh_guid_attr *attr) -{ - memcpy(attr, &device->node_guid, sizeof(*attr)); -} - enum roh_link_status roh_device_query_link_status(struct roh_device *device) { return device->link_status; diff --git a/drivers/roh/core/core.h b/drivers/roh/core/core.h index fd37192eb..11c8a4578 100644 --- a/drivers/roh/core/core.h +++ b/drivers/roh/core/core.h @@ -7,7 +7,7 @@ #include <linux/types.h> #include <linux/workqueue.h> #include <linux/netdevice.h> -#include <net/bonding.h> +#include <linux/etherdevice.h> #define ROH_DEVICE_NAME_MAX 64 #define MAX_DEVICE_REFCOUNT 2 @@ -23,14 +23,9 @@ enum roh_link_status { ROH_LINK_DOWN = 0, ROH_LINK_UP }; enum roh_mib_type { ROH_MIB_PUBLIC = 0, ROH_MIB_PRIVATE }; -static inline void convert_eid_to_mac(u8 mac[6], u32 eid) +static inline void convert_eid_to_mac(u8 *mac, u32 eid) { - mac[0] = 0; - mac[1] = 0; - mac[2] = 0; - mac[3] = (eid >> 16) & 0xff; - mac[4] = (eid >> 8) & 0xff; - mac[5] = eid & 0xff; + u64_to_ether_addr((u64)eid, mac); } struct roh_eid_attr { @@ -38,10 +33,6 @@ struct roh_eid_attr { u32 num; }; -struct roh_guid_attr { - u8 data[16]; -}; - struct roh_mib_stats { struct mutex lock; /* Protect values[] */ const char * const *names; @@ -51,13 +42,7 @@ struct roh_mib_stats { struct roh_device; struct roh_device_ops { - int (*query_guid)(struct roh_device *device, struct roh_guid_attr *attr); int (*set_eid)(struct roh_device *device, struct roh_eid_attr *attr); - struct sk_buff *(*pkt_create)(struct net_device *ndev, - u8 *dest_mac, u8 *src_mac, int ptype, - struct roh_guid_attr *guid, u16 eid_nums); - int (*pkt_parse)(struct sk_buff *skb, struct roh_eid_attr *eid_attr, int ptype); - enum roh_dev_tx (*xmit_pkt)(struct roh_device *device, struct sk_buff *skb); struct roh_mib_stats *(*alloc_hw_stats)(struct roh_device *device, enum roh_mib_type); int (*get_hw_stats)(struct roh_device *device, struct roh_mib_stats *stats, enum roh_mib_type); @@ -85,7 +70,6 @@ struct roh_device { struct completion unreg_completion; struct mutex unregistration_lock; /* lock for unregiste */ - struct roh_guid_attr node_guid; struct roh_eid_attr eid; struct mutex eid_mutex; /* operate eid needs to be mutexed */ u32 link_status; diff --git a/drivers/roh/core/core_priv.h b/drivers/roh/core/core_priv.h index b8337636f..56f581820 100644 --- a/drivers/roh/core/core_priv.h +++ b/drivers/roh/core/core_priv.h @@ -4,6 +4,8 @@ #ifndef __CORE_PRIV_H__ #define __CORE_PRIV_H__ +#include "core.h" + struct roh_client { char *name; int (*add)(struct roh_device *device); @@ -24,7 +26,6 @@ void roh_device_unregister_sysfs(struct roh_device *device); int roh_device_set_eid(struct roh_device *device, struct roh_eid_attr *attr); void roh_device_get_eid(struct roh_device *device, struct roh_eid_attr *attr); -void roh_device_query_guid(struct roh_device *device, struct roh_guid_attr *attr); enum roh_link_status roh_device_query_link_status(struct roh_device *device); #endif /* __CORE_PRIV_H__ */ diff --git a/drivers/roh/core/sysfs.c b/drivers/roh/core/sysfs.c index a502b9f4f..a65185861 100644 --- a/drivers/roh/core/sysfs.c +++ b/drivers/roh/core/sysfs.c @@ -1,9 +1,9 @@ // SPDX-License-Identifier: GPL-2.0+ // Copyright (c) 2020-2022 Hisilicon Limited. +#include <net/sock.h> #include <linux/sysfs.h> #include <linux/stat.h> -#include <net/sock.h> #include "core.h" #include "core_priv.h" @@ -21,18 +21,6 @@ static ssize_t node_eid_show(struct device *device, return sprintf(buf, "base:%u num:%u\n", eid.base, eid.num); } -static ssize_t node_guid_show(struct device *device, - struct device_attribute *attr, char *buf) -{ - struct roh_device *dev = container_of(device, struct roh_device, dev); - struct roh_guid_attr guid; - u32 *val = (u32 *)guid.data; - - roh_device_query_guid(dev, &guid); - - return sprintf(buf, "%08x:%08x:%08x:%08x\n", val[0], val[1], val[2], val[3]); -} - static ssize_t node_link_status_show(struct device *device, struct device_attribute *attr, char *buf) { @@ -44,12 +32,10 @@ static ssize_t node_link_status_show(struct device *device, } static DEVICE_ATTR_RO(node_eid); -static DEVICE_ATTR_RO(node_guid); static DEVICE_ATTR_RO(node_link_status); static struct device_attribute *roh_class_attr[] = { &dev_attr_node_eid, - &dev_attr_node_guid, &dev_attr_node_link_status, }; @@ -71,7 +57,7 @@ static void remove_device_sysfs(struct roh_device *device) device_remove_file(&device->dev, roh_class_attr[i]); } -static const char * const roh_hw_stats_name[ROH_MIB_STATS_TYPE_NUM] = { +static const char * const g_roh_hw_stats_name[ROH_MIB_STATS_TYPE_NUM] = { "mib_public", "mib_private", }; @@ -91,18 +77,19 @@ static ssize_t print_hw_stat(struct roh_device *dev, static ssize_t node_public_mib_stats_show(struct kobject *kobj, struct attribute *attr, char *buf) { - struct roh_hw_stats_attribute *hsa; struct roh_mib_stats *public_stats; struct roh_device *dev; int ret; - hsa = container_of(attr, struct roh_hw_stats_attribute, attr); dev = container_of(kobj, struct roh_device, dev.kobj); public_stats = dev->hw_public_stats; mutex_lock(&public_stats->lock); ret = dev->ops.get_hw_stats(dev, public_stats, ROH_MIB_PUBLIC); - if (ret) + if (ret) { + dev_err(&dev->dev, + "failed to get roh public hw stats, ret = %d.\n", ret); goto unlock; + } ret = print_hw_stat(dev, public_stats, buf); @@ -115,17 +102,18 @@ static ssize_t node_private_mib_stats_show(struct kobject *kobj, struct attribute *attr, char *buf) { struct roh_mib_stats *private_stats; - struct roh_hw_stats_attribute *hsa; struct roh_device *dev; int ret; - hsa = container_of(attr, struct roh_hw_stats_attribute, attr); dev = container_of(kobj, struct roh_device, dev.kobj); private_stats = dev->hw_private_stats; mutex_lock(&private_stats->lock); ret = dev->ops.get_hw_stats(dev, private_stats, ROH_MIB_PRIVATE); - if (ret) + if (ret) { + dev_err(&dev->dev, + "failed to get roh private hw stats, ret = %d.\n", ret); goto unlock; + } ret = print_hw_stat(dev, private_stats, buf); @@ -134,7 +122,7 @@ static ssize_t node_private_mib_stats_show(struct kobject *kobj, return ret; } -static ssize_t (*show_roh_mib_hw_stats[ROH_MIB_STATS_TYPE_NUM]) +static ssize_t (*g_show_roh_mib_hw_stats[ROH_MIB_STATS_TYPE_NUM]) (struct kobject *, struct attribute *, char *) = { node_public_mib_stats_show, node_private_mib_stats_show @@ -168,70 +156,129 @@ static struct attribute *alloc_hsa(const char *name, return &hsa->attr; } -static void setup_mib_stats(struct roh_device *device) +static void free_hw_stats(struct roh_device *device) +{ + kfree(device->hw_private_stats); + kfree(device->hw_public_stats); +} + +static int alloc_and_get_hw_stats(struct roh_device *device) { struct roh_mib_stats *privite_stats, *public_stats; - struct attribute_group *hsag; - struct kobject *kobj; - int i, j; int ret; public_stats = device->ops.alloc_hw_stats(device, ROH_MIB_PUBLIC); - if (!public_stats) - return; + if (!public_stats) { + dev_err(&device->dev, "failed to alloc roh public hw stats.\n"); + return -ENOMEM; + } privite_stats = device->ops.alloc_hw_stats(device, ROH_MIB_PRIVATE); if (!privite_stats) { + dev_err(&device->dev, "failed to alloc roh privite hw stats.\n"); kfree(public_stats); - return; + return -ENOMEM; } - hsag = kzalloc(sizeof(*hsag) + - sizeof(void *) * (ARRAY_SIZE(roh_hw_stats_name)), - GFP_KERNEL); - if (!hsag) - goto err_free_stats; - ret = device->ops.get_hw_stats(device, public_stats, ROH_MIB_PUBLIC); - if (ret) - goto err_free_hsag; + if (ret) { + dev_err(&device->dev, + "failed to get roh public mib stats, ret = %d\n", ret); + goto err; + } ret = device->ops.get_hw_stats(device, privite_stats, ROH_MIB_PRIVATE); - if (ret) - goto err_free_hsag; + if (ret) { + dev_err(&device->dev, + "failed to get roh privite mib stats, ret = %d\n", ret); + goto err; + } + + mutex_init(&privite_stats->lock); + mutex_init(&public_stats->lock); + + device->hw_public_stats = public_stats; + device->hw_private_stats = privite_stats; + + return 0; + +err: + free_hw_stats(device); + + return ret; +} + +static int alloc_hsag(struct roh_device *device) +{ + struct attribute_group *hsag; + struct kobject *kobj; + int i, j; + int ret; + + /* + * one extra attribue elements here, terminate the + * list for the sysfs core code + */ + hsag = kzalloc(sizeof(*hsag) + + sizeof(void *) * (ARRAY_SIZE(g_roh_hw_stats_name) + 1), + GFP_KERNEL); + if (!hsag) { + dev_err(&device->dev, "failed to kzalloc hsag.\n"); + return -ENOMEM; + } hsag->name = "node_mib_stats"; hsag->attrs = (void *)hsag + sizeof(*hsag); - for (i = 0; i < ARRAY_SIZE(roh_hw_stats_name); i++) { - hsag->attrs[i] = alloc_hsa(roh_hw_stats_name[i], - show_roh_mib_hw_stats[i]); - if (!hsag->attrs[i]) + for (i = 0; i < ARRAY_SIZE(g_roh_hw_stats_name); i++) { + hsag->attrs[i] = alloc_hsa(g_roh_hw_stats_name[i], + g_show_roh_mib_hw_stats[i]); + if (!hsag->attrs[i]) { + ret = -ENOMEM; + dev_err(&device->dev, + "failed to alloc hsa for hsag attrs[%d].\n", i); goto err; + } sysfs_attr_init(hsag->attrs[i]); } - mutex_init(&privite_stats->lock); - mutex_init(&public_stats->lock); - kobj = &device->dev.kobj; ret = sysfs_create_group(kobj, hsag); - if (ret) + if (ret) { + dev_err(&device->dev, + "failed to create roh sysfs group, ret = %d\n", ret); goto err; - device->hw_stats_ag = hsag; - device->hw_public_stats = public_stats; - device->hw_private_stats = privite_stats; + } - return; + device->hw_stats_ag = hsag; + return 0; err: for (j = i - 1; j >= 0; j--) kfree(hsag->attrs[j]); -err_free_hsag: - kfree(hsag); -err_free_stats: - kfree(public_stats); - kfree(privite_stats); + return ret; +} + +static int setup_mib_stats(struct roh_device *device) +{ + int ret; + + ret = alloc_and_get_hw_stats(device); + if (ret) { + dev_err(&device->dev, + "failed to alloc and get roh hw stats, ret = %d.\n", ret); + return ret; + } + + ret = alloc_hsag(device); + if (ret) { + dev_err(&device->dev, + "failed to alloc hsag, ret = %d.\n", ret); + free_hw_stats(device); + return ret; + } + + return 0; } int roh_device_register_sysfs(struct roh_device *device) @@ -242,17 +289,23 @@ int roh_device_register_sysfs(struct roh_device *device) for (i = 0; i < ARRAY_SIZE(roh_class_attr); i++) { ret = device_create_file(&device->dev, roh_class_attr[i]); if (ret) { - pr_err("failed to create node %s, ret = %d.\n", - roh_class_attr[i]->attr.name, ret); + dev_err(&device->dev, + "failed to create node %s, ret = %d.\n", + roh_class_attr[i]->attr.name, ret); goto err; } } - if (device->ops.alloc_hw_stats) - setup_mib_stats(device); + if (device->ops.alloc_hw_stats) { + ret = setup_mib_stats(device); + if (ret) { + dev_err(&device->dev, + "failed to setup roh mib stats, ret = %d.\n", ret); + goto err; + } + } return 0; - err: remove_device_sysfs(device); return ret; @@ -263,8 +316,7 @@ void roh_device_unregister_sysfs(struct roh_device *device) if (device->hw_stats_ag) free_hsag(&device->dev.kobj, device->hw_stats_ag); - kfree(device->hw_private_stats); - kfree(device->hw_public_stats); + free_hw_stats(device); remove_device_sysfs(device); } diff --git a/drivers/roh/hw/hns3/hns3_cmdq.c b/drivers/roh/hw/hns3/hns3_cmdq.c index fccb0c482..75fa2e852 100644 --- a/drivers/roh/hw/hns3/hns3_cmdq.c +++ b/drivers/roh/hw/hns3/hns3_cmdq.c @@ -10,8 +10,8 @@ #include "core.h" #include "hns3_device.h" #include "hns3_common.h" -#include "hns3_cmdq.h" #include "hns3_reg.h" +#include "hns3_cmdq.h" static int hns3_roh_alloc_cmdq_desc(struct hns3_roh_device *hroh_dev, struct hns3_roh_cmdq_ring *ring) @@ -224,6 +224,11 @@ static int hns3_roh_cmdq_build(struct hns3_roh_device *hroh_dev, int handle = 0; if (num > hns3_roh_cmdq_space(csq)) { + /* If CMDQ ring is full, SW HEAD and HW HEAD may be different, + * need update the SW HEAD pointer csq->next_to_clean + */ + csq->next_to_clean = + hns3_roh_read(hroh_dev, HNS3_ROH_TX_CMDQ_HEAD_REG); dev_err(hroh_dev->dev, "cmdq is full, opcode %x\n", desc->opcode); return -EBUSY; } @@ -241,49 +246,96 @@ static int hns3_roh_cmdq_build(struct hns3_roh_device *hroh_dev, return 0; } -static int hns3_roh_cmdq_done_parse(struct hns3_roh_device *hroh_dev, - struct hns3_roh_desc *desc, - int num, int ntc) +static void hns3_roh_cmd_wait_for_resp(struct hns3_roh_device *hroh_dev, + bool *is_completed) { struct hns3_roh_priv *priv = (struct hns3_roh_priv *)hroh_dev->priv; - struct hns3_roh_cmdq_ring *csq = &priv->cmdq.csq; - struct hns3_roh_desc *desc_to_use = NULL; - int handle = 0; - u16 desc_ret; - int ret; + u32 timeout = 0; - if (hns3_roh_cmdq_csq_done(hroh_dev)) { - while (handle < num) { - desc_to_use = &csq->desc[ntc]; - desc[handle] = *desc_to_use; - desc_ret = le16_to_cpu(desc[handle].retval); - if (desc_ret == HNS3_ROH_CMD_EXEC_SUCCESS) { - ret = 0; - } else if (desc_ret == HNS3_ROH_CMD_EXEC_TIMEOUT) { - priv->cmdq.last_status = desc_ret; - ret = -ETIME; - } else { - pr_err("desc_ret = %d\n", desc_ret); - ret = -EIO; - } - - ntc++; - handle++; - if (ntc == csq->desc_num) - ntc = 0; + do { + if (hns3_roh_cmdq_csq_done(hroh_dev)) { + *is_completed = true; + break; } - } else { - ret = -EAGAIN; + udelay(1); + timeout++; + } while (timeout < priv->cmdq.tx_timeout); +} + +static const u16 spec_opcode[] = { HNS3_ROH_OPC_QUERY_MIB_PUBLIC, + HNS3_ROH_OPC_QUERY_MIB_PRIVATE }; + +static bool hns_roh_is_special_opcode(u16 opcode) +{ + /* these commands have several descriptors, + * and use the first one to save opcode and return value + */ + u32 i; + + for (i = 0; i < ARRAY_SIZE(spec_opcode); i++) + if (spec_opcode[i] == opcode) + return true; + + return false; +} + +static int hns3_roh_cmd_convert_err_code(u16 desc_ret) +{ + struct hns3_roh_errcode hns3_roh_cmd_errcode[] = { + { HNS3_ROH_CMD_EXEC_SUCCESS, 0 }, + { HNS3_ROH_CMD_NO_AUTH, -EPERM }, + { HNS3_ROH_CMD_NOT_SUPPORTED, -EOPNOTSUPP }, + { HNS3_ROH_CMD_QUEUE_FULL, -EXFULL }, + { HNS3_ROH_CMD_NEXT_ERR, -ENOSR }, + { HNS3_ROH_CMD_UNEXE_ERR, -ENOTBLK }, + { HNS3_ROH_CMD_PARA_ERR, -EINVAL }, + { HNS3_ROH_CMD_RESULT_ERR, -ERANGE }, + { HNS3_ROH_CMD_TIMEOUT, -ETIME }, + { HNS3_ROH_CMD_HILINK_ERR, -ENOLINK }, + { HNS3_ROH_CMD_QUEUE_ILLEGAL, -ENXIO }, + { HNS3_ROH_CMD_INVALID, -EBADR }, + }; + u32 errcode_count = ARRAY_SIZE(hns3_roh_cmd_errcode); + u32 i; + + for (i = 0; i < errcode_count; i++) + if (hns3_roh_cmd_errcode[i].imp_errcode == desc_ret) + return hns3_roh_cmd_errcode[i].common_errno; + + return -EIO; +} + +static int hns3_roh_cmd_check_retval(struct hns3_roh_device *hroh_dev, + struct hns3_roh_desc *desc, int num, + int next_to_clean) +{ + struct hns3_roh_priv *priv = (struct hns3_roh_priv *)hroh_dev->priv; + int ntc = next_to_clean; + u16 opcode, desc_ret; + int handle; + + opcode = le16_to_cpu(desc[0].opcode); + for (handle = 0; handle < num; handle++) { + desc[handle] = priv->cmdq.csq.desc[ntc]; + ntc++; + if (ntc >= priv->cmdq.csq.desc_num) + ntc = 0; } + if (likely(!hns_roh_is_special_opcode(opcode))) + desc_ret = le16_to_cpu(desc[num - 1].retval); + else + desc_ret = le16_to_cpu(desc[0].retval); - return ret; + priv->cmdq.last_status = desc_ret; + + return hns3_roh_cmd_convert_err_code(desc_ret); } int hns3_roh_cmdq_send(struct hns3_roh_device *hroh_dev, struct hns3_roh_desc *desc, int num) { struct hns3_roh_priv *priv = (struct hns3_roh_priv *)hroh_dev->priv; struct hns3_roh_cmdq_ring *csq = &priv->cmdq.csq; - u32 timeout = 0; + bool is_completed = false; int handle = 0; int ntc = 0; int ret = 0; @@ -298,16 +350,13 @@ int hns3_roh_cmdq_send(struct hns3_roh_device *hroh_dev, struct hns3_roh_desc *d /* Write to hardware */ hns3_roh_write(hroh_dev, HNS3_ROH_TX_CMDQ_TAIL_REG, csq->next_to_use); - if (desc->flag & cpu_to_le16(HNS3_ROH_CMD_FLAG_NO_INTR)) { - do { - if (hns3_roh_cmdq_csq_done(hroh_dev)) - break; - udelay(1); - timeout++; - } while (timeout < priv->cmdq.tx_timeout); - } + if (le16_to_cpu(desc->flag) & HNS3_ROH_CMD_FLAG_NO_INTR) + hns3_roh_cmd_wait_for_resp(hroh_dev, &is_completed); - ret = hns3_roh_cmdq_done_parse(hroh_dev, desc, num, ntc); + if (!is_completed) + ret = -EBADE; + else + ret = hns3_roh_cmd_check_retval(hroh_dev, desc, num, ntc); handle = hns3_roh_cmdq_csq_clean(hroh_dev); if (handle != num) diff --git a/drivers/roh/hw/hns3/hns3_cmdq.h b/drivers/roh/hw/hns3/hns3_cmdq.h index 0176c93d0..224fe1d30 100644 --- a/drivers/roh/hw/hns3/hns3_cmdq.h +++ b/drivers/roh/hw/hns3/hns3_cmdq.h @@ -28,21 +28,28 @@ enum hns3_roh_opcode_type { HNS3_ROH_OPC_GET_INTR_INFO = 0x0023, HNS3_ROH_OPC_QUERY_PORT_LINK_STATUS = 0x038a, HNS3_ROH_OPC_SET_EID = 0x9001, - HNS3_ROH_OPC_GET_GUID = 0x9002, HNS3_ROH_OPC_QUERY_MIB_PUBLIC = 0x9005, HNS3_ROH_OPC_QUERY_MIB_PRIVATE = 0x9006, }; +struct hns3_roh_errcode { + u32 imp_errcode; + int common_errno; +}; + enum hns3_roh_cmd_return_status { - HNS3_ROH_CMD_EXEC_SUCCESS = 0, - HNS3_ROH_CMD_NO_AUTH, - HNS3_ROH_CMD_NOT_EXIST, - HNS3_ROH_CMD_QUEUE_FULL, - HNS3_ROH_CMD_NEXT_ERR, - HNS3_ROH_CMD_NOT_EXEC, - HNS3_ROH_CMD_PARA_ERR, - HNS3_ROH_CMD_RESULT_ERR, - HNS3_ROH_CMD_EXEC_TIMEOUT + HNS3_ROH_CMD_EXEC_SUCCESS = 0, + HNS3_ROH_CMD_NO_AUTH = 1, + HNS3_ROH_CMD_NOT_SUPPORTED = 2, + HNS3_ROH_CMD_QUEUE_FULL = 3, + HNS3_ROH_CMD_NEXT_ERR = 4, + HNS3_ROH_CMD_UNEXE_ERR = 5, + HNS3_ROH_CMD_PARA_ERR = 6, + HNS3_ROH_CMD_RESULT_ERR = 7, + HNS3_ROH_CMD_TIMEOUT = 8, + HNS3_ROH_CMD_HILINK_ERR = 9, + HNS3_ROH_CMD_QUEUE_ILLEGAL = 10, + HNS3_ROH_CMD_INVALID = 11, }; enum hns3_roh_mbx_opcode { @@ -69,11 +76,6 @@ struct hns3_roh_set_eid_info { u8 rsv[16]; }; -struct hns3_roh_get_guid_info { - u8 guid[16]; - u8 rsv[8]; -}; - struct hns3_roh_query_link_status_info { __le32 query_link_status; u8 rsv[20]; diff --git a/drivers/roh/hw/hns3/hns3_main.c b/drivers/roh/hw/hns3/hns3_main.c index 9c618c191..64f9a13e5 100644 --- a/drivers/roh/hw/hns3/hns3_main.c +++ b/drivers/roh/hw/hns3/hns3_main.c @@ -77,7 +77,6 @@ static int hns3_roh_register_device(struct hns3_roh_device *hroh_dev) rohdev->netdev = hroh_dev->netdev; rohdev->ops.set_eid = hns3_roh_set_eid; - rohdev->ops.query_guid = hns3_roh_query_guid; rohdev->ops.alloc_hw_stats = hns3_roh_alloc_hw_stats; rohdev->ops.get_hw_stats = hns3_roh_get_hw_stats; @@ -332,10 +331,8 @@ static int hns3_roh_init_instance(struct hnae3_handle *handle) int ret; id = pci_match_id(hns3_roh_pci_tbl, handle->pdev); - if (!id) { - dev_err(dev, "failed to match pci id.\n"); + if (!id) return 0; - } if (id->driver_data) { dev_err(dev, "not support vf.\n"); @@ -562,8 +559,9 @@ static void hns3_roh_dfx_init(struct hns3_roh_device *hroh_dev) if (IS_ERR_OR_NULL(hroh_dev->dfx_debugfs)) return; - entry = debugfs_create_file("hns3_roh_dfx", 0600, hroh_dev->dfx_debugfs, - hroh_dev, &hns3_roh_dfx_cmd_fops); + entry = debugfs_create_file("hns3_roh_dfx", 0600, + hroh_dev->dfx_debugfs, hroh_dev, + &hns3_roh_dfx_cmd_fops); if (IS_ERR_OR_NULL(entry)) { debugfs_remove_recursive(hroh_dev->dfx_debugfs); hroh_dev->dfx_debugfs = NULL; diff --git a/drivers/roh/hw/hns3/hns3_verbs.c b/drivers/roh/hw/hns3/hns3_verbs.c index 8171f9756..b4d23d66c 100644 --- a/drivers/roh/hw/hns3/hns3_verbs.c +++ b/drivers/roh/hw/hns3/hns3_verbs.c @@ -3,8 +3,8 @@ #include "core.h" -#include "hns3_verbs.h" #include "hns3_cmdq.h" +#include "hns3_verbs.h" int hns3_roh_set_eid(struct roh_device *rohdev, struct roh_eid_attr *eid_attr) { @@ -28,26 +28,6 @@ int hns3_roh_set_eid(struct roh_device *rohdev, struct roh_eid_attr *eid_attr) return 0; } -int hns3_roh_query_guid(struct roh_device *rohdev, struct roh_guid_attr *guid_attr) -{ - struct hns3_roh_device *hroh_dev = to_hroh_dev(rohdev); - struct hns3_roh_get_guid_info *req; - struct hns3_roh_desc desc; - int ret; - - hns3_roh_cmdq_setup_basic_desc(&desc, HNS3_ROH_OPC_GET_GUID, true); - ret = hns3_roh_cmdq_send(hroh_dev, &desc, 1); - if (ret) { - dev_err(hroh_dev->dev, "failed to query guid, ret = %d\n", ret); - return ret; - } - - req = (struct hns3_roh_get_guid_info *)desc.data; - memcpy(guid_attr->data, req->guid, sizeof(req->guid)); - - return 0; -} - static const char * const hns3_roh_hw_stats_name_public[] = { "mac_tx_packet_num", "mac_rx_packet_num", diff --git a/drivers/roh/hw/hns3/hns3_verbs.h b/drivers/roh/hw/hns3/hns3_verbs.h index 152d9b162..f72d0f643 100644 --- a/drivers/roh/hw/hns3/hns3_verbs.h +++ b/drivers/roh/hw/hns3/hns3_verbs.h @@ -7,7 +7,6 @@ #include "hns3_common.h" int hns3_roh_set_eid(struct roh_device *rohdev, struct roh_eid_attr *eid_attr); -int hns3_roh_query_guid(struct roh_device *rohdev, struct roh_guid_attr *guid_attr); struct roh_mib_stats *hns3_roh_alloc_hw_stats(struct roh_device *rohdev, enum roh_mib_type mib_type); int hns3_roh_get_hw_stats(struct roh_device *rohdev, struct roh_mib_stats *stats, -- 2.30.0

2 1

[PATCH PATCH OLK-5.10 0/2] bugfix the lost interruption problem after live migration
by liulongfang 08 Jun '23

08 Jun '23

The problem of service interruption and loss may be triggered during live migration. In order to ensure normal business, it is necessary to resend an interrupt in the live migration driver. And in the QM service driver, it is guaranteed that the retransmission interrupt can be received normally. Longfang Liu (2): crypto: hisilicon/qm - fix EQ/AEQ interrupt issue vfio/migration: bugfix lost interruption after live migration .../hisilicon/migration/acc_vf_migration.c | 66 +++++++---- .../hisilicon/migration/acc_vf_migration.h | 2 + drivers/crypto/hisilicon/qm.c | 107 +++++++----------- include/linux/hisi_acc_qm.h | 1 + 4 files changed, 86 insertions(+), 90 deletions(-) -- 2.24.0

1 2

[PATCH OLK-5.10] drivers/perf: hisi: Fix incorrect get one active cpu
by Junhao He 08 Jun '23

08 Jun '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7BUN2 CVE: NA ---------------------------------------------------------------------- When a cpu going offline, it may be returned by function cpumask_first(). If this happens, the PCIe PMU context is still migrated to the old cpu. Then the CPU continues to run offline processing, which also leads to the call trace. ... [ 368.104662][ T932] task:cpuhp/0 state:D stack: 0 pid: 15 ppid: 2 flags:0x00000008 [ 368.113699][ T932] Call trace: [ 368.116834][ T932] __switch_to+0x7c/0xbc [ 368.120924][ T932] __schedule+0x338/0x6f0 [ 368.125098][ T932] schedule+0x50/0xe0 [ 368.128926][ T932] schedule_preempt_disabled+0x18/0x24 [ 368.134229][ T932] __mutex_lock.constprop.0+0x1d4/0x5dc [ 368.139617][ T932] __mutex_lock_slowpath+0x1c/0x30 [ 368.144573][ T932] mutex_lock+0x50/0x60 [ 368.148579][ T932] perf_pmu_migrate_context+0x84/0x2b0 [ 368.153884][ T932] hisi_pcie_pmu_offline_cpu+0x90/0xe0 [hisi_pcie_pmu] [ 368.160579][ T932] cpuhp_invoke_callback+0x2a0/0x650 [ 368.165707][ T932] cpuhp_thread_fun+0xe4/0x190 [ 368.170316][ T932] smpboot_thread_fn+0x15c/0x1a0 [ 368.175099][ T932] kthread+0x108/0x13c [ 368.179012][ T932] ret_from_fork+0x10/0x18 ... Use function cpumask_any_but() to find one correct active cpu to fixes this issue. Fixes: 8404b0fbc7fb ("drivers/perf: hisi: Add driver for HiSilicon PCIe PMU") Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- drivers/perf/hisilicon/hisi_pcie_pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/perf/hisilicon/hisi_pcie_pmu.c b/drivers/perf/hisilicon/hisi_pcie_pmu.c index 88d488765203..8f59387aeab0 100644 --- a/drivers/perf/hisilicon/hisi_pcie_pmu.c +++ b/drivers/perf/hisilicon/hisi_pcie_pmu.c @@ -689,7 +689,7 @@ static int hisi_pcie_pmu_offline_cpu(unsigned int cpu, struct hlist_node *node) pcie_pmu->on_cpu = -1; /* Choose a new CPU from all online cpus. */ - target = cpumask_first(cpu_online_mask); + target = cpumask_any_but(cpu_online_mask, cpu); if (target >= nr_cpu_ids) { pci_err(pcie_pmu->pdev, "There is no CPU to set\n"); return 0; -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS 0/2] smart grid scheduler
by Wang ShaoBo 08 Jun '23

08 Jun '23

v6: ��OK��OK�� ,��mask��level0�� v5: ��pelt. ��review��. v4: fix KABI add 'cpu.affinity_domain_mask' add some statistics v3: ��patchwork��KABI�� v2: formal version 1. Hui Tang (1): sched: Introduce smart grid scheduling strategy for cfs Wang ShaoBo (1): sched: smart grid: init sched_grid_qos structure on QOS purpose fs/proc/array.c | 13 + include/linux/sched.h | 18 ++ include/linux/sched/grid_qos.h | 92 +++++++ include/linux/sched/sysctl.h | 4 + init/Kconfig | 13 + kernel/fork.c | 9 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 145 +++++++++++ kernel/sched/fair.c | 437 ++++++++++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 10 + kernel/sched/grid/qos.c | 126 ++++++++++ kernel/sched/grid/stat.c | 15 ++ kernel/sched/sched.h | 50 ++++ kernel/sysctl.c | 9 + mm/mempolicy.c | 12 +- 17 files changed, 959 insertions(+), 3 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS 1/3] nbd: get config_lock before sock_shutdown
by Yongqiang Liu 07 Jun '23

07 Jun '23

From: Zhong Jinghua <zhongjinghua(a)huaweicloud.com> hulk inclusion category: bugfix bugzilla: 188799, https://gitee.com/openeuler/kernel/issues/I79QWO CVE: NA ---------------------------------------- Config->socks in sock_shutdown may trigger a UAF problem. The reason is that sock_shutdown does not hold the config_lock, so that nbd_ioctl can release config->socks at this time. T0: NBD_SET_SOCK T1: NBD_DO_IT T0 T1 nbd_ioctl mutex_lock(&nbd->config_lock) // get lock __nbd_ioctl nbd_start_device_ioctl nbd_start_device mutex_unlock(&nbd->config_lock) // relase lock wait_event_interruptible (kill, enter sock_shutdown) sock_shutdown nbd_ioctl mutex_lock(&nbd->config_lock) // get lock __nbd_ioctl nbd_add_socket krealloc kfree(p) //config->socks is NULL nbd_sock *nsock = config->socks // error Fix it by moving config_lock up before sock_shutdown. Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/block/nbd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 551b2f7da8ef..a08f35946718 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1347,11 +1347,16 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b mutex_unlock(&nbd->config_lock); ret = wait_event_interruptible(config->recv_wq, atomic_read(&config->recv_threads) == 0); + + /* + * recv_work in flush_workqueue will not get this lock, because nbd_open + * will hold nbd->config_refs + */ + mutex_lock(&nbd->config_lock); if (ret) sock_shutdown(nbd); flush_workqueue(nbd->recv_workq); - mutex_lock(&nbd->config_lock); nbd_bdev_reset(bdev); /* user requested, ignore socket errors */ if (test_bit(NBD_RT_DISCONNECT_REQUESTED, &config->runtime_flags)) -- 2.25.1

1 2

[PATCH OLK-5.10 0/2] ubi: Fix deadlock caused by recursively holding work_sem
by ZhaoLong Wang 07 Jun '23

07 Jun '23

Fix deadlock caused by recursively holding work_sem Lee Jones (1): mtd: ubi: wl: Fix a couple of kernel-doc issues ZhaoLong Wang (1): ubi: Fix deadlock caused by recursively holding work_sem drivers/mtd/ubi/wl.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 0/4] io_uring: fix the problem of running
by Li Lingfeng 07 Jun '23

07 Jun '23

patch1: arch: setup PF_IO_WORKER threads like PF_KTHREAD pre patch of patch4 patch2: arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() fix patch of patch1 patch3: kernel: don't call do_exit() for PF_IO_WORKER threads fix the segfault patch4: x86/process: setup io_threads more like normal user space threads allow io worker to exit Jens Axboe (3): arch: setup PF_IO_WORKER threads like PF_KTHREAD arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() kernel: don't call do_exit() for PF_IO_WORKER threads Stefan Metzmacher (1): x86/process: setup io_threads more like normal user space threads arch/alpha/kernel/process.c | 2 +- arch/arc/kernel/process.c | 2 +- arch/arm/kernel/process.c | 2 +- arch/arm64/kernel/process.c | 2 +- arch/csky/kernel/process.c | 2 +- arch/h8300/kernel/process.c | 2 +- arch/hexagon/kernel/process.c | 2 +- arch/ia64/kernel/process.c | 2 +- arch/m68k/kernel/process.c | 2 +- arch/microblaze/kernel/process.c | 2 +- arch/mips/kernel/process.c | 2 +- arch/nds32/kernel/process.c | 2 +- arch/nios2/kernel/process.c | 2 +- arch/openrisc/kernel/process.c | 2 +- arch/parisc/kernel/process.c | 2 +- arch/powerpc/kernel/process.c | 2 +- arch/riscv/kernel/process.c | 2 +- arch/s390/kernel/process.c | 2 +- arch/sh/kernel/process_32.c | 2 +- arch/sparc/kernel/process_32.c | 2 +- arch/sparc/kernel/process_64.c | 2 +- arch/um/kernel/process.c | 2 +- arch/x86/kernel/process.c | 17 +++++++++++++++++ arch/xtensa/kernel/process.c | 2 +- kernel/signal.c | 10 +++++++++- 25 files changed, 49 insertions(+), 24 deletions(-) -- 2.31.1

2 5

[PATCH OLK-5.10 0/4] crypto: hisilicon - fix mailbox operation process
by Weili Qian 07 Jun '23

07 Jun '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> The mailbox of the Kunpeng accelerator is a special operation. Data(128 bits) needs to be read from hardware or written to hardware at one time. And the operation cannot be canceled by software. Therefore, the software process needs to be modified to avoid mailbox operation errors. Weili Qian (4): crypto: hisilicon/qm - obtain the mailbox configuration at one time vfio/migration: obtain the mailbox configuration at one time crypto: hisilicon/qm - fix the pf2vf timeout when device reset crypto: hisilicon/qm - alloc buffer to set and get xqc drivers/crypto/hisilicon/debugfs.c | 75 +-- .../hisilicon/migration/acc_vf_migration.c | 176 +++--- .../hisilicon/migration/acc_vf_migration.h | 8 +- drivers/crypto/hisilicon/qm.c | 532 +++++++++--------- drivers/crypto/hisilicon/qm_common.h | 5 +- include/linux/hisi_acc_qm.h | 18 +- 6 files changed, 429 insertions(+), 385 deletions(-) -- 2.30.0

1 4

[PATCH OLK-5.10] kobject: Fix slab-out-of-bounds in fill_kobj_path()
by Xia Fukun 07 Jun '23

07 Jun '23

mainline inclusion from mainline-v6.4-rc3 commit 3bb2a01caa813d3a1845d378bbe4169ef280d394 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I697JG CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------- In kobject_get_path(), if kobj->name is changed between calls get_kobj_path_length() and fill_kobj_path() and the length becomes longer, then fill_kobj_path() will have an out-of-bounds bug. The actual current problem occurs when the ixgbe probe. In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name length becomes longer, out-of-bounds will occur. cpu0 cpu1 ixgbe_probe register_netdev(netdev) netdev_register_kobject device_add kobject_uevent // Sending ADD events systemd-udevd // rename netdev dev_change_name device_rename kobject_rename ixgbe_mii_bus_init | mdiobus_register | __mdiobus_register | device_register | device_add | kobject_uevent | kobject_get_path | len = get_kobj_path_length // old name | path = kzalloc(len, gfp_mask); | kobj->name = name; /* name length becomes * longer */ fill_kobj_path /* kobj path length is * longer than path, * resulting in out of * bounds when filling path */ This is the kasan report: ================================================================== BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0 Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673 Workqueue: events work_for_cpu_fn Call Trace: <TASK> dump_stack_lvl+0x34/0x48 print_address_description.constprop.0+0x86/0x1e7 print_report+0x36/0x4f kasan_report+0xad/0x130 kasan_check_range+0x35/0x1c0 memcpy+0x39/0x60 fill_kobj_path+0x50/0xc0 kobject_get_path+0x5a/0xc0 kobject_uevent_env+0x140/0x460 device_add+0x5c7/0x910 __mdiobus_register+0x14e/0x490 ixgbe_probe.cold+0x441/0x574 [ixgbe] local_pci_probe+0x78/0xc0 work_for_cpu_fn+0x26/0x40 process_one_work+0x3b6/0x6a0 worker_thread+0x368/0x520 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 This reproducer triggers that bug: while: do rmmod ixgbe sleep 0.5 modprobe ixgbe sleep 0.5 When calling fill_kobj_path() to fill path, if the name length of kobj becomes longer, return failure and retry. This fixes the problem. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Link: https://lore.kernel.org/r/20221220012143.52141-1-wanghai38@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- lib/kobject.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/lib/kobject.c b/lib/kobject.c index ea53b30cf483..617a25ec355d 100644 --- a/lib/kobject.c +++ b/lib/kobject.c @@ -144,7 +144,7 @@ static int get_kobj_path_length(struct kobject *kobj) return length; } -static void fill_kobj_path(struct kobject *kobj, char *path, int length) +static int fill_kobj_path(struct kobject *kobj, char *path, int length) { struct kobject *parent; @@ -153,12 +153,16 @@ static void fill_kobj_path(struct kobject *kobj, char *path, int length) int cur = strlen(kobject_name(parent)); /* back up enough to print this name with '/' */ length -= cur; + if (length <= 0) + return -EINVAL; memcpy(path + length, kobject_name(parent), cur); *(path + --length) = '/'; } pr_debug("kobject: '%s' (%p): %s: path = '%s'\n", kobject_name(kobj), kobj, __func__, path); + + return 0; } /** @@ -173,13 +177,17 @@ char *kobject_get_path(struct kobject *kobj, gfp_t gfp_mask) char *path; int len; +retry: len = get_kobj_path_length(kobj); if (len == 0) return NULL; path = kzalloc(len, gfp_mask); if (!path) return NULL; - fill_kobj_path(kobj, path, len); + if (fill_kobj_path(kobj, path, len)) { + kfree(path); + goto retry; + } return path; } -- 2.17.1

2 1

[PATCH OLK-5.10 0/2] Fix ORC unwinder on paravirt {save,restore}_fl
by Chen Zhongjin 07 Jun '23

07 Jun '23

ISSUE: gitee.com/openeuler/kernel/issues/I6DK3O Chen Zhongjin (2): x86/unwind: Fix orc entry for paravirt {save,restore}_fl x86/unwind: Fix check_paravirt() calls orc_find() before declaration arch/x86/kernel/unwind_orc.c | 45 +++++++++++++++++++++++++++++++++++- 1 file changed, 44 insertions(+), 1 deletion(-) -- 2.17.1

2 3

[PATCH OLK-5.10 0/6] Support dynamic_hugetlb on arm64 and fix some bug
by Liu Shixin 07 Jun '23

07 Jun '23

Support dynamic_hugetlb on arm64 and fix some bug. Liu Shixin (6): mm/dynamic_hugetlb: fix kabi broken when enable CONFIG_DYNAMIC_HUGETLB on arm64 mm/dynamic_hugetlb: support dynamic hugetlb on arm64 mm/dynamic_hugetlb: isolate hugepage without dissolve mm/dynamic_hugetlb: replace spin_lock with mutex_lock and fix kabi broken mm/dynamic_hugetlb: set PagePool to bad page mm/dynamic_hugetlb: fix type error of pfn in __hpool_split_gigantic_page() fs/Kconfig | 2 +- fs/hugetlbfs/inode.c | 2 +- include/linux/dynamic_hugetlb.h | 24 +++++++++++++-- include/linux/memcontrol.h | 6 +++- mm/dynamic_hugetlb.c | 54 +++++++++++++++++++++++++++------ mm/hugetlb.c | 7 +++++ 6 files changed, 80 insertions(+), 15 deletions(-) -- 2.25.1

2 7

[PATCH 0/4] crypto: hisilicon - fix mailbox operation process
by Weili Qian 07 Jun '23

07 Jun '23

The mailbox of the Kunpeng accelerator is a special operation. Data(128 bits) needs to be read from hardware or written to hardware at one time. And the operation cannot be canceled by software. Therefore, the software process needs to be modified to avoid mailbox operation errors. Weili Qian (4): crypto: hisilicon/qm - obtain the mailbox configuration at one time vfio/migration: obtain the mailbox configuration at one time crypto: hisilicon/qm - fix the pf2vf timeout when device reset crypto: hisilicon/qm - alloc buffer to set and get xqc drivers/crypto/hisilicon/debugfs.c | 75 +-- .../hisilicon/migration/acc_vf_migration.c | 176 +++--- .../hisilicon/migration/acc_vf_migration.h | 8 +- drivers/crypto/hisilicon/qm.c | 532 +++++++++--------- drivers/crypto/hisilicon/qm_common.h | 5 +- include/linux/hisi_acc_qm.h | 18 +- 6 files changed, 429 insertions(+), 385 deletions(-) -- 2.30.0

1 4

[PATCH OLK-5.10] kobject: Fix slab-out-of-bounds in fill_kobj_path()
by Xia Fukun 07 Jun '23

07 Jun '23

mainline inclusion from mainline-v6.4-rc3 commit 3bb2a01caa813d3a1845d378bbe4169ef280d394 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I697JG CVE: NA ---------------------------------------- In kobject_get_path(), if kobj->name is changed between calls get_kobj_path_length() and fill_kobj_path() and the length becomes longer, then fill_kobj_path() will have an out-of-bounds bug. The actual current problem occurs when the ixgbe probe. In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name length becomes longer, out-of-bounds will occur. cpu0 cpu1 ixgbe_probe register_netdev(netdev) netdev_register_kobject device_add kobject_uevent // Sending ADD events systemd-udevd // rename netdev dev_change_name device_rename kobject_rename ixgbe_mii_bus_init | mdiobus_register | __mdiobus_register | device_register | device_add | kobject_uevent | kobject_get_path | len = get_kobj_path_length // old name | path = kzalloc(len, gfp_mask); | kobj->name = name; /* name length becomes * longer */ fill_kobj_path /* kobj path length is * longer than path, * resulting in out of * bounds when filling path */ This is the kasan report: ================================================================== BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0 Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673 Workqueue: events work_for_cpu_fn Call Trace: <TASK> dump_stack_lvl+0x34/0x48 print_address_description.constprop.0+0x86/0x1e7 print_report+0x36/0x4f kasan_report+0xad/0x130 kasan_check_range+0x35/0x1c0 memcpy+0x39/0x60 fill_kobj_path+0x50/0xc0 kobject_get_path+0x5a/0xc0 kobject_uevent_env+0x140/0x460 device_add+0x5c7/0x910 __mdiobus_register+0x14e/0x490 ixgbe_probe.cold+0x441/0x574 [ixgbe] local_pci_probe+0x78/0xc0 work_for_cpu_fn+0x26/0x40 process_one_work+0x3b6/0x6a0 worker_thread+0x368/0x520 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 This reproducer triggers that bug: while: do rmmod ixgbe sleep 0.5 modprobe ixgbe sleep 0.5 When calling fill_kobj_path() to fill path, if the name length of kobj becomes longer, return failure and retry. This fixes the problem. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Link: https://lore.kernel.org/r/20221220012143.52141-1-wanghai38@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- lib/kobject.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/lib/kobject.c b/lib/kobject.c index ea53b30cf483..617a25ec355d 100644 --- a/lib/kobject.c +++ b/lib/kobject.c @@ -144,7 +144,7 @@ static int get_kobj_path_length(struct kobject *kobj) return length; } -static void fill_kobj_path(struct kobject *kobj, char *path, int length) +static int fill_kobj_path(struct kobject *kobj, char *path, int length) { struct kobject *parent; @@ -153,12 +153,16 @@ static void fill_kobj_path(struct kobject *kobj, char *path, int length) int cur = strlen(kobject_name(parent)); /* back up enough to print this name with '/' */ length -= cur; + if (length <= 0) + return -EINVAL; memcpy(path + length, kobject_name(parent), cur); *(path + --length) = '/'; } pr_debug("kobject: '%s' (%p): %s: path = '%s'\n", kobject_name(kobj), kobj, __func__, path); + + return 0; } /** @@ -173,13 +177,17 @@ char *kobject_get_path(struct kobject *kobj, gfp_t gfp_mask) char *path; int len; +retry: len = get_kobj_path_length(kobj); if (len == 0) return NULL; path = kzalloc(len, gfp_mask); if (!path) return NULL; - fill_kobj_path(kobj, path, len); + if (fill_kobj_path(kobj, path, len)) { + kfree(path); + goto retry; + } return path; } -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS v5 0/2] introduce smart grid scheduler.
by Wang ShaoBo 07 Jun '23

07 Jun '23

introduce smart grid scheduler. v5: 调度部分已完成评审完成代码修改，逃逸部分仍然使用pelt. 内存策略调整模块已经按照review已将进行修改. v4: fix KABI add 'cpu.affinity_domain_mask' add some statistics v3: 修改了patchwork错误，但是KABI还有个问题待解决。 v2: formal version 1. Hui Tang (1): sched: Introduce smart grid scheduling strategy for cfs Wang ShaoBo (1): sched: smart grid: init sched_grid_qos structure on QOS purpose fs/proc/array.c | 13 + include/linux/sched.h | 18 ++ include/linux/sched/grid_qos.h | 84 +++++++ include/linux/sched/sysctl.h | 4 + init/Kconfig | 13 + kernel/fork.c | 9 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 147 ++++++++++++ kernel/sched/fair.c | 425 ++++++++++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 10 + kernel/sched/grid/qos.c | 125 ++++++++++ kernel/sched/grid/stat.c | 15 ++ kernel/sched/sched.h | 50 ++++ kernel/sysctl.c | 9 + mm/mempolicy.c | 12 +- 17 files changed, 940 insertions(+), 3 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.25.1

1 2

[PATCH OLK-5.10 0/2] block: iocost bugfix
by Li Nan 07 Jun '23

07 Jun '23

This patch series fix iocost life cycle bug. Li Nan (2): block: fix null-pointer dereference in ioc_pd_init block: fix order error in blk_release_queue block/blk-core.c | 2 -- block/blk-sysfs.c | 2 ++ 2 files changed, 2 insertions(+), 2 deletions(-) -- 2.39.2

1 2

[PATCH OLK-5.10 00/35] xfs: fixes patchs and backport patchs
by Long Li 07 Jun '23

07 Jun '23

Allison Henderson (1): xfs: increase rename inode reservation ChenXiaoSong (1): xfs: fix NULL pointer dereference in xfs_getbmap() Darrick J. Wong (6): xfs: check return codes when flushing block devices xfs: fix maxlevels comparisons in the btree staging code xfs: shut down filesystem if we xfs_trans_cancel with deferred work items xfs: don't expose internal symlink metadata buffers to the vfs xfs: fix negative array access in xfs_getbmap iomap: iomap: fix memory corruption when recording errors during writeback Dave Chinner (13): xfs: remove xfs_blkdev_issue_flush xfs: AIL should be log centric xfs: shutdown in intent recovery has non-intent items in the AIL xfs: log shutdown triggers should only shut down the log xfs: xfs_do_force_shutdown needs to block racing shutdowns xfs: xfs_trans_commit() path must check for log shutdown xfs: shutdown during log recovery needs to mark the log shutdown xfs: remove XFS_PREALLOC_SYNC xfs: fallocate() should call file_modified() xfs: sb verifier doesn't handle uncached sb buffer xfs: write page faults in iomap are not buffered writes iomap: write iomap validity checks xfs: use iomap_valid method to detect stale cached iomaps Gao Xiang (1): xfs: account extra freespace btree splits for multiple allocations Guo Xuenan (3): Revert "[Huawei] xfs: fix uaf when leaf dir bestcount not match with dir data blocks" xfs: fix exception caused by unexpected illegal bestcount in leaf dir xfs: force shutdown xfs when xfs_attr_inactive fails Long Li (4): xfs: fix ag count overflow during growfs xfs: fix hung when transaction commit fail in xfs_inactive_ifree xfs: fix a UAF when inode item push xfs: fix a UAF in xfs_iflush_abort_clean Shida Zhang (1): xfs: trim the mapp array accordingly in xfs_da_grow_inode_int Wu Guanghao (1): xfs: fix the problem of mount failure caused by not refreshing mp->m_sb Ye Bin (2): xfs: fix BUG_ON in xfs_getbmap() xfs: fix dead loop when do mount with IO fault injection Zhang Yi (2): xfs: factor out __xfs_da3_node_read() xfs: atomic drop extent entries when inactiving attr fs/iomap/apply.c | 14 +++- fs/iomap/buffered-io.c | 29 ++++++++- fs/xfs/libxfs/xfs_alloc.c | 9 ++- fs/xfs/libxfs/xfs_alloc.h | 1 + fs/xfs/libxfs/xfs_bmap.c | 7 +- fs/xfs/libxfs/xfs_btree_staging.c | 4 +- fs/xfs/libxfs/xfs_da_btree.c | 7 +- fs/xfs/libxfs/xfs_da_btree.h | 15 ++++- fs/xfs/libxfs/xfs_dir2_leaf.c | 21 ++---- fs/xfs/libxfs/xfs_ialloc.c | 1 + fs/xfs/libxfs/xfs_sb.c | 2 +- fs/xfs/libxfs/xfs_trans_resv.c | 4 +- fs/xfs/xfs_aops.c | 2 +- fs/xfs/xfs_attr_inactive.c | 66 ++++++++++++++----- fs/xfs/xfs_bmap_util.c | 34 +++++----- fs/xfs/xfs_buf.c | 7 +- fs/xfs/xfs_buf.h | 7 +- fs/xfs/xfs_buf_item.c | 20 ++++++ fs/xfs/xfs_buf_item_recover.c | 24 +++++++ fs/xfs/xfs_file.c | 49 ++++++++------ fs/xfs/xfs_fsops.c | 9 ++- fs/xfs/xfs_inode.c | 5 +- fs/xfs/xfs_inode_item.c | 11 +++- fs/xfs/xfs_iomap.c | 105 ++++++++++++++++++++++++------ fs/xfs/xfs_iomap.h | 7 +- fs/xfs/xfs_iops.c | 34 +--------- fs/xfs/xfs_log.c | 68 +++++++++++++------ fs/xfs/xfs_log_cil.c | 4 +- fs/xfs/xfs_log_priv.h | 11 ++++ fs/xfs/xfs_log_recover.c | 56 ++++++---------- fs/xfs/xfs_mount.c | 1 + fs/xfs/xfs_pnfs.c | 12 ++-- fs/xfs/xfs_super.c | 7 -- fs/xfs/xfs_super.h | 1 - fs/xfs/xfs_symlink.c | 27 +++++--- fs/xfs/xfs_trans.c | 61 ++++++++++++----- fs/xfs/xfs_trans_ail.c | 30 ++++----- fs/xfs/xfs_trans_priv.h | 3 +- include/linux/iomap.h | 39 +++++++++-- 39 files changed, 549 insertions(+), 265 deletions(-) -- 2.31.1

2 36

[PATCH OLK-5.10] mm: page_counter: remove unneeded atomic ops for low/min
by Peng Zhang 07 Jun '23

07 Jun '23

From: Shakeel Butt <shakeelb(a)google.com> mainline inclusion from mainline-v6.1-rc1 commit cfdab60bfa66b2dc0391c9e405b8af6039924cd4 category: perf bugzilla: https://gitee.com/openeuler/kernel/issues/I7BHGR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Patch series "memcg: optimize charge codepath", v2. Recently Linux networking stack has moved from a very old per socket pre-charge caching to per-cpu caching to avoid pre-charge fragmentation and unwarranted OOMs. One impact of this change is that for network traffic workloads, memcg charging codepath can become a bottleneck. The kernel test robot has also reported this regression[1]. This patch series tries to improve the memcg charging for such workloads. This patch series implement three optimizations: (A) Reduce atomic ops in page counter update path. (B) Change layout of struct page_counter to eliminate false sharing between usage and high. (C) Increase the memcg charge batch to 64. To evaluate the impact of these optimizations, on a 72 CPUs machine, we ran the following workload in root memcg and then compared with scenario where the workload is run in a three level of cgroup hierarchy with top level having min and low setup appropriately. $ netserver -6 # 36 instances of netperf with following params $ netperf -6 -H ::1 -l 60 -t TCP_SENDFILE -- -m 10K Results (average throughput of netperf): 1. root memcg 21694.8 Mbps 2. 6.0-rc1 10482.7 Mbps (-51.6%) 3. 6.0-rc1 + (A) 14542.5 Mbps (-32.9%) 4. 6.0-rc1 + (B) 12413.7 Mbps (-42.7%) 5. 6.0-rc1 + (C) 17063.7 Mbps (-21.3%) 6. 6.0-rc1 + (A+B+C) 20120.3 Mbps (-7.2%) With all three optimizations, the memcg overhead of this workload has been reduced from 51.6% to just 7.2%. [1] https://lore.kernel.org/linux-mm/20220619150456.GB34471@xsang-OptiPlex-9020/ This patch (of 3): For cgroups using low or min protections, the function propagate_protected_usage() was doing an atomic xchg() operation irrespectively. We can optimize out this atomic operation for one specific scenario where the workload is using the protection (i.e. min > 0) and the usage is above the protection (i.e. usage > min). This scenario is actually very common where the users want a part of their workload to be protected against the external reclaim. Though this optimization does introduce a race when the usage is around the protection and concurrent charges and uncharged trip it over or under the protection. In such cases, we might see lower effective protection but the subsequent charge/uncharge will correct it. To evaluate the impact of this optimization, on a 72 CPUs machine, we ran the following workload in a three level of cgroup hierarchy with top level having min and low setup appropriately to see if this optimization is effective for the mentioned case. $ netserver -6 # 36 instances of netperf with following params $ netperf -6 -H ::1 -l 60 -t TCP_SENDFILE -- -m 10K Results (average throughput of netperf): Without (6.0-rc1) 10482.7 Mbps With patch 14542.5 Mbps (38.7% improvement) With the patch, the throughput improved by 38.7% Link: https://lkml.kernel.org/r/20220825000506.239406-1-shakeelb@google.com Link: https://lkml.kernel.org/r/20220825000506.239406-2-shakeelb@google.com Signed-off-by: Shakeel Butt <shakeelb(a)google.com> Reported-by: kernel test robot <oliver.sang(a)intel.com> Acked-by: Soheil Hassas Yeganeh <soheil(a)google.com> Reviewed-by: Feng Tang <feng.tang(a)intel.com> Acked-by: Roman Gushchin <roman.gushchin(a)linux.dev> Acked-by: Michal Hocko <mhocko(a)suse.com> Cc: Eric Dumazet <edumazet(a)google.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: "Michal Koutný" <mkoutny(a)suse.com> Cc: Muchun Song <songmuchun(a)bytedance.com> Cc: Oliver Sang <oliver.sang(a)intel.com> Cc: Soheil Hassas Yeganeh <soheil(a)google.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- mm/page_counter.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/mm/page_counter.c b/mm/page_counter.c index 6d8715e3255d..e67e54e836b1 100644 --- a/mm/page_counter.c +++ b/mm/page_counter.c @@ -17,24 +17,23 @@ static void propagate_protected_usage(struct page_counter *c, unsigned long usage) { unsigned long protected, old_protected; - unsigned long low, min; long delta; if (!c->parent) return; - min = READ_ONCE(c->min); - if (min || atomic_long_read(&c->min_usage)) { - protected = min(usage, min); + protected = min(usage, READ_ONCE(c->min)); + old_protected = atomic_long_read(&c->min_usage); + if (protected != old_protected) { old_protected = atomic_long_xchg(&c->min_usage, protected); delta = protected - old_protected; if (delta) atomic_long_add(delta, &c->parent->children_min_usage); } - low = READ_ONCE(c->low); - if (low || atomic_long_read(&c->low_usage)) { - protected = min(usage, low); + protected = min(usage, READ_ONCE(c->low)); + old_protected = atomic_long_read(&c->low_usage); + if (protected != old_protected) { old_protected = atomic_long_xchg(&c->low_usage, protected); delta = protected - old_protected; if (delta) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 1/3] dm thin: Fix ABBA deadlock by resetting dm_bufio_client
by Yongqiang Liu 07 Jun '23

07 Jun '23

From: Li Lingfeng <lilingfeng3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I79ZEK CVE: NA -------------------------------- As described in commit 273494b2cf1f ("dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata"), ABBA deadlock will be triggered since shrinker_rwsem need to be held when operations failed on dm pool metadata. We have noticed the following three problem scenarios: 1) Described by commit 273494b2cf1f ("dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata") 2) shrinker_rwsem and throttle->lock P1(drop cache) P2(kworker) drop_caches_sysctl_handler drop_slab shrink_slab down_read(&shrinker_rwsem) - LOCK A do_shrink_slab super_cache_scan prune_icache_sb dispose_list evict ext4_evict_inode ext4_clear_inode ext4_discard_preallocations ext4_mb_load_buddy_gfp ext4_mb_init_cache ext4_wait_block_bitmap __ext4_error ext4_handle_error ext4_commit_super ... dm_submit_bio do_worker throttle_work_update down_write(&t->lock) -- LOCK B process_deferred_bios commit metadata_operation_failed dm_pool_abort_metadata dm_block_manager_create dm_bufio_client_create register_shrinker down_write(&shrinker_rwsem) -- LOCK A thin_map thin_bio_map thin_defer_bio_with_throttle throttle_lock down_read(&t->lock) - LOCK B 3) shrinker_rwsem and wait_on_buffer P1(drop cache) P2(kworker) drop_caches_sysctl_handler drop_slab shrink_slab down_read(&shrinker_rwsem) - LOCK A do_shrink_slab ... ext4_wait_block_bitmap __ext4_error ext4_handle_error jbd2_journal_abort jbd2_journal_update_sb_errno jbd2_write_superblock submit_bh // LOCK B // RELEASE B do_worker throttle_work_update down_write(&t->lock) - LOCK B process_deferred_bios process_bio commit metadata_operation_failed dm_pool_abort_metadata dm_block_manager_create dm_bufio_client_create register_shrinker register_shrinker_prepared down_write(&shrinker_rwsem) - LOCK A bio_endio wait_on_buffer __wait_on_buffer Fix these by resetting dm_bufio_client without holding shrinker_rwsem. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/md/dm-bufio.c | 6 ++ drivers/md/dm-thin-metadata.c | 57 ++++++++----------- drivers/md/persistent-data/dm-block-manager.c | 6 ++ drivers/md/persistent-data/dm-block-manager.h | 1 + drivers/md/persistent-data/dm-space-map.h | 3 +- .../persistent-data/dm-transaction-manager.c | 3 + include/linux/dm-bufio.h | 2 + 7 files changed, 45 insertions(+), 33 deletions(-) diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c index b3b799f84dcc..0b41e1db4de9 100644 --- a/drivers/md/dm-bufio.c +++ b/drivers/md/dm-bufio.c @@ -1800,6 +1800,12 @@ void dm_bufio_client_destroy(struct dm_bufio_client *c) } EXPORT_SYMBOL_GPL(dm_bufio_client_destroy); +void dm_bufio_client_reset(struct dm_bufio_client *c) +{ + drop_buffers(c); +} +EXPORT_SYMBOL_GPL(dm_bufio_client_reset); + void dm_bufio_set_sector_offset(struct dm_bufio_client *c, sector_t start) { c->start = start; diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c index 26f04b84e8a2..e37f468cdbf0 100644 --- a/drivers/md/dm-thin-metadata.c +++ b/drivers/md/dm-thin-metadata.c @@ -533,6 +533,8 @@ static int __format_metadata(struct dm_pool_metadata *pmd) r = dm_tm_create_with_sm(pmd->bm, THIN_SUPERBLOCK_LOCATION, &pmd->tm, &pmd->metadata_sm); if (r < 0) { + pmd->tm = NULL; + pmd->metadata_sm = NULL; DMERR("tm_create_with_sm failed"); return r; } @@ -541,6 +543,7 @@ static int __format_metadata(struct dm_pool_metadata *pmd) if (IS_ERR(pmd->data_sm)) { DMERR("sm_disk_create failed"); r = PTR_ERR(pmd->data_sm); + pmd->data_sm = NULL; goto bad_cleanup_tm; } @@ -571,11 +574,15 @@ static int __format_metadata(struct dm_pool_metadata *pmd) bad_cleanup_nb_tm: dm_tm_destroy(pmd->nb_tm); + pmd->nb_tm = NULL; bad_cleanup_data_sm: dm_sm_destroy(pmd->data_sm); + pmd->data_sm = NULL; bad_cleanup_tm: dm_tm_destroy(pmd->tm); + pmd->tm = NULL; dm_sm_destroy(pmd->metadata_sm); + pmd->metadata_sm = NULL; return r; } @@ -641,6 +648,8 @@ static int __open_metadata(struct dm_pool_metadata *pmd) sizeof(disk_super->metadata_space_map_root), &pmd->tm, &pmd->metadata_sm); if (r < 0) { + pmd->tm = NULL; + pmd->metadata_sm = NULL; DMERR("tm_open_with_sm failed"); goto bad_unlock_sblock; } @@ -650,6 +659,7 @@ static int __open_metadata(struct dm_pool_metadata *pmd) if (IS_ERR(pmd->data_sm)) { DMERR("sm_disk_open failed"); r = PTR_ERR(pmd->data_sm); + pmd->data_sm = NULL; goto bad_cleanup_tm; } @@ -676,9 +686,12 @@ static int __open_metadata(struct dm_pool_metadata *pmd) bad_cleanup_data_sm: dm_sm_destroy(pmd->data_sm); + pmd->data_sm = NULL; bad_cleanup_tm: dm_tm_destroy(pmd->tm); + pmd->tm = NULL; dm_sm_destroy(pmd->metadata_sm); + pmd->metadata_sm = NULL; bad_unlock_sblock: dm_bm_unlock(sblock); @@ -725,9 +738,13 @@ static void __destroy_persistent_data_objects(struct dm_pool_metadata *pmd, bool destroy_bm) { dm_sm_destroy(pmd->data_sm); + pmd->data_sm = NULL; dm_sm_destroy(pmd->metadata_sm); + pmd->metadata_sm = NULL; dm_tm_destroy(pmd->nb_tm); + pmd->nb_tm = NULL; dm_tm_destroy(pmd->tm); + pmd->tm = NULL; if (destroy_bm) dm_block_manager_destroy(pmd->bm); } @@ -919,8 +936,7 @@ int dm_pool_metadata_close(struct dm_pool_metadata *pmd) __func__, r); } - if (!pmd->fail_io) - __destroy_persistent_data_objects(pmd, true); + __destroy_persistent_data_objects(pmd, true); kfree(pmd); return 0; @@ -1820,53 +1836,30 @@ static void __set_abort_with_changes_flags(struct dm_pool_metadata *pmd) int dm_pool_abort_metadata(struct dm_pool_metadata *pmd) { int r = -EINVAL; - struct dm_block_manager *old_bm = NULL, *new_bm = NULL; /* fail_io is double-checked with pmd->root_lock held below */ if (unlikely(pmd->fail_io)) return r; - /* - * Replacement block manager (new_bm) is created and old_bm destroyed outside of - * pmd root_lock to avoid ABBA deadlock that would result (due to life-cycle of - * shrinker associated with the block manager's bufio client vs pmd root_lock). - * - must take shrinker_rwsem without holding pmd->root_lock - */ - new_bm = dm_block_manager_create(pmd->bdev, THIN_METADATA_BLOCK_SIZE << SECTOR_SHIFT, - THIN_MAX_CONCURRENT_LOCKS); - down_write(&pmd->root_lock); if (pmd->fail_io) { up_write(&pmd->root_lock); - goto out; + return r; } __set_abort_with_changes_flags(pmd); + + /* destroy data_sm/metadata_sm/nb_tm/tm */ __destroy_persistent_data_objects(pmd, false); - old_bm = pmd->bm; - if (IS_ERR(new_bm)) { - DMERR("could not create block manager during abort"); - pmd->bm = NULL; - r = PTR_ERR(new_bm); - goto out_unlock; - } - pmd->bm = new_bm; + /* reset bm */ + dm_block_manager_reset(pmd->bm); + + /* rebuild data_sm/metadata_sm/nb_tm/tm */ r = __open_or_format_metadata(pmd, false); - if (r) { - pmd->bm = NULL; - goto out_unlock; - } - new_bm = NULL; -out_unlock: if (r) pmd->fail_io = true; up_write(&pmd->root_lock); - dm_block_manager_destroy(old_bm); -out: - if (new_bm && !IS_ERR(new_bm)) - dm_block_manager_destroy(new_bm); - return r; } diff --git a/drivers/md/persistent-data/dm-block-manager.c b/drivers/md/persistent-data/dm-block-manager.c index 0401daa0f7fb..11dd247cf85d 100644 --- a/drivers/md/persistent-data/dm-block-manager.c +++ b/drivers/md/persistent-data/dm-block-manager.c @@ -415,6 +415,12 @@ void dm_block_manager_destroy(struct dm_block_manager *bm) } EXPORT_SYMBOL_GPL(dm_block_manager_destroy); +void dm_block_manager_reset(struct dm_block_manager *bm) +{ + dm_bufio_client_reset(bm->bufio); +} +EXPORT_SYMBOL_GPL(dm_block_manager_reset); + unsigned dm_bm_block_size(struct dm_block_manager *bm) { return dm_bufio_get_block_size(bm->bufio); diff --git a/drivers/md/persistent-data/dm-block-manager.h b/drivers/md/persistent-data/dm-block-manager.h index e728937f376a..644cd7015e28 100644 --- a/drivers/md/persistent-data/dm-block-manager.h +++ b/drivers/md/persistent-data/dm-block-manager.h @@ -35,6 +35,7 @@ struct dm_block_manager *dm_block_manager_create( struct block_device *bdev, unsigned block_size, unsigned max_held_per_thread); void dm_block_manager_destroy(struct dm_block_manager *bm); +void dm_block_manager_reset(struct dm_block_manager *bm); unsigned dm_bm_block_size(struct dm_block_manager *bm); dm_block_t dm_bm_nr_blocks(struct dm_block_manager *bm); diff --git a/drivers/md/persistent-data/dm-space-map.h b/drivers/md/persistent-data/dm-space-map.h index 3e6d1153b7c4..f300aece842a 100644 --- a/drivers/md/persistent-data/dm-space-map.h +++ b/drivers/md/persistent-data/dm-space-map.h @@ -76,7 +76,8 @@ struct dm_space_map { static inline void dm_sm_destroy(struct dm_space_map *sm) { - sm->destroy(sm); + if (sm) + sm->destroy(sm); } static inline int dm_sm_extend(struct dm_space_map *sm, dm_block_t extra_blocks) diff --git a/drivers/md/persistent-data/dm-transaction-manager.c b/drivers/md/persistent-data/dm-transaction-manager.c index abe2c5dd0993..73f57977b2e3 100644 --- a/drivers/md/persistent-data/dm-transaction-manager.c +++ b/drivers/md/persistent-data/dm-transaction-manager.c @@ -197,6 +197,9 @@ EXPORT_SYMBOL_GPL(dm_tm_create_non_blocking_clone); void dm_tm_destroy(struct dm_transaction_manager *tm) { + if (!tm) + return; + if (!tm->is_clone) wipe_shadow_table(tm); diff --git a/include/linux/dm-bufio.h b/include/linux/dm-bufio.h index 45ba37aaf6b7..1f4316c33faf 100644 --- a/include/linux/dm-bufio.h +++ b/include/linux/dm-bufio.h @@ -31,6 +31,8 @@ dm_bufio_client_create(struct block_device *bdev, unsigned block_size, */ void dm_bufio_client_destroy(struct dm_bufio_client *c); +void dm_bufio_client_reset(struct dm_bufio_client *c); + /* * Set the sector range. * When this function is called, there must be no I/O in progress on the bufio -- 2.25.1

1 2

[PATCH OLK-5.10 0/3] locking/rwsem: Prevent potential lock starvation
by Yang Yingliang 06 Jun '23

06 Jun '23

Prevent potential lock starvation by read lock. Peter Zijlstra (1): locking/rwsem: Better collate rwsem_read_trylock() Waiman Long (2): locking/rwsem: Pass the current atomic count to rwsem_down_read_slowpath() locking/rwsem: Prevent potential lock starvation kernel/locking/rwsem.c | 56 ++++++++++++++++++++++++++++-------------- 1 file changed, 37 insertions(+), 19 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 0/4] icost bugfix
by Li Nan 06 Jun '23

06 Jun '23

This patch series fix iocost bug. Li Nan (1): blk-iocost: fix UAF in ioc_pd_free Yu Kuai (3): blk-iocost: track whether iocg is still online blk-iocost: don't throttle bio if iocg is offlined blk-iocost: dispatch all throttled bio in ioc_pd_offline block/blk-iocost.c | 57 ++++++++++++++++++++++++++++++++++++---------- 1 file changed, 45 insertions(+), 12 deletions(-) -- 2.39.2

1 4

[PATCH OLK-5.10] kobject: Fix slab-out-of-bounds in fill_kobj_path()
by Xia Fukun 06 Jun '23

06 Jun '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I697JG CVE: NA ---------------------------------------- In kobject_get_path(), if kobj->name is changed between calls get_kobj_path_length() and fill_kobj_path() and the length becomes longer, then fill_kobj_path() will have an out-of-bounds bug. The actual current problem occurs when the ixgbe probe. In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name length becomes longer, out-of-bounds will occur. cpu0 cpu1 ixgbe_probe register_netdev(netdev) netdev_register_kobject device_add kobject_uevent // Sending ADD events systemd-udevd // rename netdev dev_change_name device_rename kobject_rename ixgbe_mii_bus_init | mdiobus_register | __mdiobus_register | device_register | device_add | kobject_uevent | kobject_get_path | len = get_kobj_path_length // old name | path = kzalloc(len, gfp_mask); | kobj->name = name; /* name length becomes * longer */ fill_kobj_path /* kobj path length is * longer than path, * resulting in out of * bounds when filling path */ This is the kasan report: ================================================================== BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0 Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673 Workqueue: events work_for_cpu_fn Call Trace: <TASK> dump_stack_lvl+0x34/0x48 print_address_description.constprop.0+0x86/0x1e7 print_report+0x36/0x4f kasan_report+0xad/0x130 kasan_check_range+0x35/0x1c0 memcpy+0x39/0x60 fill_kobj_path+0x50/0xc0 kobject_get_path+0x5a/0xc0 kobject_uevent_env+0x140/0x460 device_add+0x5c7/0x910 __mdiobus_register+0x14e/0x490 ixgbe_probe.cold+0x441/0x574 [ixgbe] local_pci_probe+0x78/0xc0 work_for_cpu_fn+0x26/0x40 process_one_work+0x3b6/0x6a0 worker_thread+0x368/0x520 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 This reproducer triggers that bug: while: do rmmod ixgbe sleep 0.5 modprobe ixgbe sleep 0.5 When calling fill_kobj_path() to fill path, if the name length of kobj becomes longer, return failure and retry. This fixes the problem. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- lib/kobject.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/lib/kobject.c b/lib/kobject.c index ea53b30cf483..617a25ec355d 100644 --- a/lib/kobject.c +++ b/lib/kobject.c @@ -144,7 +144,7 @@ static int get_kobj_path_length(struct kobject *kobj) return length; } -static void fill_kobj_path(struct kobject *kobj, char *path, int length) +static int fill_kobj_path(struct kobject *kobj, char *path, int length) { struct kobject *parent; @@ -153,12 +153,16 @@ static void fill_kobj_path(struct kobject *kobj, char *path, int length) int cur = strlen(kobject_name(parent)); /* back up enough to print this name with '/' */ length -= cur; + if (length <= 0) + return -EINVAL; memcpy(path + length, kobject_name(parent), cur); *(path + --length) = '/'; } pr_debug("kobject: '%s' (%p): %s: path = '%s'\n", kobject_name(kobj), kobj, __func__, path); + + return 0; } /** @@ -173,13 +177,17 @@ char *kobject_get_path(struct kobject *kobj, gfp_t gfp_mask) char *path; int len; +retry: len = get_kobj_path_length(kobj); if (len == 0) return NULL; path = kzalloc(len, gfp_mask); if (!path) return NULL; - fill_kobj_path(kobj, path, len); + if (fill_kobj_path(kobj, path, len)) { + kfree(path); + goto retry; + } return path; } -- 2.17.1

2 1

[PATCH OLK-5.10] nbd: get config_lock before sock_shutdown
by Zhong Jinghua 06 Jun '23

06 Jun '23

hulk inclusion category: bugfix bugzilla: 188799, https://gitee.com/openeuler/kernel/issues/I79QWO CVE: NA ---------------------------------------- Config->socks in sock_shutdown may trigger a UAF problem. The reason is that sock_shutdown does not hold the config_lock, so that nbd_ioctl can release config->socks at this time. T0: NBD_SET_SOCK T1: NBD_DO_IT T0 T1 nbd_ioctl mutex_lock(&nbd->config_lock) // get lock __nbd_ioctl nbd_start_device_ioctl nbd_start_device mutex_unlock(&nbd->config_lock) // relase lock wait_event_interruptible (kill, enter sock_shutdown) sock_shutdown nbd_ioctl mutex_lock(&nbd->config_lock) // get lock __nbd_ioctl nbd_add_socket krealloc kfree(p) //config->socks is NULL nbd_sock *nsock = config->socks // error Fix it by moving config_lock up before sock_shutdown. Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> --- drivers/block/nbd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index fd20c1d9298c..389e633e32c5 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1406,13 +1406,18 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b mutex_unlock(&nbd->config_lock); ret = wait_event_interruptible(config->recv_wq, atomic_read(&config->recv_threads) == 0); + + /* + * recv_work in flush_workqueue will not get this lock, because nbd_open + * will hold nbd->config_refs + */ + mutex_lock(&nbd->config_lock); if (ret) { sock_shutdown(nbd); nbd_clear_que(nbd); } flush_workqueue(nbd->recv_workq); - mutex_lock(&nbd->config_lock); nbd_bdev_reset(bdev); /* user requested, ignore socket errors */ if (test_bit(NBD_RT_DISCONNECT_REQUESTED, &config->runtime_flags)) -- 2.31.1

2 1

[PATCH OLK-5.10 0/8] Fixed the accelerator capability register issue.
by Zhiqi Song 06 Jun '23

06 Jun '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Misc fixes for Kunpeng accelerator drivers! Kai Ye (1): crypto: hisilicon/sec - misc cleanups Wenkai Lin (3): crypto: hisilicon/sec - remove unused parameter crypto: hisilicon/sec - fix for resource leak crypto: hisilicon/qm - add a function to set qm algs Zhiqi Song (4): crypto: hisilicon/qm - save capability registers in qm init process crypto: hisilicon/hpre - save capability registers in probe process crypto: hisilicon/sec2 - save capability registers in probe process crypto: hisilicon/zip - save capability registers in probe process drivers/crypto/hisilicon/hpre/hpre_main.c | 68 ++++++------- drivers/crypto/hisilicon/qm.c | 72 ++++++++++++-- drivers/crypto/hisilicon/sec2/sec.h | 7 ++ drivers/crypto/hisilicon/sec2/sec_crypto.c | 89 +++++++++-------- drivers/crypto/hisilicon/sec2/sec_main.c | 105 ++++++++++----------- drivers/crypto/hisilicon/zip/zip_main.c | 104 ++++++++++---------- include/linux/hisi_acc_qm.h | 12 +++ 7 files changed, 254 insertions(+), 203 deletions(-) -- 2.30.0

1 8

[PATCH v2 OLK-5.10 0/4] support ACPI for MPAM 2.0
by Yu Liao 06 Jun '23

06 Jun '23

This patch series support ACPI for MPAM 2.0. Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 19 ++- drivers/acpi/arm64/mpam_v2.c | 176 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 373 insertions(+), 6 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[OLK-5.10] kobject: Fix slab-out-of-bounds in fill_kobj_path()
by Xia Fukun 06 Jun '23

06 Jun '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I697JG CVE: NA ---------------------------------------- In kobject_get_path(), if kobj->name is changed between calls get_kobj_path_length() and fill_kobj_path() and the length becomes longer, then fill_kobj_path() will have an out-of-bounds bug. The actual current problem occurs when the ixgbe probe. In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name length becomes longer, out-of-bounds will occur. cpu0 cpu1 ixgbe_probe register_netdev(netdev) netdev_register_kobject device_add kobject_uevent // Sending ADD events systemd-udevd // rename netdev dev_change_name device_rename kobject_rename ixgbe_mii_bus_init | mdiobus_register | __mdiobus_register | device_register | device_add | kobject_uevent | kobject_get_path | len = get_kobj_path_length // old name | path = kzalloc(len, gfp_mask); | kobj->name = name; /* name length becomes * longer */ fill_kobj_path /* kobj path length is * longer than path, * resulting in out of * bounds when filling path */ This is the kasan report: ================================================================== BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0 Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673 Workqueue: events work_for_cpu_fn Call Trace: <TASK> dump_stack_lvl+0x34/0x48 print_address_description.constprop.0+0x86/0x1e7 print_report+0x36/0x4f kasan_report+0xad/0x130 kasan_check_range+0x35/0x1c0 memcpy+0x39/0x60 fill_kobj_path+0x50/0xc0 kobject_get_path+0x5a/0xc0 kobject_uevent_env+0x140/0x460 device_add+0x5c7/0x910 __mdiobus_register+0x14e/0x490 ixgbe_probe.cold+0x441/0x574 [ixgbe] local_pci_probe+0x78/0xc0 work_for_cpu_fn+0x26/0x40 process_one_work+0x3b6/0x6a0 worker_thread+0x368/0x520 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 This reproducer triggers that bug: while: do rmmod ixgbe sleep 0.5 modprobe ixgbe sleep 0.5 When calling fill_kobj_path() to fill path, if the name length of kobj becomes longer, return failure and retry. This fixes the problem. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- lib/kobject.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/lib/kobject.c b/lib/kobject.c index ea53b30cf483..617a25ec355d 100644 --- a/lib/kobject.c +++ b/lib/kobject.c @@ -144,7 +144,7 @@ static int get_kobj_path_length(struct kobject *kobj) return length; } -static void fill_kobj_path(struct kobject *kobj, char *path, int length) +static int fill_kobj_path(struct kobject *kobj, char *path, int length) { struct kobject *parent; @@ -153,12 +153,16 @@ static void fill_kobj_path(struct kobject *kobj, char *path, int length) int cur = strlen(kobject_name(parent)); /* back up enough to print this name with '/' */ length -= cur; + if (length <= 0) + return -EINVAL; memcpy(path + length, kobject_name(parent), cur); *(path + --length) = '/'; } pr_debug("kobject: '%s' (%p): %s: path = '%s'\n", kobject_name(kobj), kobj, __func__, path); + + return 0; } /** @@ -173,13 +177,17 @@ char *kobject_get_path(struct kobject *kobj, gfp_t gfp_mask) char *path; int len; +retry: len = get_kobj_path_length(kobj); if (len == 0) return NULL; path = kzalloc(len, gfp_mask); if (!path) return NULL; - fill_kobj_path(kobj, path, len); + if (fill_kobj_path(kobj, path, len)) { + kfree(path); + goto retry; + } return path; } -- 2.17.1

1 0

[PATCH OLK-5.10] config: Disable CONFIG_EULER_FS by default
by Wei Li 06 Jun '23

06 Jun '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7BAJ0 -------------------------------- EulerFS was introduced as a technical preview feature in the 21.09 innovation version. Considering the current discontinuation of Intel Optane hardware and immature ecosystem, it has been decided to turn it off in the 22.03 LTS version. It will continue to evolve as an innovative feature in future innovation versions. Signed-off-by: Wei Li <liwei391(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 46e5f9652dca..5ef45486a594 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6465,7 +6465,7 @@ CONFIG_9P_FS=m CONFIG_9P_FSCACHE=y CONFIG_9P_FS_POSIX_ACL=y CONFIG_9P_FS_SECURITY=y -CONFIG_EULER_FS=m +# CONFIG_EULER_FS is not set CONFIG_NLS=y CONFIG_NLS_DEFAULT="utf8" CONFIG_NLS_CODEPAGE_437=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 62a8e5c1af11..7f86be2502e8 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -7559,7 +7559,7 @@ CONFIG_CIFS_DFS_UPCALL=y # CONFIG_SMB_SERVER is not set # CONFIG_CODA_FS is not set # CONFIG_AFS_FS is not set -CONFIG_EULER_FS=m +# CONFIG_EULER_FS is not set CONFIG_NLS=y CONFIG_NLS_DEFAULT="utf8" CONFIG_NLS_CODEPAGE_437=y -- 2.25.1

2 1

[PATCH OLK-5.10] tcp: restrict net.ipv4.tcp_app_win
by YueHaibing 06 Jun '23

06 Jun '23

mainline inclusion from mainline-v6.3-rc7 commit dc5110c2d959c1707e12df5f792f41d90614adaa category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6WB6P Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- UBSAN: shift-out-of-bounds in net/ipv4/tcp_input.c:555:23 shift exponent 255 is too large for 32-bit type 'int' CPU: 1 PID: 7907 Comm: ssh Not tainted 6.3.0-rc4-00161-g62bad54b26db-dirty #206 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x136/0x150 __ubsan_handle_shift_out_of_bounds+0x21f/0x5a0 tcp_init_transfer.cold+0x3a/0xb9 tcp_finish_connect+0x1d0/0x620 tcp_rcv_state_process+0xd78/0x4d60 tcp_v4_do_rcv+0x33d/0x9d0 __release_sock+0x133/0x3b0 release_sock+0x58/0x1b0 'maxwin' is int, shifting int for 32 or more bits is undefined behaviour. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: YueHaibing <yuehaibing(a)huawei.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: YueHaibing <yuehaibing(a)huawei.com> --- Documentation/networking/ip-sysctl.rst | 2 ++ net/ipv4/sysctl_net_ipv4.c | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst index 0158dff63887..df26cf4110ef 100644 --- a/Documentation/networking/ip-sysctl.rst +++ b/Documentation/networking/ip-sysctl.rst @@ -272,6 +272,8 @@ tcp_app_win - INTEGER Reserve max(window/2^tcp_app_win, mss) of window for application buffer. Value 0 is special, it means that nothing is reserved. + Possible values are [0, 31], inclusive. + Default: 31 tcp_autocorking - BOOLEAN diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c index dee47ef05655..029f46584203 100644 --- a/net/ipv4/sysctl_net_ipv4.c +++ b/net/ipv4/sysctl_net_ipv4.c @@ -37,6 +37,7 @@ static int ip_local_port_range_min[] = { 1, 1 }; static int ip_local_port_range_max[] = { 65535, 65535 }; static int tcp_adv_win_scale_min = -31; static int tcp_adv_win_scale_max = 31; +static int tcp_app_win_max = 31; static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS; static int tcp_min_snd_mss_max = 65535; static int ip_privileged_port_min; @@ -1156,7 +1157,9 @@ static struct ctl_table ipv4_net_table[] = { .data = &init_net.ipv4.sysctl_tcp_app_win, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = &tcp_app_win_max, }, { .procname = "tcp_adv_win_scale", -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] ubi: Fix deadlock caused by recursively holding work_sem
by ZhaoLong Wang 06 Jun '23

06 Jun '23

Fix deadlock caused by recursively holding work_sem Lee Jones (1): mtd: ubi: wl: Fix a couple of kernel-doc issues ZhaoLong Wang (1): ubi: Fix deadlock caused by recursively holding work_sem drivers/mtd/ubi/wl.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.31.1

2 3

[PATCH openEuler-22.03-LTS v2 0/2] xfs: missing lts patchs
by Long Li 06 Jun '23

06 Jun '23

Dave Chinner (2): xfs: reorder iunlink remove operation in xfs_ifree xfs: validate inode fork size against fork format fs/xfs/libxfs/xfs_inode_buf.c | 35 ++++++++++++++++++++++++++--------- fs/xfs/xfs_inode.c | 22 ++++++++++++---------- 2 files changed, 38 insertions(+), 19 deletions(-) -- 2.31.1

2 3

[PATCH OLK-5.10 v2 00/18] xfs: rework feature flags
by Long Li 06 Jun '23

06 Jun '23

2 19

[PATCH OLK-5.10] hikey9xx: Fixed incorrect use of kfree to free sreg
by ZhaoLong Wang 06 Jun '23

06 Jun '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GS86 CVE: NA -------------------------------- When memory allocated by using the devm_kmalloc(). the matching release function should use the devm_kfree() function instead of the kfree() function. @sreg allocated: hi6421_spmi_regulator_probe hi6421_spmi_regulator_probe_ldo @sreg freed: hi6421_spmi_regulator_remove Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/staging/hikey9xx/hi6421v600-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/hikey9xx/hi6421v600-regulator.c b/drivers/staging/hikey9xx/hi6421v600-regulator.c index 614b03c9ddfb..63204e460f53 100644 --- a/drivers/staging/hikey9xx/hi6421v600-regulator.c +++ b/drivers/staging/hikey9xx/hi6421v600-regulator.c @@ -452,7 +452,7 @@ static int hi6421_spmi_regulator_remove(struct platform_device *pdev) if (rdev->desc->volt_table) devm_kfree(&pdev->dev, (unsigned int *)rdev->desc->volt_table); - kfree(sreg); + devm_kfree(&pdev->dev, sreg); return 0; } -- 2.31.1

2 1

[PATCH OLK-5.10 0/2] ubi: Fix deadlock caused by recursively
by ZhaoLong Wang 06 Jun '23

06 Jun '23

Fix deadlock caused by recursively holding work_semg Lee Jones (1): mtd: ubi: wl: Fix a couple of kernel-doc issues ZhaoLong Wang (1): ubi: Fix deadlock caused by recursively holding work_sem drivers/mtd/ubi/wl.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.31.1

2 4

[PATCH OLK-5.10] tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent
by Lu Wei 06 Jun '23

06 Jun '23

stable inclusion from stable-v5.10.155 commit 02f8dfee7580b65449a67baa65cc2da4e5ffc473 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5ZG7O Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0c175da7b0378445f5ef53904247cfbfb87e0b78 ] If setsockopt with option name of TCP_REPAIR_OPTIONS and opt_code of TCPOPT_SACK_PERM is called to enable sack after data is sent and dupacks are received , it will trigger a warning in function tcp_verify_left_out() as follows: ============================================ WARNING: CPU: 8 PID: 0 at net/ipv4/tcp_input.c:2132 tcp_timeout_mark_lost+0x154/0x160 tcp_enter_loss+0x2b/0x290 tcp_retransmit_timer+0x50b/0x640 tcp_write_timer_handler+0x1c8/0x340 tcp_write_timer+0xe5/0x140 call_timer_fn+0x3a/0x1b0 __run_timers.part.0+0x1bf/0x2d0 run_timer_softirq+0x43/0xb0 __do_softirq+0xfd/0x373 __irq_exit_rcu+0xf6/0x140 The warning is caused in the following steps: 1. a socket named socketA is created 2. socketA enters repair mode without build a connection 3. socketA calls connect() and its state is changed to TCP_ESTABLISHED directly 4. socketA leaves repair mode 5. socketA calls sendmsg() to send data, packets_out and sack_outs(dup ack receives) increase 6. socketA enters repair mode again 7. socketA calls setsockopt with TCPOPT_SACK_PERM to enable sack 8. retransmit timer expires, it calls tcp_timeout_mark_lost(), lost_out increases 9. sack_outs + lost_out > packets_out triggers since lost_out and sack_outs increase repeatly In function tcp_timeout_mark_lost(), tp->sacked_out will be cleared if Step7 not happen and the warning will not be triggered. As suggested by Denis and Eric, TCP_REPAIR_OPTIONS should be prohibited if data was already sent. socket-tcp tests in CRIU has been tested as follows: $ sudo ./test/zdtm.py run -t zdtm/static/socket-tcp* --keep-going \ --ignore-taint socket-tcp* represent all socket-tcp tests in test/zdtm/static/. Fixes: b139ba4e90dc ("tcp: Repair connection-time negotiated parameters") Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/ipv4/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index e7ac3555d798..f009d78460b4 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -3295,7 +3295,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level, int optname, case TCP_REPAIR_OPTIONS: if (!tp->repair) err = -EINVAL; - else if (sk->sk_state == TCP_ESTABLISHED) + else if (sk->sk_state == TCP_ESTABLISHED && !tp->bytes_sent) err = tcp_repair_options_est(sk, optval, optlen); else err = -EPERM; -- 2.31.1

1 0

[PATCH OLK-5.10 1/2] mtd: ubi: wl: Fix a couple of kernel-doc issues
by ZhaoLong Wang 06 Jun '23

06 Jun '23

From: Lee Jones <lee.jones(a)linaro.org> mainline inclusion from mainline-v5.11-rc1 commit ab4e4de9fd8b469823a645f05f2c142e9270b012 category: bugfix bugzilla: 188441 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes the following W=1 kernel build warning(s): drivers/mtd/ubi/wl.c:584: warning: Function parameter or member 'nested' not described in 'schedule_erase' drivers/mtd/ubi/wl.c:1075: warning: Excess function parameter 'shutdown' description in '__erase_worker' Cc: Richard Weinberger <richard(a)nod.at> Cc: Miquel Raynal <miquel.raynal(a)bootlin.com> Cc: Vignesh Raghavendra <vigneshr(a)ti.com> Cc: linux-mtd(a)lists.infradead.org Signed-off-by: Lee Jones <lee.jones(a)linaro.org> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Link: https://lore.kernel.org/linux-mtd/20201109182206.3037326-13-lee.jones@linar… Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> --- drivers/mtd/ubi/wl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c index 6da09263e0b9..2ee0e60c43c2 100644 --- a/drivers/mtd/ubi/wl.c +++ b/drivers/mtd/ubi/wl.c @@ -575,6 +575,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk, * @vol_id: the volume ID that last used this PEB * @lnum: the last used logical eraseblock number for the PEB * @torture: if the physical eraseblock has to be tortured + * @nested: denotes whether the work_sem is already held in read mode * * This function returns zero in case of success and a %-ENOMEM in case of * failure. @@ -1066,8 +1067,6 @@ static int ensure_wear_leveling(struct ubi_device *ubi, int nested) * __erase_worker - physical eraseblock erase worker function. * @ubi: UBI device description object * @wl_wrk: the work object - * @shutdown: non-zero if the worker has to free memory and exit - * because the WL sub-system is shutting down * * This function erases a physical eraseblock and perform torture testing if * needed. It also takes care about marking the physical eraseblock bad if -- 2.31.1

1 1

退订
by 嚄薅鋽 06 Jun '23

06 Jun '23

退订

1 0

[PATCH OLK-5.10 0/4] icost bugfix
by linan666＠huaweicloud.com 06 Jun '23

06 Jun '23

From: Li Nan <linan122(a)huawei.com> This patch series fix iocost bug. Li Nan (1): blk-iocost: fix UAF in ioc_pd_free Yu Kuai (3): blk-iocost: track whether iocg is still online blk-iocost: don't throttle bio if iocg is offlined blk-iocost: dispatch all throttled bio in ioc_pd_offline block/blk-iocost.c | 57 ++++++++++++++++++++++++++++++++++++---------- 1 file changed, 45 insertions(+), 12 deletions(-) -- 2.39.2

1 4

[PATCH OLK-5.10] hikey9xx: Fixed incorrect use of kfree to free sreg
by ZhaoLong Wang 06 Jun '23

06 Jun '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GS86 CVE: NA -------------------------------- When memory allocated by using the devm_kmalloc(). the matching release function should use the devm_kfree() function instead of the kfree() function. @sreg allocated: hi6421_spmi_regulator_probe hi6421_spmi_regulator_probe_ldo @sreg freed: hi6421_spmi_regulator_remove Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/staging/hikey9xx/hi6421v600-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/hikey9xx/hi6421v600-regulator.c b/drivers/staging/hikey9xx/hi6421v600-regulator.c index 614b03c9ddfb..63204e460f53 100644 --- a/drivers/staging/hikey9xx/hi6421v600-regulator.c +++ b/drivers/staging/hikey9xx/hi6421v600-regulator.c @@ -452,7 +452,7 @@ static int hi6421_spmi_regulator_remove(struct platform_device *pdev) if (rdev->desc->volt_table) devm_kfree(&pdev->dev, (unsigned int *)rdev->desc->volt_table); - kfree(sreg); + devm_kfree(&pdev->dev, sreg); return 0; } -- 2.31.1

1 3

[PATCH OLK-5.10 1/2] mtd: ubi: wl: Fix a couple of kernel-doc issues
by ZhaoLong Wang 06 Jun '23

06 Jun '23

From: Lee Jones <lee.jones(a)linaro.org> mainline inclusion from mainline-v5.11-rc1 commit ab4e4de9fd8b469823a645f05f2c142e9270b012 category: bugfix bugzilla: 188441 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes the following W=1 kernel build warning(s): drivers/mtd/ubi/wl.c:584: warning: Function parameter or member 'nested' not described in 'schedule_erase' drivers/mtd/ubi/wl.c:1075: warning: Excess function parameter 'shutdown' description in '__erase_worker' Cc: Richard Weinberger <richard(a)nod.at> Cc: Miquel Raynal <miquel.raynal(a)bootlin.com> Cc: Vignesh Raghavendra <vigneshr(a)ti.com> Cc: linux-mtd(a)lists.infradead.org Signed-off-by: Lee Jones <lee.jones(a)linaro.org> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Link: https://lore.kernel.org/linux-mtd/20201109182206.3037326-13-lee.jones@linar… Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> --- drivers/mtd/ubi/wl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c index 6da09263e0b9..2ee0e60c43c2 100644 --- a/drivers/mtd/ubi/wl.c +++ b/drivers/mtd/ubi/wl.c @@ -575,6 +575,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk, * @vol_id: the volume ID that last used this PEB * @lnum: the last used logical eraseblock number for the PEB * @torture: if the physical eraseblock has to be tortured + * @nested: denotes whether the work_sem is already held in read mode * * This function returns zero in case of success and a %-ENOMEM in case of * failure. @@ -1066,8 +1067,6 @@ static int ensure_wear_leveling(struct ubi_device *ubi, int nested) * __erase_worker - physical eraseblock erase worker function. * @ubi: UBI device description object * @wl_wrk: the work object - * @shutdown: non-zero if the worker has to free memory and exit - * because the WL sub-system is shutting down * * This function erases a physical eraseblock and perform torture testing if * needed. It also takes care about marking the physical eraseblock bad if -- 2.31.1

1 5

[PATCH openEuler-22.03-LTS 1/2] xfs: reorder iunlink remove operation in xfs_ifree
by Long Li 06 Jun '23

06 Jun '23

From: Dave Chinner <dchinner(a)redhat.com> stable inclusion from stable-v5.10.145 commit a6bfdc157f853004c47e93357303f3626afaa872 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I685FC CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9a5280b312e2e7898b6397b2ca3cfd03f67d7be1 upstream. [backport for 5.10.y] The O_TMPFILE creation implementation creates a specific order of operations for inode allocation/freeing and unlinked list modification. Currently both are serialised by the AGI, so the order doesn't strictly matter as long as the are both in the same transaction. However, if we want to move the unlinked list insertions largely out from under the AGI lock, then we have to be concerned about the order in which we do unlinked list modification operations. O_TMPFILE creation tells us this order is inode allocation/free, then unlinked list modification. Change xfs_ifree() to use this same ordering on unlinked list removal. This way we always guarantee that when we enter the iunlinked list removal code from this path, we already have the AGI locked and we don't have to worry about lock nesting AGI reads inside unlink list locks because it's already locked and attached to the transaction. We can do this safely as the inode freeing and unlinked list removal are done in the same transaction and hence are atomic operations with respect to log recovery. Reported-by: Frank Hofmann <fhofmann(a)cloudflare.com> Fixes: 298f7bec503f ("xfs: pin inode backing buffer to the inode log item") Signed-off-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: Darrick J. Wong <darrick.wong(a)oracle.com> Signed-off-by: Dave Chinner <david(a)fromorbit.com> Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Acked-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/xfs_inode.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c index bbf6def9429e..cd8409044b9d 100644 --- a/fs/xfs/xfs_inode.c +++ b/fs/xfs/xfs_inode.c @@ -2725,14 +2725,13 @@ xfs_ifree_cluster( } /* - * This is called to return an inode to the inode free list. - * The inode should already be truncated to 0 length and have - * no pages associated with it. This routine also assumes that - * the inode is already a part of the transaction. + * This is called to return an inode to the inode free list. The inode should + * already be truncated to 0 length and have no pages associated with it. This + * routine also assumes that the inode is already a part of the transaction. * - * The on-disk copy of the inode will have been added to the list - * of unlinked inodes in the AGI. We need to remove the inode from - * that list atomically with respect to freeing it here. + * The on-disk copy of the inode will have been added to the list of unlinked + * inodes in the AGI. We need to remove the inode from that list atomically with + * respect to freeing it here. */ int xfs_ifree( @@ -2750,13 +2749,16 @@ xfs_ifree( ASSERT(ip->i_d.di_nblocks == 0); /* - * Pull the on-disk inode from the AGI unlinked list. + * Free the inode first so that we guarantee that the AGI lock is going + * to be taken before we remove the inode from the unlinked list. This + * makes the AGI lock -> unlinked list modification order the same as + * used in O_TMPFILE creation. */ - error = xfs_iunlink_remove(tp, ip); + error = xfs_difree(tp, ip->i_ino, &xic); if (error) return error; - error = xfs_difree(tp, ip->i_ino, &xic); + error = xfs_iunlink_remove(tp, ip); if (error) return error; -- 2.31.1

1 1

[PATCH OLK-5.10] dm: add disk before alloc dax
by Li Lingfeng 06 Jun '23

06 Jun '23

Offering: HULK hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I78SWJ CVE: NA ------------------------------- In dm_create(), alloc_dev() may trigger panic if alloc_dax() fail since del_gendisk() will be called with add_disk() wasn't called before. Call add_disk() before alloc_dax() to avoid it. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> --- drivers/md/dm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/md/dm.c b/drivers/md/dm.c index 335eef5c3c05..1cb2a84f2403 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -1883,6 +1883,8 @@ static struct mapped_device *alloc_dev(int minor) md->disk->private_data = md; sprintf(md->disk->disk_name, "dm-%d", minor); + add_disk_no_queue_reg(md->disk); + if (IS_ENABLED(CONFIG_DAX_DRIVER)) { md->dax_dev = alloc_dax(md, md->disk->disk_name, &dm_dax_ops, 0); @@ -1892,7 +1894,6 @@ static struct mapped_device *alloc_dev(int minor) } } - add_disk_no_queue_reg(md->disk); format_dev_t(md->name, MKDEV(_major, minor)); md->wq = alloc_workqueue("kdmflush", WQ_MEM_RECLAIM, 0); -- 2.31.1

2 1

[PATCH OLK-5.10 00/18] xfs: rework feature flags
by Long Li 06 Jun '23

06 Jun '23

1 18

[PATCH OLK-5.10 1/3] xfs: fix the problem of mount failure caused by not refreshing mp->m_sb
by Zhihao Cheng 06 Jun '23

06 Jun '23

From: Wu Guanghao <wuguanghao3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I77NBB -------------------------------- After testing xfs_growfs + fsstress + fault injection, the following stack appeared when mounting the filesystem: [ 149.902032] XFS (loop0): xfs_buf_map_verify: daddr 0x200001 out of range, EOFS 0x200000 [ 149.902072] WARNING: CPU: 12 PID: 3045 at fs/xfs/xfs_buf.c:535 xfs_buf_get_map+0x5ae/0x650 [xfs] ... [ 149.902473] xfs_buf_read_map+0x59/0x330 [xfs] [ 149.902621] ? xlog_recover_items_pass2+0x55/0xd0 [xfs] [ 149.902809] xlog_recover_buf_commit_pass2+0xff/0x640 [xfs] [ 149.902959] ? xlog_recover_items_pass2+0x55/0xd0 [xfs] [ 149.903104] xlog_recover_items_pass2+0x55/0xd0 [xfs] [ 149.903247] xlog_recover_commit_trans+0x2e0/0x330 [xfs] [ 149.903390] xlog_recovery_process_trans+0x8e/0xf0 [xfs] [ 149.903531] xlog_recover_process_data+0x9c/0x130 [xfs] [ 149.903687] xlog_do_recovery_pass+0x3cc/0x5d0 [xfs] [ 149.903843] xlog_do_log_recovery+0x5c/0x80 [xfs] [ 149.903984] xlog_do_recover+0x33/0x1c0 [xfs] [ 149.904125] xlog_recover+0xdd/0x190 [xfs] [ 149.904265] xfs_log_mount+0x125/0x2f0 [xfs] [ 149.904410] xfs_mountfs+0x41a/0x910 [xfs] [ 149.904558] ? __pfx_xfs_fstrm_free_func+0x10/0x10 [xfs] [ 149.904725] xfs_fs_fill_super+0x4b7/0x940 [xfs] [ 149.904873] ? __pfx_xfs_fs_fill_super+0x10/0x10 [xfs] [ 149.905016] get_tree_bdev+0x19a/0x280 [ 149.905020] vfs_get_tree+0x29/0xd0 [ 149.905023] path_mount+0x69e/0x9b0 [ 149.905026] do_mount+0x7d/0xa0 [ 149.905029] __x64_sys_mount+0xdc/0x100 [ 149.905032] do_syscall_64+0x3e/0x90 [ 149.905035] entry_SYSCALL_64_after_hwframe+0x72/0xdc The trigger process is as follows: 1. Growfs size from 0x200000 to 0x300000 2. Using the space range of 0x200000~0x300000 3. The above operations have only been written to the log area on disk 4. Fault injection and shutdown filesystem 5. Mount the filesystem and replay the log about growfs, but only modify the superblock buffer without modifying the mp->m_sb structure in memory 6. Continuing the log replay, at this point we are replaying operation 2, then it was discovered that the blocks used more than mp->m_sb.sb_dblocks Therefore, during log replay, if there are any modifications made to the superblock, we should refresh the information recorded in the mp->m_sb. Signed-off-by: Wu Guanghao <wuguanghao3(a)huawei.com> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/xfs/xfs_buf_item_recover.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/fs/xfs/xfs_buf_item_recover.c b/fs/xfs/xfs_buf_item_recover.c index d892125eb022..d78060a262bd 100644 --- a/fs/xfs/xfs_buf_item_recover.c +++ b/fs/xfs/xfs_buf_item_recover.c @@ -22,6 +22,8 @@ #include "xfs_inode.h" #include "xfs_dir2.h" #include "xfs_quota.h" +#include "xfs_sb.h" +#include "xfs_ag.h" /* * This is the number of entries in the l_buf_cancel_table used during @@ -969,6 +971,28 @@ xlog_recover_buf_commit_pass2( goto out_release; } else { xlog_recover_do_reg_buffer(mp, item, bp, buf_f, current_lsn); + /* + * If the superblock buffer is modified, we also need to modify the + * content of the mp. + */ + if (bp->b_maps[0].bm_bn == XFS_SB_DADDR && bp->b_ops) { + struct xfs_dsb *sb = bp->b_addr; + + bp->b_ops->verify_write(bp); + error = bp->b_error; + if (error) + goto out_release; + + if (be32_to_cpu(sb->sb_agcount) > mp->m_sb.sb_agcount) { + error = xfs_initialize_perag(mp, + be32_to_cpu(sb->sb_agcount), + &mp->m_maxagi); + if (error) + goto out_release; + } + + xfs_sb_from_disk(&mp->m_sb, sb); + } } /* -- 2.31.1

1 0

[PATCH OLK-5.10 0/2] jbd2: fix checkpoint inconsistent
by Zhihao Cheng 06 Jun '23

06 Jun '23

Zhang Yi (2): jbd2: recheck chechpointing non-dirty buffer jbd2: remove t_checkpoint_io_list fs/jbd2/checkpoint.c | 144 ++++++++++--------------------------------- fs/jbd2/commit.c | 3 +- 2 files changed, 32 insertions(+), 115 deletions(-) -- 2.31.1

2 4

[PATCH OLK-5.10] dm thin: Fix ABBA deadlock by resetting dm_bufio_client
by Li Lingfeng 05 Jun '23

05 Jun '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I79ZEK CVE: NA -------------------------------- As described in commit d0dcee7d1cf8 ("dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata"), ABBA deadlock will be triggered since shrinker_rwsem need to be held when operations failed on dm pool metadata. We have noticed the following three problem scenarios: 1) Described by commit d0dcee7d1cf8 ("dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata") 2) shrinker_rwsem and throttle->lock P1(drop cache) P2(kworker) drop_caches_sysctl_handler drop_slab shrink_slab down_read(&shrinker_rwsem) - LOCK A do_shrink_slab super_cache_scan prune_icache_sb dispose_list evict ext4_evict_inode ext4_clear_inode ext4_discard_preallocations ext4_mb_load_buddy_gfp ext4_mb_init_cache ext4_wait_block_bitmap __ext4_error ext4_handle_error ext4_commit_super ... dm_submit_bio do_worker throttle_work_update down_write(&t->lock) -- LOCK B process_deferred_bios commit metadata_operation_failed dm_pool_abort_metadata dm_block_manager_create dm_bufio_client_create register_shrinker down_write(&shrinker_rwsem) -- LOCK A thin_map thin_bio_map thin_defer_bio_with_throttle throttle_lock down_read(&t->lock) - LOCK B 3) shrinker_rwsem and wait_on_buffer P1(drop cache) P2(kworker) drop_caches_sysctl_handler drop_slab shrink_slab down_read(&shrinker_rwsem) - LOCK A do_shrink_slab ... ext4_wait_block_bitmap __ext4_error ext4_handle_error jbd2_journal_abort jbd2_journal_update_sb_errno jbd2_write_superblock submit_bh // LOCK B // RELEASE B do_worker throttle_work_update down_write(&t->lock) - LOCK B process_deferred_bios process_bio commit metadata_operation_failed dm_pool_abort_metadata dm_block_manager_create dm_bufio_client_create register_shrinker register_shrinker_prepared down_write(&shrinker_rwsem) - LOCK A bio_endio wait_on_buffer __wait_on_buffer Fix these by resetting dm_bufio_client without holding shrinker_rwsem. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-bufio.c | 7 +++ drivers/md/dm-thin-metadata.c | 59 ++++++++----------- drivers/md/persistent-data/dm-block-manager.c | 6 ++ drivers/md/persistent-data/dm-block-manager.h | 1 + drivers/md/persistent-data/dm-space-map.h | 3 +- .../persistent-data/dm-transaction-manager.c | 3 + include/linux/dm-bufio.h | 2 + 7 files changed, 47 insertions(+), 34 deletions(-) diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c index 50f3e673729c..7e3db7618916 100644 --- a/drivers/md/dm-bufio.c +++ b/drivers/md/dm-bufio.c @@ -1883,6 +1883,13 @@ void dm_bufio_client_destroy(struct dm_bufio_client *c) } EXPORT_SYMBOL_GPL(dm_bufio_client_destroy); +void dm_bufio_client_reset(struct dm_bufio_client *c) +{ + drop_buffers(c); + flush_work(&c->shrink_work); +} +EXPORT_SYMBOL_GPL(dm_bufio_client_reset); + void dm_bufio_set_sector_offset(struct dm_bufio_client *c, sector_t start) { c->start = start; diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c index 8f4d149bb99d..85e80fc17641 100644 --- a/drivers/md/dm-thin-metadata.c +++ b/drivers/md/dm-thin-metadata.c @@ -574,6 +574,8 @@ static int __format_metadata(struct dm_pool_metadata *pmd) r = dm_tm_create_with_sm(pmd->bm, THIN_SUPERBLOCK_LOCATION, &pmd->tm, &pmd->metadata_sm); if (r < 0) { + pmd->tm = NULL; + pmd->metadata_sm = NULL; DMERR("tm_create_with_sm failed"); return r; } @@ -582,6 +584,7 @@ static int __format_metadata(struct dm_pool_metadata *pmd) if (IS_ERR(pmd->data_sm)) { DMERR("sm_disk_create failed"); r = PTR_ERR(pmd->data_sm); + pmd->data_sm = NULL; goto bad_cleanup_tm; } @@ -612,11 +615,15 @@ static int __format_metadata(struct dm_pool_metadata *pmd) bad_cleanup_nb_tm: dm_tm_destroy(pmd->nb_tm); + pmd->nb_tm = NULL; bad_cleanup_data_sm: dm_sm_destroy(pmd->data_sm); + pmd->data_sm = NULL; bad_cleanup_tm: dm_tm_destroy(pmd->tm); + pmd->tm = NULL; dm_sm_destroy(pmd->metadata_sm); + pmd->metadata_sm = NULL; return r; } @@ -682,6 +689,8 @@ static int __open_metadata(struct dm_pool_metadata *pmd) sizeof(disk_super->metadata_space_map_root), &pmd->tm, &pmd->metadata_sm); if (r < 0) { + pmd->tm = NULL; + pmd->metadata_sm = NULL; DMERR("tm_open_with_sm failed"); goto bad_unlock_sblock; } @@ -691,6 +700,7 @@ static int __open_metadata(struct dm_pool_metadata *pmd) if (IS_ERR(pmd->data_sm)) { DMERR("sm_disk_open failed"); r = PTR_ERR(pmd->data_sm); + pmd->data_sm = NULL; goto bad_cleanup_tm; } @@ -717,9 +727,12 @@ static int __open_metadata(struct dm_pool_metadata *pmd) bad_cleanup_data_sm: dm_sm_destroy(pmd->data_sm); + pmd->data_sm = NULL; bad_cleanup_tm: dm_tm_destroy(pmd->tm); + pmd->tm = NULL; dm_sm_destroy(pmd->metadata_sm); + pmd->metadata_sm = NULL; bad_unlock_sblock: dm_bm_unlock(sblock); @@ -766,9 +779,13 @@ static void __destroy_persistent_data_objects(struct dm_pool_metadata *pmd, bool destroy_bm) { dm_sm_destroy(pmd->data_sm); + pmd->data_sm = NULL; dm_sm_destroy(pmd->metadata_sm); + pmd->metadata_sm = NULL; dm_tm_destroy(pmd->nb_tm); + pmd->nb_tm = NULL; dm_tm_destroy(pmd->tm); + pmd->tm = NULL; if (destroy_bm) dm_block_manager_destroy(pmd->bm); } @@ -976,8 +993,7 @@ int dm_pool_metadata_close(struct dm_pool_metadata *pmd) __func__, r); } pmd_write_unlock(pmd); - if (!pmd->fail_io) - __destroy_persistent_data_objects(pmd, true); + __destroy_persistent_data_objects(pmd, true); kfree(pmd); return 0; @@ -1884,53 +1900,30 @@ static void __set_abort_with_changes_flags(struct dm_pool_metadata *pmd) int dm_pool_abort_metadata(struct dm_pool_metadata *pmd) { int r = -EINVAL; - struct dm_block_manager *old_bm = NULL, *new_bm = NULL; /* fail_io is double-checked with pmd->root_lock held below */ if (unlikely(pmd->fail_io)) return r; - /* - * Replacement block manager (new_bm) is created and old_bm destroyed outside of - * pmd root_lock to avoid ABBA deadlock that would result (due to life-cycle of - * shrinker associated with the block manager's bufio client vs pmd root_lock). - * - must take shrinker_rwsem without holding pmd->root_lock - */ - new_bm = dm_block_manager_create(pmd->bdev, THIN_METADATA_BLOCK_SIZE << SECTOR_SHIFT, - THIN_MAX_CONCURRENT_LOCKS); - pmd_write_lock(pmd); if (pmd->fail_io) { pmd_write_unlock(pmd); - goto out; + return r; } - __set_abort_with_changes_flags(pmd); + + /* destroy data_sm/metadata_sm/nb_tm/tm */ __destroy_persistent_data_objects(pmd, false); - old_bm = pmd->bm; - if (IS_ERR(new_bm)) { - DMERR("could not create block manager during abort"); - pmd->bm = NULL; - r = PTR_ERR(new_bm); - goto out_unlock; - } - pmd->bm = new_bm; + /* reset bm */ + dm_block_manager_reset(pmd->bm); + + /* rebuild data_sm/metadata_sm/nb_tm/tm */ r = __open_or_format_metadata(pmd, false); - if (r) { - pmd->bm = NULL; - goto out_unlock; - } - new_bm = NULL; -out_unlock: if (r) pmd->fail_io = true; - pmd_write_unlock(pmd); - dm_block_manager_destroy(old_bm); -out: - if (new_bm && !IS_ERR(new_bm)) - dm_block_manager_destroy(new_bm); + pmd_write_unlock(pmd); return r; } diff --git a/drivers/md/persistent-data/dm-block-manager.c b/drivers/md/persistent-data/dm-block-manager.c index 54c089a50b15..a9db18a73dc2 100644 --- a/drivers/md/persistent-data/dm-block-manager.c +++ b/drivers/md/persistent-data/dm-block-manager.c @@ -414,6 +414,12 @@ void dm_block_manager_destroy(struct dm_block_manager *bm) } EXPORT_SYMBOL_GPL(dm_block_manager_destroy); +void dm_block_manager_reset(struct dm_block_manager *bm) +{ + dm_bufio_client_reset(bm->bufio); +} +EXPORT_SYMBOL_GPL(dm_block_manager_reset); + unsigned dm_bm_block_size(struct dm_block_manager *bm) { return dm_bufio_get_block_size(bm->bufio); diff --git a/drivers/md/persistent-data/dm-block-manager.h b/drivers/md/persistent-data/dm-block-manager.h index e728937f376a..644cd7015e28 100644 --- a/drivers/md/persistent-data/dm-block-manager.h +++ b/drivers/md/persistent-data/dm-block-manager.h @@ -35,6 +35,7 @@ struct dm_block_manager *dm_block_manager_create( struct block_device *bdev, unsigned block_size, unsigned max_held_per_thread); void dm_block_manager_destroy(struct dm_block_manager *bm); +void dm_block_manager_reset(struct dm_block_manager *bm); unsigned dm_bm_block_size(struct dm_block_manager *bm); dm_block_t dm_bm_nr_blocks(struct dm_block_manager *bm); diff --git a/drivers/md/persistent-data/dm-space-map.h b/drivers/md/persistent-data/dm-space-map.h index 3e6d1153b7c4..f300aece842a 100644 --- a/drivers/md/persistent-data/dm-space-map.h +++ b/drivers/md/persistent-data/dm-space-map.h @@ -76,7 +76,8 @@ struct dm_space_map { static inline void dm_sm_destroy(struct dm_space_map *sm) { - sm->destroy(sm); + if (sm) + sm->destroy(sm); } static inline int dm_sm_extend(struct dm_space_map *sm, dm_block_t extra_blocks) diff --git a/drivers/md/persistent-data/dm-transaction-manager.c b/drivers/md/persistent-data/dm-transaction-manager.c index abe2c5dd0993..73f57977b2e3 100644 --- a/drivers/md/persistent-data/dm-transaction-manager.c +++ b/drivers/md/persistent-data/dm-transaction-manager.c @@ -197,6 +197,9 @@ EXPORT_SYMBOL_GPL(dm_tm_create_non_blocking_clone); void dm_tm_destroy(struct dm_transaction_manager *tm) { + if (!tm) + return; + if (!tm->is_clone) wipe_shadow_table(tm); diff --git a/include/linux/dm-bufio.h b/include/linux/dm-bufio.h index 90bd558a17f5..c93917b2f54b 100644 --- a/include/linux/dm-bufio.h +++ b/include/linux/dm-bufio.h @@ -31,6 +31,8 @@ dm_bufio_client_create(struct block_device *bdev, unsigned block_size, */ void dm_bufio_client_destroy(struct dm_bufio_client *c); +void dm_bufio_client_reset(struct dm_bufio_client *c); + /* * Set the sector range. * When this function is called, there must be no I/O in progress on the bufio -- 2.31.1

2 1

[PATCH OLK-5.10 v4] Revert "ext4: dio take shared inode lock when overwriting preallocated blocks"
by Baokun Li 05 Jun '23

05 Jun '23

hulk inclusion category: perf bugzilla: 188836, https://gitee.com/openeuler/kernel/issues/I7AYNZ -------------------------------- This reverts commit 5193a88ea78c9d4a61752443cd7e7457eeeed3c6. This commit may cause performance degradation, so it is being reverted temporarily. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- V1->V2: Modify patch description. V2->V3: Add maillist kernel(a)openeuler.org. V3->V4: subscribe kernel(a)openeuler.org. fs/ext4/file.c | 34 ++++++++++++---------------------- 1 file changed, 12 insertions(+), 22 deletions(-) diff --git a/fs/ext4/file.c b/fs/ext4/file.c index 43076e72cd76..aeb169354a53 100644 --- a/fs/ext4/file.c +++ b/fs/ext4/file.c @@ -190,9 +190,8 @@ ext4_extending_io(struct inode *inode, loff_t offset, size_t len) return false; } -/* Is IO overwriting allocated or initialized blocks? */ -static bool ext4_overwrite_io(struct inode *inode, - loff_t pos, loff_t len, bool *unwritten) +/* Is IO overwriting allocated and initialized blocks? */ +static bool ext4_overwrite_io(struct inode *inode, loff_t pos, loff_t len) { struct ext4_map_blocks map; unsigned int blkbits = inode->i_blkbits; @@ -206,15 +205,12 @@ static bool ext4_overwrite_io(struct inode *inode, blklen = map.m_len; err = ext4_map_blocks(NULL, inode, &map, 0); - if (err != blklen) - return false; /* * 'err==len' means that all of the blocks have been preallocated, - * regardless of whether they have been initialized or not. We need to - * check m_flags to distinguish the unwritten extents. + * regardless of whether they have been initialized or not. To exclude + * unwritten extents, we need to check m_flags. */ - *unwritten = !(map.m_flags & EXT4_MAP_MAPPED); - return true; + return err == blklen && (map.m_flags & EXT4_MAP_MAPPED); } static ssize_t ext4_generic_write_checks(struct kiocb *iocb, @@ -425,16 +421,11 @@ static const struct iomap_dio_ops ext4_dio_write_ops = { * - For extending writes case we don't take the shared lock, since it requires * updating inode i_disksize and/or orphan handling with exclusive lock. * - * - shared locking will only be true mostly with overwrites, including - * initialized blocks and unwritten blocks. For overwrite unwritten blocks - * we protect splitting extents by i_data_sem in ext4_inode_info, so we can - * also release exclusive i_rwsem lock. - * - * - Otherwise we will switch to exclusive i_rwsem lock. + * - shared locking will only be true mostly with overwrites. Otherwise we will + * switch to exclusive i_rwsem lock. */ static ssize_t ext4_dio_write_checks(struct kiocb *iocb, struct iov_iter *from, - bool *ilock_shared, bool *extend, - bool *unwritten) + bool *ilock_shared, bool *extend) { struct file *file = iocb->ki_filp; struct inode *inode = file_inode(file); @@ -458,7 +449,7 @@ static ssize_t ext4_dio_write_checks(struct kiocb *iocb, struct iov_iter *from, * in file_modified(). */ if (*ilock_shared && (!IS_NOSEC(inode) || *extend || - !ext4_overwrite_io(inode, offset, count, unwritten))) { + !ext4_overwrite_io(inode, offset, count))) { if (iocb->ki_flags & IOCB_NOWAIT) { ret = -EAGAIN; goto out; @@ -490,7 +481,7 @@ static ssize_t ext4_dio_write_iter(struct kiocb *iocb, struct iov_iter *from) loff_t offset = iocb->ki_pos; size_t count = iov_iter_count(from); const struct iomap_ops *iomap_ops = &ext4_iomap_ops; - bool extend = false, unaligned_io = false, unwritten = false; + bool extend = false, unaligned_io = false; bool ilock_shared = true; /* @@ -533,8 +524,7 @@ static ssize_t ext4_dio_write_iter(struct kiocb *iocb, struct iov_iter *from) return ext4_buffered_write_iter(iocb, from); } - ret = ext4_dio_write_checks(iocb, from, - &ilock_shared, &extend, &unwritten); + ret = ext4_dio_write_checks(iocb, from, &ilock_shared, &extend); if (ret <= 0) return ret; @@ -584,7 +574,7 @@ static ssize_t ext4_dio_write_iter(struct kiocb *iocb, struct iov_iter *from) ext4_journal_stop(handle); } - if (ilock_shared && !unwritten) + if (ilock_shared) iomap_ops = &ext4_iomap_overwrite_ops; ret = iomap_dio_rw(iocb, from, iomap_ops, &ext4_dio_write_ops, is_sync_kiocb(iocb) || unaligned_io || extend); -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Balance initial LPI affinity across CPUs
by Zhang Changzhong 05 Jun '23

05 Jun '23

Marc Zyngier (2): irqchip/gic-v3-its: Track LPI distribution on a per CPU basis irqchip/gic-v3-its: Balance initial LPI affinity across CPUs drivers/irqchip/irq-gic-v3-its.c | 173 ++++++++++++++++++++++++++++++++------- 1 file changed, 145 insertions(+), 28 deletions(-) -- 2.9.5

1 2

[PATCH OLK-5.10] ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
by Lu Wei 05 Jun '23

05 Jun '23

stable inclusion from stable-v5.10.173 commit da26369377f0b671c14692e2d65ceb38131053e1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GT9T Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4cc59f386991ec9374cb4bc83dbe1c0b5a95033f ] In function rt6_nlmsg_size(), the length of nexthop is calculated by multipling the nexthop length of fib6_info and the number of siblings. However if the fib6_info has no lwtunnel but the siblings have lwtunnels, the nexthop length is less than it should be, and it will trigger a warning in inet6_rt_notify() as follows: WARNING: CPU: 0 PID: 6082 at net/ipv6/route.c:6180 inet6_rt_notify+0x120/0x130 ...... Call Trace: <TASK> fib6_add_rt2node+0x685/0xa30 fib6_add+0x96/0x1b0 ip6_route_add+0x50/0xd0 inet6_rtm_newroute+0x97/0xa0 rtnetlink_rcv_msg+0x156/0x3d0 netlink_rcv_skb+0x5a/0x110 netlink_unicast+0x246/0x350 netlink_sendmsg+0x250/0x4c0 sock_sendmsg+0x66/0x70 ___sys_sendmsg+0x7c/0xd0 __sys_sendmsg+0x5d/0xb0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc This bug can be reproduced by script: ip -6 addr add 2002::2/64 dev ens2 ip -6 route add 100::/64 via 2002::1 dev ens2 metric 100 for i in 10 20 30 40 50 60 70; do ip link add link ens2 name ipv_$i type ipvlan ip -6 addr add 2002::$i/64 dev ipv_$i ifconfig ipv_$i up done for i in 10 20 30 40 50 60; do ip -6 route append 100::/64 encap ip6 dst 2002::$i via 2002::1 dev ipv_$i metric 100 done ip -6 route append 100::/64 via 2002::1 dev ipv_70 metric 100 This patch fixes it by adding nexthop_len of every siblings using rt6_nh_nlmsg_size(). Fixes: beb1afac518d ("net: ipv6: Add support to dump multipath routes via RTA_MULTIPATH attribute") Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://lore.kernel.org/r/20230222083629.335683-2-luwei32@huawei.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/ipv6/route.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index c18a6c17ce09..b5e7ce4909d5 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5439,16 +5439,17 @@ static size_t rt6_nlmsg_size(struct fib6_info *f6i) nexthop_for_each_fib6_nh(f6i->nh, rt6_nh_nlmsg_size, &nexthop_len); } else { + struct fib6_info *sibling, *next_sibling; struct fib6_nh *nh = f6i->fib6_nh; nexthop_len = 0; if (f6i->fib6_nsiblings) { - nexthop_len = nla_total_size(0) /* RTA_MULTIPATH */ - + NLA_ALIGN(sizeof(struct rtnexthop)) - + nla_total_size(16) /* RTA_GATEWAY */ - + lwtunnel_get_encap_size(nh->fib_nh_lws); + rt6_nh_nlmsg_size(nh, &nexthop_len); - nexthop_len *= f6i->fib6_nsiblings; + list_for_each_entry_safe(sibling, next_sibling, + &f6i->fib6_siblings, fib6_siblings) { + rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); + } } nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws); } -- 2.31.1

1 0

[PATCH OLK-5.10 0/4] Accelerator some bugs round
by Weili Qian 05 Jun '23

05 Jun '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Misc fixes for Kunpeng accelerator drivers. Bjorn Helgaas (1): crypto: hisilicon/qm - remove unnecessary aer.h include Weili Qian (3): crypto: hisilicon/qm - prevent soft lockup in qm_poll_req_cb()'s loop crypto: hisilicon/hpre - ensure private key less than n crypto: hisilicon/qm - stop function and write data to memory drivers/crypto/hisilicon/hpre/hpre_crypto.c | 10 ++++++++-- drivers/crypto/hisilicon/qm.c | 16 +++++++++------- include/linux/hisi_acc_qm.h | 2 +- 3 files changed, 18 insertions(+), 10 deletions(-) -- 2.30.0

1 4

[PATCH OLK-5.10] tcp/dccp: Add another way to allocate local ports in connect()
by Liu Jian 05 Jun '23

05 Jun '23

From: Lu Wei <luwei32(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7AO8G CVE: NA -------------------------------- Commit 07f4c90062f8 ("tcp/dccp: try to not exhaust ip_local_port_range in connect()") allocates even ports for connect() first while leaving odd ports for bind() and this works well in busy servers. But this strategy causes severe performance degradation in busy clients. when a client has used more than half of the local ports setted in proc/sys/net/ipv4/ip_local_port_range, if this client trys to connect to a server again, the connect time increases rapidly since it will traverse all the even ports though they are exhausted. So this path provides another strategy by introducing a system option: local_port_allocation. If it is a busy client, users should set it to 1 to use sequential allocation while it should be set to 0 in other situations. Its default value is 0. Signed-off-by: Lu Wei <luwei32(a)huawei.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/tcp.h | 1 + net/ipv4/inet_hashtables.c | 11 ++++++++--- net/ipv4/sysctl_net_ipv4.c | 8 ++++++++ 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index 9c86ff1e3ed1..1b832683ccf8 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -258,6 +258,7 @@ extern long sysctl_tcp_mem[3]; extern atomic_long_t tcp_memory_allocated; extern struct percpu_counter tcp_sockets_allocated; extern unsigned long tcp_memory_pressure; +extern int sysctl_local_port_allocation; /* optimized version of sk_under_memory_pressure() for TCP sockets */ static inline bool tcp_under_memory_pressure(const struct sock *sk) diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index ed8324ee4b1b..396a58d9708c 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -742,7 +742,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, struct net *net = sock_net(sk); struct inet_bind_bucket *tb; u32 remaining, offset; - int ret, i, low, high; + int ret, i, low, high, span_size; int l3mdev; u32 index; @@ -762,6 +762,11 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, local_bh_enable(); return ret; } + /* local_port_allocation 0 means even and odd port allocation strategy + * will be applied, so span size is 2; otherwise sequential allocation + * will be used and span size is 1. Default value is 0. + */ + span_size = sysctl_local_port_allocation ? 1 : 2; l3mdev = inet_sk_bound_l3mdev(sk); @@ -783,7 +788,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, offset &= ~1U; other_parity_scan: port = low + offset; - for (i = 0; i < remaining; i += 2, port += 2) { + for (i = 0; i < remaining; i += span_size, port += span_size) { if (unlikely(port >= high)) port -= remaining; if (inet_is_local_reserved_port(net, port)) @@ -824,7 +829,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, } offset++; - if ((offset & 1) && remaining > 1) + if ((offset & 1) && remaining > 1 && span_size == 2) goto other_parity_scan; return -EADDRNOTAVAIL; diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c index dee47ef05655..d82c0eceec91 100644 --- a/net/ipv4/sysctl_net_ipv4.c +++ b/net/ipv4/sysctl_net_ipv4.c @@ -51,6 +51,7 @@ static int comp_sack_nr_max = 255; static u32 u32_max_div_HZ = UINT_MAX / HZ; static int one_day_secs = 24 * 3600; +int sysctl_local_port_allocation; /* obsolete */ static int sysctl_tcp_low_latency __read_mostly; @@ -575,6 +576,13 @@ static struct ctl_table ipv4_table[] = { .extra2 = SYSCTL_ONE, }, #endif + { + .procname = "local_port_allocation", + .data = &sysctl_local_port_allocation, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec, + }, { } }; -- 2.34.1

1 0

[patch OLK-5.10 0/2] support ACPI for MPAM 2.0
by Yu Liao 03 Jun '23

03 Jun '23

This patch series support ACPI for MPAM 2.0 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (1): ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 19 ++- drivers/acpi/arm64/mpam_v2.c | 188 +++++++++++++++++++++++++++ include/acpi/actbl2.h | 111 ++++++++++++++++ include/linux/arm_mpam.h | 2 +- 6 files changed, 318 insertions(+), 6 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

1 2

[PATCH OLK-5.10 00/25] block bugfix
by linan666＠huaweicloud.com 03 Jun '23

03 Jun '23

From: Li Nan <linan122(a)huawei.com> This patch series fix block layer bug. 3 patchs fix iocost bug. Other patchs fix raid10 and badblocks bug. David Sloan (1): md: Flush workqueue md_rdev_misc_wq in md_alloc() Jiang Li (1): md/raid1: stop mdx_raid1 thread when raid1 array run failed Jinke Han (1): block: don't allow the same type rq_qos add more than once Li Nan (20): blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost md: replace invalid function flush_rdev_wq() with flush_workqueue() md: fix sysfs duplicate file while adding rdev md/raid10: fix softlockup in raid10_unplug md/raid10: fix taks hung in raid10d md/raid10: fix a race between removing rdev and access conf->mirrors[i].rdev md: fix io loss when remove rdev fail md/raid10: prioritize adding disk to 'removed' mirror md/raid10: fix io loss while replacement replace rdev md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request md/raid10: fix uaf if replacement replaces rdev md/raid10: remove WANR_ON_ONCE in raid10_end_write_request md/raid10: fix incorrect counting of rdev->nr_pending block: Only set bb->changed when badblocks changes md/raid10: fix io hung in md_wait_for_blocked_rdev() md: fix unexpected changes of return value in rdev_set_badblocks block/badblocks: fix the bug of reverse order block/badblocks: fix badblocks loss when badblocks combine md/raid10: fix null-ptr-deref in raid10_sync_request md/raid10: fix incorrect done of recovery Yu Kuai (2): blk-iocost: don't allow to configure bio based device md/raid10: factor out code from wait_barrier() to stop_waiting_barrier() block/badblocks.c | 29 +++-- block/blk-iocost.c | 35 ++++-- block/blk-iolatency.c | 18 +-- block/blk-rq-qos.h | 11 +- block/blk-wbt.c | 12 +- drivers/md/md.c | 45 ++++--- drivers/md/raid1.c | 1 + drivers/md/raid10.c | 286 ++++++++++++++++++++++++------------------ drivers/md/raid10.h | 12 +- 9 files changed, 268 insertions(+), 181 deletions(-) -- 2.39.2

1 25

[PATCH] hikptool: fix compiling specifications check problem
by veega 03 Jun '23

03 Jun '23

delete -g option for release vesion and add compile option: -Wextra -fno-common -std=gnu11 -Wfloat-equal Signed-off-by: veega <zhuweijia(a)huawei.com> --- CMakeLists.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 6a396e7..174dd8f 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -11,7 +11,8 @@ project(hikptool C) -set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -g -O2 -fPIC -fPIE -Wall") +set(CMAKE_C_FLAGS + "${CMAKE_C_FLAGS} -O2 -fPIC -fPIE -Wall -Wextra -fno-common -std=gnu11 -Wfloat-equal") set(CMAKE_SKIP_RPATH TRUE) macro(get_header_dir_recurse HEADER_DIR_LIST) -- 2.36.1.windows.1

1 0

[PATCH OLK-5.10] config: enable CONFIG_BPF_STREAM_PARSER=y on arm64
by Liu Jian 02 Jun '23

02 Jun '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I79J3X CVE: N/A ---------------------------------------------------- It is already enabled by default on the x86 and loongarch platforms, so let's enable it on the arm64 platform. Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawe.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 76de734953fc..2c4d0524487c 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -1796,7 +1796,7 @@ CONFIG_CGROUP_NET_CLASSID=y CONFIG_NET_RX_BUSY_POLL=y CONFIG_BQL=y CONFIG_BPF_JIT=y -# CONFIG_BPF_STREAM_PARSER is not set +CONFIG_BPF_STREAM_PARSER=y CONFIG_NET_FLOW_LIMIT=y # -- 2.34.1

1 0

[PATCH openEuler-22.03-LTS-SP2 0/2] mitigatin cacheline false
by Yang Yingliang 02 Jun '23

02 Jun '23

In the test of execl, shell1 and shell8 of UnixBench, L3 false sharing occurs between rwsem_try_write_lock_unqueued() and filemap_map_pages(). The offset between address_space.host and address_space.i_mmap_rwsem is 48. It may occur L3 false sharing. Their offsets in struct ext4_inode_info is 696 and 744, so when the address of ext4_inode_info after L3 aligned, it may occur L3 false sharing in the following condition: [0x00 ~ 0x10] false sharing [0x18 ~ 0x40] no false sharing [0x48 ~ 0x80] false sharing Change the offset of 'vfs_inode' from 320 to 360 in ext4_inode_info and make the address of ext4_inode_info L3 aligned, so the offset of host and i_mmap_rwsem in ext4_inode_info is changed to 736 and 784, it can make them in different L3 to avoid false sharing. ./Run -c 96 -i 3 execl Before this patch: System Benchmarks Partial Index BASELINE RESULT INDEX Execl Throughput 43.0 24238.0 5636.8 ======== System Benchmarks Index Score (Partial Only) 5636.8 After this patch: System Benchmarks Partial Index BASELINE RESULT INDEX Execl Throughput 43.0 29363.7 6828.8 ======== System Benchmarks Index Score (Partial Only) 6828.8 Yang Yingliang (2): ext4: mitigatin cacheline false sharing in struct ext4_inode_info enable MITIGATION_FALSE_SHARING by default arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/ext4/Kconfig | 9 +++++++++ fs/ext4/ext4.h | 5 +++++ fs/ext4/super.c | 4 ++++ 5 files changed, 20 insertions(+) -- 2.33.0

1 2

[PATCH OLK-5.10] ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
by Zhengchao Shao 02 Jun '23

02 Jun '23

From: Julian Wiedmann <jwi(a)linux.ibm.com> mainline inclusion from mainline-v5.16-rc3 commit 0276af2176c78771da7f311621a25d7608045827 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7A2A0 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ethtool_set_coalesce() now uses both the .get_coalesce() and .set_coalesce() callbacks. But the check for their availability is buggy, so changing the coalesce settings on a device where the driver provides only _one_ of the callbacks results in a NULL pointer dereference instead of an -EOPNOTSUPP. Fix the condition so that the availability of both callbacks is ensured. This also matches the netlink code. Note that reproducing this requires some effort - it only affects the legacy ioctl path, and needs a specific combination of driver options: - have .get_coalesce() and .coalesce_supported but no .set_coalesce(), or - have .set_coalesce() but no .get_coalesce(). Here eg. ethtool doesn't cause the crash as it first attempts to call ethtool_get_coalesce() and bails out on error. Fixes: f3ccfda19319 ("ethtool: extend coalesce setting uAPI with CQE mode") Cc: Yufeng Mo <moyufeng(a)huawei.com> Cc: Huazhong Tan <tanhuazhong(a)huawei.com> Cc: Andrew Lunn <andrew(a)lunn.ch> Cc: Heiner Kallweit <hkallweit1(a)gmail.com> Signed-off-by: Julian Wiedmann <jwi(a)linux.ibm.com> Link: https://lore.kernel.org/r/20211126175543.28000-1-jwi@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ethtool/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index ab056feb44a8..63a88b3e861d 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -1696,7 +1696,7 @@ static noinline_for_stack int ethtool_set_coalesce(struct net_device *dev, struct ethtool_coalesce coalesce; int ret; - if (!dev->ethtool_ops->set_coalesce && !dev->ethtool_ops->get_coalesce) + if (!dev->ethtool_ops->set_coalesce || !dev->ethtool_ops->get_coalesce) return -EOPNOTSUPP; ret = dev->ethtool_ops->get_coalesce(dev, &coalesce, &kernel_coalesce, -- 2.34.1

2 1

[PATCH v2 OLK-5.10] config: enable CONFIG_BPF_STREAM_PARSER=y on arm64
by Liu Jian 02 Jun '23

02 Jun '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I79J3X CVE: N/A ---------------------------------------------------- It is already enabled by default on the x86 and loongarch platforms, so let's enable it on the arm64 platform. Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawe.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 76de734953fc..2c4d0524487c 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -1796,7 +1796,7 @@ CONFIG_CGROUP_NET_CLASSID=y CONFIG_NET_RX_BUSY_POLL=y CONFIG_BQL=y CONFIG_BPF_JIT=y -# CONFIG_BPF_STREAM_PARSER is not set +CONFIG_BPF_STREAM_PARSER=y CONFIG_NET_FLOW_LIMIT=y # -- 2.34.1

1 0

[PATCH openEuler-22.03-LTS-SP2 0/2] mitigatin cacheline false
by Yang Yingliang 02 Jun '23

02 Jun '23

In the test of execl, shell1 and shell8 of UnixBench, L3 false sharing occurs between rwsem_try_write_lock_unqueued() and filemap_map_pages(). The offset between address_space.host and address_space.i_mmap_rwsem is 48. It may occur L3 false sharing. Their offsets in struct ext4_inode_info is 696 and 744, so when the address of ext4_inode_info after L3 aligned, it may occur L3 false sharing in the following condition: [0x00 ~ 0x10] false sharing [0x18 ~ 0x40] no false sharing [0x48 ~ 0x80] false sharing Change the offset of 'vfs_inode' from 320 to 360 in ext4_inode_info and make the address of ext4_inode_info L3 aligned, so the offset of host and i_mmap_rwsem in ext4_inode_info is changed to 736 and 784, it can make them in different L3 to avoid false sharing. ./Run -c 96 -i 3 execl Before this patch: System Benchmarks Partial Index BASELINE RESULT INDEX Execl Throughput 43.0 24238.0 5636.8 ======== System Benchmarks Index Score (Partial Only) 5636.8 After this patch: System Benchmarks Partial Index BASELINE RESULT INDEX Execl Throughput 43.0 29363.7 6828.8 ======== System Benchmarks Index Score (Partial Only) 6828.8 Yang Yingliang (2): ext4: mitigatin cacheline false sharing in struct ext4_inode_info enable MITIGATION_FALSE_SHARING by default arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/ext4/Kconfig | 9 +++++++++ fs/ext4/ext4.h | 5 +++++ fs/ext4/super.c | 4 ++++ 5 files changed, 20 insertions(+) -- 2.33.0

1 2

[PATCH OLK-5.10 0/2] Fixed two accelerator bugfixes.
by liulongfang 02 Jun '23

02 Jun '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Longfang Liu (1): crypto:hisilicon/qm: bugfix queue parameter issue Zhangfei Gao (1): uacce: use filep->f_mapping to replace inode->i_mapping drivers/crypto/hisilicon/hpre/hpre_main.c | 5 +++++ drivers/crypto/hisilicon/qm.c | 14 ++++++++++---- drivers/crypto/hisilicon/qm_common.h | 1 - drivers/crypto/hisilicon/sec2/sec_main.c | 5 +++++ drivers/crypto/hisilicon/zip/zip_main.c | 5 +++++ drivers/misc/uacce/uacce.c | 16 +++++++++------- include/linux/hisi_acc_qm.h | 8 ++++++++ include/linux/uacce.h | 4 ++-- 8 files changed, 44 insertions(+), 14 deletions(-) -- 2.30.0

1 2

[PATCH OLK-5.10] net: sched: fix NULL pointer dereference in mq_attach
by Zhengchao Shao 02 Jun '23

02 Jun '23

mainline inclusion from mainline-v6.4-rc5 commit 36eec020fab668719b541f34d97f44e232ffa165 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I79V6E CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When use the following command to test: 1)ip link add bond0 type bond 2)ip link set bond0 up 3)tc qdisc add dev bond0 root handle ffff: mq 4)tc qdisc replace dev bond0 parent ffff:fff1 handle ffff: mq The kernel reports NULL pointer dereference issue. The stack information is as follows: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mq_attach+0x44/0xa0 lr : qdisc_graft+0x20c/0x5cc sp : ffff80000e2236a0 x29: ffff80000e2236a0 x28: ffff0000c0e59d80 x27: ffff0000c0be19c0 x26: ffff0000cae3e800 x25: 0000000000000010 x24: 00000000fffffff1 x23: 0000000000000000 x22: ffff0000cae3e800 x21: ffff0000c9df4000 x20: ffff0000c9df4000 x19: 0000000000000000 x18: ffff80000a934000 x17: ffff8000f5b56000 x16: ffff80000bb08000 x15: 0000000000000000 x14: 0000000000000000 x13: 6b6b6b6b6b6b6b6b x12: 6b6b6b6b00000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff0000c0be0730 x7 : bbbbbbbbbbbbbbbb x6 : 0000000000000008 x5 : ffff0000cae3e864 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000001 x1 : ffff8000090bc23c x0 : 0000000000000000 Call trace: mq_attach+0x44/0xa0 qdisc_graft+0x20c/0x5cc tc_modify_qdisc+0x1c4/0x664 rtnetlink_rcv_msg+0x354/0x440 netlink_rcv_skb+0x64/0x144 rtnetlink_rcv+0x28/0x34 netlink_unicast+0x1e8/0x2a4 netlink_sendmsg+0x308/0x4a0 sock_sendmsg+0x64/0xac ____sys_sendmsg+0x29c/0x358 ___sys_sendmsg+0x90/0xd0 __sys_sendmsg+0x7c/0xd0 __arm64_sys_sendmsg+0x2c/0x38 invoke_syscall+0x54/0x114 el0_svc_common.constprop.1+0x90/0x174 do_el0_svc+0x3c/0xb0 el0_svc+0x24/0xec el0t_64_sync_handler+0x90/0xb4 el0t_64_sync+0x174/0x178 This is because when mq is added for the first time, qdiscs in mq is set to NULL in mq_attach(). Therefore, when replacing mq after adding mq, we need to initialize qdiscs in the mq before continuing to graft. Otherwise, it will couse NULL pointer dereference issue in mq_attach(). And the same issue will occur in the attach functions of mqprio, taprio and htb. ffff:fff1 means that the repalce qdisc is ingress. Ingress does not allow any qdisc to be attached. Therefore, ffff:fff1 is incorrectly used, and the command should be dropped. Fixes: 6ec1c69a8f64 ("net_sched: add classful multiqueue dummy scheduler") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Tested-by: Peilin Ye <peilin.ye(a)bytedance.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://lore.kernel.org/r/20230527093747.3583502-1-shaozhengchao@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> --- net/sched/sch_api.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index b12a3502fca5..b8eecd6704cb 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -1590,6 +1590,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, NL_SET_ERR_MSG(extack, "Qdisc parent/child loop detected"); return -ELOOP; } + if (clid == TC_H_INGRESS) { + NL_SET_ERR_MSG(extack, "Ingress cannot graft directly"); + return -EINVAL; + } qdisc_refcount_inc(q); goto graft; } else { -- 2.34.1

2 1

[openeuler/rdma-core v2 0/4] src-openeuler/rdma-core:bugfixes
by Chengchang Tang 02 Jun '23

02 Jun '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> Chengchang Tang (1): libhns: Add a judgment to the congestion control algorithm Haoyue Xu (1): libhns: Fix arrangement in SL to adapt MPI APP Junxian Huang (1): libhns: Fix incorrect post-send with direct wqe of wr-list in user space Luoyouming (1): libhns: Fix the owner bit error of sq in new io libibverbs/man/ibv_poll_cq.3 | 5 +++++ libibverbs/verbs.h | 15 ++++++++++++++- providers/hns/hns_roce_u_hw_v2.c | 33 ++++++++++++++++++++++++++------ providers/hns/hns_roce_u_verbs.c | 3 +++ 4 files changed, 49 insertions(+), 7 deletions(-) -- 2.30.0

1 4

Re: [PATCH OLK-5.10] config: enable CONFIG_BPF_STREAM_PARSER=y on arm64
by Wei Yongjun 02 Jun '23

02 Jun '23

On 2023/6/1 23:22, Liu Jian wrote: > hulk inclusion > category: feature > bugzilla: https://gitee.com/openeuler/kernel/issues/I79J3X > CVE: N/A > > ---------------------------------------------------- > > It is already enabled by default on the x86 and loongarch platforms, so > let's enable it on the arm64 platform. > > Signed-off-by: Liu Jian <liujian56(a)huawei.com> > --- > arch/arm64/configs/openeuler_defconfig | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > Reviewed-by: Wei Yongjun <weiyongjun1(a)huawe.com>

1 0

[PATCH openEuler-1.0-LTS] power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
by Yongqiang Liu 02 Jun '23

02 Jun '23

From: Zhao Wenhui <zhaowenhui8(a)huawei.com> mainline inclusion from mainline-v6.3-rc4 commit 47c29d69212911f50bdcdd0564b5999a559010d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7781Q CVE: CVE-2023-33288 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------- In bq24190_probe, &bdi->input_current_limit_work is bound with bq24190_input_current_limit_work. When external power changed, it will call bq24190_charger_external_power_changed to start the work. If we remove the module which will call bq24190_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows: CPU0 CPUc1 |bq24190_input_current_limit_work bq24190_remove | power_supply_unregister | device_unregister | power_supply_dev_release| kfree(psy) | | | power_supply_get_property_from_supplier | //use Fix it by finishing the work before cleanup in the bq24190_remove Fixes: 97774672573a ("power_supply: Initialize changed_work before calling device_add") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Sebastian Reichel <sebastian.reichel(a)collabora.com> Conflicts: drivers/power/supply/bq24190_charger.c Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: Chen Hui <judy.chenhui(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/power/supply/bq24190_charger.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c index b58df04d03b3..760feee2cad9 100644 --- a/drivers/power/supply/bq24190_charger.c +++ b/drivers/power/supply/bq24190_charger.c @@ -1821,6 +1821,7 @@ static int bq24190_remove(struct i2c_client *client) struct bq24190_dev_info *bdi = i2c_get_clientdata(client); int error; + cancel_delayed_work_sync(&bdi->input_current_limit_work); error = pm_runtime_get_sync(bdi->dev); if (error < 0) { dev_warn(bdi->dev, "pm_runtime_get failed: %i\n", error); -- 2.25.1

1 0

[PATCH OLK-5.10] sched: fix performance degradation on lmbench
by Hui Tang 01 Jun '23

01 Jun '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7A718 -------------------------------- There are worse performance with the 'Fixes' when running "./lat_ctx -P $SYNC_MAX -s 64 16". The 'Fixes' which allocates memory for p->prefer_cpus even if "prefer_cpus" not be set. Before the 'Fixes', only test "p->prefer_cpus", after, add test "!cpumask_empty(p->prefer_cpus)" which causing performance degradation. select_task_rq_fair ->set_task_select_cpus ->prefer_cpus_valid ---- test cpumask_empty(p->prefer_cpus) Fixes: ebeb84ad373d ("cpuset: Introduce new interface for scheduler ...") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- fs/proc/base.c | 6 ++++++ include/linux/sched.h | 1 + kernel/cgroup/cpuset.c | 3 +++ kernel/sched/fair.c | 24 ++++++++++++++++++++++++ 4 files changed, 34 insertions(+) diff --git a/fs/proc/base.c b/fs/proc/base.c index 5836b4b25052..22c65289128e 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3298,6 +3298,12 @@ static ssize_t preferred_cpuset_write(struct file *file, const char __user *buf, if (retval < 0) goto out_free_cpumask; + if (!cpumask_empty(new_mask)) { + cpus_read_lock(); + dynamic_affinity_enable(); + cpus_read_unlock(); + } + retval = count; out_free_cpumask: diff --git a/include/linux/sched.h b/include/linux/sched.h index 3b8f72bf0c6b..3aae225f98a7 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2227,6 +2227,7 @@ int set_prefer_cpus_ptr(struct task_struct *p, const struct cpumask *new_mask); int sched_prefer_cpus_fork(struct task_struct *p, struct cpumask *mask); void sched_prefer_cpus_free(struct task_struct *p); +void dynamic_affinity_enable(void); #endif #ifdef CONFIG_BPF_SCHED diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 2529a807599b..90de01cc6827 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -734,6 +734,9 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, update_tasks_prefer_cpumask(trialcs); + if (!cpumask_empty(trialcs->prefer_cpus)) + dynamic_affinity_enable(); + spin_lock_irq(&callback_lock); cpumask_copy(cs->prefer_cpus, trialcs->prefer_cpus); spin_unlock_irq(&callback_lock); diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index c7b560ffb75e..ff209d25c21c 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7067,6 +7067,27 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu) } #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + +#ifdef CONFIG_JUMP_LABEL +static DEFINE_STATIC_KEY_FALSE(__dynamic_affinity_used); + +static inline bool dynamic_affinity_used(void) +{ + return static_branch_unlikely(&__dynamic_affinity_used); +} + +void dynamic_affinity_enable(void) +{ + static_branch_enable_cpuslocked(&__dynamic_affinity_used); +} + +#else /* CONFIG_JUMP_LABEL */ +static bool dynamic_affinity_used(void) +{ + return true; +} +#endif + /* * Low utilization threshold for CPU * @@ -7076,6 +7097,9 @@ int sysctl_sched_util_low_pct = 85; static inline bool prefer_cpus_valid(struct task_struct *p) { + if (!dynamic_affinity_used()) + return false; + return p->prefer_cpus && !cpumask_empty(p->prefer_cpus) && !cpumask_equal(p->prefer_cpus, p->cpus_ptr) && -- 2.17.1

2 1

[OLK-5.10 v2 0/7] A group of bugfixes for openeuler
by Chengchang Tang 01 Jun '23

01 Jun '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> Chengchang Tang (2): RDMA/hns: fix iommu_map_sg() failed when MR bigger than 4G RDMA/hns: Fix sleeping in atomic context during DCA unloading Junxian Huang (5): RDMA/hns: Remove VF extend configuration RDMA/hns: Fix a missing check of atomic wr length RDMA/hns: Fix incorrect post-send with direct wqe of wr-list in kernel space RDMA/hns: Fix inaccurate error label name in init instance RDMA/hns: Fix a missing kfree() to hr_dev->priv drivers/infiniband/hw/hns/hns_roce_dca.c | 2 - drivers/infiniband/hw/hns/hns_roce_device.h | 3 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 115 ++++++-------------- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 10 -- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- 5 files changed, 34 insertions(+), 98 deletions(-) -- 2.30.0

1 7

[PATCH openEuler-1.0-LTS] net: sched: fix NULL pointer dereference in mq_attach
by Yongqiang Liu 01 Jun '23

01 Jun '23

From: Zhengchao Shao <shaozhengchao(a)huawei.com> mainline inclusion from mainline-v6.4-rc5 commit 36eec020fab668719b541f34d97f44e232ffa165 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I79V6E CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When use the following command to test: 1)ip link add bond0 type bond 2)ip link set bond0 up 3)tc qdisc add dev bond0 root handle ffff: mq 4)tc qdisc replace dev bond0 parent ffff:fff1 handle ffff: mq The kernel reports NULL pointer dereference issue. The stack information is as follows: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mq_attach+0x44/0xa0 lr : qdisc_graft+0x20c/0x5cc sp : ffff80000e2236a0 x29: ffff80000e2236a0 x28: ffff0000c0e59d80 x27: ffff0000c0be19c0 x26: ffff0000cae3e800 x25: 0000000000000010 x24: 00000000fffffff1 x23: 0000000000000000 x22: ffff0000cae3e800 x21: ffff0000c9df4000 x20: ffff0000c9df4000 x19: 0000000000000000 x18: ffff80000a934000 x17: ffff8000f5b56000 x16: ffff80000bb08000 x15: 0000000000000000 x14: 0000000000000000 x13: 6b6b6b6b6b6b6b6b x12: 6b6b6b6b00000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff0000c0be0730 x7 : bbbbbbbbbbbbbbbb x6 : 0000000000000008 x5 : ffff0000cae3e864 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000001 x1 : ffff8000090bc23c x0 : 0000000000000000 Call trace: mq_attach+0x44/0xa0 qdisc_graft+0x20c/0x5cc tc_modify_qdisc+0x1c4/0x664 rtnetlink_rcv_msg+0x354/0x440 netlink_rcv_skb+0x64/0x144 rtnetlink_rcv+0x28/0x34 netlink_unicast+0x1e8/0x2a4 netlink_sendmsg+0x308/0x4a0 sock_sendmsg+0x64/0xac ____sys_sendmsg+0x29c/0x358 ___sys_sendmsg+0x90/0xd0 __sys_sendmsg+0x7c/0xd0 __arm64_sys_sendmsg+0x2c/0x38 invoke_syscall+0x54/0x114 el0_svc_common.constprop.1+0x90/0x174 do_el0_svc+0x3c/0xb0 el0_svc+0x24/0xec el0t_64_sync_handler+0x90/0xb4 el0t_64_sync+0x174/0x178 This is because when mq is added for the first time, qdiscs in mq is set to NULL in mq_attach(). Therefore, when replacing mq after adding mq, we need to initialize qdiscs in the mq before continuing to graft. Otherwise, it will couse NULL pointer dereference issue in mq_attach(). And the same issue will occur in the attach functions of mqprio, taprio and htb. ffff:fff1 means that the repalce qdisc is ingress. Ingress does not allow any qdisc to be attached. Therefore, ffff:fff1 is incorrectly used, and the command should be dropped. Fixes: 6ec1c69a8f64 ("net_sched: add classful multiqueue dummy scheduler") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Tested-by: Peilin Ye <peilin.ye(a)bytedance.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://lore.kernel.org/r/20230527093747.3583502-1-shaozhengchao@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/sched/sch_api.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index c927d511bb65..448bfcdeab25 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -1514,6 +1514,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, NL_SET_ERR_MSG(extack, "Qdisc parent/child loop detected"); return -ELOOP; } + if (clid == TC_H_INGRESS) { + NL_SET_ERR_MSG(extack, "Ingress cannot graft directly"); + return -EINVAL; + } qdisc_refcount_inc(q); goto graft; } else { -- 2.25.1

1 0

[PATCH OLK-5.10] sched: fix performance degradation on lmbench
by Hui Tang 01 Jun '23

01 Jun '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7A718 -------------------------------- There are worse performance with the 'Fixes' when running "./lat_ctx -P $SYNC_MAX -s 64 16". The 'Fixes' which allocates memory for p->prefer_cpus even if "prefer_cpus" not be set. Before the 'Fixes', only test "p->prefer_cpus", after, add test "!cpumask_empty(p->prefer_cpus)" which causing performance degradation. select_task_rq_fair ->set_task_select_cpus ->prefer_cpus_valid ---- test cpumask_empty(p->prefer_cpus) Fixes: b48594bf6206 ("[Huawei] sched: Fix hardlockup on 'set_prefer_cpus_ptr'") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- fs/proc/base.c | 3 +++ include/linux/sched.h | 1 + kernel/cgroup/cpuset.c | 3 +++ kernel/sched/fair.c | 24 ++++++++++++++++++++++++ 4 files changed, 31 insertions(+) diff --git a/fs/proc/base.c b/fs/proc/base.c index 5836b4b25052..03320373207f 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3298,6 +3298,9 @@ static ssize_t preferred_cpuset_write(struct file *file, const char __user *buf, if (retval < 0) goto out_free_cpumask; + if (!cpumask_empty(new_mask)) + dynamic_affinity_enable(); + retval = count; out_free_cpumask: diff --git a/include/linux/sched.h b/include/linux/sched.h index 3b8f72bf0c6b..3aae225f98a7 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2227,6 +2227,7 @@ int set_prefer_cpus_ptr(struct task_struct *p, const struct cpumask *new_mask); int sched_prefer_cpus_fork(struct task_struct *p, struct cpumask *mask); void sched_prefer_cpus_free(struct task_struct *p); +void dynamic_affinity_enable(void); #endif #ifdef CONFIG_BPF_SCHED diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 2529a807599b..90de01cc6827 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -734,6 +734,9 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, update_tasks_prefer_cpumask(trialcs); + if (!cpumask_empty(trialcs->prefer_cpus)) + dynamic_affinity_enable(); + spin_lock_irq(&callback_lock); cpumask_copy(cs->prefer_cpus, trialcs->prefer_cpus); spin_unlock_irq(&callback_lock); diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index c7b560ffb75e..34b344557e38 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7067,6 +7067,27 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu) } #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + +#ifdef CONFIG_JUMP_LABEL +static DEFINE_STATIC_KEY_FALSE(__dynamic_affinity_used); + +static inline bool dynamic_affinity_used(void) +{ + return static_branch_unlikely(&__dynamic_affinity_used); +} + +void dynamic_affinity_enable(void) +{ + static_branch_enable(&__dynamic_affinity_used); +} + +#else /* CONFIG_JUMP_LABEL */ +static bool dynamic_affinity_used(void) +{ + return true; +} +#endif + /* * Low utilization threshold for CPU * @@ -7076,6 +7097,9 @@ int sysctl_sched_util_low_pct = 85; static inline bool prefer_cpus_valid(struct task_struct *p) { + if (!dynamic_affinity_used()) + return false; + return p->prefer_cpus && !cpumask_empty(p->prefer_cpus) && !cpumask_equal(p->prefer_cpus, p->cpus_ptr) && -- 2.17.1

2 1

[PATCH OLK-5.10] sched: fix performance degradation on lmbench
by Hui Tang 01 Jun '23

01 Jun '23

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7A718 -------------------------------- There are worse performance with the 'Fixes' when running "./lat_ctx -P $SYNC_MAX -s 64 16". The 'Fixes' which allocates memory for p->prefer_cpus even if "prefer_cpus" not be set. Before the 'Fixes', only test "p->prefer_cpus", after, add test "!cpumask_empty(p->prefer_cpus)" which causing performance degradation. select_task_rq_fair ->set_task_select_cpus ->prefer_cpus_valid ---- test cpumask_empty(p->prefer_cpus) Fixes: b48594bf6206 ("[Huawei] sched: Fix hardlockup on 'set_prefer_cpus_ptr'") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- fs/proc/base.c | 3 +++ include/linux/sched.h | 1 + kernel/cgroup/cpuset.c | 3 +++ kernel/sched/fair.c | 24 ++++++++++++++++++++++++ 4 files changed, 31 insertions(+) diff --git a/fs/proc/base.c b/fs/proc/base.c index 5836b4b25052..03320373207f 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3298,6 +3298,9 @@ static ssize_t preferred_cpuset_write(struct file *file, const char __user *buf, if (retval < 0) goto out_free_cpumask; + if (!cpumask_empty(new_mask)) + dynamic_affinity_enable(); + retval = count; out_free_cpumask: diff --git a/include/linux/sched.h b/include/linux/sched.h index 3b8f72bf0c6b..3aae225f98a7 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2227,6 +2227,7 @@ int set_prefer_cpus_ptr(struct task_struct *p, const struct cpumask *new_mask); int sched_prefer_cpus_fork(struct task_struct *p, struct cpumask *mask); void sched_prefer_cpus_free(struct task_struct *p); +void dynamic_affinity_enable(void); #endif #ifdef CONFIG_BPF_SCHED diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 2529a807599b..90de01cc6827 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -734,6 +734,9 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, update_tasks_prefer_cpumask(trialcs); + if (!cpumask_empty(trialcs->prefer_cpus)) + dynamic_affinity_enable(); + spin_lock_irq(&callback_lock); cpumask_copy(cs->prefer_cpus, trialcs->prefer_cpus); spin_unlock_irq(&callback_lock); diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index c7b560ffb75e..34b344557e38 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7067,6 +7067,27 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu) } #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + +#ifdef CONFIG_JUMP_LABEL +static DEFINE_STATIC_KEY_FALSE(__dynamic_affinity_used); + +static inline bool dynamic_affinity_used(void) +{ + return static_branch_unlikely(&__dynamic_affinity_used); +} + +void dynamic_affinity_enable(void) +{ + static_branch_enable(&__dynamic_affinity_used); +} + +#else /* CONFIG_JUMP_LABEL */ +static bool dynamic_affinity_used(void) +{ + return true; +} +#endif + /* * Low utilization threshold for CPU * @@ -7076,6 +7097,9 @@ int sysctl_sched_util_low_pct = 85; static inline bool prefer_cpus_valid(struct task_struct *p) { + if (!dynamic_affinity_used()) + return false; + return p->prefer_cpus && !cpumask_empty(p->prefer_cpus) && !cpumask_equal(p->prefer_cpus, p->cpus_ptr) && -- 2.17.1

2 1

[PATCH] sched: fix performance degradation on lmbench
by Hui Tang 01 Jun '23

01 Jun '23

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7A718 -------------------------------- There are worse performance with the 'Fixes' when running "./lat_ctx -P $SYNC_MAX -s 64 16". The 'Fixes' which allocates memory for p->prefer_cpus even if "prefer_cpus" not be set. Before the 'Fixes', only test "p->prefer_cpus", after, add test "!cpumask_empty(p->prefer_cpus)" which causing performance degradation. select_task_rq_fair ->set_task_select_cpus ->prefer_cpus_valid ---- test cpumask_empty(p->prefer_cpus) Fixes: b48594bf6206 ("[Huawei] sched: Fix hardlockup on 'set_prefer_cpus_ptr'") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- fs/proc/base.c | 3 +++ include/linux/sched.h | 1 + kernel/cgroup/cpuset.c | 3 +++ kernel/sched/fair.c | 24 ++++++++++++++++++++++++ 4 files changed, 31 insertions(+) diff --git a/fs/proc/base.c b/fs/proc/base.c index 5836b4b25052..03320373207f 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3298,6 +3298,9 @@ static ssize_t preferred_cpuset_write(struct file *file, const char __user *buf, if (retval < 0) goto out_free_cpumask; + if (!cpumask_empty(new_mask)) + dynamic_affinity_enable(); + retval = count; out_free_cpumask: diff --git a/include/linux/sched.h b/include/linux/sched.h index 3b8f72bf0c6b..3aae225f98a7 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2227,6 +2227,7 @@ int set_prefer_cpus_ptr(struct task_struct *p, const struct cpumask *new_mask); int sched_prefer_cpus_fork(struct task_struct *p, struct cpumask *mask); void sched_prefer_cpus_free(struct task_struct *p); +void dynamic_affinity_enable(void); #endif #ifdef CONFIG_BPF_SCHED diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 2529a807599b..90de01cc6827 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -734,6 +734,9 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, update_tasks_prefer_cpumask(trialcs); + if (!cpumask_empty(trialcs->prefer_cpus)) + dynamic_affinity_enable(); + spin_lock_irq(&callback_lock); cpumask_copy(cs->prefer_cpus, trialcs->prefer_cpus); spin_unlock_irq(&callback_lock); diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index c7b560ffb75e..34b344557e38 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7067,6 +7067,27 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu) } #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + +#ifdef CONFIG_JUMP_LABEL +static DEFINE_STATIC_KEY_FALSE(__dynamic_affinity_used); + +static inline bool dynamic_affinity_used(void) +{ + return static_branch_unlikely(&__dynamic_affinity_used); +} + +void dynamic_affinity_enable(void) +{ + static_branch_enable(&__dynamic_affinity_used); +} + +#else /* CONFIG_JUMP_LABEL */ +static bool dynamic_affinity_used(void) +{ + return true; +} +#endif + /* * Low utilization threshold for CPU * @@ -7076,6 +7097,9 @@ int sysctl_sched_util_low_pct = 85; static inline bool prefer_cpus_valid(struct task_struct *p) { + if (!dynamic_affinity_used()) + return false; + return p->prefer_cpus && !cpumask_empty(p->prefer_cpus) && !cpumask_equal(p->prefer_cpus, p->cpus_ptr) && -- 2.17.1

1 0

[PATCH openEuler-22.03-LTS] arm64: kdump: Avoid reserving low memory repeatedly
by Li Huafei 31 May '23

31 May '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6Y5Y1 ------------------------------- We call reserve_crashkernel_high() before map_mem() to reserve high memory in advance, which in turn can avoid using page level mapping for all memory above 4G to optimize performance. And after reserve_crashkernel_high(), reserve_crashkernel_low() is also needed to reserve low memory. But when the system RAM is less than 4G, the memory reserved by reserve_crashkernel_high() is already low memory (less than 4G), reserve_crashkernel_low() may reserve low memory again and the memory it reserves may be higher than that reserved by reserve_crashkernel_high(). Looking at /proc/iomem would have: # cat /proc/iomem | grep -i crash 65400000-953fffff : Crash kernel ==> crashk_res a7800000-b77fffff : Crash kernel ==> crashk_res_low At this point kexec-tools will incorrectly use the second memory segment for the kdump kernel image load, causing the kernel load address check to fail during kexec load (see sanity_check_segment_list()). When the memory reserved by reserve_crashkernel_high() meets the low memory requirement, reserve_crashkernel_low() is no longer called to reserve memory and avoid introducing problems with duplicate reservations. Fixes: baac34dd89ca ("arm64: kdump: Use page-level mapping for the high memory of crashkernel") Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> Reviewed-by: Yang Jihong <yangjihong1(a)huawei.com> --- kernel/crash_core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/kernel/crash_core.c b/kernel/crash_core.c index 0865f816b57a..d1402585bf84 100644 --- a/kernel/crash_core.c +++ b/kernel/crash_core.c @@ -440,6 +440,13 @@ static void __init free_reserved_high_mem(void) memblock_free(crashk_res_high.start, resource_size(&crashk_res_high)); } +static bool __init within_low_mem(unsigned long long crash_base, + unsigned long long crash_size) +{ + return crash_base < CRASH_ADDR_LOW_MAX && + CRASH_ADDR_LOW_MAX - crash_base >= crash_size; +} + /* * reserve_crashkernel() - reserves memory for crash kernel * @@ -469,6 +476,8 @@ void __init reserve_crashkernel(void) if (crash_high_mem_reserved) { take_reserved_high_mem(&crash_base, &crash_size); + if (within_low_mem(crash_base, crash_size)) + goto reserve_ok; goto reserve_low; } } @@ -490,6 +499,8 @@ void __init reserve_crashkernel(void) CRASH_ALIGN); if (!crash_base && crash_high_mem_reserved) { take_reserved_high_mem(&crash_base, &crash_size); + if (within_low_mem(crash_base, crash_size)) + goto reserve_ok; goto reserve_low; } } @@ -539,6 +550,7 @@ void __init reserve_crashkernel(void) free_reserved_high_mem(); } +reserve_ok: pr_info("Reserving %ldMB of memory at %ldMB for crashkernel (System RAM: %ldMB)\n", (unsigned long)(crash_size >> 20), (unsigned long)(crash_base >> 20), -- 2.17.1

2 1

[PATCH OLK-5.10] arm64: kdump: Avoid reserving low memory repeatedly
by Li Huafei 31 May '23

31 May '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6Y5Y1 ------------------------------- We call reserve_crashkernel_high() before map_mem() to reserve high memory in advance, which in turn can avoid using page level mapping for all memory above 4G to optimize performance. And after reserve_crashkernel_high(), reserve_crashkernel_low() is also needed to reserve low memory. But when the system RAM is less than 4G, the memory reserved by reserve_crashkernel_high() is already low memory (less than 4G), reserve_crashkernel_low() may reserve low memory again and the memory it reserves may be higher than that reserved by reserve_crashkernel_high(). Looking at /proc/iomem would have: # cat /proc/iomem | grep -i crash 65400000-953fffff : Crash kernel ==> crashk_res a7800000-b77fffff : Crash kernel ==> crashk_res_low At this point kexec-tools will incorrectly use the second memory segment for the kdump kernel image load, causing the kernel load address check to fail during kexec load (see sanity_check_segment_list()). When the memory reserved by reserve_crashkernel_high() meets the low memory requirement, reserve_crashkernel_low() is no longer called to reserve memory and avoid introducing problems with duplicate reservations. Fixes: baac34dd89ca ("arm64: kdump: Use page-level mapping for the high memory of crashkernel") Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> Reviewed-by: Yang Jihong <yangjihong1(a)huawei.com> --- kernel/crash_core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/kernel/crash_core.c b/kernel/crash_core.c index 0865f816b57a..d1402585bf84 100644 --- a/kernel/crash_core.c +++ b/kernel/crash_core.c @@ -440,6 +440,13 @@ static void __init free_reserved_high_mem(void) memblock_free(crashk_res_high.start, resource_size(&crashk_res_high)); } +static bool __init within_low_mem(unsigned long long crash_base, + unsigned long long crash_size) +{ + return crash_base < CRASH_ADDR_LOW_MAX && + CRASH_ADDR_LOW_MAX - crash_base >= crash_size; +} + /* * reserve_crashkernel() - reserves memory for crash kernel * @@ -469,6 +476,8 @@ void __init reserve_crashkernel(void) if (crash_high_mem_reserved) { take_reserved_high_mem(&crash_base, &crash_size); + if (within_low_mem(crash_base, crash_size)) + goto reserve_ok; goto reserve_low; } } @@ -490,6 +499,8 @@ void __init reserve_crashkernel(void) CRASH_ALIGN); if (!crash_base && crash_high_mem_reserved) { take_reserved_high_mem(&crash_base, &crash_size); + if (within_low_mem(crash_base, crash_size)) + goto reserve_ok; goto reserve_low; } } @@ -539,6 +550,7 @@ void __init reserve_crashkernel(void) free_reserved_high_mem(); } +reserve_ok: pr_info("Reserving %ldMB of memory at %ldMB for crashkernel (System RAM: %ldMB)\n", (unsigned long)(crash_size >> 20), (unsigned long)(crash_base >> 20), -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1 00/22] Backport CVEs and bugfixes
by Jialin Zhang 31 May '23

31 May '23

Pull new CVEs: CVE-2023-22998 cgroup bugfix from Gaosheng Cui sched bugfix from Xia Fukun block bugfixes from Zhong Jinghua and Yu Kuai iomap and ext4 bugfixes from Baokun Li md bugfixes from Yu Kuai -- 2.25.1

2 23

[PATCH OLK-5.10 00/24] Backport CVEs and bugfixes
by Jialin Zhang 31 May '23

31 May '23

Pull new CVEs: CVE-2023-22998 cgroup bugfix from Gaosheng Cui sched bugfix from Xia Fukun block bugfixes from Zhong Jinghua and Yu Kuai iomap and ext4 bugfixes from Baokun Li md and eulerfs bugfixes from Yu Kuai -- 2.25.1

2 25

[PATCH openEuler-22.03-LTS 00/22] Backport CVEs and bugfixes
by Jialin Zhang 31 May '23

31 May '23

Pull new CVEs: CVE-2023-22998 cgroup bugfix from Gaosheng Cui sched bugfix from Xia Fukun block bugfixes from Zhong Jinghua and Yu Kuai iomap and ext4 bugfixes from Baokun Li md bugfixes from Yu Kuai -- 2.25.1

1 22

[PATCH openEuler-1.0-LTS 0/2] introduce smart grid scheduler
by Wang ShaoBo 31 May '23

31 May '23

introduce smart grid scheduler Hui Tang (1): sched: introduce smart grid scheduling strategy for cfs scheduler Wang ShaoBo (1): sched: smart grid: init sched_grid_qos structure on QOS purpose fs/proc/array.c | 13 + fs/proc/stat.c | 4 + include/linux/sched.h | 11 + include/linux/sched/cputime.h | 3 + include/linux/sched/grid_qos.h | 77 ++++++ include/linux/sched/sysctl.h | 8 + init/Kconfig | 10 + kernel/fork.c | 9 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 178 +++++++++++- kernel/sched/fair.c | 491 ++++++++++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/power.c | 8 + kernel/sched/grid/qos.c | 46 +++ kernel/sched/grid/stat.c | 11 + kernel/sched/sched.h | 39 +++ kernel/sched/topology.c | 3 + kernel/sysctl.c | 27 ++ mm/mempolicy.c | 25 ++ 19 files changed, 958 insertions(+), 8 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.25.1

1 2

openEuler Kernel SIG 双周例会
by openEuler conference 31 May '23

31 May '23

您好！ Kernel SIG 邀请您参加 2023-06-02 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG 双周例会会议内容： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/89684516659?pwd=QWwyVURRUlhpVjY1RmhTVFFqeit3Zz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-06-02 14:00, The subject of the conference is openEuler Kernel SIG 双周例会, Summary: 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/89684516659?pwd=QWwyVURRUlhpVjY1RmhTVFFqeit3Zz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH] hikptool: delete redundant copyright notices
by veega 30 May '23

30 May '23

Delete redundant copyright notices in hikp_ub_link.h Signed-off-by: veega <zhuweijia(a)huawei.com> --- net/ub/ub_link/hikp_ub_link.h | 13 ------------- tool_lib/tool_lib.h | 2 +- 2 files changed, 1 insertion(+), 14 deletions(-) diff --git a/net/ub/ub_link/hikp_ub_link.h b/net/ub/ub_link/hikp_ub_link.h index 14ee912..7c71cb2 100644 --- a/net/ub/ub_link/hikp_ub_link.h +++ b/net/ub/ub_link/hikp_ub_link.h @@ -11,19 +11,6 @@ * See the Mulan PSL v2 for more details. */ -/* - * Copyright (c) 2023 Hisilicon Technologies Co., Ltd. - * Hikptool is licensed under Mulan PSL v2. - * You can use this software according to the terms and conditions of the Mulan PSL v2. - * You may obtain a copy of Mulan PSL v2 at: - * http://license.coscl.org.cn/MulanPSL2 - * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, - * EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, - * MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE. - * - * See the Mulan PSL v2 for more details. - */ - #ifndef HIKP_UB_LINK_H #define HIKP_UB_LINK_H diff --git a/tool_lib/tool_lib.h b/tool_lib/tool_lib.h index 9766a7e..6548b57 100644 --- a/tool_lib/tool_lib.h +++ b/tool_lib/tool_lib.h @@ -18,7 +18,7 @@ #define TOOL_NAME "hikptool" -#define TOOL_VER "1.0.15" +#define TOOL_VER "1.0.16" #define HI_GET_BITFIELD(value, start, mask) (((value) >> (start)) & (mask)) #define HI_SET_FIELD(origin, shift, val) ((origin) |= (val) << (shift)) -- 2.36.1.windows.1

1 0

[PATCH 10/15] Complete the developing of hikptool ub_bp function
by veega 30 May '23

30 May '23

From: veega2022 <zhuweijia(a)huawei.com> The hikptool ub_bp command is submitted for the first time. This command can be used to query the back pressure status of the VL in the UB-N. Signed-off-by: Jianqiang Li <lijianqiang16(a)huawei.com> --- net/ub/ub_bp/hikp_ub_bp.c | 102 ++++++++++++++++++++++++++++++++++++++ net/ub/ub_bp/hikp_ub_bp.h | 39 +++++++++++++++ 2 files changed, 141 insertions(+) create mode 100644 net/ub/ub_bp/hikp_ub_bp.c create mode 100644 net/ub/ub_bp/hikp_ub_bp.h diff --git a/net/ub/ub_bp/hikp_ub_bp.c b/net/ub/ub_bp/hikp_ub_bp.c new file mode 100644 index 0000000..70a9a4b --- /dev/null +++ b/net/ub/ub_bp/hikp_ub_bp.c @@ -0,0 +1,102 @@ +/* + * Copyright (c) 2023 Hisilicon Technologies Co., Ltd. + * Hikptool is licensed under Mulan PSL v2. + * You can use this software according to the terms and conditions of the Mulan PSL v2. + * You may obtain a copy of Mulan PSL v2 at: + * http://license.coscl.org.cn/MulanPSL2 + * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, + * EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, + * MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE. + * + * See the Mulan PSL v2 for more details. + */ + +#include "hikp_ub_bp.h" + +static struct ub_bp_param g_ub_bp_param = { 0 }; + +static int hikp_ub_bp_help(struct major_cmd_ctrl *self, const char *argv) +{ + printf("\n Usage: %s %s\n", self->cmd_ptr->name, "-i <interface>\n"); + printf("\n %s\n", self->cmd_ptr->help_info); + printf(" Options:\n\n"); + printf(" %s, %-25s %s\n", "-h", "--help", "display this help and exit"); + printf(" %s, %-25s %s\n", "-i", "--interface=<interface>", + "device target or bdf id, e.g. ubn0 or 0000:35:00.0"); + printf("\n"); + return 0; +} + +static int hikp_ub_bp_target(struct major_cmd_ctrl *self, const char *argv) +{ + self->err_no = tool_check_and_get_valid_bdf_id(argv, &(g_ub_bp_param.target)); + if (self->err_no) { + snprintf(self->err_str, sizeof(self->err_str), "Unknown device %s.", argv); + return self->err_no; + } + return 0; +} + +static void hikp_ub_bp_info_show(const struct ub_bp_rsp *info) +{ + int bp_val_offset; + + printf("%-28s : %u\n", "mac id", info->mac_id); + printf("%-28s : ", "back pressure status"); + + for (bp_val_offset = MAX_VL_NUM; bp_val_offset >= 0; bp_val_offset--) { + printf("%d", HI_GETBIT(info->bp_val, bp_val_offset) ? 1 : 0); + } + printf("\n"); +} + + +static int hikp_ub_query_bp(const struct bdf_t *bdf) +{ + struct hikp_cmd_header header = { 0 }; + struct ub_bp_req_para req = { 0 }; + struct hikp_cmd_ret *cmd_ret; + struct ub_bp_rsp *rsp; + + req.bdf = *bdf; + hikp_cmd_init(&header, UB_MOD, GET_UB_BP_INFO_CMD, UB_BP_INFO_DUMP); + cmd_ret = hikp_cmd_alloc(&header, &req, sizeof(req)); + if (cmd_ret == NULL || cmd_ret->status != 0) { + free(cmd_ret); + cmd_ret = NULL; + return -EIO; + } + + rsp = (struct ub_bp_rsp *)cmd_ret->rsp_data; + hikp_ub_bp_info_show(rsp); + + free(cmd_ret); + cmd_ret = NULL; + return 0; +} + +static void hikp_ub_bp_cmd_execute(struct major_cmd_ctrl *self) +{ + struct bdf_t *bdf = &g_ub_bp_param.target.bdf; + int ret; + + ret = hikp_ub_query_bp(bdf); + if (ret != 0) { + snprintf(self->err_str, sizeof(self->err_str), "fail to get ub bp info."); + self->err_no = ret; + return; + } +} + +static void cmd_ub_bp_init(void) +{ + struct major_cmd_ctrl *major_cmd = get_major_cmd(); + + major_cmd->option_count = 0; + major_cmd->execute = hikp_ub_bp_cmd_execute; + + cmd_option_register("-h", "--help", false, hikp_ub_bp_help); + cmd_option_register("-i", "--interface", true, hikp_ub_bp_target); +} + +HIKP_CMD_DECLARE("ub_bp", "get ub bp information", cmd_ub_bp_init); diff --git a/net/ub/ub_bp/hikp_ub_bp.h b/net/ub/ub_bp/hikp_ub_bp.h new file mode 100644 index 0000000..0bd4740 --- /dev/null +++ b/net/ub/ub_bp/hikp_ub_bp.h @@ -0,0 +1,39 @@ +/* + * Copyright (c) 2023 Hisilicon Technologies Co., Ltd. + * Hikptool is licensed under Mulan PSL v2. + * You can use this software according to the terms and conditions of the Mulan PSL v2. + * You may obtain a copy of Mulan PSL v2 at: + * http://license.coscl.org.cn/MulanPSL2 + * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, + * EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, + * MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE. + * + * See the Mulan PSL v2 for more details. + */ + +#ifndef HIKP_UB_BP_H +#define HIKP_UB_BP_H + +#include "hikp_net_lib.h" + +#define MAX_VL_NUM 17 + +enum ub_bp_sub_cmd_type { + UB_BP_INFO_DUMP = 0, +}; + +struct ub_bp_param { + struct tool_target target; +}; + +struct ub_bp_req_para { + struct bdf_t bdf; +}; + +struct ub_bp_rsp { + uint8_t mac_id; + uint8_t rsvd[3]; + uint32_t bp_val; +}; + +#endif /* HIKP_UB_BP_H */ -- 2.36.1.windows.1

1 0

[PATCH openEuler-1.0-LTS] x86/pm: Fix false positive kmemleak report in msr_build_context()
by Yongqiang Liu 30 May '23

30 May '23

From: Matthieu Baerts <matthieu.baerts(a)tessares.net> mainline inclusion from mainline-v5.19-rc1 commit b0b592cf08367719e1d1ef07c9f136e8c17f7ec3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I78RHX CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since e2a1256b17b1 ("x86/speculation: Restore speculation related MSRs during S3 resume") kmemleak reports this issue: unreferenced object 0xffff888009cedc00 (size 256): comm "swapper/0", pid 1, jiffies 4294693823 (age 73.764s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 ........H....... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: msr_build_context (include/linux/slab.h:621) pm_check_save_msr (arch/x86/power/cpu.c:520) do_one_initcall (init/main.c:1298) kernel_init_freeable (init/main.c:1370) kernel_init (init/main.c:1504) ret_from_fork (arch/x86/entry/entry_64.S:304) Reproducer: - boot the VM with a debug kernel config (see https://github.com/multipath-tcp/mptcp_net-next/issues/268) - wait ~1 minute - start a kmemleak scan The root cause here is alignment within the packed struct saved_context (from suspend_64.h). Kmemleak only searches for pointers that are aligned (see how pointers are scanned in kmemleak.c), but pahole shows that the saved_msrs struct member and all members after it in the structure are unaligned: struct saved_context { struct pt_regs regs; /* 0 168 */ /* --- cacheline 2 boundary (128 bytes) was 40 bytes ago --- */ u16 ds; /* 168 2 */ ... u64 misc_enable; /* 232 8 */ bool misc_enable_saved; /* 240 1 */ /* Note below odd offset values for the remainder of this struct */ struct saved_msrs saved_msrs; /* 241 16 */ /* --- cacheline 4 boundary (256 bytes) was 1 bytes ago --- */ long unsigned int efer; /* 257 8 */ u16 gdt_pad; /* 265 2 */ struct desc_ptr gdt_desc; /* 267 10 */ u16 idt_pad; /* 277 2 */ struct desc_ptr idt; /* 279 10 */ u16 ldt; /* 289 2 */ u16 tss; /* 291 2 */ long unsigned int tr; /* 293 8 */ long unsigned int safety; /* 301 8 */ long unsigned int return_address; /* 309 8 */ /* size: 317, cachelines: 5, members: 25 */ /* last cacheline: 61 bytes */ } __attribute__((__packed__)); Move misc_enable_saved to the end of the struct declaration so that saved_msrs fits in before the cacheline 4 boundary. The comment above the saved_context declaration says to fix wakeup_64.S file and __save/__restore_processor_state() if the struct is modified: it looks like all the accesses in wakeup_64.S are done through offsets which are computed at build-time. Update that comment accordingly. At the end, the false positive kmemleak report is due to a limitation from kmemleak but it is always good to avoid unaligned members for optimisation purposes. Please note that it looks like this issue is not new, e.g. https://lore.kernel.org/all/9f1bb619-c4ee-21c4-a251-870bd4db04fa@lwfinger.n… https://lore.kernel.org/all/94e48fcd-1dbd-ebd2-4c91-f39941735909@molgen.mpg… [ bp: Massage + cleanup commit message. ] Fixes: 7a9c2dd08ead ("x86/pm: Introduce quirk framework to save/restore extra MSR registers around suspend/resume") Suggested-by: Mat Martineau <mathew.j.martineau(a)linux.intel.com> Signed-off-by: Matthieu Baerts <matthieu.baerts(a)tessares.net> Signed-off-by: Borislav Petkov <bp(a)suse.de> Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://lore.kernel.org/r/20220426202138.498310-1-matthieu.baerts@tessares.… Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/x86/include/asm/suspend_32.h | 2 +- arch/x86/include/asm/suspend_64.h | 12 ++++++++---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/suspend_32.h b/arch/x86/include/asm/suspend_32.h index 8be6afb58471..32662cbaa27e 100644 --- a/arch/x86/include/asm/suspend_32.h +++ b/arch/x86/include/asm/suspend_32.h @@ -21,7 +21,6 @@ struct saved_context { #endif unsigned long cr0, cr2, cr3, cr4; u64 misc_enable; - bool misc_enable_saved; struct saved_msrs saved_msrs; struct desc_ptr gdt_desc; struct desc_ptr idt; @@ -30,6 +29,7 @@ struct saved_context { unsigned long tr; unsigned long safety; unsigned long return_address; + bool misc_enable_saved; } __attribute__((packed)); #endif /* _ASM_X86_SUSPEND_32_H */ diff --git a/arch/x86/include/asm/suspend_64.h b/arch/x86/include/asm/suspend_64.h index a7af9f53c0cb..b2861400c6a2 100644 --- a/arch/x86/include/asm/suspend_64.h +++ b/arch/x86/include/asm/suspend_64.h @@ -14,9 +14,13 @@ * Image of the saved processor state, used by the low level ACPI suspend to * RAM code and by the low level hibernation code. * - * If you modify it, fix arch/x86/kernel/acpi/wakeup_64.S and make sure that - * __save/__restore_processor_state(), defined in arch/x86/kernel/suspend_64.c, - * still work as required. + * If you modify it, check how it is used in arch/x86/kernel/acpi/wakeup_64.S + * and make sure that __save/__restore_processor_state(), defined in + * arch/x86/power/cpu.c, still work as required. + * + * Because the structure is packed, make sure to avoid unaligned members. For + * optimisation purposes but also because tools like kmemleak only search for + * pointers that are aligned. */ struct saved_context { struct pt_regs regs; @@ -36,7 +40,6 @@ struct saved_context { unsigned long cr0, cr2, cr3, cr4, cr8; u64 misc_enable; - bool misc_enable_saved; struct saved_msrs saved_msrs; unsigned long efer; u16 gdt_pad; /* Unused */ @@ -48,6 +51,7 @@ struct saved_context { unsigned long tr; unsigned long safety; unsigned long return_address; + bool misc_enable_saved; } __attribute__((packed)); #define loaddebug(thread,register) \ -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] drm: Fix use-after-free read in drm_getunique()
by Yongqiang Liu 30 May '23

30 May '23

From: Desmond Cheong Zhi Xi <desmondcheongzx(a)gmail.com> stable inclusion from stable-v4.19.195 commit 7d233ba700ceb593905ea82b42dadb4ec8ef85e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I52XND CVE: CVE-2022-1280 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b436acd1cf7fac0ba987abd22955d98025c80c2b upstream. There is a time-of-check-to-time-of-use error in drm_getunique() due to retrieving file_priv->master prior to locking the device's master mutex. An example can be seen in the crash report of the use-after-free error found by Syzbot: https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f8… In the report, the master pointer was used after being freed. This is because another process had acquired the device's master mutex in drm_setmaster_ioctl(), then overwrote fpriv->master in drm_new_set_master(). The old value of fpriv->master was subsequently freed before the mutex was unlocked. To fix this, we lock the device's master mutex before retrieving the pointer from from fpriv->master. This patch passes the Syzbot reproducer test. Reported-by: syzbot+c3a706cec1ea99e1c693(a)syzkaller.appspotmail.com Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20210608110436.239583-1-desmo… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/gpu/drm/drm_ioctl.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c index 3fe512b8a488..d15d95e3bbf4 100644 --- a/drivers/gpu/drm/drm_ioctl.c +++ b/drivers/gpu/drm/drm_ioctl.c @@ -112,17 +112,18 @@ int drm_getunique(struct drm_device *dev, void *data, struct drm_file *file_priv) { struct drm_unique *u = data; - struct drm_master *master = file_priv->master; + struct drm_master *master; - mutex_lock(&master->dev->master_mutex); + mutex_lock(&dev->master_mutex); + master = file_priv->master; if (u->unique_len >= master->unique_len) { if (copy_to_user(u->unique, master->unique, master->unique_len)) { - mutex_unlock(&master->dev->master_mutex); + mutex_unlock(&dev->master_mutex); return -EFAULT; } } u->unique_len = master->unique_len; - mutex_unlock(&master->dev->master_mutex); + mutex_unlock(&dev->master_mutex); return 0; } -- 2.25.1

1 1